@numa-tech/numa 1.14.32 → 1.14.34

package/dist/config.js

@@ -75,7 +75,16 @@ function envInteger(name, defaultValue) {
     }
     return parsed;
 }
+function authenticationModeFromEnv() {
+    const raw = process.env.NUMA_KEYCLOAK_AUTH_MODE?.trim().toLowerCase().replace(/-/gu, "_") ?? "browser";
+    if (raw === "browser" || raw === "authorization_code")
+        return "browser";
+    if (raw === "client_credentials")
+        return "client_credentials";
+    throw new Error("NUMA_KEYCLOAK_AUTH_MODE must be browser or client_credentials");
+}
 export function loadConfig(serviceKey = "platform") {
+    const authenticationMode = authenticationModeFromEnv();
     const discovery = discoveryUrlFromEnv();
     const appConfig = loadAppConfigSync();
     const selected = requireProfileService(serviceKey);
@@ -85,6 +94,9 @@ export function loadConfig(serviceKey = "platform") {
             : selected?.authority.discoveryUrl ?? discovery.discoveryUrl);
     const issuerUrl = discovery.issuerUrl
         ?? selected?.authority.issuer;
+    if (authenticationMode === "client_credentials" && !process.env.NUMA_KEYCLOAK_CLIENT_ID?.trim()) {
+        throw new Error("NUMA_KEYCLOAK_CLIENT_ID is required in client_credentials mode; the public mcp-client cannot be reused.");
+    }
     const clientId = process.env.NUMA_KEYCLOAK_CLIENT_ID ?? selected?.authority.clientId ?? DEFAULT_CLIENT_ID;
     const tokenKey = selected
         ? createHash("sha256").update(`${issuerUrl ?? discoveryUrl}\0${clientId}\0${selected.profile.tenant.id}\0${selected.service.audience}`).digest("hex").slice(0, 24)
@@ -97,9 +109,11 @@ export function loadConfig(serviceKey = "platform") {
             profileTenantId: selected.profile.tenant.id,
             resourceAudience: selected.service.audience
         } : {}),
+        authenticationMode,
         clientSecret: process.env.NUMA_KEYCLOAK_CLIENT_SECRET || undefined,
+        clientSecretFile: process.env.NUMA_KEYCLOAK_CLIENT_SECRET_FILE || undefined,
         scope: process.env.NUMA_KEYCLOAK_SCOPES ?? process.env.NUMA_KEYCLOAK_SCOPE
-            ?? selected?.authority.scopes.join(" ") ?? DEFAULT_SCOPE,
+            ?? (authenticationMode === "client_credentials" ? "" : selected?.authority.scopes.join(" ") ?? DEFAULT_SCOPE),
         tokenFile: process.env.NUMA_TOKEN_CACHE_PATH ?? process.env.NUMA_AUTH_TOKEN_FILE
             ?? (tokenKey ? join(appConfigDirectory(), `keycloak-token-${tokenKey}.json`) : defaultTokenFile()),
         redirectHost: redirectHostFromEnv(),

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAA2B,MAAM,uBAAuB,CAAC;AAoBvF,MAAM,CAAC,MAAM,qBAAqB,GAChC,gFAAgF,CAAC;AACnF,MAAM,CAAC,MAAM,iBAAiB,GAAG,YAAY,CAAC;AAC9C,MAAM,CAAC,MAAM,aAAa,GAAG,qCAAqC,CAAC;AACnE,MAAM,UAAU,gBAAgB;IAC9B,OAAO,IAAI,CAAC,kBAAkB,EAAE,EAAE,qBAAqB,CAAC,CAAC;AAC3D,CAAC;AACD,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAC;AACjD,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAE1C,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;IAClE,IAAI,iBAAiB;QAAE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,CAAC;IAElE,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;IAC5D,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,SAAS,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC;QACpD,OAAO;YACL,SAAS;YACT,YAAY,EAAE,GAAG,SAAS,mCAAmC;SAC9D,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAC9C,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;QACrB,MAAM,SAAS,GAAG,GAAG,iBAAiB,CAAC,OAAO,CAAC,WAAW,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QACtF,OAAO;YACL,SAAS;YACT,YAAY,EAAE,GAAG,SAAS,mCAAmC;SAC9D,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAC3D,IAAI,CAAC,WAAW;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,qBAAqB,CAAC;IACtF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,OAAO,GAAG,CAAC,QAAQ,CAAC;AACtB,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAC3D,IAAI,CAAC,WAAW;QAAE,OAAO,UAAU,CAAC,yBAAyB,EAAE,qBAAqB,CAAC,CAAC;IACtF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAC3D,IAAI,CAAC,WAAW;QAAE,OAAO,WAAW,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;IAC3C,OAAO,IAAI,IAAI,WAAW,CAAC;AAC7B,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,YAAqB;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,YAAY,CAAC;IACvD,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,YAAoB;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,OAAO,YAAY,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,MAAM,GAAG,KAAK,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,8CAA8C,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,UAAU,GAAuB,UAAU;IACpE,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B;WACvD,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;YACjH,CAAC,CAAC,SAAS,CAAC,YAAY;YACxB,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,YAAY,IAAI,SAAS,CAAC,YAAY,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS;WAChC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC;IAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IAC1G,MAAM,QAAQ,GAAG,QAAQ;QACvB,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,YAAY,KAAK,QAAQ,KAAK,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAClK,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,YAAY;QACZ,SAAS;QACT,QAAQ;QACR,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YACb,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;YAC3C,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ;SAC5C,CAAC,CAAC,CAAC,EAAE,CAAC;QACP,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,SAAS;QAClE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB;eACrE,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,aAAa;QAC1D,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB;eAC3E,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,kBAAkB,QAAQ,OAAO,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC;QACpG,YAAY,EAAE,mBAAmB,EAAE;QACnC,YAAY,EAAE,mBAAmB,EAAE;QACnC,YAAY,EAAE,mBAAmB,EAAE;QACnC,WAAW,EAAE,UAAU,CAAC,wBAAwB,EAAE,IAAI,CAAC;QACvD,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,QAAQ,EAAE,OAAO,CAAC,OAAO,IAAI,SAAS,CAAC,UAAU,IAAI,SAAS;QACnH,aAAa,EAAE,QAAQ,EAAE,OAAO,CAAC,aAAa;QAC9C,wBAAwB,EAAE,UAAU,CAAC,kCAAkC,EAAE,KAAK,CAAC;KAChF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAkB;IAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,0BAA0B;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAC1F,OAAO,UAAU,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;AACtF,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAA2B,MAAM,uBAAuB,CAAC;AAsBvF,MAAM,CAAC,MAAM,qBAAqB,GAChC,gFAAgF,CAAC;AACnF,MAAM,CAAC,MAAM,iBAAiB,GAAG,YAAY,CAAC;AAC9C,MAAM,CAAC,MAAM,aAAa,GAAG,qCAAqC,CAAC;AACnE,MAAM,UAAU,gBAAgB;IAC9B,OAAO,IAAI,CAAC,kBAAkB,EAAE,EAAE,qBAAqB,CAAC,CAAC;AAC3D,CAAC;AACD,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAC;AACjD,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAE1C,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC;IAClE,IAAI,iBAAiB;QAAE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,CAAC;IAElE,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;IAC5D,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,SAAS,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC;QACpD,OAAO;YACL,SAAS;YACT,YAAY,EAAE,GAAG,SAAS,mCAAmC;SAC9D,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAC9C,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;QACrB,MAAM,SAAS,GAAG,GAAG,iBAAiB,CAAC,OAAO,CAAC,WAAW,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QACtF,OAAO;YACL,SAAS;YACT,YAAY,EAAE,GAAG,SAAS,mCAAmC;SAC9D,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAC3D,IAAI,CAAC,WAAW;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,qBAAqB,CAAC;IACtF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,OAAO,GAAG,CAAC,QAAQ,CAAC;AACtB,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAC3D,IAAI,CAAC,WAAW;QAAE,OAAO,UAAU,CAAC,yBAAyB,EAAE,qBAAqB,CAAC,CAAC;IACtF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAC3D,IAAI,CAAC,WAAW;QAAE,OAAO,WAAW,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;IAC3C,OAAO,IAAI,IAAI,WAAW,CAAC;AAC7B,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,YAAqB;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,YAAY,CAAC;IACvD,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,YAAoB;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK;QAAE,OAAO,YAAY,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,MAAM,GAAG,KAAK,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,8CAA8C,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,yBAAyB;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,SAAS,CAAC;IACvG,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,oBAAoB;QAAE,OAAO,SAAS,CAAC;IACxE,IAAI,GAAG,KAAK,oBAAoB;QAAE,OAAO,oBAAoB,CAAC;IAC9D,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,UAAU,GAAuB,UAAU;IACpE,MAAM,kBAAkB,GAAG,yBAAyB,EAAE,CAAC;IACvD,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B;WACvD,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;YACjH,CAAC,CAAC,SAAS,CAAC,YAAY;YACxB,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,YAAY,IAAI,SAAS,CAAC,YAAY,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS;WAChC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC;IAChC,IAAI,kBAAkB,KAAK,oBAAoB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,EAAE,CAAC;QAChG,MAAM,IAAI,KAAK,CAAC,yGAAyG,CAAC,CAAC;IAC7H,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IAC1G,MAAM,QAAQ,GAAG,QAAQ;QACvB,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,YAAY,KAAK,QAAQ,KAAK,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAClK,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,YAAY;QACZ,SAAS;QACT,QAAQ;QACR,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YACb,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;YAC3C,gBAAgB,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ;SAC5C,CAAC,CAAC,CAAC,EAAE,CAAC;QACP,kBAAkB;QAClB,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,SAAS;QAClE,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,gCAAgC,IAAI,SAAS;QAC3E,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB;eACrE,CAAC,kBAAkB,KAAK,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC;QAC/G,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB;eAC3E,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,kBAAkB,QAAQ,OAAO,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC;QACpG,YAAY,EAAE,mBAAmB,EAAE;QACnC,YAAY,EAAE,mBAAmB,EAAE;QACnC,YAAY,EAAE,mBAAmB,EAAE;QACnC,WAAW,EAAE,UAAU,CAAC,wBAAwB,EAAE,IAAI,CAAC;QACvD,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,QAAQ,EAAE,OAAO,CAAC,OAAO,IAAI,SAAS,CAAC,UAAU,IAAI,SAAS;QACnH,aAAa,EAAE,QAAQ,EAAE,OAAO,CAAC,aAAa;QAC9C,wBAAwB,EAAE,UAAU,CAAC,kCAAkC,EAAE,KAAK,CAAC;KAChF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAkB;IAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,0BAA0B;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAC1F,OAAO,UAAU,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;AACtF,CAAC"}

package/dist/oss/client.d.ts

@@ -0,0 +1,18 @@
+import type { AuthConfig } from "../config.js";
+import { type KeycloakTokenProvider } from "../oauth.js";
+import { type AccessGrant, type AccessGrantsResponse, type AccessSession } from "./schemas.js";
+export declare const MACHINE_IDENTITY_TEST_BUCKET = "mcexp-oss-dev";
+export interface OssClientDependencies {
+    fetch?: typeof fetch;
+    tokenProvider?: KeycloakTokenProvider;
+}
+export declare class OssClient {
+    private readonly config;
+    private readonly fetchImpl;
+    private readonly tokenProvider;
+    constructor(config: AuthConfig, dependencies?: OssClientDependencies);
+    private json;
+    listGrants(): Promise<AccessGrantsResponse>;
+    issueSession(grantId: number, ttlSeconds?: number): Promise<AccessSession>;
+    resolveGrant(grantId: number): Promise<AccessGrant>;
+}

package/dist/oss/client.js

@@ -0,0 +1,90 @@
+import { resolveBackendUrl } from "../backend.js";
+import { ensureAccessToken, fetchWithKeycloakIdentity } from "../oauth.js";
+import { AccessGrantsResponseSchema, AccessSessionSchema, ApiErrorSchema } from "./schemas.js";
+import { OssError } from "./errors.js";
+export const MACHINE_IDENTITY_TEST_BUCKET = "mcexp-oss-dev";
+function validateGrantId(grantId) {
+    if (!Number.isSafeInteger(grantId) || grantId <= 0) {
+        throw new OssError("grantId must be a positive integer.", "oss_input_invalid");
+    }
+}
+function validateTtl(ttlSeconds) {
+    if (ttlSeconds != null && (!Number.isSafeInteger(ttlSeconds) || ttlSeconds < 900 || ttlSeconds > 3600)) {
+        throw new OssError("TTL must be an integer between 900 and 3600 seconds.", "oss_input_invalid");
+    }
+}
+async function responseBody(response) {
+    const text = await response.text();
+    if (!text)
+        return {};
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+function requestIdFrom(response, body) {
+    if (body && typeof body === "object" && "requestId" in body && typeof body.requestId === "string") {
+        return body.requestId;
+    }
+    return response.headers.get("x-request-id") ?? undefined;
+}
+function apiFailure(response, body) {
+    const parsed = ApiErrorSchema.safeParse(body);
+    const message = parsed.success
+        ? parsed.data.message ?? response.statusText ?? "OSS API request failed."
+        : typeof body === "string" ? body : response.statusText || "OSS API request failed.";
+    return new OssError(`OSS API HTTP ${response.status}: ${message}`, parsed.success ? parsed.data.code ?? "oss_api_error" : "oss_api_error", response.status, requestIdFrom(response, body));
+}
+export class OssClient {
+    config;
+    fetchImpl;
+    tokenProvider;
+    constructor(config, dependencies = {}) {
+        this.config = config;
+        this.fetchImpl = dependencies.fetch ?? fetch;
+        this.tokenProvider = dependencies.tokenProvider ?? ensureAccessToken;
+    }
+    async json(path, schema, init = {}, expectedStatuses = [200]) {
+        const url = resolveBackendUrl(this.config, { method: init.method ?? "GET", path });
+        const headers = new Headers(init.headers);
+        headers.set("Accept", "application/json");
+        if (init.body != null)
+            headers.set("Content-Type", "application/json");
+        const response = await fetchWithKeycloakIdentity(this.config, url, () => ({ ...init, headers }), { fetch: this.fetchImpl, tokenProvider: this.tokenProvider });
+        const body = await responseBody(response);
+        if (!response.ok)
+            throw apiFailure(response, body);
+        if (!expectedStatuses.includes(response.status)) {
+            throw new OssError(`OSS API returned HTTP ${response.status}; expected ${expectedStatuses.join(" or ")}.`, "oss_invalid_response", response.status, requestIdFrom(response, body));
+        }
+        const parsed = schema.safeParse(body);
+        if (!parsed.success) {
+            throw new OssError(`OSS API returned an invalid response: ${parsed.error.message}`, "oss_invalid_response", response.status, requestIdFrom(response, body));
+        }
+        return parsed.data;
+    }
+    async listGrants() {
+        return this.json("/api/v1/oss/access-grants", AccessGrantsResponseSchema);
+    }
+    async issueSession(grantId, ttlSeconds) {
+        validateGrantId(grantId);
+        validateTtl(ttlSeconds);
+        const session = await this.json("/api/v1/oss/access-sessions", AccessSessionSchema, { method: "POST", body: JSON.stringify({ grantId, ...(ttlSeconds == null ? {} : { ttlSeconds }) }) }, [201]);
+        if (this.config.authenticationMode === "client_credentials"
+            && session.bucketName !== MACHINE_IDENTITY_TEST_BUCKET) {
+            throw new OssError(`Machine identity OSS access is temporarily limited to ${MACHINE_IDENTITY_TEST_BUCKET}.`, "oss_machine_bucket_forbidden", 403);
+        }
+        return session;
+    }
+    async resolveGrant(grantId) {
+        validateGrantId(grantId);
+        const response = await this.listGrants();
+        const grant = response.grants.find((candidate) => candidate.grantId === grantId);
+        if (!grant)
+            throw new OssError(`OSS grant ${grantId} is not available to the current identity.`, "oss_grant_forbidden", 403, response.requestId);
+        return grant;
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/oss/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/oss/client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAA8B,MAAM,aAAa,CAAC;AACvG,OAAO,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,cAAc,EAAmE,MAAM,cAAc,CAAC;AAChK,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,MAAM,CAAC,MAAM,4BAA4B,GAAG,eAAe,CAAC;AAO5D,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,QAAQ,CAAC,qCAAqC,EAAE,mBAAmB,CAAC,CAAC;IACjF,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,UAA8B;IACjD,IAAI,UAAU,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,GAAG,IAAI,UAAU,GAAG,IAAI,CAAC,EAAE,CAAC;QACvG,MAAM,IAAI,QAAQ,CAAC,sDAAsD,EAAE,mBAAmB,CAAC,CAAC;IAClG,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,QAAkB;IAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,QAAkB,EAAE,IAAa;IACtD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,WAAW,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClG,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC;AAC3D,CAAC;AAED,SAAS,UAAU,CAAC,QAAkB,EAAE,IAAa;IACnD,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO;QAC5B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,UAAU,IAAI,yBAAyB;QACzE,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,IAAI,yBAAyB,CAAC;IACvF,OAAO,IAAI,QAAQ,CACjB,gBAAgB,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,EAC7C,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,eAAe,CAAC,CAAC,CAAC,eAAe,EACtE,QAAQ,CAAC,MAAM,EACf,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,SAAS;IAKD,MAAM;IAJR,SAAS,CAAe;IACxB,aAAa,CAAwB;IAEtD,YACmB,MAAkB,EACnC,YAAY,GAA0B,EAAE;sBADvB,MAAM;QAGvB,IAAI,CAAC,SAAS,GAAG,YAAY,CAAC,KAAK,IAAI,KAAK,CAAC;QAC7C,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC,aAAa,IAAI,iBAAiB,CAAC;IACvE,CAAC;IAEO,KAAK,CAAC,IAAI,CAChB,IAAY,EACZ,MAAkH,EAClH,IAAI,GAAgB,EAAE,EACtB,gBAAgB,GAAa,CAAC,GAAG,CAAC;QAElC,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAG,IAAI,CAAC,MAAqC,IAAI,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACnH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAC9C,IAAI,CAAC,MAAM,EACX,GAAG,EACH,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,EAC5B,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAC7D,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,QAAQ,CAChB,yBAAyB,QAAQ,CAAC,MAAM,cAAc,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EACtF,sBAAsB,EACtB,QAAQ,CAAC,MAAM,EACf,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAC9B,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,QAAQ,CAChB,yCAAyC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAC/D,sBAAsB,EACtB,QAAQ,CAAC,MAAM,EACf,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAC9B,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,2BAA2B,EAAE,0BAA0B,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,UAAmB;QACrD,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,WAAW,CAAC,UAAU,CAAC,CAAC;QACxB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAC7B,6BAA6B,EAC7B,mBAAmB,EACnB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,EAAE,EACpG,CAAC,GAAG,CAAC,CACN,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,KAAK,oBAAoB;eACtD,OAAO,CAAC,UAAU,KAAK,4BAA4B,EAAE,CAAC;YACzD,MAAM,IAAI,QAAQ,CAChB,yDAAyD,4BAA4B,GAAG,EACxF,8BAA8B,EAC9B,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,OAAe;QAChC,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;QACjF,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,QAAQ,CAAC,aAAa,OAAO,4CAA4C,EAAE,qBAAqB,EAAE,GAAG,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QACjJ,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/oss/commands.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function registerOssCommands(program: Command): void;

package/dist/oss/commands.js

@@ -0,0 +1,137 @@
+import process from "node:process";
+import { loadAppConfig } from "../app-config.js";
+import { loadConfig } from "../config.js";
+import { OssClient } from "./client.js";
+import { OssError, sanitizeOssOutput } from "./errors.js";
+import { sessionMetadata, OssTransferClient } from "./transfers.js";
+function jsonEnabled(command, configuredOutput) {
+    return Boolean(command.optsWithGlobals().json || configuredOutput === "json");
+}
+function printJson(value) {
+    process.stdout.write(`${JSON.stringify(sanitizeOssOutput(value), null, 2)}\n`);
+}
+async function output(command, payload, text) {
+    const config = await loadAppConfig();
+    if (jsonEnabled(command, config.output))
+        printJson(payload);
+    else
+        process.stdout.write(`${text}\n`);
+}
+function grantId(value) {
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed) || parsed <= 0)
+        throw new OssError("grantId must be a positive integer.", "oss_input_invalid");
+    return parsed;
+}
+function ttl(value) {
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed < 900 || parsed > 3600) {
+        throw new OssError("TTL must be an integer between 900 and 3600 seconds.", "oss_input_invalid");
+    }
+    return parsed;
+}
+function limit(value) {
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed < 1 || parsed > 1000) {
+        throw new OssError("Limit must be an integer between 1 and 1000.", "oss_input_invalid");
+    }
+    return parsed;
+}
+function key(value, label = "object key") {
+    const trimmed = value.trim();
+    if (!trimmed || trimmed.length > 1024 || /[\\\u0000-\u001f\u007f]/u.test(trimmed) || trimmed.split("/").some((segment) => segment === "." || segment === "..")) {
+        throw new OssError(`${label} is invalid.`, "oss_input_invalid");
+    }
+    return trimmed;
+}
+function yes(value, action) {
+    if (!value)
+        throw new OssError(`${action} requires --yes.`, "oss_confirmation_required");
+}
+export function registerOssCommands(program) {
+    const oss = program
+        .command("oss")
+        .description("使用平台签发的短期 STS 直接读写受限 Aliyun OSS（凭据仅保存在内存）");
+    oss
+        .command("grants")
+        .description("列出当前 Keycloak 身份可使用的 OSS Role 授权")
+        .action(async (_options, command) => {
+        const result = await new OssClient(loadConfig("platform")).listGrants();
+        await output(command, { ok: true, request_id: result.requestId ?? null, grants: result.grants }, result.grants.length ? `可用 OSS 授权: ${result.grants.length}` : "当前身份没有可用 OSS 授权");
+    });
+    oss
+        .command("session <grantId>")
+        .description("申请短期 STS；只输出会话元数据，不输出 AccessKey Secret 或 SecurityToken")
+        .option("--ttl <seconds>", "STS 有效期，900-3600 秒", ttl)
+        .action(async (grant, options, command) => {
+        const session = await new OssClient(loadConfig("platform")).issueSession(grantId(grant), options.ttl);
+        await output(command, { ok: true, session: sessionMetadata(session) }, `OSS STS 已签发: ${session.roleName}，到期 ${session.expiration}`);
+    });
+    const transfer = new OssTransferClient();
+    oss
+        .command("ls <grantId> [prefix]")
+        .description("列出授权前缀下的 OSS 对象")
+        .option("-l, --limit <number>", "返回条数，1-1000", limit, 100)
+        .option("--ttl <seconds>", "STS 有效期，900-3600 秒", ttl)
+        .action(async (grant, prefix, options, command) => {
+        const parsedGrantId = grantId(grant);
+        const parsedPrefix = prefix?.trim() ? key(prefix, "prefix") : undefined;
+        const client = new OssClient(loadConfig("platform"));
+        const session = await client.issueSession(parsedGrantId, options.ttl);
+        const result = await transfer.list(session, parsedPrefix, options.limit);
+        await output(command, { ok: true, session: sessionMetadata(session), listing: result }, `OSS 对象 ${result.objects.length} 个${result.truncated ? "（还有更多）" : ""}`);
+    });
+    oss
+        .command("stat <grantId> <key>")
+        .description("读取授权范围内对象的安全元数据")
+        .option("--ttl <seconds>", "STS 有效期，900-3600 秒", ttl)
+        .action(async (grant, objectKey, options, command) => {
+        const parsedGrantId = grantId(grant);
+        const parsedKey = key(objectKey);
+        const session = await new OssClient(loadConfig("platform")).issueSession(parsedGrantId, options.ttl);
+        const result = await transfer.stat(session, parsedKey);
+        await output(command, { ok: true, session: sessionMetadata(session), object: result }, `OSS 对象: ${objectKey}`);
+    });
+    oss
+        .command("get <grantId> <key>")
+        .description("下载对象到不存在的本地文件，使用临时文件原子落盘")
+        .requiredOption("-o, --output <file>", "目标文件；为避免覆盖，路径必须不存在")
+        .option("--ttl <seconds>", "STS 有效期，900-3600 秒", ttl)
+        .action(async (grant, objectKey, options, command) => {
+        const parsedGrantId = grantId(grant);
+        const parsedKey = key(objectKey);
+        if (!options.output.trim())
+            throw new OssError("Download output path is required.", "oss_input_invalid");
+        const session = await new OssClient(loadConfig("platform")).issueSession(parsedGrantId, options.ttl);
+        const result = await transfer.download(session, parsedKey, options.output);
+        await output(command, { ok: true, session: sessionMetadata(session), object: result }, `OSS 对象已下载: ${result.outputPath}`);
+    });
+    oss
+        .command("put <grantId> <key> <file>")
+        .description("上传本地文件；默认禁止覆盖已有对象")
+        .option("--overwrite", "显式允许覆盖已有 OSS 对象")
+        .option("--ttl <seconds>", "STS 有效期，900-3600 秒", ttl)
+        .action(async (grant, objectKey, file, options, command) => {
+        const parsedGrantId = grantId(grant);
+        const parsedKey = key(objectKey);
+        if (!file.trim())
+            throw new OssError("Upload source file is required.", "oss_input_invalid");
+        const session = await new OssClient(loadConfig("platform")).issueSession(parsedGrantId, options.ttl);
+        const result = await transfer.upload(session, parsedKey, file, Boolean(options.overwrite));
+        await output(command, { ok: true, session: sessionMetadata(session), object: result }, `OSS 对象已上传: ${result.key} (${result.sizeBytes} bytes)`);
+    });
+    oss
+        .command("rm <grantId> <key>")
+        .description("删除授权范围内对象；必须显式确认")
+        .requiredOption("--yes", "确认删除 OSS 对象")
+        .option("--ttl <seconds>", "STS 有效期，900-3600 秒", ttl)
+        .action(async (grant, objectKey, options, command) => {
+        yes(options.yes, "删除 OSS 对象");
+        const parsedGrantId = grantId(grant);
+        const parsedKey = key(objectKey);
+        const session = await new OssClient(loadConfig("platform")).issueSession(parsedGrantId, options.ttl);
+        const result = await transfer.remove(session, parsedKey);
+        await output(command, { ok: true, session: sessionMetadata(session), object: result }, `OSS 对象已删除: ${result.key}`);
+    });
+}
+//# sourceMappingURL=commands.js.map

package/dist/oss/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../src/oss/commands.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEpE,SAAS,WAAW,CAAC,OAAgB,EAAE,gBAAiC;IACtE,OAAO,OAAO,CAAC,OAAO,CAAC,eAAe,EAAsB,CAAC,IAAI,IAAI,gBAAgB,KAAK,MAAM,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACjF,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,OAAgB,EAAE,OAAgB,EAAE,IAAY;IACpE,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;IACrC,IAAI,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;QAAE,SAAS,CAAC,OAAO,CAAC,CAAC;;QACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,qCAAqC,EAAE,mBAAmB,CAAC,CAAC;IACjI,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,GAAG,CAAC,KAAa;IACxB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,GAAG,IAAI,EAAE,CAAC;QAC/D,MAAM,IAAI,QAAQ,CAAC,sDAAsD,EAAE,mBAAmB,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAC,KAAa;IAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,IAAI,EAAE,CAAC;QAC7D,MAAM,IAAI,QAAQ,CAAC,8CAA8C,EAAE,mBAAmB,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,GAAG,CAAC,KAAa,EAAE,KAAK,GAAG,YAAY;IAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/J,MAAM,IAAI,QAAQ,CAAC,GAAG,KAAK,cAAc,EAAE,mBAAmB,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,GAAG,CAAC,KAA0B,EAAE,MAAc;IACrD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,QAAQ,CAAC,GAAG,MAAM,kBAAkB,EAAE,2BAA2B,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,GAAG,GAAG,OAAO;SAChB,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,2CAA2C,CAAC,CAAC;IAE5D,GAAG;SACA,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,kCAAkC,CAAC;SAC/C,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAgB,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;QACxE,MAAM,MAAM,CACV,OAAO,EACP,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EACzE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAChF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CAAC,wDAAwD,CAAC;SACrE,MAAM,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,GAAG,CAAC;SACpD,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,OAAyB,EAAE,OAAgB,EAAE,EAAE;QAC3E,MAAM,OAAO,GAAG,MAAM,IAAI,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACtG,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE,gBAAgB,OAAO,CAAC,QAAQ,OAAO,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACtI,CAAC,CAAC,CAAC;IAEL,MAAM,QAAQ,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAEzC,GAAG;SACA,OAAO,CAAC,uBAAuB,CAAC;SAChC,WAAW,CAAC,iBAAiB,CAAC;SAC9B,MAAM,CAAC,sBAAsB,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,CAAC;SACzD,MAAM,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,GAAG,CAAC;SACpD,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,MAA0B,EAAE,OAAwC,EAAE,OAAgB,EAAE,EAAE;QACtH,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,YAAY,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACzE,MAAM,MAAM,CACV,OAAO,EACP,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAChE,UAAU,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CACvE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,sBAAsB,CAAC;SAC/B,WAAW,CAAC,iBAAiB,CAAC;SAC9B,MAAM,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,GAAG,CAAC;SACpD,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,SAAiB,EAAE,OAAyB,EAAE,OAAgB,EAAE,EAAE;QAC9F,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACrG,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACvD,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,WAAW,SAAS,EAAE,CAAC,CAAC;IACjH,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,qBAAqB,CAAC;SAC9B,WAAW,CAAC,0BAA0B,CAAC;SACvC,cAAc,CAAC,qBAAqB,EAAE,oBAAoB,CAAC;SAC3D,MAAM,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,GAAG,CAAC;SACpD,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,SAAiB,EAAE,OAAyC,EAAE,OAAgB,EAAE,EAAE;QAC9G,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE;YAAE,MAAM,IAAI,QAAQ,CAAC,mCAAmC,EAAE,mBAAmB,CAAC,CAAC;QACzG,MAAM,OAAO,GAAG,MAAM,IAAI,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACrG,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3E,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,cAAc,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAC5H,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,4BAA4B,CAAC;SACrC,WAAW,CAAC,mBAAmB,CAAC;SAChC,MAAM,CAAC,aAAa,EAAE,iBAAiB,CAAC;SACxC,MAAM,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,GAAG,CAAC;SACpD,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,SAAiB,EAAE,IAAY,EAAE,OAA8C,EAAE,OAAgB,EAAE,EAAE;QACjI,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,MAAM,IAAI,QAAQ,CAAC,iCAAiC,EAAE,mBAAmB,CAAC,CAAC;QAC7F,MAAM,OAAO,GAAG,MAAM,IAAI,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACrG,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAC3F,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,cAAc,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,SAAS,SAAS,CAAC,CAAC;IACjJ,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,oBAAoB,CAAC;SAC7B,WAAW,CAAC,kBAAkB,CAAC;SAC/B,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC;SACtC,MAAM,CAAC,iBAAiB,EAAE,oBAAoB,EAAE,GAAG,CAAC;SACpD,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,SAAiB,EAAE,OAAwC,EAAE,OAAgB,EAAE,EAAE;QAC7G,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC9B,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACrG,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACzD,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,cAAc,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IACrH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/oss/errors.d.ts

@@ -0,0 +1,15 @@
+/**
+ * OSS SDK failures can include signed request URLs or a serialized request
+ * object.  Keep this redaction local to the OSS boundary instead of relying on
+ * the media sanitizer, whose key list intentionally does not include all of
+ * the STS field names used by Aliyun.
+ */
+export declare function redactOssSensitiveText(value: string): string;
+/** Recursively remove credentials from payloads before they reach stdout. */
+export declare function sanitizeOssOutput(value: unknown, key?: string): unknown;
+export declare class OssError extends Error {
+    readonly code: string;
+    readonly status?: number | undefined;
+    readonly requestId?: string | undefined;
+    constructor(message: string, code: string, status?: number | undefined, requestId?: string | undefined);
+}

package/dist/oss/errors.js

@@ -0,0 +1,42 @@
+import { redactSensitiveText } from "../media/errors.js";
+/**
+ * OSS SDK failures can include signed request URLs or a serialized request
+ * object.  Keep this redaction local to the OSS boundary instead of relying on
+ * the media sanitizer, whose key list intentionally does not include all of
+ * the STS field names used by Aliyun.
+ */
+export function redactOssSensitiveText(value) {
+    return redactSensitiveText(value)
+        .replace(/([?&\s](?:OSSAccessKeyId|OSSAccessKeySecret|AccessKeyId|AccessKeySecret|SecurityToken|stsToken|security_token|sts_token|access[-_]key[-_]id|access[-_]key[-_]secret)=)[^&#\s]+/giu, "$1[REDACTED]")
+        .replace(/(["']?(?:OSSAccessKeyId|OSSAccessKeySecret|AccessKeyId|AccessKeySecret|SecurityToken|stsToken|security_token|sts_token|access[-_]key[-_]id|access[-_]key[-_]secret|credentials?|secret)["']?\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;}&#]+)/giu, "$1[REDACTED]");
+}
+function isSensitiveOutputKey(key) {
+    return /^(?:authorization|access[_-]?key[_-]?(?:id|secret)?|ossaccesskeyid|security[_-]?token|sts[_-]?token|token|secret|signature|credentials?)$/iu.test(key)
+        || /(?:access[_-]?key[_-]?(?:id|secret)?|security[_-]?token|sts[_-]?token|credential|secret|signature)/iu.test(key);
+}
+/** Recursively remove credentials from payloads before they reach stdout. */
+export function sanitizeOssOutput(value, key = "") {
+    if (isSensitiveOutputKey(key))
+        return "[REDACTED]";
+    if (typeof value === "string")
+        return redactOssSensitiveText(value);
+    if (Array.isArray(value))
+        return value.map((item) => sanitizeOssOutput(item));
+    if (value && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value).map(([name, item]) => [name, sanitizeOssOutput(item, name)]));
+    }
+    return value;
+}
+export class OssError extends Error {
+    code;
+    status;
+    requestId;
+    constructor(message, code, status, requestId) {
+        super(redactOssSensitiveText(message));
+        this.code = code;
+        this.status = status;
+        this.requestId = requestId;
+        this.name = "OssError";
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/oss/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/oss/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,OAAO,mBAAmB,CAAC,KAAK,CAAC;SAC9B,OAAO,CACN,mLAAmL,EACnL,cAAc,CACf;SACA,OAAO,CACN,yOAAyO,EACzO,cAAc,CACf,CAAC;AACN,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAW;IACvC,OAAO,6IAA6I,CAAC,IAAI,CAAC,GAAG,CAAC;WACzJ,sGAAsG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxH,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,iBAAiB,CAAC,KAAc,EAAE,GAAG,GAAG,EAAE;IACxD,IAAI,oBAAoB,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,QAAS,SAAQ,KAAK;IAGf,IAAI;IACJ,MAAM;IACN,SAAS;IAJ3B,YACE,OAAe,EACC,IAAY,EACZ,MAAe,EACf,SAAkB;QAElC,KAAK,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;oBAJvB,IAAI;sBACJ,MAAM;yBACN,SAAS;QAGzB,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF"}

package/dist/oss/schemas.d.ts

@@ -0,0 +1,74 @@
+import { z } from "zod";
+export declare const ApiErrorSchema: z.ZodObject<{
+    code: z.ZodOptional<z.ZodString>;
+    message: z.ZodOptional<z.ZodString>;
+    requestId: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>;
+export declare const AccessGrantSchema: z.ZodObject<{
+    grantId: z.ZodNumber;
+    subjectType: z.ZodString;
+    subjectKey: z.ZodString;
+    accountCode: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    roleName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    roleArn: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    policyCode: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    bucketName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    scopeType: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    objectPrefix: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    permissionLevel: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    maxSessionSeconds: z.ZodNumber;
+    cloudPolicySynced: z.ZodBoolean;
+    status: z.ZodString;
+}, z.core.$loose>;
+export declare const AccessGrantsResponseSchema: z.ZodObject<{
+    requestId: z.ZodString;
+    subject: z.ZodString;
+    grants: z.ZodArray<z.ZodObject<{
+        grantId: z.ZodNumber;
+        subjectType: z.ZodString;
+        subjectKey: z.ZodString;
+        accountCode: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        roleName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        roleArn: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        policyCode: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        bucketName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        scopeType: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        objectPrefix: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        permissionLevel: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        maxSessionSeconds: z.ZodNumber;
+        cloudPolicySynced: z.ZodBoolean;
+        status: z.ZodString;
+    }, z.core.$loose>>;
+}, z.core.$loose>;
+export declare const StsCredentialsSchema: z.ZodObject<{
+    accessKeyId: z.ZodString;
+    accessKeySecret: z.ZodString;
+    securityToken: z.ZodString;
+}, z.core.$strip>;
+export declare const AccessSessionSchema: z.ZodObject<{
+    sessionId: z.ZodString;
+    grantId: z.ZodNumber;
+    accountCode: z.ZodString;
+    accountUid: z.ZodString;
+    roleId: z.ZodNumber;
+    roleName: z.ZodString;
+    roleArn: z.ZodString;
+    policyId: z.ZodNumber;
+    policyCode: z.ZodString;
+    region: z.ZodString;
+    bucketName: z.ZodString;
+    scopeType: z.ZodString;
+    objectPrefix: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    permissionLevel: z.ZodString;
+    roleSessionName: z.ZodString;
+    sourceIdentity: z.ZodString;
+    expiration: z.ZodString;
+    credentials: z.ZodObject<{
+        accessKeyId: z.ZodString;
+        accessKeySecret: z.ZodString;
+        securityToken: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$loose>;
+export type AccessGrant = z.infer<typeof AccessGrantSchema>;
+export type AccessGrantsResponse = z.infer<typeof AccessGrantsResponseSchema>;
+export type AccessSession = z.infer<typeof AccessSessionSchema>;

package/dist/oss/schemas.js

@@ -0,0 +1,53 @@
+import { z } from "zod";
+export const ApiErrorSchema = z.object({
+    code: z.string().optional(),
+    message: z.string().optional(),
+    requestId: z.string().optional()
+}).passthrough();
+export const AccessGrantSchema = z.object({
+    grantId: z.number().int().positive(),
+    subjectType: z.string().min(1),
+    subjectKey: z.string().min(1),
+    accountCode: z.string().nullable().optional(),
+    roleName: z.string().nullable().optional(),
+    roleArn: z.string().nullable().optional(),
+    policyCode: z.string().nullable().optional(),
+    bucketName: z.string().nullable().optional(),
+    scopeType: z.string().nullable().optional(),
+    objectPrefix: z.string().nullable().optional(),
+    permissionLevel: z.string().nullable().optional(),
+    maxSessionSeconds: z.number().int().min(900).max(3600),
+    cloudPolicySynced: z.boolean(),
+    status: z.string().min(1)
+}).passthrough();
+export const AccessGrantsResponseSchema = z.object({
+    requestId: z.string().min(1),
+    subject: z.string().min(1),
+    grants: z.array(AccessGrantSchema)
+}).passthrough();
+export const StsCredentialsSchema = z.object({
+    accessKeyId: z.string().min(1),
+    accessKeySecret: z.string().min(1),
+    securityToken: z.string().min(1)
+});
+export const AccessSessionSchema = z.object({
+    sessionId: z.string().min(1),
+    grantId: z.number().int().positive(),
+    accountCode: z.string().min(1),
+    accountUid: z.string().min(1),
+    roleId: z.number().int().positive(),
+    roleName: z.string().min(1),
+    roleArn: z.string().min(1),
+    policyId: z.number().int().positive(),
+    policyCode: z.string().min(1),
+    region: z.string().min(1),
+    bucketName: z.string().min(1),
+    scopeType: z.string().min(1),
+    objectPrefix: z.string().nullable().optional(),
+    permissionLevel: z.string().min(1),
+    roleSessionName: z.string().min(1),
+    sourceIdentity: z.string().min(1),
+    expiration: z.string().min(1),
+    credentials: StsCredentialsSchema
+}).passthrough();
+//# sourceMappingURL=schemas.js.map

package/dist/oss/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../src/oss/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC,WAAW,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC1C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACzC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACtD,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAC,CAAC,WAAW,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;CACnC,CAAC,CAAC,WAAW,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,WAAW,EAAE,oBAAoB;CAClC,CAAC,CAAC,WAAW,EAAE,CAAC"}

package/dist/oss/transfers.d.ts

@@ -0,0 +1,36 @@
+import OSS from "ali-oss";
+import type { AccessSession } from "./schemas.js";
+export interface OssTransferDependencies {
+    clientFactory?: (options: OSS.Options) => OSS;
+}
+export interface OssObjectSummary {
+    key: string;
+    sizeBytes: number;
+    lastModified?: string;
+    etag?: string;
+    type?: string;
+}
+export declare class OssTransferClient {
+    private readonly clientFactory;
+    constructor(dependencies?: OssTransferDependencies);
+    private client;
+    list(session: AccessSession, requestedPrefix?: string, limit?: number): Promise<{
+        prefix: string;
+        objects: OssObjectSummary[];
+        truncated: boolean;
+        nextMarker?: string;
+    }>;
+    stat(session: AccessSession, key: string): Promise<Record<string, unknown>>;
+    download(session: AccessSession, key: string, outputPath: string): Promise<{
+        key: string;
+        outputPath: string;
+    }>;
+    upload(session: AccessSession, key: string, inputPath: string, overwrite?: boolean): Promise<{
+        key: string;
+        sizeBytes: number;
+    }>;
+    remove(session: AccessSession, key: string): Promise<{
+        key: string;
+    }>;
+}
+export declare function sessionMetadata(session: AccessSession): Record<string, unknown>;