@shumai-one/shumai 0.6.0 → 0.6.2

package/bin/{chunk-01ym2agz.js → chunk-kvhf12b4.js}

@@ -1,2 +1,2 @@
-import{I}from"./chunk-vvr8tnse.js";var a=[["path",{d:"M12 3v12",key:"1x0j5s"}],["path",{d:"m17 8-5-5-5 5",key:"7q97r8"}],["path",{d:"M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4",key:"ih7n3h"}]],uo=I("upload",a);
-export{uo};
+import{z}from"./chunk-zarz3sqn.js";var a=[["path",{d:"M12 3v12",key:"1x0j5s"}],["path",{d:"m17 8-5-5-5 5",key:"7q97r8"}],["path",{d:"M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4",key:"ih7n3h"}]],zo=z("upload",a);
+export{zo};

package/bin/chunk-m0q2cgfg.js

@@ -0,0 +1,2 @@
+// @bun
+import{Yt}from"./chunk-9xhjy897.js";import{at,sr}from"./chunk-e4yscwen.js";import{se}from"./chunk-2jj4j8cn.js";var A=se(Yt()),f=se(at());var g=se(at()),P=se(sr());import{createHash as F,createPrivateKey as L,createPublicKey as O,sign as H}from"crypto";import{promises as x}from"fs";import{homedir as K}from"os";import{dirname as _,join as I}from"path";class h{profileData;init;callerClientConfig;static REFRESH_THRESHOLD=300000;constructor(e,t,s){this.profileData=e,this.init=t,this.callerClientConfig=s}async loadCredentials(){let e=await this.loadToken();if(!e)throw new g.CredentialsProviderError(`Failed to load a token for session ${this.loginSession}, please re-authenticate using aws login`,{tryNextLink:!1,logger:this.logger});let t=e.accessToken,s=Date.now();if(new Date(t.expiresAt).getTime()-s<=h.REFRESH_THRESHOLD)return this.refresh(e);return this.toCredentials(e.accessToken)}get logger(){return this.init?.logger}get loginSession(){return this.profileData.login_session}toCredentials(e){return{accessKeyId:e.accessKeyId,secretAccessKey:e.secretAccessKey,sessionToken:e.sessionToken,accountId:e.accountId,expiration:new Date(e.expiresAt)}}async refresh(e){let t=await this.loadToken().catch(()=>e),s=Date.now(),r=new Date(t.accessToken.expiresAt).getTime(),n=new Date(e.accessToken.expiresAt).getTime(),o=r<=s&&n>s?e:t;if(new Date(o.accessToken.expiresAt).getTime()-Date.now()>h.REFRESH_THRESHOLD)return this.toCredentials(o.accessToken);let{SigninClient:p,CreateOAuth2TokenCommand:w}=await import("./chunk-fatmqnp1.js"),{logger:y,userAgentAppId:m}=this.callerClientConfig??{},T=((i)=>i?.metadata?.handlerProtocol==="h2")(this.callerClientConfig?.requestHandler)?void 0:this.callerClientConfig?.requestHandler,d=this.profileData.region??await this.callerClientConfig?.region?.()??process.env.AWS_REGION,u=new p({credentials:{accessKeyId:"",secretAccessKey:""},region:d,requestHandler:T,logger:y,userAgentAppId:m,...this.init?.clientConfig});this.createDPoPInterceptor(u.middlewareStack);let S={tokenInput:{clientId:o.clientId,refreshToken:o.refreshToken,grantType:"refresh_token"}};try{let i=await u.send(new w(S)),{accessKeyId:c,secretAccessKey:k,sessionToken:l}=i.tokenOutput?.accessToken??{},{refreshToken:D,expiresIn:N}=i.tokenOutput??{};if(!c||!k||!l||!D)throw new g.CredentialsProviderError("Token refresh response missing required fields",{logger:this.logger,tryNextLink:!1});let R=(N??900)*1000,b=new Date(Date.now()+R),C={...o,accessToken:{...o.accessToken,accessKeyId:c,secretAccessKey:k,sessionToken:l,expiresAt:b.toISOString()},refreshToken:D};return await this.saveToken(C),this.toCredentials(C.accessToken)}catch(i){if(i.name==="AccessDeniedException"){let k=i.error,l;switch(k){case"TOKEN_EXPIRED":l="Your session has expired. Please reauthenticate.";break;case"USER_CREDENTIALS_CHANGED":l="Unable to refresh credentials because of a change in your password. Please reauthenticate with your new password.";break;case"INSUFFICIENT_PERMISSIONS":l="Unable to refresh credentials due to insufficient permissions. You may be missing permission for the 'CreateOAuth2Token' action.";break;default:l=`Failed to refresh token: ${String(i)}. Please re-authenticate using \`aws login\``}throw new g.CredentialsProviderError(l,{logger:this.logger,tryNextLink:!1})}if(new Date(o.accessToken.expiresAt).getTime()>Date.now())return this.logger?.warn?.(`Failed to refresh token: ${String(i)}. Using existing token until expiry.`),this.toCredentials(o.accessToken);throw new g.CredentialsProviderError(`Failed to refresh token: ${String(i)}. Please re-authenticate using aws login`,{logger:this.logger})}}async loadToken(){let e=this.getTokenFilePath();try{let t=await x.readFile(e,"utf8"),s=JSON.parse(t),r=["accessToken","clientId","refreshToken","dpopKey"].filter((n)=>!s[n]);if(!s.accessToken?.accountId)r.push("accountId");if(r.length>0)throw new g.CredentialsProviderError(`Token validation failed, missing fields: ${r.join(", ")}`,{logger:this.logger,tryNextLink:!1});return s}catch(t){throw new g.CredentialsProviderError(`Failed to load token from ${e}: ${String(t)}`,{logger:this.logger,tryNextLink:!1})}}async saveToken(e){let t=this.getTokenFilePath(),s=_(t);try{await x.mkdir(s,{recursive:!0})}catch(r){}await x.writeFile(t,JSON.stringify(e,null,2),"utf8")}getTokenFilePath(){let e=process.env.AWS_LOGIN_CACHE_DIRECTORY??I(K(),".aws","login","cache"),t=Buffer.from(this.loginSession,"utf8"),s=F("sha256").update(t).digest("hex");return I(e,`${s}.json`)}derToRawSignature(e){let t=2;if(e[t]!==2)throw Error("Invalid DER signature");t++;let s=e[t++],r=e.subarray(t,t+s);if(t+=s,e[t]!==2)throw Error("Invalid DER signature");t++;let n=e[t++],o=e.subarray(t,t+n);r=r[0]===0?r.subarray(1):r,o=o[0]===0?o.subarray(1):o;let a=Buffer.concat([Buffer.alloc(32-r.length),r]),p=Buffer.concat([Buffer.alloc(32-o.length),o]);return Buffer.concat([a,p])}createDPoPInterceptor(e){e.add((t)=>async(s)=>{if(P.HttpRequest.isInstance(s.request)){let r=s.request,n=`${r.protocol}//${r.hostname}${r.port?`:${r.port}`:""}${r.path}`,o=await this.generateDpop(r.method,n);r.headers={...r.headers,DPoP:o}}return t(s)},{step:"finalizeRequest",name:"dpopInterceptor",override:!0})}async generateDpop(e="POST",t){let s=await this.loadToken();try{let r=L({key:s.dpopKey,format:"pem",type:"sec1"}),o=O(r).export({format:"der",type:"spki"}),a=-1;for(let c=0;c<o.length;c++)if(o[c]===4){a=c;break}let p=o.slice(a+1,a+33),w=o.slice(a+33,a+65),y={alg:"ES256",typ:"dpop+jwt",jwk:{kty:"EC",crv:"P-256",x:p.toString("base64url"),y:w.toString("base64url")}},m={jti:crypto.randomUUID(),htm:e,htu:t,iat:Math.floor(Date.now()/1000)},E=Buffer.from(JSON.stringify(y)).toString("base64url"),T=Buffer.from(JSON.stringify(m)).toString("base64url"),d=`${E}.${T}`,u=H("sha256",Buffer.from(d),r),i=this.derToRawSignature(u).toString("base64url");return`${d}.${i}`}catch(r){throw new g.CredentialsProviderError(`Failed to generate Dpop proof: ${r instanceof Error?r.message:String(r)}`,{logger:this.logger,tryNextLink:!1})}}}var v=(e)=>async({callerClientConfig:t}={})=>{e?.logger?.debug?.("@aws-sdk/credential-providers - fromLoginCredentials");let s=await f.parseKnownFiles(e||{}),r=f.getProfileName({profile:e?.profile??t?.profile}),n=s[r];if(!n?.login_session)throw new f.CredentialsProviderError(`Profile ${r} does not contain login_session.`,{tryNextLink:!0,logger:e?.logger});let a=await new h(n,e,t).loadCredentials();return A.setCredentialFeature(a,"CREDENTIALS_LOGIN","AD")};export{v as fromLoginCredentials};