blogwright-core 0.1.0

package/dist/aws/route53.js

@@ -0,0 +1,71 @@
+import { AwsError } from './errors.js';
+import { encodeEntities, textTag } from './xml.js';
+const API = '/2013-04-01';
+/** Route53 client (REST-XML). Global service, signed in us-east-1. */
+export class Route53Client {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    /** Find the hosted zone id for a domain (e.g. "preview.example.com"). */
+    async hostedZoneId(dnsName) {
+        const res = await this.client.send({
+            service: 'route53',
+            method: 'GET',
+            path: `${API}/hostedzonesbyname`,
+            query: { dnsname: dnsName },
+        });
+        const xml = res.text();
+        const want = dnsName.endsWith('.') ? dnsName : `${dnsName}.`;
+        // Match the HostedZone block whose <Name> equals the requested domain.
+        for (const block of xml.split('<HostedZone>').slice(1)) {
+            if (textTag(block, 'Name') === want) {
+                const id = textTag(block, 'Id');
+                return id?.replace(/^\/hostedzone\//, '');
+            }
+        }
+        return undefined;
+    }
+    async change(zoneId, action, r) {
+        const body = `<?xml version="1.0" encoding="UTF-8"?>` +
+            `<ChangeResourceRecordSetsRequest xmlns="https://route53.amazonaws.com/doc/2013-04-01/">` +
+            `<ChangeBatch><Changes><Change>` +
+            `<Action>${action}</Action>` +
+            `<ResourceRecordSet>` +
+            `<Name>${encodeEntities(r.name)}</Name>` +
+            `<Type>${r.type}</Type>` +
+            `<TTL>${r.ttl ?? 300}</TTL>` +
+            `<ResourceRecords><ResourceRecord><Value>${encodeEntities(r.value)}</Value></ResourceRecord></ResourceRecords>` +
+            `</ResourceRecordSet>` +
+            `</Change></Changes></ChangeBatch>` +
+            `</ChangeResourceRecordSetsRequest>`;
+        await this.client.send({
+            service: 'route53',
+            method: 'POST',
+            path: `${API}/hostedzone/${zoneId}/rrset`,
+            headers: { 'content-type': 'application/xml' },
+            body,
+        });
+    }
+    /** Create or update a record (idempotent). */
+    async upsertRecord(zoneId, record) {
+        await this.change(zoneId, 'UPSERT', record);
+    }
+    /** Delete a record; ignores an already-absent record. */
+    async deleteRecord(zoneId, record) {
+        try {
+            await this.change(zoneId, 'DELETE', record);
+        }
+        catch (err) {
+            // Route53 rejects a DELETE whose record doesn't exactly match/exist —
+            // that (and only that) means "already gone". Throttling, auth, and other
+            // failures must surface, or a teardown leaves the record dangling while
+            // reporting success.
+            const gone = err instanceof AwsError &&
+                (err.isNotFound || (err.code === 'InvalidChangeBatch' && /not found/i.test(err.message)));
+            if (!gone)
+                throw err;
+        }
+    }
+}
+//# sourceMappingURL=route53.js.map

package/dist/aws/route53.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route53.js","sourceRoot":"","sources":["../../src/aws/route53.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAEnD,MAAM,GAAG,GAAG,aAAa,CAAC;AAS1B,sEAAsE;AACtE,MAAM,OAAO,aAAa;IACK;IAA7B,YAA6B,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;IAAG,CAAC;IAEtD,yEAAyE;IACzE,KAAK,CAAC,YAAY,CAAC,OAAe;QAChC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACjC,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,GAAG,oBAAoB;YAChC,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE;SAC5B,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,CAAC;QAC7D,uEAAuE;QACvE,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,IAAI,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;gBACpC,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBAChC,OAAO,EAAE,EAAE,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,MAA2B,EAAE,CAAY;QAC5E,MAAM,IAAI,GACR,wCAAwC;YACxC,yFAAyF;YACzF,gCAAgC;YAChC,WAAW,MAAM,WAAW;YAC5B,qBAAqB;YACrB,SAAS,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS;YACxC,SAAS,CAAC,CAAC,IAAI,SAAS;YACxB,QAAQ,CAAC,CAAC,GAAG,IAAI,GAAG,QAAQ;YAC5B,2CAA2C,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,6CAA6C;YAC/G,sBAAsB;YACtB,mCAAmC;YACnC,oCAAoC,CAAC;QACvC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACrB,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG,GAAG,eAAe,MAAM,QAAQ;YACzC,OAAO,EAAE,EAAE,cAAc,EAAE,iBAAiB,EAAE;YAC9C,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IAED,8CAA8C;IAC9C,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,MAAiB;QAClD,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED,yDAAyD;IACzD,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,MAAiB;QAClD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,sEAAsE;YACtE,yEAAyE;YACzE,wEAAwE;YACxE,qBAAqB;YACrB,MAAM,IAAI,GACR,GAAG,YAAY,QAAQ;gBACvB,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,oBAAoB,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAC5F,IAAI,CAAC,IAAI;gBAAE,MAAM,GAAG,CAAC;QACvB,CAAC;IACH,CAAC;CACF"}

package/dist/aws/s3.d.ts

@@ -0,0 +1,31 @@
+import type { SigningClient } from './signer.js';
+export interface S3Object {
+    key: string;
+    size: number;
+    lastModified: string | undefined;
+    /** S3 ETag with surrounding quotes stripped (MD5 hex for single-part objects). */
+    etag: string | undefined;
+}
+/** Thin S3 client (path-style addressing) built on the shared signing transport. */
+export declare class S3Client {
+    private readonly client;
+    constructor(client: SigningClient);
+    private objectPath;
+    bucketExists(bucket: string): Promise<boolean>;
+    /** Create a bucket. Regions other than us-east-1 require a LocationConstraint body. */
+    createBucket(bucket: string): Promise<void>;
+    deleteBucket(bucket: string): Promise<void>;
+    putPublicAccessBlock(bucket: string): Promise<void>;
+    putObject(bucket: string, key: string, body: string | Uint8Array, contentType?: string): Promise<void>;
+    getObject(bucket: string, key: string): Promise<Uint8Array>;
+    getObjectText(bucket: string, key: string): Promise<string | undefined>;
+    objectExists(bucket: string, key: string): Promise<boolean>;
+    deleteObject(bucket: string, key: string): Promise<void>;
+    /** List all objects under a prefix, following continuation tokens. */
+    listObjects(bucket: string, prefix: string): Promise<S3Object[]>;
+    /** Delete every object under a prefix. Returns the number deleted. */
+    deletePrefix(bucket: string, prefix: string): Promise<number>;
+    putBucketPolicy(bucket: string, policy: string): Promise<void>;
+    /** Build an S3 REST-XML error-free marker; exported for callers needing entity-safe values. */
+    static xmlValue(value: string): string;
+}

package/dist/aws/s3.js

@@ -0,0 +1,178 @@
+import { allTags, encodeEntities, rawTextTag, textTag } from './xml.js';
+import { AwsError } from './errors.js';
+/** Percent-encode an object key for a path-style URL, preserving '/' separators. */
+function encodeKey(key) {
+    return key
+        .split('/')
+        .map((seg) => encodeURIComponent(seg).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`))
+        .join('/');
+}
+/** Thin S3 client (path-style addressing) built on the shared signing transport. */
+export class S3Client {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    objectPath(bucket, key) {
+        return `/${bucket}/${encodeKey(key)}`;
+    }
+    async bucketExists(bucket) {
+        try {
+            await this.client.send({ service: 's3', method: 'HEAD', path: `/${bucket}` });
+            return true;
+        }
+        catch (err) {
+            if (err instanceof AwsError && err.isNotFound)
+                return false;
+            throw err;
+        }
+    }
+    /** Create a bucket. Regions other than us-east-1 require a LocationConstraint body. */
+    async createBucket(bucket) {
+        const region = this.client.region;
+        const body = region && region !== 'us-east-1'
+            ? `<?xml version="1.0" encoding="UTF-8"?><CreateBucketConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><LocationConstraint>${region}</LocationConstraint></CreateBucketConfiguration>`
+            : undefined;
+        try {
+            await this.client.send({
+                service: 's3',
+                method: 'PUT',
+                path: `/${bucket}`,
+                ...(body ? { headers: { 'content-type': 'application/xml' }, body } : {}),
+            });
+        }
+        catch (err) {
+            if (err instanceof AwsError && err.isAlreadyExists)
+                return;
+            throw err;
+        }
+    }
+    async deleteBucket(bucket) {
+        try {
+            await this.client.send({ service: 's3', method: 'DELETE', path: `/${bucket}` });
+        }
+        catch (err) {
+            if (err instanceof AwsError && err.isNotFound)
+                return;
+            throw err;
+        }
+    }
+    async putPublicAccessBlock(bucket) {
+        const body = '<?xml version="1.0" encoding="UTF-8"?>' +
+            '<PublicAccessBlockConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">' +
+            '<BlockPublicAcls>true</BlockPublicAcls>' +
+            '<IgnorePublicAcls>true</IgnorePublicAcls>' +
+            '<BlockPublicPolicy>true</BlockPublicPolicy>' +
+            '<RestrictPublicBuckets>true</RestrictPublicBuckets>' +
+            '</PublicAccessBlockConfiguration>';
+        await this.client.send({
+            service: 's3',
+            method: 'PUT',
+            path: `/${bucket}`,
+            query: { publicAccessBlock: '' },
+            headers: { 'content-type': 'application/xml' },
+            body,
+        });
+    }
+    async putObject(bucket, key, body, contentType = 'application/octet-stream') {
+        await this.client.send({
+            service: 's3',
+            method: 'PUT',
+            path: this.objectPath(bucket, key),
+            headers: { 'content-type': contentType },
+            body,
+        });
+    }
+    async getObject(bucket, key) {
+        const res = await this.client.send({
+            service: 's3',
+            method: 'GET',
+            path: this.objectPath(bucket, key),
+        });
+        return res.body;
+    }
+    async getObjectText(bucket, key) {
+        try {
+            const bytes = await this.getObject(bucket, key);
+            return new TextDecoder().decode(bytes);
+        }
+        catch (err) {
+            if (err instanceof AwsError && err.isNotFound)
+                return undefined;
+            throw err;
+        }
+    }
+    async objectExists(bucket, key) {
+        try {
+            await this.client.send({ service: 's3', method: 'HEAD', path: this.objectPath(bucket, key) });
+            return true;
+        }
+        catch (err) {
+            if (err instanceof AwsError && err.isNotFound)
+                return false;
+            throw err;
+        }
+    }
+    async deleteObject(bucket, key) {
+        await this.client.send({
+            service: 's3',
+            method: 'DELETE',
+            path: this.objectPath(bucket, key),
+        });
+    }
+    /** List all objects under a prefix, following continuation tokens. */
+    async listObjects(bucket, prefix) {
+        const out = [];
+        let token;
+        do {
+            const res = await this.client.send({
+                service: 's3',
+                method: 'GET',
+                path: `/${bucket}`,
+                query: {
+                    'list-type': '2',
+                    prefix,
+                    ...(token ? { 'continuation-token': token } : {}),
+                },
+            });
+            const xml = res.text();
+            for (const block of allTags(xml, 'Contents')) {
+                const key = rawTextTag(block, 'Key');
+                if (key === undefined)
+                    continue;
+                out.push({
+                    key,
+                    size: Number(textTag(block, 'Size') ?? '0'),
+                    lastModified: textTag(block, 'LastModified'),
+                    etag: textTag(block, 'ETag')?.replace(/"/g, ''),
+                });
+            }
+            token =
+                textTag(xml, 'IsTruncated') === 'true' ? textTag(xml, 'NextContinuationToken') : undefined;
+        } while (token);
+        return out;
+    }
+    /** Delete every object under a prefix. Returns the number deleted. */
+    async deletePrefix(bucket, prefix) {
+        const objects = await this.listObjects(bucket, prefix);
+        for (const obj of objects) {
+            await this.deleteObject(bucket, obj.key);
+        }
+        return objects.length;
+    }
+    async putBucketPolicy(bucket, policy) {
+        await this.client.send({
+            service: 's3',
+            method: 'PUT',
+            path: `/${bucket}`,
+            query: { policy: '' },
+            headers: { 'content-type': 'application/json' },
+            body: policy,
+        });
+    }
+    /** Build an S3 REST-XML error-free marker; exported for callers needing entity-safe values. */
+    static xmlValue(value) {
+        return encodeEntities(value);
+    }
+}
+//# sourceMappingURL=s3.js.map

package/dist/aws/s3.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"s3.js","sourceRoot":"","sources":["../../src/aws/s3.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACxE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAWvC,oFAAoF;AACpF,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACX,kBAAkB,CAAC,GAAG,CAAC,CAAC,OAAO,CAC7B,UAAU,EACV,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CACxD,CACF;SACA,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,oFAAoF;AACpF,MAAM,OAAO,QAAQ;IACU;IAA7B,YAA6B,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;IAAG,CAAC;IAE9C,UAAU,CAAC,MAAc,EAAE,GAAW;QAC5C,OAAO,IAAI,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;YAC9E,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,UAAU;gBAAE,OAAO,KAAK,CAAC;YAC5D,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAClC,MAAM,IAAI,GACR,MAAM,IAAI,MAAM,KAAK,WAAW;YAC9B,CAAC,CAAC,wIAAwI,MAAM,mDAAmD;YACnM,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACrB,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,IAAI,MAAM,EAAE;gBAClB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1E,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,eAAe;gBAAE,OAAO;YAC3D,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,UAAU;gBAAE,OAAO;YACtD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,MAAc;QACvC,MAAM,IAAI,GACR,wCAAwC;YACxC,kFAAkF;YAClF,yCAAyC;YACzC,2CAA2C;YAC3C,6CAA6C;YAC7C,qDAAqD;YACrD,mCAAmC,CAAC;QACtC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACrB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,MAAM,EAAE;YAClB,KAAK,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE;YAChC,OAAO,EAAE,EAAE,cAAc,EAAE,iBAAiB,EAAE;YAC9C,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS,CACb,MAAc,EACd,GAAW,EACX,IAAyB,EACzB,WAAW,GAAG,0BAA0B;QAExC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACrB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC;YAClC,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE;YACxC,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,GAAW;QACzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACjC,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC;SACnC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,GAAW;QAC7C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAChD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,UAAU;gBAAE,OAAO,SAAS,CAAC;YAChE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,GAAW;QAC5C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9F,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,UAAU;gBAAE,OAAO,KAAK,CAAC;YAC5D,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,GAAW;QAC5C,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACrB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC;SACnC,CAAC,CAAC;IACL,CAAC;IAED,sEAAsE;IACtE,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,MAAc;QAC9C,MAAM,GAAG,GAAe,EAAE,CAAC;QAC3B,IAAI,KAAyB,CAAC;QAC9B,GAAG,CAAC;YACF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACjC,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,IAAI,MAAM,EAAE;gBAClB,KAAK,EAAE;oBACL,WAAW,EAAE,GAAG;oBAChB,MAAM;oBACN,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAClD;aACF,CAAC,CAAC;YACH,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YACvB,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC;gBAC7C,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBACrC,IAAI,GAAG,KAAK,SAAS;oBAAE,SAAS;gBAChC,GAAG,CAAC,IAAI,CAAC;oBACP,GAAG;oBACH,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC;oBAC3C,YAAY,EAAE,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC;oBAC5C,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;iBAChD,CAAC,CAAC;YACL,CAAC;YACD,KAAK;gBACH,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,CAAC,QAAQ,KAAK,EAAE;QAChB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,sEAAsE;IACtE,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,MAAc;QAC/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACvD,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,MAAc;QAClD,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACrB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,MAAM,EAAE;YAClB,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;YACrB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;IACL,CAAC;IAED,+FAA+F;IAC/F,MAAM,CAAC,QAAQ,CAAC,KAAa;QAC3B,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;CACF"}

package/dist/aws/secretsmanager.d.ts

@@ -0,0 +1,21 @@
+import type { SigningClient } from './signer.js';
+export interface SecretMetadata {
+    arn: string;
+    name: string;
+    /** Epoch seconds (fractional) of the last value change, when reported. */
+    lastChangedDate?: number | undefined;
+}
+/** AWS Secrets Manager client (AWS JSON 1.1). */
+export declare class SecretsManagerClient {
+    private readonly client;
+    constructor(client: SigningClient);
+    private call;
+    /** Create the secret, or update its value if it already exists. */
+    upsertSecret(name: string, value: string, description?: string): Promise<void>;
+    /** Fetch the secret's string value; undefined when the secret does not exist. */
+    getSecretValue(name: string): Promise<string | undefined>;
+    /** Fetch metadata (never the value); undefined when the secret does not exist. */
+    describeSecret(name: string): Promise<SecretMetadata | undefined>;
+    /** Delete immediately (no recovery window). No-op when the secret does not exist. */
+    deleteSecret(name: string): Promise<void>;
+}

package/dist/aws/secretsmanager.js

@@ -0,0 +1,84 @@
+import { AwsError } from './errors.js';
+const TARGET = 'secretsmanager';
+/** AWS Secrets Manager client (AWS JSON 1.1). */
+export class SecretsManagerClient {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    async call(op, payload) {
+        const res = await this.client.send({
+            service: 'secretsmanager',
+            method: 'POST',
+            path: '/',
+            headers: {
+                'content-type': 'application/x-amz-json-1.1',
+                'x-amz-target': `${TARGET}.${op}`,
+            },
+            body: JSON.stringify(payload),
+        });
+        const text = res.text();
+        return (text ? JSON.parse(text) : {});
+    }
+    /** Create the secret, or update its value if it already exists. */
+    async upsertSecret(name, value, description) {
+        // The raw API requires the idempotency token SDKs normally generate.
+        try {
+            await this.call('CreateSecret', {
+                Name: name,
+                SecretString: value,
+                ClientRequestToken: crypto.randomUUID(),
+                ...(description ? { Description: description } : {}),
+            });
+        }
+        catch (err) {
+            // Secrets Manager reports an existing secret as ResourceExistsException.
+            const exists = err instanceof AwsError && (err.isAlreadyExists || err.code === 'ResourceExistsException');
+            if (!exists)
+                throw err;
+            await this.call('PutSecretValue', {
+                SecretId: name,
+                SecretString: value,
+                ClientRequestToken: crypto.randomUUID(),
+            });
+        }
+    }
+    /** Fetch the secret's string value; undefined when the secret does not exist. */
+    async getSecretValue(name) {
+        try {
+            const out = await this.call('GetSecretValue', {
+                SecretId: name,
+            });
+            return out.SecretString;
+        }
+        catch (err) {
+            if (err instanceof AwsError && err.isNotFound)
+                return undefined;
+            throw err;
+        }
+    }
+    /** Fetch metadata (never the value); undefined when the secret does not exist. */
+    async describeSecret(name) {
+        try {
+            const out = await this.call('DescribeSecret', { SecretId: name });
+            return { arn: out.ARN, name: out.Name, lastChangedDate: out.LastChangedDate };
+        }
+        catch (err) {
+            if (err instanceof AwsError && err.isNotFound)
+                return undefined;
+            throw err;
+        }
+    }
+    /** Delete immediately (no recovery window). No-op when the secret does not exist. */
+    async deleteSecret(name) {
+        try {
+            await this.call('DeleteSecret', { SecretId: name, ForceDeleteWithoutRecovery: true });
+        }
+        catch (err) {
+            if (err instanceof AwsError && err.isNotFound)
+                return;
+            throw err;
+        }
+    }
+}
+//# sourceMappingURL=secretsmanager.js.map

package/dist/aws/secretsmanager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretsmanager.js","sourceRoot":"","sources":["../../src/aws/secretsmanager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGvC,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAShC,iDAAiD;AACjD,MAAM,OAAO,oBAAoB;IACF;IAA7B,YAA6B,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;IAAG,CAAC;IAE9C,KAAK,CAAC,IAAI,CAAI,EAAU,EAAE,OAAe;QAC/C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACjC,OAAO,EAAE,gBAAgB;YACzB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG;YACT,OAAO,EAAE;gBACP,cAAc,EAAE,4BAA4B;gBAC5C,cAAc,EAAE,GAAG,MAAM,IAAI,EAAE,EAAE;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC9B,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAM,CAAC;IAC7C,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,KAAa,EAAE,WAAoB;QAClE,qEAAqE;QACrE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;gBAC9B,IAAI,EAAE,IAAI;gBACV,YAAY,EAAE,KAAK;gBACnB,kBAAkB,EAAE,MAAM,CAAC,UAAU,EAAE;gBACvC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yEAAyE;YACzE,MAAM,MAAM,GACV,GAAG,YAAY,QAAQ,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,IAAI,KAAK,yBAAyB,CAAC,CAAC;YAC7F,IAAI,CAAC,MAAM;gBAAE,MAAM,GAAG,CAAC;YACvB,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE;gBAChC,QAAQ,EAAE,IAAI;gBACd,YAAY,EAAE,KAAK;gBACnB,kBAAkB,EAAE,MAAM,CAAC,UAAU,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,cAAc,CAAC,IAAY;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAA4B,gBAAgB,EAAE;gBACvE,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,YAAY,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,UAAU;gBAAE,OAAO,SAAS,CAAC;YAChE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,cAAc,CAAC,IAAY;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CACzB,gBAAgB,EAChB,EAAE,QAAQ,EAAE,IAAI,EAAE,CACnB,CAAC;YACF,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,CAAC,eAAe,EAAE,CAAC;QAChF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,UAAU;gBAAE,OAAO,SAAS,CAAC;YAChE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,YAAY,CAAC,IAAY;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,UAAU;gBAAE,OAAO;YACtD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF"}

package/dist/aws/signer.d.ts

@@ -0,0 +1,44 @@
+import type { CredentialProvider } from './credentials.js';
+import { type ServiceKey } from './endpoint.js';
+export interface RawResponse {
+    statusCode: number;
+    headers: Record<string, string>;
+    body: Uint8Array;
+    text(): string;
+}
+/** Low-level transport. Injectable so tests can intercept without real network I/O. */
+export type Transport = (req: {
+    url: string;
+    method: string;
+    headers: Record<string, string>;
+    body: string | Uint8Array | undefined;
+}) => Promise<RawResponse>;
+export interface SendOptions {
+    service: ServiceKey;
+    method: string;
+    /** Path starting with '/'. For S3 pass an already-percent-encoded path. */
+    path: string;
+    query?: Record<string, string | number | undefined> | undefined;
+    headers?: Record<string, string> | undefined;
+    body?: string | Uint8Array | undefined;
+}
+export interface SigningClientOptions {
+    region: string;
+    endpointOverride?: string | undefined;
+    credentials: CredentialProvider;
+    transport?: Transport | undefined;
+}
+/** Default transport backed by the global fetch. */
+export declare const fetchTransport: Transport;
+/**
+ * Signs and sends raw HTTP requests to AWS services using SigV4. This is the single
+ * seam through which every service client talks to AWS (or the floci emulator).
+ */
+export declare class SigningClient {
+    readonly region: string;
+    readonly endpointOverride: string | undefined;
+    private readonly credentials;
+    private readonly transport;
+    constructor(opts: SigningClientOptions);
+    send(opts: SendOptions): Promise<RawResponse>;
+}

package/dist/aws/signer.js

@@ -0,0 +1,144 @@
+import { Sha256 } from '@aws-crypto/sha256-js';
+import { HttpRequest } from '@smithy/protocol-http';
+import { SignatureV4 } from '@smithy/signature-v4';
+import { resolveEndpoint, SIGNING_NAMES } from './endpoint.js';
+import { AwsError, isRetryable } from './errors.js';
+import { withRetry } from '../util.js';
+import { textTag } from './xml.js';
+/** Default transport backed by the global fetch. */
+export const fetchTransport = async (req) => {
+    const init = { method: req.method, headers: req.headers };
+    if (req.body !== undefined)
+        init.body = req.body;
+    const res = await fetch(req.url, init);
+    const buf = new Uint8Array(await res.arrayBuffer());
+    const headers = {};
+    res.headers.forEach((value, key) => {
+        headers[key] = value;
+    });
+    return {
+        statusCode: res.status,
+        headers,
+        body: buf,
+        text: () => new TextDecoder().decode(buf),
+    };
+};
+/** Strict RFC-3986 percent encoder (matches SigV4 canonicalisation). */
+function escape(component) {
+    return encodeURIComponent(component).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+async function sha256Hex(body) {
+    const hash = new Sha256();
+    hash.update(body ?? '');
+    const digest = await hash.digest();
+    return Array.from(digest)
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+}
+/**
+ * Signs and sends raw HTTP requests to AWS services using SigV4. This is the single
+ * seam through which every service client talks to AWS (or the floci emulator).
+ */
+export class SigningClient {
+    region;
+    endpointOverride;
+    credentials;
+    transport;
+    constructor(opts) {
+        this.region = opts.region;
+        this.endpointOverride = opts.endpointOverride;
+        this.credentials = opts.credentials;
+        this.transport = opts.transport ?? fetchTransport;
+    }
+    async send(opts) {
+        const ep = resolveEndpoint(opts.service, this.region, this.endpointOverride);
+        const [hostname, portStr] = ep.host.split(':');
+        const port = portStr ? Number(portStr) : undefined;
+        const query = {};
+        for (const [key, value] of Object.entries(opts.query ?? {})) {
+            if (value !== undefined)
+                query[key] = String(value);
+        }
+        const contentHash = await sha256Hex(opts.body);
+        const headers = {
+            host: ep.host,
+            'x-amz-content-sha256': contentHash,
+            ...opts.headers,
+        };
+        const request = new HttpRequest({
+            protocol: ep.protocol,
+            hostname: hostname ?? ep.host,
+            ...(port !== undefined ? { port } : {}),
+            method: opts.method,
+            path: opts.path,
+            query,
+            headers,
+            ...(opts.body !== undefined ? { body: opts.body } : {}),
+        });
+        const signer = new SignatureV4({
+            service: SIGNING_NAMES[opts.service],
+            region: ep.signingRegion,
+            credentials: async () => {
+                const c = await this.credentials();
+                return {
+                    accessKeyId: c.accessKeyId,
+                    secretAccessKey: c.secretAccessKey,
+                    ...(c.sessionToken ? { sessionToken: c.sessionToken } : {}),
+                };
+            },
+            sha256: Sha256,
+            uriEscapePath: opts.service !== 's3',
+        });
+        const signed = await signer.sign(request);
+        const qs = Object.keys(query)
+            .map((k) => `${escape(k)}=${escape(query[k])}`)
+            .join('&');
+        const url = `${ep.protocol}//${ep.host}${opts.path}${qs ? `?${qs}` : ''}`;
+        // Retry transient failures with backoff. For idempotent methods, retry on network
+        // errors and 5xx/429. For non-idempotent POSTs, retry ONLY on network errors (the
+        // request never reached the server) — never on a 5xx, which may mean the mutation
+        // was applied and a retry would double-execute (e.g. launch a second MicroVM).
+        const idempotent = ['GET', 'HEAD', 'PUT', 'DELETE'].includes(opts.method);
+        const retryable = idempotent ? isRetryable : (err) => err instanceof TypeError;
+        return withRetry(async () => {
+            const response = await this.transport({
+                url,
+                method: opts.method,
+                headers: signed.headers,
+                body: opts.body,
+            });
+            // Anything outside 2xx is a failure. 3xx matters: S3's region-mismatch
+            // PermanentRedirect is a 301 with no Location header, which fetch
+            // returns as final — treating it as success would report writes as
+            // stored and listings as empty against the wrong endpoint.
+            if (response.statusCode >= 300)
+                throw parseError(opts.service, response);
+            return response;
+        }, { retryable });
+    }
+}
+function parseError(service, response) {
+    const text = response.text();
+    let code = `Http${response.statusCode}`;
+    let message = text.slice(0, 500) || 'request failed';
+    let requestId;
+    const trimmed = text.trimStart();
+    if (trimmed.startsWith('{')) {
+        try {
+            const json = JSON.parse(text);
+            const rawCode = (json.__type ?? json.code ?? json.Code);
+            code = rawCode ? (rawCode.split('#').pop() ?? code) : code;
+            message = (json.message ?? json.Message ?? message);
+        }
+        catch {
+            /* fall through */
+        }
+    }
+    else if (trimmed.startsWith('<')) {
+        code = textTag(text, 'Code') ?? code;
+        message = textTag(text, 'Message') ?? message;
+        requestId = textTag(text, 'RequestId') ?? textTag(text, 'RequestID');
+    }
+    return new AwsError({ service, code, message, statusCode: response.statusCode, requestId });
+}
+//# sourceMappingURL=signer.js.map

package/dist/aws/signer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer.js","sourceRoot":"","sources":["../../src/aws/signer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAGnD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAmB,MAAM,eAAe,CAAC;AAChF,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAkCnC,oDAAoD;AACpD,MAAM,CAAC,MAAM,cAAc,GAAc,KAAK,EAAE,GAAG,EAAE,EAAE;IACrD,MAAM,IAAI,GAAgB,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IACvE,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,IAAwC,CAAC;IACrF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IACpD,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACjC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,OAAO;QACL,UAAU,EAAE,GAAG,CAAC,MAAM;QACtB,OAAO;QACP,IAAI,EAAE,GAAG;QACT,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC;KAC1C,CAAC;AACJ,CAAC,CAAC;AAEF,wEAAwE;AACxE,SAAS,MAAM,CAAC,SAAiB;IAC/B,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC,OAAO,CAC1C,UAAU,EACV,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CACxD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAqC;IAC5D,MAAM,IAAI,GAAG,IAAI,MAAM,EAAE,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;IACnC,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;SACtB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,aAAa;IACf,MAAM,CAAS;IACf,gBAAgB,CAAqB;IAC7B,WAAW,CAAqB;IAChC,SAAS,CAAY;IAEtC,YAAY,IAA0B;QACpC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC;QAC9C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,cAAc,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAiB;QAC1B,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7E,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEnD,MAAM,KAAK,GAA2B,EAAE,CAAC;QACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5D,IAAI,KAAK,KAAK,SAAS;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,OAAO,GAA2B;YACtC,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,sBAAsB,EAAE,WAAW;YACnC,GAAG,IAAI,CAAC,OAAO;SAChB,CAAC;QAEF,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC;YAC9B,QAAQ,EAAE,EAAE,CAAC,QAAQ;YACrB,QAAQ,EAAE,QAAQ,IAAI,EAAE,CAAC,IAAI;YAC7B,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK;YACL,OAAO;YACP,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC;YAC7B,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;YACpC,MAAM,EAAE,EAAE,CAAC,aAAa;YACxB,WAAW,EAAE,KAAK,IAAI,EAAE;gBACtB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnC,OAAO;oBACL,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,eAAe,EAAE,CAAC,CAAC,eAAe;oBAClC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC5D,CAAC;YACJ,CAAC;YACD,MAAM,EAAE,MAAM;YACd,aAAa,EAAE,IAAI,CAAC,OAAO,KAAK,IAAI;SACrC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE1C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;aAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC,EAAE,CAAC;aACxD,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,QAAQ,KAAK,EAAE,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAE1E,kFAAkF;QAClF,kFAAkF;QAClF,kFAAkF;QAClF,+EAA+E;QAC/E,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,GAAG,YAAY,SAAS,CAAC;QACxF,OAAO,SAAS,CACd,KAAK,IAAI,EAAE;YACT,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC;gBACpC,GAAG;gBACH,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAiC;gBACjD,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAC;YACH,uEAAuE;YACvE,kEAAkE;YAClE,mEAAmE;YACnE,2DAA2D;YAC3D,IAAI,QAAQ,CAAC,UAAU,IAAI,GAAG;gBAAE,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACzE,OAAO,QAAQ,CAAC;QAClB,CAAC,EACD,EAAE,SAAS,EAAE,CACd,CAAC;IACJ,CAAC;CACF;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,QAAqB;IACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,IAAI,GAAG,OAAO,QAAQ,CAAC,UAAU,EAAE,CAAC;IACxC,IAAI,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,gBAAgB,CAAC;IACrD,IAAI,SAA6B,CAAC;IAElC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IACjC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;YACzD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAuB,CAAC;YAC9E,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC3D,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,IAAI,OAAO,CAAW,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC;QACrC,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,OAAO,CAAC;QAC9C,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,IAAI,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;AAC9F,CAAC"}

package/dist/aws/sts.d.ts

@@ -0,0 +1,7 @@
+import type { SigningClient } from './signer.js';
+/** STS client — only GetCallerIdentity, used to derive the account id. */
+export declare class StsClient {
+    private readonly client;
+    constructor(client: SigningClient);
+    getAccountId(): Promise<string>;
+}

package/dist/aws/sts.js

@@ -0,0 +1,22 @@
+import { textTag } from './xml.js';
+/** STS client — only GetCallerIdentity, used to derive the account id. */
+export class StsClient {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    async getAccountId() {
+        const res = await this.client.send({
+            service: 'sts',
+            method: 'POST',
+            path: '/',
+            headers: { 'content-type': 'application/x-www-form-urlencoded; charset=utf-8' },
+            body: 'Action=GetCallerIdentity&Version=2011-06-15',
+        });
+        const account = textTag(res.text(), 'Account');
+        if (!account)
+            throw new Error('STS GetCallerIdentity returned no Account');
+        return account;
+    }
+}
+//# sourceMappingURL=sts.js.map

package/dist/aws/sts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sts.js","sourceRoot":"","sources":["../../src/aws/sts.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAEnC,0EAA0E;AAC1E,MAAM,OAAO,SAAS;IACS;IAA7B,YAA6B,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;IAAG,CAAC;IAEtD,KAAK,CAAC,YAAY;QAChB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACjC,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG;YACT,OAAO,EAAE,EAAE,cAAc,EAAE,kDAAkD,EAAE;YAC/E,IAAI,EAAE,6CAA6C;SACpD,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC3E,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}