blogwright-core 0.1.0

package/dist/aws/cloudfront.js

@@ -0,0 +1,341 @@
+import { AwsError } from './errors.js';
+import { encodeEntities, textTag } from './xml.js';
+const API = '/2020-05-31';
+const XMLNS = 'http://cloudfront.amazonaws.com/doc/2020-05-31/';
+/** AWS managed "CachingOptimized" cache policy. */
+export const CACHING_OPTIMIZED = '658327ea-f89d-4fab-a63d-7e88639e58f6';
+/** AWS managed "CachingDisabled" cache policy (used for previews — no CDN caching). */
+export const CACHING_DISABLED = '4135ea2d-6df8-44a3-9df3-4b5a84be39ad';
+/** CloudFront client (REST-XML). Global service, signed in us-east-1. */
+export class CloudFrontClient {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    async createOriginAccessControl(name) {
+        const body = `<?xml version="1.0" encoding="UTF-8"?>` +
+            `<OriginAccessControlConfig xmlns="${XMLNS}">` +
+            `<Name>${encodeEntities(name)}</Name>` +
+            `<Description>OAC for ${encodeEntities(name)}</Description>` +
+            `<SigningProtocol>sigv4</SigningProtocol>` +
+            `<SigningBehavior>always</SigningBehavior>` +
+            `<OriginAccessControlOriginType>s3</OriginAccessControlOriginType>` +
+            `</OriginAccessControlConfig>`;
+        const res = await this.client.send({
+            service: 'cloudfront',
+            method: 'POST',
+            path: `${API}/origin-access-control`,
+            headers: { 'content-type': 'application/xml' },
+            body,
+        });
+        const id = textTag(res.text(), 'Id');
+        if (!id)
+            throw new Error('CreateOriginAccessControl returned no Id');
+        return id;
+    }
+    async deleteOriginAccessControl(id) {
+        try {
+            const get = await this.client.send({
+                service: 'cloudfront',
+                method: 'GET',
+                path: `${API}/origin-access-control/${id}`,
+            });
+            const etag = get.headers['etag'];
+            await this.client.send({
+                service: 'cloudfront',
+                method: 'DELETE',
+                path: `${API}/origin-access-control/${id}`,
+                ...(etag ? { headers: { 'if-match': etag } } : {}),
+            });
+        }
+        catch (err) {
+            if (err instanceof AwsError && err.isNotFound)
+                return;
+            throw err;
+        }
+    }
+    async createDistribution(input) {
+        const body = buildDistributionConfig(input);
+        const res = await this.client.send({
+            service: 'cloudfront',
+            method: 'POST',
+            path: `${API}/distribution`,
+            headers: { 'content-type': 'application/xml' },
+            body,
+        });
+        return parseDistribution(res.text(), res.headers['etag']);
+    }
+    async getDistribution(id) {
+        try {
+            const res = await this.client.send({
+                service: 'cloudfront',
+                method: 'GET',
+                path: `${API}/distribution/${id}`,
+            });
+            return parseDistribution(res.text(), res.headers['etag']);
+        }
+        catch (err) {
+            if (err instanceof AwsError && err.isNotFound)
+                return undefined;
+            throw err;
+        }
+    }
+    /** Fetch the raw DistributionConfig XML plus its ETag (needed to update/disable). */
+    async getDistributionConfig(id) {
+        try {
+            const res = await this.client.send({
+                service: 'cloudfront',
+                method: 'GET',
+                path: `${API}/distribution/${id}/config`,
+            });
+            return { config: res.text(), etag: res.headers['etag'] ?? '' };
+        }
+        catch (err) {
+            if (err instanceof AwsError && err.isNotFound)
+                return undefined;
+            throw err;
+        }
+    }
+    /**
+     * Reconcile the distribution's aliases and viewer certificate in place — the
+     * path taken when a domain is added (or changed) after the distribution was
+     * first created. Compares semantically (CNAME set + certificate ARN), since
+     * the returned config carries legacy elements our builder never emits.
+     * Returns true when a change was pushed.
+     */
+    async setDistributionAliases(id, aliases, acmCertificateArn) {
+        const current = await this.getDistributionConfig(id);
+        if (!current)
+            throw new Error(`distribution ${id} not found while reconciling aliases`);
+        const currentAliases = [...current.config.matchAll(/<CNAME>(.*?)<\/CNAME>/g)]
+            .map((m) => m[1] ?? '')
+            .sort();
+        const currentCert = textTag(current.config, 'ACMCertificateArn');
+        const sameAliases = currentAliases.length === aliases.length &&
+            [...aliases].sort().every((a, i) => a === currentAliases[i]);
+        if (sameAliases && currentCert === acmCertificateArn)
+            return false;
+        const next = current.config
+            .replace(/<Aliases>.*?<\/Aliases>/s, aliasesBlock(aliases))
+            .replace(/<ViewerCertificate>.*?<\/ViewerCertificate>/s, viewerCertificateBlock(acmCertificateArn));
+        await this.client.send({
+            service: 'cloudfront',
+            method: 'PUT',
+            path: `${API}/distribution/${id}/config`,
+            headers: { 'content-type': 'application/xml', 'if-match': current.etag },
+            body: next,
+        });
+        return true;
+    }
+    /**
+     * Disable a distribution by flipping its top-level `<Enabled>` to false. The config
+     * also contains `<Enabled>false</Enabled>` inside TrustedSigners/Logging, so the
+     * distribution-level flag must be matched specifically — it is the one immediately
+     * followed by `<ViewerCertificate>` in the schema.
+     */
+    async disableDistribution(id) {
+        const current = await this.getDistributionConfig(id);
+        if (!current)
+            return;
+        if (/<Enabled>false<\/Enabled><ViewerCertificate>/.test(current.config))
+            return; // already disabled
+        const disabled = current.config.replace(/<Enabled>true<\/Enabled><ViewerCertificate>/, '<Enabled>false</Enabled><ViewerCertificate>');
+        await this.client.send({
+            service: 'cloudfront',
+            method: 'PUT',
+            path: `${API}/distribution/${id}/config`,
+            headers: { 'content-type': 'application/xml', 'if-match': current.etag },
+            body: disabled,
+        });
+    }
+    async deleteDistribution(id) {
+        try {
+            const res = await this.client.send({
+                service: 'cloudfront',
+                method: 'GET',
+                path: `${API}/distribution/${id}`,
+            });
+            const etag = res.headers['etag'];
+            await this.client.send({
+                service: 'cloudfront',
+                method: 'DELETE',
+                path: `${API}/distribution/${id}`,
+                ...(etag ? { headers: { 'if-match': etag } } : {}),
+            });
+        }
+        catch (err) {
+            if (err instanceof AwsError && err.isNotFound)
+                return;
+            throw err;
+        }
+    }
+    /** Invalidate paths (defaults to everything). Returns the invalidation id. */
+    async createInvalidation(id, paths, reference) {
+        const items = paths.map((p) => `<Path>${encodeEntities(p)}</Path>`).join('');
+        const body = `<?xml version="1.0" encoding="UTF-8"?>` +
+            `<InvalidationBatch xmlns="${XMLNS}">` +
+            `<Paths><Quantity>${paths.length}</Quantity><Items>${items}</Items></Paths>` +
+            `<CallerReference>${encodeEntities(reference)}</CallerReference>` +
+            `</InvalidationBatch>`;
+        const res = await this.client.send({
+            service: 'cloudfront',
+            method: 'POST',
+            path: `${API}/distribution/${id}/invalidation`,
+            headers: { 'content-type': 'application/xml' },
+            body,
+        });
+        return textTag(res.text(), 'Id') ?? '';
+    }
+    // --- CloudFront Functions (viewer-request routing for previews) ---
+    functionBody(root, name, code, comment) {
+        const b64 = Buffer.from(code, 'utf8').toString('base64');
+        return (`<?xml version="1.0" encoding="UTF-8"?>` +
+            `<${root} xmlns="${XMLNS}">` +
+            `<FunctionCode>${b64}</FunctionCode>` +
+            `<FunctionConfig><Comment>${encodeEntities(comment)}</Comment><Runtime>cloudfront-js-2.0</Runtime></FunctionConfig>` +
+            `<Name>${encodeEntities(name)}</Name>` +
+            `</${root}>`);
+    }
+    async describeFunction(name) {
+        // DescribeFunction is GET …/function/{name}/describe (XML summary). The
+        // bare GET …/function/{name} is GetFunction, whose body is the raw code
+        // bytes — no FunctionARN to parse.
+        try {
+            const res = await this.client.send({
+                service: 'cloudfront',
+                method: 'GET',
+                path: `${API}/function/${name}/describe`,
+            });
+            return { arn: textTag(res.text(), 'FunctionARN') ?? '', etag: res.headers['etag'] ?? '' };
+        }
+        catch (err) {
+            if (err instanceof AwsError && err.isNotFound)
+                return undefined;
+            throw err;
+        }
+    }
+    /** Create-or-update the function code and publish it. Returns the published ARN. */
+    async ensureFunction(name, code, comment) {
+        const existing = await this.describeFunction(name);
+        if (existing) {
+            await this.client.send({
+                service: 'cloudfront',
+                method: 'PUT',
+                path: `${API}/function/${name}`,
+                headers: { 'content-type': 'application/xml', 'if-match': existing.etag },
+                body: this.functionBody('UpdateFunctionRequest', name, code, comment),
+            });
+        }
+        else {
+            await this.client.send({
+                service: 'cloudfront',
+                method: 'POST',
+                path: `${API}/function`,
+                headers: { 'content-type': 'application/xml' },
+                body: this.functionBody('CreateFunctionRequest', name, code, comment),
+            });
+        }
+        // Re-read the current ETag before publishing. Create/update return a fresh ETag, but
+        // it isn't reliably surfaced from the response headers — publishing the DEVELOPMENT
+        // stage with a stale ETag fails the precondition (HTTP 412), which is what broke
+        // reconciling an already-existing function.
+        const current = await this.describeFunction(name);
+        const pub = await this.client.send({
+            service: 'cloudfront',
+            method: 'POST',
+            path: `${API}/function/${name}/publish`,
+            headers: { 'if-match': current?.etag ?? '' },
+        });
+        return textTag(pub.text(), 'FunctionARN') ?? current?.arn ?? existing?.arn ?? '';
+    }
+    async deleteFunction(name) {
+        const existing = await this.describeFunction(name);
+        if (!existing)
+            return;
+        await this.client.send({
+            service: 'cloudfront',
+            method: 'DELETE',
+            path: `${API}/function/${name}`,
+            headers: { 'if-match': existing.etag },
+        });
+    }
+}
+/** Build the <CustomErrorResponses> block, ordered by error code for a stable payload. */
+function buildCustomErrorResponses(responses) {
+    if (!responses || responses.length === 0) {
+        return `<CustomErrorResponses><Quantity>0</Quantity></CustomErrorResponses>`;
+    }
+    const items = [...responses]
+        .sort((a, b) => a.errorCode - b.errorCode)
+        .map((r) => `<CustomErrorResponse>` +
+        `<ErrorCode>${r.errorCode}</ErrorCode>` +
+        `<ResponsePagePath>${encodeEntities(r.responsePagePath)}</ResponsePagePath>` +
+        `<ResponseCode>${r.responseCode}</ResponseCode>` +
+        `<ErrorCachingMinTTL>${r.errorCachingMinTtl ?? 10}</ErrorCachingMinTTL>` +
+        `</CustomErrorResponse>`)
+        .join('');
+    return `<CustomErrorResponses><Quantity>${responses.length}</Quantity><Items>${items}</Items></CustomErrorResponses>`;
+}
+function parseDistribution(xml, etag) {
+    return {
+        id: textTag(xml, 'Id') ?? '',
+        arn: textTag(xml, 'ARN') ?? '',
+        domainName: textTag(xml, 'DomainName') ?? '',
+        status: textTag(xml, 'Status') ?? 'InProgress',
+        etag,
+    };
+}
+function aliasesBlock(aliases) {
+    return aliases.length > 0
+        ? `<Aliases><Quantity>${aliases.length}</Quantity><Items>${aliases
+            .map((a) => `<CNAME>${encodeEntities(a)}</CNAME>`)
+            .join('')}</Items></Aliases>`
+        : `<Aliases><Quantity>0</Quantity></Aliases>`;
+}
+function viewerCertificateBlock(acmCertificateArn) {
+    return acmCertificateArn
+        ? `<ViewerCertificate><ACMCertificateArn>${encodeEntities(acmCertificateArn)}</ACMCertificateArn><SSLSupportMethod>sni-only</SSLSupportMethod><MinimumProtocolVersion>TLSv1.2_2021</MinimumProtocolVersion></ViewerCertificate>`
+        : `<ViewerCertificate><CloudFrontDefaultCertificate>true</CloudFrontDefaultCertificate></ViewerCertificate>`;
+}
+/** Build a DistributionConfig document. Element order follows the CloudFront schema. */
+function buildDistributionConfig(input) {
+    const aliases = aliasesBlock(input.aliases);
+    const viewerCertificate = viewerCertificateBlock(input.acmCertificateArn);
+    return (`<?xml version="1.0" encoding="UTF-8"?>` +
+        `<DistributionConfig xmlns="${XMLNS}">` +
+        `<CallerReference>${encodeEntities(input.callerReference)}</CallerReference>` +
+        aliases +
+        `<DefaultRootObject>${encodeEntities(input.defaultRootObject)}</DefaultRootObject>` +
+        `<Origins><Quantity>1</Quantity><Items><Origin>` +
+        `<Id>s3-site</Id>` +
+        `<DomainName>${encodeEntities(input.bucketDomainName)}</DomainName>` +
+        `<OriginPath>${encodeEntities(input.originPath)}</OriginPath>` +
+        `<CustomHeaders><Quantity>0</Quantity></CustomHeaders>` +
+        `<S3OriginConfig><OriginAccessIdentity></OriginAccessIdentity></S3OriginConfig>` +
+        `<OriginAccessControlId>${encodeEntities(input.originAccessControlId)}</OriginAccessControlId>` +
+        `<ConnectionAttempts>3</ConnectionAttempts><ConnectionTimeout>10</ConnectionTimeout>` +
+        `</Origin></Items></Origins>` +
+        `<DefaultCacheBehavior>` +
+        `<TargetOriginId>s3-site</TargetOriginId>` +
+        `<TrustedSigners><Enabled>false</Enabled><Quantity>0</Quantity></TrustedSigners>` +
+        `<ViewerProtocolPolicy>redirect-to-https</ViewerProtocolPolicy>` +
+        `<Compress>true</Compress>` +
+        (input.functionArn
+            ? `<FunctionAssociations><Quantity>1</Quantity><Items><FunctionAssociation><EventType>viewer-request</EventType><FunctionARN>${encodeEntities(input.functionArn)}</FunctionARN></FunctionAssociation></Items></FunctionAssociations>`
+            : `<FunctionAssociations><Quantity>0</Quantity></FunctionAssociations>`) +
+        `<CachePolicyId>${input.cachePolicyId ?? CACHING_OPTIMIZED}</CachePolicyId>` +
+        `</DefaultCacheBehavior>` +
+        `<CacheBehaviors><Quantity>0</Quantity></CacheBehaviors>` +
+        buildCustomErrorResponses(input.customErrorResponses) +
+        `<Comment>${encodeEntities(input.comment)}</Comment>` +
+        `<Logging><Enabled>false</Enabled><IncludeCookies>false</IncludeCookies><Bucket></Bucket><Prefix></Prefix></Logging>` +
+        `<PriceClass>PriceClass_100</PriceClass>` +
+        `<Enabled>true</Enabled>` +
+        viewerCertificate +
+        `<Restrictions><GeoRestriction><RestrictionType>none</RestrictionType><Quantity>0</Quantity></GeoRestriction></Restrictions>` +
+        `<WebACLId></WebACLId>` +
+        `<HttpVersion>http2and3</HttpVersion>` +
+        `<IsIPV6Enabled>true</IsIPV6Enabled>` +
+        `</DistributionConfig>`);
+}
+//# sourceMappingURL=cloudfront.js.map

package/dist/aws/cloudfront.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudfront.js","sourceRoot":"","sources":["../../src/aws/cloudfront.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAEnD,MAAM,GAAG,GAAG,aAAa,CAAC;AAC1B,MAAM,KAAK,GAAG,iDAAiD,CAAC;AAChE,mDAAmD;AACnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,sCAAsC,CAAC;AACxE,uFAAuF;AACvF,MAAM,CAAC,MAAM,gBAAgB,GAAG,sCAAsC,CAAC;AAmCvE,yEAAyE;AACzE,MAAM,OAAO,gBAAgB;IACE;IAA7B,YAA6B,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;IAAG,CAAC;IAEtD,KAAK,CAAC,yBAAyB,CAAC,IAAY;QAC1C,MAAM,IAAI,GACR,wCAAwC;YACxC,qCAAqC,KAAK,IAAI;YAC9C,SAAS,cAAc,CAAC,IAAI,CAAC,SAAS;YACtC,wBAAwB,cAAc,CAAC,IAAI,CAAC,gBAAgB;YAC5D,0CAA0C;YAC1C,2CAA2C;YAC3C,mEAAmE;YACnE,8BAA8B,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACjC,OAAO,EAAE,YAAY;YACrB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG,GAAG,wBAAwB;YACpC,OAAO,EAAE,EAAE,cAAc,EAAE,iBAAiB,EAAE;YAC9C,IAAI;SACL,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QACrE,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,yBAAyB,CAAC,EAAU;QACxC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACjC,OAAO,EAAE,YAAY;gBACrB,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,GAAG,GAAG,0BAA0B,EAAE,EAAE;aAC3C,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACrB,OAAO,EAAE,YAAY;gBACrB,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,GAAG,GAAG,0BAA0B,EAAE,EAAE;gBAC1C,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,UAAU;gBAAE,OAAO;YACtD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,KAA8B;QACrD,MAAM,IAAI,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACjC,OAAO,EAAE,YAAY;YACrB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG,GAAG,eAAe;YAC3B,OAAO,EAAE,EAAE,cAAc,EAAE,iBAAiB,EAAE;YAC9C,IAAI;SACL,CAAC,CAAC;QACH,OAAO,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,EAAU;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACjC,OAAO,EAAE,YAAY;gBACrB,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,GAAG,GAAG,iBAAiB,EAAE,EAAE;aAClC,CAAC,CAAC;YACH,OAAO,iBAAiB,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,UAAU;gBAAE,OAAO,SAAS,CAAC;YAChE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,qBAAqB,CAAC,EAAU;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACjC,OAAO,EAAE,YAAY;gBACrB,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,GAAG,GAAG,iBAAiB,EAAE,SAAS;aACzC,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACjE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,UAAU;gBAAE,OAAO,SAAS,CAAC;YAChE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,sBAAsB,CAC1B,EAAU,EACV,OAAiB,EACjB,iBAAqC;QAErC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,EAAE,sCAAsC,CAAC,CAAC;QACxF,MAAM,cAAc,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC;aAC1E,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACtB,IAAI,EAAE,CAAC;QACV,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;QACjE,MAAM,WAAW,GACf,cAAc,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;YACxC,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,IAAI,WAAW,IAAI,WAAW,KAAK,iBAAiB;YAAE,OAAO,KAAK,CAAC;QACnE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM;aACxB,OAAO,CAAC,0BAA0B,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;aAC1D,OAAO,CAAC,8CAA8C,EAAE,sBAAsB,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACtG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACrB,OAAO,EAAE,YAAY;YACrB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,GAAG,iBAAiB,EAAE,SAAS;YACxC,OAAO,EAAE,EAAE,cAAc,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE;YACxE,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,mBAAmB,CAAC,EAAU;QAClC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,8CAA8C,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,mBAAmB;QACpG,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CACrC,6CAA6C,EAC7C,6CAA6C,CAC9C,CAAC;QACF,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACrB,OAAO,EAAE,YAAY;YACrB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,GAAG,iBAAiB,EAAE,SAAS;YACxC,OAAO,EAAE,EAAE,cAAc,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE;YACxE,IAAI,EAAE,QAAQ;SACf,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,EAAU;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACjC,OAAO,EAAE,YAAY;gBACrB,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,GAAG,GAAG,iBAAiB,EAAE,EAAE;aAClC,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACjC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACrB,OAAO,EAAE,YAAY;gBACrB,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,GAAG,GAAG,iBAAiB,EAAE,EAAE;gBACjC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,UAAU;gBAAE,OAAO;YACtD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,kBAAkB,CAAC,EAAU,EAAE,KAAe,EAAE,SAAiB;QACrE,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7E,MAAM,IAAI,GACR,wCAAwC;YACxC,6BAA6B,KAAK,IAAI;YACtC,oBAAoB,KAAK,CAAC,MAAM,qBAAqB,KAAK,kBAAkB;YAC5E,oBAAoB,cAAc,CAAC,SAAS,CAAC,oBAAoB;YACjE,sBAAsB,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACjC,OAAO,EAAE,YAAY;YACrB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG,GAAG,iBAAiB,EAAE,eAAe;YAC9C,OAAO,EAAE,EAAE,cAAc,EAAE,iBAAiB,EAAE;YAC9C,IAAI;SACL,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IAED,qEAAqE;IAE7D,YAAY,CAAC,IAAY,EAAE,IAAY,EAAE,IAAY,EAAE,OAAe;QAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzD,OAAO,CACL,wCAAwC;YACxC,IAAI,IAAI,WAAW,KAAK,IAAI;YAC5B,iBAAiB,GAAG,iBAAiB;YACrC,4BAA4B,cAAc,CAAC,OAAO,CAAC,iEAAiE;YACpH,SAAS,cAAc,CAAC,IAAI,CAAC,SAAS;YACtC,KAAK,IAAI,GAAG,CACb,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACzC,wEAAwE;QACxE,wEAAwE;QACxE,mCAAmC;QACnC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACjC,OAAO,EAAE,YAAY;gBACrB,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,GAAG,GAAG,aAAa,IAAI,WAAW;aACzC,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,aAAa,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,UAAU;gBAAE,OAAO,SAAS,CAAC;YAChE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,cAAc,CAAC,IAAY,EAAE,IAAY,EAAE,OAAe;QAC9D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACrB,OAAO,EAAE,YAAY;gBACrB,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,GAAG,GAAG,aAAa,IAAI,EAAE;gBAC/B,OAAO,EAAE,EAAE,cAAc,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE;gBACzE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,uBAAuB,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC;aACtE,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACrB,OAAO,EAAE,YAAY;gBACrB,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,GAAG,GAAG,WAAW;gBACvB,OAAO,EAAE,EAAE,cAAc,EAAE,iBAAiB,EAAE;gBAC9C,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,uBAAuB,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC;aACtE,CAAC,CAAC;QACL,CAAC;QACD,qFAAqF;QACrF,oFAAoF;QACpF,iFAAiF;QACjF,4CAA4C;QAC5C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACjC,OAAO,EAAE,YAAY;YACrB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG,GAAG,aAAa,IAAI,UAAU;YACvC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,EAAE;SAC7C,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,aAAa,CAAC,IAAI,OAAO,EAAE,GAAG,IAAI,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,IAAY;QAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACrB,OAAO,EAAE,YAAY;YACrB,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,GAAG,GAAG,aAAa,IAAI,EAAE;YAC/B,OAAO,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE;SACvC,CAAC,CAAC;IACL,CAAC;CACF;AAED,0FAA0F;AAC1F,SAAS,yBAAyB,CAAC,SAA4C;IAC7E,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,OAAO,qEAAqE,CAAC;IAC/E,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,GAAG,SAAS,CAAC;SACzB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;SACzC,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,uBAAuB;QACvB,cAAc,CAAC,CAAC,SAAS,cAAc;QACvC,qBAAqB,cAAc,CAAC,CAAC,CAAC,gBAAgB,CAAC,qBAAqB;QAC5E,iBAAiB,CAAC,CAAC,YAAY,iBAAiB;QAChD,uBAAuB,CAAC,CAAC,kBAAkB,IAAI,EAAE,uBAAuB;QACxE,wBAAwB,CAC3B;SACA,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO,mCAAmC,SAAS,CAAC,MAAM,qBAAqB,KAAK,iCAAiC,CAAC;AACxH,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW,EAAE,IAAwB;IAC9D,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE;QAC5B,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE;QAC9B,UAAU,EAAE,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,IAAI,EAAE;QAC5C,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,YAAY;QAC9C,IAAI;KACL,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,OAAiB;IACrC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC;QACvB,CAAC,CAAC,sBAAsB,OAAO,CAAC,MAAM,qBAAqB,OAAO;aAC7D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC;aACjD,IAAI,CAAC,EAAE,CAAC,oBAAoB;QACjC,CAAC,CAAC,2CAA2C,CAAC;AAClD,CAAC;AAED,SAAS,sBAAsB,CAAC,iBAAqC;IACnE,OAAO,iBAAiB;QACtB,CAAC,CAAC,yCAAyC,cAAc,CACrD,iBAAiB,CAClB,oJAAoJ;QACvJ,CAAC,CAAC,0GAA0G,CAAC;AACjH,CAAC;AAED,wFAAwF;AACxF,SAAS,uBAAuB,CAAC,KAA8B;IAC7D,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAE1E,OAAO,CACL,wCAAwC;QACxC,8BAA8B,KAAK,IAAI;QACvC,oBAAoB,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,oBAAoB;QAC7E,OAAO;QACP,sBAAsB,cAAc,CAAC,KAAK,CAAC,iBAAiB,CAAC,sBAAsB;QACnF,gDAAgD;QAChD,kBAAkB;QAClB,eAAe,cAAc,CAAC,KAAK,CAAC,gBAAgB,CAAC,eAAe;QACpE,eAAe,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe;QAC9D,uDAAuD;QACvD,gFAAgF;QAChF,0BAA0B,cAAc,CAAC,KAAK,CAAC,qBAAqB,CAAC,0BAA0B;QAC/F,qFAAqF;QACrF,6BAA6B;QAC7B,wBAAwB;QACxB,0CAA0C;QAC1C,iFAAiF;QACjF,gEAAgE;QAChE,2BAA2B;QAC3B,CAAC,KAAK,CAAC,WAAW;YAChB,CAAC,CAAC,6HAA6H,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,qEAAqE;YACrO,CAAC,CAAC,qEAAqE,CAAC;QAC1E,kBAAkB,KAAK,CAAC,aAAa,IAAI,iBAAiB,kBAAkB;QAC5E,yBAAyB;QACzB,yDAAyD;QACzD,yBAAyB,CAAC,KAAK,CAAC,oBAAoB,CAAC;QACrD,YAAY,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY;QACrD,qHAAqH;QACrH,yCAAyC;QACzC,yBAAyB;QACzB,iBAAiB;QACjB,6HAA6H;QAC7H,uBAAuB;QACvB,sCAAsC;QACtC,qCAAqC;QACrC,uBAAuB,CACxB,CAAC;AACJ,CAAC"}

package/dist/aws/credentials.d.ts

@@ -0,0 +1,19 @@
+export interface AwsCredentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string | undefined;
+}
+export type CredentialProvider = () => Promise<AwsCredentials>;
+/**
+ * Resolve ambient AWS credentials (env vars, shared config/credentials files, SSO,
+ * container/instance metadata) via the standard Node provider chain.
+ *
+ * When an endpoint override is in play (floci/localstack) and no real credentials
+ * are configured, fall back to the emulator's dummy `test/test` pair so signing
+ * still succeeds — floci does not validate signatures.
+ */
+export declare function createCredentialProvider(opts: {
+    override?: boolean | undefined;
+}): CredentialProvider;
+/** A fixed-credentials provider, useful for tests. */
+export declare function staticCredentials(creds: AwsCredentials): CredentialProvider;

package/dist/aws/credentials.js

@@ -0,0 +1,36 @@
+import { fromNodeProviderChain } from '@aws-sdk/credential-providers';
+/**
+ * Resolve ambient AWS credentials (env vars, shared config/credentials files, SSO,
+ * container/instance metadata) via the standard Node provider chain.
+ *
+ * When an endpoint override is in play (floci/localstack) and no real credentials
+ * are configured, fall back to the emulator's dummy `test/test` pair so signing
+ * still succeeds — floci does not validate signatures.
+ */
+export function createCredentialProvider(opts) {
+    const chain = fromNodeProviderChain();
+    return async () => {
+        try {
+            const creds = await chain();
+            return {
+                accessKeyId: creds.accessKeyId,
+                secretAccessKey: creds.secretAccessKey,
+                sessionToken: creds.sessionToken,
+            };
+        }
+        catch (err) {
+            if (opts.override) {
+                return {
+                    accessKeyId: process.env.AWS_ACCESS_KEY_ID ?? 'test',
+                    secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY ?? 'test',
+                };
+            }
+            throw err;
+        }
+    };
+}
+/** A fixed-credentials provider, useful for tests. */
+export function staticCredentials(creds) {
+    return () => Promise.resolve(creds);
+}
+//# sourceMappingURL=credentials.js.map

package/dist/aws/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/aws/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAUtE;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAExC;IACC,MAAM,KAAK,GAAG,qBAAqB,EAAE,CAAC;IACtC,OAAO,KAAK,IAAI,EAAE;QAChB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,KAAK,EAAE,CAAC;YAC5B,OAAO;gBACL,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,OAAO;oBACL,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,MAAM;oBACpD,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,MAAM;iBAC7D,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,iBAAiB,CAAC,KAAqB;IACrD,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC"}

package/dist/aws/endpoint.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Endpoint resolution for AWS services.
+ *
+ * When an endpoint override is present (config or `AWS_ENDPOINT_URL`, e.g. the
+ * floci emulator on http://localhost:4566) every service is routed to that single
+ * origin. Otherwise the canonical per-service AWS hostname is used.
+ */
+export interface ResolvedEndpoint {
+    protocol: 'http:' | 'https:';
+    host: string;
+    /** Signing region — some services (iam, cloudfront) are global and sign as us-east-1. */
+    signingRegion: string;
+    /** True when talking to an override origin (floci/localstack); forces S3 path-style. */
+    override: boolean;
+}
+/** Service keys understood by the resolver. The value is the SigV4 signing name. */
+export declare const SIGNING_NAMES: {
+    readonly s3: "s3";
+    readonly sts: "sts";
+    readonly iam: "iam";
+    readonly logs: "logs";
+    readonly acm: "acm";
+    readonly cloudfront: "cloudfront";
+    readonly route53: "route53";
+    readonly microvms: "lambda";
+    readonly secretsmanager: "secretsmanager";
+};
+export type ServiceKey = keyof typeof SIGNING_NAMES;
+export declare function resolveEndpoint(service: ServiceKey, region: string, override: string | undefined): ResolvedEndpoint;

package/dist/aws/endpoint.js

@@ -0,0 +1,58 @@
+/**
+ * Endpoint resolution for AWS services.
+ *
+ * When an endpoint override is present (config or `AWS_ENDPOINT_URL`, e.g. the
+ * floci emulator on http://localhost:4566) every service is routed to that single
+ * origin. Otherwise the canonical per-service AWS hostname is used.
+ */
+/** Service keys understood by the resolver. The value is the SigV4 signing name. */
+export const SIGNING_NAMES = {
+    s3: 's3',
+    sts: 'sts',
+    iam: 'iam',
+    logs: 'logs',
+    acm: 'acm',
+    cloudfront: 'cloudfront',
+    route53: 'route53',
+    // Lambda MicroVMs is served off the standard Lambda endpoint (host + signing name
+    // "lambda"); operations are distinguished by the /2025-09-09/ path prefix.
+    microvms: 'lambda',
+    secretsmanager: 'secretsmanager',
+};
+/** Services that are global; they always sign in us-east-1. */
+const GLOBAL_SERVICES = new Set(['iam', 'cloudfront', 'route53']);
+export function resolveEndpoint(service, region, override) {
+    const signingRegion = GLOBAL_SERVICES.has(service) ? 'us-east-1' : region;
+    if (override) {
+        const url = new URL(override);
+        return {
+            protocol: url.protocol === 'http:' ? 'http:' : 'https:',
+            host: url.host,
+            signingRegion,
+            override: true,
+        };
+    }
+    return {
+        protocol: 'https:',
+        host: canonicalHost(service, region),
+        signingRegion,
+        override: false,
+    };
+}
+function canonicalHost(service, region) {
+    switch (service) {
+        case 'iam':
+            return 'iam.amazonaws.com';
+        case 'cloudfront':
+            return 'cloudfront.amazonaws.com';
+        case 'route53':
+            return 'route53.amazonaws.com';
+        case 's3':
+            return `s3.${region}.amazonaws.com`;
+        case 'microvms':
+            return `lambda.${region}.amazonaws.com`;
+        default:
+            return `${service}.${region}.amazonaws.com`;
+    }
+}
+//# sourceMappingURL=endpoint.js.map

package/dist/aws/endpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint.js","sourceRoot":"","sources":["../../src/aws/endpoint.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAWH,oFAAoF;AACpF,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,EAAE,EAAE,IAAI;IACR,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,KAAK;IACV,UAAU,EAAE,YAAY;IACxB,OAAO,EAAE,SAAS;IAClB,kFAAkF;IAClF,2EAA2E;IAC3E,QAAQ,EAAE,QAAQ;IAClB,cAAc,EAAE,gBAAgB;CACxB,CAAC;AAIX,+DAA+D;AAC/D,MAAM,eAAe,GAAG,IAAI,GAAG,CAAa,CAAC,KAAK,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC;AAE9E,MAAM,UAAU,eAAe,CAC7B,OAAmB,EACnB,MAAc,EACd,QAA4B;IAE5B,MAAM,aAAa,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;IAE1E,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,OAAO;YACL,QAAQ,EAAE,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;YACvD,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,aAAa;YACb,QAAQ,EAAE,IAAI;SACf,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC;QACpC,aAAa;QACb,QAAQ,EAAE,KAAK;KAChB,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,OAAmB,EAAE,MAAc;IACxD,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,KAAK;YACR,OAAO,mBAAmB,CAAC;QAC7B,KAAK,YAAY;YACf,OAAO,0BAA0B,CAAC;QACpC,KAAK,SAAS;YACZ,OAAO,uBAAuB,CAAC;QACjC,KAAK,IAAI;YACP,OAAO,MAAM,MAAM,gBAAgB,CAAC;QACtC,KAAK,UAAU;YACb,OAAO,UAAU,MAAM,gBAAgB,CAAC;QAC1C;YACE,OAAO,GAAG,OAAO,IAAI,MAAM,gBAAgB,CAAC;IAChD,CAAC;AACH,CAAC"}

package/dist/aws/errors.d.ts

@@ -0,0 +1,20 @@
+/** A structured error raised when an AWS API returns a non-2xx response. */
+export declare class AwsError extends Error {
+    readonly code: string;
+    readonly statusCode: number;
+    readonly requestId: string | undefined;
+    readonly service: string;
+    constructor(opts: {
+        service: string;
+        code: string;
+        message: string;
+        statusCode: number;
+        requestId?: string | undefined;
+    });
+    /** True for error codes that indicate the resource simply does not exist. */
+    get isNotFound(): boolean;
+    /** True for "already exists" style conflicts that bootstrap can treat as success. */
+    get isAlreadyExists(): boolean;
+}
+/** True for transient errors worth retrying with backoff. */
+export declare function isRetryable(err: unknown): boolean;

package/dist/aws/errors.js

@@ -0,0 +1,35 @@
+/** A structured error raised when an AWS API returns a non-2xx response. */
+export class AwsError extends Error {
+    code;
+    statusCode;
+    requestId;
+    service;
+    constructor(opts) {
+        super(`${opts.service}: ${opts.code} — ${opts.message} (HTTP ${opts.statusCode})`);
+        this.name = 'AwsError';
+        this.service = opts.service;
+        this.code = opts.code;
+        this.statusCode = opts.statusCode;
+        this.requestId = opts.requestId;
+    }
+    /** True for error codes that indicate the resource simply does not exist. */
+    get isNotFound() {
+        return (this.statusCode === 404 ||
+            /NotFound|NoSuchEntity|NoSuchBucket|NoSuchKey|ResourceNotFoundException/i.test(this.code));
+    }
+    /** True for "already exists" style conflicts that bootstrap can treat as success. */
+    get isAlreadyExists() {
+        return /AlreadyExists|BucketAlreadyOwnedByYou|EntityAlreadyExists|Conflict/i.test(this.code);
+    }
+}
+/** True for transient errors worth retrying with backoff. */
+export function isRetryable(err) {
+    if (err instanceof AwsError) {
+        return (err.statusCode >= 500 ||
+            err.statusCode === 429 ||
+            /Throttling|TooManyRequests|InternalError|ServiceUnavailable/i.test(err.code));
+    }
+    // Network-level failures (fetch throws TypeError) are retryable.
+    return err instanceof TypeError;
+}
+//# sourceMappingURL=errors.js.map

package/dist/aws/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/aws/errors.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,IAAI,CAAS;IACb,UAAU,CAAS;IACnB,SAAS,CAAqB;IAC9B,OAAO,CAAS;IAEzB,YAAY,IAMX;QACC,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,OAAO,UAAU,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAClC,CAAC;IAED,6EAA6E;IAC7E,IAAI,UAAU;QACZ,OAAO,CACL,IAAI,CAAC,UAAU,KAAK,GAAG;YACvB,yEAAyE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAC1F,CAAC;IACJ,CAAC;IAED,qFAAqF;IACrF,IAAI,eAAe;QACjB,OAAO,qEAAqE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/F,CAAC;CACF;AAED,6DAA6D;AAC7D,MAAM,UAAU,WAAW,CAAC,GAAY;IACtC,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;QAC5B,OAAO,CACL,GAAG,CAAC,UAAU,IAAI,GAAG;YACrB,GAAG,CAAC,UAAU,KAAK,GAAG;YACtB,8DAA8D,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAC9E,CAAC;IACJ,CAAC;IACD,iEAAiE;IACjE,OAAO,GAAG,YAAY,SAAS,CAAC;AAClC,CAAC"}

package/dist/aws/form.d.ts

@@ -0,0 +1,2 @@
+/** Encode a map as an application/x-www-form-urlencoded body (query protocol). */
+export declare function formEncode(params: Record<string, string | undefined>): string;

package/dist/aws/form.js

@@ -0,0 +1,11 @@
+/** Encode a map as an application/x-www-form-urlencoded body (query protocol). */
+export function formEncode(params) {
+    return Object.entries(params)
+        .filter((entry) => entry[1] !== undefined)
+        .map(([k, v]) => `${encode(k)}=${encode(v)}`)
+        .join('&');
+}
+function encode(value) {
+    return encodeURIComponent(value).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+//# sourceMappingURL=form.js.map

package/dist/aws/form.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"form.js","sourceRoot":"","sources":["../../src/aws/form.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,MAAM,UAAU,UAAU,CAAC,MAA0C;IACnE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SAC1B,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;SACpE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,OAAO,CACtC,UAAU,EACV,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CACxD,CAAC;AACJ,CAAC"}

package/dist/aws/iam.d.ts

@@ -0,0 +1,18 @@
+import type { SigningClient } from './signer.js';
+/** IAM client (query protocol) — roles with inline policies. */
+export declare class IamClient {
+    private readonly client;
+    constructor(client: SigningClient);
+    private call;
+    /** Return the role ARN, or undefined if the role does not exist. */
+    getRoleArn(roleName: string): Promise<string | undefined>;
+    /** Create a role (idempotent) and return its ARN. */
+    ensureRole(roleName: string, assumeRolePolicy: object, description?: string): Promise<string>;
+    putRolePolicy(roleName: string, policyName: string, policy: object): Promise<void>;
+    listRolePolicies(roleName: string): Promise<string[]>;
+    deleteRolePolicy(roleName: string, policyName: string): Promise<void>;
+    /** Create an OIDC identity provider (idempotent). Account-global; never deleted here. */
+    ensureOidcProvider(url: string, clientId: string, thumbprint: string): Promise<void>;
+    /** Delete a role, first removing any inline policies. Idempotent. */
+    deleteRole(roleName: string): Promise<void>;
+}