@intentius/chant-lexicon-aws 0.124.30 → 0.124.32

package/dist/validate-cli.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env tsx
+/**
+ * Thin entry point for `npm run validate` in lexicon-aws.
+ */
+import { validate } from "./validate.js";
+const result = await validate();
+for (const check of result.checks) {
+    const status = check.ok ? "OK" : "FAIL";
+    const msg = check.error ? ` — ${check.error}` : "";
+    console.error(`  [${status}] ${check.name}${msg}`);
+}
+if (!result.success) {
+    console.error("Validation failed");
+    process.exit(1);
+}
+console.error("All validation checks passed.");

package/dist/validate.js

@@ -0,0 +1,33 @@
+/**
+ * Validate generated lexicon-aws artifacts.
+ *
+ * Thin wrapper around the core validation framework
+ * with AWS-specific configuration.
+ */
+import { dirname } from "path";
+import { fileURLToPath } from "url";
+import { validateLexiconArtifacts } from "@intentius/chant/codegen/validate";
+const REQUIRED_NAMES = ["Bucket", "Function", "Role", "Table", "Policy", "LogGroup"];
+/**
+ * Validate the generated lexicon-aws artifacts.
+ *
+ * @param opts.basePath - Override the package directory (defaults to lexicon-aws package root)
+ */
+export async function validate(opts) {
+    const basePath = opts?.basePath ?? dirname(dirname(fileURLToPath(import.meta.url)));
+    return validateLexiconArtifacts({
+        lexiconJsonFilename: "lexicon-aws.json",
+        requiredNames: REQUIRED_NAMES,
+        basePath,
+        // chant #1473 — this is the release gate for aws. `prepack` regenerates
+        // from a CloudFormation archive that is republished several times a day,
+        // so the spec pin cannot decide whether a build is safe to ship; what must
+        // match the reviewed baseline is the API that comes out.
+        checkSurfaceSnapshot: true,
+        coverageThresholds: {
+            minPropertyPct: 1,
+            minLifecyclePct: 1,
+            minAttrPct: 1,
+        },
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-aws",
-  "version": "0.124.30",
+  "version": "0.124.32",
   "description": "AWS CloudFormation lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -32,32 +32,32 @@
     ".": {
       "development": "./src/index.ts",
       "types": "./dist/index.d.ts",
-      "default": "./src/index.ts"
+      "default": "./dist/index.js"
     },
     "./*": {
       "development": "./src/*.ts",
       "types": "./dist/*.d.ts",
-      "default": "./src/*.ts"
+      "default": "./dist/*.js"
     },
     "./components": {
       "development": "./src/components/index.ts",
       "types": "./dist/components/index.d.ts",
-      "default": "./src/components/index.ts"
+      "default": "./dist/components/index.js"
     },
     "./op/activities": {
       "development": "./src/op/activities/index.ts",
       "types": "./dist/op/activities/index.d.ts",
-      "default": "./src/op/activities/index.ts"
+      "default": "./dist/op/activities/index.js"
     },
     "./detect": {
       "development": "./src/detect.ts",
       "types": "./dist/detect.d.ts",
-      "default": "./src/detect.ts"
+      "default": "./dist/detect.js"
     },
     "./lint/post-synth": {
       "development": "./src/lint/post-synth/index.ts",
       "types": "./dist/lint/post-synth/index.d.ts",
-      "default": "./src/lint/post-synth/index.ts"
+      "default": "./dist/lint/post-synth/index.js"
     },
     "./manifest": "./dist/manifest.json",
     "./meta": "./dist/meta.json",
@@ -69,7 +69,7 @@
     "validate": "tsx src/validate-cli.ts",
     "docs": "tsx src/codegen/docs-cli.ts",
     "prepack": "npm run generate && npm run bundle && npm run validate && npm run build",
-    "build": "../../scripts/tsc7.sh -p tsconfig.build.json && tsc-alias -p tsconfig.build.json && find dist -type f \\( -name \"*.js\" -o -name \"*.js.map\" \\) -delete"
+    "build": "../../scripts/tsc7.sh -p tsconfig.build.json --sourceMap false && tsc-alias -p tsconfig.build.json"
   },
   "dependencies": {
     "fflate": "^0.8.2",
@@ -80,6 +80,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.30"
+    "@intentius/chant": "^0.124.32"
   }
 }

package/src/agentcore/trace-fetch.ts

@@ -80,6 +80,7 @@ import {
   AwsReadError,
   requestHeaders,
   serviceUrl,
+  withChainCredentials,
   withEndpointOverride,
   type AwsCredentialSource,
   type AwsReadHttp,
@@ -536,7 +537,7 @@ async function agentCorePost(
   http: AwsReadHttp,
   signal?: AbortSignal,
 ): Promise<Record<string, unknown>> {
-  const options = withEndpointOverride(SERVICE, readOptions);
+  const options = await withChainCredentials(withEndpointOverride(SERVICE, readOptions));
   const url = `${serviceUrl(SERVICE, options.endpoint, options.region)}${path.replace(/^\//, "")}`;
   const wire = JSON.stringify(body);
   const res = await http(

package/src/api/credential-chain.ts

@@ -8,7 +8,9 @@
  * than keys: `AWS_PROFILE=dev` with an SSO session came back as "no identity
  * is configured" while `aws sts get-caller-identity` answered. This module is
  * the asynchronous half: it resolves what the CLI would sign with and hands
- * back literal credentials plus a label for where they came from.
+ * back literal credentials plus a label for where they came from. The read
+ * transport uses the same walk through {@link transportCredentials} (#3958),
+ * so whoami and `describeResources` sign as the same principal.
  *
  * There is still no `@aws-sdk/*` here, for the reason the read transport gives:
  * a lexicon keeps that tree out. The chain is small enough to state.
@@ -16,8 +18,7 @@
  * ## Order
  *
  *  1. `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` (+ `AWS_SESSION_TOKEN`).
- *     They win over `AWS_PROFILE`, as they do in the AWS CLI, and as they do
- *     in chant's own read transport, which signs with nothing else. (The JS
+ *     They win over `AWS_PROFILE`, as they do in the AWS CLI. (The JS
  *     SDK v3 skips the environment when `AWS_PROFILE` is set; the CLI does
  *     not, and the CLI is what an operator checks whoami against.) When both
  *     are set, the label says the profile was not used.
@@ -90,6 +91,8 @@ export interface ResolvedChainCredentials {
   source: string;
   /** The profile that resolved them, when one did. */
   profile?: string;
+  /** When the credentials stop working, for role, SSO and `credential_process` credentials that say so. */
+  expiration?: Date;
 }
 
 export interface UnresolvedChainCredentials {
@@ -103,6 +106,20 @@ export type CredentialChainResult =
 
 type Section = Record<string, string>;
 
+/** One link of the chain's answer, before the profile name is attached. */
+interface Resolved {
+  credentials: AwsCredentials;
+  source: string;
+  expiration?: Date;
+}
+
+/** A timestamp as a Date, or undefined when it is absent or does not parse. */
+function expiryOf(value: string | number | undefined): Date | undefined {
+  if (value === undefined || value === "") return undefined;
+  const ms = typeof value === "number" ? value : Date.parse(value);
+  return Number.isFinite(ms) ? new Date(ms) : undefined;
+}
+
 /**
  * The INI dialect of the AWS shared files: `[section]`, `key = value`, `#` and
  * `;` comments on their own line (not inline: a `credential_process` command
@@ -263,7 +280,7 @@ async function resolveProfile(
   ctx: Context,
   name: string,
   visited: string[],
-): Promise<{ credentials: AwsCredentials; source: string }> {
+): Promise<Resolved> {
   if (visited.includes(name)) {
     throw new ChainRefusal("no-credentials", `profile ${name}: source_profile loops (${[...visited, name].join(" -> ")})`);
   }
@@ -303,16 +320,26 @@ async function resolveProfile(
   );
 }
 
+function withExpiry(expiration: Date | undefined): { expiration?: Date } {
+  return expiration ? { expiration } : {};
+}
+
+function earliest(a: Date | undefined, b: Date | undefined): Date | undefined {
+  if (!a) return b;
+  if (!b) return a;
+  return a.getTime() <= b.getTime() ? a : b;
+}
+
 async function resolveRoleProfile(
   ctx: Context,
   name: string,
   p: Section,
   visited: string[],
-): Promise<{ credentials: AwsCredentials; source: string }> {
+): Promise<Resolved> {
   if (p.mfa_serial) {
     throw new ChainRefusal("no-credentials", `profile ${name} sets mfa_serial; chant cannot prompt for an MFA code`);
   }
-  let base: { credentials: AwsCredentials; source: string };
+  let base: Resolved;
   if (p.source_profile) {
     base = await resolveProfile(ctx, p.source_profile, [...visited, name]);
   } else if (p.credential_source === "Environment") {
@@ -351,6 +378,7 @@ async function resolveRoleProfile(
         sessionToken: assumed.sessionToken,
       },
       source: `profile ${name} (role ${p.role_arn} via ${base.source})`,
+      ...withExpiry(earliest(expiryOf(assumed.expiration), base.expiration)),
     };
   } catch (err) {
     const what = err instanceof AwsReadError ? `${err.code ? `${err.code}: ` : ""}${err.message}` : String(err);
@@ -376,7 +404,7 @@ async function resolveSsoProfile(
   ctx: Context,
   name: string,
   p: Section,
-): Promise<{ credentials: AwsCredentials; source: string }> {
+): Promise<Resolved> {
   let startUrl = p.sso_start_url;
   let ssoRegion = p.sso_region;
   let cacheKey = startUrl;
@@ -446,7 +474,7 @@ async function resolveSsoProfile(
   if (res.status >= 400) {
     throw new ChainRefusal("read-failed", `profile ${name}: sso:GetRoleCredentials for ${roleName} in ${accountId} failed with HTTP ${res.status}`);
   }
-  let role: { accessKeyId?: string; secretAccessKey?: string; sessionToken?: string } | undefined;
+  let role: { accessKeyId?: string; secretAccessKey?: string; sessionToken?: string; expiration?: number } | undefined;
   try {
     role = (JSON.parse(res.text) as { roleCredentials?: typeof role }).roleCredentials;
   } catch {
@@ -462,6 +490,7 @@ async function resolveSsoProfile(
       ...(role.sessionToken ? { sessionToken: role.sessionToken } : {}),
     },
     source: `${label}, role ${roleName} in ${accountId}`,
+    ...withExpiry(expiryOf(role.expiration)),
   };
 }
 
@@ -501,7 +530,7 @@ async function resolveProcessProfile(
   ctx: Context,
   name: string,
   command: string,
-): Promise<{ credentials: AwsCredentials; source: string }> {
+): Promise<Resolved> {
   const out = await ctx.runProcess(command);
   if (out.exitCode !== 0) {
     const firstLine = out.stderr.trim().split(/\r?\n/)[0] ?? "";
@@ -532,5 +561,86 @@ async function resolveProcessProfile(
       ...(parsed.SessionToken ? { sessionToken: parsed.SessionToken } : {}),
     },
     source: `profile ${name} (credential_process)`,
+    ...withExpiry(expiryOf(parsed.Expiration)),
   };
 }
+
+/* ── Credentials for the read transport (#3958) ─────────────────────────── */
+
+/** Cached credentials are re-resolved this long before they expire. */
+export const TRANSPORT_REFRESH_MARGIN_MS = 5 * 60_000;
+
+/**
+ * How long "nothing resolves" is kept before the chain is walked again, so a
+ * long-running process picks up an `aws sso login` done after it started.
+ */
+export const TRANSPORT_UNRESOLVED_TTL_MS = 5 * 60_000;
+
+interface TransportEntry {
+  credentials?: AwsCredentials;
+  /** Epoch ms after which the entry is walked again. */
+  refreshAt: number;
+}
+
+/**
+ * One walk per environment and shared-file location, shared by every read in
+ * the process. Concurrent first reads await the same promise, so an SSO
+ * portal call or a `credential_process` runs once rather than once per read.
+ */
+const transportCache = new Map<string, Promise<TransportEntry>>();
+
+/** Forget every cached walk. For tests, and for a process that changed its profile. */
+export function resetTransportCredentials(): void {
+  transportCache.clear();
+}
+
+async function walkForTransport(options: CredentialChainOptions, now: () => Date): Promise<TransportEntry> {
+  let result: CredentialChainResult | undefined;
+  try {
+    result = await resolveCredentialChain(options);
+  } catch {
+    result = undefined;
+  }
+  const t = now().getTime();
+  if (!result || "unresolved" in result) return { refreshAt: t + TRANSPORT_UNRESOLVED_TTL_MS };
+  const expires = result.resolved.expiration?.getTime();
+  if (expires === undefined) return { credentials: result.resolved.credentials, refreshAt: Infinity };
+  const early = expires - TRANSPORT_REFRESH_MARGIN_MS;
+  return { credentials: result.resolved.credentials, refreshAt: early > t ? early : expires };
+}
+
+/**
+ * What the native read transport signs with when the caller injected nothing:
+ * the same chain whoami walks, so `lifecycle diff --live` signs as the
+ * principal whoami reports. The signing seam (`AwsCredentialResolver` in
+ * ./sigv4.ts) is synchronous and the chain is not, so the transport awaits
+ * this once before a request and passes the literal credentials in.
+ *
+ * Environment keys answer directly, as in the chain. Otherwise the walk is
+ * cached per process, keyed by the profile and the shared-file locations, and
+ * walked again within {@link TRANSPORT_REFRESH_MARGIN_MS} of the expiry the
+ * role, SSO or `credential_process` answer carried. A refusal or a failure is
+ * `undefined`, which leaves the request unsigned exactly as before; it is kept
+ * for {@link TRANSPORT_UNRESOLVED_TTL_MS}.
+ */
+export async function transportCredentials(options: CredentialChainOptions = {}): Promise<AwsCredentials | undefined> {
+  const env = options.env ?? process.env;
+  const fromEnv = envCredentials(env);
+  if (fromEnv) return fromEnv;
+  const now = options.now ?? (() => new Date());
+  const home = options.home ?? (env.HOME || env.USERPROFILE || homedir());
+  const key = JSON.stringify([env.AWS_PROFILE ?? "", env.AWS_CONFIG_FILE ?? "", env.AWS_SHARED_CREDENTIALS_FILE ?? "", home]);
+
+  const cached = transportCache.get(key);
+  if (cached) {
+    const entry = await cached;
+    if (now().getTime() < entry.refreshAt) return entry.credentials;
+    if (transportCache.get(key) === cached) transportCache.delete(key);
+  }
+  let pending = transportCache.get(key);
+  if (!pending) {
+    pending = walkForTransport({ ...options, env, home }, now);
+    transportCache.set(key, pending);
+  }
+  return (await pending).credentials;
+}

package/src/api/credential-isolation.test.ts

@@ -0,0 +1,72 @@
+/**
+ * The unit project keeps the developer's ~/.aws out of reach (#3958).
+ * test/aws-credential-isolation.setup.ts strips the credential variables and
+ * points the shared files at paths that do not exist. These tests put a
+ * `credential_process` profile under a HOME that the chain would otherwise
+ * read and check that a read with no injected `env` never runs it.
+ */
+import { afterEach, beforeEach, describe, expect, test } from "vitest";
+import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describeStackResources, type AwsReadHttp } from "./read-client";
+import { resetTransportCredentials, resolveCredentialChain, transportCredentials } from "./credential-chain";
+
+const stackXml =
+  "<DescribeStackResourcesResponse><DescribeStackResourcesResult><StackResources></StackResources>" +
+  "</DescribeStackResourcesResult></DescribeStackResourcesResponse>";
+
+let home: string;
+let marker: string;
+let savedHome: string | undefined;
+
+beforeEach(() => {
+  resetTransportCredentials();
+  home = mkdtempSync(join(tmpdir(), "chant-aws-isolation-"));
+  marker = join(home, "credential-process-ran");
+  mkdirSync(join(home, ".aws"));
+  // The command writes the marker and prints nothing, so the chain refuses its
+  // output; the marker alone says whether it ran.
+  writeFileSync(join(home, ".aws", "config"), `[default]\ncredential_process = touch '${marker}'\n`);
+  savedHome = process.env.HOME;
+  process.env.HOME = home;
+});
+
+afterEach(() => {
+  if (savedHome === undefined) delete process.env.HOME;
+  else process.env.HOME = savedHome;
+  rmSync(home, { recursive: true, force: true });
+  resetTransportCredentials();
+});
+
+describe("unit tests do not read the real AWS shared files (#3958)", () => {
+  test("the setup file cleared the credential variables and pointed the shared files nowhere", () => {
+    for (const name of ["AWS_PROFILE", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN"]) {
+      expect(process.env[name]).toBeUndefined();
+    }
+    expect(process.env.AWS_CONFIG_FILE).toBeTruthy();
+    expect(existsSync(process.env.AWS_CONFIG_FILE!)).toBe(false);
+    expect(process.env.AWS_SHARED_CREDENTIALS_FILE).toBeTruthy();
+    expect(existsSync(process.env.AWS_SHARED_CREDENTIALS_FILE!)).toBe(false);
+  });
+
+  test("a read with no injected env goes out unsigned and runs no credential_process", async () => {
+    const auth: string[] = [];
+    const http: AwsReadHttp = async (_url, init) => {
+      auth.push(init.headers.authorization ?? "");
+      return { status: 200, text: stackXml };
+    };
+    await describeStackResources("app", { http, region: "us-east-1" });
+    expect(auth[0]).toContain("Signature=unsigned");
+    expect(await transportCredentials()).toBeUndefined();
+    const chain = await resolveCredentialChain();
+    expect("unresolved" in chain).toBe(true);
+    expect(existsSync(marker)).toBe(false);
+  });
+
+  test("control: the same HOME injected without the setup's file paths does run the command", async () => {
+    const result = await resolveCredentialChain({ env: { HOME: home } });
+    expect("unresolved" in result).toBe(true);
+    expect(existsSync(marker)).toBe(true);
+  });
+});

package/src/api/read-client-chain.test.ts

@@ -0,0 +1,159 @@
+/**
+ * The read transport signs with the AWS CLI's credential chain (#3958), the
+ * same walk `chant lifecycle whoami` does (#3954). Shared files live in a temp
+ * directory and HTTP is injected, so nothing reads the real `~/.aws` or
+ * reaches a network.
+ */
+import { afterEach, beforeEach, describe, expect, test } from "vitest";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describeStackResources, getCallerIdentity, type AwsReadHttp } from "./read-client";
+import { resetTransportCredentials, transportCredentials, TRANSPORT_REFRESH_MARGIN_MS } from "./credential-chain";
+import { ssmCall } from "../receipt-store";
+
+const stackXml =
+  "<DescribeStackResourcesResponse><DescribeStackResourcesResult><StackResources></StackResources>" +
+  "</DescribeStackResourcesResult></DescribeStackResourcesResponse>";
+
+function recording(text: (url: string, body: string) => string) {
+  const calls: Array<{ url: string; headers: Record<string, string>; body: string }> = [];
+  const http: AwsReadHttp = async (url, init) => {
+    calls.push({ url, headers: init.headers, body: init.body });
+    return { status: 200, text: text(url, init.body) };
+  };
+  return { http, calls };
+}
+
+let home: string;
+beforeEach(() => {
+  resetTransportCredentials();
+  home = mkdtempSync(join(tmpdir(), "chant-aws-chain-"));
+});
+afterEach(() => {
+  rmSync(home, { recursive: true, force: true });
+  resetTransportCredentials();
+});
+
+function writeAws(config: string, credentials = ""): Record<string, string> {
+  const configPath = join(home, "config");
+  const credentialsPath = join(home, "credentials");
+  writeFileSync(configPath, config);
+  writeFileSync(credentialsPath, credentials);
+  return { HOME: home, AWS_CONFIG_FILE: configPath, AWS_SHARED_CREDENTIALS_FILE: credentialsPath };
+}
+
+describe("the read transport walks the credential chain (#3958)", () => {
+  test("AWS_PROFILE with static keys in the shared credentials file signs a CloudFormation read", async () => {
+    const env = { ...writeAws("[profile dev]\nregion = eu-west-1\n", "[dev]\naws_access_key_id = AKIDPROFILE\naws_secret_access_key = secret\n"), AWS_PROFILE: "dev" };
+    const { http, calls } = recording(() => stackXml);
+    await describeStackResources("app", { http, env, region: "eu-west-1" });
+    const auth = calls[0]!.headers.authorization ?? "";
+    expect(auth).toMatch(/^AWS4-HMAC-SHA256 Credential=AKIDPROFILE\/\d{8}\/eu-west-1\/cloudformation\/aws4_request/);
+    expect(auth).not.toContain("Signature=unsigned");
+    expect(calls[0]!.headers["x-amz-date"]).toBeDefined();
+  });
+
+  test("the default profile signs when AWS_PROFILE is unset, and the SSM receipt store signs too", async () => {
+    const env = writeAws("", "[default]\naws_access_key_id = AKIDDEFAULT\naws_secret_access_key = secret\naws_session_token = tok\n");
+    const { http, calls } = recording(() => "{}");
+    await ssmCall("GetParameter", { Name: "/x" }, { http, env });
+    expect(calls[0]!.headers.authorization).toMatch(/Credential=AKIDDEFAULT\/.*\/ssm\/aws4_request/);
+    expect(calls[0]!.headers["x-amz-security-token"]).toBe("tok");
+  });
+
+  test("a role_arn profile assumes the role once and signs later reads with the role's keys", async () => {
+    const env = {
+      ...writeAws(
+        "[profile ops]\nrole_arn = arn:aws:iam::111122223333:role/ops\nsource_profile = base\n",
+        "[base]\naws_access_key_id = AKIDBASE\naws_secret_access_key = secret\n",
+      ),
+      AWS_PROFILE: "ops",
+    };
+    const expiration = new Date(Date.now() + 3600_000).toISOString();
+    const { http, calls } = recording((_url, body) =>
+      body.includes("Action=AssumeRole")
+        ? `<AssumeRoleResponse><AssumeRoleResult><Credentials><AccessKeyId>ASIAROLE</AccessKeyId><SecretAccessKey>s</SecretAccessKey><SessionToken>t</SessionToken><Expiration>${expiration}</Expiration></Credentials></AssumeRoleResult></AssumeRoleResponse>`
+        : body.includes("GetCallerIdentity")
+          ? "<GetCallerIdentityResponse><GetCallerIdentityResult><Arn>arn:aws:sts::111122223333:assumed-role/ops/x</Arn><Account>111122223333</Account></GetCallerIdentityResult></GetCallerIdentityResponse>"
+          : stackXml,
+    );
+    await Promise.all([describeStackResources("a", { http, env }), describeStackResources("b", { http, env })]);
+    await getCallerIdentity({ http, env });
+    const assume = calls.filter((c) => c.body.includes("Action=AssumeRole"));
+    expect(assume).toHaveLength(1);
+    expect(assume[0]!.headers.authorization).toContain("Credential=AKIDBASE/");
+    const reads = calls.filter((c) => !c.body.includes("Action=AssumeRole"));
+    expect(reads).toHaveLength(3);
+    for (const r of reads) expect(r.headers.authorization).toContain("Credential=ASIAROLE/");
+  });
+
+  test("environment keys still win over AWS_PROFILE", async () => {
+    const env = {
+      ...writeAws("", "[dev]\naws_access_key_id = AKIDPROFILE\naws_secret_access_key = secret\n"),
+      AWS_PROFILE: "dev",
+      AWS_ACCESS_KEY_ID: "AKIDENV",
+      AWS_SECRET_ACCESS_KEY: "secret",
+    };
+    const { http, calls } = recording(() => stackXml);
+    await describeStackResources("app", { http, env });
+    expect(calls[0]!.headers.authorization).toContain("Credential=AKIDENV/");
+  });
+
+  test("an endpoint override stays unsigned and the chain is not walked", async () => {
+    const env = { ...writeAws("[profile tool]\ncredential_process = definitely-not-a-command\n"), AWS_PROFILE: "tool" };
+    const { http, calls } = recording(() => stackXml);
+    await describeStackResources("app", { http, env, endpoint: "http://localhost:4566", region: "us-west-1" });
+    expect(calls[0]!.headers.authorization).toContain("Signature=unsigned");
+  });
+
+  test("an injected environment that names no shared files does not read the process's ~/.aws", async () => {
+    const { http, calls } = recording(() => stackXml);
+    await describeStackResources("app", { http, env: {}, region: "us-east-1" });
+    expect(calls[0]!.headers.authorization).toContain("Signature=unsigned");
+  });
+
+  test("a profile that does not resolve leaves the read unsigned, as before", async () => {
+    const env = { ...writeAws("[profile s]\nsso_start_url = https://a/start\nsso_region = us-east-1\nsso_account_id = 1\nsso_role_name = R\n"), AWS_PROFILE: "s" };
+    const { http, calls } = recording(() => stackXml);
+    await describeStackResources("app", { http, env, region: "us-east-1" });
+    expect(calls[0]!.headers.authorization).toContain("Signature=unsigned");
+  });
+});
+
+describe("transportCredentials caching", () => {
+  test("credentials are resolved once and walked again within the refresh margin of their expiry", async () => {
+    const env = { ...writeAws("[profile tool]\ncredential_process = issue\n"), AWS_PROFILE: "tool" };
+    let t = Date.parse("2026-10-19T12:00:00Z");
+    const expires = t + 3600_000;
+    let runs = 0;
+    const runProcess = async () => {
+      runs++;
+      return {
+        exitCode: 0,
+        stderr: "",
+        stdout: JSON.stringify({ Version: 1, AccessKeyId: `AKID${runs}`, SecretAccessKey: "s", Expiration: new Date(expires + (runs - 1) * 3600_000).toISOString() }),
+      };
+    };
+    const options = { env, runProcess, now: () => new Date(t) };
+    expect((await transportCredentials(options))?.accessKeyId).toBe("AKID1");
+    t = expires - TRANSPORT_REFRESH_MARGIN_MS - 1;
+    expect((await transportCredentials(options))?.accessKeyId).toBe("AKID1");
+    expect(runs).toBe(1);
+    t = expires - TRANSPORT_REFRESH_MARGIN_MS + 1;
+    expect((await transportCredentials(options))?.accessKeyId).toBe("AKID2");
+    expect(runs).toBe(2);
+  });
+
+  test("concurrent first calls share one walk", async () => {
+    const env = { ...writeAws("[profile tool]\ncredential_process = issue\n"), AWS_PROFILE: "tool" };
+    let runs = 0;
+    const runProcess = async () => {
+      runs++;
+      await new Promise((r) => setTimeout(r, 10));
+      return { exitCode: 0, stderr: "", stdout: JSON.stringify({ Version: 1, AccessKeyId: "AKID", SecretAccessKey: "s" }) };
+    };
+    await Promise.all([1, 2, 3].map(() => transportCredentials({ env, runProcess })));
+    expect(runs).toBe(1);
+  });
+});