alibabacloud-agentcore-sdk 0.1.0

package/dist/bound-credentials-C1fM0thh.d.cts

@@ -0,0 +1,39 @@
+import { inspect } from 'node:util';
+import { CredentialMetadata, AgentCoreControlPlane } from './controlplane/index.cjs';
+import { L as Logger } from './logging-C8GLLg1f.cjs';
+import { C as CredentialProvider } from './access-key-CkoHq3S8.cjs';
+
+interface CredentialRuntime {
+    workspaceId: string;
+    regionId: string;
+    controlPlane: AgentCoreControlPlane;
+    resourceSTS?: CredentialProvider;
+    workloadAccessToken?: {
+        get(): Promise<string>;
+        invalidate(token: string): Promise<void>;
+    };
+}
+declare class BoundCredential {
+    #private;
+    readonly metadata: CredentialMetadata;
+    readonly providerName: string;
+    constructor(providerName: string, value: string, metadata: CredentialMetadata);
+    get value(): string;
+    get credentialType(): string;
+    asHeaders(): Record<string, string>;
+    [inspect.custom](): string;
+    toJSON(): string;
+}
+/** Resolve metadata by name, then fetch the secret from AgentIdentity. WAT/STS cache independently. */
+declare class BoundCredentials {
+    private readonly runtime;
+    private readonly logger;
+    constructor(runtime: () => Promise<CredentialRuntime>, logger?: Logger);
+    get(credentialName: string): Promise<BoundCredential>;
+    /** @internal Bind only after validating the credential's MCP application scope. */
+    getForMCP(credentialName: string, serverId: string): Promise<BoundCredential>;
+    private resolve;
+    private getAPIKey;
+}
+
+export { BoundCredential as B, BoundCredentials as a };

package/dist/bound-credentials-DqT64Q2s.d.ts

@@ -0,0 +1,39 @@
+import { inspect } from 'node:util';
+import { CredentialMetadata, AgentCoreControlPlane } from './controlplane/index.js';
+import { L as Logger } from './logging-C8GLLg1f.js';
+import { C as CredentialProvider } from './access-key-CkoHq3S8.js';
+
+interface CredentialRuntime {
+    workspaceId: string;
+    regionId: string;
+    controlPlane: AgentCoreControlPlane;
+    resourceSTS?: CredentialProvider;
+    workloadAccessToken?: {
+        get(): Promise<string>;
+        invalidate(token: string): Promise<void>;
+    };
+}
+declare class BoundCredential {
+    #private;
+    readonly metadata: CredentialMetadata;
+    readonly providerName: string;
+    constructor(providerName: string, value: string, metadata: CredentialMetadata);
+    get value(): string;
+    get credentialType(): string;
+    asHeaders(): Record<string, string>;
+    [inspect.custom](): string;
+    toJSON(): string;
+}
+/** Resolve metadata by name, then fetch the secret from AgentIdentity. WAT/STS cache independently. */
+declare class BoundCredentials {
+    private readonly runtime;
+    private readonly logger;
+    constructor(runtime: () => Promise<CredentialRuntime>, logger?: Logger);
+    get(credentialName: string): Promise<BoundCredential>;
+    /** @internal Bind only after validating the credential's MCP application scope. */
+    getForMCP(credentialName: string, serverId: string): Promise<BoundCredential>;
+    private resolve;
+    private getAPIKey;
+}
+
+export { BoundCredential as B, BoundCredentials as a };

package/dist/chunk-2E5EWEDG.cjs

@@ -0,0 +1,142 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; } var _class;
+
+var _chunk5RKN46UUcjs = require('./chunk-5RKN46UU.cjs');
+
+
+var _chunkLE5P3SJWcjs = require('./chunk-LE5P3SJW.cjs');
+
+
+
+var _chunkJSP7ZROScjs = require('./chunk-JSP7ZROS.cjs');
+
+// src/auth/agent-sa-token.ts
+var _promises = require('fs/promises');
+var DEFAULT_AGENT_SA_TOKEN_PATH = "/var/run/agentcore/agent/token";
+var AgentSATokenProvider = class {
+  constructor(path = DEFAULT_AGENT_SA_TOKEN_PATH) {
+    this.path = path;
+  }
+  
+  async get() {
+    let token;
+    try {
+      token = await _promises.readFile.call(void 0, this.path, "utf8");
+    } catch (cause) {
+      throw new (0, _chunkJSP7ZROScjs.AuthenticationError)("cannot read the Agent SA token file", { cause });
+    }
+    return validToken(token);
+  }
+};
+function validToken(token) {
+  if (typeof token !== "string" || !token.trim()) throw new (0, _chunkJSP7ZROScjs.AuthenticationError)("the Agent SA token source returned an empty token");
+  return token.trim();
+}
+async function getAgentSAToken(source) {
+  return validToken(await source.get());
+}
+async function refreshAgentSAToken(source, current) {
+  return validToken(await (source.refresh ? source.refresh(current) : source.get()));
+}
+
+// src/auth/controller.ts
+var _promises3 = require('timers/promises');
+var ControllerClient = (_class = class {
+  constructor(endpoint, saTokens, options = {}) {;_class.prototype.__init.call(this);
+    this.saTokens = saTokens;
+    this.endpoint = _chunk5RKN46UUcjs.httpUrl.call(void 0, endpoint, "Controller endpoint");
+    this.timeoutMs = _nullishCoalesce(options.timeoutMs, () => ( 1e4));
+    this.maxAttempts = _nullishCoalesce(options.maxAttempts, () => ( 3));
+    if (!Number.isFinite(this.timeoutMs) || this.timeoutMs <= 0 || !Number.isInteger(this.maxAttempts) || this.maxAttempts < 1) {
+      throw new TypeError("timeoutMs and maxAttempts must be positive");
+    }
+    this.logger = _nullishCoalesce(options.logger, () => ( _chunkLE5P3SJWcjs.nullLogger));
+  }
+  
+  
+  
+  
+  
+  __init() {this.lifetime = new AbortController()}
+  async post(path, purpose) {
+    let token = await getAgentSAToken(this.saTokens);
+    let response = await this.request(path, token, purpose);
+    if (response.status === 401) {
+      const rotated = await refreshAgentSAToken(this.saTokens, token);
+      this.logger.warn("agentcore.controller.sa_rejected", { rotated: rotated !== token });
+      if (rotated !== token) {
+        token = rotated;
+        response = await this.request(path, token, purpose);
+      }
+    }
+    if (response.status === 401) throw new (0, _chunkJSP7ZROScjs.AuthenticationError)("Controller rejected the Agent SA token");
+    return response;
+  }
+  close() {
+    this.lifetime.abort();
+  }
+  async request(path, token, purpose) {
+    const url = new URL(`${this.endpoint}${path}`);
+    const query = typeof purpose === "string" ? { purpose } : purpose;
+    for (const [key, value] of Object.entries(_nullishCoalesce(query, () => ( {})))) url.searchParams.set(key, value);
+    const fields = { url: `${url.origin}${url.pathname}`, purpose: _nullishCoalesce(_optionalChain([query, 'optionalAccess', _ => _.purpose]), () => ( "default")) };
+    for (let attempt = 1; attempt <= this.maxAttempts; attempt++) {
+      this.lifetime.signal.throwIfAborted();
+      this.logger.debug("agentcore.controller.request.started", { ...fields, attempt });
+      let response;
+      let text;
+      const timeout = new AbortController();
+      const timer = setTimeout(() => timeout.abort(), this.timeoutMs);
+      const signal = AbortSignal.any([this.lifetime.signal, timeout.signal]);
+      try {
+        response = await fetch(url, {
+          method: "POST",
+          headers: { Authorization: `Bearer ${token}` },
+          body: "",
+          redirect: "manual",
+          signal
+        });
+        text = await response.text();
+      } catch (cause) {
+        this.lifetime.signal.throwIfAborted();
+        this.logger.warn("agentcore.controller.request.failed", { ...fields, attempt, reason: "transport_error" });
+        if (attempt === this.maxAttempts) throw new (0, _chunkJSP7ZROScjs.CredentialExchangeError)("cannot reach the AgentCore Controller", { cause });
+        await _promises3.setTimeout.call(void 0, 50 * 2 ** (attempt - 1), void 0, { signal: this.lifetime.signal });
+        continue;
+      } finally {
+        clearTimeout(timer);
+      }
+      let payload;
+      try {
+        payload = JSON.parse(text);
+      } catch (e) {
+        payload = void 0;
+      }
+      const rawMessage = payload && typeof payload === "object" && "message" in payload ? payload.message : void 0;
+      const message = typeof rawMessage === "string" ? rawMessage.split(token).join("<redacted>").replace(/Bearer\s+\S+/gi, "Bearer <redacted>").replace(/\s+/g, " ").slice(0, 1024) : void 0;
+      const result = { status: response.status, payload, message };
+      if (response.ok) {
+        this.logger.debug("agentcore.controller.request.succeeded", { ...fields, status: response.status });
+        return result;
+      }
+      this.logger.warn("agentcore.controller.request.failed", {
+        ...fields,
+        status: response.status,
+        attempt,
+        message,
+        requestId: _nullishCoalesce(_nullishCoalesce(response.headers.get("x-acs-request-id"), () => ( response.headers.get("x-request-id"))), () => ( void 0))
+      });
+      if (![500, 502, 503, 504].includes(response.status) || attempt === this.maxAttempts) return result;
+      await _promises3.setTimeout.call(void 0, 50 * 2 ** (attempt - 1), void 0, { signal: this.lifetime.signal });
+    }
+    throw new (0, _chunkJSP7ZROScjs.CredentialExchangeError)("Controller request did not complete");
+  }
+}, _class);
+
+
+
+
+
+
+
+exports.DEFAULT_AGENT_SA_TOKEN_PATH = DEFAULT_AGENT_SA_TOKEN_PATH; exports.AgentSATokenProvider = AgentSATokenProvider; exports.getAgentSAToken = getAgentSAToken; exports.refreshAgentSAToken = refreshAgentSAToken; exports.ControllerClient = ControllerClient;
+//# sourceMappingURL=chunk-2E5EWEDG.cjs.map

package/dist/chunk-2E5EWEDG.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/Users/zhuoguang/Documents/Code/collaborate/hiclaw/agentcore-sdk-nodejs/dist/chunk-2E5EWEDG.cjs","../src/auth/agent-sa-token.ts","../src/auth/controller.ts"],"names":[],"mappings":"AAAA;AACE;AACF,wDAA6B;AAC7B;AACE;AACF,wDAA6B;AAC7B;AACE;AACA;AACF,wDAA6B;AAC7B;AACA;ACXA,uCAAyB;AAGlB,IAAM,4BAAA,EAA8B,gCAAA;AAMpC,IAAM,qBAAA,EAAN,MAAyD;AAAA,EAC9D,WAAA,CAAqB,KAAA,EAAO,2BAAA,EAA6B;AAApC,IAAA,IAAA,CAAA,KAAA,EAAA,IAAA;AAAA,EAAqC;AAAA,EAArC;AAAA,EACrB,MAAM,GAAA,CAAA,EAAuB;AAC3B,IAAA,IAAI,KAAA;AACJ,IAAA,IAAI;AAAE,MAAA,MAAA,EAAQ,MAAM,gCAAA,IAAS,CAAK,IAAA,EAAM,MAAM,CAAA;AAAA,IAAG,EAAA,MAAA,CAAS,KAAA,EAAO;AAC/D,MAAA,MAAM,IAAI,0CAAA,CAAoB,qCAAA,EAAuC,EAAE,MAAM,CAAC,CAAA;AAAA,IAChF;AACA,IAAA,OAAO,UAAA,CAAW,KAAK,CAAA;AAAA,EACzB;AACF,CAAA;AAEA,SAAS,UAAA,CAAW,KAAA,EAAuB;AACzC,EAAA,GAAA,CAAI,OAAO,MAAA,IAAU,SAAA,GAAY,CAAC,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,MAAM,IAAI,0CAAA,CAAoB,mDAAmD,CAAA;AACjI,EAAA,OAAO,KAAA,CAAM,IAAA,CAAK,CAAA;AACpB;AACA,MAAA,SAAsB,eAAA,CAAgB,MAAA,EAA6C;AACjF,EAAA,OAAO,UAAA,CAAW,MAAM,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA;AACtC;AACA,MAAA,SAAsB,mBAAA,CAAoB,MAAA,EAA4B,OAAA,EAAkC;AACtG,EAAA,OAAO,UAAA,CAAW,MAAA,CAAO,MAAA,CAAO,QAAA,EAAU,MAAA,CAAO,OAAA,CAAQ,OAAO,EAAA,EAAI,MAAA,CAAO,GAAA,CAAI,CAAA,CAAE,CAAA;AACnF;ADUA;AACA;AExCA,4CAAoC;AAkB7B,IAAM,iBAAA,YAAN,MAAuB;AAAA,EAO5B,WAAA,CAAY,QAAA,EAAmC,QAAA,EAA8B,QAAA,EAA6B,CAAC,CAAA,EAAG;AAA/D,IAAA,IAAA,CAAA,SAAA,EAAA,QAAA;AAC7C,IAAA,IAAA,CAAK,SAAA,EAAW,uCAAA,QAAQ,EAAU,qBAAqB,CAAA;AACvD,IAAA,IAAA,CAAK,UAAA,mBAAY,OAAA,CAAQ,SAAA,UAAa,KAAA;AACtC,IAAA,IAAA,CAAK,YAAA,mBAAc,OAAA,CAAQ,WAAA,UAAe,GAAA;AAC1C,IAAA,GAAA,CAAI,CAAC,MAAA,CAAO,QAAA,CAAS,IAAA,CAAK,SAAS,EAAA,GAAK,IAAA,CAAK,UAAA,GAAa,EAAA,GAAK,CAAC,MAAA,CAAO,SAAA,CAAU,IAAA,CAAK,WAAW,EAAA,GAAK,IAAA,CAAK,YAAA,EAAc,CAAA,EAAG;AAC1H,MAAA,MAAM,IAAI,SAAA,CAAU,4CAA4C,CAAA;AAAA,IAClE;AACA,IAAA,IAAA,CAAK,OAAA,mBAAS,OAAA,CAAQ,MAAA,UAAU,8BAAA;AAAA,EAClC;AAAA,EAR+C;AAAA,EAN9B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,iBACA,SAAA,EAAW,IAAI,eAAA,CAAgB,EAAA;AAAA,EAYhD,MAAM,IAAA,CAAK,IAAA,EAAc,OAAA,EAAkF;AACzG,IAAA,IAAI,MAAA,EAAQ,MAAM,eAAA,CAAgB,IAAA,CAAK,QAAQ,CAAA;AAC/C,IAAA,IAAI,SAAA,EAAW,MAAM,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,KAAA,EAAO,OAAO,CAAA;AACtD,IAAA,GAAA,CAAI,QAAA,CAAS,OAAA,IAAW,GAAA,EAAK;AAC3B,MAAA,MAAM,QAAA,EAAU,MAAM,mBAAA,CAAoB,IAAA,CAAK,QAAA,EAAU,KAAK,CAAA;AAC9D,MAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,kCAAA,EAAoC,EAAE,OAAA,EAAS,QAAA,IAAY,MAAM,CAAC,CAAA;AACnF,MAAA,GAAA,CAAI,QAAA,IAAY,KAAA,EAAO;AACrB,QAAA,MAAA,EAAQ,OAAA;AACR,QAAA,SAAA,EAAW,MAAM,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,KAAA,EAAO,OAAO,CAAA;AAAA,MACpD;AAAA,IACF;AACA,IAAA,GAAA,CAAI,QAAA,CAAS,OAAA,IAAW,GAAA,EAAK,MAAM,IAAI,0CAAA,CAAoB,wCAAwC,CAAA;AACnG,IAAA,OAAO,QAAA;AAAA,EACT;AAAA,EAEA,KAAA,CAAA,EAAc;AAAE,IAAA,IAAA,CAAK,QAAA,CAAS,KAAA,CAAM,CAAA;AAAA,EAAG;AAAA,EAEvC,MAAc,OAAA,CAAQ,IAAA,EAAc,KAAA,EAAe,OAAA,EAAkF;AACnI,IAAA,MAAM,IAAA,EAAM,IAAI,GAAA,CAAI,CAAA,EAAA;AACC,IAAA;AACJ,IAAA;AACA,IAAA;AACE,IAAA;AACH,MAAA;AACI,MAAA;AACd,MAAA;AACA,MAAA;AACY,MAAA;AACF,MAAA;AACC,MAAA;AACX,MAAA;AACe,QAAA;AACP,UAAA;AAAmB,UAAA;AAA0C,UAAA;AAC3D,UAAA;AAAU,UAAA;AACrB,QAAA;AACY,QAAA;AACC,MAAA;AACA,QAAA;AACG,QAAA;AACD,QAAA;AACC,QAAA;AACjB,QAAA;AACA,MAAA;AAAuB,QAAA;AAAQ,MAAA;AAC7B,MAAA;AACA,MAAA;AAAiB,QAAA;AAAqB,MAAA;AAAY,QAAA;AAAW,MAAA;AAE9C,MAAA;AACH,MAAA;AAGC,MAAA;AACA,MAAA;AACH,QAAA;AACL,QAAA;AACT,MAAA;AACiB,MAAA;AACZ,QAAA;AAAyB,QAAA;AAAQ,QAAA;AAAS,QAAA;AAClC,QAAA;AACZ,MAAA;AACe,MAAA;AACC,MAAA;AACnB,IAAA;AACU,IAAA;AACZ,EAAA;AACF;AFkCyB;AACA;AACA;AACA;AACA;AACA;AACA;AACA","file":"/Users/zhuoguang/Documents/Code/collaborate/hiclaw/agentcore-sdk-nodejs/dist/chunk-2E5EWEDG.cjs","sourcesContent":[null,"import { readFile } from 'node:fs/promises';\nimport { AuthenticationError } from '../errors';\n\nexport const DEFAULT_AGENT_SA_TOKEN_PATH = '/var/run/agentcore/agent/token';\nexport interface AgentSATokenSource {\n  get(): string | Promise<string>;\n  refresh?(current: string): string | Promise<string>;\n}\n\nexport class AgentSATokenProvider implements AgentSATokenSource {\n  constructor(readonly path = DEFAULT_AGENT_SA_TOKEN_PATH) {}\n  async get(): Promise<string> {\n    let token: string;\n    try { token = await readFile(this.path, 'utf8'); } catch (cause) {\n      throw new AuthenticationError('cannot read the Agent SA token file', { cause });\n    }\n    return validToken(token);\n  }\n}\n\nfunction validToken(token: string): string {\n  if (typeof token !== 'string' || !token.trim()) throw new AuthenticationError('the Agent SA token source returned an empty token');\n  return token.trim();\n}\nexport async function getAgentSAToken(source: AgentSATokenSource): Promise<string> {\n  return validToken(await source.get());\n}\nexport async function refreshAgentSAToken(source: AgentSATokenSource, current: string): Promise<string> {\n  return validToken(await (source.refresh ? source.refresh(current) : source.get()));\n}\n","import { setTimeout as sleep } from 'node:timers/promises';\nimport { AuthenticationError, CredentialExchangeError } from '../errors';\nimport { nullLogger, type Logger } from '../logging';\nimport { httpUrl } from '../runtime/config';\nimport { getAgentSAToken, refreshAgentSAToken, type AgentSATokenSource } from './agent-sa-token';\n\nexport interface ControllerOptions {\n  timeoutMs?: number;\n  maxAttempts?: number;\n  logger?: Logger;\n}\ninterface ControllerResponse {\n  status: number;\n  payload: unknown;\n  message?: string;\n}\n\n// Shared transport only for the Controller's idempotent credential exchanges.\nexport class ControllerClient {\n  private readonly endpoint: string;\n  private readonly timeoutMs: number;\n  private readonly maxAttempts: number;\n  private readonly logger: Logger;\n  private readonly lifetime = new AbortController();\n\n  constructor(endpoint: string, private readonly saTokens: AgentSATokenSource, options: ControllerOptions = {}) {\n    this.endpoint = httpUrl(endpoint, 'Controller endpoint');\n    this.timeoutMs = options.timeoutMs ?? 10_000;\n    this.maxAttempts = options.maxAttempts ?? 3;\n    if (!Number.isFinite(this.timeoutMs) || this.timeoutMs <= 0 || !Number.isInteger(this.maxAttempts) || this.maxAttempts < 1) {\n      throw new TypeError('timeoutMs and maxAttempts must be positive');\n    }\n    this.logger = options.logger ?? nullLogger;\n  }\n\n  async post(path: string, purpose?: string | Readonly<Record<string, string>>): Promise<ControllerResponse> {\n    let token = await getAgentSAToken(this.saTokens);\n    let response = await this.request(path, token, purpose);\n    if (response.status === 401) {\n      const rotated = await refreshAgentSAToken(this.saTokens, token);\n      this.logger.warn('agentcore.controller.sa_rejected', { rotated: rotated !== token });\n      if (rotated !== token) {\n        token = rotated;\n        response = await this.request(path, token, purpose);\n      }\n    }\n    if (response.status === 401) throw new AuthenticationError('Controller rejected the Agent SA token');\n    return response;\n  }\n\n  close(): void { this.lifetime.abort(); }\n\n  private async request(path: string, token: string, purpose?: string | Readonly<Record<string, string>>): Promise<ControllerResponse> {\n    const url = new URL(`${this.endpoint}${path}`);\n    const query = typeof purpose === 'string' ? { purpose } : purpose;\n    for (const [key, value] of Object.entries(query ?? {})) url.searchParams.set(key, value);\n    const fields = { url: `${url.origin}${url.pathname}`, purpose: query?.purpose ?? 'default' };\n    for (let attempt = 1; attempt <= this.maxAttempts; attempt++) {\n      this.lifetime.signal.throwIfAborted();\n      this.logger.debug('agentcore.controller.request.started', { ...fields, attempt });\n      let response: Response;\n      let text: string;\n      const timeout = new AbortController();\n      const timer = setTimeout(() => timeout.abort(), this.timeoutMs);\n      const signal = AbortSignal.any([this.lifetime.signal, timeout.signal]);\n      try {\n        response = await fetch(url, {\n          method: 'POST', headers: { Authorization: `Bearer ${token}` }, body: '',\n          redirect: 'manual', signal,\n        });\n        text = await response.text();\n      } catch (cause) {\n        this.lifetime.signal.throwIfAborted();\n        this.logger.warn('agentcore.controller.request.failed', { ...fields, attempt, reason: 'transport_error' });\n        if (attempt === this.maxAttempts) throw new CredentialExchangeError('cannot reach the AgentCore Controller', { cause });\n        await sleep(50 * 2 ** (attempt - 1), undefined, { signal: this.lifetime.signal });\n        continue;\n      } finally { clearTimeout(timer); }\n      let payload: unknown;\n      try { payload = JSON.parse(text); } catch { payload = undefined; }\n      // Never log a successful credential response, headers, or arbitrary JSON fields.\n      const rawMessage = payload && typeof payload === 'object' && 'message' in payload ? payload.message : undefined;\n      const message = typeof rawMessage === 'string'\n        ? rawMessage.split(token).join('<redacted>').replace(/Bearer\\s+\\S+/gi, 'Bearer <redacted>').replace(/\\s+/g, ' ').slice(0, 1024)\n        : undefined;\n      const result = { status: response.status, payload, message };\n      if (response.ok) {\n        this.logger.debug('agentcore.controller.request.succeeded', { ...fields, status: response.status });\n        return result;\n      }\n      this.logger.warn('agentcore.controller.request.failed', {\n        ...fields, status: response.status, attempt, message,\n        requestId: response.headers.get('x-acs-request-id') ?? response.headers.get('x-request-id') ?? undefined,\n      });\n      if (![500, 502, 503, 504].includes(response.status) || attempt === this.maxAttempts) return result;\n      await sleep(50 * 2 ** (attempt - 1), undefined, { signal: this.lifetime.signal });\n    }\n    throw new CredentialExchangeError('Controller request did not complete');\n  }\n}\n"]}

package/dist/chunk-55XZZRKO.js

@@ -0,0 +1,220 @@
+import {
+  nullLogger
+} from "./chunk-NZL3VPJ2.js";
+import {
+  ConfigError,
+  ResourceNotConfiguredError
+} from "./chunk-MZ5UWGXS.js";
+
+// src/skill/loader.ts
+import { createHash } from "crypto";
+import { lstat, mkdir, mkdtemp, readFile, readdir, rename, rm, writeFile } from "fs/promises";
+import { basename, dirname, join, posix, resolve } from "path";
+import { fromBuffer } from "yauzl";
+import { parseDocument } from "yaml";
+var MAX_BYTES = 10 * 1024 * 1024;
+var METADATA = ".agentcore-skill.json";
+var writes = /* @__PURE__ */ new Map();
+var Skills = class {
+  constructor(options = {}) {
+    this.options = options;
+    this.workspace = resolve(options.workspaceDir ?? process.env.AGENTCORE_SKILL_WORKSPACE_DIR ?? ".skills/.agentcore-managed");
+    this.logger = options.logger ?? nullLogger;
+  }
+  options;
+  pins = /* @__PURE__ */ new Map();
+  workspace;
+  logger;
+  async local(root) {
+    this.logger.info("agentcore.skill.local.load.started", { root });
+    try {
+      root = resolve(root);
+      if (!(await lstat(root)).isDirectory()) throw new ConfigError("local Skill root is not a directory");
+      const entries = await readdir(root, { withFileTypes: true });
+      const directories = entries.some((entry) => entry.name === "SKILL.md") ? [root] : entries.sort((a, b) => a.name.localeCompare(b.name)).flatMap((entry) => {
+        if (entry.isSymbolicLink()) throw new ConfigError("local Skill root must not contain symbolic-link Skills");
+        return entry.isDirectory() ? [join(root, entry.name)] : [];
+      });
+      const result = [];
+      for (const directory of directories) {
+        if ((await readdir(directory)).includes("SKILL.md")) result.push(await loadDirectory(directory));
+      }
+      this.logger.info("agentcore.skill.local.load.succeeded", { root, skill_count: result.length });
+      return result;
+    } catch (error) {
+      this.logger.warn("agentcore.skill.local.load.failed", { root, error_type: error instanceof Error ? error.name : "Error" });
+      throw error;
+    }
+  }
+  async managed(name, options = {}) {
+    if (!this.options.runtime) throw new ResourceNotConfiguredError("managed Skill runtime is not configured");
+    const { workspaceId, provider } = await this.options.runtime();
+    component(name, "name");
+    component(workspaceId, "workspace ID");
+    if (options.version !== void 0) component(options.version, "version");
+    const key = JSON.stringify([workspaceId, name, options.version]);
+    const cached = this.pins.get(key);
+    if (cached) return cached;
+    const pending = (async () => {
+      this.logger.info("agentcore.skill.managed.load.started", { workspace_id: workspaceId, name, version: options.version ?? "latest" });
+      const artifact = await provider.getSkill(name, options.version);
+      component(artifact.version, "version");
+      const files = await unpack(name, artifact.archive);
+      const hash = createHash("sha256");
+      for (const [path, data] of [...files.entries()].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) hash.update(path).update("\0").update(data).update("\0");
+      const digest = hash.digest("hex");
+      const target = join(this.workspace, workspaceId, name, artifact.version);
+      const metadata = { source: "agentcore", workspaceId, name, version: artifact.version, digest };
+      const write = (writes.get(target) ?? Promise.resolve()).catch(() => void 0).then(() => materialize(target, files, metadata));
+      writes.set(target, write);
+      try {
+        await write;
+      } finally {
+        if (writes.get(target) === write) writes.delete(target);
+      }
+      const sourceFiles = ["SKILL.md", ...[...files.keys()].filter((path) => path !== "SKILL.md").sort()];
+      const skill = Object.freeze({ ...await loadDirectory(target, sourceFiles), ...metadata, source: "agentcore" });
+      this.logger.info("agentcore.skill.managed.load.succeeded", { workspace_id: workspaceId, name, version: artifact.version, digest });
+      return skill;
+    })();
+    this.pins.set(key, pending);
+    try {
+      return await pending;
+    } catch (error) {
+      this.pins.delete(key);
+      this.logger.warn("agentcore.skill.managed.load.failed", { workspace_id: workspaceId, name, error_type: error instanceof Error ? error.name : "Error" });
+      throw error;
+    }
+  }
+};
+function component(value, label) {
+  if (!value.trim() || /[\\/:\0]/.test(value) || value === "." || value === "..") throw new ConfigError(`managed Skill ${label} is invalid`);
+}
+function safePath(path) {
+  if (!path || /[\\:\0]/.test(path) || posix.isAbsolute(path) || path !== posix.normalize(path) || path.split("/").some((part) => part === "." || part === "..") || path === METADATA) throw new ConfigError("managed Skill contains an unsafe resource path");
+}
+async function unpack(name, archive) {
+  if (!archive.length || archive.length > MAX_BYTES) throw new ConfigError("Skill package exceeds the 10 MiB size limit");
+  try {
+    const zip = await new Promise((accept, reject) => fromBuffer(Buffer.from(archive), { lazyEntries: true, strictFileNames: true }, (error, value) => error ? reject(error) : accept(value)));
+    const files = /* @__PURE__ */ new Map();
+    let total = 0;
+    await new Promise((accept, reject) => {
+      zip.on("error", reject);
+      zip.on("end", accept);
+      zip.on("entry", (entry) => {
+        void (async () => {
+          if (entry.fileName.endsWith("/")) return;
+          safePath(entry.fileName);
+          if (!entry.fileName.startsWith(`${name}/`)) throw new ConfigError("managed Skill package must use the Skill name as its root directory");
+          const path = entry.fileName.slice(name.length + 1);
+          safePath(path);
+          if (files.has(path)) throw new ConfigError("managed Skill package contains a duplicate path");
+          if ((entry.externalFileAttributes >>> 16 & 61440) === 40960) throw new ConfigError("Skill directories must not contain symbolic links");
+          if (entry.uncompressedSize > MAX_BYTES - total) throw new ConfigError("Skill content exceeds the 10 MiB size limit");
+          const stream = await new Promise((resolve2, reject2) => zip.openReadStream(entry, (error, stream2) => error ? reject2(error) : resolve2(stream2)));
+          const chunks = [];
+          for await (const chunk of stream) {
+            const data = Buffer.from(chunk);
+            total += data.length;
+            if (total > MAX_BYTES) throw new ConfigError("Skill content exceeds the 10 MiB size limit");
+            chunks.push(data);
+          }
+          files.set(path, Buffer.concat(chunks));
+        })().then(() => zip.readEntry(), (error) => {
+          zip.close();
+          reject(error);
+        });
+      });
+      zip.readEntry();
+    });
+    if (!files.has("SKILL.md")) throw new ConfigError(`managed Skill package does not contain ${name}/SKILL.md`);
+    for (const path of files.keys()) {
+      let parent = posix.dirname(path);
+      while (parent !== ".") {
+        if (files.has(parent)) throw new ConfigError("managed Skill contains a colliding resource path");
+        parent = posix.dirname(parent);
+      }
+    }
+    return files;
+  } catch (error) {
+    if (error instanceof ConfigError) throw error;
+    throw new ConfigError("managed Skill package is not a valid ZIP archive");
+  }
+}
+async function materialize(target, files, metadata) {
+  try {
+    const stat = await lstat(target);
+    if (stat.isDirectory() && !stat.isSymbolicLink()) {
+      const existing = JSON.parse(await readFile(join(target, METADATA), "utf8"));
+      if (JSON.stringify(existing) === JSON.stringify(metadata)) return;
+    }
+  } catch (error) {
+    if (!(error instanceof SyntaxError) && error.code !== "ENOENT") throw error;
+  }
+  await mkdir(dirname(target), { recursive: true });
+  const temporary = await mkdtemp(join(dirname(target), ".skill-"));
+  try {
+    for (const [path, content] of files) {
+      const destination = join(temporary, path);
+      await mkdir(dirname(destination), { recursive: true });
+      await writeFile(destination, content);
+    }
+    await writeFile(join(temporary, METADATA), JSON.stringify(metadata));
+    await loadDirectory(temporary);
+    await rm(target, { recursive: true, force: true });
+    await rename(temporary, target);
+  } finally {
+    await rm(temporary, { recursive: true, force: true });
+  }
+}
+async function loadDirectory(root, sourceFiles) {
+  const files = [];
+  let total = 0;
+  async function walk(directory, prefix = "") {
+    for (const entry of (await readdir(directory, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {
+      if (entry.isSymbolicLink()) throw new ConfigError("Skill directories must not contain symbolic links");
+      const name = prefix + entry.name;
+      if (entry.isDirectory()) await walk(join(directory, entry.name), `${name}/`);
+      else if (entry.isFile() && entry.name !== METADATA) {
+        total += (await lstat(join(directory, entry.name))).size;
+        if (total > MAX_BYTES) throw new ConfigError("Skill content exceeds the 10 MiB size limit");
+        files.push(name);
+      }
+    }
+  }
+  if (sourceFiles) {
+    for (const name of sourceFiles) {
+      const entry = await lstat(join(root, name));
+      if (entry.isSymbolicLink() || !entry.isFile()) throw new ConfigError("managed Skill workspace is missing a source file");
+      files.push(name);
+    }
+  } else await walk(root);
+  const instruction = new TextDecoder("utf8", { fatal: true }).decode(await readFile(join(root, "SKILL.md")));
+  const match = /^---\s*\n([\s\S]*?)\n---(?:\s*\n|$)/.exec(instruction);
+  const metadata = {};
+  if (match) {
+    const document = parseDocument(match[1]);
+    if (document.errors.length) throw new ConfigError("SKILL.md contains invalid YAML frontmatter");
+    let value;
+    try {
+      value = document.toJS({ maxAliasCount: 0 }) ?? {};
+    } catch {
+      throw new ConfigError("SKILL.md contains invalid YAML frontmatter");
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value)) throw new ConfigError("SKILL.md frontmatter must be an object");
+    for (const key of ["name", "description", "version"]) {
+      const item = value[key];
+      if (item !== void 0 && item !== null) {
+        if (typeof item !== "string") throw new ConfigError(`SKILL.md frontmatter ${key} must be a string`);
+        metadata[key] = item;
+      }
+    }
+  }
+  return Object.freeze({ name: metadata.name || basename(root), description: metadata.description || "", version: metadata.version || "", instruction, root, files: Object.freeze(files), source: "local" });
+}
+
+export {
+  Skills
+};
+//# sourceMappingURL=chunk-55XZZRKO.js.map

package/dist/chunk-55XZZRKO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/skill/loader.ts"],"sourcesContent":["import { createHash } from 'node:crypto';\nimport { lstat, mkdir, mkdtemp, readFile, readdir, rename, rm, writeFile } from 'node:fs/promises';\nimport { basename, dirname, join, posix, resolve } from 'node:path';\nimport { fromBuffer, type Entry, type ZipFile } from 'yauzl';\nimport { parseDocument } from 'yaml';\nimport type { SkillArtifact } from '../controlplane/client';\nimport { ConfigError, ResourceNotConfiguredError } from '../errors';\nimport { nullLogger, type Logger } from '../logging';\n\nconst MAX_BYTES = 10 * 1024 * 1024;\nconst METADATA = '.agentcore-skill.json';\nconst writes = new Map<string, Promise<void>>();\nexport interface Skill {\n  readonly name: string;\n  readonly description: string;\n  readonly version: string;\n  readonly instruction: string;\n  readonly root: string;\n  readonly files: readonly string[];\n  readonly source: 'local' | 'agentcore';\n  readonly digest?: string;\n  readonly workspaceId?: string;\n}\nexport interface SkillProvider { getSkill(name: string, version?: string): Promise<SkillArtifact>; }\nexport interface SkillsOptions {\n  workspaceDir?: string;\n  runtime?: () => Promise<{ workspaceId: string; provider: SkillProvider }>;\n  logger?: Logger;\n}\n\nexport class Skills {\n  private readonly pins = new Map<string, Promise<Skill>>();\n  private readonly workspace: string;\n  private readonly logger: Logger;\n  constructor(private readonly options: SkillsOptions = {}) {\n    this.workspace = resolve(options.workspaceDir ?? process.env.AGENTCORE_SKILL_WORKSPACE_DIR ?? '.skills/.agentcore-managed');\n    this.logger = options.logger ?? nullLogger;\n  }\n  async local(root: string): Promise<Skill[]> {\n    this.logger.info('agentcore.skill.local.load.started', { root });\n    try {\n      root = resolve(root);\n      if (!(await lstat(root)).isDirectory()) throw new ConfigError('local Skill root is not a directory');\n      const entries = await readdir(root, { withFileTypes: true });\n      const directories = entries.some((entry) => entry.name === 'SKILL.md') ? [root] : entries.sort((a, b) => a.name.localeCompare(b.name)).flatMap((entry) => {\n        if (entry.isSymbolicLink()) throw new ConfigError('local Skill root must not contain symbolic-link Skills');\n        return entry.isDirectory() ? [join(root, entry.name)] : [];\n      });\n      const result: Skill[] = [];\n      for (const directory of directories) {\n        if ((await readdir(directory)).includes('SKILL.md')) result.push(await loadDirectory(directory));\n      }\n      this.logger.info('agentcore.skill.local.load.succeeded', { root, skill_count: result.length }); return result;\n    } catch (error) { this.logger.warn('agentcore.skill.local.load.failed', { root, error_type: error instanceof Error ? error.name : 'Error' }); throw error; }\n  }\n  async managed(name: string, options: { version?: string } = {}): Promise<Skill> {\n    if (!this.options.runtime) throw new ResourceNotConfiguredError('managed Skill runtime is not configured');\n    const { workspaceId, provider } = await this.options.runtime();\n    component(name, 'name'); component(workspaceId, 'workspace ID');\n    if (options.version !== undefined) component(options.version, 'version');\n    const key = JSON.stringify([workspaceId, name, options.version]);\n    const cached = this.pins.get(key); if (cached) return cached;\n    const pending = (async () => {\n      this.logger.info('agentcore.skill.managed.load.started', { workspace_id: workspaceId, name, version: options.version ?? 'latest' });\n      const artifact = await provider.getSkill(name, options.version); component(artifact.version, 'version');\n      const files = await unpack(name, artifact.archive);\n      const hash = createHash('sha256');\n      for (const [path, data] of [...files.entries()].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) hash.update(path).update('\\0').update(data).update('\\0');\n      const digest = hash.digest('hex');\n      const target = join(this.workspace, workspaceId, name, artifact.version);\n      const metadata = { source: 'agentcore', workspaceId, name, version: artifact.version, digest };\n      // Serialize writes to the same named version across Core instances in this process.\n      const write = (writes.get(target) ?? Promise.resolve()).catch(() => undefined).then(() => materialize(target, files, metadata));\n      writes.set(target, write);\n      try { await write; } finally { if (writes.get(target) === write) writes.delete(target); }\n      const sourceFiles = ['SKILL.md', ...[...files.keys()].filter((path) => path !== 'SKILL.md').sort()];\n      const skill = Object.freeze({ ...await loadDirectory(target, sourceFiles), ...metadata, source: 'agentcore' as const });\n      this.logger.info('agentcore.skill.managed.load.succeeded', { workspace_id: workspaceId, name, version: artifact.version, digest });\n      return skill;\n    })();\n    this.pins.set(key, pending);\n    try { return await pending; } catch (error) {\n      this.pins.delete(key); this.logger.warn('agentcore.skill.managed.load.failed', { workspace_id: workspaceId, name, error_type: error instanceof Error ? error.name : 'Error' }); throw error;\n    }\n  }\n}\n\nfunction component(value: string, label: string): void {\n  if (!value.trim() || /[\\\\/:\\0]/.test(value) || value === '.' || value === '..') throw new ConfigError(`managed Skill ${label} is invalid`);\n}\nfunction safePath(path: string): void {\n  if (!path || /[\\\\:\\0]/.test(path) || posix.isAbsolute(path) || path !== posix.normalize(path) || path.split('/').some((part) => part === '.' || part === '..') || path === METADATA) throw new ConfigError('managed Skill contains an unsafe resource path');\n}\nasync function unpack(name: string, archive: Uint8Array): Promise<Map<string, Buffer>> {\n  if (!archive.length || archive.length > MAX_BYTES) throw new ConfigError('Skill package exceeds the 10 MiB size limit');\n  try {\n    const zip = await new Promise<ZipFile>((accept, reject) => fromBuffer(Buffer.from(archive), { lazyEntries: true, strictFileNames: true }, (error, value) => error ? reject(error) : accept(value)));\n    const files = new Map<string, Buffer>(); let total = 0;\n    await new Promise<void>((accept, reject) => {\n      zip.on('error', reject); zip.on('end', accept);\n      zip.on('entry', (entry: Entry) => { void (async () => {\n        if (entry.fileName.endsWith('/')) return;\n        safePath(entry.fileName);\n        if (!entry.fileName.startsWith(`${name}/`)) throw new ConfigError('managed Skill package must use the Skill name as its root directory');\n        const path = entry.fileName.slice(name.length + 1); safePath(path);\n        if (files.has(path)) throw new ConfigError('managed Skill package contains a duplicate path');\n        if (((entry.externalFileAttributes >>> 16) & 0xf000) === 0xa000) throw new ConfigError('Skill directories must not contain symbolic links');\n        if (entry.uncompressedSize > MAX_BYTES - total) throw new ConfigError('Skill content exceeds the 10 MiB size limit');\n        const stream = await new Promise<NodeJS.ReadableStream>((resolve, reject) => zip.openReadStream(entry, (error, stream) => error ? reject(error) : resolve(stream)));\n        const chunks: Buffer[] = [];\n        for await (const chunk of stream) { const data = Buffer.from(chunk); total += data.length; if (total > MAX_BYTES) throw new ConfigError('Skill content exceeds the 10 MiB size limit'); chunks.push(data); }\n        files.set(path, Buffer.concat(chunks));\n      })().then(() => zip.readEntry(), (error) => { zip.close(); reject(error); }); });\n      zip.readEntry();\n    });\n    if (!files.has('SKILL.md')) throw new ConfigError(`managed Skill package does not contain ${name}/SKILL.md`);\n    for (const path of files.keys()) {\n      let parent = posix.dirname(path);\n      while (parent !== '.') { if (files.has(parent)) throw new ConfigError('managed Skill contains a colliding resource path'); parent = posix.dirname(parent); }\n    }\n    return files;\n  } catch (error) { if (error instanceof ConfigError) throw error; throw new ConfigError('managed Skill package is not a valid ZIP archive'); }\n}\n\nasync function materialize(target: string, files: Map<string, Buffer>, metadata: Record<string, string>): Promise<void> {\n  try {\n    const stat = await lstat(target);\n    if (stat.isDirectory() && !stat.isSymbolicLink()) {\n      const existing: unknown = JSON.parse(await readFile(join(target, METADATA), 'utf8'));\n      if (JSON.stringify(existing) === JSON.stringify(metadata)) return;\n    }\n  } catch (error) { if (!(error instanceof SyntaxError) && (error as NodeJS.ErrnoException).code !== 'ENOENT') throw error; }\n  await mkdir(dirname(target), { recursive: true });\n  const temporary = await mkdtemp(join(dirname(target), '.skill-'));\n  try {\n    for (const [path, content] of files) { const destination = join(temporary, path); await mkdir(dirname(destination), { recursive: true }); await writeFile(destination, content); }\n    await writeFile(join(temporary, METADATA), JSON.stringify(metadata));\n    await loadDirectory(temporary); // Do not replace a working version with invalid SKILL.md.\n    await rm(target, { recursive: true, force: true });\n    await rename(temporary, target);\n  } finally { await rm(temporary, { recursive: true, force: true }); }\n}\n\nasync function loadDirectory(root: string, sourceFiles?: readonly string[]): Promise<Skill> {\n  const files: string[] = []; let total = 0;\n  async function walk(directory: string, prefix = ''): Promise<void> {\n    for (const entry of (await readdir(directory, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name))) {\n      if (entry.isSymbolicLink()) throw new ConfigError('Skill directories must not contain symbolic links');\n      const name = prefix + entry.name;\n      if (entry.isDirectory()) await walk(join(directory, entry.name), `${name}/`);\n      else if (entry.isFile() && entry.name !== METADATA) { total += (await lstat(join(directory, entry.name))).size; if (total > MAX_BYTES) throw new ConfigError('Skill content exceeds the 10 MiB size limit'); files.push(name); }\n    }\n  }\n  if (sourceFiles) {\n    // Managed packages track source files, not files generated by command execution.\n    for (const name of sourceFiles) {\n      const entry = await lstat(join(root, name));\n      if (entry.isSymbolicLink() || !entry.isFile()) throw new ConfigError('managed Skill workspace is missing a source file');\n      files.push(name);\n    }\n  } else await walk(root);\n  const instruction = new TextDecoder('utf8', { fatal: true }).decode(await readFile(join(root, 'SKILL.md')));\n  const match = /^---\\s*\\n([\\s\\S]*?)\\n---(?:\\s*\\n|$)/.exec(instruction);\n  const metadata: Record<string, string> = {};\n  if (match) {\n    const document = parseDocument(match[1]!);\n    if (document.errors.length) throw new ConfigError('SKILL.md contains invalid YAML frontmatter');\n    let value: unknown;\n    try { value = document.toJS({ maxAliasCount: 0 }) ?? {}; } catch { throw new ConfigError('SKILL.md contains invalid YAML frontmatter'); }\n    if (!value || typeof value !== 'object' || Array.isArray(value)) throw new ConfigError('SKILL.md frontmatter must be an object');\n    for (const key of ['name', 'description', 'version']) {\n      const item = (value as Record<string, unknown>)[key];\n      if (item !== undefined && item !== null) { if (typeof item !== 'string') throw new ConfigError(`SKILL.md frontmatter ${key} must be a string`); metadata[key] = item; }\n    }\n  }\n  return Object.freeze({ name: metadata.name || basename(root), description: metadata.description || '', version: metadata.version || '', instruction, root, files: Object.freeze(files), source: 'local' as const });\n}\n"],"mappings":";;;;;;;;;AAAA,SAAS,kBAAkB;AAC3B,SAAS,OAAO,OAAO,SAAS,UAAU,SAAS,QAAQ,IAAI,iBAAiB;AAChF,SAAS,UAAU,SAAS,MAAM,OAAO,eAAe;AACxD,SAAS,kBAA4C;AACrD,SAAS,qBAAqB;AAK9B,IAAM,YAAY,KAAK,OAAO;AAC9B,IAAM,WAAW;AACjB,IAAM,SAAS,oBAAI,IAA2B;AAmBvC,IAAM,SAAN,MAAa;AAAA,EAIlB,YAA6B,UAAyB,CAAC,GAAG;AAA7B;AAC3B,SAAK,YAAY,QAAQ,QAAQ,gBAAgB,QAAQ,IAAI,iCAAiC,4BAA4B;AAC1H,SAAK,SAAS,QAAQ,UAAU;AAAA,EAClC;AAAA,EAH6B;AAAA,EAHZ,OAAO,oBAAI,IAA4B;AAAA,EACvC;AAAA,EACA;AAAA,EAKjB,MAAM,MAAM,MAAgC;AAC1C,SAAK,OAAO,KAAK,sCAAsC,EAAE,KAAK,CAAC;AAC/D,QAAI;AACF,aAAO,QAAQ,IAAI;AACnB,UAAI,EAAE,MAAM,MAAM,IAAI,GAAG,YAAY,EAAG,OAAM,IAAI,YAAY,qCAAqC;AACnG,YAAM,UAAU,MAAM,QAAQ,MAAM,EAAE,eAAe,KAAK,CAAC;AAC3D,YAAM,cAAc,QAAQ,KAAK,CAAC,UAAU,MAAM,SAAS,UAAU,IAAI,CAAC,IAAI,IAAI,QAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,UAAU;AACxJ,YAAI,MAAM,eAAe,EAAG,OAAM,IAAI,YAAY,wDAAwD;AAC1G,eAAO,MAAM,YAAY,IAAI,CAAC,KAAK,MAAM,MAAM,IAAI,CAAC,IAAI,CAAC;AAAA,MAC3D,CAAC;AACD,YAAM,SAAkB,CAAC;AACzB,iBAAW,aAAa,aAAa;AACnC,aAAK,MAAM,QAAQ,SAAS,GAAG,SAAS,UAAU,EAAG,QAAO,KAAK,MAAM,cAAc,SAAS,CAAC;AAAA,MACjG;AACA,WAAK,OAAO,KAAK,wCAAwC,EAAE,MAAM,aAAa,OAAO,OAAO,CAAC;AAAG,aAAO;AAAA,IACzG,SAAS,OAAO;AAAE,WAAK,OAAO,KAAK,qCAAqC,EAAE,MAAM,YAAY,iBAAiB,QAAQ,MAAM,OAAO,QAAQ,CAAC;AAAG,YAAM;AAAA,IAAO;AAAA,EAC7J;AAAA,EACA,MAAM,QAAQ,MAAc,UAAgC,CAAC,GAAmB;AAC9E,QAAI,CAAC,KAAK,QAAQ,QAAS,OAAM,IAAI,2BAA2B,yCAAyC;AACzG,UAAM,EAAE,aAAa,SAAS,IAAI,MAAM,KAAK,QAAQ,QAAQ;AAC7D,cAAU,MAAM,MAAM;AAAG,cAAU,aAAa,cAAc;AAC9D,QAAI,QAAQ,YAAY,OAAW,WAAU,QAAQ,SAAS,SAAS;AACvE,UAAM,MAAM,KAAK,UAAU,CAAC,aAAa,MAAM,QAAQ,OAAO,CAAC;AAC/D,UAAM,SAAS,KAAK,KAAK,IAAI,GAAG;AAAG,QAAI,OAAQ,QAAO;AACtD,UAAM,WAAW,YAAY;AAC3B,WAAK,OAAO,KAAK,wCAAwC,EAAE,cAAc,aAAa,MAAM,SAAS,QAAQ,WAAW,SAAS,CAAC;AAClI,YAAM,WAAW,MAAM,SAAS,SAAS,MAAM,QAAQ,OAAO;AAAG,gBAAU,SAAS,SAAS,SAAS;AACtG,YAAM,QAAQ,MAAM,OAAO,MAAM,SAAS,OAAO;AACjD,YAAM,OAAO,WAAW,QAAQ;AAChC,iBAAW,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,EAAG,MAAK,OAAO,IAAI,EAAE,OAAO,IAAI,EAAE,OAAO,IAAI,EAAE,OAAO,IAAI;AACvJ,YAAM,SAAS,KAAK,OAAO,KAAK;AAChC,YAAM,SAAS,KAAK,KAAK,WAAW,aAAa,MAAM,SAAS,OAAO;AACvE,YAAM,WAAW,EAAE,QAAQ,aAAa,aAAa,MAAM,SAAS,SAAS,SAAS,OAAO;AAE7F,YAAM,SAAS,OAAO,IAAI,MAAM,KAAK,QAAQ,QAAQ,GAAG,MAAM,MAAM,MAAS,EAAE,KAAK,MAAM,YAAY,QAAQ,OAAO,QAAQ,CAAC;AAC9H,aAAO,IAAI,QAAQ,KAAK;AACxB,UAAI;AAAE,cAAM;AAAA,MAAO,UAAE;AAAU,YAAI,OAAO,IAAI,MAAM,MAAM,MAAO,QAAO,OAAO,MAAM;AAAA,MAAG;AACxF,YAAM,cAAc,CAAC,YAAY,GAAG,CAAC,GAAG,MAAM,KAAK,CAAC,EAAE,OAAO,CAAC,SAAS,SAAS,UAAU,EAAE,KAAK,CAAC;AAClG,YAAM,QAAQ,OAAO,OAAO,EAAE,GAAG,MAAM,cAAc,QAAQ,WAAW,GAAG,GAAG,UAAU,QAAQ,YAAqB,CAAC;AACtH,WAAK,OAAO,KAAK,0CAA0C,EAAE,cAAc,aAAa,MAAM,SAAS,SAAS,SAAS,OAAO,CAAC;AACjI,aAAO;AAAA,IACT,GAAG;AACH,SAAK,KAAK,IAAI,KAAK,OAAO;AAC1B,QAAI;AAAE,aAAO,MAAM;AAAA,IAAS,SAAS,OAAO;AAC1C,WAAK,KAAK,OAAO,GAAG;AAAG,WAAK,OAAO,KAAK,uCAAuC,EAAE,cAAc,aAAa,MAAM,YAAY,iBAAiB,QAAQ,MAAM,OAAO,QAAQ,CAAC;AAAG,YAAM;AAAA,IACxL;AAAA,EACF;AACF;AAEA,SAAS,UAAU,OAAe,OAAqB;AACrD,MAAI,CAAC,MAAM,KAAK,KAAK,WAAW,KAAK,KAAK,KAAK,UAAU,OAAO,UAAU,KAAM,OAAM,IAAI,YAAY,iBAAiB,KAAK,aAAa;AAC3I;AACA,SAAS,SAAS,MAAoB;AACpC,MAAI,CAAC,QAAQ,UAAU,KAAK,IAAI,KAAK,MAAM,WAAW,IAAI,KAAK,SAAS,MAAM,UAAU,IAAI,KAAK,KAAK,MAAM,GAAG,EAAE,KAAK,CAAC,SAAS,SAAS,OAAO,SAAS,IAAI,KAAK,SAAS,SAAU,OAAM,IAAI,YAAY,gDAAgD;AAC7P;AACA,eAAe,OAAO,MAAc,SAAmD;AACrF,MAAI,CAAC,QAAQ,UAAU,QAAQ,SAAS,UAAW,OAAM,IAAI,YAAY,6CAA6C;AACtH,MAAI;AACF,UAAM,MAAM,MAAM,IAAI,QAAiB,CAAC,QAAQ,WAAW,WAAW,OAAO,KAAK,OAAO,GAAG,EAAE,aAAa,MAAM,iBAAiB,KAAK,GAAG,CAAC,OAAO,UAAU,QAAQ,OAAO,KAAK,IAAI,OAAO,KAAK,CAAC,CAAC;AAClM,UAAM,QAAQ,oBAAI,IAAoB;AAAG,QAAI,QAAQ;AACrD,UAAM,IAAI,QAAc,CAAC,QAAQ,WAAW;AAC1C,UAAI,GAAG,SAAS,MAAM;AAAG,UAAI,GAAG,OAAO,MAAM;AAC7C,UAAI,GAAG,SAAS,CAAC,UAAiB;AAAE,cAAM,YAAY;AACpD,cAAI,MAAM,SAAS,SAAS,GAAG,EAAG;AAClC,mBAAS,MAAM,QAAQ;AACvB,cAAI,CAAC,MAAM,SAAS,WAAW,GAAG,IAAI,GAAG,EAAG,OAAM,IAAI,YAAY,qEAAqE;AACvI,gBAAM,OAAO,MAAM,SAAS,MAAM,KAAK,SAAS,CAAC;AAAG,mBAAS,IAAI;AACjE,cAAI,MAAM,IAAI,IAAI,EAAG,OAAM,IAAI,YAAY,iDAAiD;AAC5F,eAAM,MAAM,2BAA2B,KAAM,WAAY,MAAQ,OAAM,IAAI,YAAY,mDAAmD;AAC1I,cAAI,MAAM,mBAAmB,YAAY,MAAO,OAAM,IAAI,YAAY,6CAA6C;AACnH,gBAAM,SAAS,MAAM,IAAI,QAA+B,CAACA,UAASC,YAAW,IAAI,eAAe,OAAO,CAAC,OAAOC,YAAW,QAAQD,QAAO,KAAK,IAAID,SAAQE,OAAM,CAAC,CAAC;AAClK,gBAAM,SAAmB,CAAC;AAC1B,2BAAiB,SAAS,QAAQ;AAAE,kBAAM,OAAO,OAAO,KAAK,KAAK;AAAG,qBAAS,KAAK;AAAQ,gBAAI,QAAQ,UAAW,OAAM,IAAI,YAAY,6CAA6C;AAAG,mBAAO,KAAK,IAAI;AAAA,UAAG;AAC3M,gBAAM,IAAI,MAAM,OAAO,OAAO,MAAM,CAAC;AAAA,QACvC,GAAG,EAAE,KAAK,MAAM,IAAI,UAAU,GAAG,CAAC,UAAU;AAAE,cAAI,MAAM;AAAG,iBAAO,KAAK;AAAA,QAAG,CAAC;AAAA,MAAG,CAAC;AAC/E,UAAI,UAAU;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,MAAM,IAAI,UAAU,EAAG,OAAM,IAAI,YAAY,0CAA0C,IAAI,WAAW;AAC3G,eAAW,QAAQ,MAAM,KAAK,GAAG;AAC/B,UAAI,SAAS,MAAM,QAAQ,IAAI;AAC/B,aAAO,WAAW,KAAK;AAAE,YAAI,MAAM,IAAI,MAAM,EAAG,OAAM,IAAI,YAAY,kDAAkD;AAAG,iBAAS,MAAM,QAAQ,MAAM;AAAA,MAAG;AAAA,IAC7J;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AAAE,QAAI,iBAAiB,YAAa,OAAM;AAAO,UAAM,IAAI,YAAY,kDAAkD;AAAA,EAAG;AAC9I;AAEA,eAAe,YAAY,QAAgB,OAA4B,UAAiD;AACtH,MAAI;AACF,UAAM,OAAO,MAAM,MAAM,MAAM;AAC/B,QAAI,KAAK,YAAY,KAAK,CAAC,KAAK,eAAe,GAAG;AAChD,YAAM,WAAoB,KAAK,MAAM,MAAM,SAAS,KAAK,QAAQ,QAAQ,GAAG,MAAM,CAAC;AACnF,UAAI,KAAK,UAAU,QAAQ,MAAM,KAAK,UAAU,QAAQ,EAAG;AAAA,IAC7D;AAAA,EACF,SAAS,OAAO;AAAE,QAAI,EAAE,iBAAiB,gBAAiB,MAAgC,SAAS,SAAU,OAAM;AAAA,EAAO;AAC1H,QAAM,MAAM,QAAQ,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;AAChD,QAAM,YAAY,MAAM,QAAQ,KAAK,QAAQ,MAAM,GAAG,SAAS,CAAC;AAChE,MAAI;AACF,eAAW,CAAC,MAAM,OAAO,KAAK,OAAO;AAAE,YAAM,cAAc,KAAK,WAAW,IAAI;AAAG,YAAM,MAAM,QAAQ,WAAW,GAAG,EAAE,WAAW,KAAK,CAAC;AAAG,YAAM,UAAU,aAAa,OAAO;AAAA,IAAG;AACjL,UAAM,UAAU,KAAK,WAAW,QAAQ,GAAG,KAAK,UAAU,QAAQ,CAAC;AACnE,UAAM,cAAc,SAAS;AAC7B,UAAM,GAAG,QAAQ,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AACjD,UAAM,OAAO,WAAW,MAAM;AAAA,EAChC,UAAE;AAAU,UAAM,GAAG,WAAW,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EAAG;AACrE;AAEA,eAAe,cAAc,MAAc,aAAiD;AAC1F,QAAM,QAAkB,CAAC;AAAG,MAAI,QAAQ;AACxC,iBAAe,KAAK,WAAmB,SAAS,IAAmB;AACjE,eAAW,UAAU,MAAM,QAAQ,WAAW,EAAE,eAAe,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC,GAAG;AACpH,UAAI,MAAM,eAAe,EAAG,OAAM,IAAI,YAAY,mDAAmD;AACrG,YAAM,OAAO,SAAS,MAAM;AAC5B,UAAI,MAAM,YAAY,EAAG,OAAM,KAAK,KAAK,WAAW,MAAM,IAAI,GAAG,GAAG,IAAI,GAAG;AAAA,eAClE,MAAM,OAAO,KAAK,MAAM,SAAS,UAAU;AAAE,kBAAU,MAAM,MAAM,KAAK,WAAW,MAAM,IAAI,CAAC,GAAG;AAAM,YAAI,QAAQ,UAAW,OAAM,IAAI,YAAY,6CAA6C;AAAG,cAAM,KAAK,IAAI;AAAA,MAAG;AAAA,IACjO;AAAA,EACF;AACA,MAAI,aAAa;AAEf,eAAW,QAAQ,aAAa;AAC9B,YAAM,QAAQ,MAAM,MAAM,KAAK,MAAM,IAAI,CAAC;AAC1C,UAAI,MAAM,eAAe,KAAK,CAAC,MAAM,OAAO,EAAG,OAAM,IAAI,YAAY,kDAAkD;AACvH,YAAM,KAAK,IAAI;AAAA,IACjB;AAAA,EACF,MAAO,OAAM,KAAK,IAAI;AACtB,QAAM,cAAc,IAAI,YAAY,QAAQ,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,MAAM,SAAS,KAAK,MAAM,UAAU,CAAC,CAAC;AAC1G,QAAM,QAAQ,sCAAsC,KAAK,WAAW;AACpE,QAAM,WAAmC,CAAC;AAC1C,MAAI,OAAO;AACT,UAAM,WAAW,cAAc,MAAM,CAAC,CAAE;AACxC,QAAI,SAAS,OAAO,OAAQ,OAAM,IAAI,YAAY,4CAA4C;AAC9F,QAAI;AACJ,QAAI;AAAE,cAAQ,SAAS,KAAK,EAAE,eAAe,EAAE,CAAC,KAAK,CAAC;AAAA,IAAG,QAAQ;AAAE,YAAM,IAAI,YAAY,4CAA4C;AAAA,IAAG;AACxI,QAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,YAAY,wCAAwC;AAC/H,eAAW,OAAO,CAAC,QAAQ,eAAe,SAAS,GAAG;AACpD,YAAM,OAAQ,MAAkC,GAAG;AACnD,UAAI,SAAS,UAAa,SAAS,MAAM;AAAE,YAAI,OAAO,SAAS,SAAU,OAAM,IAAI,YAAY,wBAAwB,GAAG,mBAAmB;AAAG,iBAAS,GAAG,IAAI;AAAA,MAAM;AAAA,IACxK;AAAA,EACF;AACA,SAAO,OAAO,OAAO,EAAE,MAAM,SAAS,QAAQ,SAAS,IAAI,GAAG,aAAa,SAAS,eAAe,IAAI,SAAS,SAAS,WAAW,IAAI,aAAa,MAAM,OAAO,OAAO,OAAO,KAAK,GAAG,QAAQ,QAAiB,CAAC;AACpN;","names":["resolve","reject","stream"]}

package/dist/chunk-5JXA7JPS.js

@@ -0,0 +1,29 @@
+import {
+  ConfigError
+} from "./chunk-MZ5UWGXS.js";
+
+// src/http.ts
+async function readBytes(response, maxBytes, label) {
+  if (!response.body) return new Uint8Array();
+  const reader = response.body.getReader();
+  const chunks = [];
+  let size = 0;
+  try {
+    for (; ; ) {
+      const result = await reader.read();
+      if (result.done) break;
+      size += result.value.length;
+      if (size > maxBytes) throw new ConfigError(`${label} exceeds the ${maxBytes} byte size limit`);
+      chunks.push(result.value);
+    }
+  } finally {
+    await reader.cancel().catch(() => void 0);
+    reader.releaseLock();
+  }
+  return Buffer.concat(chunks, size);
+}
+
+export {
+  readBytes
+};
+//# sourceMappingURL=chunk-5JXA7JPS.js.map

package/dist/chunk-5JXA7JPS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/http.ts"],"sourcesContent":["import { ConfigError } from './errors';\n\n/** Read a bounded body without retaining a credential-bearing URL in errors. */\nexport async function readBytes(response: Response, maxBytes: number, label: string): Promise<Uint8Array> {\n  if (!response.body) return new Uint8Array();\n  const reader = response.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let size = 0;\n  try {\n    for (;;) {\n      const result = await reader.read();\n      if (result.done) break;\n      size += result.value.length;\n      if (size > maxBytes) throw new ConfigError(`${label} exceeds the ${maxBytes} byte size limit`);\n      chunks.push(result.value);\n    }\n  } finally { await reader.cancel().catch(() => undefined); reader.releaseLock(); }\n  return Buffer.concat(chunks, size);\n}\n"],"mappings":";;;;;AAGA,eAAsB,UAAU,UAAoB,UAAkB,OAAoC;AACxG,MAAI,CAAC,SAAS,KAAM,QAAO,IAAI,WAAW;AAC1C,QAAM,SAAS,SAAS,KAAK,UAAU;AACvC,QAAM,SAAuB,CAAC;AAC9B,MAAI,OAAO;AACX,MAAI;AACF,eAAS;AACP,YAAM,SAAS,MAAM,OAAO,KAAK;AACjC,UAAI,OAAO,KAAM;AACjB,cAAQ,OAAO,MAAM;AACrB,UAAI,OAAO,SAAU,OAAM,IAAI,YAAY,GAAG,KAAK,gBAAgB,QAAQ,kBAAkB;AAC7F,aAAO,KAAK,OAAO,KAAK;AAAA,IAC1B;AAAA,EACF,UAAE;AAAU,UAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAAG,WAAO,YAAY;AAAA,EAAG;AAChF,SAAO,OAAO,OAAO,QAAQ,IAAI;AACnC;","names":[]}