// @bun
import{dh as B,eh as p,kh as _}from"./chunk-2dgwqxhs.js";import{lh as v}from"./chunk-dk53xvr5.js";import{oh as D}from"./chunk-fpj0fg8k.js";import{ph as d}from"./chunk-5khs25a1.js";import{LG as n}from"./chunk-xyhgvt88.js";var x=n(D(),1),E=n(B(),1),i=n(d(),1);import M from"fs/promises";var C=n(d(),1);var A="169.254.170.2",O="169.254.170.23",b="[fd00:ec2::23]",S=(e,a)=>{if(e.protocol==="https:")return;if(e.hostname===A||e.hostname===O||e.hostname===b)return;if(e.hostname.includes("[")){if(e.hostname==="[::1]"||e.hostname==="[0000:0000:0000:0000:0000:0000:0000:0001]")return}else{if(e.hostname==="localhost")return;let c=e.hostname.split("."),r=(t)=>{let s=parseInt(t,10);return 0<=s&&s<=255};if(c[0]==="127"&&r(c[1])&&r(c[2])&&r(c[3])&&c.length===4)return}throw new C.CredentialsProviderError(`URL not accepted. It must either be HTTPS or match one of the following:
  - loopback CIDR 127.0.0.0/8 or [::1/128]
  - ECS container host 169.254.170.2
  - EKS container host 169.254.170.23 or [fd00:ec2::23]`,{logger:a})};var o=n(d(),1),g=n(v(),1),w=n(_(),1),I=n(p(),1);function P(e){return new g.HttpRequest({protocol:e.protocol,hostname:e.hostname,port:Number(e.port),path:e.pathname,query:Array.from(e.searchParams.entries()).reduce((a,[c,r])=>{return a[c]=r,a},{}),fragment:e.hash})}async function K(e,a){let r=await I.sdkStreamMixin(e.body).transformToString();if(e.statusCode===200){let t=JSON.parse(r);if(typeof t.AccessKeyId!=="string"||typeof t.SecretAccessKey!=="string"||typeof t.Token!=="string"||typeof t.Expiration!=="string")throw new o.CredentialsProviderError("HTTP credential provider response not of the required format, an object matching: { AccessKeyId: string, SecretAccessKey: string, Token: string, Expiration: string(rfc3339) }",{logger:a});return{accessKeyId:t.AccessKeyId,secretAccessKey:t.SecretAccessKey,sessionToken:t.Token,expiration:w.parseRfc3339DateTime(t.Expiration)}}if(e.statusCode>=400&&e.statusCode<500){let t={};try{t=JSON.parse(r)}catch(s){}throw Object.assign(new o.CredentialsProviderError(`Server responded with status: ${e.statusCode}`,{logger:a}),{Code:t.Code,Message:t.Message})}throw new o.CredentialsProviderError(`Server responded with status: ${e.statusCode}`,{logger:a})}var T=(e,a,c)=>{return async()=>{for(let r=0;r<a;++r)try{return await e()}catch(t){await new Promise((s)=>setTimeout(s,c))}return await e()}};var N="AWS_CONTAINER_CREDENTIALS_RELATIVE_URI",j="http://169.254.170.2",H="AWS_CONTAINER_CREDENTIALS_FULL_URI",J="AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE",$="AWS_CONTAINER_AUTHORIZATION_TOKEN",G=(e={})=>{e.logger?.debug("@aws-sdk/credential-provider-http - fromHttp");let a,c=e.awsContainerCredentialsRelativeUri??process.env[N],r=e.awsContainerCredentialsFullUri??process.env[H],t=e.awsContainerAuthorizationToken??process.env[$],s=e.awsContainerAuthorizationTokenFile??process.env[J],m=e.logger?.constructor?.name==="NoOpLogger"||!e.logger?.warn?console.warn:e.logger.warn.bind(e.logger);if(c&&r)m("@aws-sdk/credential-provider-http: you have set both awsContainerCredentialsRelativeUri and awsContainerCredentialsFullUri."),m("awsContainerCredentialsFullUri will take precedence.");if(t&&s)m("@aws-sdk/credential-provider-http: you have set both awsContainerAuthorizationToken and awsContainerAuthorizationTokenFile."),m("awsContainerAuthorizationToken will take precedence.");if(r)a=r;else if(c)a=`${j}${c}`;else throw new i.CredentialsProviderError(`No HTTP credential provider host provided.
Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.`,{logger:e.logger});let y=new URL(a);S(y,e.logger);let R=E.NodeHttpHandler.create({requestTimeout:e.timeout??1000,connectionTimeout:e.timeout??1000});return T(async()=>{let f=P(y);if(t)f.headers.Authorization=t;else if(s)f.headers.Authorization=(await M.readFile(s)).toString();try{let h=await R.handle(f);return K(h.response).then((u)=>x.setCredentialFeature(u,"CREDENTIALS_HTTP","z"))}catch(h){throw new i.CredentialsProviderError(String(h),{logger:e.logger})}},e.maxRetries??3,e.timeout??1000)};export{G as ug};
