@desplega.ai/agent-swarm 1.152.2 → 1.154.0

package/dist/cli-yn0a417a.js

@@ -0,0 +1,4069 @@
+import {
+  require_checksum,
+  require_client,
+  require_client1 as require_client2,
+  require_config,
+  require_dist_cjs,
+  require_dist_cjs1 as require_dist_cjs2,
+  require_dist_cjs2 as require_dist_cjs3,
+  require_endpoints,
+  require_httpAuthSchemes,
+  require_protocols,
+  require_protocols1 as require_protocols2,
+  require_retry,
+  require_schema,
+  require_serde,
+  require_sso_oidc
+} from "./cli-cgj4hc12.js";
+import {
+  __commonJS,
+  __require
+} from "./cli-bc05qbss.js";
+
+// node_modules/@aws-sdk/credential-provider-env/dist-cjs/index.js
+var require_dist_cjs4 = __commonJS(function(exports) {
+  var { setCredentialFeature } = require_client2();
+  var { CredentialsProviderError } = require_config();
+  var ENV_KEY = "AWS_ACCESS_KEY_ID";
+  var ENV_SECRET = "AWS_SECRET_ACCESS_KEY";
+  var ENV_SESSION = "AWS_SESSION_TOKEN";
+  var ENV_EXPIRATION = "AWS_CREDENTIAL_EXPIRATION";
+  var ENV_CREDENTIAL_SCOPE = "AWS_CREDENTIAL_SCOPE";
+  var ENV_ACCOUNT_ID = "AWS_ACCOUNT_ID";
+  var fromEnv = (init) => async () => {
+    init?.logger?.debug("@aws-sdk/credential-provider-env - fromEnv");
+    const accessKeyId = process.env[ENV_KEY];
+    const secretAccessKey = process.env[ENV_SECRET];
+    const sessionToken = process.env[ENV_SESSION];
+    const expiry = process.env[ENV_EXPIRATION];
+    const credentialScope = process.env[ENV_CREDENTIAL_SCOPE];
+    const accountId = process.env[ENV_ACCOUNT_ID];
+    if (accessKeyId && secretAccessKey) {
+      const credentials = {
+        accessKeyId,
+        secretAccessKey,
+        ...sessionToken && { sessionToken },
+        ...expiry && { expiration: new Date(expiry) },
+        ...credentialScope && { credentialScope },
+        ...accountId && { accountId }
+      };
+      setCredentialFeature(credentials, "CREDENTIALS_ENV_VARS", "g");
+      return credentials;
+    }
+    throw new CredentialsProviderError("Unable to find environment variable credentials.", { logger: init?.logger });
+  };
+  exports.ENV_ACCOUNT_ID = ENV_ACCOUNT_ID;
+  exports.ENV_CREDENTIAL_SCOPE = ENV_CREDENTIAL_SCOPE;
+  exports.ENV_EXPIRATION = ENV_EXPIRATION;
+  exports.ENV_KEY = ENV_KEY;
+  exports.ENV_SECRET = ENV_SECRET;
+  exports.ENV_SESSION = ENV_SESSION;
+  exports.fromEnv = fromEnv;
+});
+
+// node_modules/@smithy/credential-provider-imds/dist-cjs/index.js
+var require_dist_cjs5 = __commonJS(function(exports) {
+  var { ProviderError, CredentialsProviderError, loadConfig } = require_config();
+  var node_http = __require("node:http");
+  var { parseUrl } = require_protocols();
+  var isImdsCredentials = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.AccessKeyId === "string" && typeof arg.SecretAccessKey === "string" && typeof arg.Token === "string" && typeof arg.Expiration === "string";
+  var fromImdsCredentials = (creds) => ({
+    accessKeyId: creds.AccessKeyId,
+    secretAccessKey: creds.SecretAccessKey,
+    sessionToken: creds.Token,
+    expiration: new Date(creds.Expiration),
+    ...creds.AccountId && { accountId: creds.AccountId }
+  });
+  var DEFAULT_TIMEOUT = 1000;
+  var DEFAULT_MAX_RETRIES = 0;
+  var providerConfigFromInit = ({ maxRetries = DEFAULT_MAX_RETRIES, timeout = DEFAULT_TIMEOUT }) => ({ maxRetries, timeout });
+  function httpRequest(options) {
+    return new Promise((resolve, reject) => {
+      const req = node_http.request({
+        method: "GET",
+        ...options,
+        hostname: options.hostname?.replace(/^\[(.+)\]$/, "$1")
+      });
+      req.on("error", (err) => {
+        reject(Object.assign(new ProviderError("Unable to connect to instance metadata service"), err));
+        req.destroy();
+      });
+      req.on("timeout", () => {
+        reject(new ProviderError("TimeoutError from instance metadata service"));
+        req.destroy();
+      });
+      req.on("response", (res) => {
+        const { statusCode = 400 } = res;
+        if (statusCode < 200 || 300 <= statusCode) {
+          reject(Object.assign(new ProviderError("Error response received from instance metadata service"), { statusCode }));
+          req.destroy();
+        }
+        const chunks = [];
+        res.on("data", (chunk) => {
+          chunks.push(chunk);
+        });
+        res.on("end", () => {
+          resolve(Buffer.concat(chunks));
+          req.destroy();
+        });
+      });
+      req.end();
+    });
+  }
+  var retry = (toRetry, maxRetries) => {
+    let promise = toRetry();
+    for (let i = 0;i < maxRetries; i++) {
+      promise = promise.catch(toRetry);
+    }
+    return promise;
+  };
+  var ENV_CMDS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI";
+  var ENV_CMDS_RELATIVE_URI = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI";
+  var ENV_CMDS_AUTH_TOKEN = "AWS_CONTAINER_AUTHORIZATION_TOKEN";
+  var fromContainerMetadata = (init = {}) => {
+    const { timeout, maxRetries } = providerConfigFromInit(init);
+    return () => retry(async () => {
+      const requestOptions = await getCmdsUri({ logger: init.logger });
+      const credsResponse = JSON.parse(await requestFromEcsImds(timeout, requestOptions));
+      if (!isImdsCredentials(credsResponse)) {
+        throw new CredentialsProviderError("Invalid response received from instance metadata service.", {
+          logger: init.logger
+        });
+      }
+      return fromImdsCredentials(credsResponse);
+    }, maxRetries);
+  };
+  var requestFromEcsImds = async (timeout, options) => {
+    if (process.env[ENV_CMDS_AUTH_TOKEN]) {
+      options.headers = {
+        ...options.headers,
+        Authorization: process.env[ENV_CMDS_AUTH_TOKEN]
+      };
+    }
+    const buffer = await httpRequest({
+      ...options,
+      timeout
+    });
+    return buffer.toString();
+  };
+  var CMDS_IP = "169.254.170.2";
+  var GREENGRASS_HOSTS = new Set(["localhost", "127.0.0.1"]);
+  var GREENGRASS_PROTOCOLS = new Set(["http:", "https:"]);
+  var getCmdsUri = async ({ logger }) => {
+    if (process.env[ENV_CMDS_RELATIVE_URI]) {
+      return {
+        hostname: CMDS_IP,
+        path: process.env[ENV_CMDS_RELATIVE_URI]
+      };
+    }
+    if (process.env[ENV_CMDS_FULL_URI]) {
+      let parsed;
+      try {
+        parsed = new URL(process.env[ENV_CMDS_FULL_URI]);
+      } catch {
+        throw new CredentialsProviderError(`${process.env[ENV_CMDS_FULL_URI]} is not a valid container metadata service URL`, { tryNextLink: false, logger });
+      }
+      if (!parsed.hostname || !GREENGRASS_HOSTS.has(parsed.hostname)) {
+        throw new CredentialsProviderError(`${parsed.hostname} is not a valid container metadata service hostname`, {
+          tryNextLink: false,
+          logger
+        });
+      }
+      if (!parsed.protocol || !GREENGRASS_PROTOCOLS.has(parsed.protocol)) {
+        throw new CredentialsProviderError(`${parsed.protocol} is not a valid container metadata service protocol`, {
+          tryNextLink: false,
+          logger
+        });
+      }
+      return {
+        protocol: parsed.protocol,
+        hostname: parsed.hostname,
+        path: parsed.pathname + parsed.search,
+        port: parsed.port ? parseInt(parsed.port, 10) : undefined
+      };
+    }
+    throw new CredentialsProviderError("The container metadata credential provider cannot be used unless" + ` the ${ENV_CMDS_RELATIVE_URI} or ${ENV_CMDS_FULL_URI} environment` + " variable is set", {
+      tryNextLink: false,
+      logger
+    });
+  };
+
+  class InstanceMetadataV1FallbackError extends CredentialsProviderError {
+    tryNextLink;
+    name = "InstanceMetadataV1FallbackError";
+    constructor(message, tryNextLink = true) {
+      super(message, tryNextLink);
+      this.tryNextLink = tryNextLink;
+      Object.setPrototypeOf(this, InstanceMetadataV1FallbackError.prototype);
+    }
+  }
+  var Endpoint;
+  (function(Endpoint2) {
+    Endpoint2["IPv4"] = "http://169.254.169.254";
+    Endpoint2["IPv6"] = "http://[fd00:ec2::254]";
+  })(Endpoint || (Endpoint = {}));
+  var ENV_ENDPOINT_NAME = "AWS_EC2_METADATA_SERVICE_ENDPOINT";
+  var CONFIG_ENDPOINT_NAME = "ec2_metadata_service_endpoint";
+  var ENDPOINT_CONFIG_OPTIONS = {
+    environmentVariableSelector: (env) => env[ENV_ENDPOINT_NAME],
+    configFileSelector: (profile) => profile[CONFIG_ENDPOINT_NAME],
+    default: undefined
+  };
+  var EndpointMode;
+  (function(EndpointMode2) {
+    EndpointMode2["IPv4"] = "IPv4";
+    EndpointMode2["IPv6"] = "IPv6";
+  })(EndpointMode || (EndpointMode = {}));
+  var ENV_ENDPOINT_MODE_NAME = "AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE";
+  var CONFIG_ENDPOINT_MODE_NAME = "ec2_metadata_service_endpoint_mode";
+  var ENDPOINT_MODE_CONFIG_OPTIONS = {
+    environmentVariableSelector: (env) => env[ENV_ENDPOINT_MODE_NAME],
+    configFileSelector: (profile) => profile[CONFIG_ENDPOINT_MODE_NAME],
+    default: EndpointMode.IPv4
+  };
+  var getInstanceMetadataEndpoint = async () => parseUrl(await getFromEndpointConfig() || await getFromEndpointModeConfig());
+  var getFromEndpointConfig = async () => loadConfig(ENDPOINT_CONFIG_OPTIONS)();
+  var getFromEndpointModeConfig = async () => {
+    const endpointMode = await loadConfig(ENDPOINT_MODE_CONFIG_OPTIONS)();
+    switch (endpointMode) {
+      case EndpointMode.IPv4:
+        return Endpoint.IPv4;
+      case EndpointMode.IPv6:
+        return Endpoint.IPv6;
+      default:
+        throw new Error(`Unsupported endpoint mode: ${endpointMode}.` + ` Select from ${Object.values(EndpointMode)}`);
+    }
+  };
+  var STATIC_STABILITY_REFRESH_INTERVAL_SECONDS = 5 * 60;
+  var STATIC_STABILITY_REFRESH_INTERVAL_JITTER_WINDOW_SECONDS = 5 * 60;
+  var STATIC_STABILITY_DOC_URL = "https://docs.aws.amazon.com/sdkref/latest/guide/feature-static-credentials.html";
+  var getExtendedInstanceMetadataCredentials = (credentials, logger) => {
+    const refreshInterval = STATIC_STABILITY_REFRESH_INTERVAL_SECONDS + Math.floor(Math.random() * STATIC_STABILITY_REFRESH_INTERVAL_JITTER_WINDOW_SECONDS);
+    const newExpiration = new Date(Date.now() + refreshInterval * 1000);
+    logger.warn("Attempting credential expiration extension due to a credential service availability issue. A refresh of these " + `credentials will be attempted after ${new Date(newExpiration)}.
+For more information, please visit: ` + STATIC_STABILITY_DOC_URL);
+    const originalExpiration = credentials.originalExpiration ?? credentials.expiration;
+    return {
+      ...credentials,
+      ...originalExpiration ? { originalExpiration } : {},
+      expiration: newExpiration
+    };
+  };
+  var staticStabilityProvider = (provider, options = {}) => {
+    const logger = options?.logger || console;
+    let pastCredentials;
+    return async () => {
+      let credentials;
+      try {
+        credentials = await provider();
+        if (credentials.expiration && credentials.expiration.getTime() < Date.now()) {
+          credentials = getExtendedInstanceMetadataCredentials(credentials, logger);
+        }
+      } catch (e) {
+        if (pastCredentials) {
+          logger.warn("Credential renew failed: ", e);
+          credentials = getExtendedInstanceMetadataCredentials(pastCredentials, logger);
+        } else {
+          throw e;
+        }
+      }
+      pastCredentials = credentials;
+      return credentials;
+    };
+  };
+  var IMDS_PATH = "/latest/meta-data/iam/security-credentials/";
+  var IMDS_TOKEN_PATH = "/latest/api/token";
+  var AWS_EC2_METADATA_V1_DISABLED = "AWS_EC2_METADATA_V1_DISABLED";
+  var PROFILE_AWS_EC2_METADATA_V1_DISABLED = "ec2_metadata_v1_disabled";
+  var X_AWS_EC2_METADATA_TOKEN = "x-aws-ec2-metadata-token";
+  var fromInstanceMetadata = (init = {}) => staticStabilityProvider(getInstanceMetadataProvider(init), { logger: init.logger });
+  var getInstanceMetadataProvider = (init = {}) => {
+    let disableFetchToken = false;
+    const { logger, profile } = init;
+    const { timeout, maxRetries } = providerConfigFromInit(init);
+    const getCredentials = async (maxRetries2, options) => {
+      const isImdsV1Fallback = disableFetchToken || options.headers?.[X_AWS_EC2_METADATA_TOKEN] == null;
+      if (isImdsV1Fallback) {
+        let fallbackBlockedFromProfile = false;
+        let fallbackBlockedFromProcessEnv = false;
+        const configValue = await loadConfig({
+          environmentVariableSelector: (env) => {
+            const envValue = env[AWS_EC2_METADATA_V1_DISABLED];
+            fallbackBlockedFromProcessEnv = !!envValue && envValue !== "false";
+            if (envValue === undefined) {
+              throw new CredentialsProviderError(`${AWS_EC2_METADATA_V1_DISABLED} not set in env, checking config file next.`, { logger: init.logger });
+            }
+            return fallbackBlockedFromProcessEnv;
+          },
+          configFileSelector: (profile2) => {
+            const profileValue = profile2[PROFILE_AWS_EC2_METADATA_V1_DISABLED];
+            fallbackBlockedFromProfile = !!profileValue && profileValue !== "false";
+            return fallbackBlockedFromProfile;
+          },
+          default: false
+        }, {
+          profile
+        })();
+        if (init.ec2MetadataV1Disabled || configValue) {
+          const causes = [];
+          if (init.ec2MetadataV1Disabled)
+            causes.push("credential provider initialization (runtime option ec2MetadataV1Disabled)");
+          if (fallbackBlockedFromProfile)
+            causes.push(`config file profile (${PROFILE_AWS_EC2_METADATA_V1_DISABLED})`);
+          if (fallbackBlockedFromProcessEnv)
+            causes.push(`process environment variable (${AWS_EC2_METADATA_V1_DISABLED})`);
+          throw new InstanceMetadataV1FallbackError(`AWS EC2 Metadata v1 fallback has been blocked by AWS SDK configuration in the following: [${causes.join(", ")}].`);
+        }
+      }
+      const imdsProfile = (await retry(async () => {
+        let profile2;
+        try {
+          profile2 = await getProfile(options);
+        } catch (err) {
+          if (err.statusCode === 401) {
+            disableFetchToken = false;
+          }
+          throw err;
+        }
+        return profile2;
+      }, maxRetries2)).trim();
+      return retry(async () => {
+        let creds;
+        try {
+          creds = await getCredentialsFromProfile(imdsProfile, options, init);
+        } catch (err) {
+          if (err.statusCode === 401) {
+            disableFetchToken = false;
+          }
+          throw err;
+        }
+        return creds;
+      }, maxRetries2);
+    };
+    return async () => {
+      const endpoint = await getInstanceMetadataEndpoint();
+      if (disableFetchToken) {
+        logger?.debug("AWS SDK Instance Metadata", "using v1 fallback (no token fetch)");
+        return getCredentials(maxRetries, { ...endpoint, timeout });
+      } else {
+        let token;
+        try {
+          token = (await getMetadataToken({ ...endpoint, timeout })).toString();
+        } catch (error) {
+          if (error?.statusCode === 400) {
+            throw Object.assign(error, {
+              message: "EC2 Metadata token request returned error"
+            });
+          } else if (error.message === "TimeoutError" || [403, 404, 405].includes(error.statusCode)) {
+            disableFetchToken = true;
+          }
+          logger?.debug("AWS SDK Instance Metadata", "using v1 fallback (initial)");
+          return getCredentials(maxRetries, { ...endpoint, timeout });
+        }
+        return getCredentials(maxRetries, {
+          ...endpoint,
+          headers: {
+            [X_AWS_EC2_METADATA_TOKEN]: token
+          },
+          timeout
+        });
+      }
+    };
+  };
+  var getMetadataToken = async (options) => httpRequest({
+    ...options,
+    path: IMDS_TOKEN_PATH,
+    method: "PUT",
+    headers: {
+      "x-aws-ec2-metadata-token-ttl-seconds": "21600"
+    }
+  });
+  var getProfile = async (options) => (await httpRequest({ ...options, path: IMDS_PATH })).toString();
+  var getCredentialsFromProfile = async (profile, options, init) => {
+    const credentialsResponse = JSON.parse((await httpRequest({
+      ...options,
+      path: IMDS_PATH + profile
+    })).toString());
+    if (!isImdsCredentials(credentialsResponse)) {
+      throw new CredentialsProviderError("Invalid response received from instance metadata service.", {
+        logger: init.logger
+      });
+    }
+    return fromImdsCredentials(credentialsResponse);
+  };
+  exports.DEFAULT_MAX_RETRIES = DEFAULT_MAX_RETRIES;
+  exports.DEFAULT_TIMEOUT = DEFAULT_TIMEOUT;
+  exports.ENV_CMDS_AUTH_TOKEN = ENV_CMDS_AUTH_TOKEN;
+  exports.ENV_CMDS_FULL_URI = ENV_CMDS_FULL_URI;
+  exports.ENV_CMDS_RELATIVE_URI = ENV_CMDS_RELATIVE_URI;
+  exports.Endpoint = Endpoint;
+  exports.fromContainerMetadata = fromContainerMetadata;
+  exports.fromInstanceMetadata = fromInstanceMetadata;
+  exports.getInstanceMetadataEndpoint = getInstanceMetadataEndpoint;
+  exports.httpRequest = httpRequest;
+  exports.providerConfigFromInit = providerConfigFromInit;
+});
+
+// node_modules/@aws-sdk/credential-provider-http/dist-cjs/index.js
+var require_dist_cjs6 = __commonJS(function(exports) {
+  var { setCredentialFeature } = require_client2();
+  var { CredentialsProviderError } = require_config();
+  var { NodeHttpHandler } = require_dist_cjs3();
+  var fs = __require("node:fs/promises");
+  var { HttpRequest } = require_protocols();
+  var { sdkStreamMixin, parseRfc3339DateTime } = require_serde();
+  var ECS_CONTAINER_HOST = "169.254.170.2";
+  var EKS_CONTAINER_HOST_IPv4 = "169.254.170.23";
+  var EKS_CONTAINER_HOST_IPv6 = "[fd00:ec2::23]";
+  var checkUrl = (url, logger) => {
+    if (url.protocol === "https:") {
+      return;
+    }
+    if (url.hostname === ECS_CONTAINER_HOST || url.hostname === EKS_CONTAINER_HOST_IPv4 || url.hostname === EKS_CONTAINER_HOST_IPv6) {
+      return;
+    }
+    if (url.hostname.includes("[")) {
+      if (url.hostname === "[::1]" || url.hostname === "[0000:0000:0000:0000:0000:0000:0000:0001]") {
+        return;
+      }
+    } else {
+      if (url.hostname === "localhost") {
+        return;
+      }
+      const ipComponents = url.hostname.split(".");
+      const inRange = (component) => {
+        const num = parseInt(component, 10);
+        return 0 <= num && num <= 255;
+      };
+      if (ipComponents[0] === "127" && inRange(ipComponents[1]) && inRange(ipComponents[2]) && inRange(ipComponents[3]) && ipComponents.length === 4) {
+        return;
+      }
+    }
+    throw new CredentialsProviderError(`URL not accepted. It must either be HTTPS or match one of the following:
+  - loopback CIDR 127.0.0.0/8 or [::1/128]
+  - ECS container host 169.254.170.2
+  - EKS container host 169.254.170.23 or [fd00:ec2::23]`, { logger });
+  };
+  function createGetRequest(url) {
+    return new HttpRequest({
+      protocol: url.protocol,
+      hostname: url.hostname,
+      port: Number(url.port),
+      path: url.pathname,
+      query: Array.from(url.searchParams.entries()).reduce((acc, [k, v]) => {
+        acc[k] = v;
+        return acc;
+      }, {}),
+      fragment: url.hash
+    });
+  }
+  async function getCredentials(response, logger) {
+    const stream = sdkStreamMixin(response.body);
+    const str = await stream.transformToString();
+    if (response.statusCode === 200) {
+      const parsed = JSON.parse(str);
+      if (typeof parsed.AccessKeyId !== "string" || typeof parsed.SecretAccessKey !== "string" || typeof parsed.Token !== "string" || typeof parsed.Expiration !== "string") {
+        throw new CredentialsProviderError("HTTP credential provider response not of the required format, an object matching: " + "{ AccessKeyId: string, SecretAccessKey: string, Token: string, Expiration: string(rfc3339) }", { logger });
+      }
+      return {
+        accessKeyId: parsed.AccessKeyId,
+        secretAccessKey: parsed.SecretAccessKey,
+        sessionToken: parsed.Token,
+        expiration: parseRfc3339DateTime(parsed.Expiration)
+      };
+    }
+    if (response.statusCode >= 400 && response.statusCode < 500) {
+      let parsedBody = {};
+      try {
+        parsedBody = JSON.parse(str);
+      } catch (e) {}
+      throw Object.assign(new CredentialsProviderError(`Server responded with status: ${response.statusCode}`, { logger }), {
+        Code: parsedBody.Code,
+        Message: parsedBody.Message
+      });
+    }
+    throw new CredentialsProviderError(`Server responded with status: ${response.statusCode}`, { logger });
+  }
+  var retryWrapper = (toRetry, maxRetries, delayMs) => {
+    return async () => {
+      for (let i = 0;i < maxRetries; ++i) {
+        try {
+          return await toRetry();
+        } catch (e) {
+          await new Promise((resolve) => setTimeout(resolve, delayMs));
+        }
+      }
+      return await toRetry();
+    };
+  };
+  var AWS_CONTAINER_CREDENTIALS_RELATIVE_URI = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI";
+  var DEFAULT_LINK_LOCAL_HOST = "http://169.254.170.2";
+  var AWS_CONTAINER_CREDENTIALS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI";
+  var AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE = "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE";
+  var AWS_CONTAINER_AUTHORIZATION_TOKEN = "AWS_CONTAINER_AUTHORIZATION_TOKEN";
+  var fromHttp = (options = {}) => {
+    options.logger?.debug("@aws-sdk/credential-provider-http - fromHttp");
+    let host;
+    const relative = options.awsContainerCredentialsRelativeUri ?? process.env[AWS_CONTAINER_CREDENTIALS_RELATIVE_URI];
+    const full = options.awsContainerCredentialsFullUri ?? process.env[AWS_CONTAINER_CREDENTIALS_FULL_URI];
+    const token = options.awsContainerAuthorizationToken ?? process.env[AWS_CONTAINER_AUTHORIZATION_TOKEN];
+    const tokenFile = options.awsContainerAuthorizationTokenFile ?? process.env[AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE];
+    const warn = options.logger?.constructor?.name === "NoOpLogger" || !options.logger?.warn ? console.warn : options.logger.warn.bind(options.logger);
+    if (relative && full) {
+      warn("@aws-sdk/credential-provider-http: " + "you have set both awsContainerCredentialsRelativeUri and awsContainerCredentialsFullUri.");
+      warn("awsContainerCredentialsRelativeUri will take precedence.");
+    }
+    if (token && tokenFile) {
+      warn("@aws-sdk/credential-provider-http: " + "you have set both awsContainerAuthorizationToken and awsContainerAuthorizationTokenFile.");
+      warn("awsContainerAuthorizationTokenFile will take precedence.");
+    }
+    if (relative) {
+      host = `${DEFAULT_LINK_LOCAL_HOST}${relative}`;
+    } else if (full) {
+      host = full;
+    } else {
+      throw new CredentialsProviderError(`No HTTP credential provider host provided.
+Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.`, { logger: options.logger });
+    }
+    const url = new URL(host);
+    checkUrl(url, options.logger);
+    const requestHandler = NodeHttpHandler.create({ connectionTimeout: options.timeout ?? 1000 });
+    const requestTimeout = options.timeout ?? 1000;
+    const provider = retryWrapper(async () => {
+      const request = createGetRequest(url);
+      if (tokenFile) {
+        request.headers.Authorization = validateToken((await fs.readFile(tokenFile)).toString());
+      } else if (token) {
+        request.headers.Authorization = validateToken(token);
+      }
+      try {
+        const result = await requestHandler.handle(request, { requestTimeout });
+        return getCredentials(result.response).then((creds) => setCredentialFeature(creds, "CREDENTIALS_HTTP", "z"));
+      } catch (e) {
+        throw new CredentialsProviderError(String(e), { logger: options.logger });
+      }
+    }, options.maxRetries ?? 3, options.timeout ?? 1000);
+    return async () => {
+      try {
+        return await provider();
+      } finally {
+        requestHandler.destroy?.();
+      }
+    };
+  };
+  var validateToken = (token) => {
+    if (token.includes(`\r
+`)) {
+      throw new CredentialsProviderError("Authorization token contains invalid \\r\\n sequence.");
+    }
+    return token;
+  };
+  exports.fromHttp = fromHttp;
+});
+
+// node_modules/@aws-sdk/credential-provider-sso/node_modules/@aws-sdk/token-providers/dist-cjs/index.js
+var require_dist_cjs7 = __commonJS(function(exports) {
+  var { setTokenFeature } = require_client2();
+  var { getBearerTokenEnvKey } = require_httpAuthSchemes();
+  var { TokenProviderError, getSSOTokenFilepath, parseKnownFiles, getProfileName, loadSsoSessionData, getSSOTokenFromFile, memoize, chain } = require_config();
+  var { promises } = __require("node:fs");
+  var fromEnvSigningName = ({ logger, signingName } = {}) => async () => {
+    logger?.debug?.("@aws-sdk/token-providers - fromEnvSigningName");
+    if (!signingName) {
+      throw new TokenProviderError("Please pass 'signingName' to compute environment variable key", { logger });
+    }
+    const bearerTokenKey = getBearerTokenEnvKey(signingName);
+    if (!(bearerTokenKey in process.env)) {
+      throw new TokenProviderError(`Token not present in '${bearerTokenKey}' environment variable`, { logger });
+    }
+    const token = { token: process.env[bearerTokenKey] };
+    setTokenFeature(token, "BEARER_SERVICE_ENV_VARS", "3");
+    return token;
+  };
+  var EXPIRE_WINDOW_MS = 5 * 60 * 1000;
+  var REFRESH_MESSAGE = `To refresh this SSO session run 'aws sso login' with the corresponding profile.`;
+  var getSsoOidcClient = async (ssoRegion, init = {}, callerClientConfig) => {
+    const { SSOOIDCClient } = require_sso_oidc();
+    const coalesce = (prop) => init.clientConfig?.[prop] ?? init.parentClientConfig?.[prop] ?? callerClientConfig?.[prop];
+    const ssoOidcClient = new SSOOIDCClient(Object.assign({}, init.clientConfig ?? {}, {
+      region: ssoRegion ?? init.clientConfig?.region,
+      logger: coalesce("logger"),
+      userAgentAppId: coalesce("userAgentAppId")
+    }));
+    return ssoOidcClient;
+  };
+  var getNewSsoOidcToken = async (ssoToken, ssoRegion, init = {}, callerClientConfig) => {
+    const { CreateTokenCommand } = require_sso_oidc();
+    const ssoOidcClient = await getSsoOidcClient(ssoRegion, init, callerClientConfig);
+    return ssoOidcClient.send(new CreateTokenCommand({
+      clientId: ssoToken.clientId,
+      clientSecret: ssoToken.clientSecret,
+      refreshToken: ssoToken.refreshToken,
+      grantType: "refresh_token"
+    }));
+  };
+  var validateTokenExpiry = (token) => {
+    if (token.expiration && token.expiration.getTime() < Date.now()) {
+      throw new TokenProviderError(`Token is expired. ${REFRESH_MESSAGE}`, false);
+    }
+  };
+  var validateTokenKey = (key, value, forRefresh = false) => {
+    if (typeof value === "undefined") {
+      throw new TokenProviderError(`Value not present for '${key}' in SSO Token${forRefresh ? ". Cannot refresh" : ""}. ${REFRESH_MESSAGE}`, false);
+    }
+  };
+  var { writeFile } = promises;
+  var writeSSOTokenToFile = (id, ssoToken) => {
+    const tokenFilepath = getSSOTokenFilepath(id);
+    const tokenString = JSON.stringify(ssoToken, null, 2);
+    return writeFile(tokenFilepath, tokenString);
+  };
+  var lastRefreshAttemptTimes = new Map;
+  var fromSso = (init = {}) => async ({ callerClientConfig } = {}) => {
+    init.logger?.debug("@aws-sdk/token-providers - fromSso");
+    const profiles = await parseKnownFiles(init);
+    const profileName = getProfileName({
+      profile: init.profile ?? callerClientConfig?.profile
+    });
+    const profile = profiles[profileName];
+    if (!profile) {
+      throw new TokenProviderError(`Profile '${profileName}' could not be found in shared credentials file.`, false);
+    } else if (!profile["sso_session"]) {
+      throw new TokenProviderError(`Profile '${profileName}' is missing required property 'sso_session'.`);
+    }
+    const ssoSessionName = profile["sso_session"];
+    const ssoSessions = await loadSsoSessionData(init);
+    const ssoSession = ssoSessions[ssoSessionName];
+    if (!ssoSession) {
+      throw new TokenProviderError(`Sso session '${ssoSessionName}' could not be found in shared credentials file.`, false);
+    }
+    for (const ssoSessionRequiredKey of ["sso_start_url", "sso_region"]) {
+      if (!ssoSession[ssoSessionRequiredKey]) {
+        throw new TokenProviderError(`Sso session '${ssoSessionName}' is missing required property '${ssoSessionRequiredKey}'.`, false);
+      }
+    }
+    ssoSession["sso_start_url"];
+    const ssoRegion = ssoSession["sso_region"];
+    let ssoToken;
+    try {
+      ssoToken = await getSSOTokenFromFile(ssoSessionName);
+    } catch (e) {
+      throw new TokenProviderError(`The SSO session token associated with profile=${profileName} was not found or is invalid. ${REFRESH_MESSAGE}`, false);
+    }
+    validateTokenKey("accessToken", ssoToken.accessToken);
+    validateTokenKey("expiresAt", ssoToken.expiresAt);
+    const { accessToken, expiresAt } = ssoToken;
+    const existingToken = {
+      token: accessToken,
+      expiration: new Date(expiresAt)
+    };
+    if (existingToken.expiration.getTime() - Date.now() > EXPIRE_WINDOW_MS) {
+      return existingToken;
+    }
+    const lastRefreshAttemptTime = lastRefreshAttemptTimes.get(ssoSessionName) ?? 0;
+    if (Date.now() - lastRefreshAttemptTime < 30 * 1000) {
+      validateTokenExpiry(existingToken);
+      return existingToken;
+    }
+    validateTokenKey("clientId", ssoToken.clientId, true);
+    validateTokenKey("clientSecret", ssoToken.clientSecret, true);
+    validateTokenKey("refreshToken", ssoToken.refreshToken, true);
+    try {
+      lastRefreshAttemptTimes.set(ssoSessionName, Date.now());
+      const newSsoOidcToken = await getNewSsoOidcToken(ssoToken, ssoRegion, init, callerClientConfig);
+      validateTokenKey("accessToken", newSsoOidcToken.accessToken);
+      validateTokenKey("expiresIn", newSsoOidcToken.expiresIn);
+      const newTokenExpiration = new Date(Date.now() + newSsoOidcToken.expiresIn * 1000);
+      try {
+        await writeSSOTokenToFile(ssoSessionName, {
+          ...ssoToken,
+          accessToken: newSsoOidcToken.accessToken,
+          expiresAt: newTokenExpiration.toISOString(),
+          refreshToken: newSsoOidcToken.refreshToken
+        });
+      } catch (error) {}
+      return {
+        token: newSsoOidcToken.accessToken,
+        expiration: newTokenExpiration
+      };
+    } catch (error) {
+      validateTokenExpiry(existingToken);
+      return existingToken;
+    }
+  };
+  var fromStatic = ({ token, logger }) => async () => {
+    logger?.debug("@aws-sdk/token-providers - fromStatic");
+    if (!token || !token.token) {
+      throw new TokenProviderError(`Please pass a valid token to fromStatic`, false);
+    }
+    return token;
+  };
+  var nodeProvider = (init = {}) => memoize(chain(fromSso(init), async () => {
+    throw new TokenProviderError("Could not load token from any providers", false);
+  }), (token) => token.expiration !== undefined && token.expiration.getTime() - Date.now() < 300000, (token) => token.expiration !== undefined);
+  exports.fromEnvSigningName = fromEnvSigningName;
+  exports.fromSso = fromSso;
+  exports.fromStatic = fromStatic;
+  exports.nodeProvider = nodeProvider;
+});
+
+// node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/sso/index.js
+var require_sso = __commonJS(function(exports) {
+  var { awsEndpointFunctions, emitWarningIfUnsupportedVersion: emitWarningIfUnsupportedVersion$1, createDefaultUserAgentProvider, NODE_APP_ID_CONFIG_OPTIONS, getAwsRegionExtensionConfiguration, resolveAwsRegionExtensionConfiguration, resolveUserAgentConfig, resolveHostHeaderConfig, getUserAgentPlugin, getHostHeaderPlugin, getLoggerPlugin, getRecursionDetectionPlugin } = require_client2();
+  var { NoAuthSigner, getHttpAuthSchemeEndpointRuleSetPlugin, DefaultIdentityProviderConfig, getHttpSigningPlugin } = require_dist_cjs();
+  var { normalizeProvider, getSmithyContext, ServiceException, NoOpLogger, emitWarningIfUnsupportedVersion, loadConfigsForDefaultMode, getDefaultExtensionConfiguration, resolveDefaultRuntimeConfig, Client, makeBuilder, createAggregatedClient } = require_client();
+  var { Command: $Command } = require_client();
+  exports.$Command = $Command;
+  exports.__Client = Client;
+  var { resolveDefaultsModeConfig, loadConfig, NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, NODE_REGION_CONFIG_OPTIONS, NODE_REGION_CONFIG_FILE_OPTIONS, resolveRegionConfig } = require_config();
+  var { BinaryDecisionDiagram, EndpointCache, decideEndpoint, customEndpointFunctions, resolveEndpointConfig, getEndpointPlugin } = require_endpoints();
+  var { parseUrl, getHttpHandlerExtensionConfiguration, resolveHttpHandlerRuntimeConfig, getContentLengthPlugin } = require_protocols();
+  var { DEFAULT_RETRY_MODE, NODE_RETRY_MODE_CONFIG_OPTIONS, NODE_MAX_ATTEMPT_CONFIG_OPTIONS, resolveRetryConfig, getRetryPlugin } = require_retry();
+  var { TypeRegistry, getSchemaSerdePlugin } = require_schema();
+  var { resolveAwsSdkSigV4Config, AwsSdkSigV4Signer, NODE_AUTH_SCHEME_PREFERENCE_OPTIONS } = require_httpAuthSchemes();
+  var { toUtf8, fromUtf8, toBase64, fromBase64, calculateBodyLength } = require_serde();
+  var { streamCollector, NodeHttpHandler } = require_dist_cjs3();
+  var { AwsRestJsonProtocol } = require_protocols2();
+  var { Sha256 } = require_checksum();
+  var defaultSSOHttpAuthSchemeParametersProvider = async (config, context, input) => {
+    return {
+      operation: getSmithyContext(context).operation,
+      region: await normalizeProvider(config.region)() || (() => {
+        throw new Error("expected `region` to be configured for `aws.auth#sigv4`");
+      })()
+    };
+  };
+  function createAwsAuthSigv4HttpAuthOption(authParameters) {
+    return {
+      schemeId: "aws.auth#sigv4",
+      signingProperties: {
+        name: "awsssoportal",
+        region: authParameters.region
+      },
+      propertiesExtractor: (config, context) => ({
+        signingProperties: {
+          config,
+          context
+        }
+      })
+    };
+  }
+  function createSmithyApiNoAuthHttpAuthOption(authParameters) {
+    return {
+      schemeId: "smithy.api#noAuth"
+    };
+  }
+  var defaultSSOHttpAuthSchemeProvider = (authParameters) => {
+    const options = [];
+    switch (authParameters.operation) {
+      case "GetRoleCredentials": {
+        options.push(createSmithyApiNoAuthHttpAuthOption());
+        break;
+      }
+      default: {
+        options.push(createAwsAuthSigv4HttpAuthOption(authParameters));
+      }
+    }
+    return options;
+  };
+  var resolveHttpAuthSchemeConfig = (config) => {
+    const config_0 = resolveAwsSdkSigV4Config(config);
+    return Object.assign(config_0, {
+      authSchemePreference: normalizeProvider(config.authSchemePreference ?? [])
+    });
+  };
+  var resolveClientEndpointParameters = (options) => {
+    return Object.assign(options, {
+      useDualstackEndpoint: options.useDualstackEndpoint ?? false,
+      useFipsEndpoint: options.useFipsEndpoint ?? false,
+      defaultSigningName: "awsssoportal"
+    });
+  };
+  var commonParams = {
+    UseFIPS: { type: "builtInParams", name: "useFipsEndpoint" },
+    Endpoint: { type: "builtInParams", name: "endpoint" },
+    Region: { type: "builtInParams", name: "region" },
+    UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" }
+  };
+  var version = "3.997.45";
+  var packageInfo = {
+    version
+  };
+  var k = "ref";
+  var a = -1;
+  var b = true;
+  var c = "isSet";
+  var d = "PartitionResult";
+  var e = "booleanEquals";
+  var f = "getAttr";
+  var g = { [k]: "Endpoint" };
+  var h = { [k]: d };
+  var i = {};
+  var j = [{ [k]: "Region" }];
+  var _data = {
+    conditions: [
+      [c, [g]],
+      [c, j],
+      ["aws.partition", j, d],
+      [e, [{ [k]: "UseFIPS" }, b]],
+      [e, [{ [k]: "UseDualStack" }, b]],
+      [e, [{ fn: f, argv: [h, "supportsDualStack"] }, b]],
+      [e, [{ fn: f, argv: [h, "supportsFIPS"] }, b]],
+      ["stringEquals", [{ fn: f, argv: [h, "name"] }, "aws-us-gov"]]
+    ],
+    results: [
+      [a],
+      [a, "Invalid Configuration: FIPS and custom endpoint are not supported"],
+      [a, "Invalid Configuration: Dualstack and custom endpoint are not supported"],
+      [g, i],
+      ["https://portal.sso-fips.{Region}.{PartitionResult#dualStackDnsSuffix}", i],
+      [a, "FIPS and DualStack are enabled, but this partition does not support one or both"],
+      ["https://portal.sso.{Region}.amazonaws.com", i],
+      ["https://portal.sso-fips.{Region}.{PartitionResult#dnsSuffix}", i],
+      [a, "FIPS is enabled but this partition does not support FIPS"],
+      ["https://portal.sso.{Region}.{PartitionResult#dualStackDnsSuffix}", i],
+      [a, "DualStack is enabled but this partition does not support DualStack"],
+      ["https://portal.sso.{Region}.{PartitionResult#dnsSuffix}", i],
+      [a, "Invalid Configuration: Missing Region"]
+    ]
+  };
+  var root = 2;
+  var r = 1e8;
+  var nodes = new Int32Array([
+    -1,
+    1,
+    -1,
+    0,
+    13,
+    3,
+    1,
+    4,
+    r + 12,
+    2,
+    5,
+    r + 12,
+    3,
+    8,
+    6,
+    4,
+    7,
+    r + 11,
+    5,
+    r + 9,
+    r + 10,
+    4,
+    11,
+    9,
+    6,
+    10,
+    r + 8,
+    7,
+    r + 6,
+    r + 7,
+    5,
+    12,
+    r + 5,
+    6,
+    r + 4,
+    r + 5,
+    3,
+    r + 1,
+    14,
+    4,
+    r + 2,
+    r + 3
+  ]);
+  var bdd = BinaryDecisionDiagram.from(nodes, root, _data.conditions, _data.results);
+  var cache = new EndpointCache({
+    size: 50,
+    params: ["Endpoint", "Region", "UseDualStack", "UseFIPS"]
+  });
+  var defaultEndpointResolver = (endpointParams, context = {}) => {
+    return cache.get(endpointParams, () => decideEndpoint(bdd, {
+      endpointParams,
+      logger: context.logger
+    }));
+  };
+  customEndpointFunctions.aws = awsEndpointFunctions;
+
+  class SSOServiceException extends ServiceException {
+    constructor(options) {
+      super(options);
+      Object.setPrototypeOf(this, SSOServiceException.prototype);
+    }
+  }
+
+  class InvalidRequestException extends SSOServiceException {
+    name = "InvalidRequestException";
+    $fault = "client";
+    constructor(opts) {
+      super({
+        name: "InvalidRequestException",
+        $fault: "client",
+        ...opts
+      });
+      Object.setPrototypeOf(this, InvalidRequestException.prototype);
+    }
+  }
+
+  class ResourceNotFoundException extends SSOServiceException {
+    name = "ResourceNotFoundException";
+    $fault = "client";
+    constructor(opts) {
+      super({
+        name: "ResourceNotFoundException",
+        $fault: "client",
+        ...opts
+      });
+      Object.setPrototypeOf(this, ResourceNotFoundException.prototype);
+    }
+  }
+
+  class TooManyRequestsException extends SSOServiceException {
+    name = "TooManyRequestsException";
+    $fault = "client";
+    constructor(opts) {
+      super({
+        name: "TooManyRequestsException",
+        $fault: "client",
+        ...opts
+      });
+      Object.setPrototypeOf(this, TooManyRequestsException.prototype);
+    }
+  }
+
+  class UnauthorizedException extends SSOServiceException {
+    name = "UnauthorizedException";
+    $fault = "client";
+    constructor(opts) {
+      super({
+        name: "UnauthorizedException",
+        $fault: "client",
+        ...opts
+      });
+      Object.setPrototypeOf(this, UnauthorizedException.prototype);
+    }
+  }
+  var _ATT = "AccessTokenType";
+  var _GRC = "GetRoleCredentials";
+  var _GRCR = "GetRoleCredentialsRequest";
+  var _GRCRe = "GetRoleCredentialsResponse";
+  var _IRE = "InvalidRequestException";
+  var _RC = "RoleCredentials";
+  var _RNFE = "ResourceNotFoundException";
+  var _SAKT = "SecretAccessKeyType";
+  var _STT = "SessionTokenType";
+  var _TMRE = "TooManyRequestsException";
+  var _UE = "UnauthorizedException";
+  var _aI = "accountId";
+  var _aKI = "accessKeyId";
+  var _aT = "accessToken";
+  var _ai = "account_id";
+  var _c = "client";
+  var _e = "error";
+  var _ex = "expiration";
+  var _h = "http";
+  var _hE = "httpError";
+  var _hH = "httpHeader";
+  var _hQ = "httpQuery";
+  var _m = "message";
+  var _rC = "roleCredentials";
+  var _rN = "roleName";
+  var _rn = "role_name";
+  var _s = "smithy.ts.sdk.synthetic.com.amazonaws.sso";
+  var _sAK = "secretAccessKey";
+  var _sT = "sessionToken";
+  var _xasbt = "x-amz-sso_bearer_token";
+  var n0 = "com.amazonaws.sso";
+  var _s_registry = new TypeRegistry(_s);
+  var SSOServiceException$ = [-3, _s, "SSOServiceException", 0, [], []];
+  _s_registry.registerError(SSOServiceException$, SSOServiceException);
+  var n0_registry = new TypeRegistry(n0);
+  var InvalidRequestException$ = [
+    -3,
+    n0,
+    _IRE,
+    { [_e]: _c, [_hE]: 400 },
+    [_m],
+    [0]
+  ];
+  n0_registry.registerError(InvalidRequestException$, InvalidRequestException);
+  var ResourceNotFoundException$ = [
+    -3,
+    n0,
+    _RNFE,
+    { [_e]: _c, [_hE]: 404 },
+    [_m],
+    [0]
+  ];
+  n0_registry.registerError(ResourceNotFoundException$, ResourceNotFoundException);
+  var TooManyRequestsException$ = [
+    -3,
+    n0,
+    _TMRE,
+    { [_e]: _c, [_hE]: 429 },
+    [_m],
+    [0]
+  ];
+  n0_registry.registerError(TooManyRequestsException$, TooManyRequestsException);
+  var UnauthorizedException$ = [
+    -3,
+    n0,
+    _UE,
+    { [_e]: _c, [_hE]: 401 },
+    [_m],
+    [0]
+  ];
+  n0_registry.registerError(UnauthorizedException$, UnauthorizedException);
+  var errorTypeRegistries = [
+    _s_registry,
+    n0_registry
+  ];
+  var AccessTokenType = [0, n0, _ATT, 8, 0];
+  var SecretAccessKeyType = [0, n0, _SAKT, 8, 0];
+  var SessionTokenType = [0, n0, _STT, 8, 0];
+  var GetRoleCredentialsRequest$ = [
+    3,
+    n0,
+    _GRCR,
+    0,
+    [_rN, _aI, _aT],
+    [[0, { [_hQ]: _rn }], [0, { [_hQ]: _ai }], [() => AccessTokenType, { [_hH]: _xasbt }]],
+    3
+  ];
+  var GetRoleCredentialsResponse$ = [
+    3,
+    n0,
+    _GRCRe,
+    0,
+    [_rC],
+    [[() => RoleCredentials$, 0]]
+  ];
+  var RoleCredentials$ = [
+    3,
+    n0,
+    _RC,
+    0,
+    [_aKI, _sAK, _sT, _ex],
+    [0, [() => SecretAccessKeyType, 0], [() => SessionTokenType, 0], 1]
+  ];
+  var GetRoleCredentials$ = [
+    9,
+    n0,
+    _GRC,
+    { [_h]: ["GET", "/federation/credentials", 200] },
+    () => GetRoleCredentialsRequest$,
+    () => GetRoleCredentialsResponse$
+  ];
+  var getRuntimeConfig$1 = (config) => {
+    return {
+      apiVersion: "2019-06-10",
+      base64Decoder: config?.base64Decoder ?? fromBase64,
+      base64Encoder: config?.base64Encoder ?? toBase64,
+      disableHostPrefix: config?.disableHostPrefix ?? false,
+      endpointProvider: config?.endpointProvider ?? defaultEndpointResolver,
+      extensions: config?.extensions ?? [],
+      httpAuthSchemeProvider: config?.httpAuthSchemeProvider ?? defaultSSOHttpAuthSchemeProvider,
+      httpAuthSchemes: config?.httpAuthSchemes ?? [
+        {
+          schemeId: "aws.auth#sigv4",
+          identityProvider: (ipc) => ipc.getIdentityProvider("aws.auth#sigv4"),
+          signer: new AwsSdkSigV4Signer
+        },
+        {
+          schemeId: "smithy.api#noAuth",
+          identityProvider: (ipc) => ipc.getIdentityProvider("smithy.api#noAuth") || (async () => ({})),
+          signer: new NoAuthSigner
+        }
+      ],
+      logger: config?.logger ?? new NoOpLogger,
+      protocol: config?.protocol ?? AwsRestJsonProtocol,
+      protocolSettings: config?.protocolSettings ?? {
+        defaultNamespace: "com.amazonaws.sso",
+        errorTypeRegistries,
+        version: "2019-06-10",
+        serviceTarget: "SWBPortalService"
+      },
+      serviceId: config?.serviceId ?? "SSO",
+      sha256: config?.sha256 ?? Sha256,
+      urlParser: config?.urlParser ?? parseUrl,
+      utf8Decoder: config?.utf8Decoder ?? fromUtf8,
+      utf8Encoder: config?.utf8Encoder ?? toUtf8
+    };
+  };
+  var getRuntimeConfig = (config) => {
+    emitWarningIfUnsupportedVersion(process.version);
+    const defaultsMode = resolveDefaultsModeConfig(config);
+    const defaultConfigProvider = () => defaultsMode().then(loadConfigsForDefaultMode);
+    const clientSharedValues = getRuntimeConfig$1(config);
+    emitWarningIfUnsupportedVersion$1(process.version);
+    const loaderConfig = {
+      profile: config?.profile,
+      logger: clientSharedValues.logger
+    };
+    return {
+      ...clientSharedValues,
+      ...config,
+      runtime: "node",
+      defaultsMode,
+      authSchemePreference: config?.authSchemePreference ?? loadConfig(NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
+      bodyLengthChecker: config?.bodyLengthChecker ?? calculateBodyLength,
+      defaultUserAgentProvider: config?.defaultUserAgentProvider ?? createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: packageInfo.version }),
+      maxAttempts: config?.maxAttempts ?? loadConfig(NODE_MAX_ATTEMPT_CONFIG_OPTIONS, config),
+      region: config?.region ?? loadConfig(NODE_REGION_CONFIG_OPTIONS, { ...NODE_REGION_CONFIG_FILE_OPTIONS, ...loaderConfig }),
+      requestHandler: NodeHttpHandler.create(config?.requestHandler ?? defaultConfigProvider),
+      retryMode: config?.retryMode ?? loadConfig({
+        ...NODE_RETRY_MODE_CONFIG_OPTIONS,
+        default: async () => (await defaultConfigProvider()).retryMode || DEFAULT_RETRY_MODE
+      }, config),
+      streamCollector: config?.streamCollector ?? streamCollector,
+      useDualstackEndpoint: config?.useDualstackEndpoint ?? loadConfig(NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
+      useFipsEndpoint: config?.useFipsEndpoint ?? loadConfig(NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
+      userAgentAppId: config?.userAgentAppId ?? loadConfig(NODE_APP_ID_CONFIG_OPTIONS, loaderConfig)
+    };
+  };
+  var getHttpAuthExtensionConfiguration = (runtimeConfig) => {
+    const _httpAuthSchemes = runtimeConfig.httpAuthSchemes;
+    let _httpAuthSchemeProvider = runtimeConfig.httpAuthSchemeProvider;
+    let _credentials = runtimeConfig.credentials;
+    return {
+      setHttpAuthScheme(httpAuthScheme) {
+        const index = _httpAuthSchemes.findIndex((scheme) => scheme.schemeId === httpAuthScheme.schemeId);
+        if (index === -1) {
+          _httpAuthSchemes.push(httpAuthScheme);
+        } else {
+          _httpAuthSchemes.splice(index, 1, httpAuthScheme);
+        }
+      },
+      httpAuthSchemes() {
+        return _httpAuthSchemes;
+      },
+      setHttpAuthSchemeProvider(httpAuthSchemeProvider) {
+        _httpAuthSchemeProvider = httpAuthSchemeProvider;
+      },
+      httpAuthSchemeProvider() {
+        return _httpAuthSchemeProvider;
+      },
+      setCredentials(credentials) {
+        _credentials = credentials;
+      },
+      credentials() {
+        return _credentials;
+      }
+    };
+  };
+  var resolveHttpAuthRuntimeConfig = (config) => {
+    return {
+      httpAuthSchemes: config.httpAuthSchemes(),
+      httpAuthSchemeProvider: config.httpAuthSchemeProvider(),
+      credentials: config.credentials()
+    };
+  };
+  var resolveRuntimeExtensions = (runtimeConfig, extensions) => {
+    const extensionConfiguration = Object.assign(getAwsRegionExtensionConfiguration(runtimeConfig), getDefaultExtensionConfiguration(runtimeConfig), getHttpHandlerExtensionConfiguration(runtimeConfig), getHttpAuthExtensionConfiguration(runtimeConfig));
+    extensions.forEach((extension) => extension.configure(extensionConfiguration));
+    return Object.assign(runtimeConfig, resolveAwsRegionExtensionConfiguration(extensionConfiguration), resolveDefaultRuntimeConfig(extensionConfiguration), resolveHttpHandlerRuntimeConfig(extensionConfiguration), resolveHttpAuthRuntimeConfig(extensionConfiguration));
+  };
+
+  class SSOClient extends Client {
+    config;
+    constructor(...[configuration]) {
+      const _config_0 = getRuntimeConfig(configuration || {});
+      super(_config_0);
+      this.initConfig = _config_0;
+      const _config_1 = resolveClientEndpointParameters(_config_0);
+      const _config_2 = resolveUserAgentConfig(_config_1);
+      const _config_3 = resolveRetryConfig(_config_2);
+      const _config_4 = resolveRegionConfig(_config_3);
+      const _config_5 = resolveHostHeaderConfig(_config_4);
+      const _config_6 = resolveEndpointConfig(_config_5);
+      const _config_7 = resolveHttpAuthSchemeConfig(_config_6);
+      const _config_8 = resolveRuntimeExtensions(_config_7, configuration?.extensions || []);
+      this.config = _config_8;
+      this.middlewareStack.use(getSchemaSerdePlugin(this.config));
+      this.middlewareStack.use(getUserAgentPlugin(this.config));
+      this.middlewareStack.use(getRetryPlugin(this.config));
+      this.middlewareStack.use(getContentLengthPlugin(this.config));
+      this.middlewareStack.use(getHostHeaderPlugin(this.config));
+      this.middlewareStack.use(getLoggerPlugin(this.config));
+      this.middlewareStack.use(getRecursionDetectionPlugin(this.config));
+      this.middlewareStack.use(getHttpAuthSchemeEndpointRuleSetPlugin(this.config, {
+        httpAuthSchemeParametersProvider: defaultSSOHttpAuthSchemeParametersProvider,
+        identityProviderConfigProvider: async (config) => new DefaultIdentityProviderConfig({
+          "aws.auth#sigv4": config.credentials
+        })
+      }));
+      this.middlewareStack.use(getHttpSigningPlugin(this.config));
+    }
+    destroy() {
+      super.destroy();
+    }
+  }
+  var command = makeBuilder(commonParams, "SWBPortalService", "SSOClient", getEndpointPlugin);
+  var _ep0 = {};
+  var _mw0 = (Command, cs, config, o) => [];
+
+  class GetRoleCredentialsCommand extends command(_ep0, _mw0, "GetRoleCredentials", GetRoleCredentials$) {
+  }
+  var commands = {
+    GetRoleCredentialsCommand
+  };
+
+  class SSO extends SSOClient {
+  }
+  createAggregatedClient(commands, SSO);
+  exports.GetRoleCredentials$ = GetRoleCredentials$;
+  exports.GetRoleCredentialsCommand = GetRoleCredentialsCommand;
+  exports.GetRoleCredentialsRequest$ = GetRoleCredentialsRequest$;
+  exports.GetRoleCredentialsResponse$ = GetRoleCredentialsResponse$;
+  exports.InvalidRequestException = InvalidRequestException;
+  exports.InvalidRequestException$ = InvalidRequestException$;
+  exports.ResourceNotFoundException = ResourceNotFoundException;
+  exports.ResourceNotFoundException$ = ResourceNotFoundException$;
+  exports.RoleCredentials$ = RoleCredentials$;
+  exports.SSO = SSO;
+  exports.SSOClient = SSOClient;
+  exports.SSOServiceException = SSOServiceException;
+  exports.SSOServiceException$ = SSOServiceException$;
+  exports.TooManyRequestsException = TooManyRequestsException;
+  exports.TooManyRequestsException$ = TooManyRequestsException$;
+  exports.UnauthorizedException = UnauthorizedException;
+  exports.UnauthorizedException$ = UnauthorizedException$;
+  exports.errorTypeRegistries = errorTypeRegistries;
+});
+
+// node_modules/@aws-sdk/credential-provider-sso/dist-cjs/loadSso-BGYXHf8s.js
+var require_loadSso_BGYXHf8s = __commonJS(function(exports) {
+  var { GetRoleCredentialsCommand, SSOClient } = require_sso();
+  exports.GetRoleCredentialsCommand = GetRoleCredentialsCommand;
+  exports.SSOClient = SSOClient;
+});
+
+// node_modules/@aws-sdk/credential-provider-sso/dist-cjs/index.js
+var require_dist_cjs8 = __commonJS(function(exports) {
+  var { CredentialsProviderError, getSSOTokenFromFile, getProfileName, parseKnownFiles, loadSsoSessionData } = require_config();
+  var { setCredentialFeature } = require_client2();
+  var { fromSso } = require_dist_cjs7();
+  var isSsoProfile = (arg) => arg && (typeof arg.sso_start_url === "string" || typeof arg.sso_account_id === "string" || typeof arg.sso_session === "string" || typeof arg.sso_region === "string" || typeof arg.sso_role_name === "string");
+  var SHOULD_FAIL_CREDENTIAL_CHAIN = false;
+  var resolveSSOCredentials = async ({ ssoStartUrl, ssoSession, ssoAccountId, ssoRegion, ssoRoleName, ssoClient, clientConfig, parentClientConfig, callerClientConfig, profile, filepath, configFilepath, ignoreCache, logger }) => {
+    let token;
+    const refreshMessage = `To refresh this SSO session run aws sso login with the corresponding profile.`;
+    if (ssoSession) {
+      try {
+        const _token = await fromSso({
+          profile,
+          filepath,
+          configFilepath,
+          ignoreCache,
+          clientConfig,
+          parentClientConfig,
+          logger
+        })({ callerClientConfig });
+        token = {
+          accessToken: _token.token,
+          expiresAt: new Date(_token.expiration).toISOString()
+        };
+      } catch (e) {
+        throw new CredentialsProviderError(e.message, {
+          tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
+          logger
+        });
+      }
+    } else {
+      try {
+        token = await getSSOTokenFromFile(ssoStartUrl);
+      } catch (e) {
+        throw new CredentialsProviderError(`The SSO session associated with this profile is invalid. ${refreshMessage}`, {
+          tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
+          logger
+        });
+      }
+    }
+    if (new Date(token.expiresAt).getTime() - Date.now() <= 0) {
+      throw new CredentialsProviderError(`The SSO session associated with this profile has expired. ${refreshMessage}`, {
+        tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
+        logger
+      });
+    }
+    const { accessToken } = token;
+    const { SSOClient, GetRoleCredentialsCommand } = require_loadSso_BGYXHf8s();
+    const sso = ssoClient || new SSOClient(Object.assign({}, clientConfig ?? {}, {
+      logger: clientConfig?.logger ?? callerClientConfig?.logger ?? parentClientConfig?.logger,
+      region: clientConfig?.region ?? ssoRegion,
+      userAgentAppId: clientConfig?.userAgentAppId ?? callerClientConfig?.userAgentAppId ?? parentClientConfig?.userAgentAppId
+    }));
+    let ssoResp;
+    try {
+      ssoResp = await sso.send(new GetRoleCredentialsCommand({
+        accountId: ssoAccountId,
+        roleName: ssoRoleName,
+        accessToken
+      }));
+    } catch (e) {
+      throw new CredentialsProviderError(e, {
+        tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
+        logger
+      });
+    }
+    const { roleCredentials: { accessKeyId, secretAccessKey, sessionToken, expiration, credentialScope, accountId } = {} } = ssoResp;
+    if (!accessKeyId || !secretAccessKey || !sessionToken || !expiration) {
+      throw new CredentialsProviderError("SSO returns an invalid temporary credential.", {
+        tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
+        logger
+      });
+    }
+    const credentials = {
+      accessKeyId,
+      secretAccessKey,
+      sessionToken,
+      expiration: new Date(expiration),
+      ...credentialScope && { credentialScope },
+      ...accountId && { accountId }
+    };
+    if (ssoSession) {
+      setCredentialFeature(credentials, "CREDENTIALS_SSO", "s");
+    } else {
+      setCredentialFeature(credentials, "CREDENTIALS_SSO_LEGACY", "u");
+    }
+    return credentials;
+  };
+  var validateSsoProfile = (profile, logger) => {
+    const { sso_start_url, sso_account_id, sso_region, sso_role_name } = profile;
+    if (!sso_start_url || !sso_account_id || !sso_region || !sso_role_name) {
+      throw new CredentialsProviderError(`Profile is configured with invalid SSO credentials. Required parameters "sso_account_id", ` + `"sso_region", "sso_role_name", "sso_start_url". Got ${Object.keys(profile).join(", ")}
+Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html`, { tryNextLink: false, logger });
+    }
+    return profile;
+  };
+  var fromSSO = (init = {}) => async ({ callerClientConfig } = {}) => {
+    init.logger?.debug("@aws-sdk/credential-provider-sso - fromSSO");
+    const { ssoStartUrl, ssoAccountId, ssoRegion, ssoRoleName, ssoSession } = init;
+    const { ssoClient } = init;
+    const profileName = getProfileName({
+      profile: init.profile ?? callerClientConfig?.profile
+    });
+    if (!ssoStartUrl && !ssoAccountId && !ssoRegion && !ssoRoleName && !ssoSession) {
+      const profiles = await parseKnownFiles(init);
+      const profile = profiles[profileName];
+      if (!profile) {
+        throw new CredentialsProviderError(`Profile ${profileName} was not found.`, { logger: init.logger });
+      }
+      if (!isSsoProfile(profile)) {
+        throw new CredentialsProviderError(`Profile ${profileName} is not configured with SSO credentials.`, {
+          logger: init.logger
+        });
+      }
+      if (profile?.sso_session) {
+        const ssoSessions = await loadSsoSessionData(init);
+        const session = ssoSessions[profile.sso_session];
+        const conflictMsg = ` configurations in profile ${profileName} and sso-session ${profile.sso_session}`;
+        if (ssoRegion && ssoRegion !== session.sso_region) {
+          throw new CredentialsProviderError(`Conflicting SSO region` + conflictMsg, {
+            tryNextLink: false,
+            logger: init.logger
+          });
+        }
+        if (ssoStartUrl && ssoStartUrl !== session.sso_start_url) {
+          throw new CredentialsProviderError(`Conflicting SSO start_url` + conflictMsg, {
+            tryNextLink: false,
+            logger: init.logger
+          });
+        }
+        profile.sso_region = session.sso_region;
+        profile.sso_start_url = session.sso_start_url;
+      }
+      const { sso_start_url, sso_account_id, sso_region, sso_role_name, sso_session } = validateSsoProfile(profile, init.logger);
+      return resolveSSOCredentials({
+        ssoStartUrl: sso_start_url,
+        ssoSession: sso_session,
+        ssoAccountId: sso_account_id,
+        ssoRegion: sso_region,
+        ssoRoleName: sso_role_name,
+        ssoClient,
+        clientConfig: init.clientConfig,
+        parentClientConfig: init.parentClientConfig,
+        callerClientConfig: init.callerClientConfig,
+        profile: profileName,
+        filepath: init.filepath,
+        configFilepath: init.configFilepath,
+        ignoreCache: init.ignoreCache,
+        logger: init.logger
+      });
+    } else if (!ssoStartUrl || !ssoAccountId || !ssoRegion || !ssoRoleName) {
+      throw new CredentialsProviderError("Incomplete configuration. The fromSSO() argument hash must include " + '"ssoStartUrl", "ssoAccountId", "ssoRegion", "ssoRoleName"', { tryNextLink: false, logger: init.logger });
+    } else {
+      return resolveSSOCredentials({
+        ssoStartUrl,
+        ssoSession,
+        ssoAccountId,
+        ssoRegion,
+        ssoRoleName,
+        ssoClient,
+        clientConfig: init.clientConfig,
+        parentClientConfig: init.parentClientConfig,
+        callerClientConfig: init.callerClientConfig,
+        profile: profileName,
+        filepath: init.filepath,
+        configFilepath: init.configFilepath,
+        ignoreCache: init.ignoreCache,
+        logger: init.logger
+      });
+    }
+  };
+  exports.fromSSO = fromSSO;
+  exports.isSsoProfile = isSsoProfile;
+  exports.validateSsoProfile = validateSsoProfile;
+});
+
+// node_modules/@aws-sdk/signature-v4-multi-region/dist-cjs/index.js
+var require_dist_cjs9 = __commonJS(function(exports) {
+  var { SignatureV4, signatureV4aContainer } = require_dist_cjs2();
+  var signatureV4CrtContainer = {
+    CrtSignerV4: null
+  };
+  var SESSION_TOKEN_QUERY_PARAM = "X-Amz-S3session-Token";
+  var SESSION_TOKEN_HEADER = SESSION_TOKEN_QUERY_PARAM.toLowerCase();
+
+  class SignatureV4SignWithCredentials extends SignatureV4 {
+    async signWithCredentials(requestToSign, credentials, options) {
+      const credentialsWithoutSessionToken = getCredentialsWithoutSessionToken(credentials);
+      requestToSign.headers[SESSION_TOKEN_HEADER] = credentials.sessionToken;
+      const privateAccess = this;
+      setSingleOverride(privateAccess, credentialsWithoutSessionToken);
+      return privateAccess.signRequest(requestToSign, options ?? {});
+    }
+    async presignWithCredentials(requestToSign, credentials, options) {
+      const credentialsWithoutSessionToken = getCredentialsWithoutSessionToken(credentials);
+      delete requestToSign.headers[SESSION_TOKEN_HEADER];
+      requestToSign.headers[SESSION_TOKEN_QUERY_PARAM] = credentials.sessionToken;
+      requestToSign.query = requestToSign.query ?? {};
+      requestToSign.query[SESSION_TOKEN_QUERY_PARAM] = credentials.sessionToken;
+      const privateAccess = this;
+      setSingleOverride(privateAccess, credentialsWithoutSessionToken);
+      return this.presign(requestToSign, options);
+    }
+  }
+  function getCredentialsWithoutSessionToken(credentials) {
+    return {
+      accessKeyId: credentials.accessKeyId,
+      secretAccessKey: credentials.secretAccessKey,
+      expiration: credentials.expiration
+    };
+  }
+  function setSingleOverride(privateAccess, credentialsWithoutSessionToken) {
+    const currentCredentialProvider = privateAccess.credentialProvider;
+    privateAccess.credentialProvider = () => {
+      privateAccess.credentialProvider = currentCredentialProvider;
+      return Promise.resolve(credentialsWithoutSessionToken);
+    };
+  }
+
+  class SignatureV4MultiRegion {
+    sigv4aSigner;
+    sigv4Signer;
+    signerOptions;
+    static sigv4aDependency() {
+      if (typeof signatureV4CrtContainer.CrtSignerV4 === "function") {
+        return "crt";
+      } else if (typeof signatureV4aContainer.SignatureV4a === "function") {
+        return "js";
+      }
+      return "none";
+    }
+    constructor(options) {
+      this.sigv4Signer = new SignatureV4SignWithCredentials(options);
+      this.signerOptions = options;
+    }
+    async sign(requestToSign, options = {}) {
+      if (options.signingRegion === "*") {
+        return this.getSigv4aSigner().sign(requestToSign, options);
+      }
+      return this.sigv4Signer.sign(requestToSign, options);
+    }
+    async signWithCredentials(requestToSign, credentials, options = {}) {
+      if (options.signingRegion === "*") {
+        const signer = this.getSigv4aSigner();
+        const CrtSignerV4 = signatureV4CrtContainer.CrtSignerV4;
+        if (CrtSignerV4 && signer instanceof CrtSignerV4) {
+          return signer.signWithCredentials(requestToSign, credentials, options);
+        } else {
+          throw new Error(`signWithCredentials with signingRegion '*' is only supported when using the CRT dependency @aws-sdk/signature-v4-crt. ` + `Please check whether you have installed the "@aws-sdk/signature-v4-crt" package explicitly. ` + `You must also register the package by calling [require("@aws-sdk/signature-v4-crt");] ` + `or an ESM equivalent such as [import "@aws-sdk/signature-v4-crt";]. ` + `For more information please go to https://github.com/aws/aws-sdk-js-v3#functionality-requiring-aws-common-runtime-crt`);
+        }
+      }
+      return this.sigv4Signer.signWithCredentials(requestToSign, credentials, options);
+    }
+    async presign(originalRequest, options = {}) {
+      if (options.signingRegion === "*") {
+        const signer = this.getSigv4aSigner();
+        const CrtSignerV4 = signatureV4CrtContainer.CrtSignerV4;
+        if (CrtSignerV4 && signer instanceof CrtSignerV4) {
+          return signer.presign(originalRequest, options);
+        } else {
+          throw new Error(`presign with signingRegion '*' is only supported when using the CRT dependency @aws-sdk/signature-v4-crt. ` + `Please check whether you have installed the "@aws-sdk/signature-v4-crt" package explicitly. ` + `You must also register the package by calling [require("@aws-sdk/signature-v4-crt");] ` + `or an ESM equivalent such as [import "@aws-sdk/signature-v4-crt";]. ` + `For more information please go to https://github.com/aws/aws-sdk-js-v3#functionality-requiring-aws-common-runtime-crt`);
+        }
+      }
+      return this.sigv4Signer.presign(originalRequest, options);
+    }
+    async presignWithCredentials(originalRequest, credentials, options = {}) {
+      if (options.signingRegion === "*") {
+        throw new Error("Method presignWithCredentials is not supported for [signingRegion=*].");
+      }
+      return this.sigv4Signer.presignWithCredentials(originalRequest, credentials, options);
+    }
+    getSigv4aSigner() {
+      if (!this.sigv4aSigner) {
+        const CrtSignerV4 = signatureV4CrtContainer.CrtSignerV4;
+        const JsSigV4aSigner = signatureV4aContainer.SignatureV4a;
+        if (this.signerOptions.runtime === "node") {
+          if (!CrtSignerV4 && !JsSigV4aSigner) {
+            throw new Error("Neither CRT nor JS SigV4a implementation is available. " + "Please load either @aws-sdk/signature-v4-crt or @aws-sdk/signature-v4a. " + "For more information please go to " + "https://github.com/aws/aws-sdk-js-v3#functionality-requiring-aws-common-runtime-crt");
+          }
+          if (CrtSignerV4 && typeof CrtSignerV4 === "function") {
+            this.sigv4aSigner = new CrtSignerV4({
+              ...this.signerOptions,
+              signingAlgorithm: 1
+            });
+          } else if (JsSigV4aSigner && typeof JsSigV4aSigner === "function") {
+            this.sigv4aSigner = new JsSigV4aSigner({
+              ...this.signerOptions
+            });
+          } else {
+            throw new Error("Available SigV4a implementation is not a valid constructor. " + "Please ensure you've properly imported @aws-sdk/signature-v4-crt or @aws-sdk/signature-v4a." + "For more information please go to " + "https://github.com/aws/aws-sdk-js-v3#functionality-requiring-aws-common-runtime-crt");
+          }
+        } else {
+          if (!JsSigV4aSigner || typeof JsSigV4aSigner !== "function") {
+            throw new Error("JS SigV4a implementation is not available or not a valid constructor. " + "Please check whether you have installed the @aws-sdk/signature-v4a package explicitly. The CRT implementation is not available for browsers. " + "You must also register the package by calling [require('@aws-sdk/signature-v4a');] " + "or an ESM equivalent such as [import '@aws-sdk/signature-v4a';]. " + "For more information please go to " + "https://github.com/aws/aws-sdk-js-v3#using-javascript-non-crt-implementation-of-sigv4a");
+          }
+          this.sigv4aSigner = new JsSigV4aSigner({
+            ...this.signerOptions
+          });
+        }
+      }
+      return this.sigv4aSigner;
+    }
+  }
+  exports.SignatureV4MultiRegion = SignatureV4MultiRegion;
+  exports.SignatureV4SignWithCredentials = SignatureV4SignWithCredentials;
+  exports.signatureV4CrtContainer = signatureV4CrtContainer;
+});
+
+// node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/sts/index.js
+var require_sts = __commonJS(function(exports) {
+  var { awsEndpointFunctions, emitWarningIfUnsupportedVersion: emitWarningIfUnsupportedVersion$1, createDefaultUserAgentProvider, NODE_APP_ID_CONFIG_OPTIONS, getAwsRegionExtensionConfiguration, resolveAwsRegionExtensionConfiguration, resolveUserAgentConfig, resolveHostHeaderConfig, getUserAgentPlugin, getHostHeaderPlugin, getLoggerPlugin, getRecursionDetectionPlugin, setCredentialFeature, stsRegionDefaultResolver } = require_client2();
+  var { NoAuthSigner, getHttpAuthSchemeEndpointRuleSetPlugin, DefaultIdentityProviderConfig, getHttpSigningPlugin } = require_dist_cjs();
+  var { normalizeProvider, getSmithyContext, ServiceException, NoOpLogger, emitWarningIfUnsupportedVersion, loadConfigsForDefaultMode, getDefaultExtensionConfiguration, resolveDefaultRuntimeConfig, Client, makeBuilder, createAggregatedClient } = require_client();
+  var { Command: $Command } = require_client();
+  exports.$Command = $Command;
+  exports.__Client = Client;
+  var { resolveDefaultsModeConfig, loadConfig, NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, NODE_REGION_CONFIG_OPTIONS, NODE_REGION_CONFIG_FILE_OPTIONS, resolveRegionConfig } = require_config();
+  var { BinaryDecisionDiagram, EndpointCache, decideEndpoint, customEndpointFunctions, resolveParams, resolveEndpointConfig, getEndpointPlugin } = require_endpoints();
+  var { parseUrl, getHttpHandlerExtensionConfiguration, resolveHttpHandlerRuntimeConfig, getContentLengthPlugin } = require_protocols();
+  var { DEFAULT_RETRY_MODE, NODE_RETRY_MODE_CONFIG_OPTIONS, NODE_MAX_ATTEMPT_CONFIG_OPTIONS, resolveRetryConfig, getRetryPlugin } = require_retry();
+  var { TypeRegistry, getSchemaSerdePlugin } = require_schema();
+  var { resolveAwsSdkSigV4Config, resolveAwsSdkSigV4AConfig, AwsSdkSigV4Signer, AwsSdkSigV4ASigner, NODE_SIGV4A_CONFIG_OPTIONS, NODE_AUTH_SCHEME_PREFERENCE_OPTIONS } = require_httpAuthSchemes();
+  var { SignatureV4MultiRegion } = require_dist_cjs9();
+  var { toUtf8, fromUtf8, toBase64, fromBase64, calculateBodyLength } = require_serde();
+  var { streamCollector, NodeHttpHandler } = require_dist_cjs3();
+  var { AwsQueryProtocol } = require_protocols2();
+  var { Sha256 } = require_checksum();
+  var q = "ref";
+  var a = -1;
+  var b = true;
+  var c = "isSet";
+  var d = "PartitionResult";
+  var e = "booleanEquals";
+  var f = "stringEquals";
+  var g = "getAttr";
+  var h = "us-east-1";
+  var i = "sigv4";
+  var j = "sts";
+  var k = "https://sts.{Region}.{PartitionResult#dnsSuffix}";
+  var l = { [q]: "Endpoint" };
+  var m = { [q]: "Region" };
+  var n = { [q]: d };
+  var o = {};
+  var p = [m];
+  var _data = {
+    conditions: [
+      [c, [l]],
+      [c, p],
+      ["aws.partition", p, d],
+      [e, [{ [q]: "UseFIPS" }, b]],
+      [e, [{ [q]: "UseDualStack" }, b]],
+      [f, [m, "aws-global"]],
+      [e, [{ [q]: "UseGlobalEndpoint" }, b]],
+      [f, [m, "eu-central-1"]],
+      [e, [{ fn: g, argv: [n, "supportsDualStack"] }, b]],
+      [e, [{ fn: g, argv: [n, "supportsFIPS"] }, b]],
+      [f, [m, "ap-south-1"]],
+      [f, [m, "eu-north-1"]],
+      [f, [m, "eu-west-1"]],
+      [f, [m, "eu-west-2"]],
+      [f, [m, "eu-west-3"]],
+      [f, [m, "sa-east-1"]],
+      [f, [m, h]],
+      [f, [m, "us-east-2"]],
+      [f, [m, "us-west-2"]],
+      [f, [m, "us-west-1"]],
+      [f, [m, "ca-central-1"]],
+      [f, [m, "ap-southeast-1"]],
+      [f, [m, "ap-northeast-1"]],
+      [f, [m, "ap-southeast-2"]],
+      [f, [{ fn: g, argv: [n, "name"] }, "aws-us-gov"]]
+    ],
+    results: [
+      [a],
+      ["https://sts.amazonaws.com", { authSchemes: [{ name: i, signingName: j, signingRegion: h }] }],
+      [k, { authSchemes: [{ name: i, signingName: j, signingRegion: "{Region}" }] }],
+      [a, "Invalid Configuration: FIPS and custom endpoint are not supported"],
+      [a, "Invalid Configuration: Dualstack and custom endpoint are not supported"],
+      [l, o],
+      ["https://sts-fips.{Region}.{PartitionResult#dualStackDnsSuffix}", o],
+      [a, "FIPS and DualStack are enabled, but this partition does not support one or both"],
+      ["https://sts.{Region}.amazonaws.com", o],
+      ["https://sts-fips.{Region}.{PartitionResult#dnsSuffix}", o],
+      [a, "FIPS is enabled but this partition does not support FIPS"],
+      ["https://sts.{Region}.{PartitionResult#dualStackDnsSuffix}", o],
+      [a, "DualStack is enabled but this partition does not support DualStack"],
+      [k, o],
+      [a, "Invalid Configuration: Missing Region"]
+    ]
+  };
+  var root = 2;
+  var r = 1e8;
+  var nodes = new Int32Array([
+    -1,
+    1,
+    -1,
+    0,
+    30,
+    3,
+    1,
+    4,
+    r + 14,
+    2,
+    5,
+    r + 14,
+    3,
+    25,
+    6,
+    4,
+    24,
+    7,
+    5,
+    r + 1,
+    8,
+    6,
+    9,
+    r + 13,
+    7,
+    r + 1,
+    10,
+    10,
+    r + 1,
+    11,
+    11,
+    r + 1,
+    12,
+    12,
+    r + 1,
+    13,
+    13,
+    r + 1,
+    14,
+    14,
+    r + 1,
+    15,
+    15,
+    r + 1,
+    16,
+    16,
+    r + 1,
+    17,
+    17,
+    r + 1,
+    18,
+    18,
+    r + 1,
+    19,
+    19,
+    r + 1,
+    20,
+    20,
+    r + 1,
+    21,
+    21,
+    r + 1,
+    22,
+    22,
+    r + 1,
+    23,
+    23,
+    r + 1,
+    r + 2,
+    8,
+    r + 11,
+    r + 12,
+    4,
+    28,
+    26,
+    9,
+    27,
+    r + 10,
+    24,
+    r + 8,
+    r + 9,
+    8,
+    29,
+    r + 7,
+    9,
+    r + 6,
+    r + 7,
+    3,
+    r + 3,
+    31,
+    4,
+    r + 4,
+    r + 5
+  ]);
+  var bdd = BinaryDecisionDiagram.from(nodes, root, _data.conditions, _data.results);
+  var cache = new EndpointCache({
+    size: 50,
+    params: ["Endpoint", "Region", "UseDualStack", "UseFIPS", "UseGlobalEndpoint"]
+  });
+  var defaultEndpointResolver = (endpointParams, context = {}) => {
+    return cache.get(endpointParams, () => decideEndpoint(bdd, {
+      endpointParams,
+      logger: context.logger
+    }));
+  };
+  customEndpointFunctions.aws = awsEndpointFunctions;
+  var createEndpointRuleSetHttpAuthSchemeParametersProvider = (defaultHttpAuthSchemeParametersProvider) => async (config, context, input) => {
+    if (!input) {
+      throw new Error("Could not find `input` for `defaultEndpointRuleSetHttpAuthSchemeParametersProvider`");
+    }
+    const defaultParameters = await defaultHttpAuthSchemeParametersProvider(config, context, input);
+    const instructionsFn = getSmithyContext(context)?.commandInstance?.constructor?.getEndpointParameterInstructions;
+    if (!instructionsFn) {
+      throw new Error(`getEndpointParameterInstructions() is not defined on '${context.commandName}'`);
+    }
+    const endpointParameters = await resolveParams(input, { getEndpointParameterInstructions: instructionsFn }, config);
+    return Object.assign(defaultParameters, endpointParameters);
+  };
+  var _defaultSTSHttpAuthSchemeParametersProvider = async (config, context, input) => {
+    return {
+      operation: getSmithyContext(context).operation,
+      region: await normalizeProvider(config.region)() || (() => {
+        throw new Error("expected `region` to be configured for `aws.auth#sigv4`");
+      })()
+    };
+  };
+  var defaultSTSHttpAuthSchemeParametersProvider = createEndpointRuleSetHttpAuthSchemeParametersProvider(_defaultSTSHttpAuthSchemeParametersProvider);
+  function createAwsAuthSigv4HttpAuthOption(authParameters) {
+    return {
+      schemeId: "aws.auth#sigv4",
+      signingProperties: {
+        name: "sts",
+        region: authParameters.region
+      },
+      propertiesExtractor: (config, context) => ({
+        signingProperties: {
+          config,
+          context
+        }
+      })
+    };
+  }
+  function createAwsAuthSigv4aHttpAuthOption(authParameters) {
+    return {
+      schemeId: "aws.auth#sigv4a",
+      signingProperties: {
+        name: "sts",
+        region: authParameters.region
+      },
+      propertiesExtractor: (config, context) => ({
+        signingProperties: {
+          config,
+          context
+        }
+      })
+    };
+  }
+  function createSmithyApiNoAuthHttpAuthOption(authParameters) {
+    return {
+      schemeId: "smithy.api#noAuth"
+    };
+  }
+  var createEndpointRuleSetHttpAuthSchemeProvider = (defaultEndpointResolver2, defaultHttpAuthSchemeResolver, createHttpAuthOptionFunctions) => {
+    const endpointRuleSetHttpAuthSchemeProvider = (authParameters) => {
+      const endpoint = defaultEndpointResolver2(authParameters);
+      const authSchemes = endpoint.properties?.authSchemes;
+      if (!authSchemes) {
+        return defaultHttpAuthSchemeResolver(authParameters);
+      }
+      const options = [];
+      for (const scheme of authSchemes) {
+        const { name: resolvedName, properties = {}, ...rest } = scheme;
+        const name = resolvedName.toLowerCase();
+        if (resolvedName !== name) {
+          console.warn(`HttpAuthScheme has been normalized with lowercasing: '${resolvedName}' to '${name}'`);
+        }
+        let schemeId;
+        if (name === "sigv4a") {
+          schemeId = "aws.auth#sigv4a";
+          const sigv4Present = authSchemes.find((s) => {
+            const name2 = s.name.toLowerCase();
+            return name2 !== "sigv4a" && name2.startsWith("sigv4");
+          });
+          if (SignatureV4MultiRegion.sigv4aDependency() === "none" && sigv4Present) {
+            continue;
+          }
+        } else if (name.startsWith("sigv4")) {
+          schemeId = "aws.auth#sigv4";
+        } else {
+          throw new Error(`Unknown HttpAuthScheme found in '@smithy.rules#endpointRuleSet': '${name}'`);
+        }
+        const createOption = createHttpAuthOptionFunctions[schemeId];
+        if (!createOption) {
+          throw new Error(`Could not find HttpAuthOption create function for '${schemeId}'`);
+        }
+        const option = createOption(authParameters);
+        option.schemeId = schemeId;
+        option.signingProperties = { ...option.signingProperties || {}, ...rest, ...properties };
+        options.push(option);
+      }
+      return options;
+    };
+    return endpointRuleSetHttpAuthSchemeProvider;
+  };
+  var _defaultSTSHttpAuthSchemeProvider = (authParameters) => {
+    const options = [];
+    switch (authParameters.operation) {
+      case "AssumeRoleWithWebIdentity": {
+        options.push(createSmithyApiNoAuthHttpAuthOption());
+        options.push(createAwsAuthSigv4aHttpAuthOption(authParameters));
+        break;
+      }
+      default: {
+        options.push(createAwsAuthSigv4HttpAuthOption(authParameters));
+        options.push(createAwsAuthSigv4aHttpAuthOption(authParameters));
+      }
+    }
+    return options;
+  };
+  var defaultSTSHttpAuthSchemeProvider = createEndpointRuleSetHttpAuthSchemeProvider(defaultEndpointResolver, _defaultSTSHttpAuthSchemeProvider, {
+    "aws.auth#sigv4": createAwsAuthSigv4HttpAuthOption,
+    "aws.auth#sigv4a": createAwsAuthSigv4aHttpAuthOption,
+    "smithy.api#noAuth": createSmithyApiNoAuthHttpAuthOption
+  });
+  var resolveHttpAuthSchemeConfig = (config) => {
+    const config_0 = resolveAwsSdkSigV4Config(config);
+    const config_1 = resolveAwsSdkSigV4AConfig(config_0);
+    return Object.assign(config_1, {
+      authSchemePreference: normalizeProvider(config.authSchemePreference ?? [])
+    });
+  };
+  var resolveClientEndpointParameters = (options) => {
+    return Object.assign(options, {
+      useDualstackEndpoint: options.useDualstackEndpoint ?? false,
+      useFipsEndpoint: options.useFipsEndpoint ?? false,
+      useGlobalEndpoint: options.useGlobalEndpoint ?? false,
+      defaultSigningName: "sts"
+    });
+  };
+  var commonParams = {
+    UseGlobalEndpoint: { type: "builtInParams", name: "useGlobalEndpoint" },
+    UseFIPS: { type: "builtInParams", name: "useFipsEndpoint" },
+    Endpoint: { type: "builtInParams", name: "endpoint" },
+    Region: { type: "builtInParams", name: "region" },
+    UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" }
+  };
+  var version = "3.997.45";
+  var packageInfo = {
+    version
+  };
+
+  class STSServiceException extends ServiceException {
+    constructor(options) {
+      super(options);
+      Object.setPrototypeOf(this, STSServiceException.prototype);
+    }
+  }
+
+  class ExpiredTokenException extends STSServiceException {
+    name = "ExpiredTokenException";
+    $fault = "client";
+    constructor(opts) {
+      super({
+        name: "ExpiredTokenException",
+        $fault: "client",
+        ...opts
+      });
+      Object.setPrototypeOf(this, ExpiredTokenException.prototype);
+    }
+  }
+
+  class MalformedPolicyDocumentException extends STSServiceException {
+    name = "MalformedPolicyDocumentException";
+    $fault = "client";
+    constructor(opts) {
+      super({
+        name: "MalformedPolicyDocumentException",
+        $fault: "client",
+        ...opts
+      });
+      Object.setPrototypeOf(this, MalformedPolicyDocumentException.prototype);
+    }
+  }
+
+  class PackedPolicyTooLargeException extends STSServiceException {
+    name = "PackedPolicyTooLargeException";
+    $fault = "client";
+    constructor(opts) {
+      super({
+        name: "PackedPolicyTooLargeException",
+        $fault: "client",
+        ...opts
+      });
+      Object.setPrototypeOf(this, PackedPolicyTooLargeException.prototype);
+    }
+  }
+
+  class RegionDisabledException extends STSServiceException {
+    name = "RegionDisabledException";
+    $fault = "client";
+    constructor(opts) {
+      super({
+        name: "RegionDisabledException",
+        $fault: "client",
+        ...opts
+      });
+      Object.setPrototypeOf(this, RegionDisabledException.prototype);
+    }
+  }
+
+  class IDPRejectedClaimException extends STSServiceException {
+    name = "IDPRejectedClaimException";
+    $fault = "client";
+    constructor(opts) {
+      super({
+        name: "IDPRejectedClaimException",
+        $fault: "client",
+        ...opts
+      });
+      Object.setPrototypeOf(this, IDPRejectedClaimException.prototype);
+    }
+  }
+
+  class InvalidIdentityTokenException extends STSServiceException {
+    name = "InvalidIdentityTokenException";
+    $fault = "client";
+    constructor(opts) {
+      super({
+        name: "InvalidIdentityTokenException",
+        $fault: "client",
+        ...opts
+      });
+      Object.setPrototypeOf(this, InvalidIdentityTokenException.prototype);
+    }
+  }
+
+  class IDPCommunicationErrorException extends STSServiceException {
+    name = "IDPCommunicationErrorException";
+    $fault = "client";
+    $retryable = {};
+    constructor(opts) {
+      super({
+        name: "IDPCommunicationErrorException",
+        $fault: "client",
+        ...opts
+      });
+      Object.setPrototypeOf(this, IDPCommunicationErrorException.prototype);
+    }
+  }
+  var _A = "Arn";
+  var _AKI = "AccessKeyId";
+  var _AR = "AssumeRole";
+  var _ARI = "AssumedRoleId";
+  var _ARR = "AssumeRoleRequest";
+  var _ARRs = "AssumeRoleResponse";
+  var _ARU = "AssumedRoleUser";
+  var _ARWWI = "AssumeRoleWithWebIdentity";
+  var _ARWWIR = "AssumeRoleWithWebIdentityRequest";
+  var _ARWWIRs = "AssumeRoleWithWebIdentityResponse";
+  var _Au = "Audience";
+  var _C = "Credentials";
+  var _CA = "ContextAssertion";
+  var _DS = "DurationSeconds";
+  var _E = "Expiration";
+  var _EI = "ExternalId";
+  var _ETE = "ExpiredTokenException";
+  var _IDPCEE = "IDPCommunicationErrorException";
+  var _IDPRCE = "IDPRejectedClaimException";
+  var _IITE = "InvalidIdentityTokenException";
+  var _K = "Key";
+  var _MPDE = "MalformedPolicyDocumentException";
+  var _MSTS = "MinimumSessionTokenSize";
+  var _P = "Policy";
+  var _PA = "PolicyArns";
+  var _PAr = "ProviderArn";
+  var _PC = "ProvidedContexts";
+  var _PCLT = "ProvidedContextsListType";
+  var _PCr = "ProvidedContext";
+  var _PDT = "PolicyDescriptorType";
+  var _PI = "ProviderId";
+  var _PPS = "PackedPolicySize";
+  var _PPTLE = "PackedPolicyTooLargeException";
+  var _Pr = "Provider";
+  var _RA = "RoleArn";
+  var _RDE = "RegionDisabledException";
+  var _RSN = "RoleSessionName";
+  var _SAK = "SecretAccessKey";
+  var _SFWIT = "SubjectFromWebIdentityToken";
+  var _SI = "SourceIdentity";
+  var _SN = "SerialNumber";
+  var _ST = "SessionToken";
+  var _STS = "SessionTokenSize";
+  var _STU = "SessionTokenUtilization";
+  var _T = "Tags";
+  var _TC = "TokenCode";
+  var _TTK = "TransitiveTagKeys";
+  var _Ta = "Tag";
+  var _V = "Value";
+  var _WIT = "WebIdentityToken";
+  var _a = "arn";
+  var _aKST = "accessKeySecretType";
+  var _aQE = "awsQueryError";
+  var _c = "client";
+  var _cTT = "clientTokenType";
+  var _e = "error";
+  var _hE = "httpError";
+  var _m = "message";
+  var _pDLT = "policyDescriptorListType";
+  var _s = "smithy.ts.sdk.synthetic.com.amazonaws.sts";
+  var _tLT = "tagListType";
+  var n0 = "com.amazonaws.sts";
+  var _s_registry = new TypeRegistry(_s);
+  var STSServiceException$ = [-3, _s, "STSServiceException", 0, [], []];
+  _s_registry.registerError(STSServiceException$, STSServiceException);
+  var n0_registry = new TypeRegistry(n0);
+  var ExpiredTokenException$ = [
+    -3,
+    n0,
+    _ETE,
+    { [_aQE]: [`ExpiredTokenException`, 400], [_e]: _c, [_hE]: 400 },
+    [_m],
+    [0]
+  ];
+  n0_registry.registerError(ExpiredTokenException$, ExpiredTokenException);
+  var IDPCommunicationErrorException$ = [
+    -3,
+    n0,
+    _IDPCEE,
+    { [_aQE]: [`IDPCommunicationError`, 400], [_e]: _c, [_hE]: 400 },
+    [_m],
+    [0]
+  ];
+  n0_registry.registerError(IDPCommunicationErrorException$, IDPCommunicationErrorException);
+  var IDPRejectedClaimException$ = [
+    -3,
+    n0,
+    _IDPRCE,
+    { [_aQE]: [`IDPRejectedClaim`, 403], [_e]: _c, [_hE]: 403 },
+    [_m],
+    [0]
+  ];
+  n0_registry.registerError(IDPRejectedClaimException$, IDPRejectedClaimException);
+  var InvalidIdentityTokenException$ = [
+    -3,
+    n0,
+    _IITE,
+    { [_aQE]: [`InvalidIdentityToken`, 400], [_e]: _c, [_hE]: 400 },
+    [_m],
+    [0]
+  ];
+  n0_registry.registerError(InvalidIdentityTokenException$, InvalidIdentityTokenException);
+  var MalformedPolicyDocumentException$ = [
+    -3,
+    n0,
+    _MPDE,
+    { [_aQE]: [`MalformedPolicyDocument`, 400], [_e]: _c, [_hE]: 400 },
+    [_m],
+    [0]
+  ];
+  n0_registry.registerError(MalformedPolicyDocumentException$, MalformedPolicyDocumentException);
+  var PackedPolicyTooLargeException$ = [
+    -3,
+    n0,
+    _PPTLE,
+    { [_aQE]: [`PackedPolicyTooLarge`, 400], [_e]: _c, [_hE]: 400 },
+    [_m],
+    [0]
+  ];
+  n0_registry.registerError(PackedPolicyTooLargeException$, PackedPolicyTooLargeException);
+  var RegionDisabledException$ = [
+    -3,
+    n0,
+    _RDE,
+    { [_aQE]: [`RegionDisabledException`, 403], [_e]: _c, [_hE]: 403 },
+    [_m],
+    [0]
+  ];
+  n0_registry.registerError(RegionDisabledException$, RegionDisabledException);
+  var errorTypeRegistries = [
+    _s_registry,
+    n0_registry
+  ];
+  var accessKeySecretType = [0, n0, _aKST, 8, 0];
+  var clientTokenType = [0, n0, _cTT, 8, 0];
+  var AssumedRoleUser$ = [
+    3,
+    n0,
+    _ARU,
+    0,
+    [_ARI, _A],
+    [0, 0],
+    2
+  ];
+  var AssumeRoleRequest$ = [
+    3,
+    n0,
+    _ARR,
+    0,
+    [_RA, _RSN, _PA, _P, _DS, _T, _TTK, _EI, _SN, _TC, _SI, _PC, _MSTS],
+    [0, 0, () => policyDescriptorListType, 0, 1, () => tagListType, 64 | 0, 0, 0, 0, 0, () => ProvidedContextsListType, 1],
+    2
+  ];
+  var AssumeRoleResponse$ = [
+    3,
+    n0,
+    _ARRs,
+    0,
+    [_C, _ARU, _PPS, _SI, _STU, _STS],
+    [[() => Credentials$, 0], () => AssumedRoleUser$, 1, 0, 1, 1]
+  ];
+  var AssumeRoleWithWebIdentityRequest$ = [
+    3,
+    n0,
+    _ARWWIR,
+    0,
+    [_RA, _RSN, _WIT, _PI, _PA, _P, _DS, _MSTS],
+    [0, 0, [() => clientTokenType, 0], 0, () => policyDescriptorListType, 0, 1, 1],
+    3
+  ];
+  var AssumeRoleWithWebIdentityResponse$ = [
+    3,
+    n0,
+    _ARWWIRs,
+    0,
+    [_C, _SFWIT, _ARU, _PPS, _Pr, _Au, _SI, _STU, _STS],
+    [[() => Credentials$, 0], 0, () => AssumedRoleUser$, 1, 0, 0, 0, 1, 1]
+  ];
+  var Credentials$ = [
+    3,
+    n0,
+    _C,
+    0,
+    [_AKI, _SAK, _ST, _E],
+    [0, [() => accessKeySecretType, 0], 0, 4],
+    4
+  ];
+  var PolicyDescriptorType$ = [
+    3,
+    n0,
+    _PDT,
+    0,
+    [_a],
+    [0]
+  ];
+  var ProvidedContext$ = [
+    3,
+    n0,
+    _PCr,
+    0,
+    [_PAr, _CA],
+    [0, 0]
+  ];
+  var Tag$ = [
+    3,
+    n0,
+    _Ta,
+    0,
+    [_K, _V],
+    [0, 0],
+    2
+  ];
+  var policyDescriptorListType = [
+    1,
+    n0,
+    _pDLT,
+    0,
+    () => PolicyDescriptorType$
+  ];
+  var ProvidedContextsListType = [
+    1,
+    n0,
+    _PCLT,
+    0,
+    () => ProvidedContext$
+  ];
+  var tagListType = [
+    1,
+    n0,
+    _tLT,
+    0,
+    () => Tag$
+  ];
+  var AssumeRole$ = [
+    9,
+    n0,
+    _AR,
+    0,
+    () => AssumeRoleRequest$,
+    () => AssumeRoleResponse$
+  ];
+  var AssumeRoleWithWebIdentity$ = [
+    9,
+    n0,
+    _ARWWI,
+    0,
+    () => AssumeRoleWithWebIdentityRequest$,
+    () => AssumeRoleWithWebIdentityResponse$
+  ];
+  var getRuntimeConfig$1 = (config) => {
+    return {
+      apiVersion: "2011-06-15",
+      base64Decoder: config?.base64Decoder ?? fromBase64,
+      base64Encoder: config?.base64Encoder ?? toBase64,
+      disableHostPrefix: config?.disableHostPrefix ?? false,
+      endpointProvider: config?.endpointProvider ?? defaultEndpointResolver,
+      extensions: config?.extensions ?? [],
+      httpAuthSchemeProvider: config?.httpAuthSchemeProvider ?? defaultSTSHttpAuthSchemeProvider,
+      httpAuthSchemes: config?.httpAuthSchemes ?? [
+        {
+          schemeId: "aws.auth#sigv4",
+          identityProvider: (ipc) => ipc.getIdentityProvider("aws.auth#sigv4"),
+          signer: new AwsSdkSigV4Signer
+        },
+        {
+          schemeId: "aws.auth#sigv4a",
+          identityProvider: (ipc) => ipc.getIdentityProvider("aws.auth#sigv4a"),
+          signer: new AwsSdkSigV4ASigner
+        },
+        {
+          schemeId: "smithy.api#noAuth",
+          identityProvider: (ipc) => ipc.getIdentityProvider("smithy.api#noAuth") || (async () => ({})),
+          signer: new NoAuthSigner
+        }
+      ],
+      logger: config?.logger ?? new NoOpLogger,
+      protocol: config?.protocol ?? AwsQueryProtocol,
+      protocolSettings: config?.protocolSettings ?? {
+        defaultNamespace: "com.amazonaws.sts",
+        errorTypeRegistries,
+        xmlNamespace: "https://sts.amazonaws.com/doc/2011-06-15/",
+        version: "2011-06-15",
+        serviceTarget: "AWSSecurityTokenServiceV20110615"
+      },
+      serviceId: config?.serviceId ?? "STS",
+      sha256: config?.sha256 ?? Sha256,
+      signerConstructor: config?.signerConstructor ?? SignatureV4MultiRegion,
+      urlParser: config?.urlParser ?? parseUrl,
+      utf8Decoder: config?.utf8Decoder ?? fromUtf8,
+      utf8Encoder: config?.utf8Encoder ?? toUtf8
+    };
+  };
+  var getRuntimeConfig = (config) => {
+    emitWarningIfUnsupportedVersion(process.version);
+    const defaultsMode = resolveDefaultsModeConfig(config);
+    const defaultConfigProvider = () => defaultsMode().then(loadConfigsForDefaultMode);
+    const clientSharedValues = getRuntimeConfig$1(config);
+    emitWarningIfUnsupportedVersion$1(process.version);
+    const loaderConfig = {
+      profile: config?.profile,
+      logger: clientSharedValues.logger
+    };
+    return {
+      ...clientSharedValues,
+      ...config,
+      runtime: "node",
+      defaultsMode,
+      authSchemePreference: config?.authSchemePreference ?? loadConfig(NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
+      bodyLengthChecker: config?.bodyLengthChecker ?? calculateBodyLength,
+      defaultUserAgentProvider: config?.defaultUserAgentProvider ?? createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: packageInfo.version }),
+      httpAuthSchemes: config?.httpAuthSchemes ?? [
+        {
+          schemeId: "aws.auth#sigv4",
+          identityProvider: (ipc) => ipc.getIdentityProvider("aws.auth#sigv4") || (async (idProps) => await config.credentialDefaultProvider(idProps?.__config || {})()),
+          signer: new AwsSdkSigV4Signer
+        },
+        {
+          schemeId: "aws.auth#sigv4a",
+          identityProvider: (ipc) => ipc.getIdentityProvider("aws.auth#sigv4a"),
+          signer: new AwsSdkSigV4ASigner
+        },
+        {
+          schemeId: "smithy.api#noAuth",
+          identityProvider: (ipc) => ipc.getIdentityProvider("smithy.api#noAuth") || (async () => ({})),
+          signer: new NoAuthSigner
+        }
+      ],
+      maxAttempts: config?.maxAttempts ?? loadConfig(NODE_MAX_ATTEMPT_CONFIG_OPTIONS, config),
+      region: config?.region ?? loadConfig(NODE_REGION_CONFIG_OPTIONS, { ...NODE_REGION_CONFIG_FILE_OPTIONS, ...loaderConfig }),
+      requestHandler: NodeHttpHandler.create(config?.requestHandler ?? defaultConfigProvider),
+      retryMode: config?.retryMode ?? loadConfig({
+        ...NODE_RETRY_MODE_CONFIG_OPTIONS,
+        default: async () => (await defaultConfigProvider()).retryMode || DEFAULT_RETRY_MODE
+      }, config),
+      sigv4aSigningRegionSet: config?.sigv4aSigningRegionSet ?? loadConfig(NODE_SIGV4A_CONFIG_OPTIONS, loaderConfig),
+      streamCollector: config?.streamCollector ?? streamCollector,
+      useDualstackEndpoint: config?.useDualstackEndpoint ?? loadConfig(NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
+      useFipsEndpoint: config?.useFipsEndpoint ?? loadConfig(NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
+      userAgentAppId: config?.userAgentAppId ?? loadConfig(NODE_APP_ID_CONFIG_OPTIONS, loaderConfig)
+    };
+  };
+  var getHttpAuthExtensionConfiguration = (runtimeConfig) => {
+    const _httpAuthSchemes = runtimeConfig.httpAuthSchemes;
+    let _httpAuthSchemeProvider = runtimeConfig.httpAuthSchemeProvider;
+    let _credentials = runtimeConfig.credentials;
+    return {
+      setHttpAuthScheme(httpAuthScheme) {
+        const index = _httpAuthSchemes.findIndex((scheme) => scheme.schemeId === httpAuthScheme.schemeId);
+        if (index === -1) {
+          _httpAuthSchemes.push(httpAuthScheme);
+        } else {
+          _httpAuthSchemes.splice(index, 1, httpAuthScheme);
+        }
+      },
+      httpAuthSchemes() {
+        return _httpAuthSchemes;
+      },
+      setHttpAuthSchemeProvider(httpAuthSchemeProvider) {
+        _httpAuthSchemeProvider = httpAuthSchemeProvider;
+      },
+      httpAuthSchemeProvider() {
+        return _httpAuthSchemeProvider;
+      },
+      setCredentials(credentials) {
+        _credentials = credentials;
+      },
+      credentials() {
+        return _credentials;
+      }
+    };
+  };
+  var resolveHttpAuthRuntimeConfig = (config) => {
+    return {
+      httpAuthSchemes: config.httpAuthSchemes(),
+      httpAuthSchemeProvider: config.httpAuthSchemeProvider(),
+      credentials: config.credentials()
+    };
+  };
+  var resolveRuntimeExtensions = (runtimeConfig, extensions) => {
+    const extensionConfiguration = Object.assign(getAwsRegionExtensionConfiguration(runtimeConfig), getDefaultExtensionConfiguration(runtimeConfig), getHttpHandlerExtensionConfiguration(runtimeConfig), getHttpAuthExtensionConfiguration(runtimeConfig));
+    extensions.forEach((extension) => extension.configure(extensionConfiguration));
+    return Object.assign(runtimeConfig, resolveAwsRegionExtensionConfiguration(extensionConfiguration), resolveDefaultRuntimeConfig(extensionConfiguration), resolveHttpHandlerRuntimeConfig(extensionConfiguration), resolveHttpAuthRuntimeConfig(extensionConfiguration));
+  };
+
+  class STSClient extends Client {
+    config;
+    constructor(...[configuration]) {
+      const _config_0 = getRuntimeConfig(configuration || {});
+      super(_config_0);
+      this.initConfig = _config_0;
+      const _config_1 = resolveClientEndpointParameters(_config_0);
+      const _config_2 = resolveUserAgentConfig(_config_1);
+      const _config_3 = resolveRetryConfig(_config_2);
+      const _config_4 = resolveRegionConfig(_config_3);
+      const _config_5 = resolveHostHeaderConfig(_config_4);
+      const _config_6 = resolveEndpointConfig(_config_5);
+      const _config_7 = resolveHttpAuthSchemeConfig(_config_6);
+      const _config_8 = resolveRuntimeExtensions(_config_7, configuration?.extensions || []);
+      this.config = _config_8;
+      this.middlewareStack.use(getSchemaSerdePlugin(this.config));
+      this.middlewareStack.use(getUserAgentPlugin(this.config));
+      this.middlewareStack.use(getRetryPlugin(this.config));
+      this.middlewareStack.use(getContentLengthPlugin(this.config));
+      this.middlewareStack.use(getHostHeaderPlugin(this.config));
+      this.middlewareStack.use(getLoggerPlugin(this.config));
+      this.middlewareStack.use(getRecursionDetectionPlugin(this.config));
+      this.middlewareStack.use(getHttpAuthSchemeEndpointRuleSetPlugin(this.config, {
+        httpAuthSchemeParametersProvider: defaultSTSHttpAuthSchemeParametersProvider,
+        identityProviderConfigProvider: async (config) => new DefaultIdentityProviderConfig({
+          "aws.auth#sigv4": config.credentials,
+          "aws.auth#sigv4a": config.credentials
+        })
+      }));
+      this.middlewareStack.use(getHttpSigningPlugin(this.config));
+    }
+    destroy() {
+      super.destroy();
+    }
+  }
+  var command = makeBuilder(commonParams, "AWSSecurityTokenServiceV20110615", "STSClient", getEndpointPlugin);
+  var _ep0 = {};
+  var _mw0 = (Command, cs, config, o2) => [];
+
+  class AssumeRoleCommand extends command(_ep0, _mw0, "AssumeRole", AssumeRole$) {
+  }
+
+  class AssumeRoleWithWebIdentityCommand extends command(_ep0, _mw0, "AssumeRoleWithWebIdentity", AssumeRoleWithWebIdentity$) {
+  }
+  var commands = {
+    AssumeRoleCommand,
+    AssumeRoleWithWebIdentityCommand
+  };
+
+  class STS extends STSClient {
+  }
+  createAggregatedClient(commands, STS);
+  var getAccountIdFromAssumedRoleUser = (assumedRoleUser) => {
+    if (typeof assumedRoleUser?.Arn === "string") {
+      const arnComponents = assumedRoleUser.Arn.split(":");
+      if (arnComponents.length > 4 && arnComponents[4] !== "") {
+        return arnComponents[4];
+      }
+    }
+    return;
+  };
+  var resolveRegion = async (_region, _parentRegion, credentialProviderLogger, loaderConfig = {}) => {
+    const region = typeof _region === "function" ? await _region() : _region;
+    const parentRegion = typeof _parentRegion === "function" ? await _parentRegion() : _parentRegion;
+    let stsDefaultRegion = "";
+    const resolvedRegion = region ?? parentRegion ?? (stsDefaultRegion = await stsRegionDefaultResolver(loaderConfig)());
+    credentialProviderLogger?.debug?.("@aws-sdk/client-sts::resolveRegion", "accepting first of:", `${region} (credential provider clientConfig)`, `${parentRegion} (contextual client)`, `${stsDefaultRegion} (STS default: AWS_REGION, profile region, or us-east-1)`);
+    return resolvedRegion;
+  };
+  var getDefaultRoleAssumer$1 = (stsOptions, STSClient2) => {
+    let stsClient;
+    let closureSourceCreds;
+    return async (sourceCreds, params) => {
+      closureSourceCreds = sourceCreds;
+      if (!stsClient) {
+        const { logger = stsOptions?.parentClientConfig?.logger, profile = stsOptions?.parentClientConfig?.profile, region, requestHandler = stsOptions?.parentClientConfig?.requestHandler, credentialProviderLogger, userAgentAppId = stsOptions?.parentClientConfig?.userAgentAppId } = stsOptions;
+        const resolvedRegion = await resolveRegion(region, stsOptions?.parentClientConfig?.region, credentialProviderLogger, {
+          logger,
+          profile
+        });
+        const isCompatibleRequestHandler = !isH2(requestHandler);
+        stsClient = new STSClient2({
+          ...stsOptions,
+          userAgentAppId,
+          profile,
+          credentialDefaultProvider: () => async () => closureSourceCreds,
+          region: resolvedRegion,
+          requestHandler: isCompatibleRequestHandler ? requestHandler : undefined,
+          logger
+        });
+      }
+      const { Credentials, AssumedRoleUser } = await stsClient.send(new AssumeRoleCommand(params));
+      if (!Credentials || !Credentials.AccessKeyId || !Credentials.SecretAccessKey) {
+        throw new Error(`Invalid response from STS.assumeRole call with role ${params.RoleArn}`);
+      }
+      const accountId = getAccountIdFromAssumedRoleUser(AssumedRoleUser);
+      const credentials = {
+        accessKeyId: Credentials.AccessKeyId,
+        secretAccessKey: Credentials.SecretAccessKey,
+        sessionToken: Credentials.SessionToken,
+        expiration: Credentials.Expiration,
+        ...Credentials.CredentialScope && { credentialScope: Credentials.CredentialScope },
+        ...accountId && { accountId }
+      };
+      setCredentialFeature(credentials, "CREDENTIALS_STS_ASSUME_ROLE", "i");
+      return credentials;
+    };
+  };
+  var getDefaultRoleAssumerWithWebIdentity$1 = (stsOptions, STSClient2) => {
+    let stsClient;
+    return async (params) => {
+      if (!stsClient) {
+        const { logger = stsOptions?.parentClientConfig?.logger, profile = stsOptions?.parentClientConfig?.profile, region, requestHandler = stsOptions?.parentClientConfig?.requestHandler, credentialProviderLogger, userAgentAppId = stsOptions?.parentClientConfig?.userAgentAppId } = stsOptions;
+        const resolvedRegion = await resolveRegion(region, stsOptions?.parentClientConfig?.region, credentialProviderLogger, {
+          logger,
+          profile
+        });
+        const isCompatibleRequestHandler = !isH2(requestHandler);
+        stsClient = new STSClient2({
+          ...stsOptions,
+          userAgentAppId,
+          profile,
+          region: resolvedRegion,
+          requestHandler: isCompatibleRequestHandler ? requestHandler : undefined,
+          logger
+        });
+      }
+      const { Credentials, AssumedRoleUser } = await stsClient.send(new AssumeRoleWithWebIdentityCommand(params));
+      if (!Credentials || !Credentials.AccessKeyId || !Credentials.SecretAccessKey) {
+        throw new Error(`Invalid response from STS.assumeRoleWithWebIdentity call with role ${params.RoleArn}`);
+      }
+      const accountId = getAccountIdFromAssumedRoleUser(AssumedRoleUser);
+      const credentials = {
+        accessKeyId: Credentials.AccessKeyId,
+        secretAccessKey: Credentials.SecretAccessKey,
+        sessionToken: Credentials.SessionToken,
+        expiration: Credentials.Expiration,
+        ...Credentials.CredentialScope && { credentialScope: Credentials.CredentialScope },
+        ...accountId && { accountId }
+      };
+      if (accountId) {
+        setCredentialFeature(credentials, "RESOLVED_ACCOUNT_ID", "T");
+      }
+      setCredentialFeature(credentials, "CREDENTIALS_STS_ASSUME_ROLE_WEB_ID", "k");
+      return credentials;
+    };
+  };
+  var isH2 = (requestHandler) => {
+    return requestHandler?.metadata?.handlerProtocol === "h2";
+  };
+  var getCustomizableStsClientCtor = (baseCtor, customizations) => {
+    if (!customizations)
+      return baseCtor;
+    else
+      return class CustomizableSTSClient extends baseCtor {
+        constructor(config) {
+          super(config);
+          for (const customization of customizations) {
+            this.middlewareStack.use(customization);
+          }
+        }
+      };
+  };
+  var getDefaultRoleAssumer = (stsOptions = {}, stsPlugins) => getDefaultRoleAssumer$1(stsOptions, getCustomizableStsClientCtor(STSClient, stsPlugins));
+  var getDefaultRoleAssumerWithWebIdentity = (stsOptions = {}, stsPlugins) => getDefaultRoleAssumerWithWebIdentity$1(stsOptions, getCustomizableStsClientCtor(STSClient, stsPlugins));
+  var decorateDefaultCredentialProvider = (provider) => (input) => provider({
+    roleAssumer: getDefaultRoleAssumer(input),
+    roleAssumerWithWebIdentity: getDefaultRoleAssumerWithWebIdentity(input),
+    ...input
+  });
+  exports.AssumeRole$ = AssumeRole$;
+  exports.AssumeRoleCommand = AssumeRoleCommand;
+  exports.AssumeRoleRequest$ = AssumeRoleRequest$;
+  exports.AssumeRoleResponse$ = AssumeRoleResponse$;
+  exports.AssumeRoleWithWebIdentity$ = AssumeRoleWithWebIdentity$;
+  exports.AssumeRoleWithWebIdentityCommand = AssumeRoleWithWebIdentityCommand;
+  exports.AssumeRoleWithWebIdentityRequest$ = AssumeRoleWithWebIdentityRequest$;
+  exports.AssumeRoleWithWebIdentityResponse$ = AssumeRoleWithWebIdentityResponse$;
+  exports.AssumedRoleUser$ = AssumedRoleUser$;
+  exports.Credentials$ = Credentials$;
+  exports.ExpiredTokenException = ExpiredTokenException;
+  exports.ExpiredTokenException$ = ExpiredTokenException$;
+  exports.IDPCommunicationErrorException = IDPCommunicationErrorException;
+  exports.IDPCommunicationErrorException$ = IDPCommunicationErrorException$;
+  exports.IDPRejectedClaimException = IDPRejectedClaimException;
+  exports.IDPRejectedClaimException$ = IDPRejectedClaimException$;
+  exports.InvalidIdentityTokenException = InvalidIdentityTokenException;
+  exports.InvalidIdentityTokenException$ = InvalidIdentityTokenException$;
+  exports.MalformedPolicyDocumentException = MalformedPolicyDocumentException;
+  exports.MalformedPolicyDocumentException$ = MalformedPolicyDocumentException$;
+  exports.PackedPolicyTooLargeException = PackedPolicyTooLargeException;
+  exports.PackedPolicyTooLargeException$ = PackedPolicyTooLargeException$;
+  exports.PolicyDescriptorType$ = PolicyDescriptorType$;
+  exports.ProvidedContext$ = ProvidedContext$;
+  exports.RegionDisabledException = RegionDisabledException;
+  exports.RegionDisabledException$ = RegionDisabledException$;
+  exports.STS = STS;
+  exports.STSClient = STSClient;
+  exports.STSServiceException = STSServiceException;
+  exports.STSServiceException$ = STSServiceException$;
+  exports.Tag$ = Tag$;
+  exports.decorateDefaultCredentialProvider = decorateDefaultCredentialProvider;
+  exports.errorTypeRegistries = errorTypeRegistries;
+  exports.getDefaultRoleAssumer = getDefaultRoleAssumer;
+  exports.getDefaultRoleAssumerWithWebIdentity = getDefaultRoleAssumerWithWebIdentity;
+});
+
+// node_modules/@aws-sdk/nested-clients/dist-cjs/submodules/signin/index.js
+var require_signin = __commonJS(function(exports) {
+  var { awsEndpointFunctions, emitWarningIfUnsupportedVersion: emitWarningIfUnsupportedVersion$1, createDefaultUserAgentProvider, NODE_APP_ID_CONFIG_OPTIONS, getAwsRegionExtensionConfiguration, resolveAwsRegionExtensionConfiguration, resolveUserAgentConfig, resolveHostHeaderConfig, getUserAgentPlugin, getHostHeaderPlugin, getLoggerPlugin, getRecursionDetectionPlugin } = require_client2();
+  var { NoAuthSigner, getHttpAuthSchemeEndpointRuleSetPlugin, DefaultIdentityProviderConfig, getHttpSigningPlugin } = require_dist_cjs();
+  var { normalizeProvider, getSmithyContext, ServiceException, NoOpLogger, emitWarningIfUnsupportedVersion, loadConfigsForDefaultMode, getDefaultExtensionConfiguration, resolveDefaultRuntimeConfig, Client, makeBuilder, createAggregatedClient } = require_client();
+  var { Command: $Command } = require_client();
+  exports.$Command = $Command;
+  exports.__Client = Client;
+  var { resolveDefaultsModeConfig, loadConfig, NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, NODE_REGION_CONFIG_OPTIONS, NODE_REGION_CONFIG_FILE_OPTIONS, resolveRegionConfig } = require_config();
+  var { BinaryDecisionDiagram, EndpointCache, decideEndpoint, customEndpointFunctions, resolveEndpointConfig, getEndpointPlugin } = require_endpoints();
+  var { parseUrl, getHttpHandlerExtensionConfiguration, resolveHttpHandlerRuntimeConfig, getContentLengthPlugin } = require_protocols();
+  var { DEFAULT_RETRY_MODE, NODE_RETRY_MODE_CONFIG_OPTIONS, NODE_MAX_ATTEMPT_CONFIG_OPTIONS, resolveRetryConfig, getRetryPlugin } = require_retry();
+  var { TypeRegistry, getSchemaSerdePlugin } = require_schema();
+  var { resolveAwsSdkSigV4Config, AwsSdkSigV4Signer, NODE_AUTH_SCHEME_PREFERENCE_OPTIONS } = require_httpAuthSchemes();
+  var { toUtf8, fromUtf8, toBase64, fromBase64, calculateBodyLength } = require_serde();
+  var { streamCollector, NodeHttpHandler } = require_dist_cjs3();
+  var { AwsRestJsonProtocol } = require_protocols2();
+  var { Sha256 } = require_checksum();
+  var defaultSigninHttpAuthSchemeParametersProvider = async (config, context, input) => {
+    return {
+      operation: getSmithyContext(context).operation,
+      region: await normalizeProvider(config.region)() || (() => {
+        throw new Error("expected `region` to be configured for `aws.auth#sigv4`");
+      })()
+    };
+  };
+  function createAwsAuthSigv4HttpAuthOption(authParameters) {
+    return {
+      schemeId: "aws.auth#sigv4",
+      signingProperties: {
+        name: "signin",
+        region: authParameters.region
+      },
+      propertiesExtractor: (config, context) => ({
+        signingProperties: {
+          config,
+          context
+        }
+      })
+    };
+  }
+  function createSmithyApiNoAuthHttpAuthOption(authParameters) {
+    return {
+      schemeId: "smithy.api#noAuth"
+    };
+  }
+  var defaultSigninHttpAuthSchemeProvider = (authParameters) => {
+    const options = [];
+    switch (authParameters.operation) {
+      case "CreateOAuth2Token": {
+        options.push(createSmithyApiNoAuthHttpAuthOption());
+        break;
+      }
+      default: {
+        options.push(createAwsAuthSigv4HttpAuthOption(authParameters));
+      }
+    }
+    return options;
+  };
+  var resolveHttpAuthSchemeConfig = (config) => {
+    const config_0 = resolveAwsSdkSigV4Config(config);
+    return Object.assign(config_0, {
+      authSchemePreference: normalizeProvider(config.authSchemePreference ?? [])
+    });
+  };
+  var resolveClientEndpointParameters = (options) => {
+    return Object.assign(options, {
+      useDualstackEndpoint: options.useDualstackEndpoint ?? false,
+      useFipsEndpoint: options.useFipsEndpoint ?? false,
+      defaultSigningName: "signin"
+    });
+  };
+  var commonParams = {
+    UseFIPS: { type: "builtInParams", name: "useFipsEndpoint" },
+    Endpoint: { type: "builtInParams", name: "endpoint" },
+    Region: { type: "builtInParams", name: "region" },
+    UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" }
+  };
+  var version = "3.997.45";
+  var packageInfo = {
+    version
+  };
+  var s = "ref";
+  var a = -1;
+  var b = false;
+  var c = true;
+  var d = "isSet";
+  var e = "booleanEquals";
+  var f = "coalesce";
+  var g = "PartitionResult";
+  var h = "stringEquals";
+  var i = "getAttr";
+  var j = "https://signin.{Region}.{PartitionResult#dualStackDnsSuffix}";
+  var k = { [s]: "Endpoint" };
+  var l = { fn: i, argv: [{ [s]: g }, "name"] };
+  var m = { [s]: "Region" };
+  var n = { [s]: g };
+  var o = { authSchemes: [{ name: "sigv4", signingName: "signin", signingRegion: "{Region}" }] };
+  var p = {};
+  var q = [m];
+  var _data = {
+    conditions: [
+      [d, q],
+      [e, [{ fn: f, argv: [{ [s]: "IsControlPlane" }, b] }, c]],
+      [d, [k]],
+      ["aws.partition", q, g],
+      [e, [{ [s]: "UseFIPS" }, c]],
+      [h, [l, "aws"]],
+      [e, [{ fn: f, argv: [{ [s]: "IsOAuthEndpoint" }, b] }, c]],
+      [e, [{ [s]: "UseDualStack" }, c]],
+      [h, [l, "aws-cn"]],
+      [h, [m, "us-gov-west-1"]],
+      [h, [l, "aws-us-gov"]],
+      [e, [{ fn: i, argv: [n, "supportsFIPS"] }, c]],
+      [h, [l, "aws-iso"]],
+      [h, [l, "aws-iso-b"]],
+      [h, [l, "aws-iso-f"]],
+      [h, [l, "aws-iso-e"]],
+      [h, [l, "aws-eusc"]],
+      [e, [{ fn: i, argv: [n, "supportsDualStack"] }, c]]
+    ],
+    results: [
+      [a],
+      ["https://signin.{Region}.api.aws", o],
+      ["https://signin.{Region}.api.amazonwebservices.com.cn", o],
+      [j, o],
+      [a, "FIPS endpoints are not supported for OAuth operations. Disable FIPS or use a non-OAuth operation."],
+      ["https://{Region}.oauth.signin.aws", o],
+      ["https://{Region}.signin.aws.amazon.com", p],
+      ["https://{Region}.signin.amazonaws.cn", p],
+      ["https://{Region}.signin.amazonaws-us-gov.com", p],
+      ["https://{Region}.signin.c2shome.ic.gov", p],
+      ["https://{Region}.signin.sc2shome.sgov.gov", p],
+      ["https://{Region}.signin.csphome.hci.ic.gov", p],
+      ["https://{Region}.signin.csphome.adc-e.uk", p],
+      ["https://{Region}.signin.amazonaws-eusc.eu", p],
+      ["https://signin-fips.amazonaws-us-gov.com", p],
+      ["https://{Region}.signin-fips.amazonaws-us-gov.com", p],
+      ["https://{Region}.signin.{PartitionResult#dnsSuffix}", p],
+      [a, "Invalid Configuration: FIPS and custom endpoint are not supported"],
+      [a, "Invalid Configuration: Dualstack and custom endpoint are not supported"],
+      [k, p],
+      ["https://signin-fips.{Region}.{PartitionResult#dualStackDnsSuffix}", p],
+      [a, "FIPS and DualStack are enabled, but this partition does not support one or both"],
+      ["https://signin-fips.{Region}.{PartitionResult#dnsSuffix}", p],
+      [a, "FIPS is enabled but this partition does not support FIPS"],
+      [j, p],
+      [a, "DualStack is enabled but this partition does not support DualStack"],
+      ["https://signin.{Region}.{PartitionResult#dnsSuffix}", p],
+      [a, "Invalid Configuration: Missing Region"]
+    ]
+  };
+  var root = 2;
+  var r = 1e8;
+  var nodes = new Int32Array([
+    -1,
+    1,
+    -1,
+    0,
+    6,
+    3,
+    2,
+    36,
+    4,
+    4,
+    5,
+    r + 27,
+    6,
+    r + 4,
+    r + 27,
+    1,
+    29,
+    7,
+    2,
+    36,
+    8,
+    3,
+    9,
+    31,
+    4,
+    22,
+    10,
+    5,
+    19,
+    11,
+    7,
+    21,
+    12,
+    8,
+    r + 7,
+    13,
+    10,
+    r + 8,
+    14,
+    12,
+    r + 9,
+    15,
+    13,
+    r + 10,
+    16,
+    14,
+    r + 11,
+    17,
+    15,
+    r + 12,
+    18,
+    16,
+    r + 13,
+    r + 16,
+    6,
+    r + 5,
+    20,
+    7,
+    21,
+    r + 6,
+    17,
+    r + 24,
+    r + 25,
+    6,
+    r + 4,
+    23,
+    7,
+    27,
+    24,
+    9,
+    r + 14,
+    25,
+    10,
+    r + 15,
+    26,
+    11,
+    r + 22,
+    r + 23,
+    11,
+    28,
+    r + 21,
+    17,
+    r + 20,
+    r + 21,
+    2,
+    35,
+    30,
+    3,
+    39,
+    31,
+    4,
+    32,
+    r + 27,
+    6,
+    r + 4,
+    33,
+    7,
+    r + 27,
+    34,
+    9,
+    r + 14,
+    r + 27,
+    3,
+    39,
+    36,
+    4,
+    38,
+    37,
+    7,
+    r + 18,
+    r + 19,
+    6,
+    r + 4,
+    r + 17,
+    5,
+    r + 1,
+    40,
+    8,
+    r + 2,
+    r + 3
+  ]);
+  var bdd = BinaryDecisionDiagram.from(nodes, root, _data.conditions, _data.results);
+  var cache = new EndpointCache({
+    size: 50,
+    params: ["Endpoint", "IsControlPlane", "IsOAuthEndpoint", "Region", "UseDualStack", "UseFIPS"]
+  });
+  var defaultEndpointResolver = (endpointParams, context = {}) => {
+    return cache.get(endpointParams, () => decideEndpoint(bdd, {
+      endpointParams,
+      logger: context.logger
+    }));
+  };
+  customEndpointFunctions.aws = awsEndpointFunctions;
+
+  class SigninServiceException extends ServiceException {
+    constructor(options) {
+      super(options);
+      Object.setPrototypeOf(this, SigninServiceException.prototype);
+    }
+  }
+
+  class AccessDeniedException extends SigninServiceException {
+    name = "AccessDeniedException";
+    $fault = "client";
+    error;
+    constructor(opts) {
+      super({
+        name: "AccessDeniedException",
+        $fault: "client",
+        ...opts
+      });
+      Object.setPrototypeOf(this, AccessDeniedException.prototype);
+      this.error = opts.error;
+    }
+  }
+
+  class InternalServerException extends SigninServiceException {
+    name = "InternalServerException";
+    $fault = "server";
+    error;
+    constructor(opts) {
+      super({
+        name: "InternalServerException",
+        $fault: "server",
+        ...opts
+      });
+      Object.setPrototypeOf(this, InternalServerException.prototype);
+      this.error = opts.error;
+    }
+  }
+
+  class TooManyRequestsError extends SigninServiceException {
+    name = "TooManyRequestsError";
+    $fault = "client";
+    error;
+    constructor(opts) {
+      super({
+        name: "TooManyRequestsError",
+        $fault: "client",
+        ...opts
+      });
+      Object.setPrototypeOf(this, TooManyRequestsError.prototype);
+      this.error = opts.error;
+    }
+  }
+
+  class ValidationException extends SigninServiceException {
+    name = "ValidationException";
+    $fault = "client";
+    error;
+    constructor(opts) {
+      super({
+        name: "ValidationException",
+        $fault: "client",
+        ...opts
+      });
+      Object.setPrototypeOf(this, ValidationException.prototype);
+      this.error = opts.error;
+    }
+  }
+  var _ADE = "AccessDeniedException";
+  var _AT = "AccessToken";
+  var _COAT = "CreateOAuth2Token";
+  var _COATR = "CreateOAuth2TokenRequest";
+  var _COATRB = "CreateOAuth2TokenRequestBody";
+  var _COATRBr = "CreateOAuth2TokenResponseBody";
+  var _COATRr = "CreateOAuth2TokenResponse";
+  var _COATWIAM = "CreateOAuth2TokenWithIAM";
+  var _COATWIAMR = "CreateOAuth2TokenWithIAMRequest";
+  var _COATWIAMRr = "CreateOAuth2TokenWithIAMResponse";
+  var _ISE = "InternalServerException";
+  var _OAAT = "OAuthAccessToken";
+  var _RT = "RefreshToken";
+  var _TMRE = "TooManyRequestsError";
+  var _VE = "ValidationException";
+  var _aKI = "accessKeyId";
+  var _aT = "accessToken";
+  var _at = "access_token";
+  var _c = "client";
+  var _cI = "clientId";
+  var _cV = "codeVerifier";
+  var _co = "code";
+  var _e = "error";
+  var _eI = "expiresIn";
+  var _ei = "expires_in";
+  var _gT = "grantType";
+  var _gt = "grant_type";
+  var _h = "http";
+  var _hE = "httpError";
+  var _iT = "idToken";
+  var _jN = "jsonName";
+  var _m = "message";
+  var _r = "resource";
+  var _rT = "refreshToken";
+  var _rU = "redirectUri";
+  var _s = "smithy.ts.sdk.synthetic.com.amazonaws.signin";
+  var _sAK = "secretAccessKey";
+  var _sT = "sessionToken";
+  var _se = "server";
+  var _tI = "tokenInput";
+  var _tO = "tokenOutput";
+  var _tT = "tokenType";
+  var _tt = "token_type";
+  var n0 = "com.amazonaws.signin";
+  var _s_registry = new TypeRegistry(_s);
+  var SigninServiceException$ = [-3, _s, "SigninServiceException", 0, [], []];
+  _s_registry.registerError(SigninServiceException$, SigninServiceException);
+  var n0_registry = new TypeRegistry(n0);
+  var AccessDeniedException$ = [
+    -3,
+    n0,
+    _ADE,
+    { [_e]: _c },
+    [_e, _m],
+    [0, 0],
+    2
+  ];
+  n0_registry.registerError(AccessDeniedException$, AccessDeniedException);
+  var InternalServerException$ = [
+    -3,
+    n0,
+    _ISE,
+    { [_e]: _se, [_hE]: 500 },
+    [_e, _m],
+    [0, 0],
+    2
+  ];
+  n0_registry.registerError(InternalServerException$, InternalServerException);
+  var TooManyRequestsError$ = [
+    -3,
+    n0,
+    _TMRE,
+    { [_e]: _c, [_hE]: 429 },
+    [_e, _m],
+    [0, 0],
+    2
+  ];
+  n0_registry.registerError(TooManyRequestsError$, TooManyRequestsError);
+  var ValidationException$ = [
+    -3,
+    n0,
+    _VE,
+    { [_e]: _c, [_hE]: 400 },
+    [_e, _m],
+    [0, 0],
+    2
+  ];
+  n0_registry.registerError(ValidationException$, ValidationException);
+  var errorTypeRegistries = [
+    _s_registry,
+    n0_registry
+  ];
+  var OAuthAccessToken = [0, n0, _OAAT, 8, 0];
+  var RefreshToken = [0, n0, _RT, 8, 0];
+  var AccessToken$ = [
+    3,
+    n0,
+    _AT,
+    8,
+    [_aKI, _sAK, _sT],
+    [[0, { [_jN]: _aKI }], [0, { [_jN]: _sAK }], [0, { [_jN]: _sT }]],
+    3
+  ];
+  var CreateOAuth2TokenRequest$ = [
+    3,
+    n0,
+    _COATR,
+    0,
+    [_tI],
+    [[() => CreateOAuth2TokenRequestBody$, 16]],
+    1
+  ];
+  var CreateOAuth2TokenRequestBody$ = [
+    3,
+    n0,
+    _COATRB,
+    0,
+    [_cI, _gT, _co, _rU, _cV, _rT],
+    [[0, { [_jN]: _cI }], [0, { [_jN]: _gT }], 0, [0, { [_jN]: _rU }], [0, { [_jN]: _cV }], [() => RefreshToken, { [_jN]: _rT }]],
+    2
+  ];
+  var CreateOAuth2TokenResponse$ = [
+    3,
+    n0,
+    _COATRr,
+    0,
+    [_tO],
+    [[() => CreateOAuth2TokenResponseBody$, 16]],
+    1
+  ];
+  var CreateOAuth2TokenResponseBody$ = [
+    3,
+    n0,
+    _COATRBr,
+    0,
+    [_aT, _tT, _eI, _rT, _iT],
+    [[() => AccessToken$, { [_jN]: _aT }], [0, { [_jN]: _tT }], [1, { [_jN]: _eI }], [() => RefreshToken, { [_jN]: _rT }], [0, { [_jN]: _iT }]],
+    4
+  ];
+  var CreateOAuth2TokenWithIAMRequest$ = [
+    3,
+    n0,
+    _COATWIAMR,
+    0,
+    [_gT, _r],
+    [[0, { [_jN]: _gt }], 0],
+    2
+  ];
+  var CreateOAuth2TokenWithIAMResponse$ = [
+    3,
+    n0,
+    _COATWIAMRr,
+    0,
+    [_aT, _tT, _eI],
+    [[() => OAuthAccessToken, { [_jN]: _at }], [0, { [_jN]: _tt }], [1, { [_jN]: _ei }]],
+    3
+  ];
+  var CreateOAuth2Token$ = [
+    9,
+    n0,
+    _COAT,
+    { [_h]: ["POST", "/v1/token", 200] },
+    () => CreateOAuth2TokenRequest$,
+    () => CreateOAuth2TokenResponse$
+  ];
+  var CreateOAuth2TokenWithIAM$ = [
+    9,
+    n0,
+    _COATWIAM,
+    { [_h]: ["POST", "/v1/token?x-amz-client-auth-method=iam", 200] },
+    () => CreateOAuth2TokenWithIAMRequest$,
+    () => CreateOAuth2TokenWithIAMResponse$
+  ];
+  var getRuntimeConfig$1 = (config) => {
+    return {
+      apiVersion: "2023-01-01",
+      base64Decoder: config?.base64Decoder ?? fromBase64,
+      base64Encoder: config?.base64Encoder ?? toBase64,
+      disableHostPrefix: config?.disableHostPrefix ?? false,
+      endpointProvider: config?.endpointProvider ?? defaultEndpointResolver,
+      extensions: config?.extensions ?? [],
+      httpAuthSchemeProvider: config?.httpAuthSchemeProvider ?? defaultSigninHttpAuthSchemeProvider,
+      httpAuthSchemes: config?.httpAuthSchemes ?? [
+        {
+          schemeId: "aws.auth#sigv4",
+          identityProvider: (ipc) => ipc.getIdentityProvider("aws.auth#sigv4"),
+          signer: new AwsSdkSigV4Signer
+        },
+        {
+          schemeId: "smithy.api#noAuth",
+          identityProvider: (ipc) => ipc.getIdentityProvider("smithy.api#noAuth") || (async () => ({})),
+          signer: new NoAuthSigner
+        }
+      ],
+      logger: config?.logger ?? new NoOpLogger,
+      protocol: config?.protocol ?? AwsRestJsonProtocol,
+      protocolSettings: config?.protocolSettings ?? {
+        defaultNamespace: "com.amazonaws.signin",
+        errorTypeRegistries,
+        version: "2023-01-01",
+        serviceTarget: "Signin"
+      },
+      serviceId: config?.serviceId ?? "Signin",
+      sha256: config?.sha256 ?? Sha256,
+      urlParser: config?.urlParser ?? parseUrl,
+      utf8Decoder: config?.utf8Decoder ?? fromUtf8,
+      utf8Encoder: config?.utf8Encoder ?? toUtf8
+    };
+  };
+  var getRuntimeConfig = (config) => {
+    emitWarningIfUnsupportedVersion(process.version);
+    const defaultsMode = resolveDefaultsModeConfig(config);
+    const defaultConfigProvider = () => defaultsMode().then(loadConfigsForDefaultMode);
+    const clientSharedValues = getRuntimeConfig$1(config);
+    emitWarningIfUnsupportedVersion$1(process.version);
+    const loaderConfig = {
+      profile: config?.profile,
+      logger: clientSharedValues.logger
+    };
+    return {
+      ...clientSharedValues,
+      ...config,
+      runtime: "node",
+      defaultsMode,
+      authSchemePreference: config?.authSchemePreference ?? loadConfig(NODE_AUTH_SCHEME_PREFERENCE_OPTIONS, loaderConfig),
+      bodyLengthChecker: config?.bodyLengthChecker ?? calculateBodyLength,
+      defaultUserAgentProvider: config?.defaultUserAgentProvider ?? createDefaultUserAgentProvider({ serviceId: clientSharedValues.serviceId, clientVersion: packageInfo.version }),
+      maxAttempts: config?.maxAttempts ?? loadConfig(NODE_MAX_ATTEMPT_CONFIG_OPTIONS, config),
+      region: config?.region ?? loadConfig(NODE_REGION_CONFIG_OPTIONS, { ...NODE_REGION_CONFIG_FILE_OPTIONS, ...loaderConfig }),
+      requestHandler: NodeHttpHandler.create(config?.requestHandler ?? defaultConfigProvider),
+      retryMode: config?.retryMode ?? loadConfig({
+        ...NODE_RETRY_MODE_CONFIG_OPTIONS,
+        default: async () => (await defaultConfigProvider()).retryMode || DEFAULT_RETRY_MODE
+      }, config),
+      streamCollector: config?.streamCollector ?? streamCollector,
+      useDualstackEndpoint: config?.useDualstackEndpoint ?? loadConfig(NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
+      useFipsEndpoint: config?.useFipsEndpoint ?? loadConfig(NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS, loaderConfig),
+      userAgentAppId: config?.userAgentAppId ?? loadConfig(NODE_APP_ID_CONFIG_OPTIONS, loaderConfig)
+    };
+  };
+  var getHttpAuthExtensionConfiguration = (runtimeConfig) => {
+    const _httpAuthSchemes = runtimeConfig.httpAuthSchemes;
+    let _httpAuthSchemeProvider = runtimeConfig.httpAuthSchemeProvider;
+    let _credentials = runtimeConfig.credentials;
+    return {
+      setHttpAuthScheme(httpAuthScheme) {
+        const index = _httpAuthSchemes.findIndex((scheme) => scheme.schemeId === httpAuthScheme.schemeId);
+        if (index === -1) {
+          _httpAuthSchemes.push(httpAuthScheme);
+        } else {
+          _httpAuthSchemes.splice(index, 1, httpAuthScheme);
+        }
+      },
+      httpAuthSchemes() {
+        return _httpAuthSchemes;
+      },
+      setHttpAuthSchemeProvider(httpAuthSchemeProvider) {
+        _httpAuthSchemeProvider = httpAuthSchemeProvider;
+      },
+      httpAuthSchemeProvider() {
+        return _httpAuthSchemeProvider;
+      },
+      setCredentials(credentials) {
+        _credentials = credentials;
+      },
+      credentials() {
+        return _credentials;
+      }
+    };
+  };
+  var resolveHttpAuthRuntimeConfig = (config) => {
+    return {
+      httpAuthSchemes: config.httpAuthSchemes(),
+      httpAuthSchemeProvider: config.httpAuthSchemeProvider(),
+      credentials: config.credentials()
+    };
+  };
+  var resolveRuntimeExtensions = (runtimeConfig, extensions) => {
+    const extensionConfiguration = Object.assign(getAwsRegionExtensionConfiguration(runtimeConfig), getDefaultExtensionConfiguration(runtimeConfig), getHttpHandlerExtensionConfiguration(runtimeConfig), getHttpAuthExtensionConfiguration(runtimeConfig));
+    extensions.forEach((extension) => extension.configure(extensionConfiguration));
+    return Object.assign(runtimeConfig, resolveAwsRegionExtensionConfiguration(extensionConfiguration), resolveDefaultRuntimeConfig(extensionConfiguration), resolveHttpHandlerRuntimeConfig(extensionConfiguration), resolveHttpAuthRuntimeConfig(extensionConfiguration));
+  };
+
+  class SigninClient extends Client {
+    config;
+    constructor(...[configuration]) {
+      const _config_0 = getRuntimeConfig(configuration || {});
+      super(_config_0);
+      this.initConfig = _config_0;
+      const _config_1 = resolveClientEndpointParameters(_config_0);
+      const _config_2 = resolveUserAgentConfig(_config_1);
+      const _config_3 = resolveRetryConfig(_config_2);
+      const _config_4 = resolveRegionConfig(_config_3);
+      const _config_5 = resolveHostHeaderConfig(_config_4);
+      const _config_6 = resolveEndpointConfig(_config_5);
+      const _config_7 = resolveHttpAuthSchemeConfig(_config_6);
+      const _config_8 = resolveRuntimeExtensions(_config_7, configuration?.extensions || []);
+      this.config = _config_8;
+      this.middlewareStack.use(getSchemaSerdePlugin(this.config));
+      this.middlewareStack.use(getUserAgentPlugin(this.config));
+      this.middlewareStack.use(getRetryPlugin(this.config));
+      this.middlewareStack.use(getContentLengthPlugin(this.config));
+      this.middlewareStack.use(getHostHeaderPlugin(this.config));
+      this.middlewareStack.use(getLoggerPlugin(this.config));
+      this.middlewareStack.use(getRecursionDetectionPlugin(this.config));
+      this.middlewareStack.use(getHttpAuthSchemeEndpointRuleSetPlugin(this.config, {
+        httpAuthSchemeParametersProvider: defaultSigninHttpAuthSchemeParametersProvider,
+        identityProviderConfigProvider: async (config) => new DefaultIdentityProviderConfig({
+          "aws.auth#sigv4": config.credentials
+        })
+      }));
+      this.middlewareStack.use(getHttpSigningPlugin(this.config));
+    }
+    destroy() {
+      super.destroy();
+    }
+  }
+  var command = makeBuilder(commonParams, "Signin", "SigninClient", getEndpointPlugin);
+  var _ep0 = {
+    IsControlPlane: { type: "staticContextParams", value: false }
+  };
+  var _ep1 = {
+    IsOAuthEndpoint: { type: "staticContextParams", value: true }
+  };
+  var _mw0 = (Command, cs, config, o2) => [];
+
+  class CreateOAuth2TokenCommand extends command(_ep0, _mw0, "CreateOAuth2Token", CreateOAuth2Token$) {
+  }
+
+  class CreateOAuth2TokenWithIAMCommand extends command(_ep1, _mw0, "CreateOAuth2TokenWithIAM", CreateOAuth2TokenWithIAM$) {
+  }
+  var commands = {
+    CreateOAuth2TokenCommand,
+    CreateOAuth2TokenWithIAMCommand
+  };
+
+  class Signin extends SigninClient {
+  }
+  createAggregatedClient(commands, Signin);
+  var OAuth2ErrorCode = {
+    AUTHCODE_EXPIRED: "AUTHCODE_EXPIRED",
+    CONFLICT: "CONFLICT",
+    INSUFFICIENT_PERMISSIONS: "INSUFFICIENT_PERMISSIONS",
+    INVALID_REQUEST: "INVALID_REQUEST",
+    RESOURCE_NOT_FOUND: "RESOURCE_NOT_FOUND",
+    SERVER_ERROR: "server_error",
+    SERVICE_QUOTA_EXCEEDED: "SERVICE_QUOTA_EXCEEDED",
+    TOKEN_EXPIRED: "TOKEN_EXPIRED",
+    USER_CREDENTIALS_CHANGED: "USER_CREDENTIALS_CHANGED"
+  };
+  exports.AccessDeniedException = AccessDeniedException;
+  exports.AccessDeniedException$ = AccessDeniedException$;
+  exports.AccessToken$ = AccessToken$;
+  exports.CreateOAuth2Token$ = CreateOAuth2Token$;
+  exports.CreateOAuth2TokenCommand = CreateOAuth2TokenCommand;
+  exports.CreateOAuth2TokenRequest$ = CreateOAuth2TokenRequest$;
+  exports.CreateOAuth2TokenRequestBody$ = CreateOAuth2TokenRequestBody$;
+  exports.CreateOAuth2TokenResponse$ = CreateOAuth2TokenResponse$;
+  exports.CreateOAuth2TokenResponseBody$ = CreateOAuth2TokenResponseBody$;
+  exports.CreateOAuth2TokenWithIAM$ = CreateOAuth2TokenWithIAM$;
+  exports.CreateOAuth2TokenWithIAMCommand = CreateOAuth2TokenWithIAMCommand;
+  exports.CreateOAuth2TokenWithIAMRequest$ = CreateOAuth2TokenWithIAMRequest$;
+  exports.CreateOAuth2TokenWithIAMResponse$ = CreateOAuth2TokenWithIAMResponse$;
+  exports.InternalServerException = InternalServerException;
+  exports.InternalServerException$ = InternalServerException$;
+  exports.OAuth2ErrorCode = OAuth2ErrorCode;
+  exports.Signin = Signin;
+  exports.SigninClient = SigninClient;
+  exports.SigninServiceException = SigninServiceException;
+  exports.SigninServiceException$ = SigninServiceException$;
+  exports.TooManyRequestsError = TooManyRequestsError;
+  exports.TooManyRequestsError$ = TooManyRequestsError$;
+  exports.ValidationException = ValidationException;
+  exports.ValidationException$ = ValidationException$;
+  exports.errorTypeRegistries = errorTypeRegistries;
+});
+
+// node_modules/@aws-sdk/credential-provider-login/dist-cjs/index.js
+var require_dist_cjs10 = __commonJS(function(exports) {
+  var { setCredentialFeature } = require_client2();
+  var { CredentialsProviderError, parseKnownFiles, getProfileName } = require_config();
+  var { HttpRequest } = require_protocols();
+  var { createHash, createPrivateKey, createPublicKey, sign } = __require("node:crypto");
+  var { promises } = __require("node:fs");
+  var { homedir } = __require("node:os");
+  var { dirname, join } = __require("node:path");
+
+  class LoginCredentialsFetcher {
+    profileData;
+    init;
+    callerClientConfig;
+    static REFRESH_THRESHOLD = 5 * 60 * 1000;
+    constructor(profileData, init, callerClientConfig) {
+      this.profileData = profileData;
+      this.init = init;
+      this.callerClientConfig = callerClientConfig;
+    }
+    async loadCredentials() {
+      const token = await this.loadToken();
+      if (!token) {
+        throw new CredentialsProviderError(`Failed to load a token for session ${this.loginSession}, please re-authenticate using aws login`, { tryNextLink: false, logger: this.logger });
+      }
+      const accessToken = token.accessToken;
+      const now = Date.now();
+      const expiryTime = new Date(accessToken.expiresAt).getTime();
+      const timeUntilExpiry = expiryTime - now;
+      if (timeUntilExpiry <= LoginCredentialsFetcher.REFRESH_THRESHOLD) {
+        return this.refresh(token);
+      }
+      return this.toCredentials(token.accessToken);
+    }
+    get logger() {
+      return this.init?.logger;
+    }
+    get loginSession() {
+      return this.profileData.login_session;
+    }
+    toCredentials(token) {
+      return {
+        accessKeyId: token.accessKeyId,
+        secretAccessKey: token.secretAccessKey,
+        sessionToken: token.sessionToken,
+        accountId: token.accountId,
+        expiration: new Date(token.expiresAt)
+      };
+    }
+    async refresh(token) {
+      const diskToken = await this.loadToken().catch(() => token);
+      const now = Date.now();
+      const diskExpiry = new Date(diskToken.accessToken.expiresAt).getTime();
+      const tokenExpiry = new Date(token.accessToken.expiresAt).getTime();
+      const freshToken = diskExpiry <= now && tokenExpiry > now ? token : diskToken;
+      const freshExpiry = new Date(freshToken.accessToken.expiresAt).getTime();
+      if (freshExpiry - Date.now() > LoginCredentialsFetcher.REFRESH_THRESHOLD) {
+        return this.toCredentials(freshToken.accessToken);
+      }
+      const { SigninClient, CreateOAuth2TokenCommand } = require_signin();
+      const { logger, userAgentAppId } = this.callerClientConfig ?? {};
+      const isH2 = (requestHandler2) => {
+        return requestHandler2?.metadata?.handlerProtocol === "h2";
+      };
+      const requestHandler = isH2(this.callerClientConfig?.requestHandler) ? undefined : this.callerClientConfig?.requestHandler;
+      const region = this.profileData.region ?? await this.callerClientConfig?.region?.() ?? process.env.AWS_REGION;
+      const client = new SigninClient({
+        credentials: {
+          accessKeyId: "",
+          secretAccessKey: ""
+        },
+        region,
+        requestHandler,
+        logger,
+        userAgentAppId,
+        ...this.init?.clientConfig
+      });
+      this.createDPoPInterceptor(client.middlewareStack);
+      const commandInput = {
+        tokenInput: {
+          clientId: freshToken.clientId,
+          refreshToken: freshToken.refreshToken,
+          grantType: "refresh_token"
+        }
+      };
+      try {
+        const response = await client.send(new CreateOAuth2TokenCommand(commandInput));
+        const { accessKeyId, secretAccessKey, sessionToken } = response.tokenOutput?.accessToken ?? {};
+        const { refreshToken, expiresIn } = response.tokenOutput ?? {};
+        if (!accessKeyId || !secretAccessKey || !sessionToken || !refreshToken) {
+          throw new CredentialsProviderError("Token refresh response missing required fields", {
+            logger: this.logger,
+            tryNextLink: false
+          });
+        }
+        const expiresInMs = (expiresIn ?? 900) * 1000;
+        const expiration = new Date(Date.now() + expiresInMs);
+        const updatedToken = {
+          ...freshToken,
+          accessToken: {
+            ...freshToken.accessToken,
+            accessKeyId,
+            secretAccessKey,
+            sessionToken,
+            expiresAt: expiration.toISOString()
+          },
+          refreshToken
+        };
+        await this.saveToken(updatedToken);
+        return this.toCredentials(updatedToken.accessToken);
+      } catch (error) {
+        if (error.name === "AccessDeniedException") {
+          const errorType = error.error;
+          let message;
+          switch (errorType) {
+            case "TOKEN_EXPIRED":
+              message = "Your session has expired. Please reauthenticate.";
+              break;
+            case "USER_CREDENTIALS_CHANGED":
+              message = "Unable to refresh credentials because of a change in your password. Please reauthenticate with your new password.";
+              break;
+            case "INSUFFICIENT_PERMISSIONS":
+              message = "Unable to refresh credentials due to insufficient permissions. You may be missing permission for the 'CreateOAuth2Token' action.";
+              break;
+            default:
+              message = `Failed to refresh token: ${String(error)}. Please re-authenticate using \`aws login\``;
+          }
+          throw new CredentialsProviderError(message, {
+            logger: this.logger,
+            tryNextLink: false
+          });
+        }
+        const tokenExpiry2 = new Date(freshToken.accessToken.expiresAt).getTime();
+        if (tokenExpiry2 > Date.now()) {
+          this.logger?.warn?.(`Failed to refresh token: ${String(error)}. Using existing token until expiry.`);
+          return this.toCredentials(freshToken.accessToken);
+        }
+        throw new CredentialsProviderError(`Failed to refresh token: ${String(error)}. Please re-authenticate using aws login`, { logger: this.logger });
+      }
+    }
+    async loadToken() {
+      const tokenFilePath = this.getTokenFilePath();
+      try {
+        const tokenData = await promises.readFile(tokenFilePath, "utf8");
+        const token = JSON.parse(tokenData);
+        const missingFields = ["accessToken", "clientId", "refreshToken", "dpopKey"].filter((k) => !token[k]);
+        if (!token.accessToken?.accountId) {
+          missingFields.push("accountId");
+        }
+        if (missingFields.length > 0) {
+          throw new CredentialsProviderError(`Token validation failed, missing fields: ${missingFields.join(", ")}`, {
+            logger: this.logger,
+            tryNextLink: false
+          });
+        }
+        return token;
+      } catch (error) {
+        throw new CredentialsProviderError(`Failed to load token from ${tokenFilePath}: ${String(error)}`, {
+          logger: this.logger,
+          tryNextLink: false
+        });
+      }
+    }
+    async saveToken(token) {
+      const tokenFilePath = this.getTokenFilePath();
+      const directory = dirname(tokenFilePath);
+      try {
+        await promises.mkdir(directory, { recursive: true });
+      } catch (error) {}
+      await promises.writeFile(tokenFilePath, JSON.stringify(token, null, 2), "utf8");
+    }
+    getTokenFilePath() {
+      const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ?? join(homedir(), ".aws", "login", "cache");
+      const loginSessionBytes = Buffer.from(this.loginSession, "utf8");
+      const loginSessionSha256 = createHash("sha256").update(loginSessionBytes).digest("hex");
+      return join(directory, `${loginSessionSha256}.json`);
+    }
+    derToRawSignature(derSignature) {
+      let offset = 2;
+      if (derSignature[offset] !== 2) {
+        throw new Error("Invalid DER signature");
+      }
+      offset++;
+      const rLength = derSignature[offset++];
+      let r = derSignature.subarray(offset, offset + rLength);
+      offset += rLength;
+      if (derSignature[offset] !== 2) {
+        throw new Error("Invalid DER signature");
+      }
+      offset++;
+      const sLength = derSignature[offset++];
+      let s = derSignature.subarray(offset, offset + sLength);
+      r = r[0] === 0 ? r.subarray(1) : r;
+      s = s[0] === 0 ? s.subarray(1) : s;
+      const rPadded = Buffer.concat([Buffer.alloc(32 - r.length), r]);
+      const sPadded = Buffer.concat([Buffer.alloc(32 - s.length), s]);
+      return Buffer.concat([rPadded, sPadded]);
+    }
+    createDPoPInterceptor(middlewareStack) {
+      middlewareStack.add((next) => async (args) => {
+        if (HttpRequest.isInstance(args.request)) {
+          const request = args.request;
+          const actualEndpoint = `${request.protocol}//${request.hostname}${request.port ? `:${request.port}` : ""}${request.path}`;
+          const dpop = await this.generateDpop(request.method, actualEndpoint);
+          request.headers = {
+            ...request.headers,
+            DPoP: dpop
+          };
+        }
+        return next(args);
+      }, {
+        step: "finalizeRequest",
+        name: "dpopInterceptor",
+        override: true
+      });
+    }
+    async generateDpop(method = "POST", endpoint) {
+      const token = await this.loadToken();
+      try {
+        const privateKey = createPrivateKey({
+          key: token.dpopKey,
+          format: "pem",
+          type: "sec1"
+        });
+        const publicKey = createPublicKey(privateKey);
+        const publicDer = publicKey.export({ format: "der", type: "spki" });
+        let pointStart = -1;
+        for (let i = 0;i < publicDer.length; i++) {
+          if (publicDer[i] === 4) {
+            pointStart = i;
+            break;
+          }
+        }
+        const x = publicDer.slice(pointStart + 1, pointStart + 33);
+        const y = publicDer.slice(pointStart + 33, pointStart + 65);
+        const header = {
+          alg: "ES256",
+          typ: "dpop+jwt",
+          jwk: {
+            kty: "EC",
+            crv: "P-256",
+            x: x.toString("base64url"),
+            y: y.toString("base64url")
+          }
+        };
+        const payload = {
+          jti: crypto.randomUUID(),
+          htm: method,
+          htu: endpoint,
+          iat: Math.floor(Date.now() / 1000)
+        };
+        const headerB64 = Buffer.from(JSON.stringify(header)).toString("base64url");
+        const payloadB64 = Buffer.from(JSON.stringify(payload)).toString("base64url");
+        const message = `${headerB64}.${payloadB64}`;
+        const asn1Signature = sign("sha256", Buffer.from(message), privateKey);
+        const rawSignature = this.derToRawSignature(asn1Signature);
+        const signatureB64 = rawSignature.toString("base64url");
+        return `${message}.${signatureB64}`;
+      } catch (error) {
+        throw new CredentialsProviderError(`Failed to generate Dpop proof: ${error instanceof Error ? error.message : String(error)}`, { logger: this.logger, tryNextLink: false });
+      }
+    }
+  }
+  var fromLoginCredentials = (init) => async ({ callerClientConfig } = {}) => {
+    init?.logger?.debug?.("@aws-sdk/credential-providers - fromLoginCredentials");
+    const profiles = await parseKnownFiles(init || {});
+    const profileName = getProfileName({
+      profile: init?.profile ?? callerClientConfig?.profile
+    });
+    const profile = profiles[profileName];
+    if (!profile?.login_session) {
+      throw new CredentialsProviderError(`Profile ${profileName} does not contain login_session.`, {
+        tryNextLink: true,
+        logger: init?.logger
+      });
+    }
+    const fetcher = new LoginCredentialsFetcher(profile, init, callerClientConfig);
+    const credentials = await fetcher.loadCredentials();
+    return setCredentialFeature(credentials, "CREDENTIALS_LOGIN", "AD");
+  };
+  exports.fromLoginCredentials = fromLoginCredentials;
+});
+
+// node_modules/@aws-sdk/credential-provider-process/dist-cjs/index.js
+var require_dist_cjs11 = __commonJS(function(exports) {
+  var { externalDataInterceptor, CredentialsProviderError, parseKnownFiles, getProfileName } = require_config();
+  var { exec } = __require("node:child_process");
+  var { promisify } = __require("node:util");
+  var { setCredentialFeature } = require_client2();
+  var getValidatedProcessCredentials = (profileName, data, profiles) => {
+    if (data.Version !== 1) {
+      throw Error(`Profile ${profileName} credential_process did not return Version 1.`);
+    }
+    if (data.AccessKeyId === undefined || data.SecretAccessKey === undefined) {
+      throw Error(`Profile ${profileName} credential_process returned invalid credentials.`);
+    }
+    if (data.Expiration) {
+      const currentTime = new Date;
+      const expireTime = new Date(data.Expiration);
+      if (expireTime < currentTime) {
+        throw Error(`Profile ${profileName} credential_process returned expired credentials.`);
+      }
+    }
+    let accountId = data.AccountId;
+    if (!accountId && profiles?.[profileName]?.aws_account_id) {
+      accountId = profiles[profileName].aws_account_id;
+    }
+    const credentials = {
+      accessKeyId: data.AccessKeyId,
+      secretAccessKey: data.SecretAccessKey,
+      ...data.SessionToken && { sessionToken: data.SessionToken },
+      ...data.Expiration && { expiration: new Date(data.Expiration) },
+      ...data.CredentialScope && { credentialScope: data.CredentialScope },
+      ...accountId && { accountId }
+    };
+    setCredentialFeature(credentials, "CREDENTIALS_PROCESS", "w");
+    return credentials;
+  };
+  var resolveProcessCredentials = async (profileName, profiles, logger) => {
+    const profile = profiles[profileName];
+    if (profiles[profileName]) {
+      const credentialProcess = profile["credential_process"];
+      if (credentialProcess !== undefined) {
+        const execPromise = promisify(externalDataInterceptor?.getTokenRecord?.().exec ?? exec);
+        try {
+          const { stdout } = await execPromise(credentialProcess);
+          let data;
+          try {
+            data = JSON.parse(stdout.trim());
+          } catch {
+            throw Error(`Profile ${profileName} credential_process returned invalid JSON.`);
+          }
+          return getValidatedProcessCredentials(profileName, data, profiles);
+        } catch (error) {
+          throw new CredentialsProviderError(error.message, { logger });
+        }
+      } else {
+        throw new CredentialsProviderError(`Profile ${profileName} did not contain credential_process.`, { logger });
+      }
+    } else {
+      throw new CredentialsProviderError(`Profile ${profileName} could not be found in shared credentials file.`, {
+        logger
+      });
+    }
+  };
+  var fromProcess = (init = {}) => async ({ callerClientConfig } = {}) => {
+    init.logger?.debug("@aws-sdk/credential-provider-process - fromProcess");
+    const profiles = await parseKnownFiles(init);
+    return resolveProcessCredentials(getProfileName({
+      profile: init.profile ?? callerClientConfig?.profile
+    }), profiles, init.logger);
+  };
+  exports.fromProcess = fromProcess;
+});
+
+// node_modules/@aws-sdk/credential-provider-web-identity/dist-cjs/index.js
+var require_dist_cjs12 = __commonJS(function(exports) {
+  var { setCredentialFeature } = require_client2();
+  var { CredentialsProviderError, externalDataInterceptor } = require_config();
+  var { readFileSync } = __require("node:fs");
+  var fromWebToken = (init) => async (awsIdentityProperties) => {
+    init.logger?.debug("@aws-sdk/credential-provider-web-identity - fromWebToken");
+    const { roleArn, roleSessionName, webIdentityToken, providerId, policyArns, policy, durationSeconds } = init;
+    let { roleAssumerWithWebIdentity } = init;
+    if (!roleAssumerWithWebIdentity) {
+      const { getDefaultRoleAssumerWithWebIdentity } = require_sts();
+      roleAssumerWithWebIdentity = getDefaultRoleAssumerWithWebIdentity({
+        ...init.clientConfig,
+        credentialProviderLogger: init.logger,
+        parentClientConfig: {
+          ...awsIdentityProperties?.callerClientConfig,
+          ...init.parentClientConfig
+        }
+      }, init.clientPlugins);
+    }
+    return roleAssumerWithWebIdentity({
+      RoleArn: roleArn,
+      RoleSessionName: roleSessionName ?? `aws-sdk-js-session-${Date.now()}`,
+      WebIdentityToken: webIdentityToken,
+      ProviderId: providerId,
+      PolicyArns: policyArns,
+      Policy: policy,
+      DurationSeconds: durationSeconds
+    });
+  };
+  var ENV_TOKEN_FILE = "AWS_WEB_IDENTITY_TOKEN_FILE";
+  var ENV_ROLE_ARN = "AWS_ROLE_ARN";
+  var ENV_ROLE_SESSION_NAME = "AWS_ROLE_SESSION_NAME";
+  var fromTokenFile = (init = {}) => async (awsIdentityProperties) => {
+    init.logger?.debug("@aws-sdk/credential-provider-web-identity - fromTokenFile");
+    const webIdentityTokenFile = init?.webIdentityTokenFile ?? process.env[ENV_TOKEN_FILE];
+    const roleArn = init?.roleArn ?? process.env[ENV_ROLE_ARN];
+    const roleSessionName = init?.roleSessionName ?? process.env[ENV_ROLE_SESSION_NAME];
+    if (!webIdentityTokenFile || !roleArn) {
+      throw new CredentialsProviderError("Web identity configuration not specified", {
+        logger: init.logger
+      });
+    }
+    const credentials = await fromWebToken({
+      ...init,
+      webIdentityToken: externalDataInterceptor?.getTokenRecord?.()[webIdentityTokenFile] ?? readFileSync(webIdentityTokenFile, { encoding: "ascii" }),
+      roleArn,
+      roleSessionName
+    })(awsIdentityProperties);
+    if (webIdentityTokenFile === process.env[ENV_TOKEN_FILE]) {
+      setCredentialFeature(credentials, "CREDENTIALS_ENV_VARS_STS_WEB_ID_TOKEN", "h");
+    }
+    return credentials;
+  };
+  exports.fromTokenFile = fromTokenFile;
+  exports.fromWebToken = fromWebToken;
+});
+
+// node_modules/@aws-sdk/credential-provider-ini/dist-cjs/index.js
+var require_dist_cjs13 = __commonJS(function(exports) {
+  var { CredentialsProviderError, chain, getProfileName, parseKnownFiles } = require_config();
+  var { setCredentialFeature } = require_client2();
+  var resolveCredentialSource = (credentialSource, profileName, logger) => {
+    const sourceProvidersMap = {
+      EcsContainer: async (options) => {
+        const { fromHttp } = require_dist_cjs6();
+        const { fromContainerMetadata } = require_dist_cjs5();
+        logger?.debug("@aws-sdk/credential-provider-ini - credential_source is EcsContainer");
+        return async () => chain(fromHttp(options ?? {}), fromContainerMetadata(options))().then(setNamedProvider);
+      },
+      Ec2InstanceMetadata: async (options) => {
+        logger?.debug("@aws-sdk/credential-provider-ini - credential_source is Ec2InstanceMetadata");
+        const { fromInstanceMetadata } = require_dist_cjs5();
+        return async () => fromInstanceMetadata(options)().then(setNamedProvider);
+      },
+      Environment: async (options) => {
+        logger?.debug("@aws-sdk/credential-provider-ini - credential_source is Environment");
+        const { fromEnv } = require_dist_cjs4();
+        return async () => fromEnv(options)().then(setNamedProvider);
+      }
+    };
+    if (credentialSource in sourceProvidersMap) {
+      return sourceProvidersMap[credentialSource];
+    } else {
+      throw new CredentialsProviderError(`Unsupported credential source in profile ${profileName}. Got ${credentialSource}, ` + `expected EcsContainer or Ec2InstanceMetadata or Environment.`, { logger });
+    }
+  };
+  var setNamedProvider = (creds) => setCredentialFeature(creds, "CREDENTIALS_PROFILE_NAMED_PROVIDER", "p");
+  var isAssumeRoleProfile = (arg, { profile = "default", logger } = {}) => {
+    return Boolean(arg) && typeof arg === "object" && typeof arg.role_arn === "string" && ["undefined", "string"].indexOf(typeof arg.role_session_name) > -1 && ["undefined", "string"].indexOf(typeof arg.external_id) > -1 && ["undefined", "string"].indexOf(typeof arg.mfa_serial) > -1 && (isAssumeRoleWithSourceProfile(arg, { profile, logger }) || isCredentialSourceProfile(arg, { profile, logger }));
+  };
+  var isAssumeRoleWithSourceProfile = (arg, { profile, logger }) => {
+    const withSourceProfile = typeof arg.source_profile === "string" && typeof arg.credential_source === "undefined";
+    if (withSourceProfile) {
+      logger?.debug?.(`    ${profile} isAssumeRoleWithSourceProfile source_profile=${arg.source_profile}`);
+    }
+    return withSourceProfile;
+  };
+  var isCredentialSourceProfile = (arg, { profile, logger }) => {
+    const withProviderProfile = typeof arg.credential_source === "string" && typeof arg.source_profile === "undefined";
+    if (withProviderProfile) {
+      logger?.debug?.(`    ${profile} isCredentialSourceProfile credential_source=${arg.credential_source}`);
+    }
+    return withProviderProfile;
+  };
+  var resolveAssumeRoleCredentials = async (profileName, profiles, options, callerClientConfig, visitedProfiles = {}, resolveProfileData2) => {
+    options.logger?.debug("@aws-sdk/credential-provider-ini - resolveAssumeRoleCredentials (STS)");
+    const profileData = profiles[profileName];
+    const { source_profile, region } = profileData;
+    if (!options.roleAssumer) {
+      const { getDefaultRoleAssumer } = require_sts();
+      options.roleAssumer = getDefaultRoleAssumer({
+        ...options.clientConfig,
+        credentialProviderLogger: options.logger,
+        parentClientConfig: {
+          ...callerClientConfig,
+          ...options?.parentClientConfig,
+          region: region ?? options?.parentClientConfig?.region ?? callerClientConfig?.region
+        }
+      }, options.clientPlugins);
+    }
+    if (source_profile && source_profile in visitedProfiles) {
+      throw new CredentialsProviderError(`Detected a cycle attempting to resolve credentials for profile` + ` ${getProfileName(options)}. Profiles visited: ` + Object.keys(visitedProfiles).join(", "), { logger: options.logger });
+    }
+    options.logger?.debug(`@aws-sdk/credential-provider-ini - finding credential resolver using ${source_profile ? `source_profile=[${source_profile}]` : `profile=[${profileName}]`}`);
+    const sourceCredsProvider = source_profile ? resolveProfileData2(source_profile, profiles, options, callerClientConfig, {
+      ...visitedProfiles,
+      [source_profile]: true
+    }, isCredentialSourceWithoutRoleArn(profiles[source_profile] ?? {})) : (await resolveCredentialSource(profileData.credential_source, profileName, options.logger)(options))();
+    if (isCredentialSourceWithoutRoleArn(profileData)) {
+      return sourceCredsProvider.then((creds) => setCredentialFeature(creds, "CREDENTIALS_PROFILE_SOURCE_PROFILE", "o"));
+    } else {
+      const params = {
+        RoleArn: profileData.role_arn,
+        RoleSessionName: profileData.role_session_name || `aws-sdk-js-${Date.now()}`,
+        ExternalId: profileData.external_id,
+        DurationSeconds: parseInt(profileData.duration_seconds || "3600", 10)
+      };
+      const { mfa_serial } = profileData;
+      if (mfa_serial) {
+        if (!options.mfaCodeProvider) {
+          throw new CredentialsProviderError(`Profile ${profileName} requires multi-factor authentication, but no MFA code callback was provided.`, { logger: options.logger, tryNextLink: false });
+        }
+        params.SerialNumber = mfa_serial;
+        params.TokenCode = await options.mfaCodeProvider(mfa_serial);
+      }
+      const sourceCreds = await sourceCredsProvider;
+      return options.roleAssumer(sourceCreds, params).then((creds) => setCredentialFeature(creds, "CREDENTIALS_PROFILE_SOURCE_PROFILE", "o"));
+    }
+  };
+  var isCredentialSourceWithoutRoleArn = (section) => {
+    return !section.role_arn && !!section.credential_source;
+  };
+  var isLoginProfile = (data) => {
+    return Boolean(data && data.login_session);
+  };
+  var resolveLoginCredentials = async (profileName, options, callerClientConfig) => {
+    const { fromLoginCredentials } = require_dist_cjs10();
+    const credentials = await fromLoginCredentials({
+      ...options,
+      profile: profileName
+    })({ callerClientConfig });
+    return setCredentialFeature(credentials, "CREDENTIALS_PROFILE_LOGIN", "AC");
+  };
+  var isProcessProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.credential_process === "string";
+  var resolveProcessCredentials = async (options, profile) => {
+    const { fromProcess } = require_dist_cjs11();
+    const credentials = await fromProcess({
+      ...options,
+      profile
+    })();
+    return setCredentialFeature(credentials, "CREDENTIALS_PROFILE_PROCESS", "v");
+  };
+  var resolveSsoCredentials = async (profile, profileData, options = {}, callerClientConfig) => {
+    const { fromSSO } = require_dist_cjs8();
+    return fromSSO({
+      profile,
+      logger: options.logger,
+      parentClientConfig: options.parentClientConfig,
+      clientConfig: options.clientConfig
+    })({
+      callerClientConfig
+    }).then((creds) => {
+      if (profileData.sso_session) {
+        return setCredentialFeature(creds, "CREDENTIALS_PROFILE_SSO", "r");
+      } else {
+        return setCredentialFeature(creds, "CREDENTIALS_PROFILE_SSO_LEGACY", "t");
+      }
+    });
+  };
+  var isSsoProfile = (arg) => arg && (typeof arg.sso_start_url === "string" || typeof arg.sso_account_id === "string" || typeof arg.sso_session === "string" || typeof arg.sso_region === "string" || typeof arg.sso_role_name === "string");
+  var isStaticCredsProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.aws_access_key_id === "string" && typeof arg.aws_secret_access_key === "string" && ["undefined", "string"].indexOf(typeof arg.aws_session_token) > -1 && ["undefined", "string"].indexOf(typeof arg.aws_account_id) > -1;
+  var resolveStaticCredentials = async (profile, options) => {
+    options?.logger?.debug("@aws-sdk/credential-provider-ini - resolveStaticCredentials");
+    const credentials = {
+      accessKeyId: profile.aws_access_key_id,
+      secretAccessKey: profile.aws_secret_access_key,
+      sessionToken: profile.aws_session_token,
+      ...profile.aws_credential_scope && { credentialScope: profile.aws_credential_scope },
+      ...profile.aws_account_id && { accountId: profile.aws_account_id }
+    };
+    return setCredentialFeature(credentials, "CREDENTIALS_PROFILE", "n");
+  };
+  var isWebIdentityProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.web_identity_token_file === "string" && typeof arg.role_arn === "string" && ["undefined", "string"].indexOf(typeof arg.role_session_name) > -1;
+  var resolveWebIdentityCredentials = async (profile, options, callerClientConfig) => {
+    const { fromTokenFile } = require_dist_cjs12();
+    const credentials = await fromTokenFile({
+      webIdentityTokenFile: profile.web_identity_token_file,
+      roleArn: profile.role_arn,
+      roleSessionName: profile.role_session_name,
+      roleAssumerWithWebIdentity: options.roleAssumerWithWebIdentity,
+      logger: options.logger,
+      parentClientConfig: options.parentClientConfig
+    })({
+      callerClientConfig
+    });
+    return setCredentialFeature(credentials, "CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN", "q");
+  };
+  var resolveProfileData = async (profileName, profiles, options, callerClientConfig, visitedProfiles = {}, isAssumeRoleRecursiveCall = false) => {
+    const data = profiles[profileName];
+    if (Object.keys(visitedProfiles).length > 0 && isStaticCredsProfile(data)) {
+      return resolveStaticCredentials(data, options);
+    }
+    if (isAssumeRoleRecursiveCall || isAssumeRoleProfile(data, { profile: profileName, logger: options.logger })) {
+      return resolveAssumeRoleCredentials(profileName, profiles, options, callerClientConfig, visitedProfiles, resolveProfileData);
+    }
+    if (isStaticCredsProfile(data)) {
+      return resolveStaticCredentials(data, options);
+    }
+    if (isWebIdentityProfile(data)) {
+      return resolveWebIdentityCredentials(data, options, callerClientConfig);
+    }
+    if (isProcessProfile(data)) {
+      return resolveProcessCredentials(options, profileName);
+    }
+    if (isSsoProfile(data)) {
+      return await resolveSsoCredentials(profileName, data, options, callerClientConfig);
+    }
+    if (isLoginProfile(data)) {
+      return resolveLoginCredentials(profileName, options, callerClientConfig);
+    }
+    throw new CredentialsProviderError(`Could not resolve credentials using profile: [${profileName}] in configuration/credentials file(s).`, { logger: options.logger });
+  };
+  var fromIni = (init = {}) => async ({ callerClientConfig } = {}) => {
+    init.logger?.debug("@aws-sdk/credential-provider-ini - fromIni");
+    const profiles = await parseKnownFiles(init);
+    return resolveProfileData(getProfileName({
+      profile: init.profile ?? callerClientConfig?.profile
+    }), profiles, init, callerClientConfig);
+  };
+  exports.fromIni = fromIni;
+});
+
+// node_modules/@aws-sdk/credential-provider-node/dist-cjs/index.js
+var require_dist_cjs14 = __commonJS(function(exports) {
+  var { ENV_KEY, ENV_SECRET, fromEnv } = require_dist_cjs4();
+  var { chain, CredentialsProviderError, ENV_PROFILE } = require_config();
+  var ENV_IMDS_DISABLED = "AWS_EC2_METADATA_DISABLED";
+  var remoteProvider = async (init) => {
+    const { ENV_CMDS_FULL_URI, ENV_CMDS_RELATIVE_URI, fromContainerMetadata, fromInstanceMetadata } = require_dist_cjs5();
+    if (process.env[ENV_CMDS_RELATIVE_URI] || process.env[ENV_CMDS_FULL_URI]) {
+      init.logger?.debug("@aws-sdk/credential-provider-node - remoteProvider::fromHttp/fromContainerMetadata");
+      const { fromHttp } = require_dist_cjs6();
+      return chain(fromHttp(init), fromContainerMetadata(init));
+    }
+    if (process.env[ENV_IMDS_DISABLED] && process.env[ENV_IMDS_DISABLED] !== "false") {
+      return async () => {
+        throw new CredentialsProviderError("EC2 Instance Metadata Service access disabled", { logger: init.logger });
+      };
+    }
+    init.logger?.debug("@aws-sdk/credential-provider-node - remoteProvider::fromInstanceMetadata");
+    return fromInstanceMetadata(init);
+  };
+  function memoizeChain(providers, treatAsExpired) {
+    const chain2 = internalCreateChain(providers);
+    let activeLock;
+    let passiveLock;
+    let credentials;
+    let forceRefreshLock;
+    const provider = async (options) => {
+      if (options?.forceRefresh) {
+        if (!forceRefreshLock) {
+          forceRefreshLock = chain2(options).then((c) => {
+            credentials = c;
+          }).finally(() => {
+            forceRefreshLock = undefined;
+          });
+        }
+        await forceRefreshLock;
+        return credentials;
+      }
+      if (credentials?.expiration) {
+        if (credentials?.expiration?.getTime() < Date.now()) {
+          credentials = undefined;
+        }
+      }
+      if (activeLock) {
+        await activeLock;
+      } else if (!credentials || treatAsExpired?.(credentials)) {
+        if (credentials) {
+          if (!passiveLock) {
+            passiveLock = chain2(options).then((c) => {
+              credentials = c;
+            }).catch(() => {}).finally(() => {
+              passiveLock = undefined;
+            });
+          }
+        } else {
+          activeLock = chain2(options).then((c) => {
+            credentials = c;
+          }).finally(() => {
+            activeLock = undefined;
+          });
+          return provider(options);
+        }
+      }
+      return credentials;
+    };
+    return provider;
+  }
+  var internalCreateChain = (providers) => async (awsIdentityProperties) => {
+    let lastProviderError;
+    for (const provider of providers) {
+      try {
+        return await provider(awsIdentityProperties);
+      } catch (err) {
+        lastProviderError = err;
+        if (err?.tryNextLink) {
+          continue;
+        }
+        throw err;
+      }
+    }
+    throw lastProviderError;
+  };
+  var multipleCredentialSourceWarningEmitted = false;
+  var defaultProvider = (init = {}) => memoizeChain([
+    async () => {
+      const profile = init.profile ?? process.env[ENV_PROFILE];
+      if (profile) {
+        const envStaticCredentialsAreSet = process.env[ENV_KEY] && process.env[ENV_SECRET];
+        if (envStaticCredentialsAreSet) {
+          if (!multipleCredentialSourceWarningEmitted) {
+            const warnFn = init.logger?.warn && init.logger?.constructor?.name !== "NoOpLogger" ? init.logger.warn.bind(init.logger) : console.warn;
+            warnFn(`@aws-sdk/credential-provider-node - defaultProvider::fromEnv WARNING:
+    Multiple credential sources detected: 
+    Both AWS_PROFILE and the pair AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY static credentials are set.
+    This SDK will proceed with the AWS_PROFILE value.
+    
+    However, a future version may change this behavior to prefer the ENV static credentials.
+    Please ensure that your environment only sets either the AWS_PROFILE or the
+    AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY pair.
+`);
+            multipleCredentialSourceWarningEmitted = true;
+          }
+        }
+        throw new CredentialsProviderError("AWS_PROFILE is set, skipping fromEnv provider.", {
+          logger: init.logger,
+          tryNextLink: true
+        });
+      }
+      init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromEnv");
+      return fromEnv(init)();
+    },
+    async (awsIdentityProperties) => {
+      init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromSSO");
+      const { ssoStartUrl, ssoAccountId, ssoRegion, ssoRoleName, ssoSession } = init;
+      if (!ssoStartUrl && !ssoAccountId && !ssoRegion && !ssoRoleName && !ssoSession) {
+        throw new CredentialsProviderError("Skipping SSO provider in default chain (inputs do not include SSO fields).", { logger: init.logger });
+      }
+      const { fromSSO } = require_dist_cjs8();
+      return fromSSO(init)(awsIdentityProperties);
+    },
+    async (awsIdentityProperties) => {
+      init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromIni");
+      const { fromIni } = require_dist_cjs13();
+      return fromIni(init)(awsIdentityProperties);
+    },
+    async (awsIdentityProperties) => {
+      init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromProcess");
+      const { fromProcess } = require_dist_cjs11();
+      return fromProcess(init)(awsIdentityProperties);
+    },
+    async (awsIdentityProperties) => {
+      init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::fromTokenFile");
+      const { fromTokenFile } = require_dist_cjs12();
+      return fromTokenFile(init)(awsIdentityProperties);
+    },
+    async () => {
+      init.logger?.debug("@aws-sdk/credential-provider-node - defaultProvider::remoteProvider");
+      return (await remoteProvider(init))();
+    },
+    async () => {
+      throw new CredentialsProviderError("Could not load credentials from any providers", {
+        tryNextLink: false,
+        logger: init.logger
+      });
+    }
+  ], credentialsTreatedAsExpired);
+  var credentialsWillNeedRefresh = (credentials) => credentials?.expiration !== undefined;
+  var credentialsTreatedAsExpired = (credentials) => credentials?.expiration !== undefined && credentials.expiration.getTime() - Date.now() < 300000;
+  exports.credentialsTreatedAsExpired = credentialsTreatedAsExpired;
+  exports.credentialsWillNeedRefresh = credentialsWillNeedRefresh;
+  exports.defaultProvider = defaultProvider;
+});
+
+export { require_dist_cjs14 as require_dist_cjs };