@intentius/chant-lexicon-aws 0.124.23 → 0.124.25

package/dist/api/credential-chain.d.ts

@@ -0,0 +1,114 @@
+/**
+ * The AWS credential chain, as the AWS CLI walks it, for `chant lifecycle
+ * whoami` (#3954).
+ *
+ * `resolveCredentials` (./sigv4.ts) reads the three environment variables and
+ * nothing else. That is right for the read transport's synchronous signing
+ * seam, and it made whoami wrong for anyone whose shell holds a profile rather
+ * than keys: `AWS_PROFILE=dev` with an SSO session came back as "no identity
+ * is configured" while `aws sts get-caller-identity` answered. This module is
+ * the asynchronous half: it resolves what the CLI would sign with and hands
+ * back literal credentials plus a label for where they came from.
+ *
+ * There is still no `@aws-sdk/*` here, for the reason the read transport gives:
+ * a lexicon keeps that tree out. The chain is small enough to state.
+ *
+ * ## Order
+ *
+ *  1. `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` (+ `AWS_SESSION_TOKEN`).
+ *     They win over `AWS_PROFILE`, as they do in the AWS CLI, and as they do
+ *     in chant's own read transport, which signs with nothing else. (The JS
+ *     SDK v3 skips the environment when `AWS_PROFILE` is set; the CLI does
+ *     not, and the CLI is what an operator checks whoami against.) When both
+ *     are set, the label says the profile was not used.
+ *  2. The profile `AWS_PROFILE` names, else `default` when one exists, read
+ *     from `AWS_CONFIG_FILE` (`~/.aws/config`) and
+ *     `AWS_SHARED_CREDENTIALS_FILE` (`~/.aws/credentials`). Within a profile:
+ *     `role_arn` (with `source_profile` or `credential_source = Environment`),
+ *     then static keys, then SSO (`sso_session` or the legacy
+ *     `sso_start_url`), then `credential_process`.
+ *
+ * Not resolved, and said so rather than skipped: `web_identity_token_file`,
+ * `mfa_serial`, `credential_source` other than `Environment`, and the
+ * instance-metadata and container endpoints.
+ *
+ * ## SSO
+ *
+ * The token `aws sso login` cached under `~/.aws/sso/cache/` is read, and when
+ * its access token has expired but it carries a refresh token, it is refreshed
+ * through SSO OIDC the way the CLI does. The refreshed token is used for this
+ * call and NOT written back; whoami is read-only. A missing, expired or
+ * refused session is a `no-credentials` answer naming
+ * `aws sso login --profile <p>`.
+ *
+ * ## Credential material
+ *
+ * Nothing this module returns in a label or an error carries a key, a secret,
+ * a session token or an SSO bearer token. `credential_process` output is
+ * credential JSON, so a malformed one is described, never echoed.
+ */
+import { type AwsReadClientOptions } from "./read-client.js";
+import type { AwsCredentials } from "./sigv4.js";
+/** One HTTP exchange for the SSO portal and OIDC calls. Injected by tests. */
+export type CredentialChainHttp = (url: string, init: {
+    method: "GET" | "POST";
+    headers: Record<string, string>;
+    body?: string;
+}) => Promise<{
+    status: number;
+    text: string;
+}>;
+/** Runs a `credential_process` command line. Injected by tests. */
+export type CredentialProcessRunner = (command: string) => Promise<{
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+}>;
+export interface CredentialChainOptions {
+    /** Defaults to `process.env`. */
+    env?: Record<string, string | undefined>;
+    /** Reads a file, `undefined` when it does not exist. Defaults to the filesystem. */
+    readFile?: (path: string) => string | undefined;
+    /** The home directory `~/.aws` hangs off. Defaults to `HOME`, then `os.homedir()`. */
+    home?: string;
+    /** SSO portal and OIDC transport. Defaults to `fetch`. */
+    http?: CredentialChainHttp;
+    /** `credential_process` runner. Defaults to a shell `exec`. */
+    runProcess?: CredentialProcessRunner;
+    /** STS transport for `role_arn` profiles. The `credentials` field is set per call. */
+    sts?: AwsReadClientOptions;
+    /** Clock for token and credential expiry. */
+    now?: () => Date;
+}
+export interface ResolvedChainCredentials {
+    credentials: AwsCredentials;
+    /** Where they came from, e.g. `profile dev (sso session acme)`. Never a credential value. */
+    source: string;
+    /** The profile that resolved them, when one did. */
+    profile?: string;
+}
+export interface UnresolvedChainCredentials {
+    reason: "no-credentials" | "read-failed";
+    detail: string;
+}
+export type CredentialChainResult = {
+    resolved: ResolvedChainCredentials;
+} | {
+    unresolved: UnresolvedChainCredentials;
+};
+type Section = Record<string, string>;
+/**
+ * The INI dialect of the AWS shared files: `[section]`, `key = value`, `#` and
+ * `;` comments on their own line (not inline: a `credential_process` command
+ * line may hold either character). An indented line under a key with an empty value is a nested
+ * setting (`s3 =` / `  max_concurrent_requests = 10`); nothing here reads
+ * those, so they are dropped rather than mistaken for top-level keys.
+ */
+export declare function parseIni(text: string): Record<string, Section>;
+/**
+ * Resolve credentials the way the AWS CLI does. Returns literal credentials
+ * and their source, or a typed refusal that says what to do about it.
+ */
+export declare function resolveCredentialChain(options?: CredentialChainOptions): Promise<CredentialChainResult>;
+export {};
+//# sourceMappingURL=credential-chain.d.ts.map

package/dist/api/credential-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-chain.d.ts","sourceRoot":"","sources":["../../src/api/credential-chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAOH,OAAO,EAA4B,KAAK,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACpF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,8EAA8E;AAC9E,MAAM,MAAM,mBAAmB,GAAG,CAChC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,KAC7E,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE/C,mEAAmE;AACnE,MAAM,MAAM,uBAAuB,GAAG,CACpC,OAAO,EAAE,MAAM,KACZ,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEnE,MAAM,WAAW,sBAAsB;IACrC,iCAAiC;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,oFAAoF;IACpF,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAChD,sFAAsF;IACtF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0DAA0D;IAC1D,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B,+DAA+D;IAC/D,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,sFAAsF;IACtF,GAAG,CAAC,EAAE,oBAAoB,CAAC;IAC3B,6CAA6C;IAC7C,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,cAAc,CAAC;IAC5B,6FAA6F;IAC7F,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,gBAAgB,GAAG,aAAa,CAAC;IACzC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,EAAE,wBAAwB,CAAA;CAAE,GACtC;IAAE,UAAU,EAAE,0BAA0B,CAAA;CAAE,CAAC;AAE/C,KAAK,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAEtC;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAsB9D;AAgFD;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,GAAE,sBAA2B,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAyCjH"}

package/dist/api/read-client.d.ts

@@ -188,6 +188,26 @@ export interface CallerIdentity {
  * and the narrower the surface, the fewer ways a credential reaches a report.
  */
 export declare function getCallerIdentity(options?: AwsReadClientOptions): Promise<CallerIdentity>;
+/** Temporary credentials `sts:AssumeRole` hands back, with their expiry. */
+export interface AssumedRoleCredentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken: string;
+    expiration?: string;
+}
+/**
+ * `sts:AssumeRole` — the call behind a shared-config profile with `role_arn`
+ * (#3954). Signed with the source credentials the caller passes in
+ * `options.credentials`, on the same Query transport as
+ * {@link getCallerIdentity}. The response is credential material, so it goes
+ * back to the caller and never into an error message.
+ */
+export declare function assumeRole(params: {
+    roleArn: string;
+    sessionName: string;
+    externalId?: string;
+    durationSeconds?: number;
+}, options?: AwsReadClientOptions): Promise<AssumedRoleCredentials>;
 /** One live resource, as Cloud Control describes it. */
 export interface CloudControlDescription {
     identifier: string;

package/dist/api/read-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read-client.d.ts","sourceRoot":"","sources":["../../src/api/read-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAmC,KAAK,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAEpF,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAM1F,sFAAsF;AACtF,MAAM,MAAM,WAAW,GAAG,CACxB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACvD,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAO/C,2EAA2E;AAC3E,qBAAa,YAAa,SAAQ,KAAK;IAGnC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,gGAAgG;IAChG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM;IAJxB,YACE,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM;IACvB,gGAAgG;IACvF,IAAI,CAAC,EAAE,MAAM,YAAA,EAIvB;CACF;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;OAIG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,kGAAkG;IAClG,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,iFAAiF;IACjF,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,uEAAuE;IACvE,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAWD,0FAA0F;AAC1F,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAG7D;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,GAAG,SAAS,CAEpB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,oBAAoB,CAGzG;AAED,kEAAkE;AAClE,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,SAAiB,GAAG,MAAM,CAE9F;AAqCD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,oBAAoB,GAC5B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAexB;AAID;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOlE;AAYD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAItF;AAED,0FAA0F;AAC1F,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAIrF;AAED;;;;GAIG;AACH,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wEAAwE;AACxE,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,aAAa,EAAE,CAAC,CAS1B;AAED,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,WAAW,CAAC,CAWtB;AAED,gEAAgE;AAChE,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAEjC;AAMD,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,cAAc,CAAC,CAuBnG;AAID,wDAAwD;AACxD,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAoDD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,uBAAuB,GAAG,IAAI,CAQrF;AAWD,8DAA8D;AAC9D,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAGzC;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,oBAAyB,EAClC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACtC,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAqBpC"}
+{"version":3,"file":"read-client.d.ts","sourceRoot":"","sources":["../../src/api/read-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAmC,KAAK,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAEpF,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAM1F,sFAAsF;AACtF,MAAM,MAAM,WAAW,GAAG,CACxB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACvD,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAO/C,2EAA2E;AAC3E,qBAAa,YAAa,SAAQ,KAAK;IAGnC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,gGAAgG;IAChG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM;IAJxB,YACE,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM;IACvB,gGAAgG;IACvF,IAAI,CAAC,EAAE,MAAM,YAAA,EAIvB;CACF;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;OAIG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,kGAAkG;IAClG,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,iFAAiF;IACjF,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,uEAAuE;IACvE,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAWD,0FAA0F;AAC1F,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAG7D;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,GAAG,SAAS,CAEpB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,oBAAoB,CAGzG;AAED,kEAAkE;AAClE,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,SAAiB,GAAG,MAAM,CAE9F;AAqCD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,oBAAoB,GAC5B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAexB;AAID;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOlE;AAYD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAItF;AAED,0FAA0F;AAC1F,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAIrF;AAED;;;;GAIG;AACH,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wEAAwE;AACxE,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,aAAa,EAAE,CAAC,CAS1B;AAED,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,WAAW,CAAC,CAWtB;AAED,gEAAgE;AAChE,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAEjC;AAMD,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,cAAc,CAAC,CAuBnG;AAED,4EAA4E;AAC5E,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,EAC/F,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,sBAAsB,CAAC,CAkCjC;AAID,wDAAwD;AACxD,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAoDD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,uBAAuB,GAAG,IAAI,CAQrF;AAWD,8DAA8D;AAC9D,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAGzC;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,oBAAyB,EAClC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACtC,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAqBpC"}

package/dist/caller-identity.d.ts

@@ -20,21 +20,40 @@
  *
  * ## Credentials
  *
- * `resolveCredentials` (./api/sigv4.ts) reads `AWS_ACCESS_KEY_ID` /
- * `AWS_SECRET_ACCESS_KEY` and nothing else — no profile file, no IMDS, no
- * container endpoint, deliberately. `AWS_PROFILE` alone therefore signs
- * nothing, and against real AWS the call comes back unauthorized. That is
- * reported as `no-credentials` naming the profile, which is a far better
- * answer than an empty stack read an hour later.
+ * Resolved the way the AWS CLI resolves them (#3954), by
+ * `./api/credential-chain.ts`: environment keys, then the profile
+ * `AWS_PROFILE` names (or `default`) from the shared config and credentials
+ * files, through static keys, `role_arn`, SSO sessions and
+ * `credential_process`. Before #3954 only the environment keys were read, so
+ * `AWS_PROFILE=dev` on an SSO session answered "no identity is configured"
+ * while `aws sts get-caller-identity` answered with a principal. An expired
+ * SSO session is `no-credentials` naming `aws sso login --profile <p>`.
+ *
+ * The native read transport still signs with environment keys only
+ * (`resolveCredentials` in ./api/sigv4.ts; #3958). So a profile-sourced row says
+ * what the CLI, and anything shelling out to it, would act as; it does not
+ * yet say what `describeResources` signs with. The `source` column names the
+ * profile, so the difference is visible.
+ *
+ * Against an endpoint override the chain is not walked: the emulator call is
+ * unsigned whatever resolves, and a whoami against Floci should not start an
+ * SSO refresh or a `credential_process`.
  *
  * No credential value is ever returned. The identity is the principal ARN the
  * service itself answers with, and the scope is an account and a region.
  */
 import type { DescribeIdentityOptions, DescribeIdentityResult } from "@intentius/chant/lexicon";
 import { type AwsReadClientOptions } from "./api/read-client.js";
+import { type CredentialChainOptions } from "./api/credential-chain.js";
 /** Options this module needs beyond the contract — the injectable transport, for tests. */
 export interface CallerIdentityOptions extends DescribeIdentityOptions {
     client?: AwsReadClientOptions;
+    /**
+     * The credential chain's seams: shared-file reads, the SSO and
+     * `credential_process` transports, the clock. Its `env` defaults to the
+     * client's, and its STS transport to the client's `http`.
+     */
+    chain?: CredentialChainOptions;
 }
 /**
  * The AWS `describeIdentity`. Returns the STS principal and the account+region

package/dist/caller-identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"caller-identity.d.ts","sourceRoot":"","sources":["../src/caller-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAChG,OAAO,EAKL,KAAK,oBAAoB,EAC1B,MAAM,mBAAmB,CAAC;AAgC3B,2FAA2F;AAC3F,MAAM,WAAW,qBAAsB,SAAQ,uBAAuB;IACpE,MAAM,CAAC,EAAE,oBAAoB,CAAC;CAC/B;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAmEtG"}
+{"version":3,"file":"caller-identity.d.ts","sourceRoot":"","sources":["../src/caller-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAChG,OAAO,EAKL,KAAK,oBAAoB,EAC1B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAA0B,KAAK,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AA+B7F,2FAA2F;AAC3F,MAAM,WAAW,qBAAsB,SAAQ,uBAAuB;IACpE,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B;;;;OAIG;IACH,KAAK,CAAC,EAAE,sBAAsB,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAuEtG"}

package/dist/codegen/generate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/codegen/generate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,cAAc,EAGpB,MAAM,mCAAmC,CAAC;AA0B3C,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC;AA+HhD;;GAEG;AACH,wBAAsB,QAAQ,CAAC,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAgBlF;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAgBjF"}
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/codegen/generate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,cAAc,EAGpB,MAAM,mCAAmC,CAAC;AAmC3C,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC;AA0IhD;;GAEG;AACH,wBAAsB,QAAQ,CAAC,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAkBlF;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAgBjF"}

package/dist/codegen/property-overlay.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Backfilled properties (chant #3953).
+ *
+ * The Registry spec is pinned by content (src/spec/pin.ts), so a property AWS
+ * adds after the pin was accepted does not reach the generated types until the
+ * pin moves. Moving it is a reviewed, whole-spec decision: the 2026-08-05 pin
+ * against the October upstream is 185 resource types apart. When one property
+ * is needed before that, it goes here instead of being cast past the types.
+ *
+ * Each entry names a top-level property and the schema fragment to add for it,
+ * copied from the live Registry schema. It is merged into the raw schema before
+ * parsing, so the property reaches the `.d.ts` and the lexicon registry by the
+ * same path a spec property does. The overlay has no way to mark a property
+ * create-only, so it only suits properties that are updatable in place.
+ *
+ * Precedence follows the enum overlay (#1497): where the spec already declares
+ * the property, the spec wins and the entry is reported as redundant, so a pin
+ * bump surfaces the entries it retires.
+ */
+/** One backfilled property. */
+export interface PropertyOverlayEntry {
+    /** CloudFormation type name, e.g. `AWS::BedrockAgentCore::Runtime`. */
+    type: string;
+    /** Top-level property name, added under `/properties`. */
+    property: string;
+    /** The chant issue that asked for it. */
+    issue: number;
+    /** Where the schema fragment was copied from. */
+    source: string;
+    /** ISO date the fragment was last read from `source`. */
+    reviewed: string;
+    /** JSON Schema for the property, as the Registry schema declares it. */
+    schema: Record<string, unknown>;
+}
+/** What happened to one entry during a generation run. */
+export interface PropertyOverlayApplication {
+    entry: PropertyOverlayEntry;
+    /** `applied` added the property; `redundant` found the spec already declares it. */
+    outcome: "applied" | "redundant";
+}
+/** The backfilled entries, in file order. */
+export declare function propertyOverlayEntries(): PropertyOverlayEntry[];
+/** Entries grouped by CloudFormation type name. */
+export declare function propertyOverlayByType(entries?: PropertyOverlayEntry[]): Map<string, PropertyOverlayEntry[]>;
+/** Add the entries for one CloudFormation type to its raw schema bytes. */
+export declare function applyPropertyOverlay(data: Buffer | string, entries: PropertyOverlayEntry[]): {
+    data: Buffer | string;
+    applications: PropertyOverlayApplication[];
+};
+/**
+ * Fail on an entry whose type the run never saw. Only a run over the real
+ * schema zip is strict; a fixture run legitimately lacks most types.
+ */
+export declare function assertPropertyOverlayCoverage(entries: PropertyOverlayEntry[], seenTypes: Set<string>, strict: boolean): void;
+/** One warning line per entry the spec has caught up with. */
+export declare function redundantPropertyOverlayWarnings(applications: PropertyOverlayApplication[]): Array<{
+    file: string;
+    error: string;
+}>;
+//# sourceMappingURL=property-overlay.d.ts.map

package/dist/codegen/property-overlay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"property-overlay.d.ts","sourceRoot":"","sources":["../../src/codegen/property-overlay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,+BAA+B;AAC/B,MAAM,WAAW,oBAAoB;IACnC,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED,0DAA0D;AAC1D,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,oBAAoB,CAAC;IAC5B,oFAAoF;IACpF,OAAO,EAAE,SAAS,GAAG,WAAW,CAAC;CAClC;AAED,6CAA6C;AAC7C,wBAAgB,sBAAsB,IAAI,oBAAoB,EAAE,CAE/D;AAED,mDAAmD;AACnD,wBAAgB,qBAAqB,CACnC,OAAO,GAAE,oBAAoB,EAA6B,GACzD,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAQrC;AAED,2EAA2E;AAC3E,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,GAAG,MAAM,EACrB,OAAO,EAAE,oBAAoB,EAAE,GAC9B;IAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,YAAY,EAAE,0BAA0B,EAAE,CAAA;CAAE,CAyBvE;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,oBAAoB,EAAE,EAC/B,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,EACtB,MAAM,EAAE,OAAO,GACd,IAAI,CAQN;AAED,8DAA8D;AAC9D,wBAAgB,gCAAgC,CAC9C,YAAY,EAAE,0BAA0B,EAAE,GACzC,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CASxC"}

package/dist/codegen/property-overlay.json

@@ -0,0 +1,19 @@
+{
+    "$comment": "Properties CloudFormation has shipped since the pinned Registry spec (src/spec/pin.ts) was accepted (chant #3953). Hand-maintained, merged into the raw schema at codegen time by src/codegen/property-overlay.ts. Each entry is copied from the live Registry schema; retire it when a pin bump (#3960) brings the property in; generation warns when it does.",
+    "entries": [
+        {
+            "type": "AWS::BedrockAgentCore::Runtime",
+            "property": "PlatformVersion",
+            "issue": 3953,
+            "source": "https://schema.cloudformation.us-east-1.amazonaws.com/CloudformationSchema.zip (aws-bedrockagentcore-runtime.json)",
+            "reviewed": "2026-10-12",
+            "schema": {
+                "type": "string",
+                "description": "The version of the runtime platform",
+                "minLength": 1,
+                "maxLength": 128,
+                "pattern": "^[^\\s]+$"
+            }
+        }
+    ]
+}

package/dist/integrity.json

@@ -1,9 +1,9 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "4e6c66a32aea8e6f80bc95d0b40d7087db6580bf665b86a02c001a47676e8503",
-    "meta.json": "31795ba62a1da7503a8d55192c212ac44c56a56cdb2d4fde47966a1abc8b021b",
-    "types/index.d.ts": "1038589dccfc1e690e3373014bff4d319e4ed3b421db2448ed4e70d51eb9d1f2",
+    "manifest.json": "70adb1c39c2ffcc0455db97bca51a4174230553594a5e26dbf132b4b2b19708d",
+    "meta.json": "435429f998bf94568544f01780e35c28b73e7d030520d59d4025867d272cdb75",
+    "types/index.d.ts": "9e99bb26113f101eb7073759e1b02b8d06aac73379254a64a5e492d52506156c",
     "rules/hardcoded-region.ts": "957eadcaa9f39cc17d21437565d7a94607d9b082cf28918b178fa067f07498a9",
     "rules/iam-wildcard.ts": "10f5065fa2bbf2c8ce23dfb475a56df33f280df87784e44fec641b2584cbf333",
     "rules/s3-encryption.ts": "6611f3977d40314c31e6d4af99829a25ea71a529a6dfcaff425549c8aa54c29a",
@@ -73,5 +73,5 @@
     "skills/chant-aws-eks.md": "8789255709ff004ad0a875fd5999edcdc66fc6e33d710db058d9f42703bcfdfe",
     "skills/chant-aws-carve-terraform.md": "8780b94ce60aded935938d5ef20ea667738354051da1bf9ca6d70d9886f65d21"
   },
-  "composite": "c7e6cf7b0488fd800a0cc32e8ce33a71975bcc95d5350e530ce11c1232ca859f"
+  "composite": "b77434bedc9ecf554c9a694db9163c95b70c85bc3bfa48e20d19381216ce5aa3"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "aws",
-  "version": "0.124.23",
+  "version": "0.124.25",
   "chantVersion": ">=0.1.0",
   "namespace": "AWS",
   "intrinsics": [

package/dist/meta.json

@@ -87930,6 +87930,13 @@
       "WorkloadIdentityDetails": "WorkloadIdentityDetails",
       "FailureReason": "FailureReason"
     },
+    "propertyConstraints": {
+      "PlatformVersion": {
+        "pattern": "^[^\\s]+$",
+        "minLength": 1,
+        "maxLength": 128
+      }
+    },
     "createOnly": [
       "AgentRuntimeName"
     ],

package/dist/okf/types/Runtime.md

@@ -25,6 +25,7 @@ resource_type: AWS::BedrockAgentCore::Runtime
 - `FilesystemConfigurations` (`Runtime_FilesystemConfiguration[]`, optional): Filesystem configurations for the agent runtime
 - `LastUpdatedAt` (`string`, optional): When resource was last updated
 - `LifecycleConfiguration` (`Runtime_LifecycleConfiguration`, optional): Lifecycle configuration for managing runtime sessions
+- `PlatformVersion` (`string`, optional): The version of the runtime platform
 - `ProtocolConfiguration` (`Runtime_ProtocolConfiguration`, optional): Protocol configuration for the agent runtime
 - `RequestHeaderConfiguration` (`Runtime_RequestHeaderConfiguration`, optional): Configuration for HTTP request headers
 - `Status` (`Runtime_AgentStatus`, optional): Current status of the agent

package/dist/op/activities/floci.d.ts

@@ -4,8 +4,17 @@ export interface FlociUpArgs {
     name?: string;
     /** Host port mapped to the emulator's `:4566`. Default: `4566`. */
     port?: number;
-    /** Floci image. Default: `floci/floci:latest`. */
+    /** Floci image. Default: the pinned `floci/floci:1.5.34`. */
     image?: string;
+    /** Docker network the container joins, e.g. a compose network other containers reach Floci on. */
+    network?: string;
+    /**
+     * Extra Floci settings, passed to the container as `-e KEY=VALUE`. Every key
+     * must start with `FLOCI_`; any other key is refused rather than passed on.
+     */
+    settings?: Record<string, string>;
+    /** Publish the port on 127.0.0.1 only, instead of every host interface. Default: `false`. */
+    loopback?: boolean;
     /** Mount the docker socket — Floci needs it for the ECR backing registry. Default: `false`. */
     dockerSocket?: boolean;
     /** `AWS_REGION` exported for subsequent steps. Default: `us-east-1`. */

package/dist/op/activities/floci.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"floci.d.ts","sourceRoot":"","sources":["../../../src/op/activities/floci.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,YAAY,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAapG,MAAM,WAAW,WAAW;IAC1B,8CAA8C;IAC9C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wFAAwF;AACxF,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED,iFAAiF;AACjF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAO7E;AAcD,+EAA+E;AAC/E,eAAO,MAAM,UAAU,EAAE,YAAkD,CAAC;AAE5E;4DAC4D;AAC5D,eAAO,MAAM,cAAc,EAAE,kBAQ5B,CAAC;AAMF,eAAO,MAAM,kBAAkB,0BAAyB,CAAC;AACzD,eAAO,MAAM,cAAc,0BAAqB,CAAC;AACjD,eAAO,MAAM,cAAc,0BAAqB,CAAC;AAEjD,uDAAuD;AACvD,wBAAgB,eAAe,CAAC,IAAI,GAAE,WAAgB,GAAG,MAAM,CAO9D;AAED;;;;;;;;;GASG;AACH,wBAAsB,OAAO,CAAC,IAAI,GAAE,WAAgB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBzG;AAED,kFAAkF;AAClF,wBAAsB,SAAS,CAAC,IAAI,GAAE,aAAkB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7F"}
+{"version":3,"file":"floci.d.ts","sourceRoot":"","sources":["../../../src/op/activities/floci.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,YAAY,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAapG,MAAM,WAAW,WAAW;IAC1B,8CAA8C;IAC9C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kGAAkG;IAClG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,6FAA6F;IAC7F,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+FAA+F;IAC/F,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wFAAwF;AACxF,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED,iFAAiF;AACjF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAO7E;AAeD,+EAA+E;AAC/E,eAAO,MAAM,UAAU,EAAE,YAAkD,CAAC;AAE5E;4DAC4D;AAC5D,eAAO,MAAM,cAAc,EAAE,kBAQ5B,CAAC;AAMF,eAAO,MAAM,kBAAkB,0BAAyB,CAAC;AACzD,eAAO,MAAM,cAAc,0BAAqB,CAAC;AACjD,eAAO,MAAM,cAAc,0BAAqB,CAAC;AAEjD,uDAAuD;AACvD,wBAAgB,eAAe,CAAC,IAAI,GAAE,WAAgB,GAAG,MAAM,CAU9D;AAED;;;;;;;;;GASG;AACH,wBAAsB,OAAO,CAAC,IAAI,GAAE,WAAgB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAmBzG;AAED,kFAAkF;AAClF,wBAAsB,SAAS,CAAC,IAAI,GAAE,aAAkB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7F"}

package/dist/types/index.d.ts

@@ -30885,6 +30885,8 @@ export declare class Runtime {
     LastUpdatedAt?: string;
     /** Lifecycle configuration for managing runtime sessions */
     LifecycleConfiguration?: Runtime_LifecycleConfiguration;
+    /** The version of the runtime platform */
+    PlatformVersion?: string;
     /** Protocol configuration for the agent runtime */
     ProtocolConfiguration?: Runtime_ProtocolConfiguration;
     /** Configuration for HTTP request headers */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-aws",
-  "version": "0.124.23",
+  "version": "0.124.25",
   "description": "AWS CloudFormation lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -80,6 +80,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.23"
+    "@intentius/chant": "^0.124.25"
   }
 }

package/src/api/credential-chain.test.ts

@@ -0,0 +1,70 @@
+/**
+ * The shared-file parser and the refusals of the credential chain (#3954).
+ * Every seam is injected; nothing reads `~/.aws` or reaches a network.
+ */
+import { describe, test, expect } from "vitest";
+import { parseIni, resolveCredentialChain } from "./credential-chain";
+
+const HOME = "/home/op";
+const files = (config: string) => ({
+  home: HOME,
+  readFile: (path: string) => (path === `${HOME}/.aws/config` ? config : undefined),
+});
+
+describe("parseIni", () => {
+  test("reads sections and keys, skips comments and nested settings, keeps ; and # inside values", () => {
+    const parsed = parseIni(
+      [
+        "# a comment",
+        "[default]",
+        "region = eu-west-1",
+        "s3 =",
+        "  max_concurrent_requests = 10",
+        "output = json",
+        "",
+        "[profile  tool]",
+        "; another comment",
+        "credential_process = sh -c 'a; b # c'",
+      ].join("\n"),
+    );
+    expect(parsed).toEqual({
+      default: { region: "eu-west-1", output: "json" },
+      "profile tool": { credential_process: "sh -c 'a; b # c'" },
+    });
+  });
+});
+
+describe("resolveCredentialChain refusals", () => {
+  test("a source_profile loop is refused, not followed forever", async () => {
+    const result = await resolveCredentialChain({
+      env: { AWS_PROFILE: "a" },
+      ...files("[profile a]\nrole_arn = arn:aws:iam::1:role/a\nsource_profile = b\n[profile b]\nrole_arn = arn:aws:iam::1:role/b\nsource_profile = a\n"),
+    });
+    expect(result).toEqual({
+      unresolved: { reason: "no-credentials", detail: "profile a: source_profile loops (a -> b -> a)" },
+    });
+  });
+
+  test("mfa_serial and web identity profiles say what chant does not resolve", async () => {
+    const mfa = await resolveCredentialChain({
+      env: { AWS_PROFILE: "m" },
+      ...files("[profile m]\nrole_arn = arn:aws:iam::1:role/m\nsource_profile = m2\nmfa_serial = arn:aws:iam::1:mfa/me\n"),
+    });
+    expect(mfa).toMatchObject({ unresolved: { detail: expect.stringContaining("mfa_serial") } });
+    const web = await resolveCredentialChain({
+      env: { AWS_PROFILE: "w" },
+      ...files("[profile w]\nweb_identity_token_file = /tmp/t\nrole_arn = x\n"),
+    });
+    expect(web).toMatchObject({ unresolved: { reason: "no-credentials" } });
+  });
+
+  test("an SSO profile with no cached token names aws sso login", async () => {
+    const result = await resolveCredentialChain({
+      env: { AWS_PROFILE: "s" },
+      ...files("[profile s]\nsso_start_url = https://a/start\nsso_region = us-east-1\nsso_account_id = 1\nsso_role_name = R\n"),
+    });
+    expect(result).toMatchObject({
+      unresolved: { reason: "no-credentials", detail: expect.stringContaining("run `aws sso login --profile s`") },
+    });
+  });
+});