blogwright-core 0.3.2 → 0.4.0-beta.0

package/README.md

@@ -2,6 +2,6 @@
 
 SigV4 transport, per-service AWS HTTP clients, config parsing, and the S3 state store
 used by [blogwright](https://www.npmjs.com/package/blogwright). Not useful on its
-own — install `blogwright` instead.
+own - install `blogwright` instead.
 
 Full documentation: https://github.com/antstanley/blogwright

package/dist/adapters/memory-fs.js

@@ -51,4 +51,3 @@ export function createMemoryFileSystem(initialFiles = {}) {
         },
     };
 }
-//# sourceMappingURL=memory-fs.js.map

package/dist/adapters/node-fs.js

@@ -62,4 +62,3 @@ export function createNodeFileSystem() {
         },
     };
 }
-//# sourceMappingURL=node-fs.js.map

package/dist/adapters/node-terminal.d.ts

@@ -13,7 +13,7 @@ export interface TerminalStreams {
 export interface NodeTerminalOptions extends Partial<TerminalStreams> {
     /**
      * Force the minimal, machine-friendly presentation (`--plain`): the terminal
-     * reports non-interactive, so output is plain durable lines — no colour, no
+     * reports non-interactive, so output is plain durable lines - no colour, no
      * transient status, no prompts left hanging for automation.
      */
     plain?: boolean | undefined;
@@ -22,7 +22,7 @@ export interface NodeTerminalOptions extends Partial<TerminalStreams> {
 }
 /**
  * Build the real Terminal adapter over the process's standard streams. TTY
- * state is read once, at construction — never at module load or per call.
+ * state is read once, at construction - never at module load or per call.
  * The transient status line exists only on an interactive TTY; `write`/`error`
  * clear it first so durable lines never interleave with a stale status.
  */

package/dist/adapters/node-terminal.js

@@ -4,7 +4,7 @@ import { stripColors } from '../colors.js';
 const CLEAR_LINE = '\r\u001B[2K';
 /**
  * Build the real Terminal adapter over the process's standard streams. TTY
- * state is read once, at construction — never at module load or per call.
+ * state is read once, at construction - never at module load or per call.
  * The transient status line exists only on an interactive TTY; `write`/`error`
  * clear it first so durable lines never interleave with a stale status.
  */
@@ -55,4 +55,3 @@ export function createNodeTerminal(options = {}) {
         },
     };
 }
-//# sourceMappingURL=node-terminal.js.map

package/dist/adapters/script-terminal.js

@@ -35,4 +35,3 @@ export function createScriptedTerminal(options = {}) {
         },
     };
 }
-//# sourceMappingURL=script-terminal.js.map

package/dist/aws/acm.js

@@ -55,4 +55,3 @@ export class AcmClient {
         }
     }
 }
-//# sourceMappingURL=acm.js.map

package/dist/aws/cloudfront.d.ts

@@ -2,7 +2,7 @@ import type { SigningClient } from './signer.js';
 import type { ResourceTags } from '../tags.js';
 /** AWS managed "CachingOptimized" cache policy. */
 export declare const CACHING_OPTIMIZED = "658327ea-f89d-4fab-a63d-7e88639e58f6";
-/** AWS managed "CachingDisabled" cache policy (used for previews — no CDN caching). */
+/** AWS managed "CachingDisabled" cache policy (used for previews - no CDN caching). */
 export declare const CACHING_DISABLED = "4135ea2d-6df8-44a3-9df3-4b5a84be39ad";
 export interface DistributionSummary {
     id: string;
@@ -11,7 +11,7 @@ export interface DistributionSummary {
     status: string;
     etag: string | undefined;
 }
-/** One entry from ListDistributions — enough to identify a distribution for adoption. */
+/** One entry from ListDistributions - enough to identify a distribution for adoption. */
 export interface DistributionListItem {
     id: string;
     arn: string;
@@ -62,7 +62,7 @@ export declare class CloudFrontClient {
         etag: string;
     } | undefined>;
     /**
-     * Reconcile the distribution's aliases and viewer certificate in place — the
+     * Reconcile the distribution's aliases and viewer certificate in place - the
      * path taken when a domain is added (or changed) after the distribution was
      * first created. Compares semantically (CNAME set + certificate ARN), since
      * the returned config carries legacy elements our builder never emits.
@@ -72,7 +72,7 @@ export declare class CloudFrontClient {
     /**
      * Disable a distribution by flipping its top-level `<Enabled>` to false. The config
      * also contains `<Enabled>false</Enabled>` inside TrustedSigners/Logging, so the
-     * distribution-level flag must be matched specifically — it is the one immediately
+     * distribution-level flag must be matched specifically - it is the one immediately
      * followed by `<ViewerCertificate>` in the schema.
      */
     disableDistribution(id: string): Promise<void>;

package/dist/aws/cloudfront.js

@@ -4,7 +4,7 @@ const API = '/2020-05-31';
 const XMLNS = 'http://cloudfront.amazonaws.com/doc/2020-05-31/';
 /** AWS managed "CachingOptimized" cache policy. */
 export const CACHING_OPTIMIZED = '658327ea-f89d-4fab-a63d-7e88639e58f6';
-/** AWS managed "CachingDisabled" cache policy (used for previews — no CDN caching). */
+/** AWS managed "CachingDisabled" cache policy (used for previews - no CDN caching). */
 export const CACHING_DISABLED = '4135ea2d-6df8-44a3-9df3-4b5a84be39ad';
 /** CloudFront client (REST-XML). Global service, signed in us-east-1. */
 export class CloudFrontClient {
@@ -116,7 +116,7 @@ export class CloudFrontClient {
             service: 'cloudfront',
             method: 'POST',
             path: `${API}/tagging`,
-            // Operation=Tag is required — the tagging path is shared with UntagResource
+            // Operation=Tag is required - the tagging path is shared with UntagResource
             // (Operation=Untag) and CloudFront routes on it; without it: InvalidAction.
             query: { Operation: 'Tag', Resource: resourceArn },
             headers: { 'content-type': 'application/xml' },
@@ -140,7 +140,7 @@ export class CloudFrontClient {
         }
     }
     /**
-     * Reconcile the distribution's aliases and viewer certificate in place — the
+     * Reconcile the distribution's aliases and viewer certificate in place - the
      * path taken when a domain is added (or changed) after the distribution was
      * first created. Compares semantically (CNAME set + certificate ARN), since
      * the returned config carries legacy elements our builder never emits.
@@ -150,9 +150,7 @@ export class CloudFrontClient {
         const current = await this.getDistributionConfig(id);
         if (!current)
             throw new Error(`distribution ${id} not found while reconciling aliases`);
-        const currentAliases = [...current.config.matchAll(/<CNAME>(.*?)<\/CNAME>/g)]
-            .map((m) => m[1] ?? '')
-            .sort();
+        const currentAliases = Array.from(current.config.matchAll(/<CNAME>(.*?)<\/CNAME>/g), (m) => m[1] ?? '').sort();
         const currentCert = textTag(current.config, 'ACMCertificateArn');
         const sameAliases = currentAliases.length === aliases.length &&
             [...aliases].sort().every((a, i) => a === currentAliases[i]);
@@ -173,7 +171,7 @@ export class CloudFrontClient {
     /**
      * Disable a distribution by flipping its top-level `<Enabled>` to false. The config
      * also contains `<Enabled>false</Enabled>` inside TrustedSigners/Logging, so the
-     * distribution-level flag must be matched specifically — it is the one immediately
+     * distribution-level flag must be matched specifically - it is the one immediately
      * followed by `<ViewerCertificate>` in the schema.
      */
     async disableDistribution(id) {
@@ -242,7 +240,7 @@ export class CloudFrontClient {
     async describeFunction(name) {
         // DescribeFunction is GET …/function/{name}/describe (XML summary). The
         // bare GET …/function/{name} is GetFunction, whose body is the raw code
-        // bytes — no FunctionARN to parse.
+        // bytes - no FunctionARN to parse.
         try {
             const res = await this.client.send({
                 service: 'cloudfront',
@@ -279,7 +277,7 @@ export class CloudFrontClient {
             });
         }
         // Re-read the current ETag before publishing. Create/update return a fresh ETag, but
-        // it isn't reliably surfaced from the response headers — publishing the DEVELOPMENT
+        // it isn't reliably surfaced from the response headers - publishing the DEVELOPMENT
         // stage with a stale ETag fails the precondition (HTTP 412), which is what broke
         // reconciling an already-existing function.
         const current = await this.describeFunction(name);
@@ -381,4 +379,3 @@ function buildDistributionConfig(input) {
         `<IsIPV6Enabled>true</IsIPV6Enabled>` +
         `</DistributionConfig>`);
 }
-//# sourceMappingURL=cloudfront.js.map

package/dist/aws/credentials.d.ts

@@ -10,7 +10,7 @@ export type CredentialProvider = () => Promise<AwsCredentials>;
  *
  * When an endpoint override is in play (floci/localstack) and no real credentials
  * are configured, fall back to the emulator's dummy `test/test` pair so signing
- * still succeeds — floci does not validate signatures.
+ * still succeeds - floci does not validate signatures.
  */
 export declare function createCredentialProvider(opts: {
     override?: boolean | undefined;

package/dist/aws/credentials.js

@@ -5,7 +5,7 @@ import { fromNodeProviderChain } from '@aws-sdk/credential-providers';
  *
  * When an endpoint override is in play (floci/localstack) and no real credentials
  * are configured, fall back to the emulator's dummy `test/test` pair so signing
- * still succeeds — floci does not validate signatures.
+ * still succeeds - floci does not validate signatures.
  */
 export function createCredentialProvider(opts) {
     const chain = fromNodeProviderChain();
@@ -33,4 +33,3 @@ export function createCredentialProvider(opts) {
 export function staticCredentials(creds) {
     return () => Promise.resolve(creds);
 }
-//# sourceMappingURL=credentials.js.map

package/dist/aws/endpoint.d.ts

@@ -8,7 +8,7 @@
 export interface ResolvedEndpoint {
     protocol: 'http:' | 'https:';
     host: string;
-    /** Signing region — some services (iam, cloudfront) are global and sign as us-east-1. */
+    /** Signing region - some services (iam, cloudfront) are global and sign as us-east-1. */
     signingRegion: string;
     /** True when talking to an override origin (floci/localstack); forces S3 path-style. */
     override: boolean;
@@ -26,4 +26,24 @@ export declare const SIGNING_NAMES: {
     readonly secretsmanager: "secretsmanager";
 };
 export type ServiceKey = keyof typeof SIGNING_NAMES;
-export declare function resolveEndpoint(service: ServiceKey, region: string, override: string | undefined): ResolvedEndpoint;
+/**
+ * A plugin-supplied AWS service - core does not enumerate it, so the plugin names
+ * its own SigV4 signing name and whether it is global (signs in us-east-1).
+ */
+export interface ServiceDescriptor {
+    service: string;
+    signingName: string;
+    global?: boolean | undefined;
+}
+/** What every `service`-keyed site actually needs, whichever form `service` arrived in. */
+export interface ResolvedService {
+    name: string;
+    signingName: string;
+    global: boolean;
+}
+/**
+ * Turns a core `ServiceKey` or a plugin-supplied `ServiceDescriptor` into one shape.
+ * The single resolution helper every `service`-keyed site reads.
+ */
+export declare function resolveService(service: ServiceKey | ServiceDescriptor): ResolvedService;
+export declare function resolveEndpoint(service: ServiceKey | ServiceDescriptor, region: string, override: string | undefined): ResolvedEndpoint;

package/dist/aws/endpoint.js

@@ -21,8 +21,27 @@ export const SIGNING_NAMES = {
 };
 /** Services that are global; they always sign in us-east-1. */
 const GLOBAL_SERVICES = new Set(['iam', 'cloudfront', 'route53']);
+/**
+ * Turns a core `ServiceKey` or a plugin-supplied `ServiceDescriptor` into one shape.
+ * The single resolution helper every `service`-keyed site reads.
+ */
+export function resolveService(service) {
+    if (typeof service === 'string') {
+        return {
+            name: service,
+            signingName: SIGNING_NAMES[service],
+            global: GLOBAL_SERVICES.has(service),
+        };
+    }
+    return {
+        name: service.service,
+        signingName: service.signingName,
+        global: service.global ?? false,
+    };
+}
 export function resolveEndpoint(service, region, override) {
-    const signingRegion = GLOBAL_SERVICES.has(service) ? 'us-east-1' : region;
+    const resolved = resolveService(service);
+    const signingRegion = resolved.global ? 'us-east-1' : region;
     if (override) {
         const url = new URL(override);
         return {
@@ -34,7 +53,7 @@ export function resolveEndpoint(service, region, override) {
     }
     return {
         protocol: 'https:',
-        host: canonicalHost(service, region),
+        host: canonicalHost(resolved.name, region),
         signingRegion,
         override: false,
     };
@@ -55,4 +74,3 @@ function canonicalHost(service, region) {
             return `${service}.${region}.amazonaws.com`;
     }
 }
-//# sourceMappingURL=endpoint.js.map

package/dist/aws/errors.js

@@ -5,7 +5,7 @@ export class AwsError extends Error {
     requestId;
     service;
     constructor(opts) {
-        super(`${opts.service}: ${opts.code} — ${opts.message} (HTTP ${opts.statusCode})`);
+        super(`${opts.service}: ${opts.code} - ${opts.message} (HTTP ${opts.statusCode})`);
         this.name = 'AwsError';
         this.service = opts.service;
         this.code = opts.code;
@@ -32,4 +32,3 @@ export function isRetryable(err) {
     // Network-level failures (fetch throws TypeError) are retryable.
     return err instanceof TypeError;
 }
-//# sourceMappingURL=errors.js.map

package/dist/aws/form.js

@@ -8,4 +8,3 @@ export function formEncode(params) {
 function encode(value) {
     return encodeURIComponent(value).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
 }
-//# sourceMappingURL=form.js.map

package/dist/aws/iam.d.ts

@@ -1,6 +1,6 @@
 import type { ResourceTags } from '../tags.js';
 import type { SigningClient } from './signer.js';
-/** IAM client (query protocol) — roles with inline policies. */
+/** IAM client (query protocol) - roles with inline policies. */
 export declare class IamClient {
     private readonly client;
     constructor(client: SigningClient);

package/dist/aws/iam.js

@@ -2,7 +2,7 @@ import { AwsError } from './errors.js';
 import { formEncode } from './form.js';
 import { allTags, textTag } from './xml.js';
 const VERSION = '2010-05-08';
-/** IAM client (query protocol) — roles with inline policies. */
+/** IAM client (query protocol) - roles with inline policies. */
 export class IamClient {
     client;
     constructor(client) {
@@ -131,4 +131,3 @@ export class IamClient {
         }
     }
 }
-//# sourceMappingURL=iam.js.map

package/dist/aws/logs.d.ts

@@ -9,6 +9,26 @@ export interface FilterEventsOptions {
     startTime?: number | undefined;
     endTime?: number | undefined;
 }
+/** The format CloudWatch Logs writes records in for a vended log delivery. */
+export type DeliveryOutputFormat = 'json' | 'plain' | 'w3c' | 'raw' | 'parquet';
+export interface DeliveryDestinationOptions {
+    outputFormat?: DeliveryOutputFormat | undefined;
+}
+export interface DeliveryOptions {
+    recordFields?: readonly string[] | undefined;
+    fieldDelimiter?: string | undefined;
+}
+/**
+ * One delivery attached to a delivery source. The destination ARN travels with
+ * the id because a delivery source is shared - AWS permits exactly one per
+ * distribution - so a caller tearing its own wiring down has to tell its
+ * delivery from someone else's, and the destination it feeds is the only thing
+ * that distinguishes them. `DescribeDeliveries` already returns the field.
+ */
+export interface DeliverySummary {
+    id: string;
+    deliveryDestinationArn: string;
+}
 /** CloudWatch Logs client (AWS JSON 1.1). */
 export declare class LogsClient {
     private readonly client;
@@ -21,12 +41,12 @@ export declare class LogsClient {
     /** Fetch events across a log group within an optional time window. */
     filterEvents(logGroupName: string, opts?: FilterEventsOptions): Promise<LogEvent[]>;
     putDeliverySource(name: string, resourceArn: string, logType: string, tags?: ResourceTags): Promise<string>;
-    putDeliveryDestination(name: string, logGroupArn: string): Promise<string>;
-    createDelivery(deliverySourceName: string, deliveryDestinationArn: string): Promise<void>;
+    putDeliveryDestination(name: string, logGroupArn: string, opts?: DeliveryDestinationOptions): Promise<string>;
+    createDelivery(deliverySourceName: string, deliveryDestinationArn: string, opts?: DeliveryOptions): Promise<void>;
     /** The delivery id linking a given source (needed to delete it), or undefined if none. */
     findDeliveryIdBySource(deliverySourceName: string): Promise<string | undefined>;
-    /** Ids of every delivery attached to a delivery source. */
-    deliveriesForSource(sourceName: string): Promise<string[]>;
+    /** Every delivery attached to a delivery source, each paired with the destination it feeds. */
+    deliveriesForSource(sourceName: string): Promise<DeliverySummary[]>;
     deleteDelivery(id: string): Promise<void>;
     deleteDeliverySource(name: string): Promise<void>;
     deleteDeliveryDestination(name: string): Promise<void>;

package/dist/aws/logs.js

@@ -78,13 +78,22 @@ export class LogsClient {
         });
         return out.deliverySource?.arn ?? '';
     }
-    async putDeliveryDestination(name, logGroupArn) {
-        const out = await this.call('PutDeliveryDestination', { name, deliveryDestinationConfiguration: { destinationResourceArn: logGroupArn } });
+    async putDeliveryDestination(name, logGroupArn, opts = {}) {
+        const out = await this.call('PutDeliveryDestination', {
+            name,
+            deliveryDestinationConfiguration: { destinationResourceArn: logGroupArn },
+            ...(opts.outputFormat !== undefined ? { outputFormat: opts.outputFormat } : {}),
+        });
         return out.deliveryDestination?.arn ?? '';
     }
-    async createDelivery(deliverySourceName, deliveryDestinationArn) {
+    async createDelivery(deliverySourceName, deliveryDestinationArn, opts = {}) {
         try {
-            await this.call('CreateDelivery', { deliverySourceName, deliveryDestinationArn });
+            await this.call('CreateDelivery', {
+                deliverySourceName,
+                deliveryDestinationArn,
+                ...(opts.recordFields !== undefined ? { recordFields: opts.recordFields } : {}),
+                ...(opts.fieldDelimiter !== undefined ? { fieldDelimiter: opts.fieldDelimiter } : {}),
+            });
         }
         catch (err) {
             if (err instanceof AwsError && err.isAlreadyExists)
@@ -104,19 +113,20 @@ export class LogsClient {
         } while (nextToken);
         return undefined;
     }
-    /** Ids of every delivery attached to a delivery source. */
+    /** Every delivery attached to a delivery source, each paired with the destination it feeds. */
     async deliveriesForSource(sourceName) {
-        const ids = [];
+        const deliveries = [];
         let nextToken;
         do {
             const out = await this.call('DescribeDeliveries', nextToken ? { nextToken } : {});
             for (const d of out.deliveries ?? []) {
-                if (d.deliverySourceName === sourceName)
-                    ids.push(d.id);
+                if (d.deliverySourceName === sourceName) {
+                    deliveries.push({ id: d.id, deliveryDestinationArn: d.deliveryDestinationArn ?? '' });
+                }
             }
             nextToken = out.nextToken;
         } while (nextToken);
-        return ids;
+        return deliveries;
     }
     async deleteDelivery(id) {
         try {
@@ -149,4 +159,3 @@ export class LogsClient {
         }
     }
 }
-//# sourceMappingURL=logs.js.map

package/dist/aws/microvms.d.ts

@@ -73,7 +73,7 @@ export declare class MicrovmsClient {
      *
      * `maxResults` is always sent: the ListMicrovms operation defines it as a defaulted
      * query parameter, and the service normalizes a missing default into the request before
-     * validating the SigV4 signature — so omitting it produces an intermittent
+     * validating the SigV4 signature - so omitting it produces an intermittent
      * SignatureDoesNotMatch that GetMicrovm/DeleteMicrovm (no query params) never hit.
      */
     listMicrovms(opts?: {

package/dist/aws/microvms.js

@@ -84,7 +84,7 @@ export class MicrovmsClient {
         return normalizeImage(await this.call('POST', PATHS.images, body));
     }
     async updateImage(id, input) {
-        // A PUT is idempotent on the image itself, so no clientToken is needed — and reusing one
+        // A PUT is idempotent on the image itself, so no clientToken is needed - and reusing one
         // across separate update attempts triggers "clientToken used with different parameters".
         const { clientToken, ...body } = this.imageBody(input);
         void clientToken;
@@ -140,7 +140,7 @@ export class MicrovmsClient {
      *
      * `maxResults` is always sent: the ListMicrovms operation defines it as a defaulted
      * query parameter, and the service normalizes a missing default into the request before
-     * validating the SigV4 signature — so omitting it produces an intermittent
+     * validating the SigV4 signature - so omitting it produces an intermittent
      * SignatureDoesNotMatch that GetMicrovm/DeleteMicrovm (no query params) never hit.
      */
     async listMicrovms(opts = {}) {
@@ -179,4 +179,3 @@ export class MicrovmsClient {
         return out.authToken?.['X-aws-proxy-auth'] ?? '';
     }
 }
-//# sourceMappingURL=microvms.js.map

package/dist/aws/route53.d.ts

@@ -8,7 +8,7 @@ export interface DnsRecord {
     /** When set, emit an AliasTarget (no TTL/ResourceRecords) pointing at `value`. */
     aliasZoneId?: string | undefined;
 }
-/** CloudFront's fixed alias hosted zone id — the same for every distribution. */
+/** CloudFront's fixed alias hosted zone id - the same for every distribution. */
 export declare const CLOUDFRONT_ALIAS_ZONE_ID = "Z2FDTNDATAQYW2";
 /** Route53 client (REST-XML). Global service, signed in us-east-1. */
 export declare class Route53Client {

package/dist/aws/route53.js

@@ -1,7 +1,7 @@
 import { AwsError } from './errors.js';
 import { encodeEntities, textTag } from './xml.js';
 const API = '/2013-04-01';
-/** CloudFront's fixed alias hosted zone id — the same for every distribution. */
+/** CloudFront's fixed alias hosted zone id - the same for every distribution. */
 export const CLOUDFRONT_ALIAS_ZONE_ID = 'Z2FDTNDATAQYW2';
 /** Route53 client (REST-XML). Global service, signed in us-east-1. */
 export class Route53Client {
@@ -63,7 +63,7 @@ export class Route53Client {
             await this.change(zoneId, 'DELETE', record);
         }
         catch (err) {
-            // Route53 rejects a DELETE whose record doesn't exactly match/exist —
+            // Route53 rejects a DELETE whose record doesn't exactly match/exist -
             // that (and only that) means "already gone". Throttling, auth, and other
             // failures must surface, or a teardown leaves the record dangling while
             // reporting success.
@@ -74,4 +74,3 @@ export class Route53Client {
         }
     }
 }
-//# sourceMappingURL=route53.js.map

package/dist/aws/s3.js

@@ -195,7 +195,10 @@ export class S3Client {
             method: 'PUT',
             path: `/${bucket}`,
             query: { policy: '' },
-            headers: { 'content-type': 'application/json', 'x-amz-checksum-sha256': bodyChecksum(policy) },
+            headers: {
+                'content-type': 'application/json',
+                'x-amz-checksum-sha256': bodyChecksum(policy),
+            },
             body: policy,
         });
     }
@@ -204,4 +207,3 @@ export class S3Client {
         return encodeEntities(value);
     }
 }
-//# sourceMappingURL=s3.js.map

package/dist/aws/secretsmanager.js

@@ -84,4 +84,3 @@ export class SecretsManagerClient {
         }
     }
 }
-//# sourceMappingURL=secretsmanager.js.map

package/dist/aws/signer.d.ts

@@ -1,5 +1,5 @@
 import type { CredentialProvider } from './credentials.js';
-import { type ServiceKey } from './endpoint.js';
+import { type ServiceDescriptor, type ServiceKey } from './endpoint.js';
 export interface RawResponse {
     statusCode: number;
     headers: Record<string, string>;
@@ -14,7 +14,7 @@ export type Transport = (req: {
     body: string | Uint8Array | undefined;
 }) => Promise<RawResponse>;
 export interface SendOptions {
-    service: ServiceKey;
+    service: ServiceKey | ServiceDescriptor;
     method: string;
     /** Path starting with '/'. For S3 pass an already-percent-encoded path. */
     path: string;

package/dist/aws/signer.js

@@ -1,7 +1,7 @@
 import { Sha256 } from '@aws-crypto/sha256-js';
 import { HttpRequest } from '@smithy/protocol-http';
 import { SignatureV4 } from '@smithy/signature-v4';
-import { resolveEndpoint, SIGNING_NAMES } from './endpoint.js';
+import { resolveEndpoint, resolveService, } from './endpoint.js';
 import { AwsError, isRetryable } from './errors.js';
 import { withRetry } from '../util.js';
 import { textTag } from './xml.js';
@@ -51,6 +51,7 @@ export class SigningClient {
         this.transport = opts.transport ?? fetchTransport;
     }
     async send(opts) {
+        const resolved = resolveService(opts.service);
         const ep = resolveEndpoint(opts.service, this.region, this.endpointOverride);
         const [hostname, portStr] = ep.host.split(':');
         const port = portStr ? Number(portStr) : undefined;
@@ -76,7 +77,7 @@ export class SigningClient {
             ...(opts.body !== undefined ? { body: opts.body } : {}),
         });
         const signer = new SignatureV4({
-            service: SIGNING_NAMES[opts.service],
+            service: resolved.signingName,
             region: ep.signingRegion,
             credentials: async () => {
                 const c = await this.credentials();
@@ -87,7 +88,7 @@ export class SigningClient {
                 };
             },
             sha256: Sha256,
-            uriEscapePath: opts.service !== 's3',
+            uriEscapePath: resolved.name !== 's3',
         });
         const signed = await signer.sign(request);
         const qs = Object.keys(query)
@@ -96,7 +97,7 @@ export class SigningClient {
         const url = `${ep.protocol}//${ep.host}${opts.path}${qs ? `?${qs}` : ''}`;
         // Retry transient failures with backoff. For idempotent methods, retry on network
         // errors and 5xx/429. For non-idempotent POSTs, retry ONLY on network errors (the
-        // request never reached the server) — never on a 5xx, which may mean the mutation
+        // request never reached the server) - never on a 5xx, which may mean the mutation
         // was applied and a retry would double-execute (e.g. launch a second MicroVM).
         const idempotent = ['GET', 'HEAD', 'PUT', 'DELETE'].includes(opts.method);
         const retryable = idempotent ? isRetryable : (err) => err instanceof TypeError;
@@ -109,10 +110,10 @@ export class SigningClient {
             });
             // Anything outside 2xx is a failure. 3xx matters: S3's region-mismatch
             // PermanentRedirect is a 301 with no Location header, which fetch
-            // returns as final — treating it as success would report writes as
+            // returns as final - treating it as success would report writes as
             // stored and listings as empty against the wrong endpoint.
             if (response.statusCode >= 300)
-                throw parseError(opts.service, response);
+                throw parseError(resolved.name, response);
             return response;
         }, { retryable });
     }
@@ -141,4 +142,3 @@ function parseError(service, response) {
     }
     return new AwsError({ service, code, message, statusCode: response.statusCode, requestId });
 }
-//# sourceMappingURL=signer.js.map

package/dist/aws/sts.d.ts

@@ -1,5 +1,5 @@
 import type { SigningClient } from './signer.js';
-/** STS client — only GetCallerIdentity, used to derive the account id. */
+/** STS client - only GetCallerIdentity, used to derive the account id. */
 export declare class StsClient {
     private readonly client;
     constructor(client: SigningClient);

package/dist/aws/sts.js

@@ -1,5 +1,5 @@
 import { textTag } from './xml.js';
-/** STS client — only GetCallerIdentity, used to derive the account id. */
+/** STS client - only GetCallerIdentity, used to derive the account id. */
 export class StsClient {
     client;
     constructor(client) {
@@ -19,4 +19,3 @@ export class StsClient {
         return account;
     }
 }
-//# sourceMappingURL=sts.js.map

package/dist/aws/xml.d.ts

@@ -1,6 +1,6 @@
 /**
  * Minimal XML helpers for the handful of AWS REST-XML / query responses this CLI
- * reads (S3, STS, IAM, CloudFront). Not a general XML parser — it extracts tag
+ * reads (S3, STS, IAM, CloudFront). Not a general XML parser - it extracts tag
  * contents by name, which is sufficient for the flat response shapes we consume.
  */
 export declare function decodeEntities(value: string): string;
@@ -10,7 +10,7 @@ export declare function firstTag(xml: string, name: string): string | undefined;
 /** Return the decoded text value of the first `<name>` element. */
 export declare function textTag(xml: string, name: string): string | undefined;
 /**
- * Like {@link textTag} but verbatim — no trimming. For values where whitespace
+ * Like {@link textTag} but verbatim - no trimming. For values where whitespace
  * is data, like S3 object keys (a trimmed key would target a different object).
  */
 export declare function rawTextTag(xml: string, name: string): string | undefined;