@xiaoso/dsh-tool-plus 0.1.0-beta.2 → 0.1.0-beta.4

package/lib/aws-credentials-CXryMobh.mjs

@@ -0,0 +1,867 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { I as $flag, P as $env, S as debug, y as isEnoent } from "./src-BgpusnsB.mjs";
+import { H as AwsCredentialsError } from "./error-Dd8DIqs-.mjs";
+import { n as raceWithSignal } from "./abort-dIkZBV7Q.mjs";
+import { i as isLocalOrMetadataHost } from "./proxy-pM_NIv-H.mjs";
+import * as path from "node:path";
+import * as fs from "node:fs";
+import * as os from "node:os";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/utils/aws-profile.ts
+function parseAwsIni(text) {
+	const out = {};
+	let current = null;
+	for (const rawLine of text.split(/\r?\n/)) {
+		const line = rawLine.trim();
+		if (!line || line.startsWith("#") || line.startsWith(";")) continue;
+		if (line.startsWith("[") && line.endsWith("]")) {
+			let name = line.slice(1, -1).trim();
+			if (name.startsWith("profile ")) name = name.slice(8).trim();
+			if (name.startsWith("sso-session ")) name = `sso-session:${name.slice(12).trim()}`;
+			let section = out[name];
+			if (!section) {
+				section = {};
+				out[name] = section;
+			}
+			current = section;
+			continue;
+		}
+		if (!current) continue;
+		const eq = line.indexOf("=");
+		if (eq === -1) continue;
+		current[line.slice(0, eq).trim()] = line.slice(eq + 1).trim();
+	}
+	return out;
+}
+function readAwsIniSync(filePath) {
+	try {
+		return parseAwsIni(fs.readFileSync(filePath, "utf8"));
+	} catch {
+		return;
+	}
+}
+/** Resolve the selected shared-credentials profile. */
+function resolveAwsProfile(profile) {
+	return profile || $env.AWS_PROFILE || "default";
+}
+/**
+* Whether the shared config file participates in profile/region resolution.
+* Explicit profile selection enables it; the implicit default profile follows
+* the AWS SDK's `AWS_SDK_LOAD_CONFIG` opt-in.
+*/
+function shouldLoadAwsSharedConfig(profile) {
+	if (profile || $env.AWS_PROFILE) return true;
+	const value = $env.AWS_SDK_LOAD_CONFIG?.toLowerCase();
+	return value === "1" || value === "true";
+}
+function resolveAwsProfileRegion(profile) {
+	if (!shouldLoadAwsSharedConfig(profile)) return void 0;
+	return readAwsIniSync($env.AWS_CONFIG_FILE || path.join(os.homedir(), ".aws", "config"))?.[resolveAwsProfile(profile)]?.region;
+}
+/** Region selected by the environment or active shared-config profile. */
+function resolveAwsAmbientRegion(profile) {
+	return $env.AWS_REGION || $env.AWS_DEFAULT_REGION || resolveAwsProfileRegion(profile);
+}
+/** Resolve the region precedence shared by AWS transports and credential exchanges. */
+function resolveAwsRegion(explicitRegion, profile) {
+	return explicitRegion || resolveAwsAmbientRegion(profile) || "us-east-1";
+}
+function hasConfiguredAwsProfile(profile) {
+	const selectedProfile = resolveAwsProfile(profile);
+	const credentialsPath = $env.AWS_SHARED_CREDENTIALS_FILE || path.join(os.homedir(), ".aws", "credentials");
+	const configPath = $env.AWS_CONFIG_FILE || path.join(os.homedir(), ".aws", "config");
+	return profileHasCredentialSource(selectedProfile, readAwsIniSync(credentialsPath), shouldLoadAwsSharedConfig(profile) ? readAwsIniSync(configPath) : void 0, /* @__PURE__ */ new Set());
+}
+/**
+* Whether a profile terminates in a usable credential source. Mirrors the
+* resolver's per-profile dispatch (static keys, SSO, `credential_process`,
+* `role_arn` chaining) so the availability probe never diverges from what
+* `resolveAwsCredentials` can actually resolve. `role_arn` chains follow
+* `source_profile` recursively (cycle-guarded by `seen`); MFA-gated roles are
+* treated as unusable because non-interactive resolution cannot supply a token.
+*/
+function profileHasCredentialSource(profile, credentialsIni, configIni, seen) {
+	if (seen.has(profile)) return false;
+	seen.add(profile);
+	const merged = {
+		...configIni?.[profile] ?? {},
+		...credentialsIni?.[profile] ?? {}
+	};
+	if (merged.role_arn) {
+		if (merged.web_identity_token_file) return true;
+		if (merged.mfa_serial) return false;
+		if (merged.credential_source) switch (merged.credential_source) {
+			case "Environment": return !!($env.AWS_ACCESS_KEY_ID && $env.AWS_SECRET_ACCESS_KEY);
+			case "EcsContainer": return !!($env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI || $env.AWS_CONTAINER_CREDENTIALS_FULL_URI);
+			case "Ec2InstanceMetadata": return $env.AWS_EC2_METADATA_DISABLED?.toLowerCase() !== "true";
+			default: return false;
+		}
+		if (merged.source_profile) return profileHasCredentialSource(merged.source_profile, credentialsIni, configIni, seen);
+		return false;
+	}
+	if (merged.aws_access_key_id && merged.aws_secret_access_key) return true;
+	if (merged.credential_process) return true;
+	if (!merged.sso_account_id || !merged.sso_role_name) return false;
+	if (merged.sso_start_url && merged.sso_region) return true;
+	const session = merged.sso_session ? configIni?.[`sso-session:${merged.sso_session}`] : void 0;
+	return !!(session?.sso_start_url && session.sso_region);
+}
+//#endregion
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/registry/types.ts
+/** Credentials are resolved by the provider transport rather than used as a bearer string. */
+const AUTHENTICATED_SENTINEL = "<authenticated>";
+//#endregion
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/registry/aws.ts
+function isEc2Host() {
+	const checks = [
+		["/sys/hypervisor/uuid", (v) => v.startsWith("ec2")],
+		["/sys/devices/virtual/dmi/id/product_uuid", (v) => v.startsWith("ec2")],
+		["/sys/devices/virtual/dmi/id/board_asset_tag", (v) => v.startsWith("ec2") || v.startsWith("i-")],
+		["/sys/devices/virtual/dmi/id/sys_vendor", (v) => v.includes("amazon ec2")],
+		["/sys/devices/virtual/dmi/id/bios_vendor", (v) => v.includes("amazon ec2")]
+	];
+	for (const [candidate, matches] of checks) try {
+		if (matches(fs.readFileSync(candidate, "utf8").trim().toLowerCase())) return true;
+	} catch {}
+	return false;
+}
+function hasAwsCredentialSource() {
+	const hasEcsCredentials = !!$env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI || !!$env.AWS_CONTAINER_CREDENTIALS_FULL_URI;
+	const hasWebIdentity = !!$env.AWS_WEB_IDENTITY_TOKEN_FILE && !!$env.AWS_ROLE_ARN;
+	const hasProfile = hasConfiguredAwsProfile();
+	const hasInstanceRole = $env.AWS_EC2_METADATA_DISABLED?.toLowerCase() !== "true" && (!!$env.AWS_EC2_METADATA_SERVICE_ENDPOINT || isEc2Host());
+	return !!($env.AWS_ACCESS_KEY_ID && $env.AWS_SECRET_ACCESS_KEY || $env.AWS_BEARER_TOKEN_BEDROCK || hasWebIdentity || hasProfile || hasEcsCredentials || hasInstanceRole);
+}
+/** Registry key marker for AWS transports that resolve their own bearer/IAM credentials. */
+function resolveAwsRegistryApiKey(options) {
+	if (options?.allowSkipAuth && $flag("AWS_BEDROCK_SKIP_AUTH")) return AUTHENTICATED_SENTINEL;
+	return hasAwsCredentialSource() ? AUTHENTICATED_SENTINEL : void 0;
+}
+/** Resolve a real AWS bearer token while filtering the registry's auth marker. */
+function resolveAwsBearerToken(apiKey, bearerToken) {
+	return bearerToken || (apiKey === "<authenticated>" ? void 0 : apiKey) || $env.AWS_BEARER_TOKEN_BEDROCK;
+}
+//#endregion
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/providers/aws-sigv4.ts
+const ALGORITHM = "AWS4-HMAC-SHA256";
+const KEY_TYPE = "aws4_request";
+const UNSIGNABLE = {
+	authorization: true,
+	"cache-control": true,
+	connection: true,
+	expect: true,
+	from: true,
+	"keep-alive": true,
+	"max-forwards": true,
+	pragma: true,
+	referer: true,
+	te: true,
+	trailer: true,
+	"transfer-encoding": true,
+	upgrade: true,
+	"user-agent": true,
+	"x-amzn-trace-id": true
+};
+/** Coerce a possibly-ArrayBufferLike-backed `Uint8Array` into one over a fresh
+* `ArrayBuffer`, which is what `crypto.subtle.{digest,sign,importKey}` requires
+* under the strict TS DOM typings. No-op when already strict.
+*/
+function asStrict(bytes) {
+	if (bytes.buffer instanceof ArrayBuffer && bytes.byteOffset === 0 && bytes.byteLength === bytes.buffer.byteLength) return bytes;
+	const copy = new Uint8Array(bytes.byteLength);
+	copy.set(bytes);
+	return copy;
+}
+const subtle = globalThis.crypto.subtle;
+const HEX = "0123456789abcdef";
+function toHex(bytes) {
+	let out = "";
+	for (let i = 0; i < bytes.length; i++) {
+		const b = bytes[i];
+		out += HEX[b >> 4] + HEX[b & 15];
+	}
+	return out;
+}
+async function sha256(data) {
+	const bytes = typeof data === "string" ? new TextEncoder().encode(data) : asStrict(data);
+	const digest = await subtle.digest("SHA-256", bytes);
+	return new Uint8Array(digest);
+}
+async function sha256Hex(data) {
+	return toHex(await sha256(data));
+}
+async function hmac(key, data) {
+	const cryptoKey = await subtle.importKey("raw", asStrict(key), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const bytes = typeof data === "string" ? new TextEncoder().encode(data) : asStrict(data);
+	const sig = await subtle.sign("HMAC", cryptoKey, bytes);
+	return new Uint8Array(sig);
+}
+/**
+* Derive a signing key: HMAC chain `kSecret → kDate → kRegion → kService → kSigning`.
+*/
+async function getSigningKey(secretAccessKey, shortDate, region, service) {
+	return hmac(await hmac(await hmac(await hmac(new TextEncoder().encode(`AWS4${secretAccessKey}`), shortDate), region), service), KEY_TYPE);
+}
+/** `YYYYMMDDTHHMMSSZ` + 8-char `YYYYMMDD`. */
+function formatAmzDate(d) {
+	const iso = d.toISOString();
+	const longDate = `${iso.slice(0, 4)}${iso.slice(5, 7)}${iso.slice(8, 10)}T${iso.slice(11, 13)}${iso.slice(14, 16)}${iso.slice(17, 19)}Z`;
+	return {
+		longDate,
+		shortDate: longDate.slice(0, 8)
+	};
+}
+/**
+* Canonicalize a request path per RFC 3986: each segment is %-encoded but `/`
+* stays literal. Matches the smithy default (`uriEscapePath: true`, then revert
+* the double-encoding of `/`). Bedrock paths use no reserved characters in
+* practice, but model IDs can include `:` and `.`.
+*/
+function canonicalPath(path) {
+	return path.split("/").map((seg) => seg.length === 0 ? "" : encodeRfc3986(seg)).join("/");
+}
+function encodeRfc3986(str) {
+	return encodeURIComponent(str).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+function canonicalQuery(query) {
+	if (!query) return "";
+	const pairs = [];
+	for (const part of query.split("&")) {
+		if (!part) continue;
+		const eq = part.indexOf("=");
+		const k = eq === -1 ? part : part.slice(0, eq);
+		const v = eq === -1 ? "" : part.slice(eq + 1);
+		pairs.push([decodeURIComponent(k), decodeURIComponent(v)]);
+	}
+	pairs.sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : a[1] < b[1] ? -1 : a[1] > b[1] ? 1 : 0);
+	return pairs.map(([k, v]) => `${encodeRfc3986(k)}=${encodeRfc3986(v)}`).join("&");
+}
+async function signRequest(params) {
+	const { method, host, path, query, body, region, service, credentials } = params;
+	const { longDate, shortDate } = formatAmzDate(params.date ?? /* @__PURE__ */ new Date());
+	const payloadHash = await sha256Hex(body);
+	const signed = {
+		host,
+		"x-amz-date": longDate,
+		"x-amz-content-sha256": payloadHash
+	};
+	if (credentials.sessionToken) signed["x-amz-security-token"] = credentials.sessionToken;
+	const extraHeaders = params.headers;
+	if (extraHeaders) for (const k in extraHeaders) {
+		const lk = k.toLowerCase();
+		if (UNSIGNABLE[lk]) continue;
+		if (lk.startsWith("proxy-") || lk.startsWith("sec-")) continue;
+		signed[lk] = extraHeaders[k].trim().replace(/\s+/g, " ");
+	}
+	const sortedNames = Object.keys(signed).sort();
+	const canonicalHeaders = `${sortedNames.map((n) => `${n}:${signed[n]}`).join("\n")}\n`;
+	const signedHeadersStr = sortedNames.join(";");
+	const canonicalRequest = [
+		method.toUpperCase(),
+		canonicalPath(path),
+		canonicalQuery(query),
+		canonicalHeaders,
+		signedHeadersStr,
+		payloadHash
+	].join("\n");
+	const scope = `${shortDate}/${region}/${service}/${KEY_TYPE}`;
+	const stringToSign = [
+		ALGORITHM,
+		longDate,
+		scope,
+		await sha256Hex(canonicalRequest)
+	].join("\n");
+	const signature = toHex(await hmac(await getSigningKey(credentials.secretAccessKey, shortDate, region, service), stringToSign));
+	const out = {
+		host,
+		"x-amz-date": longDate,
+		"x-amz-content-sha256": payloadHash,
+		authorization: `${ALGORITHM} Credential=${credentials.accessKeyId}/${scope}, SignedHeaders=${signedHeadersStr}, Signature=${signature}`
+	};
+	if (credentials.sessionToken) out["x-amz-security-token"] = credentials.sessionToken;
+	return out;
+}
+//#endregion
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/providers/aws-credentials.ts
+/**
+* AWS credential resolution for the Bedrock provider.
+*
+* Chain (first hit wins):
+*  1. Static credentials from the environment
+*     (`AWS_ACCESS_KEY_ID` + `AWS_SECRET_ACCESS_KEY` [+ `AWS_SESSION_TOKEN`]).
+*  2. Web identity (`AWS_WEB_IDENTITY_TOKEN_FILE` + `AWS_ROLE_ARN`).
+*  3. Profile in `~/.aws/credentials` (and `~/.aws/config` for SSO/roles):
+*      - static keys, SSO, `credential_process`, or `role_arn` role chaining
+*        (`source_profile` recursion, `web_identity_token_file`, `credential_source`).
+*  4. ECS/container credentials from `AWS_CONTAINER_CREDENTIALS_*`.
+*  5. EC2 IMDSv2 when metadata is enabled.
+*
+* Resolved credentials are cached process-wide per profile and refreshed
+* 60 s before `Expiration` to absorb clock skew.
+*/
+const REFRESH_SKEW_MS = 6e4;
+/**
+* TTL for file-sourced credentials that carry a session token but no expiry.
+* Tools like aws-vault/saml2aws rewrite ~/.aws/credentials with short-lived STS
+* session keys; caching them forever serves stale creds after rotation.
+*/
+const FILE_SESSION_CREDS_TTL_MS = 3e5;
+/**
+* Bound for the detached (signal-free) shared resolution: a hung
+* credential_process/SSO/IMDS fetch must not pin the inflight slot forever.
+*/
+const SHARED_RESOLVE_TIMEOUT_MS = 3e4;
+function requireDynamicCredentialExpiration(value, source, kind) {
+	const expiresAt = value ? Date.parse(value) : NaN;
+	if (Number.isFinite(expiresAt)) return expiresAt;
+	throw new AwsCredentialsError(`${source} response has a missing or invalid Expiration.`, kind);
+}
+/** Credential-process expiry is optional; missing/malformed values disable caching. */
+function dynamicCredentialExpiration(value) {
+	if (!value) return Date.now();
+	const expiresAt = Date.parse(value);
+	return Number.isFinite(expiresAt) ? expiresAt : Date.now();
+}
+const cache = /* @__PURE__ */ new Map();
+const inflight = /* @__PURE__ */ new Map();
+function credentialCacheKey(profile, region, loadSharedConfig) {
+	return `${profile}\x00${region}\x00${loadSharedConfig ? "config" : "credentials"}`;
+}
+async function resolveAwsCredentials(opts = {}) {
+	const profile = resolveAwsProfile(opts.profile);
+	const region = resolveAwsRegion(opts.region, opts.profile);
+	const loadSharedConfig = shouldLoadAwsSharedConfig(opts.profile);
+	const cacheKey = credentialCacheKey(profile, region, loadSharedConfig);
+	const hit = cache.get(cacheKey);
+	if (hit && hit.expiresAt - REFRESH_SKEW_MS > Date.now()) return hit.creds;
+	const existing = inflight.get(cacheKey);
+	if (existing) return raceWithSignal(existing, opts.signal);
+	const fetchImpl = opts.fetch ?? globalThis.fetch;
+	const promise = (async () => {
+		try {
+			const creds = await resolveFresh(profile, region, loadSharedConfig, AbortSignal.timeout(SHARED_RESOLVE_TIMEOUT_MS), fetchImpl);
+			cache.set(cacheKey, {
+				creds,
+				expiresAt: creds.expiresAt ?? Number.POSITIVE_INFINITY
+			});
+			return creds;
+		} finally {
+			inflight.delete(cacheKey);
+		}
+	})();
+	inflight.set(cacheKey, promise);
+	return raceWithSignal(promise, opts.signal);
+}
+async function resolveFresh(profile, region, loadSharedConfig, signal, fetchImpl = globalThis.fetch) {
+	const envCreds = readEnvCredentials();
+	if (envCreds) return envCreds;
+	const webIdentityCreds = await readWebIdentityCredentials(region, signal, fetchImpl);
+	if (webIdentityCreds) return webIdentityCreds;
+	const profileCreds = await readProfileCredentials(profile, region, loadSharedConfig, signal, fetchImpl);
+	if (profileCreds) return profileCreds;
+	const containerCreds = await readContainerCredentials(signal, fetchImpl);
+	if (containerCreds) return containerCreds;
+	if ($env.AWS_EC2_METADATA_DISABLED?.toLowerCase() !== "true") {
+		const imdsCreds = await readImdsCredentials(signal, fetchImpl);
+		if (imdsCreds) return imdsCreds;
+	}
+	throw new AwsCredentialsError("Unable to resolve AWS credentials. Configure static environment keys, web identity, an AWS profile, ECS credentials, or an EC2 instance role.", "resolution");
+}
+function readEnvCredentials() {
+	const ak = $env.AWS_ACCESS_KEY_ID;
+	const sk = $env.AWS_SECRET_ACCESS_KEY;
+	if (!ak || !sk) return void 0;
+	const token = $env.AWS_SESSION_TOKEN;
+	return token ? {
+		accessKeyId: ak,
+		secretAccessKey: sk,
+		sessionToken: token
+	} : {
+		accessKeyId: ak,
+		secretAccessKey: sk
+	};
+}
+async function readIniFile(p) {
+	try {
+		return parseAwsIni(await fs.promises.readFile(p, "utf8"));
+	} catch (err) {
+		if (isEnoent(err)) return void 0;
+		throw err;
+	}
+}
+async function readProfileCredentials(profile, region, loadSharedConfig, signal, fetchImpl) {
+	const home = os.homedir();
+	const credentialsPath = $env.AWS_SHARED_CREDENTIALS_FILE || path.join(home, ".aws", "credentials");
+	const configPath = $env.AWS_CONFIG_FILE || path.join(home, ".aws", "config");
+	return resolveProfileChain(profile, {
+		credentialsIni: await readIniFile(credentialsPath),
+		configIni: loadSharedConfig ? await readIniFile(configPath) : void 0,
+		region,
+		signal,
+		fetchImpl
+	}, /* @__PURE__ */ new Set());
+}
+/**
+* Resolve one profile, following `role_arn` chains. A `role_arn` profile derives
+* base credentials from `source_profile` (recursive), `web_identity_token_file`,
+* or `credential_source`, then exchanges them via STS. Non-role profiles resolve
+* directly from static keys, SSO, or `credential_process`. `seen` guards against
+* `source_profile` cycles.
+*/
+async function resolveProfileChain(profile, ctx, seen) {
+	if (seen.has(profile)) throw new AwsCredentialsError(`AWS profile role chain contains a cycle at '${profile}'.`, "profile");
+	seen.add(profile);
+	const merged = {
+		...ctx.configIni?.[profile] ?? {},
+		...ctx.credentialsIni?.[profile] ?? {}
+	};
+	if (Object.keys(merged).length === 0) return void 0;
+	if (merged.role_arn) return assumeRoleFromProfile(profile, merged, ctx, seen);
+	if (merged.aws_access_key_id && merged.aws_secret_access_key) {
+		const out = {
+			accessKeyId: merged.aws_access_key_id,
+			secretAccessKey: merged.aws_secret_access_key
+		};
+		if (merged.aws_session_token) {
+			out.sessionToken = merged.aws_session_token;
+			out.expiresAt = Date.now() + FILE_SESSION_CREDS_TTL_MS;
+		}
+		return out;
+	}
+	if (merged.sso_account_id && merged.sso_role_name) return readSsoCredentials(merged, ctx.configIni, ctx.region, ctx.signal, ctx.fetchImpl);
+	if (merged.credential_process) return readCredentialProcess(profile, merged.credential_process, ctx.signal);
+}
+/**
+* Resolve base credentials for a `role_arn` profile and exchange them for the
+* target role. `web_identity_token_file` is a self-contained
+* AssumeRoleWithWebIdentity; otherwise the base comes from `source_profile`
+* (recursive) or `credential_source`, followed by an STS `AssumeRole`.
+*/
+async function assumeRoleFromProfile(profile, merged, ctx, seen) {
+	const roleArn = merged.role_arn;
+	const region = ctx.region;
+	if (merged.web_identity_token_file) return assumeRoleWithWebIdentity({
+		roleArn,
+		tokenFile: merged.web_identity_token_file,
+		sessionName: merged.role_session_name
+	}, region, ctx.signal, ctx.fetchImpl);
+	if (merged.mfa_serial) throw new AwsCredentialsError(`AWS profile '${profile}' requires MFA (mfa_serial), which is not supported for non-interactive credential resolution.`, "profile");
+	let base;
+	if (merged.source_profile) {
+		base = await resolveProfileChain(merged.source_profile, ctx, seen);
+		if (!base) throw new AwsCredentialsError(`AWS profile '${profile}' references source_profile '${merged.source_profile}', which has no usable credentials.`, "profile");
+	} else if (merged.credential_source) {
+		base = await resolveCredentialSource(merged.credential_source, region, ctx.signal, ctx.fetchImpl);
+		if (!base) throw new AwsCredentialsError(`AWS profile '${profile}' credential_source '${merged.credential_source}' produced no credentials.`, "profile");
+	} else throw new AwsCredentialsError(`AWS profile '${profile}' sets role_arn without source_profile, credential_source, or web_identity_token_file.`, "profile");
+	return stsAssumeRole(base, roleArn, region, {
+		sessionName: merged.role_session_name,
+		durationSeconds: merged.duration_seconds,
+		externalId: merged.external_id
+	}, ctx.signal, ctx.fetchImpl);
+}
+/** Resolve the base credentials named by a profile `credential_source` directive. */
+async function resolveCredentialSource(source, _region, signal, fetchImpl) {
+	switch (source) {
+		case "Environment": return readEnvCredentials();
+		case "Ec2InstanceMetadata": return $env.AWS_EC2_METADATA_DISABLED?.toLowerCase() === "true" ? void 0 : readImdsCredentials(signal, fetchImpl);
+		case "EcsContainer": return readContainerCredentials(signal, fetchImpl);
+		default: throw new AwsCredentialsError(`Unsupported AWS credential_source '${source}'.`, "profile");
+	}
+}
+/**
+* Exchange base credentials for a target role via STS `AssumeRole`. The request
+* is SigV4-signed with the base credentials.
+*/
+async function stsAssumeRole(base, roleArn, region, opts, signal, fetchImpl) {
+	const body = new URLSearchParams({
+		Action: "AssumeRole",
+		Version: "2011-06-15",
+		RoleArn: roleArn,
+		RoleSessionName: opts.sessionName || `omp-${process.pid}`
+	});
+	if (opts.durationSeconds) body.set("DurationSeconds", opts.durationSeconds);
+	if (opts.externalId) body.set("ExternalId", opts.externalId);
+	const payload = new TextEncoder().encode(body.toString());
+	const endpoint = new URL(stsEndpoint(region));
+	const contentType = "application/x-www-form-urlencoded";
+	const response = await fetchImpl(endpoint, {
+		method: "POST",
+		headers: {
+			...await signRequest({
+				method: "POST",
+				host: endpoint.host,
+				path: endpoint.pathname,
+				body: payload,
+				region,
+				service: "sts",
+				credentials: base,
+				headers: { "content-type": contentType }
+			}),
+			"content-type": contentType
+		},
+		body: payload,
+		signal
+	});
+	const xml = await response.text();
+	if (!response.ok) throw new AwsCredentialsError(`AWS AssumeRole failed: ${response.status} ${xmlTag(xml, "Message") ?? xml.slice(0, 200)}`, "assume-role");
+	return parseStsCredentials(xml, "AWS AssumeRole", "assume-role");
+}
+async function readSsoCredentials(profileCfg, configIni, defaultRegion, signal, fetchImpl) {
+	let startUrl = profileCfg.sso_start_url;
+	let ssoRegion = profileCfg.sso_region;
+	const sessionName = profileCfg.sso_session;
+	if (sessionName && configIni) {
+		const session = configIni[`sso-session:${sessionName}`];
+		if (session) {
+			startUrl = startUrl || session.sso_start_url;
+			ssoRegion = ssoRegion || session.sso_region;
+		}
+	}
+	if (!startUrl || !ssoRegion) return void 0;
+	const token = await loadSsoCachedToken(startUrl, sessionName);
+	if (!token?.accessToken) throw new AwsCredentialsError(`AWS SSO token for ${startUrl} not found in ~/.aws/sso/cache. Run 'aws sso login' first.`, "sso-token-missing");
+	const expiresAt = token.expiresAt ? Date.parse(token.expiresAt) : Number.POSITIVE_INFINITY;
+	if (Number.isFinite(expiresAt) && expiresAt <= Date.now()) throw new AwsCredentialsError(`AWS SSO token for ${startUrl} has expired. Run 'aws sso login' to refresh.`, "sso-token-expired");
+	const response = await fetchImpl(`https://portal.sso.${ssoRegion}.amazonaws.com/federation/credentials?account_id=${encodeURIComponent(profileCfg.sso_account_id)}&role_name=${encodeURIComponent(profileCfg.sso_role_name)}`, {
+		method: "GET",
+		headers: { "x-amz-sso_bearer_token": token.accessToken },
+		signal
+	});
+	if (!response.ok) {
+		const body = await response.text().catch(() => "");
+		throw new AwsCredentialsError(`AWS SSO GetRoleCredentials failed: ${response.status} ${body.slice(0, 200)}`, "sso-role");
+	}
+	const role = (await response.json()).roleCredentials;
+	if (!role) throw new AwsCredentialsError("AWS SSO GetRoleCredentials: missing roleCredentials in response", "sso-role");
+	return {
+		accessKeyId: role.accessKeyId,
+		secretAccessKey: role.secretAccessKey,
+		sessionToken: role.sessionToken,
+		expiresAt: role.expiration
+	};
+}
+async function loadSsoCachedToken(startUrl, sessionName) {
+	const cacheDir = path.join(os.homedir(), ".aws", "sso", "cache");
+	let entries;
+	try {
+		entries = await fs.promises.readdir(cacheDir);
+	} catch (err) {
+		if (isEnoent(err)) return void 0;
+		throw err;
+	}
+	const candidates = [];
+	const hash = await sha1Hex(sessionName || startUrl);
+	candidates.push(`${hash}.json`);
+	for (const entry of entries) if (entry.endsWith(".json") && !candidates.includes(entry)) candidates.push(entry);
+	for (const file of candidates) {
+		if (!entries.includes(file)) continue;
+		try {
+			const text = await fs.promises.readFile(path.join(cacheDir, file), "utf8");
+			const parsed = JSON.parse(text);
+			if (parsed.startUrl === startUrl || sessionName && file === `${hash}.json`) return parsed;
+		} catch (err) {
+			debug("aws-credentials: failed to read SSO cache", {
+				file,
+				err: String(err)
+			});
+		}
+	}
+}
+async function sha1Hex(input) {
+	const digest = await globalThis.crypto.subtle.digest("SHA-1", new TextEncoder().encode(input));
+	const bytes = new Uint8Array(digest);
+	let out = "";
+	for (let i = 0; i < bytes.length; i++) out += bytes[i].toString(16).padStart(2, "0");
+	return out;
+}
+async function readCredentialProcess(profile, command, signal) {
+	const argv = buildCredentialProcessArgv(profile, command);
+	const child = Bun.spawn(argv, {
+		stdin: "ignore",
+		stdout: "pipe",
+		stderr: "pipe",
+		windowsHide: true,
+		signal
+	});
+	const [stdout, stderr, exitCode] = await Promise.all([
+		new Response(child.stdout).text(),
+		new Response(child.stderr).text(),
+		child.exited
+	]);
+	if (exitCode !== 0) {
+		const tail = stderr.trim().slice(-512) || stdout.trim().slice(-512) || "(no output)";
+		throw new AwsCredentialsError(`AWS credential_process for profile '${profile}' exited ${exitCode}: ${tail}`, "credential-process");
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(stdout);
+	} catch (err) {
+		throw new AwsCredentialsError(`AWS credential_process for profile '${profile}' did not emit valid JSON: ${String(err)}`, "credential-process", { cause: err });
+	}
+	if (parsed.Version !== 1) throw new AwsCredentialsError(`AWS credential_process for profile '${profile}' returned unsupported Version ${parsed.Version ?? "<missing>"}; expected 1.`, "credential-process");
+	if (!parsed.AccessKeyId || !parsed.SecretAccessKey) throw new AwsCredentialsError(`AWS credential_process for profile '${profile}' returned envelope without AccessKeyId/SecretAccessKey.`, "credential-process");
+	const out = {
+		accessKeyId: parsed.AccessKeyId,
+		secretAccessKey: parsed.SecretAccessKey
+	};
+	if (parsed.SessionToken) {
+		out.sessionToken = parsed.SessionToken;
+		out.expiresAt = dynamicCredentialExpiration(parsed.Expiration);
+	} else if (parsed.Expiration) out.expiresAt = dynamicCredentialExpiration(parsed.Expiration);
+	return out;
+}
+/** Resolve the argv for `Bun.spawn`. On Windows we route `.cmd`/`.bat` helpers
+* through `cmd.exe /c` because direct execution refuses batch files (mirrors
+* Node's `execFile` policy and avoids surprise no-ops). */
+function buildCredentialProcessArgv(profile, command) {
+	const tokens = tokenizeCredentialProcessCommand(command);
+	if (tokens.length === 0) throw new AwsCredentialsError(`AWS credential_process for profile '${profile}' is empty.`, "credential-process");
+	if (process.platform === "win32" && isBatchScript(tokens[0])) return [
+		"cmd.exe",
+		"/d",
+		"/s",
+		"/c",
+		command
+	];
+	return tokens;
+}
+function isBatchScript(executable) {
+	const lower = executable.toLowerCase();
+	return lower.endsWith(".cmd") || lower.endsWith(".bat");
+}
+/** POSIX-shell-style tokenizer used by the AWS CLI for `credential_process`.
+*
+* Outside quotes a backslash escapes the next character. Inside single quotes
+* everything is literal (no escapes, cannot contain `'`). Inside double quotes
+* a backslash only escapes `$`, `` ` ``, `"`, and `\` — every other backslash
+* is preserved verbatim, which is what makes Windows paths like
+* `"C:\Program Files\tool\auth.exe"` survive tokenization. */
+function tokenizeCredentialProcessCommand(cmd) {
+	const tokens = [];
+	let current = "";
+	let hasToken = false;
+	let mode = "normal";
+	for (let i = 0; i < cmd.length; i++) {
+		const ch = cmd[i];
+		if (mode === "normal") {
+			if (ch === "'") {
+				mode = "single";
+				hasToken = true;
+				continue;
+			}
+			if (ch === "\"") {
+				mode = "double";
+				hasToken = true;
+				continue;
+			}
+			if (ch === "\\" && i + 1 < cmd.length) {
+				current += cmd[++i];
+				hasToken = true;
+				continue;
+			}
+			if (ch === " " || ch === "	" || ch === "\n" || ch === "\r") {
+				if (hasToken) {
+					tokens.push(current);
+					current = "";
+					hasToken = false;
+				}
+				continue;
+			}
+			current += ch;
+			hasToken = true;
+			continue;
+		}
+		if (mode === "single") {
+			if (ch === "'") {
+				mode = "normal";
+				continue;
+			}
+			current += ch;
+			continue;
+		}
+		if (ch === "\"") {
+			mode = "normal";
+			continue;
+		}
+		if (ch === "\\" && i + 1 < cmd.length) {
+			const next = cmd[i + 1];
+			if (next === "$" || next === "`" || next === "\"" || next === "\\") {
+				current += next;
+				i++;
+				continue;
+			}
+			current += ch;
+			continue;
+		}
+		current += ch;
+	}
+	if (mode !== "normal") throw new AwsCredentialsError("AWS credential_process command has an unterminated quote.", "credential-process");
+	if (hasToken) tokens.push(current);
+	return tokens;
+}
+function xmlTag(xml, tag) {
+	const value = new RegExp(`<${tag}>([\\s\\S]*?)</${tag}>`).exec(xml)?.[1];
+	if (!value) return void 0;
+	return value.replaceAll("&amp;", "&").replaceAll("&lt;", "<").replaceAll("&gt;", ">").replaceAll("&quot;", "\"").replaceAll("&apos;", "'");
+}
+function stsEndpoint(region) {
+	return `https://sts.${region}.${region.startsWith("cn-") ? "amazonaws.com.cn" : "amazonaws.com"}/`;
+}
+/** Parse `<Credentials>` from an STS AssumeRole/WithWebIdentity XML response. */
+function parseStsCredentials(xml, source, kind) {
+	const accessKeyId = xmlTag(xml, "AccessKeyId");
+	const secretAccessKey = xmlTag(xml, "SecretAccessKey");
+	const sessionToken = xmlTag(xml, "SessionToken");
+	if (!accessKeyId || !secretAccessKey || !sessionToken) throw new AwsCredentialsError(`${source} response is missing credentials.`, kind);
+	return {
+		accessKeyId,
+		secretAccessKey,
+		sessionToken,
+		expiresAt: requireDynamicCredentialExpiration(xmlTag(xml, "Expiration"), source, kind)
+	};
+}
+async function readWebIdentityCredentials(region, signal, fetchImpl) {
+	const tokenFile = $env.AWS_WEB_IDENTITY_TOKEN_FILE;
+	const roleArn = $env.AWS_ROLE_ARN;
+	if (!tokenFile || !roleArn) return void 0;
+	return assumeRoleWithWebIdentity({
+		roleArn,
+		tokenFile,
+		sessionName: $env.AWS_ROLE_SESSION_NAME
+	}, region, signal, fetchImpl);
+}
+/**
+* Exchange a web-identity token file for role credentials via STS
+* `AssumeRoleWithWebIdentity`. Used by the env chain (`AWS_WEB_IDENTITY_TOKEN_FILE`)
+* and by `role_arn` + `web_identity_token_file` profiles.
+*/
+async function assumeRoleWithWebIdentity(params, region, signal, fetchImpl) {
+	let token;
+	try {
+		token = (await Bun.file(params.tokenFile).text()).trim();
+	} catch (err) {
+		throw new AwsCredentialsError(`Unable to read AWS web identity token file: ${String(err)}`, "web-identity", { cause: err });
+	}
+	if (!token) throw new AwsCredentialsError("AWS web identity token file is empty.", "web-identity");
+	const body = new URLSearchParams({
+		Action: "AssumeRoleWithWebIdentity",
+		Version: "2011-06-15",
+		RoleArn: params.roleArn,
+		RoleSessionName: params.sessionName || `omp-${process.pid}`,
+		WebIdentityToken: token
+	});
+	const response = await fetchImpl(stsEndpoint(region), {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded" },
+		body: body.toString(),
+		signal
+	});
+	const xml = await response.text();
+	if (!response.ok) throw new AwsCredentialsError(`AWS AssumeRoleWithWebIdentity failed: ${response.status} ${xmlTag(xml, "Message") ?? xml.slice(0, 200)}`, "web-identity");
+	return parseStsCredentials(xml, "AWS web identity", "web-identity");
+}
+const ECS_TASK_CREDENTIALS_BASE_URL = new URL("http://169.254.170.2/");
+async function readContainerCredentials(signal, fetchImpl) {
+	const relativeUri = $env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI;
+	const fullUri = $env.AWS_CONTAINER_CREDENTIALS_FULL_URI;
+	if (!relativeUri && !fullUri) return void 0;
+	let endpoint;
+	if (relativeUri) {
+		if (!relativeUri.startsWith("/") || relativeUri.startsWith("//")) throw new AwsCredentialsError("AWS_CONTAINER_CREDENTIALS_RELATIVE_URI must be a single-host absolute path.", "container");
+		endpoint = new URL(relativeUri.slice(1), ECS_TASK_CREDENTIALS_BASE_URL);
+	} else {
+		try {
+			endpoint = new URL(fullUri);
+		} catch (err) {
+			throw new AwsCredentialsError(`AWS_CONTAINER_CREDENTIALS_FULL_URI is invalid: ${String(err)}`, "container", { cause: err });
+		}
+		if (endpoint.protocol !== "https:" && !isLocalOrMetadataHost(endpoint.hostname)) throw new AwsCredentialsError("AWS_CONTAINER_CREDENTIALS_FULL_URI must use HTTPS or a local metadata host.", "container");
+	}
+	let authorization = $env.AWS_CONTAINER_AUTHORIZATION_TOKEN;
+	const authorizationTokenFile = $env.AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE;
+	if (!authorization && authorizationTokenFile) try {
+		authorization = (await Bun.file(authorizationTokenFile).text()).trim();
+	} catch (err) {
+		throw new AwsCredentialsError(`Unable to read AWS container authorization token file: ${String(err)}`, "container", { cause: err });
+	}
+	const response = await fetchImpl(endpoint, {
+		headers: authorization ? { authorization } : void 0,
+		signal
+	});
+	if (!response.ok) {
+		const body = await response.text().catch(() => "");
+		throw new AwsCredentialsError(`AWS container credential endpoint failed: ${response.status} ${body.slice(0, 200)}`, "container");
+	}
+	const body = await response.json();
+	if (!body.AccessKeyId || !body.SecretAccessKey || !body.Token) throw new AwsCredentialsError("AWS container credential response is missing AccessKeyId/SecretAccessKey/Token.", "container");
+	return {
+		accessKeyId: body.AccessKeyId,
+		secretAccessKey: body.SecretAccessKey,
+		sessionToken: body.Token,
+		expiresAt: requireDynamicCredentialExpiration(body.Expiration, "AWS container credential", "container")
+	};
+}
+const IMDS_IPV4_BASE_URL = "http://169.254.169.254/";
+const IMDS_IPV6_BASE_URL = "http://[fd00:ec2::254]/";
+const IMDS_TIMEOUT_MS = 1e3;
+function imdsRequestSignal(parentSignal) {
+	const timeout = AbortSignal.timeout(IMDS_TIMEOUT_MS);
+	return parentSignal ? AbortSignal.any([parentSignal, timeout]) : timeout;
+}
+function imdsBaseUrl() {
+	const fallback = $env.AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE?.toLowerCase() === "ipv6" ? IMDS_IPV6_BASE_URL : IMDS_IPV4_BASE_URL;
+	const endpoint = new URL($env.AWS_EC2_METADATA_SERVICE_ENDPOINT || fallback);
+	if (!endpoint.pathname.endsWith("/")) endpoint.pathname += "/";
+	return endpoint;
+}
+async function readImdsCredentials(parentSignal, fetchImpl) {
+	try {
+		const endpoint = imdsBaseUrl();
+		const tokenRes = await fetchImpl(new URL("latest/api/token", endpoint), {
+			method: "PUT",
+			headers: { "x-aws-ec2-metadata-token-ttl-seconds": "21600" },
+			signal: imdsRequestSignal(parentSignal)
+		});
+		if (!tokenRes.ok) return void 0;
+		const token = await tokenRes.text();
+		const roleRes = await fetchImpl(new URL("latest/meta-data/iam/security-credentials/", endpoint), {
+			headers: { "x-aws-ec2-metadata-token": token },
+			signal: imdsRequestSignal(parentSignal)
+		});
+		if (!roleRes.ok) return void 0;
+		const role = (await roleRes.text()).trim();
+		if (!role) return void 0;
+		const credsRes = await fetchImpl(new URL(`latest/meta-data/iam/security-credentials/${encodeURIComponent(role)}`, endpoint), {
+			headers: { "x-aws-ec2-metadata-token": token },
+			signal: imdsRequestSignal(parentSignal)
+		});
+		if (!credsRes.ok) return void 0;
+		const body = await credsRes.json();
+		if (!body.AccessKeyId || !body.SecretAccessKey || !body.Token || !body.Expiration) return void 0;
+		const expiresAt = Date.parse(body.Expiration);
+		if (!Number.isFinite(expiresAt)) return void 0;
+		return {
+			accessKeyId: body.AccessKeyId,
+			secretAccessKey: body.SecretAccessKey,
+			sessionToken: body.Token,
+			expiresAt
+		};
+	} catch {
+		return;
+	}
+}
+/**
+* Drop the cache entry for one profile/region. Called by the Bedrock provider on
+* 401/403 responses so stale credentials are re-resolved instead of served until restart.
+*/
+function invalidateAwsCredentialCache(opts = {}) {
+	const profile = resolveAwsProfile(opts.profile);
+	const region = resolveAwsRegion(opts.region, opts.profile);
+	cache.delete(credentialCacheKey(profile, region, shouldLoadAwsSharedConfig(opts.profile)));
+}
+//#endregion
+export { resolveAwsRegistryApiKey as a, resolveAwsRegion as c, resolveAwsBearerToken as i, resolveAwsCredentials as n, AUTHENTICATED_SENTINEL as o, signRequest as r, resolveAwsAmbientRegion as s, invalidateAwsCredentialCache as t };