blogwright-core 0.3.3 → 0.4.0-beta.0

package/README.md

@@ -2,6 +2,6 @@
 
 SigV4 transport, per-service AWS HTTP clients, config parsing, and the S3 state store
 used by [blogwright](https://www.npmjs.com/package/blogwright). Not useful on its
-own — install `blogwright` instead.
+own - install `blogwright` instead.
 
 Full documentation: https://github.com/antstanley/blogwright

package/dist/adapters/node-terminal.d.ts

@@ -13,7 +13,7 @@ export interface TerminalStreams {
 export interface NodeTerminalOptions extends Partial<TerminalStreams> {
     /**
      * Force the minimal, machine-friendly presentation (`--plain`): the terminal
-     * reports non-interactive, so output is plain durable lines — no colour, no
+     * reports non-interactive, so output is plain durable lines - no colour, no
      * transient status, no prompts left hanging for automation.
      */
     plain?: boolean | undefined;
@@ -22,7 +22,7 @@ export interface NodeTerminalOptions extends Partial<TerminalStreams> {
 }
 /**
  * Build the real Terminal adapter over the process's standard streams. TTY
- * state is read once, at construction — never at module load or per call.
+ * state is read once, at construction - never at module load or per call.
  * The transient status line exists only on an interactive TTY; `write`/`error`
  * clear it first so durable lines never interleave with a stale status.
  */

package/dist/adapters/node-terminal.js

@@ -4,7 +4,7 @@ import { stripColors } from '../colors.js';
 const CLEAR_LINE = '\r\u001B[2K';
 /**
  * Build the real Terminal adapter over the process's standard streams. TTY
- * state is read once, at construction — never at module load or per call.
+ * state is read once, at construction - never at module load or per call.
  * The transient status line exists only on an interactive TTY; `write`/`error`
  * clear it first so durable lines never interleave with a stale status.
  */

package/dist/aws/cloudfront.d.ts

@@ -2,7 +2,7 @@ import type { SigningClient } from './signer.js';
 import type { ResourceTags } from '../tags.js';
 /** AWS managed "CachingOptimized" cache policy. */
 export declare const CACHING_OPTIMIZED = "658327ea-f89d-4fab-a63d-7e88639e58f6";
-/** AWS managed "CachingDisabled" cache policy (used for previews — no CDN caching). */
+/** AWS managed "CachingDisabled" cache policy (used for previews - no CDN caching). */
 export declare const CACHING_DISABLED = "4135ea2d-6df8-44a3-9df3-4b5a84be39ad";
 export interface DistributionSummary {
     id: string;
@@ -11,7 +11,7 @@ export interface DistributionSummary {
     status: string;
     etag: string | undefined;
 }
-/** One entry from ListDistributions — enough to identify a distribution for adoption. */
+/** One entry from ListDistributions - enough to identify a distribution for adoption. */
 export interface DistributionListItem {
     id: string;
     arn: string;
@@ -62,7 +62,7 @@ export declare class CloudFrontClient {
         etag: string;
     } | undefined>;
     /**
-     * Reconcile the distribution's aliases and viewer certificate in place — the
+     * Reconcile the distribution's aliases and viewer certificate in place - the
      * path taken when a domain is added (or changed) after the distribution was
      * first created. Compares semantically (CNAME set + certificate ARN), since
      * the returned config carries legacy elements our builder never emits.
@@ -72,7 +72,7 @@ export declare class CloudFrontClient {
     /**
      * Disable a distribution by flipping its top-level `<Enabled>` to false. The config
      * also contains `<Enabled>false</Enabled>` inside TrustedSigners/Logging, so the
-     * distribution-level flag must be matched specifically — it is the one immediately
+     * distribution-level flag must be matched specifically - it is the one immediately
      * followed by `<ViewerCertificate>` in the schema.
      */
     disableDistribution(id: string): Promise<void>;

package/dist/aws/cloudfront.js

@@ -4,7 +4,7 @@ const API = '/2020-05-31';
 const XMLNS = 'http://cloudfront.amazonaws.com/doc/2020-05-31/';
 /** AWS managed "CachingOptimized" cache policy. */
 export const CACHING_OPTIMIZED = '658327ea-f89d-4fab-a63d-7e88639e58f6';
-/** AWS managed "CachingDisabled" cache policy (used for previews — no CDN caching). */
+/** AWS managed "CachingDisabled" cache policy (used for previews - no CDN caching). */
 export const CACHING_DISABLED = '4135ea2d-6df8-44a3-9df3-4b5a84be39ad';
 /** CloudFront client (REST-XML). Global service, signed in us-east-1. */
 export class CloudFrontClient {
@@ -116,7 +116,7 @@ export class CloudFrontClient {
             service: 'cloudfront',
             method: 'POST',
             path: `${API}/tagging`,
-            // Operation=Tag is required — the tagging path is shared with UntagResource
+            // Operation=Tag is required - the tagging path is shared with UntagResource
             // (Operation=Untag) and CloudFront routes on it; without it: InvalidAction.
             query: { Operation: 'Tag', Resource: resourceArn },
             headers: { 'content-type': 'application/xml' },
@@ -140,7 +140,7 @@ export class CloudFrontClient {
         }
     }
     /**
-     * Reconcile the distribution's aliases and viewer certificate in place — the
+     * Reconcile the distribution's aliases and viewer certificate in place - the
      * path taken when a domain is added (or changed) after the distribution was
      * first created. Compares semantically (CNAME set + certificate ARN), since
      * the returned config carries legacy elements our builder never emits.
@@ -171,7 +171,7 @@ export class CloudFrontClient {
     /**
      * Disable a distribution by flipping its top-level `<Enabled>` to false. The config
      * also contains `<Enabled>false</Enabled>` inside TrustedSigners/Logging, so the
-     * distribution-level flag must be matched specifically — it is the one immediately
+     * distribution-level flag must be matched specifically - it is the one immediately
      * followed by `<ViewerCertificate>` in the schema.
      */
     async disableDistribution(id) {
@@ -240,7 +240,7 @@ export class CloudFrontClient {
     async describeFunction(name) {
         // DescribeFunction is GET …/function/{name}/describe (XML summary). The
         // bare GET …/function/{name} is GetFunction, whose body is the raw code
-        // bytes — no FunctionARN to parse.
+        // bytes - no FunctionARN to parse.
         try {
             const res = await this.client.send({
                 service: 'cloudfront',
@@ -277,7 +277,7 @@ export class CloudFrontClient {
             });
         }
         // Re-read the current ETag before publishing. Create/update return a fresh ETag, but
-        // it isn't reliably surfaced from the response headers — publishing the DEVELOPMENT
+        // it isn't reliably surfaced from the response headers - publishing the DEVELOPMENT
         // stage with a stale ETag fails the precondition (HTTP 412), which is what broke
         // reconciling an already-existing function.
         const current = await this.describeFunction(name);

package/dist/aws/credentials.d.ts

@@ -10,7 +10,7 @@ export type CredentialProvider = () => Promise<AwsCredentials>;
  *
  * When an endpoint override is in play (floci/localstack) and no real credentials
  * are configured, fall back to the emulator's dummy `test/test` pair so signing
- * still succeeds — floci does not validate signatures.
+ * still succeeds - floci does not validate signatures.
  */
 export declare function createCredentialProvider(opts: {
     override?: boolean | undefined;

package/dist/aws/credentials.js

@@ -5,7 +5,7 @@ import { fromNodeProviderChain } from '@aws-sdk/credential-providers';
  *
  * When an endpoint override is in play (floci/localstack) and no real credentials
  * are configured, fall back to the emulator's dummy `test/test` pair so signing
- * still succeeds — floci does not validate signatures.
+ * still succeeds - floci does not validate signatures.
  */
 export function createCredentialProvider(opts) {
     const chain = fromNodeProviderChain();

package/dist/aws/endpoint.d.ts

@@ -8,7 +8,7 @@
 export interface ResolvedEndpoint {
     protocol: 'http:' | 'https:';
     host: string;
-    /** Signing region — some services (iam, cloudfront) are global and sign as us-east-1. */
+    /** Signing region - some services (iam, cloudfront) are global and sign as us-east-1. */
     signingRegion: string;
     /** True when talking to an override origin (floci/localstack); forces S3 path-style. */
     override: boolean;
@@ -26,4 +26,24 @@ export declare const SIGNING_NAMES: {
     readonly secretsmanager: "secretsmanager";
 };
 export type ServiceKey = keyof typeof SIGNING_NAMES;
-export declare function resolveEndpoint(service: ServiceKey, region: string, override: string | undefined): ResolvedEndpoint;
+/**
+ * A plugin-supplied AWS service - core does not enumerate it, so the plugin names
+ * its own SigV4 signing name and whether it is global (signs in us-east-1).
+ */
+export interface ServiceDescriptor {
+    service: string;
+    signingName: string;
+    global?: boolean | undefined;
+}
+/** What every `service`-keyed site actually needs, whichever form `service` arrived in. */
+export interface ResolvedService {
+    name: string;
+    signingName: string;
+    global: boolean;
+}
+/**
+ * Turns a core `ServiceKey` or a plugin-supplied `ServiceDescriptor` into one shape.
+ * The single resolution helper every `service`-keyed site reads.
+ */
+export declare function resolveService(service: ServiceKey | ServiceDescriptor): ResolvedService;
+export declare function resolveEndpoint(service: ServiceKey | ServiceDescriptor, region: string, override: string | undefined): ResolvedEndpoint;

package/dist/aws/endpoint.js

@@ -21,8 +21,27 @@ export const SIGNING_NAMES = {
 };
 /** Services that are global; they always sign in us-east-1. */
 const GLOBAL_SERVICES = new Set(['iam', 'cloudfront', 'route53']);
+/**
+ * Turns a core `ServiceKey` or a plugin-supplied `ServiceDescriptor` into one shape.
+ * The single resolution helper every `service`-keyed site reads.
+ */
+export function resolveService(service) {
+    if (typeof service === 'string') {
+        return {
+            name: service,
+            signingName: SIGNING_NAMES[service],
+            global: GLOBAL_SERVICES.has(service),
+        };
+    }
+    return {
+        name: service.service,
+        signingName: service.signingName,
+        global: service.global ?? false,
+    };
+}
 export function resolveEndpoint(service, region, override) {
-    const signingRegion = GLOBAL_SERVICES.has(service) ? 'us-east-1' : region;
+    const resolved = resolveService(service);
+    const signingRegion = resolved.global ? 'us-east-1' : region;
     if (override) {
         const url = new URL(override);
         return {
@@ -34,7 +53,7 @@ export function resolveEndpoint(service, region, override) {
     }
     return {
         protocol: 'https:',
-        host: canonicalHost(service, region),
+        host: canonicalHost(resolved.name, region),
         signingRegion,
         override: false,
     };

package/dist/aws/errors.js

@@ -5,7 +5,7 @@ export class AwsError extends Error {
     requestId;
     service;
     constructor(opts) {
-        super(`${opts.service}: ${opts.code} — ${opts.message} (HTTP ${opts.statusCode})`);
+        super(`${opts.service}: ${opts.code} - ${opts.message} (HTTP ${opts.statusCode})`);
         this.name = 'AwsError';
         this.service = opts.service;
         this.code = opts.code;

package/dist/aws/iam.d.ts

@@ -1,6 +1,6 @@
 import type { ResourceTags } from '../tags.js';
 import type { SigningClient } from './signer.js';
-/** IAM client (query protocol) — roles with inline policies. */
+/** IAM client (query protocol) - roles with inline policies. */
 export declare class IamClient {
     private readonly client;
     constructor(client: SigningClient);

package/dist/aws/iam.js

@@ -2,7 +2,7 @@ import { AwsError } from './errors.js';
 import { formEncode } from './form.js';
 import { allTags, textTag } from './xml.js';
 const VERSION = '2010-05-08';
-/** IAM client (query protocol) — roles with inline policies. */
+/** IAM client (query protocol) - roles with inline policies. */
 export class IamClient {
     client;
     constructor(client) {

package/dist/aws/logs.d.ts

@@ -9,6 +9,26 @@ export interface FilterEventsOptions {
     startTime?: number | undefined;
     endTime?: number | undefined;
 }
+/** The format CloudWatch Logs writes records in for a vended log delivery. */
+export type DeliveryOutputFormat = 'json' | 'plain' | 'w3c' | 'raw' | 'parquet';
+export interface DeliveryDestinationOptions {
+    outputFormat?: DeliveryOutputFormat | undefined;
+}
+export interface DeliveryOptions {
+    recordFields?: readonly string[] | undefined;
+    fieldDelimiter?: string | undefined;
+}
+/**
+ * One delivery attached to a delivery source. The destination ARN travels with
+ * the id because a delivery source is shared - AWS permits exactly one per
+ * distribution - so a caller tearing its own wiring down has to tell its
+ * delivery from someone else's, and the destination it feeds is the only thing
+ * that distinguishes them. `DescribeDeliveries` already returns the field.
+ */
+export interface DeliverySummary {
+    id: string;
+    deliveryDestinationArn: string;
+}
 /** CloudWatch Logs client (AWS JSON 1.1). */
 export declare class LogsClient {
     private readonly client;
@@ -21,12 +41,12 @@ export declare class LogsClient {
     /** Fetch events across a log group within an optional time window. */
     filterEvents(logGroupName: string, opts?: FilterEventsOptions): Promise<LogEvent[]>;
     putDeliverySource(name: string, resourceArn: string, logType: string, tags?: ResourceTags): Promise<string>;
-    putDeliveryDestination(name: string, logGroupArn: string): Promise<string>;
-    createDelivery(deliverySourceName: string, deliveryDestinationArn: string): Promise<void>;
+    putDeliveryDestination(name: string, logGroupArn: string, opts?: DeliveryDestinationOptions): Promise<string>;
+    createDelivery(deliverySourceName: string, deliveryDestinationArn: string, opts?: DeliveryOptions): Promise<void>;
     /** The delivery id linking a given source (needed to delete it), or undefined if none. */
     findDeliveryIdBySource(deliverySourceName: string): Promise<string | undefined>;
-    /** Ids of every delivery attached to a delivery source. */
-    deliveriesForSource(sourceName: string): Promise<string[]>;
+    /** Every delivery attached to a delivery source, each paired with the destination it feeds. */
+    deliveriesForSource(sourceName: string): Promise<DeliverySummary[]>;
     deleteDelivery(id: string): Promise<void>;
     deleteDeliverySource(name: string): Promise<void>;
     deleteDeliveryDestination(name: string): Promise<void>;

package/dist/aws/logs.js

@@ -78,13 +78,22 @@ export class LogsClient {
         });
         return out.deliverySource?.arn ?? '';
     }
-    async putDeliveryDestination(name, logGroupArn) {
-        const out = await this.call('PutDeliveryDestination', { name, deliveryDestinationConfiguration: { destinationResourceArn: logGroupArn } });
+    async putDeliveryDestination(name, logGroupArn, opts = {}) {
+        const out = await this.call('PutDeliveryDestination', {
+            name,
+            deliveryDestinationConfiguration: { destinationResourceArn: logGroupArn },
+            ...(opts.outputFormat !== undefined ? { outputFormat: opts.outputFormat } : {}),
+        });
         return out.deliveryDestination?.arn ?? '';
     }
-    async createDelivery(deliverySourceName, deliveryDestinationArn) {
+    async createDelivery(deliverySourceName, deliveryDestinationArn, opts = {}) {
         try {
-            await this.call('CreateDelivery', { deliverySourceName, deliveryDestinationArn });
+            await this.call('CreateDelivery', {
+                deliverySourceName,
+                deliveryDestinationArn,
+                ...(opts.recordFields !== undefined ? { recordFields: opts.recordFields } : {}),
+                ...(opts.fieldDelimiter !== undefined ? { fieldDelimiter: opts.fieldDelimiter } : {}),
+            });
         }
         catch (err) {
             if (err instanceof AwsError && err.isAlreadyExists)
@@ -104,19 +113,20 @@ export class LogsClient {
         } while (nextToken);
         return undefined;
     }
-    /** Ids of every delivery attached to a delivery source. */
+    /** Every delivery attached to a delivery source, each paired with the destination it feeds. */
     async deliveriesForSource(sourceName) {
-        const ids = [];
+        const deliveries = [];
         let nextToken;
         do {
             const out = await this.call('DescribeDeliveries', nextToken ? { nextToken } : {});
             for (const d of out.deliveries ?? []) {
-                if (d.deliverySourceName === sourceName)
-                    ids.push(d.id);
+                if (d.deliverySourceName === sourceName) {
+                    deliveries.push({ id: d.id, deliveryDestinationArn: d.deliveryDestinationArn ?? '' });
+                }
             }
             nextToken = out.nextToken;
         } while (nextToken);
-        return ids;
+        return deliveries;
     }
     async deleteDelivery(id) {
         try {

package/dist/aws/microvms.d.ts

@@ -73,7 +73,7 @@ export declare class MicrovmsClient {
      *
      * `maxResults` is always sent: the ListMicrovms operation defines it as a defaulted
      * query parameter, and the service normalizes a missing default into the request before
-     * validating the SigV4 signature — so omitting it produces an intermittent
+     * validating the SigV4 signature - so omitting it produces an intermittent
      * SignatureDoesNotMatch that GetMicrovm/DeleteMicrovm (no query params) never hit.
      */
     listMicrovms(opts?: {

package/dist/aws/microvms.js

@@ -84,7 +84,7 @@ export class MicrovmsClient {
         return normalizeImage(await this.call('POST', PATHS.images, body));
     }
     async updateImage(id, input) {
-        // A PUT is idempotent on the image itself, so no clientToken is needed — and reusing one
+        // A PUT is idempotent on the image itself, so no clientToken is needed - and reusing one
         // across separate update attempts triggers "clientToken used with different parameters".
         const { clientToken, ...body } = this.imageBody(input);
         void clientToken;
@@ -140,7 +140,7 @@ export class MicrovmsClient {
      *
      * `maxResults` is always sent: the ListMicrovms operation defines it as a defaulted
      * query parameter, and the service normalizes a missing default into the request before
-     * validating the SigV4 signature — so omitting it produces an intermittent
+     * validating the SigV4 signature - so omitting it produces an intermittent
      * SignatureDoesNotMatch that GetMicrovm/DeleteMicrovm (no query params) never hit.
      */
     async listMicrovms(opts = {}) {

package/dist/aws/route53.d.ts

@@ -8,7 +8,7 @@ export interface DnsRecord {
     /** When set, emit an AliasTarget (no TTL/ResourceRecords) pointing at `value`. */
     aliasZoneId?: string | undefined;
 }
-/** CloudFront's fixed alias hosted zone id — the same for every distribution. */
+/** CloudFront's fixed alias hosted zone id - the same for every distribution. */
 export declare const CLOUDFRONT_ALIAS_ZONE_ID = "Z2FDTNDATAQYW2";
 /** Route53 client (REST-XML). Global service, signed in us-east-1. */
 export declare class Route53Client {

package/dist/aws/route53.js

@@ -1,7 +1,7 @@
 import { AwsError } from './errors.js';
 import { encodeEntities, textTag } from './xml.js';
 const API = '/2013-04-01';
-/** CloudFront's fixed alias hosted zone id — the same for every distribution. */
+/** CloudFront's fixed alias hosted zone id - the same for every distribution. */
 export const CLOUDFRONT_ALIAS_ZONE_ID = 'Z2FDTNDATAQYW2';
 /** Route53 client (REST-XML). Global service, signed in us-east-1. */
 export class Route53Client {
@@ -63,7 +63,7 @@ export class Route53Client {
             await this.change(zoneId, 'DELETE', record);
         }
         catch (err) {
-            // Route53 rejects a DELETE whose record doesn't exactly match/exist —
+            // Route53 rejects a DELETE whose record doesn't exactly match/exist -
             // that (and only that) means "already gone". Throttling, auth, and other
             // failures must surface, or a teardown leaves the record dangling while
             // reporting success.

package/dist/aws/signer.d.ts

@@ -1,5 +1,5 @@
 import type { CredentialProvider } from './credentials.js';
-import { type ServiceKey } from './endpoint.js';
+import { type ServiceDescriptor, type ServiceKey } from './endpoint.js';
 export interface RawResponse {
     statusCode: number;
     headers: Record<string, string>;
@@ -14,7 +14,7 @@ export type Transport = (req: {
     body: string | Uint8Array | undefined;
 }) => Promise<RawResponse>;
 export interface SendOptions {
-    service: ServiceKey;
+    service: ServiceKey | ServiceDescriptor;
     method: string;
     /** Path starting with '/'. For S3 pass an already-percent-encoded path. */
     path: string;

package/dist/aws/signer.js

@@ -1,7 +1,7 @@
 import { Sha256 } from '@aws-crypto/sha256-js';
 import { HttpRequest } from '@smithy/protocol-http';
 import { SignatureV4 } from '@smithy/signature-v4';
-import { resolveEndpoint, SIGNING_NAMES } from './endpoint.js';
+import { resolveEndpoint, resolveService, } from './endpoint.js';
 import { AwsError, isRetryable } from './errors.js';
 import { withRetry } from '../util.js';
 import { textTag } from './xml.js';
@@ -51,6 +51,7 @@ export class SigningClient {
         this.transport = opts.transport ?? fetchTransport;
     }
     async send(opts) {
+        const resolved = resolveService(opts.service);
         const ep = resolveEndpoint(opts.service, this.region, this.endpointOverride);
         const [hostname, portStr] = ep.host.split(':');
         const port = portStr ? Number(portStr) : undefined;
@@ -76,7 +77,7 @@ export class SigningClient {
             ...(opts.body !== undefined ? { body: opts.body } : {}),
         });
         const signer = new SignatureV4({
-            service: SIGNING_NAMES[opts.service],
+            service: resolved.signingName,
             region: ep.signingRegion,
             credentials: async () => {
                 const c = await this.credentials();
@@ -87,7 +88,7 @@ export class SigningClient {
                 };
             },
             sha256: Sha256,
-            uriEscapePath: opts.service !== 's3',
+            uriEscapePath: resolved.name !== 's3',
         });
         const signed = await signer.sign(request);
         const qs = Object.keys(query)
@@ -96,7 +97,7 @@ export class SigningClient {
         const url = `${ep.protocol}//${ep.host}${opts.path}${qs ? `?${qs}` : ''}`;
         // Retry transient failures with backoff. For idempotent methods, retry on network
         // errors and 5xx/429. For non-idempotent POSTs, retry ONLY on network errors (the
-        // request never reached the server) — never on a 5xx, which may mean the mutation
+        // request never reached the server) - never on a 5xx, which may mean the mutation
         // was applied and a retry would double-execute (e.g. launch a second MicroVM).
         const idempotent = ['GET', 'HEAD', 'PUT', 'DELETE'].includes(opts.method);
         const retryable = idempotent ? isRetryable : (err) => err instanceof TypeError;
@@ -109,10 +110,10 @@ export class SigningClient {
             });
             // Anything outside 2xx is a failure. 3xx matters: S3's region-mismatch
             // PermanentRedirect is a 301 with no Location header, which fetch
-            // returns as final — treating it as success would report writes as
+            // returns as final - treating it as success would report writes as
             // stored and listings as empty against the wrong endpoint.
             if (response.statusCode >= 300)
-                throw parseError(opts.service, response);
+                throw parseError(resolved.name, response);
             return response;
         }, { retryable });
     }

package/dist/aws/sts.d.ts

@@ -1,5 +1,5 @@
 import type { SigningClient } from './signer.js';
-/** STS client — only GetCallerIdentity, used to derive the account id. */
+/** STS client - only GetCallerIdentity, used to derive the account id. */
 export declare class StsClient {
     private readonly client;
     constructor(client: SigningClient);

package/dist/aws/sts.js

@@ -1,5 +1,5 @@
 import { textTag } from './xml.js';
-/** STS client — only GetCallerIdentity, used to derive the account id. */
+/** STS client - only GetCallerIdentity, used to derive the account id. */
 export class StsClient {
     client;
     constructor(client) {

package/dist/aws/xml.d.ts

@@ -1,6 +1,6 @@
 /**
  * Minimal XML helpers for the handful of AWS REST-XML / query responses this CLI
- * reads (S3, STS, IAM, CloudFront). Not a general XML parser — it extracts tag
+ * reads (S3, STS, IAM, CloudFront). Not a general XML parser - it extracts tag
  * contents by name, which is sufficient for the flat response shapes we consume.
  */
 export declare function decodeEntities(value: string): string;
@@ -10,7 +10,7 @@ export declare function firstTag(xml: string, name: string): string | undefined;
 /** Return the decoded text value of the first `<name>` element. */
 export declare function textTag(xml: string, name: string): string | undefined;
 /**
- * Like {@link textTag} but verbatim — no trimming. For values where whitespace
+ * Like {@link textTag} but verbatim - no trimming. For values where whitespace
  * is data, like S3 object keys (a trimmed key would target a different object).
  */
 export declare function rawTextTag(xml: string, name: string): string | undefined;

package/dist/aws/xml.js

@@ -1,6 +1,6 @@
 /**
  * Minimal XML helpers for the handful of AWS REST-XML / query responses this CLI
- * reads (S3, STS, IAM, CloudFront). Not a general XML parser — it extracts tag
+ * reads (S3, STS, IAM, CloudFront). Not a general XML parser - it extracts tag
  * contents by name, which is sufficient for the flat response shapes we consume.
  */
 const ENTITIES = {
@@ -41,7 +41,7 @@ export function textTag(xml, name) {
     return inner === undefined ? undefined : decodeEntities(inner.trim());
 }
 /**
- * Like {@link textTag} but verbatim — no trimming. For values where whitespace
+ * Like {@link textTag} but verbatim - no trimming. For values where whitespace
  * is data, like S3 object keys (a trimmed key would target a different object).
  */
 export function rawTextTag(xml, name) {

package/dist/clients.d.ts

@@ -19,12 +19,22 @@ export interface ClientBundleOptions {
 export interface AwsClients {
     region: string;
     signing: SigningClient;
+    /**
+     * The us-east-1 signer, exposed so a plugin can build clients for services
+     * core does not enumerate over the credentials, endpoint override and
+     * transport the host already resolved - a `SigningClient`'s region is fixed
+     * at construction and both of those are private, so a hand-built one would
+     * re-resolve credentials and ignore a transport a test injected. Core builds
+     * no additional client from it: `logsUsEast1`, `acm`, `cloudfront` and
+     * `route53` below are the only ones it signs for.
+     */
+    signingUsEast1: SigningClient;
     s3: S3Client;
     sts: StsClient;
     iam: IamClient;
     logs: LogsClient;
     /**
-     * Logs client pinned to us-east-1 for CloudFront vended log delivery —
+     * Logs client pinned to us-east-1 for CloudFront vended log delivery -
      * PutDeliverySource with the CloudFront LogType exists only there, the same
      * global-service quirk as CloudFront's ACM certificates.
      */

package/dist/clients.js

@@ -19,11 +19,13 @@ export function createClients(opts) {
         ...(opts.transport ? { transport: opts.transport } : {}),
     };
     const signing = new SigningClient({ region: opts.region, ...base });
-    // ACM for CloudFront must be us-east-1 regardless of the primary region.
+    // ACM for CloudFront must be us-east-1 regardless of the primary region; the
+    // same signer is handed out as `signingUsEast1` for plugin-supplied services.
     const usEast1 = new SigningClient({ region: 'us-east-1', ...base });
     return {
         region: opts.region,
         signing,
+        signingUsEast1: usEast1,
         s3: new S3Client(signing),
         sts: new StsClient(signing),
         iam: new IamClient(signing),

package/dist/colors.js

@@ -1,6 +1,6 @@
 /*
  * ANSI colour helpers shared by the CLI and feature packages. Pure string
- * composition — writing (and stripping for non-interactive sessions) is the
+ * composition - writing (and stripping for non-interactive sessions) is the
  * logger's job.
  */
 const ESCAPE = '\u001B';