import { a as CredentialsProviderError, s as setCredentialFeature, H as HttpRequest, b as sdkStreamMixin, p as parseRfc3339DateTime } from './role-executor-C4-3bmgC.js';
import { N as NodeHttpHandler } from './node-http-handler-Bt_LmISw.js';
import fs$1 from 'node:fs/promises';
import './paths-2M_UxD_H.js';
import 'node:fs';
import 'node:path';
import 'node:os';
import 'node:events';
import 'node:diagnostics_channel';
import 'fs';
import 'events';
import 'util';
import 'path';
import 'assert';
import 'worker_threads';
import 'module';
import 'node:url';
import 'url';
import 'buffer';
import 'node:module';
import 'node:child_process';
import 'node:crypto';
import 'node:process';
import 'node:async_hooks';
import './credential-pool-B04qO8at.js';
import './index-IVoIz4D5.js';
import 'constants';
import 'stream';
import './config-B0nEjgSh.js';
import './json-DXl7iDYg.js';
import './lock-BoHF25mx.js';
import './index-Ca4C2M45.js';
import './role-resolver-DF9BQ_U6.js';
import 'node:stream';
import 'crypto';
import 'os';
import 'node:http2';
import 'fs/promises';
import 'node:net';
import 'node:https';

//#region ../../node_modules/.pnpm/@aws-sdk+credential-provider-http@3.972.39/node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/checkUrl.js
var ECS_CONTAINER_HOST = "169.254.170.2";
var EKS_CONTAINER_HOST_IPv4 = "169.254.170.23";
var EKS_CONTAINER_HOST_IPv6 = "[fd00:ec2::23]";
var checkUrl = (url, logger) => {
	if (url.protocol === "https:") return;
	if (url.hostname === ECS_CONTAINER_HOST || url.hostname === EKS_CONTAINER_HOST_IPv4 || url.hostname === EKS_CONTAINER_HOST_IPv6) return;
	if (url.hostname.includes("[")) {
		if (url.hostname === "[::1]" || url.hostname === "[0000:0000:0000:0000:0000:0000:0000:0001]") return;
	} else {
		if (url.hostname === "localhost") return;
		const ipComponents = url.hostname.split(".");
		const inRange = (component) => {
			const num = parseInt(component, 10);
			return 0 <= num && num <= 255;
		};
		if (ipComponents[0] === "127" && inRange(ipComponents[1]) && inRange(ipComponents[2]) && inRange(ipComponents[3]) && ipComponents.length === 4) return;
	}
	throw new CredentialsProviderError(`URL not accepted. It must either be HTTPS or match one of the following:
  - loopback CIDR 127.0.0.0/8 or [::1/128]
  - ECS container host 169.254.170.2
  - EKS container host 169.254.170.23 or [fd00:ec2::23]`, { logger });
};
//#endregion
//#region ../../node_modules/.pnpm/@aws-sdk+credential-provider-http@3.972.39/node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/requestHelpers.js
function createGetRequest(url) {
	return new HttpRequest({
		protocol: url.protocol,
		hostname: url.hostname,
		port: Number(url.port),
		path: url.pathname,
		query: Array.from(url.searchParams.entries()).reduce((acc, [k, v]) => {
			acc[k] = v;
			return acc;
		}, {}),
		fragment: url.hash
	});
}
async function getCredentials(response, logger) {
	const str = await sdkStreamMixin(response.body).transformToString();
	if (response.statusCode === 200) {
		const parsed = JSON.parse(str);
		if (typeof parsed.AccessKeyId !== "string" || typeof parsed.SecretAccessKey !== "string" || typeof parsed.Token !== "string" || typeof parsed.Expiration !== "string") throw new CredentialsProviderError("HTTP credential provider response not of the required format, an object matching: { AccessKeyId: string, SecretAccessKey: string, Token: string, Expiration: string(rfc3339) }", { logger });
		return {
			accessKeyId: parsed.AccessKeyId,
			secretAccessKey: parsed.SecretAccessKey,
			sessionToken: parsed.Token,
			expiration: parseRfc3339DateTime(parsed.Expiration)
		};
	}
	if (response.statusCode >= 400 && response.statusCode < 500) {
		let parsedBody = {};
		try {
			parsedBody = JSON.parse(str);
		} catch (e) {}
		throw Object.assign(new CredentialsProviderError(`Server responded with status: ${response.statusCode}`, { logger }), {
			Code: parsedBody.Code,
			Message: parsedBody.Message
		});
	}
	throw new CredentialsProviderError(`Server responded with status: ${response.statusCode}`, { logger });
}
//#endregion
//#region ../../node_modules/.pnpm/@aws-sdk+credential-provider-http@3.972.39/node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/retry-wrapper.js
var retryWrapper = (toRetry, maxRetries, delayMs) => {
	return async () => {
		for (let i = 0; i < maxRetries; ++i) try {
			return await toRetry();
		} catch (e) {
			await new Promise((resolve) => setTimeout(resolve, delayMs));
		}
		return await toRetry();
	};
};
//#endregion
//#region ../../node_modules/.pnpm/@aws-sdk+credential-provider-http@3.972.39/node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/fromHttp.js
var AWS_CONTAINER_CREDENTIALS_RELATIVE_URI = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI";
var DEFAULT_LINK_LOCAL_HOST = "http://169.254.170.2";
var AWS_CONTAINER_CREDENTIALS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI";
var AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE = "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE";
var AWS_CONTAINER_AUTHORIZATION_TOKEN = "AWS_CONTAINER_AUTHORIZATION_TOKEN";
var fromHttp = (options = {}) => {
	options.logger?.debug("@aws-sdk/credential-provider-http - fromHttp");
	let host;
	const relative = options.awsContainerCredentialsRelativeUri ?? process.env[AWS_CONTAINER_CREDENTIALS_RELATIVE_URI];
	const full = options.awsContainerCredentialsFullUri ?? process.env[AWS_CONTAINER_CREDENTIALS_FULL_URI];
	const token = options.awsContainerAuthorizationToken ?? process.env[AWS_CONTAINER_AUTHORIZATION_TOKEN];
	const tokenFile = options.awsContainerAuthorizationTokenFile ?? process.env[AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE];
	const warn = options.logger?.constructor?.name === "NoOpLogger" || !options.logger?.warn ? console.warn : options.logger.warn.bind(options.logger);
	if (relative && full) {
		warn("@aws-sdk/credential-provider-http: you have set both awsContainerCredentialsRelativeUri and awsContainerCredentialsFullUri.");
		warn("awsContainerCredentialsFullUri will take precedence.");
	}
	if (token && tokenFile) {
		warn("@aws-sdk/credential-provider-http: you have set both awsContainerAuthorizationToken and awsContainerAuthorizationTokenFile.");
		warn("awsContainerAuthorizationToken will take precedence.");
	}
	if (full) host = full;
	else if (relative) host = `${DEFAULT_LINK_LOCAL_HOST}${relative}`;
	else throw new CredentialsProviderError(`No HTTP credential provider host provided.
Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.`, { logger: options.logger });
	const url = new URL(host);
	checkUrl(url, options.logger);
	const requestHandler = NodeHttpHandler.create({
		requestTimeout: options.timeout ?? 1e3,
		connectionTimeout: options.timeout ?? 1e3
	});
	return retryWrapper(async () => {
		const request = createGetRequest(url);
		if (token) request.headers.Authorization = token;
		else if (tokenFile) request.headers.Authorization = (await fs$1.readFile(tokenFile)).toString();
		try {
			return getCredentials((await requestHandler.handle(request)).response).then((creds) => setCredentialFeature(creds, "CREDENTIALS_HTTP", "z"));
		} catch (e) {
			throw new CredentialsProviderError(String(e), { logger: options.logger });
		}
	}, options.maxRetries ?? 3, options.timeout ?? 1e3);
};

export { fromHttp };
//# sourceMappingURL=dist-es4-DZgvsxry.js.map
