@huaweidevtools/aishell-dsh-credentials-store 0.0.1-beta.2 → 0.0.1-beta.3

package/lib/types/verify.js

@@ -0,0 +1,240 @@
+/**
+ * Huawei Cloud IAM credential verification — one implementation, shared.
+ *
+ * ## Why it moved here
+ *
+ * Two packages verified credentials independently: `aishell-credentials`' Host
+ * route, with `GET /v3/auth/domains` (it only wanted the account name), and
+ * the copied ops tool `auth`, with `GET /v3/projects` (it also wanted the
+ * account id and the project list). Same question — "are these credentials
+ * valid?" — two endpoints, two error-message vocabularies, two chances to
+ * disagree about what a 403 means.
+ *
+ * This module is the one answer. It is storage-adjacent rather than
+ * credential-form-specific, so it lives with the store and the signer, and
+ * every caller gets the same verdict in the same shape.
+ *
+ * ## Why `/v3/projects` is the endpoint
+ *
+ * It is a superset of the domains call:
+ *
+ *   - A 200 proves the AK/SK (and STS token) work, signed exactly the way every
+ *     other call is.
+ *   - Each project carries `domain_id`, which **is** the account id (Huawei
+ *     Cloud's "domain" and "account" are the same object).
+ *   - Each project's `name` is a region name, so a caller that needs a
+ *     `project_id` for a region-scoped API has it without a second request.
+ *
+ * The account *name* is the one thing projects does not carry, so it is read
+ * from `/v3/auth/domains` **best-effort** — some AK/SK scopes do not grant it,
+ * and a missing name is diagnostic-only. A failure there never fails
+ * verification.
+ *
+ * ## Region semantics, which surprise people
+ *
+ * IAM is a global service. The region in the URL only routes to a regional
+ * replica; it does not scope the result. So a wrong region still answers 200
+ * with the same account, and the real mismatch surfaces at the first
+ * region-scoped call. Verification therefore validates the credentials and
+ * **not** the region — conflating them would report "invalid credentials" for
+ * a typo'd region, sending the person to check the wrong thing.
+ *
+ * ## Result shape
+ *
+ * A discriminated union rather than a throw: a rejected credential is an
+ * expected outcome of asking someone for credentials, not an exception. The
+ * caller decides whether to show, log or retry it.
+ *
+ * @module @huaweidevtools/aishell-dsh-credentials-store/verify
+ */
+import { sign } from "./signer.js";
+/** Default per-request timeout; IAM answers in well under a second when healthy. */
+const DEFAULT_TIMEOUT_MS = 15_000;
+/** IAM hostname for a region (regional replica of a global service). */
+function iamUrl(region) {
+    const host = /^\d+\.\d+\.\d+\.\d+$/.test(region) || region === 'global'
+        ? 'iam.myhuaweicloud.com'
+        : `iam.${region}.myhuaweicloud.com`;
+    return `https://${host}`;
+}
+/**
+ * Sign and GET one IAM path, returning the status and body.
+ *
+ * @param base - IAM origin.
+ * @param path - the request path.
+ * @param credentials - the pair to sign with.
+ * @param options - fetch implementation and timeout.
+ */
+async function signedGet(base, path, credentials, options) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const url = new URL(`${base}${path}`);
+    const headers = sign('GET', url.host, url.pathname, {}, '', credentials);
+    const signal = AbortSignal.timeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+    const response = await fetchImpl(url, {
+        method: 'GET',
+        headers: {
+            host: headers.host,
+            'x-sdk-date': headers['x-sdk-date'],
+            Authorization: headers.Authorization,
+            ...(headers['x-security-token'] === undefined
+                ? {}
+                : { 'x-security-token': headers['x-security-token'] }),
+        },
+        signal,
+    });
+    return { status: response.status, body: await response.text() };
+}
+/**
+ * Verify a credential pair against Huawei Cloud IAM.
+ *
+ * The pair is signed exactly as every other request is, so a 200 proves the
+ * same thing a successful tool call would prove — no separate verification
+ * scheme that could drift from the one that actually runs.
+ *
+ * @param credentials - the AK/SK (and optional STS token) to verify.
+ * @param options - region and transport details.
+ * @returns the account on success, or a failure naming what IAM said.
+ */
+export async function verifyCredentials(credentials, options) {
+    const base = iamUrl(options.region);
+    let status;
+    let body;
+    try {
+        ({ status, body } = await signedGet(base, '/v3/projects', credentials, options));
+    }
+    catch (error) {
+        return {
+            ok: false,
+            status: 0,
+            message: `Could not reach Huawei Cloud IAM: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+    if (status !== 200) {
+        return { ok: false, status, message: describeIamFailure(status, body) };
+    }
+    const parsedProjects = parseProjects(body);
+    if (parsedProjects === undefined) {
+        return { ok: false, status, message: 'Huawei Cloud IAM answered with a body that is not JSON.' };
+    }
+    const first = parsedProjects[0];
+    if (first === undefined) {
+        // Authenticated but sees no projects. IAM is global, so this is not a
+        // region problem: the AK/SK lacks IAM read scope, or belongs to a
+        // sub-account whose parent has not granted project membership. Terraform
+        // needs a project, so this is a failure rather than an empty success.
+        return {
+            ok: false,
+            status,
+            message: 'The credentials are valid but no project is visible to them. Confirm the AK/SK may '
+                + 'read IAM, or ask the main account to grant project membership. '
+                + '(This is unrelated to the region — IAM is a global service.)',
+        };
+    }
+    const accountId = first.domainId;
+    if (accountId === undefined) {
+        return { ok: false, status, message: 'Huawei Cloud IAM returned no domain_id, so the account is unknown.' };
+    }
+    const name = await readAccountName(base, accountId, credentials, options) ?? accountId;
+    return {
+        ok: true,
+        account: { accountId, name, projects: parsedProjects },
+        region: options.region,
+        sts: credentials.securityToken !== undefined,
+    };
+}
+/**
+ * Parse `/v3/projects` into the project list.
+ *
+ * @returns the projects (possibly empty), or `undefined` when the body is not
+ *   JSON at all — a different failure from "valid JSON, no projects".
+ */
+function parseProjects(body) {
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return undefined;
+    }
+    const raw = parsed?.projects;
+    if (!Array.isArray(raw))
+        return [];
+    const projects = [];
+    for (const entry of raw) {
+        const project = entry;
+        if (project === null || typeof project !== 'object')
+            continue;
+        if (typeof project.id !== 'string' || project.id === '')
+            continue;
+        projects.push({
+            id: project.id,
+            name: typeof project.name === 'string' ? project.name : '',
+            ...(typeof project.description === 'string' && project.description !== ''
+                ? { description: project.description }
+                : {}),
+            // Kept beside the public fields because the caller derives the account id
+            // from it without a second pass over the raw body.
+            ...(typeof project.domain_id === 'string' && project.domain_id !== ''
+                ? { domainId: project.domain_id }
+                : {}),
+        });
+    }
+    return projects;
+}
+/**
+ * Read the account (domain) name, best-effort.
+ *
+ * @returns the name, or `undefined` — never an error. Some AK/SK scopes do not
+ *   grant `/v3/auth/domains`, and the account name is diagnostic only.
+ */
+async function readAccountName(base, accountId, credentials, options) {
+    let status;
+    let body;
+    try {
+        ({ status, body } = await signedGet(base, '/v3/auth/domains', credentials, options));
+    }
+    catch {
+        return undefined;
+    }
+    if (status !== 200)
+        return undefined;
+    try {
+        const parsed = JSON.parse(body);
+        const match = parsed.domains?.find(domain => domain.id === accountId);
+        return typeof match?.name === 'string' && match.name !== '' ? match.name : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Render an IAM rejection into one actionable sentence.
+ *
+ * @param status - the HTTP status.
+ * @param body - the response body, which may carry Huawei's own error text.
+ */
+function describeIamFailure(status, body) {
+    try {
+        const parsed = JSON.parse(body);
+        const detail = typeof parsed.error_msg === 'string'
+            ? parsed.error_msg
+            : typeof parsed.message === 'string' ? parsed.message : undefined;
+        if (detail !== undefined) {
+            const code = typeof parsed.error_code === 'string' ? `, ${parsed.error_code}` : '';
+            return `Huawei Cloud rejected the credentials (HTTP ${status}${code}): ${detail}`;
+        }
+    }
+    catch {
+        // Non-JSON body — an ingress page or a proxy error; nothing to read.
+    }
+    if (status === 401) {
+        return 'Huawei Cloud rejected the credentials (HTTP 401): the Access Key, Secret Key, '
+            + 'or Security Token was refused.';
+    }
+    if (status === 403) {
+        return 'The credentials are valid but may not read IAM (HTTP 403). '
+            + 'Confirm the Access Key has IAM read permission.';
+    }
+    return `Huawei Cloud IAM failed with HTTP ${status}: ${body.slice(0, 200)}`;
+}
+//# sourceMappingURL=verify.js.map

package/lib/types/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAAE,IAAI,EAAwB,MAAM,aAAa,CAAA;AA2DxD,oFAAoF;AACpF,MAAM,kBAAkB,GAAG,MAAM,CAAA;AAEjC,wEAAwE;AACxE,SAAS,MAAM,CAAC,MAAc;IAC5B,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,KAAK,QAAQ;QACrE,CAAC,CAAC,uBAAuB;QACzB,CAAC,CAAC,OAAO,MAAM,oBAAoB,CAAA;IACrC,OAAO,WAAW,IAAI,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,SAAS,CACtB,IAAY,EACZ,IAAY,EACZ,WAA4B,EAC5B,OAAsB;IAEtB,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAA;IAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAA;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,CAAA;IACxE,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAA;IAC3E,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QACpC,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACP,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC;YACnC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,SAAS;gBAC3C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC;SACzD;QACD,MAAM;KACP,CAAC,CAAA;IACF,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAA;AACjE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,WAA4B,EAC5B,OAAsB;IAEtB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAEnC,IAAI,MAAc,CAAA;IAClB,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAA;IAClF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,qCAAqC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SACvG,CAAA;IACH,CAAC;IAED,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAA;IACzE,CAAC;IAED,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAC1C,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,yDAAyD,EAAE,CAAA;IAClG,CAAC;IAED,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;IAC/B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,sEAAsE;QACtE,kEAAkE;QAClE,yEAAyE;QACzE,sEAAsE;QACtE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM;YACN,OAAO,EACL,qFAAqF;kBACnF,iEAAiE;kBACjE,8DAA8D;SACnE,CAAA;IACH,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAA;IAChC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,oEAAoE,EAAE,CAAA;IAC7G,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,SAAS,CAAA;IAEtF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE;QACtD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,EAAE,WAAW,CAAC,aAAa,KAAK,SAAS;KAC7C,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,GAAG,GAAI,MAAwC,EAAE,QAAQ,CAAA;IAC/D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAA;IAElC,MAAM,QAAQ,GAA4D,EAAE,CAAA;IAC5E,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,KAAuC,CAAA;QACvD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,SAAQ;QAC7D,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,EAAE,KAAK,EAAE;YAAE,SAAQ;QACjE,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,IAAI,EAAE,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;YAC1D,GAAG,CAAC,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,CAAC,WAAW,KAAK,EAAE;gBACvE,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE;gBACtC,CAAC,CAAC,EAAE,CAAC;YACP,0EAA0E;YAC1E,mDAAmD;YACnD,GAAG,CAAC,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,KAAK,EAAE;gBACnE,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE;gBACjC,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAC5B,IAAY,EACZ,SAAiB,EACjB,WAA4B,EAC5B,OAAsB;IAEtB,IAAI,MAAc,CAAA;IAClB,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,kBAAkB,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAA;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,SAAS,CAAA;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA0D,CAAA;QACxF,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,SAAS,CAAC,CAAA;QACrE,OAAO,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,MAAc,EAAE,IAAY;IACtD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqE,CAAA;QACnG,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;YACjD,CAAC,CAAC,MAAM,CAAC,SAAS;YAClB,CAAC,CAAC,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;QACnE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;YAClF,OAAO,+CAA+C,MAAM,GAAG,IAAI,MAAM,MAAM,EAAE,CAAA;QACnF,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;IACvE,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,gFAAgF;cACnF,gCAAgC,CAAA;IACtC,CAAC;IACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QACnB,OAAO,6DAA6D;cAChE,iDAAiD,CAAA;IACvD,CAAC;IACD,OAAO,qCAAqC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAA;AAC7E,CAAC"}

package/lib/verify.d.ts

@@ -0,0 +1,72 @@
+import { SignCredentials } from "./signer-Et0DIH6o.js";
+
+//#region src/verify.d.ts
+/** One project visible to the credentials; its `name` is a region name. */
+
+/** One project visible to the credentials; its `name` is a region name. */
+interface VerifiedProject {
+  /** The `project_id` a region-scoped API takes. */
+  readonly id: string;
+  /** The project name — the region name, e.g. `cn-north-4`. */
+  readonly name: string;
+  readonly description?: string;
+}
+/** The account the credentials belong to. */
+interface VerifiedAccount {
+  /** The account id, equal to IAM's `domain_id`. */
+  readonly accountId: string;
+  /** The account (domain) name; falls back to {@link accountId} when unreadable. */
+  readonly name: string;
+  /**
+   * Every project visible to these credentials.
+   *
+   * More than one project may share a region name (enterprise projects), which
+   * is why this is not reduced to a region→project map: picking one would be a
+   * deployment decision this module has no basis for.
+   */
+  readonly projects: readonly VerifiedProject[];
+}
+/** A successful verification. */
+interface VerifyOk {
+  readonly ok: true;
+  readonly account: VerifiedAccount;
+  /** The region the call was routed through; see the module note — not verified. */
+  readonly region: string;
+  /** Whether the credentials were temporary (STS). */
+  readonly sts: boolean;
+}
+/** A failed verification. */
+interface VerifyFailed {
+  readonly ok: false;
+  /** HTTP status from IAM, or `0` for a network/signing failure. */
+  readonly status: number;
+  /** A sentence the person or model can act on. */
+  readonly message: string;
+}
+/** The outcome of one verification. */
+type VerifyResult = VerifyOk | VerifyFailed;
+/** Options for {@link verifyCredentials}. */
+interface VerifyOptions {
+  /** Region used to route the call. Does not scope the result; see the module note. */
+  readonly region: string;
+  /** Fetch implementation; defaults to the global. Injected so tests need no network. */
+  readonly fetchImpl?: typeof fetch;
+  /** Per-request timeout in milliseconds; defaults to 15 s. */
+  readonly timeoutMs?: number;
+}
+/**
+ * Verify a credential pair against Huawei Cloud IAM.
+ *
+ * The pair is signed exactly as every other request is, so a 200 proves the
+ * same thing a successful tool call would prove — no separate verification
+ * scheme that could drift from the one that actually runs.
+ *
+ * @param credentials - the AK/SK (and optional STS token) to verify.
+ * @param options - region and transport details.
+ * @returns the account on success, or a failure naming what IAM said.
+ */
+declare function verifyCredentials(credentials: SignCredentials, options: VerifyOptions): Promise<VerifyResult>; //#endregion
+
+//# sourceMappingURL=verify.d.ts.map
+export { VerifiedAccount, VerifiedProject, VerifyFailed, VerifyOk, VerifyOptions, VerifyResult, verifyCredentials };
+//# sourceMappingURL=verify.d.ts.map

package/lib/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","names":[],"sources":["../../src/verify.ts"],"sourcesContent":null,"mappings":";;;;;;UAqDiB,eAAA;;;;;;;;UASA,eAAA;;;;;;;;;;;;8BAYa;;;UAIb,QAAA;;oBAEG;;;;;;;UAQH,YAAA;;;;;;;;KASL,YAAA,GAAe,WAAW;;UAGrB,aAAA;;;;8BAIa;;;;;;;;;;;;;;;iBA4DR,iBAAA,cACP,0BACJ,gBACR,QAAQ"}

package/lib/verify.js

@@ -0,0 +1,172 @@
+import { sign } from "./signer-BPR0UAF0.js";
+
+//#region src/verify.ts
+/** Default per-request timeout; IAM answers in well under a second when healthy. */
+const DEFAULT_TIMEOUT_MS = 15e3;
+/** IAM hostname for a region (regional replica of a global service). */
+function iamUrl(region) {
+	const host = /^\d+\.\d+\.\d+\.\d+$/.test(region) || region === "global" ? "iam.myhuaweicloud.com" : `iam.${region}.myhuaweicloud.com`;
+	return `https://${host}`;
+}
+/**
+* Sign and GET one IAM path, returning the status and body.
+*
+* @param base - IAM origin.
+* @param path - the request path.
+* @param credentials - the pair to sign with.
+* @param options - fetch implementation and timeout.
+*/
+async function signedGet(base, path, credentials, options) {
+	const fetchImpl = options.fetchImpl ?? fetch;
+	const url = new URL(`${base}${path}`);
+	const headers = sign("GET", url.host, url.pathname, {}, "", credentials);
+	const signal = AbortSignal.timeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+	const response = await fetchImpl(url, {
+		method: "GET",
+		headers: {
+			host: headers.host,
+			"x-sdk-date": headers["x-sdk-date"],
+			Authorization: headers.Authorization,
+			...headers["x-security-token"] === void 0 ? {} : { "x-security-token": headers["x-security-token"] }
+		},
+		signal
+	});
+	return {
+		status: response.status,
+		body: await response.text()
+	};
+}
+/**
+* Verify a credential pair against Huawei Cloud IAM.
+*
+* The pair is signed exactly as every other request is, so a 200 proves the
+* same thing a successful tool call would prove — no separate verification
+* scheme that could drift from the one that actually runs.
+*
+* @param credentials - the AK/SK (and optional STS token) to verify.
+* @param options - region and transport details.
+* @returns the account on success, or a failure naming what IAM said.
+*/
+async function verifyCredentials(credentials, options) {
+	const base = iamUrl(options.region);
+	let status;
+	let body;
+	try {
+		({status, body} = await signedGet(base, "/v3/projects", credentials, options));
+	} catch (error) {
+		return {
+			ok: false,
+			status: 0,
+			message: `Could not reach Huawei Cloud IAM: ${error instanceof Error ? error.message : String(error)}`
+		};
+	}
+	if (status !== 200) return {
+		ok: false,
+		status,
+		message: describeIamFailure(status, body)
+	};
+	const parsedProjects = parseProjects(body);
+	if (parsedProjects === void 0) return {
+		ok: false,
+		status,
+		message: "Huawei Cloud IAM answered with a body that is not JSON."
+	};
+	const first = parsedProjects[0];
+	if (first === void 0) return {
+		ok: false,
+		status,
+		message: "The credentials are valid but no project is visible to them. Confirm the AK/SK may read IAM, or ask the main account to grant project membership. (This is unrelated to the region — IAM is a global service.)"
+	};
+	const accountId = first.domainId;
+	if (accountId === void 0) return {
+		ok: false,
+		status,
+		message: "Huawei Cloud IAM returned no domain_id, so the account is unknown."
+	};
+	const name = await readAccountName(base, accountId, credentials, options) ?? accountId;
+	return {
+		ok: true,
+		account: {
+			accountId,
+			name,
+			projects: parsedProjects
+		},
+		region: options.region,
+		sts: credentials.securityToken !== void 0
+	};
+}
+/**
+* Parse `/v3/projects` into the project list.
+*
+* @returns the projects (possibly empty), or `undefined` when the body is not
+*   JSON at all — a different failure from "valid JSON, no projects".
+*/
+function parseProjects(body) {
+	let parsed;
+	try {
+		parsed = JSON.parse(body);
+	} catch {
+		return void 0;
+	}
+	const raw = parsed?.projects;
+	if (!Array.isArray(raw)) return [];
+	const projects = [];
+	for (const entry of raw) {
+		const project = entry;
+		if (project === null || typeof project !== "object") continue;
+		if (typeof project.id !== "string" || project.id === "") continue;
+		projects.push({
+			id: project.id,
+			name: typeof project.name === "string" ? project.name : "",
+			...typeof project.description === "string" && project.description !== "" ? { description: project.description } : {},
+			...typeof project.domain_id === "string" && project.domain_id !== "" ? { domainId: project.domain_id } : {}
+		});
+	}
+	return projects;
+}
+/**
+* Read the account (domain) name, best-effort.
+*
+* @returns the name, or `undefined` — never an error. Some AK/SK scopes do not
+*   grant `/v3/auth/domains`, and the account name is diagnostic only.
+*/
+async function readAccountName(base, accountId, credentials, options) {
+	let status;
+	let body;
+	try {
+		({status, body} = await signedGet(base, "/v3/auth/domains", credentials, options));
+	} catch {
+		return void 0;
+	}
+	if (status !== 200) return void 0;
+	try {
+		const parsed = JSON.parse(body);
+		const match = parsed.domains?.find((domain) => domain.id === accountId);
+		return typeof match?.name === "string" && match.name !== "" ? match.name : void 0;
+	} catch {
+		return void 0;
+	}
+}
+/**
+* Render an IAM rejection into one actionable sentence.
+*
+* @param status - the HTTP status.
+* @param body - the response body, which may carry Huawei's own error text.
+*/
+function describeIamFailure(status, body) {
+	try {
+		const parsed = JSON.parse(body);
+		const detail = typeof parsed.error_msg === "string" ? parsed.error_msg : typeof parsed.message === "string" ? parsed.message : void 0;
+		if (detail !== void 0) {
+			const code = typeof parsed.error_code === "string" ? `, ${parsed.error_code}` : "";
+			return `Huawei Cloud rejected the credentials (HTTP ${status}${code}): ${detail}`;
+		}
+	} catch {}
+	if (status === 401) return "Huawei Cloud rejected the credentials (HTTP 401): the Access Key, Secret Key, or Security Token was refused.";
+	if (status === 403) return "The credentials are valid but may not read IAM (HTTP 403). Confirm the Access Key has IAM read permission.";
+	return `Huawei Cloud IAM failed with HTTP ${status}: ${body.slice(0, 200)}`;
+}
+
+//#endregion
+export { verifyCredentials };
+//# sourceMappingURL=verify.js.map

package/lib/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","names":["region: string","base: string","path: string","credentials: SignCredentials","options: VerifyOptions","status: number","body: string","parsed: unknown","projects: Array<VerifiedProject & { readonly domainId?: string }>","accountId: string"],"sources":["../src/verify.ts"],"sourcesContent":["/**\n * Huawei Cloud IAM credential verification — one implementation, shared.\n *\n * ## Why it moved here\n *\n * Two packages verified credentials independently: `aishell-credentials`' Host\n * route, with `GET /v3/auth/domains` (it only wanted the account name), and\n * the copied ops tool `auth`, with `GET /v3/projects` (it also wanted the\n * account id and the project list). Same question — \"are these credentials\n * valid?\" — two endpoints, two error-message vocabularies, two chances to\n * disagree about what a 403 means.\n *\n * This module is the one answer. It is storage-adjacent rather than\n * credential-form-specific, so it lives with the store and the signer, and\n * every caller gets the same verdict in the same shape.\n *\n * ## Why `/v3/projects` is the endpoint\n *\n * It is a superset of the domains call:\n *\n *   - A 200 proves the AK/SK (and STS token) work, signed exactly the way every\n *     other call is.\n *   - Each project carries `domain_id`, which **is** the account id (Huawei\n *     Cloud's \"domain\" and \"account\" are the same object).\n *   - Each project's `name` is a region name, so a caller that needs a\n *     `project_id` for a region-scoped API has it without a second request.\n *\n * The account *name* is the one thing projects does not carry, so it is read\n * from `/v3/auth/domains` **best-effort** — some AK/SK scopes do not grant it,\n * and a missing name is diagnostic-only. A failure there never fails\n * verification.\n *\n * ## Region semantics, which surprise people\n *\n * IAM is a global service. The region in the URL only routes to a regional\n * replica; it does not scope the result. So a wrong region still answers 200\n * with the same account, and the real mismatch surfaces at the first\n * region-scoped call. Verification therefore validates the credentials and\n * **not** the region — conflating them would report \"invalid credentials\" for\n * a typo'd region, sending the person to check the wrong thing.\n *\n * ## Result shape\n *\n * A discriminated union rather than a throw: a rejected credential is an\n * expected outcome of asking someone for credentials, not an exception. The\n * caller decides whether to show, log or retry it.\n *\n * @module @huaweidevtools/aishell-dsh-credentials-store/verify\n */\n\nimport { sign, type SignCredentials } from './signer.ts'\n\n/** One project visible to the credentials; its `name` is a region name. */\nexport interface VerifiedProject {\n  /** The `project_id` a region-scoped API takes. */\n  readonly id: string\n  /** The project name — the region name, e.g. `cn-north-4`. */\n  readonly name: string\n  readonly description?: string\n}\n\n/** The account the credentials belong to. */\nexport interface VerifiedAccount {\n  /** The account id, equal to IAM's `domain_id`. */\n  readonly accountId: string\n  /** The account (domain) name; falls back to {@link accountId} when unreadable. */\n  readonly name: string\n  /**\n   * Every project visible to these credentials.\n   *\n   * More than one project may share a region name (enterprise projects), which\n   * is why this is not reduced to a region→project map: picking one would be a\n   * deployment decision this module has no basis for.\n   */\n  readonly projects: readonly VerifiedProject[]\n}\n\n/** A successful verification. */\nexport interface VerifyOk {\n  readonly ok: true\n  readonly account: VerifiedAccount\n  /** The region the call was routed through; see the module note — not verified. */\n  readonly region: string\n  /** Whether the credentials were temporary (STS). */\n  readonly sts: boolean\n}\n\n/** A failed verification. */\nexport interface VerifyFailed {\n  readonly ok: false\n  /** HTTP status from IAM, or `0` for a network/signing failure. */\n  readonly status: number\n  /** A sentence the person or model can act on. */\n  readonly message: string\n}\n\n/** The outcome of one verification. */\nexport type VerifyResult = VerifyOk | VerifyFailed\n\n/** Options for {@link verifyCredentials}. */\nexport interface VerifyOptions {\n  /** Region used to route the call. Does not scope the result; see the module note. */\n  readonly region: string\n  /** Fetch implementation; defaults to the global. Injected so tests need no network. */\n  readonly fetchImpl?: typeof fetch\n  /** Per-request timeout in milliseconds; defaults to 15 s. */\n  readonly timeoutMs?: number\n}\n\n/** Default per-request timeout; IAM answers in well under a second when healthy. */\nconst DEFAULT_TIMEOUT_MS = 15_000\n\n/** IAM hostname for a region (regional replica of a global service). */\nfunction iamUrl(region: string): string {\n  const host = /^\\d+\\.\\d+\\.\\d+\\.\\d+$/.test(region) || region === 'global'\n    ? 'iam.myhuaweicloud.com'\n    : `iam.${region}.myhuaweicloud.com`\n  return `https://${host}`\n}\n\n/**\n * Sign and GET one IAM path, returning the status and body.\n *\n * @param base - IAM origin.\n * @param path - the request path.\n * @param credentials - the pair to sign with.\n * @param options - fetch implementation and timeout.\n */\nasync function signedGet(\n  base: string,\n  path: string,\n  credentials: SignCredentials,\n  options: VerifyOptions,\n): Promise<{ status: number, body: string }> {\n  const fetchImpl = options.fetchImpl ?? fetch\n  const url = new URL(`${base}${path}`)\n  const headers = sign('GET', url.host, url.pathname, {}, '', credentials)\n  const signal = AbortSignal.timeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS)\n  const response = await fetchImpl(url, {\n    method: 'GET',\n    headers: {\n      host: headers.host,\n      'x-sdk-date': headers['x-sdk-date'],\n      Authorization: headers.Authorization,\n      ...(headers['x-security-token'] === undefined\n        ? {}\n        : { 'x-security-token': headers['x-security-token'] }),\n    },\n    signal,\n  })\n  return { status: response.status, body: await response.text() }\n}\n\n/**\n * Verify a credential pair against Huawei Cloud IAM.\n *\n * The pair is signed exactly as every other request is, so a 200 proves the\n * same thing a successful tool call would prove — no separate verification\n * scheme that could drift from the one that actually runs.\n *\n * @param credentials - the AK/SK (and optional STS token) to verify.\n * @param options - region and transport details.\n * @returns the account on success, or a failure naming what IAM said.\n */\nexport async function verifyCredentials(\n  credentials: SignCredentials,\n  options: VerifyOptions,\n): Promise<VerifyResult> {\n  const base = iamUrl(options.region)\n\n  let status: number\n  let body: string\n  try {\n    ({ status, body } = await signedGet(base, '/v3/projects', credentials, options))\n  } catch (error) {\n    return {\n      ok: false,\n      status: 0,\n      message: `Could not reach Huawei Cloud IAM: ${error instanceof Error ? error.message : String(error)}`,\n    }\n  }\n\n  if (status !== 200) {\n    return { ok: false, status, message: describeIamFailure(status, body) }\n  }\n\n  const parsedProjects = parseProjects(body)\n  if (parsedProjects === undefined) {\n    return { ok: false, status, message: 'Huawei Cloud IAM answered with a body that is not JSON.' }\n  }\n\n  const first = parsedProjects[0]\n  if (first === undefined) {\n    // Authenticated but sees no projects. IAM is global, so this is not a\n    // region problem: the AK/SK lacks IAM read scope, or belongs to a\n    // sub-account whose parent has not granted project membership. Terraform\n    // needs a project, so this is a failure rather than an empty success.\n    return {\n      ok: false,\n      status,\n      message:\n        'The credentials are valid but no project is visible to them. Confirm the AK/SK may '\n        + 'read IAM, or ask the main account to grant project membership. '\n        + '(This is unrelated to the region — IAM is a global service.)',\n    }\n  }\n\n  const accountId = first.domainId\n  if (accountId === undefined) {\n    return { ok: false, status, message: 'Huawei Cloud IAM returned no domain_id, so the account is unknown.' }\n  }\n\n  const name = await readAccountName(base, accountId, credentials, options) ?? accountId\n\n  return {\n    ok: true,\n    account: { accountId, name, projects: parsedProjects },\n    region: options.region,\n    sts: credentials.securityToken !== undefined,\n  }\n}\n\n/**\n * Parse `/v3/projects` into the project list.\n *\n * @returns the projects (possibly empty), or `undefined` when the body is not\n *   JSON at all — a different failure from \"valid JSON, no projects\".\n */\nfunction parseProjects(body: string): Array<VerifiedProject & { readonly domainId?: string }> | undefined {\n  let parsed: unknown\n  try {\n    parsed = JSON.parse(body)\n  } catch {\n    return undefined\n  }\n  const raw = (parsed as { projects?: unknown } | null)?.projects\n  if (!Array.isArray(raw)) return []\n\n  const projects: Array<VerifiedProject & { readonly domainId?: string }> = []\n  for (const entry of raw) {\n    const project = entry as Record<string, unknown> | null\n    if (project === null || typeof project !== 'object') continue\n    if (typeof project.id !== 'string' || project.id === '') continue\n    projects.push({\n      id: project.id,\n      name: typeof project.name === 'string' ? project.name : '',\n      ...(typeof project.description === 'string' && project.description !== ''\n        ? { description: project.description }\n        : {}),\n      // Kept beside the public fields because the caller derives the account id\n      // from it without a second pass over the raw body.\n      ...(typeof project.domain_id === 'string' && project.domain_id !== ''\n        ? { domainId: project.domain_id }\n        : {}),\n    })\n  }\n  return projects\n}\n\n/**\n * Read the account (domain) name, best-effort.\n *\n * @returns the name, or `undefined` — never an error. Some AK/SK scopes do not\n *   grant `/v3/auth/domains`, and the account name is diagnostic only.\n */\nasync function readAccountName(\n  base: string,\n  accountId: string,\n  credentials: SignCredentials,\n  options: VerifyOptions,\n): Promise<string | undefined> {\n  let status: number\n  let body: string\n  try {\n    ({ status, body } = await signedGet(base, '/v3/auth/domains', credentials, options))\n  } catch {\n    return undefined\n  }\n  if (status !== 200) return undefined\n  try {\n    const parsed = JSON.parse(body) as { domains?: Array<{ id?: unknown, name?: unknown }> }\n    const match = parsed.domains?.find(domain => domain.id === accountId)\n    return typeof match?.name === 'string' && match.name !== '' ? match.name : undefined\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * Render an IAM rejection into one actionable sentence.\n *\n * @param status - the HTTP status.\n * @param body - the response body, which may carry Huawei's own error text.\n */\nfunction describeIamFailure(status: number, body: string): string {\n  try {\n    const parsed = JSON.parse(body) as { error_msg?: unknown, error_code?: unknown, message?: unknown }\n    const detail = typeof parsed.error_msg === 'string'\n      ? parsed.error_msg\n      : typeof parsed.message === 'string' ? parsed.message : undefined\n    if (detail !== undefined) {\n      const code = typeof parsed.error_code === 'string' ? `, ${parsed.error_code}` : ''\n      return `Huawei Cloud rejected the credentials (HTTP ${status}${code}): ${detail}`\n    }\n  } catch {\n    // Non-JSON body — an ingress page or a proxy error; nothing to read.\n  }\n  if (status === 401) {\n    return 'Huawei Cloud rejected the credentials (HTTP 401): the Access Key, Secret Key, '\n      + 'or Security Token was refused.'\n  }\n  if (status === 403) {\n    return 'The credentials are valid but may not read IAM (HTTP 403). '\n      + 'Confirm the Access Key has IAM read permission.'\n  }\n  return `Huawei Cloud IAM failed with HTTP ${status}: ${body.slice(0, 200)}`\n}"],"mappings":";;;;AA8GA,MAAM,qBAAqB;;AAG3B,SAAS,OAAOA,QAAwB;CACtC,MAAM,OAAO,uBAAuB,KAAK,OAAO,IAAI,WAAW,WAC3D,2BACC,MAAM,OAAO;AAClB,SAAQ,UAAU,KAAK;AACxB;;;;;;;;;AAUD,eAAe,UACbC,MACAC,MACAC,aACAC,SAC2C;CAC3C,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,MAAM,IAAI,KAAK,EAAE,KAAK,EAAE,KAAK;CACnC,MAAM,UAAU,KAAK,OAAO,IAAI,MAAM,IAAI,UAAU,CAAE,GAAE,IAAI,YAAY;CACxE,MAAM,SAAS,YAAY,QAAQ,QAAQ,aAAa,mBAAmB;CAC3E,MAAM,WAAW,MAAM,UAAU,KAAK;EACpC,QAAQ;EACR,SAAS;GACP,MAAM,QAAQ;GACd,cAAc,QAAQ;GACtB,eAAe,QAAQ;GACvB,GAAI,QAAQ,iCACR,CAAE,IACF,EAAE,oBAAoB,QAAQ,oBAAqB;EACxD;EACD;CACD,EAAC;AACF,QAAO;EAAE,QAAQ,SAAS;EAAQ,MAAM,MAAM,SAAS,MAAM;CAAE;AAChE;;;;;;;;;;;;AAaD,eAAsB,kBACpBD,aACAC,SACuB;CACvB,MAAM,OAAO,OAAO,QAAQ,OAAO;CAEnC,IAAIC;CACJ,IAAIC;AACJ,KAAI;AACF,GAAC,CAAE,QAAQ,KAAM,GAAG,MAAM,UAAU,MAAM,gBAAgB,aAAa,QAAQ;CAChF,SAAQ,OAAO;AACd,SAAO;GACL,IAAI;GACJ,QAAQ;GACR,UAAU,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CAAC;EACtG;CACF;AAED,KAAI,WAAW,IACb,QAAO;EAAE,IAAI;EAAO;EAAQ,SAAS,mBAAmB,QAAQ,KAAK;CAAE;CAGzE,MAAM,iBAAiB,cAAc,KAAK;AAC1C,KAAI,0BACF,QAAO;EAAE,IAAI;EAAO;EAAQ,SAAS;CAA2D;CAGlG,MAAM,QAAQ,eAAe;AAC7B,KAAI,iBAKF,QAAO;EACL,IAAI;EACJ;EACA,SACE;CAGH;CAGH,MAAM,YAAY,MAAM;AACxB,KAAI,qBACF,QAAO;EAAE,IAAI;EAAO;EAAQ,SAAS;CAAsE;CAG7G,MAAM,OAAO,MAAM,gBAAgB,MAAM,WAAW,aAAa,QAAQ,IAAI;AAE7E,QAAO;EACL,IAAI;EACJ,SAAS;GAAE;GAAW;GAAM,UAAU;EAAgB;EACtD,QAAQ,QAAQ;EAChB,KAAK,YAAY;CAClB;AACF;;;;;;;AAQD,SAAS,cAAcA,MAAmF;CACxG,IAAIC;AACJ,KAAI;AACF,WAAS,KAAK,MAAM,KAAK;CAC1B,QAAO;AACN;CACD;CACD,MAAM,MAAO,QAA0C;AACvD,MAAK,MAAM,QAAQ,IAAI,CAAE,QAAO,CAAE;CAElC,MAAMC,WAAoE,CAAE;AAC5E,MAAK,MAAM,SAAS,KAAK;EACvB,MAAM,UAAU;AAChB,MAAI,YAAY,eAAe,YAAY,SAAU;AACrD,aAAW,QAAQ,OAAO,YAAY,QAAQ,OAAO,GAAI;AACzD,WAAS,KAAK;GACZ,IAAI,QAAQ;GACZ,aAAa,QAAQ,SAAS,WAAW,QAAQ,OAAO;GACxD,UAAW,QAAQ,gBAAgB,YAAY,QAAQ,gBAAgB,KACnE,EAAE,aAAa,QAAQ,YAAa,IACpC,CAAE;GAGN,UAAW,QAAQ,cAAc,YAAY,QAAQ,cAAc,KAC/D,EAAE,UAAU,QAAQ,UAAW,IAC/B,CAAE;EACP,EAAC;CACH;AACD,QAAO;AACR;;;;;;;AAQD,eAAe,gBACbP,MACAQ,WACAN,aACAC,SAC6B;CAC7B,IAAIC;CACJ,IAAIC;AACJ,KAAI;AACF,GAAC,CAAE,QAAQ,KAAM,GAAG,MAAM,UAAU,MAAM,oBAAoB,aAAa,QAAQ;CACpF,QAAO;AACN;CACD;AACD,KAAI,WAAW,IAAK;AACpB,KAAI;EACF,MAAM,SAAS,KAAK,MAAM,KAAK;EAC/B,MAAM,QAAQ,OAAO,SAAS,KAAK,CAAA,WAAU,OAAO,OAAO,UAAU;AACrE,gBAAc,OAAO,SAAS,YAAY,MAAM,SAAS,KAAK,MAAM;CACrE,QAAO;AACN;CACD;AACF;;;;;;;AAQD,SAAS,mBAAmBD,QAAgBC,MAAsB;AAChE,KAAI;EACF,MAAM,SAAS,KAAK,MAAM,KAAK;EAC/B,MAAM,gBAAgB,OAAO,cAAc,WACvC,OAAO,mBACA,OAAO,YAAY,WAAW,OAAO;AAChD,MAAI,mBAAsB;GACxB,MAAM,cAAc,OAAO,eAAe,YAAY,IAAI,OAAO,WAAW,IAAI;AAChF,WAAQ,8CAA8C,OAAO,EAAE,KAAK,KAAK,OAAO;EACjF;CACF,QAAO,CAEP;AACD,KAAI,WAAW,IACb,QAAO;AAGT,KAAI,WAAW,IACb,QAAO;AAGT,SAAQ,oCAAoC,OAAO,IAAI,KAAK,MAAM,GAAG,IAAI,CAAC;AAC3E"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@huaweidevtools/aishell-dsh-credentials-store",
   "description": "Credential storage + SDK-HMAC-SHA256 signing for aishell DSH plugins",
-  "version": "0.0.1-beta.2",
+  "version": "0.0.1-beta.3",
   "publishConfig": {
     "access": "public"
   },
@@ -21,19 +21,32 @@
     "./signer": {
       "types": "./lib/signer.d.ts",
       "default": "./lib/signer.js"
+    },
+    "./accounts": {
+      "types": "./lib/accounts.d.ts",
+      "default": "./lib/accounts.js"
+    },
+    "./verify": {
+      "types": "./lib/verify.d.ts",
+      "default": "./lib/verify.js"
+    },
+    "./scope": {
+      "types": "./lib/scope.d.ts",
+      "default": "./lib/scope.js"
+    },
+    "./paths": {
+      "types": "./lib/paths.d.ts",
+      "default": "./lib/paths.js"
     }
   },
   "files": [
-    "lib/index.js",
-    "lib/signer.js",
-    "lib/index.d.ts",
-    "lib/signer.d.ts",
-    "lib/index.js.map",
-    "lib/index.d.ts.map"
+    "lib/**/*.js",
+    "lib/**/*.d.ts",
+    "lib/**/*.map"
   ],
   "license": "Apache-2.0",
   "dependencies": {
-    "@napi-rs/keyring": "^2.0.0",
+    "@napi-rs/keyring": "^2.1.1",
     "node-machine-id": "^1.1.12"
   },
   "scripts": {

package/lib/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../../src/backends/keyring.ts","../../src/backends/fingerprint.ts","../../src/backends/memory.ts","../../src/failover.ts","../../src/index.ts"],"sourcesContent":null,"mappings":";;AA+CA,KA1BK,YAAA,GA0BQ;EAAe,WAAA,EAAA,GAAA,GAAA,MAAA,GAAA,IAAA;EAAA,WAIN,EAAA,CAAA,KAAA,EAAA,MAAA,EAAA,GAAA,IAAA;EAA2B,cAJV,EAAA,GAAA,GAAA,IAAA;AAAgB,CAAA;KArBlD,aAAA;mDAAmE;;;iBAIxD,kBAAA,OAAyB;;;;;;;;AC2DzC;AAAgC,cD1CnB,cAAA,YAA0B,gBC0CP,CAAA;EAAA,iBAIV,WAAA;EAA2B,iBAJN,KAAA;EAAgB,WAAA,CAAA,MAAA,CAAA,EDtCrC,sBCsCqC;;;;;AC1E3D,CAAA;;;;;AFgCuD;;;;;;;cC0C1C,kBAAA,YAA8B;;;uBAIrB;;;AAJtB;;;;EAA2D,QAAA,IAAA;;;;;EC1E9C,MAAA,CAAA,OAAA,EAAc,MAAA,CAAA,EAAA,IAAA;EAAA,GAAA,CAAA,OAAA,EAAA,MAAA,CAAA,EAAA,OAAA;CAAA;;;;;AFgCd,cEhCA,aAAA,YAAyB,gBFgCV,CAAA;EAAA,iBAAA,OAAA;EAAA,WAIN,CAAA,OAAA,CAAA,EEjCC,sBFiCD;EAA2B,GAJV,CAAA,OAAA,EAAA,MAAA,CAAA,EAAA,MAAA,GAAA,SAAA;EAAgB,GAAA,CAAA,OAAA,EAAA,MAAA,EAAA,KAAA,EAAA,MAAA,CAAA,EAAA,IAAA;;;;;;;;;;UGqDtC,oBAAA;;;;;;;iCAOgB;;;ACnFjC;;;;;;;;AAuBA;;;;;;cD8Ea,aAAA,YAAyB;;;;;;uBAOf,2BAA2B;;;;;;;;;ACtDlD;EAAsC,QAAA,cAAA;EAAA,GAAS,CAAA,OAAA,EAAA,MAAA,CAAA,EAAA,MAAA,GAAA,SAAA;EAA2B,GAAG,CAAA,OAAA,EAAA,MAAA,CAAA,EAAA,OAAA;EAAgB,GAAA,CAAA,OAAA,EAAA,MAAA,EAAA,KAAA,EAAA,MAAA,CAAA,EAAA,IAAA;;;;;;;;;;;;;;;AJhElB;AAO1D;;AASjB;;;;;;;;;AAiBA;;;;AAAuD;UIvBtC,sBAAA;;;;;;;;;;;;AHiEjB;EAAgC,SAAA,cAAA,CAAA,EAAA,MAAA;;;AAA2B;;;;;AC1E3D;AAA2B,UEgCV,gBAAA,CFhCU;EAAA;EAGuB,GAHZ,CAAA,OAAA,EAAA,MAAA,CAAA,EAAA,MAAA,GAAA,SAAA;EAAgB;;;;;ECqFrC,GAAA,CAAA,OAAA,EAAA,MAAA,CAAA,EAAA,OAAoB;;;;;;;;;;;;;;;;AAyBrC;;;;;AAAsD;iBC/CtC,sBAAA,UAA+B,yBAA8B"}