@huaweidevtools/aishell-dsh-credentials-store 0.0.15 → 0.0.17

package/lib/{scope-QmrHZaZt.js → scope-DJcK27Uc.js}

@@ -18,25 +18,25 @@
 * | keyring service name | `aishell-dsh-plugins` |
 * | encrypted file name | `plugins.credentials.enc` |
 *
-* ## Why it is not a plugin config option
+* ## Why it is a build-time constant
 *
-* It was one, briefly: `keyringService` sat on four plugins' `Config`. Only one
-* of the four writes and all four read, so a deployment that set it on a reader
-* but not the writer stored credentials in one namespace and looked for them in
-* another — the form said "saved" while every tool said "not authenticated".
-* A knob whose only observable effect is that failure is not worth having.
+* The value has to be the same on both sides of a credential: the writer that
+* stores it and the reader that looks it up. A runtime setting can be applied
+* to one plugin and not another, and the result is a form that says "saved"
+* beside tools that say "not authenticated" — a failure whose only symptom is
+* the one thing the setting exists to control.
 *
 * A constant cannot be set on one side only. Two deployments that must not see
 * each other's credentials (a staging profile beside a production one) differ
 * by *building* differently, which is the honest place for a persistence
 * boundary.
 *
-* ## Why there is no migration
+* ## Why the default namespace carries no migration path
 *
-* The default changed from `aishell-dsh` to `aishell-dsh-plugins` before the
-* first release, so no install ever wrote the old namespace. Nothing reads it,
-* and adding a migration path would mean keeping the old name alive forever for
-* a state that never existed.
+* `plugins` is the first and only scope, so a build that sets nothing lands on
+* it and a build that sets something has deliberately moved to a namespace of
+* its own. There are no two names to reconcile, so there is no migration path
+* to write — and none is needed until a release renames this default.
 *
 * @module @huaweidevtools/aishell-dsh-credentials-store/scope
 */
@@ -93,4 +93,4 @@ const CREDENTIALS_FILE_NAME = `${CREDENTIAL_SCOPE}.credentials.enc`;
 
 //#endregion
 export { CREDENTIALS_FILE_NAME, CREDENTIAL_SCOPE, DEFAULT_SCOPE, KEYRING_SERVICE };
-//# sourceMappingURL=scope-QmrHZaZt.js.map
+//# sourceMappingURL=scope-DJcK27Uc.js.map

package/lib/scope-DJcK27Uc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-DJcK27Uc.js","names":[],"sources":["../src/scope.ts"],"sourcesContent":["/**\n * Which credential namespace this build uses.\n *\n * ## The knob\n *\n * A build-time constant, not a runtime setting:\n *\n * ```sh\n * AISHELL_CREDENTIAL_SCOPE=staging pnpm run build\n * ```\n *\n * Default `plugins`. It decides two things, and it decides both at once —\n * which is the point:\n *\n * | Used as | Default |\n * |---|---|\n * | keyring service name | `aishell-dsh-plugins` |\n * | encrypted file name | `plugins.credentials.enc` |\n *\n * ## Why it is a build-time constant\n *\n * The value has to be the same on both sides of a credential: the writer that\n * stores it and the reader that looks it up. A runtime setting can be applied\n * to one plugin and not another, and the result is a form that says \"saved\"\n * beside tools that say \"not authenticated\" — a failure whose only symptom is\n * the one thing the setting exists to control.\n *\n * A constant cannot be set on one side only. Two deployments that must not see\n * each other's credentials (a staging profile beside a production one) differ\n * by *building* differently, which is the honest place for a persistence\n * boundary.\n *\n * ## Why the default namespace carries no migration path\n *\n * `plugins` is the first and only scope, so a build that sets nothing lands on\n * it and a build that sets something has deliberately moved to a namespace of\n * its own. There are no two names to reconcile, so there is no migration path\n * to write — and none is needed until a release renames this default.\n *\n * @module @huaweidevtools/aishell-dsh-credentials-store/scope\n */\n\n/**\n * The default scope.\n *\n * Named for the repository, not for a feature: the credential store is shared\n * by every plugin in this set, so it is not `llm`'s or `e2b`'s.\n */\nexport const DEFAULT_SCOPE = 'plugins'\n\n/**\n * Injected at build time; see `tsdown.config.ts`.\n *\n * Declared as possibly-absent because a source run (the test suite, which\n * resolves `src/` directly) never passes through the bundler. The `typeof`\n * guard below handles that without a `ReferenceError`.\n */\ndeclare const __AISHELL_CREDENTIAL_SCOPE__: string | undefined\n\n/**\n * Accepted scope shape: a lowercase identifier.\n *\n * The value reaches a keyring service name and a file name, so it is validated\n * as a strict identifier rather than merely \"not obviously a path\": no\n * separators, no dots, no leading dash. Assuming a value is benign because the\n * caller is trusted is how path traversal gets in.\n */\nconst SCOPE_PATTERN = /^[a-z0-9][a-z0-9_-]{0,63}$/\n\n/**\n * Resolve the scope for this build.\n *\n * Fails loudly on a malformed value rather than falling back to the default:\n * a typo would otherwise silently share the namespace with every unset build,\n * which is exactly the confusion scoping exists to avoid.\n *\n * @returns the validated scope.\n * @throws when the injected value is not a valid scope.\n */\nfunction resolveScope(): string {\n  // `typeof` rather than a direct read: an undeclared identifier throws, and a\n  // source run legitimately has no injected value.\n  const injected = typeof __AISHELL_CREDENTIAL_SCOPE__ === 'string'\n    ? __AISHELL_CREDENTIAL_SCOPE__\n    : undefined\n  if (injected === undefined || injected === '') return DEFAULT_SCOPE\n  const normalized = injected.trim().toLowerCase()\n  if (normalized.length === 0) return DEFAULT_SCOPE\n  if (!SCOPE_PATTERN.test(normalized)) {\n    throw new Error(\n      `AISHELL_CREDENTIAL_SCOPE=${JSON.stringify(injected)} is not a valid credential scope: `\n      + `expected 1-64 characters of [a-z0-9_-], starting with a letter or digit `\n      + '(for example \"plugins\" or \"staging\").',\n    )\n  }\n  return normalized\n}\n\n/** The scope this build uses. */\nexport const CREDENTIAL_SCOPE = resolveScope()\n\n/**\n * The keyring service every entry of this build lives under.\n *\n * Part of the persistence contract: renaming it orphans every stored entry\n * while looking like a harmless constant change.\n */\nexport const KEYRING_SERVICE = `aishell-dsh-${CREDENTIAL_SCOPE}`\n\n/**\n * The encrypted file name for this build.\n *\n * Scoped the same way as the keyring service, so two builds on one machine\n * cannot collide in either backend.\n */\nexport const CREDENTIALS_FILE_NAME = `${CREDENTIAL_SCOPE}.credentials.enc`"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDA,MAAa,gBAAgB;;;;;;;;;AAmB7B,MAAM,gBAAgB;;;;;;;;;;;AAYtB,SAAS,eAAuB;CAG9B,MAAM;AAGN,KAAI,uBAA0B,aAAa,GAAI,QAAO;CACtD,MAAM,aAAa,SAAS,MAAM,CAAC,aAAa;AAChD,KAAI,WAAW,WAAW,EAAG,QAAO;AACpC,MAAK,cAAc,KAAK,WAAW,CACjC,OAAM,IAAI,OACP,2BAA2B,KAAK,UAAU,SAAS,CAAC;AAKzD,QAAO;AACR;;AAGD,MAAa,mBAAmB,cAAc;;;;;;;AAQ9C,MAAa,mBAAmB,cAAc,iBAAiB;;;;;;;AAQ/D,MAAa,yBAAyB,EAAE,iBAAiB"}

package/lib/scope.d.ts

@@ -1,2 +1,2 @@
-import { CREDENTIALS_FILE_NAME$1 as CREDENTIALS_FILE_NAME, CREDENTIAL_SCOPE$1 as CREDENTIAL_SCOPE, DEFAULT_SCOPE$1 as DEFAULT_SCOPE, KEYRING_SERVICE$1 as KEYRING_SERVICE } from "./scope-CFetnbG3.js";
+import { CREDENTIALS_FILE_NAME$1 as CREDENTIALS_FILE_NAME, CREDENTIAL_SCOPE$1 as CREDENTIAL_SCOPE, DEFAULT_SCOPE$1 as DEFAULT_SCOPE, KEYRING_SERVICE$1 as KEYRING_SERVICE } from "./scope-C7w2eTvE.js";
 export { CREDENTIALS_FILE_NAME, CREDENTIAL_SCOPE, DEFAULT_SCOPE, KEYRING_SERVICE };

package/lib/scope.js

@@ -1,3 +1,3 @@
-import { CREDENTIALS_FILE_NAME, CREDENTIAL_SCOPE, DEFAULT_SCOPE, KEYRING_SERVICE } from "./scope-QmrHZaZt.js";
+import { CREDENTIALS_FILE_NAME, CREDENTIAL_SCOPE, DEFAULT_SCOPE, KEYRING_SERVICE } from "./scope-DJcK27Uc.js";
 
 export { CREDENTIALS_FILE_NAME, CREDENTIAL_SCOPE, DEFAULT_SCOPE, KEYRING_SERVICE };

package/lib/signer-Bx88x7dI.d.ts

@@ -0,0 +1,72 @@
+//#region src/signer.d.ts
+/**
+ * Huawei Cloud SDK-HMAC-SHA256 request signing.
+ *
+ * Signs an HTTP request with AK/SK (and an optional temporary SecurityToken)
+ * using the same algorithm as the official Huawei Cloud SDK. Produces the
+ * `Authorization`, `x-sdk-date`, and `x-security-token` headers to attach
+ * to a `fetch` call.
+ *
+ * @module @huaweidevtools/aishell-dsh-credentials-store/signer
+ */
+/** Credentials for signing. */
+interface SignCredentials {
+  readonly ak: string;
+  readonly sk: string;
+  readonly securityToken?: string;
+}
+/** The headers produced by {@link sign}. */
+interface SignedHeaders {
+  readonly host: string;
+  readonly 'x-sdk-date': string;
+  readonly Authorization: string;
+  readonly 'x-security-token'?: string;
+}
+/**
+ * Code-unit comparison — the order the signing specification requires.
+ *
+ * Exported because it is the part of signing that is checkable without a
+ * signature: everything downstream of it is a hash, so a test that compares two
+ * signatures cannot tell a correct ordering from a consistently wrong one. See
+ * `tests/format.spec.ts`.
+ *
+ * @param a - one string.
+ * @param b - the other.
+ * @returns negative, zero or positive in code-unit order.
+ */
+declare function compareCodeUnits(a: string, b: string): number;
+/**
+ * Build the canonical query string, sorted by parameter name.
+ *
+ * ## Why byte order and not `localeCompare`
+ *
+ * The specification sorts by code point. Locale-aware collation disagrees with
+ * it on mixed case: `Zebra` sorts *before* `apple` by code unit and *after* it
+ * under the default locale. The signed string would then differ from the one
+ * the gateway rebuilds from the same URL, and the request fails to authenticate
+ * with nothing in the error naming the sort.
+ *
+ * Every caller in this repo passes lowercase ASCII parameter names today, which
+ * is why this survived; `openapi_request` takes a URL from the model, so mixed
+ * case reaches this path from outside.
+ *
+ * @param query - the query parameters.
+ * @returns the canonical string, `k=v&k=v`, with both sides URL-encoded.
+ */
+declare function canonicalQuery(query: Record<string, string>): string;
+/**
+ * Sign an HTTP request with SDK-HMAC-SHA256.
+ *
+ * @param method - HTTP method (GET, POST, ...).
+ * @param host - Host component of the request URL (e.g. `openai.aishell.openbuildlab.com`).
+ * @param path - Path component of the request URL (e.g. `/chat/completions`).
+ * @param query - Query parameters as a key-value map.
+ * @param body - Request body (stringified for hashing; empty string for GET).
+ * @param credentials - AK/SK and optional SecurityToken.
+ * @returns The headers to attach to the fetch call.
+ */
+declare function sign(method: string, host: string, path: string, query: Record<string, string>, body: string, credentials: SignCredentials): SignedHeaders; //#endregion
+
+//# sourceMappingURL=signer.d.ts.map
+export { SignCredentials, SignedHeaders, canonicalQuery as canonicalQuery$1, compareCodeUnits as compareCodeUnits$1, sign as sign$1 };
+//# sourceMappingURL=signer-Bx88x7dI.d.ts.map

package/lib/signer-Bx88x7dI.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer-Bx88x7dI.d.ts","names":[],"sources":["../../src/signer.ts"],"sourcesContent":null,"mappings":";;;;;;;;;;;;UAciB,eAAA;EAAA,SAAA,EAAA,EAAA,MAAe;;EAOf,SAAA,aAAa,CAAA,EAAA,MAAA;;;UAAb,aAAA;;;;;;;;;;AAkDjB;;;;;;;;iBAAgB,gBAAA;;;;;;;;;;;AAsBhB;;;;;;;;iBAAgB,cAAA,QAAsB;;;;AAkBtC;;;;;AAOgB;;;iBAPA,IAAA,oDAIP,mDAEM,kBACZ"}

package/lib/{signer-BPR0UAF0.js → signer-CVOjpi6y.js}

@@ -24,6 +24,42 @@ function sdkTimestamp() {
 	return new Date().toISOString().replace(/[-:]/g, "").replace(/\.\d+/, "");
 }
 /**
+* Code-unit comparison — the order the signing specification requires.
+*
+* Exported because it is the part of signing that is checkable without a
+* signature: everything downstream of it is a hash, so a test that compares two
+* signatures cannot tell a correct ordering from a consistently wrong one. See
+* `tests/format.spec.ts`.
+*
+* @param a - one string.
+* @param b - the other.
+* @returns negative, zero or positive in code-unit order.
+*/
+function compareCodeUnits(a, b) {
+	return a < b ? -1 : a > b ? 1 : 0;
+}
+/**
+* Build the canonical query string, sorted by parameter name.
+*
+* ## Why byte order and not `localeCompare`
+*
+* The specification sorts by code point. Locale-aware collation disagrees with
+* it on mixed case: `Zebra` sorts *before* `apple` by code unit and *after* it
+* under the default locale. The signed string would then differ from the one
+* the gateway rebuilds from the same URL, and the request fails to authenticate
+* with nothing in the error naming the sort.
+*
+* Every caller in this repo passes lowercase ASCII parameter names today, which
+* is why this survived; `openapi_request` takes a URL from the model, so mixed
+* case reaches this path from outside.
+*
+* @param query - the query parameters.
+* @returns the canonical string, `k=v&k=v`, with both sides URL-encoded.
+*/
+function canonicalQuery(query) {
+	return Object.entries(query).sort(([a], [b]) => compareCodeUnits(a, b)).map(([k, v]) => `${urlEncode(k)}=${urlEncode(v)}`).join("&");
+}
+/**
 * Sign an HTTP request with SDK-HMAC-SHA256.
 *
 * @param method - HTTP method (GET, POST, ...).
@@ -36,7 +72,7 @@ function sdkTimestamp() {
 */
 function sign(method, host, path, query, body, credentials) {
 	const ts = sdkTimestamp();
-	const cqs = Object.entries(query).sort(([a], [b]) => a.localeCompare(b)).map(([k, v]) => `${urlEncode(k)}=${urlEncode(v)}`).join("&");
+	const cqs = canonicalQuery(query);
 	const curi = "/" + path.split("/").filter(Boolean).map(urlEncode).join("/") + "/";
 	const hasToken = credentials.securityToken !== void 0;
 	const signedHeaders = hasToken ? "host;x-sdk-date;x-security-token" : "host;x-sdk-date";
@@ -62,5 +98,5 @@ function sign(method, host, path, query, body, credentials) {
 }
 
 //#endregion
-export { sign };
-//# sourceMappingURL=signer-BPR0UAF0.js.map
+export { canonicalQuery, compareCodeUnits, sign };
+//# sourceMappingURL=signer-CVOjpi6y.js.map

package/lib/signer-CVOjpi6y.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer-CVOjpi6y.js","names":["data: string","key: string","str: string","c: number","a: string","b: string","query: Record<string, string>","method: string","host: string","path: string","body: string","credentials: SignCredentials","headers: SignedHeaders"],"sources":["../src/signer.ts"],"sourcesContent":["/**\n * Huawei Cloud SDK-HMAC-SHA256 request signing.\n *\n * Signs an HTTP request with AK/SK (and an optional temporary SecurityToken)\n * using the same algorithm as the official Huawei Cloud SDK. Produces the\n * `Authorization`, `x-sdk-date`, and `x-security-token` headers to attach\n * to a `fetch` call.\n *\n * @module @huaweidevtools/aishell-dsh-credentials-store/signer\n */\n\nimport crypto from 'node:crypto'\n\n/** Credentials for signing. */\nexport interface SignCredentials {\n  readonly ak: string\n  readonly sk: string\n  readonly securityToken?: string\n}\n\n/** The headers produced by {@link sign}. */\nexport interface SignedHeaders {\n  readonly host: string\n  readonly 'x-sdk-date': string\n  readonly Authorization: string\n  readonly 'x-security-token'?: string\n}\n\nfunction sha256Hex(data: string): string {\n  return crypto.createHash('sha256').update(data).digest('hex')\n}\n\nfunction hmacSha256(key: string, data: string): string {\n  return crypto.createHmac('sha256', key).update(data).digest('hex')\n}\n\n/** RFC 3986 URL-encode a string (unreserved chars stay literal). */\nfunction urlEncode(str: string): string {\n  const hex = (c: number): string => '%' + (c < 16 ? '0' : '') + c.toString(16).toUpperCase()\n  const noEscape = new Set('ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.~'.split(''))\n  let out = ''\n  for (const ch of str) {\n    const c = ch.codePointAt(0)!\n    if (c < 0x80) {\n      out += noEscape.has(ch) ? ch : hex(c)\n    } else {\n      out += encodeURIComponent(ch)\n    }\n  }\n  return out\n}\n\n/** ISO 8601 timestamp in Huawei Cloud format: `20260912T064552Z`. */\nfunction sdkTimestamp(): string {\n  // toISOString() returns \"2026-09-12T06:45:52.123Z\"; strip separators and\n  // milliseconds but keep the trailing Z — do NOT append another one.\n  return new Date().toISOString().replace(/[-:]/g, '').replace(/\\.\\d+/, '')\n}\n\n/**\n * Code-unit comparison — the order the signing specification requires.\n *\n * Exported because it is the part of signing that is checkable without a\n * signature: everything downstream of it is a hash, so a test that compares two\n * signatures cannot tell a correct ordering from a consistently wrong one. See\n * `tests/format.spec.ts`.\n *\n * @param a - one string.\n * @param b - the other.\n * @returns negative, zero or positive in code-unit order.\n */\nexport function compareCodeUnits(a: string, b: string): number {\n  return a < b ? -1 : a > b ? 1 : 0\n}\n\n/**\n * Build the canonical query string, sorted by parameter name.\n *\n * ## Why byte order and not `localeCompare`\n *\n * The specification sorts by code point. Locale-aware collation disagrees with\n * it on mixed case: `Zebra` sorts *before* `apple` by code unit and *after* it\n * under the default locale. The signed string would then differ from the one\n * the gateway rebuilds from the same URL, and the request fails to authenticate\n * with nothing in the error naming the sort.\n *\n * Every caller in this repo passes lowercase ASCII parameter names today, which\n * is why this survived; `openapi_request` takes a URL from the model, so mixed\n * case reaches this path from outside.\n *\n * @param query - the query parameters.\n * @returns the canonical string, `k=v&k=v`, with both sides URL-encoded.\n */\nexport function canonicalQuery(query: Record<string, string>): string {\n  return Object.entries(query)\n    .sort(([a], [b]) => compareCodeUnits(a, b))\n    .map(([k, v]) => `${urlEncode(k)}=${urlEncode(v)}`)\n    .join('&')\n}\n\n/**\n * Sign an HTTP request with SDK-HMAC-SHA256.\n *\n * @param method - HTTP method (GET, POST, ...).\n * @param host - Host component of the request URL (e.g. `openai.aishell.openbuildlab.com`).\n * @param path - Path component of the request URL (e.g. `/chat/completions`).\n * @param query - Query parameters as a key-value map.\n * @param body - Request body (stringified for hashing; empty string for GET).\n * @param credentials - AK/SK and optional SecurityToken.\n * @returns The headers to attach to the fetch call.\n */\nexport function sign(\n  method: string,\n  host: string,\n  path: string,\n  query: Record<string, string>,\n  body: string,\n  credentials: SignCredentials,\n): SignedHeaders {\n  const ts = sdkTimestamp()\n  const cqs = canonicalQuery(query)\n\n  // Canonical URI: path segments URL-encoded, joined with /, trailing /\n  const curi = '/' + path.split('/').filter(Boolean).map(urlEncode).join('/') + '/'\n\n  // Signed headers\n  const hasToken = credentials.securityToken !== undefined\n  const signedHeaders = hasToken ? 'host;x-sdk-date;x-security-token' : 'host;x-sdk-date'\n  const canonicalHeaders = hasToken\n    ? `host:${host}\\nx-sdk-date:${ts}\\nx-security-token:${credentials.securityToken}\\n`\n    : `host:${host}\\nx-sdk-date:${ts}\\n`\n\n  // Payload hash\n  const payloadHash = sha256Hex(body)\n\n  // Canonical request\n  const canonicalRequest = [method, curi, cqs, canonicalHeaders, signedHeaders, payloadHash].join('\\n')\n\n  // String to sign\n  const stringToSign = `SDK-HMAC-SHA256\\n${ts}\\n${sha256Hex(canonicalRequest)}`\n  const signature = hmacSha256(credentials.sk, stringToSign)\n\n  const headers: SignedHeaders = {\n    host,\n    'x-sdk-date': ts,\n    Authorization: `SDK-HMAC-SHA256 Access=${credentials.ak}, SignedHeaders=${signedHeaders}, Signature=${signature}`,\n    ...(hasToken ? { 'x-security-token': credentials.securityToken } : {}),\n  }\n  return headers\n}\n"],"mappings":";;;AA4BA,SAAS,UAAUA,MAAsB;AACvC,QAAO,OAAO,WAAW,SAAS,CAAC,OAAO,KAAK,CAAC,OAAO,MAAM;AAC9D;AAED,SAAS,WAAWC,KAAaD,MAAsB;AACrD,QAAO,OAAO,WAAW,UAAU,IAAI,CAAC,OAAO,KAAK,CAAC,OAAO,MAAM;AACnE;;AAGD,SAAS,UAAUE,KAAqB;CACtC,MAAM,MAAM,CAACC,MAAsB,OAAO,IAAI,KAAK,MAAM,MAAM,EAAE,SAAS,GAAG,CAAC,aAAa;CAC3F,MAAM,WAAW,IAAI,IAAI,qEAAqE,MAAM,GAAG;CACvG,IAAI,MAAM;AACV,MAAK,MAAM,MAAM,KAAK;EACpB,MAAM,IAAI,GAAG,YAAY,EAAE;AAC3B,MAAI,IAAI,IACN,QAAO,SAAS,IAAI,GAAG,GAAG,KAAK,IAAI,EAAE;MAErC,QAAO,mBAAmB,GAAG;CAEhC;AACD,QAAO;AACR;;AAGD,SAAS,eAAuB;AAG9B,QAAO,IAAI,OAAO,aAAa,CAAC,QAAQ,SAAS,GAAG,CAAC,QAAQ,SAAS,GAAG;AAC1E;;;;;;;;;;;;;AAcD,SAAgB,iBAAiBC,GAAWC,GAAmB;AAC7D,QAAO,IAAI,IAAA,KAAS,IAAI,IAAI,IAAI;AACjC;;;;;;;;;;;;;;;;;;;AAoBD,SAAgB,eAAeC,OAAuC;AACpE,QAAO,OAAO,QAAQ,MAAM,CACzB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,iBAAiB,GAAG,EAAE,CAAC,CAC1C,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,CAClD,KAAK,IAAI;AACb;;;;;;;;;;;;AAaD,SAAgB,KACdC,QACAC,MACAC,MACAH,OACAI,MACAC,aACe;CACf,MAAM,KAAK,cAAc;CACzB,MAAM,MAAM,eAAe,MAAM;CAGjC,MAAM,OAAO,MAAM,KAAK,MAAM,IAAI,CAAC,OAAO,QAAQ,CAAC,IAAI,UAAU,CAAC,KAAK,IAAI,GAAG;CAG9E,MAAM,WAAW,YAAY;CAC7B,MAAM,gBAAgB,WAAW,qCAAqC;CACtE,MAAM,mBAAmB,YACpB,OAAO,KAAK,eAAe,GAAG,qBAAqB,YAAY,cAAc,OAC7E,OAAO,KAAK,eAAe,GAAG;CAGnC,MAAM,cAAc,UAAU,KAAK;CAGnC,MAAM,mBAAmB;EAAC;EAAQ;EAAM;EAAK;EAAkB;EAAe;CAAY,EAAC,KAAK,KAAK;CAGrG,MAAM,gBAAgB,mBAAmB,GAAG,IAAI,UAAU,iBAAiB,CAAC;CAC5E,MAAM,YAAY,WAAW,YAAY,IAAI,aAAa;CAE1D,MAAMC,UAAyB;EAC7B;EACA,cAAc;EACd,gBAAgB,yBAAyB,YAAY,GAAG,kBAAkB,cAAc,cAAc,UAAU;EAChH,GAAI,WAAW,EAAE,oBAAoB,YAAY,cAAe,IAAG,CAAE;CACtE;AACD,QAAO;AACR"}

package/lib/signer.d.ts

@@ -1,2 +1,2 @@
-import { SignCredentials, SignedHeaders, sign$1 as sign } from "./signer-Et0DIH6o.js";
-export { SignCredentials, SignedHeaders, sign };
+import { SignCredentials, SignedHeaders, canonicalQuery$1 as canonicalQuery, compareCodeUnits$1 as compareCodeUnits, sign$1 as sign } from "./signer-Bx88x7dI.js";
+export { SignCredentials, SignedHeaders, canonicalQuery, compareCodeUnits, sign };

package/lib/signer.js

@@ -1,3 +1,3 @@
-import { sign } from "./signer-BPR0UAF0.js";
+import { canonicalQuery, compareCodeUnits, sign } from "./signer-CVOjpi6y.js";
 
-export { sign };
+export { canonicalQuery, compareCodeUnits, sign };

package/lib/types/accounts.d.ts

@@ -1,18 +1,15 @@
 /**
  * The Huawei Cloud credential vocabulary every plugin in this set shares.
  *
- * ## Why this module exists
+ * ## Why one module owns the account names
  *
- * This repo once read the same keyring entries from four places, each declaring
- * the account names itself and re-implementing "read AK and SK as a pair". The
- * account names are a *persistence* contract, so a divergence would not fail a
- * build — it would surface as one plugin working and another reporting "not
- * authenticated" on a machine where the person had stored exactly one pair, and
- * the cause would be invisible in the diff that introduced it.
+ * The account names and the "AK and SK are one unit" rule are a *persistence*
+ * contract. A second declaration of either does not fail a build: it surfaces
+ * as one plugin working and another reporting "not authenticated" on a machine
+ * where exactly one pair is stored, and the diff that introduced it looks
+ * harmless. Keeping them in one file makes the contract have one owner.
  *
- * Everything now goes through this file.
- *
- * ## One entry, not three
+ * ## One record, holding the whole bundle
  *
  * The store holds **one** record, `aishell-credential`, whose value is a single
  * JSON bundle encoded as base64:
@@ -24,18 +21,16 @@
  * }
  * ```
  *
- * The earlier layout was three separate entries (`HW_ACCESS_KEY`,
- * `HW_SECRET_KEY`, `HW_SECURITY_TOKEN`). That had two problems this fixes:
- *
- *   - **A save was four operations.** Clear, then write AK, then SK, then
- *     token. Every backend is per-entry, so a failure between them left a
- *     half-set behind, and nothing rolled it back.
- *   - **A read was three reads.** A concurrent write landing between them could
- *     hand back a new AK with an old SK — a pair that passes "both present" and
- *     then fails at the gateway with 401, pointing nowhere near the cause.
+ * One record is what makes a save one operation and a read one consistent
+ * snapshot:
  *
- * One entry makes a write one atomic operation and a read one consistent
- * snapshot.
+ *   - **A save is one write.** Splitting the pair across entries makes every
+ *     save a sequence, and every backend is per-entry, so a failure between two
+ *     of them leaves a half-set behind that nothing rolls back.
+ *   - **A read is one read.** Reading the AK and the SK separately lets a
+ *     concurrent write land between them: the caller gets a new AK with an old
+ *     SK, which passes "both present" and then fails at the gateway with 401,
+ *     pointing nowhere near the cause.
  *
  * ## base64 is an encoding, not encryption
  *
@@ -50,9 +45,25 @@
  * back. Two processes doing that concurrently can lose one of the changes. That
  * is accepted rather than solved: the only writer is a person via the
  * credential form, and both the e2b key and the AK/SK are refreshed by that
- * same person. A lost update would be corrected by the next save. Solving it
+ * same person, so a lost update is corrected by the next save. Solving it
  * properly needs compare-and-swap, which the keyring API does not offer.
  *
+ * ## One accepted consequence: a partial bundle can overwrite an unreadable one
+ *
+ * A read that cannot decrypt the file reports "nothing stored", so an
+ * {@link updateCredentials} built on it computes its next bundle from an empty
+ * one and writes that. For `clearE2BKey` that means the written record carries
+ * only whatever the updater added, and the section it could not read is no
+ * longer in the live file.
+ *
+ * That is not repaired here, because there is nothing to repair it *from* — the
+ * bytes are unreadable. What limits the damage is the file backend's write path:
+ * an unreadable file is moved to `<name>.unreadable-<timestamp>` rather than
+ * overwritten, so the old record survives on disk and the next successful save
+ * starts from an empty map. A reader who cannot decrypt the file has already
+ * lost those credentials; the guarantee is only that the file they were in is
+ * not destroyed.
+ *
  * @module @huaweidevtools/aishell-dsh-credentials-store/accounts
  */
 import type { CredentialsStore } from './index.ts';
@@ -65,18 +76,22 @@ import type { SignCredentials } from './signer.ts';
  */
 export declare const CREDENTIAL_ACCOUNT = "aishell-credential";
 /**
- * Entries written by the earlier three-key layout, in the order they are read
- * during migration.
+ * The per-field account names a store may still hold beside the bundle.
+ *
+ * These are the read-side names of a store written field-by-field instead of
+ * as one record. {@link readCredentials} folds them into
+ * {@link CREDENTIAL_ACCOUNT} on first read, so a machine that holds them keeps
+ * working; nothing writes them.
  *
- * Kept only so an existing install keeps working: see {@link readCredentials}.
- * New writes never touch these.
+ * The order is the order the migration reads them: access key, secret key,
+ * token.
  */
 export declare const LEGACY_ACCOUNTS: readonly ["HW_ACCESS_KEY", "HW_SECRET_KEY", "HW_SECURITY_TOKEN"];
 /**
- * The legacy entry holding an e2b API key on its own.
+ * The standalone e2b key entry, beside the per-field names above.
  *
- * Folded into the bundle by {@link readCredentials}. Kept as a constant because
- * the migration has to name it.
+ * Folded into the bundle by {@link readCredentials}, for the same reason: a
+ * store written before the bundle existed keeps working. Nothing writes it.
  */
 export declare const LEGACY_E2B_ACCOUNT = "AISHELL_E2B_API_KEY";
 /** The Huawei Cloud pair, as the bundle stores it. Snake-case on disk. */
@@ -128,12 +143,12 @@ export declare function encodeBundle(bundle: CredentialBundle): string;
  */
 export declare function decodeBundle(raw: string | undefined): CredentialBundle;
 /**
- * Read the whole bundle, migrating a legacy layout on the way.
+ * Read the whole bundle, folding a per-field store into it on the way.
  *
- * Migration is lazy and idempotent: the first read that finds no bundle but
- * finds legacy entries merges them into one record, writes it, and removes the
- * old entries. A failed write leaves the legacy entries alone, so the next read
- * tries again — the person is never left with neither layout.
+ * The fold is lazy and idempotent: a read that finds no bundle but finds the
+ * per-field names merges them into one record, writes it, and removes the old
+ * entries. A failed write leaves them in place so the next read tries again —
+ * a store is never left with neither layout.
  *
  * @param store - the caller's credential store.
  * @returns the bundle; empty when nothing is stored.
@@ -182,11 +197,11 @@ export declare function readE2BKey(store: CredentialsStore): E2BSection | undefi
  */
 export declare function updateCredentials(store: CredentialsStore, update: (current: CredentialBundle) => CredentialBundle | undefined): CredentialBundle;
 /**
- * Store the Huawei Cloud pair, replacing any previous one.
+ * Store the Huawei Cloud pair, replacing whatever is there.
  *
  * One write, so the pair can never be left half-replaced. A save without a
- * token removes a previously stored one: a token belongs to the credential set
- * that carried it, and inheriting a stale one would sign the next request with
+ * token removes a stored one: a token belongs to the credential set that
+ * carried it, and inheriting a stale one would sign the next request with
  * someone else's session.
  *
  * @param store - the caller's credential store.
@@ -211,10 +226,17 @@ export declare function clearE2BKey(store: CredentialsStore): void;
  *
  * The whole record goes, so a clear cannot leave a token or a key behind for
  * the next pair to inherit. Deleting an absent entry is a no-op in every
- * backend, and the legacy entries are removed too so a half-migrated store does
- * not come back.
+ * backend.
+ *
+ * The per-field names are removed as well, so a store the fold never reached
+ * does not keep answering after a clear. Those deletes are best-effort and the
+ * main record's is not: a refusal on `CREDENTIAL_ACCOUNT` means the credentials
+ * are still there and the person has to be told, while the per-field names are
+ * leftovers whose removal nothing depends on. Swallowing the first would report
+ * a clear that did not happen.
  *
  * @param store - the caller's credential store.
+ * @throws when the backend refused to remove the main record.
  */
 export declare function clearCredentials(store: CredentialsStore): void;
 /**

package/lib/types/accounts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"accounts.d.ts","sourceRoot":"","sources":["../../src/accounts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,uBAAuB,CAAA;AAEtD;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,kEAAmE,CAAA;AAE/F;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,wBAAwB,CAAA;AAEvD,0EAA0E;AAC1E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CACjC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,yEAAyE;IACzE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CACjC;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,CAAA;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE,UAAU,CAAA;CAClC;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAE7D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,gBAAgB,CAoBtE;AAoCD;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,gBAAgB,GAAG,gBAAgB,CAOzE;AAsED,0DAA0D;AAC1D,eAAO,MAAM,cAAc,6BAA6B,CAAA;AAExD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,gBAAgB,GAAG,eAAe,GAAG,SAAS,CAQnF;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,gBAAgB,GAAG,UAAU,GAAG,SAAS,CAE1E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,gBAAgB,EACvB,MAAM,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,gBAAgB,GAAG,SAAS,GAClE,gBAAgB,CAMlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,eAAe,GAAG,IAAI,CAS5F;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,UAAU,GAAG,IAAI,CAE1E;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAMzD;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAI9D;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE9C"}
+{"version":3,"file":"accounts.d.ts","sourceRoot":"","sources":["../../src/accounts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,uBAAuB,CAAA;AAEtD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe,kEAAmE,CAAA;AAE/F;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,wBAAwB,CAAA;AAEvD,0EAA0E;AAC1E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CACjC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,yEAAyE;IACzE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CACjC;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,CAAA;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE,UAAU,CAAA;CAClC;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAE7D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,gBAAgB,CAoBtE;AAoCD;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,gBAAgB,GAAG,gBAAgB,CAOzE;AA8ED,0DAA0D;AAC1D,eAAO,MAAM,cAAc,6BAA6B,CAAA;AA2BxD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,gBAAgB,GAAG,eAAe,GAAG,SAAS,CAQnF;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,gBAAgB,GAAG,UAAU,GAAG,SAAS,CAE1E;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,gBAAgB,EACvB,MAAM,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,gBAAgB,GAAG,SAAS,GAClE,gBAAgB,CAMlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,eAAe,GAAG,IAAI,CAS5F;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,UAAU,GAAG,IAAI,CAE1E;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAMzD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAI9D;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE9C"}