@aws/agentcore 1.0.0-preview.2 → 1.0.0-preview.21

package/dist/lib/secrets/key-provider.js

@@ -0,0 +1,191 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveEncryptionKey = resolveEncryptionKey;
+exports.resolveCandidateKeys = resolveCandidateKeys;
+exports.__resetKeyCacheForTests = __resetKeyCacheForTests;
+const types_1 = require("../errors/types");
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const KEY_BYTES = 32;
+const KEYCHAIN_SERVICE = 'aws-agentcore';
+const KEYCHAIN_ACCOUNT = 'env-local-secret-key';
+let cachedKey = null;
+/** Keychain is opt-out (headless/CI) and best-effort; any failure falls through to the keyfile. */
+async function tryKeychainKey() {
+    if (process.env.AGENTCORE_DISABLE_KEYCHAIN === '1')
+        return null;
+    try {
+        // Optional native dependency — dynamic import so a missing/unbuildable
+        // module degrades to the keyfile instead of failing the CLI.
+        const { Entry } = (await Promise.resolve().then(() => __importStar(require('@napi-rs/keyring'))));
+        const entry = new Entry(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
+        try {
+            const existing = entry.getPassword();
+            if (existing)
+                return Buffer.from(existing, 'base64');
+        }
+        catch {
+            // no stored password yet
+        }
+        const key = (0, node_crypto_1.randomBytes)(KEY_BYTES);
+        entry.setPassword(key.toString('base64'));
+        // Re-read after writing: if a concurrent process stored a different key
+        // between our getPassword() and setPassword(), the keychain now holds
+        // theirs — trust the persisted value, not our local one, so both processes
+        // converge on the same key.
+        try {
+            const persisted = entry.getPassword();
+            if (persisted)
+                return Buffer.from(persisted, 'base64');
+        }
+        catch {
+            // fall through to the freshly-generated key
+        }
+        return key;
+    }
+    catch {
+        return null;
+    }
+}
+function resolveConfigDir() {
+    return process.env.AGENTCORE_CONFIG_DIR ?? (0, node_path_1.join)((0, node_os_1.homedir)(), '.agentcore');
+}
+function keyfilePath() {
+    return (0, node_path_1.join)(resolveConfigDir(), 'secrets.key');
+}
+/** A keyfile that exists but isn't KEY_BYTES long is corrupt — never overwrite it. */
+function assertKeyfileSize(key, path) {
+    if (key.length === KEY_BYTES)
+        return key;
+    throw new types_1.SecretEncryptionError(`Encryption key file at ${path} is corrupt (expected ${KEY_BYTES} bytes, found ${key.length}). ` +
+        `Move it aside and re-add your credentials, or restore the original key file`);
+}
+function keyfileKey() {
+    const path = keyfilePath();
+    try {
+        if ((0, node_fs_1.existsSync)(path)) {
+            // A wrong-sized existing file is corruption, NOT a cue to mint a new key:
+            // overwriting it would permanently orphan every secret sealed with the
+            // real key. Fail loud instead.
+            return assertKeyfileSize((0, node_fs_1.readFileSync)(path), path);
+        }
+        (0, node_fs_1.mkdirSync)(resolveConfigDir(), { recursive: true });
+        const key = (0, node_crypto_1.randomBytes)(KEY_BYTES);
+        try {
+            // `wx` fails if the file already exists, making first-time creation
+            // last-writer-safe: if a concurrent process created it between the
+            // existsSync check and here, re-read theirs instead of clobbering it.
+            (0, node_fs_1.writeFileSync)(path, key, { mode: 0o600, flag: 'wx' });
+            return key;
+        }
+        catch (writeErr) {
+            if (writeErr.code === 'EEXIST') {
+                return assertKeyfileSize((0, node_fs_1.readFileSync)(path), path);
+            }
+            throw writeErr;
+        }
+    }
+    catch (err) {
+        if (err instanceof types_1.SecretEncryptionError)
+            throw err;
+        throw new types_1.SecretEncryptionError(`Could not create or read the machine encryption key at ${path}.`, {
+            cause: err instanceof Error ? err : undefined,
+        });
+    }
+}
+/** Read the keyfile key WITHOUT creating one if absent (read-only; returns null when missing). */
+function readKeyfileKeyIfPresent() {
+    try {
+        const path = keyfilePath();
+        if ((0, node_fs_1.existsSync)(path)) {
+            const key = (0, node_fs_1.readFileSync)(path);
+            if (key.length === KEY_BYTES)
+                return key;
+        }
+    }
+    catch {
+        // unreadable keyfile — treat as absent
+    }
+    return null;
+}
+/** Read the keychain key WITHOUT creating one if absent (returns null when unavailable/missing). */
+async function readKeychainKeyIfPresent() {
+    if (process.env.AGENTCORE_DISABLE_KEYCHAIN === '1')
+        return null;
+    try {
+        const { Entry } = (await Promise.resolve().then(() => __importStar(require('@napi-rs/keyring'))));
+        const existing = new Entry(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT).getPassword();
+        return existing ? Buffer.from(existing, 'base64') : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve the single key used to ENCRYPT new values: keychain first, keyfile
+ * fallback. Creates a key if none exists yet.
+ */
+async function resolveEncryptionKey() {
+    if (cachedKey)
+        return cachedKey;
+    const fromKeychain = await tryKeychainKey();
+    cachedKey = fromKeychain ?? keyfileKey();
+    return cachedKey;
+}
+/**
+ * Resolve ALL candidate keys for DECRYPTION, newest-intent first. A stored
+ * value may have been sealed by the keychain on one run and the keyfile on
+ * another (e.g. AGENTCORE_DISABLE_KEYCHAIN toggled); trying every available key
+ * lets a value decrypt regardless of which source is currently active. Read-only
+ * — never creates a key. May be empty if no key material exists at all.
+ */
+async function resolveCandidateKeys() {
+    const keys = [];
+    const fromKeychain = await readKeychainKeyIfPresent();
+    if (fromKeychain)
+        keys.push(fromKeychain);
+    const fromKeyfile = readKeyfileKeyIfPresent();
+    if (fromKeyfile && !keys.some(k => k.equals(fromKeyfile)))
+        keys.push(fromKeyfile);
+    return keys;
+}
+/** Reset the per-process key cache. Only for use in tests. */
+function __resetKeyCacheForTests() {
+    cachedKey = null;
+}
+//# sourceMappingURL=key-provider.js.map

package/dist/lib/secrets/key-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-provider.js","sourceRoot":"","sources":["../../../src/lib/secrets/key-provider.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmIA,oDAKC;AASD,oDAOC;AAGD,0DAEC;AA7JD,2CAAwD;AACxD,6CAA0C;AAC1C,qCAA6E;AAC7E,qCAAkC;AAClC,yCAAiC;AAEjC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,gBAAgB,GAAG,eAAe,CAAC;AACzC,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AAEhD,IAAI,SAAS,GAAkB,IAAI,CAAC;AAWpC,mGAAmG;AACnG,KAAK,UAAU,cAAc;IAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,0BAA0B,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAChE,IAAI,CAAC;QACH,uEAAuE;QACvE,6DAA6D;QAC7D,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,wDAAa,kBAAkB,GAAC,CAAkB,CAAC;QACtE,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;YACrC,IAAI,QAAQ;gBAAE,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;QACD,MAAM,GAAG,GAAG,IAAA,yBAAW,EAAC,SAAS,CAAC,CAAC;QACnC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC1C,wEAAwE;QACxE,sEAAsE;QACtE,2EAA2E;QAC3E,4BAA4B;QAC5B,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;YACtC,IAAI,SAAS;gBAAE,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;QAC9C,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,YAAY,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,WAAW;IAClB,OAAO,IAAA,gBAAI,EAAC,gBAAgB,EAAE,EAAE,aAAa,CAAC,CAAC;AACjD,CAAC;AAED,sFAAsF;AACtF,SAAS,iBAAiB,CAAC,GAAW,EAAE,IAAY;IAClD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IACzC,MAAM,IAAI,6BAAqB,CAC7B,0BAA0B,IAAI,yBAAyB,SAAS,iBAAiB,GAAG,CAAC,MAAM,KAAK;QAC9F,6EAA6E,CAChF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,IAAI,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;YACrB,0EAA0E;YAC1E,uEAAuE;YACvE,+BAA+B;YAC/B,OAAO,iBAAiB,CAAC,IAAA,sBAAY,EAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QACrD,CAAC;QACD,IAAA,mBAAS,EAAC,gBAAgB,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,IAAA,yBAAW,EAAC,SAAS,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,oEAAoE;YACpE,mEAAmE;YACnE,sEAAsE;YACtE,IAAA,uBAAa,EAAC,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,QAAQ,EAAE,CAAC;YAClB,IAAK,QAAkC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1D,OAAO,iBAAiB,CAAC,IAAA,sBAAY,EAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;YACrD,CAAC;YACD,MAAM,QAAQ,CAAC;QACjB,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,6BAAqB;YAAE,MAAM,GAAG,CAAC;QACpD,MAAM,IAAI,6BAAqB,CAAC,0DAA0D,IAAI,GAAG,EAAE;YACjG,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,kGAAkG;AAClG,SAAS,uBAAuB;IAC9B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;QAC3B,IAAI,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,IAAA,sBAAY,EAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,GAAG,CAAC;QAC3C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oGAAoG;AACpG,KAAK,UAAU,wBAAwB;IACrC,IAAI,OAAO,CAAC,GAAG,CAAC,0BAA0B,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,wDAAa,kBAAkB,GAAC,CAAkB,CAAC;QACtE,MAAM,QAAQ,GAAG,IAAI,KAAK,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7E,OAAO,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,oBAAoB;IACxC,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,YAAY,GAAG,MAAM,cAAc,EAAE,CAAC;IAC5C,SAAS,GAAG,YAAY,IAAI,UAAU,EAAE,CAAC;IACzC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,oBAAoB;IACxC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,YAAY,GAAG,MAAM,wBAAwB,EAAE,CAAC;IACtD,IAAI,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,uBAAuB,EAAE,CAAC;IAC9C,IAAI,WAAW,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAClF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8DAA8D;AAC9D,SAAgB,uBAAuB;IACrC,SAAS,GAAG,IAAI,CAAC;AACnB,CAAC"}

package/dist/lib/secrets/sensitive-keys.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Single source of truth for "is this env value a secret that must be encrypted
+ * at rest." Used by env.ts on write/read; extend with one entry when a new
+ * secret-bearing credential field is introduced anywhere in the CLI.
+ */
+export declare const SENSITIVE_KEY_PATTERNS: RegExp[];
+export declare function isSensitiveKey(key: string): boolean;
+/**
+ * Validate that an API-key credential NAME won't collide with a reserved
+ * reference suffix. A bare API-key credential is stored as
+ * `AGENTCORE_CREDENTIAL_<NAME>` carrying the secret value directly; if <NAME>
+ * normalizes to end in a reference suffix (e.g. `my-client-id` → `..._CLIENT_ID`)
+ * the value is indistinguishable from a non-secret reference and would be left
+ * UNENCRYPTED at rest. Reject such names at creation (fail closed).
+ *
+ * Returns `true` if the name is safe, or an error message string if not — the
+ * `(value) => true | string` contract used by both the CLI and the TUI's
+ * SecretInput/TextInput `customValidation`.
+ */
+export declare function validateCredentialNameEncryptable(name: string): true | string;
+//# sourceMappingURL=sensitive-keys.d.ts.map

package/dist/lib/secrets/sensitive-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive-keys.d.ts","sourceRoot":"","sources":["../../../src/lib/secrets/sensitive-keys.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAeH,eAAO,MAAM,sBAAsB,EAAE,MAAM,EAAkD,CAAC;AAY9F,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAInD;AAUD;;;;;;;;;;;GAWG;AACH,wBAAgB,iCAAiC,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAO7E"}

package/dist/lib/secrets/sensitive-keys.js

@@ -0,0 +1,67 @@
+"use strict";
+/**
+ * Single source of truth for "is this env value a secret that must be encrypted
+ * at rest." Used by env.ts on write/read; extend with one entry when a new
+ * secret-bearing credential field is introduced anywhere in the CLI.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SENSITIVE_KEY_PATTERNS = void 0;
+exports.isSensitiveKey = isSensitiveKey;
+exports.validateCredentialNameEncryptable = validateCredentialNameEncryptable;
+/** Suffixes whose values are secrets. */
+const SECRET_SUFFIXES = [
+    '_API_KEY_SECRET',
+    '_WALLET_SECRET',
+    '_AUTHORIZATION_PRIVATE_KEY',
+    '_APP_SECRET',
+    '_CLIENT_SECRET',
+    '_API_KEY',
+];
+/** Reference/identifier suffixes that are NOT secrets (stay readable). */
+const REFERENCE_SUFFIXES = ['_API_KEY_ID', '_APP_ID', '_CLIENT_ID', '_AUTHORIZATION_ID'];
+exports.SENSITIVE_KEY_PATTERNS = SECRET_SUFFIXES.map(s => new RegExp(`${s}$`));
+/**
+ * Model-provider API keys are stored as the bare `AGENTCORE_CREDENTIAL_<NAME>`
+ * (no secret suffix). Treat such a credential var as a secret UNLESS it ends in
+ * a known reference suffix.
+ */
+function isBareModelCredential(key) {
+    if (!key.startsWith('AGENTCORE_CREDENTIAL_'))
+        return false;
+    return !REFERENCE_SUFFIXES.some(suffix => key.endsWith(suffix));
+}
+function isSensitiveKey(key) {
+    if (REFERENCE_SUFFIXES.some(suffix => key.endsWith(suffix)))
+        return false;
+    if (exports.SENSITIVE_KEY_PATTERNS.some(re => re.test(key)))
+        return true;
+    return isBareModelCredential(key);
+}
+/**
+ * Normalize a credential name into its env-var-suffix form (matches
+ * computeDefaultCredentialEnvVarName: hyphens → underscores, uppercased).
+ */
+function normalizeCredentialNameToKey(name) {
+    return name.replace(/-/g, '_').toUpperCase();
+}
+/**
+ * Validate that an API-key credential NAME won't collide with a reserved
+ * reference suffix. A bare API-key credential is stored as
+ * `AGENTCORE_CREDENTIAL_<NAME>` carrying the secret value directly; if <NAME>
+ * normalizes to end in a reference suffix (e.g. `my-client-id` → `..._CLIENT_ID`)
+ * the value is indistinguishable from a non-secret reference and would be left
+ * UNENCRYPTED at rest. Reject such names at creation (fail closed).
+ *
+ * Returns `true` if the name is safe, or an error message string if not — the
+ * `(value) => true | string` contract used by both the CLI and the TUI's
+ * SecretInput/TextInput `customValidation`.
+ */
+function validateCredentialNameEncryptable(name) {
+    const normalized = normalizeCredentialNameToKey(name);
+    const collision = REFERENCE_SUFFIXES.find(suffix => normalized.endsWith(suffix));
+    if (collision) {
+        return `Credential name "${name}" ends in a reserved reference suffix (${collision}) and its secret would not be encrypted at rest. Choose a name that does not end in id/client-id/app-id/authorization-id.`;
+    }
+    return true;
+}
+//# sourceMappingURL=sensitive-keys.js.map

package/dist/lib/secrets/sensitive-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive-keys.js","sourceRoot":"","sources":["../../../src/lib/secrets/sensitive-keys.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AA2BH,wCAIC;AAsBD,8EAOC;AA1DD,yCAAyC;AACzC,MAAM,eAAe,GAAG;IACtB,iBAAiB;IACjB,gBAAgB;IAChB,4BAA4B;IAC5B,aAAa;IACb,gBAAgB;IAChB,UAAU;CACX,CAAC;AAEF,0EAA0E;AAC1E,MAAM,kBAAkB,GAAG,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,mBAAmB,CAAC,CAAC;AAE5E,QAAA,sBAAsB,GAAa,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAE9F;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,GAAW;IACxC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,uBAAuB,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAgB,cAAc,CAAC,GAAW;IACxC,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,8BAAsB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,SAAS,4BAA4B,CAAC,IAAY;IAChD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,iCAAiC,CAAC,IAAY;IAC5D,MAAM,UAAU,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACjF,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,oBAAoB,IAAI,0CAA0C,SAAS,2HAA2H,CAAC;IAChN,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/time-constants.d.ts

@@ -0,0 +1,5 @@
+export declare const ONE_SECOND_MS = 1000;
+export declare const ONE_MINUTE_MS: number;
+export declare const ONE_HOUR_MS: number;
+export declare const ONE_DAY_MS: number;
+//# sourceMappingURL=time-constants.d.ts.map

package/dist/lib/time-constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"time-constants.d.ts","sourceRoot":"","sources":["../../src/lib/time-constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,OAAO,CAAC;AAClC,eAAO,MAAM,aAAa,QAAqB,CAAC;AAChD,eAAO,MAAM,WAAW,QAAqB,CAAC;AAC9C,eAAO,MAAM,UAAU,QAAmB,CAAC"}

package/dist/lib/time-constants.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ONE_DAY_MS = exports.ONE_HOUR_MS = exports.ONE_MINUTE_MS = exports.ONE_SECOND_MS = void 0;
+exports.ONE_SECOND_MS = 1000;
+exports.ONE_MINUTE_MS = exports.ONE_SECOND_MS * 60;
+exports.ONE_HOUR_MS = exports.ONE_MINUTE_MS * 60;
+exports.ONE_DAY_MS = exports.ONE_HOUR_MS * 24;
+//# sourceMappingURL=time-constants.js.map

package/dist/lib/time-constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"time-constants.js","sourceRoot":"","sources":["../../src/lib/time-constants.ts"],"names":[],"mappings":";;;AAAa,QAAA,aAAa,GAAG,IAAI,CAAC;AACrB,QAAA,aAAa,GAAG,qBAAa,GAAG,EAAE,CAAC;AACnC,QAAA,WAAW,GAAG,qBAAa,GAAG,EAAE,CAAC;AACjC,QAAA,UAAU,GAAG,mBAAW,GAAG,EAAE,CAAC"}

package/dist/lib/utils/env.d.ts

@@ -4,7 +4,8 @@
  */
 export declare function getEnvPath(configRoot?: string): string;
 /**
- * Read agentcore/.env.local.
+ * Read agentcore/.env.local. Sensitive values stored as `enc:v1:` envelopes are
+ * decrypted transparently; legacy plaintext values are returned as-is.
  */
 export declare function readEnvFile(configRoot?: string): Promise<Record<string, string>>;
 /**
@@ -12,11 +13,16 @@ export declare function readEnvFile(configRoot?: string): Promise<Record<string,
  */
 export declare function getEnvVar(key: string, configRoot?: string): Promise<string | undefined>;
 /**
- * Write to agentcore/.env.local. Merges with existing values by default.
+ * Write to agentcore/.env.local. Merges with existing values by default and
+ * encrypts sensitive values at rest.
  */
 export declare function writeEnvFile(updates: Record<string, string>, configRoot?: string, merge?: boolean): Promise<void>;
 /**
  * Set a single value in agentcore/.env.local.
  */
 export declare function setEnvVar(key: string, value: string, configRoot?: string): Promise<void>;
+/**
+ * Remove keys from agentcore/.env.local.
+ */
+export declare function removeEnvVars(keys: string[], configRoot?: string): Promise<void>;
 //# sourceMappingURL=env.d.ts.map

package/dist/lib/utils/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../src/lib/utils/env.ts"],"names":[],"mappings":"AAOA;;;GAGG;AACH,wBAAgB,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAItD;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAItF;AAED;;GAEG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAE7F;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,UAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBpH;AAED;;GAEG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9F"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../../src/lib/utils/env.ts"],"names":[],"mappings":"AAeA;;;GAGG;AACH,wBAAgB,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAItD;AAeD;;;GAGG;AACH,wBAAsB,WAAW,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CActF;AAED;;GAEG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAE7F;AAmBD;;;GAGG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,UAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAOpH;AAED;;GAEG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9F;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOtF"}

package/dist/lib/utils/env.js

@@ -5,8 +5,10 @@ exports.readEnvFile = readEnvFile;
 exports.getEnvVar = getEnvVar;
 exports.writeEnvFile = writeEnvFile;
 exports.setEnvVar = setEnvVar;
+exports.removeEnvVars = removeEnvVars;
 const constants_1 = require("../constants");
 const path_resolver_1 = require("../schemas/io/path-resolver");
+const secrets_1 = require("../secrets");
 const dotenv_1 = require("dotenv");
 const fs_1 = require("fs");
 const promises_1 = require("fs/promises");
@@ -21,14 +23,40 @@ function getEnvPath(configRoot) {
         throw new Error('Could not find agentcore directory');
     return (0, path_1.join)(root, constants_1.ENV_FILE);
 }
+/** Escape and serialize an env record to dotenv `KEY="value"` lines. */
+function serializeEnv(env) {
+    const lines = Object.entries(env)
+        .map(([k, v]) => {
+        if (v === undefined || v === null)
+            return '';
+        if (!/^[a-z_][a-z0-9_]*$/i.test(k))
+            throw new Error(`Invalid env key: ${k}`);
+        const val = String(v).replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n').replace(/\r/g, '\\r');
+        return `${k}="${val}"`;
+    })
+        .filter(Boolean);
+    return lines.length > 0 ? lines.join('\n') + '\n' : '';
+}
 /**
- * Read agentcore/.env.local.
+ * Read agentcore/.env.local. Sensitive values stored as `enc:v1:` envelopes are
+ * decrypted transparently; legacy plaintext values are returned as-is.
  */
 async function readEnvFile(configRoot) {
     const path = getEnvPath(configRoot);
     if (!(0, fs_1.existsSync)(path))
         return {};
-    return (0, dotenv_1.parse)(await (0, promises_1.readFile)(path, 'utf-8'));
+    const parsed = (0, dotenv_1.parse)(await (0, promises_1.readFile)(path, 'utf-8'));
+    const entries = Object.entries(parsed);
+    if (!entries.some(([, v]) => v.startsWith(secrets_1.ENC_PREFIX)))
+        return parsed;
+    // Try every available key (keychain + keyfile) so a value sealed by either
+    // source decrypts even if the active source differs from the one that wrote it.
+    const keys = await (0, secrets_1.resolveCandidateKeys)();
+    const out = {};
+    for (const [k, v] of entries) {
+        out[k] = v.startsWith(secrets_1.ENC_PREFIX) ? (0, secrets_1.decryptSecret)(v, keys) : v;
+    }
+    return out;
 }
 /**
  * Get a single value from agentcore/.env.local.
@@ -36,25 +64,32 @@ async function readEnvFile(configRoot) {
 async function getEnvVar(key, configRoot) {
     return (await readEnvFile(configRoot))[key];
 }
+/** Encrypt sensitive plaintext values; leave non-sensitive and already-encrypted values unchanged. */
+async function encryptSensitive(env) {
+    const needsEncryption = Object.entries(env).some(([k, v]) => (0, secrets_1.isSensitiveKey)(k) && v !== undefined && v !== null && !String(v).startsWith(secrets_1.ENC_PREFIX));
+    if (!needsEncryption)
+        return env;
+    const key = await (0, secrets_1.resolveEncryptionKey)();
+    const out = {};
+    for (const [k, v] of Object.entries(env)) {
+        out[k] =
+            (0, secrets_1.isSensitiveKey)(k) && v !== undefined && v !== null && !String(v).startsWith(secrets_1.ENC_PREFIX)
+                ? (0, secrets_1.encryptSecret)(String(v), key)
+                : v;
+    }
+    return out;
+}
 /**
- * Write to agentcore/.env.local. Merges with existing values by default.
+ * Write to agentcore/.env.local. Merges with existing values by default and
+ * encrypts sensitive values at rest.
  */
 async function writeEnvFile(updates, configRoot, merge = true) {
     const path = getEnvPath(configRoot);
-    const current = merge ? await readEnvFile(configRoot) : {};
-    const env = { ...current, ...updates };
-    const content = Object.entries(env)
-        .map(([k, v]) => {
-        if (v === undefined || v === null)
-            return '';
-        if (!/^[a-z_][a-z0-9_]*$/i.test(k))
-            throw new Error(`Invalid env key: ${k}`);
-        const val = String(v).replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n').replace(/\r/g, '\\r');
-        return `${k}="${val}"`;
-    })
-        .filter(Boolean)
-        .join('\n') + '\n';
-    await (0, promises_1.writeFile)(path, content);
+    // Merge against the RAW on-disk values (still encrypted) so we never decrypt
+    // then re-encrypt unchanged secrets; encryptSensitive skips enc:v1: values.
+    const current = merge && (0, fs_1.existsSync)(path) ? (0, dotenv_1.parse)(await (0, promises_1.readFile)(path, 'utf-8')) : {};
+    const env = await encryptSensitive({ ...current, ...updates });
+    await (0, promises_1.writeFile)(path, serializeEnv(env));
 }
 /**
  * Set a single value in agentcore/.env.local.
@@ -62,4 +97,17 @@ async function writeEnvFile(updates, configRoot, merge = true) {
 async function setEnvVar(key, value, configRoot) {
     await writeEnvFile({ [key]: value }, configRoot);
 }
+/**
+ * Remove keys from agentcore/.env.local.
+ */
+async function removeEnvVars(keys, configRoot) {
+    const path = getEnvPath(configRoot);
+    if (!(0, fs_1.existsSync)(path))
+        return;
+    const current = (0, dotenv_1.parse)(await (0, promises_1.readFile)(path, 'utf-8')); // raw (encrypted) values
+    for (const key of keys)
+        delete current[key];
+    const env = await encryptSensitive(current); // re-encrypts any legacy plaintext among the remainder
+    await (0, promises_1.writeFile)(path, serializeEnv(env));
+}
 //# sourceMappingURL=env.js.map

package/dist/lib/utils/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../../../src/lib/utils/env.ts"],"names":[],"mappings":";;AAWA,gCAIC;AAKD,kCAIC;AAKD,8BAEC;AAKD,oCAmBC;AAKD,8BAEC;AA9DD,4CAAwC;AACxC,+DAA6D;AAC7D,mCAA+B;AAC/B,2BAAgC;AAChC,0CAAkD;AAClD,+BAA4B;AAE5B;;;GAGG;AACH,SAAgB,UAAU,CAAC,UAAmB;IAC5C,MAAM,IAAI,GAAG,UAAU,IAAI,IAAA,8BAAc,GAAE,CAAC;IAC5C,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACjE,OAAO,IAAA,WAAI,EAAC,IAAI,EAAE,oBAAQ,CAAC,CAAC;AAC9B,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,WAAW,CAAC,UAAmB;IACnD,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACpC,IAAI,CAAC,IAAA,eAAU,EAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,IAAA,cAAK,EAAC,MAAM,IAAA,mBAAQ,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,UAAmB;IAC9D,OAAO,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,YAAY,CAAC,OAA+B,EAAE,UAAmB,EAAE,KAAK,GAAG,IAAI;IACnG,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;IAEvC,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SAChB,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE;QACd,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC;QAC7C,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;QAE7E,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAE9G,OAAO,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC;IACzB,CAAC,CAAC;SACD,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAEvB,MAAM,IAAA,oBAAS,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACjC,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,KAAa,EAAE,UAAmB;IAC7E,MAAM,YAAY,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC;AACnD,CAAC"}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../../src/lib/utils/env.ts"],"names":[],"mappings":";;AAmBA,gCAIC;AAmBD,kCAcC;AAKD,8BAEC;AAuBD,oCAOC;AAKD,8BAEC;AAKD,sCAOC;AAhHD,4CAAwC;AACxC,+DAA6D;AAC7D,wCAOoB;AACpB,mCAA+B;AAC/B,2BAAgC;AAChC,0CAAkD;AAClD,+BAA4B;AAE5B;;;GAGG;AACH,SAAgB,UAAU,CAAC,UAAmB;IAC5C,MAAM,IAAI,GAAG,UAAU,IAAI,IAAA,8BAAc,GAAE,CAAC;IAC5C,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACjE,OAAO,IAAA,WAAI,EAAC,IAAI,EAAE,oBAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,wEAAwE;AACxE,SAAS,YAAY,CAAC,GAA2B;IAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SAC9B,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE;QACd,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC;QAC7C,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC9G,OAAO,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC;IACzB,CAAC,CAAC;SACD,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AACzD,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,WAAW,CAAC,UAAmB;IACnD,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACpC,IAAI,CAAC,IAAA,eAAU,EAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,IAAA,cAAK,EAAC,MAAM,IAAA,mBAAQ,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,oBAAU,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IACtE,2EAA2E;IAC3E,gFAAgF;IAChF,MAAM,IAAI,GAAG,MAAM,IAAA,8BAAoB,GAAE,CAAC;IAC1C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;QAC7B,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,oBAAU,CAAC,CAAC,CAAC,CAAC,IAAA,uBAAa,EAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,UAAmB;IAC9D,OAAO,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED,sGAAsG;AACtG,KAAK,UAAU,gBAAgB,CAAC,GAA2B;IACzD,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAC9C,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,wBAAc,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,oBAAU,CAAC,CACpG,CAAC;IACF,IAAI,CAAC,eAAe;QAAE,OAAO,GAAG,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,IAAA,8BAAoB,GAAE,CAAC;IACzC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,CAAC,CAAC;YACJ,IAAA,wBAAc,EAAC,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,oBAAU,CAAC;gBACrF,CAAC,CAAC,IAAA,uBAAa,EAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC/B,CAAC,CAAC,CAAC,CAAC;IACV,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,YAAY,CAAC,OAA+B,EAAE,UAAmB,EAAE,KAAK,GAAG,IAAI;IACnG,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACpC,6EAA6E;IAC7E,4EAA4E;IAC5E,MAAM,OAAO,GAAG,KAAK,IAAI,IAAA,eAAU,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,cAAK,EAAC,MAAM,IAAA,mBAAQ,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC/D,MAAM,IAAA,oBAAS,EAAC,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,KAAa,EAAE,UAAmB;IAC7E,MAAM,YAAY,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC;AACnD,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,aAAa,CAAC,IAAc,EAAE,UAAmB;IACrE,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACpC,IAAI,CAAC,IAAA,eAAU,EAAC,IAAI,CAAC;QAAE,OAAO;IAC9B,MAAM,OAAO,GAAG,IAAA,cAAK,EAAC,MAAM,IAAA,mBAAQ,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,yBAAyB;IAC/E,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,uDAAuD;IACpG,MAAM,IAAA,oBAAS,EAAC,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC"}

package/dist/lib/utils/index.d.ts

@@ -1,9 +1,10 @@
 export { detectAwsAccount } from './aws-account';
 export { SecureCredentials } from './credentials';
-export { getEnvPath, readEnvFile, writeEnvFile, getEnvVar, setEnvVar } from './env';
+export { getEnvPath, readEnvFile, writeEnvFile, getEnvVar, setEnvVar, removeEnvVars } from './env';
 export { isWindows } from './platform';
 export { runSubprocess, checkSubprocess, runSubprocessCapture, type SubprocessOptions, type SubprocessResult, } from './subprocess';
 export { parseTimeString } from './time-parser';
 export { parseJsonRpcResponse } from './json-rpc';
-export { validateAgentSchema, validateProjectSchema } from './zod';
+export { poll, isThrottlingError } from './polling';
+export { validateAgentSchema, validateProjectSchema, resilientParse, type ResilientParseOptions } from './zod';
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AACpF,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EACL,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,OAAO,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,OAAO,CAAC;AACnG,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EACL,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,cAAc,EAAE,KAAK,qBAAqB,EAAE,MAAM,OAAO,CAAC"}

package/dist/lib/utils/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateProjectSchema = exports.validateAgentSchema = exports.parseJsonRpcResponse = exports.parseTimeString = exports.runSubprocessCapture = exports.checkSubprocess = exports.runSubprocess = exports.isWindows = exports.setEnvVar = exports.getEnvVar = exports.writeEnvFile = exports.readEnvFile = exports.getEnvPath = exports.SecureCredentials = exports.detectAwsAccount = void 0;
+exports.resilientParse = exports.validateProjectSchema = exports.validateAgentSchema = exports.isThrottlingError = exports.poll = exports.parseJsonRpcResponse = exports.parseTimeString = exports.runSubprocessCapture = exports.checkSubprocess = exports.runSubprocess = exports.isWindows = exports.removeEnvVars = exports.setEnvVar = exports.getEnvVar = exports.writeEnvFile = exports.readEnvFile = exports.getEnvPath = exports.SecureCredentials = exports.detectAwsAccount = void 0;
 var aws_account_1 = require("./aws-account");
 Object.defineProperty(exports, "detectAwsAccount", { enumerable: true, get: function () { return aws_account_1.detectAwsAccount; } });
 var credentials_1 = require("./credentials");
@@ -11,6 +11,7 @@ Object.defineProperty(exports, "readEnvFile", { enumerable: true, get: function
 Object.defineProperty(exports, "writeEnvFile", { enumerable: true, get: function () { return env_1.writeEnvFile; } });
 Object.defineProperty(exports, "getEnvVar", { enumerable: true, get: function () { return env_1.getEnvVar; } });
 Object.defineProperty(exports, "setEnvVar", { enumerable: true, get: function () { return env_1.setEnvVar; } });
+Object.defineProperty(exports, "removeEnvVars", { enumerable: true, get: function () { return env_1.removeEnvVars; } });
 var platform_1 = require("./platform");
 Object.defineProperty(exports, "isWindows", { enumerable: true, get: function () { return platform_1.isWindows; } });
 var subprocess_1 = require("./subprocess");
@@ -21,7 +22,11 @@ var time_parser_1 = require("./time-parser");
 Object.defineProperty(exports, "parseTimeString", { enumerable: true, get: function () { return time_parser_1.parseTimeString; } });
 var json_rpc_1 = require("./json-rpc");
 Object.defineProperty(exports, "parseJsonRpcResponse", { enumerable: true, get: function () { return json_rpc_1.parseJsonRpcResponse; } });
+var polling_1 = require("./polling");
+Object.defineProperty(exports, "poll", { enumerable: true, get: function () { return polling_1.poll; } });
+Object.defineProperty(exports, "isThrottlingError", { enumerable: true, get: function () { return polling_1.isThrottlingError; } });
 var zod_1 = require("./zod");
 Object.defineProperty(exports, "validateAgentSchema", { enumerable: true, get: function () { return zod_1.validateAgentSchema; } });
 Object.defineProperty(exports, "validateProjectSchema", { enumerable: true, get: function () { return zod_1.validateProjectSchema; } });
+Object.defineProperty(exports, "resilientParse", { enumerable: true, get: function () { return zod_1.resilientParse; } });
 //# sourceMappingURL=index.js.map

package/dist/lib/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/utils/index.ts"],"names":[],"mappings":";;;AAAA,6CAAiD;AAAxC,+GAAA,gBAAgB,OAAA;AACzB,6CAAkD;AAAzC,gHAAA,iBAAiB,OAAA;AAC1B,6BAAoF;AAA3E,iGAAA,UAAU,OAAA;AAAE,kGAAA,WAAW,OAAA;AAAE,mGAAA,YAAY,OAAA;AAAE,gGAAA,SAAS,OAAA;AAAE,gGAAA,SAAS,OAAA;AACpE,uCAAuC;AAA9B,qGAAA,SAAS,OAAA;AAClB,2CAMsB;AALpB,2GAAA,aAAa,OAAA;AACb,6GAAA,eAAe,OAAA;AACf,kHAAA,oBAAoB,OAAA;AAItB,6CAAgD;AAAvC,8GAAA,eAAe,OAAA;AACxB,uCAAkD;AAAzC,gHAAA,oBAAoB,OAAA;AAC7B,6BAAmE;AAA1D,0GAAA,mBAAmB,OAAA;AAAE,4GAAA,qBAAqB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/utils/index.ts"],"names":[],"mappings":";;;AAAA,6CAAiD;AAAxC,+GAAA,gBAAgB,OAAA;AACzB,6CAAkD;AAAzC,gHAAA,iBAAiB,OAAA;AAC1B,6BAAmG;AAA1F,iGAAA,UAAU,OAAA;AAAE,kGAAA,WAAW,OAAA;AAAE,mGAAA,YAAY,OAAA;AAAE,gGAAA,SAAS,OAAA;AAAE,gGAAA,SAAS,OAAA;AAAE,oGAAA,aAAa,OAAA;AACnF,uCAAuC;AAA9B,qGAAA,SAAS,OAAA;AAClB,2CAMsB;AALpB,2GAAA,aAAa,OAAA;AACb,6GAAA,eAAe,OAAA;AACf,kHAAA,oBAAoB,OAAA;AAItB,6CAAgD;AAAvC,8GAAA,eAAe,OAAA;AACxB,uCAAkD;AAAzC,gHAAA,oBAAoB,OAAA;AAC7B,qCAAoD;AAA3C,+FAAA,IAAI,OAAA;AAAE,4GAAA,iBAAiB,OAAA;AAChC,6BAA+G;AAAtG,0GAAA,mBAAmB,OAAA;AAAE,4GAAA,qBAAqB,OAAA;AAAE,qGAAA,cAAc,OAAA"}

package/dist/lib/utils/polling.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Shared polling/retry utility for async operations.
+ */
+export type PollResult<T> = {
+    done: true;
+    value: T;
+} | {
+    done: false;
+};
+export interface PollOptions<T> {
+    /** Async function called each iteration. Return {done: true, value} when complete, {done: false} to keep polling. */
+    fn: () => Promise<PollResult<T>>;
+    /** Max number of attempts before throwing PollExhaustedError. */
+    maxAttempts?: number;
+    /** Max total time in ms before throwing PollTimeoutError. */
+    timeoutMs?: number;
+    /** Delay between iterations in ms. Default 5000. */
+    delayMs?: number;
+    /** Multiply delay by this factor each iteration. Default 1 (fixed). */
+    backoffFactor?: number;
+    /** Cap on delay in ms. */
+    maxDelayMs?: number;
+    /** Abort after this many consecutive errors. */
+    maxConsecutiveErrors?: number;
+    /** Called when fn throws. Return 'retry' to continue or 'abort' to rethrow. Default: 'retry'. */
+    onError?: (err: unknown) => 'retry' | 'abort';
+}
+export declare function poll<T>(options: PollOptions<T>): Promise<T>;
+/** Check if an error is an AWS throttling/rate-limit error. */
+export declare function isThrottlingError(err: unknown): boolean;
+//# sourceMappingURL=polling.d.ts.map

package/dist/lib/utils/polling.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"polling.d.ts","sourceRoot":"","sources":["../../../src/lib/utils/polling.ts"],"names":[],"mappings":"AAEA;;GAEG;AAEH,MAAM,MAAM,UAAU,CAAC,CAAC,IAAI;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC;AAEvE,MAAM,WAAW,WAAW,CAAC,CAAC;IAC5B,qHAAqH;IACrH,EAAE,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0BAA0B;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iGAAiG;IACjG,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,GAAG,OAAO,CAAC;CAC/C;AAED,wBAAsB,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAsDjE;AAED,+DAA+D;AAC/D,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAYvD"}