@shumai-one/shumai-transcode 0.6.0 → 0.6.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shumai-one/shumai-transcode",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "Media transcoding worker for the shumai media workspace",
   "type": "module",
   "bin": {
@@ -25,12 +25,12 @@
     "exiftool-vendored": "38.1.0"
   },
   "optionalDependencies": {
-    "@shumai-one/shumai-transcode-darwin-arm64": "0.6.0",
-    "@shumai-one/shumai-transcode-darwin-x64": "0.6.0",
-    "@shumai-one/shumai-transcode-linux-arm64": "0.6.0",
-    "@shumai-one/shumai-transcode-linux-x64": "0.6.0",
-    "@shumai-one/shumai-transcode-win32-arm64": "0.6.0",
-    "@shumai-one/shumai-transcode-win32-x64": "0.6.0"
+    "@shumai-one/shumai-transcode-darwin-arm64": "0.6.2",
+    "@shumai-one/shumai-transcode-darwin-x64": "0.6.2",
+    "@shumai-one/shumai-transcode-linux-arm64": "0.6.2",
+    "@shumai-one/shumai-transcode-linux-x64": "0.6.2",
+    "@shumai-one/shumai-transcode-win32-arm64": "0.6.2",
+    "@shumai-one/shumai-transcode-win32-x64": "0.6.2"
   },
   "repository": {
     "type": "git",

package/prisma/migrations/20261026024507_hash_api_tokens/migration.sql

@@ -0,0 +1,28 @@
+-- Store API tokens as SHA-256 digests instead of plaintext.
+--
+-- Existing tokens keep working: their plaintext is hashed in place with the same
+-- algorithm the application uses (hex-encoded SHA-256 of the UTF-8 token), so
+-- clients holding the plaintext still authenticate. This migration is one-way:
+-- after it runs the plaintext values are gone.
+
+-- AlterTable: add the new columns as nullable so existing rows can be backfilled
+ALTER TABLE "api_tokens" ADD COLUMN     "token_hash" TEXT,
+ADD COLUMN     "token_hint" TEXT;
+
+-- Backfill: keep the last 4 characters for display, then hash the plaintext
+UPDATE "api_tokens"
+SET "token_hint" = right("token", 4),
+    "token_hash" = encode(sha256(convert_to("token", 'UTF8')), 'hex');
+
+-- AlterTable: enforce the final shape
+ALTER TABLE "api_tokens" ALTER COLUMN "token_hash" SET NOT NULL,
+ALTER COLUMN "token_hint" SET NOT NULL;
+
+-- DropIndex
+DROP INDEX "api_tokens_token_key";
+
+-- AlterTable
+ALTER TABLE "api_tokens" DROP COLUMN "token";
+
+-- CreateIndex
+CREATE UNIQUE INDEX "api_tokens_token_hash_key" ON "api_tokens"("token_hash");

package/prisma/migrations/20261026031904_add_audit_log_via/migration.sql

@@ -0,0 +1,2 @@
+-- AlterTable
+ALTER TABLE "audit_logs" ADD COLUMN     "via" TEXT;

package/prisma/migrations/20261029024626_add_oauth_and_jwks/migration.sql

@@ -0,0 +1,205 @@
+-- CreateTable
+CREATE TABLE "jwks" (
+    "id" TEXT NOT NULL,
+    "public_key" TEXT NOT NULL,
+    "private_key" TEXT NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "expires_at" TIMESTAMP(3),
+    "alg" TEXT,
+    "crv" TEXT,
+
+    CONSTRAINT "jwks_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "oauth_clients" (
+    "id" TEXT NOT NULL,
+    "client_id" TEXT NOT NULL,
+    "client_secret" TEXT,
+    "client_discovery_id" TEXT,
+    "disabled" BOOLEAN DEFAULT false,
+    "skip_consent" BOOLEAN,
+    "enable_end_session" BOOLEAN,
+    "subject_type" TEXT,
+    "scopes" TEXT[],
+    "client_credentials_scopes" TEXT[] DEFAULT ARRAY[]::TEXT[],
+    "user_id" TEXT,
+    "created_at" TIMESTAMP(3) DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3),
+    "name" TEXT,
+    "uri" TEXT,
+    "icon" TEXT,
+    "contacts" TEXT[],
+    "tos" TEXT,
+    "policy" TEXT,
+    "software_id" TEXT,
+    "software_version" TEXT,
+    "software_statement" TEXT,
+    "redirect_uris" TEXT[],
+    "post_logout_redirect_uris" TEXT[],
+    "backchannel_logout_uri" TEXT,
+    "backchannel_logout_session_required" BOOLEAN,
+    "token_endpoint_auth_method" TEXT,
+    "application_type" TEXT,
+    "jwks" TEXT,
+    "jwks_uri" TEXT,
+    "grant_types" TEXT[],
+    "response_types" TEXT[],
+    "require_pkce" BOOLEAN,
+    "dpop_bound_access_tokens" BOOLEAN DEFAULT false,
+    "reference_id" TEXT,
+    "metadata" JSONB,
+
+    CONSTRAINT "oauth_clients_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "oauth_resources" (
+    "id" TEXT NOT NULL,
+    "identifier" TEXT NOT NULL,
+    "name" TEXT NOT NULL,
+    "access_token_ttl" INTEGER,
+    "refresh_token_ttl" INTEGER,
+    "signing_algorithm" TEXT,
+    "signing_key_id" TEXT,
+    "allowed_scopes" TEXT[],
+    "custom_claims" JSONB,
+    "dpop_bound_access_tokens_required" BOOLEAN DEFAULT false,
+    "disabled" BOOLEAN DEFAULT false,
+    "created_at" TIMESTAMP(3) DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3),
+    "policy_version" INTEGER DEFAULT 1,
+    "metadata" JSONB,
+
+    CONSTRAINT "oauth_resources_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "oauth_client_resources" (
+    "id" TEXT NOT NULL,
+    "client_id" TEXT NOT NULL,
+    "resource_id" TEXT NOT NULL,
+    "metadata" JSONB,
+    "created_at" TIMESTAMP(3) DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "oauth_client_resources_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "oauth_refresh_tokens" (
+    "id" TEXT NOT NULL,
+    "token" TEXT NOT NULL,
+    "client_id" TEXT NOT NULL,
+    "session_id" TEXT,
+    "user_id" TEXT NOT NULL,
+    "reference_id" TEXT,
+    "authorization_code_id" TEXT,
+    "resources" TEXT[],
+    "requested_user_info_claims" TEXT[],
+    "expires_at" TIMESTAMP(3) NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "revoked" TIMESTAMP(3),
+    "rotated_at" TIMESTAMP(3),
+    "rotation_replay_response" TEXT,
+    "rotation_replay_expires_at" TIMESTAMP(3),
+    "auth_time" TIMESTAMP(3),
+    "confirmation" JSONB,
+    "scopes" TEXT[],
+
+    CONSTRAINT "oauth_refresh_tokens_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "oauth_access_tokens" (
+    "id" TEXT NOT NULL,
+    "token" TEXT NOT NULL,
+    "client_id" TEXT NOT NULL,
+    "session_id" TEXT,
+    "user_id" TEXT,
+    "reference_id" TEXT,
+    "authorization_code_id" TEXT,
+    "resources" TEXT[],
+    "requested_user_info_claims" TEXT[],
+    "refresh_id" TEXT,
+    "expires_at" TIMESTAMP(3) NOT NULL,
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "revoked" TIMESTAMP(3),
+    "confirmation" JSONB,
+    "scopes" TEXT[],
+
+    CONSTRAINT "oauth_access_tokens_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "oauth_consents" (
+    "id" TEXT NOT NULL,
+    "client_id" TEXT NOT NULL,
+    "user_id" TEXT,
+    "reference_id" TEXT,
+    "resources" TEXT[],
+    "requested_user_info_claims" TEXT[],
+    "scopes" TEXT[],
+    "created_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updated_at" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "oauth_consents_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateTable
+CREATE TABLE "oauth_client_assertions" (
+    "id" TEXT NOT NULL,
+    "expires_at" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "oauth_client_assertions_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE UNIQUE INDEX "oauth_clients_client_id_key" ON "oauth_clients"("client_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "oauth_resources_identifier_key" ON "oauth_resources"("identifier");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "oauth_client_resources_client_id_resource_id_key" ON "oauth_client_resources"("client_id", "resource_id");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "oauth_refresh_tokens_token_key" ON "oauth_refresh_tokens"("token");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "oauth_access_tokens_token_key" ON "oauth_access_tokens"("token");
+
+-- AddForeignKey
+ALTER TABLE "oauth_clients" ADD CONSTRAINT "oauth_clients_user_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "oauth_client_resources" ADD CONSTRAINT "oauth_client_resources_client_id_fkey" FOREIGN KEY ("client_id") REFERENCES "oauth_clients"("client_id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "oauth_client_resources" ADD CONSTRAINT "oauth_client_resources_resource_id_fkey" FOREIGN KEY ("resource_id") REFERENCES "oauth_resources"("identifier") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "oauth_refresh_tokens" ADD CONSTRAINT "oauth_refresh_tokens_client_id_fkey" FOREIGN KEY ("client_id") REFERENCES "oauth_clients"("client_id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "oauth_refresh_tokens" ADD CONSTRAINT "oauth_refresh_tokens_session_id_fkey" FOREIGN KEY ("session_id") REFERENCES "sessions"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "oauth_refresh_tokens" ADD CONSTRAINT "oauth_refresh_tokens_user_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "oauth_access_tokens" ADD CONSTRAINT "oauth_access_tokens_client_id_fkey" FOREIGN KEY ("client_id") REFERENCES "oauth_clients"("client_id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "oauth_access_tokens" ADD CONSTRAINT "oauth_access_tokens_session_id_fkey" FOREIGN KEY ("session_id") REFERENCES "sessions"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "oauth_access_tokens" ADD CONSTRAINT "oauth_access_tokens_user_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "oauth_access_tokens" ADD CONSTRAINT "oauth_access_tokens_refresh_id_fkey" FOREIGN KEY ("refresh_id") REFERENCES "oauth_refresh_tokens"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "oauth_consents" ADD CONSTRAINT "oauth_consents_client_id_fkey" FOREIGN KEY ("client_id") REFERENCES "oauth_clients"("client_id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "oauth_consents" ADD CONSTRAINT "oauth_consents_user_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE;

package/prisma/migrations/20261029030321_default_empty_arrays_oauth/migration.sql

@@ -0,0 +1,25 @@
+-- AlterTable
+ALTER TABLE "oauth_access_tokens" ALTER COLUMN "resources" SET DEFAULT ARRAY[]::TEXT[],
+ALTER COLUMN "requested_user_info_claims" SET DEFAULT ARRAY[]::TEXT[],
+ALTER COLUMN "scopes" SET DEFAULT ARRAY[]::TEXT[];
+
+-- AlterTable
+ALTER TABLE "oauth_clients" ALTER COLUMN "scopes" SET DEFAULT ARRAY[]::TEXT[],
+ALTER COLUMN "contacts" SET DEFAULT ARRAY[]::TEXT[],
+ALTER COLUMN "redirect_uris" SET DEFAULT ARRAY[]::TEXT[],
+ALTER COLUMN "post_logout_redirect_uris" SET DEFAULT ARRAY[]::TEXT[],
+ALTER COLUMN "grant_types" SET DEFAULT ARRAY[]::TEXT[],
+ALTER COLUMN "response_types" SET DEFAULT ARRAY[]::TEXT[];
+
+-- AlterTable
+ALTER TABLE "oauth_consents" ALTER COLUMN "resources" SET DEFAULT ARRAY[]::TEXT[],
+ALTER COLUMN "requested_user_info_claims" SET DEFAULT ARRAY[]::TEXT[],
+ALTER COLUMN "scopes" SET DEFAULT ARRAY[]::TEXT[];
+
+-- AlterTable
+ALTER TABLE "oauth_refresh_tokens" ALTER COLUMN "resources" SET DEFAULT ARRAY[]::TEXT[],
+ALTER COLUMN "requested_user_info_claims" SET DEFAULT ARRAY[]::TEXT[],
+ALTER COLUMN "scopes" SET DEFAULT ARRAY[]::TEXT[];
+
+-- AlterTable
+ALTER TABLE "oauth_resources" ALTER COLUMN "allowed_scopes" SET DEFAULT ARRAY[]::TEXT[];

package/prisma/schema.prisma

@@ -249,6 +249,10 @@ model User {
   kanbanTaskComments        KanbanTaskComment[]
   kanbanTaskEvents          KanbanTaskEvent[]
   recentFiles               RecentFileItem[]
+  oauthClients              OauthClient[]
+  oauthRefreshTokens        OauthRefreshToken[]
+  oauthAccessTokens         OauthAccessToken[]
+  oauthConsents             OauthConsent[]
 
   @@map("users")
 }
@@ -264,6 +268,9 @@ model Session {
   userId    String   @map("user_id")
   user      User     @relation(fields: [userId], references: [id], onDelete: Cascade)
 
+  oauthRefreshTokens OauthRefreshToken[]
+  oauthAccessTokens  OauthAccessToken[]
+
   @@map("sessions")
 }
 
@@ -1089,7 +1096,10 @@ model Collection {
 
 model ApiToken {
   id        String   @id @default(ulid())
-  token     String   @unique @default(ulid())
+  /// SHA-256 hex digest of the plaintext token. The plaintext is never stored.
+  tokenHash String   @unique @map("token_hash")
+  /// Last characters of the plaintext token, shown in the UI to identify it.
+  tokenHint String   @map("token_hint")
   name      String
   userId    String   @map("user_id")
   user      User     @relation("UserToApiToken", fields: [userId], references: [id], onDelete: Cascade)
@@ -1129,6 +1139,8 @@ model AuditLog {
   agentId   String?     @map("agent_id")
   projectId String?     @map("project_id")
   itemId    String?     @map("item_id")
+  /// Surface the action came through: api, agent, mcp, or cli. Null for actions recorded outside Operations.
+  via       String?     @map("via")
   createdAt DateTime    @default(now()) @map("created_at")
 
   team    Team     @relation("TeamToAuditLog", fields: [teamId], references: [id], onDelete: Cascade)
@@ -1339,5 +1351,178 @@ model RecentFileItem {
   @@map("recent_file_items")
 }
 
+model Jwks {
+  id         String    @id @default(ulid())
+  publicKey  String    @map("public_key")
+  privateKey String    @map("private_key")
+  createdAt  DateTime  @default(now()) @map("created_at")
+  expiresAt  DateTime? @map("expires_at")
+  alg        String?
+  crv        String?
+
+  @@map("jwks")
+}
+
+model OauthClient {
+  id                               String                @id @default(ulid())
+  clientId                         String                @unique @map("client_id")
+  clientSecret                     String?               @map("client_secret")
+  clientDiscoveryId                String?               @map("client_discovery_id")
+  disabled                         Boolean?              @default(false)
+  skipConsent                      Boolean?              @map("skip_consent")
+  enableEndSession                 Boolean?              @map("enable_end_session")
+  subjectType                      String?               @map("subject_type")
+  scopes                           String[]              @default([])
+  clientCredentialsScopes          String[]              @default([]) @map("client_credentials_scopes")
+  userId                           String?               @map("user_id")
+  user                             User?                 @relation(fields: [userId], references: [id], onDelete: Cascade)
+  createdAt                        DateTime?             @default(now()) @map("created_at")
+  updatedAt                        DateTime?             @updatedAt @map("updated_at")
+  name                             String?
+  uri                              String?
+  icon                             String?
+  contacts                         String[]              @default([])
+  tos                              String?
+  policy                           String?
+  softwareId                       String?               @map("software_id")
+  softwareVersion                  String?               @map("software_version")
+  softwareStatement                String?               @map("software_statement")
+  redirectUris                     String[]              @default([]) @map("redirect_uris")
+  postLogoutRedirectUris           String[]              @default([]) @map("post_logout_redirect_uris")
+  backchannelLogoutUri             String?               @map("backchannel_logout_uri")
+  backchannelLogoutSessionRequired Boolean?              @map("backchannel_logout_session_required")
+  tokenEndpointAuthMethod          String?               @map("token_endpoint_auth_method")
+  applicationType                  String?               @map("application_type")
+  jwks                             String?
+  jwksUri                          String?               @map("jwks_uri")
+  grantTypes                       String[]              @default([]) @map("grant_types")
+  responseTypes                    String[]              @default([]) @map("response_types")
+  requirePKCE                      Boolean?              @map("require_pkce")
+  dpopBoundAccessTokens            Boolean?              @default(false) @map("dpop_bound_access_tokens")
+  referenceId                      String?               @map("reference_id")
+  /// [OauthMetadata]
+  metadata                         Json?
+
+  clientResources                  OauthClientResource[]
+  refreshTokens                    OauthRefreshToken[]
+  accessTokens                     OauthAccessToken[]
+  consents                         OauthConsent[]
+
+  @@map("oauth_clients")
+}
+
+model OauthResource {
+  id                            String                @id @default(ulid())
+  identifier                    String                @unique
+  name                          String
+  accessTokenTtl                Int?                  @map("access_token_ttl")
+  refreshTokenTtl               Int?                  @map("refresh_token_ttl")
+  signingAlgorithm              String?               @map("signing_algorithm")
+  signingKeyId                  String?               @map("signing_key_id")
+  allowedScopes                 String[]              @default([]) @map("allowed_scopes")
+  /// [OauthCustomClaims]
+  customClaims                  Json?                 @map("custom_claims")
+  dpopBoundAccessTokensRequired Boolean?              @default(false) @map("dpop_bound_access_tokens_required")
+  disabled                      Boolean?              @default(false)
+  createdAt                     DateTime?             @default(now()) @map("created_at")
+  updatedAt                     DateTime?             @updatedAt @map("updated_at")
+  policyVersion                 Int?                  @default(1) @map("policy_version")
+  /// [OauthMetadata]
+  metadata                      Json?
+
+  clientResources               OauthClientResource[]
+
+  @@map("oauth_resources")
+}
+
+model OauthClientResource {
+  id         String        @id @default(ulid())
+  clientId   String        @map("client_id")
+  client     OauthClient   @relation(fields: [clientId], references: [clientId], onDelete: Cascade)
+  resourceId String        @map("resource_id")
+  resource   OauthResource @relation(fields: [resourceId], references: [identifier], onDelete: Cascade)
+  /// [OauthMetadata]
+  metadata   Json?
+  createdAt  DateTime?     @default(now()) @map("created_at")
+
+  @@unique([clientId, resourceId])
+  @@map("oauth_client_resources")
+}
+
+model OauthRefreshToken {
+  id                      String             @id @default(ulid())
+  token                   String             @unique
+  clientId                String             @map("client_id")
+  client                  OauthClient        @relation(fields: [clientId], references: [clientId], onDelete: Cascade)
+  sessionId               String?            @map("session_id")
+  session                 Session?           @relation(fields: [sessionId], references: [id], onDelete: SetNull)
+  userId                  String             @map("user_id")
+  user                    User               @relation(fields: [userId], references: [id], onDelete: Cascade)
+  referenceId             String?            @map("reference_id")
+  authorizationCodeId     String?            @map("authorization_code_id")
+  resources               String[]           @default([])
+  requestedUserInfoClaims String[]           @default([]) @map("requested_user_info_claims")
+  expiresAt               DateTime           @map("expires_at")
+  createdAt               DateTime           @default(now()) @map("created_at")
+  revoked                 DateTime?
+  rotatedAt               DateTime?          @map("rotated_at")
+  rotationReplayResponse  String?            @map("rotation_replay_response")
+  rotationReplayExpiresAt DateTime?          @map("rotation_replay_expires_at")
+  authTime                DateTime?          @map("auth_time")
+  /// [OauthConfirmation]
+  confirmation            Json?
+  scopes                  String[]           @default([])
+
+  accessTokens            OauthAccessToken[]
+
+  @@map("oauth_refresh_tokens")
+}
+
+model OauthAccessToken {
+  id                      String             @id @default(ulid())
+  token                   String             @unique
+  clientId                String             @map("client_id")
+  client                  OauthClient        @relation(fields: [clientId], references: [clientId], onDelete: Cascade)
+  sessionId               String?            @map("session_id")
+  session                 Session?           @relation(fields: [sessionId], references: [id], onDelete: SetNull)
+  userId                  String?            @map("user_id")
+  user                    User?              @relation(fields: [userId], references: [id], onDelete: Cascade)
+  referenceId             String?            @map("reference_id")
+  authorizationCodeId     String?            @map("authorization_code_id")
+  resources               String[]           @default([])
+  requestedUserInfoClaims String[]           @default([]) @map("requested_user_info_claims")
+  refreshId               String?            @map("refresh_id")
+  refreshToken            OauthRefreshToken? @relation(fields: [refreshId], references: [id], onDelete: Cascade)
+  expiresAt               DateTime           @map("expires_at")
+  createdAt               DateTime           @default(now()) @map("created_at")
+  revoked                 DateTime?
+  /// [OauthConfirmation]
+  confirmation            Json?
+  scopes                  String[]           @default([])
+
+  @@map("oauth_access_tokens")
+}
+
+model OauthConsent {
+  id                      String      @id @default(ulid())
+  clientId                String      @map("client_id")
+  client                  OauthClient @relation(fields: [clientId], references: [clientId], onDelete: Cascade)
+  userId                  String?     @map("user_id")
+  user                    User?       @relation(fields: [userId], references: [id], onDelete: Cascade)
+  referenceId             String?     @map("reference_id")
+  resources               String[]    @default([])
+  requestedUserInfoClaims String[]    @default([]) @map("requested_user_info_claims")
+  scopes                  String[]    @default([])
+  createdAt               DateTime    @default(now()) @map("created_at")
+  updatedAt               DateTime    @updatedAt @map("updated_at")
+
+  @@map("oauth_consents")
+}
+
+model OauthClientAssertion {
+  id        String   @id @default(ulid())
+  expiresAt DateTime @map("expires_at")
 
+  @@map("oauth_client_assertions")
+}
 

package/bin/chunk-44p6jb11.js

@@ -1,2 +0,0 @@
-// @bun
-import{o,n,e,a,s,i,r,g,c,t,C,u,d,l}from"./shumai-transcode-app.js";var{awsEndpointFunctions:At,emitWarningIfUnsupportedVersion:Et,createDefaultUserAgentProvider:vt,NODE_APP_ID_CONFIG_OPTIONS:yt,getAwsRegionExtensionConfiguration:It,resolveAwsRegionExtensionConfiguration:Rt,resolveUserAgentConfig:_t,resolveHostHeaderConfig:Ct,getUserAgentPlugin:xt,getHostHeaderPlugin:wt,getLoggerPlugin:Tt,getRecursionDetectionPlugin:Dt,setCredentialFeature:ce,stsRegionDefaultResolver:bt}=t(),{NoAuthSigner:_e,getHttpAuthSchemeEndpointRuleSetPlugin:$t,DefaultIdentityProviderConfig:kt,getHttpSigningPlugin:Ot}=c(),{normalizeProvider:Ce,getSmithyContext:xe,ServiceException:Nt,NoOpLogger:Wt,emitWarningIfUnsupportedVersion:Ht,loadConfigsForDefaultMode:Ut,getDefaultExtensionConfiguration:qt,resolveDefaultRuntimeConfig:Ft,Client:we,makeBuilder:Lt,createAggregatedClient:Kt}=n(),{Command:Mt}=n();var jn=Mt,Gn=we;var{resolveDefaultsModeConfig:jt,loadConfig:O,NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS:Gt,NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS:Vt,NODE_REGION_CONFIG_OPTIONS:zt,NODE_REGION_CONFIG_FILE_OPTIONS:Bt,resolveRegionConfig:Qt}=e(),{BinaryDecisionDiagram:Yt,EndpointCache:Xt,decideEndpoint:Jt,customEndpointFunctions:Zt,resolveParams:es,resolveEndpointConfig:ts,getEndpointPlugin:ss}=a(),{parseUrl:ns,getHttpHandlerExtensionConfiguration:os,resolveHttpHandlerRuntimeConfig:rs,getContentLengthPlugin:is}=r(),{DEFAULT_RETRY_MODE:as,NODE_RETRY_MODE_CONFIG_OPTIONS:cs,NODE_MAX_ATTEMPT_CONFIG_OPTIONS:us,resolveRetryConfig:ds,getRetryPlugin:ls}=g(),{TypeRegistry:Te,getSchemaSerdePlugin:ps}=o(),{resolveAwsSdkSigV4Config:gs,resolveAwsSdkSigV4AConfig:hs,AwsSdkSigV4Signer:De,AwsSdkSigV4ASigner:be,NODE_SIGV4A_CONFIG_OPTIONS:ms,NODE_AUTH_SCHEME_PREFERENCE_OPTIONS:Ps}=d(),{SignatureV4MultiRegion:$e}=C(),{toUtf8:fs,fromUtf8:Ss,toBase64:As,fromBase64:Es,calculateBodyLength:vs}=s(),{streamCollector:ys,NodeHttpHandler:Is}=l(),{AwsQueryProtocol:Rs}=u(),{Sha256:_s}=i(),G="ref",H=-1,V=!0,fe="isSet",ke="PartitionResult",z="booleanEquals",y="stringEquals",ie="getAttr",Se="us-east-1",Ae="sigv4",Ee="sts",ve="https://sts.{Region}.{PartitionResult#dnsSuffix}",ye={[G]:"Endpoint"},I={[G]:"Region"},ae={[G]:ke},j={},Ie=[I],Re={conditions:[[fe,[ye]],[fe,Ie],["aws.partition",Ie,ke],[z,[{[G]:"UseFIPS"},V]],[z,[{[G]:"UseDualStack"},V]],[y,[I,"aws-global"]],[z,[{[G]:"UseGlobalEndpoint"},V]],[y,[I,"eu-central-1"]],[z,[{fn:ie,argv:[ae,"supportsDualStack"]},V]],[z,[{fn:ie,argv:[ae,"supportsFIPS"]},V]],[y,[I,"ap-south-1"]],[y,[I,"eu-north-1"]],[y,[I,"eu-west-1"]],[y,[I,"eu-west-2"]],[y,[I,"eu-west-3"]],[y,[I,"sa-east-1"]],[y,[I,Se]],[y,[I,"us-east-2"]],[y,[I,"us-west-2"]],[y,[I,"us-west-1"]],[y,[I,"ca-central-1"]],[y,[I,"ap-southeast-1"]],[y,[I,"ap-northeast-1"]],[y,[I,"ap-southeast-2"]],[y,[{fn:ie,argv:[ae,"name"]},"aws-us-gov"]]],results:[[H],["https://sts.amazonaws.com",{authSchemes:[{name:Ae,signingName:Ee,signingRegion:Se}]}],[ve,{authSchemes:[{name:Ae,signingName:Ee,signingRegion:"{Region}"}]}],[H,"Invalid Configuration: FIPS and custom endpoint are not supported"],[H,"Invalid Configuration: Dualstack and custom endpoint are not supported"],[ye,j],["https://sts-fips.{Region}.{PartitionResult#dualStackDnsSuffix}",j],[H,"FIPS and DualStack are enabled, but this partition does not support one or both"],["https://sts.{Region}.amazonaws.com",j],["https://sts-fips.{Region}.{PartitionResult#dnsSuffix}",j],[H,"FIPS is enabled but this partition does not support FIPS"],["https://sts.{Region}.{PartitionResult#dualStackDnsSuffix}",j],[H,"DualStack is enabled but this partition does not support DualStack"],[ve,j],[H,"Invalid Configuration: Missing Region"]]},Cs=2,f=1e8,xs=new Int32Array([-1,1,-1,0,30,3,1,4,f+14,2,5,f+14,3,25,6,4,24,7,5,f+1,8,6,9,f+13,7,f+1,10,10,f+1,11,11,f+1,12,12,f+1,13,13,f+1,14,14,f+1,15,15,f+1,16,16,f+1,17,17,f+1,18,18,f+1,19,19,f+1,20,20,f+1,21,21,f+1,22,22,f+1,23,23,f+1,f+2,8,f+11,f+12,4,28,26,9,27,f+10,24,f+8,f+9,8,29,f+7,9,f+6,f+7,3,f+3,31,4,f+4,f+5]),ws=Yt.from(xs,Cs,Re.conditions,Re.results),Ts=new Xt({size:50,params:["Endpoint","Region","UseDualStack","UseFIPS","UseGlobalEndpoint"]}),Oe=(p,h={})=>Ts.get(p,()=>Jt(ws,{endpointParams:p,logger:h.logger}));Zt.aws=At;var Ds=(p)=>async(h,m,A)=>{if(!A)throw Error("Could not find `input` for `defaultEndpointRuleSetHttpAuthSchemeParametersProvider`");let P=await p(h,m,A),v=xe(m)?.commandInstance?.constructor?.getEndpointParameterInstructions;if(!v)throw Error(`getEndpointParameterInstructions() is not defined on '${m.commandName}'`);let S=await es(A,{getEndpointParameterInstructions:v},h);return Object.assign(P,S)},bs=async(p,h,m)=>({operation:xe(h).operation,region:await Ce(p.region)()||(()=>{throw Error("expected `region` to be configured for `aws.auth#sigv4`")})()}),$s=Ds(bs);function Ne(p){return{schemeId:"aws.auth#sigv4",signingProperties:{name:"sts",region:p.region},propertiesExtractor:(h,m)=>({signingProperties:{config:h,context:m}})}}function ue(p){return{schemeId:"aws.auth#sigv4a",signingProperties:{name:"sts",region:p.region},propertiesExtractor:(h,m)=>({signingProperties:{config:h,context:m}})}}function We(p){return{schemeId:"smithy.api#noAuth"}}var ks=(p,h,m)=>(P)=>{let S=p(P).properties?.authSchemes;if(!S)return h(P);let R=[];for(let T of S){let{name:_,properties:D={},...W}=T,b=_.toLowerCase();if(_!==b)console.warn(`HttpAuthScheme has been normalized with lowercasing: '${_}' to '${b}'`);let w;if(b==="sigv4a"){w="aws.auth#sigv4a";let oe=S.find((re)=>{let Pe=re.name.toLowerCase();return Pe!=="sigv4a"&&Pe.startsWith("sigv4")});if($e.sigv4aDependency()==="none"&&oe)continue}else if(b.startsWith("sigv4"))w="aws.auth#sigv4";else throw Error(`Unknown HttpAuthScheme found in '@smithy.rules#endpointRuleSet': '${b}'`);let M=m[w];if(!M)throw Error(`Could not find HttpAuthOption create function for '${w}'`);let k=M(P);k.schemeId=w,k.signingProperties={...k.signingProperties||{},...W,...D},R.push(k)}return R},Os=(p)=>{let h=[];switch(p.operation){case"AssumeRoleWithWebIdentity":{h.push(We()),h.push(ue(p));break}default:h.push(Ne(p)),h.push(ue(p))}return h},Ns=ks(Oe,Os,{"aws.auth#sigv4":Ne,"aws.auth#sigv4a":ue,"smithy.api#noAuth":We}),Ws=(p)=>{let h=gs(p),m=hs(h);return Object.assign(m,{authSchemePreference:Ce(p.authSchemePreference??[])})},Hs=(p)=>Object.assign(p,{useDualstackEndpoint:p.useDualstackEndpoint??!1,useFipsEndpoint:p.useFipsEndpoint??!1,useGlobalEndpoint:p.useGlobalEndpoint??!1,defaultSigningName:"sts"}),Us={UseGlobalEndpoint:{type:"builtInParams",name:"useGlobalEndpoint"},UseFIPS:{type:"builtInParams",name:"useFipsEndpoint"},Endpoint:{type:"builtInParams",name:"endpoint"},Region:{type:"builtInParams",name:"region"},UseDualStack:{type:"builtInParams",name:"useDualstackEndpoint"}},qs="3.997.43",Fs={version:qs};class x extends Nt{constructor(p){super(p);Object.setPrototypeOf(this,x.prototype)}}class Q extends x{name="ExpiredTokenException";$fault="client";constructor(p){super({name:"ExpiredTokenException",$fault:"client",...p});Object.setPrototypeOf(this,Q.prototype)}}class Y extends x{name="MalformedPolicyDocumentException";$fault="client";constructor(p){super({name:"MalformedPolicyDocumentException",$fault:"client",...p});Object.setPrototypeOf(this,Y.prototype)}}class X extends x{name="PackedPolicyTooLargeException";$fault="client";constructor(p){super({name:"PackedPolicyTooLargeException",$fault:"client",...p});Object.setPrototypeOf(this,X.prototype)}}class J extends x{name="RegionDisabledException";$fault="client";constructor(p){super({name:"RegionDisabledException",$fault:"client",...p});Object.setPrototypeOf(this,J.prototype)}}class Z extends x{name="IDPRejectedClaimException";$fault="client";constructor(p){super({name:"IDPRejectedClaimException",$fault:"client",...p});Object.setPrototypeOf(this,Z.prototype)}}class ee extends x{name="InvalidIdentityTokenException";$fault="client";constructor(p){super({name:"InvalidIdentityTokenException",$fault:"client",...p});Object.setPrototypeOf(this,ee.prototype)}}class te extends x{name="IDPCommunicationErrorException";$fault="client";$retryable={};constructor(p){super({name:"IDPCommunicationErrorException",$fault:"client",...p});Object.setPrototypeOf(this,te.prototype)}}var Ls="Arn",Ks="AccessKeyId",Ms="AssumeRole",js="AssumedRoleId",Gs="AssumeRoleRequest",Vs="AssumeRoleResponse",de="AssumedRoleUser",zs="AssumeRoleWithWebIdentity",Bs="AssumeRoleWithWebIdentityRequest",Qs="AssumeRoleWithWebIdentityResponse",Ys="Audience",le="Credentials",Xs="ContextAssertion",He="DurationSeconds",Js="Expiration",Zs="ExternalId",en="ExpiredTokenException",tn="IDPCommunicationErrorException",sn="IDPRejectedClaimException",nn="InvalidIdentityTokenException",on="Key",rn="MalformedPolicyDocumentException",Ue="Policy",qe="PolicyArns",an="ProviderArn",cn="ProvidedContexts",un="ProvidedContextsListType",dn="ProvidedContext",ln="PolicyDescriptorType",pn="ProviderId",Fe="PackedPolicySize",gn="PackedPolicyTooLargeException",hn="Provider",Le="RoleArn",mn="RegionDisabledException",Ke="RoleSessionName",Pn="SecretAccessKey",fn="SubjectFromWebIdentityToken",pe="SourceIdentity",Sn="SerialNumber",An="SessionToken",En="Tags",vn="TokenCode",yn="TransitiveTagKeys",In="Tag",Rn="Value",_n="WebIdentityToken",Cn="arn",xn="accessKeySecretType",U="awsQueryError",q="client",wn="clientTokenType",F="error",L="httpError",K="message",Tn="policyDescriptorListType",Me="smithy.ts.sdk.synthetic.com.amazonaws.sts",Dn="tagListType",E="com.amazonaws.sts",je=Te.for(Me),Ge=[-3,Me,"STSServiceException",0,[],[]];je.registerError(Ge,x);var N=Te.for(E),Ve=[-3,E,en,{[U]:["ExpiredTokenException",400],[F]:q,[L]:400},[K],[0]];N.registerError(Ve,Q);var ze=[-3,E,tn,{[U]:["IDPCommunicationError",400],[F]:q,[L]:400},[K],[0]];N.registerError(ze,te);var Be=[-3,E,sn,{[U]:["IDPRejectedClaim",403],[F]:q,[L]:403},[K],[0]];N.registerError(Be,Z);var Qe=[-3,E,nn,{[U]:["InvalidIdentityToken",400],[F]:q,[L]:400},[K],[0]];N.registerError(Qe,ee);var Ye=[-3,E,rn,{[U]:["MalformedPolicyDocument",400],[F]:q,[L]:400},[K],[0]];N.registerError(Ye,Y);var Xe=[-3,E,gn,{[U]:["PackedPolicyTooLarge",400],[F]:q,[L]:400},[K],[0]];N.registerError(Xe,X);var Je=[-3,E,mn,{[U]:["RegionDisabledException",403],[F]:q,[L]:403},[K],[0]];N.registerError(Je,J);var Ze=[je,N],bn=[0,E,xn,8,0],$n=[0,E,wn,8,0],ge=[3,E,de,0,[js,Ls],[0,0],2],et=[3,E,Gs,0,[Le,Ke,qe,Ue,He,En,yn,Zs,Sn,vn,pe,cn],[0,0,()=>at,0,1,()=>On,64,0,0,0,0,()=>kn],2],tt=[3,E,Vs,0,[le,de,Fe,pe],[[()=>he,0],()=>ge,1,0]],st=[3,E,Bs,0,[Le,Ke,_n,pn,qe,Ue,He],[0,0,[()=>$n,0],0,()=>at,0,1],3],nt=[3,E,Qs,0,[le,fn,de,Fe,hn,Ys,pe],[[()=>he,0],0,()=>ge,1,0,0,0]],he=[3,E,le,0,[Ks,Pn,An,Js],[0,[()=>bn,0],0,4],4],ot=[3,E,ln,0,[Cn],[0]],rt=[3,E,dn,0,[an,Xs],[0,0]],it=[3,E,In,0,[on,Rn],[0,0],2],at=[1,E,Tn,0,()=>ot],kn=[1,E,un,0,()=>rt],On=[1,E,Dn,0,()=>it],ct=[9,E,Ms,0,()=>et,()=>tt],ut=[9,E,zs,0,()=>st,()=>nt],Nn=(p)=>({apiVersion:"2011-06-15",base64Decoder:p?.base64Decoder??Es,base64Encoder:p?.base64Encoder??As,disableHostPrefix:p?.disableHostPrefix??!1,endpointProvider:p?.endpointProvider??Oe,extensions:p?.extensions??[],httpAuthSchemeProvider:p?.httpAuthSchemeProvider??Ns,httpAuthSchemes:p?.httpAuthSchemes??[{schemeId:"aws.auth#sigv4",identityProvider:(h)=>h.getIdentityProvider("aws.auth#sigv4"),signer:new De},{schemeId:"aws.auth#sigv4a",identityProvider:(h)=>h.getIdentityProvider("aws.auth#sigv4a"),signer:new be},{schemeId:"smithy.api#noAuth",identityProvider:(h)=>h.getIdentityProvider("smithy.api#noAuth")||(async()=>({})),signer:new _e}],logger:p?.logger??new Wt,protocol:p?.protocol??Rs,protocolSettings:p?.protocolSettings??{defaultNamespace:"com.amazonaws.sts",errorTypeRegistries:Ze,xmlNamespace:"https://sts.amazonaws.com/doc/2011-06-15/",version:"2011-06-15",serviceTarget:"AWSSecurityTokenServiceV20110615"},serviceId:p?.serviceId??"STS",sha256:p?.sha256??_s,signerConstructor:p?.signerConstructor??$e,urlParser:p?.urlParser??ns,utf8Decoder:p?.utf8Decoder??Ss,utf8Encoder:p?.utf8Encoder??fs}),Wn=(p)=>{Ht(process.version);let h=jt(p),m=()=>h().then(Ut),A=Nn(p);Et(process.version);let P={profile:p?.profile,logger:A.logger};return{...A,...p,runtime:"node",defaultsMode:h,authSchemePreference:p?.authSchemePreference??O(Ps,P),bodyLengthChecker:p?.bodyLengthChecker??vs,defaultUserAgentProvider:p?.defaultUserAgentProvider??vt({serviceId:A.serviceId,clientVersion:Fs.version}),httpAuthSchemes:p?.httpAuthSchemes??[{schemeId:"aws.auth#sigv4",identityProvider:(v)=>v.getIdentityProvider("aws.auth#sigv4")||(async(S)=>await p.credentialDefaultProvider(S?.__config||{})()),signer:new De},{schemeId:"aws.auth#sigv4a",identityProvider:(v)=>v.getIdentityProvider("aws.auth#sigv4a"),signer:new be},{schemeId:"smithy.api#noAuth",identityProvider:(v)=>v.getIdentityProvider("smithy.api#noAuth")||(async()=>({})),signer:new _e}],maxAttempts:p?.maxAttempts??O(us,p),region:p?.region??O(zt,{...Bt,...P}),requestHandler:Is.create(p?.requestHandler??m),retryMode:p?.retryMode??O({...cs,default:async()=>(await m()).retryMode||as},p),sigv4aSigningRegionSet:p?.sigv4aSigningRegionSet??O(ms,P),streamCollector:p?.streamCollector??ys,useDualstackEndpoint:p?.useDualstackEndpoint??O(Vt,P),useFipsEndpoint:p?.useFipsEndpoint??O(Gt,P),userAgentAppId:p?.userAgentAppId??O(yt,P)}},Hn=(p)=>{let{httpAuthSchemes:h,httpAuthSchemeProvider:m,credentials:A}=p;return{setHttpAuthScheme(P){let v=h.findIndex((S)=>S.schemeId===P.schemeId);if(v===-1)h.push(P);else h.splice(v,1,P)},httpAuthSchemes(){return h},setHttpAuthSchemeProvider(P){m=P},httpAuthSchemeProvider(){return m},setCredentials(P){A=P},credentials(){return A}}},Un=(p)=>({httpAuthSchemes:p.httpAuthSchemes(),httpAuthSchemeProvider:p.httpAuthSchemeProvider(),credentials:p.credentials()}),qn=(p,h)=>{let m=Object.assign(It(p),qt(p),os(p),Hn(p));return h.forEach((A)=>A.configure(m)),Object.assign(p,Rt(m),Ft(m),rs(m),Un(m))};class B extends we{config;constructor(...[p]){let h=Wn(p||{});super(h);this.initConfig=h;let m=Hs(h),A=_t(m),P=ds(A),v=Qt(P),S=Ct(v),R=ts(S),T=Ws(R),_=qn(T,p?.extensions||[]);this.config=_,this.middlewareStack.use(ps(this.config)),this.middlewareStack.use(xt(this.config)),this.middlewareStack.use(ls(this.config)),this.middlewareStack.use(is(this.config)),this.middlewareStack.use(wt(this.config)),this.middlewareStack.use(Tt(this.config)),this.middlewareStack.use(Dt(this.config)),this.middlewareStack.use($t(this.config,{httpAuthSchemeParametersProvider:$s,identityProviderConfigProvider:async(D)=>new kt({"aws.auth#sigv4":D.credentials,"aws.auth#sigv4a":D.credentials})})),this.middlewareStack.use(Ot(this.config))}destroy(){super.destroy()}}var dt=Lt(Us,"AWSSecurityTokenServiceV20110615","STSClient",ss),lt={},pt=(p,h,m,A)=>[];class se extends dt(lt,pt,"AssumeRole",ct){}class ne extends dt(lt,pt,"AssumeRoleWithWebIdentity",ut){}var Fn={AssumeRoleCommand:se,AssumeRoleWithWebIdentityCommand:ne};class me extends B{}Kt(Fn,me);var gt=(p)=>{if(typeof p?.Arn==="string"){let h=p.Arn.split(":");if(h.length>4&&h[4]!=="")return h[4]}return},ht=async(p,h,m,A={})=>{let P=typeof p==="function"?await p():p,v=typeof h==="function"?await h():h,S="",R=P??v??(S=await bt(A)());return m?.debug?.("@aws-sdk/client-sts::resolveRegion","accepting first of:",`${P} (credential provider clientConfig)`,`${v} (contextual client)`,`${S} (STS default: AWS_REGION, profile region, or us-east-1)`),R},Ln=(p,h)=>{let m,A;return async(P,v)=>{if(A=P,!m){let{logger:D=p?.parentClientConfig?.logger,profile:W=p?.parentClientConfig?.profile,region:b,requestHandler:w=p?.parentClientConfig?.requestHandler,credentialProviderLogger:M,userAgentAppId:k=p?.parentClientConfig?.userAgentAppId}=p,oe=await ht(b,p?.parentClientConfig?.region,M,{logger:D,profile:W}),re=!mt(w);m=new h({...p,userAgentAppId:k,profile:W,credentialDefaultProvider:()=>async()=>A,region:oe,requestHandler:re?w:void 0,logger:D})}let{Credentials:S,AssumedRoleUser:R}=await m.send(new se(v));if(!S||!S.AccessKeyId||!S.SecretAccessKey)throw Error(`Invalid response from STS.assumeRole call with role ${v.RoleArn}`);let T=gt(R),_={accessKeyId:S.AccessKeyId,secretAccessKey:S.SecretAccessKey,sessionToken:S.SessionToken,expiration:S.Expiration,...S.CredentialScope&&{credentialScope:S.CredentialScope},...T&&{accountId:T}};return ce(_,"CREDENTIALS_STS_ASSUME_ROLE","i"),_}},Kn=(p,h)=>{let m;return async(A)=>{if(!m){let{logger:T=p?.parentClientConfig?.logger,profile:_=p?.parentClientConfig?.profile,region:D,requestHandler:W=p?.parentClientConfig?.requestHandler,credentialProviderLogger:b,userAgentAppId:w=p?.parentClientConfig?.userAgentAppId}=p,M=await ht(D,p?.parentClientConfig?.region,b,{logger:T,profile:_}),k=!mt(W);m=new h({...p,userAgentAppId:w,profile:_,region:M,requestHandler:k?W:void 0,logger:T})}let{Credentials:P,AssumedRoleUser:v}=await m.send(new ne(A));if(!P||!P.AccessKeyId||!P.SecretAccessKey)throw Error(`Invalid response from STS.assumeRoleWithWebIdentity call with role ${A.RoleArn}`);let S=gt(v),R={accessKeyId:P.AccessKeyId,secretAccessKey:P.SecretAccessKey,sessionToken:P.SessionToken,expiration:P.Expiration,...P.CredentialScope&&{credentialScope:P.CredentialScope},...S&&{accountId:S}};if(S)ce(R,"RESOLVED_ACCOUNT_ID","T");return ce(R,"CREDENTIALS_STS_ASSUME_ROLE_WEB_ID","k"),R}},mt=(p)=>p?.metadata?.handlerProtocol==="h2",Pt=(p,h)=>{if(!h)return p;else return class extends p{constructor(A){super(A);for(let P of h)this.middlewareStack.use(P)}}},ft=(p={},h)=>Ln(p,Pt(B,h)),St=(p={},h)=>Kn(p,Pt(B,h)),Mn=(p)=>(h)=>p({roleAssumer:ft(h),roleAssumerWithWebIdentity:St(h),...h});var Vn=ct,zn=se,Bn=et,Qn=tt,Yn=ut,Xn=ne,Jn=st,Zn=nt,eo=ge,to=he,so=Q,no=Ve,oo=te,ro=ze,io=Z,ao=Be,co=ee,uo=Qe,lo=Y,po=Ye,go=X,ho=Xe,mo=ot,Po=rt,fo=J,So=Je,Ao=me,Eo=B,vo=x,yo=Ge,Io=it,Ro=Mn,_o=Ze,Co=ft,xo=St;export{jn as $Command,Gn as __Client,Vn as AssumeRole$,zn as AssumeRoleCommand,Bn as AssumeRoleRequest$,Qn as AssumeRoleResponse$,Yn as AssumeRoleWithWebIdentity$,Xn as AssumeRoleWithWebIdentityCommand,Jn as AssumeRoleWithWebIdentityRequest$,Zn as AssumeRoleWithWebIdentityResponse$,eo as AssumedRoleUser$,to as Credentials$,so as ExpiredTokenException,no as ExpiredTokenException$,oo as IDPCommunicationErrorException,ro as IDPCommunicationErrorException$,io as IDPRejectedClaimException,ao as IDPRejectedClaimException$,co as InvalidIdentityTokenException,uo as InvalidIdentityTokenException$,lo as MalformedPolicyDocumentException,po as MalformedPolicyDocumentException$,go as PackedPolicyTooLargeException,ho as PackedPolicyTooLargeException$,mo as PolicyDescriptorType$,Po as ProvidedContext$,fo as RegionDisabledException,So as RegionDisabledException$,Ao as STS,Eo as STSClient,vo as STSServiceException,yo as STSServiceException$,Io as Tag$,Ro as decorateDefaultCredentialProvider,_o as errorTypeRegistries,Co as getDefaultRoleAssumer,xo as getDefaultRoleAssumerWithWebIdentity};

package/bin/chunk-45m7ga4h.js

@@ -1,2 +0,0 @@
-// @bun
-import{o,n,e,a,s,i,r,g,c,t,u,d,l}from"./shumai-transcode-app.js";var{awsEndpointFunctions:ie,emitWarningIfUnsupportedVersion:ae,createDefaultUserAgentProvider:ce,NODE_APP_ID_CONFIG_OPTIONS:ue,getAwsRegionExtensionConfiguration:de,resolveAwsRegionExtensionConfiguration:le,resolveUserAgentConfig:pe,resolveHostHeaderConfig:he,getUserAgentPlugin:ge,getHostHeaderPlugin:me,getLoggerPlugin:_e,getRecursionDetectionPlugin:Se}=t(),{NoAuthSigner:fe,getHttpAuthSchemeEndpointRuleSetPlugin:Ee,DefaultIdentityProviderConfig:Pe,getHttpSigningPlugin:ve}=c(),{normalizeProvider:W,getSmithyContext:Re,ServiceException:Ce,NoOpLogger:xe,emitWarningIfUnsupportedVersion:Ie,loadConfigsForDefaultMode:Ae,getDefaultExtensionConfiguration:ye,resolveDefaultRuntimeConfig:Oe,Client:Te,makeBuilder:De,createAggregatedClient:Ne}=n(),{Command:fs}=n();var{resolveDefaultsModeConfig:we,loadConfig:P,NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS:ke,NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS:be,NODE_REGION_CONFIG_OPTIONS:Fe,NODE_REGION_CONFIG_FILE_OPTIONS:$e,resolveRegionConfig:qe}=e(),{BinaryDecisionDiagram:He,EndpointCache:Ue,decideEndpoint:Ge,customEndpointFunctions:Me,resolveEndpointConfig:ze,getEndpointPlugin:je}=a(),{parseUrl:Le,getHttpHandlerExtensionConfiguration:Ke,resolveHttpHandlerRuntimeConfig:Ve,getContentLengthPlugin:Be}=r(),{DEFAULT_RETRY_MODE:We,NODE_RETRY_MODE_CONFIG_OPTIONS:Qe,NODE_MAX_ATTEMPT_CONFIG_OPTIONS:Ye,resolveRetryConfig:Je,getRetryPlugin:Xe}=g(),{TypeRegistry:Q,getSchemaSerdePlugin:Ze}=o(),{resolveAwsSdkSigV4Config:et,AwsSdkSigV4Signer:tt,NODE_AUTH_SCHEME_PREFERENCE_OPTIONS:st}=d(),{toUtf8:ot,fromUtf8:nt,toBase64:rt,fromBase64:it,calculateBodyLength:at}=s(),{streamCollector:ct,NodeHttpHandler:ut}=l(),{AwsRestJsonProtocol:dt}=u(),{Sha256:lt}=i(),pt=async(p,h,m)=>({operation:Re(h).operation,region:await W(p.region)()||(()=>{throw Error("expected `region` to be configured for `aws.auth#sigv4`")})()});function ht(p){return{schemeId:"aws.auth#sigv4",signingProperties:{name:"awsssoportal",region:p.region},propertiesExtractor:(h,m)=>({signingProperties:{config:h,context:m}})}}function gt(p){return{schemeId:"smithy.api#noAuth"}}var mt=(p)=>{let h=[];switch(p.operation){case"GetRoleCredentials":{h.push(gt());break}default:h.push(ht(p))}return h},_t=(p)=>{let h=et(p);return Object.assign(h,{authSchemePreference:W(p.authSchemePreference??[])})},St=(p)=>Object.assign(p,{useDualstackEndpoint:p.useDualstackEndpoint??!1,useFipsEndpoint:p.useFipsEndpoint??!1,defaultSigningName:"awsssoportal"}),ft={UseFIPS:{type:"builtInParams",name:"useFipsEndpoint"},Endpoint:{type:"builtInParams",name:"endpoint"},Region:{type:"builtInParams",name:"region"},UseDualStack:{type:"builtInParams",name:"useDualstackEndpoint"}},Et="3.997.43",Pt={version:Et},x="ref",v=-1,y=!0,j="isSet",Y="PartitionResult",O="booleanEquals",b="getAttr",L={[x]:"Endpoint"},F={[x]:Y},C={},K=[{[x]:"Region"}],V={conditions:[[j,[L]],[j,K],["aws.partition",K,Y],[O,[{[x]:"UseFIPS"},y]],[O,[{[x]:"UseDualStack"},y]],[O,[{fn:b,argv:[F,"supportsDualStack"]},y]],[O,[{fn:b,argv:[F,"supportsFIPS"]},y]],["stringEquals",[{fn:b,argv:[F,"name"]},"aws-us-gov"]]],results:[[v],[v,"Invalid Configuration: FIPS and custom endpoint are not supported"],[v,"Invalid Configuration: Dualstack and custom endpoint are not supported"],[L,C],["https://portal.sso-fips.{Region}.{PartitionResult#dualStackDnsSuffix}",C],[v,"FIPS and DualStack are enabled, but this partition does not support one or both"],["https://portal.sso.{Region}.amazonaws.com",C],["https://portal.sso-fips.{Region}.{PartitionResult#dnsSuffix}",C],[v,"FIPS is enabled but this partition does not support FIPS"],["https://portal.sso.{Region}.{PartitionResult#dualStackDnsSuffix}",C],[v,"DualStack is enabled but this partition does not support DualStack"],["https://portal.sso.{Region}.{PartitionResult#dnsSuffix}",C],[v,"Invalid Configuration: Missing Region"]]},vt=2,S=1e8,Rt=new Int32Array([-1,1,-1,0,13,3,1,4,S+12,2,5,S+12,3,8,6,4,7,S+11,5,S+9,S+10,4,11,9,6,10,S+8,7,S+6,S+7,5,12,S+5,6,S+4,S+5,3,S+1,14,4,S+2,S+3]),Ct=He.from(Rt,vt,V.conditions,V.results),xt=new Ue({size:50,params:["Endpoint","Region","UseDualStack","UseFIPS"]}),It=(p,h={})=>xt.get(p,()=>Ge(Ct,{endpointParams:p,logger:h.logger}));Me.aws=ie;class R extends Ce{constructor(p){super(p);Object.setPrototypeOf(this,R.prototype)}}class q extends R{name="InvalidRequestException";$fault="client";constructor(p){super({name:"InvalidRequestException",$fault:"client",...p});Object.setPrototypeOf(this,q.prototype)}}class H extends R{name="ResourceNotFoundException";$fault="client";constructor(p){super({name:"ResourceNotFoundException",$fault:"client",...p});Object.setPrototypeOf(this,H.prototype)}}class U extends R{name="TooManyRequestsException";$fault="client";constructor(p){super({name:"TooManyRequestsException",$fault:"client",...p});Object.setPrototypeOf(this,U.prototype)}}class G extends R{name="UnauthorizedException";$fault="client";constructor(p){super({name:"UnauthorizedException",$fault:"client",...p});Object.setPrototypeOf(this,G.prototype)}}var At="AccessTokenType",yt="GetRoleCredentials",Ot="GetRoleCredentialsRequest",Tt="GetRoleCredentialsResponse",Dt="InvalidRequestException",Nt="RoleCredentials",wt="ResourceNotFoundException",kt="SecretAccessKeyType",bt="SessionTokenType",Ft="TooManyRequestsException",$t="UnauthorizedException",qt="accountId",Ht="accessKeyId",Ut="accessToken",Gt="account_id",T="client",D="error",Mt="expiration",zt="http",N="httpError",jt="httpHeader",B="httpQuery",w="message",Lt="roleCredentials",Kt="roleName",Vt="role_name",J="smithy.ts.sdk.synthetic.com.amazonaws.sso",Bt="secretAccessKey",Wt="sessionToken",Qt="x-amz-sso_bearer_token",f="com.amazonaws.sso",X=Q.for(J),Yt=[-3,J,"SSOServiceException",0,[],[]];X.registerError(Yt,R);var I=Q.for(f),Jt=[-3,f,Dt,{[D]:T,[N]:400},[w],[0]];I.registerError(Jt,q);var Xt=[-3,f,wt,{[D]:T,[N]:404},[w],[0]];I.registerError(Xt,H);var Zt=[-3,f,Ft,{[D]:T,[N]:429},[w],[0]];I.registerError(Zt,U);var es=[-3,f,$t,{[D]:T,[N]:401},[w],[0]];I.registerError(es,G);var ts=[X,I],ss=[0,f,At,8,0],os=[0,f,kt,8,0],ns=[0,f,bt,8,0],rs=[3,f,Ot,0,[Kt,qt,Ut],[[0,{[B]:Vt}],[0,{[B]:Gt}],[()=>ss,{[jt]:Qt}]],3],is=[3,f,Tt,0,[Lt],[[()=>as,0]]],as=[3,f,Nt,0,[Ht,Bt,Wt,Mt],[0,[()=>os,0],[()=>ns,0],1]],cs=[9,f,yt,{[zt]:["GET","/federation/credentials",200]},()=>rs,()=>is],us=(p)=>({apiVersion:"2019-06-10",base64Decoder:p?.base64Decoder??it,base64Encoder:p?.base64Encoder??rt,disableHostPrefix:p?.disableHostPrefix??!1,endpointProvider:p?.endpointProvider??It,extensions:p?.extensions??[],httpAuthSchemeProvider:p?.httpAuthSchemeProvider??mt,httpAuthSchemes:p?.httpAuthSchemes??[{schemeId:"aws.auth#sigv4",identityProvider:(h)=>h.getIdentityProvider("aws.auth#sigv4"),signer:new tt},{schemeId:"smithy.api#noAuth",identityProvider:(h)=>h.getIdentityProvider("smithy.api#noAuth")||(async()=>({})),signer:new fe}],logger:p?.logger??new xe,protocol:p?.protocol??dt,protocolSettings:p?.protocolSettings??{defaultNamespace:"com.amazonaws.sso",errorTypeRegistries:ts,version:"2019-06-10",serviceTarget:"SWBPortalService"},serviceId:p?.serviceId??"SSO",sha256:p?.sha256??lt,urlParser:p?.urlParser??Le,utf8Decoder:p?.utf8Decoder??nt,utf8Encoder:p?.utf8Encoder??ot}),ds=(p)=>{Ie(process.version);let h=we(p),m=()=>h().then(Ae),E=us(p);ae(process.version);let _={profile:p?.profile,logger:E.logger};return{...E,...p,runtime:"node",defaultsMode:h,authSchemePreference:p?.authSchemePreference??P(st,_),bodyLengthChecker:p?.bodyLengthChecker??at,defaultUserAgentProvider:p?.defaultUserAgentProvider??ce({serviceId:E.serviceId,clientVersion:Pt.version}),maxAttempts:p?.maxAttempts??P(Ye,p),region:p?.region??P(Fe,{...$e,..._}),requestHandler:ut.create(p?.requestHandler??m),retryMode:p?.retryMode??P({...Qe,default:async()=>(await m()).retryMode||We},p),streamCollector:p?.streamCollector??ct,useDualstackEndpoint:p?.useDualstackEndpoint??P(be,_),useFipsEndpoint:p?.useFipsEndpoint??P(ke,_),userAgentAppId:p?.userAgentAppId??P(ue,_)}},ls=(p)=>{let{httpAuthSchemes:h,httpAuthSchemeProvider:m,credentials:E}=p;return{setHttpAuthScheme(_){let A=h.findIndex((k)=>k.schemeId===_.schemeId);if(A===-1)h.push(_);else h.splice(A,1,_)},httpAuthSchemes(){return h},setHttpAuthSchemeProvider(_){m=_},httpAuthSchemeProvider(){return m},setCredentials(_){E=_},credentials(){return E}}},ps=(p)=>({httpAuthSchemes:p.httpAuthSchemes(),httpAuthSchemeProvider:p.httpAuthSchemeProvider(),credentials:p.credentials()}),hs=(p,h)=>{let m=Object.assign(de(p),ye(p),Ke(p),ls(p));return h.forEach((E)=>E.configure(m)),Object.assign(p,le(m),Oe(m),Ve(m),ps(m))};class M extends Te{config;constructor(...[p]){let h=ds(p||{});super(h);this.initConfig=h;let m=St(h),E=pe(m),_=Je(E),A=qe(_),k=he(A),se=ze(k),oe=_t(se),ne=hs(oe,p?.extensions||[]);this.config=ne,this.middlewareStack.use(Ze(this.config)),this.middlewareStack.use(ge(this.config)),this.middlewareStack.use(Xe(this.config)),this.middlewareStack.use(Be(this.config)),this.middlewareStack.use(me(this.config)),this.middlewareStack.use(_e(this.config)),this.middlewareStack.use(Se(this.config)),this.middlewareStack.use(Ee(this.config,{httpAuthSchemeParametersProvider:pt,identityProviderConfigProvider:async(re)=>new Pe({"aws.auth#sigv4":re.credentials})})),this.middlewareStack.use(ve(this.config))}destroy(){super.destroy()}}var gs=De(ft,"SWBPortalService","SSOClient",je),ms={},_s=(p,h,m,E)=>[];class z extends gs(ms,_s,"GetRoleCredentials",cs){}var Ss={GetRoleCredentialsCommand:z};class Z extends M{}Ne(Ss,Z);var ee=z;var te=M;export{ee as GetRoleCredentialsCommand,te as SSOClient};

package/bin/chunk-5m3ed2gz.js

@@ -1,2 +0,0 @@
-// @bun
-import{o,n,e,a,s,i,r,g,c,t,u,d,l}from"./shumai-transcode-app.js";var{awsEndpointFunctions:ze,emitWarningIfUnsupportedVersion:Be,createDefaultUserAgentProvider:je,NODE_APP_ID_CONFIG_OPTIONS:Ge,getAwsRegionExtensionConfiguration:Ke,resolveAwsRegionExtensionConfiguration:Xe,resolveUserAgentConfig:Qe,resolveHostHeaderConfig:Ye,getUserAgentPlugin:Je,getHostHeaderPlugin:Ze,getLoggerPlugin:et,getRecursionDetectionPlugin:tt}=t(),{NoAuthSigner:st,getHttpAuthSchemeEndpointRuleSetPlugin:nt,DefaultIdentityProviderConfig:ot,getHttpSigningPlugin:rt}=c(),{normalizeProvider:Ee,getSmithyContext:it,ServiceException:at,NoOpLogger:ct,emitWarningIfUnsupportedVersion:ut,loadConfigsForDefaultMode:pt,getDefaultExtensionConfiguration:dt,resolveDefaultRuntimeConfig:ht,Client:me,makeBuilder:gt,createAggregatedClient:lt}=n(),{Command:Et}=n();var zs=Et,Bs=me;var{resolveDefaultsModeConfig:mt,loadConfig:k,NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS:At,NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS:_t,NODE_REGION_CONFIG_OPTIONS:Ot,NODE_REGION_CONFIG_FILE_OPTIONS:St,resolveRegionConfig:It}=e(),{BinaryDecisionDiagram:Ct,EndpointCache:Rt,decideEndpoint:vt,customEndpointFunctions:ft,resolveEndpointConfig:Pt,getEndpointPlugin:Tt}=a(),{parseUrl:kt,getHttpHandlerExtensionConfiguration:xt,resolveHttpHandlerRuntimeConfig:yt,getContentLengthPlugin:Dt}=r(),{DEFAULT_RETRY_MODE:Nt,NODE_RETRY_MODE_CONFIG_OPTIONS:wt,NODE_MAX_ATTEMPT_CONFIG_OPTIONS:$t,resolveRetryConfig:Ut,getRetryPlugin:Ft}=g(),{TypeRegistry:Ae,getSchemaSerdePlugin:bt}=o(),{resolveAwsSdkSigV4Config:qt,AwsSdkSigV4Signer:Mt,NODE_AUTH_SCHEME_PREFERENCE_OPTIONS:Ht}=d(),{toUtf8:Vt,fromUtf8:Wt,toBase64:Lt,fromBase64:zt,calculateBodyLength:Bt}=s(),{streamCollector:jt,NodeHttpHandler:Gt}=l(),{AwsRestJsonProtocol:Kt}=u(),{Sha256:Xt}=i(),Qt=async(p,E,m)=>({operation:it(E).operation,region:await Ee(p.region)()||(()=>{throw Error("expected `region` to be configured for `aws.auth#sigv4`")})()});function Yt(p){return{schemeId:"aws.auth#sigv4",signingProperties:{name:"signin",region:p.region},propertiesExtractor:(E,m)=>({signingProperties:{config:E,context:m}})}}function Jt(p){return{schemeId:"smithy.api#noAuth"}}var Zt=(p)=>{let E=[];switch(p.operation){case"CreateOAuth2Token":{E.push(Jt());break}default:E.push(Yt(p))}return E},es=(p)=>{let E=qt(p);return Object.assign(E,{authSchemePreference:Ee(p.authSchemePreference??[])})},ts=(p)=>Object.assign(p,{useDualstackEndpoint:p.useDualstackEndpoint??!1,useFipsEndpoint:p.useFipsEndpoint??!1,defaultSigningName:"signin"}),ss={UseFIPS:{type:"builtInParams",name:"useFipsEndpoint"},Endpoint:{type:"builtInParams",name:"endpoint"},Region:{type:"builtInParams",name:"region"},UseDualStack:{type:"builtInParams",name:"useDualstackEndpoint"}},ns="3.997.43",os={version:ns},f="ref",R=-1,ee=!1,x=!0,te="isSet",y="booleanEquals",se="coalesce",G="PartitionResult",C="stringEquals",W="getAttr",ne="https://signin.{Region}.{PartitionResult#dualStackDnsSuffix}",oe={[f]:"Endpoint"},v={fn:W,argv:[{[f]:G},"name"]},_e={[f]:"Region"},re={[f]:G},w={authSchemes:[{name:"sigv4",signingName:"signin",signingRegion:"{Region}"}]},_={},ie=[_e],ae={conditions:[[te,ie],[y,[{fn:se,argv:[{[f]:"IsControlPlane"},ee]},x]],[te,[oe]],["aws.partition",ie,G],[y,[{[f]:"UseFIPS"},x]],[C,[v,"aws"]],[y,[{fn:se,argv:[{[f]:"IsOAuthEndpoint"},ee]},x]],[y,[{[f]:"UseDualStack"},x]],[C,[v,"aws-cn"]],[C,[_e,"us-gov-west-1"]],[C,[v,"aws-us-gov"]],[y,[{fn:W,argv:[re,"supportsFIPS"]},x]],[C,[v,"aws-iso"]],[C,[v,"aws-iso-b"]],[C,[v,"aws-iso-f"]],[C,[v,"aws-iso-e"]],[C,[v,"aws-eusc"]],[y,[{fn:W,argv:[re,"supportsDualStack"]},x]]],results:[[R],["https://signin.{Region}.api.aws",w],["https://signin.{Region}.api.amazonwebservices.com.cn",w],[ne,w],[R,"FIPS endpoints are not supported for OAuth operations. Disable FIPS or use a non-OAuth operation."],["https://{Region}.oauth.signin.aws",w],["https://{Region}.signin.aws.amazon.com",_],["https://{Region}.signin.amazonaws.cn",_],["https://{Region}.signin.amazonaws-us-gov.com",_],["https://{Region}.signin.c2shome.ic.gov",_],["https://{Region}.signin.sc2shome.sgov.gov",_],["https://{Region}.signin.csphome.hci.ic.gov",_],["https://{Region}.signin.csphome.adc-e.uk",_],["https://{Region}.signin.amazonaws-eusc.eu",_],["https://signin-fips.amazonaws-us-gov.com",_],["https://{Region}.signin-fips.amazonaws-us-gov.com",_],["https://{Region}.signin.{PartitionResult#dnsSuffix}",_],[R,"Invalid Configuration: FIPS and custom endpoint are not supported"],[R,"Invalid Configuration: Dualstack and custom endpoint are not supported"],[oe,_],["https://signin-fips.{Region}.{PartitionResult#dualStackDnsSuffix}",_],[R,"FIPS and DualStack are enabled, but this partition does not support one or both"],["https://signin-fips.{Region}.{PartitionResult#dnsSuffix}",_],[R,"FIPS is enabled but this partition does not support FIPS"],[ne,_],[R,"DualStack is enabled but this partition does not support DualStack"],["https://signin.{Region}.{PartitionResult#dnsSuffix}",_],[R,"Invalid Configuration: Missing Region"]]},rs=2,h=1e8,is=new Int32Array([-1,1,-1,0,6,3,2,36,4,4,5,h+27,6,h+4,h+27,1,29,7,2,36,8,3,9,31,4,22,10,5,19,11,7,21,12,8,h+7,13,10,h+8,14,12,h+9,15,13,h+10,16,14,h+11,17,15,h+12,18,16,h+13,h+16,6,h+5,20,7,21,h+6,17,h+24,h+25,6,h+4,23,7,27,24,9,h+14,25,10,h+15,26,11,h+22,h+23,11,28,h+21,17,h+20,h+21,2,35,30,3,39,31,4,32,h+27,6,h+4,33,7,h+27,34,9,h+14,h+27,3,39,36,4,38,37,7,h+18,h+19,6,h+4,h+17,5,h+1,40,8,h+2,h+3]),as=Ct.from(is,rs,ae.conditions,ae.results),cs=new Rt({size:50,params:["Endpoint","IsControlPlane","IsOAuthEndpoint","Region","UseDualStack","UseFIPS"]}),us=(p,E={})=>cs.get(p,()=>vt(as,{endpointParams:p,logger:E.logger}));ft.aws=ze;class T extends at{constructor(p){super(p);Object.setPrototypeOf(this,T.prototype)}}class F extends T{name="AccessDeniedException";$fault="client";error;constructor(p){super({name:"AccessDeniedException",$fault:"client",...p});Object.setPrototypeOf(this,F.prototype),this.error=p.error}}class b extends T{name="InternalServerException";$fault="server";error;constructor(p){super({name:"InternalServerException",$fault:"server",...p});Object.setPrototypeOf(this,b.prototype),this.error=p.error}}class q extends T{name="TooManyRequestsError";$fault="client";error;constructor(p){super({name:"TooManyRequestsError",$fault:"client",...p});Object.setPrototypeOf(this,q.prototype),this.error=p.error}}class M extends T{name="ValidationException";$fault="client";error;constructor(p){super({name:"ValidationException",$fault:"client",...p});Object.setPrototypeOf(this,M.prototype),this.error=p.error}}var ps="AccessDeniedException",ds="AccessToken",hs="CreateOAuth2Token",gs="CreateOAuth2TokenRequest",ls="CreateOAuth2TokenRequestBody",Es="CreateOAuth2TokenResponseBody",ms="CreateOAuth2TokenResponse",As="CreateOAuth2TokenWithIAM",_s="CreateOAuth2TokenWithIAMRequest",Os="CreateOAuth2TokenWithIAMResponse",Ss="InternalServerException",Is="OAuthAccessToken",Cs="RefreshToken",Rs="TooManyRequestsError",vs="ValidationException",ce="accessKeyId",L="accessToken",fs="access_token",K="client",ue="clientId",pe="codeVerifier",Ps="code",P="error",z="expiresIn",Ts="expires_in",B="grantType",ks="grant_type",Oe="http",X="httpError",de="idToken",A="jsonName",H="message",xs="resource",U="refreshToken",he="redirectUri",Se="smithy.ts.sdk.synthetic.com.amazonaws.signin",ge="secretAccessKey",le="sessionToken",ys="server",Ds="tokenInput",Ns="tokenOutput",j="tokenType",ws="token_type",O="com.amazonaws.signin",Ie=Ae.for(Se),Ce=[-3,Se,"SigninServiceException",0,[],[]];Ie.registerError(Ce,T);var D=Ae.for(O),Re=[-3,O,ps,{[P]:K},[P,H],[0,0],2];D.registerError(Re,F);var ve=[-3,O,Ss,{[P]:ys,[X]:500},[P,H],[0,0],2];D.registerError(ve,b);var fe=[-3,O,Rs,{[P]:K,[X]:429},[P,H],[0,0],2];D.registerError(fe,q);var Pe=[-3,O,vs,{[P]:K,[X]:400},[P,H],[0,0],2];D.registerError(Pe,M);var Te=[Ie,D],$s=[0,O,Is,8,0],ke=[0,O,Cs,8,0],xe=[3,O,ds,8,[ce,ge,le],[[0,{[A]:ce}],[0,{[A]:ge}],[0,{[A]:le}]],3],ye=[3,O,gs,0,[Ds],[[()=>De,16]],1],De=[3,O,ls,0,[ue,B,Ps,he,pe,U],[[0,{[A]:ue}],[0,{[A]:B}],0,[0,{[A]:he}],[0,{[A]:pe}],[()=>ke,{[A]:U}]],2],Ne=[3,O,ms,0,[Ns],[[()=>we,16]],1],we=[3,O,Es,0,[L,j,z,U,de],[[()=>xe,{[A]:L}],[0,{[A]:j}],[1,{[A]:z}],[()=>ke,{[A]:U}],[0,{[A]:de}]],4],$e=[3,O,_s,0,[B,xs],[[0,{[A]:ks}],0],2],Ue=[3,O,Os,0,[L,j,z],[[()=>$s,{[A]:fs}],[0,{[A]:ws}],[1,{[A]:Ts}]],3],Fe=[9,O,hs,{[Oe]:["POST","/v1/token",200]},()=>ye,()=>Ne],be=[9,O,As,{[Oe]:["POST","/v1/token?x-amz-client-auth-method=iam",200]},()=>$e,()=>Ue],Us=(p)=>({apiVersion:"2023-01-01",base64Decoder:p?.base64Decoder??zt,base64Encoder:p?.base64Encoder??Lt,disableHostPrefix:p?.disableHostPrefix??!1,endpointProvider:p?.endpointProvider??us,extensions:p?.extensions??[],httpAuthSchemeProvider:p?.httpAuthSchemeProvider??Zt,httpAuthSchemes:p?.httpAuthSchemes??[{schemeId:"aws.auth#sigv4",identityProvider:(E)=>E.getIdentityProvider("aws.auth#sigv4"),signer:new Mt},{schemeId:"smithy.api#noAuth",identityProvider:(E)=>E.getIdentityProvider("smithy.api#noAuth")||(async()=>({})),signer:new st}],logger:p?.logger??new ct,protocol:p?.protocol??Kt,protocolSettings:p?.protocolSettings??{defaultNamespace:"com.amazonaws.signin",errorTypeRegistries:Te,version:"2023-01-01",serviceTarget:"Signin"},serviceId:p?.serviceId??"Signin",sha256:p?.sha256??Xt,urlParser:p?.urlParser??kt,utf8Decoder:p?.utf8Decoder??Wt,utf8Encoder:p?.utf8Encoder??Vt}),Fs=(p)=>{ut(process.version);let E=mt(p),m=()=>E().then(pt),I=Us(p);Be(process.version);let S={profile:p?.profile,logger:I.logger};return{...I,...p,runtime:"node",defaultsMode:E,authSchemePreference:p?.authSchemePreference??k(Ht,S),bodyLengthChecker:p?.bodyLengthChecker??Bt,defaultUserAgentProvider:p?.defaultUserAgentProvider??je({serviceId:I.serviceId,clientVersion:os.version}),maxAttempts:p?.maxAttempts??k($t,p),region:p?.region??k(Ot,{...St,...S}),requestHandler:Gt.create(p?.requestHandler??m),retryMode:p?.retryMode??k({...wt,default:async()=>(await m()).retryMode||Nt},p),streamCollector:p?.streamCollector??jt,useDualstackEndpoint:p?.useDualstackEndpoint??k(_t,S),useFipsEndpoint:p?.useFipsEndpoint??k(At,S),userAgentAppId:p?.userAgentAppId??k(Ge,S)}},bs=(p)=>{let{httpAuthSchemes:E,httpAuthSchemeProvider:m,credentials:I}=p;return{setHttpAuthScheme(S){let N=E.findIndex((V)=>V.schemeId===S.schemeId);if(N===-1)E.push(S);else E.splice(N,1,S)},httpAuthSchemes(){return E},setHttpAuthSchemeProvider(S){m=S},httpAuthSchemeProvider(){return m},setCredentials(S){I=S},credentials(){return I}}},qs=(p)=>({httpAuthSchemes:p.httpAuthSchemes(),httpAuthSchemeProvider:p.httpAuthSchemeProvider(),credentials:p.credentials()}),Ms=(p,E)=>{let m=Object.assign(Ke(p),dt(p),xt(p),bs(p));return E.forEach((I)=>I.configure(m)),Object.assign(p,Xe(m),ht(m),yt(m),qs(m))};class Q extends me{config;constructor(...[p]){let E=Fs(p||{});super(E);this.initConfig=E;let m=ts(E),I=Qe(m),S=Ut(I),N=It(S),V=Ye(N),He=Pt(V),Ve=es(He),We=Ms(Ve,p?.extensions||[]);this.config=We,this.middlewareStack.use(bt(this.config)),this.middlewareStack.use(Je(this.config)),this.middlewareStack.use(Ft(this.config)),this.middlewareStack.use(Dt(this.config)),this.middlewareStack.use(Ze(this.config)),this.middlewareStack.use(et(this.config)),this.middlewareStack.use(tt(this.config)),this.middlewareStack.use(nt(this.config,{httpAuthSchemeParametersProvider:Qt,identityProviderConfigProvider:async(Le)=>new ot({"aws.auth#sigv4":Le.credentials})})),this.middlewareStack.use(rt(this.config))}destroy(){super.destroy()}}var qe=gt(ss,"Signin","SigninClient",Tt),Hs={IsControlPlane:{type:"staticContextParams",value:!1}},Vs={IsOAuthEndpoint:{type:"staticContextParams",value:!0}},Me=(p,E,m,I)=>[];class Y extends qe(Hs,Me,"CreateOAuth2Token",Fe){}class J extends qe(Vs,Me,"CreateOAuth2TokenWithIAM",be){}var Ws={CreateOAuth2TokenCommand:Y,CreateOAuth2TokenWithIAMCommand:J};class Z extends Q{}lt(Ws,Z);var Ls={AUTHCODE_EXPIRED:"AUTHCODE_EXPIRED",CONFLICT:"CONFLICT",INSUFFICIENT_PERMISSIONS:"INSUFFICIENT_PERMISSIONS",INVALID_REQUEST:"INVALID_REQUEST",RESOURCE_NOT_FOUND:"RESOURCE_NOT_FOUND",SERVER_ERROR:"server_error",SERVICE_QUOTA_EXCEEDED:"SERVICE_QUOTA_EXCEEDED",TOKEN_EXPIRED:"TOKEN_EXPIRED",USER_CREDENTIALS_CHANGED:"USER_CREDENTIALS_CHANGED"};var js=F,Gs=Re,Ks=xe,Xs=Fe,Qs=Y,Ys=ye,Js=De,Zs=Ne,en=we,tn=be,sn=J,nn=$e,on=Ue,rn=b,an=ve,cn=Ls,un=Z,pn=Q,dn=T,hn=Ce,gn=q,ln=fe,En=M,mn=Pe,An=Te;export{zs as $Command,Bs as __Client,js as AccessDeniedException,Gs as AccessDeniedException$,Ks as AccessToken$,Xs as CreateOAuth2Token$,Qs as CreateOAuth2TokenCommand,Ys as CreateOAuth2TokenRequest$,Js as CreateOAuth2TokenRequestBody$,Zs as CreateOAuth2TokenResponse$,en as CreateOAuth2TokenResponseBody$,tn as CreateOAuth2TokenWithIAM$,sn as CreateOAuth2TokenWithIAMCommand,nn as CreateOAuth2TokenWithIAMRequest$,on as CreateOAuth2TokenWithIAMResponse$,rn as InternalServerException,an as InternalServerException$,cn as OAuth2ErrorCode,un as Signin,pn as SigninClient,dn as SigninServiceException,hn as SigninServiceException$,gn as TooManyRequestsError,ln as TooManyRequestsError$,En as ValidationException,mn as ValidationException$,An as errorTypeRegistries};

package/bin/chunk-62q3kf5d.js

@@ -1,2 +0,0 @@
-// @bun
-import{A,e,t}from"./shumai-transcode-app.js";var f=A(t()),i=A(e());import{readFileSync as S}from"fs";var a=(o)=>async(l)=>{o.logger?.debug("@aws-sdk/credential-provider-web-identity - fromWebToken");let{roleArn:r,roleSessionName:n,webIdentityToken:c,providerId:s,policyArns:g,policy:E,durationSeconds:p}=o,{roleAssumerWithWebIdentity:d}=o;if(!d){let{getDefaultRoleAssumerWithWebIdentity:_}=await import("./chunk-44p6jb11.js");d=_({...o.clientConfig,credentialProviderLogger:o.logger,parentClientConfig:{...l?.callerClientConfig,...o.parentClientConfig}},o.clientPlugins)}return d({RoleArn:r,RoleSessionName:n??`aws-sdk-js-session-${Date.now()}`,WebIdentityToken:c,ProviderId:s,PolicyArns:g,Policy:E,DurationSeconds:p})};var m="AWS_WEB_IDENTITY_TOKEN_FILE",T="AWS_ROLE_ARN",N="AWS_ROLE_SESSION_NAME",I=(o={})=>async(l)=>{o.logger?.debug("@aws-sdk/credential-provider-web-identity - fromTokenFile");let r=o?.webIdentityTokenFile??process.env[m],n=o?.roleArn??process.env[T],c=o?.roleSessionName??process.env[N];if(!r||!n)throw new i.CredentialsProviderError("Web identity configuration not specified",{logger:o.logger});let s=await a({...o,webIdentityToken:i.externalDataInterceptor?.getTokenRecord?.()[r]??S(r,{encoding:"ascii"}),roleArn:n,roleSessionName:c})(l);if(r===process.env[m])f.setCredentialFeature(s,"CREDENTIALS_ENV_VARS_STS_WEB_ID_TOKEN","h");return s};export{I as fromTokenFile};