@sayknow-cli/ai 0.3.12 → 0.3.13

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@sayknow-cli/ai",
-	"version": "0.3.12",
+	"version": "0.3.13",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://sayknow-cli.com",
 	"author": "jaybeyond",
@@ -27,7 +27,7 @@
 		"api"
 	],
 	"main": "./src/index.ts",
-	"types": "./dist/types/index.d.ts",
+	"types": "./src/index.ts",
 	"bin": {
 		"pi-ai": "./src/cli.ts"
 	},
@@ -43,7 +43,7 @@
 	"dependencies": {
 		"@anthropic-ai/sdk": "^0.94.0",
 		"@bufbuild/protobuf": "^2.12.0",
-		"@sayknow-cli/utils": "0.3.12",
+		"@sayknow-cli/utils": "0.3.13",
 		"openai": "^6.36.0",
 		"partial-json": "^0.1.7",
 		"zod": "4.4.3"
@@ -57,88 +57,87 @@
 	"files": [
 		"src",
 		"README.md",
-		"CHANGELOG.md",
-		"dist/types"
+		"CHANGELOG.md"
 	],
 	"exports": {
 		".": {
-			"types": "./dist/types/index.d.ts",
+			"types": "./src/index.ts",
 			"import": "./src/index.ts"
 		},
 		"./*": {
-			"types": "./dist/types/*.d.ts",
+			"types": "./src/*.ts",
 			"import": "./src/*.ts"
 		},
 		"./auth-broker": {
-			"types": "./dist/types/auth-broker/index.d.ts",
+			"types": "./src/auth-broker/index.ts",
 			"import": "./src/auth-broker/index.ts"
 		},
 		"./auth-broker/*": {
-			"types": "./dist/types/auth-broker/*.d.ts",
+			"types": "./src/auth-broker/*.ts",
 			"import": "./src/auth-broker/*.ts"
 		},
 		"./auth-gateway": {
-			"types": "./dist/types/auth-gateway/index.d.ts",
+			"types": "./src/auth-gateway/index.ts",
 			"import": "./src/auth-gateway/index.ts"
 		},
 		"./auth-gateway/*": {
-			"types": "./dist/types/auth-gateway/*.d.ts",
+			"types": "./src/auth-gateway/*.ts",
 			"import": "./src/auth-gateway/*.ts"
 		},
 		"./models.json": {
-			"types": "./dist/types/models.json.d.d.ts",
+			"types": "./src/models.json.d.ts",
 			"import": "./src/models.json"
 		},
 		"./provider-models": {
-			"types": "./dist/types/provider-models/index.d.ts",
+			"types": "./src/provider-models/index.ts",
 			"import": "./src/provider-models/index.ts"
 		},
 		"./provider-models/*": {
-			"types": "./dist/types/provider-models/*.d.ts",
+			"types": "./src/provider-models/*.ts",
 			"import": "./src/provider-models/*.ts"
 		},
 		"./providers/*": {
-			"types": "./dist/types/providers/*.d.ts",
+			"types": "./src/providers/*.ts",
 			"import": "./src/providers/*.ts"
 		},
 		"./providers/cursor/gen/*": {
-			"types": "./dist/types/providers/cursor/gen/*.d.ts",
+			"types": "./src/providers/cursor/gen/*.ts",
 			"import": "./src/providers/cursor/gen/*.ts"
 		},
 		"./providers/openai-codex/*": {
-			"types": "./dist/types/providers/openai-codex/*.d.ts",
+			"types": "./src/providers/openai-codex/*.ts",
 			"import": "./src/providers/openai-codex/*.ts"
 		},
 		"./usage/*": {
-			"types": "./dist/types/usage/*.d.ts",
+			"types": "./src/usage/*.ts",
 			"import": "./src/usage/*.ts"
 		},
 		"./utils/*": {
-			"types": "./dist/types/utils/*.d.ts",
+			"types": "./src/utils/*.ts",
 			"import": "./src/utils/*.ts"
 		},
 		"./utils/discovery": {
-			"types": "./dist/types/utils/discovery/index.d.ts",
+			"types": "./src/utils/discovery/index.ts",
 			"import": "./src/utils/discovery/index.ts"
 		},
 		"./utils/discovery/*": {
-			"types": "./dist/types/utils/discovery/*.d.ts",
+			"types": "./src/utils/discovery/*.ts",
 			"import": "./src/utils/discovery/*.ts"
 		},
 		"./utils/oauth": {
-			"types": "./dist/types/utils/oauth/index.d.ts",
+			"types": "./src/utils/oauth/index.ts",
 			"import": "./src/utils/oauth/index.ts"
 		},
 		"./utils/oauth/*": {
-			"types": "./dist/types/utils/oauth/*.d.ts",
+			"types": "./src/utils/oauth/*.ts",
 			"import": "./src/utils/oauth/*.ts"
 		},
 		"./utils/schema": {
-			"types": "./dist/types/utils/schema/index.d.ts",
+			"types": "./src/utils/schema/index.ts",
 			"import": "./src/utils/schema/index.ts"
 		},
 		"./utils/schema/*": {
-			"types": "./dist/types/utils/schema/*.d.ts",
+			"types": "./src/utils/schema/*.ts",
 			"import": "./src/utils/schema/*.ts"
 		},
 		"./*.js": "./src/*.ts"

package/src/providers/amazon-bedrock.ts

@@ -7,7 +7,7 @@
  * Bun's native `HTTPS_PROXY` support.
  */
 
-import { $env, $flag, extractHttpStatusFromError, fetchWithRetry } from "@sayknow-cli/utils";
+import { $credentialEnv, $env, $flag, extractHttpStatusFromError, fetchWithRetry } from "@sayknow-cli/utils";
 import type { Effort } from "../model-thinking";
 import { mapEffortToAnthropicAdaptiveEffort, requireSupportedEffort } from "../model-thinking";
 import { calculateCost } from "../models";
@@ -39,8 +39,10 @@ import {
 	markToolChoiceIncapability,
 	resolveToolChoice,
 } from "../utils/tool-choice-capability";
+import { isValidBedrockBearerToken } from "./aws-credential-config";
 import { resolveAwsCredentials } from "./aws-credentials";
 import { decodeEventStream } from "./aws-eventstream";
+import type { AwsCredentials } from "./aws-sigv4";
 import { signRequest } from "./aws-sigv4";
 import { transformMessages } from "./transform-messages";
 
@@ -162,6 +164,8 @@ interface MetadataEvent {
 	};
 }
 
+type BedrockAuthMode = { kind: "bearer"; token: string } | { kind: "sigv4"; credentials: AwsCredentials };
+
 export const streamBedrock: StreamFunction<"bedrock-converse-stream"> = (
 	model: Model<"bedrock-converse-stream">,
 	context: Context,
@@ -233,34 +237,44 @@ export const streamBedrock: StreamFunction<"bedrock-converse-stream"> = (
 				body: commandInput,
 			};
 
-			let credentials: { accessKeyId: string; secretAccessKey: string; sessionToken?: string };
-			if ($flag("AWS_BEDROCK_SKIP_AUTH")) {
-				credentials = { accessKeyId: "dummy-access-key", secretAccessKey: "dummy-secret-key" };
-			} else {
-				credentials = await resolveAwsCredentials({
-					profile: options.profile,
-					region,
-					signal: options.signal,
-				});
+			const bearerToken = $credentialEnv("AWS_BEARER_TOKEN_BEDROCK");
+			if (bearerToken && !isValidBedrockBearerToken(bearerToken)) {
+				throw new Error("AWS_BEARER_TOKEN_BEDROCK contains unsafe control characters.");
 			}
-
+			const authMode: BedrockAuthMode = bearerToken
+				? { kind: "bearer", token: bearerToken }
+				: {
+						kind: "sigv4",
+						credentials: $flag("AWS_BEDROCK_SKIP_AUTH")
+							? { accessKeyId: "dummy-access-key", secretAccessKey: "dummy-secret-key" }
+							: await resolveAwsCredentials({ profile: options.profile, region, signal: options.signal }),
+					};
 			const bodyText = JSON.stringify(commandInput);
 			const body = new TextEncoder().encode(bodyText);
 			const baseHeaders: Record<string, string> = {
 				"content-type": "application/json",
 				accept: "application/vnd.amazon.eventstream",
 			};
-			const signed = await signRequest({
-				method: "POST",
-				host,
-				path: urlPath,
-				body,
-				region,
-				service: "bedrock",
-				credentials,
-				headers: baseHeaders,
-			});
-			const requestHeaders: Record<string, string> = { ...baseHeaders, ...signed };
+			const buildRequestHeaders = async (requestBody: Uint8Array): Promise<Record<string, string>> => {
+				const headers = new Headers(baseHeaders);
+				if (authMode.kind === "bearer") {
+					headers.set("authorization", `Bearer ${authMode.token}`);
+					return Object.fromEntries(headers);
+				}
+				const signed = await signRequest({
+					method: "POST",
+					host,
+					path: urlPath,
+					body: requestBody,
+					region,
+					service: "bedrock",
+					credentials: authMode.credentials,
+					headers: baseHeaders,
+				});
+				for (const [name, value] of Object.entries(signed)) headers.set(name, value);
+				return Object.fromEntries(headers);
+			};
+			const requestHeaders = await buildRequestHeaders(body);
 			const sentForcedToolChoice = Boolean(toolConfig?.toolChoice?.any || toolConfig?.toolChoice?.tool);
 			let fallbackRan = false;
 			const retryWithoutForcedToolChoice = async (reason: string) => {
@@ -279,20 +293,10 @@ export const streamBedrock: StreamFunction<"bedrock-converse-stream"> = (
 				stripBedrockForcedToolChoiceForRetry(commandInput);
 				const retryBodyText = JSON.stringify(commandInput);
 				const retryBody = new TextEncoder().encode(retryBodyText);
-				const retrySigned = await signRequest({
-					method: "POST",
-					host,
-					path: urlPath,
-					body: retryBody,
-					region,
-					service: "bedrock",
-					credentials,
-					headers: baseHeaders,
-				});
 				if (rawRequestDump) rawRequestDump.body = commandInput;
 				return fetchWithRetry(url, {
 					method: "POST",
-					headers: { ...baseHeaders, ...retrySigned },
+					headers: await buildRequestHeaders(retryBody),
 					body: retryBody,
 					signal: options.signal,
 					maxAttempts: 1,

package/src/providers/anthropic.ts

@@ -1341,6 +1341,17 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 				}
 				blocksByAnthropicIndex.set(anthropicIndex, block);
 			};
+			const resetOutputForRetry = () => {
+				output.content.length = 0;
+				output.responseId = undefined;
+				output.errorKind = undefined;
+				output.errorStatus = undefined;
+				output.errorMessage = strictFallbackErrorMessage;
+				output.providerPayload = undefined;
+				output.usage = createEmptyUsage(copilotDynamicHeaders?.premiumRequests);
+				output.stopReason = "stop";
+				firstTokenTime = undefined;
+			};
 			const idleTimeoutMs = options?.streamIdleTimeoutMs ?? getStreamIdleTimeoutMs();
 			const firstEventTimeoutMs = options?.streamFirstEventTimeoutMs ?? getStreamFirstEventTimeoutMs(idleTimeoutMs);
 			stream.push({ type: "start", partial: output });
@@ -1360,6 +1371,7 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 				const { requestSignal } = activeAbortTracker;
 				const anthropicRequest = client.messages.create({ ...params, stream: true }, { signal: requestSignal });
 				let streamedReplayUnsafeContent = false;
+				let sawProviderSafetyStop = false;
 
 				try {
 					const {
@@ -1386,6 +1398,12 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 						abortSignal: options?.signal,
 					})) {
 						sawEvent = true;
+						if (sawProviderSafetyStop) {
+							if (event.type === "message_stop") {
+								sawTerminalEnvelope = true;
+							}
+							continue;
+						}
 
 						if (event.type === "message_start") {
 							if (sawMessageStart) {
@@ -1545,26 +1563,34 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 							}
 						} else if (event.type === "message_delta") {
 							const rawStopReason = event.delta.stop_reason as string | null | undefined;
+							const stopDetails = event.delta.stop_details;
+							const isProviderSafetyStop =
+								rawStopReason === "refusal" || rawStopReason === "sensitive" || stopDetails?.type === "refusal";
 							if (rawStopReason) {
-								output.stopReason = mapStopReason(rawStopReason);
+								output.stopReason = isProviderSafetyStop ? "error" : mapStopReason(rawStopReason);
 								sawTerminalEnvelope = true;
 							}
-							const stopDetails = event.delta.stop_details;
-							if (stopDetails && stopDetails.type === "refusal") {
-								const explanation = stopDetails.explanation?.trim();
-								const category = stopDetails.category;
-								const label = category ? `Refusal (${category})` : "Refusal";
-								output.errorMessage = explanation ? `${label}: ${explanation}` : label;
+							if (isProviderSafetyStop) {
+								sawProviderSafetyStop = true;
+								sawTerminalEnvelope = true;
+								output.stopReason = "error";
+								output.errorKind = "provider_safety_stop";
+								if (stopDetails?.type === "refusal") {
+									const explanation = stopDetails.explanation?.trim();
+									const category = stopDetails.category;
+									const label = category ? `Refusal (${category})` : "Refusal";
+									output.errorMessage = explanation ? `${label}: ${explanation}` : label;
+								} else if (!output.errorMessage) {
+									output.errorMessage =
+										rawStopReason === "refusal"
+											? "Refusal (no details provided)"
+											: "Content flagged by safety filters";
+								}
 							} else if (output.stopReason === "error" && !output.errorMessage) {
-								// Anthropic flagged an error-class stop (refusal / sensitive) without
-								// populating stop_details. Surface the raw reason instead of falling
-								// through to the generic "unknown error" string when we throw below.
-								output.errorMessage =
-									rawStopReason === "refusal"
-										? "Refusal (no details provided)"
-										: rawStopReason === "sensitive"
-											? "Content flagged by safety filters"
-											: `Anthropic stream ended with stop_reason: ${rawStopReason ?? "unknown"}`;
+								// Anthropic flagged an error-class stop without populating stop_details.
+								// Surface the raw reason instead of falling through to the generic
+								// "unknown error" string when we throw below.
+								output.errorMessage = `Anthropic stream ended with stop_reason: ${rawStopReason ?? "unknown"}`;
 							}
 							if (event.usage.input_tokens != null) {
 								output.usage.input = event.usage.input_tokens;
@@ -1607,6 +1633,9 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 					break;
 				} catch (streamError) {
 					const streamFailure = activeAbortTracker.getLocalAbortReason() ?? streamError;
+					if (sawProviderSafetyStop) {
+						throw streamFailure;
+					}
 					if (
 						!disableStrictTools &&
 						firstTokenTime === undefined &&
@@ -1614,19 +1643,13 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 						isAnthropicStrictGrammarTooLargeError(streamFailure)
 					) {
 						strictFallbackErrorMessage = await finalizeErrorMessage(streamFailure, rawRequestDump);
-						output.errorMessage = strictFallbackErrorMessage;
 						if (providerSessionState) {
 							providerSessionState.strictToolsDisabled = true;
 						}
 						disableStrictTools = true;
 						params = await prepareParams();
 						providerRetryAttempt = 0;
-						output.content.length = 0;
-						output.responseId = undefined;
-						output.providerPayload = undefined;
-						output.usage = createEmptyUsage(copilotDynamicHeaders?.premiumRequests);
-						output.stopReason = "stop";
-						firstTokenTime = undefined;
+						resetOutputForRetry();
 						continue;
 					}
 					if (
@@ -1654,12 +1677,7 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 						droppedForcedToolChoice = true;
 						params = await prepareParams({ dropForcedToolChoice: true });
 						providerRetryAttempt = 0;
-						output.content.length = 0;
-						output.responseId = undefined;
-						output.providerPayload = undefined;
-						output.usage = createEmptyUsage(copilotDynamicHeaders?.premiumRequests);
-						output.stopReason = "stop";
-						firstTokenTime = undefined;
+						resetOutputForRetry();
 						continue;
 					}
 					if (
@@ -1674,12 +1692,7 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 						thinkingRepairAttempted = true;
 						params = await prepareParams({ repairLatestAssistantThinking: true });
 						providerRetryAttempt = 0;
-						output.content.length = 0;
-						output.responseId = undefined;
-						output.providerPayload = undefined;
-						output.usage = createEmptyUsage(copilotDynamicHeaders?.premiumRequests);
-						output.stopReason = "stop";
-						firstTokenTime = undefined;
+						resetOutputForRetry();
 						continue;
 					}
 					if (
@@ -1698,12 +1711,7 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 						dropFastMode = true;
 						params = await prepareParams();
 						providerRetryAttempt = 0;
-						output.content.length = 0;
-						output.responseId = undefined;
-						output.providerPayload = undefined;
-						output.usage = createEmptyUsage(copilotDynamicHeaders?.premiumRequests);
-						output.stopReason = "stop";
-						firstTokenTime = undefined;
+						resetOutputForRetry();
 						continue;
 					}
 					const isTransientEnvelopeFailure =
@@ -1725,13 +1733,7 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 					} else {
 						await scheduler.wait(delayMs, { signal: options?.signal });
 					}
-					output.content.length = 0;
-					output.responseId = undefined;
-					output.errorMessage = strictFallbackErrorMessage;
-					output.providerPayload = undefined;
-					output.usage = createEmptyUsage(copilotDynamicHeaders?.premiumRequests);
-					output.stopReason = "stop";
-					firstTokenTime = undefined;
+					resetOutputForRetry();
 				}
 			}
 
@@ -1750,7 +1752,10 @@ export const streamAnthropic: StreamFunction<"anthropic-messages"> = (
 			const firstEventTimeoutError = activeAbortTracker.getLocalAbortReason();
 			output.stopReason = activeAbortTracker.wasCallerAbort() ? "aborted" : "error";
 			output.errorStatus = extractHttpStatusFromError(error);
-			output.errorMessage = firstEventTimeoutError?.message ?? (await finalizeErrorMessage(error, rawRequestDump));
+			if (output.errorKind !== "provider_safety_stop" || !output.errorMessage) {
+				output.errorMessage =
+					firstEventTimeoutError?.message ?? (await finalizeErrorMessage(error, rawRequestDump));
+			}
 			output.errorMessage = rewriteCopilotError(output.errorMessage, error, model.provider);
 			output.duration = Date.now() - startTime;
 			if (firstTokenTime) output.ttft = firstTokenTime - startTime;

package/src/providers/aws-credential-config.ts

@@ -0,0 +1,180 @@
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { $credentialEnv } from "@sayknow-cli/utils";
+import type { AwsCredentials } from "./aws-sigv4";
+
+export type AwsIniFile = Record<string, Record<string, string>>;
+
+export interface AwsCredentialSourceOptions {
+	profile?: string;
+}
+
+export interface AwsCredentialSource {
+	profile: string;
+	credentialsPath: string;
+	configPath: string;
+}
+
+export type AwsProfileCapability = "static" | "process" | "sso" | undefined;
+
+const AVAILABILITY_CACHE_MAX_AGE_MS = 1_000;
+const MAX_AWS_INI_FILE_BYTES = 1024 * 1024;
+
+interface FileFingerprint {
+	exists: boolean;
+	size?: number;
+	mtimeMs?: number;
+	ctimeMs?: number;
+	ino?: number;
+}
+
+interface AvailabilityCacheEntry {
+	source: AwsCredentialSource;
+	credentials: FileFingerprint;
+	config: FileFingerprint;
+	value: boolean;
+	checkedAt: number;
+}
+
+let availabilityCache: AvailabilityCacheEntry | undefined;
+
+export function parseAwsIni(text: string): AwsIniFile {
+	const out: AwsIniFile = {};
+	let current: Record<string, string> | undefined;
+	for (const rawLine of text.split(/\r?\n/)) {
+		const line = rawLine.trim();
+		if (!line || line.startsWith("#") || line.startsWith(";")) continue;
+		if (line.startsWith("[") && line.endsWith("]")) {
+			let name = line.slice(1, -1).trim();
+			if (name.startsWith("profile ")) name = name.slice(8).trim();
+			if (name.startsWith("sso-session ")) name = `sso-session:${name.slice(12).trim()}`;
+			current = out[name] ??= {};
+			continue;
+		}
+		if (!current) continue;
+		const equals = line.indexOf("=");
+		if (equals === -1) continue;
+		const key = line.slice(0, equals).trim();
+		const value = line.slice(equals + 1).trim();
+		if (key) current[key] = value;
+	}
+	return out;
+}
+
+export function resolveAwsCredentialSource(options: AwsCredentialSourceOptions = {}): AwsCredentialSource {
+	const profile = options.profile || $credentialEnv("AWS_PROFILE") || "default";
+	const home = os.homedir();
+	return {
+		profile,
+		credentialsPath: path.resolve(
+			$credentialEnv("AWS_SHARED_CREDENTIALS_FILE") || path.join(home, ".aws", "credentials"),
+		),
+		configPath: path.resolve($credentialEnv("AWS_CONFIG_FILE") || path.join(home, ".aws", "config")),
+	};
+}
+
+export function readAwsStaticEnvironmentCredentials(): AwsCredentials | undefined {
+	const accessKeyId = $credentialEnv("AWS_ACCESS_KEY_ID");
+	const secretAccessKey = $credentialEnv("AWS_SECRET_ACCESS_KEY");
+	if (!accessKeyId || !secretAccessKey) return undefined;
+	const sessionToken = $credentialEnv("AWS_SESSION_TOKEN");
+	return sessionToken ? { accessKeyId, secretAccessKey, sessionToken } : { accessKeyId, secretAccessKey };
+}
+
+export function classifyAwsProfileCapability(
+	profile: string,
+	credentialsIni: AwsIniFile | undefined,
+	configIni: AwsIniFile | undefined,
+): AwsProfileCapability {
+	const merged = { ...(configIni?.[profile] ?? {}), ...(credentialsIni?.[profile] ?? {}) };
+	if (merged.aws_access_key_id && merged.aws_secret_access_key) return "static";
+	if (merged.sso_account_id && merged.sso_role_name) {
+		if (merged.sso_start_url && merged.sso_region) return "sso";
+		const session = merged.sso_session ? configIni?.[`sso-session:${merged.sso_session}`] : undefined;
+		if (session?.sso_start_url && session.sso_region) return "sso";
+	}
+	if (merged.credential_process) return "process";
+	return undefined;
+}
+
+export function hasResolvableAwsProfileSource(
+	options: AwsCredentialSourceOptions & { /** @internal Test-only cache scan observer. */ onScan?: () => void } = {},
+	now = Date.now(),
+): boolean {
+	const source = resolveAwsCredentialSource(options);
+	const credentials = fingerprint(source.credentialsPath);
+	const config = fingerprint(source.configPath);
+	if (
+		availabilityCache &&
+		now >= availabilityCache.checkedAt &&
+		now - availabilityCache.checkedAt < AVAILABILITY_CACHE_MAX_AGE_MS &&
+		sameSource(availabilityCache.source, source) &&
+		sameFingerprint(availabilityCache.credentials, credentials) &&
+		sameFingerprint(availabilityCache.config, config)
+	) {
+		return availabilityCache.value;
+	}
+	options.onScan?.();
+	const credentialsIni = readAwsIniSync(source.credentialsPath);
+	const configIni = readAwsIniSync(source.configPath);
+	const value = classifyAwsProfileCapability(source.profile, credentialsIni, configIni) !== undefined;
+	availabilityCache = { source, credentials, config, value, checkedAt: now };
+	return value;
+}
+
+export function isValidBedrockBearerToken(token: string | undefined): token is string {
+	if (!token) return false;
+	return !/[\x00-\x1f\x7f]/.test(token);
+}
+
+function readAwsIniSync(filePath: string): AwsIniFile | undefined {
+	let fd: number | undefined;
+	try {
+		fd = fs.openSync(filePath, fs.constants.O_RDONLY | fs.constants.O_NONBLOCK);
+		const stat = fs.fstatSync(fd);
+		if (!stat.isFile() || stat.size > MAX_AWS_INI_FILE_BYTES) return undefined;
+		const contents = Buffer.allocUnsafe(MAX_AWS_INI_FILE_BYTES + 1);
+		let bytesRead = 0;
+		while (bytesRead < contents.length) {
+			const count = fs.readSync(fd, contents, bytesRead, contents.length - bytesRead, bytesRead);
+			if (count === 0) break;
+			bytesRead += count;
+		}
+		if (bytesRead > MAX_AWS_INI_FILE_BYTES) return undefined;
+		return parseAwsIni(contents.toString("utf8", 0, bytesRead));
+	} catch {
+		return undefined;
+	} finally {
+		if (fd !== undefined) {
+			try {
+				fs.closeSync(fd);
+			} catch {
+				// Ignore close errors because file availability has already been determined.
+			}
+		}
+	}
+}
+
+function fingerprint(filePath: string): FileFingerprint {
+	try {
+		const stat = fs.statSync(filePath);
+		return { exists: true, size: stat.size, mtimeMs: stat.mtimeMs, ctimeMs: stat.ctimeMs, ino: stat.ino };
+	} catch {
+		return { exists: false };
+	}
+}
+
+function sameSource(a: AwsCredentialSource, b: AwsCredentialSource): boolean {
+	return a.profile === b.profile && a.credentialsPath === b.credentialsPath && a.configPath === b.configPath;
+}
+
+function sameFingerprint(a: FileFingerprint, b: FileFingerprint): boolean {
+	return (
+		a.exists === b.exists &&
+		a.size === b.size &&
+		a.mtimeMs === b.mtimeMs &&
+		a.ctimeMs === b.ctimeMs &&
+		a.ino === b.ino
+	);
+}