euclid-ndk 0.2.0

package/dist/auth/scheme.js

@@ -0,0 +1,44 @@
+/** Which request-signing scheme a client uses when it authenticates with an access key. */
+import * as rfc9421 from "./rfc9421.js";
+import * as sigv4 from "./sigv4.js";
+/** What euclid has always spoken, and the default. */
+export const SIGV4 = Object.freeze({
+    name: "sigv4",
+    sign(req, accessKeyId, secretAccessKey, region, service) {
+        sigv4.sign(req, accessKeyId, secretAccessKey, region, service);
+    },
+    verify(req, lookupSecret) {
+        return sigv4.verify(req, lookupSecret);
+    },
+    signatureHeaderNames() {
+        return sigv4.SIGNATURE_HEADER_NAMES;
+    },
+});
+/** The standard scheme meant to replace SigV4. */
+export const RFC9421 = Object.freeze({
+    name: "rfc9421",
+    sign(req, accessKeyId, secretAccessKey) {
+        rfc9421.sign(req, accessKeyId, secretAccessKey);
+    },
+    verify(req, lookupSecret) {
+        return rfc9421.verify(req, lookupSecret);
+    },
+    signatureHeaderNames() {
+        return rfc9421.SIGNATURE_HEADER_NAMES;
+    },
+});
+/**
+ * Which scheme, if either, a received request presents a signature for.
+ *
+ * A routing decision, not a verification: it says which {@link SigningScheme.verify} to call and
+ * nothing about whether that call will succeed. Null means the request presents no signature at
+ * all - a bearer-token request, or an unsigned one.
+ */
+export function signingSchemeOf(req) {
+    if (req.get("signature-input"))
+        return RFC9421;
+    if (req.get("authorization").startsWith(sigv4.ALGORITHM))
+        return SIGV4;
+    return null;
+}
+//# sourceMappingURL=scheme.js.map

package/dist/auth/scheme.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheme.js","sourceRoot":"","sources":["../../src/auth/scheme.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAE3F,OAAO,KAAK,OAAO,MAAM,cAAc,CAAC;AAExC,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AAqCpC,sDAAsD;AACtD,MAAM,CAAC,MAAM,KAAK,GAAkB,MAAM,CAAC,MAAM,CAAgB;IAC/D,IAAI,EAAE,OAAO;IACb,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO;QACrD,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,CAAC,GAAG,EAAE,YAAY;QACtB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACzC,CAAC;IACD,oBAAoB;QAClB,OAAO,KAAK,CAAC,sBAAsB,CAAC;IACtC,CAAC;CACF,CAAC,CAAC;AAEH,kDAAkD;AAClD,MAAM,CAAC,MAAM,OAAO,GAAkB,MAAM,CAAC,MAAM,CAAgB;IACjE,IAAI,EAAE,SAAS;IACf,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,eAAe;QACpC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,CAAC,GAAG,EAAE,YAAY;QACtB,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC3C,CAAC;IACD,oBAAoB;QAClB,OAAO,OAAO,CAAC,sBAAsB,CAAC;IACxC,CAAC;CACF,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,GAAoB;IAClD,IAAI,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAAE,OAAO,OAAO,CAAC;IAC/C,IAAI,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACvE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/auth/signable.d.ts

@@ -0,0 +1,37 @@
+/** The view of a request that the signing schemes work on. */
+/**
+ * A minimal, transport-agnostic request: method, target, headers and body.
+ *
+ * Deliberately not node's `ClientRequest`. A signature has to be computed over headers that are
+ * already set and then written back as more headers, which needs a mutable object that exists
+ * before anything is sent - and it has to be the same object the verifier sees on the other side,
+ * so that signing and verification are demonstrably the same canonicalisation rather than two
+ * implementations of one description.
+ *
+ * Header names are stored lowercase and values trimmed, because that is what both canonical forms
+ * are defined over: HTTP header names are case-insensitive, and neither SigV4 nor RFC 9421 treats
+ * the surrounding whitespace of a value as part of it.
+ */
+export declare class SignableRequest {
+    #private;
+    readonly method: string;
+    readonly target: string;
+    constructor(method: string, target: string);
+    get body(): Buffer;
+    get scheme(): string;
+    /** The headers, keyed by lowercase name, in the order they were first set. */
+    get headers(): Record<string, string>;
+    /** Sets a header, and returns this so calls can be chained. */
+    header(name: string, value: string): this;
+    /** Copies every header of an object onto this request. */
+    headersFrom(headers: Record<string, string | undefined>): this;
+    /** A header's value, or the empty string when the request does not carry it. */
+    get(name: string): string;
+    /** Whether the request carries a header at all, which is not the same as it being non-empty. */
+    has(name: string): boolean;
+    /** Sets the body. Text is encoded as UTF-8, which is what both ends hash. */
+    setBody(body: Buffer | string | null | undefined): this;
+    /** Sets the URI scheme. Ignored when empty, leaving the https default in place. */
+    setScheme(scheme: string | null | undefined): this;
+}
+//# sourceMappingURL=signable.d.ts.map

package/dist/auth/signable.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signable.d.ts","sourceRoot":"","sources":["../../src/auth/signable.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAE9D;;;;;;;;;;;;GAYG;AACH,qBAAa,eAAe;;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAQZ,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAK1C,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED,8EAA8E;IAC9E,IAAI,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEpC;IAED,+DAA+D;IAC/D,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAKzC,0DAA0D;IAC1D,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,IAAI;IAO9D,gFAAgF;IAChF,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAIzB,gGAAgG;IAChG,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B,6EAA6E;IAC7E,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI;IAKvD,mFAAmF;IACnF,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI;CAInD"}

package/dist/auth/signable.js

@@ -0,0 +1,70 @@
+/** The view of a request that the signing schemes work on. */
+/**
+ * A minimal, transport-agnostic request: method, target, headers and body.
+ *
+ * Deliberately not node's `ClientRequest`. A signature has to be computed over headers that are
+ * already set and then written back as more headers, which needs a mutable object that exists
+ * before anything is sent - and it has to be the same object the verifier sees on the other side,
+ * so that signing and verification are demonstrably the same canonicalisation rather than two
+ * implementations of one description.
+ *
+ * Header names are stored lowercase and values trimmed, because that is what both canonical forms
+ * are defined over: HTTP header names are case-insensitive, and neither SigV4 nor RFC 9421 treats
+ * the surrounding whitespace of a value as part of it.
+ */
+export class SignableRequest {
+    method;
+    target;
+    #headers = new Map();
+    #body = Buffer.alloc(0);
+    // https, because that is how euclid is reached anywhere the distinction can matter. A
+    // plain-HTTP caller sets it so that both ends agree on whether the port belongs in "@authority".
+    #scheme = "https";
+    constructor(method, target) {
+        this.method = method;
+        this.target = target;
+    }
+    get body() {
+        return this.#body;
+    }
+    get scheme() {
+        return this.#scheme;
+    }
+    /** The headers, keyed by lowercase name, in the order they were first set. */
+    get headers() {
+        return Object.fromEntries(this.#headers);
+    }
+    /** Sets a header, and returns this so calls can be chained. */
+    header(name, value) {
+        this.#headers.set(name.toLowerCase(), value.trim());
+        return this;
+    }
+    /** Copies every header of an object onto this request. */
+    headersFrom(headers) {
+        for (const [name, value] of Object.entries(headers)) {
+            if (value !== undefined)
+                this.header(name, value);
+        }
+        return this;
+    }
+    /** A header's value, or the empty string when the request does not carry it. */
+    get(name) {
+        return this.#headers.get(name.toLowerCase()) ?? "";
+    }
+    /** Whether the request carries a header at all, which is not the same as it being non-empty. */
+    has(name) {
+        return this.#headers.has(name.toLowerCase());
+    }
+    /** Sets the body. Text is encoded as UTF-8, which is what both ends hash. */
+    setBody(body) {
+        this.#body = body == null ? Buffer.alloc(0) : typeof body === "string" ? Buffer.from(body, "utf8") : body;
+        return this;
+    }
+    /** Sets the URI scheme. Ignored when empty, leaving the https default in place. */
+    setScheme(scheme) {
+        if (scheme)
+            this.#scheme = scheme.toLowerCase();
+        return this;
+    }
+}
+//# sourceMappingURL=signable.js.map

package/dist/auth/signable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signable.js","sourceRoot":"","sources":["../../src/auth/signable.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAE9D;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,eAAe;IACjB,MAAM,CAAS;IACf,MAAM,CAAS;IAExB,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IACrC,KAAK,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,sFAAsF;IACtF,iGAAiG;IACjG,OAAO,GAAG,OAAO,CAAC;IAElB,YAAY,MAAc,EAAE,MAAc;QACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,8EAA8E;IAC9E,IAAI,OAAO;QACT,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED,+DAA+D;IAC/D,MAAM,CAAC,IAAY,EAAE,KAAa;QAChC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0DAA0D;IAC1D,WAAW,CAAC,OAA2C;QACrD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACpD,IAAI,KAAK,KAAK,SAAS;gBAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gFAAgF;IAChF,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IACrD,CAAC;IAED,gGAAgG;IAChG,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,6EAA6E;IAC7E,OAAO,CAAC,IAAwC;QAC9C,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1G,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mFAAmF;IACnF,SAAS,CAAC,MAAiC;QACzC,IAAI,MAAM;YAAE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/auth/sigv4.d.ts

@@ -0,0 +1,72 @@
+/**
+ * AWS Signature Version 4 request signing and verification.
+ *
+ * Ported from euclid's `Core::SigV4` (C++, `core/src/SigV4.cpp`), by way of euclid-pdk. Unlike real
+ * AWS, the target service and the action live in `x-euclid-*` headers rather than in the URI, so
+ * those headers are always part of the signed set: a fixed list rather than the client-chosen
+ * `SignedHeaders` that AWS allows, so that nothing in transit can narrow what a signature actually
+ * covers and still have it verify.
+ */
+import type { SignableRequest } from "./signable.js";
+export declare const ALGORITHM = "AWS4-HMAC-SHA256";
+/**
+ * Signature headers, in the case they are sent in, for callers that copy them onto some other
+ * request object afterwards.
+ */
+export declare const SIGNATURE_HEADER_NAMES: readonly ["x-amz-date", "x-amz-content-sha256", "Authorization"];
+/** The `<key>/<date>/<region>/<service>/aws4_request` scope out of an Authorization header. */
+export interface CredentialScope {
+    accessKeyId: string;
+    dateStamp: string;
+    region: string;
+    service: string;
+}
+/** An Authorization header split into its parts. */
+export interface ParsedAuthorization {
+    scope: CredentialScope;
+    signedHeaders: string;
+    signature: string;
+}
+/** The headers a SigV4 signature always covers, lowercase, in signing order. */
+export declare function signedHeaderNames(): readonly string[];
+/**
+ * Parses `AWS4-HMAC-SHA256 Credential=..., SignedHeaders=..., Signature=...`.
+ *
+ * Answers null when the header is absent or not well-formed, which the caller treats exactly as it
+ * treats a signature that does not match - see {@link verify}.
+ */
+export declare function parseAuthorizationHeader(headerValue: string | undefined): ParsedAuthorization | null;
+/**
+ * Percent-decodes each name and value, re-encodes them per SigV4's rules, and sorts by name.
+ *
+ * euclid POSTs everything to `/` and carries its arguments in the body, so in practice this
+ * canonicalises the empty string. It is here because the canonical request has a slot for it and a
+ * signature computed with a different filling for that slot does not verify.
+ */
+export declare function canonicalizeQueryString(rawQuery: string): string;
+/** Builds the SigV4 canonical request string. */
+export declare function buildCanonicalRequest(method: string, canonicalUri: string, canonicalQuery: string, headers: Record<string, string>, headerNames: readonly string[], payloadHashHex: string): string;
+/** Builds the SigV4 string-to-sign. */
+export declare function buildStringToSign(amzDate: string, credentialScope: string, canonicalRequestHashHex: string): string;
+/** Derives the signing key via the kDate -> kRegion -> kService -> kSigning HMAC chain. */
+export declare function deriveSigningKey(secretAccessKey: string, dateStamp: string, region: string, service: string): Buffer;
+/**
+ * Signs a request in place: sets x-amz-date, x-amz-content-sha256 and Authorization.
+ *
+ * Call it once every other header the signature covers - the `x-euclid-*` ones and host - and the
+ * body are already set on `req`. Anything set afterwards is not covered, and on the server that is
+ * indistinguishable from an attacker having added it.
+ */
+export declare function sign(req: SignableRequest, accessKeyId: string, secretAccessKey: string, region: string, service: string): void;
+/**
+ * Verifies a SigV4-signed request, answering the access key ID it was signed with.
+ *
+ * Recomputes the signature from the request exactly as received and compares it in constant time,
+ * so any change to a signed header or to the body between signing and here makes this fail.
+ *
+ * Answers null on every failure - missing or malformed header, unknown key, stale timestamp,
+ * mismatched signature - without saying which, the way token verification collapses its failure
+ * modes into one rejection. A caller that could tell them apart would be an oracle.
+ */
+export declare function verify(req: SignableRequest, lookupSecret: (accessKeyId: string) => string | null | undefined, maxSkewMs?: number): string | null;
+//# sourceMappingURL=sigv4.d.ts.map

package/dist/auth/sigv4.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigv4.d.ts","sourceRoot":"","sources":["../../src/auth/sigv4.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,eAAO,MAAM,SAAS,qBAAqB,CAAC;AAsB5C;;;GAGG;AACH,eAAO,MAAM,sBAAsB,kEAAmE,CAAC;AAEvG,+FAA+F;AAC/F,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,oDAAoD;AACpD,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,eAAe,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,gFAAgF;AAChF,wBAAgB,iBAAiB,IAAI,SAAS,MAAM,EAAE,CAErD;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,GAAG,IAAI,CAsBpG;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAchE;AAED,iDAAiD;AACjD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,cAAc,EAAE,MAAM,GACrB,MAAM,CAGR;AAED,uCAAuC;AACvC,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,GAAG,MAAM,CAEnH;AAED,2FAA2F;AAC3F,wBAAgB,gBAAgB,CAAC,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAKpH;AAED;;;;;;GAMG;AACH,wBAAgB,IAAI,CAClB,GAAG,EAAE,eAAe,EACpB,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GACd,IAAI,CA0BN;AAED;;;;;;;;;GASG;AACH,wBAAgB,MAAM,CACpB,GAAG,EAAE,eAAe,EACpB,YAAY,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,EAChE,SAAS,GAAE,MAA4B,GACtC,MAAM,GAAG,IAAI,CAuCf"}

package/dist/auth/sigv4.js

@@ -0,0 +1,227 @@
+/**
+ * AWS Signature Version 4 request signing and verification.
+ *
+ * Ported from euclid's `Core::SigV4` (C++, `core/src/SigV4.cpp`), by way of euclid-pdk. Unlike real
+ * AWS, the target service and the action live in `x-euclid-*` headers rather than in the URI, so
+ * those headers are always part of the signed set: a fixed list rather than the client-chosen
+ * `SignedHeaders` that AWS allows, so that nothing in transit can narrow what a signature actually
+ * covers and still have it verify.
+ */
+import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+export const ALGORITHM = "AWS4-HMAC-SHA256";
+const SCOPE_TERMINATOR = "aws4_request";
+const DEFAULT_MAX_SKEW_MS = 15 * 60 * 1000;
+/**
+ * Always part of the signature, in the (already alphabetical) order the canonical request needs.
+ * host and the two x-amz-* headers give the usual SigV4 transport and payload integrity; the
+ * x-euclid-* headers are in there because that is where euclid carries the routing information AWS
+ * would put in the URI, and a signature that left them out would authenticate a request without
+ * authenticating what it asks for.
+ */
+const SIGNED_HEADER_NAMES = [
+    "host",
+    "x-amz-content-sha256",
+    "x-amz-date",
+    "x-euclid-account-id",
+    "x-euclid-action",
+    "x-euclid-region",
+    "x-euclid-target",
+    "x-euclid-user-id",
+];
+/**
+ * Signature headers, in the case they are sent in, for callers that copy them onto some other
+ * request object afterwards.
+ */
+export const SIGNATURE_HEADER_NAMES = ["x-amz-date", "x-amz-content-sha256", "Authorization"];
+/** The headers a SigV4 signature always covers, lowercase, in signing order. */
+export function signedHeaderNames() {
+    return SIGNED_HEADER_NAMES;
+}
+/**
+ * Parses `AWS4-HMAC-SHA256 Credential=..., SignedHeaders=..., Signature=...`.
+ *
+ * Answers null when the header is absent or not well-formed, which the caller treats exactly as it
+ * treats a signature that does not match - see {@link verify}.
+ */
+export function parseAuthorizationHeader(headerValue) {
+    if (!headerValue || !headerValue.startsWith(ALGORITHM))
+        return null;
+    let credential = "";
+    let signedHeaders = "";
+    let signature = "";
+    for (const part of headerValue.slice(ALGORITHM.length).trim().split(",")) {
+        const trimmed = part.trim();
+        if (trimmed.startsWith("Credential="))
+            credential = trimmed.slice("Credential=".length);
+        else if (trimmed.startsWith("SignedHeaders="))
+            signedHeaders = trimmed.slice("SignedHeaders=".length);
+        else if (trimmed.startsWith("Signature="))
+            signature = trimmed.slice("Signature=".length);
+    }
+    if (!credential || !signedHeaders || !signature)
+        return null;
+    const parts = credential.split("/");
+    if (parts.length !== 5 || parts[4] !== SCOPE_TERMINATOR)
+        return null;
+    return {
+        scope: { accessKeyId: parts[0], dateStamp: parts[1], region: parts[2], service: parts[3] },
+        signedHeaders,
+        signature,
+    };
+}
+/**
+ * Percent-decodes each name and value, re-encodes them per SigV4's rules, and sorts by name.
+ *
+ * euclid POSTs everything to `/` and carries its arguments in the body, so in practice this
+ * canonicalises the empty string. It is here because the canonical request has a slot for it and a
+ * signature computed with a different filling for that slot does not verify.
+ */
+export function canonicalizeQueryString(rawQuery) {
+    if (!rawQuery)
+        return "";
+    const params = [];
+    for (const pair of rawQuery.split("&")) {
+        if (!pair)
+            continue;
+        const equals = pair.indexOf("=");
+        const name = equals < 0 ? pair : pair.slice(0, equals);
+        const value = equals < 0 ? "" : pair.slice(equals + 1);
+        params.push([uriEncode(percentDecode(name)), uriEncode(percentDecode(value))]);
+    }
+    params.sort((left, right) => (left[0] < right[0] ? -1 : left[0] > right[0] ? 1 : left[1] < right[1] ? -1 : left[1] > right[1] ? 1 : 0));
+    return params.map(([name, value]) => `${name}=${value}`).join("&");
+}
+/** Builds the SigV4 canonical request string. */
+export function buildCanonicalRequest(method, canonicalUri, canonicalQuery, headers, headerNames, payloadHashHex) {
+    const canonicalHeaders = headerNames.map((name) => `${name}:${headers[name] ?? ""}\n`).join("");
+    return [method, canonicalUri, canonicalQuery, canonicalHeaders, headerNames.join(";"), payloadHashHex].join("\n");
+}
+/** Builds the SigV4 string-to-sign. */
+export function buildStringToSign(amzDate, credentialScope, canonicalRequestHashHex) {
+    return [ALGORITHM, amzDate, credentialScope, canonicalRequestHashHex].join("\n");
+}
+/** Derives the signing key via the kDate -> kRegion -> kService -> kSigning HMAC chain. */
+export function deriveSigningKey(secretAccessKey, dateStamp, region, service) {
+    const kDate = hmac(Buffer.from(`AWS4${secretAccessKey}`, "utf8"), dateStamp);
+    const kRegion = hmac(kDate, region);
+    const kService = hmac(kRegion, service);
+    return hmac(kService, SCOPE_TERMINATOR);
+}
+/**
+ * Signs a request in place: sets x-amz-date, x-amz-content-sha256 and Authorization.
+ *
+ * Call it once every other header the signature covers - the `x-euclid-*` ones and host - and the
+ * body are already set on `req`. Anything set afterwards is not covered, and on the server that is
+ * indistinguishable from an attacker having added it.
+ */
+export function sign(req, accessKeyId, secretAccessKey, region, service) {
+    const amzDate = formatAmzDate(new Date());
+    const dateStamp = amzDate.slice(0, 8);
+    req.header("x-amz-date", amzDate);
+    req.header("x-amz-content-sha256", sha256Hex(req.body));
+    const [canonicalUri, canonicalQuery] = splitTarget(req.target);
+    const canonicalRequest = buildCanonicalRequest(req.method, canonicalUri, canonicalQuery, req.headers, SIGNED_HEADER_NAMES, req.get("x-amz-content-sha256"));
+    const credentialScope = `${dateStamp}/${region}/${service}/${SCOPE_TERMINATOR}`;
+    const stringToSign = buildStringToSign(amzDate, credentialScope, sha256Hex(Buffer.from(canonicalRequest, "utf8")));
+    const signature = hmac(deriveSigningKey(secretAccessKey, dateStamp, region, service), stringToSign).toString("hex");
+    req.header("Authorization", `${ALGORITHM} Credential=${accessKeyId}/${credentialScope}, ` +
+        `SignedHeaders=${SIGNED_HEADER_NAMES.join(";")}, Signature=${signature}`);
+}
+/**
+ * Verifies a SigV4-signed request, answering the access key ID it was signed with.
+ *
+ * Recomputes the signature from the request exactly as received and compares it in constant time,
+ * so any change to a signed header or to the body between signing and here makes this fail.
+ *
+ * Answers null on every failure - missing or malformed header, unknown key, stale timestamp,
+ * mismatched signature - without saying which, the way token verification collapses its failure
+ * modes into one rejection. A caller that could tell them apart would be an oracle.
+ */
+export function verify(req, lookupSecret, maxSkewMs = DEFAULT_MAX_SKEW_MS) {
+    const parsed = parseAuthorizationHeader(req.get("authorization"));
+    if (parsed === null)
+        return null;
+    // Fixed policy rather than client-negotiated: a request does not get to choose how little of
+    // itself it authenticates.
+    if (parsed.signedHeaders !== SIGNED_HEADER_NAMES.join(";"))
+        return null;
+    const secret = lookupSecret(parsed.scope.accessKeyId);
+    if (secret == null)
+        return null;
+    const headers = req.headers;
+    const amzDate = headers["x-amz-date"] ?? "";
+    if (amzDate.length < 8 || amzDate.slice(0, 8) !== parsed.scope.dateStamp)
+        return null;
+    const requestTime = parseAmzDate(amzDate);
+    if (requestTime === null || Math.abs(Date.now() - requestTime) > maxSkewMs)
+        return null;
+    const payloadHash = headers["x-amz-content-sha256"];
+    if (payloadHash === undefined || payloadHash !== sha256Hex(req.body))
+        return null;
+    const [canonicalUri, canonicalQuery] = splitTarget(req.target);
+    const canonicalRequest = buildCanonicalRequest(req.method, canonicalUri, canonicalQuery, headers, SIGNED_HEADER_NAMES, payloadHash);
+    const credentialScope = `${parsed.scope.dateStamp}/${parsed.scope.region}/${parsed.scope.service}/${SCOPE_TERMINATOR}`;
+    const stringToSign = buildStringToSign(amzDate, credentialScope, sha256Hex(Buffer.from(canonicalRequest, "utf8")));
+    const expected = hmac(deriveSigningKey(secret, parsed.scope.dateStamp, parsed.scope.region, parsed.scope.service), stringToSign).toString("hex");
+    return equal(expected, parsed.signature) ? parsed.scope.accessKeyId : null;
+}
+// -- internals -------------------------------------------------------------------------------
+/** `20150830T123600Z`, which is what SigV4 dates look like. */
+function formatAmzDate(when) {
+    return when.toISOString().replace(/[-:]/g, "").replace(/\.\d{3}/, "");
+}
+function parseAmzDate(amzDate) {
+    const match = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})Z$/.exec(amzDate);
+    if (!match)
+        return null;
+    const [, year, month, day, hour, minute, second] = match.map(Number);
+    return Date.UTC(year, month - 1, day, hour, minute, second);
+}
+function splitTarget(target) {
+    const question = target.indexOf("?");
+    if (question < 0)
+        return [target, ""];
+    return [target.slice(0, question), canonicalizeQueryString(target.slice(question + 1))];
+}
+/** SigV4's URI-encoding: everything but the unreserved set, uppercase hex, byte by byte. */
+function uriEncode(value) {
+    let out = "";
+    for (const byte of value) {
+        const char = String.fromCharCode(byte);
+        if (/[A-Za-z0-9\-_.~]/.test(char))
+            out += char;
+        else
+            out += `%${byte.toString(16).toUpperCase().padStart(2, "0")}`;
+    }
+    return out;
+}
+function percentDecode(value) {
+    const out = [];
+    let i = 0;
+    while (i < value.length) {
+        if (value[i] === "%" && i + 2 < value.length) {
+            const hex = value.slice(i + 1, i + 3);
+            if (/^[0-9A-Fa-f]{2}$/.test(hex)) {
+                out.push(parseInt(hex, 16));
+                i += 3;
+                continue;
+            }
+        }
+        out.push(...Buffer.from(value[i], "utf8"));
+        i += 1;
+    }
+    return Buffer.from(out);
+}
+function sha256Hex(data) {
+    return createHash("sha256").update(data).digest("hex");
+}
+function hmac(key, data) {
+    return createHmac("sha256", key).update(data, "utf8").digest();
+}
+/** Constant-time string comparison, which is what a signature check has to be. */
+function equal(left, right) {
+    const a = Buffer.from(left, "utf8");
+    const b = Buffer.from(right, "utf8");
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+//# sourceMappingURL=sigv4.js.map

package/dist/auth/sigv4.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigv4.js","sourceRoot":"","sources":["../../src/auth/sigv4.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAItE,MAAM,CAAC,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAC5C,MAAM,gBAAgB,GAAG,cAAc,CAAC;AACxC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG;IAC1B,MAAM;IACN,sBAAsB;IACtB,YAAY;IACZ,qBAAqB;IACrB,iBAAiB;IACjB,iBAAiB;IACjB,iBAAiB;IACjB,kBAAkB;CACV,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,YAAY,EAAE,sBAAsB,EAAE,eAAe,CAAU,CAAC;AAiBvG,gFAAgF;AAChF,MAAM,UAAU,iBAAiB;IAC/B,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,WAA+B;IACtE,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpE,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,IAAI,aAAa,GAAG,EAAE,CAAC;IACvB,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACzE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC;YAAE,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;aACnF,IAAI,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC;YAAE,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;aACjG,IAAI,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE7D,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAErE,OAAO;QACL,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE;QAC9F,aAAa;QACb,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IAEzB,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxI,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrE,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,qBAAqB,CACnC,MAAc,EACd,YAAoB,EACpB,cAAsB,EACtB,OAA+B,EAC/B,WAA8B,EAC9B,cAAsB;IAEtB,MAAM,gBAAgB,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChG,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpH,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,eAAuB,EAAE,uBAA+B;IACzG,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,eAAe,EAAE,uBAAuB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnF,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,gBAAgB,CAAC,eAAuB,EAAE,SAAiB,EAAE,MAAc,EAAE,OAAe;IAC1G,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,eAAe,EAAE,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxC,OAAO,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,IAAI,CAClB,GAAoB,EACpB,WAAmB,EACnB,eAAuB,EACvB,MAAc,EACd,OAAe;IAEf,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAEtC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAClC,GAAG,CAAC,MAAM,CAAC,sBAAsB,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAExD,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/D,MAAM,gBAAgB,GAAG,qBAAqB,CAC5C,GAAG,CAAC,MAAM,EACV,YAAY,EACZ,cAAc,EACd,GAAG,CAAC,OAAO,EACX,mBAAmB,EACnB,GAAG,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAChC,CAAC;IAEF,MAAM,eAAe,GAAG,GAAG,SAAS,IAAI,MAAM,IAAI,OAAO,IAAI,gBAAgB,EAAE,CAAC;IAChF,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,EAAE,eAAe,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACnH,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEpH,GAAG,CAAC,MAAM,CACR,eAAe,EACf,GAAG,SAAS,eAAe,WAAW,IAAI,eAAe,IAAI;QAC3D,iBAAiB,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,SAAS,EAAE,CAC3E,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,MAAM,CACpB,GAAoB,EACpB,YAAgE,EAChE,YAAoB,mBAAmB;IAEvC,MAAM,MAAM,GAAG,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IAClE,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEjC,6FAA6F;IAC7F,2BAA2B;IAC3B,IAAI,MAAM,CAAC,aAAa,KAAK,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAExE,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACtD,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAEhC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAEtF,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,WAAW,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,GAAG,SAAS;QAAE,OAAO,IAAI,CAAC;IAExF,MAAM,WAAW,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACpD,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAElF,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/D,MAAM,gBAAgB,GAAG,qBAAqB,CAC5C,GAAG,CAAC,MAAM,EACV,YAAY,EACZ,cAAc,EACd,OAAO,EACP,mBAAmB,EACnB,WAAW,CACZ,CAAC;IAEF,MAAM,eAAe,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,gBAAgB,EAAE,CAAC;IACvH,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,EAAE,eAAe,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACnH,MAAM,QAAQ,GAAG,IAAI,CACnB,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAC3F,YAAY,CACb,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAElB,OAAO,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7E,CAAC;AAED,+FAA+F;AAE/F,+DAA+D;AAC/D,SAAS,aAAa,CAAC,IAAU;IAC/B,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,KAAK,GAAG,gDAAgD,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7E,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAA6D,CAAC;IACjI,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,QAAQ,GAAG,CAAC;QAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,uBAAuB,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,4FAA4F;AAC5F,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,GAAG,IAAI,IAAI,CAAC;;YAC1C,GAAG,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACtC,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC5B,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5C,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,IAAI,CAAC,GAAW,EAAE,IAAY;IACrC,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AACjE,CAAC;AAED,kFAAkF;AAClF,SAAS,KAAK,CAAC,IAAY,EAAE,KAAa;IACxC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACrC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC"}

package/dist/credentials.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The `~/.euclid/credentials` file, shared with euclid-cli, euclid-jdk and euclid-pdk.
+ *
+ * All four clients read and write the same file, so a login from any of them is picked up by the
+ * others. That makes the field names a wire format rather than an implementation detail: the
+ * namespace key is `namespace` (not `nameSpace`), `isAdmin` travels alongside the token, and an
+ * absent namespace is written as an empty string rather than null so the CLI's string reader can
+ * take it. `baseUrl` is the one field the CLI has no equivalent for - it is what lets a cached
+ * session be recognised as belonging to the server being talked to now.
+ */
+/** One cached login. */
+export interface CachedCredentials {
+    token: string;
+    userId: string;
+    accountId: string;
+    region: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    isAdmin: boolean;
+    baseUrl: string;
+    namespace: string;
+    /** The document as it was read, for fields a later euclid added that this one does not name. */
+    raw: Record<string, unknown>;
+}
+/**
+ * Where the credentials live.
+ *
+ * Resolved per call rather than captured at import, mirroring euclid-cli's
+ * `Credentials::FilePath()`: the home directory is read when the file is actually touched, so a
+ * process that changes it is not left talking to a stale path. `EUCLID_CREDENTIALS_FILE` overrides
+ * it, which is also how a euclid-managed application is handed its own credentials.
+ */
+export declare function credentialsPath(): string;
+/** The cached credentials, or null when there is no readable, well-formed file. */
+export declare function load(): Promise<CachedCredentials | null>;
+/** Writes the credentials, readable by their owner alone. */
+export declare function save(credentials: CachedCredentials): Promise<void>;
+/**
+ * Patches the cached namespace in place, if what is cached belongs to `baseUrl`.
+ *
+ * Keeps the file in step when a session's namespace changes outside of a login. A no-op when
+ * nothing is cached for that server, in keeping with the best-effort nature of the cache: failing
+ * to record a namespace is not a reason to fail the call that changed it.
+ */
+export declare function updateNamespace(baseUrl: string, namespace: string): Promise<void>;
+/**
+ * Whether a JWT is well-formed and its `exp` is still in the future.
+ *
+ * Checked locally to avoid a round trip that would only tell us what the token already says. The
+ * signature is not verified - the client does not hold the server's secret, and a token the client
+ * forged for itself would be rejected on arrival anyway.
+ */
+export declare function isTokenValid(token: string): boolean;
+/** An empty set of credentials, which is what every field defaults from. */
+export declare function emptyCredentials(): CachedCredentials;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,wBAAwB;AACxB,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,gGAAgG;IAChG,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,mFAAmF;AACnF,wBAAsB,IAAI,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAW9D;AAED,6DAA6D;AAC7D,wBAAsB,IAAI,CAAC,WAAW,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAUxE;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKvF;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAYnD;AAED,4EAA4E;AAC5E,wBAAgB,gBAAgB,IAAI,iBAAiB,CAapD"}