@go-to-k/cdkd 0.290.16 → 0.290.18

package/dist/aws-client-defaults-BoIxyCir.js

@@ -0,0 +1,574 @@
+import { defaultProvider } from "@aws-sdk/credential-provider-node";
+import { NodeHttpHandler } from "@smithy/node-http-handler";
+import { Agent } from "node:http";
+import { Agent as Agent$1 } from "node:https";
+import { Agent as Agent$2 } from "agent-base";
+import { HttpProxyAgent } from "http-proxy-agent";
+import { HttpsProxyAgent } from "https-proxy-agent";
+import { getProxyForUrl } from "proxy-from-env";
+
+//#region src/utils/proxy-routing-agent.ts
+/**
+* An `http.Agent` that routes each request through the environment's proxy, or
+* direct, according to `HTTPS_PROXY` / `HTTP_PROXY` / `NO_PROXY`.
+*
+* WHY A ROUTING AGENT AND NOT A PLAIN PROXY AGENT
+*
+* `NodeHttpHandler` picks its agent by PROTOCOL alone — `httpsAgent` for an
+* `https:` request, `httpAgent` otherwise — and never consults the request's
+* host. `https-proxy-agent` does not read `NO_PROXY` either. So a statically
+* chosen proxy agent cannot express "this host is exempt", which is the whole
+* of what `NO_PROXY` means. Deciding per REQUEST is the only place the host is
+* known, and `agent-base` gives us that hook: when `connect()` returns an
+* `http.Agent` rather than a socket, the base class delegates the request to it
+* via `socket.addRequest(req, connectOpts)`.
+*
+* That delegation is also why the INNER agents carry `keepAlive` rather than
+* this one: the sockets pool on whichever agent `connect()` hands back, so a
+* `keepAlive` set only here would never be consulted.
+*
+* WHY THE INNER CACHE IS PER INSTANCE
+*
+* Node's `Agent.prototype.destroy()` walks `[this.freeSockets, this.sockets]`,
+* and the second is the ACTIVE set — it aborts in-flight requests, not just
+* idle sockets. `NodeHttpHandler.destroy()` forwards to `httpAgent` and
+* `httpsAgent` unconditionally, external instances included, and cdkd destroys
+* clients mid-run (`deploy` drops the STS client right after
+* `GetCallerIdentity`). A module-global inner cache would therefore let one
+* client's teardown kill another client's live request. Each `AwsClients`
+* client gets its own routing agent, so the cache is scoped to `this` and
+* {@link destroy} forwards to the inner agents — without that forwarding the
+* tunneled sockets would outlive the client and keep the process alive.
+*
+* The cost of not sharing is duplicate CONNECT + TLS handshakes where two
+* clients talk to the same host. Pooling is per host either way, so sharing
+* could never remove the FIRST handshake to each distinct AWS endpoint, and
+* most runtime traffic goes through the per-service `AwsClients` singleton, so
+* the duplicates are few. This is also what the SDK already does: it builds a
+* `keepAlive` agent per client on the unproxied path.
+*/
+/**
+* Applied to every inner agent.
+*
+* The SDK sets these itself, but ONLY when it is handed a plain option bag —
+* an external `Agent` instance is passed through untouched
+* (`@smithy/node-http-handler`'s `NodeHttpHandler` constructor). Since a
+* routing agent IS such an instance, omitting them would silently drop
+* connection reuse for every proxied run, and a concurrent deploy would
+* renegotiate TLS per request.
+*/
+const INNER_AGENT_OPTIONS = {
+	keepAlive: true,
+	maxSockets: 50
+};
+/**
+* Build the absolute URL `getProxyForUrl` needs from what `connect()` is given.
+*
+* An IPv6 literal is bracketed, or the `host:port` join produces a string no
+* URL parser accepts (`https://::1:443`) and `NO_PROXY` could never match an
+* IPv6 entry. Unreachable with AWS hostnames; handled because the alternative
+* is a silent wrong answer rather than an error.
+*/
+function requestUrl(options) {
+	const secure = options.secureEndpoint;
+	const rawHost = options.host ?? "localhost";
+	const host = rawHost.includes(":") && !rawHost.startsWith("[") ? `[${rawHost}]` : rawHost;
+	const port = options.port ?? (secure ? 443 : 80);
+	return `${secure ? "https" : "http"}://${host}:${port}`;
+}
+var ProxyRoutingAgent = class extends Agent$2 {
+	/**
+	* Inner agents by `<scheme>|<proxy url or "direct">`.
+	*
+	* Keyed on the proxy URL and not merely on "proxied or not" because
+	* `NO_PROXY` is not the only thing that varies per host: `HTTP_PROXY` and
+	* `HTTPS_PROXY` may name different proxies, and a single agent bound to one
+	* of them would quietly send the other scheme's traffic to the wrong place.
+	*/
+	innerAgents = /* @__PURE__ */ new Map();
+	connect(_req, options) {
+		const secure = options.secureEndpoint;
+		const proxyUrl = getProxyForUrl(requestUrl(options));
+		const key = `${secure ? "https" : "http"}|${proxyUrl || "direct"}`;
+		const cached = this.innerAgents.get(key);
+		if (cached) return cached;
+		const agent = createInnerAgent(secure, proxyUrl);
+		this.innerAgents.set(key, agent);
+		return agent;
+	}
+	destroy() {
+		for (const agent of this.innerAgents.values()) agent.destroy();
+		this.innerAgents.clear();
+		super.destroy();
+	}
+};
+function createInnerAgent(secure, proxyUrl) {
+	if (!proxyUrl) return secure ? new Agent$1(INNER_AGENT_OPTIONS) : new Agent(INNER_AGENT_OPTIONS);
+	return secure ? new HttpsProxyAgent(proxyUrl, INNER_AGENT_OPTIONS) : new HttpProxyAgent(proxyUrl, INNER_AGENT_OPTIONS);
+}
+
+//#endregion
+//#region src/utils/aws-client-defaults.ts
+/**
+* Client config every AWS SDK client in cdkd must be built with.
+*
+* WHY THIS EXISTS
+*
+* The AWS SDK for JavaScript v3 does NOT read `HTTPS_PROXY` / `HTTP_PROXY` the
+* way botocore (the AWS CLI) and Go's `net/http` do. Its own guide says a proxy
+* is supplied "through a third-party HTTP agent" by whoever constructs the
+* client — so on a machine whose only egress is a corporate proxy, an SDK call
+* dials out directly and fails, typically as
+* `CredentialsProviderError: self-signed certificate in certificate chain`
+* because the direct route is what the network intercepts (issue #2388).
+*
+* Node 24's `NODE_USE_ENV_PROXY=1` is not a way out: it rewires the GLOBAL
+* agent, and every SDK client builds its own.
+*
+* WHY THE CREDENTIAL CHAIN IS INJECTED TOO
+*
+* A client's `requestHandler` does not reach every credential hop:
+*
+* - STS (`role_arn` profiles, web identity) reads `requestHandler` off
+*   `parentClientConfig`, so it INHERITS ours. Nothing to do.
+* - `@aws-sdk/credential-provider-sso` builds its portal client from
+*   `clientConfig` alone, coalescing only `logger`, `region` and
+*   `userAgentAppId` from the caller. `@aws-sdk/token-providers` does the same
+*   for the SSO-OIDC refresh. So an SSO profile fails at
+*   `resolveSSOCredentials` — BEFORE any service call — unless the chain is
+*   constructed here with the handler threaded through `clientConfig`.
+* - IMDS (`@smithy/credential-provider-imds`) and ECS container credentials
+*   (`@aws-sdk/credential-provider-http`) call `node:http` / build their own
+*   handler, so they bypass a proxy on their own and need no special casing.
+*
+* The chain is therefore built per call. `defaultProvider` MEMOIZES resolved
+* credentials inside the chain instance, so one shared instance would hand a
+* client configured for profile A the credentials of profile B. Per call costs
+* nothing relative to today, since each client already builds its own chain.
+*
+* `clientConfig` carries `requestHandler` and NOTHING else — a `region` there
+* would override the SSO portal's own region — and `profile` is passed
+* ALONGSIDE it, because the built-in chain sees a profile through the client
+* config while an injected chain does not.
+*
+* SPREAD THIS FIRST, SITE-SPECIFIC CONFIG SECOND
+*
+* `new S3Client({ ...awsClientDefaults({ profile }), region, ...(creds && { credentials: creds }) })`
+*
+* A site that supplies its own `credentials` must keep them — `config-loader`'s
+* default-bucket probe reuses the STS client's resolved provider on purpose, so
+* that the bucket it probes is checked as the identity the name was derived
+* from. That provider already carries the handler, because the STS client it
+* came from was built through this helper.
+*
+* WHY THE ASSUMED ROLE IS PUBLISHED FROM HERE
+*
+* `--role-arn` / `CDKD_ROLE_ARN` used to reach the SDK through the `AWS_*`
+* environment variables ALONE (`src/utils/role-arn.ts`). That channel is dead
+* whenever a profile is selected: `@aws-sdk/credential-provider-node` skips the
+* env-var provider entirely once `AWS_PROFILE` is set OR a `profile` is passed
+* on the client config, so `cdkd deploy --profile ci --role-arn <r>` assumed the
+* role, logged it as assumed, and then issued every AWS call as the profile's
+* own principal — in the wrong account, silently (issue
+* [#3130](https://github.com/go-to-k/cdkd/issues/3130)).
+*
+* Clearing `AWS_PROFILE` would not have closed it: cdkd ALSO threads `profile`
+* as an explicit client-config key at every construction site, and an explicit
+* key outranks the environment. So the assumed credentials are published HERE
+* instead, as an explicit `credentials` value — which outranks BOTH, because
+* `resolveAwsSdkSigV4Config` uses `config.credentials` when present and never
+* builds the default chain, leaving `profile` to select non-credential settings
+* only (`role-arn.ts`'s header carries why the profile is left in place).
+*
+* This is the one place that reaches every client without a per-site edit:
+* `scripts/check-aws-client-defaults.ts` requires this helper to be spread
+* FIRST at EVERY `new XxxClient(...)` under `src/**`, with an EMPTY allow-list.
+* The same spread order keeps a site's OWN explicit `credentials` winning — the
+* cross-account `Fn::GetStackOutput` read stays scoped to the producer's role.
+*
+* Clients built OUTSIDE `src/**` (cdk-local's own, the CDK app subprocess) see
+* none of this; they read the `AWS_*` triple `applyRoleArnIfSet` also writes,
+* which the SDK honours for them unless a profile is selected.
+*/
+/**
+* The profile `@smithy/shared-ini-file-loader`'s `getProfileName` falls back to
+* when neither a client config nor `AWS_PROFILE` names one.
+*
+* Naming it EXPLICITLY is how {@link callerIdentityForOptOut} builds shape 3's
+* chain: `credential-provider-node`'s first link short-circuits whenever
+* `init.profile ?? process.env.AWS_PROFILE` is truthy, and every OTHER link it
+* feeds (`fromSSO` / `fromIni` / `fromProcess`) resolves the same profile name
+* it would have defaulted to, while `fromTokenFile` and the container / IMDS
+* providers do not read a profile at all. So passing this is EXACTLY "the
+* default chain minus its environment link" — the one thing that has to be
+* subtracted, expressed through the SDK's own documented precedence rather than
+* by re-spelling the chain (which would then go stale on an SDK bump).
+*/
+const SDK_DEFAULT_PROFILE = "default";
+/**
+* The one warning {@link CHAIN_LOGGER} drops, matched on its distinctive line
+* rather than on the whole text: the rest of the message is advisory prose an
+* SDK bump is free to reword, while this line is the warning's identity.
+*/
+const MULTIPLE_CREDENTIAL_SOURCES_WARNING = "Multiple credential sources detected";
+/**
+* Handed to shape 3's injected chain to drop exactly ONE message —
+* `credential-provider-node`'s `Multiple credential sources detected` warning —
+* while every other warning the chain emits still reaches the user.
+*
+* That warning fires on `profile set AND AWS_ACCESS_KEY_ID/SECRET set`, which
+* is exactly shape 3's inputs, because this module NAMES `default` as the
+* profile ({@link SDK_DEFAULT_PROFILE}) to subtract the env link. Its text
+* ("Both AWS_PROFILE and the pair ... are set. This SDK will proceed with the
+* AWS_PROFILE value.") is FALSE here: `AWS_PROFILE` is unset, the profile name
+* is one cdkd passed, and the triple is one cdkd itself wrote. Left alone it
+* goes to `console.warn`, outside cdkd's logger, on every shape-3 client.
+*
+* **Scoped to shape 3, deliberately.** Shape 1 (`AWS_PROFILE` or a `profile`
+* key selected) returns `{}`, so the client builds the chain itself with no
+* logger and the SDK still emits this warning to `console.warn`. That is left
+* alone: there the message is TRUE — a profile really is selected and really
+* does win — so only its closing advice is unhelpful, and silencing it would
+* mean injecting a logger into every client config in the tree.
+*
+* **Why not a wholesale `warn: () => {}`.** Shape 3's own population is who
+* loses real warnings: `@smithy/credential-provider-imds`'s
+* `staticStabilityProvider` warns on `Credential renew failed:` and on
+* extending an expiration, and `@aws-sdk/credential-provider-http`'s `fromHttp`
+* warns when both the relative and full container-credential URIs (or both
+* token spellings) are set. Both of those default to `console` when no logger
+* is passed, so forwarding `warn` to the console restores their baseline
+* exactly. `trace` / `debug` / `info` stay no-ops: `defaultProvider`
+* reaches those through `logger?.` and therefore emits NOTHING without a
+* logger, so forwarding them would newly print a per-link chain trace on every
+* shape-3 run.
+*
+* **`error` is DEFENSIVE, and restores no baseline** — the claim above is true
+* of `warn` alone. No link in the installed chain calls either spelling of it:
+* across `@aws-sdk/credential-provider-*`, `@aws-sdk/token-providers` and
+* `@smithy/credential-provider-imds` the logger methods invoked are
+* `logger?.debug`, `logger?.warn` and `logger.warn`, with zero `logger.error` /
+* `logger?.error` (measured 2026-09-17), and the imds `options?.logger ||
+* console` default is therefore warn-only in practice. The arm is kept so that
+* a link which starts raising one is not silenced by cdkd having supplied a
+* logger. If such a link arrives, re-decide this arm rather than assuming it is
+* still right: a new link will most likely reach the logger through
+* `logger?.error`, which is the same optional-call shape that makes `info`
+* silent without a logger — so forwarding it would print a line the SDK emits
+* for nobody today, and the `info` argument above applies to it unchanged.
+*
+* **A dropped emission is permanent, and that is a bound, not a claim of
+* harmlessness.** `multipleCredentialSourceWarningEmitted` is a module-global
+* one-shot inside `credential-provider-node`, and the SDK sets it whether or
+* not the logger printed anything — so a drop here silences any LATER
+* emission in the process, including one from a chain cdk-local builds. What
+* makes that acceptable is reachability rather than scope: a later legitimate
+* emission needs a profile selected, and a selected profile is shape 1, where
+* nothing is dropped. Only a caller that builds a shape-3 client and then
+* selects a profile in the SAME process could lose one, and no cdkd path does:
+* `buildProgram`'s `preAction` hook (`src/cli/program.ts`) mirrors `--profile`
+* into `process.env.AWS_PROFILE` BEFORE any command action runs, so a
+* `--profile` run is shape 1 at every site from its first client onward.
+*
+* **That hook is the whole argument, which is why it is named.** Only 2 of the
+* 19 opt-out sites pass `profile` to this helper, so "a `--profile` run passes
+* the key to every site" is NOT what makes the claim true — and moving the
+* mirror into the individual commands, or dropping it because the SDK reads the
+* flag anyway, would kill the reachability argument with nothing in THIS file's
+* tests failing. Removing the hook outright does red three cases that assert it
+* directly (`AWS_PROFILE` set before a nested command action runs, and two
+* siblings), so the tree is not silent about the hook itself — it is silent
+* about this argument depending on it.
+*
+* **A BOUND on both forwards** (go-to-k/cdkd#3003, recorded rather than fixed):
+* `console.warn` / `console.error` bypass `ConsoleLogger.formatMessage`, so the
+* extra arguments the chain passes — an SDK error object on
+* `logger.warn("Credential renew failed: ", e)` — skip the C0 / C1 / bidi
+* denylist every cdkd logger call inherits, and skip cdkd's level control too.
+* It is NOT a regression: without a logger those links write to `console`
+* themselves, so the baseline is the same unsanitized call. Routing through
+* `getLogger()` is what the fix would need, and it collides with the import
+* closure this file's own import block describes: this module is reachable from
+* `aws-clients.ts`, so every relative import in it must carry the `.ts`
+* spelling, and `src/utils/logger.ts` reaches `display-safe` /
+* `live-renderer` / `stack-context` through `.js` specifiers — pulling the
+* whole tree into the closure `vp run audit:coverage:check` resolves the way
+* `node` does. The same constraint is why the whitespace-proxy refusal below
+* throws a plain `Error` rather than a `CdkdError`.
+*
+* `constructor.name` must not be `NoOpLogger` or `credential-provider-node`
+* routes the warning to `console.warn` instead of here — a plain object literal
+* is what satisfies that.
+*
+* EXPORTED as a test seam only, like {@link resetAwsClientDefaults}. No
+* `src/**` module reads it THROUGH this export — the one reader is
+* `callerIdentityForOptOut` below, which hands it straight to `defaultProvider`.
+* `defaultProvider` closes over it, so `error` —
+* the arm no installed link calls — is reachable from a test by NO other route.
+* Do not mutate it: every shape-3 chain in the process shares this one object.
+*/
+const CHAIN_LOGGER = {
+	trace: (..._args) => {},
+	debug: (..._args) => {},
+	info: (..._args) => {},
+	warn: (...args) => {
+		if (args.some((arg) => typeof arg === "string" && arg.includes(MULTIPLE_CREDENTIAL_SOURCES_WARNING))) return;
+		console.warn(...args);
+	},
+	error: (...args) => {
+		console.error(...args);
+	}
+};
+/**
+* The proxy variables, in the order `proxy-from-env` itself reads them.
+*
+* Only their PRESENCE is decided here. Which one applies to a given request —
+* and whether `NO_PROXY` exempts it — is `getProxyForUrl`'s job, per request,
+* inside {@link ProxyRoutingAgent}. Deciding it here instead would collapse
+* `HTTP_PROXY` and `HTTPS_PROXY` into one answer and send `http://` traffic to
+* an HTTPS proxy.
+*/
+const PROXY_ENV_VARS = [
+	"HTTPS_PROXY",
+	"https_proxy",
+	"HTTP_PROXY",
+	"http_proxy",
+	"ALL_PROXY",
+	"all_proxy"
+];
+let proxyConfigured;
+/**
+* The credentials `--role-arn` assumed for THIS process, or `undefined` when no
+* role was assumed. Set once, at the command's entry, by `applyRoleArnIfSet`.
+*
+* Process-global for the same reason the `AWS_*` env vars it replaces were:
+* `--role-arn` is a process-wide decision taken before any stack work starts,
+* so there is nothing per-stack or per-concurrent-task to key it on. It is
+* monotonic — set once and never unset in production — so a client built before
+* it is set and one built after cannot disagree about which identity the user
+* chose; only about whether the role had been assumed yet, and every command
+* assumes it before constructing any other client. That is ENFORCED, not
+* merely intended: {@link setAssumedRoleCredentials} refuses a second publish.
+*/
+let assumedRoleCredentials;
+/**
+* The `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN` triple
+* the process was started with, captured by `applyRoleArnIfSet` IMMEDIATELY
+* BEFORE it overwrites those variables with the assumed role's.
+*
+* `undefined` means one of two different things, and the caller must not
+* conflate them: no role has been assumed at all (ask
+* {@link getAssumedRoleCredentials}), or a role was assumed and the caller had
+* NO static credentials in its environment — the SSO / IMDS / container-role
+* chains, where the triple was absent before the assume and there is nothing to
+* restore. `src/utils/caller-credentials.ts` is the one place that reads the two
+* together and turns them into an answer.
+*
+* Process-global for the same reason {@link assumedRoleCredentials} is: this is
+* the state of the environment at a single process-wide decision point.
+*/
+let preAssumeEnvCredentials;
+/**
+* The message BOTH ends of the single-publish invariant refuse with — this
+* module's {@link setAssumedRoleCredentials} and `role-arn.ts`'s
+* `applyRoleArnIfSet`, which trips first so that nothing is corrupted before
+* the refusal (see that function's comment).
+*
+* Shared rather than spelled twice: the two were byte-identical copies, so
+* rewording one would silently leave a user facing two different explanations
+* of one invariant depending on which end caught them — and the test that
+* matches the text would keep passing against the stale copy.
+*/
+const SECOND_ROLE_PUBLISH_REFUSAL = "An assumed role has already been published for this process. `--role-arn` is a single process-wide decision taken once at a command entry; publishing a second role would leave clients built before and after it running as different identities.";
+/**
+* Publish the credentials `--role-arn` assumed, so every later SDK client
+* built through {@link awsClientDefaults} runs as the role.
+*
+* Called by `applyRoleArnIfSet` AFTER the `sts:AssumeRole` hop completes — the
+* base credentials (a profile, the env, an instance role) must still be the
+* ones answering that hop.
+*
+* **A SECOND publish is REFUSED.** {@link assumedRoleCredentials}'s doc calls
+* the value monotonic, and every consumer relies on it: a client built before a
+* second publish and one built after would run as DIFFERENT identities inside
+* one process, with nothing naming which. `applyRoleArnIfSet` is meant to run
+* once at a command's entry, so a second call is a wiring defect — and the
+* failure it produces without this refusal is silent and account-scoped, which
+* is the class issue [#3130](https://github.com/go-to-k/cdkd/issues/3130)
+* exists to close. `resetAwsClientDefaults()` is the only way back, and it is a
+* TEST seam. A plain `Error` rather than `CdkdError` for this module's usual
+* reason: importing the error module would add a relative `.js` import to the
+* closure `scripts/audit-provider-coverage.ts` resolves literally.
+*
+* The bag is COPIED rather than stored by reference. The same object is handed
+* to every client `awsClientDefaults` serves, so aliasing the caller's would
+* let whoever still holds it rewrite the identity of clients already built —
+* the reason `AwsClients.credentialConfig` clones for its own siblings.
+*/
+function setAssumedRoleCredentials(credentials) {
+	if (assumedRoleCredentials !== void 0) throw new Error(SECOND_ROLE_PUBLISH_REFUSAL);
+	assumedRoleCredentials = {
+		accessKeyId: credentials.accessKeyId,
+		secretAccessKey: credentials.secretAccessKey,
+		sessionToken: credentials.sessionToken,
+		...credentials.expiration && { expiration: credentials.expiration }
+	};
+}
+/**
+* Record the caller's own pre-assume environment credentials, or `undefined`
+* when the environment carried none.
+*
+* Called by `applyRoleArnIfSet` BEFORE it overwrites the `AWS_*` triple —
+* afterwards the value is unrecoverable, and it is the only identity the
+* `cdkd local` surface may hand to an emulated workload.
+*
+* COPIED rather than stored by reference, for {@link setAssumedRoleCredentials}'s
+* reason and with more reach than it had before: since shape 2 of the
+* `ignoreAssumedRole` opt-out reads this snapshot, it is the source of the
+* identity EVERY opted-out client runs as, and {@link getPreAssumeEnvCredentials}
+* hands it out. Aliasing the caller's object would let whoever still holds it
+* rewrite that identity after the fact.
+*/
+function setPreAssumeEnvCredentials(credentials) {
+	preAssumeEnvCredentials = credentials ? {
+		accessKeyId: credentials.accessKeyId,
+		secretAccessKey: credentials.secretAccessKey,
+		...credentials.sessionToken !== void 0 && { sessionToken: credentials.sessionToken }
+	} : void 0;
+}
+/**
+* The credentials recorded by {@link setPreAssumeEnvCredentials}, if any.
+*
+* Read by `src/utils/caller-credentials.ts` — the local surface's env channel —
+* and by tests. Read it THROUGH that module rather than directly: `undefined`
+* here is ambiguous on its own (see {@link preAssumeEnvCredentials}).
+*
+* The returned bag is this module's OWN copy, not the caller's — do not mutate
+* it; shape 2 of the opt-out resolves every opted-out client's identity from
+* the same object.
+*/
+function getPreAssumeEnvCredentials() {
+	return preAssumeEnvCredentials;
+}
+/**
+* The credentials published by {@link setAssumedRoleCredentials}, if any.
+*
+* ONE production consumer, and it asks a yes/no question rather than using the
+* value: `applyRoleArnIfSet` reads it to refuse a second `--role-arn` BEFORE
+* its `AssumeRole` hop, so that nothing is corrupted first. No client ever
+* reads it — every one of those receives the credentials through
+* {@link awsClientDefaults} — so this is not a way to "get the role" and must
+* not become one; a site that wants the role's identity simply omits
+* `ignoreAssumedRole`.
+*/
+function getAssumedRoleCredentials() {
+	return assumedRoleCredentials;
+}
+function isProxyConfigured() {
+	if (proxyConfigured === void 0) {
+		let configured = false;
+		for (const name of PROXY_ENV_VARS) {
+			const value = process.env[name];
+			if (value === void 0 || value === "") continue;
+			if (value.trim() === "") throw new Error(`${name} is set to whitespace only. Set it to a proxy URL (e.g. http://proxy.example:8080) or unset it.`);
+			configured = true;
+		}
+		proxyConfigured = configured;
+	}
+	return proxyConfigured;
+}
+/**
+* The identity a client that passed `ignoreAssumedRole` must run as, or
+* `undefined` when the SDK's own chain already resolves the caller and nothing
+* needs injecting.
+*
+* Only called once a role HAS been published — see
+* {@link AwsClientDefaultsOptions.ignoreAssumedRole} for the three shapes and
+* why shape 3 cannot be left to the default chain.
+*
+* `process.env` is READ here and never written. Clearing the triple around the
+* client construction would be the obvious alternative and is wrong: cdkd
+* builds clients concurrently (`--concurrency`, parallel stacks), so a window
+* in which the triple is absent is a window another task resolves through.
+*
+* TWO BOUNDS, RECORDED RATHER THAN CLOSED
+*
+* 1. **A `[default]` profile that sources the environment defeats shape 3.**
+*    Subtracting the chain's own env link does not subtract `fromEnv` reached
+*    THROUGH another link, and `credential_source = Environment` in the
+*    `[default]` profile is exactly that — so the opt-out resolves the ROLE's
+*    triple again. Its sibling is `credential_process`: the ini format has no
+*    environment interpolation, so a templated `aws_access_key_id` is not a
+*    vector, but a helper process that reads `AWS_ACCESS_KEY_ID` out of the
+*    environment it inherits and echoes it back defeats the subtraction
+*    identically. It is a narrow case and it is not a regression: before this
+*    shape existed the same configuration simply resolved the role too. Closing
+*    it would mean neutering `process.env` around the resolution, which the
+*    paragraph above rules out on concurrency grounds.
+* 2. **Shapes 2 and 3 inject an explicit `credentials`, which outranks a
+*    `profile` key a site sets AFTER the spread.** Shape 1 exists to hand the
+*    profile back to the SDK, but it only sees a profile passed through
+*    {@link AwsClientDefaultsOptions.profile} or `AWS_PROFILE` — a site that
+*    passes neither and then writes `profile: x` into its own client literal
+*    gets shape 2/3's credentials instead, silently. No site does that today
+*    (all 19 opt-out sites audited at PR #3223), and no fence catches it: the
+*    local-surface fence asks whether a site DECLARED an identity, not which
+*    keys its literal carries. Pass the profile to this helper, not only to the
+*    client.
+*/
+function callerIdentityForOptOut(options, requestHandler) {
+	const profile = options.profile !== void 0 && options.profile !== "" ? options.profile : process.env["AWS_PROFILE"];
+	if (profile !== void 0 && profile !== "") return void 0;
+	const caller = preAssumeEnvCredentials;
+	if (caller) return {
+		accessKeyId: caller.accessKeyId,
+		secretAccessKey: caller.secretAccessKey,
+		...caller.sessionToken && { sessionToken: caller.sessionToken }
+	};
+	return defaultProvider({
+		profile: SDK_DEFAULT_PROFILE,
+		logger: CHAIN_LOGGER,
+		...requestHandler && { clientConfig: { requestHandler } }
+	});
+}
+/**
+* Returns `{}` when no proxy is configured, no role has been assumed, and no
+* opt-out is in play — which keeps that path byte-identical to what the SDK
+* builds on its own and makes this a no-op for every existing user.
+*/
+function awsClientDefaults(options = {}) {
+	const proxied = isProxyConfigured();
+	const optedOut = options.ignoreAssumedRole === true;
+	const assumed = optedOut ? void 0 : assumedRoleCredentials;
+	const optedOutOfPublishedRole = optedOut && assumedRoleCredentials !== void 0;
+	if (!proxied) {
+		if (assumed) return { credentials: assumed };
+		const caller = optedOutOfPublishedRole ? callerIdentityForOptOut(options, void 0) : void 0;
+		return caller ? { credentials: caller } : {};
+	}
+	const agent = new ProxyRoutingAgent();
+	const requestHandler = new NodeHttpHandler({
+		httpAgent: agent,
+		httpsAgent: agent
+	});
+	if (assumed) return {
+		requestHandler,
+		credentials: assumed
+	};
+	const caller = optedOutOfPublishedRole ? callerIdentityForOptOut(options, requestHandler) : void 0;
+	if (caller) return {
+		requestHandler,
+		credentials: caller
+	};
+	return {
+		requestHandler,
+		credentials: defaultProvider({
+			...options.profile !== void 0 && options.profile !== "" && { profile: options.profile },
+			clientConfig: { requestHandler }
+		})
+	};
+}
+
+//#endregion
+export { setAssumedRoleCredentials as a, getPreAssumeEnvCredentials as i, awsClientDefaults as n, setPreAssumeEnvCredentials as o, getAssumedRoleCredentials as r, SECOND_ROLE_PUBLISH_REFUSAL as t };
+//# sourceMappingURL=aws-client-defaults-BoIxyCir.js.map