@layervai/qurl-aws 2.0.0

package/dist/cjs/index.d.ts

@@ -0,0 +1,3 @@
+export { createSSMAgentStateStore } from "./ssm.js";
+export { createSecretsManagerAgentStateStore } from "./secrets-manager.js";
+export { createKMSAgentStateKeyWrapper } from "./kms.js";

package/dist/cjs/index.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createKMSAgentStateKeyWrapper = exports.createSecretsManagerAgentStateStore = exports.createSSMAgentStateStore = void 0;
+var ssm_js_1 = require("./ssm.js");
+Object.defineProperty(exports, "createSSMAgentStateStore", { enumerable: true, get: function () { return ssm_js_1.createSSMAgentStateStore; } });
+var secrets_manager_js_1 = require("./secrets-manager.js");
+Object.defineProperty(exports, "createSecretsManagerAgentStateStore", { enumerable: true, get: function () { return secrets_manager_js_1.createSecretsManagerAgentStateStore; } });
+var kms_js_1 = require("./kms.js");
+Object.defineProperty(exports, "createKMSAgentStateKeyWrapper", { enumerable: true, get: function () { return kms_js_1.createKMSAgentStateKeyWrapper; } });

package/dist/cjs/kms.d.ts

@@ -0,0 +1,3 @@
+import { type KMSClient } from "@aws-sdk/client-kms";
+import { type AgentStateKeyWrapper } from "@layervai/qurl/node";
+export declare function createKMSAgentStateKeyWrapper(client: KMSClient, keyID: string): AgentStateKeyWrapper;

package/dist/cjs/kms.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createKMSAgentStateKeyWrapper = createKMSAgentStateKeyWrapper;
+const client_kms_1 = require("@aws-sdk/client-kms");
+const node_1 = require("@layervai/qurl/node");
+const store_js_1 = require("./store.js");
+const KEY_ARN = /^arn:aws(?:-[a-z]+)?:kms:[a-z0-9-]+:\d{12}:key\/(?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|mrk-[0-9a-f]{32})$/;
+function context(binding) {
+    if (binding.purpose !== "qurl-go/agent-state" ||
+        binding.envelopeVersion !== 1 ||
+        !binding.agentID ||
+        !binding.providerID)
+        throw new node_1.AgentStateError("INVALID_KEY_BINDING");
+    return {
+        qurl_purpose: binding.purpose,
+        qurl_envelope_version: String(binding.envelopeVersion),
+        qurl_provider_id: binding.providerID,
+        qurl_agent_id: binding.agentID,
+    };
+}
+function createKMSAgentStateKeyWrapper(client, keyID) {
+    if (!client || !keyID || keyID.trim() !== keyID || keyID.length > 2048)
+        throw new node_1.AgentStateError("INVALID_KMS_CONFIGURATION");
+    return {
+        async wrapKey(key, binding, signal) {
+            signal?.throwIfAborted();
+            if (key.length !== 32)
+                throw new node_1.AgentStateError("INVALID_DATA_KEY");
+            const plaintext = Buffer.from(key);
+            try {
+                const result = await client.send(new client_kms_1.EncryptCommand({
+                    KeyId: keyID,
+                    Plaintext: plaintext,
+                    EncryptionAlgorithm: "SYMMETRIC_DEFAULT",
+                    EncryptionContext: context(binding),
+                }), { abortSignal: signal });
+                if (!result.CiphertextBlob?.length || !result.KeyId || !KEY_ARN.test(result.KeyId))
+                    throw new node_1.AgentStateError("INVALID_KMS_RESPONSE");
+                return {
+                    version: 1,
+                    ciphertext: Buffer.from(result.CiphertextBlob),
+                    metadata: { key_id: result.KeyId },
+                };
+            }
+            finally {
+                plaintext.fill(0);
+            }
+        },
+        async unwrapKey(wrapped, binding, signal) {
+            signal?.throwIfAborted();
+            const metadata = wrapped.metadata;
+            if (wrapped.version !== 1 ||
+                !wrapped.ciphertext.length ||
+                !metadata ||
+                typeof metadata !== "object" ||
+                Array.isArray(metadata) ||
+                Object.keys(metadata).length !== 1 ||
+                typeof metadata.key_id !== "string" ||
+                !KEY_ARN.test(metadata.key_id))
+                throw new node_1.AgentStateError("INVALID_WRAPPED_KEY");
+            let result;
+            try {
+                result = await client.send(new client_kms_1.DecryptCommand({
+                    KeyId: metadata.key_id,
+                    CiphertextBlob: wrapped.ciphertext,
+                    EncryptionAlgorithm: "SYMMETRIC_DEFAULT",
+                    EncryptionContext: context(binding),
+                }), { abortSignal: signal });
+            }
+            catch (error) {
+                if ((0, store_js_1.errorNamed)(error, "InvalidCiphertextException") ||
+                    (0, store_js_1.errorNamed)(error, "IncorrectKeyException"))
+                    throw new node_1.AgentStateError("INVALID_WRAPPED_KEY");
+                throw error;
+            }
+            try {
+                if (result.KeyId !== metadata.key_id || result.Plaintext?.length !== 32)
+                    throw new node_1.AgentStateError("INVALID_KMS_RESPONSE");
+                return Buffer.from(result.Plaintext);
+            }
+            finally {
+                result.Plaintext?.fill(0);
+            }
+        },
+    };
+}

package/dist/cjs/package.json

@@ -0,0 +1 @@
+{"type":"commonjs"}

package/dist/cjs/secrets-manager.d.ts

@@ -0,0 +1,3 @@
+import { type SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
+import { type AgentStateStore } from "@layervai/qurl/node";
+export declare function createSecretsManagerAgentStateStore(client: SecretsManagerClient, secretID: string, kmsKeyID?: string): AgentStateStore;

package/dist/cjs/secrets-manager.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSecretsManagerAgentStateStore = createSecretsManagerAgentStateStore;
+const client_secrets_manager_1 = require("@aws-sdk/client-secrets-manager");
+const node_1 = require("@layervai/qurl/node");
+const store_js_1 = require("./store.js");
+const node_crypto_1 = require("node:crypto");
+function createSecretsManagerAgentStateStore(client, secretID, kmsKeyID) {
+    secretID = secretID.trim();
+    if (!client || !secretID)
+        throw new node_1.AgentStateError("INVALID_SECRETS_MANAGER_CONFIGURATION");
+    return (0, store_js_1.lockedStore)({
+        async load(signal) {
+            signal?.throwIfAborted();
+            let result;
+            try {
+                result = await client.send(new client_secrets_manager_1.GetSecretValueCommand({ SecretId: secretID }), {
+                    abortSignal: signal,
+                });
+            }
+            catch (error) {
+                if ((0, store_js_1.errorNamed)(error, "ResourceNotFoundException"))
+                    throw new node_1.AgentStateError("NOT_FOUND");
+                throw error;
+            }
+            if (typeof result.SecretString !== "string")
+                throw new node_1.AgentStateError("INVALID_STATE");
+            const raw = Buffer.from(result.SecretString);
+            try {
+                return (0, node_1.decodeAgentState)(raw);
+            }
+            finally {
+                raw.fill(0);
+            }
+        },
+        async save(state, signal) {
+            signal?.throwIfAborted();
+            const raw = (0, node_1.encodeAgentState)(state);
+            const token = (0, node_crypto_1.randomUUID)();
+            try {
+                if (raw.length > 65536)
+                    throw new node_1.AgentStateError("SECRETS_MANAGER_SIZE_LIMIT");
+                const SecretString = raw.toString();
+                try {
+                    await client.send(new client_secrets_manager_1.PutSecretValueCommand({
+                        SecretId: secretID,
+                        SecretString,
+                        ClientRequestToken: token,
+                    }), { abortSignal: signal });
+                }
+                catch (error) {
+                    if (!(0, store_js_1.errorNamed)(error, "ResourceNotFoundException"))
+                        throw error;
+                    if (secretID.startsWith("arn:"))
+                        throw new node_1.AgentStateError("SECRET_MUST_EXIST");
+                    try {
+                        await client.send(new client_secrets_manager_1.CreateSecretCommand({
+                            Name: secretID,
+                            SecretString,
+                            ClientRequestToken: token,
+                            KmsKeyId: kmsKeyID,
+                        }), { abortSignal: signal });
+                    }
+                    catch (creation) {
+                        if (!(0, store_js_1.errorNamed)(creation, "ResourceExistsException"))
+                            throw creation;
+                        await client.send(new client_secrets_manager_1.PutSecretValueCommand({
+                            SecretId: secretID,
+                            SecretString,
+                            ClientRequestToken: token,
+                        }), { abortSignal: signal });
+                    }
+                }
+            }
+            finally {
+                raw.fill(0);
+            }
+        },
+    });
+}

package/dist/cjs/ssm.d.ts

@@ -0,0 +1,6 @@
+import { type SSMClient } from "@aws-sdk/client-ssm";
+import { type AgentStateStore } from "@layervai/qurl/node";
+export declare function createSSMAgentStateStore(client: SSMClient, name: string, options?: {
+    kmsKeyID?: string;
+    tier?: "Standard" | "Advanced" | "Intelligent-Tiering";
+}): AgentStateStore;

package/dist/cjs/ssm.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSSMAgentStateStore = createSSMAgentStateStore;
+const client_ssm_1 = require("@aws-sdk/client-ssm");
+const node_1 = require("@layervai/qurl/node");
+const store_js_1 = require("./store.js");
+function createSSMAgentStateStore(client, name, options = {}) {
+    name = name.trim();
+    if (!client || !name)
+        throw new node_1.AgentStateError("INVALID_SSM_CONFIGURATION");
+    const { kmsKeyID, tier } = options;
+    return (0, store_js_1.lockedStore)({
+        async load(signal) {
+            signal?.throwIfAborted();
+            let result;
+            try {
+                result = await client.send(new client_ssm_1.GetParameterCommand({ Name: name, WithDecryption: true }), {
+                    abortSignal: signal,
+                });
+            }
+            catch (error) {
+                if ((0, store_js_1.errorNamed)(error, "ParameterNotFound"))
+                    throw new node_1.AgentStateError("NOT_FOUND");
+                throw error;
+            }
+            if (typeof result.Parameter?.Value !== "string")
+                throw new node_1.AgentStateError("INVALID_STATE");
+            const raw = Buffer.from(result.Parameter.Value);
+            try {
+                return (0, node_1.decodeAgentState)(raw);
+            }
+            finally {
+                raw.fill(0);
+            }
+        },
+        async save(state, signal) {
+            signal?.throwIfAborted();
+            const raw = (0, node_1.encodeAgentState)(state);
+            try {
+                if (raw.length > (tier === "Advanced" || tier === "Intelligent-Tiering" ? 8192 : 4096))
+                    throw new node_1.AgentStateError("SSM_SIZE_LIMIT");
+                await client.send(new client_ssm_1.PutParameterCommand({
+                    Name: name,
+                    Value: raw.toString(),
+                    Type: "SecureString",
+                    Overwrite: true,
+                    KeyId: kmsKeyID,
+                    Tier: tier,
+                }), { abortSignal: signal });
+            }
+            finally {
+                raw.fill(0);
+            }
+        },
+    });
+}

package/dist/cjs/store.d.ts

@@ -0,0 +1,4 @@
+import type { AgentStateStore } from "@layervai/qurl/node";
+/** SSM and Secrets Manager have no transaction lock. One process must own each agent state. */
+export declare function lockedStore(store: Omit<AgentStateStore, "withLock">): AgentStateStore;
+export declare function errorNamed(error: unknown, name: string): boolean;

package/dist/cjs/store.js

@@ -0,0 +1,85 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.lockedStore = lockedStore;
+exports.errorNamed = errorNamed;
+/** SSM and Secrets Manager have no transaction lock. One process must own each agent state. */
+function lockedStore(store) {
+    let tail = Promise.resolve();
+    const result = {
+        ...store,
+        save(state, signal) {
+            const snapshot = structuredClone(state);
+            return result.withLock((locked) => locked.save(snapshot, signal), signal);
+        },
+        async withLock(operation, signal) {
+            let release;
+            const previous = tail;
+            tail = new Promise((resolve) => {
+                release = resolve;
+            });
+            let entered = false;
+            let abort;
+            try {
+                if (signal) {
+                    await Promise.race([
+                        previous,
+                        new Promise((_, reject) => {
+                            abort = () => reject(signal.reason);
+                            signal.addEventListener("abort", abort, { once: true });
+                            if (signal.aborted)
+                                abort();
+                        }),
+                    ]);
+                }
+                else
+                    await previous;
+                entered = true;
+                signal?.throwIfAborted();
+                let active = true;
+                const check = () => {
+                    if (!active)
+                        throw new Error("qURL AWS state lock has expired");
+                };
+                const scoped = {
+                    load: async (nextSignal) => {
+                        check();
+                        const effective = nextSignal ?? signal;
+                        effective?.throwIfAborted();
+                        const state = await store.load(effective);
+                        check();
+                        effective?.throwIfAborted();
+                        return state;
+                    },
+                    save: async (state, nextSignal) => {
+                        check();
+                        const effective = nextSignal ?? signal;
+                        effective?.throwIfAborted();
+                        return store.save(state, effective);
+                    },
+                    withLock: async (operation) => {
+                        check();
+                        return operation(scoped);
+                    },
+                };
+                try {
+                    return await operation(scoped);
+                }
+                finally {
+                    active = false;
+                }
+            }
+            finally {
+                if (abort)
+                    signal?.removeEventListener("abort", abort);
+                if (entered)
+                    release();
+                else
+                    void previous.then(release);
+            }
+        },
+    };
+    return result;
+}
+function errorNamed(error, name) {
+    return error instanceof Error && error.name === name;
+}

package/dist/esm/index.d.ts

@@ -0,0 +1,4 @@
+export { createSSMAgentStateStore } from "./ssm.js";
+export { createSecretsManagerAgentStateStore } from "./secrets-manager.js";
+export { createKMSAgentStateKeyWrapper } from "./kms.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AACpD,OAAO,EAAE,mCAAmC,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,6BAA6B,EAAE,MAAM,UAAU,CAAC"}

package/dist/esm/index.js

@@ -0,0 +1,4 @@
+export { createSSMAgentStateStore } from "./ssm.js";
+export { createSecretsManagerAgentStateStore } from "./secrets-manager.js";
+export { createKMSAgentStateKeyWrapper } from "./kms.js";
+//# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AACpD,OAAO,EAAE,mCAAmC,EAAE,MAAM,sBAAsB,CAAC;AAC3E,OAAO,EAAE,6BAA6B,EAAE,MAAM,UAAU,CAAC"}

package/dist/esm/kms.d.ts

@@ -0,0 +1,4 @@
+import { type KMSClient } from "@aws-sdk/client-kms";
+import { type AgentStateKeyWrapper } from "@layervai/qurl/node";
+export declare function createKMSAgentStateKeyWrapper(client: KMSClient, keyID: string): AgentStateKeyWrapper;
+//# sourceMappingURL=kms.d.ts.map

package/dist/esm/kms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kms.d.ts","sourceRoot":"","sources":["../../src/kms.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkC,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrF,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,qBAAqB,CAAC;AAqB7B,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,SAAS,EACjB,KAAK,EAAE,MAAM,GACZ,oBAAoB,CAuEtB"}

package/dist/esm/kms.js

@@ -0,0 +1,84 @@
+import { EncryptCommand, DecryptCommand } from "@aws-sdk/client-kms";
+import { AgentStateError, } from "@layervai/qurl/node";
+import { errorNamed } from "./store.js";
+const KEY_ARN = /^arn:aws(?:-[a-z]+)?:kms:[a-z0-9-]+:\d{12}:key\/(?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|mrk-[0-9a-f]{32})$/;
+function context(binding) {
+    if (binding.purpose !== "qurl-go/agent-state" ||
+        binding.envelopeVersion !== 1 ||
+        !binding.agentID ||
+        !binding.providerID)
+        throw new AgentStateError("INVALID_KEY_BINDING");
+    return {
+        qurl_purpose: binding.purpose,
+        qurl_envelope_version: String(binding.envelopeVersion),
+        qurl_provider_id: binding.providerID,
+        qurl_agent_id: binding.agentID,
+    };
+}
+export function createKMSAgentStateKeyWrapper(client, keyID) {
+    if (!client || !keyID || keyID.trim() !== keyID || keyID.length > 2048)
+        throw new AgentStateError("INVALID_KMS_CONFIGURATION");
+    return {
+        async wrapKey(key, binding, signal) {
+            signal?.throwIfAborted();
+            if (key.length !== 32)
+                throw new AgentStateError("INVALID_DATA_KEY");
+            const plaintext = Buffer.from(key);
+            try {
+                const result = await client.send(new EncryptCommand({
+                    KeyId: keyID,
+                    Plaintext: plaintext,
+                    EncryptionAlgorithm: "SYMMETRIC_DEFAULT",
+                    EncryptionContext: context(binding),
+                }), { abortSignal: signal });
+                if (!result.CiphertextBlob?.length || !result.KeyId || !KEY_ARN.test(result.KeyId))
+                    throw new AgentStateError("INVALID_KMS_RESPONSE");
+                return {
+                    version: 1,
+                    ciphertext: Buffer.from(result.CiphertextBlob),
+                    metadata: { key_id: result.KeyId },
+                };
+            }
+            finally {
+                plaintext.fill(0);
+            }
+        },
+        async unwrapKey(wrapped, binding, signal) {
+            signal?.throwIfAborted();
+            const metadata = wrapped.metadata;
+            if (wrapped.version !== 1 ||
+                !wrapped.ciphertext.length ||
+                !metadata ||
+                typeof metadata !== "object" ||
+                Array.isArray(metadata) ||
+                Object.keys(metadata).length !== 1 ||
+                typeof metadata.key_id !== "string" ||
+                !KEY_ARN.test(metadata.key_id))
+                throw new AgentStateError("INVALID_WRAPPED_KEY");
+            let result;
+            try {
+                result = await client.send(new DecryptCommand({
+                    KeyId: metadata.key_id,
+                    CiphertextBlob: wrapped.ciphertext,
+                    EncryptionAlgorithm: "SYMMETRIC_DEFAULT",
+                    EncryptionContext: context(binding),
+                }), { abortSignal: signal });
+            }
+            catch (error) {
+                if (errorNamed(error, "InvalidCiphertextException") ||
+                    errorNamed(error, "IncorrectKeyException"))
+                    throw new AgentStateError("INVALID_WRAPPED_KEY");
+                throw error;
+            }
+            try {
+                if (result.KeyId !== metadata.key_id || result.Plaintext?.length !== 32)
+                    throw new AgentStateError("INVALID_KMS_RESPONSE");
+                return Buffer.from(result.Plaintext);
+            }
+            finally {
+                result.Plaintext?.fill(0);
+            }
+        },
+    };
+}
+//# sourceMappingURL=kms.js.map

package/dist/esm/kms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kms.js","sourceRoot":"","sources":["../../src/kms.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,cAAc,EAAkB,MAAM,qBAAqB,CAAC;AACrF,OAAO,EACL,eAAe,GAGhB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,MAAM,OAAO,GACX,oIAAoI,CAAC;AACvI,SAAS,OAAO,CAAC,OAA6B;IAC5C,IACE,OAAO,CAAC,OAAO,KAAK,qBAAqB;QACzC,OAAO,CAAC,eAAe,KAAK,CAAC;QAC7B,CAAC,OAAO,CAAC,OAAO;QAChB,CAAC,OAAO,CAAC,UAAU;QAEnB,MAAM,IAAI,eAAe,CAAC,qBAAqB,CAAC,CAAC;IACnD,OAAO;QACL,YAAY,EAAE,OAAO,CAAC,OAAO;QAC7B,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC;QACtD,gBAAgB,EAAE,OAAO,CAAC,UAAU;QACpC,aAAa,EAAE,OAAO,CAAC,OAAO;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,MAAiB,EACjB,KAAa;IAEb,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;QACpE,MAAM,IAAI,eAAe,CAAC,2BAA2B,CAAC,CAAC;IACzD,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM;YAChC,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;gBAAE,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAC;YACrE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,IAAI,cAAc,CAAC;oBACjB,KAAK,EAAE,KAAK;oBACZ,SAAS,EAAE,SAAS;oBACpB,mBAAmB,EAAE,mBAAmB;oBACxC,iBAAiB,EAAE,OAAO,CAAC,OAAO,CAAC;iBACpC,CAAC,EACF,EAAE,WAAW,EAAE,MAAM,EAAE,CACxB,CAAC;gBACF,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;oBAChF,MAAM,IAAI,eAAe,CAAC,sBAAsB,CAAC,CAAC;gBACpD,OAAO;oBACL,OAAO,EAAE,CAAC;oBACV,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;oBAC9C,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE;iBACnC,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM;YACtC,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;YAClC,IACE,OAAO,CAAC,OAAO,KAAK,CAAC;gBACrB,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM;gBAC1B,CAAC,QAAQ;gBACT,OAAO,QAAQ,KAAK,QAAQ;gBAC5B,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC;gBAClC,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ;gBACnC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAE9B,MAAM,IAAI,eAAe,CAAC,qBAAqB,CAAC,CAAC;YACnD,IAAI,MAAM,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CACxB,IAAI,cAAc,CAAC;oBACjB,KAAK,EAAE,QAAQ,CAAC,MAAM;oBACtB,cAAc,EAAE,OAAO,CAAC,UAAU;oBAClC,mBAAmB,EAAE,mBAAmB;oBACxC,iBAAiB,EAAE,OAAO,CAAC,OAAO,CAAC;iBACpC,CAAC,EACF,EAAE,WAAW,EAAE,MAAM,EAAE,CACxB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IACE,UAAU,CAAC,KAAK,EAAE,4BAA4B,CAAC;oBAC/C,UAAU,CAAC,KAAK,EAAE,uBAAuB,CAAC;oBAE1C,MAAM,IAAI,eAAe,CAAC,qBAAqB,CAAC,CAAC;gBACnD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,CAAC;gBACH,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,EAAE,MAAM,KAAK,EAAE;oBACrE,MAAM,IAAI,eAAe,CAAC,sBAAsB,CAAC,CAAC;gBACpD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACvC,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/esm/secrets-manager.d.ts

@@ -0,0 +1,4 @@
+import { type SecretsManagerClient } from "@aws-sdk/client-secrets-manager";
+import { type AgentStateStore } from "@layervai/qurl/node";
+export declare function createSecretsManagerAgentStateStore(client: SecretsManagerClient, secretID: string, kmsKeyID?: string): AgentStateStore;
+//# sourceMappingURL=secrets-manager.d.ts.map

package/dist/esm/secrets-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-manager.d.ts","sourceRoot":"","sources":["../../src/secrets-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,qBAAqB,CAAC;AAI7B,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,oBAAoB,EAC5B,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,GAChB,eAAe,CAqEjB"}

package/dist/esm/secrets-manager.js

@@ -0,0 +1,78 @@
+import { GetSecretValueCommand, PutSecretValueCommand, CreateSecretCommand, } from "@aws-sdk/client-secrets-manager";
+import { AgentStateError, decodeAgentState, encodeAgentState, } from "@layervai/qurl/node";
+import { lockedStore, errorNamed } from "./store.js";
+import { randomUUID } from "node:crypto";
+export function createSecretsManagerAgentStateStore(client, secretID, kmsKeyID) {
+    secretID = secretID.trim();
+    if (!client || !secretID)
+        throw new AgentStateError("INVALID_SECRETS_MANAGER_CONFIGURATION");
+    return lockedStore({
+        async load(signal) {
+            signal?.throwIfAborted();
+            let result;
+            try {
+                result = await client.send(new GetSecretValueCommand({ SecretId: secretID }), {
+                    abortSignal: signal,
+                });
+            }
+            catch (error) {
+                if (errorNamed(error, "ResourceNotFoundException"))
+                    throw new AgentStateError("NOT_FOUND");
+                throw error;
+            }
+            if (typeof result.SecretString !== "string")
+                throw new AgentStateError("INVALID_STATE");
+            const raw = Buffer.from(result.SecretString);
+            try {
+                return decodeAgentState(raw);
+            }
+            finally {
+                raw.fill(0);
+            }
+        },
+        async save(state, signal) {
+            signal?.throwIfAborted();
+            const raw = encodeAgentState(state);
+            const token = randomUUID();
+            try {
+                if (raw.length > 65536)
+                    throw new AgentStateError("SECRETS_MANAGER_SIZE_LIMIT");
+                const SecretString = raw.toString();
+                try {
+                    await client.send(new PutSecretValueCommand({
+                        SecretId: secretID,
+                        SecretString,
+                        ClientRequestToken: token,
+                    }), { abortSignal: signal });
+                }
+                catch (error) {
+                    if (!errorNamed(error, "ResourceNotFoundException"))
+                        throw error;
+                    if (secretID.startsWith("arn:"))
+                        throw new AgentStateError("SECRET_MUST_EXIST");
+                    try {
+                        await client.send(new CreateSecretCommand({
+                            Name: secretID,
+                            SecretString,
+                            ClientRequestToken: token,
+                            KmsKeyId: kmsKeyID,
+                        }), { abortSignal: signal });
+                    }
+                    catch (creation) {
+                        if (!errorNamed(creation, "ResourceExistsException"))
+                            throw creation;
+                        await client.send(new PutSecretValueCommand({
+                            SecretId: secretID,
+                            SecretString,
+                            ClientRequestToken: token,
+                        }), { abortSignal: signal });
+                    }
+                }
+            }
+            finally {
+                raw.fill(0);
+            }
+        },
+    });
+}
+//# sourceMappingURL=secrets-manager.js.map

package/dist/esm/secrets-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-manager.js","sourceRoot":"","sources":["../../src/secrets-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,GAEpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,gBAAgB,GAEjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,UAAU,mCAAmC,CACjD,MAA4B,EAC5B,QAAgB,EAChB,QAAiB;IAEjB,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,eAAe,CAAC,uCAAuC,CAAC,CAAC;IAC7F,OAAO,WAAW,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,MAAM;YACf,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,IAAI,MAAM,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE;oBAC5E,WAAW,EAAE,MAAM;iBACpB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,UAAU,CAAC,KAAK,EAAE,2BAA2B,CAAC;oBAAE,MAAM,IAAI,eAAe,CAAC,WAAW,CAAC,CAAC;gBAC3F,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;gBAAE,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;YACxF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC7C,IAAI,CAAC;gBACH,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAC/B,CAAC;oBAAS,CAAC;gBACT,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACd,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM;YACtB,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,MAAM,GAAG,KAAK;oBAAE,MAAM,IAAI,eAAe,CAAC,4BAA4B,CAAC,CAAC;gBAChF,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACpC,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,qBAAqB,CAAC;wBACxB,QAAQ,EAAE,QAAQ;wBAClB,YAAY;wBACZ,kBAAkB,EAAE,KAAK;qBAC1B,CAAC,EACF,EAAE,WAAW,EAAE,MAAM,EAAE,CACxB,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,2BAA2B,CAAC;wBAAE,MAAM,KAAK,CAAC;oBACjE,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;wBAAE,MAAM,IAAI,eAAe,CAAC,mBAAmB,CAAC,CAAC;oBAChF,IAAI,CAAC;wBACH,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,mBAAmB,CAAC;4BACtB,IAAI,EAAE,QAAQ;4BACd,YAAY;4BACZ,kBAAkB,EAAE,KAAK;4BACzB,QAAQ,EAAE,QAAQ;yBACnB,CAAC,EACF,EAAE,WAAW,EAAE,MAAM,EAAE,CACxB,CAAC;oBACJ,CAAC;oBAAC,OAAO,QAAQ,EAAE,CAAC;wBAClB,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,yBAAyB,CAAC;4BAAE,MAAM,QAAQ,CAAC;wBACrE,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,qBAAqB,CAAC;4BACxB,QAAQ,EAAE,QAAQ;4BAClB,YAAY;4BACZ,kBAAkB,EAAE,KAAK;yBAC1B,CAAC,EACF,EAAE,WAAW,EAAE,MAAM,EAAE,CACxB,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/esm/ssm.d.ts

@@ -0,0 +1,7 @@
+import { type SSMClient } from "@aws-sdk/client-ssm";
+import { type AgentStateStore } from "@layervai/qurl/node";
+export declare function createSSMAgentStateStore(client: SSMClient, name: string, options?: {
+    kmsKeyID?: string;
+    tier?: "Standard" | "Advanced" | "Intelligent-Tiering";
+}): AgentStateStore;
+//# sourceMappingURL=ssm.d.ts.map

package/dist/esm/ssm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssm.d.ts","sourceRoot":"","sources":["../../src/ssm.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4C,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,qBAAqB,CAAC;AAG7B,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,qBAAqB,CAAA;CAAO,GAC1F,eAAe,CA8CjB"}

package/dist/esm/ssm.js

@@ -0,0 +1,54 @@
+import { GetParameterCommand, PutParameterCommand } from "@aws-sdk/client-ssm";
+import { AgentStateError, decodeAgentState, encodeAgentState, } from "@layervai/qurl/node";
+import { lockedStore, errorNamed } from "./store.js";
+export function createSSMAgentStateStore(client, name, options = {}) {
+    name = name.trim();
+    if (!client || !name)
+        throw new AgentStateError("INVALID_SSM_CONFIGURATION");
+    const { kmsKeyID, tier } = options;
+    return lockedStore({
+        async load(signal) {
+            signal?.throwIfAborted();
+            let result;
+            try {
+                result = await client.send(new GetParameterCommand({ Name: name, WithDecryption: true }), {
+                    abortSignal: signal,
+                });
+            }
+            catch (error) {
+                if (errorNamed(error, "ParameterNotFound"))
+                    throw new AgentStateError("NOT_FOUND");
+                throw error;
+            }
+            if (typeof result.Parameter?.Value !== "string")
+                throw new AgentStateError("INVALID_STATE");
+            const raw = Buffer.from(result.Parameter.Value);
+            try {
+                return decodeAgentState(raw);
+            }
+            finally {
+                raw.fill(0);
+            }
+        },
+        async save(state, signal) {
+            signal?.throwIfAborted();
+            const raw = encodeAgentState(state);
+            try {
+                if (raw.length > (tier === "Advanced" || tier === "Intelligent-Tiering" ? 8192 : 4096))
+                    throw new AgentStateError("SSM_SIZE_LIMIT");
+                await client.send(new PutParameterCommand({
+                    Name: name,
+                    Value: raw.toString(),
+                    Type: "SecureString",
+                    Overwrite: true,
+                    KeyId: kmsKeyID,
+                    Tier: tier,
+                }), { abortSignal: signal });
+            }
+            finally {
+                raw.fill(0);
+            }
+        },
+    });
+}
+//# sourceMappingURL=ssm.js.map

package/dist/esm/ssm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssm.js","sourceRoot":"","sources":["../../src/ssm.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAkB,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,gBAAgB,GAEjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,UAAU,wBAAwB,CACtC,MAAiB,EACjB,IAAY,EACZ,OAAO,GAAkF,EAAE;IAE3F,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACnB,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,eAAe,CAAC,2BAA2B,CAAC,CAAC;IAC7E,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IACnC,OAAO,WAAW,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,MAAM;YACf,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,IAAI,MAAM,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,EAAE;oBACxF,WAAW,EAAE,MAAM;iBACpB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,UAAU,CAAC,KAAK,EAAE,mBAAmB,CAAC;oBAAE,MAAM,IAAI,eAAe,CAAC,WAAW,CAAC,CAAC;gBACnF,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,OAAO,MAAM,CAAC,SAAS,EAAE,KAAK,KAAK,QAAQ;gBAAE,MAAM,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;YAC5F,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAChD,IAAI,CAAC;gBACH,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAC/B,CAAC;oBAAS,CAAC;gBACT,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACd,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM;YACtB,MAAM,EAAE,cAAc,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;oBACpF,MAAM,IAAI,eAAe,CAAC,gBAAgB,CAAC,CAAC;gBAC9C,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,mBAAmB,CAAC;oBACtB,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE;oBACrB,IAAI,EAAE,cAAc;oBACpB,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,QAAQ;oBACf,IAAI,EAAE,IAAI;iBACX,CAAC,EACF,EAAE,WAAW,EAAE,MAAM,EAAE,CACxB,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/esm/store.d.ts

@@ -0,0 +1,5 @@
+import type { AgentStateStore } from "@layervai/qurl/node";
+/** SSM and Secrets Manager have no transaction lock. One process must own each agent state. */
+export declare function lockedStore(store: Omit<AgentStateStore, "withLock">): AgentStateStore;
+export declare function errorNamed(error: unknown, name: string): boolean;
+//# sourceMappingURL=store.d.ts.map

package/dist/esm/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,+FAA+F;AAC/F,wBAAgB,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,GAAG,eAAe,CAmErF;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhE"}

package/dist/esm/store.js

@@ -0,0 +1,82 @@
+/** SSM and Secrets Manager have no transaction lock. One process must own each agent state. */
+export function lockedStore(store) {
+    let tail = Promise.resolve();
+    const result = {
+        ...store,
+        save(state, signal) {
+            const snapshot = structuredClone(state);
+            return result.withLock((locked) => locked.save(snapshot, signal), signal);
+        },
+        async withLock(operation, signal) {
+            let release;
+            const previous = tail;
+            tail = new Promise((resolve) => {
+                release = resolve;
+            });
+            let entered = false;
+            let abort;
+            try {
+                if (signal) {
+                    await Promise.race([
+                        previous,
+                        new Promise((_, reject) => {
+                            abort = () => reject(signal.reason);
+                            signal.addEventListener("abort", abort, { once: true });
+                            if (signal.aborted)
+                                abort();
+                        }),
+                    ]);
+                }
+                else
+                    await previous;
+                entered = true;
+                signal?.throwIfAborted();
+                let active = true;
+                const check = () => {
+                    if (!active)
+                        throw new Error("qURL AWS state lock has expired");
+                };
+                const scoped = {
+                    load: async (nextSignal) => {
+                        check();
+                        const effective = nextSignal ?? signal;
+                        effective?.throwIfAborted();
+                        const state = await store.load(effective);
+                        check();
+                        effective?.throwIfAborted();
+                        return state;
+                    },
+                    save: async (state, nextSignal) => {
+                        check();
+                        const effective = nextSignal ?? signal;
+                        effective?.throwIfAborted();
+                        return store.save(state, effective);
+                    },
+                    withLock: async (operation) => {
+                        check();
+                        return operation(scoped);
+                    },
+                };
+                try {
+                    return await operation(scoped);
+                }
+                finally {
+                    active = false;
+                }
+            }
+            finally {
+                if (abort)
+                    signal?.removeEventListener("abort", abort);
+                if (entered)
+                    release();
+                else
+                    void previous.then(release);
+            }
+        },
+    };
+    return result;
+}
+export function errorNamed(error, name) {
+    return error instanceof Error && error.name === name;
+}
+//# sourceMappingURL=store.js.map

package/dist/esm/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/store.ts"],"names":[],"mappings":"AAEA,+FAA+F;AAC/F,MAAM,UAAU,WAAW,CAAC,KAAwC;IAClE,IAAI,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAoB;QAC9B,GAAG,KAAK;QACR,IAAI,CAAC,KAAK,EAAE,MAAM;YAChB,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACxC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAC5E,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM;YAC9B,IAAI,OAAoB,CAAC;YACzB,MAAM,QAAQ,GAAG,IAAI,CAAC;YACtB,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBACnC,OAAO,GAAG,OAAO,CAAC;YACpB,CAAC,CAAC,CAAC;YACH,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,KAA+B,CAAC;YACpC,IAAI,CAAC;gBACH,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,OAAO,CAAC,IAAI,CAAC;wBACjB,QAAQ;wBACR,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;4BAC/B,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;4BACpC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;4BACxD,IAAI,MAAM,CAAC,OAAO;gCAAE,KAAK,EAAE,CAAC;wBAC9B,CAAC,CAAC;qBACH,CAAC,CAAC;gBACL,CAAC;;oBAAM,MAAM,QAAQ,CAAC;gBACtB,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,EAAE,cAAc,EAAE,CAAC;gBACzB,IAAI,MAAM,GAAG,IAAI,CAAC;gBAClB,MAAM,KAAK,GAAG,GAAG,EAAE;oBACjB,IAAI,CAAC,MAAM;wBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBAClE,CAAC,CAAC;gBACF,MAAM,MAAM,GAAoB;oBAC9B,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;wBACzB,KAAK,EAAE,CAAC;wBACR,MAAM,SAAS,GAAG,UAAU,IAAI,MAAM,CAAC;wBACvC,SAAS,EAAE,cAAc,EAAE,CAAC;wBAC5B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;wBAC1C,KAAK,EAAE,CAAC;wBACR,SAAS,EAAE,cAAc,EAAE,CAAC;wBAC5B,OAAO,KAAK,CAAC;oBACf,CAAC;oBACD,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;wBAChC,KAAK,EAAE,CAAC;wBACR,MAAM,SAAS,GAAG,UAAU,IAAI,MAAM,CAAC;wBACvC,SAAS,EAAE,cAAc,EAAE,CAAC;wBAC5B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;oBACtC,CAAC;oBACD,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;wBAC5B,KAAK,EAAE,CAAC;wBACR,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;oBAC3B,CAAC;iBACF,CAAC;gBACF,IAAI,CAAC;oBACH,OAAO,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;gBACjC,CAAC;wBAAS,CAAC;oBACT,MAAM,GAAG,KAAK,CAAC;gBACjB,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,IAAI,KAAK;oBAAE,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACvD,IAAI,OAAO;oBAAE,OAAO,EAAE,CAAC;;oBAClB,KAAK,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;KACF,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAc,EAAE,IAAY;IACrD,OAAO,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AACvD,CAAC"}

package/package.json

@@ -0,0 +1,85 @@
+{
+  "name": "@layervai/qurl-aws",
+  "version": "2.0.0",
+  "type": "module",
+  "description": "AWS state adapters for qURL agent lifecycle",
+  "license": "MIT",
+  "files": [
+    "dist/"
+  ],
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/esm/index.d.ts",
+        "default": "./dist/esm/index.js"
+      },
+      "require": {
+        "types": "./dist/cjs/index.d.ts",
+        "default": "./dist/cjs/index.js"
+      }
+    },
+    "./ssm": {
+      "import": {
+        "types": "./dist/esm/ssm.d.ts",
+        "default": "./dist/esm/ssm.js"
+      },
+      "require": {
+        "types": "./dist/cjs/ssm.d.ts",
+        "default": "./dist/cjs/ssm.js"
+      }
+    },
+    "./secrets-manager": {
+      "import": {
+        "types": "./dist/esm/secrets-manager.d.ts",
+        "default": "./dist/esm/secrets-manager.js"
+      },
+      "require": {
+        "types": "./dist/cjs/secrets-manager.d.ts",
+        "default": "./dist/cjs/secrets-manager.js"
+      }
+    },
+    "./kms": {
+      "import": {
+        "types": "./dist/esm/kms.d.ts",
+        "default": "./dist/esm/kms.js"
+      },
+      "require": {
+        "types": "./dist/cjs/kms.d.ts",
+        "default": "./dist/cjs/kms.js"
+      }
+    }
+  },
+  "types": "./dist/esm/index.d.ts",
+  "scripts": {
+    "build": "node -e 'require(\"node:fs\").rmSync(\"dist\", {recursive:true, force:true})' && tsc -p tsconfig.json && tsc -p tsconfig.cjs.json && node -e 'require(\"node:fs\").writeFileSync(\"dist/cjs/package.json\", JSON.stringify({type:\"commonjs\"}))'"
+  },
+  "peerDependencies": {
+    "@layervai/qurl": "^2.0.0",
+    "@aws-sdk/client-ssm": "^3.1036.0",
+    "@aws-sdk/client-secrets-manager": "^3.1036.0",
+    "@aws-sdk/client-kms": "^3.1036.0"
+  },
+  "devDependencies": {
+    "@layervai/qurl": "file:../..",
+    "@aws-sdk/client-ssm": "3.1036.0",
+    "@aws-sdk/client-secrets-manager": "3.1036.0",
+    "@aws-sdk/client-kms": "3.1036.0"
+  },
+  "main": "./dist/cjs/index.js",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/layervai/qurl-typescript",
+    "directory": "packages/aws"
+  },
+  "peerDependenciesMeta": {
+    "@aws-sdk/client-ssm": {
+      "optional": true
+    },
+    "@aws-sdk/client-secrets-manager": {
+      "optional": true
+    },
+    "@aws-sdk/client-kms": {
+      "optional": true
+    }
+  }
+}