@better-forge/mirror 0.1.0 → 0.1.1

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 BetterStatusPage contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 BetterStatusPage contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,11 +1,11 @@
-# @better-forge/mirror
-
-Publishes a set of files to static hosting.
-
-- `createS3Transport`: uploads to S3-compatible storage (AWS S3, Cloudflare R2, Backblaze B2, MinIO) with a SigV4
-  signature over `fetch`; no SDK.
-- `createMirrorPublisher`: uploads files in the given order, skipping those whose content did not change since the
-  last successful upload, with a timeout per request.
-- `createIntervalRunner`: runs a job every interval, never two at once.
-
-Depends on: nothing.
+# @better-forge/mirror
+
+Publishes a set of files to static hosting.
+
+- `createS3Transport`: uploads to S3-compatible storage (AWS S3, Cloudflare R2, Backblaze B2, MinIO) with a SigV4
+  signature over `fetch`; no SDK.
+- `createMirrorPublisher`: uploads files in the given order, skipping those whose content did not change since the
+  last successful upload, with a timeout per request.
+- `createIntervalRunner`: runs a job every interval, never two at once.
+
+Depends on: nothing.

package/package.json

@@ -1,44 +1,44 @@
-{
-  "name": "@better-forge/mirror",
-  "version": "0.1.0",
-  "description": "Publishes a set of files to static hosting: S3-compatible storage transport, change detection and a single-flight interval runner.",
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/BElluu/Better-Forge.git",
-    "directory": "packages/mirror"
-  },
-  "homepage": "https://github.com/BElluu/Better-Forge/tree/main/packages/mirror#readme",
-  "bugs": {
-    "url": "https://github.com/BElluu/Better-Forge/issues"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "type": "module",
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
-    },
-    "./package.json": "./package.json"
-  },
-  "files": [
-    "dist",
-    "src",
-    "!src/**/*.test.*"
-  ],
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "dev": "tsc -p tsconfig.json --watch --preserveWatchOutput"
-  },
-  "devDependencies": {
-    "@types/node": "^26.6.2",
-    "typescript": "^5.7.3"
-  },
-  "engines": {
-    "node": ">=26.10.0"
-  }
-}
+{
+  "name": "@better-forge/mirror",
+  "version": "0.1.1",
+  "description": "Publishes a set of files to static hosting: S3-compatible storage transport, change detection and a single-flight interval runner.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/BElluu/Better-Forge.git",
+    "directory": "packages/mirror"
+  },
+  "homepage": "https://github.com/BElluu/Better-Forge/tree/main/packages/mirror#readme",
+  "bugs": {
+    "url": "https://github.com/BElluu/Better-Forge/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "src",
+    "!src/**/*.test.*"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "dev": "tsc -p tsconfig.json --watch --preserveWatchOutput"
+  },
+  "devDependencies": {
+    "@types/node": "^26.6.2",
+    "typescript": "^5.7.3"
+  },
+  "engines": {
+    "node": ">=26.10.0"
+  }
+}

package/src/index.ts

@@ -1,4 +1,4 @@
-export { createS3Transport, type S3Options } from './s3.js'
-export { createMirrorPublisher, type MirrorObject, type MirrorTransport, type MirrorPublisherOptions, type PublishResult } from './publisher.js'
-export { createIntervalRunner, type IntervalRunnerOptions } from './runner.js'
-export { signRequest, sha256Hex, type SignInput } from './sigv4.js'
+export { createS3Transport, type S3Options } from './s3.js'
+export { createMirrorPublisher, type MirrorObject, type MirrorTransport, type MirrorPublisherOptions, type PublishResult } from './publisher.js'
+export { createIntervalRunner, type IntervalRunnerOptions } from './runner.js'
+export { signRequest, sha256Hex, type SignInput } from './sigv4.js'

package/src/publisher.ts

@@ -1,56 +1,56 @@
-import { sha256Hex } from './sigv4.js'
-
-export interface MirrorObject {
-  /** Path below the target's root, without a leading slash. */
-  key: string
-  body: string | Uint8Array
-  contentType: string
-  cacheControl?: string
-}
-
-export interface MirrorTransport {
-  put(object: MirrorObject, signal?: AbortSignal): Promise<void>
-  delete(key: string, signal?: AbortSignal): Promise<void>
-}
-
-export interface PublishResult {
-  uploaded: string[]
-  unchanged: number
-}
-
-export interface MirrorPublisherOptions {
-  transport: MirrorTransport
-  /** Per request, in milliseconds. */
-  timeoutMs?: number
-}
-
-/**
- * Uploads objects in the order given, so a page that refers to other files goes after them. An object whose content
- * is the same as at its last successful upload is skipped. The first failure stops the run: whatever was not
- * uploaded is retried by the next one.
- */
-export function createMirrorPublisher({ transport, timeoutMs = 30_000 }: MirrorPublisherOptions) {
-  const uploadedHashes = new Map<string, string>()
-
-  return {
-    async publish(objects: MirrorObject[]): Promise<PublishResult> {
-      const uploaded: string[] = []
-      let unchanged = 0
-      for (const object of objects) {
-        const hash = sha256Hex(object.body)
-        if (uploadedHashes.get(object.key) === hash) {
-          unchanged++
-          continue
-        }
-        await transport.put(object, AbortSignal.timeout(timeoutMs))
-        uploadedHashes.set(object.key, hash)
-        uploaded.push(object.key)
-      }
-      return { uploaded, unchanged }
-    },
-    /** Forget what was uploaded, so the next run uploads everything. */
-    reset() {
-      uploadedHashes.clear()
-    },
-  }
-}
+import { sha256Hex } from './sigv4.js'
+
+export interface MirrorObject {
+  /** Path below the target's root, without a leading slash. */
+  key: string
+  body: string | Uint8Array
+  contentType: string
+  cacheControl?: string
+}
+
+export interface MirrorTransport {
+  put(object: MirrorObject, signal?: AbortSignal): Promise<void>
+  delete(key: string, signal?: AbortSignal): Promise<void>
+}
+
+export interface PublishResult {
+  uploaded: string[]
+  unchanged: number
+}
+
+export interface MirrorPublisherOptions {
+  transport: MirrorTransport
+  /** Per request, in milliseconds. */
+  timeoutMs?: number
+}
+
+/**
+ * Uploads objects in the order given, so a page that refers to other files goes after them. An object whose content
+ * is the same as at its last successful upload is skipped. The first failure stops the run: whatever was not
+ * uploaded is retried by the next one.
+ */
+export function createMirrorPublisher({ transport, timeoutMs = 30_000 }: MirrorPublisherOptions) {
+  const uploadedHashes = new Map<string, string>()
+
+  return {
+    async publish(objects: MirrorObject[]): Promise<PublishResult> {
+      const uploaded: string[] = []
+      let unchanged = 0
+      for (const object of objects) {
+        const hash = sha256Hex(object.body)
+        if (uploadedHashes.get(object.key) === hash) {
+          unchanged++
+          continue
+        }
+        await transport.put(object, AbortSignal.timeout(timeoutMs))
+        uploadedHashes.set(object.key, hash)
+        uploaded.push(object.key)
+      }
+      return { uploaded, unchanged }
+    },
+    /** Forget what was uploaded, so the next run uploads everything. */
+    reset() {
+      uploadedHashes.clear()
+    },
+  }
+}

package/src/runner.ts

@@ -1,48 +1,48 @@
-export interface IntervalRunnerOptions {
-  /** Read before every wait, so a changed setting applies without a restart. */
-  intervalMs: () => number
-  job: () => Promise<void>
-}
-
-/** Runs a job again `intervalMs` after the previous run ended, and never two at once. */
-export function createIntervalRunner({ intervalMs, job }: IntervalRunnerOptions) {
-  let timer: ReturnType<typeof setTimeout> | null = null
-  let running: Promise<void> | null = null
-  let stopped = true
-
-  const schedule = () => {
-    if (stopped) return
-    timer = setTimeout(() => { void runNow() }, intervalMs())
-    timer.unref()
-  }
-
-  /** Starts a run now unless one is going; resolves when the run in progress (new or not) ends. */
-  function runNow(): Promise<void> {
-    if (running) return running
-    if (timer) clearTimeout(timer)
-    running = job().catch(() => { /* the job reports its own failures */ }).finally(() => {
-      running = null
-      schedule()
-    })
-    return running
-  }
-
-  return {
-    start() {
-      if (!stopped) return
-      stopped = false
-      void runNow()
-    },
-    /**
-     * Stops scheduling. A run in progress is waited for unless `wait` is false; it then ends on its own and schedules
-     * nothing, unless the runner was started again meanwhile.
-     */
-    async stop({ wait = true }: { wait?: boolean } = {}) {
-      stopped = true
-      if (timer) clearTimeout(timer)
-      timer = null
-      if (wait) await running
-    },
-    runNow,
-  }
-}
+export interface IntervalRunnerOptions {
+  /** Read before every wait, so a changed setting applies without a restart. */
+  intervalMs: () => number
+  job: () => Promise<void>
+}
+
+/** Runs a job again `intervalMs` after the previous run ended, and never two at once. */
+export function createIntervalRunner({ intervalMs, job }: IntervalRunnerOptions) {
+  let timer: ReturnType<typeof setTimeout> | null = null
+  let running: Promise<void> | null = null
+  let stopped = true
+
+  const schedule = () => {
+    if (stopped) return
+    timer = setTimeout(() => { void runNow() }, intervalMs())
+    timer.unref()
+  }
+
+  /** Starts a run now unless one is going; resolves when the run in progress (new or not) ends. */
+  function runNow(): Promise<void> {
+    if (running) return running
+    if (timer) clearTimeout(timer)
+    running = job().catch(() => { /* the job reports its own failures */ }).finally(() => {
+      running = null
+      schedule()
+    })
+    return running
+  }
+
+  return {
+    start() {
+      if (!stopped) return
+      stopped = false
+      void runNow()
+    },
+    /**
+     * Stops scheduling. A run in progress is waited for unless `wait` is false; it then ends on its own and schedules
+     * nothing, unless the runner was started again meanwhile.
+     */
+    async stop({ wait = true }: { wait?: boolean } = {}) {
+      stopped = true
+      if (timer) clearTimeout(timer)
+      timer = null
+      if (wait) await running
+    },
+    runNow,
+  }
+}

package/src/s3.ts

@@ -1,64 +1,64 @@
-import { sha256Hex, signRequest } from './sigv4.js'
-import type { MirrorObject, MirrorTransport } from './publisher.js'
-
-export interface S3Options {
-  bucket: string
-  region: string
-  accessKeyId: string
-  secretAccessKey: string
-  /** Base URL of an S3-compatible service (R2, B2, MinIO); leave out for AWS S3. */
-  endpoint?: string
-  /** Prepended to every key, e.g. `status/`. */
-  prefix?: string
-  /** `https://host/bucket/key` instead of `https://bucket.host/key`. Always on when an endpoint is given. */
-  forcePathStyle?: boolean
-}
-
-/** Only the service's error code reaches a message, never its body, which may echo request details. */
-const errorCode = (body: string): string => /<Code>([A-Za-z0-9]+)<\/Code>/.exec(body)?.[1] ?? ''
-
-export function createS3Transport(options: S3Options): MirrorTransport {
-  const prefix = (options.prefix ?? '').replace(/^\/+/, '')
-
-  function urlFor(key: string): URL {
-    const objectKey = prefix + key
-    if (options.endpoint) return new URL(`${options.endpoint.replace(/\/+$/, '')}/${options.bucket}/${objectKey}`)
-    // A dot in the bucket name breaks the TLS name of the virtual-host form.
-    return options.forcePathStyle || options.bucket.includes('.')
-      ? new URL(`https://s3.${options.region}.amazonaws.com/${options.bucket}/${objectKey}`)
-      : new URL(`https://${options.bucket}.s3.${options.region}.amazonaws.com/${objectKey}`)
-  }
-
-  async function send(
-    method: 'PUT' | 'DELETE', key: string, body: Buffer<ArrayBuffer>, contentType: string | null, cacheControl: string | undefined, signal?: AbortSignal,
-  ) {
-    const url = urlFor(key)
-    const headers = signRequest({
-      method,
-      url,
-      headers: contentType ? { 'content-type': contentType } : {},
-      payloadHash: sha256Hex(body),
-      region: options.region,
-      service: 's3',
-      accessKeyId: options.accessKeyId,
-      secretAccessKey: options.secretAccessKey,
-      now: new Date(),
-    })
-    // Sent unsigned, as the service allows.
-    if (cacheControl) headers['cache-control'] = cacheControl
-    // fetch sets `host` from the URL.
-    delete headers['host']
-
-    // A redirect is never followed: it would send the body to a host nobody configured.
-    const res = await fetch(url, { method, headers, ...(method === 'PUT' ? { body } : {}), redirect: 'manual', ...(signal ? { signal } : {}) })
-    if (!res.ok) {
-      const code = errorCode(await res.text().catch(() => ''))
-      throw new Error(`${method === 'PUT' ? 'Upload of' : 'Removal of'} ${key} failed: HTTP ${res.status}${code ? ` ${code}` : ''}`)
-    }
-  }
-
-  return {
-    put: (object: MirrorObject, signal?: AbortSignal) => send('PUT', object.key, Buffer.from(object.body), object.contentType, object.cacheControl, signal),
-    delete: (key: string, signal?: AbortSignal) => send('DELETE', key, Buffer.alloc(0), null, undefined, signal),
-  }
-}
+import { sha256Hex, signRequest } from './sigv4.js'
+import type { MirrorObject, MirrorTransport } from './publisher.js'
+
+export interface S3Options {
+  bucket: string
+  region: string
+  accessKeyId: string
+  secretAccessKey: string
+  /** Base URL of an S3-compatible service (R2, B2, MinIO); leave out for AWS S3. */
+  endpoint?: string
+  /** Prepended to every key, e.g. `status/`. */
+  prefix?: string
+  /** `https://host/bucket/key` instead of `https://bucket.host/key`. Always on when an endpoint is given. */
+  forcePathStyle?: boolean
+}
+
+/** Only the service's error code reaches a message, never its body, which may echo request details. */
+const errorCode = (body: string): string => /<Code>([A-Za-z0-9]+)<\/Code>/.exec(body)?.[1] ?? ''
+
+export function createS3Transport(options: S3Options): MirrorTransport {
+  const prefix = (options.prefix ?? '').replace(/^\/+/, '')
+
+  function urlFor(key: string): URL {
+    const objectKey = prefix + key
+    if (options.endpoint) return new URL(`${options.endpoint.replace(/\/+$/, '')}/${options.bucket}/${objectKey}`)
+    // A dot in the bucket name breaks the TLS name of the virtual-host form.
+    return options.forcePathStyle || options.bucket.includes('.')
+      ? new URL(`https://s3.${options.region}.amazonaws.com/${options.bucket}/${objectKey}`)
+      : new URL(`https://${options.bucket}.s3.${options.region}.amazonaws.com/${objectKey}`)
+  }
+
+  async function send(
+    method: 'PUT' | 'DELETE', key: string, body: Buffer<ArrayBuffer>, contentType: string | null, cacheControl: string | undefined, signal?: AbortSignal,
+  ) {
+    const url = urlFor(key)
+    const headers = signRequest({
+      method,
+      url,
+      headers: contentType ? { 'content-type': contentType } : {},
+      payloadHash: sha256Hex(body),
+      region: options.region,
+      service: 's3',
+      accessKeyId: options.accessKeyId,
+      secretAccessKey: options.secretAccessKey,
+      now: new Date(),
+    })
+    // Sent unsigned, as the service allows.
+    if (cacheControl) headers['cache-control'] = cacheControl
+    // fetch sets `host` from the URL.
+    delete headers['host']
+
+    // A redirect is never followed: it would send the body to a host nobody configured.
+    const res = await fetch(url, { method, headers, ...(method === 'PUT' ? { body } : {}), redirect: 'manual', ...(signal ? { signal } : {}) })
+    if (!res.ok) {
+      const code = errorCode(await res.text().catch(() => ''))
+      throw new Error(`${method === 'PUT' ? 'Upload of' : 'Removal of'} ${key} failed: HTTP ${res.status}${code ? ` ${code}` : ''}`)
+    }
+  }
+
+  return {
+    put: (object: MirrorObject, signal?: AbortSignal) => send('PUT', object.key, Buffer.from(object.body), object.contentType, object.cacheControl, signal),
+    delete: (key: string, signal?: AbortSignal) => send('DELETE', key, Buffer.alloc(0), null, undefined, signal),
+  }
+}

package/src/sigv4.ts

@@ -1,51 +1,51 @@
-import { createHash, createHmac } from 'node:crypto'
-
-export interface SignInput {
-  method: string
-  url: URL
-  /** Headers to sign besides `host`, `x-amz-content-sha256` and `x-amz-date`, which are added. */
-  headers: Record<string, string>
-  payloadHash: string
-  region: string
-  service: string
-  accessKeyId: string
-  secretAccessKey: string
-  now: Date
-}
-
-export const sha256Hex = (data: string | Uint8Array): string => createHash('sha256').update(data).digest('hex')
-const hmac = (key: string | Buffer, data: string): Buffer => createHmac('sha256', key).update(data).digest()
-
-/** RFC 3986 encoding of one path segment, which is how S3 canonicalises object keys. */
-const encodeSegment = (segment: string): string =>
-  encodeURIComponent(segment).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`)
-
-/** The headers of a SigV4-signed request: everything the caller passes, plus the signature headers. */
-export function signRequest(input: SignInput): Record<string, string> {
-  const amzDate = input.now.toISOString().replace(/[-:]|\.\d{3}/g, '')
-  const day = amzDate.slice(0, 8)
-  const headers: Record<string, string> = {
-    ...input.headers,
-    host: input.url.host,
-    'x-amz-content-sha256': input.payloadHash,
-    'x-amz-date': amzDate,
-  }
-  const byName = new Map(Object.entries(headers).map(([name, value]) => [name.toLowerCase(), value.trim()]))
-  const names = [...byName.keys()].sort()
-  const canonicalHeaders = names.map((name) => `${name}:${byName.get(name)}\n`).join('')
-  const signedHeaders = names.join(';')
-  const canonicalUri = input.url.pathname.split('/').map((s) => encodeSegment(decodeURIComponent(s))).join('/')
-  const canonicalQuery = [...input.url.searchParams].sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
-    .map(([k, v]) => `${encodeSegment(k)}=${encodeSegment(v)}`).join('&')
-  const canonicalRequest = [input.method, canonicalUri, canonicalQuery, canonicalHeaders, signedHeaders, input.payloadHash].join('\n')
-
-  const scope = `${day}/${input.region}/${input.service}/aws4_request`
-  const stringToSign = ['AWS4-HMAC-SHA256', amzDate, scope, sha256Hex(canonicalRequest)].join('\n')
-  const signingKey = hmac(hmac(hmac(hmac(`AWS4${input.secretAccessKey}`, day), input.region), input.service), 'aws4_request')
-  const signature = createHmac('sha256', signingKey).update(stringToSign).digest('hex')
-
-  return {
-    ...headers,
-    authorization: `AWS4-HMAC-SHA256 Credential=${input.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`,
-  }
-}
+import { createHash, createHmac } from 'node:crypto'
+
+export interface SignInput {
+  method: string
+  url: URL
+  /** Headers to sign besides `host`, `x-amz-content-sha256` and `x-amz-date`, which are added. */
+  headers: Record<string, string>
+  payloadHash: string
+  region: string
+  service: string
+  accessKeyId: string
+  secretAccessKey: string
+  now: Date
+}
+
+export const sha256Hex = (data: string | Uint8Array): string => createHash('sha256').update(data).digest('hex')
+const hmac = (key: string | Buffer, data: string): Buffer => createHmac('sha256', key).update(data).digest()
+
+/** RFC 3986 encoding of one path segment, which is how S3 canonicalises object keys. */
+const encodeSegment = (segment: string): string =>
+  encodeURIComponent(segment).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`)
+
+/** The headers of a SigV4-signed request: everything the caller passes, plus the signature headers. */
+export function signRequest(input: SignInput): Record<string, string> {
+  const amzDate = input.now.toISOString().replace(/[-:]|\.\d{3}/g, '')
+  const day = amzDate.slice(0, 8)
+  const headers: Record<string, string> = {
+    ...input.headers,
+    host: input.url.host,
+    'x-amz-content-sha256': input.payloadHash,
+    'x-amz-date': amzDate,
+  }
+  const byName = new Map(Object.entries(headers).map(([name, value]) => [name.toLowerCase(), value.trim()]))
+  const names = [...byName.keys()].sort()
+  const canonicalHeaders = names.map((name) => `${name}:${byName.get(name)}\n`).join('')
+  const signedHeaders = names.join(';')
+  const canonicalUri = input.url.pathname.split('/').map((s) => encodeSegment(decodeURIComponent(s))).join('/')
+  const canonicalQuery = [...input.url.searchParams].sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+    .map(([k, v]) => `${encodeSegment(k)}=${encodeSegment(v)}`).join('&')
+  const canonicalRequest = [input.method, canonicalUri, canonicalQuery, canonicalHeaders, signedHeaders, input.payloadHash].join('\n')
+
+  const scope = `${day}/${input.region}/${input.service}/aws4_request`
+  const stringToSign = ['AWS4-HMAC-SHA256', amzDate, scope, sha256Hex(canonicalRequest)].join('\n')
+  const signingKey = hmac(hmac(hmac(hmac(`AWS4${input.secretAccessKey}`, day), input.region), input.service), 'aws4_request')
+  const signature = createHmac('sha256', signingKey).update(stringToSign).digest('hex')
+
+  return {
+    ...headers,
+    authorization: `AWS4-HMAC-SHA256 Credential=${input.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`,
+  }
+}