@open-agent-toolkit/cli 0.2.72 → 0.2.74

package/assets/skills/explainer-kit/scripts/lib/s3-static.mjs

@@ -1,759 +0,0 @@
-import { execFile as execFileCallback } from 'node:child_process';
-import { createHash, randomBytes as nodeRandomBytes } from 'node:crypto';
-import {
-  mkdtemp,
-  readFile,
-  realpath,
-  rename,
-  rm,
-  writeFile,
-} from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { basename, dirname, join, resolve, sep } from 'node:path';
-import { promisify } from 'node:util';
-
-import {
-  catalogFromManifest,
-  initiativeCatalogPath,
-  resolvePublicVerificationPolicy,
-  serializeInitiativeCatalog,
-  validateInitiativeCatalog,
-} from './catalog.mjs';
-import { validateContract } from './contracts.mjs';
-import { assertManifestPublishable } from './publication-policy.mjs';
-import {
-  composePublicationTarget,
-  describeRootDivergence,
-  isPrivatePublicHost,
-  normalizePublishRoots,
-  privatePublicRootAllowed,
-  rootDivergenceWarningSuppressed,
-} from './s3-roots.mjs';
-
-export {
-  composePublicationTarget,
-  normalizePublishRoots,
-} from './s3-roots.mjs';
-
-const execFile = promisify(execFileCallback);
-const SENTINEL_BODY = 'explainer-kit sentinel\n';
-const TRANSIENT_PATTERN =
-  /(?:timeout|timed out|connection reset|temporar|throttl|slowdown|service unavailable|\b5\d\d\b)/i;
-const AUTH_PATTERN =
-  /(?:credential|expired|sso session|access key|invalidclienttokenid|unrecognizedclient|token)/i;
-const NOT_FOUND_PATTERN = /(?:\b404\b|not found|nosuchkey)/i;
-
-export function createSentinelRelativePath(
-  runId,
-  randomBytes = nodeRandomBytes,
-) {
-  const safeRunId =
-    String(runId)
-      .toLowerCase()
-      .replace(/[^a-z0-9]+/g, '-')
-      .replace(/^-|-$/g, '') || 'run';
-  const suffix = randomBytes(16).toString('hex');
-  if (!/^[a-f0-9]{32}$/.test(suffix)) {
-    throw publishError(
-      'E_PUBLISH_INPUT',
-      'Sentinel randomness must provide 128 bits.',
-    );
-  }
-  return `.explainer-kit-sentinel/${safeRunId}-${suffix}.txt`;
-}
-
-export async function publishS3Static(request, dependencies = {}) {
-  if (dependencies.approved !== true) {
-    throw publishError(
-      'E_PUBLISH_APPROVAL',
-      'Publishing requires explicit human approval.',
-    );
-  }
-
-  const requestValidation = validateContract('publish-request', request);
-  if (!requestValidation.valid) {
-    throw publishError(
-      'E_PUBLISH_INPUT',
-      `Invalid publish request: ${requestValidation.errors[0].message}`,
-    );
-  }
-  const roots = normalizePublishRoots(request.s3Uri, request.publicBaseUrl);
-  const cwd = dependencies.cwd ?? process.cwd();
-  const siteRoot = resolve(cwd, request.siteRoot);
-  const manifestPath = resolve(cwd, request.manifestPath);
-  const manifest = await readJson(manifestPath, 'manifest');
-  const buildRecord =
-    manifest.outcome === 'incomplete'
-      ? await readJson(
-          resolve(dirname(manifestPath), manifest.buildRecord?.path ?? ''),
-          'build record',
-        )
-      : undefined;
-  assertManifestPublishable(manifest, { buildRecord });
-  const manifestValidation = validateContract('manifest', manifest);
-  if (!manifestValidation.valid) {
-    throw publishError(
-      'E_PUBLISH_INPUT',
-      `Invalid manifest: ${manifestValidation.errors[0].message}`,
-    );
-  }
-  const artifacts = await collectArtifacts(manifest, siteRoot);
-  const command = dependencies.command ?? defaultCommand;
-  const httpGet = dependencies.httpGet ?? defaultHttpGet;
-  const randomBytes = dependencies.randomBytes ?? nodeRandomBytes;
-  const now = dependencies.now ?? (() => new Date().toISOString());
-  const sleep = dependencies.sleep ?? defaultSleep;
-  const awsOptions = {
-    region: request.awsRegion,
-    profile: request.awsProfile,
-  };
-  const sentinelRelativePath = createSentinelRelativePath(
-    manifest.runId,
-    randomBytes,
-  );
-  const sentinelTargetPath = composePublicationTarget(
-    sentinelRelativePath,
-    roots,
-  );
-  // Resolved before the catalog is built: the catalog is hashed and uploaded
-  // before any public verification runs, so it must carry the policy up front.
-  const publicAccess =
-    request.schemaVersion === 'explainer-kit.publish-request/v1'
-      ? 'public'
-      : request.publicAccess;
-  const verificationPolicy = resolvePublicVerificationPolicy(publicAccess);
-
-  const divergence = describeRootDivergence(roots);
-  if (divergence && !rootDivergenceWarningSuppressed()) {
-    (dependencies.warn ?? ((message) => console.warn(message)))(
-      `explainer-kit: ${divergence}`,
-    );
-  }
-
-  const catalog = catalogFromManifest(manifest, roots.publicBaseUrl, {
-    publicAccess,
-  });
-  const catalogValidation = validateInitiativeCatalog(
-    catalog,
-    manifest,
-    roots.publicBaseUrl,
-    { publicAccess },
-  );
-  if (!catalogValidation.valid) {
-    throw publishError(
-      'E_PUBLISH_INPUT',
-      `Invalid initiative catalog: ${catalogValidation.errors[0].message}`,
-    );
-  }
-  const catalogBody = Buffer.from(serializeInitiativeCatalog(catalog));
-  const catalogManifestPath = initiativeCatalogPath(manifest.slug);
-  const catalogPublishPath = catalogManifestPath.slice('site/'.length);
-  if (artifacts.some(({ publishPath }) => publishPath === catalogPublishPath)) {
-    throw publishError(
-      'E_PUBLISH_INPUT',
-      `Generated catalog path collides with a manifest artifact: ${catalogManifestPath}`,
-    );
-  }
-  const sentinelDirectory = await mkdtemp(
-    join(tmpdir(), 'explainer-sentinel-'),
-  );
-  const sentinelBodyPath = join(sentinelDirectory, 'sentinel.txt');
-  const catalogBodyPath = join(sentinelDirectory, 'catalog.json');
-  const catalogArtifact = {
-    source: { kind: 'auxiliary', name: 'catalog' },
-    manifestPath: catalogManifestPath,
-    publishPath: catalogPublishPath,
-    filePath: catalogBodyPath,
-    hash: fileHash(catalogBody),
-    contentType: 'application/json',
-    cacheControl: 'public, max-age=300',
-  };
-  const publicationArtifacts = [...artifacts, catalogArtifact];
-  let sentinelUploaded = false;
-  let sentinelDeleted = false;
-
-  try {
-    await writeFile(sentinelBodyPath, SENTINEL_BODY, 'utf8');
-    await writeFile(catalogBodyPath, catalogBody);
-    await runAws(
-      command,
-      putObjectArgs({
-        roots,
-        relativePath: sentinelRelativePath,
-        bodyPath: sentinelBodyPath,
-        contentType: 'text/plain; charset=utf-8',
-        cacheControl: 'no-store',
-        hash: fileHash(Buffer.from(SENTINEL_BODY)),
-        awsOptions,
-      }),
-      { sleep },
-    );
-    sentinelUploaded = true;
-    const sentinelMetadata = await readObjectMetadata(
-      command,
-      headObjectArgs(roots, sentinelRelativePath, awsOptions),
-      { sleep },
-    );
-    const sentinelObjectVerification = await verifyObjectBytes({
-      command,
-      metadata: sentinelMetadata,
-      roots,
-      relativePath: sentinelRelativePath,
-      expectedHash: fileHash(Buffer.from(SENTINEL_BODY)),
-      downloadPath: join(sentinelDirectory, 'sentinel-download.txt'),
-      awsOptions,
-      sleep,
-    });
-    let sentinelPublicVerification = {
-      status: verificationPolicy.receiptSkipStatus,
-    };
-    if (verificationPolicy.verifyPublicly) {
-      const sentinelResponse = await httpGet(sentinelTargetPath.publicUrl);
-      if (
-        sentinelResponse.status < 200 ||
-        sentinelResponse.status > 299 ||
-        !responseBytes(sentinelResponse.body).equals(Buffer.from(SENTINEL_BODY))
-      ) {
-        throw publishError(
-          'E_PUBLISH_ROOTS',
-          'Public root did not serve the uploaded sentinel.',
-        );
-      }
-      sentinelPublicVerification = {
-        status: 'verified',
-        httpStatus: sentinelResponse.status,
-        hash: fileHash(responseBytes(sentinelResponse.body)),
-      };
-    }
-    await runAws(
-      command,
-      deleteObjectArgs(roots, sentinelRelativePath, awsOptions),
-      { sleep },
-    );
-    sentinelDeleted = true;
-
-    const receiptArtifacts = [];
-    for (const artifact of publicationArtifacts) {
-      const target = composePublicationTarget(artifact.publishPath, roots);
-      const metadata = await readExistingMetadata(
-        command,
-        headObjectArgs(roots, artifact.publishPath, awsOptions),
-        { sleep },
-      );
-      if (!matchesPublishedArtifact(metadata, artifact)) {
-        await runAws(
-          command,
-          putObjectArgs({
-            roots,
-            relativePath: artifact.publishPath,
-            bodyPath: artifact.filePath,
-            contentType: artifact.contentType,
-            cacheControl: artifact.cacheControl,
-            hash: artifact.hash,
-            awsOptions,
-          }),
-          { sleep },
-        );
-      }
-      const uploadedMetadata = await readObjectMetadata(
-        command,
-        headObjectArgs(roots, artifact.publishPath, awsOptions),
-        { sleep },
-      );
-      assertMetadata(uploadedMetadata, artifact);
-      const objectVerification = await verifyObjectBytes({
-        command,
-        metadata: uploadedMetadata,
-        roots,
-        relativePath: artifact.publishPath,
-        expectedHash: artifact.hash,
-        downloadPath: join(
-          sentinelDirectory,
-          `object-${receiptArtifacts.length}.download`,
-        ),
-        awsOptions,
-        sleep,
-      });
-      let publicVerification = {
-        status: verificationPolicy.receiptSkipStatus,
-      };
-      if (verificationPolicy.verifyPublicly) {
-        const response = await httpGet(target.publicUrl);
-        if (response.status < 200 || response.status > 299) {
-          throw publishError(
-            'E_PUBLISH_VERIFY',
-            `Public verification failed for ${artifact.manifestPath}.`,
-          );
-        }
-        const servedType = headerValue(response.headers, 'content-type');
-        if (!contentTypesMatch(servedType, artifact.contentType)) {
-          throw publishError(
-            'E_PUBLISH_VERIFY',
-            `Public content type mismatch for ${artifact.manifestPath}.`,
-          );
-        }
-        const publicHash = fileHash(responseBytes(response.body));
-        if (publicHash !== artifact.hash) {
-          throw publishError(
-            'E_PUBLISH_VERIFY',
-            `Public bytes do not match the manifest for ${artifact.manifestPath}.`,
-          );
-        }
-        publicVerification = {
-          status: 'verified',
-          httpStatus: response.status,
-          hash: publicHash,
-        };
-      }
-      receiptArtifacts.push({
-        source: artifact.source,
-        relativePath: artifact.manifestPath,
-        hash: artifact.hash,
-        s3Uri: target.s3Uri,
-        publicUrl: target.publicUrl,
-        contentType: artifact.contentType,
-        objectVerification,
-        publicVerification,
-      });
-    }
-
-    const receipt = {
-      schemaVersion: 'explainer-kit.publish-receipt/v2',
-      provider: 's3-static',
-      publishedAt: now(),
-      publicAccess,
-      // Durable trace for the anti-SSRF opt-in. Without it, a run that
-      // published to an internal address with the control disabled is
-      // indistinguishable in retained evidence from one that did not, because
-      // the variable is read straight from the environment and enters no other
-      // record. Emitted only in that exceptional case, so ordinary receipts are
-      // byte-identical to before.
-      ...(privatePublicRootAllowed() &&
-        isPrivatePublicHost(new URL(roots.publicBaseUrl).hostname) && {
-          publicRootPolicy: 'private-allowed',
-        }),
-      roots: { s3Uri: roots.s3Uri, publicBaseUrl: roots.publicBaseUrl },
-      sentinel: {
-        relativePath: sentinelRelativePath,
-        objectVerification: sentinelObjectVerification,
-        publicVerification: sentinelPublicVerification,
-        deleted: sentinelDeleted,
-      },
-      artifacts: receiptArtifacts,
-    };
-    const receiptValidation = validateContract('publish-receipt', receipt, {
-      manifest,
-      catalogArtifact: {
-        relativePath: catalogArtifact.manifestPath,
-        hash: catalogArtifact.hash,
-      },
-    });
-    if (!receiptValidation.valid) {
-      throw publishError(
-        'E_PUBLISH_VERIFY',
-        `Invalid publish receipt: ${receiptValidation.errors[0].message}`,
-      );
-    }
-    const receiptPath =
-      dependencies.receiptPath ??
-      join(dirname(manifestPath), 'publish-receipt.json');
-    await writeJsonAtomic(receiptPath, receipt);
-    return receipt;
-  } finally {
-    if (sentinelUploaded && !sentinelDeleted) {
-      try {
-        await runAws(
-          command,
-          deleteObjectArgs(roots, sentinelRelativePath, awsOptions),
-          { sleep },
-        );
-      } catch {
-        // Preserve the original failure. The missing cleanup remains observable
-        // because no successful receipt is emitted.
-      }
-    }
-    await rm(sentinelDirectory, { recursive: true, force: true });
-  }
-}
-
-async function collectArtifacts(manifest, siteRoot) {
-  const canonicalSiteRoot = await realpath(siteRoot);
-  const sitePrefix = `${basename(canonicalSiteRoot)}/`;
-  const seen = new Set();
-  const artifacts = [];
-  for (const entry of manifest.artifacts) {
-    if (entry.status !== 'built' || typeof entry.renderedPath !== 'string') {
-      continue;
-    }
-    if (!entry.renderedPath.startsWith(sitePrefix)) {
-      throw publishError(
-        'E_PUBLISH_INPUT',
-        `Rendered path is outside the site root: ${entry.renderedPath}`,
-      );
-    }
-    const publishPath = entry.renderedPath.slice(sitePrefix.length);
-    if (
-      !publishPath ||
-      publishPath.startsWith('/') ||
-      publishPath.includes('..')
-    ) {
-      throw publishError(
-        'E_PUBLISH_INPUT',
-        `Unsafe publish path: ${entry.renderedPath}`,
-      );
-    }
-    if (seen.has(publishPath)) {
-      throw publishError(
-        'E_PUBLISH_INPUT',
-        `Duplicate publish path: ${publishPath}`,
-      );
-    }
-    seen.add(publishPath);
-    const filePath = await realpath(join(canonicalSiteRoot, publishPath));
-    if (
-      filePath !== canonicalSiteRoot &&
-      !filePath.startsWith(`${canonicalSiteRoot}${sep}`)
-    ) {
-      throw publishError(
-        'E_PUBLISH_INPUT',
-        `Artifact escapes the site root: ${entry.renderedPath}`,
-      );
-    }
-    const bytes = await readFile(filePath);
-    const actualHash = fileHash(bytes);
-    if (actualHash !== entry.hash) {
-      throw publishError(
-        'E_PUBLISH_INPUT',
-        `Artifact hash mismatch: ${entry.renderedPath}`,
-      );
-    }
-    const contentType = contentTypeFor(publishPath, entry.mediaType);
-    artifacts.push({
-      source: { kind: 'manifest', artifactId: entry.id },
-      manifestPath: entry.renderedPath,
-      publishPath,
-      filePath,
-      hash: actualHash,
-      contentType,
-      cacheControl: 'public, max-age=300',
-    });
-  }
-  return artifacts;
-}
-
-function putObjectArgs({
-  roots,
-  relativePath,
-  bodyPath,
-  contentType,
-  cacheControl,
-  hash,
-  awsOptions,
-}) {
-  return withAwsOptions(
-    [
-      's3api',
-      'put-object',
-      '--bucket',
-      roots.bucket,
-      '--key',
-      objectKey(roots, relativePath),
-      '--body',
-      bodyPath,
-      '--content-type',
-      contentType,
-      '--cache-control',
-      cacheControl,
-      '--metadata',
-      `explainer-sha256=${hash.slice('sha256:'.length)}`,
-      '--checksum-sha256',
-      Buffer.from(hash.slice('sha256:'.length), 'hex').toString('base64'),
-      '--no-cli-pager',
-    ],
-    awsOptions,
-  );
-}
-
-function headObjectArgs(roots, relativePath, awsOptions) {
-  return withAwsOptions(
-    [
-      's3api',
-      'head-object',
-      '--bucket',
-      roots.bucket,
-      '--key',
-      objectKey(roots, relativePath),
-      '--checksum-mode',
-      'ENABLED',
-      '--output',
-      'json',
-      '--no-cli-pager',
-    ],
-    awsOptions,
-  );
-}
-
-function getObjectArgs(roots, relativePath, downloadPath, awsOptions) {
-  return withAwsOptions(
-    [
-      's3api',
-      'get-object',
-      '--bucket',
-      roots.bucket,
-      '--key',
-      objectKey(roots, relativePath),
-      '--checksum-mode',
-      'ENABLED',
-      downloadPath,
-      '--no-cli-pager',
-    ],
-    awsOptions,
-  );
-}
-
-function deleteObjectArgs(roots, relativePath, awsOptions) {
-  return withAwsOptions(
-    [
-      's3api',
-      'delete-object',
-      '--bucket',
-      roots.bucket,
-      '--key',
-      objectKey(roots, relativePath),
-      '--no-cli-pager',
-    ],
-    awsOptions,
-  );
-}
-
-function withAwsOptions(args, { region, profile }) {
-  const result = [...args, '--region', region];
-  if (profile) {
-    result.push('--profile', profile);
-  }
-  return result;
-}
-
-async function runAws(
-  command,
-  args,
-  { sleep = defaultSleep, attempts = 3, allowNotFound = false } = {},
-) {
-  for (let attempt = 1; attempt <= attempts; attempt += 1) {
-    try {
-      return await command('aws', args);
-    } catch (caught) {
-      const diagnostic = `${caught?.message ?? ''}\n${caught?.stderr ?? ''}`;
-      if (AUTH_PATTERN.test(diagnostic)) {
-        throw publishError(
-          'E_PUBLISH_AUTH',
-          'AWS authentication failed; refresh the configured credential chain and retry.',
-        );
-      }
-      if (allowNotFound && NOT_FOUND_PATTERN.test(diagnostic)) {
-        return null;
-      }
-      if (!TRANSIENT_PATTERN.test(diagnostic) || attempt === attempts) {
-        throw publishError('E_PUBLISH_AWS', 'AWS object operation failed.');
-      }
-      await sleep(50 * 2 ** (attempt - 1));
-    }
-  }
-}
-
-async function readExistingMetadata(command, args, { sleep }) {
-  const result = await runAws(command, args, {
-    sleep,
-    allowNotFound: true,
-  });
-  if (result === null) return null;
-  try {
-    return JSON.parse(result.stdout || '{}');
-  } catch {
-    throw publishError(
-      'E_PUBLISH_VERIFY',
-      'AWS returned invalid object metadata.',
-    );
-  }
-}
-
-async function readObjectMetadata(command, args, { sleep }) {
-  const result = await runAws(command, args, { sleep });
-  return parseAwsJson(result.stdout);
-}
-
-function matchesPublishedArtifact(metadata, artifact) {
-  return (
-    metadata?.Metadata?.['explainer-sha256'] ===
-      artifact.hash.slice('sha256:'.length) &&
-    metadata.ContentType === artifact.contentType &&
-    metadata.CacheControl === artifact.cacheControl
-  );
-}
-
-function assertMetadata(metadata, artifact) {
-  if (!matchesPublishedArtifact(metadata, artifact)) {
-    throw publishError(
-      'E_PUBLISH_VERIFY',
-      `Uploaded metadata mismatch for ${artifact.manifestPath}.`,
-    );
-  }
-}
-
-async function verifyObjectBytes({
-  command,
-  metadata,
-  roots,
-  relativePath,
-  expectedHash,
-  downloadPath,
-  awsOptions,
-  sleep,
-}) {
-  const expectedBase64 = Buffer.from(
-    expectedHash.slice('sha256:'.length),
-    'hex',
-  ).toString('base64');
-  if (typeof metadata.ChecksumSHA256 === 'string') {
-    if (metadata.ChecksumSHA256 !== expectedBase64) {
-      throw publishError(
-        'E_PUBLISH_VERIFY',
-        `Authenticated object checksum mismatch for ${relativePath}.`,
-      );
-    }
-    return {
-      status: 'verified',
-      method: 'service-checksum',
-      hash: expectedHash,
-    };
-  }
-
-  try {
-    await runAws(
-      command,
-      getObjectArgs(roots, relativePath, downloadPath, awsOptions),
-      { sleep },
-    );
-  } catch {
-    throw publishError(
-      'E_PUBLISH_VERIFY',
-      `Authenticated object-byte verification is unavailable for ${relativePath}.`,
-    );
-  }
-  if (fileHash(await readFile(downloadPath)) !== expectedHash) {
-    throw publishError(
-      'E_PUBLISH_VERIFY',
-      `Authenticated object bytes do not match ${relativePath}.`,
-    );
-  }
-  return {
-    status: 'verified',
-    method: 'authenticated-download',
-    hash: expectedHash,
-  };
-}
-
-function parseAwsJson(stdout) {
-  try {
-    return JSON.parse(stdout || '{}');
-  } catch {
-    throw publishError(
-      'E_PUBLISH_VERIFY',
-      'AWS returned invalid object metadata.',
-    );
-  }
-}
-
-function contentTypeFor(path, declared) {
-  const extension = path.slice(path.lastIndexOf('.')).toLowerCase();
-  const known = {
-    '.css': 'text/css; charset=utf-8',
-    '.html': 'text/html; charset=utf-8',
-    '.js': 'text/javascript; charset=utf-8',
-    '.json': 'application/json',
-    '.svg': 'image/svg+xml',
-    '.txt': 'text/plain; charset=utf-8',
-  };
-  return known[extension] ?? declared ?? 'application/octet-stream';
-}
-
-function contentTypesMatch(served, expected) {
-  if (!served) {
-    return false;
-  }
-  return (
-    served.toLowerCase().split(';')[0].trim() ===
-    expected.toLowerCase().split(';')[0].trim()
-  );
-}
-
-function objectKey(roots, relativePath) {
-  return roots.keyPrefix ? `${roots.keyPrefix}/${relativePath}` : relativePath;
-}
-
-function fileHash(bytes) {
-  return `sha256:${createHash('sha256').update(bytes).digest('hex')}`;
-}
-
-function headerValue(headers, name) {
-  if (typeof headers?.get === 'function') {
-    return headers.get(name);
-  }
-  return headers?.[name] ?? headers?.[name.toLowerCase()];
-}
-
-async function readJson(path, label) {
-  try {
-    return JSON.parse(await readFile(path, 'utf8'));
-  } catch {
-    throw publishError('E_PUBLISH_INPUT', `Could not read ${label} JSON.`);
-  }
-}
-
-async function writeJsonAtomic(path, value) {
-  const temporary = `${path}.tmp-${process.pid}-${nodeRandomBytes(6).toString('hex')}`;
-  await writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, {
-    flag: 'wx',
-  });
-  await rename(temporary, path);
-}
-
-async function defaultCommand(file, args) {
-  return execFile(file, args, { maxBuffer: 1024 * 1024 });
-}
-
-export async function defaultHttpGet(url, { fetchImpl = fetch } = {}) {
-  // A canonical public artifact URL is uploaded to a known key and should never
-  // legitimately redirect. Following redirects turned public verification into
-  // an outbound GET primitive that a third party could bounce inward, so a
-  // redirect is a verification failure rather than something to chase.
-  const response = await fetchImpl(url, {
-    redirect: 'error',
-    signal: AbortSignal.timeout(15_000),
-  });
-  return {
-    status: response.status,
-    headers: response.headers,
-    body: Buffer.from(await response.arrayBuffer()),
-  };
-}
-
-function responseBytes(body) {
-  if (Buffer.isBuffer(body)) return body;
-  if (body instanceof Uint8Array) {
-    return Buffer.from(body.buffer, body.byteOffset, body.byteLength);
-  }
-  if (typeof body === 'string') return Buffer.from(body);
-  throw publishError(
-    'E_PUBLISH_VERIFY',
-    'Public verification returned an unreadable response body.',
-  );
-}
-
-function defaultSleep(milliseconds) {
-  return new Promise((resolveSleep) => setTimeout(resolveSleep, milliseconds));
-}
-
-function publishError(code, message) {
-  return Object.assign(new Error(message), { code });
-}