chore: rename the site to aws-credentials

.github/workflows/claude-review.yml

@@ -87,7 +87,7 @@ jobs:
             REPO: ${{ github.repository }}
             PR: ${{ github.event.pull_request.number }}
 
-            This repository (0-draft/assume-role): AWS STS, drawn: every endpoint, every API, every way a workload or a human ends up holding temporary credentials. EN/JA.
+            This repository (0-draft/aws-credentials): AWS credentials, drawn: every STS endpoint, every API, every way a workload or a human ends up holding temporary credentials, and how requests are signed with them (SigV4, SigV4a, presigned URLs). EN/JA.
 
             Before reviewing, read whatever this repository says about itself: CLAUDE.md,
             AGENTS.md, CONTRIBUTING.md, README.md (and README.ja.md if present), and the

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 assume-role contributors
+Copyright (c) 2026 aws-credentials contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

LICENSE-docs.md

@@ -2,6 +2,6 @@
 
 The contents of `docs/` are licensed under the [Creative Commons Attribution 4.0 International License (CC BY 4.0)](https://creativecommons.org/licenses/by/4.0/).
 
-You may share and adapt them for any purpose, including commercially, as long as you give appropriate credit: "assume-role (<https://github.com/0-draft/assume-role>)", link to the license, and indicate if changes were made.
+You may share and adapt them for any purpose, including commercially, as long as you give appropriate credit: "aws-credentials (<https://github.com/0-draft/aws-credentials>)", link to the license, and indicate if changes were made.
 
 Third-party facts and figures are cited to their original sources; those sources keep their own terms. Source code in this repository is licensed separately under the [MIT License](./LICENSE).

README.ja.md

@@ -1,11 +1,13 @@
-# assume-role
+# aws-credentials
 
-[![ci](https://github.com/0-draft/assume-role/actions/workflows/ci.yml/badge.svg)](https://github.com/0-draft/assume-role/actions/workflows/ci.yml)
-[![codeql](https://github.com/0-draft/assume-role/actions/workflows/codeql.yml/badge.svg)](https://github.com/0-draft/assume-role/actions/workflows/codeql.yml)
+[![ci](https://github.com/0-draft/aws-credentials/actions/workflows/ci.yml/badge.svg)](https://github.com/0-draft/aws-credentials/actions/workflows/ci.yml)
+[![codeql](https://github.com/0-draft/aws-credentials/actions/workflows/codeql.yml/badge.svg)](https://github.com/0-draft/aws-credentials/actions/workflows/codeql.yml)
 
-AWS STS を図解するサイトです。英語と日本語に対応したインタラクティブな解説で、AWS Security Token Service のグローバルエンドポイントと、リージョン・FIPS・デュアルスタック・PrivateLink の各ホスト名、STS の API 11 個すべて、ワークロードや人が一時認証情報を手にするまでの全経路、それにまつわるポリシー・上限・エラーを扱います。
+AWS の認証情報を図解するサイトです。英語と日本語に対応したインタラクティブな解説で、認証情報がどう発行され、どう使われるかを扱います。発行の側では、AWS Security Token Service のグローバルエンドポイントと、リージョン・FIPS・デュアルスタック・PrivateLink の各ホスト名、STS の API 11 個すべて、ワークロードや人が一時認証情報を手にするまでの全経路、それにまつわるポリシー・上限・エラー。使う側では、ブラウザ内でその場で計算する SigV4 / SigV4a の署名、presigned URL、bearer 型の API キーです。
 
-**サイト:** <https://0-draft.github.io/assume-role/?lang=ja> ([English](https://0-draft.github.io/assume-role/))
+このリポジトリは 2026-11-08 まで `assume-role` という名前でした。その日に旧 `caller-identity` プロジェクト (リクエスト署名) を統合しています。
+
+**サイト:** <https://0-draft.github.io/aws-credentials/?lang=ja> ([English](https://0-draft.github.io/aws-credentials/))
 
 [English README](README.md)
 
@@ -35,7 +37,7 @@ Node.js 24 が必要です。
 
 ```bash
 npm ci
-npm run dev        # http://localhost:5173/assume-role/
+npm run dev        # http://localhost:5173/aws-credentials/
 npm run check      # 型チェック、lint、フォーマット、markdownlint、テスト、ビルド
 npm run test:e2e   # 実ブラウザでのチェック (要: npx playwright install chromium)
 ```

README.md

@@ -1,11 +1,13 @@
-# assume-role
+# aws-credentials
 
-[![ci](https://github.com/0-draft/assume-role/actions/workflows/ci.yml/badge.svg)](https://github.com/0-draft/assume-role/actions/workflows/ci.yml)
-[![codeql](https://github.com/0-draft/assume-role/actions/workflows/codeql.yml/badge.svg)](https://github.com/0-draft/assume-role/actions/workflows/codeql.yml)
+[![ci](https://github.com/0-draft/aws-credentials/actions/workflows/ci.yml/badge.svg)](https://github.com/0-draft/aws-credentials/actions/workflows/ci.yml)
+[![codeql](https://github.com/0-draft/aws-credentials/actions/workflows/codeql.yml/badge.svg)](https://github.com/0-draft/aws-credentials/actions/workflows/codeql.yml)
 
-AWS STS, drawn. An interactive, bilingual (English / 日本語) explainer of the AWS Security Token Service: the global endpoint and every regional, FIPS, dual-stack and PrivateLink hostname, all 11 STS APIs, every path by which a workload or a person ends up holding temporary credentials, and the policies, limits and errors around them.
+AWS credentials, drawn. An interactive, bilingual (English / 日本語) explainer of how AWS credentials are issued and how they are used. Issuance: the AWS Security Token Service's global endpoint and every regional, FIPS, dual-stack and PrivateLink hostname, all 11 STS APIs, every path by which a workload or a person ends up holding temporary credentials, and the policies, limits and errors around them. Use: SigV4 and SigV4a signing computed live in the browser, presigned URLs and bearer API keys.
 
-**Site:** <https://0-draft.github.io/assume-role/> ([日本語](https://0-draft.github.io/assume-role/?lang=ja))
+This repository was called `assume-role` until 2026-11-08, when the former `caller-identity` project (request signing) was merged in.
+
+**Site:** <https://0-draft.github.io/aws-credentials/> ([日本語](https://0-draft.github.io/aws-credentials/?lang=ja))
 
 [日本語の README](README.ja.md)
 
@@ -35,7 +37,7 @@ Requires Node.js 24.
 
 ```bash
 npm ci
-npm run dev        # http://localhost:5173/assume-role/
+npm run dev        # http://localhost:5173/aws-credentials/
 npm run check      # typecheck, lint, format, markdownlint, tests, build
 npm run test:e2e   # real-browser checks (needs: npx playwright install chromium)
 ```

docs/01-overview.md

@@ -36,4 +36,4 @@ Temporary credentials matter because they expire on their own. A leaked long-ter
 
 - Running into an error: [06-operations-and-security.md](06-operations-and-security.md) has the error catalogue, CloudTrail fields and quotas.
 - How it got this way: [07-timeline.md](07-timeline.md).
-- The interactive version of all of this: <https://0-draft.github.io/assume-role/>.
+- The interactive version of all of this: <https://0-draft.github.io/aws-credentials/>.

e2e/a11y.spec.ts

@@ -6,7 +6,7 @@ import { expect, test } from "@playwright/test";
 for (const lang of ["en", "ja"] as const) {
   for (const scheme of ["light", "dark"] as const) {
     test(`no WCAG A/AA violations (${lang}, ${scheme})`, async ({ page }) => {
-      // axe walks the whole page (ten chapters); under a parallel run on a busy
+      // axe walks the whole page (eleven chapters); under a parallel run on a busy
       // machine that can pass the default 30 s.
       test.slow();
       await page.emulateMedia({ colorScheme: scheme });

index.html

@@ -3,21 +3,24 @@
   <head>
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>assume-role: AWS STS, drawn</title>
+    <title>aws-credentials: AWS credentials, drawn</title>
     <meta
       name="description"
-      content="AWS Security Token Service, drawn: global and regional endpoints, every STS API, every way a workload or a human ends up holding temporary credentials, session policies, role chaining and the errors you will meet. Bilingual (EN/JA)."
+      content="AWS credentials, drawn: how they are issued (STS global and regional endpoints, every STS API, every way a workload or a human ends up holding temporary credentials, session policies, role chaining, errors) and how they are used (SigV4 and SigV4a signing, presigned URLs, bearer API keys). Bilingual (EN/JA)."
     />
-    <link rel="canonical" href="https://0-draft.github.io/assume-role/" />
+    <link rel="canonical" href="https://0-draft.github.io/aws-credentials/" />
     <meta property="og:type" content="website" />
-    <meta property="og:site_name" content="assume-role" />
-    <meta property="og:title" content="assume-role: AWS STS, drawn" />
+    <meta property="og:site_name" content="aws-credentials" />
+    <meta property="og:title" content="aws-credentials: AWS credentials, drawn" />
     <meta
       property="og:description"
-      content="Every STS endpoint, all 11 APIs, every way a workload or a person ends up holding temporary credentials. Interactive, EN / 日本語."
+      content="Every STS endpoint, all 11 APIs, every way a workload or a person ends up holding temporary credentials, and how SigV4 signs every request with them. Interactive, EN / 日本語."
+    />
+    <meta property="og:url" content="https://0-draft.github.io/aws-credentials/" />
+    <meta
+      property="og:image"
+      content="https://0-draft.github.io/aws-credentials/og.png"
     />
-    <meta property="og:url" content="https://0-draft.github.io/assume-role/" />
-    <meta property="og:image" content="https://0-draft.github.io/assume-role/og.png" />
     <meta property="og:image:width" content="1200" />
     <meta property="og:image:height" content="630" />
     <meta
@@ -27,7 +30,8 @@
     <meta name="twitter:card" content="summary_large_image" />
     <meta name="theme-color" content="#8a1538" />
     <script>
-      // Apply a saved theme before first paint so it never flashes.
+      // Apply a saved theme before first paint so it never flashes. The key keeps
+      // the site's former name so saved choices survive the rename.
       try {
         const t = localStorage.getItem("assume-role:theme");
         if (t === "light" || t === "dark") document.documentElement.dataset.theme = t;

package.json

@@ -1,10 +1,10 @@
 {
-  "name": "assume-role",
+  "name": "aws-credentials",
   "private": true,
   "version": "0.1.0",
   "license": "MIT",
   "type": "module",
-  "description": "AWS STS, drawn: every endpoint, every API, every way a workload or a human ends up holding temporary credentials. Bilingual (EN/JA).",
+  "description": "AWS credentials, drawn: how they are issued (every STS endpoint, API and credential path) and how requests are signed with them (SigV4, SigV4a). Bilingual (EN/JA).",
   "engines": {
     "node": ">=24"
   },

playwright.config.ts

@@ -13,7 +13,7 @@ export default defineConfig({
   retries: process.env.CI ? 1 : 0,
   reporter: process.env.CI ? [["github"], ["html", { open: "never" }]] : "list",
   use: {
-    baseURL: `http://localhost:${PORT}/assume-role/`,
+    baseURL: `http://localhost:${PORT}/aws-credentials/`,
     trace: "retain-on-failure",
   },
   projects: [
@@ -28,7 +28,7 @@ export default defineConfig({
   ],
   webServer: {
     command: `npm run build && npx vite preview --port ${PORT} --strictPort`,
-    url: `http://localhost:${PORT}/assume-role/`,
+    url: `http://localhost:${PORT}/aws-credentials/`,
     reuseExistingServer: !process.env.CI,
     timeout: 120_000,
   },

scripts/og/og.html

@@ -159,10 +159,10 @@
   <body>
     <div class="wrap">
       <div>
-        <h1>AWS STS, drawn.</h1>
+        <h1>AWS credentials, drawn.</h1>
         <p>
-          Every endpoint, all 11 APIs, every way a workload or a person ends up holding
-          temporary credentials. Interactive, in
+          Every STS endpoint and API, every way a workload or a person ends up holding
+          temporary credentials, and how SigV4 signs with them. Interactive, in
           <span style="white-space: nowrap">EN / 日本語</span>.
         </p>
       </div>
@@ -185,6 +185,6 @@ <h1>AWS STS, drawn.</h1>
         </div>
       </div>
     </div>
-    <div class="brand">0-draft.github.io/<b>assume-role</b></div>
+    <div class="brand">0-draft.github.io/<b>aws-credentials</b></div>
   </body>
 </html>

src/components/layout/Footer.tsx

@@ -21,9 +21,9 @@ export function Footer() {
         <p>
           <a
             className="underline underline-offset-2"
-            href="https://github.com/0-draft/assume-role"
+            href="https://github.com/0-draft/aws-credentials"
           >
-            github.com/0-draft/assume-role
+            github.com/0-draft/aws-credentials
           </a>
         </p>
       </div>

src/components/layout/Header.tsx

@@ -6,6 +6,7 @@ import { useActiveSection } from "@/hooks/useActiveSection";
 const IDS = NAV.map((n) => n.id);
 
 type Theme = "light" | "dark";
+// Former site name, kept so saved choices survive the rename.
 const THEME_KEY = "assume-role:theme";
 
 function currentTheme(): Theme {

src/i18n/LangContext.tsx

@@ -4,8 +4,8 @@ import { type Lang, readStoredLang, resolveInitialLang, storeLang } from "./lang
 import { LangContext, type LangValue } from "./context";
 
 const TITLE: Record<Lang, string> = {
-  en: "assume-role: AWS STS, drawn",
-  ja: "assume-role: 図解 AWS STS",
+  en: "aws-credentials: AWS credentials, drawn",
+  ja: "aws-credentials: 図解 AWS 認証情報",
 };
 
 export function LangProvider({

src/i18n/lang.ts

@@ -5,6 +5,7 @@ export type Lang = (typeof LANGS)[number];
 export type L = Record<Lang, string>;
 
 export const DEFAULT_LANG: Lang = "en";
+// Former site name, kept so saved choices survive the rename.
 const STORAGE_KEY = "assume-role:lang";
 
 export function isLang(v: unknown): v is Lang {

vite.config.ts

@@ -4,9 +4,9 @@ import react from "@vitejs/plugin-react";
 import tailwindcss from "@tailwindcss/vite";
 import { fileURLToPath } from "node:url";
 
-// Served from https://0-draft.github.io/assume-role/ on GitHub Pages.
+// Served from https://0-draft.github.io/aws-credentials/ on GitHub Pages.
 export default defineConfig({
-  base: process.env.BASE_PATH ?? "/assume-role/",
+  base: process.env.BASE_PATH ?? "/aws-credentials/",
   plugins: [react(), tailwindcss()],
   build: {
     rolldownOptions: {