@contractspec/lib.contracts 1.44.0

package/dist/integrations/providers/twilio-sms.js

@@ -0,0 +1,64 @@
+import { StabilityEnum } from "../../ownership.js";
+
+//#region src/integrations/providers/twilio-sms.ts
+const twilioSmsIntegrationSpec = {
+	meta: {
+		key: "sms.twilio",
+		version: 1,
+		category: "sms",
+		title: "Twilio Messaging",
+		description: "Twilio SMS integration for transactional and notification messaging.",
+		domain: "communications",
+		owners: ["platform.messaging"],
+		tags: ["sms", "messaging"],
+		stability: StabilityEnum.Stable
+	},
+	supportedModes: ["managed", "byok"],
+	capabilities: { provides: [{
+		key: "sms.outbound",
+		version: 1
+	}] },
+	configSchema: {
+		schema: {
+			type: "object",
+			properties: { fromNumber: {
+				type: "string",
+				description: "Default Twilio phone number used as sender."
+			} }
+		},
+		example: { fromNumber: "+15551234567" }
+	},
+	secretSchema: {
+		schema: {
+			type: "object",
+			required: ["accountSid", "authToken"],
+			properties: {
+				accountSid: {
+					type: "string",
+					description: "Twilio Account SID."
+				},
+				authToken: {
+					type: "string",
+					description: "Twilio Auth Token."
+				}
+			}
+		},
+		example: {
+			accountSid: "ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
+			authToken: "auth-token"
+		}
+	},
+	healthCheck: {
+		method: "custom",
+		timeoutMs: 3e3
+	},
+	docsUrl: "https://www.twilio.com/docs/sms/api",
+	constraints: { rateLimit: { rpm: 200 } },
+	byokSetup: { setupInstructions: "Provide a Twilio account SID, auth token, and verify the outbound sending numbers used by the integration." }
+};
+function registerTwilioSmsIntegration(registry) {
+	return registry.register(twilioSmsIntegrationSpec);
+}
+
+//#endregion
+export { registerTwilioSmsIntegration, twilioSmsIntegrationSpec };

package/dist/integrations/providers/vector-store.d.ts

@@ -0,0 +1,43 @@
+import { EmbeddingVector } from "./embedding.js";
+
+//#region src/integrations/providers/vector-store.d.ts
+interface VectorDocument {
+  id: string;
+  vector: EmbeddingVector;
+  payload?: Record<string, unknown>;
+  namespace?: string;
+  expiresAt?: Date;
+}
+interface VectorUpsertRequest {
+  collection: string;
+  documents: VectorDocument[];
+  waitForSync?: boolean;
+}
+interface VectorDeleteRequest {
+  collection: string;
+  ids: string[];
+  namespace?: string;
+}
+interface VectorSearchQuery {
+  collection: string;
+  vector: EmbeddingVector;
+  topK: number;
+  namespace?: string;
+  filter?: Record<string, unknown>;
+  scoreThreshold?: number;
+  consistent?: boolean;
+}
+interface VectorSearchResult {
+  id: string;
+  score: number;
+  payload?: Record<string, unknown>;
+  vector?: EmbeddingVector;
+  namespace?: string;
+}
+interface VectorStoreProvider {
+  upsert(request: VectorUpsertRequest): Promise<void>;
+  search(query: VectorSearchQuery): Promise<VectorSearchResult[]>;
+  delete(request: VectorDeleteRequest): Promise<void>;
+}
+//#endregion
+export { VectorDeleteRequest, VectorDocument, VectorSearchQuery, VectorSearchResult, VectorStoreProvider, VectorUpsertRequest };

package/dist/integrations/providers/voice.d.ts

@@ -0,0 +1,34 @@
+//#region src/integrations/providers/voice.d.ts
+interface Voice {
+  id: string;
+  name: string;
+  description?: string;
+  language?: string;
+  gender?: 'male' | 'female' | 'neutral';
+  previewUrl?: string;
+  metadata?: Record<string, string>;
+}
+interface VoiceSynthesisInput {
+  text: string;
+  voiceId?: string;
+  language?: string;
+  style?: number;
+  stability?: number;
+  similarityBoost?: number;
+  format?: 'mp3' | 'wav' | 'ogg' | 'pcm';
+  sampleRateHz?: number;
+  metadata?: Record<string, string>;
+}
+interface VoiceSynthesisResult {
+  audio: Uint8Array;
+  format: string;
+  sampleRateHz: number;
+  durationSeconds?: number;
+  url?: string;
+}
+interface VoiceProvider {
+  listVoices(): Promise<Voice[]>;
+  synthesize(input: VoiceSynthesisInput): Promise<VoiceSynthesisResult>;
+}
+//#endregion
+export { Voice, VoiceProvider, VoiceSynthesisInput, VoiceSynthesisResult };

package/dist/integrations/runtime.d.ts

@@ -0,0 +1,99 @@
+import { IntegrationSpec } from "./spec.js";
+import { ConnectionStatus, IntegrationConnection } from "./connection.js";
+import { ResolvedAppConfig, ResolvedIntegration } from "../app-config/runtime.js";
+import { SecretProvider } from "./secrets/provider.js";
+
+//#region src/integrations/runtime.d.ts
+interface IntegrationTraceMetadata {
+  blueprintName: string;
+  blueprintVersion: number;
+  configVersion: number;
+}
+interface IntegrationTelemetryEvent {
+  tenantId: string;
+  appId: string;
+  environment?: string;
+  slotId?: string;
+  integrationKey: string;
+  integrationVersion: number;
+  connectionId: string;
+  status: 'success' | 'error';
+  durationMs?: number;
+  errorCode?: string;
+  errorMessage?: string;
+  occurredAt: Date;
+  metadata?: Record<string, string | number | boolean>;
+}
+interface IntegrationTelemetryEmitter {
+  record(event: IntegrationTelemetryEvent): Promise<void> | void;
+}
+type IntegrationInvocationStatus = 'success' | 'error';
+interface IntegrationContext {
+  tenantId: string;
+  appId: string;
+  environment?: string;
+  slotId?: string;
+  spec: IntegrationSpec;
+  connection: IntegrationConnection;
+  secretProvider: SecretProvider;
+  secretReference: string;
+  trace: IntegrationTraceMetadata;
+  config?: Record<string, unknown>;
+}
+interface IntegrationCallContext {
+  tenantId: string;
+  appId: string;
+  environment?: string;
+  blueprintName: string;
+  blueprintVersion: number;
+  configVersion: number;
+  slotId: string;
+  operation: string;
+}
+interface IntegrationCallError {
+  code: string;
+  message: string;
+  retryable: boolean;
+  cause?: unknown;
+}
+interface IntegrationCallResult<T> {
+  success: boolean;
+  data?: T;
+  error?: IntegrationCallError;
+  metadata: {
+    latencyMs: number;
+    connectionId: string;
+    ownershipMode: IntegrationConnection['ownershipMode'];
+    attempts: number;
+  };
+}
+interface IntegrationCallGuardOptions {
+  telemetry?: IntegrationTelemetryEmitter;
+  maxAttempts?: number;
+  backoffMs?: number;
+  shouldRetry?: (error: unknown, attempt: number) => boolean;
+  sleep?: (ms: number) => Promise<void>;
+  now?: () => Date;
+}
+declare class IntegrationCallGuard {
+  private readonly secretProvider;
+  private readonly telemetry?;
+  private readonly maxAttempts;
+  private readonly backoffMs;
+  private readonly shouldRetry;
+  private readonly sleep;
+  private readonly now;
+  constructor(secretProvider: SecretProvider, options?: IntegrationCallGuardOptions);
+  executeWithGuards<T>(slotId: string, operation: string, _input: unknown, resolvedConfig: ResolvedAppConfig, executor: (connection: IntegrationConnection, secrets: Record<string, string>) => Promise<T>): Promise<IntegrationCallResult<T>>;
+  private findIntegration;
+  private fetchSecrets;
+  private parseSecret;
+  private emitTelemetry;
+  private failure;
+  private makeContext;
+  private errorCodeFor;
+}
+declare function ensureConnectionReady(integration: ResolvedIntegration): void;
+declare function connectionStatusLabel(status: ConnectionStatus): string;
+//#endregion
+export { IntegrationCallContext, IntegrationCallError, IntegrationCallGuard, IntegrationCallGuardOptions, IntegrationCallResult, IntegrationContext, IntegrationInvocationStatus, IntegrationTelemetryEmitter, IntegrationTelemetryEvent, IntegrationTraceMetadata, connectionStatusLabel, ensureConnectionReady };

package/dist/integrations/runtime.js

@@ -0,0 +1,186 @@
+import { performance } from "node:perf_hooks";
+
+//#region src/integrations/runtime.ts
+const DEFAULT_MAX_ATTEMPTS = 3;
+const DEFAULT_BACKOFF_MS = 250;
+var IntegrationCallGuard = class {
+	telemetry;
+	maxAttempts;
+	backoffMs;
+	shouldRetry;
+	sleep;
+	now;
+	constructor(secretProvider, options = {}) {
+		this.secretProvider = secretProvider;
+		this.telemetry = options.telemetry;
+		this.maxAttempts = Math.max(1, options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS);
+		this.backoffMs = options.backoffMs ?? DEFAULT_BACKOFF_MS;
+		this.shouldRetry = options.shouldRetry ?? ((error) => typeof error === "object" && error !== null && "retryable" in error && Boolean(error.retryable));
+		this.sleep = options.sleep ?? ((ms) => ms <= 0 ? Promise.resolve() : new Promise((resolve) => setTimeout(resolve, ms)));
+		this.now = options.now ?? (() => /* @__PURE__ */ new Date());
+	}
+	async executeWithGuards(slotId, operation, _input, resolvedConfig, executor) {
+		const integration = this.findIntegration(slotId, resolvedConfig);
+		if (!integration) return this.failure({
+			tenantId: resolvedConfig.tenantId,
+			appId: resolvedConfig.appId,
+			environment: resolvedConfig.environment,
+			blueprintName: resolvedConfig.blueprintName,
+			blueprintVersion: resolvedConfig.blueprintVersion,
+			configVersion: resolvedConfig.configVersion,
+			slotId,
+			operation
+		}, void 0, {
+			code: "SLOT_NOT_BOUND",
+			message: `Integration slot "${slotId}" is not bound for tenant "${resolvedConfig.tenantId}".`,
+			retryable: false
+		}, 0);
+		const status = integration.connection.status;
+		if (status === "disconnected" || status === "error") return this.failure(this.makeContext(slotId, operation, resolvedConfig), integration, {
+			code: "CONNECTION_NOT_READY",
+			message: `Integration connection "${integration.connection.meta.label}" is in status "${status}".`,
+			retryable: false
+		}, 0);
+		const secrets = await this.fetchSecrets(integration.connection);
+		let attempt = 0;
+		const started = performance.now();
+		while (attempt < this.maxAttempts) {
+			attempt += 1;
+			try {
+				const data = await executor(integration.connection, secrets);
+				const duration = performance.now() - started;
+				this.emitTelemetry(this.makeContext(slotId, operation, resolvedConfig), integration, "success", duration);
+				return {
+					success: true,
+					data,
+					metadata: {
+						latencyMs: duration,
+						connectionId: integration.connection.meta.id,
+						ownershipMode: integration.connection.ownershipMode,
+						attempts: attempt
+					}
+				};
+			} catch (error) {
+				const duration = performance.now() - started;
+				this.emitTelemetry(this.makeContext(slotId, operation, resolvedConfig), integration, "error", duration, this.errorCodeFor(error), error instanceof Error ? error.message : String(error));
+				const retryable = this.shouldRetry(error, attempt);
+				if (!retryable || attempt >= this.maxAttempts) return {
+					success: false,
+					error: {
+						code: this.errorCodeFor(error),
+						message: error instanceof Error ? error.message : String(error),
+						retryable,
+						cause: error
+					},
+					metadata: {
+						latencyMs: duration,
+						connectionId: integration.connection.meta.id,
+						ownershipMode: integration.connection.ownershipMode,
+						attempts: attempt
+					}
+				};
+				await this.sleep(this.backoffMs);
+			}
+		}
+		return {
+			success: false,
+			error: {
+				code: "UNKNOWN_ERROR",
+				message: "Integration call failed after retries.",
+				retryable: false
+			},
+			metadata: {
+				latencyMs: performance.now() - started,
+				connectionId: integration.connection.meta.id,
+				ownershipMode: integration.connection.ownershipMode,
+				attempts: this.maxAttempts
+			}
+		};
+	}
+	findIntegration(slotId, config) {
+		return config.integrations.find((integration) => integration.slot.slotId === slotId);
+	}
+	async fetchSecrets(connection) {
+		if (!this.secretProvider.canHandle(connection.secretRef)) throw new Error(`Secret provider "${this.secretProvider.id}" cannot handle reference "${connection.secretRef}".`);
+		const secret = await this.secretProvider.getSecret(connection.secretRef);
+		return this.parseSecret(secret);
+	}
+	parseSecret(secret) {
+		const text = new TextDecoder().decode(secret.data);
+		try {
+			const parsed = JSON.parse(text);
+			if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+				const entries = Object.entries(parsed).filter(([, value]) => typeof value === "string" || typeof value === "number" || typeof value === "boolean");
+				return Object.fromEntries(entries.map(([key, value]) => [key, String(value)]));
+			}
+		} catch {}
+		return { secret: text };
+	}
+	emitTelemetry(context, integration, status, durationMs, errorCode, errorMessage) {
+		if (!this.telemetry || !integration) return;
+		this.telemetry.record({
+			tenantId: context.tenantId,
+			appId: context.appId,
+			environment: context.environment,
+			slotId: context.slotId,
+			integrationKey: integration.connection.meta.integrationKey,
+			integrationVersion: integration.connection.meta.integrationVersion,
+			connectionId: integration.connection.meta.id,
+			status,
+			durationMs,
+			errorCode,
+			errorMessage,
+			occurredAt: this.now(),
+			metadata: {
+				blueprint: `${context.blueprintName}.v${context.blueprintVersion}`,
+				configVersion: context.configVersion,
+				operation: context.operation
+			}
+		});
+	}
+	failure(context, integration, error, attempts) {
+		if (integration) this.emitTelemetry(context, integration, "error", 0, error.code, error.message);
+		return {
+			success: false,
+			error,
+			metadata: {
+				latencyMs: 0,
+				connectionId: integration?.connection.meta.id ?? "unknown",
+				ownershipMode: integration?.connection.ownershipMode ?? "managed",
+				attempts
+			}
+		};
+	}
+	makeContext(slotId, operation, config) {
+		return {
+			tenantId: config.tenantId,
+			appId: config.appId,
+			environment: config.environment,
+			blueprintName: config.blueprintName,
+			blueprintVersion: config.blueprintVersion,
+			configVersion: config.configVersion,
+			slotId,
+			operation
+		};
+	}
+	errorCodeFor(error) {
+		if (typeof error === "object" && error !== null && "code" in error && typeof error.code === "string") return error.code;
+		return "PROVIDER_ERROR";
+	}
+};
+function ensureConnectionReady(integration) {
+	const status = integration.connection.status;
+	if (status === "disconnected" || status === "error") throw new Error(`Integration connection "${integration.connection.meta.label}" is in status "${status}".`);
+}
+function connectionStatusLabel(status) {
+	switch (status) {
+		case "connected": return "connected";
+		case "disconnected": return "disconnected";
+		case "error": return "error";
+		case "unknown":
+		default: return "unknown";
+	}
+}
+
+//#endregion
+export { IntegrationCallGuard, connectionStatusLabel, ensureConnectionReady };

package/dist/integrations/secrets/aws-secret-manager.d.ts

@@ -0,0 +1,31 @@
+import { SecretFetchOptions, SecretProvider, SecretReference, SecretRotationResult, SecretValue, SecretWritePayload } from "./provider.js";
+import { SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
+
+//#region src/integrations/secrets/aws-secret-manager.d.ts
+type AwsSecretsManagerClient = Pick<SecretsManagerClient, 'send'>;
+type AwsSecretsManagerClientConfig = ConstructorParameters<typeof SecretsManagerClient>[0];
+interface AwsSecretsManagerProviderOptions {
+  region?: string;
+  client?: AwsSecretsManagerClient;
+  clientConfig?: AwsSecretsManagerClientConfig;
+}
+declare class AwsSecretsManagerProvider implements SecretProvider {
+  readonly id = "aws-secrets-manager";
+  private readonly explicitRegion?;
+  private readonly injectedClient?;
+  private readonly clientConfig?;
+  private readonly clientsByRegion;
+  constructor(options?: AwsSecretsManagerProviderOptions);
+  canHandle(reference: SecretReference): boolean;
+  getSecret(reference: SecretReference, options?: SecretFetchOptions): Promise<SecretValue>;
+  setSecret(reference: SecretReference, payload: SecretWritePayload): Promise<SecretRotationResult>;
+  rotateSecret(reference: SecretReference, payload: SecretWritePayload): Promise<SecretRotationResult>;
+  deleteSecret(reference: SecretReference): Promise<void>;
+  private getClient;
+  private parseReference;
+  private resolveRegion;
+  private buildVersionSelector;
+  private buildReference;
+}
+//#endregion
+export { AwsSecretsManagerProvider };

package/dist/integrations/secrets/aws-secret-manager.js

@@ -0,0 +1,231 @@
+import { SecretProviderError, normalizeSecretPayload, parseSecretUri } from "./provider.js";
+import { Buffer } from "node:buffer";
+import { CreateSecretCommand, DeleteSecretCommand, GetSecretValueCommand, PutSecretValueCommand, SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
+
+//#region src/integrations/secrets/aws-secret-manager.ts
+const DEFAULT_DELETE_RECOVERY_DAYS = 7;
+var AwsSecretsManagerProvider = class {
+	id = "aws-secrets-manager";
+	explicitRegion;
+	injectedClient;
+	clientConfig;
+	clientsByRegion = /* @__PURE__ */ new Map();
+	constructor(options = {}) {
+		this.explicitRegion = options.region;
+		this.injectedClient = options.client;
+		this.clientConfig = options.clientConfig;
+	}
+	canHandle(reference) {
+		try {
+			const parsed = parseSecretUri(reference);
+			return parsed.provider === "aws" && (parsed.path === "secretsmanager" || parsed.path.startsWith("secretsmanager/"));
+		} catch {
+			return false;
+		}
+	}
+	async getSecret(reference, options) {
+		const location = this.parseReference(reference);
+		const client = this.getClient(location.region);
+		const requestedVersion = options?.version ?? location.stage ?? location.version;
+		const input = {
+			SecretId: location.secretId,
+			...this.buildVersionSelector(requestedVersion)
+		};
+		try {
+			const result = await client.send(new GetSecretValueCommand(input));
+			return {
+				data: extractAwsSecretBytes(result, reference, this.id),
+				version: typeof result.VersionId === "string" && result.VersionId ? result.VersionId : requestedVersion,
+				metadata: {
+					region: location.region,
+					secretId: location.secretId,
+					...requestedVersion ? { requestedVersion } : {}
+				},
+				retrievedAt: /* @__PURE__ */ new Date()
+			};
+		} catch (error) {
+			throw toAwsSecretProviderError({
+				error,
+				provider: this.id,
+				reference,
+				operation: "getSecret"
+			});
+		}
+	}
+	async setSecret(reference, payload) {
+		const location = this.parseReference(reference);
+		const client = this.getClient(location.region);
+		const bytes = normalizeSecretPayload(payload);
+		try {
+			const result = await client.send(new PutSecretValueCommand({
+				SecretId: location.secretId,
+				SecretBinary: bytes
+			}));
+			const versionId = typeof result.VersionId === "string" && result.VersionId ? result.VersionId : "latest";
+			return {
+				reference: this.buildReference(location.region, location.secretId, { version: versionId }),
+				version: versionId
+			};
+		} catch (error) {
+			if (!isAwsNotFound(error)) throw toAwsSecretProviderError({
+				error,
+				provider: this.id,
+				reference,
+				operation: "putSecretValue"
+			});
+			if (looksLikeAwsArn(location.secretId)) throw new SecretProviderError({
+				message: `Secret not found: ${location.secretId}`,
+				provider: this.id,
+				reference,
+				code: "NOT_FOUND",
+				cause: error
+			});
+			try {
+				const created = await client.send(new CreateSecretCommand({
+					Name: location.secretId,
+					SecretBinary: bytes
+				}));
+				const versionId = typeof created.VersionId === "string" && created.VersionId ? created.VersionId : "latest";
+				return {
+					reference: this.buildReference(location.region, location.secretId, { version: versionId }),
+					version: versionId
+				};
+			} catch (creationError) {
+				throw toAwsSecretProviderError({
+					error: creationError,
+					provider: this.id,
+					reference,
+					operation: "createSecret"
+				});
+			}
+		}
+	}
+	async rotateSecret(reference, payload) {
+		return this.setSecret(reference, payload);
+	}
+	async deleteSecret(reference) {
+		const location = this.parseReference(reference);
+		const client = this.getClient(location.region);
+		try {
+			await client.send(new DeleteSecretCommand({
+				SecretId: location.secretId,
+				RecoveryWindowInDays: DEFAULT_DELETE_RECOVERY_DAYS
+			}));
+		} catch (error) {
+			throw toAwsSecretProviderError({
+				error,
+				provider: this.id,
+				reference,
+				operation: "deleteSecret"
+			});
+		}
+	}
+	getClient(region) {
+		if (this.injectedClient) return this.injectedClient;
+		const cached = this.clientsByRegion.get(region);
+		if (cached) return cached;
+		const client = new SecretsManagerClient({
+			...this.clientConfig ?? {},
+			region
+		});
+		this.clientsByRegion.set(region, client);
+		return client;
+	}
+	parseReference(reference) {
+		const parsed = parseSecretUri(reference);
+		if (parsed.provider !== "aws") throw new SecretProviderError({
+			message: `Unsupported secret provider: ${parsed.provider}`,
+			provider: this.id,
+			reference,
+			code: "INVALID"
+		});
+		const segments = parsed.path.split("/").filter(Boolean);
+		if (segments.length < 3 || segments[0] !== "secretsmanager") throw new SecretProviderError({
+			message: "Expected secret reference format aws://secretsmanager/{region}/{secretIdOrArn}[?version=...]",
+			provider: this.id,
+			reference,
+			code: "INVALID"
+		});
+		const regionCandidate = segments[1];
+		const region = this.resolveRegion(regionCandidate);
+		const secretId = segments.slice(2).join("/");
+		if (!secretId) throw new SecretProviderError({
+			message: `Unable to resolve secret id from reference "${parsed.path}"`,
+			provider: this.id,
+			reference,
+			code: "INVALID"
+		});
+		return {
+			region,
+			secretId,
+			version: parsed.extras?.version,
+			stage: parsed.extras?.stage
+		};
+	}
+	resolveRegion(regionCandidate) {
+		const region = regionCandidate ?? this.explicitRegion ?? process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION;
+		if (!region) throw new SecretProviderError({
+			message: "AWS region must be provided either in reference (aws://secretsmanager/{region}/...) or via AWS_REGION/AWS_DEFAULT_REGION.",
+			provider: this.id,
+			reference: "aws://secretsmanager//",
+			code: "INVALID"
+		});
+		return region;
+	}
+	buildVersionSelector(version) {
+		if (!version) return {};
+		if (version === "latest" || version === "current") return { VersionStage: "AWSCURRENT" };
+		if (version.startsWith("AWS")) return { VersionStage: version };
+		return { VersionId: version };
+	}
+	buildReference(region, secretId, extras) {
+		const base = `aws://secretsmanager/${region}/${secretId}`;
+		const query = extras ? Object.entries(extras).filter(([, value]) => Boolean(value)).map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&") : "";
+		return query ? `${base}?${query}` : base;
+	}
+};
+function extractAwsSecretBytes(result, reference, provider) {
+	if (!result || typeof result !== "object") throw new SecretProviderError({
+		message: "Invalid AWS Secrets Manager response",
+		provider,
+		reference,
+		code: "UNKNOWN",
+		cause: result
+	});
+	const record = result;
+	if (record.SecretBinary instanceof Uint8Array) return record.SecretBinary;
+	if (typeof record.SecretBinary === "string") return Buffer.from(record.SecretBinary, "base64");
+	if (typeof record.SecretString === "string") return Buffer.from(record.SecretString, "utf-8");
+	throw new SecretProviderError({
+		message: "AWS secret value is empty",
+		provider,
+		reference,
+		code: "NOT_FOUND",
+		cause: result
+	});
+}
+function looksLikeAwsArn(secretId) {
+	return secretId.startsWith("arn:aws:secretsmanager:");
+}
+function isAwsNotFound(error) {
+	if (!error || typeof error !== "object") return false;
+	const err = error;
+	if (typeof err.$metadata?.httpStatusCode === "number") return err.$metadata.httpStatusCode === 404;
+	return err.name === "ResourceNotFoundException";
+}
+function toAwsSecretProviderError(params) {
+	const { error, provider, reference, operation } = params;
+	if (error instanceof SecretProviderError) return error;
+	const httpStatusCode = typeof error === "object" && error !== null && "$metadata" in error && typeof error.$metadata === "object" && error.$metadata?.httpStatusCode;
+	const code = httpStatusCode === 404 ? "NOT_FOUND" : httpStatusCode === 401 || httpStatusCode === 403 ? "FORBIDDEN" : httpStatusCode === 400 ? "INVALID" : "UNKNOWN";
+	return new SecretProviderError({
+		message: error instanceof Error ? error.message : `Unknown error during ${operation}`,
+		provider,
+		reference,
+		code,
+		cause: error
+	});
+}
+
+//#endregion
+export { AwsSecretsManagerProvider };