@larkup/cli 0.2.25 → 0.2.27

package/dist/chunk-QGM4M3NI.js

@@ -0,0 +1,37 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __commonJS = (cb, mod) => function __require2() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+export {
+  __require,
+  __commonJS,
+  __toESM
+};

package/dist/chunk-S5DCG3CZ.js

@@ -0,0 +1,41 @@
+import {
+  buildQueryString
+} from "./chunk-HAABLEPO.js";
+
+// ../../node_modules/.pnpm/@aws-sdk+core@3.977.9/node_modules/@aws-sdk/core/dist-es/submodules/util/util-format-url/format-url.js
+function formatUrl(request) {
+  const { port, query } = request;
+  let { protocol, path, hostname } = request;
+  if (protocol && protocol.slice(-1) !== ":") {
+    protocol += ":";
+  }
+  if (port) {
+    hostname += `:${port}`;
+  }
+  if (path && path.charAt(0) !== "/") {
+    path = `/${path}`;
+  }
+  let queryString = query ? buildQueryString(query) : "";
+  if (queryString && queryString[0] !== "?") {
+    queryString = `?${queryString}`;
+  }
+  let auth = "";
+  if (request.username != null || request.password != null) {
+    const username = request.username ?? "";
+    const password = request.password ?? "";
+    auth = `${username}:${password}@`;
+  }
+  let fragment = "";
+  if (request.fragment) {
+    fragment = `#${request.fragment}`;
+  }
+  return `${protocol}//${auth}${hostname}${path}${queryString}${fragment}`;
+}
+
+// ../../node_modules/.pnpm/@aws-sdk+core@3.977.9/node_modules/@aws-sdk/core/dist-es/submodules/util/util-arn-parser/arn.js
+var validate = (str) => typeof str === "string" && str.indexOf("arn:") === 0 && str.split(":").length >= 6;
+
+export {
+  validate,
+  formatUrl
+};

package/dist/{chunk-I6JJWCUQ.js → chunk-V3VNCOZ6.js}

@@ -1,10 +1,10 @@
 import {
   getToolById,
   invalidateRegistryCache
-} from "./chunk-FM6HYXZ5.js";
+} from "./chunk-5UWKP64Q.js";
 import {
   __require
-} from "./chunk-3RG5ZIWI.js";
+} from "./chunk-QGM4M3NI.js";
 
 // ../../packages/marketplace/src/tool-loader.ts
 import { promises as fs2 } from "fs";
@@ -16,6 +16,8 @@ import { promises as fs } from "fs";
 import path from "path";
 import { exec as execCb } from "child_process";
 import { promisify } from "util";
+var installingTools = /* @__PURE__ */ new Set();
+var uninstallingTools = /* @__PURE__ */ new Set();
 var execAsync = promisify(execCb);
 var packageMutationChain = Promise.resolve();
 function serializePackageMutation(fn) {
@@ -312,11 +314,41 @@ async function resolveWorkspaceToolPath(packageName) {
       await fs.readFile(path.join(packageRoot, "package.json"), "utf8")
     );
     return manifest.name === packageName && !packageRoot.includes(`${path.sep}node_modules${path.sep}`) ? packageRoot : void 0;
+  } catch {
+  }
+  let workspaceRoot = process.cwd();
+  while (true) {
+    try {
+      await fs.access(path.join(workspaceRoot, "pnpm-workspace.yaml"));
+      break;
+    } catch {
+      const parent = path.dirname(workspaceRoot);
+      if (parent === workspaceRoot) return void 0;
+      workspaceRoot = parent;
+    }
+  }
+  const toolsRoot = path.join(workspaceRoot, "packages", "marketplace-tools");
+  let entries;
+  try {
+    entries = await fs.readdir(toolsRoot, { withFileTypes: true });
   } catch {
     return void 0;
   }
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    const packageRoot = path.join(toolsRoot, entry.name);
+    try {
+      const manifest = JSON.parse(
+        await fs.readFile(path.join(packageRoot, "package.json"), "utf8")
+      );
+      if (manifest.name === packageName) return packageRoot;
+    } catch {
+    }
+  }
+  return void 0;
 }
-async function installTool(toolId, onProgress) {
+async function installTool(toolId, onProgress, initialConfig = {}) {
+  installingTools.add(toolId);
   const report = (stage, percent, message) => {
     onProgress?.({ toolId, stage, percent, message });
   };
@@ -380,7 +412,7 @@ async function installTool(toolId, onProgress) {
       packageName: descriptor.packageName,
       resolvedPath,
       source,
-      config: buildDefaultConfig(descriptor)
+      config: { ...buildDefaultConfig(descriptor), ...initialConfig }
     };
     if (existing >= 0) {
       manifest.tools[existing] = entry;
@@ -397,26 +429,33 @@ async function installTool(toolId, onProgress) {
     const message = err instanceof Error ? err.message : "Installation failed.";
     report("failed", 0, message);
     throw err;
+  } finally {
+    installingTools.delete(toolId);
   }
 }
 async function uninstallTool(toolId) {
-  const manifest = await readManifest();
-  const tool = manifest.tools.find((t) => t.id === toolId);
-  manifest.tools = manifest.tools.filter((t) => t.id !== toolId);
-  await writeManifest(manifest);
-  if (tool?.source === "registry" && tool.packageName) {
-    try {
-      const toolsDir = getToolsDir();
-      await execAsync(`npm uninstall ${tool.packageName} --prefix "${toolsDir}"`, {
-        cwd: toolsDir,
-        timeout: 3e4
-      });
-    } catch {
+  uninstallingTools.add(toolId);
+  try {
+    const manifest = await readManifest();
+    const tool = manifest.tools.find((t) => t.id === toolId);
+    manifest.tools = manifest.tools.filter((t) => t.id !== toolId);
+    await writeManifest(manifest);
+    if (tool?.source === "registry" && tool.packageName) {
+      try {
+        const toolsDir = getToolsDir();
+        await execAsync(`npm uninstall ${tool.packageName} --prefix "${toolsDir}"`, {
+          cwd: toolsDir,
+          timeout: 3e4
+        });
+      } catch {
+      }
     }
+    invalidateRegistryCache();
+    const { unloadTool: unloadTool2 } = await import("./tool-loader-PEQZZWTB.js");
+    unloadTool2(toolId);
+  } finally {
+    uninstallingTools.delete(toolId);
   }
-  invalidateRegistryCache();
-  const { unloadTool: unloadTool2 } = await import("./tool-loader-KKODIWEV.js");
-  unloadTool2(toolId);
 }
 async function notifyHubInstall(toolId) {
   const hubUrl = process.env.LARKUP_HUB_URL ?? "https://hub.larkup.de";
@@ -444,27 +483,77 @@ function buildDefaultConfig(descriptor) {
 
 // ../../packages/marketplace/src/tool-loader.ts
 var moduleCache = /* @__PURE__ */ new Map();
+var scopedImports = /* @__PURE__ */ new Map();
+async function getScopedImport(revision) {
+  const namespace = `larkup-marketplace-tools${revision === "fixed" ? "" : `-${revision}`}`;
+  const existing = scopedImports.get(namespace);
+  if (existing) return existing;
+  const { register } = await import(
+    /* webpackIgnore: true */
+    "./api-X4PHQJTH.js"
+  );
+  const importer = register({ namespace }).import;
+  if (scopedImports.size >= 8) {
+    scopedImports.delete(scopedImports.keys().next().value);
+  }
+  scopedImports.set(namespace, importer);
+  return importer;
+}
 async function loadTool(toolId) {
-  if (moduleCache.has(toolId)) return moduleCache.get(toolId);
   const installed = await getInstalledTool(toolId);
   if (!installed) return null;
+  const importPath = await resolveImportPath(installed);
+  const revision = await entryRevision(installed, importPath);
+  const installationKey = `${installed.source}:${installed.resolvedPath}:${installed.version}:${installed.installedAt}:${revision}`;
+  const cached = moduleCache.get(toolId);
+  if (cached?.installationKey === installationKey) return cached.module;
   try {
-    const importPath = await resolveImportPath(installed);
-    const mod = await import(
-      /* webpackIgnore: true */
-      importPath
-    );
-    moduleCache.set(toolId, mod);
+    const busted = cacheBustFileImport(importPath, installationKey);
+    const importer = await getScopedImport(revision);
+    const mod = await importer(busted, import.meta.url);
+    moduleCache.set(toolId, { installationKey, module: mod });
     return mod;
   } catch (err) {
     console.error(`[marketplace] Failed to load tool "${toolId}":`, err);
     return null;
   }
 }
+async function entryRevision(installed, importPath) {
+  if (installed.source !== "local" || !importPath.startsWith("file:")) return "fixed";
+  try {
+    const directory = path2.dirname(new URL(importPath).pathname);
+    const files = await fs2.readdir(directory, { withFileTypes: true });
+    let newest = 0;
+    let total = 0;
+    for (const file of files) {
+      if (!file.isFile()) continue;
+      const { mtimeMs, size } = await fs2.stat(path2.join(directory, file.name));
+      newest = Math.max(newest, mtimeMs);
+      total += size;
+    }
+    return newest > 0 ? `${newest}-${total}` : "fixed";
+  } catch {
+    return "fixed";
+  }
+}
+function cacheBustFileImport(importPath, installationKey) {
+  if (!importPath.startsWith("file:")) return importPath;
+  const url = new URL(importPath);
+  url.searchParams.set("larkup-installation", installationKey);
+  return url.href;
+}
 async function resolveImportPath(installed) {
   switch (installed.source) {
-    case "local":
-      return installed.packageName;
+    case "local": {
+      try {
+        await fs2.access(path2.join(installed.resolvedPath, "package.json"));
+        return resolvePackageEntry(installed.resolvedPath);
+      } catch {
+        const workspacePath = await resolveWorkspaceToolPath(installed.packageName);
+        if (workspacePath) return resolvePackageEntry(workspacePath);
+        return installed.packageName;
+      }
+    }
     case "registry":
     case "sandbox":
       return resolvePackageEntry(installed.resolvedPath);
@@ -486,7 +575,7 @@ function unloadTool(toolId) {
   moduleCache.delete(toolId);
 }
 async function hasCapability(capability) {
-  const { getToolsWithCapability } = await import("./tool-registry-CXCFMOWA.js");
+  const { getToolsWithCapability } = await import("./tool-registry-VJYLRXKJ.js");
   const tools = await getToolsWithCapability(capability);
   for (const t of tools) {
     const installed = await getInstalledTool(t.id);

package/dist/dist-es-5DTOPEBY.js

@@ -0,0 +1,322 @@
+import {
+  setCredentialFeature
+} from "./chunk-N6IF5QLH.js";
+import "./chunk-ODWAFTDP.js";
+import {
+  CredentialsProviderError,
+  TokenProviderError,
+  getProfileName,
+  getSSOTokenFilepath,
+  getSSOTokenFromFile,
+  loadSsoSessionData,
+  parseKnownFiles
+} from "./chunk-HAABLEPO.js";
+import "./chunk-MACWQEJS.js";
+import "./chunk-QGM4M3NI.js";
+
+// ../../node_modules/.pnpm/@aws-sdk+credential-provider-sso@3.973.14/node_modules/@aws-sdk/credential-provider-sso/dist-es/isSsoProfile.js
+var isSsoProfile = (arg) => arg && (typeof arg.sso_start_url === "string" || typeof arg.sso_account_id === "string" || typeof arg.sso_session === "string" || typeof arg.sso_region === "string" || typeof arg.sso_role_name === "string");
+
+// ../../node_modules/.pnpm/@aws-sdk+token-providers@3.1116.0/node_modules/@aws-sdk/token-providers/dist-es/constants.js
+var EXPIRE_WINDOW_MS = 5 * 60 * 1e3;
+var REFRESH_MESSAGE = `To refresh this SSO session run 'aws sso login' with the corresponding profile.`;
+
+// ../../node_modules/.pnpm/@aws-sdk+token-providers@3.1116.0/node_modules/@aws-sdk/token-providers/dist-es/getSsoOidcClient.js
+var getSsoOidcClient = async (ssoRegion, init = {}, callerClientConfig) => {
+  const { SSOOIDCClient } = await import("./sso-oidc-EPMF7LMF.js");
+  const coalesce = (prop) => init.clientConfig?.[prop] ?? init.parentClientConfig?.[prop] ?? callerClientConfig?.[prop];
+  const ssoOidcClient = new SSOOIDCClient(Object.assign({}, init.clientConfig ?? {}, {
+    region: ssoRegion ?? init.clientConfig?.region,
+    logger: coalesce("logger"),
+    userAgentAppId: coalesce("userAgentAppId")
+  }));
+  return ssoOidcClient;
+};
+
+// ../../node_modules/.pnpm/@aws-sdk+token-providers@3.1116.0/node_modules/@aws-sdk/token-providers/dist-es/getNewSsoOidcToken.js
+var getNewSsoOidcToken = async (ssoToken, ssoRegion, init = {}, callerClientConfig) => {
+  const { CreateTokenCommand } = await import("./sso-oidc-EPMF7LMF.js");
+  const ssoOidcClient = await getSsoOidcClient(ssoRegion, init, callerClientConfig);
+  return ssoOidcClient.send(new CreateTokenCommand({
+    clientId: ssoToken.clientId,
+    clientSecret: ssoToken.clientSecret,
+    refreshToken: ssoToken.refreshToken,
+    grantType: "refresh_token"
+  }));
+};
+
+// ../../node_modules/.pnpm/@aws-sdk+token-providers@3.1116.0/node_modules/@aws-sdk/token-providers/dist-es/validateTokenExpiry.js
+var validateTokenExpiry = (token) => {
+  if (token.expiration && token.expiration.getTime() < Date.now()) {
+    throw new TokenProviderError(`Token is expired. ${REFRESH_MESSAGE}`, false);
+  }
+};
+
+// ../../node_modules/.pnpm/@aws-sdk+token-providers@3.1116.0/node_modules/@aws-sdk/token-providers/dist-es/validateTokenKey.js
+var validateTokenKey = (key, value, forRefresh = false) => {
+  if (typeof value === "undefined") {
+    throw new TokenProviderError(`Value not present for '${key}' in SSO Token${forRefresh ? ". Cannot refresh" : ""}. ${REFRESH_MESSAGE}`, false);
+  }
+};
+
+// ../../node_modules/.pnpm/@aws-sdk+token-providers@3.1116.0/node_modules/@aws-sdk/token-providers/dist-es/writeSSOTokenToFile.js
+import { promises as fsPromises } from "fs";
+var { writeFile } = fsPromises;
+var writeSSOTokenToFile = (id, ssoToken) => {
+  const tokenFilepath = getSSOTokenFilepath(id);
+  const tokenString = JSON.stringify(ssoToken, null, 2);
+  return writeFile(tokenFilepath, tokenString);
+};
+
+// ../../node_modules/.pnpm/@aws-sdk+token-providers@3.1116.0/node_modules/@aws-sdk/token-providers/dist-es/fromSso.js
+var lastRefreshAttemptTimes = /* @__PURE__ */ new Map();
+var fromSso = (init = {}) => async ({ callerClientConfig } = {}) => {
+  init.logger?.debug("@aws-sdk/token-providers - fromSso");
+  const profiles = await parseKnownFiles(init);
+  const profileName = getProfileName({
+    profile: init.profile ?? callerClientConfig?.profile
+  });
+  const profile = profiles[profileName];
+  if (!profile) {
+    throw new TokenProviderError(`Profile '${profileName}' could not be found in shared credentials file.`, false);
+  } else if (!profile["sso_session"]) {
+    throw new TokenProviderError(`Profile '${profileName}' is missing required property 'sso_session'.`);
+  }
+  const ssoSessionName = profile["sso_session"];
+  const ssoSessions = await loadSsoSessionData(init);
+  const ssoSession = ssoSessions[ssoSessionName];
+  if (!ssoSession) {
+    throw new TokenProviderError(`Sso session '${ssoSessionName}' could not be found in shared credentials file.`, false);
+  }
+  for (const ssoSessionRequiredKey of ["sso_start_url", "sso_region"]) {
+    if (!ssoSession[ssoSessionRequiredKey]) {
+      throw new TokenProviderError(`Sso session '${ssoSessionName}' is missing required property '${ssoSessionRequiredKey}'.`, false);
+    }
+  }
+  const ssoStartUrl = ssoSession["sso_start_url"];
+  const ssoRegion = ssoSession["sso_region"];
+  let ssoToken;
+  try {
+    ssoToken = await getSSOTokenFromFile(ssoSessionName);
+  } catch (e) {
+    throw new TokenProviderError(`The SSO session token associated with profile=${profileName} was not found or is invalid. ${REFRESH_MESSAGE}`, false);
+  }
+  validateTokenKey("accessToken", ssoToken.accessToken);
+  validateTokenKey("expiresAt", ssoToken.expiresAt);
+  const { accessToken, expiresAt } = ssoToken;
+  const existingToken = {
+    token: accessToken,
+    expiration: new Date(expiresAt)
+  };
+  if (existingToken.expiration.getTime() - Date.now() > EXPIRE_WINDOW_MS) {
+    return existingToken;
+  }
+  const lastRefreshAttemptTime = lastRefreshAttemptTimes.get(ssoSessionName) ?? 0;
+  if (Date.now() - lastRefreshAttemptTime < 30 * 1e3) {
+    validateTokenExpiry(existingToken);
+    return existingToken;
+  }
+  validateTokenKey("clientId", ssoToken.clientId, true);
+  validateTokenKey("clientSecret", ssoToken.clientSecret, true);
+  validateTokenKey("refreshToken", ssoToken.refreshToken, true);
+  try {
+    lastRefreshAttemptTimes.set(ssoSessionName, Date.now());
+    const newSsoOidcToken = await getNewSsoOidcToken(ssoToken, ssoRegion, init, callerClientConfig);
+    validateTokenKey("accessToken", newSsoOidcToken.accessToken);
+    validateTokenKey("expiresIn", newSsoOidcToken.expiresIn);
+    const newTokenExpiration = new Date(Date.now() + newSsoOidcToken.expiresIn * 1e3);
+    try {
+      await writeSSOTokenToFile(ssoSessionName, {
+        ...ssoToken,
+        accessToken: newSsoOidcToken.accessToken,
+        expiresAt: newTokenExpiration.toISOString(),
+        refreshToken: newSsoOidcToken.refreshToken
+      });
+    } catch (error) {
+    }
+    return {
+      token: newSsoOidcToken.accessToken,
+      expiration: newTokenExpiration
+    };
+  } catch (error) {
+    validateTokenExpiry(existingToken);
+    return existingToken;
+  }
+};
+
+// ../../node_modules/.pnpm/@aws-sdk+credential-provider-sso@3.973.14/node_modules/@aws-sdk/credential-provider-sso/dist-es/resolveSSOCredentials.js
+var SHOULD_FAIL_CREDENTIAL_CHAIN = false;
+var resolveSSOCredentials = async ({ ssoStartUrl, ssoSession, ssoAccountId, ssoRegion, ssoRoleName, ssoClient, clientConfig, parentClientConfig, callerClientConfig, profile, filepath, configFilepath, ignoreCache, logger }) => {
+  let token;
+  const refreshMessage = `To refresh this SSO session run aws sso login with the corresponding profile.`;
+  if (ssoSession) {
+    try {
+      const _token = await fromSso({
+        profile,
+        filepath,
+        configFilepath,
+        ignoreCache,
+        clientConfig,
+        parentClientConfig,
+        logger
+      })({ callerClientConfig });
+      token = {
+        accessToken: _token.token,
+        expiresAt: new Date(_token.expiration).toISOString()
+      };
+    } catch (e) {
+      throw new CredentialsProviderError(e.message, {
+        tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
+        logger
+      });
+    }
+  } else {
+    try {
+      token = await getSSOTokenFromFile(ssoStartUrl);
+    } catch (e) {
+      throw new CredentialsProviderError(`The SSO session associated with this profile is invalid. ${refreshMessage}`, {
+        tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
+        logger
+      });
+    }
+  }
+  if (new Date(token.expiresAt).getTime() - Date.now() <= 0) {
+    throw new CredentialsProviderError(`The SSO session associated with this profile has expired. ${refreshMessage}`, {
+      tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
+      logger
+    });
+  }
+  const { accessToken } = token;
+  const { SSOClient, GetRoleCredentialsCommand } = await import("./loadSso-HXXA5UNF.js");
+  const sso = ssoClient || new SSOClient(Object.assign({}, clientConfig ?? {}, {
+    logger: clientConfig?.logger ?? callerClientConfig?.logger ?? parentClientConfig?.logger,
+    region: clientConfig?.region ?? ssoRegion,
+    userAgentAppId: clientConfig?.userAgentAppId ?? callerClientConfig?.userAgentAppId ?? parentClientConfig?.userAgentAppId
+  }));
+  let ssoResp;
+  try {
+    ssoResp = await sso.send(new GetRoleCredentialsCommand({
+      accountId: ssoAccountId,
+      roleName: ssoRoleName,
+      accessToken
+    }));
+  } catch (e) {
+    throw new CredentialsProviderError(e, {
+      tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
+      logger
+    });
+  }
+  const { roleCredentials: { accessKeyId, secretAccessKey, sessionToken, expiration, credentialScope, accountId } = {} } = ssoResp;
+  if (!accessKeyId || !secretAccessKey || !sessionToken || !expiration) {
+    throw new CredentialsProviderError("SSO returns an invalid temporary credential.", {
+      tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
+      logger
+    });
+  }
+  const credentials = {
+    accessKeyId,
+    secretAccessKey,
+    sessionToken,
+    expiration: new Date(expiration),
+    ...credentialScope && { credentialScope },
+    ...accountId && { accountId }
+  };
+  if (ssoSession) {
+    setCredentialFeature(credentials, "CREDENTIALS_SSO", "s");
+  } else {
+    setCredentialFeature(credentials, "CREDENTIALS_SSO_LEGACY", "u");
+  }
+  return credentials;
+};
+
+// ../../node_modules/.pnpm/@aws-sdk+credential-provider-sso@3.973.14/node_modules/@aws-sdk/credential-provider-sso/dist-es/validateSsoProfile.js
+var validateSsoProfile = (profile, logger) => {
+  const { sso_start_url, sso_account_id, sso_region, sso_role_name } = profile;
+  if (!sso_start_url || !sso_account_id || !sso_region || !sso_role_name) {
+    throw new CredentialsProviderError(`Profile is configured with invalid SSO credentials. Required parameters "sso_account_id", "sso_region", "sso_role_name", "sso_start_url". Got ${Object.keys(profile).join(", ")}
+Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html`, { tryNextLink: false, logger });
+  }
+  return profile;
+};
+
+// ../../node_modules/.pnpm/@aws-sdk+credential-provider-sso@3.973.14/node_modules/@aws-sdk/credential-provider-sso/dist-es/fromSSO.js
+var fromSSO = (init = {}) => async ({ callerClientConfig } = {}) => {
+  init.logger?.debug("@aws-sdk/credential-provider-sso - fromSSO");
+  const { ssoStartUrl, ssoAccountId, ssoRegion, ssoRoleName, ssoSession } = init;
+  const { ssoClient } = init;
+  const profileName = getProfileName({
+    profile: init.profile ?? callerClientConfig?.profile
+  });
+  if (!ssoStartUrl && !ssoAccountId && !ssoRegion && !ssoRoleName && !ssoSession) {
+    const profiles = await parseKnownFiles(init);
+    const profile = profiles[profileName];
+    if (!profile) {
+      throw new CredentialsProviderError(`Profile ${profileName} was not found.`, { logger: init.logger });
+    }
+    if (!isSsoProfile(profile)) {
+      throw new CredentialsProviderError(`Profile ${profileName} is not configured with SSO credentials.`, {
+        logger: init.logger
+      });
+    }
+    if (profile?.sso_session) {
+      const ssoSessions = await loadSsoSessionData(init);
+      const session = ssoSessions[profile.sso_session];
+      const conflictMsg = ` configurations in profile ${profileName} and sso-session ${profile.sso_session}`;
+      if (ssoRegion && ssoRegion !== session.sso_region) {
+        throw new CredentialsProviderError(`Conflicting SSO region` + conflictMsg, {
+          tryNextLink: false,
+          logger: init.logger
+        });
+      }
+      if (ssoStartUrl && ssoStartUrl !== session.sso_start_url) {
+        throw new CredentialsProviderError(`Conflicting SSO start_url` + conflictMsg, {
+          tryNextLink: false,
+          logger: init.logger
+        });
+      }
+      profile.sso_region = session.sso_region;
+      profile.sso_start_url = session.sso_start_url;
+    }
+    const { sso_start_url, sso_account_id, sso_region, sso_role_name, sso_session } = validateSsoProfile(profile, init.logger);
+    return resolveSSOCredentials({
+      ssoStartUrl: sso_start_url,
+      ssoSession: sso_session,
+      ssoAccountId: sso_account_id,
+      ssoRegion: sso_region,
+      ssoRoleName: sso_role_name,
+      ssoClient,
+      clientConfig: init.clientConfig,
+      parentClientConfig: init.parentClientConfig,
+      callerClientConfig: init.callerClientConfig,
+      profile: profileName,
+      filepath: init.filepath,
+      configFilepath: init.configFilepath,
+      ignoreCache: init.ignoreCache,
+      logger: init.logger
+    });
+  } else if (!ssoStartUrl || !ssoAccountId || !ssoRegion || !ssoRoleName) {
+    throw new CredentialsProviderError('Incomplete configuration. The fromSSO() argument hash must include "ssoStartUrl", "ssoAccountId", "ssoRegion", "ssoRoleName"', { tryNextLink: false, logger: init.logger });
+  } else {
+    return resolveSSOCredentials({
+      ssoStartUrl,
+      ssoSession,
+      ssoAccountId,
+      ssoRegion,
+      ssoRoleName,
+      ssoClient,
+      clientConfig: init.clientConfig,
+      parentClientConfig: init.parentClientConfig,
+      callerClientConfig: init.callerClientConfig,
+      profile: profileName,
+      filepath: init.filepath,
+      configFilepath: init.configFilepath,
+      ignoreCache: init.ignoreCache,
+      logger: init.logger
+    });
+  }
+};
+export {
+  fromSSO,
+  isSsoProfile,
+  validateSsoProfile
+};