ns-kiro-core 0.1.0

package/dist/kiro-cli.js

@@ -0,0 +1,308 @@
+// ABOUTME: Reads and writes credentials from the kiro-cli SQLite database.
+// ABOUTME: Provides fallback auth and write-back to keep kiro-cli in sync after refresh.
+import { execFileSync, execSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
+import { homedir, platform } from "node:os";
+import { join } from "node:path";
+import { formatSafeError } from "./debug.js";
+const require = createRequire(import.meta.url);
+/** kiro-cli's secret-store key for an enterprise external IdP (OIDC) session. */
+const EXTERNAL_IDP_TOKEN_KEY = "kirocli:external-idp:token";
+export function getKiroCliDbPath() {
+    const p = platform();
+    let dbPath;
+    if (p === "win32")
+        dbPath = join(process.env.APPDATA || join(homedir(), "AppData", "Roaming"), "kiro-cli", "data.sqlite3");
+    else if (p === "darwin")
+        dbPath = join(homedir(), "Library", "Application Support", "kiro-cli", "data.sqlite3");
+    else
+        dbPath = join(homedir(), ".local", "share", "kiro-cli", "data.sqlite3");
+    return existsSync(dbPath) ? dbPath : undefined;
+}
+function getNodeSqlite() {
+    try {
+        return require("node:sqlite");
+    }
+    catch {
+        return undefined;
+    }
+}
+function queryKiroCliDb(dbPath, sql) {
+    const sqlite = getNodeSqlite();
+    if (sqlite) {
+        try {
+            const db = new sqlite.DatabaseSync(dbPath, { readOnly: true });
+            try {
+                const rows = db.prepare(sql).all();
+                const result = JSON.stringify(rows);
+                return result === "[]" ? undefined : result;
+            }
+            finally {
+                db.close();
+            }
+        }
+        catch {
+            // Fall through to sqlite3 CLI fallback
+        }
+    }
+    try {
+        const result = execSync(`sqlite3 -json "${dbPath}" "${sql}"`, {
+            encoding: "utf-8",
+            timeout: 5000,
+            stdio: ["pipe", "pipe", "pipe"],
+        }).trim();
+        return result || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function execKiroCliDb(dbPath, sql) {
+    const sqlite = getNodeSqlite();
+    if (sqlite) {
+        try {
+            const db = new sqlite.DatabaseSync(dbPath);
+            try {
+                db.exec(sql);
+                return true;
+            }
+            finally {
+                db.close();
+            }
+        }
+        catch {
+            // Fall through to sqlite3 CLI fallback
+        }
+    }
+    try {
+        execSync(`sqlite3 "${dbPath}"`, {
+            input: sql,
+            encoding: "utf-8",
+            timeout: 5000,
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function getKiroCliCredentials() {
+    const dbPath = getKiroCliDbPath();
+    if (!dbPath)
+        return undefined;
+    try {
+        // Try IDC token first (preferred — has clientId/clientSecret for refresh)
+        const idcCreds = tryKiroCliToken(dbPath, "kirocli:odic:token", "idc");
+        if (idcCreds)
+            return idcCreds;
+        // Fall back to desktop/social token
+        const desktopCreds = tryKiroCliToken(dbPath, "kirocli:social:token", "desktop");
+        if (desktopCreds)
+            return desktopCreds;
+        // Enterprise external IdP (OIDC) login — refreshed against the customer's
+        // own token endpoint rather than AWS SSO
+        const externalIdpCreds = tryKiroCliToken(dbPath, EXTERNAL_IDP_TOKEN_KEY, "external-idp");
+        if (externalIdpCreds)
+            return externalIdpCreds;
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Like getKiroCliCredentials but returns credentials even when the access token
+ * is expired, as long as a refresh token exists. Used to attempt a token refresh
+ * before falling back to the full device code login flow.
+ */
+export function getKiroCliCredentialsAllowExpired() {
+    const dbPath = getKiroCliDbPath();
+    if (!dbPath)
+        return undefined;
+    try {
+        const idcCreds = tryKiroCliToken(dbPath, "kirocli:odic:token", "idc", true);
+        if (idcCreds)
+            return idcCreds;
+        const desktopCreds = tryKiroCliToken(dbPath, "kirocli:social:token", "desktop", true);
+        if (desktopCreds)
+            return desktopCreds;
+        const externalIdpCreds = tryKiroCliToken(dbPath, EXTERNAL_IDP_TOKEN_KEY, "external-idp", true);
+        if (externalIdpCreds)
+            return externalIdpCreds;
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function tryKiroCliToken(dbPath, tokenKey, authMethod, allowExpired = false) {
+    const tokenResult = queryKiroCliDb(dbPath, `SELECT value FROM auth_kv WHERE key = '${tokenKey}'`);
+    if (!tokenResult)
+        return undefined;
+    const rows = JSON.parse(tokenResult);
+    if (!rows[0]?.value)
+        return undefined;
+    const tokenData = JSON.parse(rows[0].value);
+    if (!tokenData.access_token || !tokenData.refresh_token)
+        return undefined;
+    let expiresAt = Date.now() + 3600000;
+    if (tokenData.expires_at)
+        expiresAt = new Date(tokenData.expires_at).getTime();
+    if (!allowExpired && Date.now() >= expiresAt - 2 * 60 * 1000)
+        return undefined;
+    const region = tokenData.region || "us-east-1";
+    if (authMethod === "desktop") {
+        return {
+            refresh: `${tokenData.refresh_token}|desktop`,
+            access: tokenData.access_token,
+            expires: expiresAt,
+            clientId: "",
+            clientSecret: "",
+            region,
+            authMethod: "desktop",
+            profileArn: tokenData.profile_arn || tokenData.profileArn,
+        };
+    }
+    // External IdP — the customer's own OIDC app. It is a public PKCE client, so
+    // there is no client secret; carry the token endpoint through the refresh
+    // string because it is per-tenant and not derivable from a region.
+    if (authMethod === "external-idp") {
+        const idpClientId = tokenData.client_id || tokenData.clientId || "";
+        const issuerUrl = tokenData.issuer_url || "";
+        const tokenEndpoint = tokenData.token_endpoint ||
+            tokenData.tokenEndpoint ||
+            (issuerUrl ? `${issuerUrl.replace(/\/+$/, "")}/v1/token` : "");
+        return {
+            refresh: `${tokenData.refresh_token}|${idpClientId}|${tokenEndpoint}|external-idp`,
+            access: tokenData.access_token,
+            expires: expiresAt,
+            clientId: idpClientId,
+            clientSecret: "",
+            region,
+            authMethod: "external-idp",
+            profileArn: tokenData.profile_arn || tokenData.profileArn,
+        };
+    }
+    // IDC — need device registration credentials for refresh
+    let clientId = "";
+    let clientSecret = "";
+    // Match the device-registration key to the same prefix as the token key
+    const keyPrefix = tokenKey.split(":")[0]; // "kirocli" or "codewhisperer"
+    const deviceResult = queryKiroCliDb(dbPath, `SELECT value FROM auth_kv WHERE key = '${keyPrefix}:odic:device-registration'`);
+    if (deviceResult) {
+        try {
+            const d = JSON.parse(JSON.parse(deviceResult)[0]?.value);
+            clientId = d.client_id || d.clientId || "";
+            clientSecret = d.client_secret || d.clientSecret || "";
+        }
+        catch { }
+    }
+    return {
+        refresh: `${tokenData.refresh_token}|${clientId}|${clientSecret}|idc`,
+        access: tokenData.access_token,
+        expires: expiresAt,
+        clientId,
+        clientSecret,
+        region,
+        authMethod: "idc",
+        profileArn: tokenData.profile_arn || tokenData.profileArn,
+    };
+}
+// Re-export the internal function for use by getKiroCliSocialToken
+export { tryKiroCliToken };
+/**
+ * Get the social token (Google/GitHub) from kiro-cli if available.
+ * Returns undefined if no valid social token exists.
+ * This is used to prefer social login when the user has logged in that way.
+ */
+export function getKiroCliSocialToken() {
+    const dbPath = getKiroCliDbPath();
+    if (!dbPath)
+        return undefined;
+    try {
+        return tryKiroCliToken(dbPath, "kirocli:social:token", "desktop");
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Like getKiroCliSocialToken but returns credentials even when the access token
+ * is expired, as long as a refresh token exists.
+ */
+export function getKiroCliSocialTokenAllowExpired() {
+    const dbPath = getKiroCliDbPath();
+    if (!dbPath)
+        return undefined;
+    try {
+        return tryKiroCliToken(dbPath, "kirocli:social:token", "desktop", true);
+    }
+    catch {
+        return undefined;
+    }
+}
+const TOKEN_KEY_BY_AUTH_METHOD = {
+    idc: ["kirocli:odic:token", "codewhisperer:odic:token"],
+    desktop: ["kirocli:social:token"],
+    "external-idp": [EXTERNAL_IDP_TOKEN_KEY],
+    apikey: [],
+};
+export function saveKiroCliCredentials(creds) {
+    const dbPath = getKiroCliDbPath();
+    if (!dbPath)
+        return;
+    const rawRefreshToken = creds.refresh.split("|")[0] ?? "";
+    // Our expires has a 5-min buffer subtracted; restore approximate actual expiry for kiro-cli
+    const expiresAt = new Date(creds.expires + 5 * 60 * 1000).toISOString();
+    const tokenKeys = TOKEN_KEY_BY_AUTH_METHOD[creds.authMethod] ?? [];
+    for (const key of tokenKeys) {
+        const existing = queryKiroCliDb(dbPath, `SELECT value FROM auth_kv WHERE key = '${key}'`);
+        if (!existing)
+            continue;
+        try {
+            const rows = JSON.parse(existing);
+            if (!rows[0]?.value)
+                continue;
+            const tokenData = JSON.parse(rows[0].value);
+            tokenData.access_token = creds.access;
+            tokenData.refresh_token = rawRefreshToken;
+            tokenData.expires_at = expiresAt;
+            // kiro-cli's ExternalIdpToken record has no region/profile_arn fields;
+            // don't add keys it never wrote.
+            if (creds.authMethod !== "external-idp") {
+                if (creds.region)
+                    tokenData.region = creds.region;
+                if (creds.profileArn)
+                    tokenData.profile_arn = creds.profileArn;
+            }
+            const escaped = JSON.stringify(tokenData).replace(/'/g, "''");
+            const sql = `UPDATE auth_kv SET value = '${escaped}' WHERE key = '${key}';`;
+            if (execKiroCliDb(dbPath, sql))
+                return;
+        }
+        catch { }
+    }
+}
+/**
+ * Ask kiro-cli to refresh its own tokens via `kiro-cli debug refresh-auth-token`,
+ * then re-read the SQLite DB for fresh credentials.
+ *
+ * Returns refreshed credentials on success, or undefined if kiro-cli is not
+ * installed, the command fails, or the DB still has no valid tokens afterward.
+ */
+export function refreshViaKiroCli() {
+    try {
+        execFileSync("kiro-cli", ["debug", "refresh-auth-token"], {
+            timeout: 15000,
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        return getKiroCliCredentials();
+    }
+    catch (error) {
+        console.warn(`[kiro-core] kiro-cli refresh failed: ${formatSafeError(error)}`);
+        return undefined;
+    }
+}
+//# sourceMappingURL=kiro-cli.js.map

package/dist/kiro-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kiro-cli.js","sourceRoot":"","sources":["../src/kiro-cli.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,yFAAyF;AAEzF,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAG7C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/C,iFAAiF;AACjF,MAAM,sBAAsB,GAAG,4BAA4B,CAAC;AAE5D,MAAM,UAAU,gBAAgB;IAC9B,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;IACrB,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC,KAAK,OAAO;QACf,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;SACrG,IAAI,CAAC,KAAK,QAAQ;QAAE,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,qBAAqB,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;;QAC3G,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;IAC7E,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC;AAED,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,aAAa,CAAiC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,GAAW;IACjD,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAe,CAAC;gBAChD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACpC,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;YAC9C,CAAC;oBAAS,CAAC;gBACT,EAAE,CAAC,KAAK,EAAE,CAAC;YACb,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;QACzC,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,kBAAkB,MAAM,MAAM,GAAG,GAAG,EAAE;YAC5D,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,MAAM,IAAI,SAAS,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,GAAW;IAChD,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAC3C,IAAI,CAAC;gBACH,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC;oBAAS,CAAC;gBACT,EAAE,CAAC,KAAK,EAAE,CAAC;YACb,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;QACzC,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,QAAQ,CAAC,YAAY,MAAM,GAAG,EAAE;YAC9B,KAAK,EAAE,GAAG;YACV,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,CAAC;QACH,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,EAAE,oBAAoB,EAAE,KAAK,CAAC,CAAC;QACtE,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,oCAAoC;QACpC,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,EAAE,sBAAsB,EAAE,SAAS,CAAC,CAAC;QAChF,IAAI,YAAY;YAAE,OAAO,YAAY,CAAC;QAEtC,0EAA0E;QAC1E,yCAAyC;QACzC,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,EAAE,sBAAsB,EAAE,cAAc,CAAC,CAAC;QACzF,IAAI,gBAAgB;YAAE,OAAO,gBAAgB,CAAC;QAE9C,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iCAAiC;IAC/C,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC5E,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,EAAE,sBAAsB,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QACtF,IAAI,YAAY;YAAE,OAAO,YAAY,CAAC;QAEtC,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,EAAE,sBAAsB,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;QAC/F,IAAI,gBAAgB;YAAE,OAAO,gBAAgB,CAAC;QAE9C,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,MAAc,EACd,QAAgB,EAChB,UAA0B,EAC1B,YAAY,GAAG,KAAK;IAEpB,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,EAAE,0CAA0C,QAAQ,GAAG,CAAC,CAAC;IAClG,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAA6B,CAAC;IACjE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,SAAS,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IAC1E,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;IACrC,IAAI,SAAS,CAAC,UAAU;QAAE,SAAS,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;IAC/E,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI;QAAE,OAAO,SAAS,CAAC;IAC/E,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,IAAI,WAAW,CAAC;IAE/C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO;YACL,OAAO,EAAE,GAAG,SAAS,CAAC,aAAa,UAAU;YAC7C,MAAM,EAAE,SAAS,CAAC,YAAY;YAC9B,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,EAAE;YACZ,YAAY,EAAE,EAAE;YAChB,MAAM;YACN,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE,SAAS,CAAC,WAAW,IAAI,SAAS,CAAC,UAAU;SAC1D,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,0EAA0E;IAC1E,mEAAmE;IACnE,IAAI,UAAU,KAAK,cAAc,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,SAAS,CAAC,SAAS,IAAI,SAAS,CAAC,QAAQ,IAAI,EAAE,CAAC;QACpE,MAAM,SAAS,GAAW,SAAS,CAAC,UAAU,IAAI,EAAE,CAAC;QACrD,MAAM,aAAa,GACjB,SAAS,CAAC,cAAc;YACxB,SAAS,CAAC,aAAa;YACvB,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACjE,OAAO;YACL,OAAO,EAAE,GAAG,SAAS,CAAC,aAAa,IAAI,WAAW,IAAI,aAAa,eAAe;YAClF,MAAM,EAAE,SAAS,CAAC,YAAY;YAC9B,OAAO,EAAE,SAAS;YAClB,QAAQ,EAAE,WAAW;YACrB,YAAY,EAAE,EAAE;YAChB,MAAM;YACN,UAAU,EAAE,cAAc;YAC1B,UAAU,EAAE,SAAS,CAAC,WAAW,IAAI,SAAS,CAAC,UAAU;SAC1D,CAAC;IACJ,CAAC;IAED,yDAAyD;IACzD,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,wEAAwE;IACxE,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,+BAA+B;IACzE,MAAM,YAAY,GAAG,cAAc,CACjC,MAAM,EACN,0CAA0C,SAAS,4BAA4B,CAChF,CAAC;IACF,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YACzD,QAAQ,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;YAC3C,YAAY,GAAG,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,GAAG,SAAS,CAAC,aAAa,IAAI,QAAQ,IAAI,YAAY,MAAM;QACrE,MAAM,EAAE,SAAS,CAAC,YAAY;QAC9B,OAAO,EAAE,SAAS;QAClB,QAAQ;QACR,YAAY;QACZ,MAAM;QACN,UAAU,EAAE,KAAK;QACjB,UAAU,EAAE,SAAS,CAAC,WAAW,IAAI,SAAS,CAAC,UAAU;KAC1D,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,OAAO,EAAE,eAAe,EAAE,CAAC;AAE3B;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,MAAM,EAAE,sBAAsB,EAAE,SAAS,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iCAAiC;IAC/C,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,MAAM,EAAE,sBAAsB,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,wBAAwB,GAAqC;IACjE,GAAG,EAAE,CAAC,oBAAoB,EAAE,0BAA0B,CAAC;IACvD,OAAO,EAAE,CAAC,sBAAsB,CAAC;IACjC,cAAc,EAAE,CAAC,sBAAsB,CAAC;IACxC,MAAM,EAAE,EAAE;CACX,CAAC;AAEF,MAAM,UAAU,sBAAsB,CAAC,KAAsB;IAC3D,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,4FAA4F;IAC5F,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACxE,MAAM,SAAS,GAAG,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAEnE,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,EAAE,0CAA0C,GAAG,GAAG,CAAC,CAAC;QAC1F,IAAI,CAAC,QAAQ;YAAE,SAAS;QAExB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA6B,CAAC;YAC9D,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK;gBAAE,SAAS;YAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAE5C,SAAS,CAAC,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC;YACtC,SAAS,CAAC,aAAa,GAAG,eAAe,CAAC;YAC1C,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC;YACjC,uEAAuE;YACvE,iCAAiC;YACjC,IAAI,KAAK,CAAC,UAAU,KAAK,cAAc,EAAE,CAAC;gBACxC,IAAI,KAAK,CAAC,MAAM;oBAAE,SAAS,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;gBAClD,IAAI,KAAK,CAAC,UAAU;oBAAE,SAAS,CAAC,WAAW,GAAG,KAAK,CAAC,UAAU,CAAC;YACjE,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC9D,MAAM,GAAG,GAAG,+BAA+B,OAAO,kBAAkB,GAAG,IAAI,CAAC;YAC5E,IAAI,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC;gBAAE,OAAO;QACzC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB;IAC/B,IAAI,CAAC;QACH,YAAY,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,oBAAoB,CAAC,EAAE;YACxD,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QACH,OAAO,qBAAqB,EAAE,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,wCAAwC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/E,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/kiro-ide.d.ts

@@ -0,0 +1,12 @@
+import type { KiroCredentials } from "./oauth.js";
+/**
+ * Returns valid (non-expired) Kiro IDE credentials read from
+ * ~/.aws/sso/cache/kiro-auth-token.json, or undefined if the IDE has not
+ * logged in or the token has already expired.
+ */
+export declare function getKiroIdeCredentials(): KiroCredentials | undefined;
+/**
+ * Like getKiroIdeCredentials but also returns expired tokens so the caller can
+ * attempt a silent OIDC refresh before falling back to the full login flow.
+ */
+export declare function getKiroIdeCredentialsAllowExpired(): KiroCredentials | undefined;

package/dist/kiro-ide.js

@@ -0,0 +1,74 @@
+// ABOUTME: Reads credentials written by the Kiro IDE.
+// ABOUTME: The IDE stores its auth token at ~/.aws/sso/cache/kiro-auth-token.json
+// ABOUTME: on all platforms (Windows, macOS, Linux) after every successful login,
+// ABOUTME: including IAM Identity Center (authMethod: "IdC") and Builder ID.
+// ABOUTME: A companion file, ~/.aws/sso/cache/{clientIdHash}.json, holds the
+// ABOUTME: OIDC clientId/clientSecret needed to silently refresh the access token
+// ABOUTME: via the standard AWS OIDC /token endpoint — no extra login flow needed.
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+// ~/.aws/sso/cache is the standard AWS SSO cache directory on all platforms.
+// Node's os.homedir() returns the correct home directory on Windows, macOS and Linux.
+const SSO_CACHE_DIR = join(homedir(), ".aws", "sso", "cache");
+const KIRO_IDE_TOKEN_PATH = join(SSO_CACHE_DIR, "kiro-auth-token.json");
+function readKiroIdeToken(allowExpired) {
+    try {
+        if (!existsSync(KIRO_IDE_TOKEN_PATH))
+            return undefined;
+        const tokenData = JSON.parse(readFileSync(KIRO_IDE_TOKEN_PATH, "utf-8"));
+        if (!tokenData.accessToken || !tokenData.refreshToken)
+            return undefined;
+        const expiresAt = new Date(tokenData.expiresAt).getTime();
+        if (!allowExpired && Date.now() >= expiresAt - 2 * 60 * 1000)
+            return undefined;
+        const region = tokenData.region ?? "us-east-1";
+        // Load the OIDC client registration so refreshKiroTokenDirect can call the
+        // AWS OIDC /token endpoint with a refresh_token grant without prompting the user.
+        let clientId = "";
+        let clientSecret = "";
+        if (tokenData.clientIdHash) {
+            const regPath = join(SSO_CACHE_DIR, `${tokenData.clientIdHash}.json`);
+            if (existsSync(regPath)) {
+                try {
+                    const reg = JSON.parse(readFileSync(regPath, "utf-8"));
+                    clientId = reg.clientId ?? "";
+                    clientSecret = reg.clientSecret ?? "";
+                }
+                catch {
+                    // Ignore — we can still use the token without a refresh client
+                }
+            }
+        }
+        return {
+            // Pack into the same pipe-delimited format used by the rest of the refresh chain
+            refresh: `${tokenData.refreshToken}|${clientId}|${clientSecret}|idc`,
+            access: tokenData.accessToken,
+            // Subtract 2-min buffer so we refresh before the actual AWS expiry
+            expires: expiresAt - 2 * 60 * 1000,
+            clientId,
+            clientSecret,
+            region,
+            authMethod: "idc",
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Returns valid (non-expired) Kiro IDE credentials read from
+ * ~/.aws/sso/cache/kiro-auth-token.json, or undefined if the IDE has not
+ * logged in or the token has already expired.
+ */
+export function getKiroIdeCredentials() {
+    return readKiroIdeToken(false);
+}
+/**
+ * Like getKiroIdeCredentials but also returns expired tokens so the caller can
+ * attempt a silent OIDC refresh before falling back to the full login flow.
+ */
+export function getKiroIdeCredentialsAllowExpired() {
+    return readKiroIdeToken(true);
+}
+//# sourceMappingURL=kiro-ide.js.map

package/dist/kiro-ide.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kiro-ide.js","sourceRoot":"","sources":["../src/kiro-ide.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,kFAAkF;AAClF,kFAAkF;AAClF,6EAA6E;AAC7E,6EAA6E;AAC7E,kFAAkF;AAClF,mFAAmF;AAEnF,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,6EAA6E;AAC7E,sFAAsF;AACtF,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AAC9D,MAAM,mBAAmB,GAAG,IAAI,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC;AAkBxE,SAAS,gBAAgB,CAAC,YAAqB;IAC7C,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;YAAE,OAAO,SAAS,CAAC;QAEvD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAqB,CAAC;QAC7F,IAAI,CAAC,SAAS,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,YAAY;YAAE,OAAO,SAAS,CAAC;QAExE,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QAC1D,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI;YAAE,OAAO,SAAS,CAAC;QAE/E,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,IAAI,WAAW,CAAC;QAE/C,2EAA2E;QAC3E,kFAAkF;QAClF,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,IAAI,YAAY,GAAG,EAAE,CAAC;QACtB,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,EAAE,GAAG,SAAS,CAAC,YAAY,OAAO,CAAC,CAAC;YACtE,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxB,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAsB,CAAC;oBAC5E,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;oBAC9B,YAAY,GAAG,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;gBACxC,CAAC;gBAAC,MAAM,CAAC;oBACP,+DAA+D;gBACjE,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO;YACL,iFAAiF;YACjF,OAAO,EAAE,GAAG,SAAS,CAAC,YAAY,IAAI,QAAQ,IAAI,YAAY,MAAM;YACpE,MAAM,EAAE,SAAS,CAAC,WAAW;YAC7B,mEAAmE;YACnE,OAAO,EAAE,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI;YAClC,QAAQ;YACR,YAAY;YACZ,MAAM;YACN,UAAU,EAAE,KAAK;SAClB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iCAAiC;IAC/C,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC"}

package/dist/management.d.ts

@@ -0,0 +1,34 @@
+export interface KiroManagementAuth {
+    accessToken: string;
+    region: string;
+}
+export interface KiroCatalogModel {
+    modelId: string;
+    tokenLimits?: {
+        maxInputTokens?: number;
+        maxOutputTokens?: number;
+        [key: string]: unknown;
+    };
+    additionalModelRequestFieldsSchema?: Record<string, unknown> | null;
+    [key: string]: unknown;
+}
+export interface KiroListAvailableModelsResponse {
+    models: KiroCatalogModel[];
+    [key: string]: unknown;
+}
+export interface KiroGetUsageLimitsRequest {
+    profileArn?: string;
+    origin: "KIRO_CLI";
+    resourceType: "CREDIT";
+    isEmailRequired: false;
+}
+export declare class KiroManagementHttpError extends Error {
+    readonly status: number;
+    constructor(message: string, status: number);
+}
+export declare function resetKiroProfileArnCache(): void;
+export declare function invalidateKiroProfileArn(auth: KiroManagementAuth): void;
+export declare function resolveKiroProfileArn(auth: KiroManagementAuth, providedArn?: string): Promise<string>;
+export declare function listAvailableModels(auth: KiroManagementAuth, profileArn: string): Promise<KiroListAvailableModelsResponse>;
+export declare function fetchKiroModelCatalog(auth: KiroManagementAuth, providedProfileArn?: string): Promise<KiroListAvailableModelsResponse>;
+export declare function getUsageLimits<TResponse>(auth: KiroManagementAuth, request: KiroGetUsageLimitsRequest): Promise<TResponse>;

package/dist/management.js

@@ -0,0 +1,226 @@
+// ABOUTME: Calls the authenticated Kiro management control plane.
+// ABOUTME: Resolves profiles and discovers the current per-profile model catalog.
+import { createHash } from "node:crypto";
+import { debugLog, redactSensitiveText } from "./debug.js";
+import { getKiroEndpoints } from "./endpoints.js";
+import { kiroAuthHeaders } from "./oauth.js";
+import { kiroTokenTypeHeaders } from "./token-type.js";
+const LIST_PROFILES_PATH = "List-Available-Profiles";
+const LIST_MODELS_PATH = "List-Available-Models";
+const profileArnCache = new Map();
+const pendingProfileRequests = new Map();
+/**
+ * Region where the token actually has a profile, keyed like profileArnCache.
+ * Populated when resolveKiroProfileArn finds the ARN on a non-primary region so
+ * callers can route profile-dependent management calls (ListAvailableModels) to
+ * the same region where the profile exists.
+ */
+const profileRegionCache = new Map();
+/**
+ * Canonical Kiro management regions. `resolveApiRegion` funnels every SSO region
+ * into one of these, but a user's actual Kiro profile may live in the other one
+ * (see #104: SSO eu-west-2 -> eu-central-1 while the profile is in us-east-1).
+ * ListAvailableProfiles is regional, so probe the canonical set when the primary
+ * region comes back empty before giving up.
+ */
+const CANONICAL_MANAGEMENT_REGIONS = ["us-east-1", "eu-central-1"];
+function candidateManagementRegions(primary) {
+    const seen = new Set([primary]);
+    const candidates = [primary];
+    for (const region of CANONICAL_MANAGEMENT_REGIONS) {
+        if (!seen.has(region)) {
+            seen.add(region);
+            candidates.push(region);
+        }
+    }
+    return candidates;
+}
+/**
+ * Explicit user override for which Kiro profile to resolve/use. When set, it
+ * wins over any token-carried or network-discovered profile, fixing #110's
+ * "wrong profile picked among several -> reduced model catalog" for users who
+ * have multiple profiles and know which one they want.
+ */
+const ENV_PROFILE_ARN = "KIRO_PROFILE_ARN";
+export class KiroManagementHttpError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+        this.name = "KiroManagementHttpError";
+    }
+}
+async function requestManagement(auth, operation, path, method, body) {
+    const url = new URL(path, getKiroEndpoints(auth.region).management);
+    const request = {
+        method,
+        headers: {
+            Accept: "application/json",
+            ...kiroAuthHeaders(auth.accessToken),
+            ...kiroTokenTypeHeaders(auth.accessToken),
+        },
+    };
+    if (method === "GET") {
+        for (const [name, value] of Object.entries(body)) {
+            if (value !== undefined)
+                url.searchParams.set(name, String(value));
+        }
+    }
+    else {
+        request.headers = { ...request.headers, "Content-Type": "application/json" };
+        request.body = JSON.stringify(body);
+    }
+    let response;
+    try {
+        response = await fetch(url.toString(), request);
+    }
+    catch (error) {
+        throw new Error(`Kiro management ${operation} request failed in ${auth.region}`, { cause: error });
+    }
+    return parseManagementResponse(response, operation, auth.region);
+}
+function profileCacheKey(auth) {
+    const tokenHash = createHash("sha256").update(auth.accessToken).digest("base64url");
+    return `${auth.region}:${tokenHash}`;
+}
+async function parseManagementResponse(response, operation, region) {
+    if (!response.ok) {
+        const statusText = response.statusText ? ` ${redactSensitiveText(response.statusText)}` : "";
+        throw new KiroManagementHttpError(`Kiro management ${operation} failed in ${region}: ${response.status}${statusText}`, response.status);
+    }
+    try {
+        return (await response.json());
+    }
+    catch (error) {
+        throw new Error(`Kiro management ${operation} returned invalid JSON in ${region}`, { cause: error });
+    }
+}
+export function resetKiroProfileArnCache() {
+    profileArnCache.clear();
+    profileRegionCache.clear();
+    pendingProfileRequests.clear();
+}
+export function invalidateKiroProfileArn(auth) {
+    const key = profileCacheKey(auth);
+    profileArnCache.delete(key);
+    profileRegionCache.delete(key);
+    pendingProfileRequests.delete(key);
+}
+export async function resolveKiroProfileArn(auth, providedArn) {
+    // Explicit user override (#110). Highest precedence: a user who pins
+    // KIRO_PROFILE_ARN knows which profile they want, even if the token or the
+    // profile list contains several candidates.
+    const envArn = process.env[ENV_PROFILE_ARN]?.trim();
+    if (envArn) {
+        debugLog("profile.resolve", { source: "env", arn: envArn });
+        return envArn;
+    }
+    if (providedArn) {
+        debugLog("profile.resolve", { source: "provided", arn: providedArn });
+        return providedArn;
+    }
+    const key = profileCacheKey(auth);
+    const cachedArn = profileArnCache.get(key);
+    if (cachedArn)
+        return cachedArn;
+    const pending = pendingProfileRequests.get(key);
+    if (pending)
+        return pending;
+    const request = (async () => {
+        // ListAvailableProfiles is regional to where the profile actually lives, not
+        // to the SSO-derived API region. Probe the primary region first, then the
+        // remaining canonical management regions, so a region-mismatched token still
+        // resolves a profile instead of failing hard (#104, #131).
+        let lastResponse;
+        let lastHttpError;
+        for (const region of candidateManagementRegions(auth.region)) {
+            let response;
+            try {
+                response = await requestManagement({ ...auth, region }, "ListAvailableProfiles", LIST_PROFILES_PATH, "POST", {});
+            }
+            catch (error) {
+                // A regional 403 means the token has no profile *in this region*, not
+                // that it is globally rejected. The profile can live in another
+                // canonical region, so keep probing; only rethrow if no region yields
+                // a profile, so callers that treat a 403 as "refresh credentials and
+                // retry" (#107) still see the auth-plane signal when it is genuine.
+                if (error instanceof KiroManagementHttpError && error.status === 403) {
+                    lastHttpError = error;
+                    continue;
+                }
+                throw error;
+            }
+            lastResponse = response;
+            const arn = response.profiles?.find((profile) => profile.arn)?.arn;
+            if (arn) {
+                profileArnCache.set(key, arn);
+                profileRegionCache.set(key, region);
+                debugLog("profile.resolve", { source: "network", region, arn });
+                return arn;
+            }
+        }
+        if (lastHttpError)
+            throw lastHttpError;
+        const attemptedRegions = candidateManagementRegions(auth.region).join(", ");
+        throw new Error(`Kiro management ListAvailableProfiles returned no profile in ${attemptedRegions} ` +
+            `(SSO-derived region: ${auth.region}). If kiro-cli works, verify your profile region with \`kiro-cli whoami\`; ` +
+            `the management API is regional to the profile, not to your login region.`, ...(lastResponse ? [{ cause: lastResponse }] : []));
+    })();
+    pendingProfileRequests.set(key, request);
+    try {
+        return await request;
+    }
+    finally {
+        if (pendingProfileRequests.get(key) === request)
+            pendingProfileRequests.delete(key);
+    }
+}
+export async function listAvailableModels(auth, profileArn) {
+    const response = await requestManagement(auth, "ListAvailableModels", LIST_MODELS_PATH, "GET", {
+        origin: "KIRO_CLI",
+        profileArn,
+    });
+    if (!Array.isArray(response.models) || response.models.length === 0) {
+        throw new Error(`Kiro management ListAvailableModels returned no models in ${auth.region}`);
+    }
+    if (response.models.some((model) => !model || typeof model.modelId !== "string" || !model.modelId)) {
+        throw new Error(`Kiro management ListAvailableModels returned an invalid catalog in ${auth.region}`);
+    }
+    return response;
+}
+export async function fetchKiroModelCatalog(auth, providedProfileArn) {
+    const profileArn = await resolveKiroProfileArn(auth, providedProfileArn);
+    // Route the models query to the region where the profile actually lives — it
+    // may differ from the SSO-derived region (#104), and ListAvailableModels is
+    // regional to the profile too, not to the login region.
+    const region = profileRegionCache.get(profileCacheKey(auth)) ?? auth.region;
+    if (region !== auth.region) {
+        return listAvailableModels({ ...auth, region }, profileArn);
+    }
+    return listAvailableModels(auth, profileArn);
+}
+export async function getUsageLimits(auth, request) {
+    const operation = "GetUsageLimits";
+    const url = new URL("Get-Usage-Limits", getKiroEndpoints(auth.region).management);
+    for (const [name, value] of Object.entries(request)) {
+        if (value !== undefined)
+            url.searchParams.set(name, String(value));
+    }
+    let response;
+    try {
+        response = await fetch(url.toString(), {
+            method: "GET",
+            headers: {
+                Accept: "application/json",
+                ...kiroAuthHeaders(auth.accessToken),
+                ...kiroTokenTypeHeaders(auth.accessToken),
+                "User-Agent": "ns-kiro-provider",
+            },
+        });
+    }
+    catch (error) {
+        throw new Error(`Kiro management ${operation} request failed in ${auth.region}`, { cause: error });
+    }
+    return parseManagementResponse(response, operation, auth.region);
+}
+//# sourceMappingURL=management.js.map