playwright-smart-test 0.0.0-stage → 1.0.1

package/node_modules/google-auth-library/build/src/auth/authclient.d.ts

@@ -0,0 +1,202 @@
+import { EventEmitter } from 'events';
+import { Gaxios, GaxiosOptions, GaxiosPromise, GaxiosResponse } from 'gaxios';
+import { Transporter } from '../transporters';
+import { Credentials } from './credentials';
+import { GetAccessTokenResponse, Headers } from './oauth2client';
+import { OriginalAndCamel } from '../util';
+/**
+ * Base auth configurations (e.g. from JWT or `.json` files) with conventional
+ * camelCased options.
+ *
+ * @privateRemarks
+ *
+ * This interface is purposely not exported so that it can be removed once
+ * {@link https://github.com/microsoft/TypeScript/issues/50715} has been
+ * resolved. Then, we can use {@link OriginalAndCamel} to shrink this interface.
+ *
+ * Tracking: {@link https://github.com/googleapis/google-auth-library-nodejs/issues/1686}
+ */
+interface AuthJSONOptions {
+    /**
+     * The project ID corresponding to the current credentials if available.
+     */
+    project_id: string | null;
+    /**
+     * An alias for {@link AuthJSONOptions.project_id `project_id`}.
+     */
+    projectId: AuthJSONOptions['project_id'];
+    /**
+     * The quota project ID. The quota project can be used by client libraries for the billing purpose.
+     * See {@link https://cloud.google.com/docs/quota Working with quotas}
+     */
+    quota_project_id: string;
+    /**
+     * An alias for {@link AuthJSONOptions.quota_project_id `quota_project_id`}.
+     */
+    quotaProjectId: AuthJSONOptions['quota_project_id'];
+    /**
+     * The default service domain for a given Cloud universe.
+     *
+     * @example
+     * 'googleapis.com'
+     */
+    universe_domain: string;
+    /**
+     * An alias for {@link AuthJSONOptions.universe_domain `universe_domain`}.
+     */
+    universeDomain: AuthJSONOptions['universe_domain'];
+}
+/**
+ * Base `AuthClient` configuration.
+ *
+ * The camelCased options are aliases of the snake_cased options, supporting both
+ * JSON API and JS conventions.
+ */
+export interface AuthClientOptions extends Partial<OriginalAndCamel<AuthJSONOptions>> {
+    /**
+     * An API key to use, optional.
+     */
+    apiKey?: string;
+    credentials?: Credentials;
+    /**
+     * A `Gaxios` or `Transporter` instance to use for `AuthClient` requests.
+     */
+    transporter?: Gaxios | Transporter;
+    /**
+     * Provides default options to the transporter, such as {@link GaxiosOptions.agent `agent`} or
+     *  {@link GaxiosOptions.retryConfig `retryConfig`}.
+     */
+    transporterOptions?: GaxiosOptions;
+    /**
+     * The expiration threshold in milliseconds before forcing token refresh of
+     * unexpired tokens.
+     */
+    eagerRefreshThresholdMillis?: number;
+    /**
+     * Whether to attempt to refresh tokens on status 401/403 responses
+     * even if an attempt is made to refresh the token preemptively based
+     * on the expiry_date.
+     */
+    forceRefreshOnFailure?: boolean;
+}
+/**
+ * The default cloud universe
+ *
+ * @see {@link AuthJSONOptions.universe_domain}
+ */
+export declare const DEFAULT_UNIVERSE = "googleapis.com";
+/**
+ * The default {@link AuthClientOptions.eagerRefreshThresholdMillis}
+ */
+export declare const DEFAULT_EAGER_REFRESH_THRESHOLD_MILLIS: number;
+/**
+ * Defines the root interface for all clients that generate credentials
+ * for calling Google APIs. All clients should implement this interface.
+ */
+export interface CredentialsClient {
+    projectId?: AuthClientOptions['projectId'];
+    eagerRefreshThresholdMillis: NonNullable<AuthClientOptions['eagerRefreshThresholdMillis']>;
+    forceRefreshOnFailure: NonNullable<AuthClientOptions['forceRefreshOnFailure']>;
+    /**
+     * @return A promise that resolves with the current GCP access token
+     *   response. If the current credential is expired, a new one is retrieved.
+     */
+    getAccessToken(): Promise<GetAccessTokenResponse>;
+    /**
+     * The main authentication interface. It takes an optional url which when
+     * present is the endpoint being accessed, and returns a Promise which
+     * resolves with authorization header fields.
+     *
+     * The result has the form:
+     * { Authorization: 'Bearer <access_token_value>' }
+     * @param url The URI being authorized.
+     */
+    getRequestHeaders(url?: string): Promise<Headers>;
+    /**
+     * Provides an alternative Gaxios request implementation with auth credentials
+     */
+    request<T>(opts: GaxiosOptions): GaxiosPromise<T>;
+    /**
+     * Sets the auth credentials.
+     */
+    setCredentials(credentials: Credentials): void;
+    /**
+     * Subscribes a listener to the tokens event triggered when a token is
+     * generated.
+     *
+     * @param event The tokens event to subscribe to.
+     * @param listener The listener that triggers on event trigger.
+     * @return The current client instance.
+     */
+    on(event: 'tokens', listener: (tokens: Credentials) => void): this;
+}
+export declare interface AuthClient {
+    on(event: 'tokens', listener: (tokens: Credentials) => void): this;
+}
+export declare abstract class AuthClient extends EventEmitter implements CredentialsClient {
+    apiKey?: string;
+    projectId?: string | null;
+    /**
+     * The quota project ID. The quota project can be used by client libraries for the billing purpose.
+     * See {@link https://cloud.google.com/docs/quota Working with quotas}
+     */
+    quotaProjectId?: string;
+    transporter: Transporter;
+    credentials: Credentials;
+    eagerRefreshThresholdMillis: number;
+    forceRefreshOnFailure: boolean;
+    universeDomain: string;
+    constructor(opts?: AuthClientOptions);
+    /**
+     * Return the {@link Gaxios `Gaxios`} instance from the {@link AuthClient.transporter}.
+     *
+     * @expiremental
+     */
+    get gaxios(): Gaxios | null;
+    /**
+     * Provides an alternative Gaxios request implementation with auth credentials
+     */
+    abstract request<T>(opts: GaxiosOptions): GaxiosPromise<T>;
+    /**
+     * The main authentication interface. It takes an optional url which when
+     * present is the endpoint being accessed, and returns a Promise which
+     * resolves with authorization header fields.
+     *
+     * The result has the form:
+     * { Authorization: 'Bearer <access_token_value>' }
+     * @param url The URI being authorized.
+     */
+    abstract getRequestHeaders(url?: string): Promise<Headers>;
+    /**
+     * @return A promise that resolves with the current GCP access token
+     *   response. If the current credential is expired, a new one is retrieved.
+     */
+    abstract getAccessToken(): Promise<{
+        token?: string | null;
+        res?: GaxiosResponse | null;
+    }>;
+    /**
+     * Sets the auth credentials.
+     */
+    setCredentials(credentials: Credentials): void;
+    /**
+     * Append additional headers, e.g., x-goog-user-project, shared across the
+     * classes inheriting AuthClient. This method should be used by any method
+     * that overrides getRequestMetadataAsync(), which is a shared helper for
+     * setting request information in both gRPC and HTTP API calls.
+     *
+     * @param headers object to append additional headers to.
+     */
+    protected addSharedMetadataHeaders(headers: Headers): Headers;
+    /**
+     * Retry config for Auth-related requests.
+     *
+     * @remarks
+     *
+     * This is not a part of the default {@link AuthClient.transporter transporter/gaxios}
+     * config as some downstream APIs would prefer if customers explicitly enable retries,
+     * such as GCS.
+     */
+    protected static get RETRY_CONFIG(): GaxiosOptions;
+}
+export {};

package/node_modules/google-auth-library/build/src/auth/authclient.js

@@ -0,0 +1,116 @@
+"use strict";
+// Copyright 2012 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthClient = exports.DEFAULT_EAGER_REFRESH_THRESHOLD_MILLIS = exports.DEFAULT_UNIVERSE = void 0;
+const events_1 = require("events");
+const gaxios_1 = require("gaxios");
+const transporters_1 = require("../transporters");
+const util_1 = require("../util");
+/**
+ * The default cloud universe
+ *
+ * @see {@link AuthJSONOptions.universe_domain}
+ */
+exports.DEFAULT_UNIVERSE = 'googleapis.com';
+/**
+ * The default {@link AuthClientOptions.eagerRefreshThresholdMillis}
+ */
+exports.DEFAULT_EAGER_REFRESH_THRESHOLD_MILLIS = 5 * 60 * 1000;
+class AuthClient extends events_1.EventEmitter {
+    constructor(opts = {}) {
+        var _a, _b, _c, _d, _e;
+        super();
+        this.credentials = {};
+        this.eagerRefreshThresholdMillis = exports.DEFAULT_EAGER_REFRESH_THRESHOLD_MILLIS;
+        this.forceRefreshOnFailure = false;
+        this.universeDomain = exports.DEFAULT_UNIVERSE;
+        const options = (0, util_1.originalOrCamelOptions)(opts);
+        // Shared auth options
+        this.apiKey = opts.apiKey;
+        this.projectId = (_a = options.get('project_id')) !== null && _a !== void 0 ? _a : null;
+        this.quotaProjectId = options.get('quota_project_id');
+        this.credentials = (_b = options.get('credentials')) !== null && _b !== void 0 ? _b : {};
+        this.universeDomain = (_c = options.get('universe_domain')) !== null && _c !== void 0 ? _c : exports.DEFAULT_UNIVERSE;
+        // Shared client options
+        this.transporter = (_d = opts.transporter) !== null && _d !== void 0 ? _d : new transporters_1.DefaultTransporter();
+        if (opts.transporterOptions) {
+            this.transporter.defaults = opts.transporterOptions;
+        }
+        if (opts.eagerRefreshThresholdMillis) {
+            this.eagerRefreshThresholdMillis = opts.eagerRefreshThresholdMillis;
+        }
+        this.forceRefreshOnFailure = (_e = opts.forceRefreshOnFailure) !== null && _e !== void 0 ? _e : false;
+    }
+    /**
+     * Return the {@link Gaxios `Gaxios`} instance from the {@link AuthClient.transporter}.
+     *
+     * @expiremental
+     */
+    get gaxios() {
+        if (this.transporter instanceof gaxios_1.Gaxios) {
+            return this.transporter;
+        }
+        else if (this.transporter instanceof transporters_1.DefaultTransporter) {
+            return this.transporter.instance;
+        }
+        else if ('instance' in this.transporter &&
+            this.transporter.instance instanceof gaxios_1.Gaxios) {
+            return this.transporter.instance;
+        }
+        return null;
+    }
+    /**
+     * Sets the auth credentials.
+     */
+    setCredentials(credentials) {
+        this.credentials = credentials;
+    }
+    /**
+     * Append additional headers, e.g., x-goog-user-project, shared across the
+     * classes inheriting AuthClient. This method should be used by any method
+     * that overrides getRequestMetadataAsync(), which is a shared helper for
+     * setting request information in both gRPC and HTTP API calls.
+     *
+     * @param headers object to append additional headers to.
+     */
+    addSharedMetadataHeaders(headers) {
+        // quota_project_id, stored in application_default_credentials.json, is set in
+        // the x-goog-user-project header, to indicate an alternate account for
+        // billing and quota:
+        if (!headers['x-goog-user-project'] && // don't override a value the user sets.
+            this.quotaProjectId) {
+            headers['x-goog-user-project'] = this.quotaProjectId;
+        }
+        return headers;
+    }
+    /**
+     * Retry config for Auth-related requests.
+     *
+     * @remarks
+     *
+     * This is not a part of the default {@link AuthClient.transporter transporter/gaxios}
+     * config as some downstream APIs would prefer if customers explicitly enable retries,
+     * such as GCS.
+     */
+    static get RETRY_CONFIG() {
+        return {
+            retry: true,
+            retryConfig: {
+                httpMethodsToRetry: ['GET', 'PUT', 'POST', 'HEAD', 'OPTIONS', 'DELETE'],
+            },
+        };
+    }
+}
+exports.AuthClient = AuthClient;

package/node_modules/google-auth-library/build/src/auth/awsclient.d.ts

@@ -0,0 +1,120 @@
+import { AwsSecurityCredentials } from './awsrequestsigner';
+import { BaseExternalAccountClient, BaseExternalAccountClientOptions, ExternalAccountSupplierContext } from './baseexternalclient';
+import { AuthClientOptions } from './authclient';
+import { SnakeToCamelObject } from '../util';
+/**
+ * AWS credentials JSON interface. This is used for AWS workloads.
+ */
+export interface AwsClientOptions extends BaseExternalAccountClientOptions {
+    /**
+     * Object containing options to retrieve AWS security credentials. A valid credential
+     * source or a aws security credentials supplier should be specified.
+     */
+    credential_source?: {
+        /**
+         * AWS environment ID. Currently only 'AWS1' is supported.
+         */
+        environment_id: string;
+        /**
+         * The EC2 metadata URL to retrieve the current AWS region from. If this is
+         * not provided, the region should be present in the AWS_REGION or AWS_DEFAULT_REGION
+         * environment variables.
+         */
+        region_url?: string;
+        /**
+         * The EC2 metadata URL to retrieve AWS security credentials. If this is not provided,
+         * the credentials should be present in the AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY,
+         * and AWS_SESSION_TOKEN environment variables.
+         */
+        url?: string;
+        /**
+         * The regional GetCallerIdentity action URL, used to determine the account
+         * ID and its roles.
+         */
+        regional_cred_verification_url: string;
+        /**
+         *  The imdsv2 session token url is used to fetch session token from AWS
+         *  which is later sent through headers for metadata requests. If the
+         *  field is missing, then session token won't be fetched and sent with
+         *  the metadata requests.
+         *  The session token is required for IMDSv2 but optional for IMDSv1
+         */
+        imdsv2_session_token_url?: string;
+    };
+    /**
+     * The AWS security credentials supplier to call to retrieve the AWS region
+     * and AWS security credentials. Either this or a valid credential source
+     * must be specified.
+     */
+    aws_security_credentials_supplier?: AwsSecurityCredentialsSupplier;
+}
+/**
+ * Supplier interface for AWS security credentials. This can be implemented to
+ * return an AWS region and AWS security credentials. These credentials can
+ * then be exchanged for a GCP token by an {@link AwsClient}.
+ */
+export interface AwsSecurityCredentialsSupplier {
+    /**
+     * Gets the active AWS region.
+     * @param context {@link ExternalAccountSupplierContext} from the calling
+     *   {@link AwsClient}, contains the requested audience and subject token type
+     *   for the external account identity as well as the transport from the
+     *   calling client to use for requests.
+     * @return A promise that resolves with the AWS region string.
+     */
+    getAwsRegion: (context: ExternalAccountSupplierContext) => Promise<string>;
+    /**
+     * Gets valid AWS security credentials for the requested external account
+     * identity. Note that these are not cached by the calling {@link AwsClient},
+     * so caching should be including in the implementation.
+     * @param context {@link ExternalAccountSupplierContext} from the calling
+     *   {@link AwsClient}, contains the requested audience and subject token type
+     *   for the external account identity as well as the transport from the
+     *   calling client to use for requests.
+     * @return A promise that resolves with the requested {@link AwsSecurityCredentials}.
+     */
+    getAwsSecurityCredentials: (context: ExternalAccountSupplierContext) => Promise<AwsSecurityCredentials>;
+}
+/**
+ * AWS external account client. This is used for AWS workloads, where
+ * AWS STS GetCallerIdentity serialized signed requests are exchanged for
+ * GCP access token.
+ */
+export declare class AwsClient extends BaseExternalAccountClient {
+    #private;
+    private readonly environmentId?;
+    private readonly awsSecurityCredentialsSupplier;
+    private readonly regionalCredVerificationUrl;
+    private awsRequestSigner;
+    private region;
+    /**
+     * @deprecated AWS client no validates the EC2 metadata address.
+     **/
+    static AWS_EC2_METADATA_IPV4_ADDRESS: string;
+    /**
+     * @deprecated AWS client no validates the EC2 metadata address.
+     **/
+    static AWS_EC2_METADATA_IPV6_ADDRESS: string;
+    /**
+     * Instantiates an AwsClient instance using the provided JSON
+     * object loaded from an external account credentials file.
+     * An error is thrown if the credential is not a valid AWS credential.
+     * @param options The external account options object typically loaded
+     *   from the external account JSON credential file.
+     * @param additionalOptions **DEPRECATED, all options are available in the
+     *   `options` parameter.** Optional additional behavior customization options.
+     *   These currently customize expiration threshold time and whether to retry
+     *   on 401/403 API request errors.
+     */
+    constructor(options: AwsClientOptions | SnakeToCamelObject<AwsClientOptions>, additionalOptions?: AuthClientOptions);
+    private validateEnvironmentId;
+    /**
+     * Triggered when an external subject token is needed to be exchanged for a
+     * GCP access token via GCP STS endpoint. This will call the
+     * {@link AwsSecurityCredentialsSupplier} to retrieve an AWS region and AWS
+     * Security Credentials, then use them to create a signed AWS STS request that
+     * can be exchanged for a GCP access token.
+     * @return A promise that resolves with the external subject token.
+     */
+    retrieveSubjectToken(): Promise<string>;
+}

package/node_modules/google-auth-library/build/src/auth/awsclient.js

@@ -0,0 +1,164 @@
+"use strict";
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _a, _AwsClient_DEFAULT_AWS_REGIONAL_CREDENTIAL_VERIFICATION_URL;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AwsClient = void 0;
+const awsrequestsigner_1 = require("./awsrequestsigner");
+const baseexternalclient_1 = require("./baseexternalclient");
+const defaultawssecuritycredentialssupplier_1 = require("./defaultawssecuritycredentialssupplier");
+const util_1 = require("../util");
+/**
+ * AWS external account client. This is used for AWS workloads, where
+ * AWS STS GetCallerIdentity serialized signed requests are exchanged for
+ * GCP access token.
+ */
+class AwsClient extends baseexternalclient_1.BaseExternalAccountClient {
+    /**
+     * Instantiates an AwsClient instance using the provided JSON
+     * object loaded from an external account credentials file.
+     * An error is thrown if the credential is not a valid AWS credential.
+     * @param options The external account options object typically loaded
+     *   from the external account JSON credential file.
+     * @param additionalOptions **DEPRECATED, all options are available in the
+     *   `options` parameter.** Optional additional behavior customization options.
+     *   These currently customize expiration threshold time and whether to retry
+     *   on 401/403 API request errors.
+     */
+    constructor(options, additionalOptions) {
+        super(options, additionalOptions);
+        const opts = (0, util_1.originalOrCamelOptions)(options);
+        const credentialSource = opts.get('credential_source');
+        const awsSecurityCredentialsSupplier = opts.get('aws_security_credentials_supplier');
+        // Validate credential sourcing configuration.
+        if (!credentialSource && !awsSecurityCredentialsSupplier) {
+            throw new Error('A credential source or AWS security credentials supplier must be specified.');
+        }
+        if (credentialSource && awsSecurityCredentialsSupplier) {
+            throw new Error('Only one of credential source or AWS security credentials supplier can be specified.');
+        }
+        if (awsSecurityCredentialsSupplier) {
+            this.awsSecurityCredentialsSupplier = awsSecurityCredentialsSupplier;
+            this.regionalCredVerificationUrl =
+                __classPrivateFieldGet(_a, _a, "f", _AwsClient_DEFAULT_AWS_REGIONAL_CREDENTIAL_VERIFICATION_URL);
+            this.credentialSourceType = 'programmatic';
+        }
+        else {
+            const credentialSourceOpts = (0, util_1.originalOrCamelOptions)(credentialSource);
+            this.environmentId = credentialSourceOpts.get('environment_id');
+            // This is only required if the AWS region is not available in the
+            // AWS_REGION or AWS_DEFAULT_REGION environment variables.
+            const regionUrl = credentialSourceOpts.get('region_url');
+            // This is only required if AWS security credentials are not available in
+            // environment variables.
+            const securityCredentialsUrl = credentialSourceOpts.get('url');
+            const imdsV2SessionTokenUrl = credentialSourceOpts.get('imdsv2_session_token_url');
+            this.awsSecurityCredentialsSupplier =
+                new defaultawssecuritycredentialssupplier_1.DefaultAwsSecurityCredentialsSupplier({
+                    regionUrl: regionUrl,
+                    securityCredentialsUrl: securityCredentialsUrl,
+                    imdsV2SessionTokenUrl: imdsV2SessionTokenUrl,
+                });
+            this.regionalCredVerificationUrl = credentialSourceOpts.get('regional_cred_verification_url');
+            this.credentialSourceType = 'aws';
+            // Data validators.
+            this.validateEnvironmentId();
+        }
+        this.awsRequestSigner = null;
+        this.region = '';
+    }
+    validateEnvironmentId() {
+        var _b;
+        const match = (_b = this.environmentId) === null || _b === void 0 ? void 0 : _b.match(/^(aws)(\d+)$/);
+        if (!match || !this.regionalCredVerificationUrl) {
+            throw new Error('No valid AWS "credential_source" provided');
+        }
+        else if (parseInt(match[2], 10) !== 1) {
+            throw new Error(`aws version "${match[2]}" is not supported in the current build.`);
+        }
+    }
+    /**
+     * Triggered when an external subject token is needed to be exchanged for a
+     * GCP access token via GCP STS endpoint. This will call the
+     * {@link AwsSecurityCredentialsSupplier} to retrieve an AWS region and AWS
+     * Security Credentials, then use them to create a signed AWS STS request that
+     * can be exchanged for a GCP access token.
+     * @return A promise that resolves with the external subject token.
+     */
+    async retrieveSubjectToken() {
+        // Initialize AWS request signer if not already initialized.
+        if (!this.awsRequestSigner) {
+            this.region = await this.awsSecurityCredentialsSupplier.getAwsRegion(this.supplierContext);
+            this.awsRequestSigner = new awsrequestsigner_1.AwsRequestSigner(async () => {
+                return this.awsSecurityCredentialsSupplier.getAwsSecurityCredentials(this.supplierContext);
+            }, this.region);
+        }
+        // Generate signed request to AWS STS GetCallerIdentity API.
+        // Use the required regional endpoint. Otherwise, the request will fail.
+        const options = await this.awsRequestSigner.getRequestOptions({
+            ..._a.RETRY_CONFIG,
+            url: this.regionalCredVerificationUrl.replace('{region}', this.region),
+            method: 'POST',
+        });
+        // The GCP STS endpoint expects the headers to be formatted as:
+        // [
+        //   {key: 'x-amz-date', value: '...'},
+        //   {key: 'Authorization', value: '...'},
+        //   ...
+        // ]
+        // And then serialized as:
+        // encodeURIComponent(JSON.stringify({
+        //   url: '...',
+        //   method: 'POST',
+        //   headers: [{key: 'x-amz-date', value: '...'}, ...]
+        // }))
+        const reformattedHeader = [];
+        const extendedHeaders = Object.assign({
+            // The full, canonical resource name of the workload identity pool
+            // provider, with or without the HTTPS prefix.
+            // Including this header as part of the signature is recommended to
+            // ensure data integrity.
+            'x-goog-cloud-target-resource': this.audience,
+        }, options.headers);
+        // Reformat header to GCP STS expected format.
+        for (const key in extendedHeaders) {
+            reformattedHeader.push({
+                key,
+                value: extendedHeaders[key],
+            });
+        }
+        // Serialize the reformatted signed request.
+        return encodeURIComponent(JSON.stringify({
+            url: options.url,
+            method: options.method,
+            headers: reformattedHeader,
+        }));
+    }
+}
+exports.AwsClient = AwsClient;
+_a = AwsClient;
+_AwsClient_DEFAULT_AWS_REGIONAL_CREDENTIAL_VERIFICATION_URL = { value: 'https://sts.{region}.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15' };
+/**
+ * @deprecated AWS client no validates the EC2 metadata address.
+ **/
+AwsClient.AWS_EC2_METADATA_IPV4_ADDRESS = '169.254.169.254';
+/**
+ * @deprecated AWS client no validates the EC2 metadata address.
+ **/
+AwsClient.AWS_EC2_METADATA_IPV6_ADDRESS = 'fd00:ec2::254';

package/node_modules/google-auth-library/build/src/auth/awsrequestsigner.d.ts

@@ -0,0 +1,40 @@
+import { GaxiosOptions } from 'gaxios';
+/**
+ * Interface defining AWS security credentials.
+ * These are either determined from AWS security_credentials endpoint or
+ * AWS environment variables.
+ */
+export interface AwsSecurityCredentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    token?: string;
+}
+/**
+ * Implements an AWS API request signer based on the AWS Signature Version 4
+ * signing process.
+ * https://docs.aws.amazon.com/general/latest/gr/signature-version-4.html
+ */
+export declare class AwsRequestSigner {
+    private readonly getCredentials;
+    private readonly region;
+    private readonly crypto;
+    /**
+     * Instantiates an AWS API request signer used to send authenticated signed
+     * requests to AWS APIs based on the AWS Signature Version 4 signing process.
+     * This also provides a mechanism to generate the signed request without
+     * sending it.
+     * @param getCredentials A mechanism to retrieve AWS security credentials
+     *   when needed.
+     * @param region The AWS region to use.
+     */
+    constructor(getCredentials: () => Promise<AwsSecurityCredentials>, region: string);
+    /**
+     * Generates the signed request for the provided HTTP request for calling
+     * an AWS API. This follows the steps described at:
+     * https://docs.aws.amazon.com/general/latest/gr/sigv4_signing.html
+     * @param amzOptions The AWS request options that need to be signed.
+     * @return A promise that resolves with the GaxiosOptions containing the
+     *   signed HTTP request parameters.
+     */
+    getRequestOptions(amzOptions: GaxiosOptions): Promise<GaxiosOptions>;
+}