@semiont/graph 0.5.20 → 0.5.22

package/dist/{dist-es-JMQZFACH.js → dist-es-5CNHCO76.js}

@@ -1,17 +1,17 @@
 import {
   NodeHttpHandler
-} from "./chunk-L7UMT7TC.js";
+} from "./chunk-AJ4W3DS7.js";
 import {
   setCredentialFeature
-} from "./chunk-QVMXXFG5.js";
+} from "./chunk-ZPTG6NGD.js";
 import {
-  CredentialsProviderError,
-  HttpRequest
-} from "./chunk-J2GNAAZA.js";
+  CredentialsProviderError
+} from "./chunk-7WLIHNPO.js";
 import {
+  HttpRequest,
   parseRfc3339DateTime,
   sdkStreamMixin
-} from "./chunk-UN64BKHA.js";
+} from "./chunk-GPJBZ6EG.js";
 
 // ../../node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/fromHttp.js
 import fs from "fs/promises";
@@ -172,4 +172,4 @@ var validateToken = (token) => {
 export {
   fromHttp
 };
-//# sourceMappingURL=dist-es-JMQZFACH.js.map
+//# sourceMappingURL=dist-es-5CNHCO76.js.map

package/dist/{dist-es-EFSR5RHO.js → dist-es-63RSTSM2.js}

@@ -1,31 +1,31 @@
 import {
   setCredentialFeature
-} from "./chunk-QVMXXFG5.js";
+} from "./chunk-ZPTG6NGD.js";
 import {
   CredentialsProviderError,
   chain,
   getProfileName,
   parseKnownFiles
-} from "./chunk-J2GNAAZA.js";
-import "./chunk-UN64BKHA.js";
+} from "./chunk-7WLIHNPO.js";
+import "./chunk-GPJBZ6EG.js";
 
 // ../../node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveCredentialSource.js
 var resolveCredentialSource = (credentialSource, profileName, logger) => {
   const sourceProvidersMap = {
     EcsContainer: async (options) => {
-      const { fromHttp } = await import("./dist-es-JMQZFACH.js");
-      const { fromContainerMetadata } = await import("./dist-es-GCAGX4FB.js");
+      const { fromHttp } = await import("./dist-es-5CNHCO76.js");
+      const { fromContainerMetadata } = await import("./dist-es-QDQUKRHU.js");
       logger?.debug("@aws-sdk/credential-provider-ini - credential_source is EcsContainer");
       return async () => chain(fromHttp(options ?? {}), fromContainerMetadata(options))().then(setNamedProvider);
     },
     Ec2InstanceMetadata: async (options) => {
       logger?.debug("@aws-sdk/credential-provider-ini - credential_source is Ec2InstanceMetadata");
-      const { fromInstanceMetadata } = await import("./dist-es-GCAGX4FB.js");
+      const { fromInstanceMetadata } = await import("./dist-es-QDQUKRHU.js");
       return async () => fromInstanceMetadata(options)().then(setNamedProvider);
     },
     Environment: async (options) => {
       logger?.debug("@aws-sdk/credential-provider-ini - credential_source is Environment");
-      const { fromEnv } = await import("./dist-es-7RLYMBW4.js");
+      const { fromEnv } = await import("./dist-es-R36PCSLH.js");
       return async () => fromEnv(options)().then(setNamedProvider);
     }
   };
@@ -60,7 +60,7 @@ var resolveAssumeRoleCredentials = async (profileName, profiles, options, caller
   const profileData = profiles[profileName];
   const { source_profile, region } = profileData;
   if (!options.roleAssumer) {
-    const { getDefaultRoleAssumer } = await import("./sts-EM5BP3PD.js");
+    const { getDefaultRoleAssumer } = await import("./sts-4YKAIUZO.js");
     options.roleAssumer = getDefaultRoleAssumer({
       ...options.clientConfig,
       credentialProviderLogger: options.logger,
@@ -109,7 +109,7 @@ var isLoginProfile = (data) => {
   return Boolean(data && data.login_session);
 };
 var resolveLoginCredentials = async (profileName, options, callerClientConfig) => {
-  const { fromLoginCredentials } = await import("./dist-es-RUJYXWW7.js");
+  const { fromLoginCredentials } = await import("./dist-es-C3XGVVKR.js");
   const credentials = await fromLoginCredentials({
     ...options,
     profile: profileName
@@ -120,7 +120,7 @@ var resolveLoginCredentials = async (profileName, options, callerClientConfig) =
 // ../../node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveProcessCredentials.js
 var isProcessProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.credential_process === "string";
 var resolveProcessCredentials = async (options, profile) => {
-  const { fromProcess } = await import("./dist-es-TFVAFKJ5.js");
+  const { fromProcess } = await import("./dist-es-BTCEI257.js");
   const credentials = await fromProcess({
     ...options,
     profile
@@ -130,7 +130,7 @@ var resolveProcessCredentials = async (options, profile) => {
 
 // ../../node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveSsoCredentials.js
 var resolveSsoCredentials = async (profile, profileData, options = {}, callerClientConfig) => {
-  const { fromSSO } = await import("./dist-es-47I7P7S4.js");
+  const { fromSSO } = await import("./dist-es-OHWBFB6Z.js");
   return fromSSO({
     profile,
     logger: options.logger,
@@ -165,7 +165,7 @@ var resolveStaticCredentials = async (profile, options) => {
 // ../../node_modules/@aws-sdk/credential-provider-ini/dist-es/resolveWebIdentityCredentials.js
 var isWebIdentityProfile = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.web_identity_token_file === "string" && typeof arg.role_arn === "string" && ["undefined", "string"].indexOf(typeof arg.role_session_name) > -1;
 var resolveWebIdentityCredentials = async (profile, options, callerClientConfig) => {
-  const { fromTokenFile } = await import("./dist-es-6D223V5J.js");
+  const { fromTokenFile } = await import("./dist-es-ZOQMUI6H.js");
   const credentials = await fromTokenFile({
     webIdentityTokenFile: profile.web_identity_token_file,
     roleArn: profile.role_arn,
@@ -217,4 +217,4 @@ var fromIni = (init = {}) => async ({ callerClientConfig } = {}) => {
 export {
   fromIni
 };
-//# sourceMappingURL=dist-es-EFSR5RHO.js.map
+//# sourceMappingURL=dist-es-63RSTSM2.js.map

package/dist/{dist-es-TFVAFKJ5.js → dist-es-BTCEI257.js}

@@ -1,13 +1,13 @@
 import {
   setCredentialFeature
-} from "./chunk-QVMXXFG5.js";
+} from "./chunk-ZPTG6NGD.js";
 import {
   CredentialsProviderError,
   externalDataInterceptor,
   getProfileName,
   parseKnownFiles
-} from "./chunk-J2GNAAZA.js";
-import "./chunk-UN64BKHA.js";
+} from "./chunk-7WLIHNPO.js";
+import "./chunk-GPJBZ6EG.js";
 
 // ../../node_modules/@aws-sdk/credential-provider-process/dist-es/resolveProcessCredentials.js
 import { exec } from "child_process";
@@ -84,4 +84,4 @@ var fromProcess = (init = {}) => async ({ callerClientConfig } = {}) => {
 export {
   fromProcess
 };
-//# sourceMappingURL=dist-es-TFVAFKJ5.js.map
+//# sourceMappingURL=dist-es-BTCEI257.js.map

package/dist/{dist-es-RUJYXWW7.js → dist-es-C3XGVVKR.js}

@@ -1,14 +1,15 @@
 import {
   setCredentialFeature
-} from "./chunk-QVMXXFG5.js";
+} from "./chunk-ZPTG6NGD.js";
 import {
   CredentialsProviderError,
-  HttpRequest,
   getProfileName,
   parseKnownFiles,
   readFile
-} from "./chunk-J2GNAAZA.js";
-import "./chunk-UN64BKHA.js";
+} from "./chunk-7WLIHNPO.js";
+import {
+  HttpRequest
+} from "./chunk-GPJBZ6EG.js";
 
 // ../../node_modules/@aws-sdk/credential-provider-login/dist-es/LoginCredentialsFetcher.js
 import { createHash, createPrivateKey, createPublicKey, sign } from "crypto";
@@ -52,7 +53,7 @@ var LoginCredentialsFetcher = class _LoginCredentialsFetcher {
     return this.profileData.login_session;
   }
   async refresh(token) {
-    const { SigninClient, CreateOAuth2TokenCommand } = await import("./signin-LCNGXJL6.js");
+    const { SigninClient, CreateOAuth2TokenCommand } = await import("./signin-OZ4KQMKS.js");
     const { logger, userAgentAppId } = this.callerClientConfig ?? {};
     const isH2 = (requestHandler2) => {
       return requestHandler2?.metadata?.handlerProtocol === "h2";
@@ -283,4 +284,4 @@ var fromLoginCredentials = (init) => async ({ callerClientConfig } = {}) => {
 export {
   fromLoginCredentials
 };
-//# sourceMappingURL=dist-es-RUJYXWW7.js.map
+//# sourceMappingURL=dist-es-C3XGVVKR.js.map

package/dist/{dist-es-RUJYXWW7.js.map → dist-es-C3XGVVKR.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../../../node_modules/@aws-sdk/credential-provider-login/dist-es/LoginCredentialsFetcher.js","../../../node_modules/@aws-sdk/credential-provider-login/dist-es/fromLoginCredentials.js"],"sourcesContent":["import { CredentialsProviderError, readFile } from \"@smithy/core/config\";\nimport { HttpRequest } from \"@smithy/core/protocols\";\nimport { createHash, createPrivateKey, createPublicKey, sign } from \"node:crypto\";\nimport { promises as fs } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\nexport class LoginCredentialsFetcher {\n    profileData;\n    init;\n    callerClientConfig;\n    static REFRESH_THRESHOLD = 5 * 60 * 1000;\n    constructor(profileData, init, callerClientConfig) {\n        this.profileData = profileData;\n        this.init = init;\n        this.callerClientConfig = callerClientConfig;\n    }\n    async loadCredentials() {\n        const token = await this.loadToken();\n        if (!token) {\n            throw new CredentialsProviderError(`Failed to load a token for session ${this.loginSession}, please re-authenticate using aws login`, { tryNextLink: false, logger: this.logger });\n        }\n        const accessToken = token.accessToken;\n        const now = Date.now();\n        const expiryTime = new Date(accessToken.expiresAt).getTime();\n        const timeUntilExpiry = expiryTime - now;\n        if (timeUntilExpiry <= LoginCredentialsFetcher.REFRESH_THRESHOLD) {\n            return this.refresh(token);\n        }\n        return {\n            accessKeyId: accessToken.accessKeyId,\n            secretAccessKey: accessToken.secretAccessKey,\n            sessionToken: accessToken.sessionToken,\n            accountId: accessToken.accountId,\n            expiration: new Date(accessToken.expiresAt),\n        };\n    }\n    get logger() {\n        return this.init?.logger;\n    }\n    get loginSession() {\n        return this.profileData.login_session;\n    }\n    async refresh(token) {\n        const { SigninClient, CreateOAuth2TokenCommand } = await import(\"@aws-sdk/nested-clients/signin\");\n        const { logger, userAgentAppId } = this.callerClientConfig ?? {};\n        const isH2 = (requestHandler) => {\n            return requestHandler?.metadata?.handlerProtocol === \"h2\";\n        };\n        const requestHandler = isH2(this.callerClientConfig?.requestHandler)\n            ? undefined\n            : this.callerClientConfig?.requestHandler;\n        const region = this.profileData.region ?? (await this.callerClientConfig?.region?.()) ?? process.env.AWS_REGION;\n        const client = new SigninClient({\n            credentials: {\n                accessKeyId: \"\",\n                secretAccessKey: \"\",\n            },\n            region,\n            requestHandler,\n            logger,\n            userAgentAppId,\n            ...this.init?.clientConfig,\n        });\n        this.createDPoPInterceptor(client.middlewareStack);\n        const commandInput = {\n            tokenInput: {\n                clientId: token.clientId,\n                refreshToken: token.refreshToken,\n                grantType: \"refresh_token\",\n            },\n        };\n        try {\n            const response = await client.send(new CreateOAuth2TokenCommand(commandInput));\n            const { accessKeyId, secretAccessKey, sessionToken } = response.tokenOutput?.accessToken ?? {};\n            const { refreshToken, expiresIn } = response.tokenOutput ?? {};\n            if (!accessKeyId || !secretAccessKey || !sessionToken || !refreshToken) {\n                throw new CredentialsProviderError(\"Token refresh response missing required fields\", {\n                    logger: this.logger,\n                    tryNextLink: false,\n                });\n            }\n            const expiresInMs = (expiresIn ?? 900) * 1000;\n            const expiration = new Date(Date.now() + expiresInMs);\n            const updatedToken = {\n                ...token,\n                accessToken: {\n                    ...token.accessToken,\n                    accessKeyId,\n                    secretAccessKey,\n                    sessionToken,\n                    expiresAt: expiration.toISOString(),\n                },\n                refreshToken,\n            };\n            await this.saveToken(updatedToken);\n            const newAccessToken = updatedToken.accessToken;\n            return {\n                accessKeyId: newAccessToken.accessKeyId,\n                secretAccessKey: newAccessToken.secretAccessKey,\n                sessionToken: newAccessToken.sessionToken,\n                accountId: newAccessToken.accountId,\n                expiration,\n            };\n        }\n        catch (error) {\n            if (error.name === \"AccessDeniedException\") {\n                const errorType = error.error;\n                let message;\n                switch (errorType) {\n                    case \"TOKEN_EXPIRED\":\n                        message = \"Your session has expired. Please reauthenticate.\";\n                        break;\n                    case \"USER_CREDENTIALS_CHANGED\":\n                        message =\n                            \"Unable to refresh credentials because of a change in your password. Please reauthenticate with your new password.\";\n                        break;\n                    case \"INSUFFICIENT_PERMISSIONS\":\n                        message =\n                            \"Unable to refresh credentials due to insufficient permissions. You may be missing permission for the 'CreateOAuth2Token' action.\";\n                        break;\n                    default:\n                        message = `Failed to refresh token: ${String(error)}. Please re-authenticate using \\`aws login\\``;\n                }\n                throw new CredentialsProviderError(message, { logger: this.logger, tryNextLink: false });\n            }\n            throw new CredentialsProviderError(`Failed to refresh token: ${String(error)}. Please re-authenticate using aws login`, { logger: this.logger });\n        }\n    }\n    async loadToken() {\n        const tokenFilePath = this.getTokenFilePath();\n        try {\n            let tokenData;\n            try {\n                tokenData = await readFile(tokenFilePath, { ignoreCache: this.init?.ignoreCache });\n            }\n            catch {\n                tokenData = await fs.readFile(tokenFilePath, \"utf8\");\n            }\n            const token = JSON.parse(tokenData);\n            const missingFields = [\"accessToken\", \"clientId\", \"refreshToken\", \"dpopKey\"].filter((k) => !token[k]);\n            if (!token.accessToken?.accountId) {\n                missingFields.push(\"accountId\");\n            }\n            if (missingFields.length > 0) {\n                throw new CredentialsProviderError(`Token validation failed, missing fields: ${missingFields.join(\", \")}`, {\n                    logger: this.logger,\n                    tryNextLink: false,\n                });\n            }\n            return token;\n        }\n        catch (error) {\n            throw new CredentialsProviderError(`Failed to load token from ${tokenFilePath}: ${String(error)}`, {\n                logger: this.logger,\n                tryNextLink: false,\n            });\n        }\n    }\n    async saveToken(token) {\n        const tokenFilePath = this.getTokenFilePath();\n        const directory = dirname(tokenFilePath);\n        try {\n            await fs.mkdir(directory, { recursive: true });\n        }\n        catch (error) {\n        }\n        await fs.writeFile(tokenFilePath, JSON.stringify(token, null, 2), \"utf8\");\n    }\n    getTokenFilePath() {\n        const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ?? join(homedir(), \".aws\", \"login\", \"cache\");\n        const loginSessionBytes = Buffer.from(this.loginSession, \"utf8\");\n        const loginSessionSha256 = createHash(\"sha256\").update(loginSessionBytes).digest(\"hex\");\n        return join(directory, `${loginSessionSha256}.json`);\n    }\n    derToRawSignature(derSignature) {\n        let offset = 2;\n        if (derSignature[offset] !== 0x02) {\n            throw new Error(\"Invalid DER signature\");\n        }\n        offset++;\n        const rLength = derSignature[offset++];\n        let r = derSignature.subarray(offset, offset + rLength);\n        offset += rLength;\n        if (derSignature[offset] !== 0x02) {\n            throw new Error(\"Invalid DER signature\");\n        }\n        offset++;\n        const sLength = derSignature[offset++];\n        let s = derSignature.subarray(offset, offset + sLength);\n        r = r[0] === 0x00 ? r.subarray(1) : r;\n        s = s[0] === 0x00 ? s.subarray(1) : s;\n        const rPadded = Buffer.concat([Buffer.alloc(32 - r.length), r]);\n        const sPadded = Buffer.concat([Buffer.alloc(32 - s.length), s]);\n        return Buffer.concat([rPadded, sPadded]);\n    }\n    createDPoPInterceptor(middlewareStack) {\n        middlewareStack.add((next) => async (args) => {\n            if (HttpRequest.isInstance(args.request)) {\n                const request = args.request;\n                const actualEndpoint = `${request.protocol}//${request.hostname}${request.port ? `:${request.port}` : \"\"}${request.path}`;\n                const dpop = await this.generateDpop(request.method, actualEndpoint);\n                request.headers = {\n                    ...request.headers,\n                    DPoP: dpop,\n                };\n            }\n            return next(args);\n        }, {\n            step: \"finalizeRequest\",\n            name: \"dpopInterceptor\",\n            override: true,\n        });\n    }\n    async generateDpop(method = \"POST\", endpoint) {\n        const token = await this.loadToken();\n        try {\n            const privateKey = createPrivateKey({\n                key: token.dpopKey,\n                format: \"pem\",\n                type: \"sec1\",\n            });\n            const publicKey = createPublicKey(privateKey);\n            const publicDer = publicKey.export({ format: \"der\", type: \"spki\" });\n            let pointStart = -1;\n            for (let i = 0; i < publicDer.length; i++) {\n                if (publicDer[i] === 0x04) {\n                    pointStart = i;\n                    break;\n                }\n            }\n            const x = publicDer.slice(pointStart + 1, pointStart + 33);\n            const y = publicDer.slice(pointStart + 33, pointStart + 65);\n            const header = {\n                alg: \"ES256\",\n                typ: \"dpop+jwt\",\n                jwk: {\n                    kty: \"EC\",\n                    crv: \"P-256\",\n                    x: x.toString(\"base64url\"),\n                    y: y.toString(\"base64url\"),\n                },\n            };\n            const payload = {\n                jti: crypto.randomUUID(),\n                htm: method,\n                htu: endpoint,\n                iat: Math.floor(Date.now() / 1000),\n            };\n            const headerB64 = Buffer.from(JSON.stringify(header)).toString(\"base64url\");\n            const payloadB64 = Buffer.from(JSON.stringify(payload)).toString(\"base64url\");\n            const message = `${headerB64}.${payloadB64}`;\n            const asn1Signature = sign(\"sha256\", Buffer.from(message), privateKey);\n            const rawSignature = this.derToRawSignature(asn1Signature);\n            const signatureB64 = rawSignature.toString(\"base64url\");\n            return `${message}.${signatureB64}`;\n        }\n        catch (error) {\n            throw new CredentialsProviderError(`Failed to generate Dpop proof: ${error instanceof Error ? error.message : String(error)}`, { logger: this.logger, tryNextLink: false });\n        }\n    }\n}\n","import { setCredentialFeature } from \"@aws-sdk/core/client\";\nimport { CredentialsProviderError, getProfileName, parseKnownFiles } from \"@smithy/core/config\";\nimport { LoginCredentialsFetcher } from \"./LoginCredentialsFetcher\";\nexport const fromLoginCredentials = (init) => async ({ callerClientConfig } = {}) => {\n    init?.logger?.debug?.(\"@aws-sdk/credential-providers - fromLoginCredentials\");\n    const profiles = await parseKnownFiles(init || {});\n    const profileName = getProfileName({\n        profile: init?.profile ?? callerClientConfig?.profile,\n    });\n    const profile = profiles[profileName];\n    if (!profile?.login_session) {\n        throw new CredentialsProviderError(`Profile ${profileName} does not contain login_session.`, {\n            tryNextLink: true,\n            logger: init?.logger,\n        });\n    }\n    const fetcher = new LoginCredentialsFetcher(profile, init, callerClientConfig);\n    const credentials = await fetcher.loadCredentials();\n    return setCredentialFeature(credentials, \"CREDENTIALS_LOGIN\", \"AD\");\n};\n"],"mappings":";;;;;;;;;;;;;AAEA,SAAS,YAAY,kBAAkB,iBAAiB,YAAY;AACpE,SAAS,YAAY,UAAU;AAC/B,SAAS,eAAe;AACxB,SAAS,SAAS,YAAY;AACvB,IAAM,0BAAN,MAAM,yBAAwB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA,OAAO,oBAAoB,IAAI,KAAK;AAAA,EACpC,YAAY,aAAa,MAAM,oBAAoB;AAC/C,SAAK,cAAc;AACnB,SAAK,OAAO;AACZ,SAAK,qBAAqB;AAAA,EAC9B;AAAA,EACA,MAAM,kBAAkB;AACpB,UAAM,QAAQ,MAAM,KAAK,UAAU;AACnC,QAAI,CAAC,OAAO;AACR,YAAM,IAAI,yBAAyB,sCAAsC,KAAK,YAAY,4CAA4C,EAAE,aAAa,OAAO,QAAQ,KAAK,OAAO,CAAC;AAAA,IACrL;AACA,UAAM,cAAc,MAAM;AAC1B,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,aAAa,IAAI,KAAK,YAAY,SAAS,EAAE,QAAQ;AAC3D,UAAM,kBAAkB,aAAa;AACrC,QAAI,mBAAmB,yBAAwB,mBAAmB;AAC9D,aAAO,KAAK,QAAQ,KAAK;AAAA,IAC7B;AACA,WAAO;AAAA,MACH,aAAa,YAAY;AAAA,MACzB,iBAAiB,YAAY;AAAA,MAC7B,cAAc,YAAY;AAAA,MAC1B,WAAW,YAAY;AAAA,MACvB,YAAY,IAAI,KAAK,YAAY,SAAS;AAAA,IAC9C;AAAA,EACJ;AAAA,EACA,IAAI,SAAS;AACT,WAAO,KAAK,MAAM;AAAA,EACtB;AAAA,EACA,IAAI,eAAe;AACf,WAAO,KAAK,YAAY;AAAA,EAC5B;AAAA,EACA,MAAM,QAAQ,OAAO;AACjB,UAAM,EAAE,cAAc,yBAAyB,IAAI,MAAM,OAAO,sBAAgC;AAChG,UAAM,EAAE,QAAQ,eAAe,IAAI,KAAK,sBAAsB,CAAC;AAC/D,UAAM,OAAO,CAACA,oBAAmB;AAC7B,aAAOA,iBAAgB,UAAU,oBAAoB;AAAA,IACzD;AACA,UAAM,iBAAiB,KAAK,KAAK,oBAAoB,cAAc,IAC7D,SACA,KAAK,oBAAoB;AAC/B,UAAM,SAAS,KAAK,YAAY,UAAW,MAAM,KAAK,oBAAoB,SAAS,KAAM,QAAQ,IAAI;AACrG,UAAM,SAAS,IAAI,aAAa;AAAA,MAC5B,aAAa;AAAA,QACT,aAAa;AAAA,QACb,iBAAiB;AAAA,MACrB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAG,KAAK,MAAM;AAAA,IAClB,CAAC;AACD,SAAK,sBAAsB,OAAO,eAAe;AACjD,UAAM,eAAe;AAAA,MACjB,YAAY;AAAA,QACR,UAAU,MAAM;AAAA,QAChB,cAAc,MAAM;AAAA,QACpB,WAAW;AAAA,MACf;AAAA,IACJ;AACA,QAAI;AACA,YAAM,WAAW,MAAM,OAAO,KAAK,IAAI,yBAAyB,YAAY,CAAC;AAC7E,YAAM,EAAE,aAAa,iBAAiB,aAAa,IAAI,SAAS,aAAa,eAAe,CAAC;AAC7F,YAAM,EAAE,cAAc,UAAU,IAAI,SAAS,eAAe,CAAC;AAC7D,UAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,cAAc;AACpE,cAAM,IAAI,yBAAyB,kDAAkD;AAAA,UACjF,QAAQ,KAAK;AAAA,UACb,aAAa;AAAA,QACjB,CAAC;AAAA,MACL;AACA,YAAM,eAAe,aAAa,OAAO;AACzC,YAAM,aAAa,IAAI,KAAK,KAAK,IAAI,IAAI,WAAW;AACpD,YAAM,eAAe;AAAA,QACjB,GAAG;AAAA,QACH,aAAa;AAAA,UACT,GAAG,MAAM;AAAA,UACT;AAAA,UACA;AAAA,UACA;AAAA,UACA,WAAW,WAAW,YAAY;AAAA,QACtC;AAAA,QACA;AAAA,MACJ;AACA,YAAM,KAAK,UAAU,YAAY;AACjC,YAAM,iBAAiB,aAAa;AACpC,aAAO;AAAA,QACH,aAAa,eAAe;AAAA,QAC5B,iBAAiB,eAAe;AAAA,QAChC,cAAc,eAAe;AAAA,QAC7B,WAAW,eAAe;AAAA,QAC1B;AAAA,MACJ;AAAA,IACJ,SACO,OAAO;AACV,UAAI,MAAM,SAAS,yBAAyB;AACxC,cAAM,YAAY,MAAM;AACxB,YAAI;AACJ,gBAAQ,WAAW;AAAA,UACf,KAAK;AACD,sBAAU;AACV;AAAA,UACJ,KAAK;AACD,sBACI;AACJ;AAAA,UACJ,KAAK;AACD,sBACI;AACJ;AAAA,UACJ;AACI,sBAAU,4BAA4B,OAAO,KAAK,CAAC;AAAA,QAC3D;AACA,cAAM,IAAI,yBAAyB,SAAS,EAAE,QAAQ,KAAK,QAAQ,aAAa,MAAM,CAAC;AAAA,MAC3F;AACA,YAAM,IAAI,yBAAyB,4BAA4B,OAAO,KAAK,CAAC,4CAA4C,EAAE,QAAQ,KAAK,OAAO,CAAC;AAAA,IACnJ;AAAA,EACJ;AAAA,EACA,MAAM,YAAY;AACd,UAAM,gBAAgB,KAAK,iBAAiB;AAC5C,QAAI;AACA,UAAI;AACJ,UAAI;AACA,oBAAY,MAAM,SAAS,eAAe,EAAE,aAAa,KAAK,MAAM,YAAY,CAAC;AAAA,MACrF,QACM;AACF,oBAAY,MAAM,GAAG,SAAS,eAAe,MAAM;AAAA,MACvD;AACA,YAAM,QAAQ,KAAK,MAAM,SAAS;AAClC,YAAM,gBAAgB,CAAC,eAAe,YAAY,gBAAgB,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACpG,UAAI,CAAC,MAAM,aAAa,WAAW;AAC/B,sBAAc,KAAK,WAAW;AAAA,MAClC;AACA,UAAI,cAAc,SAAS,GAAG;AAC1B,cAAM,IAAI,yBAAyB,4CAA4C,cAAc,KAAK,IAAI,CAAC,IAAI;AAAA,UACvG,QAAQ,KAAK;AAAA,UACb,aAAa;AAAA,QACjB,CAAC;AAAA,MACL;AACA,aAAO;AAAA,IACX,SACO,OAAO;AACV,YAAM,IAAI,yBAAyB,6BAA6B,aAAa,KAAK,OAAO,KAAK,CAAC,IAAI;AAAA,QAC/F,QAAQ,KAAK;AAAA,QACb,aAAa;AAAA,MACjB,CAAC;AAAA,IACL;AAAA,EACJ;AAAA,EACA,MAAM,UAAU,OAAO;AACnB,UAAM,gBAAgB,KAAK,iBAAiB;AAC5C,UAAM,YAAY,QAAQ,aAAa;AACvC,QAAI;AACA,YAAM,GAAG,MAAM,WAAW,EAAE,WAAW,KAAK,CAAC;AAAA,IACjD,SACO,OAAO;AAAA,IACd;AACA,UAAM,GAAG,UAAU,eAAe,KAAK,UAAU,OAAO,MAAM,CAAC,GAAG,MAAM;AAAA,EAC5E;AAAA,EACA,mBAAmB;AACf,UAAM,YAAY,QAAQ,IAAI,6BAA6B,KAAK,QAAQ,GAAG,QAAQ,SAAS,OAAO;AACnG,UAAM,oBAAoB,OAAO,KAAK,KAAK,cAAc,MAAM;AAC/D,UAAM,qBAAqB,WAAW,QAAQ,EAAE,OAAO,iBAAiB,EAAE,OAAO,KAAK;AACtF,WAAO,KAAK,WAAW,GAAG,kBAAkB,OAAO;AAAA,EACvD;AAAA,EACA,kBAAkB,cAAc;AAC5B,QAAI,SAAS;AACb,QAAI,aAAa,MAAM,MAAM,GAAM;AAC/B,YAAM,IAAI,MAAM,uBAAuB;AAAA,IAC3C;AACA;AACA,UAAM,UAAU,aAAa,QAAQ;AACrC,QAAI,IAAI,aAAa,SAAS,QAAQ,SAAS,OAAO;AACtD,cAAU;AACV,QAAI,aAAa,MAAM,MAAM,GAAM;AAC/B,YAAM,IAAI,MAAM,uBAAuB;AAAA,IAC3C;AACA;AACA,UAAM,UAAU,aAAa,QAAQ;AACrC,QAAI,IAAI,aAAa,SAAS,QAAQ,SAAS,OAAO;AACtD,QAAI,EAAE,CAAC,MAAM,IAAO,EAAE,SAAS,CAAC,IAAI;AACpC,QAAI,EAAE,CAAC,MAAM,IAAO,EAAE,SAAS,CAAC,IAAI;AACpC,UAAM,UAAU,OAAO,OAAO,CAAC,OAAO,MAAM,KAAK,EAAE,MAAM,GAAG,CAAC,CAAC;AAC9D,UAAM,UAAU,OAAO,OAAO,CAAC,OAAO,MAAM,KAAK,EAAE,MAAM,GAAG,CAAC,CAAC;AAC9D,WAAO,OAAO,OAAO,CAAC,SAAS,OAAO,CAAC;AAAA,EAC3C;AAAA,EACA,sBAAsB,iBAAiB;AACnC,oBAAgB,IAAI,CAAC,SAAS,OAAO,SAAS;AAC1C,UAAI,YAAY,WAAW,KAAK,OAAO,GAAG;AACtC,cAAM,UAAU,KAAK;AACrB,cAAM,iBAAiB,GAAG,QAAQ,QAAQ,KAAK,QAAQ,QAAQ,GAAG,QAAQ,OAAO,IAAI,QAAQ,IAAI,KAAK,EAAE,GAAG,QAAQ,IAAI;AACvH,cAAM,OAAO,MAAM,KAAK,aAAa,QAAQ,QAAQ,cAAc;AACnE,gBAAQ,UAAU;AAAA,UACd,GAAG,QAAQ;AAAA,UACX,MAAM;AAAA,QACV;AAAA,MACJ;AACA,aAAO,KAAK,IAAI;AAAA,IACpB,GAAG;AAAA,MACC,MAAM;AAAA,MACN,MAAM;AAAA,MACN,UAAU;AAAA,IACd,CAAC;AAAA,EACL;AAAA,EACA,MAAM,aAAa,SAAS,QAAQ,UAAU;AAC1C,UAAM,QAAQ,MAAM,KAAK,UAAU;AACnC,QAAI;AACA,YAAM,aAAa,iBAAiB;AAAA,QAChC,KAAK,MAAM;AAAA,QACX,QAAQ;AAAA,QACR,MAAM;AAAA,MACV,CAAC;AACD,YAAM,YAAY,gBAAgB,UAAU;AAC5C,YAAM,YAAY,UAAU,OAAO,EAAE,QAAQ,OAAO,MAAM,OAAO,CAAC;AAClE,UAAI,aAAa;AACjB,eAAS,IAAI,GAAG,IAAI,UAAU,QAAQ,KAAK;AACvC,YAAI,UAAU,CAAC,MAAM,GAAM;AACvB,uBAAa;AACb;AAAA,QACJ;AAAA,MACJ;AACA,YAAM,IAAI,UAAU,MAAM,aAAa,GAAG,aAAa,EAAE;AACzD,YAAM,IAAI,UAAU,MAAM,aAAa,IAAI,aAAa,EAAE;AAC1D,YAAM,SAAS;AAAA,QACX,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,UACD,KAAK;AAAA,UACL,KAAK;AAAA,UACL,GAAG,EAAE,SAAS,WAAW;AAAA,UACzB,GAAG,EAAE,SAAS,WAAW;AAAA,QAC7B;AAAA,MACJ;AACA,YAAM,UAAU;AAAA,QACZ,KAAK,OAAO,WAAW;AAAA,QACvB,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,MACrC;AACA,YAAM,YAAY,OAAO,KAAK,KAAK,UAAU,MAAM,CAAC,EAAE,SAAS,WAAW;AAC1E,YAAM,aAAa,OAAO,KAAK,KAAK,UAAU,OAAO,CAAC,EAAE,SAAS,WAAW;AAC5E,YAAM,UAAU,GAAG,SAAS,IAAI,UAAU;AAC1C,YAAM,gBAAgB,KAAK,UAAU,OAAO,KAAK,OAAO,GAAG,UAAU;AACrE,YAAM,eAAe,KAAK,kBAAkB,aAAa;AACzD,YAAM,eAAe,aAAa,SAAS,WAAW;AACtD,aAAO,GAAG,OAAO,IAAI,YAAY;AAAA,IACrC,SACO,OAAO;AACV,YAAM,IAAI,yBAAyB,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,IAAI,EAAE,QAAQ,KAAK,QAAQ,aAAa,MAAM,CAAC;AAAA,IAC9K;AAAA,EACJ;AACJ;;;ACjQO,IAAM,uBAAuB,CAAC,SAAS,OAAO,EAAE,mBAAmB,IAAI,CAAC,MAAM;AACjF,QAAM,QAAQ,QAAQ,sDAAsD;AAC5E,QAAM,WAAW,MAAM,gBAAgB,QAAQ,CAAC,CAAC;AACjD,QAAM,cAAc,eAAe;AAAA,IAC/B,SAAS,MAAM,WAAW,oBAAoB;AAAA,EAClD,CAAC;AACD,QAAM,UAAU,SAAS,WAAW;AACpC,MAAI,CAAC,SAAS,eAAe;AACzB,UAAM,IAAI,yBAAyB,WAAW,WAAW,oCAAoC;AAAA,MACzF,aAAa;AAAA,MACb,QAAQ,MAAM;AAAA,IAClB,CAAC;AAAA,EACL;AACA,QAAM,UAAU,IAAI,wBAAwB,SAAS,MAAM,kBAAkB;AAC7E,QAAM,cAAc,MAAM,QAAQ,gBAAgB;AAClD,SAAO,qBAAqB,aAAa,qBAAqB,IAAI;AACtE;","names":["requestHandler"]}
+{"version":3,"sources":["../../../node_modules/@aws-sdk/credential-provider-login/dist-es/LoginCredentialsFetcher.js","../../../node_modules/@aws-sdk/credential-provider-login/dist-es/fromLoginCredentials.js"],"sourcesContent":["import { CredentialsProviderError, readFile } from \"@smithy/core/config\";\nimport { HttpRequest } from \"@smithy/core/protocols\";\nimport { createHash, createPrivateKey, createPublicKey, sign } from \"node:crypto\";\nimport { promises as fs } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\nexport class LoginCredentialsFetcher {\n    profileData;\n    init;\n    callerClientConfig;\n    static REFRESH_THRESHOLD = 5 * 60 * 1000;\n    constructor(profileData, init, callerClientConfig) {\n        this.profileData = profileData;\n        this.init = init;\n        this.callerClientConfig = callerClientConfig;\n    }\n    async loadCredentials() {\n        const token = await this.loadToken();\n        if (!token) {\n            throw new CredentialsProviderError(`Failed to load a token for session ${this.loginSession}, please re-authenticate using aws login`, { tryNextLink: false, logger: this.logger });\n        }\n        const accessToken = token.accessToken;\n        const now = Date.now();\n        const expiryTime = new Date(accessToken.expiresAt).getTime();\n        const timeUntilExpiry = expiryTime - now;\n        if (timeUntilExpiry <= LoginCredentialsFetcher.REFRESH_THRESHOLD) {\n            return this.refresh(token);\n        }\n        return {\n            accessKeyId: accessToken.accessKeyId,\n            secretAccessKey: accessToken.secretAccessKey,\n            sessionToken: accessToken.sessionToken,\n            accountId: accessToken.accountId,\n            expiration: new Date(accessToken.expiresAt),\n        };\n    }\n    get logger() {\n        return this.init?.logger;\n    }\n    get loginSession() {\n        return this.profileData.login_session;\n    }\n    async refresh(token) {\n        const { SigninClient, CreateOAuth2TokenCommand } = await import(\"@aws-sdk/nested-clients/signin\");\n        const { logger, userAgentAppId } = this.callerClientConfig ?? {};\n        const isH2 = (requestHandler) => {\n            return requestHandler?.metadata?.handlerProtocol === \"h2\";\n        };\n        const requestHandler = isH2(this.callerClientConfig?.requestHandler)\n            ? undefined\n            : this.callerClientConfig?.requestHandler;\n        const region = this.profileData.region ?? (await this.callerClientConfig?.region?.()) ?? process.env.AWS_REGION;\n        const client = new SigninClient({\n            credentials: {\n                accessKeyId: \"\",\n                secretAccessKey: \"\",\n            },\n            region,\n            requestHandler,\n            logger,\n            userAgentAppId,\n            ...this.init?.clientConfig,\n        });\n        this.createDPoPInterceptor(client.middlewareStack);\n        const commandInput = {\n            tokenInput: {\n                clientId: token.clientId,\n                refreshToken: token.refreshToken,\n                grantType: \"refresh_token\",\n            },\n        };\n        try {\n            const response = await client.send(new CreateOAuth2TokenCommand(commandInput));\n            const { accessKeyId, secretAccessKey, sessionToken } = response.tokenOutput?.accessToken ?? {};\n            const { refreshToken, expiresIn } = response.tokenOutput ?? {};\n            if (!accessKeyId || !secretAccessKey || !sessionToken || !refreshToken) {\n                throw new CredentialsProviderError(\"Token refresh response missing required fields\", {\n                    logger: this.logger,\n                    tryNextLink: false,\n                });\n            }\n            const expiresInMs = (expiresIn ?? 900) * 1000;\n            const expiration = new Date(Date.now() + expiresInMs);\n            const updatedToken = {\n                ...token,\n                accessToken: {\n                    ...token.accessToken,\n                    accessKeyId,\n                    secretAccessKey,\n                    sessionToken,\n                    expiresAt: expiration.toISOString(),\n                },\n                refreshToken,\n            };\n            await this.saveToken(updatedToken);\n            const newAccessToken = updatedToken.accessToken;\n            return {\n                accessKeyId: newAccessToken.accessKeyId,\n                secretAccessKey: newAccessToken.secretAccessKey,\n                sessionToken: newAccessToken.sessionToken,\n                accountId: newAccessToken.accountId,\n                expiration,\n            };\n        }\n        catch (error) {\n            if (error.name === \"AccessDeniedException\") {\n                const errorType = error.error;\n                let message;\n                switch (errorType) {\n                    case \"TOKEN_EXPIRED\":\n                        message = \"Your session has expired. Please reauthenticate.\";\n                        break;\n                    case \"USER_CREDENTIALS_CHANGED\":\n                        message =\n                            \"Unable to refresh credentials because of a change in your password. Please reauthenticate with your new password.\";\n                        break;\n                    case \"INSUFFICIENT_PERMISSIONS\":\n                        message =\n                            \"Unable to refresh credentials due to insufficient permissions. You may be missing permission for the 'CreateOAuth2Token' action.\";\n                        break;\n                    default:\n                        message = `Failed to refresh token: ${String(error)}. Please re-authenticate using \\`aws login\\``;\n                }\n                throw new CredentialsProviderError(message, { logger: this.logger, tryNextLink: false });\n            }\n            throw new CredentialsProviderError(`Failed to refresh token: ${String(error)}. Please re-authenticate using aws login`, { logger: this.logger });\n        }\n    }\n    async loadToken() {\n        const tokenFilePath = this.getTokenFilePath();\n        try {\n            let tokenData;\n            try {\n                tokenData = await readFile(tokenFilePath, { ignoreCache: this.init?.ignoreCache });\n            }\n            catch {\n                tokenData = await fs.readFile(tokenFilePath, \"utf8\");\n            }\n            const token = JSON.parse(tokenData);\n            const missingFields = [\"accessToken\", \"clientId\", \"refreshToken\", \"dpopKey\"].filter((k) => !token[k]);\n            if (!token.accessToken?.accountId) {\n                missingFields.push(\"accountId\");\n            }\n            if (missingFields.length > 0) {\n                throw new CredentialsProviderError(`Token validation failed, missing fields: ${missingFields.join(\", \")}`, {\n                    logger: this.logger,\n                    tryNextLink: false,\n                });\n            }\n            return token;\n        }\n        catch (error) {\n            throw new CredentialsProviderError(`Failed to load token from ${tokenFilePath}: ${String(error)}`, {\n                logger: this.logger,\n                tryNextLink: false,\n            });\n        }\n    }\n    async saveToken(token) {\n        const tokenFilePath = this.getTokenFilePath();\n        const directory = dirname(tokenFilePath);\n        try {\n            await fs.mkdir(directory, { recursive: true });\n        }\n        catch (error) {\n        }\n        await fs.writeFile(tokenFilePath, JSON.stringify(token, null, 2), \"utf8\");\n    }\n    getTokenFilePath() {\n        const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ?? join(homedir(), \".aws\", \"login\", \"cache\");\n        const loginSessionBytes = Buffer.from(this.loginSession, \"utf8\");\n        const loginSessionSha256 = createHash(\"sha256\").update(loginSessionBytes).digest(\"hex\");\n        return join(directory, `${loginSessionSha256}.json`);\n    }\n    derToRawSignature(derSignature) {\n        let offset = 2;\n        if (derSignature[offset] !== 0x02) {\n            throw new Error(\"Invalid DER signature\");\n        }\n        offset++;\n        const rLength = derSignature[offset++];\n        let r = derSignature.subarray(offset, offset + rLength);\n        offset += rLength;\n        if (derSignature[offset] !== 0x02) {\n            throw new Error(\"Invalid DER signature\");\n        }\n        offset++;\n        const sLength = derSignature[offset++];\n        let s = derSignature.subarray(offset, offset + sLength);\n        r = r[0] === 0x00 ? r.subarray(1) : r;\n        s = s[0] === 0x00 ? s.subarray(1) : s;\n        const rPadded = Buffer.concat([Buffer.alloc(32 - r.length), r]);\n        const sPadded = Buffer.concat([Buffer.alloc(32 - s.length), s]);\n        return Buffer.concat([rPadded, sPadded]);\n    }\n    createDPoPInterceptor(middlewareStack) {\n        middlewareStack.add((next) => async (args) => {\n            if (HttpRequest.isInstance(args.request)) {\n                const request = args.request;\n                const actualEndpoint = `${request.protocol}//${request.hostname}${request.port ? `:${request.port}` : \"\"}${request.path}`;\n                const dpop = await this.generateDpop(request.method, actualEndpoint);\n                request.headers = {\n                    ...request.headers,\n                    DPoP: dpop,\n                };\n            }\n            return next(args);\n        }, {\n            step: \"finalizeRequest\",\n            name: \"dpopInterceptor\",\n            override: true,\n        });\n    }\n    async generateDpop(method = \"POST\", endpoint) {\n        const token = await this.loadToken();\n        try {\n            const privateKey = createPrivateKey({\n                key: token.dpopKey,\n                format: \"pem\",\n                type: \"sec1\",\n            });\n            const publicKey = createPublicKey(privateKey);\n            const publicDer = publicKey.export({ format: \"der\", type: \"spki\" });\n            let pointStart = -1;\n            for (let i = 0; i < publicDer.length; i++) {\n                if (publicDer[i] === 0x04) {\n                    pointStart = i;\n                    break;\n                }\n            }\n            const x = publicDer.slice(pointStart + 1, pointStart + 33);\n            const y = publicDer.slice(pointStart + 33, pointStart + 65);\n            const header = {\n                alg: \"ES256\",\n                typ: \"dpop+jwt\",\n                jwk: {\n                    kty: \"EC\",\n                    crv: \"P-256\",\n                    x: x.toString(\"base64url\"),\n                    y: y.toString(\"base64url\"),\n                },\n            };\n            const payload = {\n                jti: crypto.randomUUID(),\n                htm: method,\n                htu: endpoint,\n                iat: Math.floor(Date.now() / 1000),\n            };\n            const headerB64 = Buffer.from(JSON.stringify(header)).toString(\"base64url\");\n            const payloadB64 = Buffer.from(JSON.stringify(payload)).toString(\"base64url\");\n            const message = `${headerB64}.${payloadB64}`;\n            const asn1Signature = sign(\"sha256\", Buffer.from(message), privateKey);\n            const rawSignature = this.derToRawSignature(asn1Signature);\n            const signatureB64 = rawSignature.toString(\"base64url\");\n            return `${message}.${signatureB64}`;\n        }\n        catch (error) {\n            throw new CredentialsProviderError(`Failed to generate Dpop proof: ${error instanceof Error ? error.message : String(error)}`, { logger: this.logger, tryNextLink: false });\n        }\n    }\n}\n","import { setCredentialFeature } from \"@aws-sdk/core/client\";\nimport { CredentialsProviderError, getProfileName, parseKnownFiles } from \"@smithy/core/config\";\nimport { LoginCredentialsFetcher } from \"./LoginCredentialsFetcher\";\nexport const fromLoginCredentials = (init) => async ({ callerClientConfig } = {}) => {\n    init?.logger?.debug?.(\"@aws-sdk/credential-providers - fromLoginCredentials\");\n    const profiles = await parseKnownFiles(init || {});\n    const profileName = getProfileName({\n        profile: init?.profile ?? callerClientConfig?.profile,\n    });\n    const profile = profiles[profileName];\n    if (!profile?.login_session) {\n        throw new CredentialsProviderError(`Profile ${profileName} does not contain login_session.`, {\n            tryNextLink: true,\n            logger: init?.logger,\n        });\n    }\n    const fetcher = new LoginCredentialsFetcher(profile, init, callerClientConfig);\n    const credentials = await fetcher.loadCredentials();\n    return setCredentialFeature(credentials, \"CREDENTIALS_LOGIN\", \"AD\");\n};\n"],"mappings":";;;;;;;;;;;;;;AAEA,SAAS,YAAY,kBAAkB,iBAAiB,YAAY;AACpE,SAAS,YAAY,UAAU;AAC/B,SAAS,eAAe;AACxB,SAAS,SAAS,YAAY;AACvB,IAAM,0BAAN,MAAM,yBAAwB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA,OAAO,oBAAoB,IAAI,KAAK;AAAA,EACpC,YAAY,aAAa,MAAM,oBAAoB;AAC/C,SAAK,cAAc;AACnB,SAAK,OAAO;AACZ,SAAK,qBAAqB;AAAA,EAC9B;AAAA,EACA,MAAM,kBAAkB;AACpB,UAAM,QAAQ,MAAM,KAAK,UAAU;AACnC,QAAI,CAAC,OAAO;AACR,YAAM,IAAI,yBAAyB,sCAAsC,KAAK,YAAY,4CAA4C,EAAE,aAAa,OAAO,QAAQ,KAAK,OAAO,CAAC;AAAA,IACrL;AACA,UAAM,cAAc,MAAM;AAC1B,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,aAAa,IAAI,KAAK,YAAY,SAAS,EAAE,QAAQ;AAC3D,UAAM,kBAAkB,aAAa;AACrC,QAAI,mBAAmB,yBAAwB,mBAAmB;AAC9D,aAAO,KAAK,QAAQ,KAAK;AAAA,IAC7B;AACA,WAAO;AAAA,MACH,aAAa,YAAY;AAAA,MACzB,iBAAiB,YAAY;AAAA,MAC7B,cAAc,YAAY;AAAA,MAC1B,WAAW,YAAY;AAAA,MACvB,YAAY,IAAI,KAAK,YAAY,SAAS;AAAA,IAC9C;AAAA,EACJ;AAAA,EACA,IAAI,SAAS;AACT,WAAO,KAAK,MAAM;AAAA,EACtB;AAAA,EACA,IAAI,eAAe;AACf,WAAO,KAAK,YAAY;AAAA,EAC5B;AAAA,EACA,MAAM,QAAQ,OAAO;AACjB,UAAM,EAAE,cAAc,yBAAyB,IAAI,MAAM,OAAO,sBAAgC;AAChG,UAAM,EAAE,QAAQ,eAAe,IAAI,KAAK,sBAAsB,CAAC;AAC/D,UAAM,OAAO,CAACA,oBAAmB;AAC7B,aAAOA,iBAAgB,UAAU,oBAAoB;AAAA,IACzD;AACA,UAAM,iBAAiB,KAAK,KAAK,oBAAoB,cAAc,IAC7D,SACA,KAAK,oBAAoB;AAC/B,UAAM,SAAS,KAAK,YAAY,UAAW,MAAM,KAAK,oBAAoB,SAAS,KAAM,QAAQ,IAAI;AACrG,UAAM,SAAS,IAAI,aAAa;AAAA,MAC5B,aAAa;AAAA,QACT,aAAa;AAAA,QACb,iBAAiB;AAAA,MACrB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAG,KAAK,MAAM;AAAA,IAClB,CAAC;AACD,SAAK,sBAAsB,OAAO,eAAe;AACjD,UAAM,eAAe;AAAA,MACjB,YAAY;AAAA,QACR,UAAU,MAAM;AAAA,QAChB,cAAc,MAAM;AAAA,QACpB,WAAW;AAAA,MACf;AAAA,IACJ;AACA,QAAI;AACA,YAAM,WAAW,MAAM,OAAO,KAAK,IAAI,yBAAyB,YAAY,CAAC;AAC7E,YAAM,EAAE,aAAa,iBAAiB,aAAa,IAAI,SAAS,aAAa,eAAe,CAAC;AAC7F,YAAM,EAAE,cAAc,UAAU,IAAI,SAAS,eAAe,CAAC;AAC7D,UAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,cAAc;AACpE,cAAM,IAAI,yBAAyB,kDAAkD;AAAA,UACjF,QAAQ,KAAK;AAAA,UACb,aAAa;AAAA,QACjB,CAAC;AAAA,MACL;AACA,YAAM,eAAe,aAAa,OAAO;AACzC,YAAM,aAAa,IAAI,KAAK,KAAK,IAAI,IAAI,WAAW;AACpD,YAAM,eAAe;AAAA,QACjB,GAAG;AAAA,QACH,aAAa;AAAA,UACT,GAAG,MAAM;AAAA,UACT;AAAA,UACA;AAAA,UACA;AAAA,UACA,WAAW,WAAW,YAAY;AAAA,QACtC;AAAA,QACA;AAAA,MACJ;AACA,YAAM,KAAK,UAAU,YAAY;AACjC,YAAM,iBAAiB,aAAa;AACpC,aAAO;AAAA,QACH,aAAa,eAAe;AAAA,QAC5B,iBAAiB,eAAe;AAAA,QAChC,cAAc,eAAe;AAAA,QAC7B,WAAW,eAAe;AAAA,QAC1B;AAAA,MACJ;AAAA,IACJ,SACO,OAAO;AACV,UAAI,MAAM,SAAS,yBAAyB;AACxC,cAAM,YAAY,MAAM;AACxB,YAAI;AACJ,gBAAQ,WAAW;AAAA,UACf,KAAK;AACD,sBAAU;AACV;AAAA,UACJ,KAAK;AACD,sBACI;AACJ;AAAA,UACJ,KAAK;AACD,sBACI;AACJ;AAAA,UACJ;AACI,sBAAU,4BAA4B,OAAO,KAAK,CAAC;AAAA,QAC3D;AACA,cAAM,IAAI,yBAAyB,SAAS,EAAE,QAAQ,KAAK,QAAQ,aAAa,MAAM,CAAC;AAAA,MAC3F;AACA,YAAM,IAAI,yBAAyB,4BAA4B,OAAO,KAAK,CAAC,4CAA4C,EAAE,QAAQ,KAAK,OAAO,CAAC;AAAA,IACnJ;AAAA,EACJ;AAAA,EACA,MAAM,YAAY;AACd,UAAM,gBAAgB,KAAK,iBAAiB;AAC5C,QAAI;AACA,UAAI;AACJ,UAAI;AACA,oBAAY,MAAM,SAAS,eAAe,EAAE,aAAa,KAAK,MAAM,YAAY,CAAC;AAAA,MACrF,QACM;AACF,oBAAY,MAAM,GAAG,SAAS,eAAe,MAAM;AAAA,MACvD;AACA,YAAM,QAAQ,KAAK,MAAM,SAAS;AAClC,YAAM,gBAAgB,CAAC,eAAe,YAAY,gBAAgB,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACpG,UAAI,CAAC,MAAM,aAAa,WAAW;AAC/B,sBAAc,KAAK,WAAW;AAAA,MAClC;AACA,UAAI,cAAc,SAAS,GAAG;AAC1B,cAAM,IAAI,yBAAyB,4CAA4C,cAAc,KAAK,IAAI,CAAC,IAAI;AAAA,UACvG,QAAQ,KAAK;AAAA,UACb,aAAa;AAAA,QACjB,CAAC;AAAA,MACL;AACA,aAAO;AAAA,IACX,SACO,OAAO;AACV,YAAM,IAAI,yBAAyB,6BAA6B,aAAa,KAAK,OAAO,KAAK,CAAC,IAAI;AAAA,QAC/F,QAAQ,KAAK;AAAA,QACb,aAAa;AAAA,MACjB,CAAC;AAAA,IACL;AAAA,EACJ;AAAA,EACA,MAAM,UAAU,OAAO;AACnB,UAAM,gBAAgB,KAAK,iBAAiB;AAC5C,UAAM,YAAY,QAAQ,aAAa;AACvC,QAAI;AACA,YAAM,GAAG,MAAM,WAAW,EAAE,WAAW,KAAK,CAAC;AAAA,IACjD,SACO,OAAO;AAAA,IACd;AACA,UAAM,GAAG,UAAU,eAAe,KAAK,UAAU,OAAO,MAAM,CAAC,GAAG,MAAM;AAAA,EAC5E;AAAA,EACA,mBAAmB;AACf,UAAM,YAAY,QAAQ,IAAI,6BAA6B,KAAK,QAAQ,GAAG,QAAQ,SAAS,OAAO;AACnG,UAAM,oBAAoB,OAAO,KAAK,KAAK,cAAc,MAAM;AAC/D,UAAM,qBAAqB,WAAW,QAAQ,EAAE,OAAO,iBAAiB,EAAE,OAAO,KAAK;AACtF,WAAO,KAAK,WAAW,GAAG,kBAAkB,OAAO;AAAA,EACvD;AAAA,EACA,kBAAkB,cAAc;AAC5B,QAAI,SAAS;AACb,QAAI,aAAa,MAAM,MAAM,GAAM;AAC/B,YAAM,IAAI,MAAM,uBAAuB;AAAA,IAC3C;AACA;AACA,UAAM,UAAU,aAAa,QAAQ;AACrC,QAAI,IAAI,aAAa,SAAS,QAAQ,SAAS,OAAO;AACtD,cAAU;AACV,QAAI,aAAa,MAAM,MAAM,GAAM;AAC/B,YAAM,IAAI,MAAM,uBAAuB;AAAA,IAC3C;AACA;AACA,UAAM,UAAU,aAAa,QAAQ;AACrC,QAAI,IAAI,aAAa,SAAS,QAAQ,SAAS,OAAO;AACtD,QAAI,EAAE,CAAC,MAAM,IAAO,EAAE,SAAS,CAAC,IAAI;AACpC,QAAI,EAAE,CAAC,MAAM,IAAO,EAAE,SAAS,CAAC,IAAI;AACpC,UAAM,UAAU,OAAO,OAAO,CAAC,OAAO,MAAM,KAAK,EAAE,MAAM,GAAG,CAAC,CAAC;AAC9D,UAAM,UAAU,OAAO,OAAO,CAAC,OAAO,MAAM,KAAK,EAAE,MAAM,GAAG,CAAC,CAAC;AAC9D,WAAO,OAAO,OAAO,CAAC,SAAS,OAAO,CAAC;AAAA,EAC3C;AAAA,EACA,sBAAsB,iBAAiB;AACnC,oBAAgB,IAAI,CAAC,SAAS,OAAO,SAAS;AAC1C,UAAI,YAAY,WAAW,KAAK,OAAO,GAAG;AACtC,cAAM,UAAU,KAAK;AACrB,cAAM,iBAAiB,GAAG,QAAQ,QAAQ,KAAK,QAAQ,QAAQ,GAAG,QAAQ,OAAO,IAAI,QAAQ,IAAI,KAAK,EAAE,GAAG,QAAQ,IAAI;AACvH,cAAM,OAAO,MAAM,KAAK,aAAa,QAAQ,QAAQ,cAAc;AACnE,gBAAQ,UAAU;AAAA,UACd,GAAG,QAAQ;AAAA,UACX,MAAM;AAAA,QACV;AAAA,MACJ;AACA,aAAO,KAAK,IAAI;AAAA,IACpB,GAAG;AAAA,MACC,MAAM;AAAA,MACN,MAAM;AAAA,MACN,UAAU;AAAA,IACd,CAAC;AAAA,EACL;AAAA,EACA,MAAM,aAAa,SAAS,QAAQ,UAAU;AAC1C,UAAM,QAAQ,MAAM,KAAK,UAAU;AACnC,QAAI;AACA,YAAM,aAAa,iBAAiB;AAAA,QAChC,KAAK,MAAM;AAAA,QACX,QAAQ;AAAA,QACR,MAAM;AAAA,MACV,CAAC;AACD,YAAM,YAAY,gBAAgB,UAAU;AAC5C,YAAM,YAAY,UAAU,OAAO,EAAE,QAAQ,OAAO,MAAM,OAAO,CAAC;AAClE,UAAI,aAAa;AACjB,eAAS,IAAI,GAAG,IAAI,UAAU,QAAQ,KAAK;AACvC,YAAI,UAAU,CAAC,MAAM,GAAM;AACvB,uBAAa;AACb;AAAA,QACJ;AAAA,MACJ;AACA,YAAM,IAAI,UAAU,MAAM,aAAa,GAAG,aAAa,EAAE;AACzD,YAAM,IAAI,UAAU,MAAM,aAAa,IAAI,aAAa,EAAE;AAC1D,YAAM,SAAS;AAAA,QACX,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,UACD,KAAK;AAAA,UACL,KAAK;AAAA,UACL,GAAG,EAAE,SAAS,WAAW;AAAA,UACzB,GAAG,EAAE,SAAS,WAAW;AAAA,QAC7B;AAAA,MACJ;AACA,YAAM,UAAU;AAAA,QACZ,KAAK,OAAO,WAAW;AAAA,QACvB,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,MACrC;AACA,YAAM,YAAY,OAAO,KAAK,KAAK,UAAU,MAAM,CAAC,EAAE,SAAS,WAAW;AAC1E,YAAM,aAAa,OAAO,KAAK,KAAK,UAAU,OAAO,CAAC,EAAE,SAAS,WAAW;AAC5E,YAAM,UAAU,GAAG,SAAS,IAAI,UAAU;AAC1C,YAAM,gBAAgB,KAAK,UAAU,OAAO,KAAK,OAAO,GAAG,UAAU;AACrE,YAAM,eAAe,KAAK,kBAAkB,aAAa;AACzD,YAAM,eAAe,aAAa,SAAS,WAAW;AACtD,aAAO,GAAG,OAAO,IAAI,YAAY;AAAA,IACrC,SACO,OAAO;AACV,YAAM,IAAI,yBAAyB,kCAAkC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,IAAI,EAAE,QAAQ,KAAK,QAAQ,aAAa,MAAM,CAAC;AAAA,IAC9K;AAAA,EACJ;AACJ;;;ACjQO,IAAM,uBAAuB,CAAC,SAAS,OAAO,EAAE,mBAAmB,IAAI,CAAC,MAAM;AACjF,QAAM,QAAQ,QAAQ,sDAAsD;AAC5E,QAAM,WAAW,MAAM,gBAAgB,QAAQ,CAAC,CAAC;AACjD,QAAM,cAAc,eAAe;AAAA,IAC/B,SAAS,MAAM,WAAW,oBAAoB;AAAA,EAClD,CAAC;AACD,QAAM,UAAU,SAAS,WAAW;AACpC,MAAI,CAAC,SAAS,eAAe;AACzB,UAAM,IAAI,yBAAyB,WAAW,WAAW,oCAAoC;AAAA,MACzF,aAAa;AAAA,MACb,QAAQ,MAAM;AAAA,IAClB,CAAC;AAAA,EACL;AACA,QAAM,UAAU,IAAI,wBAAwB,SAAS,MAAM,kBAAkB;AAC7E,QAAM,cAAc,MAAM,QAAQ,gBAAgB;AAClD,SAAO,qBAAqB,aAAa,qBAAqB,IAAI;AACtE;","names":["requestHandler"]}

package/dist/{dist-es-47I7P7S4.js → dist-es-OHWBFB6Z.js}

@@ -1,6 +1,6 @@
 import {
   setCredentialFeature
-} from "./chunk-QVMXXFG5.js";
+} from "./chunk-ZPTG6NGD.js";
 import {
   CredentialsProviderError,
   TokenProviderError,
@@ -9,8 +9,8 @@ import {
   getSSOTokenFromFile,
   loadSsoSessionData,
   parseKnownFiles
-} from "./chunk-J2GNAAZA.js";
-import "./chunk-UN64BKHA.js";
+} from "./chunk-7WLIHNPO.js";
+import "./chunk-GPJBZ6EG.js";
 
 // ../../node_modules/@aws-sdk/credential-provider-sso/dist-es/isSsoProfile.js
 var isSsoProfile = (arg) => arg && (typeof arg.sso_start_url === "string" || typeof arg.sso_account_id === "string" || typeof arg.sso_session === "string" || typeof arg.sso_region === "string" || typeof arg.sso_role_name === "string");
@@ -21,7 +21,7 @@ var REFRESH_MESSAGE = `To refresh this SSO session run 'aws sso login' with the
 
 // ../../node_modules/@aws-sdk/token-providers/dist-es/getSsoOidcClient.js
 var getSsoOidcClient = async (ssoRegion, init = {}, callerClientConfig) => {
-  const { SSOOIDCClient } = await import("./sso-oidc-JCP5LKPR.js");
+  const { SSOOIDCClient } = await import("./sso-oidc-K2XXESPI.js");
   const coalesce = (prop) => init.clientConfig?.[prop] ?? init.parentClientConfig?.[prop] ?? callerClientConfig?.[prop];
   const ssoOidcClient = new SSOOIDCClient(Object.assign({}, init.clientConfig ?? {}, {
     region: ssoRegion ?? init.clientConfig?.region,
@@ -33,7 +33,7 @@ var getSsoOidcClient = async (ssoRegion, init = {}, callerClientConfig) => {
 
 // ../../node_modules/@aws-sdk/token-providers/dist-es/getNewSsoOidcToken.js
 var getNewSsoOidcToken = async (ssoToken, ssoRegion, init = {}, callerClientConfig) => {
-  const { CreateTokenCommand } = await import("./sso-oidc-JCP5LKPR.js");
+  const { CreateTokenCommand } = await import("./sso-oidc-K2XXESPI.js");
   const ssoOidcClient = await getSsoOidcClient(ssoRegion, init, callerClientConfig);
   return ssoOidcClient.send(new CreateTokenCommand({
     clientId: ssoToken.clientId,
@@ -181,7 +181,7 @@ var resolveSSOCredentials = async ({ ssoStartUrl, ssoSession, ssoAccountId, ssoR
     });
   }
   const { accessToken } = token;
-  const { SSOClient, GetRoleCredentialsCommand } = await import("./loadSso-UZJSAOIR.js");
+  const { SSOClient, GetRoleCredentialsCommand } = await import("./loadSso-OMYS2YH5.js");
   const sso = ssoClient || new SSOClient(Object.assign({}, clientConfig ?? {}, {
     logger: clientConfig?.logger ?? callerClientConfig?.logger ?? parentClientConfig?.logger,
     region: clientConfig?.region ?? ssoRegion,
@@ -314,4 +314,4 @@ export {
   isSsoProfile,
   validateSsoProfile
 };
-//# sourceMappingURL=dist-es-47I7P7S4.js.map
+//# sourceMappingURL=dist-es-OHWBFB6Z.js.map

package/dist/{dist-es-GCAGX4FB.js → dist-es-QDQUKRHU.js}

@@ -1,10 +1,11 @@
 import {
   CredentialsProviderError,
   ProviderError,
-  loadConfig,
+  loadConfig
+} from "./chunk-7WLIHNPO.js";
+import {
   parseUrl
-} from "./chunk-J2GNAAZA.js";
-import "./chunk-UN64BKHA.js";
+} from "./chunk-GPJBZ6EG.js";
 
 // ../../node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/ImdsCredentials.js
 var isImdsCredentials = (arg) => Boolean(arg) && typeof arg === "object" && typeof arg.AccessKeyId === "string" && typeof arg.SecretAccessKey === "string" && typeof arg.Token === "string" && typeof arg.Expiration === "string";
@@ -373,4 +374,4 @@ export {
   httpRequest,
   providerConfigFromInit
 };
-//# sourceMappingURL=dist-es-GCAGX4FB.js.map
+//# sourceMappingURL=dist-es-QDQUKRHU.js.map

package/dist/{dist-es-GCAGX4FB.js.map → dist-es-QDQUKRHU.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../../../node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/ImdsCredentials.js","../../../node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/RemoteProviderInit.js","../../../node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/node-http.js","../../../node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/httpRequest.js","../../../node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/retry.js","../../../node_modules/@smithy/credential-provider-imds/dist-es/fromContainerMetadata.js","../../../node_modules/@smithy/credential-provider-imds/dist-es/error/InstanceMetadataV1FallbackError.js","../../../node_modules/@smithy/credential-provider-imds/dist-es/config/Endpoint.js","../../../node_modules/@smithy/credential-provider-imds/dist-es/config/EndpointConfigOptions.js","../../../node_modules/@smithy/credential-provider-imds/dist-es/config/EndpointMode.js","../../../node_modules/@smithy/credential-provider-imds/dist-es/config/EndpointModeConfigOptions.js","../../../node_modules/@smithy/credential-provider-imds/dist-es/utils/getInstanceMetadataEndpoint.js","../../../node_modules/@smithy/credential-provider-imds/dist-es/utils/getExtendedInstanceMetadataCredentials.js","../../../node_modules/@smithy/credential-provider-imds/dist-es/utils/staticStabilityProvider.js","../../../node_modules/@smithy/credential-provider-imds/dist-es/fromInstanceMetadata.js"],"sourcesContent":["export const isImdsCredentials = (arg) => Boolean(arg) &&\n    typeof arg === \"object\" &&\n    typeof arg.AccessKeyId === \"string\" &&\n    typeof arg.SecretAccessKey === \"string\" &&\n    typeof arg.Token === \"string\" &&\n    typeof arg.Expiration === \"string\";\nexport const fromImdsCredentials = (creds) => ({\n    accessKeyId: creds.AccessKeyId,\n    secretAccessKey: creds.SecretAccessKey,\n    sessionToken: creds.Token,\n    expiration: new Date(creds.Expiration),\n    ...(creds.AccountId && { accountId: creds.AccountId }),\n});\n","export const DEFAULT_TIMEOUT = 1000;\nexport const DEFAULT_MAX_RETRIES = 0;\nexport const providerConfigFromInit = ({ maxRetries = DEFAULT_MAX_RETRIES, timeout = DEFAULT_TIMEOUT, }) => ({ maxRetries, timeout });\n","import node_http from \"node:http\";\nexport { node_http };\n","import { ProviderError } from \"@smithy/core/config\";\nimport { node_http } from \"./node-http\";\nexport function httpRequest(options) {\n    return new Promise((resolve, reject) => {\n        const req = node_http.request({\n            method: \"GET\",\n            ...options,\n            hostname: options.hostname?.replace(/^\\[(.+)\\]$/, \"$1\"),\n        });\n        req.on(\"error\", (err) => {\n            reject(Object.assign(new ProviderError(\"Unable to connect to instance metadata service\"), err));\n            req.destroy();\n        });\n        req.on(\"timeout\", () => {\n            reject(new ProviderError(\"TimeoutError from instance metadata service\"));\n            req.destroy();\n        });\n        req.on(\"response\", (res) => {\n            const { statusCode = 400 } = res;\n            if (statusCode < 200 || 300 <= statusCode) {\n                reject(Object.assign(new ProviderError(\"Error response received from instance metadata service\"), { statusCode }));\n                req.destroy();\n            }\n            const chunks = [];\n            res.on(\"data\", (chunk) => {\n                chunks.push(chunk);\n            });\n            res.on(\"end\", () => {\n                resolve(Buffer.concat(chunks));\n                req.destroy();\n            });\n        });\n        req.end();\n    });\n}\n","export const retry = (toRetry, maxRetries) => {\n    let promise = toRetry();\n    for (let i = 0; i < maxRetries; i++) {\n        promise = promise.catch(toRetry);\n    }\n    return promise;\n};\n","import { CredentialsProviderError } from \"@smithy/core/config\";\nimport { fromImdsCredentials, isImdsCredentials } from \"./remoteProvider/ImdsCredentials\";\nimport { providerConfigFromInit } from \"./remoteProvider/RemoteProviderInit\";\nimport { httpRequest } from \"./remoteProvider/httpRequest\";\nimport { retry } from \"./remoteProvider/retry\";\nexport const ENV_CMDS_FULL_URI = \"AWS_CONTAINER_CREDENTIALS_FULL_URI\";\nexport const ENV_CMDS_RELATIVE_URI = \"AWS_CONTAINER_CREDENTIALS_RELATIVE_URI\";\nexport const ENV_CMDS_AUTH_TOKEN = \"AWS_CONTAINER_AUTHORIZATION_TOKEN\";\nexport const fromContainerMetadata = (init = {}) => {\n    const { timeout, maxRetries } = providerConfigFromInit(init);\n    return () => retry(async () => {\n        const requestOptions = await getCmdsUri({ logger: init.logger });\n        const credsResponse = JSON.parse(await requestFromEcsImds(timeout, requestOptions));\n        if (!isImdsCredentials(credsResponse)) {\n            throw new CredentialsProviderError(\"Invalid response received from instance metadata service.\", {\n                logger: init.logger,\n            });\n        }\n        return fromImdsCredentials(credsResponse);\n    }, maxRetries);\n};\nconst requestFromEcsImds = async (timeout, options) => {\n    if (process.env[ENV_CMDS_AUTH_TOKEN]) {\n        options.headers = {\n            ...options.headers,\n            Authorization: process.env[ENV_CMDS_AUTH_TOKEN],\n        };\n    }\n    const buffer = await httpRequest({\n        ...options,\n        timeout,\n    });\n    return buffer.toString();\n};\nconst CMDS_IP = \"169.254.170.2\";\nconst GREENGRASS_HOSTS = new Set([\"localhost\", \"127.0.0.1\"]);\nconst GREENGRASS_PROTOCOLS = new Set([\"http:\", \"https:\"]);\nconst getCmdsUri = async ({ logger }) => {\n    if (process.env[ENV_CMDS_RELATIVE_URI]) {\n        return {\n            hostname: CMDS_IP,\n            path: process.env[ENV_CMDS_RELATIVE_URI],\n        };\n    }\n    if (process.env[ENV_CMDS_FULL_URI]) {\n        let parsed;\n        try {\n            parsed = new URL(process.env[ENV_CMDS_FULL_URI]);\n        }\n        catch {\n            throw new CredentialsProviderError(`${process.env[ENV_CMDS_FULL_URI]} is not a valid container metadata service URL`, { tryNextLink: false, logger });\n        }\n        if (!parsed.hostname || !GREENGRASS_HOSTS.has(parsed.hostname)) {\n            throw new CredentialsProviderError(`${parsed.hostname} is not a valid container metadata service hostname`, {\n                tryNextLink: false,\n                logger,\n            });\n        }\n        if (!parsed.protocol || !GREENGRASS_PROTOCOLS.has(parsed.protocol)) {\n            throw new CredentialsProviderError(`${parsed.protocol} is not a valid container metadata service protocol`, {\n                tryNextLink: false,\n                logger,\n            });\n        }\n        return {\n            protocol: parsed.protocol,\n            hostname: parsed.hostname,\n            path: parsed.pathname + parsed.search,\n            port: parsed.port ? parseInt(parsed.port, 10) : undefined,\n        };\n    }\n    throw new CredentialsProviderError(\"The container metadata credential provider cannot be used unless\" +\n        ` the ${ENV_CMDS_RELATIVE_URI} or ${ENV_CMDS_FULL_URI} environment` +\n        \" variable is set\", {\n        tryNextLink: false,\n        logger,\n    });\n};\n","import { CredentialsProviderError } from \"@smithy/core/config\";\nexport class InstanceMetadataV1FallbackError extends CredentialsProviderError {\n    tryNextLink;\n    name = \"InstanceMetadataV1FallbackError\";\n    constructor(message, tryNextLink = true) {\n        super(message, tryNextLink);\n        this.tryNextLink = tryNextLink;\n        Object.setPrototypeOf(this, InstanceMetadataV1FallbackError.prototype);\n    }\n}\n","export var Endpoint;\n(function (Endpoint) {\n    Endpoint[\"IPv4\"] = \"http://169.254.169.254\";\n    Endpoint[\"IPv6\"] = \"http://[fd00:ec2::254]\";\n})(Endpoint || (Endpoint = {}));\n","export const ENV_ENDPOINT_NAME = \"AWS_EC2_METADATA_SERVICE_ENDPOINT\";\nexport const CONFIG_ENDPOINT_NAME = \"ec2_metadata_service_endpoint\";\nexport const ENDPOINT_CONFIG_OPTIONS = {\n    environmentVariableSelector: (env) => env[ENV_ENDPOINT_NAME],\n    configFileSelector: (profile) => profile[CONFIG_ENDPOINT_NAME],\n    default: undefined,\n};\n","export var EndpointMode;\n(function (EndpointMode) {\n    EndpointMode[\"IPv4\"] = \"IPv4\";\n    EndpointMode[\"IPv6\"] = \"IPv6\";\n})(EndpointMode || (EndpointMode = {}));\n","import { EndpointMode } from \"./EndpointMode\";\nexport const ENV_ENDPOINT_MODE_NAME = \"AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE\";\nexport const CONFIG_ENDPOINT_MODE_NAME = \"ec2_metadata_service_endpoint_mode\";\nexport const ENDPOINT_MODE_CONFIG_OPTIONS = {\n    environmentVariableSelector: (env) => env[ENV_ENDPOINT_MODE_NAME],\n    configFileSelector: (profile) => profile[CONFIG_ENDPOINT_MODE_NAME],\n    default: EndpointMode.IPv4,\n};\n","import { loadConfig } from \"@smithy/core/config\";\nimport { parseUrl } from \"@smithy/core/protocols\";\nimport { Endpoint as InstanceMetadataEndpoint } from \"../config/Endpoint\";\nimport { ENDPOINT_CONFIG_OPTIONS } from \"../config/EndpointConfigOptions\";\nimport { EndpointMode } from \"../config/EndpointMode\";\nimport { ENDPOINT_MODE_CONFIG_OPTIONS, } from \"../config/EndpointModeConfigOptions\";\nexport const getInstanceMetadataEndpoint = async () => parseUrl((await getFromEndpointConfig()) || (await getFromEndpointModeConfig()));\nconst getFromEndpointConfig = async () => loadConfig(ENDPOINT_CONFIG_OPTIONS)();\nconst getFromEndpointModeConfig = async () => {\n    const endpointMode = await loadConfig(ENDPOINT_MODE_CONFIG_OPTIONS)();\n    switch (endpointMode) {\n        case EndpointMode.IPv4:\n            return InstanceMetadataEndpoint.IPv4;\n        case EndpointMode.IPv6:\n            return InstanceMetadataEndpoint.IPv6;\n        default:\n            throw new Error(`Unsupported endpoint mode: ${endpointMode}.` + ` Select from ${Object.values(EndpointMode)}`);\n    }\n};\n","const STATIC_STABILITY_REFRESH_INTERVAL_SECONDS = 5 * 60;\nconst STATIC_STABILITY_REFRESH_INTERVAL_JITTER_WINDOW_SECONDS = 5 * 60;\nconst STATIC_STABILITY_DOC_URL = \"https://docs.aws.amazon.com/sdkref/latest/guide/feature-static-credentials.html\";\nexport const getExtendedInstanceMetadataCredentials = (credentials, logger) => {\n    const refreshInterval = STATIC_STABILITY_REFRESH_INTERVAL_SECONDS +\n        Math.floor(Math.random() * STATIC_STABILITY_REFRESH_INTERVAL_JITTER_WINDOW_SECONDS);\n    const newExpiration = new Date(Date.now() + refreshInterval * 1000);\n    logger.warn(\"Attempting credential expiration extension due to a credential service availability issue. A refresh of these \" +\n        `credentials will be attempted after ${new Date(newExpiration)}.\\nFor more information, please visit: ` +\n        STATIC_STABILITY_DOC_URL);\n    const originalExpiration = credentials.originalExpiration ?? credentials.expiration;\n    return {\n        ...credentials,\n        ...(originalExpiration ? { originalExpiration } : {}),\n        expiration: newExpiration,\n    };\n};\n","import { getExtendedInstanceMetadataCredentials } from \"./getExtendedInstanceMetadataCredentials\";\nexport const staticStabilityProvider = (provider, options = {}) => {\n    const logger = options?.logger || console;\n    let pastCredentials;\n    return async () => {\n        let credentials;\n        try {\n            credentials = await provider();\n            if (credentials.expiration && credentials.expiration.getTime() < Date.now()) {\n                credentials = getExtendedInstanceMetadataCredentials(credentials, logger);\n            }\n        }\n        catch (e) {\n            if (pastCredentials) {\n                logger.warn(\"Credential renew failed: \", e);\n                credentials = getExtendedInstanceMetadataCredentials(pastCredentials, logger);\n            }\n            else {\n                throw e;\n            }\n        }\n        pastCredentials = credentials;\n        return credentials;\n    };\n};\n","import { CredentialsProviderError, loadConfig } from \"@smithy/core/config\";\nimport { InstanceMetadataV1FallbackError } from \"./error/InstanceMetadataV1FallbackError\";\nimport { fromImdsCredentials, isImdsCredentials } from \"./remoteProvider/ImdsCredentials\";\nimport { providerConfigFromInit } from \"./remoteProvider/RemoteProviderInit\";\nimport { httpRequest } from \"./remoteProvider/httpRequest\";\nimport { retry } from \"./remoteProvider/retry\";\nimport { getInstanceMetadataEndpoint } from \"./utils/getInstanceMetadataEndpoint\";\nimport { staticStabilityProvider } from \"./utils/staticStabilityProvider\";\nconst IMDS_PATH = \"/latest/meta-data/iam/security-credentials/\";\nconst IMDS_TOKEN_PATH = \"/latest/api/token\";\nconst AWS_EC2_METADATA_V1_DISABLED = \"AWS_EC2_METADATA_V1_DISABLED\";\nconst PROFILE_AWS_EC2_METADATA_V1_DISABLED = \"ec2_metadata_v1_disabled\";\nconst X_AWS_EC2_METADATA_TOKEN = \"x-aws-ec2-metadata-token\";\nexport const fromInstanceMetadata = (init = {}) => staticStabilityProvider(getInstanceMetadataProvider(init), { logger: init.logger });\nconst getInstanceMetadataProvider = (init = {}) => {\n    let disableFetchToken = false;\n    const { logger, profile } = init;\n    const { timeout, maxRetries } = providerConfigFromInit(init);\n    const getCredentials = async (maxRetries, options) => {\n        const isImdsV1Fallback = disableFetchToken || options.headers?.[X_AWS_EC2_METADATA_TOKEN] == null;\n        if (isImdsV1Fallback) {\n            let fallbackBlockedFromProfile = false;\n            let fallbackBlockedFromProcessEnv = false;\n            const configValue = await loadConfig({\n                environmentVariableSelector: (env) => {\n                    const envValue = env[AWS_EC2_METADATA_V1_DISABLED];\n                    fallbackBlockedFromProcessEnv = !!envValue && envValue !== \"false\";\n                    if (envValue === undefined) {\n                        throw new CredentialsProviderError(`${AWS_EC2_METADATA_V1_DISABLED} not set in env, checking config file next.`, { logger: init.logger });\n                    }\n                    return fallbackBlockedFromProcessEnv;\n                },\n                configFileSelector: (profile) => {\n                    const profileValue = profile[PROFILE_AWS_EC2_METADATA_V1_DISABLED];\n                    fallbackBlockedFromProfile = !!profileValue && profileValue !== \"false\";\n                    return fallbackBlockedFromProfile;\n                },\n                default: false,\n            }, {\n                profile,\n            })();\n            if (init.ec2MetadataV1Disabled || configValue) {\n                const causes = [];\n                if (init.ec2MetadataV1Disabled)\n                    causes.push(\"credential provider initialization (runtime option ec2MetadataV1Disabled)\");\n                if (fallbackBlockedFromProfile)\n                    causes.push(`config file profile (${PROFILE_AWS_EC2_METADATA_V1_DISABLED})`);\n                if (fallbackBlockedFromProcessEnv)\n                    causes.push(`process environment variable (${AWS_EC2_METADATA_V1_DISABLED})`);\n                throw new InstanceMetadataV1FallbackError(`AWS EC2 Metadata v1 fallback has been blocked by AWS SDK configuration in the following: [${causes.join(\", \")}].`);\n            }\n        }\n        const imdsProfile = (await retry(async () => {\n            let profile;\n            try {\n                profile = await getProfile(options);\n            }\n            catch (err) {\n                if (err.statusCode === 401) {\n                    disableFetchToken = false;\n                }\n                throw err;\n            }\n            return profile;\n        }, maxRetries)).trim();\n        return retry(async () => {\n            let creds;\n            try {\n                creds = await getCredentialsFromProfile(imdsProfile, options, init);\n            }\n            catch (err) {\n                if (err.statusCode === 401) {\n                    disableFetchToken = false;\n                }\n                throw err;\n            }\n            return creds;\n        }, maxRetries);\n    };\n    return async () => {\n        const endpoint = await getInstanceMetadataEndpoint();\n        if (disableFetchToken) {\n            logger?.debug(\"AWS SDK Instance Metadata\", \"using v1 fallback (no token fetch)\");\n            return getCredentials(maxRetries, { ...endpoint, timeout });\n        }\n        else {\n            let token;\n            try {\n                token = (await getMetadataToken({ ...endpoint, timeout })).toString();\n            }\n            catch (error) {\n                if (error?.statusCode === 400) {\n                    throw Object.assign(error, {\n                        message: \"EC2 Metadata token request returned error\",\n                    });\n                }\n                else if (error.message === \"TimeoutError\" || [403, 404, 405].includes(error.statusCode)) {\n                    disableFetchToken = true;\n                }\n                logger?.debug(\"AWS SDK Instance Metadata\", \"using v1 fallback (initial)\");\n                return getCredentials(maxRetries, { ...endpoint, timeout });\n            }\n            return getCredentials(maxRetries, {\n                ...endpoint,\n                headers: {\n                    [X_AWS_EC2_METADATA_TOKEN]: token,\n                },\n                timeout,\n            });\n        }\n    };\n};\nconst getMetadataToken = async (options) => httpRequest({\n    ...options,\n    path: IMDS_TOKEN_PATH,\n    method: \"PUT\",\n    headers: {\n        \"x-aws-ec2-metadata-token-ttl-seconds\": \"21600\",\n    },\n});\nconst getProfile = async (options) => (await httpRequest({ ...options, path: IMDS_PATH })).toString();\nconst getCredentialsFromProfile = async (profile, options, init) => {\n    const credentialsResponse = JSON.parse((await httpRequest({\n        ...options,\n        path: IMDS_PATH + profile,\n    })).toString());\n    if (!isImdsCredentials(credentialsResponse)) {\n        throw new CredentialsProviderError(\"Invalid response received from instance metadata service.\", {\n            logger: init.logger,\n        });\n    }\n    return fromImdsCredentials(credentialsResponse);\n};\n"],"mappings":";;;;;;;;;AAAO,IAAM,oBAAoB,CAAC,QAAQ,QAAQ,GAAG,KACjD,OAAO,QAAQ,YACf,OAAO,IAAI,gBAAgB,YAC3B,OAAO,IAAI,oBAAoB,YAC/B,OAAO,IAAI,UAAU,YACrB,OAAO,IAAI,eAAe;AACvB,IAAM,sBAAsB,CAAC,WAAW;AAAA,EAC3C,aAAa,MAAM;AAAA,EACnB,iBAAiB,MAAM;AAAA,EACvB,cAAc,MAAM;AAAA,EACpB,YAAY,IAAI,KAAK,MAAM,UAAU;AAAA,EACrC,GAAI,MAAM,aAAa,EAAE,WAAW,MAAM,UAAU;AACxD;;;ACZO,IAAM,kBAAkB;AACxB,IAAM,sBAAsB;AAC5B,IAAM,yBAAyB,CAAC,EAAE,aAAa,qBAAqB,UAAU,gBAAiB,OAAO,EAAE,YAAY,QAAQ;;;ACFnI,OAAO,eAAe;;;ACEf,SAAS,YAAY,SAAS;AACjC,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACpC,UAAM,MAAM,UAAU,QAAQ;AAAA,MAC1B,QAAQ;AAAA,MACR,GAAG;AAAA,MACH,UAAU,QAAQ,UAAU,QAAQ,cAAc,IAAI;AAAA,IAC1D,CAAC;AACD,QAAI,GAAG,SAAS,CAAC,QAAQ;AACrB,aAAO,OAAO,OAAO,IAAI,cAAc,gDAAgD,GAAG,GAAG,CAAC;AAC9F,UAAI,QAAQ;AAAA,IAChB,CAAC;AACD,QAAI,GAAG,WAAW,MAAM;AACpB,aAAO,IAAI,cAAc,6CAA6C,CAAC;AACvE,UAAI,QAAQ;AAAA,IAChB,CAAC;AACD,QAAI,GAAG,YAAY,CAAC,QAAQ;AACxB,YAAM,EAAE,aAAa,IAAI,IAAI;AAC7B,UAAI,aAAa,OAAO,OAAO,YAAY;AACvC,eAAO,OAAO,OAAO,IAAI,cAAc,wDAAwD,GAAG,EAAE,WAAW,CAAC,CAAC;AACjH,YAAI,QAAQ;AAAA,MAChB;AACA,YAAM,SAAS,CAAC;AAChB,UAAI,GAAG,QAAQ,CAAC,UAAU;AACtB,eAAO,KAAK,KAAK;AAAA,MACrB,CAAC;AACD,UAAI,GAAG,OAAO,MAAM;AAChB,gBAAQ,OAAO,OAAO,MAAM,CAAC;AAC7B,YAAI,QAAQ;AAAA,MAChB,CAAC;AAAA,IACL,CAAC;AACD,QAAI,IAAI;AAAA,EACZ,CAAC;AACL;;;AClCO,IAAM,QAAQ,CAAC,SAAS,eAAe;AAC1C,MAAI,UAAU,QAAQ;AACtB,WAAS,IAAI,GAAG,IAAI,YAAY,KAAK;AACjC,cAAU,QAAQ,MAAM,OAAO;AAAA,EACnC;AACA,SAAO;AACX;;;ACDO,IAAM,oBAAoB;AAC1B,IAAM,wBAAwB;AAC9B,IAAM,sBAAsB;AAC5B,IAAM,wBAAwB,CAAC,OAAO,CAAC,MAAM;AAChD,QAAM,EAAE,SAAS,WAAW,IAAI,uBAAuB,IAAI;AAC3D,SAAO,MAAM,MAAM,YAAY;AAC3B,UAAM,iBAAiB,MAAM,WAAW,EAAE,QAAQ,KAAK,OAAO,CAAC;AAC/D,UAAM,gBAAgB,KAAK,MAAM,MAAM,mBAAmB,SAAS,cAAc,CAAC;AAClF,QAAI,CAAC,kBAAkB,aAAa,GAAG;AACnC,YAAM,IAAI,yBAAyB,6DAA6D;AAAA,QAC5F,QAAQ,KAAK;AAAA,MACjB,CAAC;AAAA,IACL;AACA,WAAO,oBAAoB,aAAa;AAAA,EAC5C,GAAG,UAAU;AACjB;AACA,IAAM,qBAAqB,OAAO,SAAS,YAAY;AACnD,MAAI,QAAQ,IAAI,mBAAmB,GAAG;AAClC,YAAQ,UAAU;AAAA,MACd,GAAG,QAAQ;AAAA,MACX,eAAe,QAAQ,IAAI,mBAAmB;AAAA,IAClD;AAAA,EACJ;AACA,QAAM,SAAS,MAAM,YAAY;AAAA,IAC7B,GAAG;AAAA,IACH;AAAA,EACJ,CAAC;AACD,SAAO,OAAO,SAAS;AAC3B;AACA,IAAM,UAAU;AAChB,IAAM,mBAAmB,oBAAI,IAAI,CAAC,aAAa,WAAW,CAAC;AAC3D,IAAM,uBAAuB,oBAAI,IAAI,CAAC,SAAS,QAAQ,CAAC;AACxD,IAAM,aAAa,OAAO,EAAE,OAAO,MAAM;AACrC,MAAI,QAAQ,IAAI,qBAAqB,GAAG;AACpC,WAAO;AAAA,MACH,UAAU;AAAA,MACV,MAAM,QAAQ,IAAI,qBAAqB;AAAA,IAC3C;AAAA,EACJ;AACA,MAAI,QAAQ,IAAI,iBAAiB,GAAG;AAChC,QAAI;AACJ,QAAI;AACA,eAAS,IAAI,IAAI,QAAQ,IAAI,iBAAiB,CAAC;AAAA,IACnD,QACM;AACF,YAAM,IAAI,yBAAyB,GAAG,QAAQ,IAAI,iBAAiB,CAAC,kDAAkD,EAAE,aAAa,OAAO,OAAO,CAAC;AAAA,IACxJ;AACA,QAAI,CAAC,OAAO,YAAY,CAAC,iBAAiB,IAAI,OAAO,QAAQ,GAAG;AAC5D,YAAM,IAAI,yBAAyB,GAAG,OAAO,QAAQ,uDAAuD;AAAA,QACxG,aAAa;AAAA,QACb;AAAA,MACJ,CAAC;AAAA,IACL;AACA,QAAI,CAAC,OAAO,YAAY,CAAC,qBAAqB,IAAI,OAAO,QAAQ,GAAG;AAChE,YAAM,IAAI,yBAAyB,GAAG,OAAO,QAAQ,uDAAuD;AAAA,QACxG,aAAa;AAAA,QACb;AAAA,MACJ,CAAC;AAAA,IACL;AACA,WAAO;AAAA,MACH,UAAU,OAAO;AAAA,MACjB,UAAU,OAAO;AAAA,MACjB,MAAM,OAAO,WAAW,OAAO;AAAA,MAC/B,MAAM,OAAO,OAAO,SAAS,OAAO,MAAM,EAAE,IAAI;AAAA,IACpD;AAAA,EACJ;AACA,QAAM,IAAI,yBAAyB,wEACvB,qBAAqB,OAAO,iBAAiB,gCACjC;AAAA,IACpB,aAAa;AAAA,IACb;AAAA,EACJ,CAAC;AACL;;;AC5EO,IAAM,kCAAN,MAAM,yCAAwC,yBAAyB;AAAA,EAC1E;AAAA,EACA,OAAO;AAAA,EACP,YAAY,SAAS,cAAc,MAAM;AACrC,UAAM,SAAS,WAAW;AAC1B,SAAK,cAAc;AACnB,WAAO,eAAe,MAAM,iCAAgC,SAAS;AAAA,EACzE;AACJ;;;ACTO,IAAI;AAAA,CACV,SAAUA,WAAU;AACjB,EAAAA,UAAS,MAAM,IAAI;AACnB,EAAAA,UAAS,MAAM,IAAI;AACvB,GAAG,aAAa,WAAW,CAAC,EAAE;;;ACJvB,IAAM,oBAAoB;AAC1B,IAAM,uBAAuB;AAC7B,IAAM,0BAA0B;AAAA,EACnC,6BAA6B,CAAC,QAAQ,IAAI,iBAAiB;AAAA,EAC3D,oBAAoB,CAAC,YAAY,QAAQ,oBAAoB;AAAA,EAC7D,SAAS;AACb;;;ACNO,IAAI;AAAA,CACV,SAAUC,eAAc;AACrB,EAAAA,cAAa,MAAM,IAAI;AACvB,EAAAA,cAAa,MAAM,IAAI;AAC3B,GAAG,iBAAiB,eAAe,CAAC,EAAE;;;ACH/B,IAAM,yBAAyB;AAC/B,IAAM,4BAA4B;AAClC,IAAM,+BAA+B;AAAA,EACxC,6BAA6B,CAAC,QAAQ,IAAI,sBAAsB;AAAA,EAChE,oBAAoB,CAAC,YAAY,QAAQ,yBAAyB;AAAA,EAClE,SAAS,aAAa;AAC1B;;;ACDO,IAAM,8BAA8B,YAAY,SAAU,MAAM,sBAAsB,KAAO,MAAM,0BAA0B,CAAE;AACtI,IAAM,wBAAwB,YAAY,WAAW,uBAAuB,EAAE;AAC9E,IAAM,4BAA4B,YAAY;AAC1C,QAAM,eAAe,MAAM,WAAW,4BAA4B,EAAE;AACpE,UAAQ,cAAc;AAAA,IAClB,KAAK,aAAa;AACd,aAAO,SAAyB;AAAA,IACpC,KAAK,aAAa;AACd,aAAO,SAAyB;AAAA,IACpC;AACI,YAAM,IAAI,MAAM,8BAA8B,YAAY,iBAAsB,OAAO,OAAO,YAAY,CAAC,EAAE;AAAA,EACrH;AACJ;;;AClBA,IAAM,4CAA4C,IAAI;AACtD,IAAM,0DAA0D,IAAI;AACpE,IAAM,2BAA2B;AAC1B,IAAM,yCAAyC,CAAC,aAAa,WAAW;AAC3E,QAAM,kBAAkB,4CACpB,KAAK,MAAM,KAAK,OAAO,IAAI,uDAAuD;AACtF,QAAM,gBAAgB,IAAI,KAAK,KAAK,IAAI,IAAI,kBAAkB,GAAI;AAClE,SAAO,KAAK,qJAC+B,IAAI,KAAK,aAAa,CAAC;AAAA,wCAC9D,wBAAwB;AAC5B,QAAM,qBAAqB,YAAY,sBAAsB,YAAY;AACzE,SAAO;AAAA,IACH,GAAG;AAAA,IACH,GAAI,qBAAqB,EAAE,mBAAmB,IAAI,CAAC;AAAA,IACnD,YAAY;AAAA,EAChB;AACJ;;;ACfO,IAAM,0BAA0B,CAAC,UAAU,UAAU,CAAC,MAAM;AAC/D,QAAM,SAAS,SAAS,UAAU;AAClC,MAAI;AACJ,SAAO,YAAY;AACf,QAAI;AACJ,QAAI;AACA,oBAAc,MAAM,SAAS;AAC7B,UAAI,YAAY,cAAc,YAAY,WAAW,QAAQ,IAAI,KAAK,IAAI,GAAG;AACzE,sBAAc,uCAAuC,aAAa,MAAM;AAAA,MAC5E;AAAA,IACJ,SACO,GAAG;AACN,UAAI,iBAAiB;AACjB,eAAO,KAAK,6BAA6B,CAAC;AAC1C,sBAAc,uCAAuC,iBAAiB,MAAM;AAAA,MAChF,OACK;AACD,cAAM;AAAA,MACV;AAAA,IACJ;AACA,sBAAkB;AAClB,WAAO;AAAA,EACX;AACJ;;;AChBA,IAAM,YAAY;AAClB,IAAM,kBAAkB;AACxB,IAAM,+BAA+B;AACrC,IAAM,uCAAuC;AAC7C,IAAM,2BAA2B;AAC1B,IAAM,uBAAuB,CAAC,OAAO,CAAC,MAAM,wBAAwB,4BAA4B,IAAI,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC;AACrI,IAAM,8BAA8B,CAAC,OAAO,CAAC,MAAM;AAC/C,MAAI,oBAAoB;AACxB,QAAM,EAAE,QAAQ,QAAQ,IAAI;AAC5B,QAAM,EAAE,SAAS,WAAW,IAAI,uBAAuB,IAAI;AAC3D,QAAM,iBAAiB,OAAOC,aAAY,YAAY;AAClD,UAAM,mBAAmB,qBAAqB,QAAQ,UAAU,wBAAwB,KAAK;AAC7F,QAAI,kBAAkB;AAClB,UAAI,6BAA6B;AACjC,UAAI,gCAAgC;AACpC,YAAM,cAAc,MAAM,WAAW;AAAA,QACjC,6BAA6B,CAAC,QAAQ;AAClC,gBAAM,WAAW,IAAI,4BAA4B;AACjD,0CAAgC,CAAC,CAAC,YAAY,aAAa;AAC3D,cAAI,aAAa,QAAW;AACxB,kBAAM,IAAI,yBAAyB,GAAG,4BAA4B,+CAA+C,EAAE,QAAQ,KAAK,OAAO,CAAC;AAAA,UAC5I;AACA,iBAAO;AAAA,QACX;AAAA,QACA,oBAAoB,CAACC,aAAY;AAC7B,gBAAM,eAAeA,SAAQ,oCAAoC;AACjE,uCAA6B,CAAC,CAAC,gBAAgB,iBAAiB;AAChE,iBAAO;AAAA,QACX;AAAA,QACA,SAAS;AAAA,MACb,GAAG;AAAA,QACC;AAAA,MACJ,CAAC,EAAE;AACH,UAAI,KAAK,yBAAyB,aAAa;AAC3C,cAAM,SAAS,CAAC;AAChB,YAAI,KAAK;AACL,iBAAO,KAAK,2EAA2E;AAC3F,YAAI;AACA,iBAAO,KAAK,wBAAwB,oCAAoC,GAAG;AAC/E,YAAI;AACA,iBAAO,KAAK,iCAAiC,4BAA4B,GAAG;AAChF,cAAM,IAAI,gCAAgC,6FAA6F,OAAO,KAAK,IAAI,CAAC,IAAI;AAAA,MAChK;AAAA,IACJ;AACA,UAAM,eAAe,MAAM,MAAM,YAAY;AACzC,UAAIA;AACJ,UAAI;AACA,QAAAA,WAAU,MAAM,WAAW,OAAO;AAAA,MACtC,SACO,KAAK;AACR,YAAI,IAAI,eAAe,KAAK;AACxB,8BAAoB;AAAA,QACxB;AACA,cAAM;AAAA,MACV;AACA,aAAOA;AAAA,IACX,GAAGD,WAAU,GAAG,KAAK;AACrB,WAAO,MAAM,YAAY;AACrB,UAAI;AACJ,UAAI;AACA,gBAAQ,MAAM,0BAA0B,aAAa,SAAS,IAAI;AAAA,MACtE,SACO,KAAK;AACR,YAAI,IAAI,eAAe,KAAK;AACxB,8BAAoB;AAAA,QACxB;AACA,cAAM;AAAA,MACV;AACA,aAAO;AAAA,IACX,GAAGA,WAAU;AAAA,EACjB;AACA,SAAO,YAAY;AACf,UAAM,WAAW,MAAM,4BAA4B;AACnD,QAAI,mBAAmB;AACnB,cAAQ,MAAM,6BAA6B,oCAAoC;AAC/E,aAAO,eAAe,YAAY,EAAE,GAAG,UAAU,QAAQ,CAAC;AAAA,IAC9D,OACK;AACD,UAAI;AACJ,UAAI;AACA,iBAAS,MAAM,iBAAiB,EAAE,GAAG,UAAU,QAAQ,CAAC,GAAG,SAAS;AAAA,MACxE,SACO,OAAO;AACV,YAAI,OAAO,eAAe,KAAK;AAC3B,gBAAM,OAAO,OAAO,OAAO;AAAA,YACvB,SAAS;AAAA,UACb,CAAC;AAAA,QACL,WACS,MAAM,YAAY,kBAAkB,CAAC,KAAK,KAAK,GAAG,EAAE,SAAS,MAAM,UAAU,GAAG;AACrF,8BAAoB;AAAA,QACxB;AACA,gBAAQ,MAAM,6BAA6B,6BAA6B;AACxE,eAAO,eAAe,YAAY,EAAE,GAAG,UAAU,QAAQ,CAAC;AAAA,MAC9D;AACA,aAAO,eAAe,YAAY;AAAA,QAC9B,GAAG;AAAA,QACH,SAAS;AAAA,UACL,CAAC,wBAAwB,GAAG;AAAA,QAChC;AAAA,QACA;AAAA,MACJ,CAAC;AAAA,IACL;AAAA,EACJ;AACJ;AACA,IAAM,mBAAmB,OAAO,YAAY,YAAY;AAAA,EACpD,GAAG;AAAA,EACH,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,SAAS;AAAA,IACL,wCAAwC;AAAA,EAC5C;AACJ,CAAC;AACD,IAAM,aAAa,OAAO,aAAa,MAAM,YAAY,EAAE,GAAG,SAAS,MAAM,UAAU,CAAC,GAAG,SAAS;AACpG,IAAM,4BAA4B,OAAO,SAAS,SAAS,SAAS;AAChE,QAAM,sBAAsB,KAAK,OAAO,MAAM,YAAY;AAAA,IACtD,GAAG;AAAA,IACH,MAAM,YAAY;AAAA,EACtB,CAAC,GAAG,SAAS,CAAC;AACd,MAAI,CAAC,kBAAkB,mBAAmB,GAAG;AACzC,UAAM,IAAI,yBAAyB,6DAA6D;AAAA,MAC5F,QAAQ,KAAK;AAAA,IACjB,CAAC;AAAA,EACL;AACA,SAAO,oBAAoB,mBAAmB;AAClD;","names":["Endpoint","EndpointMode","maxRetries","profile"]}
+{"version":3,"sources":["../../../node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/ImdsCredentials.js","../../../node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/RemoteProviderInit.js","../../../node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/node-http.js","../../../node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/httpRequest.js","../../../node_modules/@smithy/credential-provider-imds/dist-es/remoteProvider/retry.js","../../../node_modules/@smithy/credential-provider-imds/dist-es/fromContainerMetadata.js","../../../node_modules/@smithy/credential-provider-imds/dist-es/error/InstanceMetadataV1FallbackError.js","../../../node_modules/@smithy/credential-provider-imds/dist-es/config/Endpoint.js","../../../node_modules/@smithy/credential-provider-imds/dist-es/config/EndpointConfigOptions.js","../../../node_modules/@smithy/credential-provider-imds/dist-es/config/EndpointMode.js","../../../node_modules/@smithy/credential-provider-imds/dist-es/config/EndpointModeConfigOptions.js","../../../node_modules/@smithy/credential-provider-imds/dist-es/utils/getInstanceMetadataEndpoint.js","../../../node_modules/@smithy/credential-provider-imds/dist-es/utils/getExtendedInstanceMetadataCredentials.js","../../../node_modules/@smithy/credential-provider-imds/dist-es/utils/staticStabilityProvider.js","../../../node_modules/@smithy/credential-provider-imds/dist-es/fromInstanceMetadata.js"],"sourcesContent":["export const isImdsCredentials = (arg) => Boolean(arg) &&\n    typeof arg === \"object\" &&\n    typeof arg.AccessKeyId === \"string\" &&\n    typeof arg.SecretAccessKey === \"string\" &&\n    typeof arg.Token === \"string\" &&\n    typeof arg.Expiration === \"string\";\nexport const fromImdsCredentials = (creds) => ({\n    accessKeyId: creds.AccessKeyId,\n    secretAccessKey: creds.SecretAccessKey,\n    sessionToken: creds.Token,\n    expiration: new Date(creds.Expiration),\n    ...(creds.AccountId && { accountId: creds.AccountId }),\n});\n","export const DEFAULT_TIMEOUT = 1000;\nexport const DEFAULT_MAX_RETRIES = 0;\nexport const providerConfigFromInit = ({ maxRetries = DEFAULT_MAX_RETRIES, timeout = DEFAULT_TIMEOUT, }) => ({ maxRetries, timeout });\n","import node_http from \"node:http\";\nexport { node_http };\n","import { ProviderError } from \"@smithy/core/config\";\nimport { node_http } from \"./node-http\";\nexport function httpRequest(options) {\n    return new Promise((resolve, reject) => {\n        const req = node_http.request({\n            method: \"GET\",\n            ...options,\n            hostname: options.hostname?.replace(/^\\[(.+)\\]$/, \"$1\"),\n        });\n        req.on(\"error\", (err) => {\n            reject(Object.assign(new ProviderError(\"Unable to connect to instance metadata service\"), err));\n            req.destroy();\n        });\n        req.on(\"timeout\", () => {\n            reject(new ProviderError(\"TimeoutError from instance metadata service\"));\n            req.destroy();\n        });\n        req.on(\"response\", (res) => {\n            const { statusCode = 400 } = res;\n            if (statusCode < 200 || 300 <= statusCode) {\n                reject(Object.assign(new ProviderError(\"Error response received from instance metadata service\"), { statusCode }));\n                req.destroy();\n            }\n            const chunks = [];\n            res.on(\"data\", (chunk) => {\n                chunks.push(chunk);\n            });\n            res.on(\"end\", () => {\n                resolve(Buffer.concat(chunks));\n                req.destroy();\n            });\n        });\n        req.end();\n    });\n}\n","export const retry = (toRetry, maxRetries) => {\n    let promise = toRetry();\n    for (let i = 0; i < maxRetries; i++) {\n        promise = promise.catch(toRetry);\n    }\n    return promise;\n};\n","import { CredentialsProviderError } from \"@smithy/core/config\";\nimport { fromImdsCredentials, isImdsCredentials } from \"./remoteProvider/ImdsCredentials\";\nimport { providerConfigFromInit } from \"./remoteProvider/RemoteProviderInit\";\nimport { httpRequest } from \"./remoteProvider/httpRequest\";\nimport { retry } from \"./remoteProvider/retry\";\nexport const ENV_CMDS_FULL_URI = \"AWS_CONTAINER_CREDENTIALS_FULL_URI\";\nexport const ENV_CMDS_RELATIVE_URI = \"AWS_CONTAINER_CREDENTIALS_RELATIVE_URI\";\nexport const ENV_CMDS_AUTH_TOKEN = \"AWS_CONTAINER_AUTHORIZATION_TOKEN\";\nexport const fromContainerMetadata = (init = {}) => {\n    const { timeout, maxRetries } = providerConfigFromInit(init);\n    return () => retry(async () => {\n        const requestOptions = await getCmdsUri({ logger: init.logger });\n        const credsResponse = JSON.parse(await requestFromEcsImds(timeout, requestOptions));\n        if (!isImdsCredentials(credsResponse)) {\n            throw new CredentialsProviderError(\"Invalid response received from instance metadata service.\", {\n                logger: init.logger,\n            });\n        }\n        return fromImdsCredentials(credsResponse);\n    }, maxRetries);\n};\nconst requestFromEcsImds = async (timeout, options) => {\n    if (process.env[ENV_CMDS_AUTH_TOKEN]) {\n        options.headers = {\n            ...options.headers,\n            Authorization: process.env[ENV_CMDS_AUTH_TOKEN],\n        };\n    }\n    const buffer = await httpRequest({\n        ...options,\n        timeout,\n    });\n    return buffer.toString();\n};\nconst CMDS_IP = \"169.254.170.2\";\nconst GREENGRASS_HOSTS = new Set([\"localhost\", \"127.0.0.1\"]);\nconst GREENGRASS_PROTOCOLS = new Set([\"http:\", \"https:\"]);\nconst getCmdsUri = async ({ logger }) => {\n    if (process.env[ENV_CMDS_RELATIVE_URI]) {\n        return {\n            hostname: CMDS_IP,\n            path: process.env[ENV_CMDS_RELATIVE_URI],\n        };\n    }\n    if (process.env[ENV_CMDS_FULL_URI]) {\n        let parsed;\n        try {\n            parsed = new URL(process.env[ENV_CMDS_FULL_URI]);\n        }\n        catch {\n            throw new CredentialsProviderError(`${process.env[ENV_CMDS_FULL_URI]} is not a valid container metadata service URL`, { tryNextLink: false, logger });\n        }\n        if (!parsed.hostname || !GREENGRASS_HOSTS.has(parsed.hostname)) {\n            throw new CredentialsProviderError(`${parsed.hostname} is not a valid container metadata service hostname`, {\n                tryNextLink: false,\n                logger,\n            });\n        }\n        if (!parsed.protocol || !GREENGRASS_PROTOCOLS.has(parsed.protocol)) {\n            throw new CredentialsProviderError(`${parsed.protocol} is not a valid container metadata service protocol`, {\n                tryNextLink: false,\n                logger,\n            });\n        }\n        return {\n            protocol: parsed.protocol,\n            hostname: parsed.hostname,\n            path: parsed.pathname + parsed.search,\n            port: parsed.port ? parseInt(parsed.port, 10) : undefined,\n        };\n    }\n    throw new CredentialsProviderError(\"The container metadata credential provider cannot be used unless\" +\n        ` the ${ENV_CMDS_RELATIVE_URI} or ${ENV_CMDS_FULL_URI} environment` +\n        \" variable is set\", {\n        tryNextLink: false,\n        logger,\n    });\n};\n","import { CredentialsProviderError } from \"@smithy/core/config\";\nexport class InstanceMetadataV1FallbackError extends CredentialsProviderError {\n    tryNextLink;\n    name = \"InstanceMetadataV1FallbackError\";\n    constructor(message, tryNextLink = true) {\n        super(message, tryNextLink);\n        this.tryNextLink = tryNextLink;\n        Object.setPrototypeOf(this, InstanceMetadataV1FallbackError.prototype);\n    }\n}\n","export var Endpoint;\n(function (Endpoint) {\n    Endpoint[\"IPv4\"] = \"http://169.254.169.254\";\n    Endpoint[\"IPv6\"] = \"http://[fd00:ec2::254]\";\n})(Endpoint || (Endpoint = {}));\n","export const ENV_ENDPOINT_NAME = \"AWS_EC2_METADATA_SERVICE_ENDPOINT\";\nexport const CONFIG_ENDPOINT_NAME = \"ec2_metadata_service_endpoint\";\nexport const ENDPOINT_CONFIG_OPTIONS = {\n    environmentVariableSelector: (env) => env[ENV_ENDPOINT_NAME],\n    configFileSelector: (profile) => profile[CONFIG_ENDPOINT_NAME],\n    default: undefined,\n};\n","export var EndpointMode;\n(function (EndpointMode) {\n    EndpointMode[\"IPv4\"] = \"IPv4\";\n    EndpointMode[\"IPv6\"] = \"IPv6\";\n})(EndpointMode || (EndpointMode = {}));\n","import { EndpointMode } from \"./EndpointMode\";\nexport const ENV_ENDPOINT_MODE_NAME = \"AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE\";\nexport const CONFIG_ENDPOINT_MODE_NAME = \"ec2_metadata_service_endpoint_mode\";\nexport const ENDPOINT_MODE_CONFIG_OPTIONS = {\n    environmentVariableSelector: (env) => env[ENV_ENDPOINT_MODE_NAME],\n    configFileSelector: (profile) => profile[CONFIG_ENDPOINT_MODE_NAME],\n    default: EndpointMode.IPv4,\n};\n","import { loadConfig } from \"@smithy/core/config\";\nimport { parseUrl } from \"@smithy/core/protocols\";\nimport { Endpoint as InstanceMetadataEndpoint } from \"../config/Endpoint\";\nimport { ENDPOINT_CONFIG_OPTIONS } from \"../config/EndpointConfigOptions\";\nimport { EndpointMode } from \"../config/EndpointMode\";\nimport { ENDPOINT_MODE_CONFIG_OPTIONS, } from \"../config/EndpointModeConfigOptions\";\nexport const getInstanceMetadataEndpoint = async () => parseUrl((await getFromEndpointConfig()) || (await getFromEndpointModeConfig()));\nconst getFromEndpointConfig = async () => loadConfig(ENDPOINT_CONFIG_OPTIONS)();\nconst getFromEndpointModeConfig = async () => {\n    const endpointMode = await loadConfig(ENDPOINT_MODE_CONFIG_OPTIONS)();\n    switch (endpointMode) {\n        case EndpointMode.IPv4:\n            return InstanceMetadataEndpoint.IPv4;\n        case EndpointMode.IPv6:\n            return InstanceMetadataEndpoint.IPv6;\n        default:\n            throw new Error(`Unsupported endpoint mode: ${endpointMode}.` + ` Select from ${Object.values(EndpointMode)}`);\n    }\n};\n","const STATIC_STABILITY_REFRESH_INTERVAL_SECONDS = 5 * 60;\nconst STATIC_STABILITY_REFRESH_INTERVAL_JITTER_WINDOW_SECONDS = 5 * 60;\nconst STATIC_STABILITY_DOC_URL = \"https://docs.aws.amazon.com/sdkref/latest/guide/feature-static-credentials.html\";\nexport const getExtendedInstanceMetadataCredentials = (credentials, logger) => {\n    const refreshInterval = STATIC_STABILITY_REFRESH_INTERVAL_SECONDS +\n        Math.floor(Math.random() * STATIC_STABILITY_REFRESH_INTERVAL_JITTER_WINDOW_SECONDS);\n    const newExpiration = new Date(Date.now() + refreshInterval * 1000);\n    logger.warn(\"Attempting credential expiration extension due to a credential service availability issue. A refresh of these \" +\n        `credentials will be attempted after ${new Date(newExpiration)}.\\nFor more information, please visit: ` +\n        STATIC_STABILITY_DOC_URL);\n    const originalExpiration = credentials.originalExpiration ?? credentials.expiration;\n    return {\n        ...credentials,\n        ...(originalExpiration ? { originalExpiration } : {}),\n        expiration: newExpiration,\n    };\n};\n","import { getExtendedInstanceMetadataCredentials } from \"./getExtendedInstanceMetadataCredentials\";\nexport const staticStabilityProvider = (provider, options = {}) => {\n    const logger = options?.logger || console;\n    let pastCredentials;\n    return async () => {\n        let credentials;\n        try {\n            credentials = await provider();\n            if (credentials.expiration && credentials.expiration.getTime() < Date.now()) {\n                credentials = getExtendedInstanceMetadataCredentials(credentials, logger);\n            }\n        }\n        catch (e) {\n            if (pastCredentials) {\n                logger.warn(\"Credential renew failed: \", e);\n                credentials = getExtendedInstanceMetadataCredentials(pastCredentials, logger);\n            }\n            else {\n                throw e;\n            }\n        }\n        pastCredentials = credentials;\n        return credentials;\n    };\n};\n","import { CredentialsProviderError, loadConfig } from \"@smithy/core/config\";\nimport { InstanceMetadataV1FallbackError } from \"./error/InstanceMetadataV1FallbackError\";\nimport { fromImdsCredentials, isImdsCredentials } from \"./remoteProvider/ImdsCredentials\";\nimport { providerConfigFromInit } from \"./remoteProvider/RemoteProviderInit\";\nimport { httpRequest } from \"./remoteProvider/httpRequest\";\nimport { retry } from \"./remoteProvider/retry\";\nimport { getInstanceMetadataEndpoint } from \"./utils/getInstanceMetadataEndpoint\";\nimport { staticStabilityProvider } from \"./utils/staticStabilityProvider\";\nconst IMDS_PATH = \"/latest/meta-data/iam/security-credentials/\";\nconst IMDS_TOKEN_PATH = \"/latest/api/token\";\nconst AWS_EC2_METADATA_V1_DISABLED = \"AWS_EC2_METADATA_V1_DISABLED\";\nconst PROFILE_AWS_EC2_METADATA_V1_DISABLED = \"ec2_metadata_v1_disabled\";\nconst X_AWS_EC2_METADATA_TOKEN = \"x-aws-ec2-metadata-token\";\nexport const fromInstanceMetadata = (init = {}) => staticStabilityProvider(getInstanceMetadataProvider(init), { logger: init.logger });\nconst getInstanceMetadataProvider = (init = {}) => {\n    let disableFetchToken = false;\n    const { logger, profile } = init;\n    const { timeout, maxRetries } = providerConfigFromInit(init);\n    const getCredentials = async (maxRetries, options) => {\n        const isImdsV1Fallback = disableFetchToken || options.headers?.[X_AWS_EC2_METADATA_TOKEN] == null;\n        if (isImdsV1Fallback) {\n            let fallbackBlockedFromProfile = false;\n            let fallbackBlockedFromProcessEnv = false;\n            const configValue = await loadConfig({\n                environmentVariableSelector: (env) => {\n                    const envValue = env[AWS_EC2_METADATA_V1_DISABLED];\n                    fallbackBlockedFromProcessEnv = !!envValue && envValue !== \"false\";\n                    if (envValue === undefined) {\n                        throw new CredentialsProviderError(`${AWS_EC2_METADATA_V1_DISABLED} not set in env, checking config file next.`, { logger: init.logger });\n                    }\n                    return fallbackBlockedFromProcessEnv;\n                },\n                configFileSelector: (profile) => {\n                    const profileValue = profile[PROFILE_AWS_EC2_METADATA_V1_DISABLED];\n                    fallbackBlockedFromProfile = !!profileValue && profileValue !== \"false\";\n                    return fallbackBlockedFromProfile;\n                },\n                default: false,\n            }, {\n                profile,\n            })();\n            if (init.ec2MetadataV1Disabled || configValue) {\n                const causes = [];\n                if (init.ec2MetadataV1Disabled)\n                    causes.push(\"credential provider initialization (runtime option ec2MetadataV1Disabled)\");\n                if (fallbackBlockedFromProfile)\n                    causes.push(`config file profile (${PROFILE_AWS_EC2_METADATA_V1_DISABLED})`);\n                if (fallbackBlockedFromProcessEnv)\n                    causes.push(`process environment variable (${AWS_EC2_METADATA_V1_DISABLED})`);\n                throw new InstanceMetadataV1FallbackError(`AWS EC2 Metadata v1 fallback has been blocked by AWS SDK configuration in the following: [${causes.join(\", \")}].`);\n            }\n        }\n        const imdsProfile = (await retry(async () => {\n            let profile;\n            try {\n                profile = await getProfile(options);\n            }\n            catch (err) {\n                if (err.statusCode === 401) {\n                    disableFetchToken = false;\n                }\n                throw err;\n            }\n            return profile;\n        }, maxRetries)).trim();\n        return retry(async () => {\n            let creds;\n            try {\n                creds = await getCredentialsFromProfile(imdsProfile, options, init);\n            }\n            catch (err) {\n                if (err.statusCode === 401) {\n                    disableFetchToken = false;\n                }\n                throw err;\n            }\n            return creds;\n        }, maxRetries);\n    };\n    return async () => {\n        const endpoint = await getInstanceMetadataEndpoint();\n        if (disableFetchToken) {\n            logger?.debug(\"AWS SDK Instance Metadata\", \"using v1 fallback (no token fetch)\");\n            return getCredentials(maxRetries, { ...endpoint, timeout });\n        }\n        else {\n            let token;\n            try {\n                token = (await getMetadataToken({ ...endpoint, timeout })).toString();\n            }\n            catch (error) {\n                if (error?.statusCode === 400) {\n                    throw Object.assign(error, {\n                        message: \"EC2 Metadata token request returned error\",\n                    });\n                }\n                else if (error.message === \"TimeoutError\" || [403, 404, 405].includes(error.statusCode)) {\n                    disableFetchToken = true;\n                }\n                logger?.debug(\"AWS SDK Instance Metadata\", \"using v1 fallback (initial)\");\n                return getCredentials(maxRetries, { ...endpoint, timeout });\n            }\n            return getCredentials(maxRetries, {\n                ...endpoint,\n                headers: {\n                    [X_AWS_EC2_METADATA_TOKEN]: token,\n                },\n                timeout,\n            });\n        }\n    };\n};\nconst getMetadataToken = async (options) => httpRequest({\n    ...options,\n    path: IMDS_TOKEN_PATH,\n    method: \"PUT\",\n    headers: {\n        \"x-aws-ec2-metadata-token-ttl-seconds\": \"21600\",\n    },\n});\nconst getProfile = async (options) => (await httpRequest({ ...options, path: IMDS_PATH })).toString();\nconst getCredentialsFromProfile = async (profile, options, init) => {\n    const credentialsResponse = JSON.parse((await httpRequest({\n        ...options,\n        path: IMDS_PATH + profile,\n    })).toString());\n    if (!isImdsCredentials(credentialsResponse)) {\n        throw new CredentialsProviderError(\"Invalid response received from instance metadata service.\", {\n            logger: init.logger,\n        });\n    }\n    return fromImdsCredentials(credentialsResponse);\n};\n"],"mappings":";;;;;;;;;;AAAO,IAAM,oBAAoB,CAAC,QAAQ,QAAQ,GAAG,KACjD,OAAO,QAAQ,YACf,OAAO,IAAI,gBAAgB,YAC3B,OAAO,IAAI,oBAAoB,YAC/B,OAAO,IAAI,UAAU,YACrB,OAAO,IAAI,eAAe;AACvB,IAAM,sBAAsB,CAAC,WAAW;AAAA,EAC3C,aAAa,MAAM;AAAA,EACnB,iBAAiB,MAAM;AAAA,EACvB,cAAc,MAAM;AAAA,EACpB,YAAY,IAAI,KAAK,MAAM,UAAU;AAAA,EACrC,GAAI,MAAM,aAAa,EAAE,WAAW,MAAM,UAAU;AACxD;;;ACZO,IAAM,kBAAkB;AACxB,IAAM,sBAAsB;AAC5B,IAAM,yBAAyB,CAAC,EAAE,aAAa,qBAAqB,UAAU,gBAAiB,OAAO,EAAE,YAAY,QAAQ;;;ACFnI,OAAO,eAAe;;;ACEf,SAAS,YAAY,SAAS;AACjC,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACpC,UAAM,MAAM,UAAU,QAAQ;AAAA,MAC1B,QAAQ;AAAA,MACR,GAAG;AAAA,MACH,UAAU,QAAQ,UAAU,QAAQ,cAAc,IAAI;AAAA,IAC1D,CAAC;AACD,QAAI,GAAG,SAAS,CAAC,QAAQ;AACrB,aAAO,OAAO,OAAO,IAAI,cAAc,gDAAgD,GAAG,GAAG,CAAC;AAC9F,UAAI,QAAQ;AAAA,IAChB,CAAC;AACD,QAAI,GAAG,WAAW,MAAM;AACpB,aAAO,IAAI,cAAc,6CAA6C,CAAC;AACvE,UAAI,QAAQ;AAAA,IAChB,CAAC;AACD,QAAI,GAAG,YAAY,CAAC,QAAQ;AACxB,YAAM,EAAE,aAAa,IAAI,IAAI;AAC7B,UAAI,aAAa,OAAO,OAAO,YAAY;AACvC,eAAO,OAAO,OAAO,IAAI,cAAc,wDAAwD,GAAG,EAAE,WAAW,CAAC,CAAC;AACjH,YAAI,QAAQ;AAAA,MAChB;AACA,YAAM,SAAS,CAAC;AAChB,UAAI,GAAG,QAAQ,CAAC,UAAU;AACtB,eAAO,KAAK,KAAK;AAAA,MACrB,CAAC;AACD,UAAI,GAAG,OAAO,MAAM;AAChB,gBAAQ,OAAO,OAAO,MAAM,CAAC;AAC7B,YAAI,QAAQ;AAAA,MAChB,CAAC;AAAA,IACL,CAAC;AACD,QAAI,IAAI;AAAA,EACZ,CAAC;AACL;;;AClCO,IAAM,QAAQ,CAAC,SAAS,eAAe;AAC1C,MAAI,UAAU,QAAQ;AACtB,WAAS,IAAI,GAAG,IAAI,YAAY,KAAK;AACjC,cAAU,QAAQ,MAAM,OAAO;AAAA,EACnC;AACA,SAAO;AACX;;;ACDO,IAAM,oBAAoB;AAC1B,IAAM,wBAAwB;AAC9B,IAAM,sBAAsB;AAC5B,IAAM,wBAAwB,CAAC,OAAO,CAAC,MAAM;AAChD,QAAM,EAAE,SAAS,WAAW,IAAI,uBAAuB,IAAI;AAC3D,SAAO,MAAM,MAAM,YAAY;AAC3B,UAAM,iBAAiB,MAAM,WAAW,EAAE,QAAQ,KAAK,OAAO,CAAC;AAC/D,UAAM,gBAAgB,KAAK,MAAM,MAAM,mBAAmB,SAAS,cAAc,CAAC;AAClF,QAAI,CAAC,kBAAkB,aAAa,GAAG;AACnC,YAAM,IAAI,yBAAyB,6DAA6D;AAAA,QAC5F,QAAQ,KAAK;AAAA,MACjB,CAAC;AAAA,IACL;AACA,WAAO,oBAAoB,aAAa;AAAA,EAC5C,GAAG,UAAU;AACjB;AACA,IAAM,qBAAqB,OAAO,SAAS,YAAY;AACnD,MAAI,QAAQ,IAAI,mBAAmB,GAAG;AAClC,YAAQ,UAAU;AAAA,MACd,GAAG,QAAQ;AAAA,MACX,eAAe,QAAQ,IAAI,mBAAmB;AAAA,IAClD;AAAA,EACJ;AACA,QAAM,SAAS,MAAM,YAAY;AAAA,IAC7B,GAAG;AAAA,IACH;AAAA,EACJ,CAAC;AACD,SAAO,OAAO,SAAS;AAC3B;AACA,IAAM,UAAU;AAChB,IAAM,mBAAmB,oBAAI,IAAI,CAAC,aAAa,WAAW,CAAC;AAC3D,IAAM,uBAAuB,oBAAI,IAAI,CAAC,SAAS,QAAQ,CAAC;AACxD,IAAM,aAAa,OAAO,EAAE,OAAO,MAAM;AACrC,MAAI,QAAQ,IAAI,qBAAqB,GAAG;AACpC,WAAO;AAAA,MACH,UAAU;AAAA,MACV,MAAM,QAAQ,IAAI,qBAAqB;AAAA,IAC3C;AAAA,EACJ;AACA,MAAI,QAAQ,IAAI,iBAAiB,GAAG;AAChC,QAAI;AACJ,QAAI;AACA,eAAS,IAAI,IAAI,QAAQ,IAAI,iBAAiB,CAAC;AAAA,IACnD,QACM;AACF,YAAM,IAAI,yBAAyB,GAAG,QAAQ,IAAI,iBAAiB,CAAC,kDAAkD,EAAE,aAAa,OAAO,OAAO,CAAC;AAAA,IACxJ;AACA,QAAI,CAAC,OAAO,YAAY,CAAC,iBAAiB,IAAI,OAAO,QAAQ,GAAG;AAC5D,YAAM,IAAI,yBAAyB,GAAG,OAAO,QAAQ,uDAAuD;AAAA,QACxG,aAAa;AAAA,QACb;AAAA,MACJ,CAAC;AAAA,IACL;AACA,QAAI,CAAC,OAAO,YAAY,CAAC,qBAAqB,IAAI,OAAO,QAAQ,GAAG;AAChE,YAAM,IAAI,yBAAyB,GAAG,OAAO,QAAQ,uDAAuD;AAAA,QACxG,aAAa;AAAA,QACb;AAAA,MACJ,CAAC;AAAA,IACL;AACA,WAAO;AAAA,MACH,UAAU,OAAO;AAAA,MACjB,UAAU,OAAO;AAAA,MACjB,MAAM,OAAO,WAAW,OAAO;AAAA,MAC/B,MAAM,OAAO,OAAO,SAAS,OAAO,MAAM,EAAE,IAAI;AAAA,IACpD;AAAA,EACJ;AACA,QAAM,IAAI,yBAAyB,wEACvB,qBAAqB,OAAO,iBAAiB,gCACjC;AAAA,IACpB,aAAa;AAAA,IACb;AAAA,EACJ,CAAC;AACL;;;AC5EO,IAAM,kCAAN,MAAM,yCAAwC,yBAAyB;AAAA,EAC1E;AAAA,EACA,OAAO;AAAA,EACP,YAAY,SAAS,cAAc,MAAM;AACrC,UAAM,SAAS,WAAW;AAC1B,SAAK,cAAc;AACnB,WAAO,eAAe,MAAM,iCAAgC,SAAS;AAAA,EACzE;AACJ;;;ACTO,IAAI;AAAA,CACV,SAAUA,WAAU;AACjB,EAAAA,UAAS,MAAM,IAAI;AACnB,EAAAA,UAAS,MAAM,IAAI;AACvB,GAAG,aAAa,WAAW,CAAC,EAAE;;;ACJvB,IAAM,oBAAoB;AAC1B,IAAM,uBAAuB;AAC7B,IAAM,0BAA0B;AAAA,EACnC,6BAA6B,CAAC,QAAQ,IAAI,iBAAiB;AAAA,EAC3D,oBAAoB,CAAC,YAAY,QAAQ,oBAAoB;AAAA,EAC7D,SAAS;AACb;;;ACNO,IAAI;AAAA,CACV,SAAUC,eAAc;AACrB,EAAAA,cAAa,MAAM,IAAI;AACvB,EAAAA,cAAa,MAAM,IAAI;AAC3B,GAAG,iBAAiB,eAAe,CAAC,EAAE;;;ACH/B,IAAM,yBAAyB;AAC/B,IAAM,4BAA4B;AAClC,IAAM,+BAA+B;AAAA,EACxC,6BAA6B,CAAC,QAAQ,IAAI,sBAAsB;AAAA,EAChE,oBAAoB,CAAC,YAAY,QAAQ,yBAAyB;AAAA,EAClE,SAAS,aAAa;AAC1B;;;ACDO,IAAM,8BAA8B,YAAY,SAAU,MAAM,sBAAsB,KAAO,MAAM,0BAA0B,CAAE;AACtI,IAAM,wBAAwB,YAAY,WAAW,uBAAuB,EAAE;AAC9E,IAAM,4BAA4B,YAAY;AAC1C,QAAM,eAAe,MAAM,WAAW,4BAA4B,EAAE;AACpE,UAAQ,cAAc;AAAA,IAClB,KAAK,aAAa;AACd,aAAO,SAAyB;AAAA,IACpC,KAAK,aAAa;AACd,aAAO,SAAyB;AAAA,IACpC;AACI,YAAM,IAAI,MAAM,8BAA8B,YAAY,iBAAsB,OAAO,OAAO,YAAY,CAAC,EAAE;AAAA,EACrH;AACJ;;;AClBA,IAAM,4CAA4C,IAAI;AACtD,IAAM,0DAA0D,IAAI;AACpE,IAAM,2BAA2B;AAC1B,IAAM,yCAAyC,CAAC,aAAa,WAAW;AAC3E,QAAM,kBAAkB,4CACpB,KAAK,MAAM,KAAK,OAAO,IAAI,uDAAuD;AACtF,QAAM,gBAAgB,IAAI,KAAK,KAAK,IAAI,IAAI,kBAAkB,GAAI;AAClE,SAAO,KAAK,qJAC+B,IAAI,KAAK,aAAa,CAAC;AAAA,wCAC9D,wBAAwB;AAC5B,QAAM,qBAAqB,YAAY,sBAAsB,YAAY;AACzE,SAAO;AAAA,IACH,GAAG;AAAA,IACH,GAAI,qBAAqB,EAAE,mBAAmB,IAAI,CAAC;AAAA,IACnD,YAAY;AAAA,EAChB;AACJ;;;ACfO,IAAM,0BAA0B,CAAC,UAAU,UAAU,CAAC,MAAM;AAC/D,QAAM,SAAS,SAAS,UAAU;AAClC,MAAI;AACJ,SAAO,YAAY;AACf,QAAI;AACJ,QAAI;AACA,oBAAc,MAAM,SAAS;AAC7B,UAAI,YAAY,cAAc,YAAY,WAAW,QAAQ,IAAI,KAAK,IAAI,GAAG;AACzE,sBAAc,uCAAuC,aAAa,MAAM;AAAA,MAC5E;AAAA,IACJ,SACO,GAAG;AACN,UAAI,iBAAiB;AACjB,eAAO,KAAK,6BAA6B,CAAC;AAC1C,sBAAc,uCAAuC,iBAAiB,MAAM;AAAA,MAChF,OACK;AACD,cAAM;AAAA,MACV;AAAA,IACJ;AACA,sBAAkB;AAClB,WAAO;AAAA,EACX;AACJ;;;AChBA,IAAM,YAAY;AAClB,IAAM,kBAAkB;AACxB,IAAM,+BAA+B;AACrC,IAAM,uCAAuC;AAC7C,IAAM,2BAA2B;AAC1B,IAAM,uBAAuB,CAAC,OAAO,CAAC,MAAM,wBAAwB,4BAA4B,IAAI,GAAG,EAAE,QAAQ,KAAK,OAAO,CAAC;AACrI,IAAM,8BAA8B,CAAC,OAAO,CAAC,MAAM;AAC/C,MAAI,oBAAoB;AACxB,QAAM,EAAE,QAAQ,QAAQ,IAAI;AAC5B,QAAM,EAAE,SAAS,WAAW,IAAI,uBAAuB,IAAI;AAC3D,QAAM,iBAAiB,OAAOC,aAAY,YAAY;AAClD,UAAM,mBAAmB,qBAAqB,QAAQ,UAAU,wBAAwB,KAAK;AAC7F,QAAI,kBAAkB;AAClB,UAAI,6BAA6B;AACjC,UAAI,gCAAgC;AACpC,YAAM,cAAc,MAAM,WAAW;AAAA,QACjC,6BAA6B,CAAC,QAAQ;AAClC,gBAAM,WAAW,IAAI,4BAA4B;AACjD,0CAAgC,CAAC,CAAC,YAAY,aAAa;AAC3D,cAAI,aAAa,QAAW;AACxB,kBAAM,IAAI,yBAAyB,GAAG,4BAA4B,+CAA+C,EAAE,QAAQ,KAAK,OAAO,CAAC;AAAA,UAC5I;AACA,iBAAO;AAAA,QACX;AAAA,QACA,oBAAoB,CAACC,aAAY;AAC7B,gBAAM,eAAeA,SAAQ,oCAAoC;AACjE,uCAA6B,CAAC,CAAC,gBAAgB,iBAAiB;AAChE,iBAAO;AAAA,QACX;AAAA,QACA,SAAS;AAAA,MACb,GAAG;AAAA,QACC;AAAA,MACJ,CAAC,EAAE;AACH,UAAI,KAAK,yBAAyB,aAAa;AAC3C,cAAM,SAAS,CAAC;AAChB,YAAI,KAAK;AACL,iBAAO,KAAK,2EAA2E;AAC3F,YAAI;AACA,iBAAO,KAAK,wBAAwB,oCAAoC,GAAG;AAC/E,YAAI;AACA,iBAAO,KAAK,iCAAiC,4BAA4B,GAAG;AAChF,cAAM,IAAI,gCAAgC,6FAA6F,OAAO,KAAK,IAAI,CAAC,IAAI;AAAA,MAChK;AAAA,IACJ;AACA,UAAM,eAAe,MAAM,MAAM,YAAY;AACzC,UAAIA;AACJ,UAAI;AACA,QAAAA,WAAU,MAAM,WAAW,OAAO;AAAA,MACtC,SACO,KAAK;AACR,YAAI,IAAI,eAAe,KAAK;AACxB,8BAAoB;AAAA,QACxB;AACA,cAAM;AAAA,MACV;AACA,aAAOA;AAAA,IACX,GAAGD,WAAU,GAAG,KAAK;AACrB,WAAO,MAAM,YAAY;AACrB,UAAI;AACJ,UAAI;AACA,gBAAQ,MAAM,0BAA0B,aAAa,SAAS,IAAI;AAAA,MACtE,SACO,KAAK;AACR,YAAI,IAAI,eAAe,KAAK;AACxB,8BAAoB;AAAA,QACxB;AACA,cAAM;AAAA,MACV;AACA,aAAO;AAAA,IACX,GAAGA,WAAU;AAAA,EACjB;AACA,SAAO,YAAY;AACf,UAAM,WAAW,MAAM,4BAA4B;AACnD,QAAI,mBAAmB;AACnB,cAAQ,MAAM,6BAA6B,oCAAoC;AAC/E,aAAO,eAAe,YAAY,EAAE,GAAG,UAAU,QAAQ,CAAC;AAAA,IAC9D,OACK;AACD,UAAI;AACJ,UAAI;AACA,iBAAS,MAAM,iBAAiB,EAAE,GAAG,UAAU,QAAQ,CAAC,GAAG,SAAS;AAAA,MACxE,SACO,OAAO;AACV,YAAI,OAAO,eAAe,KAAK;AAC3B,gBAAM,OAAO,OAAO,OAAO;AAAA,YACvB,SAAS;AAAA,UACb,CAAC;AAAA,QACL,WACS,MAAM,YAAY,kBAAkB,CAAC,KAAK,KAAK,GAAG,EAAE,SAAS,MAAM,UAAU,GAAG;AACrF,8BAAoB;AAAA,QACxB;AACA,gBAAQ,MAAM,6BAA6B,6BAA6B;AACxE,eAAO,eAAe,YAAY,EAAE,GAAG,UAAU,QAAQ,CAAC;AAAA,MAC9D;AACA,aAAO,eAAe,YAAY;AAAA,QAC9B,GAAG;AAAA,QACH,SAAS;AAAA,UACL,CAAC,wBAAwB,GAAG;AAAA,QAChC;AAAA,QACA;AAAA,MACJ,CAAC;AAAA,IACL;AAAA,EACJ;AACJ;AACA,IAAM,mBAAmB,OAAO,YAAY,YAAY;AAAA,EACpD,GAAG;AAAA,EACH,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,SAAS;AAAA,IACL,wCAAwC;AAAA,EAC5C;AACJ,CAAC;AACD,IAAM,aAAa,OAAO,aAAa,MAAM,YAAY,EAAE,GAAG,SAAS,MAAM,UAAU,CAAC,GAAG,SAAS;AACpG,IAAM,4BAA4B,OAAO,SAAS,SAAS,SAAS;AAChE,QAAM,sBAAsB,KAAK,OAAO,MAAM,YAAY;AAAA,IACtD,GAAG;AAAA,IACH,MAAM,YAAY;AAAA,EACtB,CAAC,GAAG,SAAS,CAAC;AACd,MAAI,CAAC,kBAAkB,mBAAmB,GAAG;AACzC,UAAM,IAAI,yBAAyB,6DAA6D;AAAA,MAC5F,QAAQ,KAAK;AAAA,IACjB,CAAC;AAAA,EACL;AACA,SAAO,oBAAoB,mBAAmB;AAClD;","names":["Endpoint","EndpointMode","maxRetries","profile"]}

package/dist/{dist-es-7RLYMBW4.js → dist-es-R36PCSLH.js}

@@ -6,10 +6,10 @@ import {
   ENV_SECRET,
   ENV_SESSION,
   fromEnv
-} from "./chunk-JJUYBZ5C.js";
-import "./chunk-QVMXXFG5.js";
-import "./chunk-J2GNAAZA.js";
-import "./chunk-UN64BKHA.js";
+} from "./chunk-FR442V6O.js";
+import "./chunk-ZPTG6NGD.js";
+import "./chunk-7WLIHNPO.js";
+import "./chunk-GPJBZ6EG.js";
 export {
   ENV_ACCOUNT_ID,
   ENV_CREDENTIAL_SCOPE,
@@ -19,4 +19,4 @@ export {
   ENV_SESSION,
   fromEnv
 };
-//# sourceMappingURL=dist-es-7RLYMBW4.js.map
+//# sourceMappingURL=dist-es-R36PCSLH.js.map