privateer-agent 0.15.4 → 0.15.6

package/dist-boot/c-2BMRFV24.mjs

@@ -0,0 +1,269 @@
+import{createRequire as __pvCR}from"node:module";import{fileURLToPath as __pvF}from"node:url";import{dirname as __pvD}from"node:path";const require=__pvCR(import.meta.url);const __pvUrl=(r)=>new URL(r,import.meta.url).href;const __pvFile=(r)=>__pvF(new URL(r,import.meta.url));
+import {
+  replaceFileDurable,
+  writeFileDurable
+} from "./c-DR7XQI32.mjs";
+import {
+  __name
+} from "./c-CN77DCGF.mjs";
+
+// node_modules/pi-background-tasks/src/core/attested-pi-contract.ts?ext=pi-background-tasks
+var ATTESTED_TASK_ID_PATTERN = /^b[0-9a-f]{32}$/;
+var ATTESTED_GIT_TIMEOUT_MS = 3e4;
+var ATTESTED_GIT_KILL_GRACE_MS = 250;
+var ATTESTED_GIT_MAX_OUTPUT_BYTES = 4 * 1024 * 1024;
+
+// node_modules/pi-background-tasks/src/core/task-durable.ts?ext=pi-background-tasks
+import { mkdir } from "node:fs/promises";
+import { dirname } from "node:path";
+function signalError(signal) {
+  const reason = signal.reason;
+  return reason instanceof Error ? reason : new Error(
+    `Attested Git preflight cancelled${reason === void 0 ? "" : `: ${String(reason)}`}`
+  );
+}
+__name(signalError, "signalError");
+function throwIfAborted(signal) {
+  if (signal?.aborted === true) throw signalError(signal);
+}
+__name(throwIfAborted, "throwIfAborted");
+async function writeFileFsynced(path, data, signal) {
+  throwIfAborted(signal);
+  await mkdir(dirname(path), { recursive: true });
+  throwIfAborted(signal);
+  await writeFileDurable(path, data, signal === void 0 ? {} : { signal });
+}
+__name(writeFileFsynced, "writeFileFsynced");
+async function writeJsonAtomic(path, value, signal) {
+  throwIfAborted(signal);
+  await replaceFileDurable(
+    path,
+    `${JSON.stringify(value, null, 2)}
+`,
+    signal === void 0 ? {} : { signal }
+  );
+}
+__name(writeJsonAtomic, "writeJsonAtomic");
+async function closeAndFsyncOutputStream(stream) {
+  if (!stream) return;
+  await new Promise((resolvePromise, reject) => {
+    let settled = false;
+    const finish = /* @__PURE__ */ __name(() => {
+      if (settled) return;
+      settled = true;
+      stream.off("error", fail);
+      stream.off("close", finish);
+      stream.off("finish", finish);
+      resolvePromise();
+    }, "finish");
+    const fail = /* @__PURE__ */ __name((error) => {
+      if (settled) return;
+      settled = true;
+      stream.off("close", finish);
+      reject(error);
+    }, "fail");
+    stream.once("close", finish);
+    stream.once("finish", finish);
+    stream.once("error", fail);
+    stream.end();
+  });
+}
+__name(closeAndFsyncOutputStream, "closeAndFsyncOutputStream");
+
+// node_modules/pi-background-tasks/src/core/windows-taskkill.ts?ext=pi-background-tasks
+import { spawn as nodeSpawn } from "node:child_process";
+import { win32 } from "node:path";
+var DEFAULT_TIMEOUT_MS = 5e3;
+var DEFAULT_MAX_CAPTURE_BYTES = 8 * 1024;
+var BoundedCapture = class {
+  constructor(maxBytes) {
+    this.maxBytes = maxBytes;
+  }
+  maxBytes;
+  static {
+    __name(this, "BoundedCapture");
+  }
+  chunks = [];
+  capturedBytes = 0;
+  truncated = false;
+  append(data) {
+    const buffer = Buffer.isBuffer(data) ? data : Buffer.from(data, "utf8");
+    if (buffer.length === 0) return;
+    const remaining = this.maxBytes - this.capturedBytes;
+    if (remaining > 0) {
+      const kept = buffer.length <= remaining ? buffer : buffer.subarray(0, remaining);
+      this.chunks.push(kept);
+      this.capturedBytes += kept.length;
+    }
+    if (buffer.length > Math.max(0, remaining)) this.truncated = true;
+  }
+  text() {
+    return Buffer.concat(this.chunks, this.capturedBytes).toString("utf8");
+  }
+  isTruncated() {
+    return this.truncated;
+  }
+};
+function lookupEnv(env, name) {
+  const direct = env[name];
+  if (direct !== void 0) return direct;
+  const lowerName = name.toLowerCase();
+  for (const key of Object.keys(env)) {
+    if (key.toLowerCase() === lowerName) return env[key];
+  }
+  return void 0;
+}
+__name(lookupEnv, "lookupEnv");
+function validateWindowsRoot(raw, label) {
+  const value = raw.trim();
+  if (value.length === 0) throw new Error(`${label} is empty; cannot resolve taskkill.exe`);
+  if (value.includes("\0")) throw new Error(`${label} contains a NUL byte; cannot resolve taskkill.exe`);
+  if (!win32.isAbsolute(value)) {
+    throw new Error(`${label} must be an absolute Windows path; cannot resolve taskkill.exe`);
+  }
+  return value;
+}
+__name(validateWindowsRoot, "validateWindowsRoot");
+function resolveTaskkillPath(env = process.env) {
+  const systemRoot = lookupEnv(env, "SystemRoot");
+  if (systemRoot !== void 0) {
+    return win32.join(validateWindowsRoot(systemRoot, "SystemRoot"), "System32", "taskkill.exe");
+  }
+  const windir = lookupEnv(env, "WINDIR");
+  if (windir !== void 0) {
+    return win32.join(validateWindowsRoot(windir, "WINDIR"), "System32", "taskkill.exe");
+  }
+  throw new Error("Cannot resolve taskkill.exe: SystemRoot is missing and WINDIR fallback is missing");
+}
+__name(resolveTaskkillPath, "resolveTaskkillPath");
+function validatePid(pid) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) {
+    throw new Error(`Invalid Windows taskkill pid ${String(pid)}; expected a positive safe integer`);
+  }
+}
+__name(validatePid, "validatePid");
+function validatePhase(phase) {
+  if (phase !== "terminate" && phase !== "force") {
+    throw new Error(`Invalid Windows taskkill phase ${String(phase)}`);
+  }
+}
+__name(validatePhase, "validatePhase");
+function positiveFiniteInteger(value, fallback, label) {
+  const candidate = value ?? fallback;
+  if (!Number.isFinite(candidate) || candidate <= 0) {
+    throw new Error(`${label} must be a positive finite number`);
+  }
+  return Math.max(1, Math.floor(candidate));
+}
+__name(positiveFiniteInteger, "positiveFiniteInteger");
+function outcome(exitCode, signal, stdout, stderr) {
+  return {
+    exitCode,
+    signal,
+    stdout: stdout.text(),
+    stderr: stderr.text(),
+    stdoutTruncated: stdout.isTruncated(),
+    stderrTruncated: stderr.isTruncated()
+  };
+}
+__name(outcome, "outcome");
+function defaultSpawn(command, args, options) {
+  return nodeSpawn(command, args, options);
+}
+__name(defaultSpawn, "defaultSpawn");
+function runWindowsTaskkill(pid, phase, options = {}) {
+  validatePid(pid);
+  validatePhase(phase);
+  const env = options.env ?? process.env;
+  const taskkill = resolveTaskkillPath(env);
+  const timeoutMs = positiveFiniteInteger(options.timeoutMs, DEFAULT_TIMEOUT_MS, "timeoutMs");
+  const maxCaptureBytes = positiveFiniteInteger(
+    options.maxCaptureBytes,
+    DEFAULT_MAX_CAPTURE_BYTES,
+    "maxCaptureBytes"
+  );
+  const spawn = options.spawn ?? defaultSpawn;
+  const abortSignal = options.signal;
+  const args = ["/PID", String(pid), "/T"];
+  if (phase === "force") args.push("/F");
+  if (abortSignal?.aborted) {
+    const stdout = new BoundedCapture(maxCaptureBytes);
+    const stderr = new BoundedCapture(maxCaptureBytes);
+    stderr.append("Windows taskkill was aborted before launch");
+    return Promise.resolve(outcome(null, null, stdout, stderr));
+  }
+  return new Promise((resolve) => {
+    const stdout = new BoundedCapture(maxCaptureBytes);
+    const stderr = new BoundedCapture(maxCaptureBytes);
+    let settled = false;
+    let timeout;
+    let child;
+    let abortListener;
+    const settle = /* @__PURE__ */ __name((result) => {
+      if (settled) return;
+      settled = true;
+      if (timeout !== void 0) clearTimeout(timeout);
+      if (abortSignal !== void 0 && abortListener !== void 0) {
+        abortSignal.removeEventListener("abort", abortListener);
+      }
+      resolve(result);
+    }, "settle");
+    const stopHelper = /* @__PURE__ */ __name((reason) => {
+      stderr.append(reason);
+      if (child !== void 0) {
+        try {
+          child.kill("SIGKILL");
+        } catch (error) {
+          stderr.append(`; helper kill failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+      }
+      settle(outcome(null, null, stdout, stderr));
+    }, "stopHelper");
+    const spawnOptions = {
+      env,
+      shell: false,
+      windowsVerbatimArguments: false,
+      windowsHide: true,
+      stdio: ["ignore", "pipe", "pipe"]
+    };
+    try {
+      child = spawn(taskkill, args, spawnOptions);
+    } catch (error) {
+      stderr.append(`Windows taskkill spawn failed: ${error instanceof Error ? error.message : String(error)}`);
+      settle(outcome(null, null, stdout, stderr));
+      return;
+    }
+    child.stdout?.on("data", (data) => {
+      stdout.append(data);
+    });
+    child.stderr?.on("data", (data) => {
+      stderr.append(data);
+    });
+    child.on("error", (error) => {
+      stderr.append(`Windows taskkill spawn error: ${error.message}`);
+      settle(outcome(null, null, stdout, stderr));
+    });
+    child.on("close", (code, signal) => {
+      settle(outcome(code, signal, stdout, stderr));
+    });
+    abortListener = /* @__PURE__ */ __name(() => {
+      stopHelper("Windows taskkill was aborted");
+    }, "abortListener");
+    abortSignal?.addEventListener("abort", abortListener, { once: true });
+    timeout = setTimeout(() => {
+      stopHelper(`Windows taskkill timed out after ${String(timeoutMs)}ms`);
+    }, timeoutMs);
+  });
+}
+__name(runWindowsTaskkill, "runWindowsTaskkill");
+
+export {
+  ATTESTED_TASK_ID_PATTERN,
+  ATTESTED_GIT_TIMEOUT_MS,
+  ATTESTED_GIT_KILL_GRACE_MS,
+  ATTESTED_GIT_MAX_OUTPUT_BYTES,
+  writeFileFsynced,
+  writeJsonAtomic,
+  closeAndFsyncOutputStream,
+  runWindowsTaskkill
+};

package/dist-boot/c-2CTF6JA3.mjs

@@ -0,0 +1,166 @@
+import{createRequire as __pvCR}from"node:module";import{fileURLToPath as __pvF}from"node:url";import{dirname as __pvD}from"node:path";const require=__pvCR(import.meta.url);const __pvUrl=(r)=>new URL(r,import.meta.url).href;const __pvFile=(r)=>__pvF(new URL(r,import.meta.url));
+import {
+  AttestationError,
+  ConfigurationError,
+  isBun
+} from "./c-C67644MB.mjs";
+import {
+  __name
+} from "./c-CN77DCGF.mjs";
+
+// node_modules/tinfoil/dist/pinned-tls-fetch.js
+import { X509Certificate, createHash } from "crypto";
+function createCheckServerIdentity(expectedFingerprintHex) {
+  return (host, cert) => {
+    const raw = cert?.raw;
+    if (!raw) {
+      return new AttestationError("TLS pinning failed: Certificate raw bytes are unavailable");
+    }
+    const x509 = new X509Certificate(raw);
+    const publicKeyDer = x509.publicKey.export({ type: "spki", format: "der" });
+    const fp = createHash("sha256").update(publicKeyDer).digest("hex");
+    if (fp !== expectedFingerprintHex) {
+      return new AttestationError("TLS pinning failed: Server certificate public key does not match the attested key");
+    }
+    return void 0;
+  };
+}
+__name(createCheckServerIdentity, "createCheckServerIdentity");
+async function createBunPinnedTlsFetch(baseURL, expectedFingerprintHex) {
+  const tls = await import("tls");
+  const fingerprintCheck = createCheckServerIdentity(expectedFingerprintHex);
+  const parsedBase = new URL(baseURL);
+  if (parsedBase.protocol !== "https:") {
+    throw new ConfigurationError(`Insecure connection rejected: HTTP is not allowed. Use HTTPS for ${baseURL}`);
+  }
+  return (async (input, init) => {
+    const makeURL = /* @__PURE__ */ __name((value) => {
+      if (typeof value === "string")
+        return new URL(value, baseURL);
+      if (value instanceof URL)
+        return value;
+      return new URL(value.url, baseURL);
+    }, "makeURL");
+    const url = makeURL(input);
+    if (url.protocol !== "https:") {
+      throw new ConfigurationError(`Insecure connection rejected: HTTP is not allowed. Use HTTPS for ${url.toString()}`);
+    }
+    const fetchInit = {
+      ...init,
+      // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+      // @ts-ignore - Bun-specific option
+      tls: {
+        checkServerIdentity: /* @__PURE__ */ __name((host, cert) => {
+          const result = fingerprintCheck(host, cert);
+          if (result)
+            return result;
+          return tls.checkServerIdentity(host, cert);
+        }, "checkServerIdentity")
+      }
+    };
+    return fetch(url.toString(), fetchInit);
+  });
+}
+__name(createBunPinnedTlsFetch, "createBunPinnedTlsFetch");
+async function createNodePinnedTlsFetch(baseURL, expectedFingerprintHex) {
+  const https = await import("https");
+  const tls = await import("tls");
+  const { Readable } = await import("stream");
+  const checkServerIdentity = createCheckServerIdentity(expectedFingerprintHex);
+  return (async (input, init) => {
+    const makeURL = /* @__PURE__ */ __name((value) => {
+      if (typeof value === "string")
+        return new URL(value, baseURL);
+      if (value instanceof URL)
+        return value;
+      return new URL(value.url, baseURL);
+    }, "makeURL");
+    const url = makeURL(input);
+    if (url.protocol !== "https:") {
+      throw new ConfigurationError(`Insecure connection rejected: HTTP is not allowed. Use HTTPS for ${url.toString()}`);
+    }
+    const method = (init?.method || input.method || "GET").toUpperCase();
+    const headers = new Headers(init?.headers || input?.headers || {});
+    const headerObj = {};
+    headers.forEach((v, k) => {
+      headerObj[k] = v;
+    });
+    let body = init?.body;
+    if (!body && input instanceof Request) {
+      const buf = await input.arrayBuffer();
+      if (buf && buf.byteLength)
+        body = Buffer.from(buf);
+    }
+    if (body && typeof body.getReader === "function") {
+      body = Readable.fromWeb(body);
+    }
+    if (body instanceof ArrayBuffer) {
+      body = Buffer.from(body);
+    }
+    if (ArrayBuffer.isView(body)) {
+      body = Buffer.from(body.buffer, body.byteOffset, body.byteLength);
+    }
+    const requestOptions = {
+      protocol: url.protocol,
+      hostname: url.hostname,
+      port: url.port ? Number(url.port) : 443,
+      path: `${url.pathname}${url.search}`,
+      method,
+      headers: headerObj,
+      checkServerIdentity: /* @__PURE__ */ __name((host, cert) => {
+        const result = checkServerIdentity(host, cert);
+        if (result)
+          return result;
+        return tls.checkServerIdentity(host, cert);
+      }, "checkServerIdentity")
+    };
+    const { signal } = init || {};
+    const res = await new Promise((resolve, reject) => {
+      const req = https.request(requestOptions, resolve);
+      req.on("error", reject);
+      if (signal) {
+        if (signal.aborted) {
+          req.destroy(new Error("Request aborted"));
+          return;
+        }
+        signal.addEventListener("abort", () => req.destroy(new Error("Request aborted")));
+      }
+      if (body === void 0 || body === null) {
+        req.end();
+      } else if (typeof body === "string" || Buffer.isBuffer(body) || ArrayBuffer.isView(body)) {
+        req.end(body);
+      } else if (typeof body.pipe === "function") {
+        body.pipe(req);
+      } else {
+        req.end(String(body));
+      }
+    });
+    const responseHeaders = new Headers();
+    for (const [k, v] of Object.entries(res.headers)) {
+      if (Array.isArray(v)) {
+        v.forEach((item) => responseHeaders.append(k, item));
+      } else if (v != null) {
+        responseHeaders.set(k, String(v));
+      }
+    }
+    const webStream = Readable.toWeb(res);
+    return new Response(webStream, {
+      status: res.statusCode || 0,
+      statusText: res.statusMessage || "",
+      headers: responseHeaders
+    });
+  });
+}
+__name(createNodePinnedTlsFetch, "createNodePinnedTlsFetch");
+async function createPinnedTlsFetch(baseURL, expectedFingerprintHex) {
+  if (isBun()) {
+    return createBunPinnedTlsFetch(baseURL, expectedFingerprintHex);
+  }
+  return createNodePinnedTlsFetch(baseURL, expectedFingerprintHex);
+}
+__name(createPinnedTlsFetch, "createPinnedTlsFetch");
+
+export {
+  createCheckServerIdentity,
+  createPinnedTlsFetch
+};

package/dist-boot/c-2G3BBHRJ.mjs

@@ -0,0 +1,84 @@
+import{createRequire as __pvCR}from"node:module";import{fileURLToPath as __pvF}from"node:url";import{dirname as __pvD}from"node:path";const require=__pvCR(import.meta.url);const __pvUrl=(r)=>new URL(r,import.meta.url).href;const __pvFile=(r)=>__pvF(new URL(r,import.meta.url));
+import {
+  getProviderEnvValue
+} from "./c-CDBEJSBF.mjs";
+import {
+  __name
+} from "./c-CN77DCGF.mjs";
+
+// node_modules/@earendil-works/pi-ai/dist/api/azure-openai-config.js
+var DEFAULT_AZURE_API_VERSION = "v1";
+function parseDeploymentNameMap(value) {
+  const map = /* @__PURE__ */ new Map();
+  if (!value)
+    return map;
+  for (const entry of value.split(",")) {
+    const trimmed = entry.trim();
+    if (!trimmed)
+      continue;
+    const [modelId, deploymentName] = trimmed.split("=", 2);
+    if (!modelId || !deploymentName)
+      continue;
+    map.set(modelId.trim(), deploymentName.trim());
+  }
+  return map;
+}
+__name(parseDeploymentNameMap, "parseDeploymentNameMap");
+function resolveDeploymentName(model, options) {
+  if (options?.azureDeploymentName) {
+    return options.azureDeploymentName;
+  }
+  const mappedDeployment = parseDeploymentNameMap(getProviderEnvValue("AZURE_OPENAI_DEPLOYMENT_NAME_MAP", options?.env)).get(model.id);
+  return mappedDeployment || model.id;
+}
+__name(resolveDeploymentName, "resolveDeploymentName");
+function normalizeAzureBaseUrl(baseUrl) {
+  const trimmed = baseUrl.trim().replace(/\/+$/, "");
+  let url;
+  try {
+    url = new URL(trimmed);
+  } catch {
+    throw new Error(`Invalid Azure OpenAI base URL: ${baseUrl}`);
+  }
+  const isAzureHost = url.hostname.endsWith(".openai.azure.com") || url.hostname.endsWith(".cognitiveservices.azure.com") || url.hostname.endsWith(".ai.azure.com");
+  const normalizedPath = url.pathname.replace(/\/+$/, "");
+  if (isAzureHost && (normalizedPath === "" || normalizedPath === "/" || normalizedPath === "/openai" || normalizedPath === "/openai/v1/responses")) {
+    url.pathname = "/openai/v1";
+    url.search = "";
+  }
+  return url.toString().replace(/\/+$/, "");
+}
+__name(normalizeAzureBaseUrl, "normalizeAzureBaseUrl");
+function buildDefaultBaseUrl(resourceName) {
+  return `https://${resourceName}.openai.azure.com/openai/v1`;
+}
+__name(buildDefaultBaseUrl, "buildDefaultBaseUrl");
+function resolveAzureBaseUrl(model, options) {
+  const baseUrl = options?.azureBaseUrl?.trim() || getProviderEnvValue("AZURE_OPENAI_BASE_URL", options?.env)?.trim() || void 0;
+  const resourceName = options?.azureResourceName || getProviderEnvValue("AZURE_OPENAI_RESOURCE_NAME", options?.env);
+  let resolvedBaseUrl = baseUrl;
+  if (!resolvedBaseUrl && resourceName) {
+    resolvedBaseUrl = buildDefaultBaseUrl(resourceName);
+  }
+  if (!resolvedBaseUrl && model.baseUrl) {
+    resolvedBaseUrl = model.baseUrl;
+  }
+  if (!resolvedBaseUrl) {
+    throw new Error("Azure OpenAI base URL is required. Set AZURE_OPENAI_BASE_URL or AZURE_OPENAI_RESOURCE_NAME, or pass azureBaseUrl, azureResourceName, or model.baseUrl.");
+  }
+  return normalizeAzureBaseUrl(resolvedBaseUrl);
+}
+__name(resolveAzureBaseUrl, "resolveAzureBaseUrl");
+function resolveAzureConfig(model, options) {
+  return {
+    baseUrl: resolveAzureBaseUrl(model, options),
+    apiVersion: options?.azureApiVersion || getProviderEnvValue("AZURE_OPENAI_API_VERSION", options?.env) || DEFAULT_AZURE_API_VERSION
+  };
+}
+__name(resolveAzureConfig, "resolveAzureConfig");
+
+export {
+  resolveDeploymentName,
+  resolveAzureBaseUrl,
+  resolveAzureConfig
+};