@larkup/cli 0.2.24 → 0.2.26

package/dist/dist-es-KMHWFNXI.js

@@ -0,0 +1,295 @@
+import {
+  setCredentialFeature
+} from "./chunk-N6IF5QLH.js";
+import "./chunk-ODWAFTDP.js";
+import {
+  CredentialsProviderError,
+  getProfileName,
+  parseKnownFiles
+} from "./chunk-HAABLEPO.js";
+import {
+  HttpRequest
+} from "./chunk-MACWQEJS.js";
+import "./chunk-QGM4M3NI.js";
+
+// ../../node_modules/.pnpm/@aws-sdk+credential-provider-login@3.972.77/node_modules/@aws-sdk/credential-provider-login/dist-es/LoginCredentialsFetcher.js
+import { createHash, createPrivateKey, createPublicKey, sign } from "crypto";
+import { promises as fs } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+var LoginCredentialsFetcher = class _LoginCredentialsFetcher {
+  profileData;
+  init;
+  callerClientConfig;
+  static REFRESH_THRESHOLD = 5 * 60 * 1e3;
+  constructor(profileData, init, callerClientConfig) {
+    this.profileData = profileData;
+    this.init = init;
+    this.callerClientConfig = callerClientConfig;
+  }
+  async loadCredentials() {
+    const token = await this.loadToken();
+    if (!token) {
+      throw new CredentialsProviderError(`Failed to load a token for session ${this.loginSession}, please re-authenticate using aws login`, { tryNextLink: false, logger: this.logger });
+    }
+    const accessToken = token.accessToken;
+    const now = Date.now();
+    const expiryTime = new Date(accessToken.expiresAt).getTime();
+    const timeUntilExpiry = expiryTime - now;
+    if (timeUntilExpiry <= _LoginCredentialsFetcher.REFRESH_THRESHOLD) {
+      return this.refresh(token);
+    }
+    return this.toCredentials(token.accessToken);
+  }
+  get logger() {
+    return this.init?.logger;
+  }
+  get loginSession() {
+    return this.profileData.login_session;
+  }
+  toCredentials(token) {
+    return {
+      accessKeyId: token.accessKeyId,
+      secretAccessKey: token.secretAccessKey,
+      sessionToken: token.sessionToken,
+      accountId: token.accountId,
+      expiration: new Date(token.expiresAt)
+    };
+  }
+  async refresh(token) {
+    const diskToken = await this.loadToken().catch(() => token);
+    const now = Date.now();
+    const diskExpiry = new Date(diskToken.accessToken.expiresAt).getTime();
+    const tokenExpiry = new Date(token.accessToken.expiresAt).getTime();
+    const freshToken = diskExpiry <= now && tokenExpiry > now ? token : diskToken;
+    const freshExpiry = new Date(freshToken.accessToken.expiresAt).getTime();
+    if (freshExpiry - Date.now() > _LoginCredentialsFetcher.REFRESH_THRESHOLD) {
+      return this.toCredentials(freshToken.accessToken);
+    }
+    const { SigninClient, CreateOAuth2TokenCommand } = await import("./signin-7FUGJFG3.js");
+    const { logger, userAgentAppId } = this.callerClientConfig ?? {};
+    const isH2 = (requestHandler2) => {
+      return requestHandler2?.metadata?.handlerProtocol === "h2";
+    };
+    const requestHandler = isH2(this.callerClientConfig?.requestHandler) ? void 0 : this.callerClientConfig?.requestHandler;
+    const region = this.profileData.region ?? await this.callerClientConfig?.region?.() ?? process.env.AWS_REGION;
+    const client = new SigninClient({
+      credentials: {
+        accessKeyId: "",
+        secretAccessKey: ""
+      },
+      region,
+      requestHandler,
+      logger,
+      userAgentAppId,
+      ...this.init?.clientConfig
+    });
+    this.createDPoPInterceptor(client.middlewareStack);
+    const commandInput = {
+      tokenInput: {
+        clientId: freshToken.clientId,
+        refreshToken: freshToken.refreshToken,
+        grantType: "refresh_token"
+      }
+    };
+    try {
+      const response = await client.send(new CreateOAuth2TokenCommand(commandInput));
+      const { accessKeyId, secretAccessKey, sessionToken } = response.tokenOutput?.accessToken ?? {};
+      const { refreshToken, expiresIn } = response.tokenOutput ?? {};
+      if (!accessKeyId || !secretAccessKey || !sessionToken || !refreshToken) {
+        throw new CredentialsProviderError("Token refresh response missing required fields", {
+          logger: this.logger,
+          tryNextLink: false
+        });
+      }
+      const expiresInMs = (expiresIn ?? 900) * 1e3;
+      const expiration = new Date(Date.now() + expiresInMs);
+      const updatedToken = {
+        ...freshToken,
+        accessToken: {
+          ...freshToken.accessToken,
+          accessKeyId,
+          secretAccessKey,
+          sessionToken,
+          expiresAt: expiration.toISOString()
+        },
+        refreshToken
+      };
+      await this.saveToken(updatedToken);
+      return this.toCredentials(updatedToken.accessToken);
+    } catch (error) {
+      if (error.name === "AccessDeniedException") {
+        const errorType = error.error;
+        let message;
+        switch (errorType) {
+          case "TOKEN_EXPIRED":
+            message = "Your session has expired. Please reauthenticate.";
+            break;
+          case "USER_CREDENTIALS_CHANGED":
+            message = "Unable to refresh credentials because of a change in your password. Please reauthenticate with your new password.";
+            break;
+          case "INSUFFICIENT_PERMISSIONS":
+            message = "Unable to refresh credentials due to insufficient permissions. You may be missing permission for the 'CreateOAuth2Token' action.";
+            break;
+          default:
+            message = `Failed to refresh token: ${String(error)}. Please re-authenticate using \`aws login\``;
+        }
+        throw new CredentialsProviderError(message, {
+          logger: this.logger,
+          tryNextLink: false
+        });
+      }
+      const tokenExpiry2 = new Date(freshToken.accessToken.expiresAt).getTime();
+      if (tokenExpiry2 > Date.now()) {
+        this.logger?.warn?.(`Failed to refresh token: ${String(error)}. Using existing token until expiry.`);
+        return this.toCredentials(freshToken.accessToken);
+      }
+      throw new CredentialsProviderError(`Failed to refresh token: ${String(error)}. Please re-authenticate using aws login`, { logger: this.logger });
+    }
+  }
+  async loadToken() {
+    const tokenFilePath = this.getTokenFilePath();
+    try {
+      const tokenData = await fs.readFile(tokenFilePath, "utf8");
+      const token = JSON.parse(tokenData);
+      const missingFields = ["accessToken", "clientId", "refreshToken", "dpopKey"].filter((k) => !token[k]);
+      if (!token.accessToken?.accountId) {
+        missingFields.push("accountId");
+      }
+      if (missingFields.length > 0) {
+        throw new CredentialsProviderError(`Token validation failed, missing fields: ${missingFields.join(", ")}`, {
+          logger: this.logger,
+          tryNextLink: false
+        });
+      }
+      return token;
+    } catch (error) {
+      throw new CredentialsProviderError(`Failed to load token from ${tokenFilePath}: ${String(error)}`, {
+        logger: this.logger,
+        tryNextLink: false
+      });
+    }
+  }
+  async saveToken(token) {
+    const tokenFilePath = this.getTokenFilePath();
+    const directory = dirname(tokenFilePath);
+    try {
+      await fs.mkdir(directory, { recursive: true });
+    } catch (error) {
+    }
+    await fs.writeFile(tokenFilePath, JSON.stringify(token, null, 2), "utf8");
+  }
+  getTokenFilePath() {
+    const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ?? join(homedir(), ".aws", "login", "cache");
+    const loginSessionBytes = Buffer.from(this.loginSession, "utf8");
+    const loginSessionSha256 = createHash("sha256").update(loginSessionBytes).digest("hex");
+    return join(directory, `${loginSessionSha256}.json`);
+  }
+  derToRawSignature(derSignature) {
+    let offset = 2;
+    if (derSignature[offset] !== 2) {
+      throw new Error("Invalid DER signature");
+    }
+    offset++;
+    const rLength = derSignature[offset++];
+    let r = derSignature.subarray(offset, offset + rLength);
+    offset += rLength;
+    if (derSignature[offset] !== 2) {
+      throw new Error("Invalid DER signature");
+    }
+    offset++;
+    const sLength = derSignature[offset++];
+    let s = derSignature.subarray(offset, offset + sLength);
+    r = r[0] === 0 ? r.subarray(1) : r;
+    s = s[0] === 0 ? s.subarray(1) : s;
+    const rPadded = Buffer.concat([Buffer.alloc(32 - r.length), r]);
+    const sPadded = Buffer.concat([Buffer.alloc(32 - s.length), s]);
+    return Buffer.concat([rPadded, sPadded]);
+  }
+  createDPoPInterceptor(middlewareStack) {
+    middlewareStack.add((next) => async (args) => {
+      if (HttpRequest.isInstance(args.request)) {
+        const request = args.request;
+        const actualEndpoint = `${request.protocol}//${request.hostname}${request.port ? `:${request.port}` : ""}${request.path}`;
+        const dpop = await this.generateDpop(request.method, actualEndpoint);
+        request.headers = {
+          ...request.headers,
+          DPoP: dpop
+        };
+      }
+      return next(args);
+    }, {
+      step: "finalizeRequest",
+      name: "dpopInterceptor",
+      override: true
+    });
+  }
+  async generateDpop(method = "POST", endpoint) {
+    const token = await this.loadToken();
+    try {
+      const privateKey = createPrivateKey({
+        key: token.dpopKey,
+        format: "pem",
+        type: "sec1"
+      });
+      const publicKey = createPublicKey(privateKey);
+      const publicDer = publicKey.export({ format: "der", type: "spki" });
+      let pointStart = -1;
+      for (let i = 0; i < publicDer.length; i++) {
+        if (publicDer[i] === 4) {
+          pointStart = i;
+          break;
+        }
+      }
+      const x = publicDer.slice(pointStart + 1, pointStart + 33);
+      const y = publicDer.slice(pointStart + 33, pointStart + 65);
+      const header = {
+        alg: "ES256",
+        typ: "dpop+jwt",
+        jwk: {
+          kty: "EC",
+          crv: "P-256",
+          x: x.toString("base64url"),
+          y: y.toString("base64url")
+        }
+      };
+      const payload = {
+        jti: crypto.randomUUID(),
+        htm: method,
+        htu: endpoint,
+        iat: Math.floor(Date.now() / 1e3)
+      };
+      const headerB64 = Buffer.from(JSON.stringify(header)).toString("base64url");
+      const payloadB64 = Buffer.from(JSON.stringify(payload)).toString("base64url");
+      const message = `${headerB64}.${payloadB64}`;
+      const asn1Signature = sign("sha256", Buffer.from(message), privateKey);
+      const rawSignature = this.derToRawSignature(asn1Signature);
+      const signatureB64 = rawSignature.toString("base64url");
+      return `${message}.${signatureB64}`;
+    } catch (error) {
+      throw new CredentialsProviderError(`Failed to generate Dpop proof: ${error instanceof Error ? error.message : String(error)}`, { logger: this.logger, tryNextLink: false });
+    }
+  }
+};
+
+// ../../node_modules/.pnpm/@aws-sdk+credential-provider-login@3.972.77/node_modules/@aws-sdk/credential-provider-login/dist-es/fromLoginCredentials.js
+var fromLoginCredentials = (init) => async ({ callerClientConfig } = {}) => {
+  init?.logger?.debug?.("@aws-sdk/credential-providers - fromLoginCredentials");
+  const profiles = await parseKnownFiles(init || {});
+  const profileName = getProfileName({
+    profile: init?.profile ?? callerClientConfig?.profile
+  });
+  const profile = profiles[profileName];
+  if (!profile?.login_session) {
+    throw new CredentialsProviderError(`Profile ${profileName} does not contain login_session.`, {
+      tryNextLink: true,
+      logger: init?.logger
+    });
+  }
+  const fetcher = new LoginCredentialsFetcher(profile, init, callerClientConfig);
+  const credentials = await fetcher.loadCredentials();
+  return setCredentialFeature(credentials, "CREDENTIALS_LOGIN", "AD");
+};
+export {
+  fromLoginCredentials
+};