publishport-opencli 1.8.4-pp.1

package/clis/douyin/_shared/tos-upload-short-read.test.js

@@ -0,0 +1,83 @@
+/**
+ * Tests for the fs.readSync short-read guard in tosUpload.
+ *
+ * This file is separate from tos-upload.test.ts because vi.mock is hoisted and
+ * would interfere with the real-fs tests there.
+ *
+ * Strategy:
+ * - Use setReadSyncOverride (exported testing seam) to force readSync to return 0
+ * - Mock global fetch to satisfy initMultipartUpload so the code path reaches readSync
+ */
+import * as actualFs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { CommandExecutionError } from '@jackwener/opencli/errors';
+import { setReadSyncOverride, tosUpload } from './tos-upload.js';
+/** Build a minimal fetch mock that satisfies initMultipartUpload (POST ?uploads → 200 + UploadId XML). */
+function makeFetchMock() {
+    return vi.fn().mockResolvedValue({
+        status: 200,
+        text: async () => '<InitiateMultipartUploadResult><UploadId>mock-upload-id</UploadId></InitiateMultipartUploadResult>',
+        headers: { forEach: (_cb) => { } },
+    });
+}
+describe('tosUpload short-read guard', () => {
+    let tmpDir;
+    let tmpFile;
+    let originalFetch;
+    beforeEach(() => {
+        originalFetch = globalThis.fetch;
+        tmpDir = actualFs.mkdtempSync(path.join(os.tmpdir(), 'tos-upload-shortread-'));
+        tmpFile = path.join(tmpDir, 'video.mp4');
+        // 100-byte file — fits in a single part
+        actualFs.writeFileSync(tmpFile, Buffer.alloc(100, 0xff));
+    });
+    afterEach(() => {
+        setReadSyncOverride(null);
+        globalThis.fetch = originalFetch;
+        actualFs.rmSync(tmpDir, { recursive: true, force: true });
+    });
+    it('throws CommandExecutionError on short read', async () => {
+        // Mock fetch so initMultipartUpload succeeds and code reaches readSync
+        globalThis.fetch = makeFetchMock();
+        // Override readSync to return 0 (fewer bytes than requested)
+        setReadSyncOverride(() => 0);
+        const mockCredentials = {
+            access_key_id: 'AKIAIOSFODNN7EXAMPLE',
+            secret_access_key: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
+            session_token: 'test-session-token',
+            expired_time: Date.now() / 1000 + 3600,
+        };
+        const uploadInfo = {
+            tos_upload_url: 'https://tos-cn-i-alisg.volces.com/bucket/key',
+            auth: 'AWS4-HMAC-SHA256 Credential=test',
+            video_id: 'test-video-id',
+        };
+        await expect(tosUpload({
+            filePath: tmpFile,
+            uploadInfo,
+            credentials: mockCredentials,
+        })).rejects.toThrow(CommandExecutionError);
+    });
+    it('error message identifies the part number and byte counts', async () => {
+        globalThis.fetch = makeFetchMock();
+        setReadSyncOverride(() => 0);
+        const mockCredentials = {
+            access_key_id: 'AKIAIOSFODNN7EXAMPLE',
+            secret_access_key: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
+            session_token: 'test-session-token',
+            expired_time: Date.now() / 1000 + 3600,
+        };
+        const uploadInfo = {
+            tos_upload_url: 'https://tos-cn-i-alisg.volces.com/bucket/key',
+            auth: 'AWS4-HMAC-SHA256 Credential=test',
+            video_id: 'test-video-id',
+        };
+        await expect(tosUpload({
+            filePath: tmpFile,
+            uploadInfo,
+            credentials: mockCredentials,
+        })).rejects.toThrow(/Short read on part 1: expected 100 bytes, got 0/);
+    });
+});

package/clis/douyin/_shared/tos-upload.js

@@ -0,0 +1,331 @@
+/**
+ * TOS (ByteDance Object Storage) multipart uploader with resume support.
+ *
+ * Uses AWS Signature V4 (HMAC-SHA256) with STS2 temporary credentials.
+ * For the init multipart upload call, the pre-computed auth from TosUploadInfo is used.
+ * For PUT part uploads and the final complete call, AWS4 is computed from STS2 credentials.
+ */
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { CommandExecutionError } from '@jackwener/opencli/errors';
+const PART_SIZE = 5 * 1024 * 1024; // 5 MB minimum per TOS/S3 spec
+const RESUME_DIR = path.join(os.homedir(), '.opencli', 'douyin-resume');
+// ── Resume file helpers ──────────────────────────────────────────────────────
+function getResumeFilePath(filePath) {
+    const hash = crypto.createHash('sha256').update(filePath).digest('hex');
+    return path.join(RESUME_DIR, `${hash}.json`);
+}
+function loadResumeState(resumePath, fileSize) {
+    try {
+        const raw = fs.readFileSync(resumePath, 'utf8');
+        const state = JSON.parse(raw);
+        if (state.fileSize === fileSize && state.uploadId && Array.isArray(state.parts)) {
+            return state;
+        }
+    }
+    catch {
+        // no valid resume state
+    }
+    return null;
+}
+function saveResumeState(resumePath, state) {
+    fs.mkdirSync(path.dirname(resumePath), { recursive: true });
+    fs.writeFileSync(resumePath, JSON.stringify(state, null, 2), 'utf8');
+}
+function deleteResumeState(resumePath) {
+    try {
+        fs.unlinkSync(resumePath);
+    }
+    catch {
+        // ignore if not found
+    }
+}
+// ── AWS Signature V4 ─────────────────────────────────────────────────────────
+function hmacSha256(key, data) {
+    return crypto.createHmac('sha256', key).update(data, 'utf8').digest();
+}
+function sha256Hex(data) {
+    const hash = crypto.createHash('sha256');
+    if (typeof data === 'string') {
+        hash.update(data, 'utf8');
+    }
+    else {
+        hash.update(data);
+    }
+    return hash.digest('hex');
+}
+const CRC32_TABLE = new Uint32Array(256).map((_, index) => {
+    let value = index;
+    for (let bit = 0; bit < 8; bit += 1) {
+        value = (value & 1) ? (0xEDB88320 ^ (value >>> 1)) : (value >>> 1);
+    }
+    return value >>> 0;
+});
+function crc32Hex(data) {
+    let crc = 0xffffffff;
+    for (const byte of data) {
+        crc = CRC32_TABLE[(crc ^ byte) & 0xff] ^ (crc >>> 8);
+    }
+    return ((crc ^ 0xffffffff) >>> 0).toString(16).padStart(8, '0');
+}
+function gatewayBaseUrl(tosUrl) {
+    const parsedUrl = new URL(tosUrl);
+    return `https://${parsedUrl.host}/upload/v1${parsedUrl.pathname}`;
+}
+function gatewayHeaders(auth, uploadHeader, userId = '') {
+    return {
+        Authorization: auth,
+        'X-Storage-U': encodeURIComponent(userId),
+        ...(uploadHeader ?? {}),
+    };
+}
+function extractRegionFromHost(host) {
+    // e.g. "tos-cn-i-alisg.volces.com" → "cn-i-alisg"
+    // e.g. "tos-cn-beijing.ivolces.com" → "cn-beijing"
+    const match = host.match(/^tos-([^.]+)\./);
+    if (match)
+        return match[1];
+    return 'cn-north-1'; // fallback
+}
+/**
+ * Compute AWS Signature V4 headers for a TOS request.
+ * Returns a Record of all headers to include (including Authorization, x-amz-date, etc.)
+ */
+function computeAws4Headers(opts) {
+    const { method, url, credentials, service, region, datetime } = opts;
+    const date = datetime.slice(0, 8); // YYYYMMDD
+    const parsedUrl = new URL(url);
+    const canonicalUri = parsedUrl.pathname || '/';
+    // Canonical query string: sort by name, encode
+    const queryParams = [...parsedUrl.searchParams.entries()]
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`)
+        .join('&');
+    const bodyHash = sha256Hex(opts.body);
+    // Merge in required headers and compute canonical headers
+    const allHeaders = {
+        ...opts.headers,
+        host: parsedUrl.host,
+        'x-amz-content-sha256': bodyHash,
+        'x-amz-date': datetime,
+        'x-amz-security-token': credentials.session_token,
+    };
+    const sortedHeaderKeys = Object.keys(allHeaders).sort((a, b) => a.toLowerCase().localeCompare(b.toLowerCase()));
+    const canonicalHeaders = sortedHeaderKeys
+        .map(k => `${k.toLowerCase()}:${allHeaders[k].trim()}`)
+        .join('\n') + '\n';
+    const signedHeadersList = sortedHeaderKeys.map(k => k.toLowerCase()).join(';');
+    const canonicalRequest = [
+        method.toUpperCase(),
+        canonicalUri,
+        queryParams,
+        canonicalHeaders,
+        signedHeadersList,
+        bodyHash,
+    ].join('\n');
+    const credentialScope = `${date}/${region}/${service}/aws4_request`;
+    const stringToSign = [
+        'AWS4-HMAC-SHA256',
+        datetime,
+        credentialScope,
+        sha256Hex(canonicalRequest),
+    ].join('\n');
+    // Signing key chain
+    const kDate = hmacSha256(`AWS4${credentials.secret_access_key}`, date);
+    const kRegion = hmacSha256(kDate, region);
+    const kService = hmacSha256(kRegion, service);
+    const kSigning = hmacSha256(kService, 'aws4_request');
+    const signature = hmacSha256(kSigning, stringToSign).toString('hex');
+    const authorization = `AWS4-HMAC-SHA256 Credential=${credentials.access_key_id}/${credentialScope}, SignedHeaders=${signedHeadersList}, Signature=${signature}`;
+    return {
+        ...allHeaders,
+        Authorization: authorization,
+    };
+}
+// ── HTTP helpers ─────────────────────────────────────────────────────────────
+async function tosRequest(opts) {
+    const { method, url, headers, body } = opts;
+    const fetchBody = body == null ? null
+        : typeof body === 'string' ? body
+            : body;
+    const res = await fetch(url, {
+        method,
+        headers,
+        body: fetchBody,
+        signal: AbortSignal.timeout(60000),
+    });
+    const responseBody = await res.text();
+    const responseHeaders = {};
+    res.headers.forEach((value, key) => {
+        responseHeaders[key.toLowerCase()] = value;
+    });
+    return { status: res.status, headers: responseHeaders, body: responseBody };
+}
+function nowDatetime() {
+    return new Date().toISOString().replace(/[-:]/g, '').replace(/\.\d+Z$/, 'Z');
+}
+function extractUploadId(body) {
+    const xmlMatch = body.match(/<UploadId>([^<]+)<\/UploadId>/i);
+    if (xmlMatch) return xmlMatch[1];
+    try {
+        const json = JSON.parse(body);
+        return json?.payload?.uploadID
+            || json?.payload?.uploadId
+            || json?.payload?.UploadID
+            || json?.payload?.UploadId
+            || json?.data?.uploadid
+            || json?.data?.uploadID
+            || json?.data?.uploadId
+            || json?.data?.UploadID
+            || json?.data?.UploadId
+            || json?.UploadID
+            || json?.UploadId
+            || json?.uploadID
+            || json?.uploadId
+            || null;
+    }
+    catch {
+        return null;
+    }
+}
+// ── Phase 1: Init multipart upload ───────────────────────────────────────────
+async function initMultipartUpload(tosUrl, auth, uploadHeader, userId) {
+    const initUrl = `${gatewayBaseUrl(tosUrl)}?uploadmode=part&phase=init`;
+    const res = await tosRequest({
+        method: 'POST',
+        url: initUrl,
+        headers: gatewayHeaders(auth, uploadHeader, userId),
+    });
+    if (res.status !== 200) {
+        throw new CommandExecutionError(`TOS init multipart upload failed with status ${res.status}: ${res.body}`, 'Check that TOS upload authorization is valid and not expired.');
+    }
+    const uploadId = extractUploadId(res.body);
+    if (!uploadId) {
+        throw new CommandExecutionError(`TOS init response missing UploadId: ${res.body}`);
+    }
+    return uploadId;
+}
+// ── Phase 2: Upload a single part ────────────────────────────────────────────
+async function uploadPart(tosUrl, partNumber, uploadId, data, auth, uploadHeader, userId) {
+    const crc32 = crc32Hex(data);
+    const url = `${gatewayBaseUrl(tosUrl)}?uploadid=${encodeURIComponent(uploadId)}&part_number=${partNumber}&phase=transfer`;
+    const headers = {
+        ...gatewayHeaders(auth, uploadHeader, userId),
+        'Content-CRC32': crc32,
+        'Content-Type': 'application/octet-stream',
+        'X-Use-Init-Upload-Optimize': '1',
+        'X-Use-Large-Local-Cache': '1',
+    };
+    const res = await tosRequest({ method: 'POST', url, headers, body: data });
+    let parsed;
+    try {
+        parsed = JSON.parse(res.body);
+    }
+    catch {
+        parsed = null;
+    }
+    if (res.status !== 200 || parsed?.code !== 2000) {
+        throw new CommandExecutionError(`TOS upload part ${partNumber} failed with status ${res.status}: ${res.body}`, 'Check that TOS upload authorization is valid and not expired.');
+    }
+    return parsed?.data?.crc32 || crc32;
+}
+// ── Phase 3: Complete multipart upload ───────────────────────────────────────
+async function completeMultipartUpload(tosUrl, uploadId, parts, auth, uploadHeader, userId) {
+    const url = `${gatewayBaseUrl(tosUrl)}?uploadmode=part&phase=finish&uploadid=${encodeURIComponent(uploadId)}`;
+    const body = parts
+        .sort((a, b) => a.partNumber - b.partNumber)
+        .map(p => `${p.partNumber}:${p.crc32}`)
+        .join(',');
+    const res = await tosRequest({
+        method: 'POST',
+        url,
+        headers: gatewayHeaders(auth, uploadHeader, userId),
+        body,
+    });
+    let parsed;
+    try {
+        parsed = JSON.parse(res.body);
+    }
+    catch {
+        parsed = null;
+    }
+    if (res.status !== 200 || parsed?.code !== 2000) {
+        throw new CommandExecutionError(`TOS complete multipart upload failed with status ${res.status}: ${res.body}`, 'Check that all parts were uploaded successfully.');
+    }
+    return parsed?.data?.key || null;
+}
+let _readSyncOverride = null;
+/** @internal — for testing only */
+export function setReadSyncOverride(fn) {
+    _readSyncOverride = fn;
+}
+// ── Public API ───────────────────────────────────────────────────────────────
+export async function tosUpload(options) {
+    const { filePath, uploadInfo, credentials, onProgress } = options;
+    // Validate file exists
+    if (!fs.existsSync(filePath)) {
+        throw new CommandExecutionError(`Video file not found: ${filePath}`, 'Ensure the file path is correct and accessible.');
+    }
+    const { size: fileSize } = fs.statSync(filePath);
+    if (fileSize === 0) {
+        throw new CommandExecutionError(`Video file is empty: ${filePath}`);
+    }
+    const { tos_upload_url: tosUrl, auth, upload_header: uploadHeader, user_id: userId } = uploadInfo;
+    const parsedTosUrl = new URL(tosUrl);
+    const region = extractRegionFromHost(parsedTosUrl.host);
+    const resumePath = getResumeFilePath(filePath);
+    let resumeState = loadResumeState(resumePath, fileSize);
+    let uploadId;
+    let completedParts;
+    if (resumeState) {
+        // Resume from previous state
+        uploadId = resumeState.uploadId;
+        completedParts = resumeState.parts;
+    }
+    else {
+        // Start fresh
+        uploadId = await initMultipartUpload(tosUrl, auth, uploadHeader, userId);
+        completedParts = [];
+        saveResumeState(resumePath, { uploadId, fileSize, parts: completedParts });
+    }
+    // Determine which parts are already done
+    const completedPartNumbers = new Set(completedParts.map(p => p.partNumber));
+    // Calculate total parts
+    const totalParts = Math.ceil(fileSize / PART_SIZE);
+    // Track uploaded bytes for progress
+    let uploadedBytes = completedParts.length * PART_SIZE;
+    if (onProgress)
+        onProgress(Math.min(uploadedBytes, fileSize), fileSize);
+    const fd = fs.openSync(filePath, 'r');
+    try {
+        for (let partNumber = 1; partNumber <= totalParts; partNumber++) {
+            if (completedPartNumbers.has(partNumber)) {
+                continue; // already uploaded
+            }
+            const offset = (partNumber - 1) * PART_SIZE;
+            const chunkSize = Math.min(PART_SIZE, fileSize - offset);
+            const buffer = Buffer.allocUnsafe(chunkSize);
+            const readFn = _readSyncOverride ?? fs.readSync;
+            const bytesRead = readFn(fd, buffer, 0, chunkSize, offset);
+            if (bytesRead !== chunkSize) {
+                throw new CommandExecutionError(`Short read on part ${partNumber}: expected ${chunkSize} bytes, got ${bytesRead}`);
+            }
+            const crc32 = await uploadPart(tosUrl, partNumber, uploadId, buffer, auth, uploadHeader, userId);
+            completedParts.push({ partNumber, crc32 });
+            saveResumeState(resumePath, { uploadId, fileSize, parts: completedParts });
+            uploadedBytes = Math.min(offset + chunkSize, fileSize);
+            if (onProgress)
+                onProgress(uploadedBytes, fileSize);
+        }
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    const completedKey = await completeMultipartUpload(tosUrl, uploadId, completedParts, auth, uploadHeader, userId);
+    deleteResumeState(resumePath);
+    return completedKey;
+}
+// ── Internal exports for testing ─────────────────────────────────────────────
+export { PART_SIZE, RESUME_DIR, extractRegionFromHost, getResumeFilePath, loadResumeState, saveResumeState, deleteResumeState, computeAws4Headers, extractUploadId, crc32Hex, gatewayBaseUrl, gatewayHeaders, };

package/clis/douyin/_shared/tos-upload.test.js

@@ -0,0 +1,229 @@
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { PART_SIZE, computeAws4Headers, deleteResumeState, extractRegionFromHost, getResumeFilePath, loadResumeState, saveResumeState, } from './tos-upload.js';
+// ── extractRegionFromHost ────────────────────────────────────────────────────
+describe('extractRegionFromHost', () => {
+    it('extracts region from standard TOS host', () => {
+        expect(extractRegionFromHost('tos-cn-i-alisg.volces.com')).toBe('cn-i-alisg');
+    });
+    it('extracts region from beijing TOS host', () => {
+        expect(extractRegionFromHost('tos-cn-beijing.ivolces.com')).toBe('cn-beijing');
+    });
+    it('falls back to cn-north-1 for unknown host', () => {
+        expect(extractRegionFromHost('unknown.example.com')).toBe('cn-north-1');
+    });
+});
+// ── Part chunking ────────────────────────────────────────────────────────────
+describe('PART_SIZE and part chunking logic', () => {
+    it('PART_SIZE is exactly 5 MB', () => {
+        expect(PART_SIZE).toBe(5 * 1024 * 1024);
+    });
+    it('single file smaller than PART_SIZE fits in 1 part', () => {
+        const fileSize = 1 * 1024 * 1024; // 1 MB
+        const totalParts = Math.ceil(fileSize / PART_SIZE);
+        expect(totalParts).toBe(1);
+        const lastPartSize = fileSize - (totalParts - 1) * PART_SIZE;
+        expect(lastPartSize).toBe(fileSize);
+    });
+    it('exactly 5 MB file produces 1 part', () => {
+        const fileSize = PART_SIZE;
+        expect(Math.ceil(fileSize / PART_SIZE)).toBe(1);
+    });
+    it('5 MB + 1 byte produces 2 parts', () => {
+        const fileSize = PART_SIZE + 1;
+        expect(Math.ceil(fileSize / PART_SIZE)).toBe(2);
+    });
+    it('100 MB file produces 20 parts of 5 MB each', () => {
+        const fileSize = 100 * 1024 * 1024;
+        const totalParts = Math.ceil(fileSize / PART_SIZE);
+        expect(totalParts).toBe(20);
+        // Each part is exactly PART_SIZE
+        for (let i = 1; i <= totalParts; i++) {
+            const offset = (i - 1) * PART_SIZE;
+            const chunkSize = Math.min(PART_SIZE, fileSize - offset);
+            expect(chunkSize).toBe(PART_SIZE);
+        }
+    });
+    it('101 MB file produces 21 parts, last part is 1 MB', () => {
+        const fileSize = 101 * 1024 * 1024;
+        const totalParts = Math.ceil(fileSize / PART_SIZE);
+        expect(totalParts).toBe(21);
+        const lastOffset = (totalParts - 1) * PART_SIZE;
+        const lastPartSize = fileSize - lastOffset;
+        expect(lastPartSize).toBe(1 * 1024 * 1024);
+    });
+});
+// ── Resume file serialization/deserialization ─────────────────────────────────
+describe('resume state read/write', () => {
+    let tmpDir;
+    let resumePath;
+    beforeEach(() => {
+        tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tos-upload-test-'));
+        resumePath = path.join(tmpDir, 'resume.json');
+    });
+    afterEach(() => {
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    });
+    it('saves and loads resume state correctly', () => {
+        const state = {
+            uploadId: 'test-upload-id-123',
+            fileSize: 12345678,
+            parts: [
+                { partNumber: 1, etag: '"abc123"' },
+                { partNumber: 2, etag: '"def456"' },
+            ],
+        };
+        saveResumeState(resumePath, state);
+        const loaded = loadResumeState(resumePath, 12345678);
+        expect(loaded).not.toBeNull();
+        expect(loaded.uploadId).toBe('test-upload-id-123');
+        expect(loaded.fileSize).toBe(12345678);
+        expect(loaded.parts).toHaveLength(2);
+        expect(loaded.parts[0]).toEqual({ partNumber: 1, etag: '"abc123"' });
+        expect(loaded.parts[1]).toEqual({ partNumber: 2, etag: '"def456"' });
+    });
+    it('returns null when file does not exist', () => {
+        const result = loadResumeState('/nonexistent/path/resume.json', 12345678);
+        expect(result).toBeNull();
+    });
+    it('returns null when fileSize does not match', () => {
+        const state = {
+            uploadId: 'upload-id',
+            fileSize: 100,
+            parts: [],
+        };
+        saveResumeState(resumePath, state);
+        // Different file size — should not resume
+        const result = loadResumeState(resumePath, 999);
+        expect(result).toBeNull();
+    });
+    it('returns null when JSON is malformed', () => {
+        fs.writeFileSync(resumePath, 'not-valid-json', 'utf8');
+        const result = loadResumeState(resumePath, 100);
+        expect(result).toBeNull();
+    });
+    it('returns null when uploadId is missing', () => {
+        const broken = { fileSize: 100, parts: [] };
+        fs.writeFileSync(resumePath, JSON.stringify(broken), 'utf8');
+        const result = loadResumeState(resumePath, 100);
+        expect(result).toBeNull();
+    });
+    it('deletes resume file without throwing when file exists', () => {
+        fs.writeFileSync(resumePath, '{}', 'utf8');
+        expect(() => deleteResumeState(resumePath)).not.toThrow();
+        expect(fs.existsSync(resumePath)).toBe(false);
+    });
+    it('deleteResumeState does not throw when file does not exist', () => {
+        expect(() => deleteResumeState('/nonexistent/path/resume.json')).not.toThrow();
+    });
+    it('saveResumeState creates parent directories if missing', () => {
+        const nestedPath = path.join(tmpDir, 'nested', 'deep', 'resume.json');
+        const state = { uploadId: 'x', fileSize: 0, parts: [] };
+        expect(() => saveResumeState(nestedPath, state)).not.toThrow();
+        expect(fs.existsSync(nestedPath)).toBe(true);
+    });
+});
+// ── getResumeFilePath ────────────────────────────────────────────────────────
+describe('getResumeFilePath', () => {
+    it('returns a path inside ~/.opencli/douyin-resume/', () => {
+        const result = getResumeFilePath('/some/video/file.mp4');
+        expect(result).toContain('douyin-resume');
+        expect(result).toMatch(/\.json$/);
+    });
+    it('produces same path for same input', () => {
+        const a = getResumeFilePath('/video.mp4');
+        const b = getResumeFilePath('/video.mp4');
+        expect(a).toBe(b);
+    });
+    it('produces different paths for different inputs', () => {
+        const a = getResumeFilePath('/video1.mp4');
+        const b = getResumeFilePath('/video2.mp4');
+        expect(a).not.toBe(b);
+    });
+});
+// ── computeAws4Headers ───────────────────────────────────────────────────────
+describe('computeAws4Headers', () => {
+    const mockCredentials = {
+        access_key_id: 'AKIAIOSFODNN7EXAMPLE',
+        secret_access_key: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
+        session_token: 'FQoGZXIvYXdzEJr//////////test-session-token',
+        expired_time: Date.now() / 1000 + 3600,
+    };
+    it('returns Authorization header', () => {
+        const headers = computeAws4Headers({
+            method: 'PUT',
+            url: 'https://tos-cn-i-alisg.volces.com/bucket/object?partNumber=1&uploadId=abc',
+            headers: { 'content-type': 'application/octet-stream' },
+            body: Buffer.from('hello'),
+            credentials: mockCredentials,
+            service: 'tos',
+            region: 'cn-i-alisg',
+            datetime: '20260325T120000Z',
+        });
+        expect(headers['Authorization']).toMatch(/^AWS4-HMAC-SHA256 Credential=/);
+        expect(headers['Authorization']).toContain('AKIAIOSFODNN7EXAMPLE/20260325/cn-i-alisg/tos/aws4_request');
+        expect(headers['Authorization']).toContain('SignedHeaders=');
+        expect(headers['Authorization']).toContain('Signature=');
+    });
+    it('includes x-amz-date header', () => {
+        const headers = computeAws4Headers({
+            method: 'PUT',
+            url: 'https://tos-cn-i-alisg.volces.com/bucket/object?partNumber=1&uploadId=abc',
+            headers: {},
+            body: Buffer.alloc(0),
+            credentials: mockCredentials,
+            service: 'tos',
+            region: 'cn-i-alisg',
+            datetime: '20260325T120000Z',
+        });
+        expect(headers['x-amz-date']).toBe('20260325T120000Z');
+    });
+    it('includes x-amz-security-token with session token', () => {
+        const headers = computeAws4Headers({
+            method: 'PUT',
+            url: 'https://tos-cn-i-alisg.volces.com/bucket/object',
+            headers: {},
+            body: '',
+            credentials: mockCredentials,
+            service: 'tos',
+            region: 'cn-i-alisg',
+            datetime: '20260325T120000Z',
+        });
+        expect(headers['x-amz-security-token']).toBe(mockCredentials.session_token);
+    });
+    it('signed headers list is sorted', () => {
+        const headers = computeAws4Headers({
+            method: 'POST',
+            url: 'https://tos-cn-i-alisg.volces.com/bucket/object?uploadId=abc',
+            headers: { 'content-type': 'application/xml' },
+            body: '<xml/>',
+            credentials: mockCredentials,
+            service: 'tos',
+            region: 'cn-i-alisg',
+            datetime: '20260325T120000Z',
+        });
+        const authHeader = headers['Authorization'];
+        const signedHeadersMatch = authHeader.match(/SignedHeaders=([^,]+)/);
+        expect(signedHeadersMatch).not.toBeNull();
+        const signedHeadersList = signedHeadersMatch[1].split(';');
+        const sorted = [...signedHeadersList].sort((a, b) => a.localeCompare(b));
+        expect(signedHeadersList).toEqual(sorted);
+    });
+    it('produces deterministic signature for same inputs', () => {
+        const opts = {
+            method: 'PUT',
+            url: 'https://tos-cn-i-alisg.volces.com/bucket/key?partNumber=1&uploadId=xyz',
+            headers: { 'content-type': 'application/octet-stream' },
+            body: Buffer.from('test-data'),
+            credentials: mockCredentials,
+            service: 'tos',
+            region: 'cn-i-alisg',
+            datetime: '20260325T120000Z',
+        };
+        const h1 = computeAws4Headers(opts);
+        const h2 = computeAws4Headers(opts);
+        expect(h1['Authorization']).toBe(h2['Authorization']);
+    });
+});