@etainabl/nodejs-sdk 1.3.110 → 1.3.112

package/dist/esm/dist-es-FD7XXZCE.js

@@ -0,0 +1,305 @@
+import {
+  getProfileName,
+  getSSOTokenFilepath,
+  getSSOTokenFromFile,
+  loadSsoSessionData,
+  parseKnownFiles
+} from "./chunk-HAEAETXR.js";
+import {
+  setCredentialFeature
+} from "./chunk-UZGMBQZB.js";
+import "./chunk-3YGWW265.js";
+import {
+  CredentialsProviderError,
+  TokenProviderError
+} from "./chunk-R63LRFTI.js";
+
+// node_modules/@aws-sdk/credential-provider-sso/dist-es/isSsoProfile.js
+var isSsoProfile = (arg) => arg && (typeof arg.sso_start_url === "string" || typeof arg.sso_account_id === "string" || typeof arg.sso_session === "string" || typeof arg.sso_region === "string" || typeof arg.sso_role_name === "string");
+
+// node_modules/@aws-sdk/token-providers/dist-es/constants.js
+var EXPIRE_WINDOW_MS = 5 * 60 * 1e3;
+var REFRESH_MESSAGE = `To refresh this SSO session run 'aws sso login' with the corresponding profile.`;
+
+// node_modules/@aws-sdk/token-providers/dist-es/getSsoOidcClient.js
+var getSsoOidcClient = async (ssoRegion, init = {}) => {
+  const { SSOOIDCClient } = await import("./sso-oidc-GZ3LZ3MF.js");
+  const ssoOidcClient = new SSOOIDCClient(Object.assign({}, init.clientConfig ?? {}, {
+    region: ssoRegion ?? init.clientConfig?.region,
+    logger: init.clientConfig?.logger ?? init.parentClientConfig?.logger
+  }));
+  return ssoOidcClient;
+};
+
+// node_modules/@aws-sdk/token-providers/dist-es/getNewSsoOidcToken.js
+var getNewSsoOidcToken = async (ssoToken, ssoRegion, init = {}) => {
+  const { CreateTokenCommand } = await import("./sso-oidc-GZ3LZ3MF.js");
+  const ssoOidcClient = await getSsoOidcClient(ssoRegion, init);
+  return ssoOidcClient.send(new CreateTokenCommand({
+    clientId: ssoToken.clientId,
+    clientSecret: ssoToken.clientSecret,
+    refreshToken: ssoToken.refreshToken,
+    grantType: "refresh_token"
+  }));
+};
+
+// node_modules/@aws-sdk/token-providers/dist-es/validateTokenExpiry.js
+var validateTokenExpiry = (token) => {
+  if (token.expiration && token.expiration.getTime() < Date.now()) {
+    throw new TokenProviderError(`Token is expired. ${REFRESH_MESSAGE}`, false);
+  }
+};
+
+// node_modules/@aws-sdk/token-providers/dist-es/validateTokenKey.js
+var validateTokenKey = (key, value, forRefresh = false) => {
+  if (typeof value === "undefined") {
+    throw new TokenProviderError(`Value not present for '${key}' in SSO Token${forRefresh ? ". Cannot refresh" : ""}. ${REFRESH_MESSAGE}`, false);
+  }
+};
+
+// node_modules/@aws-sdk/token-providers/dist-es/writeSSOTokenToFile.js
+import { promises as fsPromises } from "fs";
+var { writeFile } = fsPromises;
+var writeSSOTokenToFile = (id, ssoToken) => {
+  const tokenFilepath = getSSOTokenFilepath(id);
+  const tokenString = JSON.stringify(ssoToken, null, 2);
+  return writeFile(tokenFilepath, tokenString);
+};
+
+// node_modules/@aws-sdk/token-providers/dist-es/fromSso.js
+var lastRefreshAttemptTime = /* @__PURE__ */ new Date(0);
+var fromSso = (_init = {}) => async ({ callerClientConfig } = {}) => {
+  const init = {
+    ..._init,
+    parentClientConfig: {
+      ...callerClientConfig,
+      ..._init.parentClientConfig
+    }
+  };
+  init.logger?.debug("@aws-sdk/token-providers - fromSso");
+  const profiles = await parseKnownFiles(init);
+  const profileName = getProfileName({
+    profile: init.profile ?? callerClientConfig?.profile
+  });
+  const profile = profiles[profileName];
+  if (!profile) {
+    throw new TokenProviderError(`Profile '${profileName}' could not be found in shared credentials file.`, false);
+  } else if (!profile["sso_session"]) {
+    throw new TokenProviderError(`Profile '${profileName}' is missing required property 'sso_session'.`);
+  }
+  const ssoSessionName = profile["sso_session"];
+  const ssoSessions = await loadSsoSessionData(init);
+  const ssoSession = ssoSessions[ssoSessionName];
+  if (!ssoSession) {
+    throw new TokenProviderError(`Sso session '${ssoSessionName}' could not be found in shared credentials file.`, false);
+  }
+  for (const ssoSessionRequiredKey of ["sso_start_url", "sso_region"]) {
+    if (!ssoSession[ssoSessionRequiredKey]) {
+      throw new TokenProviderError(`Sso session '${ssoSessionName}' is missing required property '${ssoSessionRequiredKey}'.`, false);
+    }
+  }
+  const ssoStartUrl = ssoSession["sso_start_url"];
+  const ssoRegion = ssoSession["sso_region"];
+  let ssoToken;
+  try {
+    ssoToken = await getSSOTokenFromFile(ssoSessionName);
+  } catch (e) {
+    throw new TokenProviderError(`The SSO session token associated with profile=${profileName} was not found or is invalid. ${REFRESH_MESSAGE}`, false);
+  }
+  validateTokenKey("accessToken", ssoToken.accessToken);
+  validateTokenKey("expiresAt", ssoToken.expiresAt);
+  const { accessToken, expiresAt } = ssoToken;
+  const existingToken = { token: accessToken, expiration: new Date(expiresAt) };
+  if (existingToken.expiration.getTime() - Date.now() > EXPIRE_WINDOW_MS) {
+    return existingToken;
+  }
+  if (Date.now() - lastRefreshAttemptTime.getTime() < 30 * 1e3) {
+    validateTokenExpiry(existingToken);
+    return existingToken;
+  }
+  validateTokenKey("clientId", ssoToken.clientId, true);
+  validateTokenKey("clientSecret", ssoToken.clientSecret, true);
+  validateTokenKey("refreshToken", ssoToken.refreshToken, true);
+  try {
+    lastRefreshAttemptTime.setTime(Date.now());
+    const newSsoOidcToken = await getNewSsoOidcToken(ssoToken, ssoRegion, init);
+    validateTokenKey("accessToken", newSsoOidcToken.accessToken);
+    validateTokenKey("expiresIn", newSsoOidcToken.expiresIn);
+    const newTokenExpiration = new Date(Date.now() + newSsoOidcToken.expiresIn * 1e3);
+    try {
+      await writeSSOTokenToFile(ssoSessionName, {
+        ...ssoToken,
+        accessToken: newSsoOidcToken.accessToken,
+        expiresAt: newTokenExpiration.toISOString(),
+        refreshToken: newSsoOidcToken.refreshToken
+      });
+    } catch (error) {
+    }
+    return {
+      token: newSsoOidcToken.accessToken,
+      expiration: newTokenExpiration
+    };
+  } catch (error) {
+    validateTokenExpiry(existingToken);
+    return existingToken;
+  }
+};
+
+// node_modules/@aws-sdk/credential-provider-sso/dist-es/resolveSSOCredentials.js
+var SHOULD_FAIL_CREDENTIAL_CHAIN = false;
+var resolveSSOCredentials = async ({ ssoStartUrl, ssoSession, ssoAccountId, ssoRegion, ssoRoleName, ssoClient, clientConfig, parentClientConfig, profile, logger }) => {
+  let token;
+  const refreshMessage = `To refresh this SSO session run aws sso login with the corresponding profile.`;
+  if (ssoSession) {
+    try {
+      const _token = await fromSso({ profile })();
+      token = {
+        accessToken: _token.token,
+        expiresAt: new Date(_token.expiration).toISOString()
+      };
+    } catch (e) {
+      throw new CredentialsProviderError(e.message, {
+        tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
+        logger
+      });
+    }
+  } else {
+    try {
+      token = await getSSOTokenFromFile(ssoStartUrl);
+    } catch (e) {
+      throw new CredentialsProviderError(`The SSO session associated with this profile is invalid. ${refreshMessage}`, {
+        tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
+        logger
+      });
+    }
+  }
+  if (new Date(token.expiresAt).getTime() - Date.now() <= 0) {
+    throw new CredentialsProviderError(`The SSO session associated with this profile has expired. ${refreshMessage}`, {
+      tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
+      logger
+    });
+  }
+  const { accessToken } = token;
+  const { SSOClient, GetRoleCredentialsCommand } = await import("./loadSso-3QBKTJF3.js");
+  const sso = ssoClient || new SSOClient(Object.assign({}, clientConfig ?? {}, {
+    logger: clientConfig?.logger ?? parentClientConfig?.logger,
+    region: clientConfig?.region ?? ssoRegion
+  }));
+  let ssoResp;
+  try {
+    ssoResp = await sso.send(new GetRoleCredentialsCommand({
+      accountId: ssoAccountId,
+      roleName: ssoRoleName,
+      accessToken
+    }));
+  } catch (e) {
+    throw new CredentialsProviderError(e, {
+      tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
+      logger
+    });
+  }
+  const { roleCredentials: { accessKeyId, secretAccessKey, sessionToken, expiration, credentialScope, accountId } = {} } = ssoResp;
+  if (!accessKeyId || !secretAccessKey || !sessionToken || !expiration) {
+    throw new CredentialsProviderError("SSO returns an invalid temporary credential.", {
+      tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
+      logger
+    });
+  }
+  const credentials = {
+    accessKeyId,
+    secretAccessKey,
+    sessionToken,
+    expiration: new Date(expiration),
+    ...credentialScope && { credentialScope },
+    ...accountId && { accountId }
+  };
+  if (ssoSession) {
+    setCredentialFeature(credentials, "CREDENTIALS_SSO", "s");
+  } else {
+    setCredentialFeature(credentials, "CREDENTIALS_SSO_LEGACY", "u");
+  }
+  return credentials;
+};
+
+// node_modules/@aws-sdk/credential-provider-sso/dist-es/validateSsoProfile.js
+var validateSsoProfile = (profile, logger) => {
+  const { sso_start_url, sso_account_id, sso_region, sso_role_name } = profile;
+  if (!sso_start_url || !sso_account_id || !sso_region || !sso_role_name) {
+    throw new CredentialsProviderError(`Profile is configured with invalid SSO credentials. Required parameters "sso_account_id", "sso_region", "sso_role_name", "sso_start_url". Got ${Object.keys(profile).join(", ")}
+Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html`, { tryNextLink: false, logger });
+  }
+  return profile;
+};
+
+// node_modules/@aws-sdk/credential-provider-sso/dist-es/fromSSO.js
+var fromSSO = (init = {}) => async ({ callerClientConfig } = {}) => {
+  init.logger?.debug("@aws-sdk/credential-provider-sso - fromSSO");
+  const { ssoStartUrl, ssoAccountId, ssoRegion, ssoRoleName, ssoSession } = init;
+  const { ssoClient } = init;
+  const profileName = getProfileName({
+    profile: init.profile ?? callerClientConfig?.profile
+  });
+  if (!ssoStartUrl && !ssoAccountId && !ssoRegion && !ssoRoleName && !ssoSession) {
+    const profiles = await parseKnownFiles(init);
+    const profile = profiles[profileName];
+    if (!profile) {
+      throw new CredentialsProviderError(`Profile ${profileName} was not found.`, { logger: init.logger });
+    }
+    if (!isSsoProfile(profile)) {
+      throw new CredentialsProviderError(`Profile ${profileName} is not configured with SSO credentials.`, {
+        logger: init.logger
+      });
+    }
+    if (profile?.sso_session) {
+      const ssoSessions = await loadSsoSessionData(init);
+      const session = ssoSessions[profile.sso_session];
+      const conflictMsg = ` configurations in profile ${profileName} and sso-session ${profile.sso_session}`;
+      if (ssoRegion && ssoRegion !== session.sso_region) {
+        throw new CredentialsProviderError(`Conflicting SSO region` + conflictMsg, {
+          tryNextLink: false,
+          logger: init.logger
+        });
+      }
+      if (ssoStartUrl && ssoStartUrl !== session.sso_start_url) {
+        throw new CredentialsProviderError(`Conflicting SSO start_url` + conflictMsg, {
+          tryNextLink: false,
+          logger: init.logger
+        });
+      }
+      profile.sso_region = session.sso_region;
+      profile.sso_start_url = session.sso_start_url;
+    }
+    const { sso_start_url, sso_account_id, sso_region, sso_role_name, sso_session } = validateSsoProfile(profile, init.logger);
+    return resolveSSOCredentials({
+      ssoStartUrl: sso_start_url,
+      ssoSession: sso_session,
+      ssoAccountId: sso_account_id,
+      ssoRegion: sso_region,
+      ssoRoleName: sso_role_name,
+      ssoClient,
+      clientConfig: init.clientConfig,
+      parentClientConfig: init.parentClientConfig,
+      profile: profileName
+    });
+  } else if (!ssoStartUrl || !ssoAccountId || !ssoRegion || !ssoRoleName) {
+    throw new CredentialsProviderError('Incomplete configuration. The fromSSO() argument hash must include "ssoStartUrl", "ssoAccountId", "ssoRegion", "ssoRoleName"', { tryNextLink: false, logger: init.logger });
+  } else {
+    return resolveSSOCredentials({
+      ssoStartUrl,
+      ssoSession,
+      ssoAccountId,
+      ssoRegion,
+      ssoRoleName,
+      ssoClient,
+      clientConfig: init.clientConfig,
+      parentClientConfig: init.parentClientConfig,
+      profile: profileName
+    });
+  }
+};
+export {
+  fromSSO,
+  isSsoProfile,
+  validateSsoProfile
+};
+//# sourceMappingURL=dist-es-FD7XXZCE.js.map

package/dist/esm/dist-es-FD7XXZCE.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../node_modules/@aws-sdk/credential-provider-sso/dist-es/isSsoProfile.js","../../node_modules/@aws-sdk/token-providers/dist-es/constants.js","../../node_modules/@aws-sdk/token-providers/dist-es/getSsoOidcClient.js","../../node_modules/@aws-sdk/token-providers/dist-es/getNewSsoOidcToken.js","../../node_modules/@aws-sdk/token-providers/dist-es/validateTokenExpiry.js","../../node_modules/@aws-sdk/token-providers/dist-es/validateTokenKey.js","../../node_modules/@aws-sdk/token-providers/dist-es/writeSSOTokenToFile.js","../../node_modules/@aws-sdk/token-providers/dist-es/fromSso.js","../../node_modules/@aws-sdk/credential-provider-sso/dist-es/resolveSSOCredentials.js","../../node_modules/@aws-sdk/credential-provider-sso/dist-es/validateSsoProfile.js","../../node_modules/@aws-sdk/credential-provider-sso/dist-es/fromSSO.js"],"sourcesContent":["export const isSsoProfile = (arg) => arg &&\n    (typeof arg.sso_start_url === \"string\" ||\n        typeof arg.sso_account_id === \"string\" ||\n        typeof arg.sso_session === \"string\" ||\n        typeof arg.sso_region === \"string\" ||\n        typeof arg.sso_role_name === \"string\");\n","export const EXPIRE_WINDOW_MS = 5 * 60 * 1000;\nexport const REFRESH_MESSAGE = `To refresh this SSO session run 'aws sso login' with the corresponding profile.`;\n","export const getSsoOidcClient = async (ssoRegion, init = {}) => {\n    const { SSOOIDCClient } = await import(\"@aws-sdk/nested-clients/sso-oidc\");\n    const ssoOidcClient = new SSOOIDCClient(Object.assign({}, init.clientConfig ?? {}, {\n        region: ssoRegion ?? init.clientConfig?.region,\n        logger: init.clientConfig?.logger ?? init.parentClientConfig?.logger,\n    }));\n    return ssoOidcClient;\n};\n","import { getSsoOidcClient } from \"./getSsoOidcClient\";\nexport const getNewSsoOidcToken = async (ssoToken, ssoRegion, init = {}) => {\n    const { CreateTokenCommand } = await import(\"@aws-sdk/nested-clients/sso-oidc\");\n    const ssoOidcClient = await getSsoOidcClient(ssoRegion, init);\n    return ssoOidcClient.send(new CreateTokenCommand({\n        clientId: ssoToken.clientId,\n        clientSecret: ssoToken.clientSecret,\n        refreshToken: ssoToken.refreshToken,\n        grantType: \"refresh_token\",\n    }));\n};\n","import { TokenProviderError } from \"@smithy/property-provider\";\nimport { REFRESH_MESSAGE } from \"./constants\";\nexport const validateTokenExpiry = (token) => {\n    if (token.expiration && token.expiration.getTime() < Date.now()) {\n        throw new TokenProviderError(`Token is expired. ${REFRESH_MESSAGE}`, false);\n    }\n};\n","import { TokenProviderError } from \"@smithy/property-provider\";\nimport { REFRESH_MESSAGE } from \"./constants\";\nexport const validateTokenKey = (key, value, forRefresh = false) => {\n    if (typeof value === \"undefined\") {\n        throw new TokenProviderError(`Value not present for '${key}' in SSO Token${forRefresh ? \". Cannot refresh\" : \"\"}. ${REFRESH_MESSAGE}`, false);\n    }\n};\n","import { getSSOTokenFilepath } from \"@smithy/shared-ini-file-loader\";\nimport { promises as fsPromises } from \"fs\";\nconst { writeFile } = fsPromises;\nexport const writeSSOTokenToFile = (id, ssoToken) => {\n    const tokenFilepath = getSSOTokenFilepath(id);\n    const tokenString = JSON.stringify(ssoToken, null, 2);\n    return writeFile(tokenFilepath, tokenString);\n};\n","import { TokenProviderError } from \"@smithy/property-provider\";\nimport { getProfileName, getSSOTokenFromFile, loadSsoSessionData, parseKnownFiles, } from \"@smithy/shared-ini-file-loader\";\nimport { EXPIRE_WINDOW_MS, REFRESH_MESSAGE } from \"./constants\";\nimport { getNewSsoOidcToken } from \"./getNewSsoOidcToken\";\nimport { validateTokenExpiry } from \"./validateTokenExpiry\";\nimport { validateTokenKey } from \"./validateTokenKey\";\nimport { writeSSOTokenToFile } from \"./writeSSOTokenToFile\";\nconst lastRefreshAttemptTime = new Date(0);\nexport const fromSso = (_init = {}) => async ({ callerClientConfig } = {}) => {\n    const init = {\n        ..._init,\n        parentClientConfig: {\n            ...callerClientConfig,\n            ..._init.parentClientConfig,\n        },\n    };\n    init.logger?.debug(\"@aws-sdk/token-providers - fromSso\");\n    const profiles = await parseKnownFiles(init);\n    const profileName = getProfileName({\n        profile: init.profile ?? callerClientConfig?.profile,\n    });\n    const profile = profiles[profileName];\n    if (!profile) {\n        throw new TokenProviderError(`Profile '${profileName}' could not be found in shared credentials file.`, false);\n    }\n    else if (!profile[\"sso_session\"]) {\n        throw new TokenProviderError(`Profile '${profileName}' is missing required property 'sso_session'.`);\n    }\n    const ssoSessionName = profile[\"sso_session\"];\n    const ssoSessions = await loadSsoSessionData(init);\n    const ssoSession = ssoSessions[ssoSessionName];\n    if (!ssoSession) {\n        throw new TokenProviderError(`Sso session '${ssoSessionName}' could not be found in shared credentials file.`, false);\n    }\n    for (const ssoSessionRequiredKey of [\"sso_start_url\", \"sso_region\"]) {\n        if (!ssoSession[ssoSessionRequiredKey]) {\n            throw new TokenProviderError(`Sso session '${ssoSessionName}' is missing required property '${ssoSessionRequiredKey}'.`, false);\n        }\n    }\n    const ssoStartUrl = ssoSession[\"sso_start_url\"];\n    const ssoRegion = ssoSession[\"sso_region\"];\n    let ssoToken;\n    try {\n        ssoToken = await getSSOTokenFromFile(ssoSessionName);\n    }\n    catch (e) {\n        throw new TokenProviderError(`The SSO session token associated with profile=${profileName} was not found or is invalid. ${REFRESH_MESSAGE}`, false);\n    }\n    validateTokenKey(\"accessToken\", ssoToken.accessToken);\n    validateTokenKey(\"expiresAt\", ssoToken.expiresAt);\n    const { accessToken, expiresAt } = ssoToken;\n    const existingToken = { token: accessToken, expiration: new Date(expiresAt) };\n    if (existingToken.expiration.getTime() - Date.now() > EXPIRE_WINDOW_MS) {\n        return existingToken;\n    }\n    if (Date.now() - lastRefreshAttemptTime.getTime() < 30 * 1000) {\n        validateTokenExpiry(existingToken);\n        return existingToken;\n    }\n    validateTokenKey(\"clientId\", ssoToken.clientId, true);\n    validateTokenKey(\"clientSecret\", ssoToken.clientSecret, true);\n    validateTokenKey(\"refreshToken\", ssoToken.refreshToken, true);\n    try {\n        lastRefreshAttemptTime.setTime(Date.now());\n        const newSsoOidcToken = await getNewSsoOidcToken(ssoToken, ssoRegion, init);\n        validateTokenKey(\"accessToken\", newSsoOidcToken.accessToken);\n        validateTokenKey(\"expiresIn\", newSsoOidcToken.expiresIn);\n        const newTokenExpiration = new Date(Date.now() + newSsoOidcToken.expiresIn * 1000);\n        try {\n            await writeSSOTokenToFile(ssoSessionName, {\n                ...ssoToken,\n                accessToken: newSsoOidcToken.accessToken,\n                expiresAt: newTokenExpiration.toISOString(),\n                refreshToken: newSsoOidcToken.refreshToken,\n            });\n        }\n        catch (error) {\n        }\n        return {\n            token: newSsoOidcToken.accessToken,\n            expiration: newTokenExpiration,\n        };\n    }\n    catch (error) {\n        validateTokenExpiry(existingToken);\n        return existingToken;\n    }\n};\n","import { setCredentialFeature } from \"@aws-sdk/core/client\";\nimport { fromSso as getSsoTokenProvider } from \"@aws-sdk/token-providers\";\nimport { CredentialsProviderError } from \"@smithy/property-provider\";\nimport { getSSOTokenFromFile } from \"@smithy/shared-ini-file-loader\";\nconst SHOULD_FAIL_CREDENTIAL_CHAIN = false;\nexport const resolveSSOCredentials = async ({ ssoStartUrl, ssoSession, ssoAccountId, ssoRegion, ssoRoleName, ssoClient, clientConfig, parentClientConfig, profile, logger, }) => {\n    let token;\n    const refreshMessage = `To refresh this SSO session run aws sso login with the corresponding profile.`;\n    if (ssoSession) {\n        try {\n            const _token = await getSsoTokenProvider({ profile })();\n            token = {\n                accessToken: _token.token,\n                expiresAt: new Date(_token.expiration).toISOString(),\n            };\n        }\n        catch (e) {\n            throw new CredentialsProviderError(e.message, {\n                tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,\n                logger,\n            });\n        }\n    }\n    else {\n        try {\n            token = await getSSOTokenFromFile(ssoStartUrl);\n        }\n        catch (e) {\n            throw new CredentialsProviderError(`The SSO session associated with this profile is invalid. ${refreshMessage}`, {\n                tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,\n                logger,\n            });\n        }\n    }\n    if (new Date(token.expiresAt).getTime() - Date.now() <= 0) {\n        throw new CredentialsProviderError(`The SSO session associated with this profile has expired. ${refreshMessage}`, {\n            tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,\n            logger,\n        });\n    }\n    const { accessToken } = token;\n    const { SSOClient, GetRoleCredentialsCommand } = await import(\"./loadSso\");\n    const sso = ssoClient ||\n        new SSOClient(Object.assign({}, clientConfig ?? {}, {\n            logger: clientConfig?.logger ?? parentClientConfig?.logger,\n            region: clientConfig?.region ?? ssoRegion,\n        }));\n    let ssoResp;\n    try {\n        ssoResp = await sso.send(new GetRoleCredentialsCommand({\n            accountId: ssoAccountId,\n            roleName: ssoRoleName,\n            accessToken,\n        }));\n    }\n    catch (e) {\n        throw new CredentialsProviderError(e, {\n            tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,\n            logger,\n        });\n    }\n    const { roleCredentials: { accessKeyId, secretAccessKey, sessionToken, expiration, credentialScope, accountId } = {}, } = ssoResp;\n    if (!accessKeyId || !secretAccessKey || !sessionToken || !expiration) {\n        throw new CredentialsProviderError(\"SSO returns an invalid temporary credential.\", {\n            tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,\n            logger,\n        });\n    }\n    const credentials = {\n        accessKeyId,\n        secretAccessKey,\n        sessionToken,\n        expiration: new Date(expiration),\n        ...(credentialScope && { credentialScope }),\n        ...(accountId && { accountId }),\n    };\n    if (ssoSession) {\n        setCredentialFeature(credentials, \"CREDENTIALS_SSO\", \"s\");\n    }\n    else {\n        setCredentialFeature(credentials, \"CREDENTIALS_SSO_LEGACY\", \"u\");\n    }\n    return credentials;\n};\n","import { CredentialsProviderError } from \"@smithy/property-provider\";\nexport const validateSsoProfile = (profile, logger) => {\n    const { sso_start_url, sso_account_id, sso_region, sso_role_name } = profile;\n    if (!sso_start_url || !sso_account_id || !sso_region || !sso_role_name) {\n        throw new CredentialsProviderError(`Profile is configured with invalid SSO credentials. Required parameters \"sso_account_id\", ` +\n            `\"sso_region\", \"sso_role_name\", \"sso_start_url\". Got ${Object.keys(profile).join(\", \")}\\nReference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html`, { tryNextLink: false, logger });\n    }\n    return profile;\n};\n","import { CredentialsProviderError } from \"@smithy/property-provider\";\nimport { getProfileName, loadSsoSessionData, parseKnownFiles } from \"@smithy/shared-ini-file-loader\";\nimport { isSsoProfile } from \"./isSsoProfile\";\nimport { resolveSSOCredentials } from \"./resolveSSOCredentials\";\nimport { validateSsoProfile } from \"./validateSsoProfile\";\nexport const fromSSO = (init = {}) => async ({ callerClientConfig } = {}) => {\n    init.logger?.debug(\"@aws-sdk/credential-provider-sso - fromSSO\");\n    const { ssoStartUrl, ssoAccountId, ssoRegion, ssoRoleName, ssoSession } = init;\n    const { ssoClient } = init;\n    const profileName = getProfileName({\n        profile: init.profile ?? callerClientConfig?.profile,\n    });\n    if (!ssoStartUrl && !ssoAccountId && !ssoRegion && !ssoRoleName && !ssoSession) {\n        const profiles = await parseKnownFiles(init);\n        const profile = profiles[profileName];\n        if (!profile) {\n            throw new CredentialsProviderError(`Profile ${profileName} was not found.`, { logger: init.logger });\n        }\n        if (!isSsoProfile(profile)) {\n            throw new CredentialsProviderError(`Profile ${profileName} is not configured with SSO credentials.`, {\n                logger: init.logger,\n            });\n        }\n        if (profile?.sso_session) {\n            const ssoSessions = await loadSsoSessionData(init);\n            const session = ssoSessions[profile.sso_session];\n            const conflictMsg = ` configurations in profile ${profileName} and sso-session ${profile.sso_session}`;\n            if (ssoRegion && ssoRegion !== session.sso_region) {\n                throw new CredentialsProviderError(`Conflicting SSO region` + conflictMsg, {\n                    tryNextLink: false,\n                    logger: init.logger,\n                });\n            }\n            if (ssoStartUrl && ssoStartUrl !== session.sso_start_url) {\n                throw new CredentialsProviderError(`Conflicting SSO start_url` + conflictMsg, {\n                    tryNextLink: false,\n                    logger: init.logger,\n                });\n            }\n            profile.sso_region = session.sso_region;\n            profile.sso_start_url = session.sso_start_url;\n        }\n        const { sso_start_url, sso_account_id, sso_region, sso_role_name, sso_session } = validateSsoProfile(profile, init.logger);\n        return resolveSSOCredentials({\n            ssoStartUrl: sso_start_url,\n            ssoSession: sso_session,\n            ssoAccountId: sso_account_id,\n            ssoRegion: sso_region,\n            ssoRoleName: sso_role_name,\n            ssoClient: ssoClient,\n            clientConfig: init.clientConfig,\n            parentClientConfig: init.parentClientConfig,\n            profile: profileName,\n        });\n    }\n    else if (!ssoStartUrl || !ssoAccountId || !ssoRegion || !ssoRoleName) {\n        throw new CredentialsProviderError(\"Incomplete configuration. The fromSSO() argument hash must include \" +\n            '\"ssoStartUrl\", \"ssoAccountId\", \"ssoRegion\", \"ssoRoleName\"', { tryNextLink: false, logger: init.logger });\n    }\n    else {\n        return resolveSSOCredentials({\n            ssoStartUrl,\n            ssoSession,\n            ssoAccountId,\n            ssoRegion,\n            ssoRoleName,\n            ssoClient,\n            clientConfig: init.clientConfig,\n            parentClientConfig: init.parentClientConfig,\n            profile: profileName,\n        });\n    }\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AAAO,IAAM,eAAe,CAAC,QAAQ,QAChC,OAAO,IAAI,kBAAkB,YAC1B,OAAO,IAAI,mBAAmB,YAC9B,OAAO,IAAI,gBAAgB,YAC3B,OAAO,IAAI,eAAe,YAC1B,OAAO,IAAI,kBAAkB;;;ACL9B,IAAM,mBAAmB,IAAI,KAAK;AAClC,IAAM,kBAAkB;;;ACDxB,IAAM,mBAAmB,OAAO,WAAW,OAAO,CAAC,MAAM;AAC5D,QAAM,EAAE,cAAc,IAAI,MAAM,OAAO,wBAAkC;AACzE,QAAM,gBAAgB,IAAI,cAAc,OAAO,OAAO,CAAC,GAAG,KAAK,gBAAgB,CAAC,GAAG;AAAA,IAC/E,QAAQ,aAAa,KAAK,cAAc;AAAA,IACxC,QAAQ,KAAK,cAAc,UAAU,KAAK,oBAAoB;AAAA,EAClE,CAAC,CAAC;AACF,SAAO;AACX;;;ACNO,IAAM,qBAAqB,OAAO,UAAU,WAAW,OAAO,CAAC,MAAM;AACxE,QAAM,EAAE,mBAAmB,IAAI,MAAM,OAAO,wBAAkC;AAC9E,QAAM,gBAAgB,MAAM,iBAAiB,WAAW,IAAI;AAC5D,SAAO,cAAc,KAAK,IAAI,mBAAmB;AAAA,IAC7C,UAAU,SAAS;AAAA,IACnB,cAAc,SAAS;AAAA,IACvB,cAAc,SAAS;AAAA,IACvB,WAAW;AAAA,EACf,CAAC,CAAC;AACN;;;ACRO,IAAM,sBAAsB,CAAC,UAAU;AAC1C,MAAI,MAAM,cAAc,MAAM,WAAW,QAAQ,IAAI,KAAK,IAAI,GAAG;AAC7D,UAAM,IAAI,mBAAmB,qBAAqB,eAAe,IAAI,KAAK;AAAA,EAC9E;AACJ;;;ACJO,IAAM,mBAAmB,CAAC,KAAK,OAAO,aAAa,UAAU;AAChE,MAAI,OAAO,UAAU,aAAa;AAC9B,UAAM,IAAI,mBAAmB,0BAA0B,GAAG,iBAAiB,aAAa,qBAAqB,EAAE,KAAK,eAAe,IAAI,KAAK;AAAA,EAChJ;AACJ;;;ACLA,SAAS,YAAY,kBAAkB;AACvC,IAAM,EAAE,UAAU,IAAI;AACf,IAAM,sBAAsB,CAAC,IAAI,aAAa;AACjD,QAAM,gBAAgB,oBAAoB,EAAE;AAC5C,QAAM,cAAc,KAAK,UAAU,UAAU,MAAM,CAAC;AACpD,SAAO,UAAU,eAAe,WAAW;AAC/C;;;ACAA,IAAM,yBAAyB,oBAAI,KAAK,CAAC;AAClC,IAAM,UAAU,CAAC,QAAQ,CAAC,MAAM,OAAO,EAAE,mBAAmB,IAAI,CAAC,MAAM;AAC1E,QAAM,OAAO;AAAA,IACT,GAAG;AAAA,IACH,oBAAoB;AAAA,MAChB,GAAG;AAAA,MACH,GAAG,MAAM;AAAA,IACb;AAAA,EACJ;AACA,OAAK,QAAQ,MAAM,oCAAoC;AACvD,QAAM,WAAW,MAAM,gBAAgB,IAAI;AAC3C,QAAM,cAAc,eAAe;AAAA,IAC/B,SAAS,KAAK,WAAW,oBAAoB;AAAA,EACjD,CAAC;AACD,QAAM,UAAU,SAAS,WAAW;AACpC,MAAI,CAAC,SAAS;AACV,UAAM,IAAI,mBAAmB,YAAY,WAAW,oDAAoD,KAAK;AAAA,EACjH,WACS,CAAC,QAAQ,aAAa,GAAG;AAC9B,UAAM,IAAI,mBAAmB,YAAY,WAAW,+CAA+C;AAAA,EACvG;AACA,QAAM,iBAAiB,QAAQ,aAAa;AAC5C,QAAM,cAAc,MAAM,mBAAmB,IAAI;AACjD,QAAM,aAAa,YAAY,cAAc;AAC7C,MAAI,CAAC,YAAY;AACb,UAAM,IAAI,mBAAmB,gBAAgB,cAAc,oDAAoD,KAAK;AAAA,EACxH;AACA,aAAW,yBAAyB,CAAC,iBAAiB,YAAY,GAAG;AACjE,QAAI,CAAC,WAAW,qBAAqB,GAAG;AACpC,YAAM,IAAI,mBAAmB,gBAAgB,cAAc,mCAAmC,qBAAqB,MAAM,KAAK;AAAA,IAClI;AAAA,EACJ;AACA,QAAM,cAAc,WAAW,eAAe;AAC9C,QAAM,YAAY,WAAW,YAAY;AACzC,MAAI;AACJ,MAAI;AACA,eAAW,MAAM,oBAAoB,cAAc;AAAA,EACvD,SACO,GAAG;AACN,UAAM,IAAI,mBAAmB,iDAAiD,WAAW,iCAAiC,eAAe,IAAI,KAAK;AAAA,EACtJ;AACA,mBAAiB,eAAe,SAAS,WAAW;AACpD,mBAAiB,aAAa,SAAS,SAAS;AAChD,QAAM,EAAE,aAAa,UAAU,IAAI;AACnC,QAAM,gBAAgB,EAAE,OAAO,aAAa,YAAY,IAAI,KAAK,SAAS,EAAE;AAC5E,MAAI,cAAc,WAAW,QAAQ,IAAI,KAAK,IAAI,IAAI,kBAAkB;AACpE,WAAO;AAAA,EACX;AACA,MAAI,KAAK,IAAI,IAAI,uBAAuB,QAAQ,IAAI,KAAK,KAAM;AAC3D,wBAAoB,aAAa;AACjC,WAAO;AAAA,EACX;AACA,mBAAiB,YAAY,SAAS,UAAU,IAAI;AACpD,mBAAiB,gBAAgB,SAAS,cAAc,IAAI;AAC5D,mBAAiB,gBAAgB,SAAS,cAAc,IAAI;AAC5D,MAAI;AACA,2BAAuB,QAAQ,KAAK,IAAI,CAAC;AACzC,UAAM,kBAAkB,MAAM,mBAAmB,UAAU,WAAW,IAAI;AAC1E,qBAAiB,eAAe,gBAAgB,WAAW;AAC3D,qBAAiB,aAAa,gBAAgB,SAAS;AACvD,UAAM,qBAAqB,IAAI,KAAK,KAAK,IAAI,IAAI,gBAAgB,YAAY,GAAI;AACjF,QAAI;AACA,YAAM,oBAAoB,gBAAgB;AAAA,QACtC,GAAG;AAAA,QACH,aAAa,gBAAgB;AAAA,QAC7B,WAAW,mBAAmB,YAAY;AAAA,QAC1C,cAAc,gBAAgB;AAAA,MAClC,CAAC;AAAA,IACL,SACO,OAAO;AAAA,IACd;AACA,WAAO;AAAA,MACH,OAAO,gBAAgB;AAAA,MACvB,YAAY;AAAA,IAChB;AAAA,EACJ,SACO,OAAO;AACV,wBAAoB,aAAa;AACjC,WAAO;AAAA,EACX;AACJ;;;ACnFA,IAAM,+BAA+B;AAC9B,IAAM,wBAAwB,OAAO,EAAE,aAAa,YAAY,cAAc,WAAW,aAAa,WAAW,cAAc,oBAAoB,SAAS,OAAQ,MAAM;AAC7K,MAAI;AACJ,QAAM,iBAAiB;AACvB,MAAI,YAAY;AACZ,QAAI;AACA,YAAM,SAAS,MAAM,QAAoB,EAAE,QAAQ,CAAC,EAAE;AACtD,cAAQ;AAAA,QACJ,aAAa,OAAO;AAAA,QACpB,WAAW,IAAI,KAAK,OAAO,UAAU,EAAE,YAAY;AAAA,MACvD;AAAA,IACJ,SACO,GAAG;AACN,YAAM,IAAI,yBAAyB,EAAE,SAAS;AAAA,QAC1C,aAAa;AAAA,QACb;AAAA,MACJ,CAAC;AAAA,IACL;AAAA,EACJ,OACK;AACD,QAAI;AACA,cAAQ,MAAM,oBAAoB,WAAW;AAAA,IACjD,SACO,GAAG;AACN,YAAM,IAAI,yBAAyB,4DAA4D,cAAc,IAAI;AAAA,QAC7G,aAAa;AAAA,QACb;AAAA,MACJ,CAAC;AAAA,IACL;AAAA,EACJ;AACA,MAAI,IAAI,KAAK,MAAM,SAAS,EAAE,QAAQ,IAAI,KAAK,IAAI,KAAK,GAAG;AACvD,UAAM,IAAI,yBAAyB,6DAA6D,cAAc,IAAI;AAAA,MAC9G,aAAa;AAAA,MACb;AAAA,IACJ,CAAC;AAAA,EACL;AACA,QAAM,EAAE,YAAY,IAAI;AACxB,QAAM,EAAE,WAAW,0BAA0B,IAAI,MAAM,OAAO,uBAAW;AACzE,QAAM,MAAM,aACR,IAAI,UAAU,OAAO,OAAO,CAAC,GAAG,gBAAgB,CAAC,GAAG;AAAA,IAChD,QAAQ,cAAc,UAAU,oBAAoB;AAAA,IACpD,QAAQ,cAAc,UAAU;AAAA,EACpC,CAAC,CAAC;AACN,MAAI;AACJ,MAAI;AACA,cAAU,MAAM,IAAI,KAAK,IAAI,0BAA0B;AAAA,MACnD,WAAW;AAAA,MACX,UAAU;AAAA,MACV;AAAA,IACJ,CAAC,CAAC;AAAA,EACN,SACO,GAAG;AACN,UAAM,IAAI,yBAAyB,GAAG;AAAA,MAClC,aAAa;AAAA,MACb;AAAA,IACJ,CAAC;AAAA,EACL;AACA,QAAM,EAAE,iBAAiB,EAAE,aAAa,iBAAiB,cAAc,YAAY,iBAAiB,UAAU,IAAI,CAAC,EAAG,IAAI;AAC1H,MAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,YAAY;AAClE,UAAM,IAAI,yBAAyB,gDAAgD;AAAA,MAC/E,aAAa;AAAA,MACb;AAAA,IACJ,CAAC;AAAA,EACL;AACA,QAAM,cAAc;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,IAAI,KAAK,UAAU;AAAA,IAC/B,GAAI,mBAAmB,EAAE,gBAAgB;AAAA,IACzC,GAAI,aAAa,EAAE,UAAU;AAAA,EACjC;AACA,MAAI,YAAY;AACZ,yBAAqB,aAAa,mBAAmB,GAAG;AAAA,EAC5D,OACK;AACD,yBAAqB,aAAa,0BAA0B,GAAG;AAAA,EACnE;AACA,SAAO;AACX;;;AClFO,IAAM,qBAAqB,CAAC,SAAS,WAAW;AACnD,QAAM,EAAE,eAAe,gBAAgB,YAAY,cAAc,IAAI;AACrE,MAAI,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,cAAc,CAAC,eAAe;AACpE,UAAM,IAAI,yBAAyB,iJACwB,OAAO,KAAK,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,qFAAwF,EAAE,aAAa,OAAO,OAAO,CAAC;AAAA,EACpN;AACA,SAAO;AACX;;;ACHO,IAAM,UAAU,CAAC,OAAO,CAAC,MAAM,OAAO,EAAE,mBAAmB,IAAI,CAAC,MAAM;AACzE,OAAK,QAAQ,MAAM,4CAA4C;AAC/D,QAAM,EAAE,aAAa,cAAc,WAAW,aAAa,WAAW,IAAI;AAC1E,QAAM,EAAE,UAAU,IAAI;AACtB,QAAM,cAAc,eAAe;AAAA,IAC/B,SAAS,KAAK,WAAW,oBAAoB;AAAA,EACjD,CAAC;AACD,MAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,aAAa,CAAC,eAAe,CAAC,YAAY;AAC5E,UAAM,WAAW,MAAM,gBAAgB,IAAI;AAC3C,UAAM,UAAU,SAAS,WAAW;AACpC,QAAI,CAAC,SAAS;AACV,YAAM,IAAI,yBAAyB,WAAW,WAAW,mBAAmB,EAAE,QAAQ,KAAK,OAAO,CAAC;AAAA,IACvG;AACA,QAAI,CAAC,aAAa,OAAO,GAAG;AACxB,YAAM,IAAI,yBAAyB,WAAW,WAAW,4CAA4C;AAAA,QACjG,QAAQ,KAAK;AAAA,MACjB,CAAC;AAAA,IACL;AACA,QAAI,SAAS,aAAa;AACtB,YAAM,cAAc,MAAM,mBAAmB,IAAI;AACjD,YAAM,UAAU,YAAY,QAAQ,WAAW;AAC/C,YAAM,cAAc,8BAA8B,WAAW,oBAAoB,QAAQ,WAAW;AACpG,UAAI,aAAa,cAAc,QAAQ,YAAY;AAC/C,cAAM,IAAI,yBAAyB,2BAA2B,aAAa;AAAA,UACvE,aAAa;AAAA,UACb,QAAQ,KAAK;AAAA,QACjB,CAAC;AAAA,MACL;AACA,UAAI,eAAe,gBAAgB,QAAQ,eAAe;AACtD,cAAM,IAAI,yBAAyB,8BAA8B,aAAa;AAAA,UAC1E,aAAa;AAAA,UACb,QAAQ,KAAK;AAAA,QACjB,CAAC;AAAA,MACL;AACA,cAAQ,aAAa,QAAQ;AAC7B,cAAQ,gBAAgB,QAAQ;AAAA,IACpC;AACA,UAAM,EAAE,eAAe,gBAAgB,YAAY,eAAe,YAAY,IAAI,mBAAmB,SAAS,KAAK,MAAM;AACzH,WAAO,sBAAsB;AAAA,MACzB,aAAa;AAAA,MACb,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,WAAW;AAAA,MACX,aAAa;AAAA,MACb;AAAA,MACA,cAAc,KAAK;AAAA,MACnB,oBAAoB,KAAK;AAAA,MACzB,SAAS;AAAA,IACb,CAAC;AAAA,EACL,WACS,CAAC,eAAe,CAAC,gBAAgB,CAAC,aAAa,CAAC,aAAa;AAClE,UAAM,IAAI,yBAAyB,gIAC8B,EAAE,aAAa,OAAO,QAAQ,KAAK,OAAO,CAAC;AAAA,EAChH,OACK;AACD,WAAO,sBAAsB;AAAA,MACzB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc,KAAK;AAAA,MACnB,oBAAoB,KAAK;AAAA,MACzB,SAAS;AAAA,IACb,CAAC;AAAA,EACL;AACJ;","names":[]}