// @bun
import{Aa as y,Ia as u,Ua as C,ib as P}from"./chunk-fh4rw8kr.js";import"./chunk-2wrs9p57.js";import{zb as A}from"./chunk-ppkzf21q.js";import{Bb as n}from"./chunk-3wpw5xgd.js";import{Gb as d}from"./chunk-0m218zhk.js";var K=d(A(),1);import O from"fs/promises";var E="169.254.170.2",R="169.254.170.23",p="[fd00:ec2::23]",i=(e,a)=>{if(e.protocol==="https:")return;if(e.hostname===E||e.hostname===R||e.hostname===p)return;if(e.hostname.includes("[")){if(e.hostname==="[::1]"||e.hostname==="[0000:0000:0000:0000:0000:0000:0000:0001]")return}else{if(e.hostname==="localhost")return;let c=e.hostname.split("."),r=(t)=>{let s=parseInt(t,10);return 0<=s&&s<=255};if(c[0]==="127"&&r(c[1])&&r(c[2])&&r(c[3])&&c.length===4)return}throw new n(`URL not accepted. It must either be HTTPS or match one of the following:
  - loopback CIDR 127.0.0.0/8 or [::1/128]
  - ECS container host 169.254.170.2
  - EKS container host 169.254.170.23 or [fd00:ec2::23]`,{logger:a})};var S=d(u(),1);function g(e){return new y({protocol:e.protocol,hostname:e.hostname,port:Number(e.port),path:e.pathname,query:Array.from(e.searchParams.entries()).reduce((a,[c,r])=>{return a[c]=r,a},{}),fragment:e.hash})}async function w(e,a){let r=await S.sdkStreamMixin(e.body).transformToString();if(e.statusCode===200){let t=JSON.parse(r);if(typeof t.AccessKeyId!=="string"||typeof t.SecretAccessKey!=="string"||typeof t.Token!=="string"||typeof t.Expiration!=="string")throw new n("HTTP credential provider response not of the required format, an object matching: { AccessKeyId: string, SecretAccessKey: string, Token: string, Expiration: string(rfc3339) }",{logger:a});return{accessKeyId:t.AccessKeyId,secretAccessKey:t.SecretAccessKey,sessionToken:t.Token,expiration:C(t.Expiration)}}if(e.statusCode>=400&&e.statusCode<500){let t={};try{t=JSON.parse(r)}catch(s){}throw Object.assign(new n(`Server responded with status: ${e.statusCode}`,{logger:a}),{Code:t.Code,Message:t.Message})}throw new n(`Server responded with status: ${e.statusCode}`,{logger:a})}var I=(e,a,c)=>{return async()=>{for(let r=0;r<a;++r)try{return await e()}catch(t){await new Promise((s)=>setTimeout(s,c))}return await e()}};var b="AWS_CONTAINER_CREDENTIALS_RELATIVE_URI",v="http://169.254.170.2",_="AWS_CONTAINER_CREDENTIALS_FULL_URI",B="AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE",D="AWS_CONTAINER_AUTHORIZATION_TOKEN",M=(e={})=>{e.logger?.debug("@aws-sdk/credential-provider-http - fromHttp");let a,c=e.awsContainerCredentialsRelativeUri??process.env[b],r=e.awsContainerCredentialsFullUri??process.env[_],t=e.awsContainerAuthorizationToken??process.env[D],s=e.awsContainerAuthorizationTokenFile??process.env[B],m=e.logger?.constructor?.name==="NoOpLogger"||!e.logger?console.warn:e.logger.warn;if(c&&r)m("@aws-sdk/credential-provider-http: you have set both awsContainerCredentialsRelativeUri and awsContainerCredentialsFullUri."),m("awsContainerCredentialsFullUri will take precedence.");if(t&&s)m("@aws-sdk/credential-provider-http: you have set both awsContainerAuthorizationToken and awsContainerAuthorizationTokenFile."),m("awsContainerAuthorizationToken will take precedence.");if(r)a=r;else if(c)a=`${v}${c}`;else throw new n(`No HTTP credential provider host provided.
Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.`,{logger:e.logger});let h=new URL(a);i(h,e.logger);let T=new P({requestTimeout:e.timeout??1000,connectionTimeout:e.timeout??1000});return I(async()=>{let o=g(h);if(t)o.headers.Authorization=t;else if(s)o.headers.Authorization=(await O.readFile(s)).toString();try{let f=await T.handle(o);return w(f.response).then((x)=>K.setCredentialFeature(x,"CREDENTIALS_HTTP","z"))}catch(f){throw new n(String(f),{logger:e.logger})}},e.maxRetries??3,e.timeout??1000)};export{M as fromHttp};
