@huaweidevtools/aishell-dsh-credentials-store 0.0.1-beta.2 → 0.0.1-beta.4

package/lib/signer.d.ts

@@ -1,40 +1,2 @@
-//#region src/signer.d.ts
-/**
- * Huawei Cloud SDK-HMAC-SHA256 request signing.
- *
- * Signs an HTTP request with AK/SK (and an optional temporary SecurityToken)
- * using the same algorithm as the official Huawei Cloud SDK. Produces the
- * `Authorization`, `x-sdk-date`, and `x-security-token` headers to attach
- * to a `fetch` call.
- *
- * @module @huaweidevtools/aishell-dsh-credentials-store/signer
- */
-/** Credentials for signing. */
-interface SignCredentials {
-  readonly ak: string;
-  readonly sk: string;
-  readonly securityToken?: string;
-}
-/** The headers produced by {@link sign}. */
-interface SignedHeaders {
-  readonly host: string;
-  readonly 'x-sdk-date': string;
-  readonly Authorization: string;
-  readonly 'x-security-token'?: string;
-}
-/**
- * Sign an HTTP request with SDK-HMAC-SHA256.
- *
- * @param method - HTTP method (GET, POST, ...).
- * @param host - Host component of the request URL (e.g. `api.aishell.openbuildlab.com`).
- * @param path - Path component of the request URL (e.g. `/chat/completions`).
- * @param query - Query parameters as a key-value map.
- * @param body - Request body (stringified for hashing; empty string for GET).
- * @param credentials - AK/SK and optional SecurityToken.
- * @returns The headers to attach to the fetch call.
- */
-declare function sign(method: string, host: string, path: string, query: Record<string, string>, body: string, credentials: SignCredentials): SignedHeaders; //#endregion
-
-//# sourceMappingURL=signer.d.ts.map
-export { SignCredentials, SignedHeaders, sign };
-//# sourceMappingURL=signer.d.ts.map
+import { SignCredentials, SignedHeaders, sign$1 as sign } from "./signer-Et0DIH6o.js";
+export { SignCredentials, SignedHeaders, sign };

package/lib/signer.js

@@ -1,66 +1,3 @@
-import crypto from "node:crypto";
+import { sign } from "./signer-BPR0UAF0.js";
 
-//#region src/signer.ts
-function sha256Hex(data) {
-	return crypto.createHash("sha256").update(data).digest("hex");
-}
-function hmacSha256(key, data) {
-	return crypto.createHmac("sha256", key).update(data).digest("hex");
-}
-/** RFC 3986 URL-encode a string (unreserved chars stay literal). */
-function urlEncode(str) {
-	const hex = (c) => "%" + (c < 16 ? "0" : "") + c.toString(16).toUpperCase();
-	const noEscape = new Set("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.~".split(""));
-	let out = "";
-	for (const ch of str) {
-		const c = ch.codePointAt(0);
-		if (c < 128) out += noEscape.has(ch) ? ch : hex(c);
-		else out += encodeURIComponent(ch);
-	}
-	return out;
-}
-/** ISO 8601 timestamp in Huawei Cloud format: `20260912T064552Z`. */
-function sdkTimestamp() {
-	return new Date().toISOString().replace(/[-:]/g, "").replace(/\.\d+/, "");
-}
-/**
-* Sign an HTTP request with SDK-HMAC-SHA256.
-*
-* @param method - HTTP method (GET, POST, ...).
-* @param host - Host component of the request URL (e.g. `api.aishell.openbuildlab.com`).
-* @param path - Path component of the request URL (e.g. `/chat/completions`).
-* @param query - Query parameters as a key-value map.
-* @param body - Request body (stringified for hashing; empty string for GET).
-* @param credentials - AK/SK and optional SecurityToken.
-* @returns The headers to attach to the fetch call.
-*/
-function sign(method, host, path, query, body, credentials) {
-	const ts = sdkTimestamp();
-	const cqs = Object.entries(query).sort(([a], [b]) => a.localeCompare(b)).map(([k, v]) => `${urlEncode(k)}=${urlEncode(v)}`).join("&");
-	const curi = "/" + path.split("/").filter(Boolean).map(urlEncode).join("/") + "/";
-	const hasToken = credentials.securityToken !== void 0;
-	const signedHeaders = hasToken ? "host;x-sdk-date;x-security-token" : "host;x-sdk-date";
-	const canonicalHeaders = hasToken ? `host:${host}\nx-sdk-date:${ts}\nx-security-token:${credentials.securityToken}\n` : `host:${host}\nx-sdk-date:${ts}\n`;
-	const payloadHash = sha256Hex(body);
-	const canonicalRequest = [
-		method,
-		curi,
-		cqs,
-		canonicalHeaders,
-		signedHeaders,
-		payloadHash
-	].join("\n");
-	const stringToSign = `SDK-HMAC-SHA256\n${ts}\n${sha256Hex(canonicalRequest)}`;
-	const signature = hmacSha256(credentials.sk, stringToSign);
-	const headers = {
-		host,
-		"x-sdk-date": ts,
-		Authorization: `SDK-HMAC-SHA256 Access=${credentials.ak}, SignedHeaders=${signedHeaders}, Signature=${signature}`,
-		...hasToken ? { "x-security-token": credentials.securityToken } : {}
-	};
-	return headers;
-}
-
-//#endregion
-export { sign };
-//# sourceMappingURL=signer.js.map
+export { sign };

package/lib/types/accounts.d.ts

@@ -0,0 +1,231 @@
+/**
+ * The Huawei Cloud credential vocabulary every plugin in this set shares.
+ *
+ * ## Why this module exists
+ *
+ * This repo once read the same keyring entries from four places, each declaring
+ * the account names itself and re-implementing "read AK and SK as a pair". The
+ * account names are a *persistence* contract, so a divergence would not fail a
+ * build — it would surface as one plugin working and another reporting "not
+ * authenticated" on a machine where the person had stored exactly one pair, and
+ * the cause would be invisible in the diff that introduced it.
+ *
+ * Everything now goes through this file.
+ *
+ * ## One entry, not three
+ *
+ * The store holds **one** record, `aishell-credential`, whose value is a single
+ * JSON bundle encoded as base64:
+ *
+ * ```json
+ * {
+ *   "huaweicloud": { "access_key": "…", "secret_key": "…", "security_token": "…" },
+ *   "aishell_e2b": { "api_key": "…", "expired_at": "…", "ak_fingerprint": "…" }
+ * }
+ * ```
+ *
+ * The earlier layout was three separate entries (`HW_ACCESS_KEY`,
+ * `HW_SECRET_KEY`, `HW_SECURITY_TOKEN`). That had two problems this fixes:
+ *
+ *   - **A save was four operations.** Clear, then write AK, then SK, then
+ *     token. Every backend is per-entry, so a failure between them left a
+ *     half-set behind, and nothing rolled it back.
+ *   - **A read was three reads.** A concurrent write landing between them could
+ *     hand back a new AK with an old SK — a pair that passes "both present" and
+ *     then fails at the gateway with 401, pointing nowhere near the cause.
+ *
+ * One entry makes a write one atomic operation and a read one consistent
+ * snapshot.
+ *
+ * ## base64 is an encoding, not encryption
+ *
+ * It keeps the secret from sitting in a plaintext field a person or a log
+ * prints while poking at the store. It is **not** a security boundary: anyone
+ * who can read the entry can decode it. The actual protection is the backend —
+ * the OS keyring, or AES-256-GCM in the file backend.
+ *
+ * ## Read-modify-write is not atomic across processes
+ *
+ * {@link updateCredentials} reads the bundle, applies a change and writes it
+ * back. Two processes doing that concurrently can lose one of the changes. That
+ * is accepted rather than solved: the only writer is a person via the
+ * credential form, and both the e2b key and the AK/SK are refreshed by that
+ * same person. A lost update would be corrected by the next save. Solving it
+ * properly needs compare-and-swap, which the keyring API does not offer.
+ *
+ * @module @huaweidevtools/aishell-dsh-credentials-store/accounts
+ */
+import type { CredentialsStore } from './index.ts';
+import type { SignCredentials } from './signer.ts';
+/**
+ * The one store entry holding every credential this repo manages.
+ *
+ * Part of the persistence contract: renaming it orphans every stored entry
+ * while looking like a harmless constant change.
+ */
+export declare const CREDENTIAL_ACCOUNT = "aishell-credential";
+/**
+ * Entries written by the earlier three-key layout, in the order they are read
+ * during migration.
+ *
+ * Kept only so an existing install keeps working: see {@link readCredentials}.
+ * New writes never touch these.
+ */
+export declare const LEGACY_ACCOUNTS: readonly ["HW_ACCESS_KEY", "HW_SECRET_KEY", "HW_SECURITY_TOKEN"];
+/**
+ * The legacy entry holding an e2b API key on its own.
+ *
+ * Folded into the bundle by {@link readCredentials}. Kept as a constant because
+ * the migration has to name it.
+ */
+export declare const LEGACY_E2B_ACCOUNT = "AISHELL_E2B_API_KEY";
+/** The Huawei Cloud pair, as the bundle stores it. Snake-case on disk. */
+export interface HuaweiCloudSection {
+    readonly access_key: string;
+    readonly secret_key: string;
+    readonly security_token?: string;
+}
+/**
+ * An e2b API key, as the bundle stores it.
+ *
+ * `ak_fingerprint` is not part of the key the gateway issued — it is a digest
+ * of the AK that minted it, so a reader can tell whether the key still belongs
+ * to the credentials in hand. Without it, an AK rotation would leave the old
+ * key (and so the old tenant, with all its sandboxes) alive. It lives here
+ * rather than only in the reader's memory because it has to survive a restart.
+ */
+export interface E2BSection {
+    readonly api_key: string;
+    /** ISO 8601; `9999-12-31T23:59:59.000Z` when the key does not expire. */
+    readonly expired_at: string;
+    /** {@link fingerprint} of the AK that minted this key, when known. */
+    readonly ak_fingerprint?: string;
+}
+/** The whole bundle. Either section may be absent. */
+export interface CredentialBundle {
+    readonly huaweicloud?: HuaweiCloudSection;
+    readonly aishell_e2b?: E2BSection;
+}
+/**
+ * Encode a bundle for storage.
+ *
+ * @param bundle - the bundle to store.
+ * @returns base64 of its JSON form.
+ */
+export declare function encodeBundle(bundle: CredentialBundle): string;
+/**
+ * Decode a stored value.
+ *
+ * Anything unreadable reads as an empty bundle rather than throwing: a corrupt
+ * entry should behave like "nothing stored" so the person is asked to
+ * authenticate again, not so every tool call fails on a parse error.
+ *
+ * A value that is not base64 is tried as raw JSON first — that is what the
+ * legacy e2b entry held, and migration reads it through here.
+ *
+ * @param raw - the stored string, if any.
+ * @returns the decoded bundle; empty when nothing usable is there.
+ */
+export declare function decodeBundle(raw: string | undefined): CredentialBundle;
+/**
+ * Read the whole bundle, migrating a legacy layout on the way.
+ *
+ * Migration is lazy and idempotent: the first read that finds no bundle but
+ * finds legacy entries merges them into one record, writes it, and removes the
+ * old entries. A failed write leaves the legacy entries alone, so the next read
+ * tries again — the person is never left with neither layout.
+ *
+ * @param store - the caller's credential store.
+ * @returns the bundle; empty when nothing is stored.
+ */
+export declare function readCredentials(store: CredentialsStore): CredentialBundle;
+/** The expiry recorded for a key that does not expire. */
+export declare const FOREVER_EXPIRY = "9999-12-31T23:59:59.000Z";
+/**
+ * Read the Huawei Cloud pair.
+ *
+ * AK and SK are read together and treated as one unit: half a pair reads as no
+ * credentials rather than an error, so a partially-configured machine gets
+ * "authenticate first" instead of a signing failure with no remedy. The
+ * SecurityToken is optional and is omitted entirely when absent — an empty
+ * string would sign as a third header the gateway then rejects.
+ *
+ * @param store - the caller's credential store.
+ * @returns the pair, or `undefined` when the AK/SK pair is incomplete.
+ */
+export declare function readStoredPair(store: CredentialsStore): SignCredentials | undefined;
+/**
+ * Whether a complete Huawei Cloud pair is stored.
+ *
+ * @param store - the caller's credential store.
+ */
+export declare function hasStoredPair(store: CredentialsStore): boolean;
+/**
+ * Read the stored e2b key.
+ *
+ * @param store - the caller's credential store.
+ * @returns the section, or `undefined` when no key is stored.
+ */
+export declare function readE2BKey(store: CredentialsStore): E2BSection | undefined;
+/**
+ * Apply one change to the bundle and write it back.
+ *
+ * The updater receives the current bundle and returns the next one. Returning
+ * `undefined` aborts the write, which is how a caller says "nothing changed" —
+ * that matters because every write is a full re-encode, and needlessly
+ * rewriting a record while another process reads it is how a spurious
+ * "credentials changed" is produced.
+ *
+ * @param store - the caller's credential store.
+ * @param update - computes the next bundle.
+ * @returns the bundle now stored.
+ */
+export declare function updateCredentials(store: CredentialsStore, update: (current: CredentialBundle) => CredentialBundle | undefined): CredentialBundle;
+/**
+ * Store the Huawei Cloud pair, replacing any previous one.
+ *
+ * One write, so the pair can never be left half-replaced. A save without a
+ * token removes a previously stored one: a token belongs to the credential set
+ * that carried it, and inheriting a stale one would sign the next request with
+ * someone else's session.
+ *
+ * @param store - the caller's credential store.
+ * @param credentials - the verified pair.
+ */
+export declare function writeHuaweiCloud(store: CredentialsStore, credentials: SignCredentials): void;
+/**
+ * Store an e2b key.
+ *
+ * @param store - the caller's credential store.
+ * @param key - the section to store.
+ */
+export declare function writeE2BKey(store: CredentialsStore, key: E2BSection): void;
+/**
+ * Remove the stored e2b key, leaving the Huawei Cloud pair alone.
+ *
+ * @param store - the caller's credential store.
+ */
+export declare function clearE2BKey(store: CredentialsStore): void;
+/**
+ * Remove every credential this repo writes.
+ *
+ * The whole record goes, so a clear cannot leave a token or a key behind for
+ * the next pair to inherit. Deleting an absent entry is a no-op in every
+ * backend, and the legacy entries are removed too so a half-migrated store does
+ * not come back.
+ *
+ * @param store - the caller's credential store.
+ */
+export declare function clearCredentials(store: CredentialsStore): void;
+/**
+ * A short, stable digest of an AK, for recording which identity minted a key.
+ *
+ * The AK rather than the pair: the SK can be rotated independently while the
+ * account stays the same, and the tenant the gateway derives is the account. A
+ * digest rather than the AK itself keeps the bundle from carrying a second
+ * readable copy of a credential identifier.
+ *
+ * @param ak - the access key.
+ */
+export declare function fingerprint(ak: string): string;
+//# sourceMappingURL=accounts.d.ts.map

package/lib/types/accounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accounts.d.ts","sourceRoot":"","sources":["../../src/accounts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,uBAAuB,CAAA;AAEtD;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,kEAAmE,CAAA;AAE/F;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,wBAAwB,CAAA;AAEvD,0EAA0E;AAC1E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CACjC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,yEAAyE;IACzE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CACjC;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,CAAA;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE,UAAU,CAAA;CAClC;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAE7D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,gBAAgB,CAoBtE;AAoCD;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,gBAAgB,GAAG,gBAAgB,CAOzE;AAsED,0DAA0D;AAC1D,eAAO,MAAM,cAAc,6BAA6B,CAAA;AAExD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,gBAAgB,GAAG,eAAe,GAAG,SAAS,CAQnF;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,gBAAgB,GAAG,UAAU,GAAG,SAAS,CAE1E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,gBAAgB,EACvB,MAAM,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,gBAAgB,GAAG,SAAS,GAClE,gBAAgB,CAMlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,eAAe,GAAG,IAAI,CAS5F;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,UAAU,GAAG,IAAI,CAE1E;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAMzD;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAI9D;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE9C"}