@orion-agents/orion-code 0.1.4 → 0.1.5

package/dist/services/atomic-write.js

@@ -7,20 +7,73 @@
  * never a half-written file.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.cleanupStaleAtomicWriteFiles = cleanupStaleAtomicWriteFiles;
 exports.atomicWriteFileSync = atomicWriteFileSync;
 const fs_1 = require("fs");
+const crypto_1 = require("crypto");
 const path_1 = require("path");
+const ATOMIC_TEMP_PATTERN = /^\..+\.(?:\d+\.\d+|[a-f0-9]{24})\.tmp$/;
+const SIDECAR_TEMP_PATTERN = /\.tmp-(?:delete-)?[a-z0-9]+$/;
+/** Remove abandoned atomic-write sidecars while leaving recent in-flight writes alone. */
+function cleanupStaleAtomicWriteFiles(directory, olderThanMs = 60 * 60 * 1000, now = Date.now()) {
+    let removed = 0;
+    let entries;
+    try {
+        entries = (0, fs_1.readdirSync)(directory);
+    }
+    catch {
+        return 0;
+    }
+    for (const entry of entries) {
+        if (!ATOMIC_TEMP_PATTERN.test(entry) && !SIDECAR_TEMP_PATTERN.test(entry))
+            continue;
+        const candidate = (0, path_1.join)(directory, entry);
+        try {
+            const stat = (0, fs_1.statSync)(candidate);
+            if (!stat.isFile() || now - stat.mtimeMs < olderThanMs)
+                continue;
+            (0, fs_1.unlinkSync)(candidate);
+            removed++;
+        }
+        catch {
+            // Startup cleanup is best-effort and must not block normal storage access.
+        }
+    }
+    return removed;
+}
 function atomicWriteFileSync(path, content, opts = {}) {
-    const tmp = (0, path_1.join)((0, path_1.dirname)(path), `.${(0, path_1.basename)(path)}.${process.pid}.${Date.now()}.tmp`);
+    // Issue #85: the temp name must be unpredictable. A predictable name
+    // (basename + pid + timestamp) lets a local attacker pre-create a symlink at
+    // that exact path and divert the rename (symlink TOCTOU). A random suffix
+    // makes pre-planting infeasible. The temp stays in the target's directory so
+    // `rename` remains atomic on a single filesystem.
+    const tmp = (0, path_1.join)((0, path_1.dirname)(path), `.${(0, path_1.basename)(path)}.${(0, crypto_1.randomBytes)(12).toString('hex')}.tmp`);
     try {
         (0, fs_1.writeFileSync)(tmp, content, opts.mode !== undefined ? { mode: opts.mode } : undefined);
+        if (opts.mode !== undefined) {
+            // `writeFileSync`'s `mode` is masked by the process umask, and is ignored
+            // outright when the file already exists. An explicit chmod makes the
+            // permission guarantee unconditional before the file becomes visible.
+            (0, fs_1.chmodSync)(tmp, opts.mode);
+        }
+        if (opts.fsync) {
+            const fd = (0, fs_1.openSync)(tmp, 'r+');
+            try {
+                (0, fs_1.fsyncSync)(fd);
+            }
+            finally {
+                (0, fs_1.closeSync)(fd);
+            }
+        }
         (0, fs_1.renameSync)(tmp, path);
     }
     catch (err) {
         try {
             (0, fs_1.unlinkSync)(tmp);
         }
-        catch { /* noop */ }
+        catch {
+            /* noop */
+        }
         throw err;
     }
 }

package/dist/services/atomic-write.js.map

@@ -1 +1 @@
-{"version":3,"file":"atomic-write.js","sourceRoot":"","sources":["../../src/services/atomic-write.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AASH,kDASC;AAhBD,2BAA2D;AAC3D,+BAA+C;AAM/C,SAAgB,mBAAmB,CAAC,IAAY,EAAE,OAAe,EAAE,OAA2B,EAAE;IAC9F,MAAM,GAAG,GAAG,IAAA,WAAI,EAAC,IAAA,cAAO,EAAC,IAAI,CAAC,EAAE,IAAI,IAAA,eAAQ,EAAC,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACvF,IAAI,CAAC;QACH,IAAA,kBAAa,EAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACvF,IAAA,eAAU,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YAAC,IAAA,eAAU,EAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"atomic-write.js","sourceRoot":"","sources":["../../src/services/atomic-write.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AA8BH,oEAyBC;AAED,kDAoCC;AA3FD,2BAUY;AACZ,mCAAqC;AACrC,+BAA+C;AAY/C,MAAM,mBAAmB,GAAG,wCAAwC,CAAC;AACrE,MAAM,oBAAoB,GAAG,8BAA8B,CAAC;AAE5D,0FAA0F;AAC1F,SAAgB,4BAA4B,CAC1C,SAAiB,EACjB,cAAsB,EAAE,GAAG,EAAE,GAAG,IAAI,EACpC,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,IAAA,gBAAW,EAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,SAAS;QACpF,MAAM,SAAS,GAAG,IAAA,WAAI,EAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAA,aAAQ,EAAC,SAAS,CAAC,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,GAAG,WAAW;gBAAE,SAAS;YACjE,IAAA,eAAU,EAAC,SAAS,CAAC,CAAC;YACtB,OAAO,EAAE,CAAC;QACZ,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAgB,mBAAmB,CACjC,IAAY,EACZ,OAAwB,EACxB,OAA2B,EAAE;IAE7B,qEAAqE;IACrE,6EAA6E;IAC7E,0EAA0E;IAC1E,6EAA6E;IAC7E,kDAAkD;IAClD,MAAM,GAAG,GAAG,IAAA,WAAI,EAAC,IAAA,cAAO,EAAC,IAAI,CAAC,EAAE,IAAI,IAAA,eAAQ,EAAC,IAAI,CAAC,IAAI,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7F,IAAI,CAAC;QACH,IAAA,kBAAa,EAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACvF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,0EAA0E;YAC1E,qEAAqE;YACrE,sEAAsE;YACtE,IAAA,cAAS,EAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,EAAE,GAAG,IAAA,aAAQ,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC/B,IAAI,CAAC;gBACH,IAAA,cAAS,EAAC,EAAE,CAAC,CAAC;YAChB,CAAC;oBAAS,CAAC;gBACT,IAAA,cAAS,EAAC,EAAE,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QACD,IAAA,eAAU,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,IAAA,eAAU,EAAC,GAAG,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,UAAU;QACZ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/services/auth/auth.d.ts

@@ -36,10 +36,18 @@ export interface AwsAuth {
     secretAccessKey?: string;
     /** Session Token */
     sessionToken?: string;
+    /** Optional expiration for temporary credentials (ISO-8601). */
+    expiration?: string;
     /** Region */
     region?: string;
     /** Profile */
     profile?: string;
+    /** Optional role to assume when temporary role credentials are required. */
+    roleArn?: string;
+    /** STS role session name. */
+    roleSessionName?: string;
+    /** Optional external ID required by the target role trust policy. */
+    externalId?: string;
 }
 export declare class AuthService {
     private config;
@@ -97,21 +105,17 @@ export declare class AuthService {
         awsProfile?: string;
     };
 }
-/**
- * macOS Keychain 安全存储
- * 注意：这是简化实现，实际需要调用 security 命令
- */
 export declare class SecureStorage {
     /**
-     * 存储到 Keychain
+     * Store a credential, encrypted at rest.
      */
     store(service: string, account: string, password: string): Promise<boolean>;
     /**
-     * 从 Keychain 获取
+     * Retrieve a credential (decrypted from disk).
      */
     retrieve(service: string, account: string): Promise<string | null>;
     /**
-     * 从 Keychain 删除
+     * Delete a credential.
      */
     delete(service: string, account: string): Promise<boolean>;
 }

package/dist/services/auth/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/services/auth/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAWH,MAAM,WAAW,UAAU;IACzB,iBAAiB;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,eAAe;IACf,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,aAAa;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,cAAc;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,kCAAkC;IAClC,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;IAChC,WAAW;IACX,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,SAAS;IACxB,mBAAmB;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,oBAAoB;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW;IACX,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,OAAO;IACtB,oBAAoB;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wBAAwB;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oBAAoB;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAMD,qBAAa,WAAW;IACtB,OAAO,CAAC,MAAM,CAA2B;IACzC,OAAO,CAAC,UAAU,CAAS;;IAQ3B;;OAEG;IACH,OAAO,CAAC,IAAI;IAiBZ;;OAEG;IACH,OAAO,CAAC,IAAI;IAMZ;;OAEG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,GAAE,KAAK,GAAG,MAAM,GAAG,MAAe,GAAG,IAAI;IAYtE;;OAEG;IACH,SAAS,IAAI,MAAM,GAAG,IAAI;IAe1B;;OAEG;IACH,aAAa,CACX,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,MAAM,EACrB,SAAS,CAAC,EAAE,MAAM,GACjB,IAAI;IAaP;;OAEG;IACH,aAAa,IAAI,SAAS,GAAG,IAAI;IAajC;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IAWlD;;OAEG;IACH,UAAU,IAAI,OAAO,GAAG,IAAI;IAI5B;;OAEG;IACH,KAAK,IAAI,IAAI;IAKb;;OAEG;IACH,eAAe,IAAI,OAAO;IAI1B;;OAEG;IACH,SAAS,IAAI;QACX,SAAS,EAAE,OAAO,CAAC;QACnB,QAAQ,EAAE,OAAO,CAAC;QAClB,MAAM,EAAE,OAAO,CAAC;QAChB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB;CAUF;AAMD;;;GAGG;AACH,qBAAa,aAAa;IACxB;;OAEG;IACG,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAqBjF;;OAEG;IACG,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAiBxE;;OAEG;IACG,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAmBjE;AAQD,wBAAgB,cAAc,IAAI,WAAW,CAK5C;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AAID,wBAAgB,gBAAgB,IAAI,aAAa,CAKhD"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/services/auth/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAsBH,MAAM,WAAW,UAAU;IACzB,iBAAiB;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,eAAe;IACf,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,aAAa;IACb,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,cAAc;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,kCAAkC;IAClC,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;IAChC,WAAW;IACX,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,SAAS;IACxB,mBAAmB;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,oBAAoB;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW;IACX,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,OAAO;IACtB,oBAAoB;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wBAAwB;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oBAAoB;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6BAA6B;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAMD,qBAAa,WAAW;IACtB,OAAO,CAAC,MAAM,CAA2B;IACzC,OAAO,CAAC,UAAU,CAAS;;IAQ3B;;OAEG;IACH,OAAO,CAAC,IAAI;IAiBZ;;OAEG;IACH,OAAO,CAAC,IAAI;IAQZ;;OAEG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,GAAE,KAAK,GAAG,MAAM,GAAG,MAAe,GAAG,IAAI;IAYtE;;OAEG;IACH,SAAS,IAAI,MAAM,GAAG,IAAI;IAe1B;;OAEG;IACH,aAAa,CACX,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,MAAM,EACrB,SAAS,CAAC,EAAE,MAAM,GACjB,IAAI;IAaP;;OAEG;IACH,aAAa,IAAI,SAAS,GAAG,IAAI;IAajC;;OAEG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IAWlD;;OAEG;IACH,UAAU,IAAI,OAAO,GAAG,IAAI;IAI5B;;OAEG;IACH,KAAK,IAAI,IAAI;IAKb;;OAEG;IACH,eAAe,IAAI,OAAO;IAI1B;;OAEG;IACH,SAAS,IAAI;QACX,SAAS,EAAE,OAAO,CAAC;QACnB,QAAQ,EAAE,OAAO,CAAC;QAClB,MAAM,EAAE,OAAO,CAAC;QAChB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB;CAUF;AAoHD,qBAAa,aAAa;IACxB;;OAEG;IACG,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAcjF;;OAEG;IACG,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAYxE;;OAEG;IACG,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAajE;AAQD,wBAAgB,cAAc,IAAI,WAAW,CAK5C;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AAID,wBAAgB,gBAAgB,IAAI,aAAa,CAKhD"}

package/dist/services/auth/auth.js

@@ -10,9 +10,19 @@ exports.getAuthService = getAuthService;
 exports.resetAuthService = resetAuthService;
 exports.getSecureStorage = getSecureStorage;
 const fs_1 = require("fs");
+const crypto_1 = require("crypto");
 const path_1 = require("path");
 const config_dir_1 = require("../config-dir");
+const atomic_write_1 = require("../atomic-write");
 const debug_log_1 = require("../../utils/debug-log");
+/**
+ * Credential files are the least recoverable state Orion Code owns: a torn
+ * write makes `JSON.parse` fail, and the loaders fall back to `{}`, which
+ * silently logs the user out and drops every stored secret. Write them via
+ * temp-file + rename with an fsync, so a crash leaves either the previous file
+ * or the complete new one.
+ */
+const CREDENTIAL_WRITE_OPTS = { mode: 0o600, fsync: true };
 // ============================================================================
 // Auth Service
 // ============================================================================
@@ -46,9 +56,8 @@ class AuthService {
      * 保存认证配置
      */
     save() {
-        (0, fs_1.writeFileSync)(this.configPath, JSON.stringify(this.config, null, 2), {
-            mode: 0o600, // 仅用户可读写
-        });
+        (0, atomic_write_1.atomicWriteFileSync)(this.configPath, JSON.stringify(this.config, null, 2), CREDENTIAL_WRITE_OPTS // 0600，仅用户可读写；原子写避免半截文件
+        );
     }
     /**
      * 设置 API Key
@@ -152,26 +161,111 @@ class AuthService {
 }
 exports.AuthService = AuthService;
 // ============================================================================
-// Secure Storage (macOS Keychain)
+// Encrypted-at-rest credential storage
 // ============================================================================
 /**
- * macOS Keychain 安全存储
- * 注意：这是简化实现，实际需要调用 security 命令
+ * Encrypted credential store (AES-256-GCM).
+ *
+ * The previous "SecureStorage" wrote credentials to `secure.json` in *plain
+ * text*, which is a confidentiality hole: a backup, a stray `cat`, or a leaked
+ * dotfile sync exposes every stored secret. Plaintext is never written to disk
+ * now — the credential map is sealed with AES-256-GCM before it touches the
+ * filesystem.
+ *
+ * Key management: a 256-bit key is generated once per config directory and kept
+ * in `secure.key` (mode 0600, alongside `secure.json`). This makes `secure.json`
+ * useless on its own (the realistic leak/backup scenario) — it cannot be
+ * decrypted without `secure.key`. The key file itself is not secret against an
+ * attacker who already owns the machine, so the strong option remains a real OS
+ * keychain (macOS Keychain / libsecret); this implementation is the portable,
+ * dependency-free improvement that closes the plaintext exposure (issue #66).
  */
+const SECURE_KEY_FILE = 'secure.key';
+const SECURE_DATA_FILE = 'secure.json';
+const KEY_BYTES = 32;
+function secureKeyPath() {
+    return (0, path_1.join)((0, config_dir_1.getConfigDir)(), SECURE_KEY_FILE);
+}
+function loadOrCreateKey() {
+    const keyPath = secureKeyPath();
+    if ((0, fs_1.existsSync)(keyPath)) {
+        return (0, fs_1.readFileSync)(keyPath);
+    }
+    const key = (0, crypto_1.randomBytes)(KEY_BYTES);
+    // Generated once; atomicity is not critical here. Keep it 0600 so it is not
+    // world-readable like a stray file might be.
+    (0, fs_1.writeFileSync)(keyPath, key, { mode: 0o600 });
+    return key;
+}
+function encryptMap(plain, key) {
+    const iv = (0, crypto_1.randomBytes)(12);
+    const cipher = (0, crypto_1.createCipheriv)('aes-256-gcm', key, iv);
+    const ciphertext = Buffer.concat([
+        cipher.update(JSON.stringify(plain), 'utf-8'),
+        cipher.final(),
+    ]);
+    const blob = {
+        v: 1,
+        iv: iv.toString('base64'),
+        tag: cipher.getAuthTag().toString('base64'),
+        data: ciphertext.toString('base64'),
+    };
+    return JSON.stringify(blob);
+}
+function decryptMap(blob, key) {
+    try {
+        const parsed = JSON.parse(blob);
+        if (parsed.v !== 1)
+            return null;
+        const decipher = (0, crypto_1.createDecipheriv)('aes-256-gcm', key, Buffer.from(parsed.iv, 'base64'));
+        decipher.setAuthTag(Buffer.from(parsed.tag, 'base64'));
+        const plaintext = Buffer.concat([
+            decipher.update(Buffer.from(parsed.data, 'base64')),
+            decipher.final(),
+        ]).toString('utf-8');
+        return JSON.parse(plaintext);
+    }
+    catch {
+        // A corrupt or tampered blob is indistinguishable from "no credentials"
+        // to the caller, which is the confusing case — log it upstream.
+        return null;
+    }
+}
+function readCredentialMap() {
+    const storagePath = (0, path_1.join)((0, config_dir_1.getConfigDir)(), SECURE_DATA_FILE);
+    if (!(0, fs_1.existsSync)(storagePath)) {
+        // No file yet: a fresh, empty map. Storing/deleting is safe to proceed.
+        return {};
+    }
+    const key = loadOrCreateKey();
+    const map = decryptMap((0, fs_1.readFileSync)(storagePath, 'utf-8'), key);
+    if (map === null) {
+        // The file exists but cannot be decrypted (corrupt/tampered/wrong key).
+        // Distinguish this from "no credentials": if we returned {} here, store()
+        // and delete() would silently overwrite the file with an empty map and
+        // wipe every credential we couldn't read. Instead, surface the failure so
+        // the caller's try/catch returns false (safe failure) rather than erasing
+        // data. retrieve() still returns null, which is the correct "can't read".
+        throw new Error('secure storage file exists but is corrupt or unreadable');
+    }
+    return map;
+}
+function writeCredentialMap(map) {
+    const storagePath = (0, path_1.join)((0, config_dir_1.getConfigDir)(), SECURE_DATA_FILE);
+    const key = loadOrCreateKey();
+    // Read-modify-write over the whole file: a torn write here loses *every*
+    // stored secret, not just the one being added.
+    (0, atomic_write_1.atomicWriteFileSync)(storagePath, encryptMap(map, key), CREDENTIAL_WRITE_OPTS);
+}
 class SecureStorage {
     /**
-     * 存储到 Keychain
+     * Store a credential, encrypted at rest.
      */
     async store(service, account, password) {
-        // macOS: security add-generic-password
         try {
-            // 简化实现：存储到加密文件
-            const storagePath = (0, path_1.join)((0, config_dir_1.getConfigDir)(), 'secure.json');
-            const content = (0, fs_1.existsSync)(storagePath)
-                ? JSON.parse((0, fs_1.readFileSync)(storagePath, 'utf-8'))
-                : {};
-            content[`${service}:${account}`] = password;
-            (0, fs_1.writeFileSync)(storagePath, JSON.stringify(content), { mode: 0o600 });
+            const map = readCredentialMap();
+            map[`${service}:${account}`] = password;
+            writeCredentialMap(map);
             return true;
         }
         catch (error) {
@@ -182,36 +276,28 @@ class SecureStorage {
         }
     }
     /**
-     * 从 Keychain 获取
+     * Retrieve a credential (decrypted from disk).
      */
     async retrieve(service, account) {
         try {
-            const storagePath = (0, path_1.join)((0, config_dir_1.getConfigDir)(), 'secure.json');
-            if (!(0, fs_1.existsSync)(storagePath)) {
-                return null;
-            }
-            const content = JSON.parse((0, fs_1.readFileSync)(storagePath, 'utf-8'));
-            return content[`${service}:${account}`] || null;
+            const map = readCredentialMap();
+            return map[`${service}:${account}`] ?? null;
         }
         catch (error) {
-            // A parse failure here is indistinguishable from "no credential
+            // A parse/decrypt failure here is indistinguishable from "no credential
             // stored" to the caller, which is exactly the confusing case.
             (0, debug_log_1.debugError)('auth.retrieve', error, `${service}:${account}`);
             return null;
         }
     }
     /**
-     * 从 Keychain 删除
+     * Delete a credential.
      */
     async delete(service, account) {
         try {
-            const storagePath = (0, path_1.join)((0, config_dir_1.getConfigDir)(), 'secure.json');
-            if (!(0, fs_1.existsSync)(storagePath)) {
-                return true;
-            }
-            const content = JSON.parse((0, fs_1.readFileSync)(storagePath, 'utf-8'));
-            delete content[`${service}:${account}`];
-            (0, fs_1.writeFileSync)(storagePath, JSON.stringify(content), { mode: 0o600 });
+            const map = readCredentialMap();
+            delete map[`${service}:${account}`];
+            writeCredentialMap(map);
             return true;
         }
         catch (error) {

package/dist/services/auth/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/services/auth/auth.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAmTH,wCAKC;AAED,4CAEC;AAID,4CAKC;AAnUD,2BAA6D;AAC7D,+BAA4B;AAC5B,8CAA8D;AAC9D,qDAAmD;AAgDnD,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAE/E,MAAa,WAAW;IAItB;QAHQ,WAAM,GAAsB,IAAI,CAAC;QAIvC,IAAA,4BAAe,GAAE,CAAC;QAClB,IAAI,CAAC,UAAU,GAAG,IAAA,WAAI,EAAC,IAAA,yBAAY,GAAE,EAAE,WAAW,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED;;OAEG;IACK,IAAI;QACV,IAAI,CAAC,IAAA,eAAU,EAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAA,iBAAY,EAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACvD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,oEAAoE;YACpE,IAAA,sBAAU,EAAC,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;OAEG;IACK,IAAI;QACV,IAAA,kBAAa,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;YACnE,IAAI,EAAE,KAAK,EAAG,SAAS;SACxB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,GAAW,EAAE,SAAkC,MAAM;QAC7D,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QAEnC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG;YACnB,GAAG;YACH,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED;;OAEG;IACH,SAAS;QACP,aAAa;QACb,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC/E,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,aAAa;QACb,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;QAChC,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,aAAa,CACX,QAAgB,EAChB,WAAmB,EACnB,YAAqB,EACrB,SAAkB;QAElB,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QAEnC,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG;YAClB,QAAQ;YACR,WAAW;YACX,YAAY;YACZ,SAAS;SACV,CAAC;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED;;OAEG;IACH,aAAa;QACX,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,SAAS;QACT,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YAC5E,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,OAAe,EAAE,MAAe;QACzC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QAEnC,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG;YAChB,OAAO;YACP,MAAM,EAAE,MAAM,IAAI,WAAW;SAC9B,CAAC;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;IAC7E,CAAC;IAED;;OAEG;IACH,SAAS;QAQP,OAAO;YACL,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE;YAC7B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE;YAChC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE;YAC3B,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM;YACzC,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ;YAC3C,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO;SACtC,CAAC;IACJ,CAAC;CACF;AArKD,kCAqKC;AAED,+EAA+E;AAC/E,kCAAkC;AAClC,+EAA+E;AAE/E;;;GAGG;AACH,MAAa,aAAa;IACxB;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,OAAe,EAAE,OAAe,EAAE,QAAgB;QAC5D,uCAAuC;QACvC,IAAI,CAAC;YACH,eAAe;YACf,MAAM,WAAW,GAAG,IAAA,WAAI,EAAC,IAAA,yBAAY,GAAE,EAAE,aAAa,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,IAAA,eAAU,EAAC,WAAW,CAAC;gBACrC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,WAAW,EAAE,OAAO,CAAC,CAAC;gBAChD,CAAC,CAAC,EAAE,CAAC;YAEP,OAAO,CAAC,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC;YAC5C,IAAA,kBAAa,EAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAErE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qEAAqE;YACrE,+DAA+D;YAC/D,IAAA,sBAAU,EAAC,YAAY,EAAE,KAAK,EAAE,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC;YACzD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CAAC,OAAe,EAAE,OAAe;QAC7C,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAA,WAAI,EAAC,IAAA,yBAAY,GAAE,EAAE,aAAa,CAAC,CAAC;YACxD,IAAI,CAAC,IAAA,eAAU,EAAC,WAAW,CAAC,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;YAC/D,OAAO,OAAO,CAAC,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,IAAI,IAAI,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,gEAAgE;YAChE,8DAA8D;YAC9D,IAAA,sBAAU,EAAC,eAAe,EAAE,KAAK,EAAE,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,OAAe;QAC3C,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAA,WAAI,EAAC,IAAA,yBAAY,GAAE,EAAE,aAAa,CAAC,CAAC;YACxD,IAAI,CAAC,IAAA,eAAU,EAAC,WAAW,CAAC,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;YAC/D,OAAO,OAAO,CAAC,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC;YACxC,IAAA,kBAAa,EAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAErE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,gEAAgE;YAChE,qDAAqD;YACrD,IAAA,sBAAU,EAAC,aAAa,EAAE,KAAK,EAAE,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAnED,sCAmEC;AAED,+EAA+E;AAC/E,KAAK;AACL,+EAA+E;AAE/E,IAAI,WAAW,GAAuB,IAAI,CAAC;AAE3C,SAAgB,cAAc;IAC5B,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAgB,gBAAgB;IAC9B,WAAW,GAAG,IAAI,CAAC;AACrB,CAAC;AAED,IAAI,aAAa,GAAyB,IAAI,CAAC;AAE/C,SAAgB,gBAAgB;IAC9B,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,aAAa,GAAG,IAAI,aAAa,EAAE,CAAC;IACtC,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/services/auth/auth.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAgaH,wCAKC;AAED,4CAEC;AAID,4CAKC;AAhbD,2BAA6D;AAC7D,mCAAuE;AACvE,+BAA4B;AAC5B,8CAA8D;AAC9D,kDAAsD;AACtD,qDAAmD;AAEnD;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAW,CAAC;AAwDpE,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAE/E,MAAa,WAAW;IAItB;QAHQ,WAAM,GAAsB,IAAI,CAAC;QAIvC,IAAA,4BAAe,GAAE,CAAC;QAClB,IAAI,CAAC,UAAU,GAAG,IAAA,WAAI,EAAC,IAAA,yBAAY,GAAE,EAAE,WAAW,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED;;OAEG;IACK,IAAI;QACV,IAAI,CAAC,IAAA,eAAU,EAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAA,iBAAY,EAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACvD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,oEAAoE;YACpE,IAAA,sBAAU,EAAC,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;OAEG;IACK,IAAI;QACV,IAAA,kCAAmB,EACjB,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EACpC,qBAAqB,CAAE,wBAAwB;SAChD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,GAAW,EAAE,SAAkC,MAAM;QAC7D,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QAEnC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG;YACnB,GAAG;YACH,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED;;OAEG;IACH,SAAS;QACP,aAAa;QACb,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC/E,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,aAAa;QACb,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;QAChC,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,aAAa,CACX,QAAgB,EAChB,WAAmB,EACnB,YAAqB,EACrB,SAAkB;QAElB,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QAEnC,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG;YAClB,QAAQ;YACR,WAAW;YACX,YAAY;YACZ,SAAS;SACV,CAAC;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED;;OAEG;IACH,aAAa;QACX,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,SAAS;QACT,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YAC5E,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,OAAe,EAAE,MAAe;QACzC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QAEnC,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG;YAChB,OAAO;YACP,MAAM,EAAE,MAAM,IAAI,WAAW;SAC9B,CAAC;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;IAC7E,CAAC;IAED;;OAEG;IACH,SAAS;QAQP,OAAO;YACL,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE;YAC7B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE;YAChC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE;YAC3B,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM;YACzC,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ;YAC3C,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO;SACtC,CAAC;IACJ,CAAC;CACF;AAvKD,kCAuKC;AAED,+EAA+E;AAC/E,uCAAuC;AACvC,+EAA+E;AAE/E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,eAAe,GAAG,YAAY,CAAC;AACrC,MAAM,gBAAgB,GAAG,aAAa,CAAC;AACvC,MAAM,SAAS,GAAG,EAAE,CAAC;AASrB,SAAS,aAAa;IACpB,OAAO,IAAA,WAAI,EAAC,IAAA,yBAAY,GAAE,EAAE,eAAe,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;IAChC,IAAI,IAAA,eAAU,EAAC,OAAO,CAAC,EAAE,CAAC;QACxB,OAAO,IAAA,iBAAY,EAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,GAAG,GAAG,IAAA,oBAAW,EAAC,SAAS,CAAC,CAAC;IACnC,4EAA4E;IAC5E,6CAA6C;IAC7C,IAAA,kBAAa,EAAC,OAAO,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,KAA6B,EAAE,GAAW;IAC5D,MAAM,EAAE,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAA,uBAAc,EAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAC7C,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IACH,MAAM,IAAI,GAAkB;QAC1B,CAAC,EAAE,CAAC;QACJ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3C,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;KACpC,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,GAAW;IAC3C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;QACjD,IAAI,MAAM,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAA,yBAAgB,EAC/B,aAAa,EACb,GAAG,EACH,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CACjC,CAAC;QACF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACnD,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAA2B,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,gEAAgE;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,WAAW,GAAG,IAAA,WAAI,EAAC,IAAA,yBAAY,GAAE,EAAE,gBAAgB,CAAC,CAAC;IAC3D,IAAI,CAAC,IAAA,eAAU,EAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,wEAAwE;QACxE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,UAAU,CAAC,IAAA,iBAAY,EAAC,WAAW,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;IAChE,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,GAA2B;IACrD,MAAM,WAAW,GAAG,IAAA,WAAI,EAAC,IAAA,yBAAY,GAAE,EAAE,gBAAgB,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;IAC9B,yEAAyE;IACzE,+CAA+C;IAC/C,IAAA,kCAAmB,EAAC,WAAW,EAAE,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,qBAAqB,CAAC,CAAC;AAChF,CAAC;AAED,MAAa,aAAa;IACxB;;OAEG;IACH,KAAK,CAAC,KAAK,CAAC,OAAe,EAAE,OAAe,EAAE,QAAgB;QAC5D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;YAChC,GAAG,CAAC,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,GAAG,QAAQ,CAAC;YACxC,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qEAAqE;YACrE,+DAA+D;YAC/D,IAAA,sBAAU,EAAC,YAAY,EAAE,KAAK,EAAE,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC;YACzD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CAAC,OAAe,EAAE,OAAe;QAC7C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;YAChC,OAAO,GAAG,CAAC,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,IAAI,IAAI,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,8DAA8D;YAC9D,IAAA,sBAAU,EAAC,eAAe,EAAE,KAAK,EAAE,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,OAAe;QAC3C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;YAChC,OAAO,GAAG,CAAC,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC;YACpC,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,gEAAgE;YAChE,qDAAqD;YACrD,IAAA,sBAAU,EAAC,aAAa,EAAE,KAAK,EAAE,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAjDD,sCAiDC;AAED,+EAA+E;AAC/E,KAAK;AACL,+EAA+E;AAE/E,IAAI,WAAW,GAAuB,IAAI,CAAC;AAE3C,SAAgB,cAAc;IAC5B,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAgB,gBAAgB;IAC9B,WAAW,GAAG,IAAI,CAAC;AACrB,CAAC;AAED,IAAI,aAAa,GAAyB,IAAI,CAAC;AAE/C,SAAgB,gBAAgB;IAC9B,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,aAAa,GAAG,IAAI,aAAa,EAAE,CAAC;IACtC,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC"}

package/dist/services/auth/aws.d.ts

@@ -20,6 +20,8 @@ export declare function verifyAwsCredentials(auth: AwsAuth): Promise<StsResult>;
  * 获取临时 STS Token
  */
 export declare function getStsToken(auth: AwsAuth, durationSeconds?: number): Promise<StsResult>;
+/** Assume an IAM role and return its validated temporary credentials. */
+export declare function assumeAwsRole(auth: AwsAuth, roleArn: string, durationSeconds?: number): Promise<StsResult>;
 /**
  * 检测 AWS CLI 是否可用
  */

package/dist/services/auth/aws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../../src/services/auth/aws.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAMtC,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAsC5E;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,OAAO,EACb,eAAe,GAAE,MAAa,GAC7B,OAAO,CAAC,SAAS,CAAC,CA0CpB;AAED;;GAEG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,CAQ7D"}
+{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../../src/services/auth/aws.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAMtC,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAoFD;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CA4C5E;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,OAAO,EACb,eAAe,GAAE,MAAa,GAC7B,OAAO,CAAC,SAAS,CAAC,CAqCpB;AAED,yEAAyE;AACzE,wBAAsB,aAAa,CACjC,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,MAAM,EACf,eAAe,GAAE,MAAa,GAC7B,OAAO,CAAC,SAAS,CAAC,CAmCpB;AAED;;GAEG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,CAQ7D"}

package/dist/services/auth/aws.js

@@ -7,24 +7,97 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.verifyAwsCredentials = verifyAwsCredentials;
 exports.getStsToken = getStsToken;
+exports.assumeAwsRole = assumeAwsRole;
 exports.checkAwsCliAvailable = checkAwsCliAvailable;
 const child_process_1 = require("child_process");
+function validateExpiration(value, source) {
+    if (!value)
+        return undefined;
+    const expiresAt = Date.parse(value);
+    if (!Number.isFinite(expiresAt))
+        return `${source} credential expiration is invalid`;
+    if (expiresAt <= Date.now())
+        return `${source} credentials have expired`;
+    return undefined;
+}
+/** Resolve credentials without silently falling through a partial/expired source. */
+function resolveCredentialContext(auth) {
+    const env = { ...process.env };
+    const envAccessKey = process.env.AWS_ACCESS_KEY_ID;
+    const envSecret = process.env.AWS_SECRET_ACCESS_KEY;
+    const envToken = process.env.AWS_SESSION_TOKEN;
+    const hasAnyEnvCredential = Boolean(envAccessKey || envSecret || envToken);
+    if (hasAnyEnvCredential) {
+        if (!envAccessKey || !envSecret) {
+            return {
+                profileArgs: [],
+                env,
+                error: 'AWS environment credentials are incomplete',
+            };
+        }
+        const expirationError = validateExpiration(process.env.AWS_CREDENTIAL_EXPIRATION, 'AWS environment');
+        return { profileArgs: [], env, error: expirationError };
+    }
+    const hasAnyAuthCredential = Boolean(auth.accessKeyId || auth.secretAccessKey || auth.sessionToken);
+    if (hasAnyAuthCredential) {
+        if (!auth.accessKeyId || !auth.secretAccessKey) {
+            return { profileArgs: [], env, error: 'Configured AWS credentials are incomplete' };
+        }
+        const expirationError = validateExpiration(auth.expiration, 'Configured AWS');
+        if (expirationError)
+            return { profileArgs: [], env, error: expirationError };
+        env.AWS_ACCESS_KEY_ID = auth.accessKeyId;
+        env.AWS_SECRET_ACCESS_KEY = auth.secretAccessKey;
+        if (auth.sessionToken)
+            env.AWS_SESSION_TOKEN = auth.sessionToken;
+        return { profileArgs: [], env };
+    }
+    return {
+        profileArgs: auth.profile ? ['--profile', auth.profile] : [],
+        env,
+    };
+}
+function credentialsFromResponse(value) {
+    if (!value || typeof value !== 'object') {
+        return { success: false, error: 'STS response is missing Credentials' };
+    }
+    const credentials = value;
+    if (typeof credentials.AccessKeyId !== 'string' ||
+        typeof credentials.SecretAccessKey !== 'string' ||
+        typeof credentials.SessionToken !== 'string' ||
+        typeof credentials.Expiration !== 'string') {
+        return { success: false, error: 'STS response contains invalid temporary credentials' };
+    }
+    const expirationError = validateExpiration(credentials.Expiration, 'STS');
+    if (expirationError)
+        return { success: false, error: expirationError };
+    return {
+        success: true,
+        accessKeyId: credentials.AccessKeyId,
+        secretAccessKey: credentials.SecretAccessKey,
+        sessionToken: credentials.SessionToken,
+        expiration: credentials.Expiration,
+    };
+}
 /**
  * 验证 AWS 凭证
  */
 async function verifyAwsCredentials(auth) {
+    const credentialContext = resolveCredentialContext(auth);
+    if (credentialContext.error)
+        return { success: false, error: credentialContext.error };
     // 尝试调用 AWS CLI
     return new Promise((resolve) => {
-        const profile = auth.profile || 'default';
         const region = auth.region || 'us-east-1';
         (0, child_process_1.execFile)('aws', [
             'sts',
             'get-caller-identity',
-            '--profile', profile,
+            ...credentialContext.profileArgs,
             '--region', region,
             '--output', 'json',
         ], {
             timeout: 10000,
+            env: credentialContext.env,
         }, (error, stdout, stderr) => {
             if (error) {
                 resolve({
@@ -35,6 +108,10 @@ async function verifyAwsCredentials(auth) {
             }
             try {
                 const result = JSON.parse(stdout.toString());
+                if (!result || typeof result.Arn !== 'string') {
+                    resolve({ success: false, error: 'AWS identity response is missing Arn' });
+                    return;
+                }
                 resolve({
                     success: true,
                     // get-caller-identity 不返回凭证，仅验证身份
@@ -54,18 +131,23 @@ async function verifyAwsCredentials(auth) {
  * 获取临时 STS Token
  */
 async function getStsToken(auth, durationSeconds = 3600) {
+    if (auth.roleArn)
+        return assumeAwsRole(auth, auth.roleArn, durationSeconds);
+    const credentialContext = resolveCredentialContext(auth);
+    if (credentialContext.error)
+        return { success: false, error: credentialContext.error };
     return new Promise((resolve) => {
-        const profile = auth.profile || 'default';
         const region = auth.region || 'us-east-1';
         (0, child_process_1.execFile)('aws', [
             'sts',
             'get-session-token',
-            '--profile', profile,
+            ...credentialContext.profileArgs,
             '--region', region,
             '--duration-seconds', String(durationSeconds),
             '--output', 'json',
         ], {
             timeout: 15000,
+            env: credentialContext.env,
         }, (error, stdout, stderr) => {
             if (error) {
                 resolve({
@@ -76,14 +158,7 @@ async function getStsToken(auth, durationSeconds = 3600) {
             }
             try {
                 const result = JSON.parse(stdout.toString());
-                const credentials = result.Credentials;
-                resolve({
-                    success: true,
-                    accessKeyId: credentials.AccessKeyId,
-                    secretAccessKey: credentials.SecretAccessKey,
-                    sessionToken: credentials.SessionToken,
-                    expiration: credentials.Expiration,
-                });
+                resolve(credentialsFromResponse(result.Credentials));
             }
             catch {
                 resolve({
@@ -94,6 +169,45 @@ async function getStsToken(auth, durationSeconds = 3600) {
         });
     });
 }
+/** Assume an IAM role and return its validated temporary credentials. */
+async function assumeAwsRole(auth, roleArn, durationSeconds = 3600) {
+    if (!roleArn.trim())
+        return { success: false, error: 'AWS role ARN is required' };
+    const credentialContext = resolveCredentialContext(auth);
+    if (credentialContext.error)
+        return { success: false, error: credentialContext.error };
+    const region = auth.region || 'us-east-1';
+    const sessionName = auth.roleSessionName || `orion-code-${process.pid}`;
+    const externalIdArgs = auth.externalId ? ['--external-id', auth.externalId] : [];
+    return new Promise(resolve => {
+        (0, child_process_1.execFile)('aws', [
+            'sts',
+            'assume-role',
+            '--role-arn', roleArn,
+            '--role-session-name', sessionName,
+            ...externalIdArgs,
+            ...credentialContext.profileArgs,
+            '--region', region,
+            '--duration-seconds', String(durationSeconds),
+            '--output', 'json',
+        ], {
+            timeout: 15000,
+            env: credentialContext.env,
+        }, (error, stdout, stderr) => {
+            if (error) {
+                resolve({ success: false, error: stderr.toString() || error.message });
+                return;
+            }
+            try {
+                const result = JSON.parse(stdout.toString());
+                resolve(credentialsFromResponse(result.Credentials));
+            }
+            catch {
+                resolve({ success: false, error: 'Failed to parse STS response' });
+            }
+        });
+    });
+}
 /**
  * 检测 AWS CLI 是否可用
  */

package/dist/services/auth/aws.js.map

@@ -1 +1 @@
-{"version":3,"file":"aws.js","sourceRoot":"","sources":["../../../src/services/auth/aws.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAqBH,oDAsCC;AAKD,kCA6CC;AAKD,oDAQC;AAxHD,iDAAyC;AAgBzC;;GAEG;AACI,KAAK,UAAU,oBAAoB,CAAC,IAAa;IACtD,eAAe;IACf,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;QAE1C,IAAA,wBAAQ,EAAC,KAAK,EAAE;YACd,KAAK;YACL,qBAAqB;YACrB,WAAW,EAAE,OAAO;YACpB,UAAU,EAAE,MAAM;YAClB,UAAU,EAAE,MAAM;SACnB,EAAE;YACD,OAAO,EAAE,KAAK;SACf,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC3B,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC;oBACN,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,KAAK,CAAC,OAAO;iBAC1C,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC7C,OAAO,CAAC;oBACN,OAAO,EAAE,IAAI;oBACb,kCAAkC;oBAClC,WAAW,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;iBACtD,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC;oBACN,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,8BAA8B;iBACtC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,WAAW,CAC/B,IAAa,EACb,kBAA0B,IAAI;IAE9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;QAE1C,IAAA,wBAAQ,EAAC,KAAK,EAAE;YACd,KAAK;YACL,mBAAmB;YACnB,WAAW,EAAE,OAAO;YACpB,UAAU,EAAE,MAAM;YAClB,oBAAoB,EAAE,MAAM,CAAC,eAAe,CAAC;YAC7C,UAAU,EAAE,MAAM;SACnB,EAAE;YACD,OAAO,EAAE,KAAK;SACf,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC3B,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC;oBACN,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,KAAK,CAAC,OAAO;iBAC1C,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC7C,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;gBAEvC,OAAO,CAAC;oBACN,OAAO,EAAE,IAAI;oBACb,WAAW,EAAE,WAAW,CAAC,WAAW;oBACpC,eAAe,EAAE,WAAW,CAAC,eAAe;oBAC5C,YAAY,EAAE,WAAW,CAAC,YAAY;oBACtC,UAAU,EAAE,WAAW,CAAC,UAAU;iBACnC,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC;oBACN,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,8BAA8B;iBACtC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,oBAAoB;IACxC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAA,wBAAQ,EAAC,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE;YAC7B,OAAO,EAAE,IAAI;SACd,EAAE,CAAC,KAAK,EAAE,EAAE;YACX,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"aws.js","sourceRoot":"","sources":["../../../src/services/auth/aws.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;AAuGH,oDA4CC;AAKD,kCAwCC;AAGD,sCAuCC;AAKD,oDAQC;AArPD,iDAAyC;AAsBzC,SAAS,kBAAkB,CAAC,KAAyB,EAAE,MAAc;IACnE,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,GAAG,MAAM,mCAAmC,CAAC;IACrF,IAAI,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,GAAG,MAAM,2BAA2B,CAAC;IACzE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qFAAqF;AACrF,SAAS,wBAAwB,CAAC,IAAa;IAC7C,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/B,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC/C,MAAM,mBAAmB,GAAG,OAAO,CAAC,YAAY,IAAI,SAAS,IAAI,QAAQ,CAAC,CAAC;IAE3E,IAAI,mBAAmB,EAAE,CAAC;QACxB,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;YAChC,OAAO;gBACL,WAAW,EAAE,EAAE;gBACf,GAAG;gBACH,KAAK,EAAE,4CAA4C;aACpD,CAAC;QACJ,CAAC;QACD,MAAM,eAAe,GAAG,kBAAkB,CACxC,OAAO,CAAC,GAAG,CAAC,yBAAyB,EACrC,iBAAiB,CAClB,CAAC;QACF,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,oBAAoB,GAAG,OAAO,CAClC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,YAAY,CAC9D,CAAC;IACF,IAAI,oBAAoB,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/C,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;QACtF,CAAC;QACD,MAAM,eAAe,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;QAC9E,IAAI,eAAe;YAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;QAC7E,GAAG,CAAC,iBAAiB,GAAG,IAAI,CAAC,WAAW,CAAC;QACzC,GAAG,CAAC,qBAAqB,GAAG,IAAI,CAAC,eAAe,CAAC;QACjD,IAAI,IAAI,CAAC,YAAY;YAAE,GAAG,CAAC,iBAAiB,GAAG,IAAI,CAAC,YAAY,CAAC;QACjE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;IAClC,CAAC;IAED,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;QAC5D,GAAG;KACJ,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC7C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;IAC1E,CAAC;IACD,MAAM,WAAW,GAAG,KAAgC,CAAC;IACrD,IACE,OAAO,WAAW,CAAC,WAAW,KAAK,QAAQ;QAC3C,OAAO,WAAW,CAAC,eAAe,KAAK,QAAQ;QAC/C,OAAO,WAAW,CAAC,YAAY,KAAK,QAAQ;QAC5C,OAAO,WAAW,CAAC,UAAU,KAAK,QAAQ,EAC1C,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,qDAAqD,EAAE,CAAC;IAC1F,CAAC;IACD,MAAM,eAAe,GAAG,kBAAkB,CAAC,WAAW,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC1E,IAAI,eAAe;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IACvE,OAAO;QACL,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,eAAe,EAAE,WAAW,CAAC,eAAe;QAC5C,YAAY,EAAE,WAAW,CAAC,YAAY;QACtC,UAAU,EAAE,WAAW,CAAC,UAAU;KACnC,CAAC;AACJ,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,oBAAoB,CAAC,IAAa;IACtD,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,iBAAiB,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,CAAC,KAAK,EAAE,CAAC;IACvF,eAAe;IACf,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;QAE1C,IAAA,wBAAQ,EAAC,KAAK,EAAE;YACd,KAAK;YACL,qBAAqB;YACrB,GAAG,iBAAiB,CAAC,WAAW;YAChC,UAAU,EAAE,MAAM;YAClB,UAAU,EAAE,MAAM;SACnB,EAAE;YACD,OAAO,EAAE,KAAK;YACd,GAAG,EAAE,iBAAiB,CAAC,GAAG;SAC3B,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC3B,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC;oBACN,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,KAAK,CAAC,OAAO;iBAC1C,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC7C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;oBAC9C,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC,CAAC;oBAC3E,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC;oBACN,OAAO,EAAE,IAAI;oBACb,kCAAkC;oBAClC,WAAW,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;iBACtD,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC;oBACN,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,8BAA8B;iBACtC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,WAAW,CAC/B,IAAa,EACb,kBAA0B,IAAI;IAE9B,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC5E,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,iBAAiB,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,CAAC,KAAK,EAAE,CAAC;IACvF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;QAE1C,IAAA,wBAAQ,EAAC,KAAK,EAAE;YACd,KAAK;YACL,mBAAmB;YACnB,GAAG,iBAAiB,CAAC,WAAW;YAChC,UAAU,EAAE,MAAM;YAClB,oBAAoB,EAAE,MAAM,CAAC,eAAe,CAAC;YAC7C,UAAU,EAAE,MAAM;SACnB,EAAE;YACD,OAAO,EAAE,KAAK;YACd,GAAG,EAAE,iBAAiB,CAAC,GAAG;SAC3B,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC3B,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC;oBACN,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,KAAK,CAAC,OAAO;iBAC1C,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC7C,OAAO,CAAC,uBAAuB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC;oBACN,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,8BAA8B;iBACtC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yEAAyE;AAClE,KAAK,UAAU,aAAa,CACjC,IAAa,EACb,OAAe,EACf,kBAA0B,IAAI;IAE9B,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;IAClF,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,iBAAiB,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,CAAC,KAAK,EAAE,CAAC;IACvF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;IAC1C,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,IAAI,cAAc,OAAO,CAAC,GAAG,EAAE,CAAC;IACxE,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAEjF,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,IAAA,wBAAQ,EAAC,KAAK,EAAE;YACd,KAAK;YACL,aAAa;YACb,YAAY,EAAE,OAAO;YACrB,qBAAqB,EAAE,WAAW;YAClC,GAAG,cAAc;YACjB,GAAG,iBAAiB,CAAC,WAAW;YAChC,UAAU,EAAE,MAAM;YAClB,oBAAoB,EAAE,MAAM,CAAC,eAAe,CAAC;YAC7C,UAAU,EAAE,MAAM;SACnB,EAAE;YACD,OAAO,EAAE,KAAK;YACd,GAAG,EAAE,iBAAiB,CAAC,GAAG;SAC3B,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC3B,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBACvE,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC7C,OAAO,CAAC,uBAAuB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,oBAAoB;IACxC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAA,wBAAQ,EAAC,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE;YAC7B,OAAO,EAAE,IAAI;SACd,EAAE,CAAC,KAAK,EAAE,EAAE;YACX,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/services/auth/index.d.ts

@@ -2,5 +2,5 @@
  * orion code - Auth 服务入口
  */
 export { AuthService, getAuthService, resetAuthService, SecureStorage, getSecureStorage, type AuthConfig, type ApiKeyAuth, type OAuthAuth, type AwsAuth, } from './auth';
-export { verifyAwsCredentials, getStsToken, checkAwsCliAvailable, type StsResult, } from './aws';
+export { verifyAwsCredentials, getStsToken, assumeAwsRole, checkAwsCliAvailable, type StsResult, } from './aws';
 //# sourceMappingURL=index.d.ts.map

package/dist/services/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/auth/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,OAAO,GACb,MAAM,QAAQ,CAAC;AAEhB,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,oBAAoB,EACpB,KAAK,SAAS,GACf,MAAM,OAAO,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/auth/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,OAAO,GACb,MAAM,QAAQ,CAAC;AAEhB,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,aAAa,EACb,oBAAoB,EACpB,KAAK,SAAS,GACf,MAAM,OAAO,CAAC"}