@ts-cloud/core 0.16.90 → 0.16.92

package/dist/aws/credentials.d.ts

@@ -6,11 +6,11 @@ export interface AWSCredentials {
     region?: string;
 }
 export interface CredentialProviderOptions {
-    /** Profile name for shared credentials file (default: 'default' or AWS_PROFILE env var) */
+    /** Profile name (default: AWS_PROFILE, then AWS_DEFAULT_PROFILE, then 'default') */
     profile?: string;
-    /** Path to credentials file (default: ~/.aws/credentials) */
+    /** Path to credentials file (default: AWS_SHARED_CREDENTIALS_FILE, then ~/.aws/credentials) */
     credentialsFile?: string;
-    /** Path to config file (default: ~/.aws/config) */
+    /** Path to config file (default: AWS_CONFIG_FILE, then ~/.aws/config) */
     configFile?: string;
     /** Timeout for metadata requests in ms (default: 1000) */
     timeout?: number;
@@ -21,9 +21,17 @@ export interface CredentialProviderOptions {
  */
 export declare function fromEnvironment(): AWSCredentials | null;
 /**
- * Get credentials from shared credentials file (~/.aws/credentials)
+ * Get credentials from the shared files: static keys in `~/.aws/credentials`
+ * (or the profile's section of `~/.aws/config`). A `credential_process` is not
+ * run here, since this is synchronous; see `fromCredentialProcess`.
  */
 export declare function fromSharedCredentials(options?: CredentialProviderOptions): AWSCredentials | null;
+/**
+ * Get credentials from the profile's `credential_process` (in `~/.aws/config`
+ * or `~/.aws/credentials`), the way `aws --profile` does. `null` when the
+ * profile has none; a helper that fails, hangs or prints junk throws.
+ */
+export declare function fromCredentialProcess(options?: CredentialProviderOptions): Promise<AWSCredentials | null>;
 /**
  * Get credentials from EC2 instance metadata service (IMDSv2)
  */
@@ -38,7 +46,7 @@ export declare function fromECSMetadata(options?: CredentialProviderOptions): Pr
 export declare function fromWebIdentity(options?: CredentialProviderOptions): Promise<AWSCredentials | null>;
 /**
  * Get credentials using the default credential chain
- * Tries providers in order: Environment -> Shared Credentials -> Web Identity -> ECS -> EC2
+ * Tries providers in order: Environment -> Shared Credentials -> credential_process -> Web Identity -> ECS -> EC2
  */
 export declare function getCredentials(options?: CredentialProviderOptions): Promise<AWSCredentials>;
 /**

package/dist/aws/index.d.ts

@@ -1,7 +1,9 @@
 export { signRequest, signRequestAsync, makeAWSRequest, makeAWSRequestAsync, makeAWSRequestOnce, createPresignedUrl, createPresignedUrlAsync, detectServiceRegion, clearSigningKeyCache, getSigningKeyCacheSize, parseXMLResponse, parseJSONResponse, isNodeCryptoAvailable, isWebCryptoAvailable, } from './signature';
 export type { SignatureOptions, SignedRequest, PresignedUrlOptions, RetryOptions } from './signature';
-export { fromEnvironment, fromSharedCredentials, fromEC2Metadata, fromECSMetadata, fromWebIdentity, getCredentials, createCredentialProvider, resolveCredentials, resolveRegion, getAccountId, } from './credentials';
+export { fromEnvironment, fromSharedCredentials, fromCredentialProcess, fromEC2Metadata, fromECSMetadata, fromWebIdentity, getCredentials, createCredentialProvider, resolveCredentials, resolveRegion, getAccountId, } from './credentials';
 export type { AWSCredentials, AWSProfile, CredentialProviderOptions } from './credentials';
+export { CREDENTIAL_PROCESS_TIMEOUT_MS, CredentialProcessError, clearCredentialProcessCache, loadProfileCredentials, loadProfileCredentialsSync, loadStaticProfileCredentials, profileCredentialProcess, readSharedProfile, resolveProfileName, sharedConfigPath, sharedCredentialsPath, splitCommandLine, } from './shared-config';
+export type { ProfileCredentials, SharedConfigOptions } from './shared-config';
 export { CloudFormationClient } from './cloudformation';
 export type { CloudFormationStack, CreateStackOptions, UpdateStackOptions, StackEvent } from './cloudformation';
 export { S3Client, S3Error, createS3Client } from './s3';

package/dist/aws/shared-config.d.ts

@@ -0,0 +1,58 @@
+export interface ProfileCredentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+    /** Set when the credentials expire (a `credential_process` that reported one). */
+    expiration?: Date;
+}
+export interface SharedConfigOptions {
+    /** Profile name; falls back to AWS_PROFILE, AWS_DEFAULT_PROFILE, then `default`. */
+    profile?: string;
+    /** Credentials file path; falls back to AWS_SHARED_CREDENTIALS_FILE, then ~/.aws/credentials. */
+    credentialsFile?: string;
+    /** Config file path; falls back to AWS_CONFIG_FILE, then ~/.aws/config. */
+    configFile?: string;
+    /** How long a `credential_process` may run before it is killed (default 30 000 ms). */
+    timeoutMs?: number;
+}
+/** Default budget for a `credential_process`. */
+export declare const CREDENTIAL_PROCESS_TIMEOUT_MS = 30000;
+/** Raised when a `credential_process` fails, times out or prints something unusable. */
+export declare class CredentialProcessError extends Error {
+    readonly code = "CredentialProcessError";
+    readonly profile: string;
+    readonly command: string;
+    constructor(profile: string, command: string, reason: string);
+}
+/** The profile in effect: explicit, AWS_PROFILE, AWS_DEFAULT_PROFILE, `default`. */
+export declare function resolveProfileName(explicit?: string): string;
+export declare function sharedCredentialsPath(override?: string): string;
+export declare function sharedConfigPath(override?: string): string;
+/**
+ * Every setting of a profile, from the config and credentials files merged (the
+ * credentials file wins). `undefined` when neither file defines the profile.
+ */
+export declare function readSharedProfile(options?: SharedConfigOptions): Record<string, string> | undefined;
+/** Static keys from the profile, without running anything. */
+export declare function loadStaticProfileCredentials(options?: SharedConfigOptions): ProfileCredentials | null;
+/** The profile's `credential_process` command line, if it has one. */
+export declare function profileCredentialProcess(options?: SharedConfigOptions): string | null;
+/**
+ * Split a command line into argv the way a POSIX shell would: whitespace
+ * separates words, single quotes are literal, double quotes allow `\"` and `\\`,
+ * and a backslash outside quotes escapes the next character. No variable,
+ * glob, tilde or command expansion happens: the result is spawned directly.
+ * On Windows a backslash outside quotes stays literal, so paths survive.
+ */
+export declare function splitCommandLine(command: string, platform?: string): string[];
+/** Forget every credential a `credential_process` issued (for tests and sign-out). */
+export declare function clearCredentialProcessCache(): void;
+/**
+ * Credentials for the profile, running its `credential_process` when it has one
+ * and no static keys. `null` when the profile defines neither. A failing helper
+ * throws a CredentialProcessError rather than returning null: it was configured,
+ * so falling through to some other source would hide the real problem.
+ */
+export declare function loadProfileCredentials(options?: SharedConfigOptions): Promise<ProfileCredentials | null>;
+/** Synchronous twin of loadProfileCredentials, for the callers that cannot await. */
+export declare function loadProfileCredentialsSync(options?: SharedConfigOptions): ProfileCredentials | null;

package/dist/aws/shared-config.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/index.d.ts

@@ -37,6 +37,7 @@ export * from './presets/management-dashboard';
 export * from './presets/extend';
 export * from './aws/signature';
 export * from './aws/credentials';
+export * from './aws/shared-config';
 export * from './aws/cloudformation';
 export { S3Client, S3Error, createS3Client, type S3ClientOptions, type GetObjectOptions, type PutObjectOptions, type ListObjectsOptions, type ListObjectsResult, type S3Object, type HeadObjectResult, type CopyObjectOptions, type MultipartUploadOptions, type MultipartProgress, type PresignedUrlOptions as S3PresignedUrlOptions, } from './aws/s3';
 export * from './aws/cloudfront';