ns-kiro-core 0.1.0

package/dist/oauth.js

@@ -0,0 +1,295 @@
+// Kiro credentials and token refresh.
+//
+// Auth methods:
+//   - "idc": AWS Builder ID or IAM Identity Center (SSO)
+//   - "desktop": Google/GitHub social login via the Kiro auth service
+//   - "external-idp": enterprise OIDC (e.g. Okta)
+//   - "apikey": a long-lived `ksk_` bearer token
+//
+// Sessions are established by `kiro-cli login` or the Kiro IDE; this package
+// reads and refreshes them rather than running its own interactive login.
+import { formatSafeError } from "./debug.js";
+import { resolveApiRegion } from "./endpoints.js";
+import { getKiroIdeCredentials } from "./kiro-ide.js";
+export const SSO_OIDC_ENDPOINT = "https://oidc.us-east-1.amazonaws.com";
+export const BUILDER_ID_START_URL = "https://view.awsapps.com/start";
+export const BUILDER_ID_PROFILE_ARN = "arn:aws:codewhisperer:us-east-1:638616132270:profile/AAAACCCCXXXX";
+export const KIRO_DESKTOP_REFRESH_URL = "https://prod.{region}.auth.desktop.kiro.dev/refreshToken";
+export const SSO_SCOPES = [
+    "codewhisperer:completions",
+    "codewhisperer:analysis",
+    "codewhisperer:conversations",
+    "codewhisperer:transformations",
+    "codewhisperer:taskassist",
+];
+const EXPIRES_BUFFER_MS = 5 * 60 * 1000;
+export const KIRO_DESKTOP_USER_AGENT = "Kiro-Desktop/0.2.13 (darwin; arm64)";
+export function kiroUserAgent(service, sdkVersion) {
+    return {
+        "User-Agent": `aws-sdk-js/3.714.0 os/macos/24.3.0 lang/js md/nodejs/22.14.0 api/${service}/3.714.0 exec-env/kiro-cli/2.7.0 m/E`,
+        "amz-sdk-invocation-id": "00000000-0000-0000-0000-000000000000",
+        "amz-sdk-request": `attempt=1; max=${sdkVersion}`,
+    };
+}
+export function kiroAuthHeaders(token) {
+    const headers = { Authorization: `Bearer ${token}` };
+    if (isApiKey(token))
+        headers.tokentype = "API_KEY";
+    return headers;
+}
+export function isApiKey(token) {
+    return token.startsWith("ksk_");
+}
+/**
+ * Validate a `ksk_` API key and resolve the profile it bills against.
+ *
+ * Unlike an SSO session this needs no browser round trip, so it is the one
+ * credential this package can establish on its own: GetProfile with an empty
+ * body returns the key's own profile, which both proves the key works and
+ * supplies the ARN every runtime request needs.
+ */
+export async function loginKiroWithApiKey(apiKey, onProgress) {
+    if (!apiKey.startsWith("ksk_")) {
+        throw new Error("Invalid API key format. Kiro API keys start with 'ksk_'.");
+    }
+    onProgress?.("Validating API key...");
+    // API keys are issued for the us-east-1 control plane.
+    const region = "us-east-1";
+    const managementUrl = `https://management.${resolveApiRegion(region)}.kiro.dev/`;
+    const response = await fetch(managementUrl, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/x-amz-json-1.0",
+            "X-Amz-Target": "AmazonCodeWhispererService.GetProfile",
+            ...kiroAuthHeaders(apiKey),
+            ...kiroUserAgent("codewhispererruntime", "F,C"),
+        },
+        body: "{}",
+    });
+    if (!response.ok) {
+        let detail = "";
+        try {
+            detail = await response.text();
+        }
+        catch {
+            detail = "";
+        }
+        if (response.status === 401 || response.status === 403 || /Invalid token/i.test(detail)) {
+            throw new Error("API key was rejected by Kiro. Check that the key is valid and not expired.");
+        }
+        throw new Error(`Kiro GetProfile failed: ${response.status} ${response.statusText} ${detail}`.trim());
+    }
+    const data = (await response.json());
+    const profileArn = data.profile?.arn;
+    return {
+        access: apiKey,
+        refresh: `${apiKey}|apikey`,
+        expires: Date.now() + 365 * 24 * 60 * 60 * 1000,
+        clientId: "",
+        clientSecret: "",
+        region,
+        authMethod: "apikey",
+        ...(profileArn ? { profileArn } : {}),
+    };
+}
+export function isExpired(credentials) {
+    return Date.now() >= credentials.expires;
+}
+/**
+ * Refresh a session and kick off a catalog refresh for its region. The catalog
+ * call is deliberately not awaited: a stale catalog degrades model metadata,
+ * while a slow one would delay every request that had to reauthenticate.
+ */
+export async function refreshKiroToken(credentials) {
+    const refreshed = await refreshKiroTokenInternal(credentials);
+    if (!process.env.VITEST) {
+        try {
+            const { updateKiroModelsCache } = await import("./models.js");
+            const region = resolveApiRegion(refreshed.region);
+            updateKiroModelsCache(refreshed.access, region, refreshed.profileArn).catch((error) => {
+                console.warn(`[kiro-core] Failed to refresh Kiro model catalog in ${region}: ${formatSafeError(error)}`);
+            });
+        }
+        catch (error) {
+            console.warn(`[kiro-core] Failed to start Kiro model catalog refresh: ${formatSafeError(error)}`);
+        }
+    }
+    return refreshed;
+}
+async function refreshKiroTokenInternal(credentials) {
+    const { getKiroCliCredentials, getKiroCliCredentialsAllowExpired, saveKiroCliCredentials, getKiroCliSocialToken, getKiroCliSocialTokenAllowExpired, } = await import("./kiro-cli.js");
+    const credentialAuthMethod = credentials.authMethod ?? (credentials.refresh.split("|").at(-1) === "desktop" ? "desktop" : "idc");
+    const getValidCliCredentials = () => {
+        if (credentialAuthMethod === "desktop")
+            return getKiroCliSocialToken();
+        const cliCreds = getKiroCliCredentials();
+        return cliCreds?.authMethod === "idc" ? cliCreds : undefined;
+    };
+    const getExpiredCliCredentials = () => {
+        if (credentialAuthMethod === "desktop")
+            return getKiroCliSocialTokenAllowExpired();
+        const cliCreds = getKiroCliCredentialsAllowExpired();
+        return cliCreds?.authMethod === "idc" ? cliCreds : undefined;
+    };
+    // API key credentials are long-lived bearer tokens — there is nothing to
+    // refresh. Return them unchanged so the same key keeps being used.
+    if (credentials.authMethod === "apikey" || isApiKey(credentials.access))
+        return credentials;
+    // Kiro IDE credentials are IDC credentials. Only consult them for IDC
+    // credential refresh — never replace a stored social/desktop session with
+    // the IDE's potentially unrelated account.
+    if (credentialAuthMethod === "idc") {
+        const ideCreds = getKiroIdeCredentials();
+        if (ideCreds)
+            return ideCreds;
+    }
+    // Prefer a fresh CLI token only when it belongs to the same auth family.
+    const preCheckCreds = getValidCliCredentials();
+    if (preCheckCreds)
+        return preCheckCreds;
+    try {
+        const refreshed = await refreshKiroTokenDirect(credentials);
+        // Write refreshed tokens back to kiro-cli's store so both stay in sync.
+        saveKiroCliCredentials(refreshed);
+        return refreshed;
+    }
+    catch (refreshError) {
+        // The CLI may have rotated the refresh token between the pre-check and the
+        // network call. Re-read only the matching auth family.
+        const retryCreds = getValidCliCredentials();
+        if (retryCreds)
+            return retryCreds;
+        // The CLI may have a newer refresh token with an expired access token.
+        const expiredCliCreds = getExpiredCliCredentials();
+        if (expiredCliCreds && expiredCliCreds.refresh !== credentials.refresh) {
+            try {
+                const refreshedFromCli = await refreshKiroTokenDirect(expiredCliCreds);
+                saveKiroCliCredentials(refreshedFromCli);
+                return refreshedFromCli;
+            }
+            catch {
+                // Also failed; continue to the remaining fallbacks.
+            }
+        }
+        // `expires` carries a 5-minute buffer, so the actual token may still work.
+        const actualExpiry = credentials.expires + EXPIRES_BUFFER_MS;
+        if (credentials.access && Date.now() < actualExpiry) {
+            return { ...credentials, expires: actualExpiry };
+        }
+        throw refreshError;
+    }
+}
+async function refreshKiroTokenDirect(credentials) {
+    const parts = credentials.refresh.split("|");
+    const refreshToken = parts[0] ?? "";
+    const authMethod = (parts[parts.length - 1] ?? "idc");
+    const region = credentials.region || "us-east-1";
+    if (authMethod === "apikey")
+        return credentials;
+    if (authMethod === "desktop") {
+        // Kiro desktop app tokens use a different refresh endpoint.
+        const url = KIRO_DESKTOP_REFRESH_URL.replace("{region}", region);
+        const response = await fetch(url, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", "User-Agent": KIRO_DESKTOP_USER_AGENT },
+            body: JSON.stringify({ refreshToken }),
+        });
+        if (!response.ok)
+            throw new Error(`Desktop token refresh failed: ${response.status}`);
+        const data = (await response.json());
+        if (!data.accessToken)
+            throw new Error("Desktop token refresh: missing accessToken");
+        return {
+            refresh: `${data.refreshToken || refreshToken}|desktop`,
+            access: data.accessToken,
+            expires: Date.now() + data.expiresIn * 1000 - EXPIRES_BUFFER_MS,
+            clientId: "",
+            clientSecret: "",
+            region,
+            authMethod: "desktop",
+            profileArn: data.profileArn || credentials.profileArn,
+            startUrl: credentials.startUrl,
+        };
+    }
+    // External IdP (enterprise OIDC, e.g. Okta) — standard public-client refresh
+    // against the customer's own token endpoint. kiro-cli does the same:
+    // form-encoded grant_type/client_id/refresh_token, snake_case response, and
+    // no client secret because the OIDC app is a public PKCE client.
+    if (authMethod === "external-idp") {
+        const idpClientId = parts[1] ?? "";
+        const tokenEndpoint = parts[2] ?? "";
+        if (!tokenEndpoint)
+            throw new Error("External IdP token refresh: missing token endpoint");
+        const response = await fetch(tokenEndpoint, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/x-www-form-urlencoded",
+                Accept: "application/json",
+                "User-Agent": "kiro-core",
+            },
+            body: new URLSearchParams({
+                grant_type: "refresh_token",
+                client_id: idpClientId,
+                refresh_token: refreshToken,
+            }).toString(),
+        });
+        if (!response.ok)
+            throw new Error(`External IdP token refresh failed: ${response.status}`);
+        const data = (await response.json());
+        if (!data.access_token)
+            throw new Error("External IdP token refresh: missing access_token");
+        const expiresIn = typeof data.expires_in === "number" ? data.expires_in : 3600;
+        return {
+            refresh: `${data.refresh_token || refreshToken}|${idpClientId}|${tokenEndpoint}|external-idp`,
+            access: data.access_token,
+            expires: Date.now() + expiresIn * 1000 - EXPIRES_BUFFER_MS,
+            clientId: idpClientId,
+            clientSecret: "",
+            region,
+            authMethod: "external-idp",
+            profileArn: credentials.profileArn,
+        };
+    }
+    // IDC auth method — SSO OIDC refresh.
+    const clientId = parts[1] ?? "";
+    const clientSecret = parts[2] ?? "";
+    const ssoEndpoint = `https://oidc.${region}.amazonaws.com`;
+    const response = await fetch(`${ssoEndpoint}/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", ...kiroUserAgent("ssooidc", "E") },
+        body: JSON.stringify({ clientId, clientSecret, refreshToken, grantType: "refresh_token" }),
+    });
+    if (!response.ok)
+        throw new Error(`Token refresh failed: ${response.status}`);
+    const data = (await response.json());
+    return {
+        refresh: `${data.refreshToken}|${clientId}|${clientSecret}|idc`,
+        access: data.accessToken,
+        expires: Date.now() + data.expiresIn * 1000 - EXPIRES_BUFFER_MS,
+        clientId,
+        clientSecret,
+        region,
+        authMethod: "idc",
+        profileArn: credentials.profileArn,
+        startUrl: credentials.startUrl,
+        isEnterprise: credentials.isEnterprise,
+    };
+}
+/**
+ * Resolve a usable session from the stores this machine already has: the
+ * kiro-cli database first, then the Kiro IDE's token file. Expired material is
+ * accepted and refreshed rather than rejected, because a refresh token outlives
+ * its access token and rejecting here would ask the user to log in again for a
+ * session that is still good.
+ */
+export async function resolveKiroCredentials() {
+    const { getKiroCliCredentials, getKiroCliCredentialsAllowExpired } = await import("./kiro-cli.js");
+    const fresh = getKiroCliCredentials() ?? getKiroIdeCredentials();
+    if (fresh)
+        return fresh;
+    const stale = getKiroCliCredentialsAllowExpired();
+    if (!stale)
+        return undefined;
+    return refreshKiroToken(stale);
+}
+//# sourceMappingURL=oauth.js.map

package/dist/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,gBAAgB;AAChB,yDAAyD;AACzD,sEAAsE;AACtE,kDAAkD;AAClD,iDAAiD;AACjD,EAAE;AACF,6EAA6E;AAC7E,0EAA0E;AAE1E,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAEtD,MAAM,CAAC,MAAM,iBAAiB,GAAG,sCAAsC,CAAC;AACxE,MAAM,CAAC,MAAM,oBAAoB,GAAG,gCAAgC,CAAC;AACrE,MAAM,CAAC,MAAM,sBAAsB,GAAG,mEAAmE,CAAC;AAC1G,MAAM,CAAC,MAAM,wBAAwB,GAAG,0DAA0D,CAAC;AACnG,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,2BAA2B;IAC3B,wBAAwB;IACxB,6BAA6B;IAC7B,+BAA+B;IAC/B,0BAA0B;CAC3B,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAqBxC,MAAM,CAAC,MAAM,uBAAuB,GAAG,qCAAqC,CAAC;AAE7E,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,UAAkB;IAC/D,OAAO;QACL,YAAY,EAAE,oEAAoE,OAAO,sCAAsC;QAC/H,uBAAuB,EAAE,sCAAsC;QAC/D,iBAAiB,EAAE,kBAAkB,UAAU,EAAE;KAClD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,OAAO,GAA2B,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;IAC7E,IAAI,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IACnD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,UAAsC;IAEtC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IAED,UAAU,EAAE,CAAC,uBAAuB,CAAC,CAAC;IAEtC,uDAAuD;IACvD,MAAM,MAAM,GAAG,WAAW,CAAC;IAC3B,MAAM,aAAa,GAAG,sBAAsB,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC;IAEjF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;QAC1C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,4BAA4B;YAC5C,cAAc,EAAE,uCAAuC;YACvD,GAAG,eAAe,CAAC,MAAM,CAAC;YAC1B,GAAG,aAAa,CAAC,sBAAsB,EAAE,KAAK,CAAC;SAChD;QACD,IAAI,EAAE,IAAI;KACX,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,EAAE,CAAC;QACd,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACxF,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmC,CAAC;IACvE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC;IAErC,OAAO;QACL,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,GAAG,MAAM,SAAS;QAC3B,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;QAC/C,QAAQ,EAAE,EAAE;QACZ,YAAY,EAAE,EAAE;QAChB,MAAM;QACN,UAAU,EAAE,QAAQ;QACpB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,WAA4B;IACpD,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,OAAO,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,WAA4B;IACjE,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAC9D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAClD,qBAAqB,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACpF,OAAO,CAAC,IAAI,CAAC,uDAAuD,MAAM,KAAK,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC3G,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,2DAA2D,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,WAA4B;IAClE,MAAM,EACJ,qBAAqB,EACrB,iCAAiC,EACjC,sBAAsB,EACtB,qBAAqB,EACrB,iCAAiC,GAClC,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAClC,MAAM,oBAAoB,GACxB,WAAW,CAAC,UAAU,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACtG,MAAM,sBAAsB,GAAG,GAAgC,EAAE;QAC/D,IAAI,oBAAoB,KAAK,SAAS;YAAE,OAAO,qBAAqB,EAAE,CAAC;QACvE,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAC;QACzC,OAAO,QAAQ,EAAE,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,CAAC,CAAC;IACF,MAAM,wBAAwB,GAAG,GAAgC,EAAE;QACjE,IAAI,oBAAoB,KAAK,SAAS;YAAE,OAAO,iCAAiC,EAAE,CAAC;QACnF,MAAM,QAAQ,GAAG,iCAAiC,EAAE,CAAC;QACrD,OAAO,QAAQ,EAAE,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,CAAC,CAAC;IAEF,yEAAyE;IACzE,mEAAmE;IACnE,IAAI,WAAW,CAAC,UAAU,KAAK,QAAQ,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC;QAAE,OAAO,WAAW,CAAC;IAE5F,sEAAsE;IACtE,0EAA0E;IAC1E,2CAA2C;IAC3C,IAAI,oBAAoB,KAAK,KAAK,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAC;QACzC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;IAChC,CAAC;IAED,yEAAyE;IACzE,MAAM,aAAa,GAAG,sBAAsB,EAAE,CAAC;IAC/C,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,WAAW,CAAC,CAAC;QAC5D,wEAAwE;QACxE,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAClC,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,YAAY,EAAE,CAAC;QACtB,2EAA2E;QAC3E,uDAAuD;QACvD,MAAM,UAAU,GAAG,sBAAsB,EAAE,CAAC;QAC5C,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAElC,uEAAuE;QACvE,MAAM,eAAe,GAAG,wBAAwB,EAAE,CAAC;QACnD,IAAI,eAAe,IAAI,eAAe,CAAC,OAAO,KAAK,WAAW,CAAC,OAAO,EAAE,CAAC;YACvE,IAAI,CAAC;gBACH,MAAM,gBAAgB,GAAG,MAAM,sBAAsB,CAAC,eAAe,CAAC,CAAC;gBACvE,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;gBACzC,OAAO,gBAAgB,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,oDAAoD;YACtD,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,GAAG,iBAAiB,CAAC;QAC7D,IAAI,WAAW,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC;YACpD,OAAO,EAAE,GAAG,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QACnD,CAAC;QAED,MAAM,YAAY,CAAC;IACrB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,WAA4B;IAChE,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,CAAmB,CAAC;IACxE,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,IAAI,WAAW,CAAC;IAEjD,IAAI,UAAU,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC;IAEhD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,4DAA4D;QAC5D,MAAM,GAAG,GAAG,wBAAwB,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,YAAY,EAAE,uBAAuB,EAAE;YACtF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;SACvC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACtF,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAKlC,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QACrF,OAAO;YACL,OAAO,EAAE,GAAG,IAAI,CAAC,YAAY,IAAI,YAAY,UAAU;YACvD,MAAM,EAAE,IAAI,CAAC,WAAW;YACxB,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,iBAAiB;YAC/D,QAAQ,EAAE,EAAE;YACZ,YAAY,EAAE,EAAE;YAChB,MAAM;YACN,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,WAAW,CAAC,UAAU;YACrD,QAAQ,EAAE,WAAW,CAAC,QAAQ;SAC/B,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,qEAAqE;IACrE,4EAA4E;IAC5E,iEAAiE;IACjE,IAAI,UAAU,KAAK,cAAc,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAC1F,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;gBAC1B,YAAY,EAAE,WAAW;aAC1B;YACD,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,eAAe;gBAC3B,SAAS,EAAE,WAAW;gBACtB,aAAa,EAAE,YAAY;aAC5B,CAAC,CAAC,QAAQ,EAAE;SACd,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3F,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAIlC,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QAC5F,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/E,OAAO;YACL,OAAO,EAAE,GAAG,IAAI,CAAC,aAAa,IAAI,YAAY,IAAI,WAAW,IAAI,aAAa,eAAe;YAC7F,MAAM,EAAE,IAAI,CAAC,YAAY;YACzB,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,GAAG,iBAAiB;YAC1D,QAAQ,EAAE,WAAW;YACrB,YAAY,EAAE,EAAE;YAChB,MAAM;YACN,UAAU,EAAE,cAAc;YAC1B,UAAU,EAAE,WAAW,CAAC,UAAU;SACnC,CAAC;IACJ,CAAC;IAED,sCAAsC;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,WAAW,GAAG,gBAAgB,MAAM,gBAAgB,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,WAAW,QAAQ,EAAE;QACnD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE;QACjF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC;KAC3F,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqE,CAAC;IACzG,OAAO;QACL,OAAO,EAAE,GAAG,IAAI,CAAC,YAAY,IAAI,QAAQ,IAAI,YAAY,MAAM;QAC/D,MAAM,EAAE,IAAI,CAAC,WAAW;QACxB,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,iBAAiB;QAC/D,QAAQ;QACR,YAAY;QACZ,MAAM;QACN,UAAU,EAAE,KAAK;QACjB,UAAU,EAAE,WAAW,CAAC,UAAU;QAClC,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,YAAY,EAAE,WAAW,CAAC,YAAY;KACvC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,MAAM,EAAE,qBAAqB,EAAE,iCAAiC,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IACnG,MAAM,KAAK,GAAG,qBAAqB,EAAE,IAAI,qBAAqB,EAAE,CAAC;IACjE,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,MAAM,KAAK,GAAG,iCAAiC,EAAE,CAAC;IAClD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC"}

package/dist/retry.d.ts

@@ -0,0 +1,74 @@
+export declare const FIRST_TOKEN_TIMEOUT = 90000;
+/** Maximum wait for the runtime endpoint to return HTTP response headers. */
+export declare const REQUEST_HEADER_TIMEOUT = 90000;
+export declare function firstTokenTimeoutForModel(modelId: string): number;
+export declare const retryConfig: {
+    firstTokenTimeoutMs: number;
+    requestHeaderTimeoutMs: number;
+};
+export declare function exponentialBackoff(attempt: number, baseMs: number, maxMs: number): number;
+export declare const MAX_RETRY_DELAY = 10000;
+/** Fallback used when a request-window response carries no valid server hint. */
+export declare const REQUEST_RATE_FALLBACK_DELAY_MS = 10000;
+/** Pull the service's exact JSON `reason` field without retaining or returning the body. */
+export declare function extractKiroReason(errorText: string): string | undefined;
+/**
+ * Read a server-advertised wait in milliseconds.
+ *
+ * `retry-after-ms` is milliseconds, numeric `retry-after` and
+ * `x-ratelimit-reset-after` are seconds, and an HTTP-date `retry-after` is
+ * relative to `nowMs`. Each header is an independent candidate, so an invalid
+ * earlier value does not hide a valid later one. A past HTTP date means retry
+ * now.
+ */
+export declare function parseRetryAfterMs(headers: Headers | undefined, nowMs?: number): number | undefined;
+export declare function resolveRequestRateRetryDelay(headers: Headers | undefined, nowMs?: number): {
+    delayMs: number;
+    advertisedDelayMs?: number;
+    capped: boolean;
+};
+/**
+ * Machine reason codes returned by the Kiro API, plus the one prose marker the
+ * service emits without a code (`INPUT_TOO_LONG`).
+ *
+ * Single source of truth for the provider's error vocabulary: the pattern lists
+ * and predicates below are derived from it, and it is re-exported from the
+ * package entry point so consumers can classify a code without holding an error
+ * instance — e.g. reading a persisted log line. These are the service's own
+ * codes, deliberately not renamed or mapped into a provider taxonomy.
+ */
+export declare const KIRO_REASON_CODES: Readonly<{
+    /** Request body exceeded the service's size threshold. */
+    readonly CONTENT_LENGTH_EXCEEDS_THRESHOLD: "CONTENT_LENGTH_EXCEEDS_THRESHOLD";
+    /** Prose-only size rejection; the service sends no reason code for this one. */
+    readonly INPUT_TOO_LONG: "Input is too long";
+    /** Monthly request quota exhausted — hard limit, not transient. */
+    readonly MONTHLY_REQUEST_COUNT: "MONTHLY_REQUEST_COUNT";
+    /** Model capacity temporarily unavailable — transient, worth retrying. */
+    readonly INSUFFICIENT_MODEL_CAPACITY: "INSUFFICIENT_MODEL_CAPACITY";
+    /** Short-window request throttle — retry only within the provider budget. */
+    readonly USER_REQUEST_RATE_EXCEEDED: "USER_REQUEST_RATE_EXCEEDED";
+    /**
+     * Generic request-validation rejection, returned for a malformed body of any
+     * size (empty `content`, history referencing tools absent from the catalog).
+     * Not a size signal: classifying it as "too big" makes the caller compact a
+     * history that was never the problem, a loop it can never satisfy.
+     */
+    readonly REQUEST_BODY_INVALID: "REQUEST_BODY_INVALID";
+}>;
+export type KiroReasonCode = (typeof KIRO_REASON_CODES)[keyof typeof KIRO_REASON_CODES];
+export declare const TOO_BIG_PATTERNS: readonly string[];
+export declare const NON_RETRYABLE_BODY_PATTERNS: readonly string[];
+export declare const CAPACITY_PATTERN: "INSUFFICIENT_MODEL_CAPACITY";
+export declare const CAPACITY_MAX_RETRIES = 3;
+export declare const CAPACITY_BASE_DELAY_MS = 5000;
+export declare const capacityRetryConfig: {
+    maxRetries: number;
+    baseDelayMs: number;
+};
+/** Check whether an HTTP error represents a "request too large" condition. */
+export declare function isTooBigError(status: number, errorText: string): boolean;
+/** Check whether the response body contains a Kiro-specific non-retryable marker. */
+export declare function isNonRetryableBodyError(errorText: string): boolean;
+/** Check whether the error is a transient capacity issue worth retrying. */
+export declare function isCapacityError(errorText: string): boolean;

package/dist/retry.js

@@ -0,0 +1,156 @@
+// ABOUTME: Stream recovery helpers and Kiro-specific error classification.
+// ABOUTME: Keeps provider-local retry logic limited to auth refresh and stream quirks.
+import { kiroModels } from "./models.js";
+// kiro-cli uses 5-minute read/operation timeouts (DEFAULT_TIMEOUT_DURATION)
+// and 5-minute stalled stream grace period. 90s matches the TUI's
+// INITIAL_RESPONSE_TIMEOUT_MS for the first event from the backend.
+export const FIRST_TOKEN_TIMEOUT = 90_000;
+/** Maximum wait for the runtime endpoint to return HTTP response headers. */
+export const REQUEST_HEADER_TIMEOUT = 90_000;
+export function firstTokenTimeoutForModel(modelId) {
+    // Allow test overrides via retryConfig.firstTokenTimeoutMs
+    if (retryConfig.firstTokenTimeoutMs !== FIRST_TOKEN_TIMEOUT) {
+        return retryConfig.firstTokenTimeoutMs;
+    }
+    const model = kiroModels.find((m) => m.id === modelId);
+    return model?.firstTokenTimeout ?? FIRST_TOKEN_TIMEOUT;
+}
+// Mutable config for values that tests need to override
+export const retryConfig = {
+    firstTokenTimeoutMs: FIRST_TOKEN_TIMEOUT,
+    requestHeaderTimeoutMs: REQUEST_HEADER_TIMEOUT,
+};
+export function exponentialBackoff(attempt, baseMs, maxMs) {
+    return Math.min(baseMs * 2 ** attempt, maxMs);
+}
+export const MAX_RETRY_DELAY = 10_000;
+/** Fallback used when a request-window response carries no valid server hint. */
+export const REQUEST_RATE_FALLBACK_DELAY_MS = 10_000;
+/** Pull the service's exact JSON `reason` field without retaining or returning the body. */
+export function extractKiroReason(errorText) {
+    if (!errorText)
+        return undefined;
+    try {
+        const parsed = JSON.parse(errorText);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return undefined;
+        const reason = parsed.reason;
+        return typeof reason === "string" && reason.length > 0 ? reason : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Read a server-advertised wait in milliseconds.
+ *
+ * `retry-after-ms` is milliseconds, numeric `retry-after` and
+ * `x-ratelimit-reset-after` are seconds, and an HTTP-date `retry-after` is
+ * relative to `nowMs`. Each header is an independent candidate, so an invalid
+ * earlier value does not hide a valid later one. A past HTTP date means retry
+ * now.
+ */
+export function parseRetryAfterMs(headers, nowMs = Date.now()) {
+    const get = headers?.get?.bind(headers);
+    if (!get)
+        return undefined;
+    const milliseconds = nonNegativeNumber(get("retry-after-ms"));
+    if (milliseconds !== undefined)
+        return Math.round(milliseconds);
+    const retryAfter = get("retry-after");
+    if (retryAfter !== null && retryAfter.trim() !== "") {
+        const seconds = Number(retryAfter);
+        if (Number.isFinite(seconds)) {
+            // Numeric Retry-After is delay-seconds, never a date. In particular,
+            // do not let Date.parse reinterpret a negative delay as a year.
+            if (seconds >= 0) {
+                const delayMs = seconds * 1000;
+                if (Number.isFinite(delayMs))
+                    return Math.round(delayMs);
+            }
+        }
+        else {
+            const dateMs = Date.parse(retryAfter);
+            if (!Number.isNaN(dateMs))
+                return Math.max(0, dateMs - nowMs);
+        }
+    }
+    const resetAfterSeconds = nonNegativeNumber(get("x-ratelimit-reset-after"));
+    if (resetAfterSeconds !== undefined) {
+        const delayMs = resetAfterSeconds * 1000;
+        if (Number.isFinite(delayMs))
+            return Math.round(delayMs);
+    }
+    return undefined;
+}
+export function resolveRequestRateRetryDelay(headers, nowMs = Date.now()) {
+    const advertisedDelayMs = parseRetryAfterMs(headers, nowMs);
+    const requestedDelayMs = advertisedDelayMs ?? REQUEST_RATE_FALLBACK_DELAY_MS;
+    return {
+        delayMs: Math.min(requestedDelayMs, MAX_RETRY_DELAY),
+        ...(advertisedDelayMs !== undefined ? { advertisedDelayMs } : {}),
+        capped: requestedDelayMs > MAX_RETRY_DELAY,
+    };
+}
+function nonNegativeNumber(value) {
+    if (value === null || value.trim() === "")
+        return undefined;
+    const parsed = Number(value);
+    return Number.isFinite(parsed) && parsed >= 0 ? parsed : undefined;
+}
+/**
+ * Machine reason codes returned by the Kiro API, plus the one prose marker the
+ * service emits without a code (`INPUT_TOO_LONG`).
+ *
+ * Single source of truth for the provider's error vocabulary: the pattern lists
+ * and predicates below are derived from it, and it is re-exported from the
+ * package entry point so consumers can classify a code without holding an error
+ * instance — e.g. reading a persisted log line. These are the service's own
+ * codes, deliberately not renamed or mapped into a provider taxonomy.
+ */
+export const KIRO_REASON_CODES = Object.freeze({
+    /** Request body exceeded the service's size threshold. */
+    CONTENT_LENGTH_EXCEEDS_THRESHOLD: "CONTENT_LENGTH_EXCEEDS_THRESHOLD",
+    /** Prose-only size rejection; the service sends no reason code for this one. */
+    INPUT_TOO_LONG: "Input is too long",
+    /** Monthly request quota exhausted — hard limit, not transient. */
+    MONTHLY_REQUEST_COUNT: "MONTHLY_REQUEST_COUNT",
+    /** Model capacity temporarily unavailable — transient, worth retrying. */
+    INSUFFICIENT_MODEL_CAPACITY: "INSUFFICIENT_MODEL_CAPACITY",
+    /** Short-window request throttle — retry only within the provider budget. */
+    USER_REQUEST_RATE_EXCEEDED: "USER_REQUEST_RATE_EXCEEDED",
+    /**
+     * Generic request-validation rejection, returned for a malformed body of any
+     * size (empty `content`, history referencing tools absent from the catalog).
+     * Not a size signal: classifying it as "too big" makes the caller compact a
+     * history that was never the problem, a loop it can never satisfy.
+     */
+    REQUEST_BODY_INVALID: "REQUEST_BODY_INVALID",
+});
+// Size markers only — REQUEST_BODY_INVALID is excluded on purpose (see above).
+export const TOO_BIG_PATTERNS = Object.freeze([
+    KIRO_REASON_CODES.CONTENT_LENGTH_EXCEEDS_THRESHOLD,
+    KIRO_REASON_CODES.INPUT_TOO_LONG,
+]);
+export const NON_RETRYABLE_BODY_PATTERNS = Object.freeze([KIRO_REASON_CODES.MONTHLY_REQUEST_COUNT]);
+export const CAPACITY_PATTERN = KIRO_REASON_CODES.INSUFFICIENT_MODEL_CAPACITY;
+export const CAPACITY_MAX_RETRIES = 3;
+export const CAPACITY_BASE_DELAY_MS = 5_000;
+// Mutable capacity config for testing
+export const capacityRetryConfig = {
+    maxRetries: CAPACITY_MAX_RETRIES,
+    baseDelayMs: CAPACITY_BASE_DELAY_MS,
+};
+/** Check whether an HTTP error represents a "request too large" condition. */
+export function isTooBigError(status, errorText) {
+    return status === 413 || (status === 400 && TOO_BIG_PATTERNS.some((p) => errorText.includes(p)));
+}
+/** Check whether the response body contains a Kiro-specific non-retryable marker. */
+export function isNonRetryableBodyError(errorText) {
+    return NON_RETRYABLE_BODY_PATTERNS.some((p) => errorText.includes(p));
+}
+/** Check whether the error is a transient capacity issue worth retrying. */
+export function isCapacityError(errorText) {
+    return errorText.includes(CAPACITY_PATTERN);
+}
+//# sourceMappingURL=retry.js.map

package/dist/retry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry.js","sourceRoot":"","sources":["../src/retry.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,uFAAuF;AAEvF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,4EAA4E;AAC5E,kEAAkE;AAClE,oEAAoE;AACpE,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAC1C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAE7C,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,2DAA2D;IAC3D,IAAI,WAAW,CAAC,mBAAmB,KAAK,mBAAmB,EAAE,CAAC;QAC5D,OAAO,WAAW,CAAC,mBAAmB,CAAC;IACzC,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC;IACvD,OAAO,KAAK,EAAE,iBAAiB,IAAI,mBAAmB,CAAC;AACzD,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,mBAAmB,EAAE,mBAAmB;IACxC,sBAAsB,EAAE,sBAAsB;CAC/C,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,MAAc,EAAE,KAAa;IAC/E,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,iFAAiF;AACjF,MAAM,CAAC,MAAM,8BAA8B,GAAG,MAAM,CAAC;AAErD,4FAA4F;AAC5F,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAY,CAAC;QAChD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QACrF,MAAM,MAAM,GAAI,MAA+B,CAAC,MAAM,CAAC;QACvD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA4B,EAAE,QAAgB,IAAI,CAAC,GAAG,EAAE;IACxF,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAE3B,MAAM,YAAY,GAAG,iBAAiB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC9D,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAEhE,MAAM,UAAU,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;IACtC,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QACnC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,qEAAqE;YACrE,gEAAgE;YAChE,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;gBACjB,MAAM,OAAO,GAAG,OAAO,GAAG,IAAI,CAAC;gBAC/B,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;oBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC;IAC5E,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,iBAAiB,GAAG,IAAI,CAAC;QACzC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,OAA4B,EAC5B,QAAgB,IAAI,CAAC,GAAG,EAAE;IAE1B,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,gBAAgB,GAAG,iBAAiB,IAAI,8BAA8B,CAAC;IAC7E,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,eAAe,CAAC;QACpD,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,EAAE,gBAAgB,GAAG,eAAe;KAC3C,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAoB;IAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7C,0DAA0D;IAC1D,gCAAgC,EAAE,kCAAkC;IACpE,gFAAgF;IAChF,cAAc,EAAE,mBAAmB;IACnC,mEAAmE;IACnE,qBAAqB,EAAE,uBAAuB;IAC9C,0EAA0E;IAC1E,2BAA2B,EAAE,6BAA6B;IAC1D,6EAA6E;IAC7E,0BAA0B,EAAE,4BAA4B;IACxD;;;;;OAKG;IACH,oBAAoB,EAAE,sBAAsB;CACpC,CAAC,CAAC;AAIZ,+EAA+E;AAC/E,MAAM,CAAC,MAAM,gBAAgB,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC/D,iBAAiB,CAAC,gCAAgC;IAClD,iBAAiB,CAAC,cAAc;CACjC,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsB,MAAM,CAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,CAAC,CAAC;AACvH,MAAM,CAAC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,2BAA2B,CAAC;AAC9E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AACtC,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAE5C,sCAAsC;AACtC,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,UAAU,EAAE,oBAAoB;IAChC,WAAW,EAAE,sBAAsB;CACpC,CAAC;AAEF,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,SAAiB;IAC7D,OAAO,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,uBAAuB,CAAC,SAAiB;IACvD,OAAO,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,OAAO,SAAS,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;AAC9C,CAAC"}

package/dist/stream.d.ts

@@ -0,0 +1,36 @@
+import { type KiroModel } from "./models.js";
+import type { KiroEffort, KiroMessage, KiroStreamEvent, KiroTool } from "./types.js";
+/** One model call, fully assembled by the host adapter. */
+export interface KiroStreamRequest {
+    model: KiroModel;
+    messages: KiroMessage[];
+    systemPrompt?: string;
+    tools?: KiroTool[];
+    /** Requested reasoning level; clamped against the model's own ladder. */
+    effort?: KiroEffort;
+    /** Bearer token for this call. */
+    accessToken: string;
+    /** Reused as Kiro's `conversationId`, so a session keeps one server-side thread. */
+    sessionId?: string;
+    profileArn?: string;
+    signal?: AbortSignal;
+    /**
+     * Whether the host can drop blocks it has already been handed. Hosts that can
+     * receive a {@link KiroStreamEvent} of type `reset` and discard everything
+     * before it; hosts that cannot make the core settle for the terminal
+     * behaviour instead of retrying mid-response.
+     */
+    canDiscardEmittedBlocks?: boolean;
+}
+/** Reset profile resolution state — exported for stream tests. */
+export declare function resetProfileArnCache(resolved?: boolean): void;
+/**
+ * Stream one Kiro response as neutral events.
+ *
+ * Retries live inside this generator: transport timeouts, capacity pressure,
+ * request-rate windows, 403 credential rotation, and degenerate 200s all resend
+ * without the caller seeing a partial turn — except where the response had
+ * already been streamed out, which {@link KiroStreamRequest.canDiscardEmittedBlocks}
+ * governs.
+ */
+export declare function streamKiro(request: KiroStreamRequest): AsyncGenerator<KiroStreamEvent>;