@aws/agentcore 1.0.0-preview.18 → 1.0.0-preview.19

package/dist/lib/errors/types.d.ts

@@ -33,6 +33,20 @@ export declare class AgentAlreadyExistsError extends BaseError {
 export declare class AccessDeniedError extends BaseError {
     constructor(message: string, options?: BaseErrorOptions);
 }
+/**
+ * Error thrown when a secret value cannot be encrypted before writing to disk
+ * (e.g. the machine encryption key could not be created/read).
+ */
+export declare class SecretEncryptionError extends BaseError {
+    constructor(message: string, options?: BaseErrorOptions);
+}
+/**
+ * Error thrown when a stored secret value cannot be decrypted (missing/changed
+ * machine key, or corrupted ciphertext).
+ */
+export declare class SecretDecryptionError extends BaseError {
+    constructor(message: string, options?: BaseErrorOptions);
+}
 /**
  * Error indicating missing system dependencies required for an operation.
  */
@@ -57,6 +71,17 @@ export declare class JobNotFoundError extends BaseError {
 export declare class ValidationError extends BaseError {
     constructor(message: string, options?: BaseErrorOptions);
 }
+/**
+ * Error thrown when CDK synth fails because the project's installed `@aws/agentcore-cdk`
+ * construct is older than the running CLI and rejects a config key the CLI legitimately writes.
+ *
+ * The CLI strict-validates agentcore.json against its own schema during preflight, *before*
+ * synth. So an "unknown keys (remove)" failure reaching synth proves the key is valid to the
+ * CLI but unknown to the older bundled construct — i.e. version skew, not a bad config.
+ */
+export declare class StaleCdkConstructError extends BaseError {
+    constructor(rejectedKeys: string[], installedVersion: string | undefined, options?: BaseErrorOptions);
+}
 /**
  * Error thrown when AWS credentials are not configured or invalid.
  * Supports both a short message (for interactive mode) and detailed message (for CLI mode).

package/dist/lib/errors/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/errors/types.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAE/B,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAEpE,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,UAAU,oBAAqB,SAAQ,gBAAgB;IACrD,aAAa,EAAE,WAAW,CAAC;CAC5B;AAED,8BAAsB,SAAU,SAAQ,KAAK;IAC3C,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAElC,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB;CAKrE;AAED;;;GAGG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,OAAO,GAAG,KAAK,CAE3C;AAID;;GAEG;AACH,qBAAa,cAAe,SAAQ,SAAS;gBAC/B,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAMzD;AAED;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,SAAS;gBACxC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAG1D;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,SAAS;gBAClC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,SAAS;gBACrC,MAAM,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGzD;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,SAAS;gBACtC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,SAAS;gBACjC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,SAAS;gBAChC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,SAAS;IAChD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;gBAClB,YAAY,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAIvF;AAED;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,SAAS;gBACxC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,SAAS;gBAC/B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,cAAc;gBACvC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGhF;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,cAAc;gBAC5C,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAG7E;AAED;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,cAAc;gBAC7C,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGzD;AAED;;GAEG;AACH,qBAAa,wBAAyB,SAAQ,cAAc;gBAC9C,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGzD;AAID;;GAEG;AACH,uBAAe,WAAY,SAAQ,SAAS;IAC1C,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGlE;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,WAAW;aAEhC,QAAQ,EAAE,MAAM;aAChB,QAAQ,EAAE,MAAM;gBADhB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM;CAInC;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,WAAW;aAE5B,QAAQ,EAAE,MAAM;aACP,KAAK,EAAE,OAAO;gBADvB,QAAQ,EAAE,MAAM,EACP,KAAK,EAAE,OAAO;CAK1C;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,WAAW;aAE7B,QAAQ,EAAE,MAAM;aACP,KAAK,EAAE,OAAO;gBADvB,QAAQ,EAAE,MAAM,EACP,KAAK,EAAE,OAAO;CAK1C;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,WAAW;aAElC,QAAQ,EAAE,MAAM;aAChB,QAAQ,EAAE,MAAM;aAChB,QAAQ,EAAE,QAAQ;gBAFlB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,QAAQ;CAIrC;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,WAAW;aAE7B,QAAQ,EAAE,MAAM;aACP,KAAK,EAAE,OAAO;gBADvB,QAAQ,EAAE,MAAM,EACP,KAAK,EAAE,OAAO;CAK1C;AAED;;GAEG;AACH,qBAAa,YAAa,SAAQ,SAAS;gBAC7B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAID;;GAEG;AACH,qBAAa,aAAc,SAAQ,SAAS;gBAC9B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED;;GAEG;AACH,qBAAa,YAAa,SAAQ,SAAS;gBAC7B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,SAAS;aAEzB,UAAU,EAAE,MAAM;gBAAlB,UAAU,EAAE,MAAM,EAClC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,gBAAgB;CAI7B;AAED;;GAEG;AACH,qBAAa,wBAAyB,SAAQ,SAAS;gBACzC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED;;GAEG;AACH,qBAAa,YAAa,SAAQ,SAAS;gBAC7B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,SAAS;gBAChC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,SAAS;gBAClC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,SAAS;gBACjC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAG1D;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,SAAS;gBACnC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAG5D;AAED;;;;;GAKG;AACH,qBAAa,cAAe,SAAQ,SAAS;gBAC/B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED,qBAAa,gBAAiB,SAAQ,SAAS;gBACjC,OAAO,CAAC,EAAE,gBAAgB;CAMvC;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,SAAS;gBACtC,OAAO,CAAC,EAAE,gBAAgB;CAGvC;AAED,qBAAa,kBAAmB,SAAQ,SAAS;gBACnC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/errors/types.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAE/B,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;AAEpE,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,UAAU,oBAAqB,SAAQ,gBAAgB;IACrD,aAAa,EAAE,WAAW,CAAC;CAC5B;AAED,8BAAsB,SAAU,SAAQ,KAAK;IAC3C,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAElC,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB;CAKrE;AAED;;;GAGG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,OAAO,GAAG,KAAK,CAE3C;AAID;;GAEG;AACH,qBAAa,cAAe,SAAQ,SAAS;gBAC/B,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAMzD;AAED;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,SAAS;gBACxC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAG1D;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,SAAS;gBAClC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,SAAS;gBACtC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,SAAS;gBACtC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,SAAS;gBACrC,MAAM,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGzD;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,SAAS;gBACtC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,SAAS;gBACjC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,SAAS;gBAChC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED;;;;;;;GAOG;AACH,qBAAa,sBAAuB,SAAQ,SAAS;gBACvC,YAAY,EAAE,MAAM,EAAE,EAAE,gBAAgB,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAWrG;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,SAAS;IAChD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;gBAClB,YAAY,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAIvF;AAED;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,SAAS;gBACxC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,SAAS;gBAC/B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,cAAc;gBACvC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGhF;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,cAAc;gBAC5C,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAG7E;AAED;;GAEG;AACH,qBAAa,uBAAwB,SAAQ,cAAc;gBAC7C,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGzD;AAED;;GAEG;AACH,qBAAa,wBAAyB,SAAQ,cAAc;gBAC9C,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGzD;AAID;;GAEG;AACH,uBAAe,WAAY,SAAQ,SAAS;IAC1C,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGlE;AAED;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,WAAW;aAEhC,QAAQ,EAAE,MAAM;aAChB,QAAQ,EAAE,MAAM;gBADhB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM;CAInC;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,WAAW;aAE5B,QAAQ,EAAE,MAAM;aACP,KAAK,EAAE,OAAO;gBADvB,QAAQ,EAAE,MAAM,EACP,KAAK,EAAE,OAAO;CAK1C;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,WAAW;aAE7B,QAAQ,EAAE,MAAM;aACP,KAAK,EAAE,OAAO;gBADvB,QAAQ,EAAE,MAAM,EACP,KAAK,EAAE,OAAO;CAK1C;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,WAAW;aAElC,QAAQ,EAAE,MAAM;aAChB,QAAQ,EAAE,MAAM;aAChB,QAAQ,EAAE,QAAQ;gBAFlB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,QAAQ;CAIrC;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,WAAW;aAE7B,QAAQ,EAAE,MAAM;aACP,KAAK,EAAE,OAAO;gBADvB,QAAQ,EAAE,MAAM,EACP,KAAK,EAAE,OAAO;CAK1C;AAED;;GAEG;AACH,qBAAa,YAAa,SAAQ,SAAS;gBAC7B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAID;;GAEG;AACH,qBAAa,aAAc,SAAQ,SAAS;gBAC9B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED;;GAEG;AACH,qBAAa,YAAa,SAAQ,SAAS;gBAC7B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,SAAS;aAEzB,UAAU,EAAE,MAAM;gBAAlB,UAAU,EAAE,MAAM,EAClC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,gBAAgB;CAI7B;AAED;;GAEG;AACH,qBAAa,wBAAyB,SAAQ,SAAS;gBACzC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED;;GAEG;AACH,qBAAa,YAAa,SAAQ,SAAS;gBAC7B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,SAAS;gBAChC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,SAAS;gBAClC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,SAAS;gBACjC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAG1D;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,SAAS;gBACnC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAG5D;AAED;;;;;GAKG;AACH,qBAAa,cAAe,SAAQ,SAAS;gBAC/B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD;AAED,qBAAa,gBAAiB,SAAQ,SAAS;gBACjC,OAAO,CAAC,EAAE,gBAAgB;CAMvC;AAED;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,SAAS;gBACtC,OAAO,CAAC,EAAE,gBAAgB;CAGvC;AAED,qBAAa,kBAAmB,SAAQ,SAAS;gBACnC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB;CAGxD"}

package/dist/lib/errors/types.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ExportHarnessError = exports.UserCancellationError = exports.ShellKickedError = exports.IngestionError = exports.PollExhaustedError = exports.PollTimeoutError = exports.ServiceQuotaError = exports.ThrottlingError = exports.ServiceError = exports.DevServerConnectionError = exports.DevServerError = exports.TimeoutError = exports.ConflictError = exports.GitInitError = exports.ConfigParseError = exports.ConfigValidationError = exports.ConfigWriteError = exports.ConfigReadError = exports.ConfigNotFoundError = exports.UnsupportedLanguageError = exports.MissingProjectFileError = exports.MissingDependencyError = exports.ArtifactSizeError = exports.PackagingError = exports.MissingCredentialsError = exports.AwsCredentialsError = exports.ValidationError = exports.JobNotFoundError = exports.ResourceNotFoundError = exports.DependencyCheckError = exports.AccessDeniedError = exports.AgentAlreadyExistsError = exports.NoProjectError = exports.BaseError = void 0;
+exports.ExportHarnessError = exports.UserCancellationError = exports.ShellKickedError = exports.IngestionError = exports.PollExhaustedError = exports.PollTimeoutError = exports.ServiceQuotaError = exports.ThrottlingError = exports.ServiceError = exports.DevServerConnectionError = exports.DevServerError = exports.TimeoutError = exports.ConflictError = exports.GitInitError = exports.ConfigParseError = exports.ConfigValidationError = exports.ConfigWriteError = exports.ConfigReadError = exports.ConfigNotFoundError = exports.UnsupportedLanguageError = exports.MissingProjectFileError = exports.MissingDependencyError = exports.ArtifactSizeError = exports.PackagingError = exports.MissingCredentialsError = exports.AwsCredentialsError = exports.StaleCdkConstructError = exports.ValidationError = exports.JobNotFoundError = exports.ResourceNotFoundError = exports.DependencyCheckError = exports.SecretDecryptionError = exports.SecretEncryptionError = exports.AccessDeniedError = exports.AgentAlreadyExistsError = exports.NoProjectError = exports.BaseError = void 0;
 exports.toError = toError;
 const zod_js_1 = require("./zod.js");
 class BaseError extends Error {
@@ -50,6 +50,26 @@ class AccessDeniedError extends BaseError {
     }
 }
 exports.AccessDeniedError = AccessDeniedError;
+/**
+ * Error thrown when a secret value cannot be encrypted before writing to disk
+ * (e.g. the machine encryption key could not be created/read).
+ */
+class SecretEncryptionError extends BaseError {
+    constructor(message, options) {
+        super(message, { defaultSource: 'client', ...options });
+    }
+}
+exports.SecretEncryptionError = SecretEncryptionError;
+/**
+ * Error thrown when a stored secret value cannot be decrypted (missing/changed
+ * machine key, or corrupted ciphertext).
+ */
+class SecretDecryptionError extends BaseError {
+    constructor(message, options) {
+        super(message, { defaultSource: 'user', ...options });
+    }
+}
+exports.SecretDecryptionError = SecretDecryptionError;
 /**
  * Error indicating missing system dependencies required for an operation.
  */
@@ -86,6 +106,25 @@ class ValidationError extends BaseError {
     }
 }
 exports.ValidationError = ValidationError;
+/**
+ * Error thrown when CDK synth fails because the project's installed `@aws/agentcore-cdk`
+ * construct is older than the running CLI and rejects a config key the CLI legitimately writes.
+ *
+ * The CLI strict-validates agentcore.json against its own schema during preflight, *before*
+ * synth. So an "unknown keys (remove)" failure reaching synth proves the key is valid to the
+ * CLI but unknown to the older bundled construct — i.e. version skew, not a bad config.
+ */
+class StaleCdkConstructError extends BaseError {
+    constructor(rejectedKeys, installedVersion, options) {
+        const keyList = rejectedKeys.map(k => `"${k}"`).join(', ');
+        const versionPart = installedVersion ? ` (currently ${installedVersion})` : '';
+        super(`CDK synth rejected ${keyList}, which this CLI writes but the project's installed ` +
+            `@aws/agentcore-cdk${versionPart} does not recognize. If you did not hand-edit ` +
+            `agentcore.json, the bundled CDK constructs are likely behind the CLI. Run ` +
+            `\`npm update @aws/agentcore-cdk\` in agentcore/cdk/, then re-run \`agentcore deploy\`.`, { defaultSource: 'user', ...options });
+    }
+}
+exports.StaleCdkConstructError = StaleCdkConstructError;
 /**
  * Error thrown when AWS credentials are not configured or invalid.
  * Supports both a short message (for interactive mode) and detailed message (for CLI mode).

package/dist/lib/errors/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/lib/errors/types.ts"],"names":[],"mappings":";;;AA2BA,0BAEC;AA7BD,qCAA2C;AAa3C,MAAsB,SAAU,SAAQ,KAAK;IAClC,WAAW,CAAc;IAElC,YAAsB,OAAe,EAAE,OAA6B;QAClE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;QAClC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC;IAClE,CAAC;CACF;AARD,8BAQC;AAED;;;GAGG;AACH,SAAgB,OAAO,CAAC,GAAY;IAClC,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,sBAAsB;AAEtB;;GAEG;AACH,MAAa,cAAe,SAAQ,SAAS;IAC3C,YAAY,OAAgB,EAAE,OAA0B;QACtD,KAAK,CAAC,OAAO,IAAI,2DAA2D,EAAE;YAC5E,aAAa,EAAE,MAAM;YACrB,GAAG,OAAO;SACX,CAAC,CAAC;IACL,CAAC;CACF;AAPD,wCAOC;AAED;;GAEG;AACH,MAAa,uBAAwB,SAAQ,SAAS;IACpD,YAAY,SAAiB,EAAE,OAA0B;QACvD,KAAK,CAAC,mBAAmB,SAAS,iCAAiC,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC9G,CAAC;CACF;AAJD,0DAIC;AAED;;GAEG;AACH,MAAa,iBAAkB,SAAQ,SAAS;IAC9C,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;CACF;AAJD,8CAIC;AAED;;GAEG;AACH,MAAa,oBAAqB,SAAQ,SAAS;IACjD,YAAY,MAAgB,EAAE,OAA0B;QACtD,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;CACF;AAJD,oDAIC;AAED;;GAEG;AACH,MAAa,qBAAsB,SAAQ,SAAS;IAClD,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;CACF;AAJD,sDAIC;AAED;;GAEG;AACH,MAAa,gBAAiB,SAAQ,SAAS;IAC7C,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;CACF;AAJD,4CAIC;AAED;;GAEG;AACH,MAAa,eAAgB,SAAQ,SAAS;IAC5C,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;CACF;AAJD,0CAIC;AAED;;;GAGG;AACH,MAAa,mBAAoB,SAAQ,SAAS;IACvC,YAAY,CAAS;IAC9B,YAAY,YAAoB,EAAE,eAAwB,EAAE,OAA0B;QACpF,KAAK,CAAC,eAAe,IAAI,YAAY,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;CACF;AAND,kDAMC;AAED;;GAEG;AACH,MAAa,uBAAwB,SAAQ,SAAS;IACpD,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;CACF;AAJD,0DAIC;AAED;;GAEG;AACH,MAAa,cAAe,SAAQ,SAAS;IAC3C,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;CACF;AAJD,wCAIC;AAED;;GAEG;AACH,MAAa,iBAAkB,SAAQ,cAAc;IACnD,YAAY,UAAkB,EAAE,WAAmB,EAAE,OAA0B;QAC7E,KAAK,CAAC,6BAA6B,UAAU,mBAAmB,WAAW,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5F,CAAC;CACF;AAJD,8CAIC;AAED;;GAEG;AACH,MAAa,sBAAuB,SAAQ,cAAc;IACxD,YAAY,MAAc,EAAE,WAAoB,EAAE,OAA0B;QAC1E,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,MAAM,iBAAiB,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,eAAe,EAAE,OAAO,CAAC,CAAC;IACnG,CAAC;CACF;AAJD,wDAIC;AAED;;GAEG;AACH,MAAa,uBAAwB,SAAQ,cAAc;IACzD,YAAY,QAAgB,EAAE,OAA0B;QACtD,KAAK,CAAC,oCAAoC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;CACF;AAJD,0DAIC;AAED;;GAEG;AACH,MAAa,wBAAyB,SAAQ,cAAc;IAC1D,YAAY,QAAgB,EAAE,OAA0B;QACtD,KAAK,CAAC,GAAG,QAAQ,kCAAkC,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;CACF;AAJD,4DAIC;AAED,+BAA+B;AAE/B;;GAEG;AACH,MAAe,WAAY,SAAQ,SAAS;IAC1C,YAAsB,OAAe,EAAE,OAA0B;QAC/D,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;CACF;AAED;;GAEG;AACH,MAAa,mBAAoB,SAAQ,WAAW;IAEhC;IACA;IAFlB,YACkB,QAAgB,EAChB,QAAgB;QAEhC,KAAK,CAAC,GAAG,QAAQ,8BAA8B,QAAQ,EAAE,CAAC,CAAC;QAH3C,aAAQ,GAAR,QAAQ,CAAQ;QAChB,aAAQ,GAAR,QAAQ,CAAQ;IAGlC,CAAC;CACF;AAPD,kDAOC;AAED;;GAEG;AACH,MAAa,eAAgB,SAAQ,WAAW;IAE5B;IACS;IAF3B,YACkB,QAAgB,EACP,KAAc;QAEvC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,KAAK,CAAC,iCAAiC,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC;QAJ/C,aAAQ,GAAR,QAAQ,CAAQ;QACP,UAAK,GAAL,KAAK,CAAS;IAIzC,CAAC;CACF;AARD,0CAQC;AAED;;GAEG;AACH,MAAa,gBAAiB,SAAQ,WAAW;IAE7B;IACS;IAF3B,YACkB,QAAgB,EACP,KAAc;QAEvC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,KAAK,CAAC,kCAAkC,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC;QAJhD,aAAQ,GAAR,QAAQ,CAAQ;QACP,UAAK,GAAL,KAAK,CAAS;IAIzC,CAAC;CACF;AARD,4CAQC;AAED;;GAEG;AACH,MAAa,qBAAsB,SAAQ,WAAW;IAElC;IACA;IACA;IAHlB,YACkB,QAAgB,EAChB,QAAgB,EAChB,QAAkB;QAElC,KAAK,CAAC,GAAG,QAAQ,MAAM,IAAA,wBAAe,EAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAJ3C,aAAQ,GAAR,QAAQ,CAAQ;QAChB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,aAAQ,GAAR,QAAQ,CAAU;IAGpC,CAAC;CACF;AARD,sDAQC;AAED;;GAEG;AACH,MAAa,gBAAiB,SAAQ,WAAW;IAE7B;IACS;IAF3B,YACkB,QAAgB,EACP,KAAc;QAEvC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,KAAK,CAAC,0CAA0C,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC;QAJxD,aAAQ,GAAR,QAAQ,CAAQ;QACP,UAAK,GAAL,KAAK,CAAS;IAIzC,CAAC;CACF;AARD,4CAQC;AAED;;GAEG;AACH,MAAa,YAAa,SAAQ,SAAS;IACzC,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC1D,CAAC;CACF;AAJD,oCAIC;AAED,yBAAyB;AAEzB;;GAEG;AACH,MAAa,aAAc,SAAQ,SAAS;IAC1C,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;CACF;AAJD,sCAIC;AAED;;GAEG;AACH,MAAa,YAAa,SAAQ,SAAS;IACzC,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;CACF;AAJD,oCAIC;AAED;;GAEG;AACH,MAAa,cAAe,SAAQ,SAAS;IAEzB;IADlB,YACkB,UAAkB,EAClC,IAAY,EACZ,OAA0B;QAE1B,KAAK,CAAC,IAAI,IAAI,mBAAmB,UAAU,EAAE,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QAJxE,eAAU,GAAV,UAAU,CAAQ;IAKpC,CAAC;CACF;AARD,wCAQC;AAED;;GAEG;AACH,MAAa,wBAAyB,SAAQ,SAAS;IACrD,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC1D,CAAC;CACF;AAJD,4DAIC;AAED;;GAEG;AACH,MAAa,YAAa,SAAQ,SAAS;IACzC,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;CACF;AAJD,oCAIC;AAED;;GAEG;AACH,MAAa,eAAgB,SAAQ,SAAS;IAC5C,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;CACF;AAJD,0CAIC;AAED;;GAEG;AACH,MAAa,iBAAkB,SAAQ,SAAS;IAC9C,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;CACF;AAJD,8CAIC;AAED;;GAEG;AACH,MAAa,gBAAiB,SAAQ,SAAS;IAC7C,YAAY,SAAiB,EAAE,OAA0B;QACvD,KAAK,CAAC,2BAA2B,SAAS,IAAI,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC5F,CAAC;CACF;AAJD,4CAIC;AAED;;GAEG;AACH,MAAa,kBAAmB,SAAQ,SAAS;IAC/C,YAAY,WAAmB,EAAE,OAA0B;QACzD,KAAK,CAAC,2BAA2B,WAAW,WAAW,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACrG,CAAC;CACF;AAJD,gDAIC;AAED;;;;;GAKG;AACH,MAAa,cAAe,SAAQ,SAAS;IAC3C,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;CACF;AAJD,wCAIC;AAED,MAAa,gBAAiB,SAAQ,SAAS;IAC7C,YAAY,OAA0B;QACpC,KAAK,CAAC,kEAAkE,EAAE;YACxE,aAAa,EAAE,SAAS;YACxB,GAAG,OAAO;SACX,CAAC,CAAC;IACL,CAAC;CACF;AAPD,4CAOC;AAED;;GAEG;AACH,MAAa,qBAAsB,SAAQ,SAAS;IAClD,YAAY,OAA0B;QACpC,KAAK,CAAC,gBAAgB,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;CACF;AAJD,sDAIC;AAED,MAAa,kBAAmB,SAAQ,SAAS;IAC/C,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC1D,CAAC;CACF;AAJD,gDAIC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/lib/errors/types.ts"],"names":[],"mappings":";;;AA2BA,0BAEC;AA7BD,qCAA2C;AAa3C,MAAsB,SAAU,SAAQ,KAAK;IAClC,WAAW,CAAc;IAElC,YAAsB,OAAe,EAAE,OAA6B;QAClE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;QAClC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC;IAClE,CAAC;CACF;AARD,8BAQC;AAED;;;GAGG;AACH,SAAgB,OAAO,CAAC,GAAY;IAClC,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,sBAAsB;AAEtB;;GAEG;AACH,MAAa,cAAe,SAAQ,SAAS;IAC3C,YAAY,OAAgB,EAAE,OAA0B;QACtD,KAAK,CAAC,OAAO,IAAI,2DAA2D,EAAE;YAC5E,aAAa,EAAE,MAAM;YACrB,GAAG,OAAO;SACX,CAAC,CAAC;IACL,CAAC;CACF;AAPD,wCAOC;AAED;;GAEG;AACH,MAAa,uBAAwB,SAAQ,SAAS;IACpD,YAAY,SAAiB,EAAE,OAA0B;QACvD,KAAK,CAAC,mBAAmB,SAAS,iCAAiC,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC9G,CAAC;CACF;AAJD,0DAIC;AAED;;GAEG;AACH,MAAa,iBAAkB,SAAQ,SAAS;IAC9C,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;CACF;AAJD,8CAIC;AAED;;;GAGG;AACH,MAAa,qBAAsB,SAAQ,SAAS;IAClD,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC1D,CAAC;CACF;AAJD,sDAIC;AAED;;;GAGG;AACH,MAAa,qBAAsB,SAAQ,SAAS;IAClD,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;CACF;AAJD,sDAIC;AAED;;GAEG;AACH,MAAa,oBAAqB,SAAQ,SAAS;IACjD,YAAY,MAAgB,EAAE,OAA0B;QACtD,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;CACF;AAJD,oDAIC;AAED;;GAEG;AACH,MAAa,qBAAsB,SAAQ,SAAS;IAClD,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;CACF;AAJD,sDAIC;AAED;;GAEG;AACH,MAAa,gBAAiB,SAAQ,SAAS;IAC7C,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;CACF;AAJD,4CAIC;AAED;;GAEG;AACH,MAAa,eAAgB,SAAQ,SAAS;IAC5C,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;CACF;AAJD,0CAIC;AAED;;;;;;;GAOG;AACH,MAAa,sBAAuB,SAAQ,SAAS;IACnD,YAAY,YAAsB,EAAE,gBAAoC,EAAE,OAA0B;QAClG,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,WAAW,GAAG,gBAAgB,CAAC,CAAC,CAAC,eAAe,gBAAgB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,KAAK,CACH,sBAAsB,OAAO,sDAAsD;YACjF,qBAAqB,WAAW,gDAAgD;YAChF,4EAA4E;YAC5E,wFAAwF,EAC1F,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CACtC,CAAC;IACJ,CAAC;CACF;AAZD,wDAYC;AAED;;;GAGG;AACH,MAAa,mBAAoB,SAAQ,SAAS;IACvC,YAAY,CAAS;IAC9B,YAAY,YAAoB,EAAE,eAAwB,EAAE,OAA0B;QACpF,KAAK,CAAC,eAAe,IAAI,YAAY,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;CACF;AAND,kDAMC;AAED;;GAEG;AACH,MAAa,uBAAwB,SAAQ,SAAS;IACpD,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;CACF;AAJD,0DAIC;AAED;;GAEG;AACH,MAAa,cAAe,SAAQ,SAAS;IAC3C,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;CACF;AAJD,wCAIC;AAED;;GAEG;AACH,MAAa,iBAAkB,SAAQ,cAAc;IACnD,YAAY,UAAkB,EAAE,WAAmB,EAAE,OAA0B;QAC7E,KAAK,CAAC,6BAA6B,UAAU,mBAAmB,WAAW,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5F,CAAC;CACF;AAJD,8CAIC;AAED;;GAEG;AACH,MAAa,sBAAuB,SAAQ,cAAc;IACxD,YAAY,MAAc,EAAE,WAAoB,EAAE,OAA0B;QAC1E,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,MAAM,iBAAiB,WAAW,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,eAAe,EAAE,OAAO,CAAC,CAAC;IACnG,CAAC;CACF;AAJD,wDAIC;AAED;;GAEG;AACH,MAAa,uBAAwB,SAAQ,cAAc;IACzD,YAAY,QAAgB,EAAE,OAA0B;QACtD,KAAK,CAAC,oCAAoC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;CACF;AAJD,0DAIC;AAED;;GAEG;AACH,MAAa,wBAAyB,SAAQ,cAAc;IAC1D,YAAY,QAAgB,EAAE,OAA0B;QACtD,KAAK,CAAC,GAAG,QAAQ,kCAAkC,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;CACF;AAJD,4DAIC;AAED,+BAA+B;AAE/B;;GAEG;AACH,MAAe,WAAY,SAAQ,SAAS;IAC1C,YAAsB,OAAe,EAAE,OAA0B;QAC/D,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;CACF;AAED;;GAEG;AACH,MAAa,mBAAoB,SAAQ,WAAW;IAEhC;IACA;IAFlB,YACkB,QAAgB,EAChB,QAAgB;QAEhC,KAAK,CAAC,GAAG,QAAQ,8BAA8B,QAAQ,EAAE,CAAC,CAAC;QAH3C,aAAQ,GAAR,QAAQ,CAAQ;QAChB,aAAQ,GAAR,QAAQ,CAAQ;IAGlC,CAAC;CACF;AAPD,kDAOC;AAED;;GAEG;AACH,MAAa,eAAgB,SAAQ,WAAW;IAE5B;IACS;IAF3B,YACkB,QAAgB,EACP,KAAc;QAEvC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,KAAK,CAAC,iCAAiC,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC;QAJ/C,aAAQ,GAAR,QAAQ,CAAQ;QACP,UAAK,GAAL,KAAK,CAAS;IAIzC,CAAC;CACF;AARD,0CAQC;AAED;;GAEG;AACH,MAAa,gBAAiB,SAAQ,WAAW;IAE7B;IACS;IAF3B,YACkB,QAAgB,EACP,KAAc;QAEvC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,KAAK,CAAC,kCAAkC,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC;QAJhD,aAAQ,GAAR,QAAQ,CAAQ;QACP,UAAK,GAAL,KAAK,CAAS;IAIzC,CAAC;CACF;AARD,4CAQC;AAED;;GAEG;AACH,MAAa,qBAAsB,SAAQ,WAAW;IAElC;IACA;IACA;IAHlB,YACkB,QAAgB,EAChB,QAAgB,EAChB,QAAkB;QAElC,KAAK,CAAC,GAAG,QAAQ,MAAM,IAAA,wBAAe,EAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAJ3C,aAAQ,GAAR,QAAQ,CAAQ;QAChB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,aAAQ,GAAR,QAAQ,CAAU;IAGpC,CAAC;CACF;AARD,sDAQC;AAED;;GAEG;AACH,MAAa,gBAAiB,SAAQ,WAAW;IAE7B;IACS;IAF3B,YACkB,QAAgB,EACP,KAAc;QAEvC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,KAAK,CAAC,0CAA0C,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC;QAJxD,aAAQ,GAAR,QAAQ,CAAQ;QACP,UAAK,GAAL,KAAK,CAAS;IAIzC,CAAC;CACF;AARD,4CAQC;AAED;;GAEG;AACH,MAAa,YAAa,SAAQ,SAAS;IACzC,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC1D,CAAC;CACF;AAJD,oCAIC;AAED,yBAAyB;AAEzB;;GAEG;AACH,MAAa,aAAc,SAAQ,SAAS;IAC1C,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;CACF;AAJD,sCAIC;AAED;;GAEG;AACH,MAAa,YAAa,SAAQ,SAAS;IACzC,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;CACF;AAJD,oCAIC;AAED;;GAEG;AACH,MAAa,cAAe,SAAQ,SAAS;IAEzB;IADlB,YACkB,UAAkB,EAClC,IAAY,EACZ,OAA0B;QAE1B,KAAK,CAAC,IAAI,IAAI,mBAAmB,UAAU,EAAE,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QAJxE,eAAU,GAAV,UAAU,CAAQ;IAKpC,CAAC;CACF;AARD,wCAQC;AAED;;GAEG;AACH,MAAa,wBAAyB,SAAQ,SAAS;IACrD,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC1D,CAAC;CACF;AAJD,4DAIC;AAED;;GAEG;AACH,MAAa,YAAa,SAAQ,SAAS;IACzC,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;CACF;AAJD,oCAIC;AAED;;GAEG;AACH,MAAa,eAAgB,SAAQ,SAAS;IAC5C,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;CACF;AAJD,0CAIC;AAED;;GAEG;AACH,MAAa,iBAAkB,SAAQ,SAAS;IAC9C,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;CACF;AAJD,8CAIC;AAED;;GAEG;AACH,MAAa,gBAAiB,SAAQ,SAAS;IAC7C,YAAY,SAAiB,EAAE,OAA0B;QACvD,KAAK,CAAC,2BAA2B,SAAS,IAAI,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC5F,CAAC;CACF;AAJD,4CAIC;AAED;;GAEG;AACH,MAAa,kBAAmB,SAAQ,SAAS;IAC/C,YAAY,WAAmB,EAAE,OAA0B;QACzD,KAAK,CAAC,2BAA2B,WAAW,WAAW,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACrG,CAAC;CACF;AAJD,gDAIC;AAED;;;;;GAKG;AACH,MAAa,cAAe,SAAQ,SAAS;IAC3C,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;CACF;AAJD,wCAIC;AAED,MAAa,gBAAiB,SAAQ,SAAS;IAC7C,YAAY,OAA0B;QACpC,KAAK,CAAC,kEAAkE,EAAE;YACxE,aAAa,EAAE,SAAS;YACxB,GAAG,OAAO;SACX,CAAC,CAAC;IACL,CAAC;CACF;AAPD,4CAOC;AAED;;GAEG;AACH,MAAa,qBAAsB,SAAQ,SAAS;IAClD,YAAY,OAA0B;QACpC,KAAK,CAAC,gBAAgB,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;CACF;AAJD,sDAIC;AAED,MAAa,kBAAmB,SAAQ,SAAS;IAC/C,YAAY,OAAe,EAAE,OAA0B;QACrD,KAAK,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC1D,CAAC;CACF;AAJD,gDAIC"}

package/dist/lib/secrets/cipher.d.ts

@@ -0,0 +1,12 @@
+export declare const ENC_PREFIX = "enc:v1:";
+/** Encrypt a plaintext secret to an `enc:v1:` envelope: base64(IV || tag || ciphertext). */
+export declare function encryptSecret(plaintext: string, key: Buffer): string;
+/**
+ * Decrypt an `enc:v1:` envelope, trying each candidate key in turn. A value may
+ * have been sealed by the OS keychain or the keyfile; trying all available keys
+ * means a value still decrypts even if the active key source differs from the
+ * one that wrote it (e.g. AGENTCORE_DISABLE_KEYCHAIN toggled between add and a
+ * later read). Throws SecretDecryptionError only if no key works.
+ */
+export declare function decryptSecret(token: string, keys: Buffer | Buffer[]): string;
+//# sourceMappingURL=cipher.d.ts.map

package/dist/lib/secrets/cipher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cipher.d.ts","sourceRoot":"","sources":["../../../src/lib/secrets/cipher.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,UAAU,YAAY,CAAC;AAMpC,4FAA4F;AAC5F,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAMpE;AAiBD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,MAAM,CAY5E"}

package/dist/lib/secrets/cipher.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ENC_PREFIX = void 0;
+exports.encryptSecret = encryptSecret;
+exports.decryptSecret = decryptSecret;
+const types_1 = require("../errors/types");
+const node_crypto_1 = require("node:crypto");
+exports.ENC_PREFIX = 'enc:v1:';
+const ALGORITHM = 'aes-256-gcm';
+const IV_BYTES = 12;
+const TAG_BYTES = 16;
+/** Encrypt a plaintext secret to an `enc:v1:` envelope: base64(IV || tag || ciphertext). */
+function encryptSecret(plaintext, key) {
+    const iv = (0, node_crypto_1.randomBytes)(IV_BYTES);
+    const cipher = (0, node_crypto_1.createCipheriv)(ALGORITHM, key, iv);
+    const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf-8'), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return exports.ENC_PREFIX + Buffer.concat([iv, tag, ciphertext]).toString('base64');
+}
+/** Attempt to decrypt with a single key. Returns the plaintext or null on any failure (does NOT throw). */
+function tryDecrypt(token, key) {
+    try {
+        const raw = Buffer.from(token.slice(exports.ENC_PREFIX.length), 'base64');
+        const iv = raw.subarray(0, IV_BYTES);
+        const tag = raw.subarray(IV_BYTES, IV_BYTES + TAG_BYTES);
+        const ciphertext = raw.subarray(IV_BYTES + TAG_BYTES);
+        const decipher = (0, node_crypto_1.createDecipheriv)(ALGORITHM, key, iv);
+        decipher.setAuthTag(tag);
+        return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf-8');
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Decrypt an `enc:v1:` envelope, trying each candidate key in turn. A value may
+ * have been sealed by the OS keychain or the keyfile; trying all available keys
+ * means a value still decrypts even if the active key source differs from the
+ * one that wrote it (e.g. AGENTCORE_DISABLE_KEYCHAIN toggled between add and a
+ * later read). Throws SecretDecryptionError only if no key works.
+ */
+function decryptSecret(token, keys) {
+    if (!token.startsWith(exports.ENC_PREFIX)) {
+        throw new types_1.SecretDecryptionError('Value is not an encrypted secret envelope.');
+    }
+    const candidates = Array.isArray(keys) ? keys : [keys];
+    for (const key of candidates) {
+        const plaintext = tryDecrypt(token, key);
+        if (plaintext !== null)
+            return plaintext;
+    }
+    throw new types_1.SecretDecryptionError('Could not decrypt a stored secret in agentcore/.env.local — the encryption key may be missing or changed. Re-add the credential');
+}
+//# sourceMappingURL=cipher.js.map

package/dist/lib/secrets/cipher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cipher.js","sourceRoot":"","sources":["../../../src/lib/secrets/cipher.ts"],"names":[],"mappings":";;;AAUA,sCAMC;AAwBD,sCAYC;AApDD,2CAAwD;AACxD,6CAA4E;AAE/D,QAAA,UAAU,GAAG,SAAS,CAAC;AAEpC,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,4FAA4F;AAC5F,SAAgB,aAAa,CAAC,SAAiB,EAAE,GAAW;IAC1D,MAAM,EAAE,GAAG,IAAA,yBAAW,EAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACtF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,kBAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC9E,CAAC;AAED,2GAA2G;AAC3G,SAAS,UAAU,CAAC,KAAa,EAAE,GAAW;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAU,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;QAClE,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,SAAS,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,IAAA,8BAAgB,EAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACtD,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,KAAa,EAAE,IAAuB;IAClE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,kBAAU,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,6BAAqB,CAAC,4CAA4C,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACvD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;IAC3C,CAAC;IACD,MAAM,IAAI,6BAAqB,CAC7B,iIAAiI,CAClI,CAAC;AACJ,CAAC"}

package/dist/lib/secrets/index.d.ts

@@ -0,0 +1,4 @@
+export { isSensitiveKey, SENSITIVE_KEY_PATTERNS, validateCredentialNameEncryptable } from './sensitive-keys';
+export { ENC_PREFIX, encryptSecret, decryptSecret } from './cipher';
+export { resolveEncryptionKey, resolveCandidateKeys } from './key-provider';
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/secrets/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/secrets/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,iCAAiC,EAAE,MAAM,kBAAkB,CAAC;AAC7G,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/lib/secrets/index.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveCandidateKeys = exports.resolveEncryptionKey = exports.decryptSecret = exports.encryptSecret = exports.ENC_PREFIX = exports.validateCredentialNameEncryptable = exports.SENSITIVE_KEY_PATTERNS = exports.isSensitiveKey = void 0;
+var sensitive_keys_1 = require("./sensitive-keys");
+Object.defineProperty(exports, "isSensitiveKey", { enumerable: true, get: function () { return sensitive_keys_1.isSensitiveKey; } });
+Object.defineProperty(exports, "SENSITIVE_KEY_PATTERNS", { enumerable: true, get: function () { return sensitive_keys_1.SENSITIVE_KEY_PATTERNS; } });
+Object.defineProperty(exports, "validateCredentialNameEncryptable", { enumerable: true, get: function () { return sensitive_keys_1.validateCredentialNameEncryptable; } });
+var cipher_1 = require("./cipher");
+Object.defineProperty(exports, "ENC_PREFIX", { enumerable: true, get: function () { return cipher_1.ENC_PREFIX; } });
+Object.defineProperty(exports, "encryptSecret", { enumerable: true, get: function () { return cipher_1.encryptSecret; } });
+Object.defineProperty(exports, "decryptSecret", { enumerable: true, get: function () { return cipher_1.decryptSecret; } });
+var key_provider_1 = require("./key-provider");
+Object.defineProperty(exports, "resolveEncryptionKey", { enumerable: true, get: function () { return key_provider_1.resolveEncryptionKey; } });
+Object.defineProperty(exports, "resolveCandidateKeys", { enumerable: true, get: function () { return key_provider_1.resolveCandidateKeys; } });
+//# sourceMappingURL=index.js.map

package/dist/lib/secrets/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/secrets/index.ts"],"names":[],"mappings":";;;AAAA,mDAA6G;AAApG,gHAAA,cAAc,OAAA;AAAE,wHAAA,sBAAsB,OAAA;AAAE,mIAAA,iCAAiC,OAAA;AAClF,mCAAoE;AAA3D,oGAAA,UAAU,OAAA;AAAE,uGAAA,aAAa,OAAA;AAAE,uGAAA,aAAa,OAAA;AACjD,+CAA4E;AAAnE,oHAAA,oBAAoB,OAAA;AAAE,oHAAA,oBAAoB,OAAA"}

package/dist/lib/secrets/key-provider.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Resolve the single key used to ENCRYPT new values: keychain first, keyfile
+ * fallback. Creates a key if none exists yet.
+ */
+export declare function resolveEncryptionKey(): Promise<Buffer>;
+/**
+ * Resolve ALL candidate keys for DECRYPTION, newest-intent first. A stored
+ * value may have been sealed by the keychain on one run and the keyfile on
+ * another (e.g. AGENTCORE_DISABLE_KEYCHAIN toggled); trying every available key
+ * lets a value decrypt regardless of which source is currently active. Read-only
+ * — never creates a key. May be empty if no key material exists at all.
+ */
+export declare function resolveCandidateKeys(): Promise<Buffer[]>;
+/** Reset the per-process key cache. Only for use in tests. */
+export declare function __resetKeyCacheForTests(): void;
+//# sourceMappingURL=key-provider.d.ts.map

package/dist/lib/secrets/key-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-provider.d.ts","sourceRoot":"","sources":["../../../src/lib/secrets/key-provider.ts"],"names":[],"mappings":"AA+HA;;;GAGG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,CAK5D;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAO9D;AAED,8DAA8D;AAC9D,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C"}

package/dist/lib/secrets/key-provider.js

@@ -0,0 +1,191 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveEncryptionKey = resolveEncryptionKey;
+exports.resolveCandidateKeys = resolveCandidateKeys;
+exports.__resetKeyCacheForTests = __resetKeyCacheForTests;
+const types_1 = require("../errors/types");
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const KEY_BYTES = 32;
+const KEYCHAIN_SERVICE = 'aws-agentcore';
+const KEYCHAIN_ACCOUNT = 'env-local-secret-key';
+let cachedKey = null;
+/** Keychain is opt-out (headless/CI) and best-effort; any failure falls through to the keyfile. */
+async function tryKeychainKey() {
+    if (process.env.AGENTCORE_DISABLE_KEYCHAIN === '1')
+        return null;
+    try {
+        // Optional native dependency — dynamic import so a missing/unbuildable
+        // module degrades to the keyfile instead of failing the CLI.
+        const { Entry } = (await Promise.resolve().then(() => __importStar(require('@napi-rs/keyring'))));
+        const entry = new Entry(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
+        try {
+            const existing = entry.getPassword();
+            if (existing)
+                return Buffer.from(existing, 'base64');
+        }
+        catch {
+            // no stored password yet
+        }
+        const key = (0, node_crypto_1.randomBytes)(KEY_BYTES);
+        entry.setPassword(key.toString('base64'));
+        // Re-read after writing: if a concurrent process stored a different key
+        // between our getPassword() and setPassword(), the keychain now holds
+        // theirs — trust the persisted value, not our local one, so both processes
+        // converge on the same key.
+        try {
+            const persisted = entry.getPassword();
+            if (persisted)
+                return Buffer.from(persisted, 'base64');
+        }
+        catch {
+            // fall through to the freshly-generated key
+        }
+        return key;
+    }
+    catch {
+        return null;
+    }
+}
+function resolveConfigDir() {
+    return process.env.AGENTCORE_CONFIG_DIR ?? (0, node_path_1.join)((0, node_os_1.homedir)(), '.agentcore');
+}
+function keyfilePath() {
+    return (0, node_path_1.join)(resolveConfigDir(), 'secrets.key');
+}
+/** A keyfile that exists but isn't KEY_BYTES long is corrupt — never overwrite it. */
+function assertKeyfileSize(key, path) {
+    if (key.length === KEY_BYTES)
+        return key;
+    throw new types_1.SecretEncryptionError(`Encryption key file at ${path} is corrupt (expected ${KEY_BYTES} bytes, found ${key.length}). ` +
+        `Move it aside and re-add your credentials, or restore the original key file`);
+}
+function keyfileKey() {
+    const path = keyfilePath();
+    try {
+        if ((0, node_fs_1.existsSync)(path)) {
+            // A wrong-sized existing file is corruption, NOT a cue to mint a new key:
+            // overwriting it would permanently orphan every secret sealed with the
+            // real key. Fail loud instead.
+            return assertKeyfileSize((0, node_fs_1.readFileSync)(path), path);
+        }
+        (0, node_fs_1.mkdirSync)(resolveConfigDir(), { recursive: true });
+        const key = (0, node_crypto_1.randomBytes)(KEY_BYTES);
+        try {
+            // `wx` fails if the file already exists, making first-time creation
+            // last-writer-safe: if a concurrent process created it between the
+            // existsSync check and here, re-read theirs instead of clobbering it.
+            (0, node_fs_1.writeFileSync)(path, key, { mode: 0o600, flag: 'wx' });
+            return key;
+        }
+        catch (writeErr) {
+            if (writeErr.code === 'EEXIST') {
+                return assertKeyfileSize((0, node_fs_1.readFileSync)(path), path);
+            }
+            throw writeErr;
+        }
+    }
+    catch (err) {
+        if (err instanceof types_1.SecretEncryptionError)
+            throw err;
+        throw new types_1.SecretEncryptionError(`Could not create or read the machine encryption key at ${path}.`, {
+            cause: err instanceof Error ? err : undefined,
+        });
+    }
+}
+/** Read the keyfile key WITHOUT creating one if absent (read-only; returns null when missing). */
+function readKeyfileKeyIfPresent() {
+    try {
+        const path = keyfilePath();
+        if ((0, node_fs_1.existsSync)(path)) {
+            const key = (0, node_fs_1.readFileSync)(path);
+            if (key.length === KEY_BYTES)
+                return key;
+        }
+    }
+    catch {
+        // unreadable keyfile — treat as absent
+    }
+    return null;
+}
+/** Read the keychain key WITHOUT creating one if absent (returns null when unavailable/missing). */
+async function readKeychainKeyIfPresent() {
+    if (process.env.AGENTCORE_DISABLE_KEYCHAIN === '1')
+        return null;
+    try {
+        const { Entry } = (await Promise.resolve().then(() => __importStar(require('@napi-rs/keyring'))));
+        const existing = new Entry(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT).getPassword();
+        return existing ? Buffer.from(existing, 'base64') : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve the single key used to ENCRYPT new values: keychain first, keyfile
+ * fallback. Creates a key if none exists yet.
+ */
+async function resolveEncryptionKey() {
+    if (cachedKey)
+        return cachedKey;
+    const fromKeychain = await tryKeychainKey();
+    cachedKey = fromKeychain ?? keyfileKey();
+    return cachedKey;
+}
+/**
+ * Resolve ALL candidate keys for DECRYPTION, newest-intent first. A stored
+ * value may have been sealed by the keychain on one run and the keyfile on
+ * another (e.g. AGENTCORE_DISABLE_KEYCHAIN toggled); trying every available key
+ * lets a value decrypt regardless of which source is currently active. Read-only
+ * — never creates a key. May be empty if no key material exists at all.
+ */
+async function resolveCandidateKeys() {
+    const keys = [];
+    const fromKeychain = await readKeychainKeyIfPresent();
+    if (fromKeychain)
+        keys.push(fromKeychain);
+    const fromKeyfile = readKeyfileKeyIfPresent();
+    if (fromKeyfile && !keys.some(k => k.equals(fromKeyfile)))
+        keys.push(fromKeyfile);
+    return keys;
+}
+/** Reset the per-process key cache. Only for use in tests. */
+function __resetKeyCacheForTests() {
+    cachedKey = null;
+}
+//# sourceMappingURL=key-provider.js.map

package/dist/lib/secrets/key-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-provider.js","sourceRoot":"","sources":["../../../src/lib/secrets/key-provider.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmIA,oDAKC;AASD,oDAOC;AAGD,0DAEC;AA7JD,2CAAwD;AACxD,6CAA0C;AAC1C,qCAA6E;AAC7E,qCAAkC;AAClC,yCAAiC;AAEjC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,gBAAgB,GAAG,eAAe,CAAC;AACzC,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAEhD,IAAI,SAAS,GAAkB,IAAI,CAAC;AAWpC,mGAAmG;AACnG,KAAK,UAAU,cAAc;IAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,0BAA0B,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAChE,IAAI,CAAC;QACH,uEAAuE;QACvE,6DAA6D;QAC7D,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,wDAAa,kBAAkB,GAAC,CAAkB,CAAC;QACtE,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;YACrC,IAAI,QAAQ;gBAAE,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;QACD,MAAM,GAAG,GAAG,IAAA,yBAAW,EAAC,SAAS,CAAC,CAAC;QACnC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1C,wEAAwE;QACxE,sEAAsE;QACtE,2EAA2E;QAC3E,4BAA4B;QAC5B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;YACtC,IAAI,SAAS;gBAAE,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;QAC9C,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,YAAY,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,IAAA,gBAAI,EAAC,gBAAgB,EAAE,EAAE,aAAa,CAAC,CAAC;AACjD,CAAC;AAED,sFAAsF;AACtF,SAAS,iBAAiB,CAAC,GAAW,EAAE,IAAY;IAClD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IACzC,MAAM,IAAI,6BAAqB,CAC7B,0BAA0B,IAAI,yBAAyB,SAAS,iBAAiB,GAAG,CAAC,MAAM,KAAK;QAC9F,6EAA6E,CAChF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,IAAI,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;YACrB,0EAA0E;YAC1E,uEAAuE;YACvE,+BAA+B;YAC/B,OAAO,iBAAiB,CAAC,IAAA,sBAAY,EAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QACrD,CAAC;QACD,IAAA,mBAAS,EAAC,gBAAgB,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,IAAA,yBAAW,EAAC,SAAS,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,oEAAoE;YACpE,mEAAmE;YACnE,sEAAsE;YACtE,IAAA,uBAAa,EAAC,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,QAAQ,EAAE,CAAC;YAClB,IAAK,QAAkC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1D,OAAO,iBAAiB,CAAC,IAAA,sBAAY,EAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;YACrD,CAAC;YACD,MAAM,QAAQ,CAAC;QACjB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,6BAAqB;YAAE,MAAM,GAAG,CAAC;QACpD,MAAM,IAAI,6BAAqB,CAAC,0DAA0D,IAAI,GAAG,EAAE;YACjG,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,kGAAkG;AAClG,SAAS,uBAAuB;IAC9B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;QAC3B,IAAI,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,IAAA,sBAAY,EAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,GAAG,CAAC;QAC3C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oGAAoG;AACpG,KAAK,UAAU,wBAAwB;IACrC,IAAI,OAAO,CAAC,GAAG,CAAC,0BAA0B,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,wDAAa,kBAAkB,GAAC,CAAkB,CAAC;QACtE,MAAM,QAAQ,GAAG,IAAI,KAAK,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7E,OAAO,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,oBAAoB;IACxC,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,YAAY,GAAG,MAAM,cAAc,EAAE,CAAC;IAC5C,SAAS,GAAG,YAAY,IAAI,UAAU,EAAE,CAAC;IACzC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,oBAAoB;IACxC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,YAAY,GAAG,MAAM,wBAAwB,EAAE,CAAC;IACtD,IAAI,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,uBAAuB,EAAE,CAAC;IAC9C,IAAI,WAAW,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAClF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8DAA8D;AAC9D,SAAgB,uBAAuB;IACrC,SAAS,GAAG,IAAI,CAAC;AACnB,CAAC"}

package/dist/lib/secrets/sensitive-keys.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Single source of truth for "is this env value a secret that must be encrypted
+ * at rest." Used by env.ts on write/read; extend with one entry when a new
+ * secret-bearing credential field is introduced anywhere in the CLI.
+ */
+export declare const SENSITIVE_KEY_PATTERNS: RegExp[];
+export declare function isSensitiveKey(key: string): boolean;
+/**
+ * Validate that an API-key credential NAME won't collide with a reserved
+ * reference suffix. A bare API-key credential is stored as
+ * `AGENTCORE_CREDENTIAL_<NAME>` carrying the secret value directly; if <NAME>
+ * normalizes to end in a reference suffix (e.g. `my-client-id` → `..._CLIENT_ID`)
+ * the value is indistinguishable from a non-secret reference and would be left
+ * UNENCRYPTED at rest. Reject such names at creation (fail closed).
+ *
+ * Returns `true` if the name is safe, or an error message string if not — the
+ * `(value) => true | string` contract used by both the CLI and the TUI's
+ * SecretInput/TextInput `customValidation`.
+ */
+export declare function validateCredentialNameEncryptable(name: string): true | string;
+//# sourceMappingURL=sensitive-keys.d.ts.map

package/dist/lib/secrets/sensitive-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive-keys.d.ts","sourceRoot":"","sources":["../../../src/lib/secrets/sensitive-keys.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAeH,eAAO,MAAM,sBAAsB,EAAE,MAAM,EAAkD,CAAC;AAY9F,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAInD;AAUD;;;;;;;;;;;GAWG;AACH,wBAAgB,iCAAiC,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAO7E"}

package/dist/lib/secrets/sensitive-keys.js

@@ -0,0 +1,67 @@
+"use strict";
+/**
+ * Single source of truth for "is this env value a secret that must be encrypted
+ * at rest." Used by env.ts on write/read; extend with one entry when a new
+ * secret-bearing credential field is introduced anywhere in the CLI.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SENSITIVE_KEY_PATTERNS = void 0;
+exports.isSensitiveKey = isSensitiveKey;
+exports.validateCredentialNameEncryptable = validateCredentialNameEncryptable;
+/** Suffixes whose values are secrets. */
+const SECRET_SUFFIXES = [
+    '_API_KEY_SECRET',
+    '_WALLET_SECRET',
+    '_AUTHORIZATION_PRIVATE_KEY',
+    '_APP_SECRET',
+    '_CLIENT_SECRET',
+    '_API_KEY',
+];
+/** Reference/identifier suffixes that are NOT secrets (stay readable). */
+const REFERENCE_SUFFIXES = ['_API_KEY_ID', '_APP_ID', '_CLIENT_ID', '_AUTHORIZATION_ID'];
+exports.SENSITIVE_KEY_PATTERNS = SECRET_SUFFIXES.map(s => new RegExp(`${s}$`));
+/**
+ * Model-provider API keys are stored as the bare `AGENTCORE_CREDENTIAL_<NAME>`
+ * (no secret suffix). Treat such a credential var as a secret UNLESS it ends in
+ * a known reference suffix.
+ */
+function isBareModelCredential(key) {
+    if (!key.startsWith('AGENTCORE_CREDENTIAL_'))
+        return false;
+    return !REFERENCE_SUFFIXES.some(suffix => key.endsWith(suffix));
+}
+function isSensitiveKey(key) {
+    if (REFERENCE_SUFFIXES.some(suffix => key.endsWith(suffix)))
+        return false;
+    if (exports.SENSITIVE_KEY_PATTERNS.some(re => re.test(key)))
+        return true;
+    return isBareModelCredential(key);
+}
+/**
+ * Normalize a credential name into its env-var-suffix form (matches
+ * computeDefaultCredentialEnvVarName: hyphens → underscores, uppercased).
+ */
+function normalizeCredentialNameToKey(name) {
+    return name.replace(/-/g, '_').toUpperCase();
+}
+/**
+ * Validate that an API-key credential NAME won't collide with a reserved
+ * reference suffix. A bare API-key credential is stored as
+ * `AGENTCORE_CREDENTIAL_<NAME>` carrying the secret value directly; if <NAME>
+ * normalizes to end in a reference suffix (e.g. `my-client-id` → `..._CLIENT_ID`)
+ * the value is indistinguishable from a non-secret reference and would be left
+ * UNENCRYPTED at rest. Reject such names at creation (fail closed).
+ *
+ * Returns `true` if the name is safe, or an error message string if not — the
+ * `(value) => true | string` contract used by both the CLI and the TUI's
+ * SecretInput/TextInput `customValidation`.
+ */
+function validateCredentialNameEncryptable(name) {
+    const normalized = normalizeCredentialNameToKey(name);
+    const collision = REFERENCE_SUFFIXES.find(suffix => normalized.endsWith(suffix));
+    if (collision) {
+        return `Credential name "${name}" ends in a reserved reference suffix (${collision}) and its secret would not be encrypted at rest. Choose a name that does not end in id/client-id/app-id/authorization-id.`;
+    }
+    return true;
+}
+//# sourceMappingURL=sensitive-keys.js.map

package/dist/lib/secrets/sensitive-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive-keys.js","sourceRoot":"","sources":["../../../src/lib/secrets/sensitive-keys.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AA2BH,wCAIC;AAsBD,8EAOC;AA1DD,yCAAyC;AACzC,MAAM,eAAe,GAAG;IACtB,iBAAiB;IACjB,gBAAgB;IAChB,4BAA4B;IAC5B,aAAa;IACb,gBAAgB;IAChB,UAAU;CACX,CAAC;AAEF,0EAA0E;AAC1E,MAAM,kBAAkB,GAAG,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,mBAAmB,CAAC,CAAC;AAE5E,QAAA,sBAAsB,GAAa,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAE9F;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,GAAW;IACxC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,uBAAuB,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAgB,cAAc,CAAC,GAAW;IACxC,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,8BAAsB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,SAAS,4BAA4B,CAAC,IAAY;IAChD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,iCAAiC,CAAC,IAAY;IAC5D,MAAM,UAAU,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACjF,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,oBAAoB,IAAI,0CAA0C,SAAS,2HAA2H,CAAC;IAChN,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/utils/env.d.ts

@@ -4,7 +4,8 @@
  */
 export declare function getEnvPath(configRoot?: string): string;
 /**
- * Read agentcore/.env.local.
+ * Read agentcore/.env.local. Sensitive values stored as `enc:v1:` envelopes are
+ * decrypted transparently; legacy plaintext values are returned as-is.
  */
 export declare function readEnvFile(configRoot?: string): Promise<Record<string, string>>;
 /**
@@ -12,7 +13,8 @@ export declare function readEnvFile(configRoot?: string): Promise<Record<string,
  */
 export declare function getEnvVar(key: string, configRoot?: string): Promise<string | undefined>;
 /**
- * Write to agentcore/.env.local. Merges with existing values by default.
+ * Write to agentcore/.env.local. Merges with existing values by default and
+ * encrypts sensitive values at rest.
  */
 export declare function writeEnvFile(updates: Record<string, string>, configRoot?: string, merge?: boolean): Promise<void>;
 /**

package/dist/lib/utils/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../src/lib/utils/env.ts"],"names":[],"mappings":"AAOA;;;GAGG;AACH,wBAAgB,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAItD;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAItF;AAED;;GAEG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAE7F;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,UAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBpH;AAED;;GAEG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9F;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBtF"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../src/lib/utils/env.ts"],"names":[],"mappings":"AAeA;;;GAGG;AACH,wBAAgB,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAItD;AAeD;;;GAGG;AACH,wBAAsB,WAAW,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CActF;AAED;;GAEG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAE7F;AAmBD;;;GAGG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,UAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAOpH;AAED;;GAEG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9F;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOtF"}