thinkwork-cli 0.13.1 → 0.13.2

package/dist/dist-es-G54LBMRN.js

@@ -0,0 +1,48 @@
+import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
+import {
+  setCredentialFeature
+} from "./chunk-QOERT44A.js";
+import {
+  CredentialsProviderError
+} from "./chunk-XYM7PE2A.js";
+import "./chunk-OCPHU34C.js";
+import "./chunk-DV3MRBR5.js";
+
+// ../../node_modules/.pnpm/@aws-sdk+credential-provider-env@3.972.59/node_modules/@aws-sdk/credential-provider-env/dist-es/fromEnv.js
+var ENV_KEY = "AWS_ACCESS_KEY_ID";
+var ENV_SECRET = "AWS_SECRET_ACCESS_KEY";
+var ENV_SESSION = "AWS_SESSION_TOKEN";
+var ENV_EXPIRATION = "AWS_CREDENTIAL_EXPIRATION";
+var ENV_CREDENTIAL_SCOPE = "AWS_CREDENTIAL_SCOPE";
+var ENV_ACCOUNT_ID = "AWS_ACCOUNT_ID";
+var fromEnv = (init) => async () => {
+  init?.logger?.debug("@aws-sdk/credential-provider-env - fromEnv");
+  const accessKeyId = process.env[ENV_KEY];
+  const secretAccessKey = process.env[ENV_SECRET];
+  const sessionToken = process.env[ENV_SESSION];
+  const expiry = process.env[ENV_EXPIRATION];
+  const credentialScope = process.env[ENV_CREDENTIAL_SCOPE];
+  const accountId = process.env[ENV_ACCOUNT_ID];
+  if (accessKeyId && secretAccessKey) {
+    const credentials = {
+      accessKeyId,
+      secretAccessKey,
+      ...sessionToken && { sessionToken },
+      ...expiry && { expiration: new Date(expiry) },
+      ...credentialScope && { credentialScope },
+      ...accountId && { accountId }
+    };
+    setCredentialFeature(credentials, "CREDENTIALS_ENV_VARS", "g");
+    return credentials;
+  }
+  throw new CredentialsProviderError("Unable to find environment variable credentials.", { logger: init?.logger });
+};
+export {
+  ENV_ACCOUNT_ID,
+  ENV_CREDENTIAL_SCOPE,
+  ENV_EXPIRATION,
+  ENV_KEY,
+  ENV_SECRET,
+  ENV_SESSION,
+  fromEnv
+};

package/dist/dist-es-G7PTG75M.js

@@ -0,0 +1,176 @@
+import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
+import {
+  NodeHttpHandler
+} from "./chunk-GG5WKBOX.js";
+import {
+  setCredentialFeature
+} from "./chunk-QOERT44A.js";
+import {
+  CredentialsProviderError,
+  HttpRequest
+} from "./chunk-XYM7PE2A.js";
+import {
+  parseRfc3339DateTime,
+  sdkStreamMixin
+} from "./chunk-OCPHU34C.js";
+import "./chunk-DV3MRBR5.js";
+
+// ../../node_modules/.pnpm/@aws-sdk+credential-provider-http@3.972.61/node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/fromHttp.js
+import fs from "fs/promises";
+
+// ../../node_modules/.pnpm/@aws-sdk+credential-provider-http@3.972.61/node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/checkUrl.js
+var ECS_CONTAINER_HOST = "169.254.170.2";
+var EKS_CONTAINER_HOST_IPv4 = "169.254.170.23";
+var EKS_CONTAINER_HOST_IPv6 = "[fd00:ec2::23]";
+var checkUrl = (url, logger) => {
+  if (url.protocol === "https:") {
+    return;
+  }
+  if (url.hostname === ECS_CONTAINER_HOST || url.hostname === EKS_CONTAINER_HOST_IPv4 || url.hostname === EKS_CONTAINER_HOST_IPv6) {
+    return;
+  }
+  if (url.hostname.includes("[")) {
+    if (url.hostname === "[::1]" || url.hostname === "[0000:0000:0000:0000:0000:0000:0000:0001]") {
+      return;
+    }
+  } else {
+    if (url.hostname === "localhost") {
+      return;
+    }
+    const ipComponents = url.hostname.split(".");
+    const inRange = (component) => {
+      const num = parseInt(component, 10);
+      return 0 <= num && num <= 255;
+    };
+    if (ipComponents[0] === "127" && inRange(ipComponents[1]) && inRange(ipComponents[2]) && inRange(ipComponents[3]) && ipComponents.length === 4) {
+      return;
+    }
+  }
+  throw new CredentialsProviderError(`URL not accepted. It must either be HTTPS or match one of the following:
+  - loopback CIDR 127.0.0.0/8 or [::1/128]
+  - ECS container host 169.254.170.2
+  - EKS container host 169.254.170.23 or [fd00:ec2::23]`, { logger });
+};
+
+// ../../node_modules/.pnpm/@aws-sdk+credential-provider-http@3.972.61/node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/requestHelpers.js
+function createGetRequest(url) {
+  return new HttpRequest({
+    protocol: url.protocol,
+    hostname: url.hostname,
+    port: Number(url.port),
+    path: url.pathname,
+    query: Array.from(url.searchParams.entries()).reduce((acc, [k, v]) => {
+      acc[k] = v;
+      return acc;
+    }, {}),
+    fragment: url.hash
+  });
+}
+async function getCredentials(response, logger) {
+  const stream = sdkStreamMixin(response.body);
+  const str = await stream.transformToString();
+  if (response.statusCode === 200) {
+    const parsed = JSON.parse(str);
+    if (typeof parsed.AccessKeyId !== "string" || typeof parsed.SecretAccessKey !== "string" || typeof parsed.Token !== "string" || typeof parsed.Expiration !== "string") {
+      throw new CredentialsProviderError("HTTP credential provider response not of the required format, an object matching: { AccessKeyId: string, SecretAccessKey: string, Token: string, Expiration: string(rfc3339) }", { logger });
+    }
+    return {
+      accessKeyId: parsed.AccessKeyId,
+      secretAccessKey: parsed.SecretAccessKey,
+      sessionToken: parsed.Token,
+      expiration: parseRfc3339DateTime(parsed.Expiration)
+    };
+  }
+  if (response.statusCode >= 400 && response.statusCode < 500) {
+    let parsedBody = {};
+    try {
+      parsedBody = JSON.parse(str);
+    } catch (e) {
+    }
+    throw Object.assign(new CredentialsProviderError(`Server responded with status: ${response.statusCode}`, { logger }), {
+      Code: parsedBody.Code,
+      Message: parsedBody.Message
+    });
+  }
+  throw new CredentialsProviderError(`Server responded with status: ${response.statusCode}`, { logger });
+}
+
+// ../../node_modules/.pnpm/@aws-sdk+credential-provider-http@3.972.61/node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/retry-wrapper.js
+var retryWrapper = (toRetry, maxRetries, delayMs) => {
+  return async () => {
+    for (let i = 0; i < maxRetries; ++i) {
+      try {
+        return await toRetry();
+      } catch (e) {
+        await new Promise((resolve) => setTimeout(resolve, delayMs));
+      }
+    }
+    return await toRetry();
+  };
+};
+
+// ../../node_modules/.pnpm/@aws-sdk+credential-provider-http@3.972.61/node_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/fromHttp.js
+var AWS_CONTAINER_CREDENTIALS_RELATIVE_URI = "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI";
+var DEFAULT_LINK_LOCAL_HOST = "http://169.254.170.2";
+var AWS_CONTAINER_CREDENTIALS_FULL_URI = "AWS_CONTAINER_CREDENTIALS_FULL_URI";
+var AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE = "AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE";
+var AWS_CONTAINER_AUTHORIZATION_TOKEN = "AWS_CONTAINER_AUTHORIZATION_TOKEN";
+var fromHttp = (options = {}) => {
+  options.logger?.debug("@aws-sdk/credential-provider-http - fromHttp");
+  let host;
+  const relative = options.awsContainerCredentialsRelativeUri ?? process.env[AWS_CONTAINER_CREDENTIALS_RELATIVE_URI];
+  const full = options.awsContainerCredentialsFullUri ?? process.env[AWS_CONTAINER_CREDENTIALS_FULL_URI];
+  const token = options.awsContainerAuthorizationToken ?? process.env[AWS_CONTAINER_AUTHORIZATION_TOKEN];
+  const tokenFile = options.awsContainerAuthorizationTokenFile ?? process.env[AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE];
+  const warn = options.logger?.constructor?.name === "NoOpLogger" || !options.logger?.warn ? console.warn : options.logger.warn.bind(options.logger);
+  if (relative && full) {
+    warn("@aws-sdk/credential-provider-http: you have set both awsContainerCredentialsRelativeUri and awsContainerCredentialsFullUri.");
+    warn("awsContainerCredentialsRelativeUri will take precedence.");
+  }
+  if (token && tokenFile) {
+    warn("@aws-sdk/credential-provider-http: you have set both awsContainerAuthorizationToken and awsContainerAuthorizationTokenFile.");
+    warn("awsContainerAuthorizationTokenFile will take precedence.");
+  }
+  if (relative) {
+    host = `${DEFAULT_LINK_LOCAL_HOST}${relative}`;
+  } else if (full) {
+    host = full;
+  } else {
+    throw new CredentialsProviderError(`No HTTP credential provider host provided.
+Set AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.`, { logger: options.logger });
+  }
+  const url = new URL(host);
+  checkUrl(url, options.logger);
+  const requestHandler = NodeHttpHandler.create({ connectionTimeout: options.timeout ?? 1e3 });
+  const requestTimeout = options.timeout ?? 1e3;
+  const provider = retryWrapper(async () => {
+    const request = createGetRequest(url);
+    if (tokenFile) {
+      request.headers.Authorization = validateToken((await fs.readFile(tokenFile)).toString());
+    } else if (token) {
+      request.headers.Authorization = validateToken(token);
+    }
+    try {
+      const result = await requestHandler.handle(request, { requestTimeout });
+      return getCredentials(result.response).then((creds) => setCredentialFeature(creds, "CREDENTIALS_HTTP", "z"));
+    } catch (e) {
+      throw new CredentialsProviderError(String(e), { logger: options.logger });
+    }
+  }, options.maxRetries ?? 3, options.timeout ?? 1e3);
+  return async () => {
+    try {
+      return await provider();
+    } finally {
+      requestHandler.destroy?.();
+    }
+  };
+};
+var validateToken = (token) => {
+  if (token.includes("\r\n")) {
+    throw new CredentialsProviderError("Authorization token contains invalid \\r\\n sequence.");
+  }
+  return token;
+};
+export {
+  fromHttp
+};

package/dist/dist-es-GKDBE7E6.js

@@ -0,0 +1,88 @@
+import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
+import {
+  setCredentialFeature
+} from "./chunk-QOERT44A.js";
+import {
+  CredentialsProviderError,
+  externalDataInterceptor,
+  getProfileName,
+  parseKnownFiles
+} from "./chunk-XYM7PE2A.js";
+import "./chunk-OCPHU34C.js";
+import "./chunk-DV3MRBR5.js";
+
+// ../../node_modules/.pnpm/@aws-sdk+credential-provider-process@3.972.59/node_modules/@aws-sdk/credential-provider-process/dist-es/resolveProcessCredentials.js
+import { exec } from "child_process";
+import { promisify } from "util";
+
+// ../../node_modules/.pnpm/@aws-sdk+credential-provider-process@3.972.59/node_modules/@aws-sdk/credential-provider-process/dist-es/getValidatedProcessCredentials.js
+var getValidatedProcessCredentials = (profileName, data, profiles) => {
+  if (data.Version !== 1) {
+    throw Error(`Profile ${profileName} credential_process did not return Version 1.`);
+  }
+  if (data.AccessKeyId === void 0 || data.SecretAccessKey === void 0) {
+    throw Error(`Profile ${profileName} credential_process returned invalid credentials.`);
+  }
+  if (data.Expiration) {
+    const currentTime = /* @__PURE__ */ new Date();
+    const expireTime = new Date(data.Expiration);
+    if (expireTime < currentTime) {
+      throw Error(`Profile ${profileName} credential_process returned expired credentials.`);
+    }
+  }
+  let accountId = data.AccountId;
+  if (!accountId && profiles?.[profileName]?.aws_account_id) {
+    accountId = profiles[profileName].aws_account_id;
+  }
+  const credentials = {
+    accessKeyId: data.AccessKeyId,
+    secretAccessKey: data.SecretAccessKey,
+    ...data.SessionToken && { sessionToken: data.SessionToken },
+    ...data.Expiration && { expiration: new Date(data.Expiration) },
+    ...data.CredentialScope && { credentialScope: data.CredentialScope },
+    ...accountId && { accountId }
+  };
+  setCredentialFeature(credentials, "CREDENTIALS_PROCESS", "w");
+  return credentials;
+};
+
+// ../../node_modules/.pnpm/@aws-sdk+credential-provider-process@3.972.59/node_modules/@aws-sdk/credential-provider-process/dist-es/resolveProcessCredentials.js
+var resolveProcessCredentials = async (profileName, profiles, logger) => {
+  const profile = profiles[profileName];
+  if (profiles[profileName]) {
+    const credentialProcess = profile["credential_process"];
+    if (credentialProcess !== void 0) {
+      const execPromise = promisify(externalDataInterceptor?.getTokenRecord?.().exec ?? exec);
+      try {
+        const { stdout } = await execPromise(credentialProcess);
+        let data;
+        try {
+          data = JSON.parse(stdout.trim());
+        } catch {
+          throw Error(`Profile ${profileName} credential_process returned invalid JSON.`);
+        }
+        return getValidatedProcessCredentials(profileName, data, profiles);
+      } catch (error) {
+        throw new CredentialsProviderError(error.message, { logger });
+      }
+    } else {
+      throw new CredentialsProviderError(`Profile ${profileName} did not contain credential_process.`, { logger });
+    }
+  } else {
+    throw new CredentialsProviderError(`Profile ${profileName} could not be found in shared credentials file.`, {
+      logger
+    });
+  }
+};
+
+// ../../node_modules/.pnpm/@aws-sdk+credential-provider-process@3.972.59/node_modules/@aws-sdk/credential-provider-process/dist-es/fromProcess.js
+var fromProcess = (init = {}) => async ({ callerClientConfig } = {}) => {
+  init.logger?.debug("@aws-sdk/credential-provider-process - fromProcess");
+  const profiles = await parseKnownFiles(init);
+  return resolveProcessCredentials(getProfileName({
+    profile: init.profile ?? callerClientConfig?.profile
+  }), profiles, init.logger);
+};
+export {
+  fromProcess
+};

package/dist/dist-es-HY3535OI.js

@@ -0,0 +1,70 @@
+import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
+import {
+  setCredentialFeature
+} from "./chunk-QOERT44A.js";
+import {
+  CredentialsProviderError,
+  externalDataInterceptor
+} from "./chunk-XYM7PE2A.js";
+import "./chunk-OCPHU34C.js";
+import "./chunk-DV3MRBR5.js";
+
+// ../../node_modules/.pnpm/@aws-sdk+credential-provider-web-identity@3.972.50/node_modules/@aws-sdk/credential-provider-web-identity/dist-es/fromTokenFile.js
+import { readFileSync } from "fs";
+
+// ../../node_modules/.pnpm/@aws-sdk+credential-provider-web-identity@3.972.50/node_modules/@aws-sdk/credential-provider-web-identity/dist-es/fromWebToken.js
+var fromWebToken = (init) => async (awsIdentityProperties) => {
+  init.logger?.debug("@aws-sdk/credential-provider-web-identity - fromWebToken");
+  const { roleArn, roleSessionName, webIdentityToken, providerId, policyArns, policy, durationSeconds } = init;
+  let { roleAssumerWithWebIdentity } = init;
+  if (!roleAssumerWithWebIdentity) {
+    const { getDefaultRoleAssumerWithWebIdentity } = await import("./sts-CWLSE3GH.js");
+    roleAssumerWithWebIdentity = getDefaultRoleAssumerWithWebIdentity({
+      ...init.clientConfig,
+      credentialProviderLogger: init.logger,
+      parentClientConfig: {
+        ...awsIdentityProperties?.callerClientConfig,
+        ...init.parentClientConfig
+      }
+    }, init.clientPlugins);
+  }
+  return roleAssumerWithWebIdentity({
+    RoleArn: roleArn,
+    RoleSessionName: roleSessionName ?? `aws-sdk-js-session-${Date.now()}`,
+    WebIdentityToken: webIdentityToken,
+    ProviderId: providerId,
+    PolicyArns: policyArns,
+    Policy: policy,
+    DurationSeconds: durationSeconds
+  });
+};
+
+// ../../node_modules/.pnpm/@aws-sdk+credential-provider-web-identity@3.972.50/node_modules/@aws-sdk/credential-provider-web-identity/dist-es/fromTokenFile.js
+var ENV_TOKEN_FILE = "AWS_WEB_IDENTITY_TOKEN_FILE";
+var ENV_ROLE_ARN = "AWS_ROLE_ARN";
+var ENV_ROLE_SESSION_NAME = "AWS_ROLE_SESSION_NAME";
+var fromTokenFile = (init = {}) => async (awsIdentityProperties) => {
+  init.logger?.debug("@aws-sdk/credential-provider-web-identity - fromTokenFile");
+  const webIdentityTokenFile = init?.webIdentityTokenFile ?? process.env[ENV_TOKEN_FILE];
+  const roleArn = init?.roleArn ?? process.env[ENV_ROLE_ARN];
+  const roleSessionName = init?.roleSessionName ?? process.env[ENV_ROLE_SESSION_NAME];
+  if (!webIdentityTokenFile || !roleArn) {
+    throw new CredentialsProviderError("Web identity configuration not specified", {
+      logger: init.logger
+    });
+  }
+  const credentials = await fromWebToken({
+    ...init,
+    webIdentityToken: externalDataInterceptor?.getTokenRecord?.()[webIdentityTokenFile] ?? readFileSync(webIdentityTokenFile, { encoding: "ascii" }),
+    roleArn,
+    roleSessionName
+  })(awsIdentityProperties);
+  if (webIdentityTokenFile === process.env[ENV_TOKEN_FILE]) {
+    setCredentialFeature(credentials, "CREDENTIALS_ENV_VARS_STS_WEB_ID_TOKEN", "h");
+  }
+  return credentials;
+};
+export {
+  fromTokenFile,
+  fromWebToken
+};