@takara-ai/miru-code 1.7.8 → 1.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@takara-ai/miru-code",
-  "version": "1.7.8",
+  "version": "1.8.0",
   "description": "Miru (見る) — hybrid code search for agents. Bun, TypeScript, Takara embeddings.",
   "type": "module",
   "license": "MIT",
@@ -54,10 +54,15 @@
     "lint": "biome check .",
     "lint:fix": "biome check --write .",
     "prepare": "bun run scripts/install-git-hooks.ts",
+    "build:kiro-plugin": "bun run scripts/build-kiro-plugin.ts",
     "vendor-grammars": "bun run scripts/vendor-grammars.ts",
     "prepublishOnly": "bun run vendor-grammars && bun run typecheck && bun test",
     "benchmark:ab": "bun run scripts/search-ab-local.ts",
     "benchmark:ab-multi": "bun run scripts/search-ab-multi.ts",
+    "benchmark:codesearchnet-compression": "bun run scripts/benchmark-codesearchnet-compression.ts",
+    "benchmark:codesearchnet-alpha": "bun run scripts/calibrate-codesearchnet-alpha.ts",
+    "benchmark:ranking-sweep": "bun run scripts/sweep-ranking-configs.ts",
+    "benchmark:ranking-factorial": "bun run scripts/sweep-ranking-factorial.ts",
     "benchmark:recall": "bun run scripts/benchmark-recall-tokens.ts",
     "benchmark:vs-grep": "bun run scripts/benchmark-miru-vs-grep.ts",
     "benchmark:workflow": "bun run scripts/benchmark-workflow-tokens.ts",
@@ -71,6 +76,7 @@
   },
   "dependencies": {
     "@aws-sdk/client-sagemaker-runtime": "^3.1090.0",
+    "@aws-sdk/credential-provider-node": "^3.972.70",
     "ignore": "^7.0.5",
     "web-tree-sitter": "^0.26.9",
     "zod": "^4.4.3"

package/src/benchmark/grep.ts

@@ -26,6 +26,12 @@ export const RG_EXCLUDE_ARGS = [
   "!tokenizer",
   "-g",
   "!tokenizer/**",
+  "-g",
+  "!*.map",
+  "-g",
+  "!*.min.js",
+  "-g",
+  "!*.min.css",
 ] as const;
 
 export class BenchmarkSearchTimeoutError extends Error {
@@ -236,6 +242,9 @@ async function grepRankedMatches(repoRoot: string, pattern: string, topK: number
     "--exclude-dir=node_modules",
     "--exclude-dir=.git",
     "--exclude-dir=tokenizer",
+    "--exclude=*.map",
+    "--exclude=*.min.js",
+    "--exclude=*.min.css",
     pattern,
     repoRoot,
   ]);

package/src/benchmark/locate-compare.ts

@@ -2,14 +2,15 @@
  * Compare Miru `locate` MCP response tokens vs the costlier native Grep path.
  *
  * Miru side counts the agent-facing text body (`formatLiteralLocateText`), not
- * the intermediate JSON payload. Baseline mirrors Cursor/Claude Grep-style
- * output: fixed-string matches with ±GREP_CONTEXT lines (not slim `rg -n`).
- * That is the expensive path agents take without `locate`, so savings measure
- * real workflow cost — not an apples-to-apples contest against minimal ripgrep.
+ * the intermediate JSON payload. The grep baseline requests only the same
+ * information: counts for `count`, line locations for `locations`, and context
+ * for `lines`. It also mirrors locate's include/exclude scope and variants.
  */
 
+import { join } from "node:path";
 import {
   DEFAULT_LITERAL_MODE,
+  filterChunksByGlob,
   formatLiteralLocate,
   type LiteralLocateOptions,
   type LiteralLocateResult,
@@ -18,7 +19,7 @@ import { formatLiteralLocateText } from "../mcp/format-text.ts";
 import type { MiruIndex } from "../miru-index.ts";
 import { countTokens } from "../token-count.ts";
 import { GREP_CONTEXT } from "./grep.ts";
-import { rgLiteralOutput } from "./rg-literal.ts";
+import { rgLiteralOutput, selectComparableLiteralSearchTool } from "./rg-literal.ts";
 import { agentBenchmarkFromTokens } from "./summary.ts";
 import type { AgentBenchmarkSummary } from "./types.ts";
 
@@ -28,6 +29,8 @@ export interface LocateBenchmarkComparison {
   result: LiteralLocateResult;
   payload: Record<string, unknown>;
   benchmark: AgentBenchmarkSummary;
+  /** Baseline match stats; compare with `result.n`/`result.files` for exact-literal parity. */
+  grep: { n: number; files: number };
   latency_ms: {
     miru: number;
     grep: number;
@@ -40,6 +43,16 @@ export async function benchmarkLocateComparison(options: {
   index: MiruIndex;
   locate?: LiteralLocateOptions;
 }): Promise<LocateBenchmarkComparison> {
+  if (options.locate?.limit != null) {
+    throw new Error(
+      "Cannot benchmark a limited locate response against native grep: rg/grep limits are per file, while locate.limit is global. Omit limit to keep token and recall comparisons valid.",
+    );
+  }
+  if (!selectComparableLiteralSearchTool()) {
+    throw new Error(
+      "A comparable literal benchmark requires rg or compatible grep; findstr is not equivalent for scoped locate output.",
+    );
+  }
   const locateOpts: LiteralLocateOptions = { mode: DEFAULT_LITERAL_MODE, ...options.locate };
 
   const miruStart = performance.now();
@@ -48,22 +61,30 @@ export async function benchmarkLocateComparison(options: {
   const payload = formatLiteralLocate(result);
   const miruTok = countTokens(formatLiteralLocateText(payload));
 
-  // Unbounded agent-style Grep dump (±context) — the costlier path without locate.
-  // Never use less context than the caller actually requested via context_lines,
-  // or a locate call that returns inline context looks artificially expensive
-  // against a baseline that didn't have to fetch that context at all. Likewise,
-  // grep every variant `match_variants`/an array `literal` actually matched —
-  // one grep pattern isn't equivalent recall, so it isn't a fair baseline.
+  // Grep every variant `match_variants`/an array `literal` actually matched — one
+  // pattern is not equivalent recall. Keep contextual lines only for `lines` mode.
+  const context =
+    locateOpts.mode === "lines" ? Math.max(GREP_CONTEXT, locateOpts.context_lines ?? 0) : 0;
+  const indexedPaths = [
+    ...new Set(
+      filterChunksByGlob(options.index.chunks, locateOpts.include, locateOpts.exclude).map(
+        (chunk) => join(options.repoPath, chunk.file_path),
+      ),
+    ),
+  ];
   const grep = await rgLiteralOutput(options.repoPath, result.literals ?? [options.literal], {
-    context: Math.max(GREP_CONTEXT, locateOpts.context_lines ?? 0),
+    context,
     maxCount: 0,
     ignoreCase: locateOpts.ignore_case,
+    countOnly: locateOpts.mode === "count",
+    paths: indexedPaths,
   });
 
   return {
     result,
     payload,
     benchmark: agentBenchmarkFromTokens(miruTok, grep.tokens, result.n > 0),
+    grep: { n: grep.n, files: grep.files },
     latency_ms: { miru: miruMs, grep: grep.latency_ms },
   };
 }

package/src/benchmark/rg-literal.ts

@@ -4,6 +4,9 @@ import { relative } from "node:path";
 import { countTokens } from "../token-count.ts";
 import { RG_EXCLUDE_ARGS, selectBenchmarkSearchTool, spawnBenchmarkSearch } from "./grep.ts";
 
+/** Keep each native-search invocation well below platform command-line limits. */
+const MAX_LITERAL_PATH_ARGUMENT_CHARS = 4_096;
+
 export interface RgLiteralOutput {
   text: string;
   tokens: number;
@@ -12,6 +15,52 @@ export interface RgLiteralOutput {
   files: number;
 }
 
+export interface RgLiteralOptions {
+  context?: number;
+  maxCount?: number;
+  ignoreCase?: boolean;
+  /** Return per-file match counts rather than matching lines. */
+  countOnly?: boolean;
+  /** Gitignore-style globs included by the comparable locate call. */
+  include?: string[];
+  /** Gitignore-style globs excluded by the comparable locate call. */
+  exclude?: string[];
+  /** Absolute or repo-relative files in the same corpus as the compared tool. */
+  paths?: string[];
+}
+
+/**
+ * `findstr` cannot reproduce the scoped, contextual, count-mode literal baseline.
+ * Do not silently substitute it and report the result as an equivalent grep comparison.
+ */
+export function selectComparableLiteralSearchTool(
+  options?: Parameters<typeof selectBenchmarkSearchTool>[0],
+): "rg" | "grep" | null {
+  const tool = selectBenchmarkSearchTool(options);
+  return tool === "rg" || tool === "grep" ? tool : null;
+}
+
+/** Split an indexed corpus into safe native-command argument batches. */
+export function batchLiteralPaths(paths: readonly string[]): string[][] {
+  const batches: string[][] = [];
+  let batch: string[] = [];
+  let chars = 0;
+  for (const path of paths) {
+    const nextChars = chars + path.length + 1;
+    if (batch.length > 0 && nextChars > MAX_LITERAL_PATH_ARGUMENT_CHARS) {
+      batches.push(batch);
+      batch = [];
+      chars = 0;
+    }
+    batch.push(path);
+    chars += path.length + 1;
+  }
+  if (batch.length > 0) {
+    batches.push(batch);
+  }
+  return batches;
+}
+
 /** Count match lines (path:line:…) and unique files from `rg -n` output. */
 export function parseRgLiteralStats(text: string, repoRoot: string): { n: number; files: number } {
   const files = new Set<string>();
@@ -59,29 +108,69 @@ function parsePathLinePrefix(line: string): { path: string; line: number } | nul
   return null;
 }
 
+function parseCountStats(text: string, repoRoot: string): { n: number; files: number } {
+  let n = 0;
+  let files = 0;
+  for (const line of text.split("\n")) {
+    const colon = line.lastIndexOf(":");
+    if (colon < 0) {
+      continue;
+    }
+    const count = Number(line.slice(colon + 1));
+    if (!Number.isFinite(count) || count <= 0) {
+      continue;
+    }
+    // Ensure this is a path under the requested root, rather than an arbitrary line.
+    const path = line.slice(0, colon);
+    if (relative(repoRoot, path).startsWith("..")) {
+      continue;
+    }
+    n += count;
+    files += 1;
+  }
+  return { n, files };
+}
+
 export async function rgLiteralOutput(
   repoRoot: string,
   literal: string | readonly string[],
-  options: {
-    context?: number;
-    maxCount?: number;
-    ignoreCase?: boolean;
-  } = {},
+  options: RgLiteralOptions = {},
 ): Promise<RgLiteralOutput> {
   const literals = Array.isArray(literal) ? literal : [literal as string];
   const context = options.context ?? 0;
   const maxCount = options.maxCount ?? 20;
-  const tool = selectBenchmarkSearchTool();
+  const tool = selectComparableLiteralSearchTool();
   if (!tool) {
-    throw new Error("No search tool found in PATH (tried rg, grep, and findstr on Windows)");
+    throw new Error(
+      "A comparable literal benchmark requires rg or compatible grep; findstr cannot preserve locate scope, context, and count semantics.",
+    );
   }
   const start = performance.now();
-  const text = await spawnBenchmarkSearch(
-    buildLiteralArgs(tool, repoRoot, literals, context, maxCount, !!options.ignoreCase),
-    tool === "findstr" ? repoRoot : undefined,
-  );
+  const pathBatches = options.paths?.length ? batchLiteralPaths(options.paths) : [undefined];
+  const output: string[] = [];
+  for (const paths of pathBatches) {
+    output.push(
+      await spawnBenchmarkSearch(
+        buildLiteralArgs(
+          tool,
+          repoRoot,
+          literals,
+          context,
+          maxCount,
+          !!options.ignoreCase,
+          options.countOnly,
+          options.include,
+          options.exclude,
+          paths,
+        ),
+      ),
+    );
+  }
+  const text = output.filter(Boolean).join("\n");
   const latency_ms = performance.now() - start;
-  const stats = parseRgLiteralStats(text, repoRoot);
+  const stats = options.countOnly
+    ? parseCountStats(text, repoRoot)
+    : parseRgLiteralStats(text, repoRoot);
   return { text, tokens: countTokens(text), latency_ms, ...stats };
 }
 
@@ -90,15 +179,28 @@ export async function rgLiteralOutput(
  * to get the same recall as `literals`/`match_variants` (one pattern isn't equivalent).
  */
 function buildLiteralArgs(
-  tool: "rg" | "grep" | "findstr",
+  tool: "rg" | "grep",
   repoRoot: string,
   literals: readonly string[],
   context: number,
   maxCount: number,
   ignoreCase: boolean,
+  countOnly = false,
+  include: string[] = [],
+  exclude: string[] = [],
+  paths?: string[],
 ): string[] {
   if (tool === "rg") {
     const args = ["rg", "-F", "-n", "--no-heading", ...RG_EXCLUDE_ARGS];
+    if (countOnly) {
+      args.splice(2, 2, "--count");
+    }
+    for (const glob of include) {
+      args.push("-g", glob);
+    }
+    for (const glob of exclude) {
+      args.push("-g", `!${glob}`);
+    }
     if (ignoreCase) {
       args.push("-i");
     }
@@ -111,7 +213,7 @@ function buildLiteralArgs(
     for (const l of literals) {
       args.push("-e", l);
     }
-    args.push(repoRoot);
+    args.push(...(paths?.length ? paths : [repoRoot]));
     return args;
   }
   if (tool === "grep") {
@@ -124,7 +226,19 @@ function buildLiteralArgs(
       "--exclude-dir=node_modules",
       "--exclude-dir=.git",
       "--exclude-dir=tokenizer",
+      "--exclude=*.map",
+      "--exclude=*.min.js",
+      "--exclude=*.min.css",
     ];
+    for (const glob of include) {
+      args.push(`--include=${glob}`);
+    }
+    for (const glob of exclude) {
+      args.push(`--exclude=${glob}`);
+    }
+    if (countOnly) {
+      args.push("-c");
+    }
     if (ignoreCase) {
       args.push("-i");
     }
@@ -137,16 +251,8 @@ function buildLiteralArgs(
     for (const l of literals) {
       args.push("-e", l);
     }
-    args.push(repoRoot);
+    args.push(...(paths?.length ? paths : [repoRoot]));
     return args;
   }
-  const args = ["findstr", "/S", "/N", "/P"];
-  for (const l of literals) {
-    args.push(`/C:${l}`);
-  }
-  args.push("*");
-  if (ignoreCase) {
-    args.splice(4, 0, "/I");
-  }
-  return args;
+  throw new Error(`Unsupported comparable literal benchmark tool: ${tool}`);
 }

package/src/embeddings/sagemaker.ts

@@ -1,22 +1,38 @@
+import { readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
 import type { InvokeEndpointCommandOutput } from "@aws-sdk/client-sagemaker-runtime";
 import type { EmbeddingClient, EmbeddingPayload, EmbeddingResponse } from "./openai.ts";
 
 type SageMakerRuntimeModule = typeof import("@aws-sdk/client-sagemaker-runtime");
+type AwsCredentialProviderModule = typeof import("@aws-sdk/credential-provider-node");
+type StaticAwsCredentials = {
+  accessKeyId: string;
+  secretAccessKey: string;
+  sessionToken?: string;
+};
 
 /** Lazily loaded so Takara-only MCP/CLI processes never pay the AWS SDK startup cost. */
 let sageMakerRuntimePromise: Promise<SageMakerRuntimeModule> | null = null;
+let awsCredentialProviderPromise: Promise<AwsCredentialProviderModule> | null = null;
 
 function loadSageMakerRuntime(): Promise<SageMakerRuntimeModule> {
   sageMakerRuntimePromise ??= import("@aws-sdk/client-sagemaker-runtime");
   return sageMakerRuntimePromise;
 }
 
+function loadAwsCredentialProvider(): Promise<AwsCredentialProviderModule> {
+  awsCredentialProviderPromise ??= import("@aws-sdk/credential-provider-node");
+  return awsCredentialProviderPromise;
+}
+
 /** arn:aws:sagemaker:<region>:<account-id>:endpoint/<endpoint-name> (also covers aws-cn/aws-us-gov). */
 const ENDPOINT_ARN_PATTERN = /^arn:aws[a-z0-9-]*:sagemaker:([a-z0-9-]+):(\d{12}):endpoint\/(.+)$/;
 
 export interface SageMakerEmbeddingConfig {
   endpointName: string;
   region: string;
+  profile?: string;
   normalize: boolean;
   truncate: boolean;
   truncationDirection: "Left" | "Right";
@@ -54,6 +70,103 @@ function resolveTruncationDirection(): "Left" | "Right" {
   return process.env.MIRU_SAGEMAKER_TRUNCATION_DIRECTION?.trim() === "Left" ? "Left" : "Right";
 }
 
+function parseIniProfiles(contents: string): Map<string, Record<string, string>> {
+  const profiles = new Map<string, Record<string, string>>();
+  let section: Record<string, string> | undefined;
+
+  for (const line of contents.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#") || trimmed.startsWith(";")) {
+      continue;
+    }
+    if (trimmed.startsWith("[") && trimmed.endsWith("]")) {
+      section = {};
+      profiles.set(trimmed.slice(1, -1).trim().toLowerCase(), section);
+      continue;
+    }
+    if (!section) {
+      continue;
+    }
+    const separator = trimmed.indexOf("=");
+    if (separator <= 0) {
+      continue;
+    }
+    const key = trimmed.slice(0, separator).trim().toLowerCase();
+    const value = trimmed.slice(separator + 1).trim();
+    section[key] = value;
+  }
+
+  return profiles;
+}
+
+/**
+ * AWS CLI accepts credential-key casing that the AWS SDK's INI parser does not.
+ * Keep this fallback deliberately limited to static credentials; SSO, role, and
+ * credential_process profiles remain handled by the SDK's normal provider chain.
+ */
+export function parseCaseInsensitiveStaticCredentials(
+  configContents: string,
+  credentialsContents: string,
+  profileName: string,
+): StaticAwsCredentials | null {
+  const profile = profileName.trim().toLowerCase();
+  if (!profile) {
+    return null;
+  }
+
+  const merged: Record<string, string> = {};
+  for (const [sectionName, values] of parseIniProfiles(configContents)) {
+    if (sectionName === profile || sectionName === `profile ${profile}`) {
+      Object.assign(merged, values);
+    }
+  }
+  for (const [sectionName, values] of parseIniProfiles(credentialsContents)) {
+    if (sectionName === profile) {
+      Object.assign(merged, values);
+    }
+  }
+
+  const accessKeyId = merged.aws_access_key_id;
+  const secretAccessKey = merged.aws_secret_access_key;
+  if (!accessKeyId || !secretAccessKey) {
+    return null;
+  }
+  return {
+    accessKeyId,
+    secretAccessKey,
+    sessionToken: merged.aws_session_token,
+  };
+}
+
+function resolveAwsHome(): string {
+  return process.env.HOME || process.env.USERPROFILE || homedir();
+}
+
+function resolveAwsFilePath(variable: string, fallback: string): string {
+  const configured = process.env[variable] || fallback;
+  return configured.startsWith("~/") ? join(resolveAwsHome(), configured.slice(2)) : configured;
+}
+
+async function loadCaseInsensitiveStaticCredentials(
+  profileName: string,
+): Promise<StaticAwsCredentials | null> {
+  const home = resolveAwsHome();
+  const configPath = resolveAwsFilePath("AWS_CONFIG_FILE", join(home, ".aws", "config"));
+  const credentialsPath = resolveAwsFilePath(
+    "AWS_SHARED_CREDENTIALS_FILE",
+    join(home, ".aws", "credentials"),
+  );
+
+  const [configResult, credentialsResult] = await Promise.allSettled([
+    readFile(configPath, "utf8"),
+    readFile(credentialsPath, "utf8"),
+  ]);
+  const configContents = configResult.status === "fulfilled" ? configResult.value : "";
+  const credentialsContents =
+    credentialsResult.status === "fulfilled" ? credentialsResult.value : "";
+  return parseCaseInsensitiveStaticCredentials(configContents, credentialsContents, profileName);
+}
+
 /**
  * Reads MIRU_SAGEMAKER_ENDPOINT_ARN (or MIRU_SAGEMAKER_ENDPOINT_NAME + a region) to enable
  * self-hosted mode. AWS credentials are resolved by the SDK's default provider chain
@@ -91,6 +204,7 @@ export function resolveSageMakerConfig(): SageMakerEmbeddingConfig | null {
   return {
     endpointName,
     region,
+    profile: process.env.AWS_PROFILE?.trim() || undefined,
     normalize: envBool("MIRU_SAGEMAKER_NORMALIZE", true),
     truncate: envBool("MIRU_SAGEMAKER_TRUNCATE", true),
     truncationDirection: resolveTruncationDirection(),
@@ -108,6 +222,18 @@ export const SAGEMAKER_AUTH_ERROR_MESSAGE =
   "(AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY/AWS_SESSION_TOKEN or AWS_PROFILE) and that the " +
   "identity has sagemaker:InvokeEndpoint permission on the endpoint.";
 
+/** Shown when the endpoint name in the stored/env config no longer exists. */
+export const SAGEMAKER_NOT_FOUND_ERROR_MESSAGE =
+  "SageMaker endpoint not found — it may have been deleted, renamed, or deployed in a " +
+  "different region. Confirm the endpoint still exists, then run `miru setup --sagemaker` " +
+  "again to re-authenticate and re-point Miru at the correct endpoint.";
+
+/** Shown for DNS/connection-level failures reaching the SageMaker Runtime API itself. */
+export const SAGEMAKER_UNREACHABLE_ERROR_MESSAGE =
+  "Could not reach the SageMaker endpoint (network error). Check your network/VPN/VPC " +
+  "access and that the configured region is correct, then run `miru setup --sagemaker` " +
+  "again to re-authenticate and re-validate the connection.";
+
 const AUTH_EXCEPTION_NAMES = new Set([
   "AccessDeniedException",
   "UnrecognizedClientException",
@@ -115,6 +241,15 @@ const AUTH_EXCEPTION_NAMES = new Set([
   "CredentialsProviderError",
 ]);
 
+/** Node/undici connection-level error codes — the request never reached AWS. */
+const NETWORK_ERROR_CODES = new Set([
+  "ENOTFOUND",
+  "ECONNREFUSED",
+  "ECONNRESET",
+  "ETIMEDOUT",
+  "EAI_AGAIN",
+]);
+
 class SageMakerInvokeError extends Error {
   readonly status: number;
 
@@ -125,10 +260,11 @@ class SageMakerInvokeError extends Error {
   }
 }
 
-function toInvokeError(err: unknown): SageMakerInvokeError {
+export function toInvokeError(err: unknown): SageMakerInvokeError {
   const awsErr = err as {
     name?: string;
     message?: string;
+    code?: string;
     $metadata?: { httpStatusCode?: number };
     OriginalStatusCode?: string | number;
     OriginalMessage?: string;
@@ -138,6 +274,17 @@ function toInvokeError(err: unknown): SageMakerInvokeError {
     return new SageMakerInvokeError(403, SAGEMAKER_AUTH_ERROR_MESSAGE);
   }
 
+  // SageMaker returns a generic ValidationError for both "endpoint doesn't exist" and
+  // malformed-request cases — only the message distinguishes them.
+  if (awsErr?.name === "ValidationError" && /not found/i.test(awsErr?.message ?? "")) {
+    return new SageMakerInvokeError(404, SAGEMAKER_NOT_FOUND_ERROR_MESSAGE);
+  }
+
+  const errorCode = awsErr?.code ?? (err as { cause?: { code?: string } })?.cause?.code;
+  if (errorCode && NETWORK_ERROR_CODES.has(errorCode)) {
+    return new SageMakerInvokeError(503, SAGEMAKER_UNREACHABLE_ERROR_MESSAGE);
+  }
+
   // ModelError wraps the embedding container's real status/message (e.g. 424 when the
   // deployed model isn't an embedding model) behind SageMaker's own 424 response.
   const originalStatus =
@@ -206,8 +353,24 @@ export function createSageMakerClient(config: SageMakerEmbeddingConfig): Embeddi
       _model: string,
       dimensions?: number,
     ): Promise<EmbeddingResponse> {
-      const { InvokeEndpointCommand, SageMakerRuntimeClient } = await loadSageMakerRuntime();
-      client ??= new SageMakerRuntimeClient({ region: config.region });
+      const [{ InvokeEndpointCommand, SageMakerRuntimeClient }, { defaultProvider }] =
+        await Promise.all([loadSageMakerRuntime(), loadAwsCredentialProvider()]);
+      if (!client) {
+        const profile = config.profile?.trim() || process.env.AWS_PROFILE?.trim();
+        const sdkCredentials = defaultProvider({ profile });
+        const credentials = async (): Promise<StaticAwsCredentials> => {
+          try {
+            return await sdkCredentials();
+          } catch (error) {
+            const fallback = profile ? await loadCaseInsensitiveStaticCredentials(profile) : null;
+            if (fallback) {
+              return fallback;
+            }
+            throw error;
+          }
+        };
+        client = new SageMakerRuntimeClient({ region: config.region, credentials });
+      }
 
       const body = buildRequestBody(config, input, dimensions);
 

package/src/literal.ts

@@ -124,7 +124,7 @@ function expandLiterals(literals: readonly string[], matchVariants: boolean): st
   return [...seen];
 }
 
-function filterChunksByGlob(
+export function filterChunksByGlob(
   chunks: readonly Chunk[],
   include: string[] | undefined,
   exclude: string[] | undefined,