@arvoretech/pi-kiro-provider 0.8.1

package/dist/oauth.js

@@ -0,0 +1,226 @@
+// Feature 3: OAuth — Kiro Authentication
+//
+// Supports multiple auth methods:
+//   - "idc": AWS Builder ID or IAM Identity Center (SSO) via device code flow
+//   - "desktop": Google/GitHub social login via Kiro auth service (delegates to kiro-cli)
+//
+// When no existing credentials are found (no Kiro IDE, no kiro-cli), falls back
+// to the interactive login flow in login.ts (Feature 10).
+import { getKiroIdeCredentials, getKiroIdeCredentialsAllowExpired, } from "./kiro-ide.js";
+import { interactiveLogin, loginViaKiroCli } from "./login.js";
+export const SSO_OIDC_ENDPOINT = "https://oidc.us-east-1.amazonaws.com";
+export const BUILDER_ID_START_URL = "https://view.awsapps.com/start";
+export const KIRO_DESKTOP_REFRESH_URL = "https://prod.{region}.auth.desktop.kiro.dev/refreshToken";
+export const SSO_SCOPES = [
+    "codewhisperer:completions",
+    "codewhisperer:analysis",
+    "codewhisperer:conversations",
+    "codewhisperer:transformations",
+    "codewhisperer:taskassist",
+];
+/**
+ * Login to Kiro using the specified method.
+ *
+ * - "auto": Use existing kiro-cli credentials if available (any method)
+ * - "builder-id": AWS Builder ID via device code flow
+ * - "google" | "github": Social login via kiro-cli (requires kiro-cli installed)
+ */
+export async function loginKiro(callbacks, preferredMethod = "auto") {
+    const creds = await loginKiroInternal(callbacks, preferredMethod);
+    if (!process.env.VITEST) {
+        try {
+            const { resolveApiRegion, updateKiroModelsCache } = await import("./models.js");
+            const region = resolveApiRegion(creds.region);
+            updateKiroModelsCache(creds.access, region, creds.profileArn).catch(() => { });
+        }
+        catch {
+            // Ignore cache errors
+        }
+    }
+    return creds;
+}
+async function loginKiroInternal(callbacks, preferredMethod = "auto") {
+    const { getKiroCliCredentials, getKiroCliCredentialsAllowExpired, saveKiroCliCredentials, getKiroCliSocialToken, } = await import("./kiro-cli.js");
+    // If user explicitly wants social login, delegate to kiro-cli
+    if (preferredMethod === "google" || preferredMethod === "github") {
+        return loginViaKiroCli(callbacks, preferredMethod);
+    }
+    // 1. Kiro IDE token (~/.aws/sso/cache/kiro-auth-token.json)
+    //    Checked first because the IDE keeps it continuously fresh and it already
+    //    covers IAM Identity Center logins — no extra prompts needed.
+    const ideCreds = getKiroIdeCredentials();
+    if (ideCreds &&
+        (preferredMethod === "auto" || preferredMethod === "builder-id")) {
+        callbacks.onProgress?.("Using existing Kiro IDE credentials");
+        return ideCreds;
+    }
+    // 2. kiro-cli DB credentials (social / Builder ID / IdC)
+    let cliCreds = getKiroCliSocialToken();
+    if (!cliCreds) {
+        cliCreds = getKiroCliCredentials();
+    }
+    if (cliCreds &&
+        (preferredMethod === "auto" || cliCreds.authMethod === "idc")) {
+        callbacks.onProgress?.(cliCreds.authMethod === "desktop"
+            ? "Using existing kiro-cli social credentials"
+            : "Using existing kiro-cli credentials");
+        return cliCreds;
+    }
+    // 3. Expired IDE token — attempt a silent AWS OIDC refresh
+    const expiredIdeCreds = getKiroIdeCredentialsAllowExpired();
+    if (expiredIdeCreds) {
+        try {
+            callbacks.onProgress?.("Refreshing Kiro IDE credentials...");
+            return await refreshKiroTokenDirect(expiredIdeCreds);
+        }
+        catch {
+            // Fall through to kiro-cli refresh
+        }
+    }
+    // 4. Expired kiro-cli credentials — attempt a silent refresh
+    const expiredCreds = getKiroCliCredentialsAllowExpired();
+    if (expiredCreds) {
+        try {
+            callbacks.onProgress?.("Refreshing expired kiro-cli credentials...");
+            const refreshed = await refreshKiroTokenDirect(expiredCreds);
+            saveKiroCliCredentials(refreshed);
+            return refreshed;
+        }
+        catch {
+            // Refresh failed, fall through to device code flow
+        }
+    }
+    // Fall back to interactive login (Feature 10)
+    return interactiveLogin(callbacks);
+}
+/**
+ * Backward-compatible alias for loginKiro with Builder ID.
+ * @deprecated Use loginKiro instead.
+ */
+export async function loginKiroBuilderID(callbacks) {
+    return loginKiro(callbacks, "builder-id");
+}
+// Token refresh buffer (5 minutes) baked into our expires timestamps at creation time.
+// The actual AWS token is valid for this much longer than credentials.expires indicates.
+const EXPIRES_BUFFER_MS = 5 * 60 * 1000;
+export async function refreshKiroToken(credentials) {
+    const refreshed = await refreshKiroTokenInternal(credentials);
+    if (!process.env.VITEST) {
+        try {
+            const { resolveApiRegion, updateKiroModelsCache } = await import("./models.js");
+            const region = resolveApiRegion(refreshed.region);
+            updateKiroModelsCache(refreshed.access, region, refreshed.profileArn).catch(() => { });
+        }
+        catch {
+            // Ignore cache errors
+        }
+    }
+    return refreshed;
+}
+async function refreshKiroTokenInternal(credentials) {
+    const { getKiroCliCredentials, getKiroCliCredentialsAllowExpired, saveKiroCliCredentials, getKiroCliSocialToken, } = await import("./kiro-cli.js");
+    // Layer 0: Kiro IDE token — freshest source, covers IAM Identity Center
+    const ideCreds = getKiroIdeCredentials();
+    if (ideCreds)
+        return ideCreds;
+    // Layer 1: Pre-refresh check — prefer social token if available (user logged in that way)
+    // Otherwise check for any valid kiro-cli token
+    let preCheckCreds = getKiroCliSocialToken();
+    if (!preCheckCreds) {
+        preCheckCreds = getKiroCliCredentials();
+    }
+    if (preCheckCreds) {
+        return preCheckCreds;
+    }
+    try {
+        const refreshed = await refreshKiroTokenDirect(credentials);
+        // Layer 2: Write refreshed tokens back to kiro-cli's SQLite DB so both stay in sync.
+        saveKiroCliCredentials(refreshed);
+        return refreshed;
+    }
+    catch (refreshError) {
+        // Layer 3: Refresh token may have been rotated by kiro-cli between our
+        // Layer 1 check and the network call. Re-read kiro-cli's DB.
+        const retryCreds = getKiroCliCredentials();
+        if (retryCreds) {
+            return retryCreds;
+        }
+        // Layer 4: kiro-cli may have a newer refresh token (expired access token).
+        // Try refreshing with those credentials instead of the stale ones from auth.json.
+        const expiredCliCreds = getKiroCliCredentialsAllowExpired();
+        if (expiredCliCreds && expiredCliCreds.refresh !== credentials.refresh) {
+            try {
+                const refreshedFromCli = await refreshKiroTokenDirect(expiredCliCreds);
+                saveKiroCliCredentials(refreshedFromCli);
+                return refreshedFromCli;
+            }
+            catch {
+                // Also failed, continue to remaining fallbacks
+            }
+        }
+        // Layer 5: Graceful degradation — our expires has a 5-min buffer, so the
+        // actual AWS token may still be valid. Return it to buy time.
+        const actualExpiry = credentials.expires + EXPIRES_BUFFER_MS;
+        if (credentials.access && Date.now() < actualExpiry) {
+            return { ...credentials, expires: actualExpiry };
+        }
+        throw refreshError;
+    }
+}
+async function refreshKiroTokenDirect(credentials) {
+    const parts = credentials.refresh.split("|");
+    const refreshToken = parts[0] ?? "";
+    const authMethod = (parts[parts.length - 1] ?? "idc");
+    const region = credentials.region || "us-east-1";
+    if (authMethod === "desktop") {
+        // Kiro desktop app tokens use a different refresh endpoint
+        const url = KIRO_DESKTOP_REFRESH_URL.replace("{region}", region);
+        const response = await fetch(url, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", "User-Agent": "pi-cli" },
+            body: JSON.stringify({ refreshToken }),
+        });
+        if (!response.ok)
+            throw new Error(`Desktop token refresh failed: ${response.status}`);
+        const data = (await response.json());
+        if (!data.accessToken)
+            throw new Error("Desktop token refresh: missing accessToken");
+        return {
+            refresh: `${data.refreshToken || refreshToken}|desktop`,
+            access: data.accessToken,
+            expires: Date.now() + data.expiresIn * 1000 - 5 * 60 * 1000,
+            clientId: "",
+            clientSecret: "",
+            region,
+            authMethod: "desktop",
+            profileArn: data.profileArn || credentials.profileArn,
+        };
+    }
+    // IDC auth method — SSO OIDC refresh
+    const clientId = parts[1] ?? "";
+    const clientSecret = parts[2] ?? "";
+    const ssoEndpoint = `https://oidc.${region}.amazonaws.com`;
+    const response = await fetch(`${ssoEndpoint}/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", "User-Agent": "pi-cli" },
+        body: JSON.stringify({
+            clientId,
+            clientSecret,
+            refreshToken,
+            grantType: "refresh_token",
+        }),
+    });
+    if (!response.ok)
+        throw new Error(`Token refresh failed: ${response.status}`);
+    const data = (await response.json());
+    return {
+        refresh: `${data.refreshToken}|${clientId}|${clientSecret}|idc`,
+        access: data.accessToken,
+        expires: Date.now() + data.expiresIn * 1000 - 5 * 60 * 1000,
+        clientId: clientId,
+        clientSecret: clientSecret,
+        region,
+        authMethod: "idc",
+    };
+}
+//# sourceMappingURL=oauth.js.map

package/dist/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,EAAE;AACF,kCAAkC;AAClC,8EAA8E;AAC9E,0FAA0F;AAC1F,EAAE;AACF,gFAAgF;AAChF,0DAA0D;AAM1D,OAAO,EACN,qBAAqB,EACrB,iCAAiC,GACjC,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE/D,MAAM,CAAC,MAAM,iBAAiB,GAAG,sCAAsC,CAAC;AACxE,MAAM,CAAC,MAAM,oBAAoB,GAAG,gCAAgC,CAAC;AACrE,MAAM,CAAC,MAAM,wBAAwB,GACpC,0DAA0D,CAAC;AAC5D,MAAM,CAAC,MAAM,UAAU,GAAG;IACzB,2BAA2B;IAC3B,wBAAwB;IACxB,6BAA6B;IAC7B,+BAA+B;IAC/B,0BAA0B;CAC1B,CAAC;AAcF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,SAA8B,EAC9B,kBAAmC,MAAM;IAEzC,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAClE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QACzB,IAAI,CAAC;YACJ,MAAM,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAC/D,aAAa,CACb,CAAC;YACF,MAAM,MAAM,GAAG,gBAAgB,CAAE,KAAyB,CAAC,MAAM,CAAC,CAAC;YACnE,qBAAqB,CACpB,KAAK,CAAC,MAAM,EACZ,MAAM,EACL,KAAyB,CAAC,UAAU,CACrC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACR,sBAAsB;QACvB,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC/B,SAA8B,EAC9B,kBAAmC,MAAM;IAEzC,MAAM,EACL,qBAAqB,EACrB,iCAAiC,EACjC,sBAAsB,EACtB,qBAAqB,GACrB,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAElC,8DAA8D;IAC9D,IAAI,eAAe,KAAK,QAAQ,IAAI,eAAe,KAAK,QAAQ,EAAE,CAAC;QAClE,OAAO,eAAe,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACpD,CAAC;IAED,4DAA4D;IAC5D,8EAA8E;IAC9E,kEAAkE;IAClE,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAC;IACzC,IACC,QAAQ;QACR,CAAC,eAAe,KAAK,MAAM,IAAI,eAAe,KAAK,YAAY,CAAC,EAC/D,CAAC;QAED,SACA,CAAC,UAAU,EAAE,CAAC,qCAAqC,CAAC,CAAC;QACtD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,yDAAyD;IACzD,IAAI,QAAQ,GAAG,qBAAqB,EAAE,CAAC;IACvC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,QAAQ,GAAG,qBAAqB,EAAE,CAAC;IACpC,CAAC;IAED,IACC,QAAQ;QACR,CAAC,eAAe,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,KAAK,CAAC,EAC5D,CAAC;QAED,SACA,CAAC,UAAU,EAAE,CACb,QAAQ,CAAC,UAAU,KAAK,SAAS;YAChC,CAAC,CAAC,4CAA4C;YAC9C,CAAC,CAAC,qCAAqC,CACxC,CAAC;QACF,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,2DAA2D;IAC3D,MAAM,eAAe,GAAG,iCAAiC,EAAE,CAAC;IAC5D,IAAI,eAAe,EAAE,CAAC;QACrB,IAAI,CAAC;YAEH,SACA,CAAC,UAAU,EAAE,CAAC,oCAAoC,CAAC,CAAC;YACrD,OAAO,MAAM,sBAAsB,CAAC,eAAe,CAAC,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACR,mCAAmC;QACpC,CAAC;IACF,CAAC;IAED,6DAA6D;IAC7D,MAAM,YAAY,GAAG,iCAAiC,EAAE,CAAC;IACzD,IAAI,YAAY,EAAE,CAAC;QAClB,IAAI,CAAC;YAEH,SACA,CAAC,UAAU,EAAE,CAAC,4CAA4C,CAAC,CAAC;YAC7D,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,YAAY,CAAC,CAAC;YAC7D,sBAAsB,CAAC,SAA4B,CAAC,CAAC;YACrD,OAAO,SAAS,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACR,mDAAmD;QACpD,CAAC;IACF,CAAC;IAED,8CAA8C;IAC9C,OAAO,gBAAgB,CAAC,SAAS,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,SAA8B;IAE9B,OAAO,SAAS,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;AAC3C,CAAC;AAED,uFAAuF;AACvF,yFAAyF;AACzF,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAExC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,WAA6B;IAE7B,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAC9D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QACzB,IAAI,CAAC;YACJ,MAAM,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAC/D,aAAa,CACb,CAAC;YACF,MAAM,MAAM,GAAG,gBAAgB,CAAE,SAA6B,CAAC,MAAM,CAAC,CAAC;YACvE,qBAAqB,CACpB,SAAS,CAAC,MAAM,EAChB,MAAM,EACL,SAA6B,CAAC,UAAU,CACzC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACR,sBAAsB;QACvB,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,wBAAwB,CACtC,WAA6B;IAE7B,MAAM,EACL,qBAAqB,EACrB,iCAAiC,EACjC,sBAAsB,EACtB,qBAAqB,GACrB,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAElC,wEAAwE;IACxE,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAC;IACzC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,0FAA0F;IAC1F,+CAA+C;IAC/C,IAAI,aAAa,GAAG,qBAAqB,EAAE,CAAC;IAC5C,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,aAAa,GAAG,qBAAqB,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,aAAa,EAAE,CAAC;QACnB,OAAO,aAAa,CAAC;IACtB,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,WAAW,CAAC,CAAC;QAE5D,qFAAqF;QACrF,sBAAsB,CAAC,SAA4B,CAAC,CAAC;QAErD,OAAO,SAAS,CAAC;IAClB,CAAC;IAAC,OAAO,YAAY,EAAE,CAAC;QACvB,uEAAuE;QACvE,6DAA6D;QAC7D,MAAM,UAAU,GAAG,qBAAqB,EAAE,CAAC;QAC3C,IAAI,UAAU,EAAE,CAAC;YAChB,OAAO,UAAU,CAAC;QACnB,CAAC;QAED,2EAA2E;QAC3E,kFAAkF;QAClF,MAAM,eAAe,GAAG,iCAAiC,EAAE,CAAC;QAC5D,IAAI,eAAe,IAAI,eAAe,CAAC,OAAO,KAAK,WAAW,CAAC,OAAO,EAAE,CAAC;YACxE,IAAI,CAAC;gBACJ,MAAM,gBAAgB,GAAG,MAAM,sBAAsB,CAAC,eAAe,CAAC,CAAC;gBACvE,sBAAsB,CAAC,gBAAmC,CAAC,CAAC;gBAC5D,OAAO,gBAAgB,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACR,+CAA+C;YAChD,CAAC;QACF,CAAC;QAED,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,GAAG,iBAAiB,CAAC;QAC7D,IAAI,WAAW,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC;YACrD,OAAO,EAAE,GAAG,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QAClD,CAAC;QAED,MAAM,YAAY,CAAC;IACpB,CAAC;AACF,CAAC;AAED,KAAK,UAAU,sBAAsB,CACpC,WAA6B;IAE7B,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,CAAmB,CAAC;IACxE,MAAM,MAAM,GAAI,WAA+B,CAAC,MAAM,IAAI,WAAW,CAAC;IAEtE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC9B,2DAA2D;QAC3D,MAAM,GAAG,GAAG,wBAAwB,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACjC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,YAAY,EAAE,QAAQ,EAAE;YACvE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;SACtC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YACf,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAKlC,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,WAAW;YACpB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC/D,OAAO;YACN,OAAO,EAAE,GAAG,IAAI,CAAC,YAAY,IAAI,YAAY,UAAU;YACvD,MAAM,EAAE,IAAI,CAAC,WAAW;YACxB,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI;YAC3D,QAAQ,EAAE,EAAE;YACZ,YAAY,EAAE,EAAE;YAChB,MAAM;YACN,UAAU,EAAE,SAA2B;YACvC,UAAU,EACT,IAAI,CAAC,UAAU,IAAK,WAA+B,CAAC,UAAU;SAC/D,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,WAAW,GAAG,gBAAgB,MAAM,gBAAgB,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,QAAQ,EAAE;QACpD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,YAAY,EAAE,QAAQ,EAAE;QACvE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,QAAQ;YACR,YAAY;YACZ,YAAY;YACZ,SAAS,EAAE,eAAe;SAC1B,CAAC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAIlC,CAAC;IACF,OAAO;QACN,OAAO,EAAE,GAAG,IAAI,CAAC,YAAY,IAAI,QAAQ,IAAI,YAAY,MAAM;QAC/D,MAAM,EAAE,IAAI,CAAC,WAAW;QACxB,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI;QAC3D,QAAQ,EAAE,QAAQ;QAClB,YAAY,EAAE,YAAY;QAC1B,MAAM;QACN,UAAU,EAAE,KAAuB;KACnC,CAAC;AACH,CAAC"}

package/dist/retry.d.ts

@@ -0,0 +1,21 @@
+export declare const FIRST_TOKEN_TIMEOUT = 90000;
+export declare function firstTokenTimeoutForModel(modelId: string): number;
+export declare const retryConfig: {
+    firstTokenTimeoutMs: number;
+};
+export declare function exponentialBackoff(attempt: number, baseMs: number, maxMs: number): number;
+export declare const MAX_RETRY_DELAY = 10000;
+export declare const TOO_BIG_PATTERNS: string[];
+export declare const CAPACITY_MAX_RETRIES = 3;
+export declare const CAPACITY_BASE_DELAY_MS = 5000;
+export declare const capacityRetryConfig: {
+    maxRetries: number;
+    baseDelayMs: number;
+};
+/** Check whether an HTTP error represents a "request too large" condition. */
+export declare function isTooBigError(status: number, errorText: string): boolean;
+/** Check whether the response body contains a Kiro-specific non-retryable marker. */
+export declare function isNonRetryableBodyError(errorText: string): boolean;
+/** Check whether the error is a transient capacity issue worth retrying. */
+export declare function isCapacityError(errorText: string): boolean;
+//# sourceMappingURL=retry.d.ts.map

package/dist/retry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry.d.ts","sourceRoot":"","sources":["../src/retry.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,mBAAmB,QAAS,CAAC;AAE1C,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAOjE;AAGD,eAAO,MAAM,WAAW;;CAEvB,CAAC;AAEF,wBAAgB,kBAAkB,CACjC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACX,MAAM,CAER;AAED,eAAO,MAAM,eAAe,QAAS,CAAC;AAEtC,eAAO,MAAM,gBAAgB,UAI5B,CAAC;AAGF,eAAO,MAAM,oBAAoB,IAAI,CAAC;AACtC,eAAO,MAAM,sBAAsB,OAAQ,CAAC;AAG5C,eAAO,MAAM,mBAAmB;;;CAG/B,CAAC;AAEF,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAKxE;AAED,qFAAqF;AACrF,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAElE;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE1D"}

package/dist/retry.js

@@ -0,0 +1,51 @@
+// ABOUTME: Stream recovery helpers and Kiro-specific error classification.
+// ABOUTME: Keeps provider-local retry logic limited to auth refresh and stream quirks.
+import { kiroModels } from "./models.js";
+// kiro-cli uses 5-minute read/operation timeouts (DEFAULT_TIMEOUT_DURATION)
+// and 5-minute stalled stream grace period. 90s matches the TUI's
+// INITIAL_RESPONSE_TIMEOUT_MS for the first event from the backend.
+export const FIRST_TOKEN_TIMEOUT = 90_000;
+export function firstTokenTimeoutForModel(modelId) {
+    // Allow test overrides via retryConfig.firstTokenTimeoutMs
+    if (retryConfig.firstTokenTimeoutMs !== FIRST_TOKEN_TIMEOUT) {
+        return retryConfig.firstTokenTimeoutMs;
+    }
+    const model = kiroModels.find((m) => m.id === modelId);
+    return model?.firstTokenTimeout ?? FIRST_TOKEN_TIMEOUT;
+}
+// Mutable config for values that tests need to override
+export const retryConfig = {
+    firstTokenTimeoutMs: FIRST_TOKEN_TIMEOUT,
+};
+export function exponentialBackoff(attempt, baseMs, maxMs) {
+    return Math.min(baseMs * 2 ** attempt, maxMs);
+}
+export const MAX_RETRY_DELAY = 10_000;
+export const TOO_BIG_PATTERNS = [
+    "CONTENT_LENGTH_EXCEEDS_THRESHOLD",
+    "Input is too long",
+    "Improperly formed",
+];
+const NON_RETRYABLE_BODY_PATTERNS = ["MONTHLY_REQUEST_COUNT"];
+const CAPACITY_PATTERN = "INSUFFICIENT_MODEL_CAPACITY";
+export const CAPACITY_MAX_RETRIES = 3;
+export const CAPACITY_BASE_DELAY_MS = 5_000;
+// Mutable capacity config for testing
+export const capacityRetryConfig = {
+    maxRetries: CAPACITY_MAX_RETRIES,
+    baseDelayMs: CAPACITY_BASE_DELAY_MS,
+};
+/** Check whether an HTTP error represents a "request too large" condition. */
+export function isTooBigError(status, errorText) {
+    return (status === 413 ||
+        (status === 400 && TOO_BIG_PATTERNS.some((p) => errorText.includes(p))));
+}
+/** Check whether the response body contains a Kiro-specific non-retryable marker. */
+export function isNonRetryableBodyError(errorText) {
+    return NON_RETRYABLE_BODY_PATTERNS.some((p) => errorText.includes(p));
+}
+/** Check whether the error is a transient capacity issue worth retrying. */
+export function isCapacityError(errorText) {
+    return errorText.includes(CAPACITY_PATTERN);
+}
+//# sourceMappingURL=retry.js.map

package/dist/retry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry.js","sourceRoot":"","sources":["../src/retry.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,uFAAuF;AAEvF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,4EAA4E;AAC5E,kEAAkE;AAClE,oEAAoE;AACpE,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAE1C,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACxD,2DAA2D;IAC3D,IAAI,WAAW,CAAC,mBAAmB,KAAK,mBAAmB,EAAE,CAAC;QAC7D,OAAO,WAAW,CAAC,mBAAmB,CAAC;IACxC,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC;IACvD,OAAO,KAAK,EAAE,iBAAiB,IAAI,mBAAmB,CAAC;AACxD,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,MAAM,WAAW,GAAG;IAC1B,mBAAmB,EAAE,mBAAmB;CACxC,CAAC;AAEF,MAAM,UAAU,kBAAkB,CACjC,OAAe,EACf,MAAc,EACd,KAAa;IAEb,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AAEtC,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC/B,kCAAkC;IAClC,mBAAmB;IACnB,mBAAmB;CACnB,CAAC;AACF,MAAM,2BAA2B,GAAG,CAAC,uBAAuB,CAAC,CAAC;AAC9D,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AACvD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AACtC,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAE5C,sCAAsC;AACtC,MAAM,CAAC,MAAM,mBAAmB,GAAG;IAClC,UAAU,EAAE,oBAAoB;IAChC,WAAW,EAAE,sBAAsB;CACnC,CAAC;AAEF,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,SAAiB;IAC9D,OAAO,CACN,MAAM,KAAK,GAAG;QACd,CAAC,MAAM,KAAK,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CACvE,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,uBAAuB,CAAC,SAAiB;IACxD,OAAO,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAAC,SAAiB;IAChD,OAAO,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;AAC7C,CAAC"}

package/dist/stream.d.ts

@@ -0,0 +1,5 @@
+import type { Api, AssistantMessageEventStream, Context, Model, SimpleStreamOptions } from "@earendil-works/pi-ai";
+/** Reset profileArn cache — exported for tests. */
+export declare function resetProfileArnCache(resolved?: boolean): void;
+export declare function streamKiro(model: Model<Api>, context: Context, options?: SimpleStreamOptions): AssistantMessageEventStream;
+//# sourceMappingURL=stream.d.ts.map

package/dist/stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../src/stream.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACX,GAAG,EAEH,2BAA2B,EAC3B,OAAO,EAEP,KAAK,EACL,mBAAmB,EAInB,MAAM,uBAAuB,CAAC;AAoH/B,mDAAmD;AACnD,wBAAgB,oBAAoB,CAAC,QAAQ,UAAQ,GAAG,IAAI,CAI3D;AA+FD,wBAAgB,UAAU,CACzB,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EACjB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,mBAAmB,GAC3B,2BAA2B,CAmyB7B"}