@ai-support-agent/cli 0.1.35-beta.0 → 0.1.35

package/dist/ecs/ecr-publisher.js

@@ -1,118 +0,0 @@
-"use strict";
-/**
- * ECR image publisher for `ecs publish`.
- *
- * Logs in to ECR with the local AWS credentials (GetAuthorizationToken),
- * builds/tags/pushes the image with the docker CLI, and resolves the pushed
- * image digest via DescribeImages so the task definition can pin the image
- * by digest. The registry password is always passed over stdin
- * (`--password-stdin`), never on the command line.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.runDocker = runDocker;
-exports.loginToEcr = loginToEcr;
-exports.getImageDigest = getImageDigest;
-exports.publishImage = publishImage;
-const child_process_1 = require("child_process");
-const client_ecr_1 = require("@aws-sdk/client-ecr");
-const aws_arn_1 = require("./aws-arn");
-const docker_utils_1 = require("../docker/docker-utils");
-const logger_1 = require("../logger");
-const utils_1 = require("../utils");
-/**
- * Run a docker CLI command. Output is streamed to the terminal.
- * When `input` is provided it is written to the child's stdin (used for
- * `docker login --password-stdin` so the password never appears in argv).
- */
-function runDocker(args, input) {
-    return new Promise((resolve, reject) => {
-        const proc = (0, child_process_1.spawn)((0, docker_utils_1.getDockerPath)(), args, {
-            stdio: [input === undefined ? 'ignore' : 'pipe', 'inherit', 'inherit'],
-        });
-        if (input !== undefined && proc.stdin) {
-            // If the child dies between spawn and write (e.g. `docker login` fails
-            // instantly), writing to its stdin raises EPIPE. Swallow it here and let
-            // the 'close'/'error' handlers report the real exit code instead of
-            // surfacing an uncaught EPIPE.
-            proc.stdin.on('error', () => { });
-            proc.stdin.write(input);
-            proc.stdin.end();
-        }
-        proc.on('error', (err) => reject((0, utils_1.toError)(err)));
-        proc.on('close', (code) => {
-            if (code === 0)
-                resolve();
-            else
-                reject(new Error(`docker ${args[0]} exited with code ${code}`));
-        });
-    });
-}
-/**
- * Log in the local docker CLI to the ECR registry using GetAuthorizationToken.
- * The decoded password is piped to `docker login --password-stdin`.
- */
-async function loginToEcr(client, registry) {
-    logger_1.logger.info(`[ecs] Logging in to ECR registry: ${registry}`);
-    const response = await client.send(new client_ecr_1.GetAuthorizationTokenCommand({}));
-    const token = response.authorizationData?.[0]?.authorizationToken;
-    if (!token) {
-        throw new Error('ECR GetAuthorizationToken returned no authorization data');
-    }
-    const decoded = Buffer.from(token, 'base64').toString('utf-8');
-    const separator = decoded.indexOf(':');
-    if (separator < 0) {
-        throw new Error('ECR authorization token has an unexpected format');
-    }
-    const username = decoded.slice(0, separator);
-    const password = decoded.slice(separator + 1);
-    await runDocker(['login', '--username', username, '--password-stdin', registry], password);
-    logger_1.logger.success(`[ecs] Logged in to ${registry}`);
-}
-/**
- * Resolve the digest of a pushed image tag via DescribeImages.
- */
-async function getImageDigest(client, repositoryName, tag) {
-    const response = await client.send(new client_ecr_1.DescribeImagesCommand({
-        repositoryName,
-        imageIds: [{ imageTag: tag }],
-    }));
-    const digest = response.imageDetails?.[0]?.imageDigest;
-    if (!digest) {
-        throw new Error(`Could not resolve image digest for ${repositoryName}:${tag}`);
-    }
-    return digest;
-}
-/**
- * Build (unless a local image is given), tag, and push the image to ECR,
- * then return the digest-pinned image URI.
- */
-async function publishImage(options) {
-    const parts = (0, aws_arn_1.parseEcrRepositoryUri)(options.repositoryUri);
-    if (!parts) {
-        throw new Error(`Invalid ECR repository URI: ${options.repositoryUri}`);
-    }
-    const client = new client_ecr_1.ECRClient({ region: parts.region });
-    await loginToEcr(client, parts.registry);
-    const remoteRef = `${options.repositoryUri}:${options.tag}`;
-    if (options.image) {
-        logger_1.logger.info(`[ecs] Using local image ${options.image} (build skipped)`);
-        await runDocker(['tag', options.image, remoteRef]);
-    }
-    else {
-        const contextDir = options.contextDir ?? '.';
-        const buildArgs = ['build', '-t', remoteRef];
-        if (options.dockerfile) {
-            buildArgs.push('-f', options.dockerfile);
-        }
-        buildArgs.push(contextDir);
-        logger_1.logger.info(`[ecs] Building image ${remoteRef}`);
-        await runDocker(buildArgs);
-    }
-    logger_1.logger.info(`[ecs] Pushing ${remoteRef}`);
-    await runDocker(['push', remoteRef]);
-    const imageDigest = await getImageDigest(client, parts.repositoryName, options.tag);
-    const imageUri = `${options.repositoryUri}@${imageDigest}`;
-    logger_1.logger.success(`[ecs] Pushed image: ${imageUri}`);
-    return { imageUri, imageTag: options.tag, imageDigest };
-}
-//# sourceMappingURL=ecr-publisher.js.map

package/dist/ecs/ecr-publisher.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ecr-publisher.js","sourceRoot":"","sources":["../../src/ecs/ecr-publisher.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AAoCH,8BAoBC;AAMD,gCAgBC;AAKD,wCAcC;AAMD,oCA+BC;AApID,iDAAqC;AAErC,oDAAoG;AAEpG,uCAAiD;AACjD,yDAAsD;AACtD,sCAAkC;AAClC,oCAAkC;AAsBlC;;;;GAIG;AACH,SAAgB,SAAS,CAAC,IAAc,EAAE,KAAc;IACtD,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,IAAI,GAAG,IAAA,qBAAK,EAAC,IAAA,4BAAa,GAAE,EAAE,IAAI,EAAE;YACxC,KAAK,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC;SACvE,CAAC,CAAA;QACF,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACtC,uEAAuE;YACvE,yEAAyE;YACzE,oEAAoE;YACpE,+BAA+B;YAC/B,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAuC,CAAC,CAAC,CAAA;YACrE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACvB,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QAClB,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAA,eAAO,EAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QAC/C,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAA;;gBACpB,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,CAAA;QACtE,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,UAAU,CAAC,MAAiB,EAAE,QAAgB;IAClE,eAAM,CAAC,IAAI,CAAC,qCAAqC,QAAQ,EAAE,CAAC,CAAA;IAC5D,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,yCAA4B,CAAC,EAAE,CAAC,CAAC,CAAA;IACxE,MAAM,KAAK,GAAG,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAA;IACjE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;IAC7E,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC9D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACtC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACrE,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;IAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;IAC7C,MAAM,SAAS,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,kBAAkB,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAA;IAC1F,eAAM,CAAC,OAAO,CAAC,sBAAsB,QAAQ,EAAE,CAAC,CAAA;AAClD,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,cAAc,CAClC,MAAiB,EACjB,cAAsB,EACtB,GAAW;IAEX,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,kCAAqB,CAAC;QAC3D,cAAc;QACd,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;KAC9B,CAAC,CAAC,CAAA;IACH,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,CAAA;IACtD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,sCAAsC,cAAc,IAAI,GAAG,EAAE,CAAC,CAAA;IAChF,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,YAAY,CAAC,OAA4B;IAC7D,MAAM,KAAK,GAAG,IAAA,+BAAqB,EAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,+BAA+B,OAAO,CAAC,aAAa,EAAE,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,sBAAS,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;IACtD,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;IAExC,MAAM,SAAS,GAAG,GAAG,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,EAAE,CAAA;IAC3D,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,eAAM,CAAC,IAAI,CAAC,2BAA2B,OAAO,CAAC,KAAK,kBAAkB,CAAC,CAAA;QACvE,MAAM,SAAS,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAA;IACpD,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,GAAG,CAAA;QAC5C,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;QAC5C,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;QAC1C,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC1B,eAAM,CAAC,IAAI,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAA;QAChD,MAAM,SAAS,CAAC,SAAS,CAAC,CAAA;IAC5B,CAAC;IAED,eAAM,CAAC,IAAI,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAA;IACzC,MAAM,SAAS,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAA;IAEpC,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,CAAA;IACnF,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,aAAa,IAAI,WAAW,EAAE,CAAA;IAC1D,eAAM,CAAC,OAAO,CAAC,uBAAuB,QAAQ,EAAE,CAAC,CAAA;IACjD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,CAAA;AACzD,CAAC"}

package/dist/ecs/ecs-launcher.d.ts

@@ -1,25 +0,0 @@
-/**
- * Launcher-side handlers for the `ecs_launch` / `ecs_stop` commands.
- *
- * A resident agent with local AWS credentials acts as the "launcher": it
- * receives `ecs_launch` via the normal dispatch path (AppSync) and starts a
- * oneshot ECS task with RunTask, injecting the per-run environment
- * (COMMAND_ID, oneshot token, ...) through containerOverrides.
- *
- * SECURITY: the containerEnv payload contains AGENT_ONESHOT_TOKEN. Its
- * values must never be logged — only log resource identifiers.
- */
-import { type CommandResult } from '../types';
-/**
- * Handle the `ecs_launch` command: RunTask (FARGATE, awsvpc) with the
- * payload's containerEnv injected via containerOverrides.
- * Returns `{ taskArn }` on success, or a failed result carrying RunTask
- * `failures` details so the API can mark the work command/task as failed.
- */
-export declare function ecsLaunch(p: Record<string, unknown>): Promise<CommandResult>;
-/**
- * Handle the `ecs_stop` command: best-effort StopTask (used by the API's
- * timeout sweep to reclaim timed-out oneshot containers).
- */
-export declare function ecsStop(p: Record<string, unknown>): Promise<CommandResult>;
-//# sourceMappingURL=ecs-launcher.d.ts.map

package/dist/ecs/ecs-launcher.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ecs-launcher.d.ts","sourceRoot":"","sources":["../../src/ecs/ecs-launcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,OAAO,EAAE,KAAK,aAAa,EAA8B,MAAM,UAAU,CAAA;AAkDzE;;;;;GAKG;AACH,wBAAsB,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,CAyDlF;AAED;;;GAGG;AACH,wBAAsB,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,CA6BhF"}

package/dist/ecs/ecs-launcher.js

@@ -1,157 +0,0 @@
-"use strict";
-/**
- * Launcher-side handlers for the `ecs_launch` / `ecs_stop` commands.
- *
- * A resident agent with local AWS credentials acts as the "launcher": it
- * receives `ecs_launch` via the normal dispatch path (AppSync) and starts a
- * oneshot ECS task with RunTask, injecting the per-run environment
- * (COMMAND_ID, oneshot token, ...) through containerOverrides.
- *
- * SECURITY: the containerEnv payload contains AGENT_ONESHOT_TOKEN. Its
- * values must never be logged — only log resource identifiers.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ecsLaunch = ecsLaunch;
-exports.ecsStop = ecsStop;
-const client_ecs_1 = require("@aws-sdk/client-ecs");
-const aws_arn_1 = require("./aws-arn");
-const constants_1 = require("../constants");
-const logger_1 = require("../logger");
-const types_1 = require("../types");
-const utils_1 = require("../utils");
-function parseStringArray(value) {
-    if (!Array.isArray(value) || value.length === 0)
-        return null;
-    if (!value.every((v) => typeof v === 'string' && v.length > 0))
-        return null;
-    return value;
-}
-function validateLaunchPayload(p) {
-    const taskDefinitionArn = typeof p.taskDefinitionArn === 'string' && p.taskDefinitionArn ? p.taskDefinitionArn : null;
-    if (!taskDefinitionArn)
-        return 'taskDefinitionArn is required for ecs_launch';
-    const clusterArn = typeof p.clusterArn === 'string' && p.clusterArn ? p.clusterArn : null;
-    if (!clusterArn)
-        return 'clusterArn is required for ecs_launch';
-    const subnetIds = parseStringArray(p.subnetIds);
-    if (!subnetIds)
-        return 'subnetIds (non-empty string array) is required for ecs_launch';
-    const securityGroupIds = parseStringArray(p.securityGroupIds);
-    if (!securityGroupIds)
-        return 'securityGroupIds (non-empty string array) is required for ecs_launch';
-    const rawEnv = p.containerEnv;
-    if (typeof rawEnv !== 'object' || rawEnv === null || Array.isArray(rawEnv)) {
-        return 'containerEnv (object) is required for ecs_launch';
-    }
-    const containerEnv = {};
-    for (const [key, value] of Object.entries(rawEnv)) {
-        if (typeof value !== 'string') {
-            return `containerEnv.${key} must be a string`;
-        }
-        containerEnv[key] = value;
-    }
-    return {
-        taskDefinitionArn,
-        clusterArn,
-        subnetIds,
-        securityGroupIds,
-        assignPublicIp: p.assignPublicIp === true,
-        containerEnv,
-    };
-}
-/**
- * Handle the `ecs_launch` command: RunTask (FARGATE, awsvpc) with the
- * payload's containerEnv injected via containerOverrides.
- * Returns `{ taskArn }` on success, or a failed result carrying RunTask
- * `failures` details so the API can mark the work command/task as failed.
- */
-async function ecsLaunch(p) {
-    const validated = validateLaunchPayload(p);
-    if (typeof validated === 'string') {
-        return (0, types_1.errorResult)(validated);
-    }
-    const region = (0, aws_arn_1.regionFromArn)(validated.clusterArn);
-    if (!region) {
-        return (0, types_1.errorResult)(`Could not determine region from clusterArn: ${validated.clusterArn}`);
-    }
-    // Do NOT log containerEnv — it carries AGENT_ONESHOT_TOKEN.
-    logger_1.logger.info(`[ecs] RunTask: taskDefinition=${validated.taskDefinitionArn} cluster=${validated.clusterArn}`);
-    try {
-        const client = new client_ecs_1.ECSClient({ region });
-        const response = await client.send(new client_ecs_1.RunTaskCommand({
-            cluster: validated.clusterArn,
-            taskDefinition: validated.taskDefinitionArn,
-            launchType: 'FARGATE',
-            count: 1,
-            networkConfiguration: {
-                awsvpcConfiguration: {
-                    subnets: validated.subnetIds,
-                    securityGroups: validated.securityGroupIds,
-                    assignPublicIp: validated.assignPublicIp ? 'ENABLED' : 'DISABLED',
-                },
-            },
-            overrides: {
-                containerOverrides: [
-                    {
-                        name: constants_1.ECS_AGENT_CONTAINER_NAME,
-                        environment: Object.entries(validated.containerEnv).map(([name, value]) => ({ name, value })),
-                    },
-                ],
-            },
-        }));
-        if (response.failures && response.failures.length > 0) {
-            const reasons = response.failures
-                .map((f) => `${f.reason ?? 'unknown'}${f.detail ? ` (${f.detail})` : ''}`)
-                .join('; ');
-            logger_1.logger.error(`[ecs] RunTask failed: ${reasons}`);
-            return (0, types_1.errorResult)(`ECS RunTask failed: ${reasons}`, { failures: response.failures });
-        }
-        const taskArn = response.tasks?.[0]?.taskArn;
-        if (!taskArn) {
-            return (0, types_1.errorResult)('ECS RunTask returned no task');
-        }
-        logger_1.logger.success(`[ecs] Task started: ${taskArn}`);
-        return (0, types_1.successResult)({ taskArn });
-    }
-    catch (error) {
-        const message = (0, utils_1.getErrorMessage)(error);
-        logger_1.logger.error(`[ecs] RunTask error: ${message}`);
-        return (0, types_1.errorResult)(`ECS RunTask error: ${message}`);
-    }
-}
-/**
- * Handle the `ecs_stop` command: best-effort StopTask (used by the API's
- * timeout sweep to reclaim timed-out oneshot containers).
- */
-async function ecsStop(p) {
-    const clusterArn = typeof p.clusterArn === 'string' && p.clusterArn ? p.clusterArn : null;
-    if (!clusterArn)
-        return (0, types_1.errorResult)('clusterArn is required for ecs_stop');
-    const taskArn = typeof p.taskArn === 'string' && p.taskArn ? p.taskArn : null;
-    if (!taskArn)
-        return (0, types_1.errorResult)('taskArn is required for ecs_stop');
-    const region = (0, aws_arn_1.regionFromArn)(clusterArn);
-    if (!region) {
-        return (0, types_1.errorResult)(`Could not determine region from clusterArn: ${clusterArn}`);
-    }
-    logger_1.logger.info(`[ecs] StopTask: ${taskArn}`);
-    try {
-        const client = new client_ecs_1.ECSClient({ region });
-        const response = await client.send(new client_ecs_1.StopTaskCommand({
-            cluster: clusterArn,
-            task: taskArn,
-            reason: 'Stopped by ai-support-agent launcher (timeout or cancel)',
-        }));
-        return (0, types_1.successResult)({
-            stopped: true,
-            taskArn,
-            lastStatus: response.task?.lastStatus,
-        });
-    }
-    catch (error) {
-        const message = (0, utils_1.getErrorMessage)(error);
-        logger_1.logger.warn(`[ecs] StopTask failed (best-effort): ${message}`);
-        return (0, types_1.errorResult)(`ECS StopTask failed: ${message}`, { stopped: false, taskArn });
-    }
-}
-//# sourceMappingURL=ecs-launcher.js.map

package/dist/ecs/ecs-launcher.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ecs-launcher.js","sourceRoot":"","sources":["../../src/ecs/ecs-launcher.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;AA+DH,8BAyDC;AAMD,0BA6BC;AAzJD,oDAAgF;AAEhF,uCAAyC;AACzC,4CAAuD;AACvD,sCAAkC;AAClC,oCAAyE;AACzE,oCAA0C;AAW1C,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5D,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3E,OAAO,KAAiB,CAAA;AAC1B,CAAC;AAED,SAAS,qBAAqB,CAAC,CAA0B;IACvD,MAAM,iBAAiB,GAAG,OAAO,CAAC,CAAC,iBAAiB,KAAK,QAAQ,IAAI,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAA;IACrH,IAAI,CAAC,iBAAiB;QAAE,OAAO,8CAA8C,CAAA;IAC7E,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAA;IACzF,IAAI,CAAC,UAAU;QAAE,OAAO,uCAAuC,CAAA;IAC/D,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAC/C,IAAI,CAAC,SAAS;QAAE,OAAO,+DAA+D,CAAA;IACtF,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAA;IAC7D,IAAI,CAAC,gBAAgB;QAAE,OAAO,sEAAsE,CAAA;IAEpG,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,CAAA;IAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,kDAAkD,CAAA;IAC3D,CAAC;IACD,MAAM,YAAY,GAA2B,EAAE,CAAA;IAC/C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;QAC7E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,gBAAgB,GAAG,mBAAmB,CAAA;QAC/C,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAC3B,CAAC;IAED,OAAO;QACL,iBAAiB;QACjB,UAAU;QACV,SAAS;QACT,gBAAgB;QAChB,cAAc,EAAE,CAAC,CAAC,cAAc,KAAK,IAAI;QACzC,YAAY;KACb,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,SAAS,CAAC,CAA0B;IACxD,MAAM,SAAS,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAA;IAC1C,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,IAAA,mBAAW,EAAC,SAAS,CAAC,CAAA;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,uBAAa,EAAC,SAAS,CAAC,UAAU,CAAC,CAAA;IAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAA,mBAAW,EAAC,+CAA+C,SAAS,CAAC,UAAU,EAAE,CAAC,CAAA;IAC3F,CAAC;IAED,4DAA4D;IAC5D,eAAM,CAAC,IAAI,CAAC,iCAAiC,SAAS,CAAC,iBAAiB,YAAY,SAAS,CAAC,UAAU,EAAE,CAAC,CAAA;IAE3G,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,sBAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;QACxC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,2BAAc,CAAC;YACpD,OAAO,EAAE,SAAS,CAAC,UAAU;YAC7B,cAAc,EAAE,SAAS,CAAC,iBAAiB;YAC3C,UAAU,EAAE,SAAS;YACrB,KAAK,EAAE,CAAC;YACR,oBAAoB,EAAE;gBACpB,mBAAmB,EAAE;oBACnB,OAAO,EAAE,SAAS,CAAC,SAAS;oBAC5B,cAAc,EAAE,SAAS,CAAC,gBAAgB;oBAC1C,cAAc,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;iBAClE;aACF;YACD,SAAS,EAAE;gBACT,kBAAkB,EAAE;oBAClB;wBACE,IAAI,EAAE,oCAAwB;wBAC9B,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;qBAC9F;iBACF;aACF;SACF,CAAC,CAAC,CAAA;QAEH,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtD,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ;iBAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;iBACzE,IAAI,CAAC,IAAI,CAAC,CAAA;YACb,eAAM,CAAC,KAAK,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAA;YAChD,OAAO,IAAA,mBAAW,EAAC,uBAAuB,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;QACvF,CAAC;QAED,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAA;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAA,mBAAW,EAAC,8BAA8B,CAAC,CAAA;QACpD,CAAC;QACD,eAAM,CAAC,OAAO,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAA;QAChD,OAAO,IAAA,qBAAa,EAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,IAAA,uBAAe,EAAC,KAAK,CAAC,CAAA;QACtC,eAAM,CAAC,KAAK,CAAC,wBAAwB,OAAO,EAAE,CAAC,CAAA;QAC/C,OAAO,IAAA,mBAAW,EAAC,sBAAsB,OAAO,EAAE,CAAC,CAAA;IACrD,CAAC;AACH,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,OAAO,CAAC,CAA0B;IACtD,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAA;IACzF,IAAI,CAAC,UAAU;QAAE,OAAO,IAAA,mBAAW,EAAC,qCAAqC,CAAC,CAAA;IAC1E,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;IAC7E,IAAI,CAAC,OAAO;QAAE,OAAO,IAAA,mBAAW,EAAC,kCAAkC,CAAC,CAAA;IAEpE,MAAM,MAAM,GAAG,IAAA,uBAAa,EAAC,UAAU,CAAC,CAAA;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAA,mBAAW,EAAC,+CAA+C,UAAU,EAAE,CAAC,CAAA;IACjF,CAAC;IAED,eAAM,CAAC,IAAI,CAAC,mBAAmB,OAAO,EAAE,CAAC,CAAA;IACzC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,sBAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;QACxC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,4BAAe,CAAC;YACrD,OAAO,EAAE,UAAU;YACnB,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,0DAA0D;SACnE,CAAC,CAAC,CAAA;QACH,OAAO,IAAA,qBAAa,EAAC;YACnB,OAAO,EAAE,IAAI;YACb,OAAO;YACP,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU;SACtC,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,IAAA,uBAAe,EAAC,KAAK,CAAC,CAAA;QACtC,eAAM,CAAC,IAAI,CAAC,wCAAwC,OAAO,EAAE,CAAC,CAAA;QAC9D,OAAO,IAAA,mBAAW,EAAC,wBAAwB,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IACpF,CAAC;AACH,CAAC"}

package/dist/ecs/launcher-capability.d.ts

@@ -1,26 +0,0 @@
-/**
- * ecs_launch capability detection.
- *
- * A resident agent should only advertise the `ecs_launch` capability when it
- * can actually perform ECS RunTask/StopTask — i.e. when AWS credentials are
- * resolvable through the default provider chain (env vars, shared
- * config/credentials files, SSO cache, IMDS/ECS metadata, ...). Advertising
- * it unconditionally would let the API's automatic launcher selection pick an
- * agent that cannot launch anything, making ECS dispatch fail unpredictably.
- *
- * Override (checked before detection):
- *   AI_SUPPORT_AGENT_ECS_LAUNCHER=true   force-enable, skip detection
- *   AI_SUPPORT_AGENT_ECS_LAUNCHER=false  force-disable, skip detection
- *
- * The detection result is cached for the process lifetime so the register
- * retry loop does not re-probe the credential chain (IMDS/STS) on every
- * attempt.
- */
-/** Reset the positive-detection cache (tests only). */
-export declare function resetEcsLauncherCapabilityCache(): void;
-/**
- * Decide whether this agent should advertise the `ecs_launch` capability.
- * Returns true when credentials are resolvable or force-enabled via env.
- */
-export declare function detectEcsLauncherCapability(env?: NodeJS.ProcessEnv, timeoutMs?: number): Promise<boolean>;
-//# sourceMappingURL=launcher-capability.d.ts.map

package/dist/ecs/launcher-capability.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"launcher-capability.d.ts","sourceRoot":"","sources":["../../src/ecs/launcher-capability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAeH,uDAAuD;AACvD,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD;AAuBD;;;GAGG;AACH,wBAAsB,2BAA2B,CAC/C,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,SAAS,GAAE,MAAuC,GACjD,OAAO,CAAC,OAAO,CAAC,CAyBlB"}

package/dist/ecs/launcher-capability.js

@@ -1,86 +0,0 @@
-"use strict";
-/**
- * ecs_launch capability detection.
- *
- * A resident agent should only advertise the `ecs_launch` capability when it
- * can actually perform ECS RunTask/StopTask — i.e. when AWS credentials are
- * resolvable through the default provider chain (env vars, shared
- * config/credentials files, SSO cache, IMDS/ECS metadata, ...). Advertising
- * it unconditionally would let the API's automatic launcher selection pick an
- * agent that cannot launch anything, making ECS dispatch fail unpredictably.
- *
- * Override (checked before detection):
- *   AI_SUPPORT_AGENT_ECS_LAUNCHER=true   force-enable, skip detection
- *   AI_SUPPORT_AGENT_ECS_LAUNCHER=false  force-disable, skip detection
- *
- * The detection result is cached for the process lifetime so the register
- * retry loop does not re-probe the credential chain (IMDS/STS) on every
- * attempt.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.resetEcsLauncherCapabilityCache = resetEcsLauncherCapabilityCache;
-exports.detectEcsLauncherCapability = detectEcsLauncherCapability;
-const credential_providers_1 = require("@aws-sdk/credential-providers");
-const constants_1 = require("../constants");
-const logger_1 = require("../logger");
-const utils_1 = require("../utils");
-// Only a POSITIVE detection is cached for the process lifetime. A negative
-// result (e.g. a transient 3s IMDS timeout during cold start) must NOT be
-// sticky, or credentials that become available later would never be picked
-// up. Re-detection on subsequent register attempts is safe because the
-// register loop is backoff-based, so this cannot spam STS/IMDS.
-let credentialsConfirmed = false;
-/** Reset the positive-detection cache (tests only). */
-function resetEcsLauncherCapabilityCache() {
-    credentialsConfirmed = false;
-}
-async function credentialsResolvable(timeoutMs) {
-    let timer;
-    try {
-        const timeout = new Promise((_, reject) => {
-            timer = setTimeout(() => reject(new Error(`credential resolution timed out after ${timeoutMs}ms`)), timeoutMs);
-            timer.unref?.();
-        });
-        const credentials = await Promise.race([(0, credential_providers_1.fromNodeProviderChain)()(), timeout]);
-        // Never log the credential values — only whether resolution succeeded.
-        return Boolean(credentials?.accessKeyId);
-    }
-    catch (error) {
-        logger_1.logger.info(`[ecs] AWS credentials not resolvable: ${(0, utils_1.getErrorMessage)(error)}`);
-        return false;
-    }
-    finally {
-        if (timer)
-            clearTimeout(timer);
-    }
-}
-/**
- * Decide whether this agent should advertise the `ecs_launch` capability.
- * Returns true when credentials are resolvable or force-enabled via env.
- */
-async function detectEcsLauncherCapability(env = process.env, timeoutMs = constants_1.ECS_LAUNCHER_DETECT_TIMEOUT_MS) {
-    const override = env[constants_1.ENV_VARS.ECS_LAUNCHER];
-    if (override === 'false') {
-        logger_1.logger.info(`[ecs] ecs_launch capability disabled (${constants_1.ENV_VARS.ECS_LAUNCHER}=false)`);
-        return false;
-    }
-    if (override === 'true') {
-        logger_1.logger.info(`[ecs] ecs_launch capability force-enabled (${constants_1.ENV_VARS.ECS_LAUNCHER}=true, credential detection skipped)`);
-        return true;
-    }
-    // A confirmed positive is sticky; a previous negative falls through to a
-    // fresh probe on the next call.
-    if (credentialsConfirmed) {
-        return true;
-    }
-    const resolved = await credentialsResolvable(timeoutMs);
-    if (resolved) {
-        credentialsConfirmed = true;
-        logger_1.logger.info('[ecs] AWS credentials resolved; advertising ecs_launch capability');
-    }
-    else {
-        logger_1.logger.info('[ecs] ecs_launch capability not advertised (no resolvable AWS credentials; will re-check on next registration)');
-    }
-    return resolved;
-}
-//# sourceMappingURL=launcher-capability.js.map

package/dist/ecs/launcher-capability.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"launcher-capability.js","sourceRoot":"","sources":["../../src/ecs/launcher-capability.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;AAgBH,0EAEC;AA2BD,kEA4BC;AAvED,wEAAqE;AAErE,4CAAuE;AACvE,sCAAkC;AAClC,oCAA0C;AAE1C,2EAA2E;AAC3E,0EAA0E;AAC1E,2EAA2E;AAC3E,uEAAuE;AACvE,gEAAgE;AAChE,IAAI,oBAAoB,GAAG,KAAK,CAAA;AAEhC,uDAAuD;AACvD,SAAgB,+BAA+B;IAC7C,oBAAoB,GAAG,KAAK,CAAA;AAC9B,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,SAAiB;IACpD,IAAI,KAAiC,CAAA;IACrC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;YAC/C,KAAK,GAAG,UAAU,CAChB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yCAAyC,SAAS,IAAI,CAAC,CAAC,EAC/E,SAAS,CACV,CAAA;YACD,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;QACjB,CAAC,CAAC,CAAA;QACF,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAA,4CAAqB,GAAE,EAAE,EAAE,OAAO,CAAC,CAAC,CAAA;QAC5E,uEAAuE;QACvE,OAAO,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,CAAA;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,IAAI,CAAC,yCAAyC,IAAA,uBAAe,EAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAC9E,OAAO,KAAK,CAAA;IACd,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC;AACH,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,2BAA2B,CAC/C,MAAyB,OAAO,CAAC,GAAG,EACpC,YAAoB,0CAA8B;IAElD,MAAM,QAAQ,GAAG,GAAG,CAAC,oBAAQ,CAAC,YAAY,CAAC,CAAA;IAC3C,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,eAAM,CAAC,IAAI,CAAC,yCAAyC,oBAAQ,CAAC,YAAY,SAAS,CAAC,CAAA;QACpF,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,eAAM,CAAC,IAAI,CAAC,8CAA8C,oBAAQ,CAAC,YAAY,sCAAsC,CAAC,CAAA;QACtH,OAAO,IAAI,CAAA;IACb,CAAC;IAED,yEAAyE;IACzE,gCAAgC;IAChC,IAAI,oBAAoB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,SAAS,CAAC,CAAA;IACvD,IAAI,QAAQ,EAAE,CAAC;QACb,oBAAoB,GAAG,IAAI,CAAA;QAC3B,eAAM,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAA;IAClF,CAAC;SAAM,CAAC;QACN,eAAM,CAAC,IAAI,CAAC,gHAAgH,CAAC,CAAA;IAC/H,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/ecs/task-definition-registrar.d.ts

@@ -1,39 +0,0 @@
-/**
- * ECS task definition registrar for `ecs publish`.
- *
- * Registers a Fargate task definition for the ECS execution agent:
- * - image pinned by digest (`<repo>@sha256:...`)
- * - awslogs log driver (log group created when missing)
- * - NO environment variables in the task definition — COMMAND_ID, the
- *   oneshot token, etc. are injected per run via containerOverrides.
- */
-import { CloudWatchLogsClient } from '@aws-sdk/client-cloudwatch-logs';
-export interface RegisterEcsTaskDefinitionOptions {
-    /** Task definition family: ai-support-ecs-agent-{tenantCode}-{agentId} */
-    family: string;
-    /** Digest-pinned image URI */
-    imageUri: string;
-    cpu: number;
-    memory: number;
-    region: string;
-    logGroupName: string;
-    /** Task execution role (required by Fargate for ECR pull / awslogs) */
-    executionRoleArn?: string;
-    /** Task role assumed by the container itself */
-    taskRoleArn?: string;
-}
-export interface RegisteredTaskDefinition {
-    taskDefinitionArn: string;
-    family: string;
-    revision: number;
-}
-/**
- * Create the awslogs log group when it does not exist.
- * ResourceAlreadyExistsException is tolerated (idempotent).
- */
-export declare function ensureLogGroup(client: CloudWatchLogsClient, logGroupName: string): Promise<void>;
-/**
- * Register the Fargate task definition and return its ARN.
- */
-export declare function registerTaskDefinition(options: RegisterEcsTaskDefinitionOptions): Promise<RegisteredTaskDefinition>;
-//# sourceMappingURL=task-definition-registrar.d.ts.map

package/dist/ecs/task-definition-registrar.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"task-definition-registrar.d.ts","sourceRoot":"","sources":["../../src/ecs/task-definition-registrar.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,oBAAoB,EAErB,MAAM,iCAAiC,CAAA;AAMxC,MAAM,WAAW,gCAAgC;IAC/C,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAA;IACd,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,wBAAwB;IACvC,iBAAiB,EAAE,MAAM,CAAA;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,oBAAoB,EAC5B,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAYf;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,gCAAgC,GACxC,OAAO,CAAC,wBAAwB,CAAC,CA0CnC"}

package/dist/ecs/task-definition-registrar.js

@@ -1,80 +0,0 @@
-"use strict";
-/**
- * ECS task definition registrar for `ecs publish`.
- *
- * Registers a Fargate task definition for the ECS execution agent:
- * - image pinned by digest (`<repo>@sha256:...`)
- * - awslogs log driver (log group created when missing)
- * - NO environment variables in the task definition — COMMAND_ID, the
- *   oneshot token, etc. are injected per run via containerOverrides.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ensureLogGroup = ensureLogGroup;
-exports.registerTaskDefinition = registerTaskDefinition;
-const client_cloudwatch_logs_1 = require("@aws-sdk/client-cloudwatch-logs");
-const client_ecs_1 = require("@aws-sdk/client-ecs");
-const constants_1 = require("../constants");
-const logger_1 = require("../logger");
-/**
- * Create the awslogs log group when it does not exist.
- * ResourceAlreadyExistsException is tolerated (idempotent).
- */
-async function ensureLogGroup(client, logGroupName) {
-    try {
-        await client.send(new client_cloudwatch_logs_1.CreateLogGroupCommand({ logGroupName }));
-        logger_1.logger.info(`[ecs] Created log group: ${logGroupName}`);
-    }
-    catch (error) {
-        const name = error.name;
-        if (name === 'ResourceAlreadyExistsException') {
-            logger_1.logger.debug(`[ecs] Log group already exists: ${logGroupName}`);
-            return;
-        }
-        throw error;
-    }
-}
-/**
- * Register the Fargate task definition and return its ARN.
- */
-async function registerTaskDefinition(options) {
-    const logsClient = new client_cloudwatch_logs_1.CloudWatchLogsClient({ region: options.region });
-    await ensureLogGroup(logsClient, options.logGroupName);
-    const ecsClient = new client_ecs_1.ECSClient({ region: options.region });
-    const response = await ecsClient.send(new client_ecs_1.RegisterTaskDefinitionCommand({
-        family: options.family,
-        requiresCompatibilities: ['FARGATE'],
-        networkMode: 'awsvpc',
-        cpu: String(options.cpu),
-        memory: String(options.memory),
-        ...(options.executionRoleArn && { executionRoleArn: options.executionRoleArn }),
-        ...(options.taskRoleArn && { taskRoleArn: options.taskRoleArn }),
-        containerDefinitions: [
-            {
-                name: constants_1.ECS_AGENT_CONTAINER_NAME,
-                image: options.imageUri,
-                essential: true,
-                // No environment variables here: they are injected at RunTask time
-                // via containerOverrides so secrets never persist in the definition.
-                logConfiguration: {
-                    logDriver: 'awslogs',
-                    options: {
-                        'awslogs-group': options.logGroupName,
-                        'awslogs-region': options.region,
-                        'awslogs-stream-prefix': 'ecs-agent',
-                    },
-                },
-            },
-        ],
-    }));
-    const taskDefinition = response.taskDefinition;
-    if (!taskDefinition?.taskDefinitionArn) {
-        throw new Error('ECS RegisterTaskDefinition returned no task definition ARN');
-    }
-    logger_1.logger.success(`[ecs] Registered task definition: ${taskDefinition.taskDefinitionArn}`);
-    return {
-        taskDefinitionArn: taskDefinition.taskDefinitionArn,
-        family: taskDefinition.family ?? options.family,
-        revision: taskDefinition.revision ?? 0,
-    };
-}
-//# sourceMappingURL=task-definition-registrar.js.map

package/dist/ecs/task-definition-registrar.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"task-definition-registrar.js","sourceRoot":"","sources":["../../src/ecs/task-definition-registrar.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AAoCH,wCAeC;AAKD,wDA4CC;AAlGD,4EAGwC;AACxC,oDAA8E;AAE9E,4CAAuD;AACvD,sCAAkC;AAuBlC;;;GAGG;AACI,KAAK,UAAU,cAAc,CAClC,MAA4B,EAC5B,YAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,8CAAqB,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAA;QAC9D,eAAM,CAAC,IAAI,CAAC,4BAA4B,YAAY,EAAE,CAAC,CAAA;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAA;QAC9C,IAAI,IAAI,KAAK,gCAAgC,EAAE,CAAC;YAC9C,eAAM,CAAC,KAAK,CAAC,mCAAmC,YAAY,EAAE,CAAC,CAAA;YAC/D,OAAM;QACR,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,sBAAsB,CAC1C,OAAyC;IAEzC,MAAM,UAAU,GAAG,IAAI,6CAAoB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IACvE,MAAM,cAAc,CAAC,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,CAAA;IAEtD,MAAM,SAAS,GAAG,IAAI,sBAAS,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IAC3D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,0CAA6B,CAAC;QACtE,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,uBAAuB,EAAE,CAAC,SAAS,CAAC;QACpC,WAAW,EAAE,QAAQ;QACrB,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;QACxB,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAC9B,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC/E,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAChE,oBAAoB,EAAE;YACpB;gBACE,IAAI,EAAE,oCAAwB;gBAC9B,KAAK,EAAE,OAAO,CAAC,QAAQ;gBACvB,SAAS,EAAE,IAAI;gBACf,mEAAmE;gBACnE,qEAAqE;gBACrE,gBAAgB,EAAE;oBAChB,SAAS,EAAE,SAAS;oBACpB,OAAO,EAAE;wBACP,eAAe,EAAE,OAAO,CAAC,YAAY;wBACrC,gBAAgB,EAAE,OAAO,CAAC,MAAM;wBAChC,uBAAuB,EAAE,WAAW;qBACrC;iBACF;aACF;SACF;KACF,CAAC,CAAC,CAAA;IAEH,MAAM,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAA;IAC9C,IAAI,CAAC,cAAc,EAAE,iBAAiB,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;IAC/E,CAAC;IACD,eAAM,CAAC,OAAO,CAAC,qCAAqC,cAAc,CAAC,iBAAiB,EAAE,CAAC,CAAA;IACvF,OAAO;QACL,iBAAiB,EAAE,cAAc,CAAC,iBAAiB;QACnD,MAAM,EAAE,cAAc,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM;QAC/C,QAAQ,EAAE,cAAc,CAAC,QAAQ,IAAI,CAAC;KACvC,CAAA;AACH,CAAC"}

package/dist/oneshot-runner.d.ts

@@ -1,38 +0,0 @@
-/**
- * Oneshot runner (ECS container mode).
- *
- * When the CLI starts with AGENT_MODE=oneshot (set via containerOverrides at
- * ECS RunTask time), it does NOT run the resident agent flow. Instead it:
- *   getCommand(COMMAND_ID) -> executeCommand -> submitResult -> exit
- *
- * There is no AppSync subscription, no heartbeat, and no register call.
- * Authentication uses the short-lived oneshot token (AGENT_ONESHOT_TOKEN)
- * scoped to the single COMMAND_ID. The token value is never logged.
- */
-interface OneshotEnv {
-    commandId: string;
-    agentId: string;
-    tenantCode: string;
-    projectCode: string;
-    apiBaseUrl: string;
-    token: string;
-}
-/**
- * Read and validate the oneshot environment.
- * Missing variables are a clear fatal error (no fallback).
- */
-export declare function readOneshotEnv(env?: NodeJS.ProcessEnv): OneshotEnv;
-/**
- * Run exactly one command and return the process exit code
- * (0 = executed and submitted successfully, 1 = any failure).
- */
-export declare function runOneshot(env?: NodeJS.ProcessEnv): Promise<number>;
-/**
- * Entry-point wrapper used by src/index.ts: runs the oneshot flow and exits
- * the process with the resulting code. Any unexpected rejection is converted
- * into exit code 1 — a container that never exits would only be reclaimed by
- * the slow timeout sweep. The runner is injectable for tests.
- */
-export declare function runOneshotFromEnv(runner?: () => Promise<number>): Promise<void>;
-export {};
-//# sourceMappingURL=oneshot-runner.d.ts.map

package/dist/oneshot-runner.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oneshot-runner.d.ts","sourceRoot":"","sources":["../src/oneshot-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAqCH,UAAU,UAAU;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,UAAU,CAa/E;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CAkFtF;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,GAAE,MAAM,OAAO,CAAC,MAAM,CAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CASjG"}