create-sailor 1.9.1 → 1.9.3

package/dist/dist-es-7HF5URFJ.js

@@ -0,0 +1 @@
+import"./chunk-LDZWCNWB.js";import"./chunk-X6LE6K3W.js";import{w as d}from"./chunk-A3H5SUSR.js";import{m as l,x as c}from"./chunk-Z4YWESTY.js";import"./chunk-MYIHTCRS.js";import"./chunk-IYWUY3VA.js";import{readFileSync as _}from"fs";var a=e=>async t=>{e.logger?.debug("@aws-sdk/credential-provider-web-identity - fromWebToken");let{roleArn:o,roleSessionName:r,webIdentityToken:s,providerId:n,policyArns:g,policy:p,durationSeconds:E}=e,{roleAssumerWithWebIdentity:i}=e;if(!i){let{getDefaultRoleAssumerWithWebIdentity:f}=await import("./sts-4U2U3ZK4.js");i=f({...e.clientConfig,credentialProviderLogger:e.logger,parentClientConfig:{...t?.callerClientConfig,...e.parentClientConfig}},e.clientPlugins)}return i({RoleArn:o,RoleSessionName:r??`aws-sdk-js-session-${Date.now()}`,WebIdentityToken:s,ProviderId:n,PolicyArns:g,Policy:p,DurationSeconds:E})};var m="AWS_WEB_IDENTITY_TOKEN_FILE",S="AWS_ROLE_ARN",N="AWS_ROLE_SESSION_NAME",w=(e={})=>async t=>{e.logger?.debug("@aws-sdk/credential-provider-web-identity - fromTokenFile");let o=e?.webIdentityTokenFile??process.env[m],r=e?.roleArn??process.env[S],s=e?.roleSessionName??process.env[N];if(!o||!r)throw new l("Web identity configuration not specified",{logger:e.logger});let n=await a({...e,webIdentityToken:c?.getTokenRecord?.()[o]??_(o,{encoding:"ascii"}),roleArn:r,roleSessionName:s})(t);return o===process.env[m]&&d(n,"CREDENTIALS_ENV_VARS_STS_WEB_ID_TOKEN","h"),n};export{w as fromTokenFile,a as fromWebToken};

package/dist/dist-es-BORZTE76.js

@@ -0,0 +1 @@
+import"./chunk-LDZWCNWB.js";import"./chunk-X6LE6K3W.js";import{w as f}from"./chunk-A3H5SUSR.js";import{m as c,r as l,w as p,x as a}from"./chunk-Z4YWESTY.js";import"./chunk-MYIHTCRS.js";import"./chunk-IYWUY3VA.js";import{exec as m}from"child_process";import{promisify as P}from"util";var u=(r,e,o)=>{if(e.Version!==1)throw Error(`Profile ${r} credential_process did not return Version 1.`);if(e.AccessKeyId===void 0||e.SecretAccessKey===void 0)throw Error(`Profile ${r} credential_process returned invalid credentials.`);if(e.Expiration){let i=new Date;if(new Date(e.Expiration)<i)throw Error(`Profile ${r} credential_process returned expired credentials.`)}let s=e.AccountId;!s&&o?.[r]?.aws_account_id&&(s=o[r].aws_account_id);let t={accessKeyId:e.AccessKeyId,secretAccessKey:e.SecretAccessKey,...e.SessionToken&&{sessionToken:e.SessionToken},...e.Expiration&&{expiration:new Date(e.Expiration)},...e.CredentialScope&&{credentialScope:e.CredentialScope},...s&&{accountId:s}};return f(t,"CREDENTIALS_PROCESS","w"),t};var w=async(r,e,o)=>{let s=e[r];if(e[r]){let t=s.credential_process;if(t!==void 0){let i=P(a?.getTokenRecord?.().exec??m);try{let{stdout:n}=await i(t),d;try{d=JSON.parse(n.trim())}catch{throw Error(`Profile ${r} credential_process returned invalid JSON.`)}return u(r,d,e)}catch(n){throw new c(n.message,{logger:o})}}else throw new c(`Profile ${r} did not contain credential_process.`,{logger:o})}else throw new c(`Profile ${r} could not be found in shared credentials file.`,{logger:o})};var K=(r={})=>async({callerClientConfig:e}={})=>{r.logger?.debug("@aws-sdk/credential-provider-process - fromProcess");let o=await p(r);return w(l({profile:r.profile??e?.profile}),o,r.logger)};export{K as fromProcess};

package/dist/dist-es-CN2GMFBK.js

@@ -0,0 +1 @@
+import"./chunk-LDZWCNWB.js";import"./chunk-X6LE6K3W.js";import{w as d}from"./chunk-A3H5SUSR.js";import{m as l,x as c}from"./chunk-Z4YWESTY.js";import"./chunk-MYIHTCRS.js";import"./chunk-IYWUY3VA.js";import{readFileSync as _}from"fs";var a=e=>async t=>{e.logger?.debug("@aws-sdk/credential-provider-web-identity - fromWebToken");let{roleArn:o,roleSessionName:r,webIdentityToken:s,providerId:n,policyArns:g,policy:p,durationSeconds:E}=e,{roleAssumerWithWebIdentity:i}=e;if(!i){let{getDefaultRoleAssumerWithWebIdentity:f}=await import("./sts-CP4OREEC.js");i=f({...e.clientConfig,credentialProviderLogger:e.logger,parentClientConfig:{...t?.callerClientConfig,...e.parentClientConfig}},e.clientPlugins)}return i({RoleArn:o,RoleSessionName:r??`aws-sdk-js-session-${Date.now()}`,WebIdentityToken:s,ProviderId:n,PolicyArns:g,Policy:p,DurationSeconds:E})};var m="AWS_WEB_IDENTITY_TOKEN_FILE",S="AWS_ROLE_ARN",N="AWS_ROLE_SESSION_NAME",w=(e={})=>async t=>{e.logger?.debug("@aws-sdk/credential-provider-web-identity - fromTokenFile");let o=e?.webIdentityTokenFile??process.env[m],r=e?.roleArn??process.env[S],s=e?.roleSessionName??process.env[N];if(!o||!r)throw new l("Web identity configuration not specified",{logger:e.logger});let n=await a({...e,webIdentityToken:c?.getTokenRecord?.()[o]??_(o,{encoding:"ascii"}),roleArn:r,roleSessionName:s})(t);return o===process.env[m]&&d(n,"CREDENTIALS_ENV_VARS_STS_WEB_ID_TOKEN","h"),n};export{w as fromTokenFile,a as fromWebToken};

package/dist/dist-es-FQ6CEUEU.js

@@ -0,0 +1 @@
+import"./chunk-X6LE6K3W.js";import{w as S}from"./chunk-A3H5SUSR.js";import{m as _}from"./chunk-Z4YWESTY.js";import"./chunk-MYIHTCRS.js";import"./chunk-IYWUY3VA.js";var p="AWS_ACCESS_KEY_ID",A="AWS_SECRET_ACCESS_KEY",C="AWS_SESSION_TOKEN",N="AWS_CREDENTIAL_EXPIRATION",a="AWS_CREDENTIAL_SCOPE",i="AWS_ACCOUNT_ID",v=e=>async()=>{e?.logger?.debug("@aws-sdk/credential-provider-env - fromEnv");let o=process.env[p],r=process.env[A],n=process.env[C],s=process.env[N],t=process.env[a],E=process.env[i];if(o&&r){let c={accessKeyId:o,secretAccessKey:r,...n&&{sessionToken:n},...s&&{expiration:new Date(s)},...t&&{credentialScope:t},...E&&{accountId:E}};return S(c,"CREDENTIALS_ENV_VARS","g"),c}throw new _("Unable to find environment variable credentials.",{logger:e?.logger})};export{i as ENV_ACCOUNT_ID,a as ENV_CREDENTIAL_SCOPE,N as ENV_EXPIRATION,p as ENV_KEY,A as ENV_SECRET,C as ENV_SESSION,v as fromEnv};

package/dist/dist-es-FSE4MSDA.js

@@ -0,0 +1,5 @@
+import"./chunk-SYWJHPRX.js";import"./chunk-X6LE6K3W.js";import{a as l}from"./chunk-MGGNSWUA.js";import"./chunk-WJLTO7JW.js";import"./chunk-TW5BOTVX.js";import{w as C}from"./chunk-A3H5SUSR.js";import{f as A,m as a}from"./chunk-Z4YWESTY.js";import{g as T,x as h}from"./chunk-MYIHTCRS.js";import"./chunk-IYWUY3VA.js";import g from"fs/promises";var u="169.254.170.2",R="169.254.170.23",w="[fd00:ec2::23]",p=(e,o)=>{if(e.protocol!=="https:"&&!(e.hostname===u||e.hostname===R||e.hostname===w)){if(e.hostname.includes("[")){if(e.hostname==="[::1]"||e.hostname==="[0000:0000:0000:0000:0000:0000:0000:0001]")return}else{if(e.hostname==="localhost")return;let n=e.hostname.split("."),r=t=>{let s=parseInt(t,10);return 0<=s&&s<=255};if(n[0]==="127"&&r(n[1])&&r(n[2])&&r(n[3])&&n.length===4)return}throw new a(`URL not accepted. It must either be HTTPS or match one of the following:
+  - loopback CIDR 127.0.0.0/8 or [::1/128]
+  - ECS container host 169.254.170.2
+  - EKS container host 169.254.170.23 or [fd00:ec2::23]`,{logger:o})}};function _(e){return new A({protocol:e.protocol,hostname:e.hostname,port:Number(e.port),path:e.pathname,query:Array.from(e.searchParams.entries()).reduce((o,[n,r])=>(o[n]=r,o),{}),fragment:e.hash})}async function I(e,o){let r=await h(e.body).transformToString();if(e.statusCode===200){let t=JSON.parse(r);if(typeof t.AccessKeyId!="string"||typeof t.SecretAccessKey!="string"||typeof t.Token!="string"||typeof t.Expiration!="string")throw new a("HTTP credential provider response not of the required format, an object matching: { AccessKeyId: string, SecretAccessKey: string, Token: string, Expiration: string(rfc3339) }",{logger:o});return{accessKeyId:t.AccessKeyId,secretAccessKey:t.SecretAccessKey,sessionToken:t.Token,expiration:T(t.Expiration)}}if(e.statusCode>=400&&e.statusCode<500){let t={};try{t=JSON.parse(r)}catch{}throw Object.assign(new a(`Server responded with status: ${e.statusCode}`,{logger:o}),{Code:t.Code,Message:t.Message})}throw new a(`Server responded with status: ${e.statusCode}`,{logger:o})}var f=(e,o,n)=>async()=>{for(let r=0;r<o;++r)try{return await e()}catch{await new Promise(s=>setTimeout(s,n))}return await e()};var S="AWS_CONTAINER_CREDENTIALS_RELATIVE_URI",O="http://169.254.170.2",L="AWS_CONTAINER_CREDENTIALS_FULL_URI",y="AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE",v="AWS_CONTAINER_AUTHORIZATION_TOKEN",U=(e={})=>{e.logger?.debug("@aws-sdk/credential-provider-http - fromHttp");let o,n=e.awsContainerCredentialsRelativeUri??process.env[S],r=e.awsContainerCredentialsFullUri??process.env[L],t=e.awsContainerAuthorizationToken??process.env[v],s=e.awsContainerAuthorizationTokenFile??process.env[y],i=e.logger?.constructor?.name==="NoOpLogger"||!e.logger?.warn?console.warn:e.logger.warn.bind(e.logger);if(n&&r&&(i("@aws-sdk/credential-provider-http: you have set both awsContainerCredentialsRelativeUri and awsContainerCredentialsFullUri."),i("awsContainerCredentialsFullUri will take precedence.")),t&&s&&(i("@aws-sdk/credential-provider-http: you have set both awsContainerAuthorizationToken and awsContainerAuthorizationTokenFile."),i("awsContainerAuthorizationToken will take precedence.")),r)o=r;else if(n)o=`${O}${n}`;else throw new a(`No HTTP credential provider host provided.
+Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.`,{logger:e.logger});let m=new URL(o);p(m,e.logger);let E=l.create({requestTimeout:e.timeout??1e3,connectionTimeout:e.timeout??1e3});return f(async()=>{let c=_(m);t?c.headers.Authorization=t:s&&(c.headers.Authorization=(await g.readFile(s)).toString());try{let d=await E.handle(c);return I(d.response).then(N=>C(N,"CREDENTIALS_HTTP","z"))}catch(d){throw new a(String(d),{logger:e.logger})}},e.maxRetries??3,e.timeout??1e3)};export{U as fromHttp};

package/dist/dist-es-H47VUS6Q.js

@@ -0,0 +1,2 @@
+import"./chunk-X6LE6K3W.js";import"./chunk-6MSNEPUX.js";import{j as M,l as S,m as s,y as u}from"./chunk-Z4YWESTY.js";import"./chunk-MYIHTCRS.js";import"./chunk-IYWUY3VA.js";import{parse as $}from"url";import{Buffer as W}from"buffer";import{request as K}from"http";function m(e){return new Promise((t,n)=>{let o=K({method:"GET",...e,hostname:e.hostname?.replace(/^\[(.+)\]$/,"$1")});o.on("error",r=>{n(Object.assign(new S("Unable to connect to instance metadata service"),r)),o.destroy()}),o.on("timeout",()=>{n(new S("TimeoutError from instance metadata service")),o.destroy()}),o.on("response",r=>{let{statusCode:a=400}=r;(a<200||300<=a)&&(n(Object.assign(new S("Error response received from instance metadata service"),{statusCode:a})),o.destroy());let f=[];r.on("data",i=>{f.push(i)}),r.on("end",()=>{t(W.concat(f)),o.destroy()})}),o.end()})}var N=e=>!!e&&typeof e=="object"&&typeof e.AccessKeyId=="string"&&typeof e.SecretAccessKey=="string"&&typeof e.Token=="string"&&typeof e.Expiration=="string",g=e=>({accessKeyId:e.AccessKeyId,secretAccessKey:e.SecretAccessKey,sessionToken:e.Token,expiration:new Date(e.Expiration),...e.AccountId&&{accountId:e.AccountId}});var pe=1e3,me=0,h=({maxRetries:e=0,timeout:t=1e3})=>({maxRetries:e,timeout:t});var A=(e,t)=>{let n=e();for(let o=0;o<t;o++)n=n.catch(e);return n};var C="AWS_CONTAINER_CREDENTIALS_FULL_URI",O="AWS_CONTAINER_CREDENTIALS_RELATIVE_URI",y="AWS_CONTAINER_AUTHORIZATION_TOKEN",Ne=(e={})=>{let{timeout:t,maxRetries:n}=h(e);return()=>A(async()=>{let o=await j({logger:e.logger}),r=JSON.parse(await B(t,o));if(!N(r))throw new s("Invalid response received from instance metadata service.",{logger:e.logger});return g(r)},n)},B=async(e,t)=>(process.env[y]&&(t.headers={...t.headers,Authorization:process.env[y]}),(await m({...t,timeout:e})).toString()),G="169.254.170.2",q={localhost:!0,"127.0.0.1":!0},H={"http:":!0,"https:":!0},j=async({logger:e})=>{if(process.env[O])return{hostname:G,path:process.env[O]};if(process.env[C]){let t=$(process.env[C]);if(!t.hostname||!(t.hostname in q))throw new s(`${t.hostname} is not a valid container metadata service hostname`,{tryNextLink:!1,logger:e});if(!t.protocol||!(t.protocol in H))throw new s(`${t.protocol} is not a valid container metadata service protocol`,{tryNextLink:!1,logger:e});return{...t,port:t.port?parseInt(t.port,10):void 0}}throw new s(`The container metadata credential provider cannot be used unless the ${O} or ${C} environment variable is set`,{tryNextLink:!1,logger:e})};var v=class e extends s{tryNextLink;name="InstanceMetadataV1FallbackError";constructor(t,n=!0){super(t,n),this.tryNextLink=n,Object.setPrototypeOf(this,e.prototype)}};var _;(function(e){e.IPv4="http://169.254.169.254",e.IPv6="http://[fd00:ec2::254]"})(_||(_={}));var Y="AWS_EC2_METADATA_SERVICE_ENDPOINT",J="ec2_metadata_service_endpoint",P={environmentVariableSelector:e=>e[Y],configFileSelector:e=>e[J],default:void 0};var p;(function(e){e.IPv4="IPv4",e.IPv6="IPv6"})(p||(p={}));var z="AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE",X="ec2_metadata_service_endpoint_mode",R={environmentVariableSelector:e=>e[z],configFileSelector:e=>e[X],default:p.IPv4};var D=async()=>M(await Z()||await Q()),Z=async()=>u(P)(),Q=async()=>{let e=await u(R)();switch(e){case p.IPv4:return _.IPv4;case p.IPv6:return _.IPv6;default:throw new Error(`Unsupported endpoint mode: ${e}. Select from ${Object.values(p)}`)}};var ee="https://docs.aws.amazon.com/sdkref/latest/guide/feature-static-credentials.html",w=(e,t)=>{let n=300+Math.floor(Math.random()*300),o=new Date(Date.now()+n*1e3);t.warn(`Attempting credential expiration extension due to a credential service availability issue. A refresh of these credentials will be attempted after ${new Date(o)}.
+For more information, please visit: `+ee);let r=e.originalExpiration??e.expiration;return{...e,...r?{originalExpiration:r}:{},expiration:o}};var b=(e,t={})=>{let n=t?.logger||console,o;return async()=>{let r;try{r=await e(),r.expiration&&r.expiration.getTime()<Date.now()&&(r=w(r,n))}catch(a){if(o)n.warn("Credential renew failed: ",a),r=w(o,n);else throw a}return o=r,r}};var k="/latest/meta-data/iam/security-credentials/",te="/latest/api/token",x="AWS_EC2_METADATA_V1_DISABLED",F="ec2_metadata_v1_disabled",L="x-aws-ec2-metadata-token",Je=(e={})=>b(oe(e),{logger:e.logger}),oe=(e={})=>{let t=!1,{logger:n,profile:o}=e,{timeout:r,maxRetries:a}=h(e),f=async(i,E)=>{if(t||E.headers?.[L]==null){let c=!1,d=!1,U=await u({environmentVariableSelector:l=>{let I=l[x];if(d=!!I&&I!=="false",I===void 0)throw new s(`${x} not set in env, checking config file next.`,{logger:e.logger});return d},configFileSelector:l=>{let I=l[F];return c=!!I&&I!=="false",c},default:!1},{profile:o})();if(e.ec2MetadataV1Disabled||U){let l=[];throw e.ec2MetadataV1Disabled&&l.push("credential provider initialization (runtime option ec2MetadataV1Disabled)"),c&&l.push(`config file profile (${F})`),d&&l.push(`process environment variable (${x})`),new v(`AWS EC2 Metadata v1 fallback has been blocked by AWS SDK configuration in the following: [${l.join(", ")}].`)}}let V=(await A(async()=>{let c;try{c=await ne(E)}catch(d){throw d.statusCode===401&&(t=!1),d}return c},i)).trim();return A(async()=>{let c;try{c=await ae(V,E,e)}catch(d){throw d.statusCode===401&&(t=!1),d}return c},i)};return async()=>{let i=await D();if(t)return n?.debug("AWS SDK Instance Metadata","using v1 fallback (no token fetch)"),f(a,{...i,timeout:r});{let E;try{E=(await re({...i,timeout:r})).toString()}catch(T){if(T?.statusCode===400)throw Object.assign(T,{message:"EC2 Metadata token request returned error"});return(T.message==="TimeoutError"||[403,404,405].includes(T.statusCode))&&(t=!0),n?.debug("AWS SDK Instance Metadata","using v1 fallback (initial)"),f(a,{...i,timeout:r})}return f(a,{...i,headers:{[L]:E},timeout:r})}}},re=async e=>m({...e,path:te,method:"PUT",headers:{"x-aws-ec2-metadata-token-ttl-seconds":"21600"}}),ne=async e=>(await m({...e,path:k})).toString(),ae=async(e,t,n)=>{let o=JSON.parse((await m({...t,path:k+e})).toString());if(!N(o))throw new s("Invalid response received from instance metadata service.",{logger:n.logger});return g(o)};export{me as DEFAULT_MAX_RETRIES,pe as DEFAULT_TIMEOUT,y as ENV_CMDS_AUTH_TOKEN,C as ENV_CMDS_FULL_URI,O as ENV_CMDS_RELATIVE_URI,_ as Endpoint,Ne as fromContainerMetadata,Je as fromInstanceMetadata,D as getInstanceMetadataEndpoint,m as httpRequest,h as providerConfigFromInit};

package/dist/dist-es-JCIK4C4M.js

@@ -0,0 +1,2 @@
+import"./chunk-LDZWCNWB.js";import"./chunk-X6LE6K3W.js";import{w as R}from"./chunk-A3H5SUSR.js";import{m as c,n as S,r as O,s as K,t as y,v as E,w as A}from"./chunk-Z4YWESTY.js";import"./chunk-MYIHTCRS.js";import"./chunk-IYWUY3VA.js";var H=e=>e&&(typeof e.sso_start_url=="string"||typeof e.sso_account_id=="string"||typeof e.sso_session=="string"||typeof e.sso_region=="string"||typeof e.sso_role_name=="string");var u="To refresh this SSO session run 'aws sso login' with the corresponding profile.";var U=async(e,o={},r)=>{let{SSOOIDCClient:t}=await import("./sso-oidc-26OCCRMC.js"),n=f=>o.clientConfig?.[f]??o.parentClientConfig?.[f]??r?.[f];return new t(Object.assign({},o.clientConfig??{},{region:e??o.clientConfig?.region,logger:n("logger"),userAgentAppId:n("userAgentAppId")}))};var j=async(e,o,r={},t)=>{let{CreateTokenCommand:n}=await import("./sso-oidc-26OCCRMC.js");return(await U(o,r,t)).send(new n({clientId:e.clientId,clientSecret:e.clientSecret,refreshToken:e.refreshToken,grantType:"refresh_token"}))};var v=e=>{if(e.expiration&&e.expiration.getTime()<Date.now())throw new S(`Token is expired. ${u}`,!1)};var d=(e,o,r=!1)=>{if(typeof o>"u")throw new S(`Value not present for '${e}' in SSO Token${r?". Cannot refresh":""}. ${u}`,!1)};import{promises as V}from"fs";var{writeFile:Y}=V,q=(e,o)=>{let r=K(e),t=JSON.stringify(o,null,2);return Y(r,t)};var W=new Date(0),X=(e={})=>async({callerClientConfig:o}={})=>{e.logger?.debug("@aws-sdk/token-providers - fromSso");let r=await A(e),t=O({profile:e.profile??o?.profile}),n=r[t];if(n){if(!n.sso_session)throw new S(`Profile '${t}' is missing required property 'sso_session'.`)}else throw new S(`Profile '${t}' could not be found in shared credentials file.`,!1);let a=n.sso_session,p=(await E(e))[a];if(!p)throw new S(`Sso session '${a}' could not be found in shared credentials file.`,!1);for(let i of["sso_start_url","sso_region"])if(!p[i])throw new S(`Sso session '${a}' is missing required property '${i}'.`,!1);let g=p.sso_start_url,C=p.sso_region,s;try{s=await y(a)}catch{throw new S(`The SSO session token associated with profile=${t} was not found or is invalid. ${u}`,!1)}d("accessToken",s.accessToken),d("expiresAt",s.expiresAt);let{accessToken:_,expiresAt:k}=s,l={token:_,expiration:new Date(k)};if(l.expiration.getTime()-Date.now()>3e5)return l;if(Date.now()-W.getTime()<30*1e3)return v(l),l;d("clientId",s.clientId,!0),d("clientSecret",s.clientSecret,!0),d("refreshToken",s.refreshToken,!0);try{W.setTime(Date.now());let i=await j(s,C,e,o);d("accessToken",i.accessToken),d("expiresIn",i.expiresIn);let m=new Date(Date.now()+i.expiresIn*1e3);try{await q(a,{...s,accessToken:i.accessToken,expiresAt:m.toISOString(),refreshToken:i.refreshToken})}catch{}return{token:i.accessToken,expiration:m}}catch{return v(l),l}};var T=!1,D=async({ssoStartUrl:e,ssoSession:o,ssoAccountId:r,ssoRegion:t,ssoRoleName:n,ssoClient:a,clientConfig:f,parentClientConfig:p,callerClientConfig:g,profile:C,filepath:s,configFilepath:_,ignoreCache:k,logger:l})=>{let i,m="To refresh this SSO session run aws sso login with the corresponding profile.";if(o)try{let w=await X({profile:C,filepath:s,configFilepath:_,ignoreCache:k})();i={accessToken:w.token,expiresAt:new Date(w.expiration).toISOString()}}catch(w){throw new c(w.message,{tryNextLink:T,logger:l})}else try{i=await y(e)}catch{throw new c(`The SSO session associated with this profile is invalid. ${m}`,{tryNextLink:T,logger:l})}if(new Date(i.expiresAt).getTime()-Date.now()<=0)throw new c(`The SSO session associated with this profile has expired. ${m}`,{tryNextLink:T,logger:l});let{accessToken:I}=i,{SSOClient:h,GetRoleCredentialsCommand:x}=await import("./loadSso-FBBI5PDJ.js"),J=a||new h(Object.assign({},f??{},{logger:f?.logger??g?.logger??p?.logger,region:f?.region??t,userAgentAppId:f?.userAgentAppId??g?.userAgentAppId??p?.userAgentAppId})),F;try{F=await J.send(new x({accountId:r,roleName:n,accessToken:I}))}catch(w){throw new c(w,{tryNextLink:T,logger:l})}let{roleCredentials:{accessKeyId:P,secretAccessKey:$,sessionToken:L,expiration:M,credentialScope:b,accountId:G}={}}=F;if(!P||!$||!L||!M)throw new c("SSO returns an invalid temporary credential.",{tryNextLink:T,logger:l});let N={accessKeyId:P,secretAccessKey:$,sessionToken:L,expiration:new Date(M),...b&&{credentialScope:b},...G&&{accountId:G}};return o?R(N,"CREDENTIALS_SSO","s"):R(N,"CREDENTIALS_SSO_LEGACY","u"),N};var z=(e,o)=>{let{sso_start_url:r,sso_account_id:t,sso_region:n,sso_role_name:a}=e;if(!r||!t||!n||!a)throw new c(`Profile is configured with invalid SSO credentials. Required parameters "sso_account_id", "sso_region", "sso_role_name", "sso_start_url". Got ${Object.keys(e).join(", ")}
+Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html`,{tryNextLink:!1,logger:o});return e};var De=(e={})=>async({callerClientConfig:o}={})=>{e.logger?.debug("@aws-sdk/credential-provider-sso - fromSSO");let{ssoStartUrl:r,ssoAccountId:t,ssoRegion:n,ssoRoleName:a,ssoSession:f}=e,{ssoClient:p}=e,g=O({profile:e.profile??o?.profile});if(!r&&!t&&!n&&!a&&!f){let s=(await A(e))[g];if(!s)throw new c(`Profile ${g} was not found.`,{logger:e.logger});if(!H(s))throw new c(`Profile ${g} is not configured with SSO credentials.`,{logger:e.logger});if(s?.sso_session){let h=(await E(e))[s.sso_session],x=` configurations in profile ${g} and sso-session ${s.sso_session}`;if(n&&n!==h.sso_region)throw new c("Conflicting SSO region"+x,{tryNextLink:!1,logger:e.logger});if(r&&r!==h.sso_start_url)throw new c("Conflicting SSO start_url"+x,{tryNextLink:!1,logger:e.logger});s.sso_region=h.sso_region,s.sso_start_url=h.sso_start_url}let{sso_start_url:_,sso_account_id:k,sso_region:l,sso_role_name:i,sso_session:m}=z(s,e.logger);return D({ssoStartUrl:_,ssoSession:m,ssoAccountId:k,ssoRegion:l,ssoRoleName:i,ssoClient:p,clientConfig:e.clientConfig,parentClientConfig:e.parentClientConfig,callerClientConfig:e.callerClientConfig,profile:g,filepath:e.filepath,configFilepath:e.configFilepath,ignoreCache:e.ignoreCache,logger:e.logger})}else{if(!r||!t||!n||!a)throw new c('Incomplete configuration. The fromSSO() argument hash must include "ssoStartUrl", "ssoAccountId", "ssoRegion", "ssoRoleName"',{tryNextLink:!1,logger:e.logger});return D({ssoStartUrl:r,ssoSession:f,ssoAccountId:t,ssoRegion:n,ssoRoleName:a,ssoClient:p,clientConfig:e.clientConfig,parentClientConfig:e.parentClientConfig,callerClientConfig:e.callerClientConfig,profile:g,filepath:e.filepath,configFilepath:e.configFilepath,ignoreCache:e.ignoreCache,logger:e.logger})}};export{De as fromSSO,H as isSsoProfile,z as validateSsoProfile};

package/dist/dist-es-MFZXYPBY.js

@@ -0,0 +1 @@
+import"./chunk-LDZWCNWB.js";import"./chunk-X6LE6K3W.js";import"./chunk-TW5BOTVX.js";import{w as c}from"./chunk-A3H5SUSR.js";import{f as b,m as l,o as D,r as y,u as L,w as k}from"./chunk-Z4YWESTY.js";import"./chunk-MYIHTCRS.js";import"./chunk-IYWUY3VA.js";var O=(e,r,t)=>{let o={EcsContainer:async s=>{let{fromHttp:i}=await import("./dist-es-FSE4MSDA.js"),{fromContainerMetadata:n}=await import("./dist-es-TCZQ4KMP.js");return t?.debug("@aws-sdk/credential-provider-ini - credential_source is EcsContainer"),async()=>D(i(s??{}),n(s))().then(I)},Ec2InstanceMetadata:async s=>{t?.debug("@aws-sdk/credential-provider-ini - credential_source is Ec2InstanceMetadata");let{fromInstanceMetadata:i}=await import("./dist-es-TCZQ4KMP.js");return async()=>i(s)().then(I)},Environment:async s=>{t?.debug("@aws-sdk/credential-provider-ini - credential_source is Environment");let{fromEnv:i}=await import("./dist-es-FQ6CEUEU.js");return async()=>i(s)().then(I)}};if(e in o)return o[e];throw new l(`Unsupported credential source in profile ${r}. Got ${e}, expected EcsContainer or Ec2InstanceMetadata or Environment.`,{logger:t})},I=e=>c(e,"CREDENTIALS_PROFILE_NAMED_PROVIDER","p");var N=(e,{profile:r="default",logger:t}={})=>!!e&&typeof e=="object"&&typeof e.role_arn=="string"&&["undefined","string"].indexOf(typeof e.role_session_name)>-1&&["undefined","string"].indexOf(typeof e.external_id)>-1&&["undefined","string"].indexOf(typeof e.mfa_serial)>-1&&(Y(e,{profile:r,logger:t})||z(e,{profile:r,logger:t})),Y=(e,{profile:r,logger:t})=>{let o=typeof e.source_profile=="string"&&typeof e.credential_source>"u";return o&&t?.debug?.(`    ${r} isAssumeRoleWithSourceProfile source_profile=${e.source_profile}`),o},z=(e,{profile:r,logger:t})=>{let o=typeof e.credential_source=="string"&&typeof e.source_profile>"u";return o&&t?.debug?.(`    ${r} isCredentialSourceProfile credential_source=${e.credential_source}`),o},$=async(e,r,t,o,s={},i)=>{t.logger?.debug("@aws-sdk/credential-provider-ini - resolveAssumeRoleCredentials (STS)");let n=r[e],{source_profile:a,region:p}=n;if(!t.roleAssumer){let{getDefaultRoleAssumer:u}=await import("./sts-CP4OREEC.js");t.roleAssumer=u({...t.clientConfig,credentialProviderLogger:t.logger,parentClientConfig:{...o,...t?.parentClientConfig,region:p??t?.parentClientConfig?.region??o?.region}},t.clientPlugins)}if(a&&a in s)throw new l(`Detected a cycle attempting to resolve credentials for profile ${y(t)}. Profiles visited: `+Object.keys(s).join(", "),{logger:t.logger});t.logger?.debug(`@aws-sdk/credential-provider-ini - finding credential resolver using ${a?`source_profile=[${a}]`:`profile=[${e}]`}`);let m=a?i(a,r,t,o,{...s,[a]:!0},F(r[a]??{})):(await O(n.credential_source,e,t.logger)(t))();if(F(n))return m.then(u=>c(u,"CREDENTIALS_PROFILE_SOURCE_PROFILE","o"));{let u={RoleArn:n.role_arn,RoleSessionName:n.role_session_name||`aws-sdk-js-${Date.now()}`,ExternalId:n.external_id,DurationSeconds:parseInt(n.duration_seconds||"3600",10)},{mfa_serial:d}=n;if(d){if(!t.mfaCodeProvider)throw new l(`Profile ${e} requires multi-factor authentication, but no MFA code callback was provided.`,{logger:t.logger,tryNextLink:!1});u.SerialNumber=d,u.TokenCode=await t.mfaCodeProvider(d)}let g=await m;return t.roleAssumer(g,u).then(f=>c(f,"CREDENTIALS_PROFILE_SOURCE_PROFILE","o"))}},F=e=>!e.role_arn&&!!e.credential_source;import{createHash as V,createPrivateKey as X,createPublicKey as Q,sign as Z}from"crypto";import{promises as P}from"fs";import{homedir as ee}from"os";import{dirname as te,join as K}from"path";var E=class e{profileData;init;callerClientConfig;static REFRESH_THRESHOLD=300*1e3;constructor(r,t,o){this.profileData=r,this.init=t,this.callerClientConfig=o}async loadCredentials(){let r=await this.loadToken();if(!r)throw new l(`Failed to load a token for session ${this.loginSession}, please re-authenticate using aws login`,{tryNextLink:!1,logger:this.logger});let t=r.accessToken,o=Date.now();return new Date(t.expiresAt).getTime()-o<=e.REFRESH_THRESHOLD?this.refresh(r):{accessKeyId:t.accessKeyId,secretAccessKey:t.secretAccessKey,sessionToken:t.sessionToken,accountId:t.accountId,expiration:new Date(t.expiresAt)}}get logger(){return this.init?.logger}get loginSession(){return this.profileData.login_session}async refresh(r){let{SigninClient:t,CreateOAuth2TokenCommand:o}=await import("./signin-CJMG23UU.js"),{logger:s,userAgentAppId:i}=this.callerClientConfig??{},a=(d=>d?.metadata?.handlerProtocol==="h2")(this.callerClientConfig?.requestHandler)?void 0:this.callerClientConfig?.requestHandler,p=this.profileData.region??await this.callerClientConfig?.region?.()??process.env.AWS_REGION,m=new t({credentials:{accessKeyId:"",secretAccessKey:""},region:p,requestHandler:a,logger:s,userAgentAppId:i,...this.init?.clientConfig});this.createDPoPInterceptor(m.middlewareStack);let u={tokenInput:{clientId:r.clientId,refreshToken:r.refreshToken,grantType:"refresh_token"}};try{let d=await m.send(new o(u)),{accessKeyId:g,secretAccessKey:f,sessionToken:_}=d.tokenOutput?.accessToken??{},{refreshToken:w,expiresIn:R}=d.tokenOutput??{};if(!g||!f||!_||!w)throw new l("Token refresh response missing required fields",{logger:this.logger,tryNextLink:!1});let S=(R??900)*1e3,h=new Date(Date.now()+S),A={...r,accessToken:{...r.accessToken,accessKeyId:g,secretAccessKey:f,sessionToken:_,expiresAt:h.toISOString()},refreshToken:w};await this.saveToken(A);let C=A.accessToken;return{accessKeyId:C.accessKeyId,secretAccessKey:C.secretAccessKey,sessionToken:C.sessionToken,accountId:C.accountId,expiration:h}}catch(d){if(d.name==="AccessDeniedException"){let g=d.error,f;switch(g){case"TOKEN_EXPIRED":f="Your session has expired. Please reauthenticate.";break;case"USER_CREDENTIALS_CHANGED":f="Unable to refresh credentials because of a change in your password. Please reauthenticate with your new password.";break;case"INSUFFICIENT_PERMISSIONS":f="Unable to refresh credentials due to insufficient permissions. You may be missing permission for the 'CreateOAuth2Token' action.";break;default:f=`Failed to refresh token: ${String(d)}. Please re-authenticate using \`aws login\``}throw new l(f,{logger:this.logger,tryNextLink:!1})}throw new l(`Failed to refresh token: ${String(d)}. Please re-authenticate using aws login`,{logger:this.logger})}}async loadToken(){let r=this.getTokenFilePath();try{let t;try{t=await L(r,{ignoreCache:this.init?.ignoreCache})}catch{t=await P.readFile(r,"utf8")}let o=JSON.parse(t),s=["accessToken","clientId","refreshToken","dpopKey"].filter(i=>!o[i]);if(o.accessToken?.accountId||s.push("accountId"),s.length>0)throw new l(`Token validation failed, missing fields: ${s.join(", ")}`,{logger:this.logger,tryNextLink:!1});return o}catch(t){throw new l(`Failed to load token from ${r}: ${String(t)}`,{logger:this.logger,tryNextLink:!1})}}async saveToken(r){let t=this.getTokenFilePath(),o=te(t);try{await P.mkdir(o,{recursive:!0})}catch{}await P.writeFile(t,JSON.stringify(r,null,2),"utf8")}getTokenFilePath(){let r=process.env.AWS_LOGIN_CACHE_DIRECTORY??K(ee(),".aws","login","cache"),t=Buffer.from(this.loginSession,"utf8"),o=V("sha256").update(t).digest("hex");return K(r,`${o}.json`)}derToRawSignature(r){let t=2;if(r[t]!==2)throw new Error("Invalid DER signature");t++;let o=r[t++],s=r.subarray(t,t+o);if(t+=o,r[t]!==2)throw new Error("Invalid DER signature");t++;let i=r[t++],n=r.subarray(t,t+i);s=s[0]===0?s.subarray(1):s,n=n[0]===0?n.subarray(1):n;let a=Buffer.concat([Buffer.alloc(32-s.length),s]),p=Buffer.concat([Buffer.alloc(32-n.length),n]);return Buffer.concat([a,p])}createDPoPInterceptor(r){r.add(t=>async o=>{if(b.isInstance(o.request)){let s=o.request,i=`${s.protocol}//${s.hostname}${s.port?`:${s.port}`:""}${s.path}`,n=await this.generateDpop(s.method,i);s.headers={...s.headers,DPoP:n}}return t(o)},{step:"finalizeRequest",name:"dpopInterceptor",override:!0})}async generateDpop(r="POST",t){let o=await this.loadToken();try{let s=X({key:o.dpopKey,format:"pem",type:"sec1"}),n=Q(s).export({format:"der",type:"spki"}),a=-1;for(let h=0;h<n.length;h++)if(n[h]===4){a=h;break}let p=n.slice(a+1,a+33),m=n.slice(a+33,a+65),u={alg:"ES256",typ:"dpop+jwt",jwk:{kty:"EC",crv:"P-256",x:p.toString("base64url"),y:m.toString("base64url")}},d={jti:crypto.randomUUID(),htm:r,htu:t,iat:Math.floor(Date.now()/1e3)},g=Buffer.from(JSON.stringify(u)).toString("base64url"),f=Buffer.from(JSON.stringify(d)).toString("base64url"),_=`${g}.${f}`,w=Z("sha256",Buffer.from(_),s),S=this.derToRawSignature(w).toString("base64url");return`${_}.${S}`}catch(s){throw new l(`Failed to generate Dpop proof: ${s instanceof Error?s.message:String(s)}`,{logger:this.logger,tryNextLink:!1})}}};var B=e=>async({callerClientConfig:r}={})=>{e?.logger?.debug?.("@aws-sdk/credential-providers - fromLoginCredentials");let t=await k(e||{}),o=y({profile:e?.profile??r?.profile}),s=t[o];if(!s?.login_session)throw new l(`Profile ${o} does not contain login_session.`,{tryNextLink:!0,logger:e?.logger});let n=await new E(s,e,r).loadCredentials();return c(n,"CREDENTIALS_LOGIN","AD")};var H=e=>!!(e&&e.login_session),j=async(e,r,t)=>{let o=await B({...r,profile:e})({callerClientConfig:t});return c(o,"CREDENTIALS_PROFILE_LOGIN","AC")};var W=e=>!!e&&typeof e=="object"&&typeof e.credential_process=="string",q=async(e,r)=>import("./dist-es-BORZTE76.js").then(({fromProcess:t})=>t({...e,profile:r})().then(o=>c(o,"CREDENTIALS_PROFILE_PROCESS","v")));var M=async(e,r,t={},o)=>{let{fromSSO:s}=await import("./dist-es-Y7VP7FI6.js");return s({profile:e,logger:t.logger,parentClientConfig:t.parentClientConfig,clientConfig:t.clientConfig})({callerClientConfig:o}).then(i=>r.sso_session?c(i,"CREDENTIALS_PROFILE_SSO","r"):c(i,"CREDENTIALS_PROFILE_SSO_LEGACY","t"))},U=e=>e&&(typeof e.sso_start_url=="string"||typeof e.sso_account_id=="string"||typeof e.sso_session=="string"||typeof e.sso_region=="string"||typeof e.sso_role_name=="string");var T=e=>!!e&&typeof e=="object"&&typeof e.aws_access_key_id=="string"&&typeof e.aws_secret_access_key=="string"&&["undefined","string"].indexOf(typeof e.aws_session_token)>-1&&["undefined","string"].indexOf(typeof e.aws_account_id)>-1,x=async(e,r)=>{r?.logger?.debug("@aws-sdk/credential-provider-ini - resolveStaticCredentials");let t={accessKeyId:e.aws_access_key_id,secretAccessKey:e.aws_secret_access_key,sessionToken:e.aws_session_token,...e.aws_credential_scope&&{credentialScope:e.aws_credential_scope},...e.aws_account_id&&{accountId:e.aws_account_id}};return c(t,"CREDENTIALS_PROFILE","n")};var G=e=>!!e&&typeof e=="object"&&typeof e.web_identity_token_file=="string"&&typeof e.role_arn=="string"&&["undefined","string"].indexOf(typeof e.role_session_name)>-1,J=async(e,r,t)=>import("./dist-es-7HF5URFJ.js").then(({fromTokenFile:o})=>o({webIdentityTokenFile:e.web_identity_token_file,roleArn:e.role_arn,roleSessionName:e.role_session_name,roleAssumerWithWebIdentity:r.roleAssumerWithWebIdentity,logger:r.logger,parentClientConfig:r.parentClientConfig})({callerClientConfig:t}).then(s=>c(s,"CREDENTIALS_PROFILE_STS_WEB_ID_TOKEN","q")));var v=async(e,r,t,o,s={},i=!1)=>{let n=r[e];if(Object.keys(s).length>0&&T(n))return x(n,t);if(i||N(n,{profile:e,logger:t.logger}))return $(e,r,t,o,s,v);if(T(n))return x(n,t);if(G(n))return J(n,t,o);if(W(n))return q(t,e);if(U(n))return await M(e,n,t,o);if(H(n))return j(e,t,o);throw new l(`Could not resolve credentials using profile: [${e}] in configuration/credentials file(s).`,{logger:t.logger})};var Me=(e={})=>async({callerClientConfig:r}={})=>{e.logger?.debug("@aws-sdk/credential-provider-ini - fromIni");let t=await k(e);return v(y({profile:e.profile??r?.profile}),t,e,r)};export{Me as fromIni};

package/dist/dist-es-PREZ4TU2.js

@@ -0,0 +1 @@
+import"./chunk-LDZWCNWB.js";import"./chunk-X6LE6K3W.js";import{w as f}from"./chunk-A3H5SUSR.js";import{m as c,r as l,w as p,x as a}from"./chunk-Z4YWESTY.js";import"./chunk-MYIHTCRS.js";import"./chunk-IYWUY3VA.js";import{exec as m}from"child_process";import{promisify as P}from"util";var u=(r,e,o)=>{if(e.Version!==1)throw Error(`Profile ${r} credential_process did not return Version 1.`);if(e.AccessKeyId===void 0||e.SecretAccessKey===void 0)throw Error(`Profile ${r} credential_process returned invalid credentials.`);if(e.Expiration){let i=new Date;if(new Date(e.Expiration)<i)throw Error(`Profile ${r} credential_process returned expired credentials.`)}let s=e.AccountId;!s&&o?.[r]?.aws_account_id&&(s=o[r].aws_account_id);let t={accessKeyId:e.AccessKeyId,secretAccessKey:e.SecretAccessKey,...e.SessionToken&&{sessionToken:e.SessionToken},...e.Expiration&&{expiration:new Date(e.Expiration)},...e.CredentialScope&&{credentialScope:e.CredentialScope},...s&&{accountId:s}};return f(t,"CREDENTIALS_PROCESS","w"),t};var w=async(r,e,o)=>{let s=e[r];if(e[r]){let t=s.credential_process;if(t!==void 0){let i=P(a?.getTokenRecord?.().exec??m);try{let{stdout:n}=await i(t),d;try{d=JSON.parse(n.trim())}catch{throw Error(`Profile ${r} credential_process returned invalid JSON.`)}return u(r,d,e)}catch(n){throw new c(n.message,{logger:o})}}else throw new c(`Profile ${r} did not contain credential_process.`,{logger:o})}else throw new c(`Profile ${r} could not be found in shared credentials file.`,{logger:o})};var K=(r={})=>async({callerClientConfig:e}={})=>{r.logger?.debug("@aws-sdk/credential-provider-process - fromProcess");let o=await p(r);return w(l({profile:r.profile??e?.profile}),o,r.logger)};export{K as fromProcess};

package/dist/dist-es-TCZQ4KMP.js

@@ -0,0 +1,2 @@
+import{j as M,l as S,m as s,y as u}from"./chunk-Z4YWESTY.js";import"./chunk-MYIHTCRS.js";import"./chunk-IYWUY3VA.js";import{parse as K}from"url";var N=e=>!!e&&typeof e=="object"&&typeof e.AccessKeyId=="string"&&typeof e.SecretAccessKey=="string"&&typeof e.Token=="string"&&typeof e.Expiration=="string",g=e=>({accessKeyId:e.AccessKeyId,secretAccessKey:e.SecretAccessKey,sessionToken:e.Token,expiration:new Date(e.Expiration),...e.AccountId&&{accountId:e.AccountId}});var se=1e3,ie=0,h=({maxRetries:e=0,timeout:t=1e3})=>({maxRetries:e,timeout:t});import{request as W}from"http";function m(e){return new Promise((t,n)=>{let o=W({method:"GET",...e,hostname:e.hostname?.replace(/^\[(.+)\]$/,"$1")});o.on("error",r=>{n(Object.assign(new S("Unable to connect to instance metadata service"),r)),o.destroy()}),o.on("timeout",()=>{n(new S("TimeoutError from instance metadata service")),o.destroy()}),o.on("response",r=>{let{statusCode:a=400}=r;(a<200||300<=a)&&(n(Object.assign(new S("Error response received from instance metadata service"),{statusCode:a})),o.destroy());let f=[];r.on("data",i=>{f.push(i)}),r.on("end",()=>{t(Buffer.concat(f)),o.destroy()})}),o.end()})}var A=(e,t)=>{let n=e();for(let o=0;o<t;o++)n=n.catch(e);return n};var C="AWS_CONTAINER_CREDENTIALS_FULL_URI",O="AWS_CONTAINER_CREDENTIALS_RELATIVE_URI",y="AWS_CONTAINER_AUTHORIZATION_TOKEN",Ae=(e={})=>{let{timeout:t,maxRetries:n}=h(e);return()=>A(async()=>{let o=await H({logger:e.logger}),r=JSON.parse(await $(t,o));if(!N(r))throw new s("Invalid response received from instance metadata service.",{logger:e.logger});return g(r)},n)},$=async(e,t)=>(process.env[y]&&(t.headers={...t.headers,Authorization:process.env[y]}),(await m({...t,timeout:e})).toString()),B="169.254.170.2",G={localhost:!0,"127.0.0.1":!0},q={"http:":!0,"https:":!0},H=async({logger:e})=>{if(process.env[O])return{hostname:B,path:process.env[O]};if(process.env[C]){let t=K(process.env[C]);if(!t.hostname||!(t.hostname in G))throw new s(`${t.hostname} is not a valid container metadata service hostname`,{tryNextLink:!1,logger:e});if(!t.protocol||!(t.protocol in q))throw new s(`${t.protocol} is not a valid container metadata service protocol`,{tryNextLink:!1,logger:e});return{...t,port:t.port?parseInt(t.port,10):void 0}}throw new s(`The container metadata credential provider cannot be used unless the ${O} or ${C} environment variable is set`,{tryNextLink:!1,logger:e})};var v=class e extends s{tryNextLink;name="InstanceMetadataV1FallbackError";constructor(t,n=!0){super(t,n),this.tryNextLink=n,Object.setPrototypeOf(this,e.prototype)}};var _;(function(e){e.IPv4="http://169.254.169.254",e.IPv6="http://[fd00:ec2::254]"})(_||(_={}));var j="AWS_EC2_METADATA_SERVICE_ENDPOINT",Y="ec2_metadata_service_endpoint",P={environmentVariableSelector:e=>e[j],configFileSelector:e=>e[Y],default:void 0};var p;(function(e){e.IPv4="IPv4",e.IPv6="IPv6"})(p||(p={}));var J="AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE",z="ec2_metadata_service_endpoint_mode",R={environmentVariableSelector:e=>e[J],configFileSelector:e=>e[z],default:p.IPv4};var D=async()=>M(await X()||await Z()),X=async()=>u(P)(),Z=async()=>{let e=await u(R)();switch(e){case p.IPv4:return _.IPv4;case p.IPv6:return _.IPv6;default:throw new Error(`Unsupported endpoint mode: ${e}. Select from ${Object.values(p)}`)}};var Q="https://docs.aws.amazon.com/sdkref/latest/guide/feature-static-credentials.html",w=(e,t)=>{let n=300+Math.floor(Math.random()*300),o=new Date(Date.now()+n*1e3);t.warn(`Attempting credential expiration extension due to a credential service availability issue. A refresh of these credentials will be attempted after ${new Date(o)}.
+For more information, please visit: `+Q);let r=e.originalExpiration??e.expiration;return{...e,...r?{originalExpiration:r}:{},expiration:o}};var b=(e,t={})=>{let n=t?.logger||console,o;return async()=>{let r;try{r=await e(),r.expiration&&r.expiration.getTime()<Date.now()&&(r=w(r,n))}catch(a){if(o)n.warn("Credential renew failed: ",a),r=w(o,n);else throw a}return o=r,r}};var k="/latest/meta-data/iam/security-credentials/",ee="/latest/api/token",x="AWS_EC2_METADATA_V1_DISABLED",F="ec2_metadata_v1_disabled",L="x-aws-ec2-metadata-token",He=(e={})=>b(te(e),{logger:e.logger}),te=(e={})=>{let t=!1,{logger:n,profile:o}=e,{timeout:r,maxRetries:a}=h(e),f=async(i,E)=>{if(t||E.headers?.[L]==null){let c=!1,d=!1,U=await u({environmentVariableSelector:l=>{let I=l[x];if(d=!!I&&I!=="false",I===void 0)throw new s(`${x} not set in env, checking config file next.`,{logger:e.logger});return d},configFileSelector:l=>{let I=l[F];return c=!!I&&I!=="false",c},default:!1},{profile:o})();if(e.ec2MetadataV1Disabled||U){let l=[];throw e.ec2MetadataV1Disabled&&l.push("credential provider initialization (runtime option ec2MetadataV1Disabled)"),c&&l.push(`config file profile (${F})`),d&&l.push(`process environment variable (${x})`),new v(`AWS EC2 Metadata v1 fallback has been blocked by AWS SDK configuration in the following: [${l.join(", ")}].`)}}let V=(await A(async()=>{let c;try{c=await re(E)}catch(d){throw d.statusCode===401&&(t=!1),d}return c},i)).trim();return A(async()=>{let c;try{c=await ne(V,E,e)}catch(d){throw d.statusCode===401&&(t=!1),d}return c},i)};return async()=>{let i=await D();if(t)return n?.debug("AWS SDK Instance Metadata","using v1 fallback (no token fetch)"),f(a,{...i,timeout:r});{let E;try{E=(await oe({...i,timeout:r})).toString()}catch(T){if(T?.statusCode===400)throw Object.assign(T,{message:"EC2 Metadata token request returned error"});return(T.message==="TimeoutError"||[403,404,405].includes(T.statusCode))&&(t=!0),n?.debug("AWS SDK Instance Metadata","using v1 fallback (initial)"),f(a,{...i,timeout:r})}return f(a,{...i,headers:{[L]:E},timeout:r})}}},oe=async e=>m({...e,path:ee,method:"PUT",headers:{"x-aws-ec2-metadata-token-ttl-seconds":"21600"}}),re=async e=>(await m({...e,path:k})).toString(),ne=async(e,t,n)=>{let o=JSON.parse((await m({...t,path:k+e})).toString());if(!N(o))throw new s("Invalid response received from instance metadata service.",{logger:n.logger});return g(o)};export{ie as DEFAULT_MAX_RETRIES,se as DEFAULT_TIMEOUT,y as ENV_CMDS_AUTH_TOKEN,C as ENV_CMDS_FULL_URI,O as ENV_CMDS_RELATIVE_URI,_ as Endpoint,Ae as fromContainerMetadata,He as fromInstanceMetadata,D as getInstanceMetadataEndpoint,m as httpRequest,h as providerConfigFromInit};

package/dist/dist-es-Y7VP7FI6.js

@@ -0,0 +1,2 @@
+import"./chunk-LDZWCNWB.js";import"./chunk-X6LE6K3W.js";import{w as R}from"./chunk-A3H5SUSR.js";import{m as c,n as S,r as O,s as K,t as y,v as E,w as A}from"./chunk-Z4YWESTY.js";import"./chunk-MYIHTCRS.js";import"./chunk-IYWUY3VA.js";var H=e=>e&&(typeof e.sso_start_url=="string"||typeof e.sso_account_id=="string"||typeof e.sso_session=="string"||typeof e.sso_region=="string"||typeof e.sso_role_name=="string");var u="To refresh this SSO session run 'aws sso login' with the corresponding profile.";var U=async(e,o={},r)=>{let{SSOOIDCClient:t}=await import("./sso-oidc-26OCCRMC.js"),n=f=>o.clientConfig?.[f]??o.parentClientConfig?.[f]??r?.[f];return new t(Object.assign({},o.clientConfig??{},{region:e??o.clientConfig?.region,logger:n("logger"),userAgentAppId:n("userAgentAppId")}))};var j=async(e,o,r={},t)=>{let{CreateTokenCommand:n}=await import("./sso-oidc-26OCCRMC.js");return(await U(o,r,t)).send(new n({clientId:e.clientId,clientSecret:e.clientSecret,refreshToken:e.refreshToken,grantType:"refresh_token"}))};var v=e=>{if(e.expiration&&e.expiration.getTime()<Date.now())throw new S(`Token is expired. ${u}`,!1)};var d=(e,o,r=!1)=>{if(typeof o>"u")throw new S(`Value not present for '${e}' in SSO Token${r?". Cannot refresh":""}. ${u}`,!1)};import{promises as V}from"fs";var{writeFile:Y}=V,q=(e,o)=>{let r=K(e),t=JSON.stringify(o,null,2);return Y(r,t)};var W=new Date(0),X=(e={})=>async({callerClientConfig:o}={})=>{e.logger?.debug("@aws-sdk/token-providers - fromSso");let r=await A(e),t=O({profile:e.profile??o?.profile}),n=r[t];if(n){if(!n.sso_session)throw new S(`Profile '${t}' is missing required property 'sso_session'.`)}else throw new S(`Profile '${t}' could not be found in shared credentials file.`,!1);let a=n.sso_session,p=(await E(e))[a];if(!p)throw new S(`Sso session '${a}' could not be found in shared credentials file.`,!1);for(let i of["sso_start_url","sso_region"])if(!p[i])throw new S(`Sso session '${a}' is missing required property '${i}'.`,!1);let g=p.sso_start_url,C=p.sso_region,s;try{s=await y(a)}catch{throw new S(`The SSO session token associated with profile=${t} was not found or is invalid. ${u}`,!1)}d("accessToken",s.accessToken),d("expiresAt",s.expiresAt);let{accessToken:_,expiresAt:k}=s,l={token:_,expiration:new Date(k)};if(l.expiration.getTime()-Date.now()>3e5)return l;if(Date.now()-W.getTime()<30*1e3)return v(l),l;d("clientId",s.clientId,!0),d("clientSecret",s.clientSecret,!0),d("refreshToken",s.refreshToken,!0);try{W.setTime(Date.now());let i=await j(s,C,e,o);d("accessToken",i.accessToken),d("expiresIn",i.expiresIn);let m=new Date(Date.now()+i.expiresIn*1e3);try{await q(a,{...s,accessToken:i.accessToken,expiresAt:m.toISOString(),refreshToken:i.refreshToken})}catch{}return{token:i.accessToken,expiration:m}}catch{return v(l),l}};var T=!1,D=async({ssoStartUrl:e,ssoSession:o,ssoAccountId:r,ssoRegion:t,ssoRoleName:n,ssoClient:a,clientConfig:f,parentClientConfig:p,callerClientConfig:g,profile:C,filepath:s,configFilepath:_,ignoreCache:k,logger:l})=>{let i,m="To refresh this SSO session run aws sso login with the corresponding profile.";if(o)try{let w=await X({profile:C,filepath:s,configFilepath:_,ignoreCache:k})();i={accessToken:w.token,expiresAt:new Date(w.expiration).toISOString()}}catch(w){throw new c(w.message,{tryNextLink:T,logger:l})}else try{i=await y(e)}catch{throw new c(`The SSO session associated with this profile is invalid. ${m}`,{tryNextLink:T,logger:l})}if(new Date(i.expiresAt).getTime()-Date.now()<=0)throw new c(`The SSO session associated with this profile has expired. ${m}`,{tryNextLink:T,logger:l});let{accessToken:I}=i,{SSOClient:h,GetRoleCredentialsCommand:x}=await import("./loadSso-2XZQIDZP.js"),J=a||new h(Object.assign({},f??{},{logger:f?.logger??g?.logger??p?.logger,region:f?.region??t,userAgentAppId:f?.userAgentAppId??g?.userAgentAppId??p?.userAgentAppId})),F;try{F=await J.send(new x({accountId:r,roleName:n,accessToken:I}))}catch(w){throw new c(w,{tryNextLink:T,logger:l})}let{roleCredentials:{accessKeyId:P,secretAccessKey:$,sessionToken:L,expiration:M,credentialScope:b,accountId:G}={}}=F;if(!P||!$||!L||!M)throw new c("SSO returns an invalid temporary credential.",{tryNextLink:T,logger:l});let N={accessKeyId:P,secretAccessKey:$,sessionToken:L,expiration:new Date(M),...b&&{credentialScope:b},...G&&{accountId:G}};return o?R(N,"CREDENTIALS_SSO","s"):R(N,"CREDENTIALS_SSO_LEGACY","u"),N};var z=(e,o)=>{let{sso_start_url:r,sso_account_id:t,sso_region:n,sso_role_name:a}=e;if(!r||!t||!n||!a)throw new c(`Profile is configured with invalid SSO credentials. Required parameters "sso_account_id", "sso_region", "sso_role_name", "sso_start_url". Got ${Object.keys(e).join(", ")}
+Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html`,{tryNextLink:!1,logger:o});return e};var De=(e={})=>async({callerClientConfig:o}={})=>{e.logger?.debug("@aws-sdk/credential-provider-sso - fromSSO");let{ssoStartUrl:r,ssoAccountId:t,ssoRegion:n,ssoRoleName:a,ssoSession:f}=e,{ssoClient:p}=e,g=O({profile:e.profile??o?.profile});if(!r&&!t&&!n&&!a&&!f){let s=(await A(e))[g];if(!s)throw new c(`Profile ${g} was not found.`,{logger:e.logger});if(!H(s))throw new c(`Profile ${g} is not configured with SSO credentials.`,{logger:e.logger});if(s?.sso_session){let h=(await E(e))[s.sso_session],x=` configurations in profile ${g} and sso-session ${s.sso_session}`;if(n&&n!==h.sso_region)throw new c("Conflicting SSO region"+x,{tryNextLink:!1,logger:e.logger});if(r&&r!==h.sso_start_url)throw new c("Conflicting SSO start_url"+x,{tryNextLink:!1,logger:e.logger});s.sso_region=h.sso_region,s.sso_start_url=h.sso_start_url}let{sso_start_url:_,sso_account_id:k,sso_region:l,sso_role_name:i,sso_session:m}=z(s,e.logger);return D({ssoStartUrl:_,ssoSession:m,ssoAccountId:k,ssoRegion:l,ssoRoleName:i,ssoClient:p,clientConfig:e.clientConfig,parentClientConfig:e.parentClientConfig,callerClientConfig:e.callerClientConfig,profile:g,filepath:e.filepath,configFilepath:e.configFilepath,ignoreCache:e.ignoreCache,logger:e.logger})}else{if(!r||!t||!n||!a)throw new c('Incomplete configuration. The fromSSO() argument hash must include "ssoStartUrl", "ssoAccountId", "ssoRegion", "ssoRoleName"',{tryNextLink:!1,logger:e.logger});return D({ssoStartUrl:r,ssoSession:f,ssoAccountId:t,ssoRegion:n,ssoRoleName:a,ssoClient:p,clientConfig:e.clientConfig,parentClientConfig:e.parentClientConfig,callerClientConfig:e.callerClientConfig,profile:g,filepath:e.filepath,configFilepath:e.configFilepath,ignoreCache:e.ignoreCache,logger:e.logger})}};export{De as fromSSO,H as isSsoProfile,z as validateSsoProfile};

package/dist/dist-es-YN4LRIZR.js

@@ -0,0 +1,5 @@
+import"./chunk-SYWJHPRX.js";import"./chunk-X6LE6K3W.js";import{a as l}from"./chunk-MGGNSWUA.js";import"./chunk-WJLTO7JW.js";import"./chunk-TW5BOTVX.js";import{w as C}from"./chunk-A3H5SUSR.js";import{f as A,m as a}from"./chunk-Z4YWESTY.js";import{g as T,x as h}from"./chunk-MYIHTCRS.js";import"./chunk-IYWUY3VA.js";import g from"fs/promises";var u="169.254.170.2",R="169.254.170.23",w="[fd00:ec2::23]",p=(e,o)=>{if(e.protocol!=="https:"&&!(e.hostname===u||e.hostname===R||e.hostname===w)){if(e.hostname.includes("[")){if(e.hostname==="[::1]"||e.hostname==="[0000:0000:0000:0000:0000:0000:0000:0001]")return}else{if(e.hostname==="localhost")return;let n=e.hostname.split("."),r=t=>{let s=parseInt(t,10);return 0<=s&&s<=255};if(n[0]==="127"&&r(n[1])&&r(n[2])&&r(n[3])&&n.length===4)return}throw new a(`URL not accepted. It must either be HTTPS or match one of the following:
+  - loopback CIDR 127.0.0.0/8 or [::1/128]
+  - ECS container host 169.254.170.2
+  - EKS container host 169.254.170.23 or [fd00:ec2::23]`,{logger:o})}};function _(e){return new A({protocol:e.protocol,hostname:e.hostname,port:Number(e.port),path:e.pathname,query:Array.from(e.searchParams.entries()).reduce((o,[n,r])=>(o[n]=r,o),{}),fragment:e.hash})}async function I(e,o){let r=await h(e.body).transformToString();if(e.statusCode===200){let t=JSON.parse(r);if(typeof t.AccessKeyId!="string"||typeof t.SecretAccessKey!="string"||typeof t.Token!="string"||typeof t.Expiration!="string")throw new a("HTTP credential provider response not of the required format, an object matching: { AccessKeyId: string, SecretAccessKey: string, Token: string, Expiration: string(rfc3339) }",{logger:o});return{accessKeyId:t.AccessKeyId,secretAccessKey:t.SecretAccessKey,sessionToken:t.Token,expiration:T(t.Expiration)}}if(e.statusCode>=400&&e.statusCode<500){let t={};try{t=JSON.parse(r)}catch{}throw Object.assign(new a(`Server responded with status: ${e.statusCode}`,{logger:o}),{Code:t.Code,Message:t.Message})}throw new a(`Server responded with status: ${e.statusCode}`,{logger:o})}var f=(e,o,n)=>async()=>{for(let r=0;r<o;++r)try{return await e()}catch{await new Promise(s=>setTimeout(s,n))}return await e()};var S="AWS_CONTAINER_CREDENTIALS_RELATIVE_URI",O="http://169.254.170.2",L="AWS_CONTAINER_CREDENTIALS_FULL_URI",y="AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE",v="AWS_CONTAINER_AUTHORIZATION_TOKEN",U=(e={})=>{e.logger?.debug("@aws-sdk/credential-provider-http - fromHttp");let o,n=e.awsContainerCredentialsRelativeUri??process.env[S],r=e.awsContainerCredentialsFullUri??process.env[L],t=e.awsContainerAuthorizationToken??process.env[v],s=e.awsContainerAuthorizationTokenFile??process.env[y],i=e.logger?.constructor?.name==="NoOpLogger"||!e.logger?.warn?console.warn:e.logger.warn.bind(e.logger);if(n&&r&&(i("@aws-sdk/credential-provider-http: you have set both awsContainerCredentialsRelativeUri and awsContainerCredentialsFullUri."),i("awsContainerCredentialsFullUri will take precedence.")),t&&s&&(i("@aws-sdk/credential-provider-http: you have set both awsContainerAuthorizationToken and awsContainerAuthorizationTokenFile."),i("awsContainerAuthorizationToken will take precedence.")),r)o=r;else if(n)o=`${O}${n}`;else throw new a(`No HTTP credential provider host provided.
+Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.`,{logger:e.logger});let m=new URL(o);p(m,e.logger);let E=l.create({requestTimeout:e.timeout??1e3,connectionTimeout:e.timeout??1e3});return f(async()=>{let c=_(m);t?c.headers.Authorization=t:s&&(c.headers.Authorization=(await g.readFile(s)).toString());try{let d=await E.handle(c);return I(d.response).then(N=>C(N,"CREDENTIALS_HTTP","z"))}catch(d){throw new a(String(d),{logger:e.logger})}},e.maxRetries??3,e.timeout??1e3)};export{U as fromHttp};

package/dist/event-streams-TNY7XPBF.js

@@ -0,0 +1 @@
+import{c as R,e as W,s as q,t as S}from"./chunk-MYIHTCRS.js";import"./chunk-IYWUY3VA.js";var P=new Uint32Array(256);for(let s=0;s<256;++s){let e=s;for(let t=0;t<8;++t)e=e&1?3988292384^e>>>1:e>>>1;P[s]=e>>>0}var F=4294967295,G=class{digestLength=4;checksum=F;update(e){for(let t=0;t<e.length;++t)this.checksum=this.checksum>>>8^P[(this.checksum^e[t])&255]}digestSync(){return(this.checksum^F)>>>0}async digest(){let e=this.digestSync(),t=new Uint8Array(4);return new DataView(t.buffer).setUint32(0,e,!1),t}reset(){this.checksum=F}};import*as j from"zlib";var V=typeof j.crc32=="function"?j.crc32:void 0,k=V?_(V):G;function _(s){return class{digestLength=4;value=0;update(t){this.value=s(t,this.value)}digestSync(){return this.value>>>0}async digest(){let t=new Uint8Array(4);return new DataView(t.buffer).setUint32(0,this.digestSync(),!1),t}reset(){this.value=0}}}var U=class s{bytes;constructor(e){if(this.bytes=e,e.byteLength!==8)throw new Error("Int64 buffers must be exactly 8 bytes")}static fromNumber(e){if(e>9223372036854776e3||e<-9223372036854776e3)throw new Error(`${e} is too large (or, if negative, too small) to represent as an Int64`);let t=new Uint8Array(8);for(let r=7,n=Math.abs(Math.round(e));r>-1&&n>0;r--,n/=256)t[r]=n;return e<0&&Q(t),new s(t)}valueOf(){let e=this.bytes.slice(0),t=e[0]&128;return t&&Q(e),parseInt(S(e),16)*(t?-1:1)}toString(){return String(this.valueOf())}};function Q(s){for(let e=0;e<8;e++)s[e]^=255;for(let e=7;e>-1&&(s[e]++,s[e]===0);e--);}var B=class{toUtf8;fromUtf8;constructor(e,t){this.toUtf8=e,this.fromUtf8=t}format(e){let t=[];for(let a of Object.keys(e)){let i=this.fromUtf8(a);t.push(Uint8Array.from([i.byteLength]),i,this.formatHeaderValue(e[a]))}let r=new Uint8Array(t.reduce((a,i)=>a+i.byteLength,0)),n=0;for(let a of t)r.set(a,n),n+=a.byteLength;return r}formatHeaderValue(e){switch(e.type){case"boolean":return Uint8Array.from([e.value?m.boolTrue:m.boolFalse]);case"byte":return Uint8Array.from([m.byte,e.value]);case"short":let t=new DataView(new ArrayBuffer(3));return t.setUint8(0,m.short),t.setInt16(1,e.value,!1),new Uint8Array(t.buffer);case"integer":let r=new DataView(new ArrayBuffer(5));return r.setUint8(0,m.integer),r.setInt32(1,e.value,!1),new Uint8Array(r.buffer);case"long":let n=new Uint8Array(9);return n[0]=m.long,n.set(e.value.bytes,1),n;case"binary":let a=new DataView(new ArrayBuffer(3+e.value.byteLength));a.setUint8(0,m.byteArray),a.setUint16(1,e.value.byteLength,!1);let i=new Uint8Array(a.buffer);return i.set(e.value,3),i;case"string":let o=this.fromUtf8(e.value),l=new DataView(new ArrayBuffer(3+o.byteLength));l.setUint8(0,m.string),l.setUint16(1,o.byteLength,!1);let p=new Uint8Array(l.buffer);return p.set(o,3),p;case"timestamp":let h=new Uint8Array(9);return h[0]=m.timestamp,h.set(U.fromNumber(e.value.valueOf()).bytes,1),h;case"uuid":if(!ie.test(e.value))throw new Error(`Invalid UUID received: ${e.value}`);let c=new Uint8Array(17);return c[0]=m.uuid,c.set(q(e.value.replace(/-/g,"")),1),c}}parse(e){let t={},r=0;for(;r<e.byteLength;){let n=e.getUint8(r++),a=this.toUtf8(new Uint8Array(e.buffer,e.byteOffset+r,n));switch(r+=n,e.getUint8(r++)){case m.boolTrue:t[a]={type:X,value:!0};break;case m.boolFalse:t[a]={type:X,value:!1};break;case m.byte:t[a]={type:Y,value:e.getInt8(r++)};break;case m.short:t[a]={type:ee,value:e.getInt16(r,!1)},r+=2;break;case m.integer:t[a]={type:te,value:e.getInt32(r,!1)},r+=4;break;case m.long:t[a]={type:re,value:new U(new Uint8Array(e.buffer,e.byteOffset+r,8))},r+=8;break;case m.byteArray:let i=e.getUint16(r,!1);r+=2,t[a]={type:se,value:new Uint8Array(e.buffer,e.byteOffset+r,i)},r+=i;break;case m.string:let o=e.getUint16(r,!1);r+=2,t[a]={type:ne,value:this.toUtf8(new Uint8Array(e.buffer,e.byteOffset+r,o))},r+=o;break;case m.timestamp:t[a]={type:ae,value:new Date(new U(new Uint8Array(e.buffer,e.byteOffset+r,8)).valueOf())},r+=8;break;case m.uuid:let l=new Uint8Array(e.buffer,e.byteOffset+r,16);r+=16,t[a]={type:oe,value:`${S(l.subarray(0,4))}-${S(l.subarray(4,6))}-${S(l.subarray(6,8))}-${S(l.subarray(8,10))}-${S(l.subarray(10))}`};break;default:throw new Error("Unrecognized header type tag")}}return t}},m;(function(s){s[s.boolTrue=0]="boolTrue",s[s.boolFalse=1]="boolFalse",s[s.byte=2]="byte",s[s.short=3]="short",s[s.integer=4]="integer",s[s.long=5]="long",s[s.byteArray=6]="byteArray",s[s.string=7]="string",s[s.timestamp=8]="timestamp",s[s.uuid=9]="uuid"})(m||(m={}));var X="boolean",Y="byte",ee="short",te="integer",re="long",se="binary",ne="string",ae="timestamp",oe="uuid",ie=/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;var Z=4,v=Z*2,M=4,ce=v+M*2;function E({byteLength:s,byteOffset:e,buffer:t}){if(s<ce)throw new Error("Provided message too short to accommodate event stream message overhead");let r=new DataView(t,e,s),n=r.getUint32(0,!1);if(s!==n)throw new Error("Reported message length does not match received message length");let a=r.getUint32(Z,!1),i=r.getUint32(v,!1),o=r.getUint32(s-M,!1),l=new k;if(l.update(new Uint8Array(t,e,v)),i!==l.digestSync())throw new Error(`The prelude checksum specified in the message (${i}) does not match the calculated CRC32 checksum (${l.digestSync()})`);if(l.update(new Uint8Array(t,e+v,s-(v+M))),o!==l.digestSync())throw new Error(`The message checksum (${l.digestSync()}) did not match the expected value of ${o}`);return{headers:new DataView(t,e+v+M,a),body:new Uint8Array(t,e+v+M+a,n-a-(v+M+M))}}var T=class{headerMarshaller;messageBuffer;isEndOfStream;constructor(e,t){this.headerMarshaller=new B(e,t),this.messageBuffer=[],this.isEndOfStream=!1}feed(e){this.messageBuffer.push(this.decode(e))}endOfStream(){this.isEndOfStream=!0}getMessage(){let e=this.messageBuffer.pop(),t=this.isEndOfStream;return{getMessage(){return e},isEndOfStream(){return t}}}getAvailableMessages(){let e=this.messageBuffer;this.messageBuffer=[];let t=this.isEndOfStream;return{getMessages(){return e},isEndOfStream(){return t}}}encode({headers:e,body:t}){let r=this.headerMarshaller.format(e),n=r.byteLength+t.byteLength+16,a=new Uint8Array(n),i=new DataView(a.buffer,a.byteOffset,a.byteLength),o=new k;return i.setUint32(0,n,!1),i.setUint32(4,r.byteLength,!1),o.update(a.subarray(0,8)),i.setUint32(8,o.digestSync(),!1),a.set(r,12),a.set(t,r.byteLength+12),o.update(a.subarray(8,n-4)),i.setUint32(n-4,o.digestSync(),!1),a}decode(e){let{headers:t,body:r}=E(e);return{headers:this.headerMarshaller.parse(t),body:r}}formatHeaders(e){return this.headerMarshaller.format(e)}};var z=class{options;constructor(e){this.options=e}[Symbol.asyncIterator](){return this.asyncIterator()}async*asyncIterator(){for await(let e of this.options.inputStream)yield this.options.decoder.decode(e)}};var N=class{options;constructor(e){this.options=e}[Symbol.asyncIterator](){return this.asyncIterator()}async*asyncIterator(){for await(let e of this.options.messageStream)yield this.options.encoder.encode(e);this.options.includeEndFrame&&(yield new Uint8Array(0))}};var O=class{options;constructor(e){this.options=e}[Symbol.asyncIterator](){return this.asyncIterator()}async*asyncIterator(){for await(let e of this.options.messageStream){let t=await this.options.deserializer(e);t!==void 0&&(yield t)}}};var A=class{options;constructor(e){this.options=e}[Symbol.asyncIterator](){return this.asyncIterator()}async*asyncIterator(){for await(let e of this.options.inputStream)yield this.options.serializer(e)}};import{Readable as ue}from"stream";function J(s){let e=0,t=0,r=null,n=null,a=o=>{if(typeof o!="number")throw new Error("Attempted to allocate an event message where size was not a number: "+o);e=o,t=4,r=new Uint8Array(o),new DataView(r.buffer).setUint32(0,o,!1)},i=async function*(){let o=s[Symbol.asyncIterator]();for(;;){let{value:l,done:p}=await o.next();if(p){if(e)if(e===t)yield r;else throw new Error("Truncated event message received.");else return;return}let h=l.length,c=0;for(;c<h;){if(!r){let u=h-c;n||(n=new Uint8Array(4));let d=Math.min(4-t,u);if(n.set(l.slice(c,c+d),t),t+=d,c+=d,t<4)break;a(new DataView(n.buffer).getUint32(0,!1)),n=null}let f=Math.min(e-t,h-c);r.set(l.slice(c,c+f),t),t+=f,c+=f,e&&e===t&&(yield r,r=null,e=0,t=0)}}};return{[Symbol.asyncIterator]:i}}function le(s,e){let t=$(e.deserializer,e.toUtf8);return{[Symbol.asyncIterator]:async function*(){for await(let r of s){let n=e.eventStreamCodec.decode(r),a=await t(n);a!==void 0&&(yield a)}}}}function $(s,e){return async function(t){let{value:r}=t.headers[":message-type"];if(r==="error"){let n=new Error(t.headers[":error-message"].value||"UnknownError");throw n.name=t.headers[":error-code"].value,n}else if(r==="exception"){let n=t.headers[":exception-type"].value,a={[n]:t},i=await s(a);if(i.$unknown){let o=new Error(e(t.body));throw o.name=n,o}throw i[n]}else if(r==="event"){let n={[t.headers[":event-type"].value]:t},a=await s(n);return a.$unknown?void 0:a}else throw Error(`Unrecognizable event type: ${t.headers[":event-type"].value}`)}}var C=class{eventStreamCodec;utfEncoder;constructor({utf8Encoder:e,utf8Decoder:t}){this.eventStreamCodec=new T(e,t),this.utfEncoder=e}deserialize(e,t){let r=J(e);return new O({messageStream:new z({inputStream:r,decoder:this.eventStreamCodec}),deserializer:$(t,this.utfEncoder)})}serialize(e,t){return new N({messageStream:new A({inputStream:e,serializer:t}),encoder:this.eventStreamCodec,includeEndFrame:!0})}},fe=s=>new C(s);var L=class{universalMarshaller;constructor({utf8Encoder:e,utf8Decoder:t}){this.universalMarshaller=new C({utf8Decoder:t,utf8Encoder:e})}deserialize(e,t){let r=typeof e[Symbol.asyncIterator]=="function"?e:de(e);return this.universalMarshaller.deserialize(r,t)}serialize(e,t){return ue.from(this.universalMarshaller.serialize(e,t))}},me=s=>new L(s);async function*de(s){let e=!1,t=!1,r=new Array;for(s.on("error",n=>{if(e||(e=!0),n)throw n}),s.on("data",n=>{r.push(n)}),s.on("end",()=>{e=!0});!t;){let n=await new Promise(a=>setTimeout(()=>a(r.shift()),0));n&&(yield n),t=e&&r.length===0}}var ye=s=>({[Symbol.asyncIterator]:async function*(){let e=s.getReader();try{for(;;){let{done:t,value:r}=await e.read();if(t)return;yield r}}finally{e.releaseLock()}}}),he=s=>{let e=s[Symbol.asyncIterator]();return new ReadableStream({async pull(t){let{done:r,value:n}=await e.next();if(r)return t.close();t.enqueue(n)}})};var pe=s=>Object.assign(s,{eventStreamMarshaller:s.eventStreamSerdeProvider(s)});var D=class{marshaller;serializer;deserializer;serdeContext;defaultContentType;constructor({marshaller:e,serializer:t,deserializer:r,serdeContext:n,defaultContentType:a}){this.marshaller=e,this.serializer=t,this.deserializer=r,this.serdeContext=n,this.defaultContentType=a}async serializeEventStream({eventStream:e,requestSchema:t,initialRequest:r}){let n=this.marshaller,a=t.getEventStreamMember(),i=t.getMemberSchema(a),o=this.serializer,l=this.defaultContentType,p=Symbol("initialRequestMarker"),h={async*[Symbol.asyncIterator](){if(r){let c={":event-type":{type:"string",value:"initial-request"},":message-type":{type:"string",value:"event"},":content-type":{type:"string",value:l}};o.write(t,r);let f=o.flush();yield{[p]:!0,headers:c,body:f}}for await(let c of e)yield c}};return n.serialize(h,c=>{if(c[p])return{headers:c.headers,body:c.body};let f="";for(let y in c)if(y!=="__type"){f=y;break}let{additionalHeaders:u,body:d,eventType:g,explicitPayloadContentType:b}=this.writeEventBody(f,i,c);return{headers:{":event-type":{type:"string",value:g},":message-type":{type:"string",value:"event"},":content-type":{type:"string",value:b??l},...u},body:d}})}async deserializeEventStream({response:e,responseSchema:t,initialResponseContainer:r}){let n=this.marshaller,a=t.getEventStreamMember(),o=t.getMemberSchema(a).getMemberSchemas(),l=Symbol("initialResponseMarker"),p=n.deserialize(e.body,async f=>{let u="";for(let g in f)if(g!=="__type"){u=g;break}let d=f[u].body;if(u==="initial-response"){let g=await this.deserializer.read(t,d);return delete g[a],{[l]:!0,...g}}else if(u in o){let g=o[u];if(g.isStructSchema()){let b={},w=!1;for(let[y,I]of g.structIterator()){let{eventHeader:H,eventPayload:K}=I.getMergedTraits();if(w=w||!!(H||K),K)I.isBlobSchema()?b[y]=d:I.isStringSchema()?b[y]=(this.serdeContext?.utf8Encoder??W)(d):I.isStructSchema()&&(b[y]=await this.deserializer.read(I,d));else if(H){let x=f[u].headers[y]?.value;x!=null&&(I.isNumericSchema()?x&&typeof x=="object"&&"bytes"in x?b[y]=BigInt(x.toString()):b[y]=Number(x):b[y]=x)}}if(w)return{[u]:b};if(d.byteLength===0)return{[u]:{}}}return{[u]:await this.deserializer.read(g,d)}}else return{$unknown:f}}),h=p[Symbol.asyncIterator](),c=await h.next();if(c.done)return p;if(c.value?.[l]){if(!t)throw new Error("@smithy::core/protocols - initial-response event encountered in event stream but no response schema given.");for(let f in c.value)r[f]=c.value[f]}return{async*[Symbol.asyncIterator](){for(c?.value?.[l]||(yield c.value);;){let{done:f,value:u}=await h.next();if(f)break;yield u}}}}writeEventBody(e,t,r){let n=this.serializer,a=e,i=null,o,l=t.getSchema()[4].includes(e),p={};if(l){let f=t.getMemberSchema(e);if(f.isStructSchema()){for(let[u,d]of f.structIterator()){let{eventHeader:g,eventPayload:b}=d.getMergedTraits();if(b)i=u;else if(g){let w=r[e][u],y="binary";d.isNumericSchema()?(-2)**31<=w&&w<=2**31-1?y="integer":y="long":d.isTimestampSchema()?y="timestamp":d.isStringSchema()?y="string":d.isBooleanSchema()&&(y="boolean"),w!=null&&(p[u]={type:y,value:w},delete r[e][u])}}if(i!==null){let u=f.getMemberSchema(i);u.isBlobSchema()?o="application/octet-stream":u.isStringSchema()&&(o="text/plain"),n.write(u,r[e][i])}else n.write(f,r[e])}else if(f.isUnitSchema())n.write(f,{});else throw new Error("@smithy/core/event-streams - non-struct member not supported in event stream union.")}else{let[f,u]=r[e];a=f,n.write(15,u)}let h=n.flush()??new Uint8Array;return{body:typeof h=="string"?(this.serdeContext?.utf8Decoder??R)(h):h,eventType:a,explicitPayloadContentType:o,additionalHeaders:p}}};export{T as EventStreamCodec,L as EventStreamMarshaller,D as EventStreamSerde,B as HeaderMarshaller,U as Int64,z as MessageDecoderStream,N as MessageEncoderStream,O as SmithyMessageDecoderStream,A as SmithyMessageEncoderStream,C as UniversalEventStreamMarshaller,me as eventStreamSerdeProvider,J as getChunkedStream,$ as getMessageUnmarshaller,le as getUnmarshalledStream,he as iterableToReadableStream,ye as readableStreamToIterable,pe as resolveEventStreamSerdeConfig,fe as universalEventStreamSerdeProvider};