'use strict';

var OAYLBSRH_cjs = require('./OAYLBSRH.cjs');
var VVTDADG7_cjs = require('./VVTDADG7.cjs');
require('./DPDVRYLI.cjs');
var BXO3RC75_cjs = require('./BXO3RC75.cjs');
var VO65XOWD_cjs = require('./VO65XOWD.cjs');
var fs = require('fs');

// ../../node_modules/.pnpm/@aws-sdk+credential-provider-sso@3.879.0/node_modules/@aws-sdk/credential-provider-sso/dist-es/index.js
VO65XOWD_cjs.init_cjs_shims();

// ../../node_modules/.pnpm/@aws-sdk+credential-provider-sso@3.879.0/node_modules/@aws-sdk/credential-provider-sso/dist-es/fromSSO.js
VO65XOWD_cjs.init_cjs_shims();

// ../../node_modules/.pnpm/@aws-sdk+credential-provider-sso@3.879.0/node_modules/@aws-sdk/credential-provider-sso/dist-es/isSsoProfile.js
VO65XOWD_cjs.init_cjs_shims();
var isSsoProfile = /* @__PURE__ */ VO65XOWD_cjs.__name((arg) => arg && (typeof arg.sso_start_url === "string" || typeof arg.sso_account_id === "string" || typeof arg.sso_session === "string" || typeof arg.sso_region === "string" || typeof arg.sso_role_name === "string"), "isSsoProfile");

// ../../node_modules/.pnpm/@aws-sdk+credential-provider-sso@3.879.0/node_modules/@aws-sdk/credential-provider-sso/dist-es/resolveSSOCredentials.js
VO65XOWD_cjs.init_cjs_shims();

// ../../node_modules/.pnpm/@aws-sdk+token-providers@3.879.0/node_modules/@aws-sdk/token-providers/dist-es/fromSso.js
VO65XOWD_cjs.init_cjs_shims();

// ../../node_modules/.pnpm/@aws-sdk+token-providers@3.879.0/node_modules/@aws-sdk/token-providers/dist-es/constants.js
VO65XOWD_cjs.init_cjs_shims();
var EXPIRE_WINDOW_MS = 5 * 60 * 1e3;
var REFRESH_MESSAGE = `To refresh this SSO session run 'aws sso login' with the corresponding profile.`;

// ../../node_modules/.pnpm/@aws-sdk+token-providers@3.879.0/node_modules/@aws-sdk/token-providers/dist-es/getNewSsoOidcToken.js
VO65XOWD_cjs.init_cjs_shims();

// ../../node_modules/.pnpm/@aws-sdk+token-providers@3.879.0/node_modules/@aws-sdk/token-providers/dist-es/getSsoOidcClient.js
VO65XOWD_cjs.init_cjs_shims();
var getSsoOidcClient = /* @__PURE__ */ VO65XOWD_cjs.__name(async (ssoRegion, init = {}) => {
  const { SSOOIDCClient } = await import('./VYFY2754.cjs');
  const ssoOidcClient = new SSOOIDCClient(Object.assign({}, init.clientConfig ?? {}, {
    region: ssoRegion ?? init.clientConfig?.region,
    logger: init.clientConfig?.logger ?? init.parentClientConfig?.logger
  }));
  return ssoOidcClient;
}, "getSsoOidcClient");

// ../../node_modules/.pnpm/@aws-sdk+token-providers@3.879.0/node_modules/@aws-sdk/token-providers/dist-es/getNewSsoOidcToken.js
var getNewSsoOidcToken = /* @__PURE__ */ VO65XOWD_cjs.__name(async (ssoToken, ssoRegion, init = {}) => {
  const { CreateTokenCommand } = await import('./VYFY2754.cjs');
  const ssoOidcClient = await getSsoOidcClient(ssoRegion, init);
  return ssoOidcClient.send(new CreateTokenCommand({
    clientId: ssoToken.clientId,
    clientSecret: ssoToken.clientSecret,
    refreshToken: ssoToken.refreshToken,
    grantType: "refresh_token"
  }));
}, "getNewSsoOidcToken");

// ../../node_modules/.pnpm/@aws-sdk+token-providers@3.879.0/node_modules/@aws-sdk/token-providers/dist-es/validateTokenExpiry.js
VO65XOWD_cjs.init_cjs_shims();
var validateTokenExpiry = /* @__PURE__ */ VO65XOWD_cjs.__name((token) => {
  if (token.expiration && token.expiration.getTime() < Date.now()) {
    throw new BXO3RC75_cjs.TokenProviderError(`Token is expired. ${REFRESH_MESSAGE}`, false);
  }
}, "validateTokenExpiry");

// ../../node_modules/.pnpm/@aws-sdk+token-providers@3.879.0/node_modules/@aws-sdk/token-providers/dist-es/validateTokenKey.js
VO65XOWD_cjs.init_cjs_shims();
var validateTokenKey = /* @__PURE__ */ VO65XOWD_cjs.__name((key, value, forRefresh = false) => {
  if (typeof value === "undefined") {
    throw new BXO3RC75_cjs.TokenProviderError(`Value not present for '${key}' in SSO Token${forRefresh ? ". Cannot refresh" : ""}. ${REFRESH_MESSAGE}`, false);
  }
}, "validateTokenKey");

// ../../node_modules/.pnpm/@aws-sdk+token-providers@3.879.0/node_modules/@aws-sdk/token-providers/dist-es/writeSSOTokenToFile.js
VO65XOWD_cjs.init_cjs_shims();
var { writeFile } = fs.promises;
var writeSSOTokenToFile = /* @__PURE__ */ VO65XOWD_cjs.__name((id, ssoToken) => {
  const tokenFilepath = OAYLBSRH_cjs.getSSOTokenFilepath(id);
  const tokenString = JSON.stringify(ssoToken, null, 2);
  return writeFile(tokenFilepath, tokenString);
}, "writeSSOTokenToFile");

// ../../node_modules/.pnpm/@aws-sdk+token-providers@3.879.0/node_modules/@aws-sdk/token-providers/dist-es/fromSso.js
var lastRefreshAttemptTime = /* @__PURE__ */ new Date(0);
var fromSso = /* @__PURE__ */ VO65XOWD_cjs.__name((_init = {}) => async ({ callerClientConfig } = {}) => {
  const init = {
    ..._init,
    parentClientConfig: {
      ...callerClientConfig,
      ..._init.parentClientConfig
    }
  };
  init.logger?.debug("@aws-sdk/token-providers - fromSso");
  const profiles = await OAYLBSRH_cjs.parseKnownFiles(init);
  const profileName = OAYLBSRH_cjs.getProfileName({
    profile: init.profile ?? callerClientConfig?.profile
  });
  const profile = profiles[profileName];
  if (!profile) {
    throw new BXO3RC75_cjs.TokenProviderError(`Profile '${profileName}' could not be found in shared credentials file.`, false);
  } else if (!profile["sso_session"]) {
    throw new BXO3RC75_cjs.TokenProviderError(`Profile '${profileName}' is missing required property 'sso_session'.`);
  }
  const ssoSessionName = profile["sso_session"];
  const ssoSessions = await OAYLBSRH_cjs.loadSsoSessionData(init);
  const ssoSession = ssoSessions[ssoSessionName];
  if (!ssoSession) {
    throw new BXO3RC75_cjs.TokenProviderError(`Sso session '${ssoSessionName}' could not be found in shared credentials file.`, false);
  }
  for (const ssoSessionRequiredKey of [
    "sso_start_url",
    "sso_region"
  ]) {
    if (!ssoSession[ssoSessionRequiredKey]) {
      throw new BXO3RC75_cjs.TokenProviderError(`Sso session '${ssoSessionName}' is missing required property '${ssoSessionRequiredKey}'.`, false);
    }
  }
  ssoSession["sso_start_url"];
  const ssoRegion = ssoSession["sso_region"];
  let ssoToken;
  try {
    ssoToken = await OAYLBSRH_cjs.getSSOTokenFromFile(ssoSessionName);
  } catch (e) {
    throw new BXO3RC75_cjs.TokenProviderError(`The SSO session token associated with profile=${profileName} was not found or is invalid. ${REFRESH_MESSAGE}`, false);
  }
  validateTokenKey("accessToken", ssoToken.accessToken);
  validateTokenKey("expiresAt", ssoToken.expiresAt);
  const { accessToken, expiresAt } = ssoToken;
  const existingToken = {
    token: accessToken,
    expiration: new Date(expiresAt)
  };
  if (existingToken.expiration.getTime() - Date.now() > EXPIRE_WINDOW_MS) {
    return existingToken;
  }
  if (Date.now() - lastRefreshAttemptTime.getTime() < 30 * 1e3) {
    validateTokenExpiry(existingToken);
    return existingToken;
  }
  validateTokenKey("clientId", ssoToken.clientId, true);
  validateTokenKey("clientSecret", ssoToken.clientSecret, true);
  validateTokenKey("refreshToken", ssoToken.refreshToken, true);
  try {
    lastRefreshAttemptTime.setTime(Date.now());
    const newSsoOidcToken = await getNewSsoOidcToken(ssoToken, ssoRegion, init);
    validateTokenKey("accessToken", newSsoOidcToken.accessToken);
    validateTokenKey("expiresIn", newSsoOidcToken.expiresIn);
    const newTokenExpiration = new Date(Date.now() + newSsoOidcToken.expiresIn * 1e3);
    try {
      await writeSSOTokenToFile(ssoSessionName, {
        ...ssoToken,
        accessToken: newSsoOidcToken.accessToken,
        expiresAt: newTokenExpiration.toISOString(),
        refreshToken: newSsoOidcToken.refreshToken
      });
    } catch (error) {
    }
    return {
      token: newSsoOidcToken.accessToken,
      expiration: newTokenExpiration
    };
  } catch (error) {
    validateTokenExpiry(existingToken);
    return existingToken;
  }
}, "fromSso");

// ../../node_modules/.pnpm/@aws-sdk+credential-provider-sso@3.879.0/node_modules/@aws-sdk/credential-provider-sso/dist-es/resolveSSOCredentials.js
var SHOULD_FAIL_CREDENTIAL_CHAIN = false;
var resolveSSOCredentials = /* @__PURE__ */ VO65XOWD_cjs.__name(async ({ ssoStartUrl, ssoSession, ssoAccountId, ssoRegion, ssoRoleName, ssoClient, clientConfig, parentClientConfig, profile, logger }) => {
  let token;
  const refreshMessage = `To refresh this SSO session run aws sso login with the corresponding profile.`;
  if (ssoSession) {
    try {
      const _token = await fromSso({
        profile
      })();
      token = {
        accessToken: _token.token,
        expiresAt: new Date(_token.expiration).toISOString()
      };
    } catch (e) {
      throw new BXO3RC75_cjs.CredentialsProviderError(e.message, {
        tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
        logger
      });
    }
  } else {
    try {
      token = await OAYLBSRH_cjs.getSSOTokenFromFile(ssoStartUrl);
    } catch (e) {
      throw new BXO3RC75_cjs.CredentialsProviderError(`The SSO session associated with this profile is invalid. ${refreshMessage}`, {
        tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
        logger
      });
    }
  }
  if (new Date(token.expiresAt).getTime() - Date.now() <= 0) {
    throw new BXO3RC75_cjs.CredentialsProviderError(`The SSO session associated with this profile has expired. ${refreshMessage}`, {
      tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
      logger
    });
  }
  const { accessToken } = token;
  const { SSOClient, GetRoleCredentialsCommand } = await import('./DW3OZE6F.cjs');
  const sso = ssoClient || new SSOClient(Object.assign({}, clientConfig ?? {}, {
    logger: clientConfig?.logger ?? parentClientConfig?.logger,
    region: clientConfig?.region ?? ssoRegion
  }));
  let ssoResp;
  try {
    ssoResp = await sso.send(new GetRoleCredentialsCommand({
      accountId: ssoAccountId,
      roleName: ssoRoleName,
      accessToken
    }));
  } catch (e) {
    throw new BXO3RC75_cjs.CredentialsProviderError(e, {
      tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
      logger
    });
  }
  const { roleCredentials: { accessKeyId, secretAccessKey, sessionToken, expiration, credentialScope, accountId } = {} } = ssoResp;
  if (!accessKeyId || !secretAccessKey || !sessionToken || !expiration) {
    throw new BXO3RC75_cjs.CredentialsProviderError("SSO returns an invalid temporary credential.", {
      tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,
      logger
    });
  }
  const credentials = {
    accessKeyId,
    secretAccessKey,
    sessionToken,
    expiration: new Date(expiration),
    ...credentialScope && {
      credentialScope
    },
    ...accountId && {
      accountId
    }
  };
  if (ssoSession) {
    VVTDADG7_cjs.setCredentialFeature(credentials, "CREDENTIALS_SSO", "s");
  } else {
    VVTDADG7_cjs.setCredentialFeature(credentials, "CREDENTIALS_SSO_LEGACY", "u");
  }
  return credentials;
}, "resolveSSOCredentials");

// ../../node_modules/.pnpm/@aws-sdk+credential-provider-sso@3.879.0/node_modules/@aws-sdk/credential-provider-sso/dist-es/validateSsoProfile.js
VO65XOWD_cjs.init_cjs_shims();
var validateSsoProfile = /* @__PURE__ */ VO65XOWD_cjs.__name((profile, logger) => {
  const { sso_start_url, sso_account_id, sso_region, sso_role_name } = profile;
  if (!sso_start_url || !sso_account_id || !sso_region || !sso_role_name) {
    throw new BXO3RC75_cjs.CredentialsProviderError(`Profile is configured with invalid SSO credentials. Required parameters "sso_account_id", "sso_region", "sso_role_name", "sso_start_url". Got ${Object.keys(profile).join(", ")}
Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html`, {
      tryNextLink: false,
      logger
    });
  }
  return profile;
}, "validateSsoProfile");

// ../../node_modules/.pnpm/@aws-sdk+credential-provider-sso@3.879.0/node_modules/@aws-sdk/credential-provider-sso/dist-es/fromSSO.js
var fromSSO = /* @__PURE__ */ VO65XOWD_cjs.__name((init = {}) => async ({ callerClientConfig } = {}) => {
  init.logger?.debug("@aws-sdk/credential-provider-sso - fromSSO");
  const { ssoStartUrl, ssoAccountId, ssoRegion, ssoRoleName, ssoSession } = init;
  const { ssoClient } = init;
  const profileName = OAYLBSRH_cjs.getProfileName({
    profile: init.profile ?? callerClientConfig?.profile
  });
  if (!ssoStartUrl && !ssoAccountId && !ssoRegion && !ssoRoleName && !ssoSession) {
    const profiles = await OAYLBSRH_cjs.parseKnownFiles(init);
    const profile = profiles[profileName];
    if (!profile) {
      throw new BXO3RC75_cjs.CredentialsProviderError(`Profile ${profileName} was not found.`, {
        logger: init.logger
      });
    }
    if (!isSsoProfile(profile)) {
      throw new BXO3RC75_cjs.CredentialsProviderError(`Profile ${profileName} is not configured with SSO credentials.`, {
        logger: init.logger
      });
    }
    if (profile?.sso_session) {
      const ssoSessions = await OAYLBSRH_cjs.loadSsoSessionData(init);
      const session = ssoSessions[profile.sso_session];
      const conflictMsg = ` configurations in profile ${profileName} and sso-session ${profile.sso_session}`;
      if (ssoRegion && ssoRegion !== session.sso_region) {
        throw new BXO3RC75_cjs.CredentialsProviderError(`Conflicting SSO region` + conflictMsg, {
          tryNextLink: false,
          logger: init.logger
        });
      }
      if (ssoStartUrl && ssoStartUrl !== session.sso_start_url) {
        throw new BXO3RC75_cjs.CredentialsProviderError(`Conflicting SSO start_url` + conflictMsg, {
          tryNextLink: false,
          logger: init.logger
        });
      }
      profile.sso_region = session.sso_region;
      profile.sso_start_url = session.sso_start_url;
    }
    const { sso_start_url, sso_account_id, sso_region, sso_role_name, sso_session } = validateSsoProfile(profile, init.logger);
    return resolveSSOCredentials({
      ssoStartUrl: sso_start_url,
      ssoSession: sso_session,
      ssoAccountId: sso_account_id,
      ssoRegion: sso_region,
      ssoRoleName: sso_role_name,
      ssoClient,
      clientConfig: init.clientConfig,
      parentClientConfig: init.parentClientConfig,
      profile: profileName
    });
  } else if (!ssoStartUrl || !ssoAccountId || !ssoRegion || !ssoRoleName) {
    throw new BXO3RC75_cjs.CredentialsProviderError('Incomplete configuration. The fromSSO() argument hash must include "ssoStartUrl", "ssoAccountId", "ssoRegion", "ssoRoleName"', {
      tryNextLink: false,
      logger: init.logger
    });
  } else {
    return resolveSSOCredentials({
      ssoStartUrl,
      ssoSession,
      ssoAccountId,
      ssoRegion,
      ssoRoleName,
      ssoClient,
      clientConfig: init.clientConfig,
      parentClientConfig: init.parentClientConfig,
      profile: profileName
    });
  }
}, "fromSSO");

// ../../node_modules/.pnpm/@aws-sdk+credential-provider-sso@3.879.0/node_modules/@aws-sdk/credential-provider-sso/dist-es/types.js
VO65XOWD_cjs.init_cjs_shims();

exports.fromSSO = fromSSO;
exports.isSsoProfile = isSsoProfile;
exports.validateSsoProfile = validateSsoProfile;
//# sourceMappingURL=EE3HP6UB.cjs.map
//# sourceMappingURL=EE3HP6UB.cjs.map