@haneullabs/signers 0.1.0 → 1.0.1

package/dist/cjs/aws/aws-kms-signer.js

@@ -1,114 +0,0 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __typeError = (msg) => {
-  throw TypeError(msg);
-};
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
-var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
-var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
-var __privateSet = (obj, member, value, setter) => (__accessCheck(obj, member, "write to private field"), setter ? setter.call(obj, value) : member.set(obj, value), value);
-var aws_kms_signer_exports = {};
-__export(aws_kms_signer_exports, {
-  AwsKmsSigner: () => AwsKmsSigner
-});
-module.exports = __toCommonJS(aws_kms_signer_exports);
-var import_cryptography = require("@haneullabs/haneul/cryptography");
-var import_utils = require("@haneullabs/haneul/utils");
-var import_utils2 = require("../utils/utils.js");
-var import_aws_client = require("./aws-client.js");
-var _publicKey, _client, _kmsKeyId;
-const _AwsKmsSigner = class _AwsKmsSigner extends import_cryptography.Signer {
-  /**
-   * Creates an instance of AwsKmsSigner. It's expected to call the static `fromKeyId` method to create an instance.
-   * For example:
-   * ```
-   * const signer = await AwsKmsSigner.fromKeyId(keyId, options);
-   * ```
-   * @throws Will throw an error if required AWS credentials or region are not provided.
-   */
-  constructor({ kmsKeyId, client, publicKey }) {
-    super();
-    __privateAdd(this, _publicKey);
-    /** AWS KMS client instance */
-    __privateAdd(this, _client);
-    /** AWS KMS Key ID used for signing */
-    __privateAdd(this, _kmsKeyId);
-    if (!kmsKeyId) throw new Error("KMS Key ID is required");
-    __privateSet(this, _client, client);
-    __privateSet(this, _kmsKeyId, kmsKeyId);
-    __privateSet(this, _publicKey, publicKey);
-  }
-  /**
-   * Retrieves the key scheme used by this signer.
-   * @returns AWS supports only Secp256k1 and Secp256r1 schemes.
-   */
-  getKeyScheme() {
-    return import_cryptography.SIGNATURE_FLAG_TO_SCHEME[__privateGet(this, _publicKey).flag()];
-  }
-  /**
-   * Retrieves the public key associated with this signer.
-   * @returns The Secp256k1PublicKey instance.
-   * @throws Will throw an error if the public key has not been initialized.
-   */
-  getPublicKey() {
-    return __privateGet(this, _publicKey);
-  }
-  /**
-   * Signs the given data using AWS KMS.
-   * @param bytes - The data to be signed as a Uint8Array.
-   * @returns A promise that resolves to the signature as a Uint8Array.
-   * @throws Will throw an error if the public key is not initialized or if signing fails.
-   */
-  async sign(bytes) {
-    const signResponse = await __privateGet(this, _client).runCommand("Sign", {
-      KeyId: __privateGet(this, _kmsKeyId),
-      Message: (0, import_utils.toBase64)(bytes),
-      MessageType: "RAW",
-      SigningAlgorithm: "ECDSA_SHA_256"
-    });
-    return (0, import_utils2.getConcatenatedSignature)((0, import_utils.fromBase64)(signResponse.Signature), this.getKeyScheme());
-  }
-  /**
-   * Synchronous signing is not supported by AWS KMS.
-   * @throws Always throws an error indicating synchronous signing is unsupported.
-   * @deprecated use `sign` instead
-   */
-  signData() {
-    throw new Error("KMS Signer does not support sync signing");
-  }
-  /**
-   * Prepares the signer by fetching and setting the public key from AWS KMS.
-   * It is recommended to initialize an `AwsKmsSigner` instance using this function.
-   * @returns A promise that resolves once a `AwsKmsSigner` instance is prepared (public key is set).
-   */
-  static async fromKeyId(keyId, options) {
-    const client = new import_aws_client.AwsKmsClient(options);
-    const pubKey = await client.getPublicKey(keyId);
-    return new _AwsKmsSigner({
-      kmsKeyId: keyId,
-      client,
-      publicKey: pubKey
-    });
-  }
-};
-_publicKey = new WeakMap();
-_client = new WeakMap();
-_kmsKeyId = new WeakMap();
-let AwsKmsSigner = _AwsKmsSigner;
-//# sourceMappingURL=aws-kms-signer.js.map

package/dist/cjs/aws/aws-kms-signer.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../src/aws/aws-kms-signer.ts"],
-  "sourcesContent": ["// Copyright (c) Mysten Labs, Inc.\n// SPDX-License-Identifier: Apache-2.0\nimport type { PublicKey, SignatureFlag } from '@haneullabs/haneul/cryptography';\nimport { SIGNATURE_FLAG_TO_SCHEME, Signer } from '@haneullabs/haneul/cryptography';\nimport { fromBase64, toBase64 } from '@haneullabs/haneul/utils';\n\nimport { getConcatenatedSignature } from '../utils/utils.js';\nimport type { AwsClientOptions } from './aws-client.js';\nimport { AwsKmsClient } from './aws-client.js';\n\n/**\n * Configuration options for initializing the AwsKmsSigner.\n */\nexport interface AwsKmsSignerOptions {\n\t/** AWS KMS Key ID used for signing */\n\tkmsKeyId: string;\n\t/** Options for setting up the AWS KMS client */\n\tclient: AwsKmsClient;\n\t/** Public key */\n\tpublicKey: PublicKey;\n}\n\n/**\n * Aws KMS Signer integrates AWS Key Management Service (KMS) with the Haneul blockchain\n * to provide signing capabilities using AWS-managed cryptographic keys.\n */\nexport class AwsKmsSigner extends Signer {\n\t#publicKey: PublicKey;\n\t/** AWS KMS client instance */\n\t#client: AwsKmsClient;\n\t/** AWS KMS Key ID used for signing */\n\t#kmsKeyId: string;\n\n\t/**\n\t * Creates an instance of AwsKmsSigner. It's expected to call the static `fromKeyId` method to create an instance.\n\t * For example:\n\t * ```\n\t * const signer = await AwsKmsSigner.fromKeyId(keyId, options);\n\t * ```\n\t * @throws Will throw an error if required AWS credentials or region are not provided.\n\t */\n\tconstructor({ kmsKeyId, client, publicKey }: AwsKmsSignerOptions) {\n\t\tsuper();\n\t\tif (!kmsKeyId) throw new Error('KMS Key ID is required');\n\n\t\tthis.#client = client;\n\t\tthis.#kmsKeyId = kmsKeyId;\n\t\tthis.#publicKey = publicKey;\n\t}\n\n\t/**\n\t * Retrieves the key scheme used by this signer.\n\t * @returns AWS supports only Secp256k1 and Secp256r1 schemes.\n\t */\n\tgetKeyScheme() {\n\t\treturn SIGNATURE_FLAG_TO_SCHEME[this.#publicKey.flag() as SignatureFlag];\n\t}\n\n\t/**\n\t * Retrieves the public key associated with this signer.\n\t * @returns The Secp256k1PublicKey instance.\n\t * @throws Will throw an error if the public key has not been initialized.\n\t */\n\tgetPublicKey() {\n\t\treturn this.#publicKey;\n\t}\n\n\t/**\n\t * Signs the given data using AWS KMS.\n\t * @param bytes - The data to be signed as a Uint8Array.\n\t * @returns A promise that resolves to the signature as a Uint8Array.\n\t * @throws Will throw an error if the public key is not initialized or if signing fails.\n\t */\n\tasync sign(bytes: Uint8Array): Promise<Uint8Array<ArrayBuffer>> {\n\t\tconst signResponse = await this.#client.runCommand('Sign', {\n\t\t\tKeyId: this.#kmsKeyId,\n\t\t\tMessage: toBase64(bytes),\n\t\t\tMessageType: 'RAW',\n\t\t\tSigningAlgorithm: 'ECDSA_SHA_256',\n\t\t});\n\n\t\t// Concatenate the signature components into a compact form\n\t\treturn getConcatenatedSignature(fromBase64(signResponse.Signature), this.getKeyScheme());\n\t}\n\n\t/**\n\t * Synchronous signing is not supported by AWS KMS.\n\t * @throws Always throws an error indicating synchronous signing is unsupported.\n\t * @deprecated use `sign` instead\n\t */\n\tsignData(): never {\n\t\tthrow new Error('KMS Signer does not support sync signing');\n\t}\n\n\t/**\n\t * Prepares the signer by fetching and setting the public key from AWS KMS.\n\t * It is recommended to initialize an `AwsKmsSigner` instance using this function.\n\t * @returns A promise that resolves once a `AwsKmsSigner` instance is prepared (public key is set).\n\t */\n\tstatic async fromKeyId(keyId: string, options: AwsClientOptions) {\n\t\tconst client = new AwsKmsClient(options);\n\n\t\tconst pubKey = await client.getPublicKey(keyId);\n\n\t\treturn new AwsKmsSigner({\n\t\t\tkmsKeyId: keyId,\n\t\t\tclient,\n\t\t\tpublicKey: pubKey,\n\t\t});\n\t}\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAGA,0BAAiD;AACjD,mBAAqC;AAErC,IAAAA,gBAAyC;AAEzC,wBAA6B;AAR7B;AA0BO,MAAM,gBAAN,MAAM,sBAAqB,2BAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAexC,YAAY,EAAE,UAAU,QAAQ,UAAU,GAAwB;AACjE,UAAM;AAfP;AAEA;AAAA;AAEA;AAAA;AAYC,QAAI,CAAC,SAAU,OAAM,IAAI,MAAM,wBAAwB;AAEvD,uBAAK,SAAU;AACf,uBAAK,WAAY;AACjB,uBAAK,YAAa;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,eAAe;AACd,WAAO,6CAAyB,mBAAK,YAAW,KAAK,CAAkB;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,eAAe;AACd,WAAO,mBAAK;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAK,OAAqD;AAC/D,UAAM,eAAe,MAAM,mBAAK,SAAQ,WAAW,QAAQ;AAAA,MAC1D,OAAO,mBAAK;AAAA,MACZ,aAAS,uBAAS,KAAK;AAAA,MACvB,aAAa;AAAA,MACb,kBAAkB;AAAA,IACnB,CAAC;AAGD,eAAO,4CAAyB,yBAAW,aAAa,SAAS,GAAG,KAAK,aAAa,CAAC;AAAA,EACxF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,WAAkB;AACjB,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC3D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAa,UAAU,OAAe,SAA2B;AAChE,UAAM,SAAS,IAAI,+BAAa,OAAO;AAEvC,UAAM,SAAS,MAAM,OAAO,aAAa,KAAK;AAE9C,WAAO,IAAI,cAAa;AAAA,MACvB,UAAU;AAAA,MACV;AAAA,MACA,WAAW;AAAA,IACZ,CAAC;AAAA,EACF;AACD;AAnFC;AAEA;AAEA;AALM,IAAM,eAAN;",
-  "names": ["import_utils"]
-}

package/dist/cjs/aws/aws4fetch.d.ts

@@ -1,125 +0,0 @@
-type AwsRequestInit = RequestInit & {
-    aws?: {
-        accessKeyId?: string;
-        secretAccessKey?: string;
-        sessionToken?: string;
-        service?: string;
-        region?: string;
-        cache?: Map<string, ArrayBuffer>;
-        datetime?: string;
-        signQuery?: boolean;
-        appendSessionToken?: boolean;
-        allHeaders?: boolean;
-        singleEncode?: boolean;
-    };
-};
-export declare class AwsClient {
-    accessKeyId: string;
-    secretAccessKey: string;
-    sessionToken: string | undefined;
-    service: string | undefined;
-    region: string | undefined;
-    cache: Map<any, any>;
-    retries: number;
-    initRetryMs: number;
-    /**
-     * @param {} options
-     */
-    constructor({ accessKeyId, secretAccessKey, sessionToken, service, region, cache, retries, initRetryMs, }: {
-        accessKeyId: string;
-        secretAccessKey: string;
-        sessionToken?: string;
-        service?: string;
-        region?: string;
-        cache?: Map<string, ArrayBuffer>;
-        retries?: number;
-        initRetryMs?: number;
-    });
-    sign(input: Request | {
-        toString: () => string;
-    }, init: AwsRequestInit): Promise<Request>;
-    /**
-     * @param {Request | { toString: () => string }} input
-     * @param {?AwsRequestInit} [init]
-     * @returns {Promise<Response>}
-     */
-    fetch(input: Request | {
-        toString: () => string;
-    }, init: AwsRequestInit): Promise<Response>;
-}
-export declare class AwsV4Signer {
-    method: any;
-    url: URL;
-    headers: Headers;
-    body: any;
-    accessKeyId: any;
-    secretAccessKey: any;
-    sessionToken: any;
-    service: any;
-    region: any;
-    cache: any;
-    datetime: any;
-    signQuery: any;
-    appendSessionToken: any;
-    signableHeaders: any[];
-    signedHeaders: any;
-    canonicalHeaders: any;
-    credentialString: string;
-    encodedPath: string;
-    encodedSearch: string;
-    /**
-     * @param {} options
-     */
-    constructor({ method, url, headers, body, accessKeyId, secretAccessKey, sessionToken, service, region, cache, datetime, signQuery, appendSessionToken, allHeaders, singleEncode, }: {
-        method?: string;
-        url: string;
-        headers?: HeadersInit;
-        body?: BodyInit | null;
-        accessKeyId: string;
-        secretAccessKey: string;
-        sessionToken?: string;
-        service?: string;
-        region?: string;
-        cache?: Map<string, ArrayBuffer>;
-        datetime?: string;
-        signQuery?: boolean;
-        appendSessionToken?: boolean;
-        allHeaders?: boolean;
-        singleEncode?: boolean;
-    });
-    /**
-     * @returns {Promise<{
-     *   method: string
-     *   url: URL
-     *   headers: Headers
-     *   body?: BodyInit | null
-     * }>}
-     */
-    sign(): Promise<{
-        method: any;
-        url: URL;
-        headers: Headers;
-        body: any;
-    }>;
-    /**
-     * @returns {Promise<string>}
-     */
-    authHeader(): Promise<string>;
-    /**
-     * @returns {Promise<string>}
-     */
-    signature(): Promise<string>;
-    /**
-     * @returns {Promise<string>}
-     */
-    stringToSign(): Promise<string>;
-    /**
-     * @returns {Promise<string>}
-     */
-    canonicalString(): Promise<string>;
-    /**
-     * @returns {Promise<string>}
-     */
-    hexBodyHash(): Promise<string>;
-}
-export {};

package/dist/cjs/aws/aws4fetch.js

@@ -1,382 +0,0 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var aws4fetch_exports = {};
-__export(aws4fetch_exports, {
-  AwsClient: () => AwsClient,
-  AwsV4Signer: () => AwsV4Signer
-});
-module.exports = __toCommonJS(aws4fetch_exports);
-/**
- * Original implementation https://github.com/mhart/aws4fetch, inlined to reduce external dependencies
- * @license MIT <https://opensource.org/licenses/MIT>
- * @copyright Michael Hart 2024
- */
-const encoder = new TextEncoder();
-const HOST_SERVICES = {
-  appstream2: "appstream",
-  cloudhsmv2: "cloudhsm",
-  email: "ses",
-  marketplace: "aws-marketplace",
-  mobile: "AWSMobileHubService",
-  pinpoint: "mobiletargeting",
-  queue: "sqs",
-  "git-codecommit": "codecommit",
-  "mturk-requester-sandbox": "mturk-requester",
-  "personalize-runtime": "personalize"
-};
-const UNSIGNABLE_HEADERS = /* @__PURE__ */ new Set([
-  "authorization",
-  "content-type",
-  "content-length",
-  "user-agent",
-  "presigned-expires",
-  "expect",
-  "x-amzn-trace-id",
-  "range",
-  "connection"
-]);
-class AwsClient {
-  /**
-   * @param {} options
-   */
-  constructor({
-    accessKeyId,
-    secretAccessKey,
-    sessionToken,
-    service,
-    region,
-    cache,
-    retries,
-    initRetryMs
-  }) {
-    if (accessKeyId == null) throw new TypeError("accessKeyId is a required option");
-    if (secretAccessKey == null) throw new TypeError("secretAccessKey is a required option");
-    this.accessKeyId = accessKeyId;
-    this.secretAccessKey = secretAccessKey;
-    this.sessionToken = sessionToken;
-    this.service = service;
-    this.region = region;
-    this.cache = cache || /* @__PURE__ */ new Map();
-    this.retries = retries != null ? retries : 10;
-    this.initRetryMs = initRetryMs || 50;
-  }
-  async sign(input, init) {
-    if (input instanceof Request) {
-      const { method, url, headers, body } = input;
-      init = Object.assign({ method, url, headers }, init);
-      if (init.body == null && headers.has("Content-Type")) {
-        init.body = body != null && headers.has("X-Amz-Content-Sha256") ? body : await input.clone().arrayBuffer();
-      }
-      input = url;
-    }
-    const signer = new AwsV4Signer(
-      Object.assign({ url: input.toString() }, init, this, init && init.aws)
-    );
-    const signed = Object.assign({}, init, await signer.sign());
-    delete signed.aws;
-    try {
-      return new Request(signed.url.toString(), signed);
-    } catch (e) {
-      if (e instanceof TypeError) {
-        return new Request(signed.url.toString(), Object.assign({ duplex: "half" }, signed));
-      }
-      throw e;
-    }
-  }
-  /**
-   * @param {Request | { toString: () => string }} input
-   * @param {?AwsRequestInit} [init]
-   * @returns {Promise<Response>}
-   */
-  async fetch(input, init) {
-    for (let i = 0; i <= this.retries; i++) {
-      const fetched = fetch(await this.sign(input, init));
-      if (i === this.retries) {
-        return fetched;
-      }
-      const res = await fetched;
-      if (res.status < 500 && res.status !== 429) {
-        return res;
-      }
-      await new Promise(
-        (resolve) => setTimeout(resolve, Math.random() * this.initRetryMs * Math.pow(2, i))
-      );
-    }
-    throw new Error("An unknown error occurred, ensure retries is not negative");
-  }
-}
-class AwsV4Signer {
-  /**
-   * @param {} options
-   */
-  constructor({
-    method,
-    url,
-    headers,
-    body,
-    accessKeyId,
-    secretAccessKey,
-    sessionToken,
-    service,
-    region,
-    cache,
-    datetime,
-    signQuery,
-    appendSessionToken,
-    allHeaders,
-    singleEncode
-  }) {
-    if (url == null) throw new TypeError("url is a required option");
-    if (accessKeyId == null) throw new TypeError("accessKeyId is a required option");
-    if (secretAccessKey == null) throw new TypeError("secretAccessKey is a required option");
-    this.method = method || (body ? "POST" : "GET");
-    this.url = new URL(url);
-    this.headers = new Headers(headers || {});
-    this.body = body;
-    this.accessKeyId = accessKeyId;
-    this.secretAccessKey = secretAccessKey;
-    this.sessionToken = sessionToken;
-    let guessedService, guessedRegion;
-    if (!service || !region) {
-      [guessedService, guessedRegion] = guessServiceRegion(this.url, this.headers);
-    }
-    this.service = service || guessedService || "";
-    this.region = region || guessedRegion || "us-east-1";
-    this.cache = cache || /* @__PURE__ */ new Map();
-    this.datetime = datetime || (/* @__PURE__ */ new Date()).toISOString().replace(/[:-]|\.\d{3}/g, "");
-    this.signQuery = signQuery;
-    this.appendSessionToken = appendSessionToken || this.service === "iotdevicegateway";
-    this.headers.delete("Host");
-    if (this.service === "s3" && !this.signQuery && !this.headers.has("X-Amz-Content-Sha256")) {
-      this.headers.set("X-Amz-Content-Sha256", "UNSIGNED-PAYLOAD");
-    }
-    const params = this.signQuery ? this.url.searchParams : this.headers;
-    params.set("X-Amz-Date", this.datetime);
-    if (this.sessionToken && !this.appendSessionToken) {
-      params.set("X-Amz-Security-Token", this.sessionToken);
-    }
-    this.signableHeaders = ["host", ...this.headers.keys()].filter((header) => allHeaders || !UNSIGNABLE_HEADERS.has(header)).sort();
-    this.signedHeaders = this.signableHeaders.join(";");
-    this.canonicalHeaders = this.signableHeaders.map(
-      (header) => header + ":" + (header === "host" ? this.url.host : (this.headers.get(header) || "").replace(/\s+/g, " "))
-    ).join("\n");
-    this.credentialString = [
-      this.datetime.slice(0, 8),
-      this.region,
-      this.service,
-      "aws4_request"
-    ].join("/");
-    if (this.signQuery) {
-      if (this.service === "s3" && !params.has("X-Amz-Expires")) {
-        params.set("X-Amz-Expires", "86400");
-      }
-      params.set("X-Amz-Algorithm", "AWS4-HMAC-SHA256");
-      params.set("X-Amz-Credential", this.accessKeyId + "/" + this.credentialString);
-      params.set("X-Amz-SignedHeaders", this.signedHeaders);
-    }
-    if (this.service === "s3") {
-      try {
-        this.encodedPath = decodeURIComponent(this.url.pathname.replace(/\+/g, " "));
-      } catch {
-        this.encodedPath = this.url.pathname;
-      }
-    } else {
-      this.encodedPath = this.url.pathname.replace(/\/+/g, "/");
-    }
-    if (!singleEncode) {
-      this.encodedPath = encodeURIComponent(this.encodedPath).replace(/%2F/g, "/");
-    }
-    this.encodedPath = encodeRfc3986(this.encodedPath);
-    const seenKeys = /* @__PURE__ */ new Set();
-    this.encodedSearch = [...this.url.searchParams].filter(([k]) => {
-      if (!k) return false;
-      if (this.service === "s3") {
-        if (seenKeys.has(k)) return false;
-        seenKeys.add(k);
-      }
-      return true;
-    }).map((pair) => pair.map((p) => encodeRfc3986(encodeURIComponent(p)))).sort(([k1, v1], [k2, v2]) => k1 < k2 ? -1 : k1 > k2 ? 1 : v1 < v2 ? -1 : v1 > v2 ? 1 : 0).map((pair) => pair.join("=")).join("&");
-  }
-  /**
-   * @returns {Promise<{
-   *   method: string
-   *   url: URL
-   *   headers: Headers
-   *   body?: BodyInit | null
-   * }>}
-   */
-  async sign() {
-    if (this.signQuery) {
-      this.url.searchParams.set("X-Amz-Signature", await this.signature());
-      if (this.sessionToken && this.appendSessionToken) {
-        this.url.searchParams.set("X-Amz-Security-Token", this.sessionToken);
-      }
-    } else {
-      this.headers.set("Authorization", await this.authHeader());
-    }
-    return {
-      method: this.method,
-      url: this.url,
-      headers: this.headers,
-      body: this.body
-    };
-  }
-  /**
-   * @returns {Promise<string>}
-   */
-  async authHeader() {
-    return [
-      "AWS4-HMAC-SHA256 Credential=" + this.accessKeyId + "/" + this.credentialString,
-      "SignedHeaders=" + this.signedHeaders,
-      "Signature=" + await this.signature()
-    ].join(", ");
-  }
-  /**
-   * @returns {Promise<string>}
-   */
-  async signature() {
-    const date = this.datetime.slice(0, 8);
-    const cacheKey = [this.secretAccessKey, date, this.region, this.service].join();
-    let kCredentials = this.cache.get(cacheKey);
-    if (!kCredentials) {
-      const kDate = await hmac("AWS4" + this.secretAccessKey, date);
-      const kRegion = await hmac(kDate, this.region);
-      const kService = await hmac(kRegion, this.service);
-      kCredentials = await hmac(kService, "aws4_request");
-      this.cache.set(cacheKey, kCredentials);
-    }
-    return buf2hex(await hmac(kCredentials, await this.stringToSign()));
-  }
-  /**
-   * @returns {Promise<string>}
-   */
-  async stringToSign() {
-    return [
-      "AWS4-HMAC-SHA256",
-      this.datetime,
-      this.credentialString,
-      buf2hex(await hash(await this.canonicalString()))
-    ].join("\n");
-  }
-  /**
-   * @returns {Promise<string>}
-   */
-  async canonicalString() {
-    return [
-      this.method.toUpperCase(),
-      this.encodedPath,
-      this.encodedSearch,
-      this.canonicalHeaders + "\n",
-      this.signedHeaders,
-      await this.hexBodyHash()
-    ].join("\n");
-  }
-  /**
-   * @returns {Promise<string>}
-   */
-  async hexBodyHash() {
-    let hashHeader = this.headers.get("X-Amz-Content-Sha256") || (this.service === "s3" && this.signQuery ? "UNSIGNED-PAYLOAD" : null);
-    if (hashHeader == null) {
-      if (this.body && typeof this.body !== "string" && !("byteLength" in this.body)) {
-        throw new Error(
-          "body must be a string, ArrayBuffer or ArrayBufferView, unless you include the X-Amz-Content-Sha256 header"
-        );
-      }
-      hashHeader = buf2hex(await hash(this.body || ""));
-    }
-    return hashHeader;
-  }
-}
-async function hmac(key, string) {
-  const cryptoKey = await crypto.subtle.importKey(
-    "raw",
-    typeof key === "string" ? encoder.encode(key) : key,
-    { name: "HMAC", hash: { name: "SHA-256" } },
-    false,
-    ["sign"]
-  );
-  return crypto.subtle.sign("HMAC", cryptoKey, encoder.encode(string));
-}
-async function hash(content) {
-  return crypto.subtle.digest(
-    "SHA-256",
-    typeof content === "string" ? encoder.encode(content) : content
-  );
-}
-const HEX_CHARS = ["0", "1", "2", "3", "4", "5", "6", "7", "8", "9", "a", "b", "c", "d", "e", "f"];
-function buf2hex(arrayBuffer) {
-  const buffer = new Uint8Array(arrayBuffer);
-  let out = "";
-  for (let idx = 0; idx < buffer.length; idx++) {
-    const n = buffer[idx];
-    out += HEX_CHARS[n >>> 4 & 15];
-    out += HEX_CHARS[n & 15];
-  }
-  return out;
-}
-function encodeRfc3986(urlEncodedStr) {
-  return urlEncodedStr.replace(/[!'()*]/g, (c) => "%" + c.charCodeAt(0).toString(16).toUpperCase());
-}
-function guessServiceRegion(url, headers) {
-  const { hostname, pathname } = url;
-  if (hostname.endsWith(".on.aws")) {
-    const match2 = hostname.match(/^[^.]{1,63}\.lambda-url\.([^.]{1,63})\.on\.aws$/);
-    return match2 != null ? ["lambda", match2[1] || ""] : ["", ""];
-  }
-  if (hostname.endsWith(".r2.cloudflarestorage.com")) {
-    return ["s3", "auto"];
-  }
-  if (hostname.endsWith(".backblazeb2.com")) {
-    const match2 = hostname.match(/^(?:[^.]{1,63}\.)?s3\.([^.]{1,63})\.backblazeb2\.com$/);
-    return match2 != null ? ["s3", match2[1] || ""] : ["", ""];
-  }
-  const match = hostname.replace("dualstack.", "").match(/([^.]{1,63})\.(?:([^.]{0,63})\.)?amazonaws\.com(?:\.cn)?$/);
-  let service = match && match[1] || "";
-  let region = match && match[2];
-  if (region === "us-gov") {
-    region = "us-gov-west-1";
-  } else if (region === "s3" || region === "s3-accelerate") {
-    region = "us-east-1";
-    service = "s3";
-  } else if (service === "iot") {
-    if (hostname.startsWith("iot.")) {
-      service = "execute-api";
-    } else if (hostname.startsWith("data.jobs.iot.")) {
-      service = "iot-jobs-data";
-    } else {
-      service = pathname === "/mqtt" ? "iotdevicegateway" : "iotdata";
-    }
-  } else if (service === "autoscaling") {
-    const targetPrefix = (headers.get("X-Amz-Target") || "").split(".")[0];
-    if (targetPrefix === "AnyScaleFrontendService") {
-      service = "application-autoscaling";
-    } else if (targetPrefix === "AnyScaleScalingPlannerFrontendService") {
-      service = "autoscaling-plans";
-    }
-  } else if (region == null && service.startsWith("s3-")) {
-    region = service.slice(3).replace(/^fips-|^external-1/, "");
-    service = "s3";
-  } else if (service.endsWith("-fips")) {
-    service = service.slice(0, -5);
-  } else if (region && /-\d$/.test(service) && !/-\d$/.test(region)) {
-    [service, region] = [region, service];
-  }
-  return [HOST_SERVICES[service] || service, region || ""];
-}
-//# sourceMappingURL=aws4fetch.js.map