@intentius/chant-lexicon-aws 0.124.31 → 0.124.32

package/dist/api/credential-chain.js

@@ -0,0 +1,509 @@
+/**
+ * The AWS credential chain, as the AWS CLI walks it, for `chant lifecycle
+ * whoami` (#3954).
+ *
+ * `resolveCredentials` (./sigv4.ts) reads the three environment variables and
+ * nothing else. That is right for the read transport's synchronous signing
+ * seam, and it made whoami wrong for anyone whose shell holds a profile rather
+ * than keys: `AWS_PROFILE=dev` with an SSO session came back as "no identity
+ * is configured" while `aws sts get-caller-identity` answered. This module is
+ * the asynchronous half: it resolves what the CLI would sign with and hands
+ * back literal credentials plus a label for where they came from. The read
+ * transport uses the same walk through {@link transportCredentials} (#3958),
+ * so whoami and `describeResources` sign as the same principal.
+ *
+ * There is still no `@aws-sdk/*` here, for the reason the read transport gives:
+ * a lexicon keeps that tree out. The chain is small enough to state.
+ *
+ * ## Order
+ *
+ *  1. `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` (+ `AWS_SESSION_TOKEN`).
+ *     They win over `AWS_PROFILE`, as they do in the AWS CLI. (The JS
+ *     SDK v3 skips the environment when `AWS_PROFILE` is set; the CLI does
+ *     not, and the CLI is what an operator checks whoami against.) When both
+ *     are set, the label says the profile was not used.
+ *  2. The profile `AWS_PROFILE` names, else `default` when one exists, read
+ *     from `AWS_CONFIG_FILE` (`~/.aws/config`) and
+ *     `AWS_SHARED_CREDENTIALS_FILE` (`~/.aws/credentials`). Within a profile:
+ *     `role_arn` (with `source_profile` or `credential_source = Environment`),
+ *     then static keys, then SSO (`sso_session` or the legacy
+ *     `sso_start_url`), then `credential_process`.
+ *
+ * Not resolved, and said so rather than skipped: `web_identity_token_file`,
+ * `mfa_serial`, `credential_source` other than `Environment`, and the
+ * instance-metadata and container endpoints.
+ *
+ * ## SSO
+ *
+ * The token `aws sso login` cached under `~/.aws/sso/cache/` is read, and when
+ * its access token has expired but it carries a refresh token, it is refreshed
+ * through SSO OIDC the way the CLI does. The refreshed token is used for this
+ * call and NOT written back; whoami is read-only. A missing, expired or
+ * refused session is a `no-credentials` answer naming
+ * `aws sso login --profile <p>`.
+ *
+ * ## Credential material
+ *
+ * Nothing this module returns in a label or an error carries a key, a secret,
+ * a session token or an SSO bearer token. `credential_process` output is
+ * credential JSON, so a malformed one is described, never echoed.
+ */
+import { exec } from "node:child_process";
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { AwsReadError, assumeRole } from "./read-client.js";
+/** A timestamp as a Date, or undefined when it is absent or does not parse. */
+function expiryOf(value) {
+    if (value === undefined || value === "")
+        return undefined;
+    const ms = typeof value === "number" ? value : Date.parse(value);
+    return Number.isFinite(ms) ? new Date(ms) : undefined;
+}
+/**
+ * The INI dialect of the AWS shared files: `[section]`, `key = value`, `#` and
+ * `;` comments on their own line (not inline: a `credential_process` command
+ * line may hold either character). An indented line under a key with an empty value is a nested
+ * setting (`s3 =` / `  max_concurrent_requests = 10`); nothing here reads
+ * those, so they are dropped rather than mistaken for top-level keys.
+ */
+export function parseIni(text) {
+    const out = {};
+    let current;
+    let nestedUnder;
+    for (const raw of text.split(/\r?\n/)) {
+        if (/^\s*([#;]|$)/.test(raw))
+            continue;
+        const header = raw.match(/^\s*\[([^\]]+)\]\s*([#;].*)?$/);
+        if (header) {
+            const name = header[1].trim().replace(/\s+/g, " ");
+            current = out[name] ?? (out[name] = {});
+            nestedUnder = undefined;
+            continue;
+        }
+        if (!current)
+            continue;
+        if (nestedUnder && /^\s/.test(raw))
+            continue;
+        const kv = raw.match(/^\s*([^=]+?)\s*=\s*(.*?)\s*$/);
+        if (!kv)
+            continue;
+        const [, key, value] = kv;
+        nestedUnder = value === "" ? key : undefined;
+        if (value !== "")
+            current[key] = value;
+    }
+    return out;
+}
+function loadSharedFiles(env, home, read) {
+    const configPath = env.AWS_CONFIG_FILE || join(home, ".aws", "config");
+    const credentialsPath = env.AWS_SHARED_CREDENTIALS_FILE || join(home, ".aws", "credentials");
+    return {
+        configPath,
+        credentialsPath,
+        config: parseIni(read(configPath) ?? ""),
+        credentials: parseIni(read(credentialsPath) ?? ""),
+    };
+}
+/** A profile's settings, the credentials file winning over the config file as in the CLI. */
+function profileSettings(files, name) {
+    const fromConfig = files.config[name === "default" ? "default" : `profile ${name}`] ??
+        (name === "default" ? files.config["profile default"] : undefined);
+    const fromCredentials = files.credentials[name];
+    if (!fromConfig && !fromCredentials)
+        return undefined;
+    return { ...fromConfig, ...fromCredentials };
+}
+const defaultReadFile = (path) => {
+    try {
+        return readFileSync(path, "utf-8");
+    }
+    catch {
+        return undefined;
+    }
+};
+const defaultHttp = async (url, init) => {
+    const res = await fetch(url, { method: init.method, headers: init.headers, body: init.body });
+    return { status: res.status, text: await res.text() };
+};
+const defaultRunProcess = (command) => new Promise((resolve) => {
+    exec(command, { timeout: 60000, maxBuffer: 1024 * 1024 }, (error, stdout, stderr) => {
+        const code = error ? (typeof error.code === "number" ? error.code : 1) : 0;
+        resolve({ exitCode: code, stdout: String(stdout), stderr: String(stderr) });
+    });
+});
+class ChainRefusal extends Error {
+    constructor(reason, detail) {
+        super(detail);
+        this.reason = reason;
+    }
+}
+function envCredentials(env) {
+    if (!env.AWS_ACCESS_KEY_ID || !env.AWS_SECRET_ACCESS_KEY)
+        return undefined;
+    return {
+        accessKeyId: env.AWS_ACCESS_KEY_ID,
+        secretAccessKey: env.AWS_SECRET_ACCESS_KEY,
+        ...(env.AWS_SESSION_TOKEN ? { sessionToken: env.AWS_SESSION_TOKEN } : {}),
+    };
+}
+function envLabel(env) {
+    return env.AWS_SESSION_TOKEN ? "env AWS_ACCESS_KEY_ID + AWS_SESSION_TOKEN" : "env AWS_ACCESS_KEY_ID";
+}
+/**
+ * Resolve credentials the way the AWS CLI does. Returns literal credentials
+ * and their source, or a typed refusal that says what to do about it.
+ */
+export async function resolveCredentialChain(options = {}) {
+    const env = options.env ?? process.env;
+    const fromEnv = envCredentials(env);
+    if (fromEnv) {
+        const ignored = env.AWS_PROFILE ? `; AWS_PROFILE=${env.AWS_PROFILE} not used, as in the AWS CLI` : "";
+        return { resolved: { credentials: fromEnv, source: `${envLabel(env)}${ignored}` } };
+    }
+    const home = options.home ?? (env.HOME || env.USERPROFILE || homedir());
+    const read = options.readFile ?? defaultReadFile;
+    const ctx = {
+        env,
+        home,
+        read,
+        files: loadSharedFiles(env, home, read),
+        http: options.http ?? defaultHttp,
+        runProcess: options.runProcess ?? defaultRunProcess,
+        sts: options.sts ?? {},
+        now: options.now ?? (() => new Date()),
+    };
+    const named = env.AWS_PROFILE;
+    const name = named ?? "default";
+    if (!profileSettings(ctx.files, name)) {
+        return {
+            unresolved: {
+                reason: "no-credentials",
+                detail: named
+                    ? `AWS_PROFILE=${named}, but there is no profile ${named} in ${ctx.files.configPath} or ${ctx.files.credentialsPath}`
+                    : `no AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY in the environment, no AWS_PROFILE, and no default profile in ${ctx.files.configPath} or ${ctx.files.credentialsPath}`,
+            },
+        };
+    }
+    try {
+        const resolved = await resolveProfile(ctx, name, []);
+        return { resolved: { ...resolved, profile: name } };
+    }
+    catch (err) {
+        if (err instanceof ChainRefusal)
+            return { unresolved: { reason: err.reason, detail: err.message } };
+        throw err;
+    }
+}
+async function resolveProfile(ctx, name, visited) {
+    if (visited.includes(name)) {
+        throw new ChainRefusal("no-credentials", `profile ${name}: source_profile loops (${[...visited, name].join(" -> ")})`);
+    }
+    const p = profileSettings(ctx.files, name);
+    if (!p) {
+        throw new ChainRefusal("no-credentials", `profile ${visited.at(-1)} names source_profile ${name}, which is not in ${ctx.files.configPath} or ${ctx.files.credentialsPath}`);
+    }
+    // A source profile that has static keys signs with them even when it also
+    // has a role_arn, as in the CLI. Only the profile asked for, or a source
+    // profile without keys, assumes its role.
+    const isSource = visited.length > 0;
+    if (p.role_arn && !(isSource && p.aws_access_key_id && p.aws_secret_access_key)) {
+        return resolveRoleProfile(ctx, name, p, visited);
+    }
+    if (p.aws_access_key_id && p.aws_secret_access_key) {
+        return {
+            credentials: {
+                accessKeyId: p.aws_access_key_id,
+                secretAccessKey: p.aws_secret_access_key,
+                ...(p.aws_session_token ? { sessionToken: p.aws_session_token } : {}),
+            },
+            source: `profile ${name} (static keys)`,
+        };
+    }
+    if (p.sso_session || p.sso_start_url)
+        return resolveSsoProfile(ctx, name, p);
+    if (p.credential_process)
+        return resolveProcessProfile(ctx, name, p.credential_process);
+    if (p.web_identity_token_file) {
+        throw new ChainRefusal("no-credentials", `profile ${name} uses web_identity_token_file, which chant does not resolve`);
+    }
+    throw new ChainRefusal("no-credentials", `profile ${name} has no aws_access_key_id, role_arn, sso_session, sso_start_url or credential_process`);
+}
+function withExpiry(expiration) {
+    return expiration ? { expiration } : {};
+}
+function earliest(a, b) {
+    if (!a)
+        return b;
+    if (!b)
+        return a;
+    return a.getTime() <= b.getTime() ? a : b;
+}
+async function resolveRoleProfile(ctx, name, p, visited) {
+    if (p.mfa_serial) {
+        throw new ChainRefusal("no-credentials", `profile ${name} sets mfa_serial; chant cannot prompt for an MFA code`);
+    }
+    let base;
+    if (p.source_profile) {
+        base = await resolveProfile(ctx, p.source_profile, [...visited, name]);
+    }
+    else if (p.credential_source === "Environment") {
+        const creds = envCredentials(ctx.env);
+        if (!creds) {
+            throw new ChainRefusal("no-credentials", `profile ${name} has credential_source = Environment, but AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY are not set`);
+        }
+        base = { credentials: creds, source: envLabel(ctx.env) };
+    }
+    else if (p.credential_source) {
+        throw new ChainRefusal("no-credentials", `profile ${name} has credential_source = ${p.credential_source}; chant resolves only Environment`);
+    }
+    else {
+        throw new ChainRefusal("no-credentials", `profile ${name} has role_arn but no source_profile or credential_source`);
+    }
+    const duration = p.duration_seconds ? Number(p.duration_seconds) : undefined;
+    try {
+        const assumed = await assumeRole({
+            roleArn: p.role_arn,
+            sessionName: p.role_session_name || `chant-${ctx.now().getTime()}`,
+            ...(p.external_id ? { externalId: p.external_id } : {}),
+            ...(duration && Number.isFinite(duration) ? { durationSeconds: duration } : {}),
+        }, { ...ctx.sts, region: ctx.sts.region ?? p.region ?? "us-east-1", credentials: base.credentials });
+        return {
+            credentials: {
+                accessKeyId: assumed.accessKeyId,
+                secretAccessKey: assumed.secretAccessKey,
+                sessionToken: assumed.sessionToken,
+            },
+            source: `profile ${name} (role ${p.role_arn} via ${base.source})`,
+            ...withExpiry(earliest(expiryOf(assumed.expiration), base.expiration)),
+        };
+    }
+    catch (err) {
+        const what = err instanceof AwsReadError ? `${err.code ? `${err.code}: ` : ""}${err.message}` : String(err);
+        const refused = err instanceof AwsReadError && (err.status === 401 || err.status === 403);
+        throw new ChainRefusal(refused ? "no-credentials" : "read-failed", `profile ${name}: sts:AssumeRole ${p.role_arn} failed: ${what}`);
+    }
+}
+function loginHint(name) {
+    return `run \`aws sso login --profile ${name}\``;
+}
+async function resolveSsoProfile(ctx, name, p) {
+    let startUrl = p.sso_start_url;
+    let ssoRegion = p.sso_region;
+    let cacheKey = startUrl;
+    let label = `profile ${name} (sso ${startUrl})`;
+    if (p.sso_session) {
+        const session = ctx.files.config[`sso-session ${p.sso_session}`];
+        if (!session) {
+            throw new ChainRefusal("no-credentials", `profile ${name} names sso_session ${p.sso_session}, which has no [sso-session ${p.sso_session}] section in ${ctx.files.configPath}`);
+        }
+        startUrl = session.sso_start_url;
+        ssoRegion = session.sso_region ?? ssoRegion;
+        cacheKey = p.sso_session;
+        label = `profile ${name} (sso session ${p.sso_session})`;
+    }
+    const accountId = p.sso_account_id;
+    const roleName = p.sso_role_name;
+    if (!startUrl || !ssoRegion || !accountId || !roleName) {
+        const missing = [
+            !startUrl && "sso_start_url",
+            !ssoRegion && "sso_region",
+            !accountId && "sso_account_id",
+            !roleName && "sso_role_name",
+        ].filter(Boolean);
+        throw new ChainRefusal("no-credentials", `profile ${name} is an SSO profile missing ${missing.join(", ")}`);
+    }
+    const cachePath = join(ctx.home, ".aws", "sso", "cache", `${createHash("sha1").update(cacheKey).digest("hex")}.json`);
+    const raw = ctx.read(cachePath);
+    if (raw === undefined) {
+        throw new ChainRefusal("no-credentials", `profile ${name}: no cached SSO token at ${cachePath}; ${loginHint(name)}`);
+    }
+    let token;
+    try {
+        token = JSON.parse(raw);
+    }
+    catch {
+        throw new ChainRefusal("no-credentials", `profile ${name}: the cached SSO token at ${cachePath} is not JSON; ${loginHint(name)}`);
+    }
+    const now = ctx.now().getTime();
+    let accessToken = token.accessToken;
+    const expires = token.expiresAt ? Date.parse(token.expiresAt) : NaN;
+    if (!accessToken || !(expires > now)) {
+        accessToken = p.sso_session ? await refreshSsoToken(ctx, token, ssoRegion, now) : undefined;
+        if (!accessToken) {
+            throw new ChainRefusal("no-credentials", `profile ${name}: the SSO session has expired; ${loginHint(name)}`);
+        }
+    }
+    const url = `https://portal.sso.${ssoRegion}.amazonaws.com/federation/credentials` +
+        `?account_id=${encodeURIComponent(accountId)}&role_name=${encodeURIComponent(roleName)}`;
+    let res;
+    try {
+        res = await ctx.http(url, { method: "GET", headers: { "x-amz-sso_bearer_token": accessToken } });
+    }
+    catch (err) {
+        throw new ChainRefusal("read-failed", `profile ${name}: sso:GetRoleCredentials failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (res.status === 401 || res.status === 403) {
+        throw new ChainRefusal("no-credentials", `profile ${name}: the SSO portal refused the cached session (HTTP ${res.status}); ${loginHint(name)}`);
+    }
+    if (res.status >= 400) {
+        throw new ChainRefusal("read-failed", `profile ${name}: sso:GetRoleCredentials for ${roleName} in ${accountId} failed with HTTP ${res.status}`);
+    }
+    let role;
+    try {
+        role = JSON.parse(res.text).roleCredentials;
+    }
+    catch {
+        role = undefined;
+    }
+    if (!role?.accessKeyId || !role.secretAccessKey) {
+        throw new ChainRefusal("read-failed", `profile ${name}: sso:GetRoleCredentials answered without role credentials`);
+    }
+    return {
+        credentials: {
+            accessKeyId: role.accessKeyId,
+            secretAccessKey: role.secretAccessKey,
+            ...(role.sessionToken ? { sessionToken: role.sessionToken } : {}),
+        },
+        source: `${label}, role ${roleName} in ${accountId}`,
+        ...withExpiry(expiryOf(role.expiration)),
+    };
+}
+/**
+ * Trade a cached refresh token for a new access token through SSO OIDC, the
+ * way the CLI keeps an `sso-session` alive without a browser. Returns
+ * `undefined` when there is nothing to refresh with or the refresh is
+ * refused; the caller turns that into the `aws sso login` hint.
+ */
+async function refreshSsoToken(ctx, token, region, now) {
+    if (!token.refreshToken || !token.clientId || !token.clientSecret)
+        return undefined;
+    if (token.registrationExpiresAt && !(Date.parse(token.registrationExpiresAt) > now))
+        return undefined;
+    let res;
+    try {
+        res = await ctx.http(`https://oidc.${region}.amazonaws.com/token`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({
+                grantType: "refresh_token",
+                clientId: token.clientId,
+                clientSecret: token.clientSecret,
+                refreshToken: token.refreshToken,
+            }),
+        });
+    }
+    catch {
+        return undefined;
+    }
+    if (res.status >= 400)
+        return undefined;
+    try {
+        return JSON.parse(res.text).accessToken || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function resolveProcessProfile(ctx, name, command) {
+    const out = await ctx.runProcess(command);
+    if (out.exitCode !== 0) {
+        const firstLine = out.stderr.trim().split(/\r?\n/)[0] ?? "";
+        throw new ChainRefusal("no-credentials", `profile ${name}: credential_process exited ${out.exitCode}${firstLine ? `: ${firstLine}` : ""}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(out.stdout);
+    }
+    catch {
+        throw new ChainRefusal("no-credentials", `profile ${name}: credential_process did not print JSON`);
+    }
+    if (parsed.Version !== 1 || !parsed.AccessKeyId || !parsed.SecretAccessKey) {
+        throw new ChainRefusal("no-credentials", `profile ${name}: credential_process output is not Version 1 with AccessKeyId and SecretAccessKey`);
+    }
+    if (parsed.Expiration && !(Date.parse(parsed.Expiration) > ctx.now().getTime())) {
+        throw new ChainRefusal("no-credentials", `profile ${name}: credential_process returned credentials that expired at ${parsed.Expiration}`);
+    }
+    return {
+        credentials: {
+            accessKeyId: parsed.AccessKeyId,
+            secretAccessKey: parsed.SecretAccessKey,
+            ...(parsed.SessionToken ? { sessionToken: parsed.SessionToken } : {}),
+        },
+        source: `profile ${name} (credential_process)`,
+        ...withExpiry(expiryOf(parsed.Expiration)),
+    };
+}
+/* ── Credentials for the read transport (#3958) ─────────────────────────── */
+/** Cached credentials are re-resolved this long before they expire. */
+export const TRANSPORT_REFRESH_MARGIN_MS = 5 * 60000;
+/**
+ * How long "nothing resolves" is kept before the chain is walked again, so a
+ * long-running process picks up an `aws sso login` done after it started.
+ */
+export const TRANSPORT_UNRESOLVED_TTL_MS = 5 * 60000;
+/**
+ * One walk per environment and shared-file location, shared by every read in
+ * the process. Concurrent first reads await the same promise, so an SSO
+ * portal call or a `credential_process` runs once rather than once per read.
+ */
+const transportCache = new Map();
+/** Forget every cached walk. For tests, and for a process that changed its profile. */
+export function resetTransportCredentials() {
+    transportCache.clear();
+}
+async function walkForTransport(options, now) {
+    let result;
+    try {
+        result = await resolveCredentialChain(options);
+    }
+    catch {
+        result = undefined;
+    }
+    const t = now().getTime();
+    if (!result || "unresolved" in result)
+        return { refreshAt: t + TRANSPORT_UNRESOLVED_TTL_MS };
+    const expires = result.resolved.expiration?.getTime();
+    if (expires === undefined)
+        return { credentials: result.resolved.credentials, refreshAt: Infinity };
+    const early = expires - TRANSPORT_REFRESH_MARGIN_MS;
+    return { credentials: result.resolved.credentials, refreshAt: early > t ? early : expires };
+}
+/**
+ * What the native read transport signs with when the caller injected nothing:
+ * the same chain whoami walks, so `lifecycle diff --live` signs as the
+ * principal whoami reports. The signing seam (`AwsCredentialResolver` in
+ * ./sigv4.ts) is synchronous and the chain is not, so the transport awaits
+ * this once before a request and passes the literal credentials in.
+ *
+ * Environment keys answer directly, as in the chain. Otherwise the walk is
+ * cached per process, keyed by the profile and the shared-file locations, and
+ * walked again within {@link TRANSPORT_REFRESH_MARGIN_MS} of the expiry the
+ * role, SSO or `credential_process` answer carried. A refusal or a failure is
+ * `undefined`, which leaves the request unsigned exactly as before; it is kept
+ * for {@link TRANSPORT_UNRESOLVED_TTL_MS}.
+ */
+export async function transportCredentials(options = {}) {
+    const env = options.env ?? process.env;
+    const fromEnv = envCredentials(env);
+    if (fromEnv)
+        return fromEnv;
+    const now = options.now ?? (() => new Date());
+    const home = options.home ?? (env.HOME || env.USERPROFILE || homedir());
+    const key = JSON.stringify([env.AWS_PROFILE ?? "", env.AWS_CONFIG_FILE ?? "", env.AWS_SHARED_CREDENTIALS_FILE ?? "", home]);
+    const cached = transportCache.get(key);
+    if (cached) {
+        const entry = await cached;
+        if (now().getTime() < entry.refreshAt)
+            return entry.credentials;
+        if (transportCache.get(key) === cached)
+            transportCache.delete(key);
+    }
+    let pending = transportCache.get(key);
+    if (!pending) {
+        pending = walkForTransport({ ...options, env, home }, now);
+        transportCache.set(key, pending);
+    }
+    return (await pending).credentials;
+}

package/dist/api/read-client.d.ts

@@ -1,46 +1,3 @@
-/**
- * The native AWS read transport (#1206) — the read half of what
- * `op/activities/aws-apply.ts` already does for writes.
- *
- * Every AWS observer shelled `aws …` once per entity, serially, and parsed
- * stderr to find out what went wrong (#1085). The applier does not: `awsApply`
- * speaks the CloudFormation Query protocol over `fetch`, honours an endpoint
- * override, and is injectable for tests. This module is that same transport
- * pointed at the two APIs the read path needs:
- *
- *   - **CloudFormation Query** (form-encoded POST, XML back) — the stack reads
- *     `describeResources` and the deep pass both start from.
- *   - **Cloud Control** (AWS JSON 1.0, `X-Amz-Target: CloudApiService.*`) — the
- *     property-level reads (#1015).
- *
- * Both take the endpoint the same way the applier does, so `chant emulator` /
- * behold `--local` keep working by construction rather than by each observer
- * remembering to inject `--endpoint-url`.
- *
- * ## Signing
- *
- * Requests are signed with SigV4 (#1686) when credentials resolve — see
- * `./sigv4.ts`, which holds the implementation so that cedar's AVP client can
- * adopt the same one rather than growing a second. Two cases stay unsigned, and
- * both are deliberate:
- *
- *   - **No credentials.** The caller's existing no-credentials path is
- *     untouched: the request still goes out carrying only the credential scope
- *     of {@link regionScope}, which is what the emulator lanes have always
- *     sent.
- *   - **An endpoint override.** Floci does not verify signatures, and signing
- *     against it would mean every local lane suddenly needs credentials to read
- *     what it just deployed. `signEndpointOverride` opts back in for an
- *     override that *is* real AWS — a VPC endpoint, a signing proxy.
- *
- * What counts as an override is one rule, {@link resolveEndpointOverride}: the
- * `endpoint` option, else the ambient `AWS_ENDPOINT_URL_<SERVICE>` the AWS SDK
- * honours per service, else `AWS_ENDPOINT_URL` (#1694). Cedar's AVP client
- * (`lexicons/cedar/src/avp/client.ts`) applies the same rule; it restates it
- * rather than importing it, because cedar does not depend on this lexicon and
- * a lexicon build compiles against the published core, so a helper hoisted
- * into core would not be visible to either until the next core release.
- */
 import { type AwsCredentialSource } from "./sigv4.js";
 export type { AwsCredentials, AwsCredentialResolver, AwsCredentialSource } from "./sigv4.js";
 /** Injectable HTTP, mirroring `AwsHttp` in the applier so tests avoid the network. */
@@ -120,6 +77,22 @@ export declare function serviceUrl(service: string, endpoint?: string, region?:
  * override the environment named is skipped exactly like one the option did.
  */
 export declare function requestHeaders(service: string, url: string, body: string, base: Record<string, string>, options: AwsReadClientOptions): Record<string, string>;
+/**
+ * `options` with literal credentials from the AWS CLI's credential chain
+ * (#3958), when the caller injected none and the request will be signed.
+ *
+ * Every request function awaits this after {@link withEndpointOverride} and
+ * before {@link requestHeaders}, whose seam is synchronous. The chain is not
+ * walked against an endpoint override that is not signed: an emulator read
+ * should not start an SSO refresh or a `credential_process`, the same rule
+ * whoami follows. When nothing resolves the options come back unchanged and
+ * the request goes out unsigned, as it did before.
+ *
+ * An injected `env` without `HOME`, `USERPROFILE`, `AWS_CONFIG_FILE` or
+ * `AWS_SHARED_CREDENTIALS_FILE` names no shared files, so only its keys are
+ * read; the process's own `~/.aws` is not consulted behind it.
+ */
+export declare function withChainCredentials(options: AwsReadClientOptions): Promise<AwsReadClientOptions>;
 /**
  * The `<Tag>text</Tag>` pairs of one XML fragment, as a flat record. Repeated
  * tags keep the first occurrence, which is what a `<member>` body wants —

package/dist/api/read-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read-client.d.ts","sourceRoot":"","sources":["../../src/api/read-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,EAAmC,KAAK,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAEpF,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAM1F,sFAAsF;AACtF,MAAM,MAAM,WAAW,GAAG,CACxB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACvD,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAO/C,2EAA2E;AAC3E,qBAAa,YAAa,SAAQ,KAAK;IAGnC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,gGAAgG;IAChG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM;IAJxB,YACE,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM;IACvB,gGAAgG;IACvF,IAAI,CAAC,EAAE,MAAM,YAAA,EAIvB;CACF;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;OAIG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,kGAAkG;IAClG,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,iFAAiF;IACjF,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,uEAAuE;IACvE,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAWD,0FAA0F;AAC1F,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAG7D;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,GAAG,SAAS,CAEpB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,oBAAoB,CAGzG;AAED,kEAAkE;AAClE,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,SAAiB,GAAG,MAAM,CAE9F;AAqCD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,oBAAoB,GAC5B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAexB;AAID;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOlE;AAYD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAItF;AAED,0FAA0F;AAC1F,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAIrF;AAED;;;;GAIG;AACH,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wEAAwE;AACxE,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,aAAa,EAAE,CAAC,CAS1B;AAED,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,WAAW,CAAC,CAWtB;AAED,gEAAgE;AAChE,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAEjC;AAMD,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,cAAc,CAAC,CAuBnG;AAED,4EAA4E;AAC5E,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,EAC/F,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,sBAAsB,CAAC,CAkCjC;AAID,wDAAwD;AACxD,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAoDD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,uBAAuB,GAAG,IAAI,CAQrF;AAWD,8DAA8D;AAC9D,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAGzC;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,oBAAyB,EAClC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACtC,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAqBpC"}
+{"version":3,"file":"read-client.d.ts","sourceRoot":"","sources":["../../src/api/read-client.ts"],"names":[],"mappings":"AAgDA,OAAO,EAAmC,KAAK,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAEpF,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAM1F,sFAAsF;AACtF,MAAM,MAAM,WAAW,GAAG,CACxB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACvD,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAO/C,2EAA2E;AAC3E,qBAAa,YAAa,SAAQ,KAAK;IAGnC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,gGAAgG;IAChG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM;IAJxB,YACE,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM;IACvB,gGAAgG;IACvF,IAAI,CAAC,EAAE,MAAM,YAAA,EAIvB;CACF;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;OAIG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,kGAAkG;IAClG,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,iFAAiF;IACjF,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,uEAAuE;IACvE,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAWD,0FAA0F;AAC1F,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAG7D;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,GAAG,SAAS,CAEpB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,oBAAoB,CAGzG;AAED,kEAAkE;AAClE,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,SAAiB,GAAG,MAAM,CAE9F;AAqCD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,EAAE,oBAAoB,GAC5B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAexB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAcvG;AAID;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOlE;AAYD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAItF;AAED,0FAA0F;AAC1F,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAIrF;AAED;;;;GAIG;AACH,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,CA4BjB;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wEAAwE;AACxE,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,aAAa,EAAE,CAAC,CAS1B;AAED,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,WAAW,CAAC,CAWtB;AAED,gEAAgE;AAChE,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAEjC;AAMD,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,cAAc,CAAC,CAuBnG;AAED,4EAA4E;AAC5E,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,EAC/F,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,sBAAsB,CAAC,CAkCjC;AAID,wDAAwD;AACxD,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAoDD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,uBAAuB,GAAG,IAAI,CAQrF;AAWD,8DAA8D;AAC9D,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAGzC;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,oBAAyB,EAClC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACtC,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAqBpC"}