@alienplatform/manager-api 1.14.1 → 1.15.0-dev.e74fae6cd01b61e77a285276f264b5480977f41a

package/src/lib/sdks.ts

@@ -22,9 +22,9 @@ import {
   isConnectionError,
   isTimeoutError,
   matchContentType,
-  matchStatusCode,
 } from "./http.js";
 import { Logger } from "./logger.js";
+import { combineSignals } from "./primitives.js";
 import { retry, RetryConfig } from "./retries.js";
 import { SecurityState } from "./security.js";
 
@@ -127,30 +127,60 @@ export class ClientSDK {
     if (!base) {
       return ERR(new InvalidRequestError("No base URL provided for operation"));
     }
-    const reqURL = new URL(base);
-    const inputURL = new URL(path, reqURL);
-
+    const baseURL = new URL(base);
+    let reqURL: URL;
     if (path) {
-      reqURL.pathname += reqURL.pathname.endsWith("/") ? "" : "/";
-      reqURL.pathname += inputURL.pathname.replace(/^\/+/, "");
+      baseURL.pathname = baseURL.pathname.replace(/\/+$/, "") + "/";
+      reqURL = new URL(path, baseURL);
+      if (!reqURL.search && baseURL.search) {
+        reqURL.search = baseURL.search;
+      }
+    } else {
+      reqURL = baseURL;
     }
+    reqURL.hash = "";
 
-    let finalQuery = query || "";
-
-    const secQuery: string[] = [];
-    for (const [k, v] of Object.entries(security?.queryParams || {})) {
-      const q = encodeForm(k, v, { charEncoding: "percent" });
-      if (typeof q !== "undefined") {
-        secQuery.push(q);
+    // Appends already-encoded query pairs to a query string, replacing any
+    // existing pairs with the same key so later sources take precedence.
+    const mergeQuery = (current: string, additions: string): string => {
+      if (!additions) {
+        return current;
       }
-    }
-    if (secQuery.length) {
-      finalQuery += `&${secQuery.join("&")}`;
-    }
+      const additionKeys = new Set(
+        additions
+          .split("&")
+          .filter((pair) => pair !== "")
+          .map((pair) => pair.split("=")[0] ?? ""),
+      );
+      const kept = current.split("&").filter((pair) => {
+        return pair !== "" && !additionKeys.has(pair.split("=")[0] ?? "");
+      });
+      return [...kept, additions].join("&");
+    };
+
+    const encodeQueryRecord = (record: Record<string, unknown>): string => {
+      return Object.entries(record)
+        .map(([k, v]) => {
+          if (v == null) {
+            return undefined;
+          }
+          const value = v;
+          return encodeForm(k, value, {
+            explode: Array.isArray(value),
+            charEncoding: "percent",
+          });
+        })
+        .filter((pair): pair is string => typeof pair !== "undefined")
+        .join("&");
+    };
+
+    const finalQuery = [
+      query || "",
+      encodeQueryRecord(security?.queryParams || {}),
+    ].reduce(mergeQuery, reqURL.search.slice(1));
 
     if (finalQuery) {
-      const q = finalQuery.startsWith("&") ? finalQuery.slice(1) : finalQuery;
-      reqURL.search = `?${q}`;
+      reqURL.search = `?${finalQuery}`;
     }
 
     const headers = new Headers(opHeaders);
@@ -196,9 +226,8 @@ export class ClientSDK {
       ...options?.fetchOptions,
       ...options,
     };
-    if (!fetchOptions?.signal && conf.timeoutMs && conf.timeoutMs > 0) {
-      const timeoutSignal = AbortSignal.timeout(conf.timeoutMs);
-      fetchOptions.signal = timeoutSignal;
+    if (!fetchOptions?.signal && conf.timeoutMs != null && conf.timeoutMs > 0) {
+      context.timeoutMs = conf.timeoutMs;
     }
 
     if (conf.body instanceof ReadableStream) {
@@ -231,7 +260,7 @@ export class ClientSDK {
     request: Request,
     options: {
       context: HookContext;
-      errorCodes: number | string | (number | string)[];
+      isErrorStatusCode: (statusCode: number) => boolean;
       retryConfig: RetryConfig;
       retryCodes: string[];
     },
@@ -244,11 +273,20 @@ export class ClientSDK {
       | UnexpectedClientError
     >
   > {
-    const { context, errorCodes } = options;
+    const { context, isErrorStatusCode } = options;
+    const timeoutMs = context.timeoutMs;
 
     return retry(
       async () => {
-        const req = await this.#hooks.beforeRequest(context, request.clone());
+        const cloned = request.clone();
+        let attempt = cloned;
+        if (timeoutMs != null && timeoutMs > 0) {
+          const timeoutSignal = AbortSignal.timeout(timeoutMs);
+          const combined = combineSignals(cloned.signal, timeoutSignal)
+            ?? timeoutSignal;
+          attempt = new Request(cloned, { signal: combined });
+        }
+        const req = await this.#hooks.beforeRequest(context, attempt);
         await logRequest(this.#logger, req).catch((e) =>
           this.#logger?.log("Failed to log request:", e)
         );
@@ -256,7 +294,7 @@ export class ClientSDK {
         let response = await this.#httpClient.request(req);
 
         try {
-          if (matchStatusCode(response, errorCodes)) {
+          if (isErrorStatusCode(response.status)) {
             const result = await this.#hooks.afterError(
               context,
               response,
@@ -307,9 +345,9 @@ export class ClientSDK {
   }
 }
 
-const jsonLikeContentTypeRE = /(application|text)\/.*?\+*json.*/;
+const jsonLikeContentTypeRE = /^(application|text)\/([^+]+\+)*json.*/;
 const jsonlLikeContentTypeRE =
-  /(application|text)\/(.*?\+*\bjsonl\b.*|.*?\+*\bx-ndjson\b.*)/;
+  /^(application|text)\/([^+]+\+)*(jsonl|x-ndjson)\b.*/;
 async function logRequest(logger: Logger | undefined, req: Request) {
   if (!logger) {
     return;
@@ -380,8 +418,6 @@ async function logResponse(
       break;
     case matchContentType(res, "application/jsonl")
       || jsonlLikeContentTypeRE.test(ct):
-      logger.log(await res.clone().text());
-      break;
     case matchContentType(res, "text/event-stream"):
       logger.log(`<${contentType}>`);
       break;

package/src/lib/security.ts

@@ -13,17 +13,22 @@ type OAuth2PasswordFlow = {
   tokenURL: string;
 };
 
-export enum SecurityErrorCode {
-  Incomplete = "incomplete",
-  UnrecognisedSecurityType = "unrecognized_security_type",
-}
+export const SecurityErrorCode = {
+  Incomplete: "incomplete",
+  UnrecognisedSecurityType: "unrecognized_security_type",
+} as const;
+export type SecurityErrorCode =
+  (typeof SecurityErrorCode)[keyof typeof SecurityErrorCode];
 
 export class SecurityError extends Error {
+  public code: SecurityErrorCode;
+
   constructor(
-    public code: SecurityErrorCode,
+    code: SecurityErrorCode,
     message: string,
   ) {
     super(message);
+    this.code = code;
     this.name = "SecurityError";
   }
 
@@ -198,8 +203,7 @@ export function resolveSecurity(
         applyBearer(state, spec);
         break;
       default:
-        spec satisfies never;
-        throw SecurityError.unrecognizedType(type);
+        throw SecurityError.unrecognizedType((spec satisfies never, type));
     }
   });
 
@@ -241,8 +245,9 @@ function applyBearer(
 
 export function resolveGlobalSecurity(
   security: Partial<models.Security> | null | undefined,
+  allowedFields?: number[],
 ): SecurityState | null {
-  return resolveSecurity(
+  let inputs: SecurityInput[][] = [
     [
       {
         fieldName: "Authorization",
@@ -250,7 +255,18 @@ export function resolveGlobalSecurity(
         value: security?.bearer ?? env().ALIEN_MANAGER_BEARER,
       },
     ],
-  );
+  ];
+
+  if (allowedFields) {
+    inputs = allowedFields.map((i) => {
+      if (i < 0 || i >= inputs.length) {
+        throw new RangeError(`invalid allowedFields index ${i}`);
+      }
+      return inputs[i]!;
+    });
+  }
+
+  return resolveSecurity(...inputs);
 }
 
 export async function extractSecurity<

package/src/lib/url.ts

@@ -13,21 +13,23 @@ export function pathToFunc(
   const paramRE = /\{([a-zA-Z0-9_][a-zA-Z0-9_-]*?)\}/g;
 
   return function buildURLPath(params: Record<string, unknown> = {}): string {
-    return pathPattern.replace(paramRE, function (_, placeholder) {
-      if (!hasOwn.call(params, placeholder)) {
-        throw new Error(`Parameter '${placeholder}' is required`);
-      }
+    return pathPattern
+      .replace(paramRE, function (_, placeholder) {
+        if (!hasOwn.call(params, placeholder)) {
+          throw new Error(`Parameter '${placeholder}' is required`);
+        }
 
-      const value = params[placeholder];
-      if (typeof value !== "string" && typeof value !== "number") {
-        throw new Error(
-          `Parameter '${placeholder}' must be a string or number`,
-        );
-      }
+        const value = params[placeholder];
+        if (typeof value !== "string" && typeof value !== "number") {
+          throw new Error(
+            `Parameter '${placeholder}' must be a string or number`,
+          );
+        }
 
-      return options?.charEncoding === "percent"
-        ? encodeURIComponent(`${value}`)
-        : `${value}`;
-    });
+        return options?.charEncoding === "percent"
+          ? encodeURIComponent(`${value}`)
+          : `${value}`;
+      })
+      .replace(/^\/+/, "");
   };
 }

package/src/models/agentsyncresponse.ts

@@ -9,10 +9,10 @@ import { SDKValidationError } from "./errors/sdkvalidationerror.js";
 
 export type AgentSyncResponse = {
   /**
-   * Public URL for the commands API. Cloud-deployed workers use this
+   * Public URL for the commands API. Operators and app-owned receivers use
    *
    * @remarks
-   * to poll for pending commands instead of the agent's local sync URL.
+   * it to lease pending commands instead of the agent's local sync URL.
    */
   commandsUrl?: string | null | undefined;
   /**

package/src/models/awscredentials.ts

@@ -0,0 +1,231 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v4";
+import { remap as remap$ } from "../lib/primitives.js";
+import { safeParse } from "../lib/schemas.js";
+import { Result as SafeParseResult } from "../types/fp.js";
+import {
+  AwsWebIdentityConfig,
+  AwsWebIdentityConfig$inboundSchema,
+} from "./awswebidentityconfig.js";
+import { SDKValidationError } from "./errors/sdkvalidationerror.js";
+
+/**
+ * Web Identity Token for OIDC authentication
+ */
+export type AwsCredentialsWebIdentity = {
+  /**
+   * Configuration for AWS Web Identity Token authentication
+   */
+  config: AwsWebIdentityConfig;
+  type: "webIdentity";
+};
+
+/**
+ * AWS profile credentials loaded via the AWS CLI.
+ */
+export type AwsCredentialsProfile = {
+  /**
+   * AWS profile name
+   */
+  name: string;
+  type: "profile";
+};
+
+/**
+ * AWS Instance Metadata Service credentials.
+ */
+export type AwsCredentialsImds = {
+  /**
+   * Optional IMDS endpoint override
+   */
+  endpoint?: string | null | undefined;
+  type: "imds";
+};
+
+/**
+ * Temporary AWS session credentials with an expiration time.
+ */
+export type AwsCredentialsSessionCredentials = {
+  /**
+   * AWS Access Key ID
+   */
+  accessKeyId: string;
+  /**
+   * Credential expiration as an RFC3339 timestamp
+   */
+  expiresAt: string;
+  /**
+   * AWS Secret Access Key
+   */
+  secretAccessKey: string;
+  /**
+   * AWS Session Token
+   */
+  sessionToken: string;
+  type: "sessionCredentials";
+};
+
+/**
+ * Static direct access keys.
+ */
+export type AwsCredentialsAccessKeys = {
+  /**
+   * AWS Access Key ID
+   */
+  accessKeyId: string;
+  /**
+   * AWS Secret Access Key
+   */
+  secretAccessKey: string;
+  /**
+   * Optional AWS Session Token
+   */
+  sessionToken?: string | null | undefined;
+  type: "accessKeys";
+};
+
+/**
+ * Supported AWS authentication methods
+ */
+export type AwsCredentials =
+  | AwsCredentialsAccessKeys
+  | AwsCredentialsSessionCredentials
+  | AwsCredentialsImds
+  | AwsCredentialsProfile
+  | AwsCredentialsWebIdentity;
+
+/** @internal */
+export const AwsCredentialsWebIdentity$inboundSchema: z.ZodType<
+  AwsCredentialsWebIdentity,
+  unknown
+> = z.object({
+  config: AwsWebIdentityConfig$inboundSchema,
+  type: z.literal("webIdentity"),
+});
+
+export function awsCredentialsWebIdentityFromJSON(
+  jsonString: string,
+): SafeParseResult<AwsCredentialsWebIdentity, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => AwsCredentialsWebIdentity$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'AwsCredentialsWebIdentity' from JSON`,
+  );
+}
+
+/** @internal */
+export const AwsCredentialsProfile$inboundSchema: z.ZodType<
+  AwsCredentialsProfile,
+  unknown
+> = z.object({
+  name: z.string(),
+  type: z.literal("profile"),
+});
+
+export function awsCredentialsProfileFromJSON(
+  jsonString: string,
+): SafeParseResult<AwsCredentialsProfile, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => AwsCredentialsProfile$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'AwsCredentialsProfile' from JSON`,
+  );
+}
+
+/** @internal */
+export const AwsCredentialsImds$inboundSchema: z.ZodType<
+  AwsCredentialsImds,
+  unknown
+> = z.object({
+  endpoint: z.nullable(z.string()).optional(),
+  type: z.literal("imds"),
+});
+
+export function awsCredentialsImdsFromJSON(
+  jsonString: string,
+): SafeParseResult<AwsCredentialsImds, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => AwsCredentialsImds$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'AwsCredentialsImds' from JSON`,
+  );
+}
+
+/** @internal */
+export const AwsCredentialsSessionCredentials$inboundSchema: z.ZodType<
+  AwsCredentialsSessionCredentials,
+  unknown
+> = z.object({
+  access_key_id: z.string(),
+  expires_at: z.string(),
+  secret_access_key: z.string(),
+  session_token: z.string(),
+  type: z.literal("sessionCredentials"),
+}).transform((v) => {
+  return remap$(v, {
+    "access_key_id": "accessKeyId",
+    "expires_at": "expiresAt",
+    "secret_access_key": "secretAccessKey",
+    "session_token": "sessionToken",
+  });
+});
+
+export function awsCredentialsSessionCredentialsFromJSON(
+  jsonString: string,
+): SafeParseResult<AwsCredentialsSessionCredentials, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => AwsCredentialsSessionCredentials$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'AwsCredentialsSessionCredentials' from JSON`,
+  );
+}
+
+/** @internal */
+export const AwsCredentialsAccessKeys$inboundSchema: z.ZodType<
+  AwsCredentialsAccessKeys,
+  unknown
+> = z.object({
+  access_key_id: z.string(),
+  secret_access_key: z.string(),
+  session_token: z.nullable(z.string()).optional(),
+  type: z.literal("accessKeys"),
+}).transform((v) => {
+  return remap$(v, {
+    "access_key_id": "accessKeyId",
+    "secret_access_key": "secretAccessKey",
+    "session_token": "sessionToken",
+  });
+});
+
+export function awsCredentialsAccessKeysFromJSON(
+  jsonString: string,
+): SafeParseResult<AwsCredentialsAccessKeys, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => AwsCredentialsAccessKeys$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'AwsCredentialsAccessKeys' from JSON`,
+  );
+}
+
+/** @internal */
+export const AwsCredentials$inboundSchema: z.ZodType<AwsCredentials, unknown> =
+  z.union([
+    z.lazy(() => AwsCredentialsAccessKeys$inboundSchema),
+    z.lazy(() => AwsCredentialsSessionCredentials$inboundSchema),
+    z.lazy(() => AwsCredentialsImds$inboundSchema),
+    z.lazy(() => AwsCredentialsProfile$inboundSchema),
+    z.lazy(() => AwsCredentialsWebIdentity$inboundSchema),
+  ]);
+
+export function awsCredentialsFromJSON(
+  jsonString: string,
+): SafeParseResult<AwsCredentials, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => AwsCredentials$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'AwsCredentials' from JSON`,
+  );
+}

package/src/models/awsserviceoverrides.ts

@@ -0,0 +1,39 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v4";
+import { safeParse } from "../lib/schemas.js";
+import { Result as SafeParseResult } from "../types/fp.js";
+import { SDKValidationError } from "./errors/sdkvalidationerror.js";
+
+/**
+ * Service endpoint overrides for testing AWS services
+ */
+export type AwsServiceOverrides = {
+  /**
+   * Override endpoints for specific AWS services
+   *
+   * @remarks
+   * Key is the service name (e.g., "lambda", "s3"), value is the base URL
+   */
+  endpoints: { [k: string]: string };
+};
+
+/** @internal */
+export const AwsServiceOverrides$inboundSchema: z.ZodType<
+  AwsServiceOverrides,
+  unknown
+> = z.object({
+  endpoints: z.record(z.string(), z.string()),
+});
+
+export function awsServiceOverridesFromJSON(
+  jsonString: string,
+): SafeParseResult<AwsServiceOverrides, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => AwsServiceOverrides$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'AwsServiceOverrides' from JSON`,
+  );
+}

package/src/models/awswebidentityconfig.ts

@@ -0,0 +1,51 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import * as z from "zod/v4";
+import { safeParse } from "../lib/schemas.js";
+import { Result as SafeParseResult } from "../types/fp.js";
+import { SDKValidationError } from "./errors/sdkvalidationerror.js";
+
+/**
+ * Configuration for AWS Web Identity Token authentication
+ */
+export type AwsWebIdentityConfig = {
+  /**
+   * Optional duration for the assumed role credentials (in seconds)
+   */
+  durationSeconds?: number | null | undefined;
+  /**
+   * The ARN of the role to assume
+   */
+  roleArn: string;
+  /**
+   * Optional session name for the assumed role session
+   */
+  sessionName?: string | null | undefined;
+  /**
+   * The path to the web identity token file
+   */
+  webIdentityTokenFile: string;
+};
+
+/** @internal */
+export const AwsWebIdentityConfig$inboundSchema: z.ZodType<
+  AwsWebIdentityConfig,
+  unknown
+> = z.object({
+  durationSeconds: z.nullable(z.int()).optional(),
+  roleArn: z.string(),
+  sessionName: z.nullable(z.string()).optional(),
+  webIdentityTokenFile: z.string(),
+});
+
+export function awsWebIdentityConfigFromJSON(
+  jsonString: string,
+): SafeParseResult<AwsWebIdentityConfig, SDKValidationError> {
+  return safeParse(
+    jsonString,
+    (x) => AwsWebIdentityConfig$inboundSchema.parse(JSON.parse(x)),
+    `Failed to parse 'AwsWebIdentityConfig' from JSON`,
+  );
+}