@nmakarov/cli-toolkit 0.32.0 → 0.33.0

package/dist/index.js

@@ -4032,6 +4032,7 @@ var Aws = class _Aws {
       secretAccessKey: config2.secretAccessKey,
       ...config2.sessionToken ? { sessionToken: config2.sessionToken } : {}
     } : void 0;
+    this.hasExplicitCredentials = !!this._credentials;
     process.env.AWS_SDK_JS_NODE_VERSION_SUPPORT_WARNING_DISABLED ??= "true";
     this._clients = {};
   }
@@ -4054,6 +4055,66 @@ var Aws = class _Aws {
   getRegion() {
     return this.region;
   }
+  // ── credentials ─────────────────────────────────────────────────────────────
+  /**
+   * Are any credentials available *before* hitting AWS? Returns
+   * { ok, source } — explicit keys, or a resolvable default chain (profile/SSO/
+   * instance role). { ok:false } means there's nothing to even try with.
+   * Note: "ok" only means creds were *found*, not that AWS will accept them.
+   */
+  async checkCredentials() {
+    if (this.hasExplicitCredentials) {
+      return { ok: true, source: "explicit keys (env/.env/CLI)" };
+    }
+    try {
+      const provider = this._sts().config.credentials;
+      const resolved = typeof provider === "function" ? await provider() : provider;
+      if (resolved?.accessKeyId) {
+        return { ok: true, source: "default credential chain (profile/SSO/role)" };
+      }
+    } catch {
+    }
+    return { ok: false };
+  }
+  /** True for "bad/missing credentials" style errors (vs. real failures). */
+  static isAuthError(err) {
+    const name = err?.name || err?.Code || err?.__type || "";
+    return [
+      "CredentialsProviderError",
+      "InvalidClientTokenId",
+      "UnrecognizedClientException",
+      "AuthFailure",
+      "AccessDenied",
+      "AccessDeniedException",
+      "ExpiredToken",
+      "ExpiredTokenException",
+      "SignatureDoesNotMatch",
+      "MissingAuthenticationToken"
+    ].includes(name);
+  }
+  /** Short, precise instructions for getting AWS credentials into .env. */
+  static credentialsHelp(region = DEFAULT_REGION) {
+    return [
+      "No usable AWS credentials were found (or AWS rejected them).",
+      "",
+      "Put a read-only access key in the project's .env:",
+      "",
+      "  AWS_ACCESS_KEY_ID=AKIA...",
+      "  AWS_SECRET_ACCESS_KEY=...",
+      `  AWS_REGION=${region}        # optional (default ${DEFAULT_REGION})`,
+      "",
+      "Get a key from the AWS console (~2 min):",
+      "  1. IAM \u2192 Users \u2192 create or pick a user (console sign-in not needed).",
+      '  2. Attach a policy \u2014 "ReadOnlyAccess" (AWS managed) is enough for discovery.',
+      '  3. The user \u2192 "Security credentials" \u2192 "Create access key" \u2192 "CLI".',
+      "  4. Copy the Access key ID + Secret access key (the secret shows only once).",
+      "  5. Paste both into .env, then re-run.",
+      "     Direct link: https://console.aws.amazon.com/iam/home#/users",
+      "",
+      "Prefer a named profile or an EC2 instance role? Re-run with AWS_PROFILE=<name>",
+      "set (or on the instance) and credentials resolve automatically."
+    ].join("\n");
+  }
   // ── identity ──────────────────────────────────────────────────────────────
   /** { account, arn, userId } — confirm which account/identity the keys belong to. */
   async whoAmI() {