@clef-sh/agent 0.1.20-beta.142 → 0.1.20-beta.143

package/dist/agent.cjs

@@ -193923,21 +193923,48 @@ var VcsArtifactSource = class {
 // ../runtime/src/sources/s3.ts
 var crypto17 = __toESM(require("crypto"));
 function isS3Url(url) {
-  return parseS3UrlSafe(url) !== null;
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    return false;
+  }
+  if (u.protocol === "s3:") {
+    return !!u.hostname && u.pathname.length > 1;
+  }
+  if (u.protocol === "https:") {
+    return parseHttpsS3Url(u) !== null;
+  }
+  return false;
 }
 function parseS3Url(url) {
-  const loc = parseS3UrlSafe(url);
-  if (!loc) throw new Error(`Not a valid S3 URL: ${url}`);
-  return loc;
-}
-function parseS3UrlSafe(url) {
   let u;
   try {
     u = new URL(url);
   } catch {
-    return null;
+    throw new Error(`Not a valid URL: ${url}`);
+  }
+  if (u.protocol === "s3:") {
+    const bucket = u.hostname;
+    const key = u.pathname.slice(1);
+    if (!bucket || !key) {
+      throw new Error(`Invalid s3:// URL (missing bucket or key): ${url}`);
+    }
+    const region = process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION;
+    if (!region) {
+      throw new Error(
+        `s3:// URLs require AWS_REGION or AWS_DEFAULT_REGION to be set. Lambda and ECS set AWS_REGION automatically; set it explicitly for other environments, or use the https://bucket.s3.region.amazonaws.com/key form instead. URL: ${url}`
+      );
+    }
+    return { bucket, key, region };
+  }
+  if (u.protocol === "https:") {
+    const loc = parseHttpsS3Url(u);
+    if (loc) return loc;
   }
-  if (u.protocol !== "https:") return null;
+  throw new Error(`Not a valid S3 URL: ${url}`);
+}
+function parseHttpsS3Url(u) {
   const host = u.hostname;
   const key = u.pathname.slice(1);
   if (!key) return null;
@@ -194141,9 +194168,19 @@ function readyHandler(cache5, cacheTtl, encryptedStore) {
 
 // src/server.ts
 function startAgentServer(options) {
-  const { port, token, cache: cache5, cacheTtl, decryptor, encryptedStore } = options;
+  const { port, token, cache: cache5, cacheTtl, refresh, decryptor, encryptedStore } = options;
   const jitMode = !!decryptor && !!encryptedStore;
   const app = (0, import_express.default)();
+  let inflightRefresh = null;
+  const refreshOnce = () => {
+    if (!refresh) return Promise.resolve();
+    if (!inflightRefresh) {
+      inflightRefresh = refresh().finally(() => {
+        inflightRefresh = null;
+      });
+    }
+    return inflightRefresh;
+  };
   const allowedHosts = /* @__PURE__ */ new Set([`127.0.0.1:${port}`, "127.0.0.1"]);
   app.use("/v1", (req, res, next) => {
     const host = req.headers.host ?? "";
@@ -194161,13 +194198,31 @@ function startAgentServer(options) {
   app.get("/v1/ready", readyHandler(cache5, cacheTtl, encryptedStore));
   app.use("/v1/secrets", authMiddleware(token));
   app.use("/v1/keys", authMiddleware(token));
-  const ttlGuard = (_req, res, next) => {
+  const ttlGuard = async (_req, res, next) => {
     if (jitMode) {
       if (!encryptedStore.isReady()) {
         res.status(503).json({ error: "Secrets not yet loaded" });
         return;
       }
-    } else if (cacheTtl !== void 0 && cache5.isExpired(cacheTtl)) {
+      next();
+      return;
+    }
+    if (cacheTtl === void 0 || !cache5.isExpired(cacheTtl)) {
+      next();
+      return;
+    }
+    if (!refresh) {
+      res.status(503).json({ error: "Secrets expired" });
+      return;
+    }
+    try {
+      await refreshOnce();
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      res.status(503).json({ error: "Refresh failed", detail: message });
+      return;
+    }
+    if (cache5.isExpired(cacheTtl)) {
       res.status(503).json({ error: "Secrets expired" });
       return;
     }
@@ -194446,7 +194501,7 @@ async function initialFetch(poller, jitMode, encryptedStore, cache5, sourceDesc)
 }
 
 // package.json
-var version5 = "0.1.20-beta.142";
+var version5 = "0.1.20-beta.143";
 
 // src/main.ts
 var isLambda = !!process.env.AWS_LAMBDA_RUNTIME_API;
@@ -194530,7 +194585,7 @@ async function main() {
     token: config.token,
     cache: cache5,
     cacheTtl: config.cacheTtl,
-    ...jitMode ? { decryptor: poller.getDecryptor(), encryptedStore } : {}
+    ...jitMode ? { decryptor: poller.getDecryptor(), encryptedStore } : { refresh: () => poller.fetchAndDecrypt() }
   });
   const onLog = (msg) => console.log(`[clef-agent] ${msg}`);
   telemetry?.agentStarted({ version: version5 });