capo-cloudtrail-data 0.2.0__tar.gz → 0.4.0__tar.gz

{capo_cloudtrail_data-0.2.0/src/capo_cloudtrail_data.egg-info → capo_cloudtrail_data-0.4.0}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: capo-cloudtrail-data
-Version: 0.2.0
-Summary: Python SDK for Cloudtrail Data.
+Version: 0.4.0
+Summary: Python SDK for AWS Cloudtrail Data.
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License

{capo_cloudtrail_data-0.2.0 → capo_cloudtrail_data-0.4.0}/pyproject.toml

@@ -1,7 +1,7 @@
 [project]
 name = "capo-cloudtrail-data"
-version = "0.2.0"
-description = "Python SDK for Cloudtrail Data."
+version = "0.4.0"
+description = "Python SDK for AWS Cloudtrail Data."
 readme = "README.md"
 requires-python = ">=3.10"
 classifiers = [

{capo_cloudtrail_data-0.2.0 → capo_cloudtrail_data-0.4.0}/src/capo_cloudtrail_data/_auth/_signers.py

@@ -7,7 +7,11 @@ from zapros import Request
 
 from capo_cloudtrail_data._auth._identity import Credentials, Identity
 from capo_cloudtrail_data._auth._providers import IdentityProvider
-from capo_cloudtrail_data._auth._sigv4 import SigV4AuthContext, sign_sigv4
+from capo_cloudtrail_data._auth._sigv4 import (
+    S3_SIGNING_NAMES,
+    SigV4AuthContext,
+    sign_sigv4,
+)
 
 IdentityT = TypeVar("IdentityT", bound="Identity")
 
@@ -30,14 +34,25 @@ class SigV4Signer(Signer[Credentials]):
     The full auth scheme (``name`` variant, ``signingName``, ``signingRegion``,
     encoding/normalization flags) is provided by the caller — either from the
     endpoint rule-set's ``authSchemes`` property or built by the generated
-    ``get_signer`` from operation defaults.
+    ``get_signer`` from operation defaults. ``unsigned_payload`` mirrors the
+    operation's ``aws.auth#unsignedPayload`` trait: the body is sent but left
+    out of the signature. ``event_stream`` marks a request event stream: the
+    request is signed with the ``STREAMING-AWS4-HMAC-SHA256-EVENTS`` payload
+    marker and every event with a signature chained from it.
     """
 
     def __init__(
-        self, provider: IdentityProvider[Credentials], *, auth_scheme: dict[str, Any]
+        self,
+        provider: IdentityProvider[Credentials],
+        *,
+        auth_scheme: dict[str, Any],
+        unsigned_payload: bool = False,
+        event_stream: bool = False,
     ) -> None:
         super().__init__(provider)
         self._auth_scheme = auth_scheme
+        self._unsigned_payload = unsigned_payload
+        self._event_stream = event_stream
 
     async def asign(self, req: Request) -> Request:
         creds = await self.provider.aresolve_identity()
@@ -55,13 +70,24 @@ class SigV4Signer(Signer[Credentials]):
                 "disableNormalizePath", False
             ),
         }
-        if req.body is None:
-            body: bytes | None = b""
-        elif isinstance(req.body, bytes):
-            body = req.body
-        else:
-            body = None
-        return sign_sigv4(req, ctx, body)
+        unsigned_payload = self._unsigned_payload
+        if (
+            not unsigned_payload
+            and not self._event_stream
+            and req.body is not None
+            and not isinstance(req.body, bytes)
+        ):
+            if self._auth_scheme["signingName"] in S3_SIGNING_NAMES:
+                # S3 accepts UNSIGNED-PAYLOAD for any operation; streamed bodies rely on it.
+                unsigned_payload = True
+            else:
+                raise NotImplementedError(
+                    "Currently we don't support signed chunked payloads, so buffer the body and "
+                    "pass bytes as a workaround; chunked signed implementation coming soon"
+                )
+        return sign_sigv4(
+            req, ctx, unsigned_payload=unsigned_payload, event_stream=self._event_stream
+        )
 
     def sign(self, req: Request) -> Request:
         creds = self.provider.resolve_identity()
@@ -79,10 +105,21 @@ class SigV4Signer(Signer[Credentials]):
                 "disableNormalizePath", False
             ),
         }
-        if req.body is None:
-            body: bytes | None = b""
-        elif isinstance(req.body, bytes):
-            body = req.body
-        else:
-            body = None
-        return sign_sigv4(req, ctx, body)
+        unsigned_payload = self._unsigned_payload
+        if (
+            not unsigned_payload
+            and not self._event_stream
+            and req.body is not None
+            and not isinstance(req.body, bytes)
+        ):
+            if self._auth_scheme["signingName"] in S3_SIGNING_NAMES:
+                # S3 accepts UNSIGNED-PAYLOAD for any operation; streamed bodies rely on it.
+                unsigned_payload = True
+            else:
+                raise NotImplementedError(
+                    "Currently we don't support signed chunked payloads, so buffer the body and "
+                    "pass bytes as a workaround; chunked signed implementation coming soon"
+                )
+        return sign_sigv4(
+            req, ctx, unsigned_payload=unsigned_payload, event_stream=self._event_stream
+        )

{capo_cloudtrail_data-0.2.0 → capo_cloudtrail_data-0.4.0}/src/capo_cloudtrail_data/_auth/_sigv4.py

@@ -1,4 +1,4 @@
-"""AWS Signature Version 4 — single-chunk signing.
+"""AWS Signature Version 4 — single-chunk and event-stream signing.
 
 Reference:
     https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html
@@ -15,7 +15,8 @@ import functools
 import hashlib
 import hmac
 import re
-from typing import Any, Literal, TypedDict
+from collections.abc import AsyncIterator, Iterator
+from typing import Any, Literal, TypedDict, cast
 from urllib.parse import quote, unquote
 
 import zapros
@@ -23,6 +24,9 @@ from pywhatwgurl import URLSearchParams
 from zapros import Headers, Request
 from zapros._utils import get_host_header_value
 
+from .._iter import AnyIterator
+from .._protocol.eventstream import HeaderValue, Message, encode_headers
+
 
 def build_sigv4_auth_scheme(
     signing_name: str, region: str | None, endpoint_scheme: dict[str, Any] | None = None
@@ -65,6 +69,10 @@ class SigV4AuthContext(TypedDict):
 
 
 _SIGV4_ALGORITHM = "AWS4-HMAC-SHA256"
+# Per-event algorithm and request payload marker of a signed event stream.
+_EVENT_ALGORITHM = "AWS4-HMAC-SHA256-PAYLOAD"
+_EVENT_STREAM_PAYLOAD = "STREAMING-AWS4-HMAC-SHA256-EVENTS"
+_AMZ_DATE_FORMAT = "%Y%m%dT%H%M%SZ"
 _EMPTY_PAYLOAD_SHA256 = hashlib.sha256(b"").hexdigest()
 
 # Headers excluded from the signed-headers set. Mirrors botocore's denylist:
@@ -95,9 +103,11 @@ _UNSIGNED_HEADERS = frozenset(
 
 _MULTI_SPACE = re.compile(r" +")
 
-# Services that require the payload hash to travel in ``x-amz-content-sha256``.
-# Other services sign the hash into the canonical request without sending it.
-_S3_SIGNING_NAMES = frozenset({"s3", "s3express", "s3-outposts", "s3-object-lambda"})
+# Services that require the payload hash to travel in ``x-amz-content-sha256``
+# on every request, and that accept ``UNSIGNED-PAYLOAD`` for any operation.
+# Other services sign the hash into the canonical request without sending it,
+# and only see the header when the payload is left unsigned.
+S3_SIGNING_NAMES = frozenset({"s3", "s3express", "s3-outposts", "s3-object-lambda"})
 
 
 def _uri_encode(value: str) -> str:
@@ -231,12 +241,20 @@ def _canonical_query_from_pairs(pairs: list[tuple[str, str]]) -> str:
 def sign_sigv4(
     request: Request,
     ctx: SigV4AuthContext,
-    body: bytes | None,
+    *,
+    unsigned_payload: bool = False,
+    event_stream: bool = False,
 ) -> Request:
     """Return a new ``Request`` carrying SigV4 single-chunk auth headers.
 
-    Pass ``body=None`` to sign with ``UNSIGNED-PAYLOAD`` (streaming requests).
-    The original ``request.body`` is forwarded unchanged in that case.
+    The payload hash covers ``request.body``, which must be ``bytes`` or
+    ``None``. ``unsigned_payload`` signs ``UNSIGNED-PAYLOAD`` instead and
+    forwards any body unchanged (streaming S3 requests and operations carrying
+    ``aws.auth#unsignedPayload``). ``event_stream`` signs a request event
+    stream: the ``STREAMING-AWS4-HMAC-SHA256-EVENTS`` marker stands in for the
+    payload hash and the body — an iterator of encoded event messages — is
+    wrapped in an :class:`EventStreamIterator` that signs every event with a
+    signature chained from this request's.
     """
     service = ctx["signing_name"]
     region = ctx["signing_region"]
@@ -250,21 +268,31 @@ def sign_sigv4(
         date_stamp = amz_date[:8]
     else:
         now = _amz_now()
-        amz_date = now.strftime("%Y%m%dT%H%M%SZ")
+        amz_date = now.strftime(_AMZ_DATE_FORMAT)
         date_stamp = now.strftime("%Y%m%d")
         headers["X-Amz-Date"] = amz_date
 
-    # Payload hash. For S3-family services, x-amz-content-sha256 is mandatory
-    # and must be set BEFORE computing the canonical request (it gets signed).
+    # Payload hash. For S3-family services, x-amz-content-sha256 is mandatory;
+    # for every service it is the only way to announce an unsigned payload or
+    # an event stream.
+    # Either way it must be set BEFORE computing the canonical request (it
+    # gets signed).
     payload_hash = headers.get("X-Amz-Content-SHA256")
     if payload_hash is None:
-        if body is None:
+        if event_stream:
+            payload_hash = _EVENT_STREAM_PAYLOAD
+        elif unsigned_payload:
             payload_hash = "UNSIGNED-PAYLOAD"
+        elif request.body is None:
+            payload_hash = _EMPTY_PAYLOAD_SHA256
+        elif isinstance(request.body, bytes):
+            payload_hash = hashlib.sha256(request.body).hexdigest()
         else:
-            payload_hash = (
-                hashlib.sha256(body).hexdigest() if body else _EMPTY_PAYLOAD_SHA256
+            raise TypeError(
+                "sign_sigv4 hashes a bytes body only; pass unsigned_payload=True "
+                "to send a streamed body without a payload hash"
             )
-    if service in _S3_SIGNING_NAMES:
+    if service in S3_SIGNING_NAMES or unsigned_payload or event_stream:
         headers["X-Amz-Content-SHA256"] = payload_hash
 
     # Session token (STS / assumed-role credentials).
@@ -308,18 +336,135 @@ def sign_sigv4(
         f"Signature={signature}"
     )
 
-    effective_body = body if body is not None else request.body
-    if effective_body is not None:
+    body = request.body
+    if event_stream:
+        if not isinstance(body, (Iterator, AsyncIterator)):
+            raise TypeError(
+                "event_stream requires an iterator of encoded events as the body"
+            )
+        body = EventStreamIterator(
+            cast("Iterator[bytes] | AsyncIterator[bytes]", body), ctx, signature
+        )
+    if body is not None:
         return Request(
             request.url,
             request.method,
             headers,
-            body=effective_body,
+            body=body,
             context=request.context,
         )
     return Request(request.url, request.method, headers, context=request.context)
 
 
+def _sign_event(
+    ctx: SigV4AuthContext, prior_signature: str, payload: bytes
+) -> tuple[bytes, str]:
+    """Wrap one encoded event in a signed outer message.
+
+    Returns ``(frame, signature)``; the hex signature seeds the next event.
+    The string to sign chains every frame to its predecessor — the first one
+    to the request's ``Authorization`` signature — so the service can verify
+    the stream incrementally::
+
+        AWS4-HMAC-SHA256-PAYLOAD
+        <date, YYYYMMDDTHHMMSSZ>
+        <credential scope>
+        <prior signature, hex>
+        <hex sha256 of the encoded ``:date`` header>
+        <hex sha256 of the payload>
+
+    The AWS SDKs (and the service) use the ``-PAYLOAD`` algorithm name; the
+    Transcribe developer guide's pseudocode omits the suffix.
+    """
+    service = ctx["signing_name"]
+    region = ctx["signing_region"]
+    now = _amz_now()
+    amz_date = now.strftime(_AMZ_DATE_FORMAT)
+    date_stamp = amz_date[:8]
+    credential_scope = f"{date_stamp}/{region}/{service}/aws4_request"
+    date_header: dict[str, HeaderValue] = {":date": now}
+    string_to_sign = "\n".join(
+        (
+            _EVENT_ALGORITHM,
+            amz_date,
+            credential_scope,
+            prior_signature,
+            hashlib.sha256(encode_headers(date_header)).hexdigest(),
+            hashlib.sha256(payload).hexdigest(),
+        )
+    )
+    signing_key = _derive_signing_key(
+        ctx["secret_access_key"], date_stamp, region, service
+    )
+    signature = hmac.new(
+        signing_key, string_to_sign.encode("utf-8"), hashlib.sha256
+    ).hexdigest()
+    frame = Message(
+        {**date_header, ":chunk-signature": bytes.fromhex(signature)}, payload
+    ).encode()
+    return frame, signature
+
+
+class EventStreamIterator(AnyIterator[bytes]):
+    """Sign a request event stream, one frame per event.
+
+    Wraps an iterator of encoded event messages (as produced by the generated
+    ``serialize_event_*`` functions). Each event becomes the payload of an
+    outer message carrying ``:date`` and ``:chunk-signature`` headers, the
+    signature chained from the previous frame's and seeded by the request's
+    ``Authorization`` signature. Once the events are exhausted, one empty
+    signed frame is yielded to mark the end of the stream.
+
+    Like :class:`~capo._body.Body`, it is both a sync and an async iterator:
+    iterate it the way the wrapped source is iterable (``next`` over a sync
+    source, ``async for`` over an async one).
+
+    Reference:
+        https://docs.aws.amazon.com/transcribe/latest/dg/streaming-setting-up.html
+    """
+
+    def __init__(
+        self,
+        events: Iterator[bytes] | AsyncIterator[bytes],
+        ctx: SigV4AuthContext,
+        seed_signature: str,
+    ) -> None:
+        self._events = events
+        self._ctx = ctx
+        self._prior_signature = seed_signature
+        self._ended = False
+
+    def _frame(self, payload: bytes) -> bytes:
+        frame, self._prior_signature = _sign_event(
+            self._ctx, self._prior_signature, payload
+        )
+        return frame
+
+    def __next__(self) -> bytes:
+        if self._ended:
+            raise StopIteration
+        if not isinstance(self._events, Iterator):
+            raise TypeError("this event stream wraps an async source; use `async for`")
+        try:
+            payload = next(cast(Iterator[bytes], self._events))
+        except StopIteration:
+            self._ended = True
+            payload = b""
+        return self._frame(payload)
+
+    async def __anext__(self) -> bytes:
+        if self._ended:
+            raise StopAsyncIteration
+        if not isinstance(self._events, AsyncIterator):
+            raise TypeError("this event stream wraps a sync source; use `for`")
+        try:
+            payload = await cast(AsyncIterator[bytes], self._events).__anext__()
+        except StopAsyncIteration:
+            self._ended = True
+            payload = b""
+        return self._frame(payload)
+
+
 def presign_sigv4(
     request: Request,
     ctx: SigV4AuthContext,
@@ -346,7 +491,7 @@ def presign_sigv4(
     service = ctx["signing_name"]
     region = ctx["signing_region"]
 
-    amz_date = sign_time.strftime("%Y%m%dT%H%M%SZ")
+    amz_date = sign_time.strftime(_AMZ_DATE_FORMAT)
     date_stamp = sign_time.strftime("%Y%m%d")
     credential_scope = f"{date_stamp}/{region}/{service}/aws4_request"
 

{capo_cloudtrail_data-0.2.0 → capo_cloudtrail_data-0.4.0}/src/capo_cloudtrail_data/_operations/cloud_trail_data_service/put_audit_events.py

@@ -27,6 +27,7 @@ from capo_cloudtrail_data._rule_engine._endpoint_rule_set import EndpointParams,
 from capo_cloudtrail_data._services._pipeline import (
     AsyncOperationOptions,
     OperationOptions,
+    raise_error,
 )
 from capo_cloudtrail_data.errors import UnknownServiceError
 
@@ -157,7 +158,7 @@ def put_audit_events(
     try:
         if response.status >= 300:
             response.read()
-            handle_error(response)
+            raise_error(response, handle_error)
         return handle_response(response), response
     except BaseException:
         response.close()
@@ -175,7 +176,7 @@ async def async_put_audit_events(
     try:
         if response.status >= 300:
             await response.aread()
-            handle_error(response)
+            raise_error(response, handle_error)
         return await async_handle_response(response), response
     except BaseException:
         await response.aclose()

{capo_cloudtrail_data-0.2.0 → capo_cloudtrail_data-0.4.0}/src/capo_cloudtrail_data/_protocol/eventstream.py

@@ -89,7 +89,7 @@ def _decode_header_value(
     raise ValueError(f"unsupported eventstream header type: {type_byte:#x}")
 
 
-def _encode_headers(headers: dict[str, HeaderValue]) -> bytes:
+def encode_headers(headers: dict[str, HeaderValue]) -> bytes:
     parts: list[bytes] = []
     for name, value in headers.items():
         name_bytes = name.encode("utf-8")
@@ -124,10 +124,11 @@ class Message:
 
     def encode(self) -> bytes:
         """Serialize this message into eventstream framing bytes."""
-        headers_bytes = _encode_headers(self.headers)
+        headers_bytes = encode_headers(self.headers)
         headers_length = len(headers_bytes)
         payload = self.payload
-        total_length = 12 + headers_length + len(payload)
+        # total_length covers the whole frame, trailing message CRC included.
+        total_length = 12 + headers_length + len(payload) + 4
 
         prelude = total_length.to_bytes(4, "big") + headers_length.to_bytes(4, "big")
         prelude_crc = zlib.crc32(prelude).to_bytes(4, "big")
@@ -158,31 +159,31 @@ class MessageDecoder:
             prelude = bytes(self._buffer[:8])
             prelude_crc = int.from_bytes(self._buffer[8:12], "big")
 
-            if total_length < 12 + headers_length:
+            # total_length covers the whole frame: 12-byte prelude, headers,
+            # payload, and the trailing 4-byte message CRC.
+            if total_length < 16 + headers_length:
                 raise ValueError(
                     f"invalid eventstream message: total_length={total_length} "
-                    f"is smaller than minimum {12 + headers_length}"
+                    f"is smaller than minimum {16 + headers_length}"
                 )
 
-            message_end = total_length + 4
-            if len(self._buffer) < message_end:
+            if len(self._buffer) < total_length:
                 return
 
             computed_prelude_crc = zlib.crc32(prelude) & 0xFFFFFFFF
             if computed_prelude_crc != prelude_crc:
                 raise ValueError("eventstream prelude checksum mismatch")
 
-            message_bytes = bytes(self._buffer[:total_length])
-            message_crc = int.from_bytes(
-                self._buffer[total_length : total_length + 4], "big"
-            )
+            payload_end = total_length - 4
+            message_bytes = bytes(self._buffer[:payload_end])
+            message_crc = int.from_bytes(self._buffer[payload_end:total_length], "big")
             computed_message_crc = zlib.crc32(message_bytes) & 0xFFFFFFFF
             if computed_message_crc != message_crc:
                 raise ValueError("eventstream message checksum mismatch")
 
             headers = _decode_headers(self._buffer[12 : 12 + headers_length])
-            payload = bytes(self._buffer[12 + headers_length : total_length])
-            del self._buffer[:message_end]
+            payload = bytes(self._buffer[12 + headers_length : payload_end])
+            del self._buffer[:total_length]
             yield Message(headers=headers, payload=payload)
 
 
@@ -233,6 +234,7 @@ __all__ = [
     "MessageDecoder",
     "async_raw_stream_to_events",
     "async_read_messages",
+    "encode_headers",
     "raw_stream_to_events",
     "read_messages",
 ]

{capo_cloudtrail_data-0.2.0 → capo_cloudtrail_data-0.4.0}/src/capo_cloudtrail_data/_services/_pipeline.py

@@ -6,6 +6,7 @@ from collections.abc import AsyncIterator, Iterator, Sequence
 from dataclasses import dataclass
 from typing import TYPE_CHECKING, Awaitable, Callable, Generic, TypeVar, cast
 
+from typing_extensions import Never
 from zapros import (
     AsyncClient,
     Client,
@@ -135,6 +136,22 @@ async def aexecute_pipeline(
     return await make_chain(0)(request)
 
 
+def raise_error(response: Response, handle_error: Callable[[Response], Never]) -> Never:
+    try:
+        handle_error(response)
+    except ServiceError as exc:
+        # The response itself can say a retry is safe, even when the error is
+        # not marked @retryable: a 429, a transient 5xx or a Retry-After header.
+        if response.status == 429:
+            exc.is_throttling_error = True
+        if (
+            response.status in (429, 500, 502, 503, 504)
+            or "retry-after" in response.headers
+        ):
+            exc.is_retryable = True
+        raise
+
+
 def _is_retryable(exc: Exception) -> bool:
     if isinstance(exc, ServiceError):
         return exc.is_retryable

{capo_cloudtrail_data-0.2.0 → capo_cloudtrail_data-0.4.0/src/capo_cloudtrail_data.egg-info}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: capo-cloudtrail-data
-Version: 0.2.0
-Summary: Python SDK for Cloudtrail Data.
+Version: 0.4.0
+Summary: Python SDK for AWS Cloudtrail Data.
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License

{capo_cloudtrail_data-0.2.0 → capo_cloudtrail_data-0.4.0}/tests/test_sigv4.py

@@ -13,12 +13,20 @@ Vectors come from two sources:
 
 from __future__ import annotations
 
+import asyncio
+import datetime as dt
+import hashlib
+import hmac
+from collections.abc import AsyncIterator, Iterator
+
 import pytest
 
 from pywhatwgurl import URL
 from zapros import Headers, Request
 
+from capo_cloudtrail_data._auth import _sigv4
 from capo_cloudtrail_data._auth._sigv4 import (
+    EventStreamIterator,
     SigV4AuthContext,
     build_sigv4_auth_scheme,
     _build_canonical_request,
@@ -30,6 +38,7 @@ from capo_cloudtrail_data._auth._sigv4 import (
     _uri_encode,
     sign_sigv4,
 )
+from capo_cloudtrail_data._protocol.eventstream import Message, MessageDecoder, encode_headers
 
 
 # ---------------------------------------------------------------------------
@@ -201,11 +210,16 @@ _TEST_SUITE_CTX: SigV4AuthContext = {
 }
 
 
-def _make_request(method: str, url: str, headers: dict[str, str]) -> Request:
+def _make_request(
+    method: str,
+    url: str,
+    headers: dict[str, str],
+    body: bytes | Iterator[bytes] | AsyncIterator[bytes] | None = None,
+) -> Request:
     """Build a Request and strip headers Request adds by default that the
     AWS test suite does not include (Accept, User-Agent, Accept-Encoding).
     """
-    req = Request(URL(url), method, headers=headers)
+    req = Request(URL(url), method, headers=headers, body=body)
     for h in ("accept", "user-agent", "accept-encoding"):
         if h in req.headers:
             del req.headers[h]
@@ -219,7 +233,7 @@ def test_get_vanilla():
         "https://example.amazonaws.com/",
         {"Host": "example.amazonaws.com", "X-Amz-Date": "20150830T123600Z"},
     )
-    signed = sign_sigv4(req, _TEST_SUITE_CTX, b"")
+    signed = sign_sigv4(req, _TEST_SUITE_CTX)
     assert signed.headers["Authorization"] == (
         "AWS4-HMAC-SHA256 "
         "Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request,"
@@ -235,7 +249,7 @@ def test_get_vanilla_query():
         "https://example.amazonaws.com/?Param1=value1",
         {"Host": "example.amazonaws.com", "X-Amz-Date": "20150830T123600Z"},
     )
-    signed = sign_sigv4(req, _TEST_SUITE_CTX, b"")
+    signed = sign_sigv4(req, _TEST_SUITE_CTX)
     assert signed.headers["Authorization"] == (
         "AWS4-HMAC-SHA256 "
         "Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request,"
@@ -255,7 +269,7 @@ def test_get_vanilla_query_order_key():
         "https://example.amazonaws.com/?Param2=value2&Param1=value1",
         {"Host": "example.amazonaws.com", "X-Amz-Date": "20150830T123600Z"},
     )
-    signed = sign_sigv4(req, _TEST_SUITE_CTX, b"")
+    signed = sign_sigv4(req, _TEST_SUITE_CTX)
     assert signed.headers["Authorization"] == (
         "AWS4-HMAC-SHA256 "
         "Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request,"
@@ -271,7 +285,7 @@ def test_post_vanilla():
         "https://example.amazonaws.com/",
         {"Host": "example.amazonaws.com", "X-Amz-Date": "20150830T123600Z"},
     )
-    signed = sign_sigv4(req, _TEST_SUITE_CTX, b"")
+    signed = sign_sigv4(req, _TEST_SUITE_CTX)
     assert signed.headers["Authorization"] == (
         "AWS4-HMAC-SHA256 "
         "Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request,"
@@ -308,7 +322,7 @@ def test_s3_get_object_example():
             "X-Amz-Date": "20130524T000000Z",
         },
     )
-    signed = sign_sigv4(req, _S3_DOCS_CTX, b"")
+    signed = sign_sigv4(req, _S3_DOCS_CTX)
 
     # Auto-injected payload hash for an empty body.
     assert signed.headers["X-Amz-Content-SHA256"] == (
@@ -334,7 +348,7 @@ def test_session_token_added_and_signed():
         "https://example.amazonaws.com/",
         {"Host": "example.amazonaws.com", "X-Amz-Date": "20150830T123600Z"},
     )
-    signed = sign_sigv4(req, ctx, b"")
+    signed = sign_sigv4(req, ctx)
     assert signed.headers["X-Amz-Security-Token"] == "TOKEN123"
     # x-amz-security-token must appear in the signed-headers list.
     assert "x-amz-security-token" in signed.headers["Authorization"]
@@ -345,9 +359,9 @@ def test_s3_sets_payload_hash_for_body():
         "PUT",
         "https://examplebucket.s3.amazonaws.com/key",
         {"Host": "examplebucket.s3.amazonaws.com", "X-Amz-Date": "20130524T000000Z"},
+        body=b"hello",
     )
-    body = b"hello"
-    signed = sign_sigv4(req, _S3_DOCS_CTX, body)
+    signed = sign_sigv4(req, _S3_DOCS_CTX)
     # sha256("hello")
     assert signed.headers["X-Amz-Content-SHA256"] == (
         "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
@@ -380,8 +394,9 @@ def test_s3_outposts_put_with_encoded_key():
             "Host": "s3-outposts.us-west-2.amazonaws.com",
             "X-Amz-Date": "20130524T000000Z",
         },
+        body=b"hello",
     )
-    signed = sign_sigv4(req, _s3_family_ctx("s3-outposts", "us-west-2"), b"hello")
+    signed = sign_sigv4(req, _s3_family_ctx("s3-outposts", "us-west-2"))
     assert signed.headers["X-Amz-Content-SHA256"] == (
         "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
     )
@@ -400,7 +415,7 @@ def test_s3express_get_with_encoded_key():
         f"https://{host}/a%20b?list-type=2",
         {"Host": host, "X-Amz-Date": "20130524T000000Z"},
     )
-    signed = sign_sigv4(req, _s3_family_ctx("s3express", "us-west-2"), b"")
+    signed = sign_sigv4(req, _s3_family_ctx("s3express", "us-west-2"))
     assert signed.headers["X-Amz-Content-SHA256"] == (
         "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
     )
@@ -419,7 +434,7 @@ def test_s3_object_lambda_get_with_encoded_key():
         f"https://{host}/dir/a%20b",
         {"Host": host, "X-Amz-Date": "20130524T000000Z"},
     )
-    signed = sign_sigv4(req, _s3_family_ctx("s3-object-lambda", "us-east-1"), b"")
+    signed = sign_sigv4(req, _s3_family_ctx("s3-object-lambda", "us-east-1"))
     assert signed.headers["X-Amz-Content-SHA256"] == (
         "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
     )
@@ -438,19 +453,205 @@ def test_non_s3_does_not_set_payload_hash_header():
         "https://iam.amazonaws.com/",
         {"Host": "iam.amazonaws.com", "X-Amz-Date": "20150830T123600Z"},
     )
-    signed = sign_sigv4(req, ctx, b"")
+    signed = sign_sigv4(req, ctx)
     # IAM/STS/etc. signs the payload hash into the canonical request but does
     # not transmit an X-Amz-Content-SHA256 header.
     assert "X-Amz-Content-SHA256" not in signed.headers
 
 
+def test_unsigned_payload_sends_header_for_non_s3():
+    """``aws.auth#unsignedPayload`` on a non-S3 operation (Lex RecognizeUtterance):
+    the header is the only way the service learns not to hash the body."""
+    ctx: SigV4AuthContext = {**_TEST_SUITE_CTX, "signing_name": "lex"}
+    req = _make_request(
+        "POST",
+        "https://runtime-v2-lex.us-east-1.amazonaws.com/bots/b/utterance",
+        {
+            "Host": "runtime-v2-lex.us-east-1.amazonaws.com",
+            "X-Amz-Date": "20150830T123600Z",
+        },
+        body=iter([b"audio"]),
+    )
+    signed = sign_sigv4(req, ctx, unsigned_payload=True)
+    assert signed.headers["X-Amz-Content-SHA256"] == "UNSIGNED-PAYLOAD"
+    assert "x-amz-content-sha256" in signed.headers["Authorization"].split("SignedHeaders=")[1]
+
+
+def test_streamed_body_rejected_without_unsigned_payload():
+    req = _make_request(
+        "PUT",
+        "https://example.amazonaws.com/",
+        {"Host": "example.amazonaws.com"},
+        body=iter([b"chunk"]),
+    )
+    with pytest.raises(TypeError):
+        sign_sigv4(req, _TEST_SUITE_CTX)
+
+
+# ---------------------------------------------------------------------------
+# Request event streams (Transcribe StartStreamTranscription & co.)
+#
+# Frame vectors computed with the amazon-transcribe-streaming-sdk EventSigner
+# for the same credentials, clock and seed signature.
+# ---------------------------------------------------------------------------
+
+_EVENT_CTX: SigV4AuthContext = {**_TEST_SUITE_CTX, "signing_name": "transcribe"}
+_EVENT_NOW = dt.datetime(2015, 8, 30, 12, 36, 0, 123000, tzinfo=dt.timezone.utc)
+_SEED_SIGNATURE = "5fa00fa31553b73ebf1942676e86291e8372ff2a2260956d9b8aae1d763fbf31"
+_EXPECTED_CHUNK_SIGNATURES = [
+    "790059050e9798603e8e42a1ad7d6722d26b05ec6b02d78e6337e5b8c3c41c90",
+    "137143c4f956f3fe0ea64f7b27848aa1b9168e770143b06b8a78723c6d0c62c5",
+    "cb01529bff77188ec0f881ecdccab5e237925b6a14357c1ef10f873b4fc8793a",
+]
+
+
+def _audio_events() -> list[bytes]:
+    headers = {
+        ":message-type": "event",
+        ":event-type": "AudioEvent",
+        ":content-type": "application/octet-stream",
+    }
+    return [
+        Message(headers, b"\x01\x02\x03").encode(),
+        Message(headers, b"").encode(),
+    ]
+
+
+def _decode_frames(frames: list[bytes]) -> list[Message]:
+    decoder = MessageDecoder()
+    return [message for frame in frames for message in decoder.feed(frame)]
+
+
+def _chunk_signature(message: Message) -> str:
+    signature = message.headers[":chunk-signature"]
+    assert isinstance(signature, bytes) and len(signature) == 32
+    return signature.hex()
+
+
+def _expected_event_signature(prior: str, payload: bytes) -> str:
+    """The per-frame string to sign, straight from the Transcribe developer
+    guide (with the ``-PAYLOAD`` algorithm name every AWS SDK uses)."""
+    string_to_sign = "\n".join(
+        [
+            "AWS4-HMAC-SHA256-PAYLOAD",
+            "20150830T123600Z",
+            "20150830/us-east-1/transcribe/aws4_request",
+            prior,
+            hashlib.sha256(encode_headers({":date": _EVENT_NOW})).hexdigest(),
+            hashlib.sha256(payload).hexdigest(),
+        ]
+    )
+    key = _derive_signing_key(
+        _EVENT_CTX["secret_access_key"], "20150830", "us-east-1", "transcribe"
+    )
+    return hmac.new(key, string_to_sign.encode(), hashlib.sha256).hexdigest()
+
+
+def test_event_stream_frames_chain_from_seed_signature(monkeypatch):
+    monkeypatch.setattr(_sigv4, "_amz_now", lambda: _EVENT_NOW)
+    events = _audio_events()
+
+    frames = list(EventStreamIterator(iter(events), _EVENT_CTX, _SEED_SIGNATURE))
+    messages = _decode_frames(frames)
+
+    # One frame per event, plus the empty end frame.
+    assert [m.payload for m in messages] == [*events, b""]
+    prior = _SEED_SIGNATURE
+    for message, payload, expected in zip(
+        messages, [*events, b""], _EXPECTED_CHUNK_SIGNATURES
+    ):
+        assert set(message.headers) == {":date", ":chunk-signature"}
+        assert message.headers[":date"] == _EVENT_NOW
+        signature = _chunk_signature(message)
+        assert signature == _expected_event_signature(prior, payload) == expected
+        prior = signature
+
+
+def test_event_stream_empty_source_still_sends_end_frame(monkeypatch):
+    monkeypatch.setattr(_sigv4, "_amz_now", lambda: _EVENT_NOW)
+    frames = list(EventStreamIterator(iter([]), _EVENT_CTX, _SEED_SIGNATURE))
+    (message,) = _decode_frames(frames)
+    assert message.payload == b""
+    assert message.headers[":chunk-signature"] == bytes.fromhex(
+        _expected_event_signature(_SEED_SIGNATURE, b"")
+    )
+
+
+def test_async_event_stream_matches_sync(monkeypatch):
+    monkeypatch.setattr(_sigv4, "_amz_now", lambda: _EVENT_NOW)
+    events = _audio_events()
+
+    async def source() -> AsyncIterator[bytes]:
+        for event in events:
+            yield event
+
+    async def main() -> list[bytes]:
+        return [
+            f async for f in EventStreamIterator(source(), _EVENT_CTX, _SEED_SIGNATURE)
+        ]
+
+    frames = asyncio.run(main())
+    assert frames == list(EventStreamIterator(iter(events), _EVENT_CTX, _SEED_SIGNATURE))
+    assert [_chunk_signature(m) for m in _decode_frames(frames)] == _EXPECTED_CHUNK_SIGNATURES
+
+
+def test_event_stream_request_signs_marker_and_wraps_body(monkeypatch):
+    """A request event stream signs the ``STREAMING-AWS4-HMAC-SHA256-EVENTS``
+    marker, sends it in the header, and wraps the body so every event is
+    signed with a chain seeded by the Authorization signature."""
+    monkeypatch.setattr(_sigv4, "_amz_now", lambda: _EVENT_NOW)
+    events = _audio_events()
+    req = _make_request(
+        "POST",
+        "https://transcribestreaming.us-east-1.amazonaws.com/stream-transcription",
+        {
+            "Host": "transcribestreaming.us-east-1.amazonaws.com",
+            "X-Amz-Date": "20150830T123600Z",
+        },
+        body=iter(events),
+    )
+    signed = sign_sigv4(req, _EVENT_CTX, event_stream=True)
+    assert signed.headers["X-Amz-Content-SHA256"] == "STREAMING-AWS4-HMAC-SHA256-EVENTS"
+    assert "x-amz-content-sha256" in signed.headers["Authorization"].split("SignedHeaders=")[1]
+    seed = signed.headers["Authorization"].rsplit("Signature=", 1)[1]
+
+    assert isinstance(signed.body, EventStreamIterator)
+    messages = _decode_frames(list(signed.body))
+    assert [m.payload for m in messages] == [*events, b""]
+    assert messages[0].headers[":chunk-signature"] == bytes.fromhex(
+        _expected_event_signature(seed, events[0])
+    )
+
+
+def test_event_stream_request_wraps_async_body():
+    async def source() -> AsyncIterator[bytes]:
+        yield b""
+
+    req = _make_request(
+        "POST",
+        "https://transcribestreaming.us-east-1.amazonaws.com/stream-transcription",
+        {"Host": "transcribestreaming.us-east-1.amazonaws.com"},
+        body=source(),
+    )
+    signed = sign_sigv4(req, _EVENT_CTX, event_stream=True)
+    assert isinstance(signed.body, EventStreamIterator)
+    assert isinstance(signed.body, AsyncIterator)
+    with pytest.raises(TypeError):
+        next(signed.body)
+    assert len(asyncio.run(_collect(signed.body))) == 2
+
+
+async def _collect(source: AsyncIterator[bytes]) -> list[bytes]:
+    return [chunk async for chunk in source]
+
+
 def test_amz_date_autopopulated_when_missing():
     req = _make_request(
         "GET",
         "https://example.amazonaws.com/",
         {"Host": "example.amazonaws.com"},
     )
-    signed = sign_sigv4(req, _TEST_SUITE_CTX, b"")
+    signed = sign_sigv4(req, _TEST_SUITE_CTX)
     amz_date = signed.headers["X-Amz-Date"]
     # Format: YYYYMMDDTHHMMSSZ
     assert len(amz_date) == 16
@@ -464,7 +665,7 @@ def test_authorization_header_format():
         "https://example.amazonaws.com/",
         {"Host": "example.amazonaws.com", "X-Amz-Date": "20150830T123600Z"},
     )
-    signed = sign_sigv4(req, _TEST_SUITE_CTX, b"")
+    signed = sign_sigv4(req, _TEST_SUITE_CTX)
     auth = signed.headers["Authorization"]
     assert auth.startswith("AWS4-HMAC-SHA256 ")
     # Spec: comma-separated, no required whitespace between parts.