{"version":3,"sources":["jsdelivr-header.js","/npm/@aws-sdk/credential-provider-sso@3.972.49/dist-cjs/index.js"],"names":[],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA,ACNA,aAEA,IAAI,OAAS,QAAQ,uBACjB,OAAS,QAAQ,wBACjB,eAAiB,QAAQ,4BAE7B,MAAM,aAAgB,GAAQ,IACI,iBAAtB,EAAI,eACsB,iBAAvB,EAAI,gBACgB,iBAApB,EAAI,aACe,iBAAnB,EAAI,YACkB,iBAAtB,EAAI,eAEb,8BAA+B,EAC/B,sBAAwB,OAAS,cAAa,aAAY,eAAc,YAAW,cAAa,YAAW,eAAc,qBAAoB,qBAAoB,UAAS,WAAU,iBAAgB,cAAa,aACnN,IAAI,EACJ,MAAM,EAAiB,gFACvB,GAAI,EACA,IACI,MAAM,QAAe,eAAe,QAAQ,CACxC,UACA,WACA,iBACA,eAJiB,GAMrB,EAAQ,CACJ,YAAa,EAAO,MACpB,UAAW,IAAI,KAAK,EAAO,YAAY,cAE/C,CACA,MAAO,GACH,MAAM,IAAI,OAAO,yBAAyB,EAAE,QAAS,CACjD,YAnBqB,MAoBrB,UAER,MAGA,IACI,QAAc,OAAO,oBAAoB,EAC7C,CACA,MAAO,GACH,MAAM,IAAI,OAAO,yBAAyB,4DAA4D,IAAkB,CACpH,YA9BqB,MA+BrB,UAER,CAEJ,GAAI,IAAI,KAAK,EAAM,WAAW,UAAY,KAAK,OAAS,EACpD,MAAM,IAAI,OAAO,yBAAyB,6DAA6D,IAAkB,CACrH,YArCyB,MAsCzB,WAGR,MAAM,YAAE,GAAgB,GAClB,UAAE,EAAS,0BAAE,SAAoC,QAAQ,UAAU,KAAK,WAAc,OAAO,QAAQ,wBAA0B,GAC/H,EAAM,GACR,IAAI,EAAU,OAAO,OAAO,CAAC,EAAG,GAAgB,CAAC,EAAG,CAChD,OAAQ,GAAc,QAAU,GAAoB,QAAU,GAAoB,OAClF,OAAQ,GAAc,QAAU,EAChC,eAAgB,GAAc,gBAAkB,GAAoB,gBAAkB,GAAoB,kBAElH,IAAI,EACJ,IACI,QAAgB,EAAI,KAAK,IAAI,EAA0B,CACnD,UAAW,EACX,SAAU,EACV,gBAER,CACA,MAAO,GACH,MAAM,IAAI,OAAO,yBAAyB,EAAG,CACzC,YA3DyB,MA4DzB,UAER,CACA,MAAQ,iBAAiB,YAAE,EAAW,gBAAE,EAAe,aAAE,EAAY,WAAE,EAAU,gBAAE,EAAe,UAAE,GAAc,CAAC,GAAO,EAC1H,KAAK,GAAgB,GAAoB,GAAiB,GACtD,MAAM,IAAI,OAAO,yBAAyB,+CAAgD,CACtF,YAlEyB,MAmEzB,WAGR,MAAM,EAAc,CAChB,cACA,kBACA,eACA,WAAY,IAAI,KAAK,MACjB,GAAmB,CAAE,sBACrB,GAAa,CAAE,cAQvB,OANI,EACA,OAAO,qBAAqB,EAAa,kBAAmB,KAG5D,OAAO,qBAAqB,EAAa,yBAA0B,KAEhE,GAGL,mBAAqB,CAAC,EAAS,KACjC,MAAM,cAAE,EAAa,eAAE,EAAc,WAAE,EAAU,cAAE,GAAkB,EACrE,KAAK,GAAkB,GAAmB,GAAe,GACrD,MAAM,IAAI,OAAO,yBACb,iJAAuD,OAAO,KAAK,GAAS,KAAK,4FAA6F,CAAE,aAAa,EAAO,WAE5M,OAAO,GAGL,QAAU,CAAC,EAAO,CAAC,IAAM,OAAS,sBAAuB,CAAC,KAC5D,EAAK,QAAQ,MAAM,8CACnB,MAAM,YAAE,EAAW,aAAE,EAAY,UAAE,EAAS,YAAE,EAAW,WAAE,GAAe,GACpE,UAAE,GAAc,EAChB,EAAc,OAAO,eAAe,CACtC,QAAS,EAAK,SAAW,GAAoB,UAEjD,GAAK,GAAgB,GAAiB,GAAc,GAAgB,EAgD/D,IAAK,GAAgB,GAAiB,GAAc,EAKrD,OAAO,sBAAsB,CACzB,cACA,aACA,eACA,YACA,cACA,YACA,aAAc,EAAK,aACnB,mBAAoB,EAAK,mBACzB,mBAAoB,EAAK,mBACzB,QAAS,EACT,SAAU,EAAK,SACf,eAAgB,EAAK,eACrB,YAAa,EAAK,YAClB,OAAQ,EAAK,SAlBjB,MAAM,IAAI,OAAO,yBAAyB,+HACuB,CAAE,aAAa,EAAO,OAAQ,EAAK,QAmBxG,CArEgF,CAC5E,MACM,SADiB,OAAO,gBAAgB,IACrB,GACzB,IAAK,EACD,MAAM,IAAI,OAAO,yBAAyB,WAAW,mBAA8B,CAAE,OAAQ,EAAK,SAEtG,IAAK,aAAa,GACd,MAAM,IAAI,OAAO,yBAAyB,WAAW,4CAAuD,CACxG,OAAQ,EAAK,SAGrB,GAAI,GAAS,YAAa,CACtB,MACM,SADoB,OAAO,mBAAmB,IACxB,EAAQ,aAC9B,EAAc,8BAA8B,qBAA+B,EAAQ,cACzF,GAAI,GAAa,IAAc,EAAQ,WACnC,MAAM,IAAI,OAAO,yBAAyB,yBAA2B,EAAa,CAC9E,aAAa,EACb,OAAQ,EAAK,SAGrB,GAAI,GAAe,IAAgB,EAAQ,cACvC,MAAM,IAAI,OAAO,yBAAyB,4BAA8B,EAAa,CACjF,aAAa,EACb,OAAQ,EAAK,SAGrB,EAAQ,WAAa,EAAQ,WAC7B,EAAQ,cAAgB,EAAQ,aACpC,CACA,MAAM,cAAE,EAAa,eAAE,EAAc,WAAE,EAAU,cAAE,EAAa,YAAE,GAAgB,mBAAmB,EAAS,EAAK,QACnH,OAAO,sBAAsB,CACzB,YAAa,EACb,WAAY,EACZ,aAAc,EACd,UAAW,EACX,YAAa,EACb,UAAW,EACX,aAAc,EAAK,aACnB,mBAAoB,EAAK,mBACzB,mBAAoB,EAAK,mBACzB,QAAS,EACT,SAAU,EAAK,SACf,eAAgB,EAAK,eACrB,YAAa,EAAK,YAClB,OAAQ,EAAK,QAErB,GAyBJ,QAAQ,QAAU,QAClB,QAAQ,aAAe,aACvB,QAAQ,mBAAqB","file":"/npm/@aws-sdk/credential-provider-sso@3.972.49/dist-cjs/index.js","sourceRoot":"","sourcesContent":["/**\n * Minified by jsDelivr using Terser v5.48.0.\n * Original file: /npm/@aws-sdk/credential-provider-sso@3.972.49/dist-cjs/index.js\n *\n * Do NOT use SRI with dynamically generated files! More information: https://www.jsdelivr.com/using-sri-with-dynamic-files\n */\n","'use strict';\n\nvar config = require('@smithy/core/config');\nvar client = require('@aws-sdk/core/client');\nvar tokenProviders = require('@aws-sdk/token-providers');\n\nconst isSsoProfile = (arg) => arg &&\n    (typeof arg.sso_start_url === \"string\" ||\n        typeof arg.sso_account_id === \"string\" ||\n        typeof arg.sso_session === \"string\" ||\n        typeof arg.sso_region === \"string\" ||\n        typeof arg.sso_role_name === \"string\");\n\nconst SHOULD_FAIL_CREDENTIAL_CHAIN = false;\nconst resolveSSOCredentials = async ({ ssoStartUrl, ssoSession, ssoAccountId, ssoRegion, ssoRoleName, ssoClient, clientConfig, parentClientConfig, callerClientConfig, profile, filepath, configFilepath, ignoreCache, logger, }) => {\n    let token;\n    const refreshMessage = `To refresh this SSO session run aws sso login with the corresponding profile.`;\n    if (ssoSession) {\n        try {\n            const _token = await tokenProviders.fromSso({\n                profile,\n                filepath,\n                configFilepath,\n                ignoreCache,\n            })();\n            token = {\n                accessToken: _token.token,\n                expiresAt: new Date(_token.expiration).toISOString(),\n            };\n        }\n        catch (e) {\n            throw new config.CredentialsProviderError(e.message, {\n                tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,\n                logger,\n            });\n        }\n    }\n    else {\n        try {\n            token = await config.getSSOTokenFromFile(ssoStartUrl);\n        }\n        catch (e) {\n            throw new config.CredentialsProviderError(`The SSO session associated with this profile is invalid. ${refreshMessage}`, {\n                tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,\n                logger,\n            });\n        }\n    }\n    if (new Date(token.expiresAt).getTime() - Date.now() <= 0) {\n        throw new config.CredentialsProviderError(`The SSO session associated with this profile has expired. ${refreshMessage}`, {\n            tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,\n            logger,\n        });\n    }\n    const { accessToken } = token;\n    const { SSOClient, GetRoleCredentialsCommand } = await Promise.resolve().then(function () { return require('./loadSso-BKDNrsal.js'); });\n    const sso = ssoClient ||\n        new SSOClient(Object.assign({}, clientConfig ?? {}, {\n            logger: clientConfig?.logger ?? callerClientConfig?.logger ?? parentClientConfig?.logger,\n            region: clientConfig?.region ?? ssoRegion,\n            userAgentAppId: clientConfig?.userAgentAppId ?? callerClientConfig?.userAgentAppId ?? parentClientConfig?.userAgentAppId,\n        }));\n    let ssoResp;\n    try {\n        ssoResp = await sso.send(new GetRoleCredentialsCommand({\n            accountId: ssoAccountId,\n            roleName: ssoRoleName,\n            accessToken,\n        }));\n    }\n    catch (e) {\n        throw new config.CredentialsProviderError(e, {\n            tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,\n            logger,\n        });\n    }\n    const { roleCredentials: { accessKeyId, secretAccessKey, sessionToken, expiration, credentialScope, accountId } = {}, } = ssoResp;\n    if (!accessKeyId || !secretAccessKey || !sessionToken || !expiration) {\n        throw new config.CredentialsProviderError(\"SSO returns an invalid temporary credential.\", {\n            tryNextLink: SHOULD_FAIL_CREDENTIAL_CHAIN,\n            logger,\n        });\n    }\n    const credentials = {\n        accessKeyId,\n        secretAccessKey,\n        sessionToken,\n        expiration: new Date(expiration),\n        ...(credentialScope && { credentialScope }),\n        ...(accountId && { accountId }),\n    };\n    if (ssoSession) {\n        client.setCredentialFeature(credentials, \"CREDENTIALS_SSO\", \"s\");\n    }\n    else {\n        client.setCredentialFeature(credentials, \"CREDENTIALS_SSO_LEGACY\", \"u\");\n    }\n    return credentials;\n};\n\nconst validateSsoProfile = (profile, logger) => {\n    const { sso_start_url, sso_account_id, sso_region, sso_role_name } = profile;\n    if (!sso_start_url || !sso_account_id || !sso_region || !sso_role_name) {\n        throw new config.CredentialsProviderError(`Profile is configured with invalid SSO credentials. Required parameters \"sso_account_id\", ` +\n            `\"sso_region\", \"sso_role_name\", \"sso_start_url\". Got ${Object.keys(profile).join(\", \")}\\nReference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html`, { tryNextLink: false, logger });\n    }\n    return profile;\n};\n\nconst fromSSO = (init = {}) => async ({ callerClientConfig } = {}) => {\n    init.logger?.debug(\"@aws-sdk/credential-provider-sso - fromSSO\");\n    const { ssoStartUrl, ssoAccountId, ssoRegion, ssoRoleName, ssoSession } = init;\n    const { ssoClient } = init;\n    const profileName = config.getProfileName({\n        profile: init.profile ?? callerClientConfig?.profile,\n    });\n    if (!ssoStartUrl && !ssoAccountId && !ssoRegion && !ssoRoleName && !ssoSession) {\n        const profiles = await config.parseKnownFiles(init);\n        const profile = profiles[profileName];\n        if (!profile) {\n            throw new config.CredentialsProviderError(`Profile ${profileName} was not found.`, { logger: init.logger });\n        }\n        if (!isSsoProfile(profile)) {\n            throw new config.CredentialsProviderError(`Profile ${profileName} is not configured with SSO credentials.`, {\n                logger: init.logger,\n            });\n        }\n        if (profile?.sso_session) {\n            const ssoSessions = await config.loadSsoSessionData(init);\n            const session = ssoSessions[profile.sso_session];\n            const conflictMsg = ` configurations in profile ${profileName} and sso-session ${profile.sso_session}`;\n            if (ssoRegion && ssoRegion !== session.sso_region) {\n                throw new config.CredentialsProviderError(`Conflicting SSO region` + conflictMsg, {\n                    tryNextLink: false,\n                    logger: init.logger,\n                });\n            }\n            if (ssoStartUrl && ssoStartUrl !== session.sso_start_url) {\n                throw new config.CredentialsProviderError(`Conflicting SSO start_url` + conflictMsg, {\n                    tryNextLink: false,\n                    logger: init.logger,\n                });\n            }\n            profile.sso_region = session.sso_region;\n            profile.sso_start_url = session.sso_start_url;\n        }\n        const { sso_start_url, sso_account_id, sso_region, sso_role_name, sso_session } = validateSsoProfile(profile, init.logger);\n        return resolveSSOCredentials({\n            ssoStartUrl: sso_start_url,\n            ssoSession: sso_session,\n            ssoAccountId: sso_account_id,\n            ssoRegion: sso_region,\n            ssoRoleName: sso_role_name,\n            ssoClient: ssoClient,\n            clientConfig: init.clientConfig,\n            parentClientConfig: init.parentClientConfig,\n            callerClientConfig: init.callerClientConfig,\n            profile: profileName,\n            filepath: init.filepath,\n            configFilepath: init.configFilepath,\n            ignoreCache: init.ignoreCache,\n            logger: init.logger,\n        });\n    }\n    else if (!ssoStartUrl || !ssoAccountId || !ssoRegion || !ssoRoleName) {\n        throw new config.CredentialsProviderError(\"Incomplete configuration. The fromSSO() argument hash must include \" +\n            '\"ssoStartUrl\", \"ssoAccountId\", \"ssoRegion\", \"ssoRoleName\"', { tryNextLink: false, logger: init.logger });\n    }\n    else {\n        return resolveSSOCredentials({\n            ssoStartUrl,\n            ssoSession,\n            ssoAccountId,\n            ssoRegion,\n            ssoRoleName,\n            ssoClient,\n            clientConfig: init.clientConfig,\n            parentClientConfig: init.parentClientConfig,\n            callerClientConfig: init.callerClientConfig,\n            profile: profileName,\n            filepath: init.filepath,\n            configFilepath: init.configFilepath,\n            ignoreCache: init.ignoreCache,\n            logger: init.logger,\n        });\n    }\n};\n\nexports.fromSSO = fromSSO;\nexports.isSsoProfile = isSsoProfile;\nexports.validateSsoProfile = validateSsoProfile;\n"]}