@intentius/chant-lexicon-aws 0.44.8 → 0.44.10

package/dist/api/read-client.d.ts

@@ -19,12 +19,22 @@
  *
  * ## Signing
  *
- * Requests are unsigned, exactly like `awsApply`'s. That is what makes the
- * emulator-first lanes work with no credential plumbing, and it is the reason
- * this is scoped to the Floci lanes (#1198) rather than announced as a
- * real-cloud read path: real AWS rejects an unsigned request. The CLI path
- * remains available for a signed read until SigV4 lands here.
+ * Requests are signed with SigV4 (#1686) when credentials resolve — see
+ * `./sigv4.ts`, which holds the implementation so that cedar's AVP client can
+ * adopt the same one rather than growing a second. Two cases stay unsigned, and
+ * both are deliberate:
+ *
+ *   - **No credentials.** The caller's existing no-credentials path is
+ *     untouched: the request still goes out carrying only the credential scope
+ *     of {@link regionScope}, which is what the emulator lanes have always
+ *     sent.
+ *   - **An endpoint override.** Floci does not verify signatures, and signing
+ *     against it would mean every local lane suddenly needs credentials to read
+ *     what it just deployed. `signEndpointOverride` opts back in for an
+ *     override that *is* real AWS — a VPC endpoint, a signing proxy.
  */
+import { type AwsCredentialSource } from "./sigv4.js";
+export type { AwsCredentials, AwsCredentialResolver, AwsCredentialSource } from "./sigv4.js";
 /** Injectable HTTP, mirroring `AwsHttp` in the applier so tests avoid the network. */
 export type AwsReadHttp = (url: string, init: {
     headers: Record<string, string>;
@@ -49,6 +59,18 @@ export interface AwsReadClientOptions {
     region?: string;
     http?: AwsReadHttp;
     signal?: AbortSignal;
+    /**
+     * What to sign with: literal credentials, or a resolver that decides. Omitted,
+     * the environment answers; when it has nothing, the request goes out unsigned
+     * exactly as it did before signing existed.
+     */
+    credentials?: AwsCredentialSource;
+    /** Environment the credential fallback reads. Defaults to `process.env`; injectable for tests. */
+    env?: Record<string, string | undefined>;
+    /** Sign even against an endpoint override — for an override that is real AWS. */
+    signEndpointOverride?: boolean;
+    /** Signing clock. Injected by tests so a signature is reproducible. */
+    now?: Date;
 }
 /** Service host for `service`, honouring an endpoint override. */
 export declare function serviceUrl(service: string, endpoint?: string, region?: string): string;

package/dist/api/read-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read-client.d.ts","sourceRoot":"","sources":["../../src/api/read-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAMH,sFAAsF;AACtF,MAAM,MAAM,WAAW,GAAG,CACxB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACvD,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAO/C,2EAA2E;AAC3E,qBAAa,YAAa,SAAQ,KAAK;IAGnC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,gGAAgG;IAChG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM;gBAHtB,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM;IACvB,gGAAgG;IACvF,IAAI,CAAC,EAAE,MAAM,YAAA;CAKzB;AAED,MAAM,WAAW,oBAAoB;IACnC,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,kEAAkE;AAClE,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,SAAiB,GAAG,MAAM,CAE9F;AAmCD;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOlE;AAYD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAItF;AAED,0FAA0F;AAC1F,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAIrF;AAED;;;;GAIG;AACH,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,CAwBjB;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wEAAwE;AACxE,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,aAAa,EAAE,CAAC,CAS1B;AAED,gEAAgE;AAChE,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAOjC;AAID,wDAAwD;AACxD,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AA6CD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,uBAAuB,GAAG,IAAI,CAQrF;AAWD,8DAA8D;AAC9D,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAGzC;AAED,kFAAkF;AAClF,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAiBpC"}
+{"version":3,"file":"read-client.d.ts","sourceRoot":"","sources":["../../src/api/read-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EAAmC,KAAK,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAEpF,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAM1F,sFAAsF;AACtF,MAAM,MAAM,WAAW,GAAG,CACxB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACvD,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAO/C,2EAA2E;AAC3E,qBAAa,YAAa,SAAQ,KAAK;IAGnC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,gGAAgG;IAChG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM;gBAHtB,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM;IACvB,gGAAgG;IACvF,IAAI,CAAC,EAAE,MAAM,YAAA;CAKzB;AAED,MAAM,WAAW,oBAAoB;IACnC,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;OAIG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,kGAAkG;IAClG,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,iFAAiF;IACjF,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,uEAAuE;IACvE,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,kEAAkE;AAClE,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,SAAiB,GAAG,MAAM,CAE9F;AAuED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOlE;AAYD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAItF;AAED,0FAA0F;AAC1F,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAIrF;AAED;;;;GAIG;AACH,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,CA2BjB;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wEAAwE;AACxE,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,aAAa,EAAE,CAAC,CAS1B;AAED,gEAAgE;AAChE,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAOjC;AAID,wDAAwD;AACxD,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAmDD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,uBAAuB,GAAG,IAAI,CAQrF;AAWD,8DAA8D;AAC9D,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAGzC;AAED,kFAAkF;AAClF,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAiBpC"}

package/dist/api/sigv4.d.ts

@@ -0,0 +1,82 @@
+/** SHA-256 of the empty string — the payload hash of every bodyless request. */
+export declare const EMPTY_PAYLOAD_SHA256 = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
+/** A resolved credential set. `sessionToken` is present for STS/role credentials. */
+export interface AwsCredentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+}
+/**
+ * The credential injection seam: a function the caller supplies to decide, by
+ * whatever means it likes, what to sign with. Returning `undefined` means "this
+ * process has no credentials" and is respected as an answer, not overridden.
+ */
+export type AwsCredentialResolver = () => AwsCredentials | undefined;
+/** Either literal credentials or a resolver for them. */
+export type AwsCredentialSource = AwsCredentials | AwsCredentialResolver;
+/**
+ * Credentials for a request: explicit → environment → absent.
+ *
+ * A resolver function is authoritative — if one is injected and it declines,
+ * the environment is not consulted behind its back, because the point of
+ * injecting one is to control the answer. Literal credentials are likewise
+ * final. Only the no-source case falls through to `AWS_ACCESS_KEY_ID` /
+ * `AWS_SECRET_ACCESS_KEY` (plus `AWS_SESSION_TOKEN` when set), and a half-set
+ * environment — a key id with no secret — is absent rather than a signature
+ * that cannot verify.
+ *
+ * Deliberately not implemented: the profile file, IMDS, and the container
+ * credential endpoints. Each is a separate transport with its own failure and
+ * caching story; a caller that has those can resolve them itself and pass the
+ * result in, which is what the resolver seam is for.
+ */
+export declare function resolveCredentials(source?: AwsCredentialSource, env?: Record<string, string | undefined>): AwsCredentials | undefined;
+/** One request to sign. `headers` are the caller's; the signer adds its own. */
+export interface SigV4Request {
+    method: string;
+    /** Absolute URL. Its host is signed and its path/query are canonicalized. */
+    url: string;
+    headers: Record<string, string>;
+    body: string;
+    /** Service name as it appears in the credential scope (`cloudformation`, `cloudcontrolapi`, …). */
+    service: string;
+    region: string;
+    credentials: AwsCredentials;
+    /** Signing clock. Injected by tests; otherwise now. */
+    now?: Date;
+}
+/** `YYYYMMDDTHHMMSSZ` — the `X-Amz-Date` format, which is ISO-8601 basic. */
+export declare function amzDate(date: Date): string;
+/** Lowercase hex SHA-256. */
+export declare function sha256Hex(payload: string): string;
+/**
+ * The signing key: four chained HMACs from the secret, so the key on the wire
+ * is scoped to one day, one region and one service rather than being the
+ * account secret itself.
+ */
+export declare function signingKey(secretAccessKey: string, day: string, region: string, service: string): Buffer;
+/**
+ * Header names lowercased, values trimmed with internal whitespace runs
+ * collapsed, sorted by name. Returns the canonical block and the `;`-joined
+ * signed-header list that has to agree with it exactly.
+ */
+export declare function canonicalHeaders(headers: Record<string, string>): {
+    canonical: string;
+    signed: string;
+};
+/** The canonical request, verbatim as it is hashed into the string to sign. */
+export declare function canonicalRequest(method: string, url: URL, headers: Record<string, string>, payloadHash: string): {
+    canonical: string;
+    signed: string;
+};
+/** The string to sign: algorithm, timestamp, scope, hashed canonical request. */
+export declare function stringToSign(timestamp: string, scope: string, canonical: string): string;
+/**
+ * The caller's headers plus everything SigV4 adds: `x-amz-date`,
+ * `x-amz-content-sha256`, `x-amz-security-token` when the credentials are
+ * temporary, and the `Authorization` header itself.
+ *
+ * `host` is signed (AWS requires it) but not returned — see the module header.
+ */
+export declare function signRequest(request: SigV4Request): Record<string, string>;
+//# sourceMappingURL=sigv4.d.ts.map

package/dist/api/sigv4.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigv4.d.ts","sourceRoot":"","sources":["../../src/api/sigv4.ts"],"names":[],"mappings":"AAkCA,gFAAgF;AAChF,eAAO,MAAM,oBAAoB,qEAAqE,CAAC;AASvG,qFAAqF;AACrF,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG,MAAM,cAAc,GAAG,SAAS,CAAC;AAErE,yDAAyD;AACzD,MAAM,MAAM,mBAAmB,GAAG,cAAc,GAAG,qBAAqB,CAAC;AAEzE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,CAAC,EAAE,mBAAmB,EAC5B,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,cAAc,GAAG,SAAS,CAW5B;AAED,gFAAgF;AAChF,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,mGAAmG;IACnG,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,cAAc,CAAC;IAC5B,uDAAuD;IACvD,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,6EAA6E;AAC7E,wBAAgB,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAE1C;AAED,6BAA6B;AAC7B,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEjD;AAMD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,eAAe,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAKxG;AAmCD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CASvG;AAED,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,WAAW,EAAE,MAAM,GAClB;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAavC;AAED,iFAAiF;AACjF,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAExF;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA0BzE"}

package/dist/identity-observe.d.ts

@@ -0,0 +1,23 @@
+import { type AwsReadClientOptions } from "./api/read-client.js";
+import type { ResourceMetadata } from "@intentius/chant/lexicon";
+/**
+ * The Cloud Control identifier the declared props spell, or undefined when the
+ * type has no primary identifier on record or any part of it is absent or
+ * non-scalar (a Ref, an intrinsic, a server-assigned name). Multi-part
+ * identifiers join with `|`, Cloud Control's own separator.
+ */
+export declare function declaredIdentifier(entityType: string, props: Record<string, unknown>): string | undefined;
+/**
+ * Identity-read every entity the stack did not answer for and whose props
+ * spell an identifier. `already` is the stack's answer — an entity the stack
+ * DID return is never re-read. The `queried` map records the address each
+ * attempted read was issued against (#1620), whatever the verdict.
+ */
+export declare function observeByIdentity(entityNames: string[], entities: Map<string, {
+    entityType: string;
+    props: Record<string, unknown>;
+}> | undefined, already: Record<string, ResourceMetadata>, client: AwsReadClientOptions): Promise<{
+    resources: Record<string, ResourceMetadata>;
+    queried: Record<string, string>;
+}>;
+//# sourceMappingURL=identity-observe.d.ts.map

package/dist/identity-observe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-observe.d.ts","sourceRoot":"","sources":["../src/identity-observe.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAe,KAAK,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAmBjE;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,SAAS,CAazG;AAWD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EAAE,EACrB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,GAAG,SAAS,EACzF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EACzC,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC,CA4B3F"}

package/dist/index.d.ts

@@ -14,7 +14,8 @@ export { output, isLexiconOutput } from "@intentius/chant/lexicon-output";
 export type { LexiconOutput } from "@intentius/chant/lexicon-output";
 export { awsPlugin } from "./plugin.js";
 export { observeResourcesDeepAws, awsDeepNormalizationHooks, hasOwnershipMarker, DEEP_READABLE_TYPES, AWS_READ_ONLY_NAMES, AWS_SERVICE_DEFAULTS, } from "./deep-observe.js";
-export { describeStackResources, describeStackOutputs, getResource, listResources, parseResourceDescription, AwsReadError, type AwsReadHttp, type AwsReadClientOptions, type CloudControlDescription, type StackResource, } from "./api/read-client.js";
+export { describeStackResources, describeStackOutputs, getResource, listResources, parseResourceDescription, AwsReadError, type AwsReadHttp, type AwsReadClientOptions, type CloudControlDescription, type StackResource, type AwsCredentials, type AwsCredentialResolver, type AwsCredentialSource, } from "./api/read-client.js";
+export { signRequest, resolveCredentials, EMPTY_PAYLOAD_SHA256, type SigV4Request, } from "./api/sigv4.js";
 export { Sub, Ref, GetAtt, If, Join, Select, Split, Base64, GetAZs, SubIntrinsic, RefIntrinsic, GetAttIntrinsic, IfIntrinsic, JoinIntrinsic, SelectIntrinsic, SplitIntrinsic, Base64Intrinsic, GetAZsIntrinsic, } from "./intrinsics.js";
 export { AWS, StackName, Region, AccountId, StackId, URLSuffix, NoValue, NotificationARNs, Partition, } from "./pseudo.js";
 export * from "./generated/index.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACjF,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACzG,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAG9D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACvI,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG9E,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtF,YAAY,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAChG,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAC1E,YAAY,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAGrE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAIrC,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAOxB,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,WAAW,EACX,aAAa,EACb,wBAAwB,EACxB,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,GAAG,EACH,GAAG,EACH,MAAM,EACN,EAAE,EACF,IAAI,EACJ,MAAM,EACN,KAAK,EACL,MAAM,EACN,MAAM,EACN,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,EACd,eAAe,EACf,eAAe,GAChB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,GAAG,EACH,SAAS,EACT,MAAM,EACN,SAAS,EACT,OAAO,EACP,SAAS,EACT,OAAO,EACP,gBAAgB,EAChB,SAAS,GACV,MAAM,UAAU,CAAC;AAIlB,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5E,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAG5J,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGrJ,OAAO,EACL,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAClE,SAAS,EACT,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EACjE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAC3E,kBAAkB,EAClB,eAAe,EAAE,UAAU,EAAE,UAAU,EACvC,kBAAkB,EAClB,UAAU,EAAE,cAAc,EAC1B,cAAc,EACd,gBAAgB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,GAC7E,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,mBAAmB,EAAE,cAAc,EAAE,oBAAoB,EACzD,cAAc,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,aAAa,EAAE,cAAc,EAC1F,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,gBAAgB,EACzG,uBAAuB,EACvB,oBAAoB,EAAE,eAAe,EAAE,eAAe,EACtD,uBAAuB,EACvB,eAAe,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,gBAAgB,EAClF,mBAAmB,EAAE,oBAAoB,EACzC,qBAAqB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,sBAAsB,GACjG,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAKvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAIrE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAChI,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,QAAQ,EACR,SAAS,EACT,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACjF,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AACzG,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAG9D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACvI,YAAY,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAG9E,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtF,YAAY,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAChG,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAC1E,YAAY,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAGrE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAIrC,OAAO,EACL,uBAAuB,EACvB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAOxB,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,WAAW,EACX,aAAa,EACb,wBAAwB,EACxB,YAAY,EACZ,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,GACzB,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,YAAY,GAClB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,GAAG,EACH,GAAG,EACH,MAAM,EACN,EAAE,EACF,IAAI,EACJ,MAAM,EACN,KAAK,EACL,MAAM,EACN,MAAM,EACN,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,EACd,eAAe,EACf,eAAe,GAChB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,GAAG,EACH,SAAS,EACT,MAAM,EACN,SAAS,EACT,OAAO,EACP,SAAS,EACT,OAAO,EACP,gBAAgB,EAChB,SAAS,GACV,MAAM,UAAU,CAAC;AAIlB,cAAc,mBAAmB,CAAC;AAGlC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5E,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,EAAE,kBAAkB,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAG5J,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAGrJ,OAAO,EACL,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAClE,SAAS,EACT,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EACjE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAC3E,kBAAkB,EAClB,eAAe,EAAE,UAAU,EAAE,UAAU,EACvC,kBAAkB,EAClB,UAAU,EAAE,cAAc,EAC1B,cAAc,EACd,gBAAgB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,GAC7E,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,mBAAmB,EAAE,cAAc,EAAE,oBAAoB,EACzD,cAAc,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,aAAa,EAAE,cAAc,EAC1F,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,gBAAgB,EACzG,uBAAuB,EACvB,oBAAoB,EAAE,eAAe,EAAE,eAAe,EACtD,uBAAuB,EACvB,eAAe,EAAE,gBAAgB,EAAE,6BAA6B,EAAE,gBAAgB,EAClF,mBAAmB,EAAE,oBAAoB,EACzC,qBAAqB,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,sBAAsB,GACjG,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAKvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAIrE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAChI,YAAY,EACV,mBAAmB,EACnB,sBAAsB,EACtB,QAAQ,EACR,SAAS,EACT,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,cAAc,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "73481436310597fa252541226cf4d8edfa395deb2df9218b7dd62452b79e830a",
+    "manifest.json": "ba1ea326a8ff78358dba97679b751f9abf5a923977cb6cc52e759e19cae16b2f",
     "meta.json": "2e4cae67cbc2eb2962c3dd0aa57008ae96fb725dd0118af7b04b2b44eab7722a",
     "types/index.d.ts": "6d6b37bd14a9b40fb3ff5c66e1cb49be1ae1032de47a4e167cf5f411c943b7f5",
     "rules/hardcoded-region.ts": "5a0eaf7ab391231fe6cd51426ece29539cb4b36f31c8dd060956638fed55722a",
@@ -62,5 +62,5 @@
     "skills/chant-aws-eks.md": "8789255709ff004ad0a875fd5999edcdc66fc6e33d710db058d9f42703bcfdfe",
     "skills/chant-aws-carve-terraform.md": "52dc7a8a10156d236266cc8dbf75614fabb6e2fa4caf31c13cca348e167a58b5"
   },
-  "composite": "f13bd5fcaa776bd6d798093538c2497aa1a6d44bff8f94e235b4610a0b22e925"
+  "composite": "491effd79e8556535ecfaf370d32b01a5aec7540a31a03d6c2b268ec6bf81664"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "aws",
-  "version": "0.44.8",
+  "version": "0.44.10",
   "chantVersion": ">=0.1.0",
   "namespace": "AWS",
   "intrinsics": [

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAgL,MAAM,0BAA0B,CAAC;AAqC5O;yEACyE;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAWnD,eAAO,MAAM,SAAS,EAAE,aA05BvB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAgL,MAAM,0BAA0B,CAAC;AAqC5O;yEACyE;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAWnD,eAAO,MAAM,SAAS,EAAE,aAw6BvB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-aws",
-  "version": "0.44.8",
+  "version": "0.44.10",
   "description": "AWS CloudFormation lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -80,7 +80,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.44.8",
+    "@intentius/chant": "^0.44.10",
     "typescript": "^5.9.3"
   }
 }

package/src/api/read-client.test.ts

@@ -19,6 +19,7 @@ import {
   xmlError,
   type AwsReadHttp,
 } from "./read-client";
+import { EMPTY_PAYLOAD_SHA256 } from "./sigv4";
 
 const respond = (text: string, status = 200): ReturnType<AwsReadHttp> => Promise.resolve({ status, text });
 
@@ -210,25 +211,107 @@ describe("the region an endpoint override cannot carry in its host", () => {
   // snapshot recorded that region as holding nothing.
   test("the request names the region in its credential scope", async () => {
     const { http, calls } = recording(() => respond(stackXml));
-    await describeStackResources("web", { endpoint: "http://localhost:4566", region: "us-west-1", http });
+    await describeStackResources("web", { endpoint: "http://localhost:4566", region: "us-west-1", http, env: {} });
     expect(calls[0].headers.authorization).toContain("/us-west-1/cloudformation/aws4_request");
   });
 
   test("Cloud Control carries it too, scoped to its own service", async () => {
     const { http, calls } = recording(() => respond(JSON.stringify({ ResourceDescription: {} })));
-    await getResource("AWS::EC2::VPC", "vpc-01", { endpoint: "http://localhost:4566", region: "eu-west-1", http });
+    await getResource("AWS::EC2::VPC", "vpc-01", { endpoint: "http://localhost:4566", region: "eu-west-1", http, env: {} });
     expect(calls[0].headers.authorization).toContain("/eu-west-1/cloudcontrolapi/aws4_request");
   });
 
   test("no region, no header — nothing invents one", async () => {
     const { http, calls } = recording(() => respond(stackXml));
-    await describeStackResources("web", { endpoint: "http://localhost:4566", http });
+    await describeStackResources("web", { endpoint: "http://localhost:4566", http, env: {} });
     expect(calls[0].headers.authorization).toBeUndefined();
   });
 
   test("it is a scope, not a signature — the placeholder says so", async () => {
     const { http, calls } = recording(() => respond(stackXml));
-    await describeStackResources("web", { region: "us-west-1", http });
+    await describeStackResources("web", { region: "us-west-1", http, env: {} });
     expect(calls[0].headers.authorization).toContain("Signature=unsigned");
   });
 });
+
+/**
+ * The signing decision, as the client makes it. `./sigv4.test.ts` proves the
+ * signature is correct against AWS's own vectors; these prove the client only
+ * produces one when it should.
+ */
+describe("SigV4 on the read path", () => {
+  const credentials = { accessKeyId: "AKIDEXAMPLE", secretAccessKey: "wJalrXUtnFEMI/K7MDENG+bPxRfiCYEXAMPLEKEY" };
+  const now = new Date("2015-08-30T12:36:00Z");
+
+  test("credentials and a real host produce a signed request, not the placeholder", async () => {
+    const { http, calls } = recording(() => respond(stackXml));
+    await describeStackResources("web", { region: "us-west-1", credentials, now, http, env: {} });
+
+    const auth = calls[0].headers.authorization;
+    expect(auth).toContain("Credential=AKIDEXAMPLE/20150830/us-west-1/cloudformation/aws4_request");
+    expect(auth).not.toContain("Signature=unsigned");
+    expect(auth).toMatch(/Signature=[0-9a-f]{64}$/);
+    expect(calls[0].headers["x-amz-date"]).toBe("20150830T123600Z");
+    // The body hash, not the empty-payload constant — the Query call has a body.
+    expect(calls[0].headers["x-amz-content-sha256"]).toMatch(/^[0-9a-f]{64}$/);
+    expect(calls[0].headers["x-amz-content-sha256"]).not.toBe(EMPTY_PAYLOAD_SHA256);
+    // `host` is signed but never emitted: fetch computes it and forbids the override.
+    expect(calls[0].headers.host).toBeUndefined();
+    expect(auth).toContain("SignedHeaders=content-type;host;x-amz-content-sha256;x-amz-date");
+  });
+
+  test("an endpoint override is not signed, so the emulator lanes need no credentials", async () => {
+    const { http, calls } = recording(() => respond(stackXml));
+    await describeStackResources("web", {
+      endpoint: "http://localhost:4566",
+      region: "us-west-1",
+      credentials,
+      http,
+      env: {},
+    });
+    expect(calls[0].headers.authorization).toContain("Signature=unsigned");
+    expect(calls[0].headers["x-amz-date"]).toBeUndefined();
+  });
+
+  test("signEndpointOverride signs one anyway — for an override that is real AWS", async () => {
+    const { http, calls } = recording(() => respond(stackXml));
+    await describeStackResources("web", {
+      endpoint: "https://vpce-1234.cloudformation.us-west-1.vpce.amazonaws.com",
+      region: "us-west-1",
+      credentials,
+      signEndpointOverride: true,
+      now,
+      http,
+      env: {},
+    });
+    expect(calls[0].headers.authorization).toMatch(/Signature=[0-9a-f]{64}$/);
+  });
+
+  test("no credentials leaves the old unsigned path exactly as it was", async () => {
+    const { http, calls } = recording(() => respond(stackXml));
+    await describeStackResources("web", { region: "us-west-1", http, env: {} });
+    expect(calls[0].headers.authorization).toContain("Signature=unsigned");
+    expect(calls[0].headers["x-amz-date"]).toBeUndefined();
+    expect(calls[0].headers["x-amz-content-sha256"]).toBeUndefined();
+  });
+
+  test("the environment is the fallback source, and Cloud Control signs from it too", async () => {
+    const { http, calls } = recording(() => respond(JSON.stringify({ ResourceDescription: {} })));
+    await getResource("AWS::EC2::VPC", "vpc-01", {
+      region: "eu-west-1",
+      now,
+      http,
+      env: { AWS_ACCESS_KEY_ID: "AKIDENV", AWS_SECRET_ACCESS_KEY: "s", AWS_SESSION_TOKEN: "tok" },
+    });
+    expect(calls[0].headers.authorization).toContain("Credential=AKIDENV/20150830/eu-west-1/cloudcontrolapi/");
+    expect(calls[0].headers["x-amz-security-token"]).toBe("tok");
+    expect(calls[0].headers["x-amz-target"]).toBe("CloudApiService.GetResource");
+  });
+
+  test("signing without a named region falls back to the same default the host does", async () => {
+    const { http, calls } = recording(() => respond(stackXml));
+    await describeStackResources("web", { credentials, now, http, env: {} });
+    expect(calls[0].url).toBe("https://cloudformation.us-east-1.amazonaws.com/");
+    expect(calls[0].headers.authorization).toContain("/20150830/us-east-1/cloudformation/aws4_request");
+  });
+});

package/src/api/read-client.ts

@@ -19,12 +19,23 @@
  *
  * ## Signing
  *
- * Requests are unsigned, exactly like `awsApply`'s. That is what makes the
- * emulator-first lanes work with no credential plumbing, and it is the reason
- * this is scoped to the Floci lanes (#1198) rather than announced as a
- * real-cloud read path: real AWS rejects an unsigned request. The CLI path
- * remains available for a signed read until SigV4 lands here.
+ * Requests are signed with SigV4 (#1686) when credentials resolve — see
+ * `./sigv4.ts`, which holds the implementation so that cedar's AVP client can
+ * adopt the same one rather than growing a second. Two cases stay unsigned, and
+ * both are deliberate:
+ *
+ *   - **No credentials.** The caller's existing no-credentials path is
+ *     untouched: the request still goes out carrying only the credential scope
+ *     of {@link regionScope}, which is what the emulator lanes have always
+ *     sent.
+ *   - **An endpoint override.** Floci does not verify signatures, and signing
+ *     against it would mean every local lane suddenly needs credentials to read
+ *     what it just deployed. `signEndpointOverride` opts back in for an
+ *     override that *is* real AWS — a VPC endpoint, a signing proxy.
  */
+import { resolveCredentials, signRequest, type AwsCredentialSource } from "./sigv4";
+
+export type { AwsCredentials, AwsCredentialResolver, AwsCredentialSource } from "./sigv4";
 
 const DEFAULT_REGION = "us-east-1";
 const CFN_API_VERSION = "2010-05-15";
@@ -62,6 +73,18 @@ export interface AwsReadClientOptions {
   region?: string;
   http?: AwsReadHttp;
   signal?: AbortSignal;
+  /**
+   * What to sign with: literal credentials, or a resolver that decides. Omitted,
+   * the environment answers; when it has nothing, the request goes out unsigned
+   * exactly as it did before signing existed.
+   */
+  credentials?: AwsCredentialSource;
+  /** Environment the credential fallback reads. Defaults to `process.env`; injectable for tests. */
+  env?: Record<string, string | undefined>;
+  /** Sign even against an endpoint override — for an override that is real AWS. */
+  signEndpointOverride?: boolean;
+  /** Signing clock. Injected by tests so a signature is reproducible. */
+  now?: Date;
 }
 
 /** Service host for `service`, honouring an endpoint override. */
@@ -84,15 +107,19 @@ export function serviceUrl(service: string, endpoint?: string, region = DEFAULT_
  * an empty observation and the snapshot recorded the region as holding nothing.
  * A three-region estate snapshotted as one region and nothing said so.
  *
- * This is NOT SigV4. The signature is a placeholder and real AWS rejects it —
- * as it already rejects every request from this module, which is unsigned by
- * design (see the header comment). It carries the scope, nothing more, and it
- * must not be mistaken for the signed read path that would replace it.
+ * This is NOT SigV4. The signature is a placeholder and real AWS rejects it. It
+ * is what an unsigned request still has to carry so an emulator learns the
+ * region, and it is only ever sent when no credentials resolved — the moment
+ * they do, {@link requestHeaders} sends a real signature instead.
  */
-function regionScope(service: string, region?: string): Record<string, string> {
+function regionScope(
+  service: string,
+  region: string | undefined,
+  env: Record<string, string | undefined>,
+): Record<string, string> {
   if (!region) return {};
   const day = new Date().toISOString().slice(0, 10).replace(/-/g, "");
-  const key = process.env.AWS_ACCESS_KEY_ID || "chant";
+  const key = env.AWS_ACCESS_KEY_ID || "chant";
   return {
     authorization:
       `AWS4-HMAC-SHA256 Credential=${key}/${day}/${region}/${service}/aws4_request, ` +
@@ -100,6 +127,38 @@ function regionScope(service: string, region?: string): Record<string, string> {
   };
 }
 
+/**
+ * The headers one request goes out with — signed when there is something to
+ * sign with and the target is real AWS, scope-only otherwise.
+ *
+ * Signing needs a region even when the caller named none, because the scope
+ * string has a slot for one; it borrows the same `us-east-1` default that
+ * {@link serviceUrl} already used to build the host, so the signature agrees
+ * with the endpoint it is sent to.
+ */
+function requestHeaders(
+  service: string,
+  url: string,
+  body: string,
+  base: Record<string, string>,
+  options: AwsReadClientOptions,
+): Record<string, string> {
+  const env = options.env ?? process.env;
+  const credentials = resolveCredentials(options.credentials, env);
+  const signable = credentials && (!options.endpoint || options.signEndpointOverride === true);
+  if (!signable) return { ...base, ...regionScope(service, options.region, env) };
+  return signRequest({
+    method: "POST",
+    url,
+    headers: base,
+    body,
+    service,
+    region: options.region ?? DEFAULT_REGION,
+    credentials,
+    ...(options.now ? { now: options.now } : {}),
+  });
+}
+
 /* ── CloudFormation Query ─────────────────────────────────────────────────── */
 
 /**
@@ -162,10 +221,13 @@ export async function cfnQuery(
   const res = await http(
     url,
     {
-      headers: {
-        "content-type": "application/x-www-form-urlencoded",
-        ...regionScope("cloudformation", options.region),
-      },
+      headers: requestHeaders(
+        "cloudformation",
+        url,
+        body,
+        { "content-type": "application/x-www-form-urlencoded" },
+        options,
+      ),
       body,
     },
     options.signal,
@@ -238,15 +300,21 @@ async function cloudControl(
 ): Promise<Record<string, unknown>> {
   const http = options.http ?? defaultHttp;
   const url = serviceUrl("cloudcontrolapi", options.endpoint, options.region);
+  const payloadJson = JSON.stringify(payload);
   const res = await http(
     url,
     {
-      headers: {
-        "content-type": "application/x-amz-json-1.0",
-        "x-amz-target": `${CLOUD_CONTROL_TARGET_PREFIX}.${operation}`,
-        ...regionScope("cloudcontrolapi", options.region),
-      },
-      body: JSON.stringify(payload),
+      headers: requestHeaders(
+        "cloudcontrolapi",
+        url,
+        payloadJson,
+        {
+          "content-type": "application/x-amz-json-1.0",
+          "x-amz-target": `${CLOUD_CONTROL_TARGET_PREFIX}.${operation}`,
+        },
+        options,
+      ),
+      body: payloadJson,
     },
     options.signal,
   );