@huaweidevtools/aishell-dsh-credentials-store 0.0.0-stage → 0.0.1-beta.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined in Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is derived from (or based upon) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2024 Huawei Cloud AI Shell
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied. See the License for the specific language governing
+   permissions and limitations under the License.

package/README.md

@@ -1,3 +1,53 @@
-# Temporary Holding Version
+# @huaweidevtools/aishell-dsh-credentials-store
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Credential storage abstraction for aishell DSH plugins. Upper layers call `createCredentialsStore()` and receive a `CredentialsStore` — they never learn which backend is serving. The factory probes backends in priority order and returns the first that answers.
+
+This is a **tool library**, not a DSH plugin — no `dsh.client`, no `cordis.patch.yml`, no `apply`.
+
+## Backends
+
+| Priority | Backend | Durable? | Requirement |
+|---|---|---|---|
+| 1 | `KeyringBackend` | Yes (cross-process, survives reboot) | OS keyring reachable (macOS Keychain / Linux libsecret / Windows Credential Manager) |
+| 2 | `FingerprintBackend` | Yes (same-machine, survives reboot) | `node-machine-id` can resolve a machine UUID |
+| 3 | `MemoryBackend` | No (process-scoped) | None — always available, last resort |
+
+When the OS keyring is unavailable (headless Linux without D-Bus, keychain locked, container), the factory falls back to the fingerprint backend — a machine-fingerprint-bound AES-256-GCM encrypted file at `~/.<service>/credentials.enc`. The encryption key is derived from the machine UUID via scrypt; the ciphertext is useless on a different machine. If the machine UUID is also unavailable, the factory falls back to the in-memory backend so a single DSH session still works.
+
+## Usage
+
+```typescript
+import { createCredentialsStore } from '@huaweidevtools/aishell-dsh-credentials-store'
+
+const store = createCredentialsStore()          // probes keyring → fingerprint → memory
+store.set('HW_ACCESS_KEY', 'LTAIxxxx')          // durable if keyring or fingerprint is up
+const ak = store.get('HW_ACCESS_KEY')           // 'LTAIxxxx'
+store.has('HW_ACCESS_KEY')                       // true
+store.delete('HW_ACCESS_KEY')
+```
+
+A custom service name isolates entries from other applications sharing the same keyring:
+
+```typescript
+const store = createCredentialsStore({ service: 'my-app' })
+```
+
+## Security properties
+
+- **No plaintext files**: nothing on disk is readable with `cat`.
+- **OS-encrypted at rest**: Keychain (AES), libsecret (DPAPI/GNOME keyring), Credential Manager (DPAPI).
+- **Machine-bound encryption (FingerprintBackend)**: AES-256-GCM with a scrypt-derived key from the machine UUID. The ciphertext is useless on a different machine; the key never touches disk.
+- **Per-operation read**: no cache; a credential removed from the keyring is immediately absent on the next `get`.
+- **Graceful degradation**: a missing keyring reads as empty, not as an error — the caller's auth flow fails the same way whether the credential is absent or the store is unreachable.
+
+## Platform support (KeyringBackend)
+
+| Platform | Backend | Requirement |
+|---|---|---|
+| macOS | Keychain | None (built in) |
+| Linux | libsecret | `gnome-keyring` or `kwallet` running, plus `libsecret-1-dev` at build time |
+| Windows | Credential Manager | None (built in) |
+
+## License
+
+Apache License 2.0. See [LICENSE](../../LICENSE).

package/lib/index.d.ts

@@ -0,0 +1,139 @@
+//#region src/backends/keyring.d.ts
+
+type KeyringEntry = {
+  getPassword: () => string | null;
+  setPassword: (value: string) => void;
+  deletePassword: () => void;
+};
+type KeyringModule = {
+  Entry: new (service: string, account: string) => KeyringEntry;
+};
+/** @internal Test hook: inject a mock keyring module (vi.mock cannot intercept createRequire). */
+declare function __setKeyringModule(mock: KeyringModule | undefined): void;
+/**
+ * OS-keyring {@link CredentialsStore}. Constructed with a shared service name;
+ * every entry is stored under `new Entry(service, account)`.
+ *
+ * Construction probes the keyring once — if the native module cannot be loaded
+ * (no prebuilt binding for this platform) or cannot reach a secret service it
+ * throws, and {@link createCredentialsStore} falls back to the next backend.
+ */
+declare class KeyringBackend implements CredentialsStore {
+  private readonly serviceName;
+  private readonly Entry;
+  constructor(config?: CredentialsStoreConfig);
+  get(account: string): string | undefined;
+  set(account: string, value: string): void;
+  delete(account: string): void;
+  has(account: string): boolean;
+} //#endregion
+//#region src/backends/fingerprint.d.ts
+
+/**
+ * Encrypted-file {@link CredentialsStore}. Each account is one entry in a
+ * single JSON map, encrypted as one file under the resolved credentials
+ * directory (`$DSH_HOME/credentials/credentials.enc` by default).
+ *
+ * Construction probes the machine ID + crypto — if `node-machine-id` cannot
+ * resolve a UUID, construction throws and the factory falls back to
+ * {@link MemoryBackend}.
+ */
+declare class FingerprintBackend implements CredentialsStore {
+  private readonly filePath;
+  private readonly fileDir;
+  constructor(config?: CredentialsStoreConfig);
+  /**
+   * Load + decrypt the file into a fresh map. Not cached — credentials are
+   * read, used, and dropped so plaintext does not linger in memory between
+   * operations. The file I/O + scrypt decrypt per call is acceptable: this is
+   * not a hot path (once per chat request, not per token).
+   */
+  private load;
+  /** Encrypt + write the map to disk with owner-only permissions. */
+  private persist;
+  get(account: string): string | undefined;
+  set(account: string, value: string): void;
+  delete(account: string): void;
+  has(account: string): boolean;
+} //#endregion
+//#region src/backends/memory.d.ts
+
+//# sourceMappingURL=fingerprint.d.ts.map
+/** Process-scoped {@link CredentialsStore}; entries vanish on exit. */
+declare class MemoryBackend implements CredentialsStore {
+  private readonly entries;
+  constructor(_config?: CredentialsStoreConfig);
+  get(account: string): string | undefined;
+  set(account: string, value: string): void;
+  delete(account: string): void;
+  has(account: string): boolean;
+}
+
+//#endregion
+//#region src/index.d.ts
+//# sourceMappingURL=memory.d.ts.map
+/**
+ * Credential storage abstraction for aishell DSH plugins.
+ *
+ * Upper layers (aishell-llm's adapter, aishell-credentials' host half)
+ * call {@link createCredentialsStore} and get a {@link CredentialsStore} —
+ * they never learn which backend is serving. The factory probes backends in
+ * priority order (OS keyring first, process memory last) and returns the
+ * first that answers. New backends (fingerprint + encrypted file, etc.) slot
+ * into the chain without touching callers.
+ *
+ * This is a tool library, not a DSH plugin — no `dsh.client`, no
+ * `cordis.patch.yml`, no `apply`. DSH's own `ctx.credentials` is untouched;
+ * user-configured models and `.credentials.yaml` keep working.
+ *
+ * @module @huaweidevtools/aishell-dsh-credentials-store
+ */
+/** Options shared by every backend / the factory. */
+interface CredentialsStoreConfig {
+  /**
+   * Backend-scoped identity. For the OS-keyring backend this is the keyring
+   * service name; every entry is stored under `new Entry(service, account)`.
+   * Defaults to `'aishell-dsh'`.
+   */
+  readonly service?: string;
+  /**
+   * Explicit directory for the fingerprint encrypted-file backend. When set,
+   * overrides the default `$DSH_HOME/credentials` resolution. Callers rarely
+   * need this — the host's `DSH_HOME` already places credentials alongside
+   * its other data.
+   */
+  readonly credentialsDir?: string;
+}
+/**
+ * Read/write a named credential. Backends are synchronous and per-call — no
+ * cache, so a credential changed from outside is visible on the next `get`.
+ * Absent credentials read as `undefined` / `has === false`; a backend that
+ * cannot serve (e.g. no D-Bus secret service) degrades the same way rather
+ * than throwing on read.
+ */
+interface CredentialsStore {
+  /** Read one credential; `undefined` when absent or backend unavailable. */
+  get(account: string): string | undefined;
+  /** Store one credential. Rejects an empty value; throws on backend errors. */
+  set(account: string, value: string): void;
+  /** Remove one credential; absent is a no-op. Throws on backend errors. */
+  delete(account: string): void;
+  /** Whether a credential is currently stored; `false` when absent or backend unavailable. */
+  has(account: string): boolean;
+}
+/**
+ * Probe backends in priority order and return the first that answers.
+ *
+ * Priority: OS keyring (durable, cross-process) → machine-fingerprint
+ * encrypted file (durable, same-machine) → process memory (volatile,
+ * last resort). A backend that cannot initialize — no D-Bus secret service
+ * on a headless Linux box, keychain locked, etc. — is skipped, not fatal.
+ *
+ * @param config - optional service name override.
+ * @returns the highest-priority backend that could initialize.
+ */
+declare function createCredentialsStore(config?: CredentialsStoreConfig): CredentialsStore;
+
+//#endregion
+export { CredentialsStore, CredentialsStoreConfig, FingerprintBackend, KeyringBackend, MemoryBackend, __setKeyringModule, createCredentialsStore };
+//# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../src/backends/keyring.ts","../../src/backends/fingerprint.ts","../../src/backends/memory.ts","../../src/index.ts"],"sourcesContent":null,"mappings":";;AA+CA,KA1BK,YAAA,GA0BQ;EAAe,WAAA,EAAA,GAAA,GAAA,MAAA,GAAA,IAAA;EAAA,WAIN,EAAA,CAAA,KAAA,EAAA,MAAA,EAAA,GAAA,IAAA;EAA2B,cAJV,EAAA,GAAA,GAAA,IAAA;AAAgB,CAAA;KArBlD,aAAA;mDAAmE;;;iBAIxD,kBAAA,OAAyB;;;;;;;;AC2DzC;AAAgC,cD1CnB,cAAA,YAA0B,gBC0CP,CAAA;EAAA,iBAIV,WAAA;EAA2B,iBAJN,KAAA;EAAgB,WAAA,CAAA,MAAA,CAAA,EDtCrC,sBCsCqC;;;;;AC1E3D,CAAA;;;;;AFgCuD;;;;;;;cC0C1C,kBAAA,YAA8B;;;uBAIrB;;;AAJtB;;;;EAA2D,QAAA,IAAA;;;;;EC1E9C,MAAA,CAAA,OAAA,EAAc,MAAA,CAAA,EAAA,IAAA;EAAA,GAAA,CAAA,OAAA,EAAA,MAAA,CAAA,EAAA,OAAA;CAAA;;;;;AFgCd,cEhCA,aAAA,YAAyB,gBFgCV,CAAA;EAAA,iBAAA,OAAA;EAAA,WAIN,CAAA,OAAA,CAAA,EEjCC,sBFiCD;EAA2B,GAJV,CAAA,OAAA,EAAA,MAAA,CAAA,EAAA,MAAA,GAAA,SAAA;EAAgB,GAAA,CAAA,OAAA,EAAA,MAAA,EAAA,KAAA,EAAA,MAAA,CAAA,EAAA,IAAA;;;;;;;;;AAjCoB;AAO1D;;AASjB;;;;;;;;;AAiBA;;;;AAAuD,UGzBtC,sBAAA,CHyBsC;;;;;;;;;;;;;EC0C1C,SAAA,cAAmB,CAAA,EAAA,MAAA;;;;AAA2B;;;;;AC1E9C,UC8BI,gBAAA,CD9BU;EAAA;EAAA,GAGJ,CAAA,OAAA,EAAA,MAAA,CAAA,EAAA,MAAA,GAAA,SAAA;EAA2B;EAHI,GAAA,CAAA,OAAA,EAAA,MAAA,EAAA,KAAA,EAAA,MAAA,CAAA,EAAA,IAAA;;;;;;;;;;;;;;;;;iBCoDtC,sBAAA,UAA+B,yBAA8B"}

package/lib/index.js

@@ -0,0 +1,222 @@
+import { createRequire } from "node:module";
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import machineIdModule from "node-machine-id";
+
+//#region src/backends/keyring.ts
+const require = createRequire(import.meta.url);
+let keyringModule;
+/** @internal Test hook: inject a mock keyring module (vi.mock cannot intercept createRequire). */
+function __setKeyringModule(mock) {
+	keyringModule = mock;
+}
+function loadKeyring() {
+	if (keyringModule === void 0) keyringModule = require("@napi-rs/keyring");
+	return keyringModule;
+}
+/**
+* OS-keyring {@link CredentialsStore}. Constructed with a shared service name;
+* every entry is stored under `new Entry(service, account)`.
+*
+* Construction probes the keyring once — if the native module cannot be loaded
+* (no prebuilt binding for this platform) or cannot reach a secret service it
+* throws, and {@link createCredentialsStore} falls back to the next backend.
+*/
+var KeyringBackend = class {
+	constructor(config = {}) {
+		this.serviceName = config.service ?? "aishell-dsh";
+		this.Entry = loadKeyring().Entry;
+		new this.Entry(this.serviceName, "__probe__").getPassword();
+	}
+	get(account) {
+		try {
+			const value = new this.Entry(this.serviceName, account).getPassword();
+			return value ?? void 0;
+		} catch {
+			return void 0;
+		}
+	}
+	set(account, value) {
+		if (value.length === 0) throw new Error("credential value must be non-empty");
+		new this.Entry(this.serviceName, account).setPassword(value);
+	}
+	delete(account) {
+		try {
+			new this.Entry(this.serviceName, account).deletePassword();
+		} catch (error) {
+			if (!String(error).includes("not found") && !String(error).includes("no entry")) throw error;
+		}
+	}
+	has(account) {
+		try {
+			return new this.Entry(this.serviceName, account).getPassword() !== null;
+		} catch {
+			return false;
+		}
+	}
+};
+
+//#endregion
+//#region src/backends/fingerprint.ts
+const machineIdSync = machineIdModule.machineIdSync;
+const SALT = "aishell-dsh/credentials/v1";
+const KEY_LEN = 32;
+const NONCE_LEN = 12;
+const TAG_LEN = 16;
+/** Derive a 32-byte key from the machine UUID via scrypt. */
+function deriveKey() {
+	const machineId = machineIdSync();
+	return scryptSync(machineId, SALT, KEY_LEN);
+}
+/** Encrypt plaintext → [nonce][tag][ciphertext] as a Buffer. */
+function fingerprintEncrypt(plaintext) {
+	const key = deriveKey();
+	const nonce = randomBytes(NONCE_LEN);
+	const cipher = createCipheriv("aes-256-gcm", key, nonce);
+	const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+	const tag = cipher.getAuthTag();
+	return Buffer.concat([
+		nonce,
+		tag,
+		ciphertext
+	]);
+}
+/** Decrypt [nonce][tag][ciphertext] → plaintext. Throws on tamper/wrong machine. */
+function fingerprintDecrypt(data) {
+	if (data.length < NONCE_LEN + TAG_LEN) throw new Error("credentials file corrupted (too short)");
+	const key = deriveKey();
+	const nonce = data.subarray(0, NONCE_LEN);
+	const tag = data.subarray(NONCE_LEN, NONCE_LEN + TAG_LEN);
+	const ciphertext = data.subarray(NONCE_LEN + TAG_LEN);
+	const decipher = createDecipheriv("aes-256-gcm", key, nonce);
+	decipher.setAuthTag(tag);
+	const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+	return plaintext.toString("utf8");
+}
+/**
+* Resolve the directory holding the encrypted credentials file.
+*
+* Priority: an explicit `config.credentialsDir` override → the host's
+* `DSH_HOME` (so credentials live alongside the rest of that host's data —
+* `~/.aishell/credentials` for the desktop app, `~/.dsh/credentials` for the
+* dsh CLI) → a standalone `~/.aishell-dsh` fallback for headless / library
+* use where no DSH host is involved.
+*
+* The `service` config still names the keyring service (and the fallback
+* directory name when neither `credentialsDir` nor `DSH_HOME` is set).
+*/
+function resolveCredentialsDir(config) {
+	if (config.credentialsDir !== void 0) return config.credentialsDir;
+	const dshHome = process.env.DSH_HOME;
+	if (dshHome !== void 0 && dshHome.trim() !== "") return join(dshHome, "credentials");
+	const dirName = config.service ?? "aishell-dsh";
+	return join(homedir(), `.${dirName}`);
+}
+/**
+* Encrypted-file {@link CredentialsStore}. Each account is one entry in a
+* single JSON map, encrypted as one file under the resolved credentials
+* directory (`$DSH_HOME/credentials/credentials.enc` by default).
+*
+* Construction probes the machine ID + crypto — if `node-machine-id` cannot
+* resolve a UUID, construction throws and the factory falls back to
+* {@link MemoryBackend}.
+*/
+var FingerprintBackend = class {
+	constructor(config = {}) {
+		this.fileDir = resolveCredentialsDir(config);
+		this.filePath = join(this.fileDir, "credentials.enc");
+		deriveKey();
+	}
+	/**
+	* Load + decrypt the file into a fresh map. Not cached — credentials are
+	* read, used, and dropped so plaintext does not linger in memory between
+	* operations. The file I/O + scrypt decrypt per call is acceptable: this is
+	* not a hot path (once per chat request, not per token).
+	*/
+	load() {
+		if (!existsSync(this.filePath)) return new Map();
+		try {
+			const encrypted = readFileSync(this.filePath);
+			const plaintext = fingerprintDecrypt(encrypted);
+			return new Map(Object.entries(JSON.parse(plaintext)));
+		} catch {
+			return new Map();
+		}
+	}
+	/** Encrypt + write the map to disk with owner-only permissions. */
+	persist(entries) {
+		const plaintext = JSON.stringify(Object.fromEntries(entries));
+		mkdirSync(this.fileDir, {
+			recursive: true,
+			mode: 448
+		});
+		writeFileSync(this.filePath, fingerprintEncrypt(plaintext), { mode: 384 });
+	}
+	get(account) {
+		return this.load().get(account);
+	}
+	set(account, value) {
+		if (value.length === 0) throw new Error("credential value must be non-empty");
+		const entries = this.load();
+		entries.set(account, value);
+		this.persist(entries);
+	}
+	delete(account) {
+		const entries = this.load();
+		if (entries.delete(account)) this.persist(entries);
+	}
+	has(account) {
+		return this.load().has(account);
+	}
+};
+
+//#endregion
+//#region src/backends/memory.ts
+/** Process-scoped {@link CredentialsStore}; entries vanish on exit. */
+var MemoryBackend = class {
+	constructor(_config = {}) {
+		this.entries = new Map();
+	}
+	get(account) {
+		return this.entries.get(account);
+	}
+	set(account, value) {
+		if (value.length === 0) throw new Error("credential value must be non-empty");
+		this.entries.set(account, value);
+	}
+	delete(account) {
+		this.entries.delete(account);
+	}
+	has(account) {
+		return this.entries.has(account);
+	}
+};
+
+//#endregion
+//#region src/index.ts
+/**
+* Probe backends in priority order and return the first that answers.
+*
+* Priority: OS keyring (durable, cross-process) → machine-fingerprint
+* encrypted file (durable, same-machine) → process memory (volatile,
+* last resort). A backend that cannot initialize — no D-Bus secret service
+* on a headless Linux box, keychain locked, etc. — is skipped, not fatal.
+*
+* @param config - optional service name override.
+* @returns the highest-priority backend that could initialize.
+*/
+function createCredentialsStore(config = {}) {
+	try {
+		return new KeyringBackend(config);
+	} catch {}
+	try {
+		return new FingerprintBackend(config);
+	} catch {}
+	return new MemoryBackend(config);
+}
+
+//#endregion
+export { FingerprintBackend, KeyringBackend, MemoryBackend, __setKeyringModule, createCredentialsStore };
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":["keyringModule: KeyringModule | undefined","mock: KeyringModule | undefined","config: CredentialsStoreConfig","account: string","value: string","error: unknown","machineIdSync: () => string","plaintext: string","data: Buffer","config: CredentialsStoreConfig","entries: Map<string, string>","account: string","value: string","_config: CredentialsStoreConfig","account: string","value: string","config: CredentialsStoreConfig"],"sources":["../src/backends/keyring.ts","../src/backends/fingerprint.ts","../src/backends/memory.ts","../src/index.ts"],"sourcesContent":["/**\n * OS-keyring backend — the durable, cross-process credential store.\n *\n * Wraps `@napi-rs/keyring` (macOS Keychain / Linux libsecret / Windows\n * Credential Manager). Values persist across process restarts and reboots\n * because the OS owns the store.\n *\n * Native keyring errors (e.g. no D-Bus secret service running on Linux) are\n * caught: `get`/`has` return `undefined`/`false` so callers degrade\n * gracefully; `set`/`delete` throw a descriptive error so the caller knows\n * the store is unavailable.\n */\n\nimport { createRequire } from 'node:module'\nimport type { CredentialsStore, CredentialsStoreConfig } from '../index.ts'\n\n// Lazily resolved so a missing native binding (the known @napi-rs optional-deps\n// bug, or a platform with no prebuilt binary) throws inside the constructor\n// probe — where createCredentialsStore's try/catch catches it and falls back\n// to FingerprintBackend — instead of crashing at module-load time.\nconst require = createRequire(import.meta.url)\ntype KeyringEntry = {\n  getPassword: () => string | null\n  setPassword: (value: string) => void\n  deletePassword: () => void\n}\ntype KeyringModule = { Entry: new (service: string, account: string) => KeyringEntry }\nlet keyringModule: KeyringModule | undefined\n\n/** @internal Test hook: inject a mock keyring module (vi.mock cannot intercept createRequire). */\nexport function __setKeyringModule(mock: KeyringModule | undefined): void {\n  keyringModule = mock\n}\n\nfunction loadKeyring(): KeyringModule {\n  if (keyringModule === undefined) keyringModule = require('@napi-rs/keyring') as KeyringModule\n  return keyringModule\n}\n\n/**\n * OS-keyring {@link CredentialsStore}. Constructed with a shared service name;\n * every entry is stored under `new Entry(service, account)`.\n *\n * Construction probes the keyring once — if the native module cannot be loaded\n * (no prebuilt binding for this platform) or cannot reach a secret service it\n * throws, and {@link createCredentialsStore} falls back to the next backend.\n */\nexport class KeyringBackend implements CredentialsStore {\n  private readonly serviceName: string\n  private readonly Entry: new (service: string, account: string) => KeyringEntry\n\n  constructor(config: CredentialsStoreConfig = {}) {\n    this.serviceName = config.service ?? 'aishell-dsh'\n    this.Entry = loadKeyring().Entry\n    // Probe: a getPassword on a throwaway account exercises the native path.\n    // If the secret service is absent this throws (D-Bus error, etc.), which\n    // the factory catches to fall back to the fingerprint backend.\n    new this.Entry(this.serviceName, '__probe__').getPassword()\n  }\n\n  get(account: string): string | undefined {\n    try {\n      const value = new this.Entry(this.serviceName, account).getPassword()\n      return value ?? undefined\n    } catch {\n      return undefined\n    }\n  }\n\n  set(account: string, value: string): void {\n    if (value.length === 0) throw new Error('credential value must be non-empty')\n    new this.Entry(this.serviceName, account).setPassword(value)\n  }\n\n  delete(account: string): void {\n    try {\n      new this.Entry(this.serviceName, account).deletePassword()\n    } catch (error: unknown) {\n      // deletePassword on an absent entry may throw on some backends;\n      // treat that as a no-op rather than an error.\n      if (!String(error).includes('not found') && !String(error).includes('no entry')) {\n        throw error\n      }\n    }\n  }\n\n  has(account: string): boolean {\n    try {\n      return new this.Entry(this.serviceName, account).getPassword() !== null\n    } catch {\n      return false\n    }\n  }\n}\n","/**\n * Machine-fingerprint-bound encrypted file backend.\n *\n * When the OS keyring is unavailable (headless Linux, Docker, no keyring\n * daemon), credentials are encrypted with a key derived from the machine UUID\n * (node-machine-id) via scrypt, then AES-256-GCM. File format:\n * [12B nonce][16B tag][ciphertext...].\n *\n * The key never touches disk; the ciphertext is useless on a different machine.\n * Same-user-same-machine is trusted. VM cloning copies the machine UUID — a\n * known limitation, not a security hole.\n *\n * Ported from mcp-huaweicloud-ops-deploy/src/auth/fingerprint.ts.\n */\n\nimport { createCipheriv, createDecipheriv, randomBytes, scryptSync } from 'node:crypto'\nimport { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs'\nimport { homedir } from 'node:os'\nimport { join } from 'node:path'\nimport machineIdModule from 'node-machine-id'\nimport type { CredentialsStore, CredentialsStoreConfig } from '../index.ts'\n\nconst machineIdSync: () => string = machineIdModule.machineIdSync\n\nconst SALT = 'aishell-dsh/credentials/v1'\nconst KEY_LEN = 32 // AES-256\nconst NONCE_LEN = 12 // GCM standard (96-bit nonce)\nconst TAG_LEN = 16 // 128-bit auth tag\n\n/** Derive a 32-byte key from the machine UUID via scrypt. */\nfunction deriveKey(): Buffer {\n  const machineId = machineIdSync()\n  return scryptSync(machineId, SALT, KEY_LEN)\n}\n\n/** Encrypt plaintext → [nonce][tag][ciphertext] as a Buffer. */\nfunction fingerprintEncrypt(plaintext: string): Buffer {\n  const key = deriveKey()\n  const nonce = randomBytes(NONCE_LEN)\n  const cipher = createCipheriv('aes-256-gcm', key, nonce)\n  const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()])\n  const tag = cipher.getAuthTag()\n  return Buffer.concat([nonce, tag, ciphertext])\n}\n\n/** Decrypt [nonce][tag][ciphertext] → plaintext. Throws on tamper/wrong machine. */\nfunction fingerprintDecrypt(data: Buffer): string {\n  if (data.length < NONCE_LEN + TAG_LEN) {\n    throw new Error('credentials file corrupted (too short)')\n  }\n  const key = deriveKey()\n  const nonce = data.subarray(0, NONCE_LEN)\n  const tag = data.subarray(NONCE_LEN, NONCE_LEN + TAG_LEN)\n  const ciphertext = data.subarray(NONCE_LEN + TAG_LEN)\n  const decipher = createDecipheriv('aes-256-gcm', key, nonce)\n  decipher.setAuthTag(tag)\n  const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()])\n  return plaintext.toString('utf8')\n}\n\n/**\n * Resolve the directory holding the encrypted credentials file.\n *\n * Priority: an explicit `config.credentialsDir` override → the host's\n * `DSH_HOME` (so credentials live alongside the rest of that host's data —\n * `~/.aishell/credentials` for the desktop app, `~/.dsh/credentials` for the\n * dsh CLI) → a standalone `~/.aishell-dsh` fallback for headless / library\n * use where no DSH host is involved.\n *\n * The `service` config still names the keyring service (and the fallback\n * directory name when neither `credentialsDir` nor `DSH_HOME` is set).\n */\nfunction resolveCredentialsDir(config: CredentialsStoreConfig): string {\n  if (config.credentialsDir !== undefined) return config.credentialsDir\n  const dshHome = process.env.DSH_HOME\n  if (dshHome !== undefined && dshHome.trim() !== '') return join(dshHome, 'credentials')\n  const dirName = config.service ?? 'aishell-dsh'\n  return join(homedir(), `.${dirName}`)\n}\n\n/**\n * Encrypted-file {@link CredentialsStore}. Each account is one entry in a\n * single JSON map, encrypted as one file under the resolved credentials\n * directory (`$DSH_HOME/credentials/credentials.enc` by default).\n *\n * Construction probes the machine ID + crypto — if `node-machine-id` cannot\n * resolve a UUID, construction throws and the factory falls back to\n * {@link MemoryBackend}.\n */\nexport class FingerprintBackend implements CredentialsStore {\n  private readonly filePath: string\n  private readonly fileDir: string\n\n  constructor(config: CredentialsStoreConfig = {}) {\n    this.fileDir = resolveCredentialsDir(config)\n    this.filePath = join(this.fileDir, 'credentials.enc')\n    // Probe: deriveKey exercises node-machine-id. If it throws, the factory\n    // falls back to MemoryBackend.\n    deriveKey()\n  }\n\n  /**\n   * Load + decrypt the file into a fresh map. Not cached — credentials are\n   * read, used, and dropped so plaintext does not linger in memory between\n   * operations. The file I/O + scrypt decrypt per call is acceptable: this is\n   * not a hot path (once per chat request, not per token).\n   */\n  private load(): Map<string, string> {\n    if (!existsSync(this.filePath)) return new Map()\n    try {\n      const encrypted = readFileSync(this.filePath)\n      const plaintext = fingerprintDecrypt(encrypted)\n      return new Map(Object.entries(JSON.parse(plaintext) as Record<string, string>))\n    } catch {\n      // Corrupted or wrong machine — treat as empty.\n      return new Map()\n    }\n  }\n\n  /** Encrypt + write the map to disk with owner-only permissions. */\n  private persist(entries: Map<string, string>): void {\n    const plaintext = JSON.stringify(Object.fromEntries(entries))\n    mkdirSync(this.fileDir, { recursive: true, mode: 0o700 })\n    // Write owner-only (0600); on platforms that ignore the mode (Windows)\n    // the file is still encrypted, and ACLs inherit from the profile dir.\n    writeFileSync(this.filePath, fingerprintEncrypt(plaintext), { mode: 0o600 })\n  }\n\n  get(account: string): string | undefined {\n    return this.load().get(account)\n  }\n\n  set(account: string, value: string): void {\n    if (value.length === 0) throw new Error('credential value must be non-empty')\n    const entries = this.load()\n    entries.set(account, value)\n    this.persist(entries)\n  }\n\n  delete(account: string): void {\n    const entries = this.load()\n    if (entries.delete(account)) {\n      this.persist(entries)\n    }\n  }\n\n  has(account: string): boolean {\n    return this.load().has(account)\n  }\n}\n","/**\n * In-memory backend — the volatile last-resort credential store.\n *\n * Used when the OS keyring is unavailable (no secret service, keychain\n * locked, headless box without D-Bus). Entries live in a process-scoped\n * `Map` and are lost when the process exits — durable enough for a single\n * DSH session, not for persistence.\n *\n * Callers never select this directly; {@link createCredentialsStore} falls\n * back to it when {@link KeyringBackend} cannot initialize.\n */\n\nimport type { CredentialsStore, CredentialsStoreConfig } from '../index.ts'\n\n/** Process-scoped {@link CredentialsStore}; entries vanish on exit. */\nexport class MemoryBackend implements CredentialsStore {\n  private readonly entries = new Map<string, string>()\n\n  constructor(_config: CredentialsStoreConfig = {}) {\n    // Service name is accepted for API symmetry with KeyringBackend but not\n    // used: the in-process Map is keyed by account alone, and the factory\n    // guarantees only one MemoryBackend is live per credential concern.\n  }\n\n  get(account: string): string | undefined {\n    return this.entries.get(account)\n  }\n\n  set(account: string, value: string): void {\n    if (value.length === 0) throw new Error('credential value must be non-empty')\n    this.entries.set(account, value)\n  }\n\n  delete(account: string): void {\n    this.entries.delete(account)\n  }\n\n  has(account: string): boolean {\n    return this.entries.has(account)\n  }\n}\n","/**\n * Credential storage abstraction for aishell DSH plugins.\n *\n * Upper layers (aishell-llm's adapter, aishell-credentials' host half)\n * call {@link createCredentialsStore} and get a {@link CredentialsStore} —\n * they never learn which backend is serving. The factory probes backends in\n * priority order (OS keyring first, process memory last) and returns the\n * first that answers. New backends (fingerprint + encrypted file, etc.) slot\n * into the chain without touching callers.\n *\n * This is a tool library, not a DSH plugin — no `dsh.client`, no\n * `cordis.patch.yml`, no `apply`. DSH's own `ctx.credentials` is untouched;\n * user-configured models and `.credentials.yaml` keep working.\n *\n * @module @huaweidevtools/aishell-dsh-credentials-store\n */\n\nimport { KeyringBackend } from './backends/keyring.ts'\nimport { FingerprintBackend } from './backends/fingerprint.ts'\nimport { MemoryBackend } from './backends/memory.ts'\n\n/** Options shared by every backend / the factory. */\nexport interface CredentialsStoreConfig {\n  /**\n   * Backend-scoped identity. For the OS-keyring backend this is the keyring\n   * service name; every entry is stored under `new Entry(service, account)`.\n   * Defaults to `'aishell-dsh'`.\n   */\n  readonly service?: string\n  /**\n   * Explicit directory for the fingerprint encrypted-file backend. When set,\n   * overrides the default `$DSH_HOME/credentials` resolution. Callers rarely\n   * need this — the host's `DSH_HOME` already places credentials alongside\n   * its other data.\n   */\n  readonly credentialsDir?: string\n}\n\n/**\n * Read/write a named credential. Backends are synchronous and per-call — no\n * cache, so a credential changed from outside is visible on the next `get`.\n * Absent credentials read as `undefined` / `has === false`; a backend that\n * cannot serve (e.g. no D-Bus secret service) degrades the same way rather\n * than throwing on read.\n */\nexport interface CredentialsStore {\n  /** Read one credential; `undefined` when absent or backend unavailable. */\n  get(account: string): string | undefined\n  /** Store one credential. Rejects an empty value; throws on backend errors. */\n  set(account: string, value: string): void\n  /** Remove one credential; absent is a no-op. Throws on backend errors. */\n  delete(account: string): void\n  /** Whether a credential is currently stored; `false` when absent or backend unavailable. */\n  has(account: string): boolean\n}\n\n/**\n * Probe backends in priority order and return the first that answers.\n *\n * Priority: OS keyring (durable, cross-process) → machine-fingerprint\n * encrypted file (durable, same-machine) → process memory (volatile,\n * last resort). A backend that cannot initialize — no D-Bus secret service\n * on a headless Linux box, keychain locked, etc. — is skipped, not fatal.\n *\n * @param config - optional service name override.\n * @returns the highest-priority backend that could initialize.\n */\nexport function createCredentialsStore(config: CredentialsStoreConfig = {}): CredentialsStore {\n  try {\n    return new KeyringBackend(config)\n  } catch {\n    // OS keyring unavailable — try the fingerprint file backend.\n  }\n  try {\n    return new FingerprintBackend(config)\n  } catch {\n    // Machine fingerprint unavailable (no machine ID) — fall back to memory.\n  }\n  return new MemoryBackend(config)\n}\n\nexport { KeyringBackend, __setKeyringModule } from './backends/keyring.ts'\nexport { FingerprintBackend } from './backends/fingerprint.ts'\nexport { MemoryBackend } from './backends/memory.ts'\n"],"mappings":";;;;;;;;AAoBA,MAAM,UAAU,cAAc,OAAO,KAAK,IAAI;AAO9C,IAAIA;;AAGJ,SAAgB,mBAAmBC,MAAuC;AACxE,iBAAgB;AACjB;AAED,SAAS,cAA6B;AACpC,KAAI,yBAA6B,iBAAgB,QAAQ,mBAAmB;AAC5E,QAAO;AACR;;;;;;;;;AAUD,IAAa,iBAAb,MAAwD;CAItD,YAAYC,SAAiC,CAAE,GAAE;AAC/C,OAAK,cAAc,OAAO,WAAW;AACrC,OAAK,QAAQ,aAAa,CAAC;AAI3B,MAAI,KAAK,MAAM,KAAK,aAAa,aAAa,aAAa;CAC5D;CAED,IAAIC,SAAqC;AACvC,MAAI;GACF,MAAM,QAAQ,IAAI,KAAK,MAAM,KAAK,aAAa,SAAS,aAAa;AACrE,UAAO;EACR,QAAO;AACN;EACD;CACF;CAED,IAAIA,SAAiBC,OAAqB;AACxC,MAAI,MAAM,WAAW,EAAG,OAAM,IAAI,MAAM;AACxC,MAAI,KAAK,MAAM,KAAK,aAAa,SAAS,YAAY,MAAM;CAC7D;CAED,OAAOD,SAAuB;AAC5B,MAAI;AACF,OAAI,KAAK,MAAM,KAAK,aAAa,SAAS,gBAAgB;EAC3D,SAAQE,OAAgB;AAGvB,QAAK,OAAO,MAAM,CAAC,SAAS,YAAY,KAAK,OAAO,MAAM,CAAC,SAAS,WAAW,CAC7E,OAAM;EAET;CACF;CAED,IAAIF,SAA0B;AAC5B,MAAI;AACF,UAAO,IAAI,KAAK,MAAM,KAAK,aAAa,SAAS,aAAa,KAAK;EACpE,QAAO;AACN,UAAO;EACR;CACF;AACF;;;;ACvED,MAAMG,gBAA8B,gBAAgB;AAEpD,MAAM,OAAO;AACb,MAAM,UAAU;AAChB,MAAM,YAAY;AAClB,MAAM,UAAU;;AAGhB,SAAS,YAAoB;CAC3B,MAAM,YAAY,eAAe;AACjC,QAAO,WAAW,WAAW,MAAM,QAAQ;AAC5C;;AAGD,SAAS,mBAAmBC,WAA2B;CACrD,MAAM,MAAM,WAAW;CACvB,MAAM,QAAQ,YAAY,UAAU;CACpC,MAAM,SAAS,eAAe,eAAe,KAAK,MAAM;CACxD,MAAM,aAAa,OAAO,OAAO,CAAC,OAAO,OAAO,WAAW,OAAO,EAAE,OAAO,OAAO,AAAC,EAAC;CACpF,MAAM,MAAM,OAAO,YAAY;AAC/B,QAAO,OAAO,OAAO;EAAC;EAAO;EAAK;CAAW,EAAC;AAC/C;;AAGD,SAAS,mBAAmBC,MAAsB;AAChD,KAAI,KAAK,SAAS,YAAY,QAC5B,OAAM,IAAI,MAAM;CAElB,MAAM,MAAM,WAAW;CACvB,MAAM,QAAQ,KAAK,SAAS,GAAG,UAAU;CACzC,MAAM,MAAM,KAAK,SAAS,WAAW,YAAY,QAAQ;CACzD,MAAM,aAAa,KAAK,SAAS,YAAY,QAAQ;CACrD,MAAM,WAAW,iBAAiB,eAAe,KAAK,MAAM;AAC5D,UAAS,WAAW,IAAI;CACxB,MAAM,YAAY,OAAO,OAAO,CAAC,SAAS,OAAO,WAAW,EAAE,SAAS,OAAO,AAAC,EAAC;AAChF,QAAO,UAAU,SAAS,OAAO;AAClC;;;;;;;;;;;;;AAcD,SAAS,sBAAsBC,QAAwC;AACrE,KAAI,OAAO,0BAA8B,QAAO,OAAO;CACvD,MAAM,UAAU,QAAQ,IAAI;AAC5B,KAAI,sBAAyB,QAAQ,MAAM,KAAK,GAAI,QAAO,KAAK,SAAS,cAAc;CACvF,MAAM,UAAU,OAAO,WAAW;AAClC,QAAO,KAAK,SAAS,GAAG,GAAG,QAAQ,EAAE;AACtC;;;;;;;;;;AAWD,IAAa,qBAAb,MAA4D;CAI1D,YAAYA,SAAiC,CAAE,GAAE;AAC/C,OAAK,UAAU,sBAAsB,OAAO;AAC5C,OAAK,WAAW,KAAK,KAAK,SAAS,kBAAkB;AAGrD,aAAW;CACZ;;;;;;;CAQD,OAAoC;AAClC,OAAK,WAAW,KAAK,SAAS,CAAE,QAAO,IAAI;AAC3C,MAAI;GACF,MAAM,YAAY,aAAa,KAAK,SAAS;GAC7C,MAAM,YAAY,mBAAmB,UAAU;AAC/C,UAAO,IAAI,IAAI,OAAO,QAAQ,KAAK,MAAM,UAAU,CAA2B;EAC/E,QAAO;AAEN,UAAO,IAAI;EACZ;CACF;;CAGD,QAAgBC,SAAoC;EAClD,MAAM,YAAY,KAAK,UAAU,OAAO,YAAY,QAAQ,CAAC;AAC7D,YAAU,KAAK,SAAS;GAAE,WAAW;GAAM,MAAM;EAAO,EAAC;AAGzD,gBAAc,KAAK,UAAU,mBAAmB,UAAU,EAAE,EAAE,MAAM,IAAO,EAAC;CAC7E;CAED,IAAIC,SAAqC;AACvC,SAAO,KAAK,MAAM,CAAC,IAAI,QAAQ;CAChC;CAED,IAAIA,SAAiBC,OAAqB;AACxC,MAAI,MAAM,WAAW,EAAG,OAAM,IAAI,MAAM;EACxC,MAAM,UAAU,KAAK,MAAM;AAC3B,UAAQ,IAAI,SAAS,MAAM;AAC3B,OAAK,QAAQ,QAAQ;CACtB;CAED,OAAOD,SAAuB;EAC5B,MAAM,UAAU,KAAK,MAAM;AAC3B,MAAI,QAAQ,OAAO,QAAQ,CACzB,MAAK,QAAQ,QAAQ;CAExB;CAED,IAAIA,SAA0B;AAC5B,SAAO,KAAK,MAAM,CAAC,IAAI,QAAQ;CAChC;AACF;;;;;ACtID,IAAa,gBAAb,MAAuD;CAGrD,YAAYE,UAAkC,CAAE,GAAE;OAFjC,UAAU,IAAI;CAM9B;CAED,IAAIC,SAAqC;AACvC,SAAO,KAAK,QAAQ,IAAI,QAAQ;CACjC;CAED,IAAIA,SAAiBC,OAAqB;AACxC,MAAI,MAAM,WAAW,EAAG,OAAM,IAAI,MAAM;AACxC,OAAK,QAAQ,IAAI,SAAS,MAAM;CACjC;CAED,OAAOD,SAAuB;AAC5B,OAAK,QAAQ,OAAO,QAAQ;CAC7B;CAED,IAAIA,SAA0B;AAC5B,SAAO,KAAK,QAAQ,IAAI,QAAQ;CACjC;AACF;;;;;;;;;;;;;;;AC2BD,SAAgB,uBAAuBE,SAAiC,CAAE,GAAoB;AAC5F,KAAI;AACF,SAAO,IAAI,eAAe;CAC3B,QAAO,CAEP;AACD,KAAI;AACF,SAAO,IAAI,mBAAmB;CAC/B,QAAO,CAEP;AACD,QAAO,IAAI,cAAc;AAC1B"}

package/lib/signer.d.ts

@@ -0,0 +1,40 @@
+//#region src/signer.d.ts
+/**
+ * Huawei Cloud SDK-HMAC-SHA256 request signing.
+ *
+ * Signs an HTTP request with AK/SK (and an optional temporary SecurityToken)
+ * using the same algorithm as the official Huawei Cloud SDK. Produces the
+ * `Authorization`, `x-sdk-date`, and `x-security-token` headers to attach
+ * to a `fetch` call.
+ *
+ * @module @huaweidevtools/aishell-dsh-credentials-store/signer
+ */
+/** Credentials for signing. */
+interface SignCredentials {
+  readonly ak: string;
+  readonly sk: string;
+  readonly securityToken?: string;
+}
+/** The headers produced by {@link sign}. */
+interface SignedHeaders {
+  readonly host: string;
+  readonly 'x-sdk-date': string;
+  readonly Authorization: string;
+  readonly 'x-security-token'?: string;
+}
+/**
+ * Sign an HTTP request with SDK-HMAC-SHA256.
+ *
+ * @param method - HTTP method (GET, POST, ...).
+ * @param host - Host component of the request URL (e.g. `api.aishell.openbuildlab.com`).
+ * @param path - Path component of the request URL (e.g. `/chat/completions`).
+ * @param query - Query parameters as a key-value map.
+ * @param body - Request body (stringified for hashing; empty string for GET).
+ * @param credentials - AK/SK and optional SecurityToken.
+ * @returns The headers to attach to the fetch call.
+ */
+declare function sign(method: string, host: string, path: string, query: Record<string, string>, body: string, credentials: SignCredentials): SignedHeaders; //#endregion
+
+//# sourceMappingURL=signer.d.ts.map
+export { SignCredentials, SignedHeaders, sign };
+//# sourceMappingURL=signer.d.ts.map

package/lib/signer.js

@@ -0,0 +1,66 @@
+import crypto from "node:crypto";
+
+//#region src/signer.ts
+function sha256Hex(data) {
+	return crypto.createHash("sha256").update(data).digest("hex");
+}
+function hmacSha256(key, data) {
+	return crypto.createHmac("sha256", key).update(data).digest("hex");
+}
+/** RFC 3986 URL-encode a string (unreserved chars stay literal). */
+function urlEncode(str) {
+	const hex = (c) => "%" + (c < 16 ? "0" : "") + c.toString(16).toUpperCase();
+	const noEscape = new Set("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.~".split(""));
+	let out = "";
+	for (const ch of str) {
+		const c = ch.codePointAt(0);
+		if (c < 128) out += noEscape.has(ch) ? ch : hex(c);
+		else out += encodeURIComponent(ch);
+	}
+	return out;
+}
+/** ISO 8601 timestamp in Huawei Cloud format: `20260912T064552Z`. */
+function sdkTimestamp() {
+	return new Date().toISOString().replace(/[-:]/g, "").replace(/\.\d+/, "");
+}
+/**
+* Sign an HTTP request with SDK-HMAC-SHA256.
+*
+* @param method - HTTP method (GET, POST, ...).
+* @param host - Host component of the request URL (e.g. `api.aishell.openbuildlab.com`).
+* @param path - Path component of the request URL (e.g. `/chat/completions`).
+* @param query - Query parameters as a key-value map.
+* @param body - Request body (stringified for hashing; empty string for GET).
+* @param credentials - AK/SK and optional SecurityToken.
+* @returns The headers to attach to the fetch call.
+*/
+function sign(method, host, path, query, body, credentials) {
+	const ts = sdkTimestamp();
+	const cqs = Object.entries(query).sort(([a], [b]) => a.localeCompare(b)).map(([k, v]) => `${urlEncode(k)}=${urlEncode(v)}`).join("&");
+	const curi = "/" + path.split("/").filter(Boolean).map(urlEncode).join("/") + "/";
+	const hasToken = credentials.securityToken !== void 0;
+	const signedHeaders = hasToken ? "host;x-sdk-date;x-security-token" : "host;x-sdk-date";
+	const canonicalHeaders = hasToken ? `host:${host}\nx-sdk-date:${ts}\nx-security-token:${credentials.securityToken}\n` : `host:${host}\nx-sdk-date:${ts}\n`;
+	const payloadHash = sha256Hex(body);
+	const canonicalRequest = [
+		method,
+		curi,
+		cqs,
+		canonicalHeaders,
+		signedHeaders,
+		payloadHash
+	].join("\n");
+	const stringToSign = `SDK-HMAC-SHA256\n${ts}\n${sha256Hex(canonicalRequest)}`;
+	const signature = hmacSha256(credentials.sk, stringToSign);
+	const headers = {
+		host,
+		"x-sdk-date": ts,
+		Authorization: `SDK-HMAC-SHA256 Access=${credentials.ak}, SignedHeaders=${signedHeaders}, Signature=${signature}`,
+		...hasToken ? { "x-security-token": credentials.securityToken } : {}
+	};
+	return headers;
+}
+
+//#endregion
+export { sign };
+//# sourceMappingURL=signer.js.map

package/package.json

@@ -1,6 +1,42 @@
 {
   "name": "@huaweidevtools/aishell-dsh-credentials-store",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "description": "Credential storage + SDK-HMAC-SHA256 signing for aishell DSH plugins",
+  "version": "0.0.1-beta.0",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/yusheng-g/aishell-dsh-plugins.git",
+    "directory": "packages/credentials-store"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./signer": {
+      "types": "./lib/signer.d.ts",
+      "default": "./lib/signer.js"
+    }
+  },
+  "files": [
+    "lib/index.js",
+    "lib/signer.js",
+    "lib/index.d.ts",
+    "lib/signer.d.ts",
+    "lib/index.js.map",
+    "lib/index.d.ts.map"
+  ],
+  "license": "Apache-2.0",
+  "dependencies": {
+    "@napi-rs/keyring": "^2.0.0",
+    "node-machine-id": "^1.1.12"
+  },
+  "scripts": {
+    "build:bundle": "tsdown"
+  }
 }