// @bun
import{Fa as v,Ha as b,Ta as w,xa as g}from"./chunk-13143jmy.js";import"./chunk-25nxsybw.js";import{tb as _}from"./chunk-f0ksrase.js";import{ub as i}from"./chunk-08bm2xax.js";import{vb as n}from"./chunk-qqp394c2.js";var x=n(_(),1),E=n(v(),1),d=n(i(),1);import B from"fs/promises";var C=n(i(),1);var u="169.254.170.2",A="169.254.170.23",O="[fd00:ec2::23]",S=(e,a)=>{if(e.protocol==="https:")return;if(e.hostname===u||e.hostname===A||e.hostname===O)return;if(e.hostname.includes("[")){if(e.hostname==="[::1]"||e.hostname==="[0000:0000:0000:0000:0000:0000:0000:0001]")return}else{if(e.hostname==="localhost")return;let c=e.hostname.split("."),r=(t)=>{let s=parseInt(t,10);return 0<=s&&s<=255};if(c[0]==="127"&&r(c[1])&&r(c[2])&&r(c[3])&&c.length===4)return}throw new C.CredentialsProviderError(`URL not accepted. It must either be HTTPS or match one of the following:
  - loopback CIDR 127.0.0.0/8 or [::1/128]
  - ECS container host 169.254.170.2
  - EKS container host 169.254.170.23 or [fd00:ec2::23]`,{logger:a})};var o=n(i(),1);var I=n(b(),1);function P(e){return new g({protocol:e.protocol,hostname:e.hostname,port:Number(e.port),path:e.pathname,query:Array.from(e.searchParams.entries()).reduce((a,[c,r])=>{return a[c]=r,a},{}),fragment:e.hash})}async function K(e,a){let r=await I.sdkStreamMixin(e.body).transformToString();if(e.statusCode===200){let t=JSON.parse(r);if(typeof t.AccessKeyId!=="string"||typeof t.SecretAccessKey!=="string"||typeof t.Token!=="string"||typeof t.Expiration!=="string")throw new o.CredentialsProviderError("HTTP credential provider response not of the required format, an object matching: { AccessKeyId: string, SecretAccessKey: string, Token: string, Expiration: string(rfc3339) }",{logger:a});return{accessKeyId:t.AccessKeyId,secretAccessKey:t.SecretAccessKey,sessionToken:t.Token,expiration:w(t.Expiration)}}if(e.statusCode>=400&&e.statusCode<500){let t={};try{t=JSON.parse(r)}catch(s){}throw Object.assign(new o.CredentialsProviderError(`Server responded with status: ${e.statusCode}`,{logger:a}),{Code:t.Code,Message:t.Message})}throw new o.CredentialsProviderError(`Server responded with status: ${e.statusCode}`,{logger:a})}var T=(e,a,c)=>{return async()=>{for(let r=0;r<a;++r)try{return await e()}catch(t){await new Promise((s)=>setTimeout(s,c))}return await e()}};var D="AWS_CONTAINER_CREDENTIALS_RELATIVE_URI",M="http://169.254.170.2",N="AWS_CONTAINER_CREDENTIALS_FULL_URI",j="AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE",H="AWS_CONTAINER_AUTHORIZATION_TOKEN",J=(e={})=>{e.logger?.debug("@aws-sdk/credential-provider-http - fromHttp");let a,c=e.awsContainerCredentialsRelativeUri??process.env[D],r=e.awsContainerCredentialsFullUri??process.env[N],t=e.awsContainerAuthorizationToken??process.env[H],s=e.awsContainerAuthorizationTokenFile??process.env[j],m=e.logger?.constructor?.name==="NoOpLogger"||!e.logger?console.warn:e.logger.warn;if(c&&r)m("@aws-sdk/credential-provider-http: you have set both awsContainerCredentialsRelativeUri and awsContainerCredentialsFullUri."),m("awsContainerCredentialsFullUri will take precedence.");if(t&&s)m("@aws-sdk/credential-provider-http: you have set both awsContainerAuthorizationToken and awsContainerAuthorizationTokenFile."),m("awsContainerAuthorizationToken will take precedence.");if(r)a=r;else if(c)a=`${M}${c}`;else throw new d.CredentialsProviderError(`No HTTP credential provider host provided.
Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.`,{logger:e.logger});let y=new URL(a);S(y,e.logger);let R=new E.NodeHttpHandler({requestTimeout:e.timeout??1000,connectionTimeout:e.timeout??1000});return T(async()=>{let f=P(y);if(t)f.headers.Authorization=t;else if(s)f.headers.Authorization=(await B.readFile(s)).toString();try{let h=await R.handle(f);return K(h.response).then((p)=>x.setCredentialFeature(p,"CREDENTIALS_HTTP","z"))}catch(h){throw new d.CredentialsProviderError(String(h),{logger:e.logger})}},e.maxRetries??3,e.timeout??1000)};export{J as fromHttp};
