runline 0.36.0 → 0.37.0

package/dist/credentials/aws-plugin.d.ts

@@ -35,6 +35,9 @@ export interface AwsCredentialSpec {
  *   `roleDurationSeconds` shape each session request.
  * - `stsRegion`, else `region`, else `us-east-1`, is where sessions are
  *   requested.
+ * - `awsProfile` names an AWS CLI profile (an SSO login) whose key this
+ *   process signs with in place of a stored one; a host that stores the
+ *   key ignores it.
  */
 export declare function awsCredential(spec: AwsCredentialSpec): CredentialDeclaration;
 /**

package/dist/credentials/aws-plugin.js

@@ -5,7 +5,7 @@
  */
 import * as t from "typebox";
 import { AuthError } from "../auth/errors.js";
-import { awsEndpoint, awsErrorCode, awsRole, parseAwsXml } from "./aws.js";
+import { awsEndpoint, awsErrorCode, awsProfileName, awsRole, parseAwsXml, } from "./aws.js";
 import { credentialRequest, errorIdentifier, failureMessage, jsonAnswer, } from "./plugin.js";
 import { AwsAccessKeySchema, AwsSessionSchema } from "./registry.js";
 const STRICT = { additionalProperties: false };
@@ -57,6 +57,9 @@ function configString(value) {
  *   `roleDurationSeconds` shape each session request.
  * - `stsRegion`, else `region`, else `us-east-1`, is where sessions are
  *   requested.
+ * - `awsProfile` names an AWS CLI profile (an SSO login) whose key this
+ *   process signs with in place of a stored one; a host that stores the
+ *   key ignores it.
  */
 export function awsCredential(spec) {
     const key = { credential: AwsAccessKeySchema };
@@ -68,6 +71,8 @@ export function awsCredential(spec) {
     return (config) => {
         const targets = spec.targets(config);
         const probe = spec.probe ? { probe: spec.probe } : {};
+        const profile = configString(config.awsProfile);
+        const awsProfile = profile === undefined ? undefined : awsProfileName(profile);
         const roleArn = configString(config.roleArn);
         const externalId = configString(config.roleExternalId);
         const durationSeconds = configInteger(config.roleDurationSeconds);
@@ -93,7 +98,7 @@ export function awsCredential(spec) {
                     },
                 },
             },
-            localSecret,
+            ...(awsProfile === undefined ? { localSecret } : { awsProfile }),
             ...(roleArn === undefined
                 ? { method: "accessKey" }
                 : {

package/dist/credentials/aws.d.ts

@@ -14,6 +14,17 @@ export declare function awsEndpoint(service: string, region: string): string;
  * signature. Anything else is refused before any request.
  */
 export declare function awsAccessKey(value: unknown): AwsAccessKey;
+/** A profile name from config; anything else is refused before the CLI runs. */
+export declare function awsProfileName(value: unknown): string;
+/**
+ * The access key of an AWS CLI profile, as the CLI resolves it: an SSO
+ * login, an assumed role, or a key in `~/.aws/credentials`, through
+ * `aws configure export-credentials` (the `credential_process` contract).
+ * Held until five minutes before it expires; however many callers find
+ * it missing or stale, one CLI run serves them all, and a failed run is
+ * not held.
+ */
+export declare function awsProfileKey(name: string): Promise<AwsAccessKey>;
 /** A role as STS accepts it; anything else is refused before any request. */
 export declare function awsRole(role: AwsRole): AwsRole;
 /**

package/dist/credentials/aws.js

@@ -1,3 +1,4 @@
+import { execFile } from "node:child_process";
 import { XMLParser } from "fast-xml-parser";
 import { AuthError } from "../auth/errors.js";
 import { sendResource } from "./http.js";
@@ -55,6 +56,110 @@ export function awsAccessKey(value) {
             : { sessionToken: secret(key.sessionToken) }),
     };
 }
+/** An AWS CLI profile name, as `~/.aws/config` section names allow it. */
+const PROFILE = /^[\w+=,.@-]{1,64}$/;
+/** A profile name from config; anything else is refused before the CLI runs. */
+export function awsProfileName(value) {
+    if (typeof value !== "string" || !PROFILE.test(value))
+        throw new AuthError("invalid_credentials");
+    return value;
+}
+/** A profile's key is used until this long before it expires. */
+const PROFILE_KEY_MARGIN_MS = 5 * 60_000;
+/**
+ * Each profile's key as this process holds it: settled while it lasts,
+ * or still in flight, so concurrent callers share one CLI run.
+ */
+const profileKeys = new Map();
+/** A key a provider issued: one that cannot sign is a malformed answer. */
+function issuedKey(value) {
+    try {
+        return awsAccessKey(value);
+    }
+    catch {
+        throw new AuthError("invalid_response");
+    }
+}
+/**
+ * Why the CLI produced no key: it is not installed, it ran out of time,
+ * it answered more than a key, or it refused (no login, or an expired
+ * SSO session, which `aws sso login` mends).
+ */
+function cliFailure(error) {
+    if (error.code === "ENOENT")
+        return new AuthError("invalid_credentials");
+    if (error.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER")
+        return new AuthError("invalid_response");
+    if (error.killed)
+        return new AuthError("request_failed");
+    return new AuthError("reconnect_required");
+}
+/** One CLI run: the profile's key, as `credential_process` defines it. */
+async function exportProfileKey(profile) {
+    const stdout = await new Promise((resolve, reject) => {
+        execFile("aws", [
+            "configure",
+            "export-credentials",
+            "--profile",
+            profile,
+            "--format",
+            "process",
+        ], { timeout: 30_000, maxBuffer: 64 * 1024 }, (error, out) => (error ? reject(cliFailure(error)) : resolve(out)));
+    });
+    let exported;
+    try {
+        exported = JSON.parse(stdout);
+    }
+    catch {
+        throw new AuthError("invalid_response");
+    }
+    const expiresAt = exported.Expiration === undefined
+        ? undefined
+        : Date.parse(String(exported.Expiration));
+    if (exported.Version !== 1 ||
+        (expiresAt !== undefined && !Number.isSafeInteger(expiresAt)))
+        throw new AuthError("invalid_response");
+    return {
+        key: issuedKey({
+            accessKeyId: exported.AccessKeyId,
+            secretAccessKey: exported.SecretAccessKey,
+            ...(exported.SessionToken === undefined
+                ? {}
+                : { sessionToken: exported.SessionToken }),
+        }),
+        expiresAt,
+    };
+}
+/**
+ * The access key of an AWS CLI profile, as the CLI resolves it: an SSO
+ * login, an assumed role, or a key in `~/.aws/credentials`, through
+ * `aws configure export-credentials` (the `credential_process` contract).
+ * Held until five minutes before it expires; however many callers find
+ * it missing or stale, one CLI run serves them all, and a failed run is
+ * not held.
+ */
+export async function awsProfileKey(name) {
+    const profile = awsProfileName(name);
+    for (;;) {
+        const held = profileKeys.get(profile);
+        if (!held)
+            break;
+        const { key, expiresAt } = await held;
+        if (expiresAt === undefined ||
+            expiresAt > Date.now() + PROFILE_KEY_MARGIN_MS)
+            return key;
+        // Stale: refresh it, unless another caller already started to.
+        if (profileKeys.get(profile) === held)
+            break;
+    }
+    const exporting = exportProfileKey(profile);
+    profileKeys.set(profile, exporting);
+    exporting.catch(() => {
+        if (profileKeys.get(profile) === exporting)
+            profileKeys.delete(profile);
+    });
+    return (await exporting).key;
+}
 /** `arn:<partition>:iam::<account>:role/<path/name>`, as IAM allows it. */
 const ROLE_ARN = /^arn:aws(?:-[a-z]+)*:iam::\d{12}:role\/[\w+=,.@/-]{1,512}$/;
 const SESSION_NAME = /^[\w+=,.@-]{2,64}$/;
@@ -193,17 +298,11 @@ export async function assumeAwsRole(key, role, options) {
         !Number.isSafeInteger(expiresAt) ||
         expiresAt <= now)
         throw new AuthError("invalid_response");
-    let session;
-    try {
-        session = awsAccessKey({
-            accessKeyId: result.AccessKeyId,
-            secretAccessKey: result.SecretAccessKey,
-            sessionToken: result.SessionToken,
-        });
-    }
-    catch {
-        throw new AuthError("invalid_response");
-    }
+    const session = issuedKey({
+        accessKeyId: result.AccessKeyId,
+        secretAccessKey: result.SecretAccessKey,
+        sessionToken: result.SessionToken,
+    });
     return {
         accessKeyId: session.accessKeyId,
         secretAccessKey: session.secretAccessKey,

package/dist/credentials/broker.js

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 import { AuthError } from "../auth/errors.js";
+import { awsProfileKey } from "./aws.js";
 import { CredentialRegistry } from "./registry.js";
 import { CredentialTransport } from "./transport.js";
 /**
@@ -122,7 +123,7 @@ function localSigner(ctx, declaration) {
     const auth = definition.methods[method].authentication;
     const identity = { name: ctx.connection.name, plugin: ctx.connection.plugin };
     const expected = authorityOf(selection);
-    const project = (current) => {
+    const project = async (current) => {
         if (authorityOf(declaration(current)) !== expected)
             throw new AuthError("binding_changed");
         if (auth.kind === "none")
@@ -132,9 +133,9 @@ function localSigner(ctx, declaration) {
             return secret ? { [auth.field]: secret } : {};
         }
         if (auth.kind === "awsSigV4") {
-            const key = staticSecret(current, selection.localSecret, [
-                "sessionToken",
-            ]);
+            const key = selection.awsProfile
+                ? await awsProfileKey(selection.awsProfile)
+                : staticSecret(current, selection.localSecret, ["sessionToken"]);
             const cached = current.awsSession;
             const sessionField = auth.assumeRole?.sessionField;
             return {
@@ -178,9 +179,9 @@ function localSigner(ctx, declaration) {
             : createHash("sha256").update(JSON.stringify(tokens)).digest("hex");
         return { [auth.field]: { tokens, revision } };
     };
-    const snapshot = () => ({
+    const snapshot = async () => ({
         ...identity,
-        config: project(ctx.connection.config),
+        config: await project(ctx.connection.config),
     });
     const binding = {
         type: definition.id,
@@ -199,7 +200,7 @@ function localSigner(ctx, declaration) {
             async update(change) {
                 const flatten = writeBack(auth, expected);
                 await ctx.updateConnection(async (current) => {
-                    const projected = project(current);
+                    const projected = await project(current);
                     const patch = typeof change === "function" ? await change(projected) : change;
                     return patch ? flatten(patch, current) : undefined;
                 });

package/dist/credentials/transport.js

@@ -244,7 +244,11 @@ export class CredentialTransport {
         try {
             snapshot = await binding.connection.read();
         }
-        catch {
+        catch (error) {
+            // A store's own error can carry anything; an AuthError is already
+            // sanitized and says what is wrong with the credential itself.
+            if (error instanceof AuthError)
+                throw error;
             throw new AuthError("credential_store_failed");
         }
         return boundSnapshot(binding, method, snapshot);

package/dist/credentials/types.d.ts

@@ -225,6 +225,13 @@ export interface CredentialSelection {
     resourceOwner?: OAuthResourceOwner;
     /** The role an `assumeRole` method's sessions are issued for. */
     awsRole?: AwsRole;
+    /**
+     * The AWS CLI profile whose credentials an `awsSigV4` method's key
+     * comes from, read through the CLI when this process signs with its
+     * own connection: an SSO login, with no key stored anywhere. Hosts that
+     * store the key ignore it, as they ignore `localSecret`.
+     */
+    awsProfile?: string;
     /**
      * How a process signing with its own flat connection config (the CLI)
      * assembles a static secret: each of its parts, from a named config

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runline",
-  "version": "0.36.0",
+  "version": "0.37.0",
   "description": "Code mode for agents — turn any API or command into a callable action",
   "type": "module",
   "main": "dist/index.js",