@openclaw/googlechat 2026.5.20 → 2026.5.22

package/node_modules/google-auth-library/build/src/auth/awsclient.js

@@ -0,0 +1,154 @@
+"use strict";
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AwsClient = void 0;
+const awsrequestsigner_1 = require("./awsrequestsigner");
+const baseexternalclient_1 = require("./baseexternalclient");
+const defaultawssecuritycredentialssupplier_1 = require("./defaultawssecuritycredentialssupplier");
+const util_1 = require("../util");
+const gaxios_1 = require("gaxios");
+/**
+ * AWS external account client. This is used for AWS workloads, where
+ * AWS STS GetCallerIdentity serialized signed requests are exchanged for
+ * GCP access token.
+ */
+class AwsClient extends baseexternalclient_1.BaseExternalAccountClient {
+    environmentId;
+    awsSecurityCredentialsSupplier;
+    regionalCredVerificationUrl;
+    awsRequestSigner;
+    region;
+    static #DEFAULT_AWS_REGIONAL_CREDENTIAL_VERIFICATION_URL = 'https://sts.{region}.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15';
+    /**
+     * @deprecated AWS client no validates the EC2 metadata address.
+     **/
+    static AWS_EC2_METADATA_IPV4_ADDRESS = '169.254.169.254';
+    /**
+     * @deprecated AWS client no validates the EC2 metadata address.
+     **/
+    static AWS_EC2_METADATA_IPV6_ADDRESS = 'fd00:ec2::254';
+    /**
+     * Instantiates an AwsClient instance using the provided JSON
+     * object loaded from an external account credentials file.
+     * An error is thrown if the credential is not a valid AWS credential.
+     * @param options The external account options object typically loaded
+     *   from the external account JSON credential file.
+     */
+    constructor(options) {
+        super(options);
+        const opts = (0, util_1.originalOrCamelOptions)(options);
+        const credentialSource = opts.get('credential_source');
+        const awsSecurityCredentialsSupplier = opts.get('aws_security_credentials_supplier');
+        // Validate credential sourcing configuration.
+        if (!credentialSource && !awsSecurityCredentialsSupplier) {
+            throw new Error('A credential source or AWS security credentials supplier must be specified.');
+        }
+        if (credentialSource && awsSecurityCredentialsSupplier) {
+            throw new Error('Only one of credential source or AWS security credentials supplier can be specified.');
+        }
+        if (awsSecurityCredentialsSupplier) {
+            this.awsSecurityCredentialsSupplier = awsSecurityCredentialsSupplier;
+            this.regionalCredVerificationUrl =
+                AwsClient.#DEFAULT_AWS_REGIONAL_CREDENTIAL_VERIFICATION_URL;
+            this.credentialSourceType = 'programmatic';
+        }
+        else {
+            const credentialSourceOpts = (0, util_1.originalOrCamelOptions)(credentialSource);
+            this.environmentId = credentialSourceOpts.get('environment_id');
+            // This is only required if the AWS region is not available in the
+            // AWS_REGION or AWS_DEFAULT_REGION environment variables.
+            const regionUrl = credentialSourceOpts.get('region_url');
+            // This is only required if AWS security credentials are not available in
+            // environment variables.
+            const securityCredentialsUrl = credentialSourceOpts.get('url');
+            const imdsV2SessionTokenUrl = credentialSourceOpts.get('imdsv2_session_token_url');
+            this.awsSecurityCredentialsSupplier =
+                new defaultawssecuritycredentialssupplier_1.DefaultAwsSecurityCredentialsSupplier({
+                    regionUrl: regionUrl,
+                    securityCredentialsUrl: securityCredentialsUrl,
+                    imdsV2SessionTokenUrl: imdsV2SessionTokenUrl,
+                });
+            this.regionalCredVerificationUrl = credentialSourceOpts.get('regional_cred_verification_url');
+            this.credentialSourceType = 'aws';
+            // Data validators.
+            this.validateEnvironmentId();
+        }
+        this.awsRequestSigner = null;
+        this.region = '';
+    }
+    validateEnvironmentId() {
+        const match = this.environmentId?.match(/^(aws)(\d+)$/);
+        if (!match || !this.regionalCredVerificationUrl) {
+            throw new Error('No valid AWS "credential_source" provided');
+        }
+        else if (parseInt(match[2], 10) !== 1) {
+            throw new Error(`aws version "${match[2]}" is not supported in the current build.`);
+        }
+    }
+    /**
+     * Triggered when an external subject token is needed to be exchanged for a
+     * GCP access token via GCP STS endpoint. This will call the
+     * {@link AwsSecurityCredentialsSupplier} to retrieve an AWS region and AWS
+     * Security Credentials, then use them to create a signed AWS STS request that
+     * can be exchanged for a GCP access token.
+     * @return A promise that resolves with the external subject token.
+     */
+    async retrieveSubjectToken() {
+        // Initialize AWS request signer if not already initialized.
+        if (!this.awsRequestSigner) {
+            this.region = await this.awsSecurityCredentialsSupplier.getAwsRegion(this.supplierContext);
+            this.awsRequestSigner = new awsrequestsigner_1.AwsRequestSigner(async () => {
+                return this.awsSecurityCredentialsSupplier.getAwsSecurityCredentials(this.supplierContext);
+            }, this.region);
+        }
+        // Generate signed request to AWS STS GetCallerIdentity API.
+        // Use the required regional endpoint. Otherwise, the request will fail.
+        const options = await this.awsRequestSigner.getRequestOptions({
+            ...AwsClient.RETRY_CONFIG,
+            url: this.regionalCredVerificationUrl.replace('{region}', this.region),
+            method: 'POST',
+        });
+        // The GCP STS endpoint expects the headers to be formatted as:
+        // [
+        //   {key: 'x-amz-date', value: '...'},
+        //   {key: 'authorization', value: '...'},
+        //   ...
+        // ]
+        // And then serialized as:
+        // encodeURIComponent(JSON.stringify({
+        //   url: '...',
+        //   method: 'POST',
+        //   headers: [{key: 'x-amz-date', value: '...'}, ...]
+        // }))
+        const reformattedHeader = [];
+        const extendedHeaders = gaxios_1.Gaxios.mergeHeaders({
+            // The full, canonical resource name of the workload identity pool
+            // provider, with or without the HTTPS prefix.
+            // Including this header as part of the signature is recommended to
+            // ensure data integrity.
+            'x-goog-cloud-target-resource': this.audience,
+        }, options.headers);
+        // Reformat header to GCP STS expected format.
+        extendedHeaders.forEach((value, key) => reformattedHeader.push({ key, value }));
+        // Serialize the reformatted signed request.
+        return encodeURIComponent(JSON.stringify({
+            url: options.url,
+            method: options.method,
+            headers: reformattedHeader,
+        }));
+    }
+}
+exports.AwsClient = AwsClient;
+//# sourceMappingURL=awsclient.js.map

package/node_modules/google-auth-library/build/src/auth/awsrequestsigner.d.ts

@@ -0,0 +1,40 @@
+import { GaxiosOptions } from 'gaxios';
+/**
+ * Interface defining AWS security credentials.
+ * These are either determined from AWS security_credentials endpoint or
+ * AWS environment variables.
+ */
+export interface AwsSecurityCredentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    token?: string;
+}
+/**
+ * Implements an AWS API request signer based on the AWS Signature Version 4
+ * signing process.
+ * https://docs.aws.amazon.com/general/latest/gr/signature-version-4.html
+ */
+export declare class AwsRequestSigner {
+    private readonly getCredentials;
+    private readonly region;
+    private readonly crypto;
+    /**
+     * Instantiates an AWS API request signer used to send authenticated signed
+     * requests to AWS APIs based on the AWS Signature Version 4 signing process.
+     * This also provides a mechanism to generate the signed request without
+     * sending it.
+     * @param getCredentials A mechanism to retrieve AWS security credentials
+     *   when needed.
+     * @param region The AWS region to use.
+     */
+    constructor(getCredentials: () => Promise<AwsSecurityCredentials>, region: string);
+    /**
+     * Generates the signed request for the provided HTTP request for calling
+     * an AWS API. This follows the steps described at:
+     * https://docs.aws.amazon.com/general/latest/gr/sigv4_signing.html
+     * @param amzOptions The AWS request options that need to be signed.
+     * @return A promise that resolves with the GaxiosOptions containing the
+     *   signed HTTP request parameters.
+     */
+    getRequestOptions(amzOptions: GaxiosOptions): Promise<GaxiosOptions>;
+}

package/node_modules/google-auth-library/build/src/auth/awsrequestsigner.js

@@ -0,0 +1,213 @@
+"use strict";
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AwsRequestSigner = void 0;
+const gaxios_1 = require("gaxios");
+const crypto_1 = require("../crypto/crypto");
+/** AWS Signature Version 4 signing algorithm identifier.  */
+const AWS_ALGORITHM = 'AWS4-HMAC-SHA256';
+/**
+ * The termination string for the AWS credential scope value as defined in
+ * https://docs.aws.amazon.com/general/latest/gr/sigv4-create-string-to-sign.html
+ */
+const AWS_REQUEST_TYPE = 'aws4_request';
+/**
+ * Implements an AWS API request signer based on the AWS Signature Version 4
+ * signing process.
+ * https://docs.aws.amazon.com/general/latest/gr/signature-version-4.html
+ */
+class AwsRequestSigner {
+    getCredentials;
+    region;
+    crypto;
+    /**
+     * Instantiates an AWS API request signer used to send authenticated signed
+     * requests to AWS APIs based on the AWS Signature Version 4 signing process.
+     * This also provides a mechanism to generate the signed request without
+     * sending it.
+     * @param getCredentials A mechanism to retrieve AWS security credentials
+     *   when needed.
+     * @param region The AWS region to use.
+     */
+    constructor(getCredentials, region) {
+        this.getCredentials = getCredentials;
+        this.region = region;
+        this.crypto = (0, crypto_1.createCrypto)();
+    }
+    /**
+     * Generates the signed request for the provided HTTP request for calling
+     * an AWS API. This follows the steps described at:
+     * https://docs.aws.amazon.com/general/latest/gr/sigv4_signing.html
+     * @param amzOptions The AWS request options that need to be signed.
+     * @return A promise that resolves with the GaxiosOptions containing the
+     *   signed HTTP request parameters.
+     */
+    async getRequestOptions(amzOptions) {
+        if (!amzOptions.url) {
+            throw new RangeError('"url" is required in "amzOptions"');
+        }
+        // Stringify JSON requests. This will be set in the request body of the
+        // generated signed request.
+        const requestPayloadData = typeof amzOptions.data === 'object'
+            ? JSON.stringify(amzOptions.data)
+            : amzOptions.data;
+        const url = amzOptions.url;
+        const method = amzOptions.method || 'GET';
+        const requestPayload = amzOptions.body || requestPayloadData;
+        const additionalAmzHeaders = amzOptions.headers;
+        const awsSecurityCredentials = await this.getCredentials();
+        const uri = new URL(url);
+        if (typeof requestPayload !== 'string' && requestPayload !== undefined) {
+            throw new TypeError(`'requestPayload' is expected to be a string if provided. Got: ${requestPayload}`);
+        }
+        const headerMap = await generateAuthenticationHeaderMap({
+            crypto: this.crypto,
+            host: uri.host,
+            canonicalUri: uri.pathname,
+            canonicalQuerystring: uri.search.slice(1),
+            method,
+            region: this.region,
+            securityCredentials: awsSecurityCredentials,
+            requestPayload,
+            additionalAmzHeaders,
+        });
+        // Append additional optional headers, eg. X-Amz-Target, Content-Type, etc.
+        const headers = gaxios_1.Gaxios.mergeHeaders(
+        // Add x-amz-date if available.
+        headerMap.amzDate ? { 'x-amz-date': headerMap.amzDate } : {}, {
+            authorization: headerMap.authorizationHeader,
+            host: uri.host,
+        }, additionalAmzHeaders || {});
+        if (awsSecurityCredentials.token) {
+            gaxios_1.Gaxios.mergeHeaders(headers, {
+                'x-amz-security-token': awsSecurityCredentials.token,
+            });
+        }
+        const awsSignedReq = {
+            url,
+            method: method,
+            headers,
+        };
+        if (requestPayload !== undefined) {
+            awsSignedReq.body = requestPayload;
+        }
+        return awsSignedReq;
+    }
+}
+exports.AwsRequestSigner = AwsRequestSigner;
+/**
+ * Creates the HMAC-SHA256 hash of the provided message using the
+ * provided key.
+ *
+ * @param crypto The crypto instance used to facilitate cryptographic
+ *   operations.
+ * @param key The HMAC-SHA256 key to use.
+ * @param msg The message to hash.
+ * @return The computed hash bytes.
+ */
+async function sign(crypto, key, msg) {
+    return await crypto.signWithHmacSha256(key, msg);
+}
+/**
+ * Calculates the signing key used to calculate the signature for
+ * AWS Signature Version 4 based on:
+ * https://docs.aws.amazon.com/general/latest/gr/sigv4-calculate-signature.html
+ *
+ * @param crypto The crypto instance used to facilitate cryptographic
+ *   operations.
+ * @param key The AWS secret access key.
+ * @param dateStamp The '%Y%m%d' date format.
+ * @param region The AWS region.
+ * @param serviceName The AWS service name, eg. sts.
+ * @return The signing key bytes.
+ */
+async function getSigningKey(crypto, key, dateStamp, region, serviceName) {
+    const kDate = await sign(crypto, `AWS4${key}`, dateStamp);
+    const kRegion = await sign(crypto, kDate, region);
+    const kService = await sign(crypto, kRegion, serviceName);
+    const kSigning = await sign(crypto, kService, 'aws4_request');
+    return kSigning;
+}
+/**
+ * Generates the authentication header map needed for generating the AWS
+ * Signature Version 4 signed request.
+ *
+ * @param option The options needed to compute the authentication header map.
+ * @return The AWS authentication header map which constitutes of the following
+ *   components: amz-date, authorization header and canonical query string.
+ */
+async function generateAuthenticationHeaderMap(options) {
+    const additionalAmzHeaders = gaxios_1.Gaxios.mergeHeaders(options.additionalAmzHeaders);
+    const requestPayload = options.requestPayload || '';
+    // iam.amazonaws.com host => iam service.
+    // sts.us-east-2.amazonaws.com => sts service.
+    const serviceName = options.host.split('.')[0];
+    const now = new Date();
+    // Format: '%Y%m%dT%H%M%SZ'.
+    const amzDate = now
+        .toISOString()
+        .replace(/[-:]/g, '')
+        .replace(/\.[0-9]+/, '');
+    // Format: '%Y%m%d'.
+    const dateStamp = now.toISOString().replace(/[-]/g, '').replace(/T.*/, '');
+    // Add AWS token if available.
+    if (options.securityCredentials.token) {
+        additionalAmzHeaders.set('x-amz-security-token', options.securityCredentials.token);
+    }
+    // Header keys need to be sorted alphabetically.
+    const amzHeaders = gaxios_1.Gaxios.mergeHeaders({
+        host: options.host,
+    }, 
+    // Previously the date was not fixed with x-amz- and could be provided manually.
+    // https://github.com/boto/botocore/blob/879f8440a4e9ace5d3cf145ce8b3d5e5ffb892ef/tests/unit/auth/aws4_testsuite/get-header-value-trim.req
+    additionalAmzHeaders.has('date') ? {} : { 'x-amz-date': amzDate }, additionalAmzHeaders);
+    let canonicalHeaders = '';
+    // TypeScript is missing `Headers#keys` at the time of writing
+    const signedHeadersList = [
+        ...amzHeaders.keys(),
+    ].sort();
+    signedHeadersList.forEach(key => {
+        canonicalHeaders += `${key}:${amzHeaders.get(key)}\n`;
+    });
+    const signedHeaders = signedHeadersList.join(';');
+    const payloadHash = await options.crypto.sha256DigestHex(requestPayload);
+    // https://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.html
+    const canonicalRequest = `${options.method.toUpperCase()}\n` +
+        `${options.canonicalUri}\n` +
+        `${options.canonicalQuerystring}\n` +
+        `${canonicalHeaders}\n` +
+        `${signedHeaders}\n` +
+        `${payloadHash}`;
+    const credentialScope = `${dateStamp}/${options.region}/${serviceName}/${AWS_REQUEST_TYPE}`;
+    // https://docs.aws.amazon.com/general/latest/gr/sigv4-create-string-to-sign.html
+    const stringToSign = `${AWS_ALGORITHM}\n` +
+        `${amzDate}\n` +
+        `${credentialScope}\n` +
+        (await options.crypto.sha256DigestHex(canonicalRequest));
+    // https://docs.aws.amazon.com/general/latest/gr/sigv4-calculate-signature.html
+    const signingKey = await getSigningKey(options.crypto, options.securityCredentials.secretAccessKey, dateStamp, options.region, serviceName);
+    const signature = await sign(options.crypto, signingKey, stringToSign);
+    // https://docs.aws.amazon.com/general/latest/gr/sigv4-add-signature-to-request.html
+    const authorizationHeader = `${AWS_ALGORITHM} Credential=${options.securityCredentials.accessKeyId}/` +
+        `${credentialScope}, SignedHeaders=${signedHeaders}, ` +
+        `Signature=${(0, crypto_1.fromArrayBufferToHex)(signature)}`;
+    return {
+        // Do not return x-amz-date if date is available.
+        amzDate: additionalAmzHeaders.has('date') ? undefined : amzDate,
+        authorizationHeader,
+        canonicalQuerystring: options.canonicalQuerystring,
+    };
+}
+//# sourceMappingURL=awsrequestsigner.js.map