@shware/workflow 2.0.1 → 3.0.0

package/dist/transports/cloudflare-email.d.cts

@@ -0,0 +1,38 @@
+import { EmailBindingLike } from "../cloudflare/bindings.cjs";
+import { EmailTransport } from "../email-sender.cjs";
+//#region src/transports/cloudflare-email.d.ts
+/**
+ * `@shware/workflow/transports/cloudflare-email` — Cloudflare Email Service, through the
+ * Worker's `send_email` binding or, from anywhere else (a Lambda), its REST API. Both take the
+ * same finished email; only the call and the way each reports a failure differ.
+ */
+export type CloudflareEmailTransportOptions = {
+  /** The Worker's `send_email` binding. */
+  binding: EmailBindingLike;
+  accountId?: never;
+  apiToken?: never;
+} | {
+  binding?: never;
+  accountId: string;
+  /** An API token allowed to send email for the account. */
+  apiToken: string;
+  /** Defaults to `https://api.cloudflare.com/client/v4`. */
+  endpoint?: string;
+  fetch?: typeof fetch;
+};
+/** The REST API refused the email: `errors` are Cloudflare's `{ code, message }` pairs. */
+export declare class CloudflareEmailError extends Error {
+  readonly status: number;
+  readonly errors: readonly {
+    code?: number;
+    message?: string;
+  }[];
+  readonly name = "CloudflareEmailError";
+  constructor(status: number, errors: readonly {
+    code?: number;
+    message?: string;
+  }[]);
+}
+export declare function cloudflareEmailTransport(options: CloudflareEmailTransportOptions): EmailTransport;
+//#endregion
+//# sourceMappingURL=cloudflare-email.d.cts.map

package/dist/transports/cloudflare-email.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-email.d.cts","names":[],"sources":["../../src/transports/cloudflare-email.ts"],"mappings":";;;;;;;;YAUY;;EAGN,SAAS;EACT;EACA;;EAGA;EACA;;EAEA;;EAEA;EACA,eAAe;;;qBAIR,6BAA6B;WAG7B;WACA;IAAmB;IAAe;;WAH3B;EAClB,YACW,gBACA;IAAmB;IAAe;;;wBAO/B,yBAAyB,SAAS,kCAAkC"}

package/dist/transports/cloudflare-email.d.mts

@@ -0,0 +1,38 @@
+import { EmailBindingLike } from "../cloudflare/bindings.mjs";
+import { EmailTransport } from "../email-sender.mjs";
+//#region src/transports/cloudflare-email.d.ts
+/**
+ * `@shware/workflow/transports/cloudflare-email` — Cloudflare Email Service, through the
+ * Worker's `send_email` binding or, from anywhere else (a Lambda), its REST API. Both take the
+ * same finished email; only the call and the way each reports a failure differ.
+ */
+export type CloudflareEmailTransportOptions = {
+  /** The Worker's `send_email` binding. */
+  binding: EmailBindingLike;
+  accountId?: never;
+  apiToken?: never;
+} | {
+  binding?: never;
+  accountId: string;
+  /** An API token allowed to send email for the account. */
+  apiToken: string;
+  /** Defaults to `https://api.cloudflare.com/client/v4`. */
+  endpoint?: string;
+  fetch?: typeof fetch;
+};
+/** The REST API refused the email: `errors` are Cloudflare's `{ code, message }` pairs. */
+export declare class CloudflareEmailError extends Error {
+  readonly status: number;
+  readonly errors: readonly {
+    code?: number;
+    message?: string;
+  }[];
+  readonly name = "CloudflareEmailError";
+  constructor(status: number, errors: readonly {
+    code?: number;
+    message?: string;
+  }[]);
+}
+export declare function cloudflareEmailTransport(options: CloudflareEmailTransportOptions): EmailTransport;
+//#endregion
+//# sourceMappingURL=cloudflare-email.d.mts.map

package/dist/transports/cloudflare-email.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-email.d.mts","names":[],"sources":["../../src/transports/cloudflare-email.ts"],"mappings":";;;;;;;;YAUY;;EAGN,SAAS;EACT;EACA;;EAGA;EACA;;EAEA;;EAEA;EACA,eAAe;;;qBAIR,6BAA6B;WAG7B;WACA;IAAmB;IAAe;;WAH3B;EAClB,YACW,gBACA;IAAmB;IAAe;;;wBAO/B,yBAAyB,SAAS,kCAAkC"}

package/dist/transports/cloudflare-email.mjs

@@ -0,0 +1,57 @@
+import { mimeAddress } from "../email.mjs";
+//#region src/transports/cloudflare-email.ts
+/** The REST API refused the email: `errors` are Cloudflare's `{ code, message }` pairs. */
+var CloudflareEmailError = class extends Error {
+	status;
+	errors;
+	name = "CloudflareEmailError";
+	constructor(status, errors) {
+		const said = errors.map((e) => `${e.code ?? "?"} ${e.message ?? ""}`.trim()).join("; ");
+		super(`Cloudflare Email send failed (${status})${said === "" ? "" : `: ${said}`}`);
+		this.status = status;
+		this.errors = errors;
+	}
+};
+function cloudflareEmailTransport(options) {
+	if (options.binding !== void 0) {
+		const { binding } = options;
+		return { async send(message) {
+			const id = (await binding.send(message))?.messageId;
+			return typeof id === "string" ? { providerMessageId: id } : {};
+		} };
+	}
+	const given = options;
+	if (typeof given.accountId !== "string" || typeof given.apiToken !== "string") throw new TypeError("cloudflareEmailTransport needs { binding } or { accountId, apiToken }");
+	const { accountId, apiToken } = options;
+	const endpoint = (options.endpoint ?? "https://api.cloudflare.com/client/v4").replace(/\/$/, "");
+	const fetchImpl = options.fetch ?? fetch;
+	return { async send(message) {
+		const response = await fetchImpl(`${endpoint}/accounts/${encodeURIComponent(accountId)}/email/sending/send`, {
+			method: "POST",
+			headers: {
+				authorization: `Bearer ${apiToken}`,
+				"content-type": "application/json"
+			},
+			body: JSON.stringify({
+				from: mimeAddress(message.from),
+				to: message.to,
+				...message.replyTo === void 0 ? {} : { reply_to: mimeAddress(message.replyTo) },
+				subject: message.subject,
+				html: message.html
+			})
+		});
+		let body = {};
+		try {
+			body = await response.json();
+		} catch {
+			body = {};
+		}
+		if (!response.ok || body.success !== true) throw new CloudflareEmailError(response.status, Array.isArray(body.errors) ? body.errors : []);
+		const id = body.result?.message_id;
+		return typeof id === "string" ? { providerMessageId: id } : {};
+	} };
+}
+//#endregion
+export { CloudflareEmailError, cloudflareEmailTransport };
+
+//# sourceMappingURL=cloudflare-email.mjs.map

package/dist/transports/cloudflare-email.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-email.mjs","names":[],"sources":["../../src/transports/cloudflare-email.ts"],"sourcesContent":["import type { EmailBindingLike } from '../cloudflare/bindings';\nimport { mimeAddress } from '../email';\nimport type { EmailMessage, EmailTransport } from '../email-sender';\n\n/**\n * `@shware/workflow/transports/cloudflare-email` — Cloudflare Email Service, through the\n * Worker's `send_email` binding or, from anywhere else (a Lambda), its REST API. Both take the\n * same finished email; only the call and the way each reports a failure differ.\n */\n\nexport type CloudflareEmailTransportOptions =\n  | {\n      /** The Worker's `send_email` binding. */\n      binding: EmailBindingLike;\n      accountId?: never;\n      apiToken?: never;\n    }\n  | {\n      binding?: never;\n      accountId: string;\n      /** An API token allowed to send email for the account. */\n      apiToken: string;\n      /** Defaults to `https://api.cloudflare.com/client/v4`. */\n      endpoint?: string;\n      fetch?: typeof fetch;\n    };\n\n/** The REST API refused the email: `errors` are Cloudflare's `{ code, message }` pairs. */\nexport class CloudflareEmailError extends Error {\n  override readonly name = 'CloudflareEmailError';\n  constructor(\n    readonly status: number,\n    readonly errors: readonly { code?: number; message?: string }[]\n  ) {\n    const said = errors.map((e) => `${e.code ?? '?'} ${e.message ?? ''}`.trim()).join('; ');\n    super(`Cloudflare Email send failed (${status})${said === '' ? '' : `: ${said}`}`);\n  }\n}\n\nexport function cloudflareEmailTransport(options: CloudflareEmailTransportOptions): EmailTransport {\n  if (options.binding !== undefined) {\n    const { binding } = options;\n    return {\n      async send(message) {\n        // The binding takes the key and drops the duplicate a retry or replay produces\n        const result: unknown = await binding.send(message);\n        const id = (result as { messageId?: unknown } | null | undefined)?.messageId;\n        return typeof id === 'string' ? { providerMessageId: id } : {};\n      },\n    };\n  }\n  // Checked at runtime too: a JS caller can pass neither\n  const given = options as { accountId?: unknown; apiToken?: unknown };\n  if (typeof given.accountId !== 'string' || typeof given.apiToken !== 'string') {\n    throw new TypeError('cloudflareEmailTransport needs { binding } or { accountId, apiToken }');\n  }\n  const { accountId, apiToken } = options;\n  const endpoint = (options.endpoint ?? 'https://api.cloudflare.com/client/v4').replace(/\\/$/, '');\n  const fetchImpl = options.fetch ?? fetch;\n  return {\n    async send(message: EmailMessage) {\n      const response = await fetchImpl(\n        `${endpoint}/accounts/${encodeURIComponent(accountId)}/email/sending/send`,\n        {\n          method: 'POST',\n          headers: {\n            authorization: `Bearer ${apiToken}`,\n            'content-type': 'application/json',\n          },\n          body: JSON.stringify({\n            from: mimeAddress(message.from),\n            to: message.to,\n            ...(message.replyTo === undefined ? {} : { reply_to: mimeAddress(message.replyTo) }),\n            subject: message.subject,\n            html: message.html,\n          }),\n        }\n      );\n      let body: { success?: unknown; errors?: unknown; result?: { message_id?: unknown } } = {};\n      try {\n        body = (await response.json()) as typeof body;\n      } catch {\n        body = {};\n      }\n      if (!response.ok || body.success !== true) {\n        throw new CloudflareEmailError(\n          response.status,\n          Array.isArray(body.errors) ? (body.errors as { code?: number; message?: string }[]) : []\n        );\n      }\n      // No server-side de-duplication is documented for the REST API: a retry after an accepted\n      // send can deliver twice (at least once, like SES)\n      const id = body.result?.message_id;\n      return typeof id === 'string' ? { providerMessageId: id } : {};\n    },\n  };\n}\n"],"mappings":";;;AA4BA,IAAa,uBAAb,cAA0C,MAAM;CAGnC;CACA;CAHX,OAAyB;CACzB,YACE,QACA,QACA;EACA,MAAM,OAAO,OAAO,KAAK,MAAM,GAAG,EAAE,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;EACtF,MAAM,iCAAiC,OAAO,GAAG,SAAS,KAAK,KAAK,KAAK,QAAQ;EAJxE,KAAA,SAAA;EACA,KAAA,SAAA;CAIX;AACF;AAEA,SAAgB,yBAAyB,SAA0D;CACjG,IAAI,QAAQ,YAAY,KAAA,GAAW;EACjC,MAAM,EAAE,YAAY;EACpB,OAAO,EACL,MAAM,KAAK,SAAS;GAGlB,MAAM,MAAM,MADkB,QAAQ,KAAK,OAAO,EAAA,EACiB;GACnE,OAAO,OAAO,OAAO,WAAW,EAAE,mBAAmB,GAAG,IAAI,CAAC;EAC/D,EACF;CACF;CAEA,MAAM,QAAQ;CACd,IAAI,OAAO,MAAM,cAAc,YAAY,OAAO,MAAM,aAAa,UACnE,MAAM,IAAI,UAAU,uEAAuE;CAE7F,MAAM,EAAE,WAAW,aAAa;CAChC,MAAM,YAAY,QAAQ,YAAY,uCAAA,CAAwC,QAAQ,OAAO,EAAE;CAC/F,MAAM,YAAY,QAAQ,SAAS;CACnC,OAAO,EACL,MAAM,KAAK,SAAuB;EAChC,MAAM,WAAW,MAAM,UACrB,GAAG,SAAS,YAAY,mBAAmB,SAAS,EAAE,sBACtD;GACE,QAAQ;GACR,SAAS;IACP,eAAe,UAAU;IACzB,gBAAgB;GAClB;GACA,MAAM,KAAK,UAAU;IACnB,MAAM,YAAY,QAAQ,IAAI;IAC9B,IAAI,QAAQ;IACZ,GAAI,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,UAAU,YAAY,QAAQ,OAAO,EAAE;IAClF,SAAS,QAAQ;IACjB,MAAM,QAAQ;GAChB,CAAC;EACH,CACF;EACA,IAAI,OAAmF,CAAC;EACxF,IAAI;GACF,OAAQ,MAAM,SAAS,KAAK;EAC9B,QAAQ;GACN,OAAO,CAAC;EACV;EACA,IAAI,CAAC,SAAS,MAAM,KAAK,YAAY,MACnC,MAAM,IAAI,qBACR,SAAS,QACT,MAAM,QAAQ,KAAK,MAAM,IAAK,KAAK,SAAmD,CAAC,CACzF;EAIF,MAAM,KAAK,KAAK,QAAQ;EACxB,OAAO,OAAO,OAAO,WAAW,EAAE,mBAAmB,GAAG,IAAI,CAAC;CAC/D,EACF;AACF"}

package/dist/transports/ses.cjs

@@ -0,0 +1,91 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_email = require("../email.cjs");
+const require_transports_sigv4 = require("./sigv4.cjs");
+//#region src/transports/ses.ts
+/** An SES error response: `type` is SES's error code (`MessageRejected`, `TooManyRequestsException`, ...). */
+var SesSendError = class extends Error {
+	status;
+	type;
+	name = "SesSendError";
+	constructor(status, type, message) {
+		super(`SES SendEmail failed (${status}${type === void 0 ? "" : ` ${type}`}): ${message}`);
+		this.status = status;
+		this.type = type;
+	}
+};
+function environmentCredentials() {
+	const env = globalThis.process?.env;
+	const accessKeyId = env?.AWS_ACCESS_KEY_ID;
+	const secretAccessKey = env?.AWS_SECRET_ACCESS_KEY;
+	if (accessKeyId === void 0 || secretAccessKey === void 0) throw new Error("sesEmailTransport: no credentials — pass `credentials`, or run where AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are set (a Lambda execution role)");
+	return {
+		accessKeyId,
+		secretAccessKey,
+		sessionToken: env?.AWS_SESSION_TOKEN
+	};
+}
+function sesEmailTransport(options) {
+	const endpoint = (options.endpoint ?? `https://email.${options.region}.amazonaws.com`).replace(/\/$/, "");
+	const credentials = async () => {
+		const configured = options.credentials;
+		if (configured === void 0) return environmentCredentials();
+		return typeof configured === "function" ? configured() : configured;
+	};
+	const fetchImpl = options.fetch ?? fetch;
+	return { async send(message) {
+		const body = JSON.stringify({
+			FromEmailAddress: require_email.mimeAddress(message.from),
+			Destination: { ToAddresses: [message.to] },
+			...message.replyTo === void 0 ? {} : { ReplyToAddresses: [require_email.mimeAddress(message.replyTo)] },
+			Content: { Simple: {
+				Subject: {
+					Data: message.subject,
+					Charset: "UTF-8"
+				},
+				Body: { Html: {
+					Data: message.html,
+					Charset: "UTF-8"
+				} }
+			} },
+			...options.configurationSetName === void 0 ? {} : { ConfigurationSetName: options.configurationSetName }
+		});
+		const url = `${endpoint}/v2/email/outbound-emails`;
+		const headers = await require_transports_sigv4.signRequest({
+			method: "POST",
+			url,
+			headers: { "content-type": "application/json" },
+			body,
+			credentials: await credentials(),
+			region: options.region,
+			service: "ses"
+		});
+		const response = await fetchImpl(url, {
+			method: "POST",
+			headers,
+			body
+		});
+		const text = await response.text();
+		if (!response.ok) {
+			let detail = text;
+			try {
+				const parsed = JSON.parse(text);
+				const said = parsed.message ?? parsed.Message;
+				if (typeof said === "string") detail = said;
+			} catch {}
+			const type = response.headers.get("x-amzn-errortype")?.split(":")[0];
+			throw new SesSendError(response.status, type, detail);
+		}
+		let messageId;
+		try {
+			messageId = JSON.parse(text).MessageId;
+		} catch {
+			messageId = void 0;
+		}
+		return typeof messageId === "string" ? { providerMessageId: messageId } : {};
+	} };
+}
+//#endregion
+exports.SesSendError = SesSendError;
+exports.sesEmailTransport = sesEmailTransport;
+
+//# sourceMappingURL=ses.cjs.map

package/dist/transports/ses.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ses.cjs","names":["mimeAddress","signRequest"],"sources":["../../src/transports/ses.ts"],"sourcesContent":["import { mimeAddress } from '../email';\nimport type { EmailMessage, EmailTransport } from '../email-sender';\nimport { signRequest } from './sigv4';\n\n/**\n * `@shware/workflow/transports/ses` — email through Amazon SES (the v2 `SendEmail` API) over\n * plain `fetch` with a SigV4 signature, so the same transport runs in a Lambda and in a Worker.\n * Nothing here loads the AWS SDK or a Node-only credential chain.\n */\n\nexport interface AwsCredentials {\n  accessKeyId: string;\n  secretAccessKey: string;\n  /** Present for temporary credentials (a role's): signed with the request. */\n  sessionToken?: string | undefined;\n}\n\n/** Called on every send, so rotated temporary credentials are picked up rather than frozen. */\nexport type AwsCredentialProvider = () => AwsCredentials | Promise<AwsCredentials>;\n\nexport interface SesEmailTransportOptions {\n  region: string;\n  /**\n   * Fixed credentials, or a provider read on every send. Defaults to the process environment's\n   * `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`, read at send time —\n   * a Lambda's execution role. A Worker passes them explicitly from its validated env.\n   */\n  credentials?: AwsCredentials | AwsCredentialProvider;\n  /** An SES configuration set (event publishing, a dedicated IP pool). */\n  configurationSetName?: string;\n  /** Defaults to `https://email.<region>.amazonaws.com`. */\n  endpoint?: string;\n  fetch?: typeof fetch;\n}\n\n/** An SES error response: `type` is SES's error code (`MessageRejected`, `TooManyRequestsException`, ...). */\nexport class SesSendError extends Error {\n  override readonly name = 'SesSendError';\n  constructor(\n    readonly status: number,\n    readonly type: string | undefined,\n    message: string\n  ) {\n    super(`SES SendEmail failed (${status}${type === undefined ? '' : ` ${type}`}): ${message}`);\n  }\n}\n\nfunction environmentCredentials(): AwsCredentials {\n  // Read through globalThis: a Worker has no `process`, and must pass credentials instead\n  const env = (globalThis as { process?: { env?: Record<string, string | undefined> } }).process\n    ?.env;\n  const accessKeyId = env?.AWS_ACCESS_KEY_ID;\n  const secretAccessKey = env?.AWS_SECRET_ACCESS_KEY;\n  if (accessKeyId === undefined || secretAccessKey === undefined) {\n    throw new Error(\n      'sesEmailTransport: no credentials — pass `credentials`, or run where AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are set (a Lambda execution role)'\n    );\n  }\n  return { accessKeyId, secretAccessKey, sessionToken: env?.AWS_SESSION_TOKEN };\n}\n\nexport function sesEmailTransport(options: SesEmailTransportOptions): EmailTransport {\n  const endpoint = (options.endpoint ?? `https://email.${options.region}.amazonaws.com`).replace(\n    /\\/$/,\n    ''\n  );\n  const credentials = async (): Promise<AwsCredentials> => {\n    const configured = options.credentials;\n    if (configured === undefined) return environmentCredentials();\n    return typeof configured === 'function' ? configured() : configured;\n  };\n  const fetchImpl = options.fetch ?? fetch;\n\n  return {\n    async send(message: EmailMessage) {\n      const body = JSON.stringify({\n        FromEmailAddress: mimeAddress(message.from),\n        Destination: { ToAddresses: [message.to] },\n        ...(message.replyTo === undefined\n          ? {}\n          : { ReplyToAddresses: [mimeAddress(message.replyTo)] }),\n        Content: {\n          Simple: {\n            Subject: { Data: message.subject, Charset: 'UTF-8' },\n            Body: { Html: { Data: message.html, Charset: 'UTF-8' } },\n          },\n        },\n        ...(options.configurationSetName === undefined\n          ? {}\n          : { ConfigurationSetName: options.configurationSetName }),\n      });\n      const url = `${endpoint}/v2/email/outbound-emails`;\n      const headers = await signRequest({\n        method: 'POST',\n        url,\n        headers: { 'content-type': 'application/json' },\n        body,\n        credentials: await credentials(),\n        region: options.region,\n        service: 'ses',\n      });\n      // No retries here: the durable step owns them, and counts them — SES cannot de-duplicate,\n      // so every extra attempt of an accepted send is another chance to deliver twice\n      const response = await fetchImpl(url, { method: 'POST', headers, body });\n      const text = await response.text();\n      if (!response.ok) {\n        let detail = text;\n        try {\n          const parsed = JSON.parse(text) as { message?: unknown; Message?: unknown };\n          const said = parsed.message ?? parsed.Message;\n          if (typeof said === 'string') detail = said;\n        } catch {\n          // Not JSON: the raw body says what went wrong\n        }\n        const type = response.headers.get('x-amzn-errortype')?.split(':')[0];\n        throw new SesSendError(response.status, type, detail);\n      }\n      let messageId: unknown;\n      try {\n        messageId = (JSON.parse(text) as { MessageId?: unknown }).MessageId;\n      } catch {\n        messageId = undefined;\n      }\n      return typeof messageId === 'string' ? { providerMessageId: messageId } : {};\n    },\n  };\n}\n"],"mappings":";;;;;AAoCA,IAAa,eAAb,cAAkC,MAAM;CAG3B;CACA;CAHX,OAAyB;CACzB,YACE,QACA,MACA,SACA;EACA,MAAM,yBAAyB,SAAS,SAAS,KAAA,IAAY,KAAK,IAAI,OAAO,KAAK,SAAS;EAJlF,KAAA,SAAA;EACA,KAAA,OAAA;CAIX;AACF;AAEA,SAAS,yBAAyC;CAEhD,MAAM,MAAO,WAA0E,SACnF;CACJ,MAAM,cAAc,KAAK;CACzB,MAAM,kBAAkB,KAAK;CAC7B,IAAI,gBAAgB,KAAA,KAAa,oBAAoB,KAAA,GACnD,MAAM,IAAI,MACR,oJACF;CAEF,OAAO;EAAE;EAAa;EAAiB,cAAc,KAAK;CAAkB;AAC9E;AAEA,SAAgB,kBAAkB,SAAmD;CACnF,MAAM,YAAY,QAAQ,YAAY,iBAAiB,QAAQ,OAAO,gBAAA,CAAiB,QACrF,OACA,EACF;CACA,MAAM,cAAc,YAAqC;EACvD,MAAM,aAAa,QAAQ;EAC3B,IAAI,eAAe,KAAA,GAAW,OAAO,uBAAuB;EAC5D,OAAO,OAAO,eAAe,aAAa,WAAW,IAAI;CAC3D;CACA,MAAM,YAAY,QAAQ,SAAS;CAEnC,OAAO,EACL,MAAM,KAAK,SAAuB;EAChC,MAAM,OAAO,KAAK,UAAU;GAC1B,kBAAkBA,cAAAA,YAAY,QAAQ,IAAI;GAC1C,aAAa,EAAE,aAAa,CAAC,QAAQ,EAAE,EAAE;GACzC,GAAI,QAAQ,YAAY,KAAA,IACpB,CAAC,IACD,EAAE,kBAAkB,CAACA,cAAAA,YAAY,QAAQ,OAAO,CAAC,EAAE;GACvD,SAAS,EACP,QAAQ;IACN,SAAS;KAAE,MAAM,QAAQ;KAAS,SAAS;IAAQ;IACnD,MAAM,EAAE,MAAM;KAAE,MAAM,QAAQ;KAAM,SAAS;IAAQ,EAAE;GACzD,EACF;GACA,GAAI,QAAQ,yBAAyB,KAAA,IACjC,CAAC,IACD,EAAE,sBAAsB,QAAQ,qBAAqB;EAC3D,CAAC;EACD,MAAM,MAAM,GAAG,SAAS;EACxB,MAAM,UAAU,MAAMC,yBAAAA,YAAY;GAChC,QAAQ;GACR;GACA,SAAS,EAAE,gBAAgB,mBAAmB;GAC9C;GACA,aAAa,MAAM,YAAY;GAC/B,QAAQ,QAAQ;GAChB,SAAS;EACX,CAAC;EAGD,MAAM,WAAW,MAAM,UAAU,KAAK;GAAE,QAAQ;GAAQ;GAAS;EAAK,CAAC;EACvE,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,IAAI,CAAC,SAAS,IAAI;GAChB,IAAI,SAAS;GACb,IAAI;IACF,MAAM,SAAS,KAAK,MAAM,IAAI;IAC9B,MAAM,OAAO,OAAO,WAAW,OAAO;IACtC,IAAI,OAAO,SAAS,UAAU,SAAS;GACzC,QAAQ,CAER;GACA,MAAM,OAAO,SAAS,QAAQ,IAAI,kBAAkB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC;GAClE,MAAM,IAAI,aAAa,SAAS,QAAQ,MAAM,MAAM;EACtD;EACA,IAAI;EACJ,IAAI;GACF,YAAa,KAAK,MAAM,IAAI,CAAC,CAA6B;EAC5D,QAAQ;GACN,YAAY,KAAA;EACd;EACA,OAAO,OAAO,cAAc,WAAW,EAAE,mBAAmB,UAAU,IAAI,CAAC;CAC7E,EACF;AACF"}

package/dist/transports/ses.d.cts

@@ -0,0 +1,39 @@
+import { EmailTransport } from "../email-sender.cjs";
+//#region src/transports/ses.d.ts
+/**
+ * `@shware/workflow/transports/ses` — email through Amazon SES (the v2 `SendEmail` API) over
+ * plain `fetch` with a SigV4 signature, so the same transport runs in a Lambda and in a Worker.
+ * Nothing here loads the AWS SDK or a Node-only credential chain.
+ */
+export interface AwsCredentials {
+  accessKeyId: string;
+  secretAccessKey: string;
+  /** Present for temporary credentials (a role's): signed with the request. */
+  sessionToken?: string | undefined;
+}
+/** Called on every send, so rotated temporary credentials are picked up rather than frozen. */
+export type AwsCredentialProvider = () => AwsCredentials | Promise<AwsCredentials>;
+export interface SesEmailTransportOptions {
+  region: string;
+  /**
+   * Fixed credentials, or a provider read on every send. Defaults to the process environment's
+   * `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`, read at send time —
+   * a Lambda's execution role. A Worker passes them explicitly from its validated env.
+   */
+  credentials?: AwsCredentials | AwsCredentialProvider;
+  /** An SES configuration set (event publishing, a dedicated IP pool). */
+  configurationSetName?: string;
+  /** Defaults to `https://email.<region>.amazonaws.com`. */
+  endpoint?: string;
+  fetch?: typeof fetch;
+}
+/** An SES error response: `type` is SES's error code (`MessageRejected`, `TooManyRequestsException`, ...). */
+export declare class SesSendError extends Error {
+  readonly status: number;
+  readonly type: string | undefined;
+  readonly name = "SesSendError";
+  constructor(status: number, type: string | undefined, message: string);
+}
+export declare function sesEmailTransport(options: SesEmailTransportOptions): EmailTransport;
+//#endregion
+//# sourceMappingURL=ses.d.cts.map

package/dist/transports/ses.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ses.d.cts","names":[],"sources":["../../src/transports/ses.ts"],"mappings":";;;;;;;iBAUiB;EACf;EACA;;EAEA;;;YAIU,8BAA8B,iBAAiB,QAAQ;iBAElD;EACf;;;;;;EAMA,cAAc,iBAAiB;;EAE/B;;EAEA;EACA,eAAe;;;qBAIJ,qBAAqB;WAGrB;WACA;WAHO;EAClB,YACW,gBACA,0BACT;;wBAoBY,kBAAkB,SAAS,2BAA2B"}

package/dist/transports/ses.d.mts

@@ -0,0 +1,39 @@
+import { EmailTransport } from "../email-sender.mjs";
+//#region src/transports/ses.d.ts
+/**
+ * `@shware/workflow/transports/ses` — email through Amazon SES (the v2 `SendEmail` API) over
+ * plain `fetch` with a SigV4 signature, so the same transport runs in a Lambda and in a Worker.
+ * Nothing here loads the AWS SDK or a Node-only credential chain.
+ */
+export interface AwsCredentials {
+  accessKeyId: string;
+  secretAccessKey: string;
+  /** Present for temporary credentials (a role's): signed with the request. */
+  sessionToken?: string | undefined;
+}
+/** Called on every send, so rotated temporary credentials are picked up rather than frozen. */
+export type AwsCredentialProvider = () => AwsCredentials | Promise<AwsCredentials>;
+export interface SesEmailTransportOptions {
+  region: string;
+  /**
+   * Fixed credentials, or a provider read on every send. Defaults to the process environment's
+   * `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`, read at send time —
+   * a Lambda's execution role. A Worker passes them explicitly from its validated env.
+   */
+  credentials?: AwsCredentials | AwsCredentialProvider;
+  /** An SES configuration set (event publishing, a dedicated IP pool). */
+  configurationSetName?: string;
+  /** Defaults to `https://email.<region>.amazonaws.com`. */
+  endpoint?: string;
+  fetch?: typeof fetch;
+}
+/** An SES error response: `type` is SES's error code (`MessageRejected`, `TooManyRequestsException`, ...). */
+export declare class SesSendError extends Error {
+  readonly status: number;
+  readonly type: string | undefined;
+  readonly name = "SesSendError";
+  constructor(status: number, type: string | undefined, message: string);
+}
+export declare function sesEmailTransport(options: SesEmailTransportOptions): EmailTransport;
+//#endregion
+//# sourceMappingURL=ses.d.mts.map

package/dist/transports/ses.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ses.d.mts","names":[],"sources":["../../src/transports/ses.ts"],"mappings":";;;;;;;iBAUiB;EACf;EACA;;EAEA;;;YAIU,8BAA8B,iBAAiB,QAAQ;iBAElD;EACf;;;;;;EAMA,cAAc,iBAAiB;;EAE/B;;EAEA;EACA,eAAe;;;qBAIJ,qBAAqB;WAGrB;WACA;WAHO;EAClB,YACW,gBACA,0BACT;;wBAoBY,kBAAkB,SAAS,2BAA2B"}

package/dist/transports/ses.mjs

@@ -0,0 +1,89 @@
+import { mimeAddress } from "../email.mjs";
+import { signRequest } from "./sigv4.mjs";
+//#region src/transports/ses.ts
+/** An SES error response: `type` is SES's error code (`MessageRejected`, `TooManyRequestsException`, ...). */
+var SesSendError = class extends Error {
+	status;
+	type;
+	name = "SesSendError";
+	constructor(status, type, message) {
+		super(`SES SendEmail failed (${status}${type === void 0 ? "" : ` ${type}`}): ${message}`);
+		this.status = status;
+		this.type = type;
+	}
+};
+function environmentCredentials() {
+	const env = globalThis.process?.env;
+	const accessKeyId = env?.AWS_ACCESS_KEY_ID;
+	const secretAccessKey = env?.AWS_SECRET_ACCESS_KEY;
+	if (accessKeyId === void 0 || secretAccessKey === void 0) throw new Error("sesEmailTransport: no credentials — pass `credentials`, or run where AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are set (a Lambda execution role)");
+	return {
+		accessKeyId,
+		secretAccessKey,
+		sessionToken: env?.AWS_SESSION_TOKEN
+	};
+}
+function sesEmailTransport(options) {
+	const endpoint = (options.endpoint ?? `https://email.${options.region}.amazonaws.com`).replace(/\/$/, "");
+	const credentials = async () => {
+		const configured = options.credentials;
+		if (configured === void 0) return environmentCredentials();
+		return typeof configured === "function" ? configured() : configured;
+	};
+	const fetchImpl = options.fetch ?? fetch;
+	return { async send(message) {
+		const body = JSON.stringify({
+			FromEmailAddress: mimeAddress(message.from),
+			Destination: { ToAddresses: [message.to] },
+			...message.replyTo === void 0 ? {} : { ReplyToAddresses: [mimeAddress(message.replyTo)] },
+			Content: { Simple: {
+				Subject: {
+					Data: message.subject,
+					Charset: "UTF-8"
+				},
+				Body: { Html: {
+					Data: message.html,
+					Charset: "UTF-8"
+				} }
+			} },
+			...options.configurationSetName === void 0 ? {} : { ConfigurationSetName: options.configurationSetName }
+		});
+		const url = `${endpoint}/v2/email/outbound-emails`;
+		const headers = await signRequest({
+			method: "POST",
+			url,
+			headers: { "content-type": "application/json" },
+			body,
+			credentials: await credentials(),
+			region: options.region,
+			service: "ses"
+		});
+		const response = await fetchImpl(url, {
+			method: "POST",
+			headers,
+			body
+		});
+		const text = await response.text();
+		if (!response.ok) {
+			let detail = text;
+			try {
+				const parsed = JSON.parse(text);
+				const said = parsed.message ?? parsed.Message;
+				if (typeof said === "string") detail = said;
+			} catch {}
+			const type = response.headers.get("x-amzn-errortype")?.split(":")[0];
+			throw new SesSendError(response.status, type, detail);
+		}
+		let messageId;
+		try {
+			messageId = JSON.parse(text).MessageId;
+		} catch {
+			messageId = void 0;
+		}
+		return typeof messageId === "string" ? { providerMessageId: messageId } : {};
+	} };
+}
+//#endregion
+export { SesSendError, sesEmailTransport };
+
+//# sourceMappingURL=ses.mjs.map

package/dist/transports/ses.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ses.mjs","names":[],"sources":["../../src/transports/ses.ts"],"sourcesContent":["import { mimeAddress } from '../email';\nimport type { EmailMessage, EmailTransport } from '../email-sender';\nimport { signRequest } from './sigv4';\n\n/**\n * `@shware/workflow/transports/ses` — email through Amazon SES (the v2 `SendEmail` API) over\n * plain `fetch` with a SigV4 signature, so the same transport runs in a Lambda and in a Worker.\n * Nothing here loads the AWS SDK or a Node-only credential chain.\n */\n\nexport interface AwsCredentials {\n  accessKeyId: string;\n  secretAccessKey: string;\n  /** Present for temporary credentials (a role's): signed with the request. */\n  sessionToken?: string | undefined;\n}\n\n/** Called on every send, so rotated temporary credentials are picked up rather than frozen. */\nexport type AwsCredentialProvider = () => AwsCredentials | Promise<AwsCredentials>;\n\nexport interface SesEmailTransportOptions {\n  region: string;\n  /**\n   * Fixed credentials, or a provider read on every send. Defaults to the process environment's\n   * `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`, read at send time —\n   * a Lambda's execution role. A Worker passes them explicitly from its validated env.\n   */\n  credentials?: AwsCredentials | AwsCredentialProvider;\n  /** An SES configuration set (event publishing, a dedicated IP pool). */\n  configurationSetName?: string;\n  /** Defaults to `https://email.<region>.amazonaws.com`. */\n  endpoint?: string;\n  fetch?: typeof fetch;\n}\n\n/** An SES error response: `type` is SES's error code (`MessageRejected`, `TooManyRequestsException`, ...). */\nexport class SesSendError extends Error {\n  override readonly name = 'SesSendError';\n  constructor(\n    readonly status: number,\n    readonly type: string | undefined,\n    message: string\n  ) {\n    super(`SES SendEmail failed (${status}${type === undefined ? '' : ` ${type}`}): ${message}`);\n  }\n}\n\nfunction environmentCredentials(): AwsCredentials {\n  // Read through globalThis: a Worker has no `process`, and must pass credentials instead\n  const env = (globalThis as { process?: { env?: Record<string, string | undefined> } }).process\n    ?.env;\n  const accessKeyId = env?.AWS_ACCESS_KEY_ID;\n  const secretAccessKey = env?.AWS_SECRET_ACCESS_KEY;\n  if (accessKeyId === undefined || secretAccessKey === undefined) {\n    throw new Error(\n      'sesEmailTransport: no credentials — pass `credentials`, or run where AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are set (a Lambda execution role)'\n    );\n  }\n  return { accessKeyId, secretAccessKey, sessionToken: env?.AWS_SESSION_TOKEN };\n}\n\nexport function sesEmailTransport(options: SesEmailTransportOptions): EmailTransport {\n  const endpoint = (options.endpoint ?? `https://email.${options.region}.amazonaws.com`).replace(\n    /\\/$/,\n    ''\n  );\n  const credentials = async (): Promise<AwsCredentials> => {\n    const configured = options.credentials;\n    if (configured === undefined) return environmentCredentials();\n    return typeof configured === 'function' ? configured() : configured;\n  };\n  const fetchImpl = options.fetch ?? fetch;\n\n  return {\n    async send(message: EmailMessage) {\n      const body = JSON.stringify({\n        FromEmailAddress: mimeAddress(message.from),\n        Destination: { ToAddresses: [message.to] },\n        ...(message.replyTo === undefined\n          ? {}\n          : { ReplyToAddresses: [mimeAddress(message.replyTo)] }),\n        Content: {\n          Simple: {\n            Subject: { Data: message.subject, Charset: 'UTF-8' },\n            Body: { Html: { Data: message.html, Charset: 'UTF-8' } },\n          },\n        },\n        ...(options.configurationSetName === undefined\n          ? {}\n          : { ConfigurationSetName: options.configurationSetName }),\n      });\n      const url = `${endpoint}/v2/email/outbound-emails`;\n      const headers = await signRequest({\n        method: 'POST',\n        url,\n        headers: { 'content-type': 'application/json' },\n        body,\n        credentials: await credentials(),\n        region: options.region,\n        service: 'ses',\n      });\n      // No retries here: the durable step owns them, and counts them — SES cannot de-duplicate,\n      // so every extra attempt of an accepted send is another chance to deliver twice\n      const response = await fetchImpl(url, { method: 'POST', headers, body });\n      const text = await response.text();\n      if (!response.ok) {\n        let detail = text;\n        try {\n          const parsed = JSON.parse(text) as { message?: unknown; Message?: unknown };\n          const said = parsed.message ?? parsed.Message;\n          if (typeof said === 'string') detail = said;\n        } catch {\n          // Not JSON: the raw body says what went wrong\n        }\n        const type = response.headers.get('x-amzn-errortype')?.split(':')[0];\n        throw new SesSendError(response.status, type, detail);\n      }\n      let messageId: unknown;\n      try {\n        messageId = (JSON.parse(text) as { MessageId?: unknown }).MessageId;\n      } catch {\n        messageId = undefined;\n      }\n      return typeof messageId === 'string' ? { providerMessageId: messageId } : {};\n    },\n  };\n}\n"],"mappings":";;;;AAoCA,IAAa,eAAb,cAAkC,MAAM;CAG3B;CACA;CAHX,OAAyB;CACzB,YACE,QACA,MACA,SACA;EACA,MAAM,yBAAyB,SAAS,SAAS,KAAA,IAAY,KAAK,IAAI,OAAO,KAAK,SAAS;EAJlF,KAAA,SAAA;EACA,KAAA,OAAA;CAIX;AACF;AAEA,SAAS,yBAAyC;CAEhD,MAAM,MAAO,WAA0E,SACnF;CACJ,MAAM,cAAc,KAAK;CACzB,MAAM,kBAAkB,KAAK;CAC7B,IAAI,gBAAgB,KAAA,KAAa,oBAAoB,KAAA,GACnD,MAAM,IAAI,MACR,oJACF;CAEF,OAAO;EAAE;EAAa;EAAiB,cAAc,KAAK;CAAkB;AAC9E;AAEA,SAAgB,kBAAkB,SAAmD;CACnF,MAAM,YAAY,QAAQ,YAAY,iBAAiB,QAAQ,OAAO,gBAAA,CAAiB,QACrF,OACA,EACF;CACA,MAAM,cAAc,YAAqC;EACvD,MAAM,aAAa,QAAQ;EAC3B,IAAI,eAAe,KAAA,GAAW,OAAO,uBAAuB;EAC5D,OAAO,OAAO,eAAe,aAAa,WAAW,IAAI;CAC3D;CACA,MAAM,YAAY,QAAQ,SAAS;CAEnC,OAAO,EACL,MAAM,KAAK,SAAuB;EAChC,MAAM,OAAO,KAAK,UAAU;GAC1B,kBAAkB,YAAY,QAAQ,IAAI;GAC1C,aAAa,EAAE,aAAa,CAAC,QAAQ,EAAE,EAAE;GACzC,GAAI,QAAQ,YAAY,KAAA,IACpB,CAAC,IACD,EAAE,kBAAkB,CAAC,YAAY,QAAQ,OAAO,CAAC,EAAE;GACvD,SAAS,EACP,QAAQ;IACN,SAAS;KAAE,MAAM,QAAQ;KAAS,SAAS;IAAQ;IACnD,MAAM,EAAE,MAAM;KAAE,MAAM,QAAQ;KAAM,SAAS;IAAQ,EAAE;GACzD,EACF;GACA,GAAI,QAAQ,yBAAyB,KAAA,IACjC,CAAC,IACD,EAAE,sBAAsB,QAAQ,qBAAqB;EAC3D,CAAC;EACD,MAAM,MAAM,GAAG,SAAS;EACxB,MAAM,UAAU,MAAM,YAAY;GAChC,QAAQ;GACR;GACA,SAAS,EAAE,gBAAgB,mBAAmB;GAC9C;GACA,aAAa,MAAM,YAAY;GAC/B,QAAQ,QAAQ;GAChB,SAAS;EACX,CAAC;EAGD,MAAM,WAAW,MAAM,UAAU,KAAK;GAAE,QAAQ;GAAQ;GAAS;EAAK,CAAC;EACvE,MAAM,OAAO,MAAM,SAAS,KAAK;EACjC,IAAI,CAAC,SAAS,IAAI;GAChB,IAAI,SAAS;GACb,IAAI;IACF,MAAM,SAAS,KAAK,MAAM,IAAI;IAC9B,MAAM,OAAO,OAAO,WAAW,OAAO;IACtC,IAAI,OAAO,SAAS,UAAU,SAAS;GACzC,QAAQ,CAER;GACA,MAAM,OAAO,SAAS,QAAQ,IAAI,kBAAkB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC;GAClE,MAAM,IAAI,aAAa,SAAS,QAAQ,MAAM,MAAM;EACtD;EACA,IAAI;EACJ,IAAI;GACF,YAAa,KAAK,MAAM,IAAI,CAAC,CAA6B;EAC5D,QAAQ;GACN,YAAY,KAAA;EACd;EACA,OAAO,OAAO,cAAc,WAAW,EAAE,mBAAmB,UAAU,IAAI,CAAC;CAC7E,EACF;AACF"}

package/dist/transports/sigv4.cjs

@@ -0,0 +1,83 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/transports/sigv4.ts
+const utf8 = new TextEncoder();
+function hex(bytes) {
+	return [...new Uint8Array(bytes)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function sha256(data) {
+	return hex(await crypto.subtle.digest("SHA-256", utf8.encode(data)));
+}
+async function hmac(key, data) {
+	const imported = await crypto.subtle.importKey("raw", key, {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	return crypto.subtle.sign("HMAC", imported, utf8.encode(data));
+}
+/** RFC 3986 encoding, as SigV4 wants it: only unreserved characters stay. */
+function encode(value) {
+	return encodeURIComponent(value).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+/** Each path segment encoded once (the URL already decoded it). */
+function canonicalPath(pathname) {
+	return pathname.split("/").map((segment) => encode(decodeURIComponent(segment))).join("/");
+}
+/**
+* The query as sent, each name and value re-encoded. Parsed by hand: URLSearchParams reads `+`
+* as a space, which would sign a value other than the one on the wire.
+*/
+function canonicalQuery(search) {
+	if (search === "" || search === "?") return "";
+	return search.slice(1).split("&").filter((pair) => pair !== "").map((pair) => {
+		const at = pair.indexOf("=");
+		const name = at === -1 ? pair : pair.slice(0, at);
+		const value = at === -1 ? "" : pair.slice(at + 1);
+		return [encode(decodeURIComponent(name)), encode(decodeURIComponent(value))];
+	}).sort(([a, av], [b, bv]) => a === b ? av < bv ? -1 : av > bv ? 1 : 0 : a < b ? -1 : 1).map(([name, value]) => `${name}=${value}`).join("&");
+}
+/** The request's headers with `authorization` (and `x-amz-date`, the session token) added. */
+async function signRequest(request) {
+	const url = new URL(request.url);
+	const datetime = request.datetime ?? (/* @__PURE__ */ new Date()).toISOString().replace(/[:-]|\.\d{3}/g, "");
+	const date = datetime.slice(0, 8);
+	const { accessKeyId, secretAccessKey, sessionToken } = request.credentials;
+	const headers = {};
+	for (const [name, value] of Object.entries(request.headers ?? {})) headers[name.toLowerCase()] = value.trim().replace(/\s+/g, " ");
+	headers.host = url.host;
+	headers["x-amz-date"] = datetime;
+	if (sessionToken !== void 0) headers["x-amz-security-token"] = sessionToken;
+	const names = Object.keys(headers).sort();
+	const signedHeaders = names.join(";");
+	const canonical = [
+		request.method.toUpperCase(),
+		canonicalPath(url.pathname),
+		canonicalQuery(url.search),
+		...names.map((name) => `${name}:${headers[name]}`),
+		"",
+		signedHeaders,
+		await sha256(request.body ?? "")
+	].join("\n");
+	const scope = `${date}/${request.region}/${request.service}/aws4_request`;
+	const toSign = [
+		"AWS4-HMAC-SHA256",
+		datetime,
+		scope,
+		await sha256(canonical)
+	].join("\n");
+	let key = await hmac(utf8.encode(`AWS4${secretAccessKey}`), date);
+	for (const part of [
+		request.region,
+		request.service,
+		"aws4_request"
+	]) key = await hmac(key, part);
+	const signature = hex(await hmac(key, toSign));
+	const { host: _host, ...sent } = headers;
+	return {
+		...sent,
+		authorization: `AWS4-HMAC-SHA256 Credential=${accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`
+	};
+}
+//#endregion
+exports.signRequest = signRequest;
+
+//# sourceMappingURL=sigv4.cjs.map

package/dist/transports/sigv4.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigv4.cjs","names":[],"sources":["../../src/transports/sigv4.ts"],"sourcesContent":["/**\n * AWS Signature Version 4 over WebCrypto, which a Worker and Node both have: enough to sign\n * the JSON API calls the transports make. Headers are signed as given (plus `host` and\n * `x-amz-date`); the payload hash is the body's SHA-256.\n * https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html\n */\n\nexport interface SigV4Credentials {\n  accessKeyId: string;\n  secretAccessKey: string;\n  sessionToken?: string | undefined;\n}\n\nexport interface SigV4Request {\n  method: string;\n  url: string;\n  headers?: Record<string, string>;\n  body?: string;\n  credentials: SigV4Credentials;\n  region: string;\n  service: string;\n  /** `YYYYMMDD'T'HHMMSS'Z'`; now by default. */\n  datetime?: string;\n}\n\nconst utf8 = new TextEncoder();\n\nfunction hex(bytes: ArrayBuffer): string {\n  return [...new Uint8Array(bytes)].map((b) => b.toString(16).padStart(2, '0')).join('');\n}\n\nasync function sha256(data: string): Promise<string> {\n  return hex(await crypto.subtle.digest('SHA-256', utf8.encode(data)));\n}\n\nasync function hmac(\n  key: ArrayBuffer | Uint8Array<ArrayBuffer>,\n  data: string\n): Promise<ArrayBuffer> {\n  const imported = await crypto.subtle.importKey(\n    'raw',\n    key,\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign']\n  );\n  return crypto.subtle.sign('HMAC', imported, utf8.encode(data));\n}\n\n/** RFC 3986 encoding, as SigV4 wants it: only unreserved characters stay. */\nfunction encode(value: string): string {\n  return encodeURIComponent(value).replace(\n    /[!'()*]/g,\n    (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`\n  );\n}\n\n/** Each path segment encoded once (the URL already decoded it). */\nfunction canonicalPath(pathname: string): string {\n  return pathname\n    .split('/')\n    .map((segment) => encode(decodeURIComponent(segment)))\n    .join('/');\n}\n\n/**\n * The query as sent, each name and value re-encoded. Parsed by hand: URLSearchParams reads `+`\n * as a space, which would sign a value other than the one on the wire.\n */\nfunction canonicalQuery(search: string): string {\n  if (search === '' || search === '?') return '';\n  return search\n    .slice(1)\n    .split('&')\n    .filter((pair) => pair !== '')\n    .map((pair) => {\n      const at = pair.indexOf('=');\n      const name = at === -1 ? pair : pair.slice(0, at);\n      const value = at === -1 ? '' : pair.slice(at + 1);\n      return [encode(decodeURIComponent(name)), encode(decodeURIComponent(value))] as const;\n    })\n    .sort(([a, av], [b, bv]) => (a === b ? (av < bv ? -1 : av > bv ? 1 : 0) : a < b ? -1 : 1))\n    .map(([name, value]) => `${name}=${value}`)\n    .join('&');\n}\n\n/** The request's headers with `authorization` (and `x-amz-date`, the session token) added. */\nexport async function signRequest(request: SigV4Request): Promise<Record<string, string>> {\n  const url = new URL(request.url);\n  const datetime = request.datetime ?? new Date().toISOString().replace(/[:-]|\\.\\d{3}/g, '');\n  const date = datetime.slice(0, 8);\n  const { accessKeyId, secretAccessKey, sessionToken } = request.credentials;\n\n  const headers: Record<string, string> = {};\n  for (const [name, value] of Object.entries(request.headers ?? {})) {\n    headers[name.toLowerCase()] = value.trim().replace(/\\s+/g, ' ');\n  }\n  headers.host = url.host;\n  headers['x-amz-date'] = datetime;\n  if (sessionToken !== undefined) headers['x-amz-security-token'] = sessionToken;\n\n  const names = Object.keys(headers).sort();\n  const signedHeaders = names.join(';');\n  const canonical = [\n    request.method.toUpperCase(),\n    canonicalPath(url.pathname),\n    canonicalQuery(url.search),\n    ...names.map((name) => `${name}:${headers[name]}`),\n    '',\n    signedHeaders,\n    await sha256(request.body ?? ''),\n  ].join('\\n');\n\n  const scope = `${date}/${request.region}/${request.service}/aws4_request`;\n  const toSign = ['AWS4-HMAC-SHA256', datetime, scope, await sha256(canonical)].join('\\n');\n\n  let key = await hmac(utf8.encode(`AWS4${secretAccessKey}`), date);\n  for (const part of [request.region, request.service, 'aws4_request']) {\n    key = await hmac(key, part);\n  }\n  const signature = hex(await hmac(key, toSign));\n\n  const { host: _host, ...sent } = headers;\n  return {\n    ...sent,\n    authorization: `AWS4-HMAC-SHA256 Credential=${accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`,\n  };\n}\n"],"mappings":";;AAyBA,MAAM,OAAO,IAAI,YAAY;AAE7B,SAAS,IAAI,OAA4B;CACvC,OAAO,CAAC,GAAG,IAAI,WAAW,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;AACvF;AAEA,eAAe,OAAO,MAA+B;CACnD,OAAO,IAAI,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK,OAAO,IAAI,CAAC,CAAC;AACrE;AAEA,eAAe,KACb,KACA,MACsB;CACtB,MAAM,WAAW,MAAM,OAAO,OAAO,UACnC,OACA,KACA;EAAE,MAAM;EAAQ,MAAM;CAAU,GAChC,OACA,CAAC,MAAM,CACT;CACA,OAAO,OAAO,OAAO,KAAK,QAAQ,UAAU,KAAK,OAAO,IAAI,CAAC;AAC/D;;AAGA,SAAS,OAAO,OAAuB;CACrC,OAAO,mBAAmB,KAAK,CAAC,CAAC,QAC/B,aACC,MAAM,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,YAAY,GACtD;AACF;;AAGA,SAAS,cAAc,UAA0B;CAC/C,OAAO,SACJ,MAAM,GAAG,CAAC,CACV,KAAK,YAAY,OAAO,mBAAmB,OAAO,CAAC,CAAC,CAAC,CACrD,KAAK,GAAG;AACb;;;;;AAMA,SAAS,eAAe,QAAwB;CAC9C,IAAI,WAAW,MAAM,WAAW,KAAK,OAAO;CAC5C,OAAO,OACJ,MAAM,CAAC,CAAC,CACR,MAAM,GAAG,CAAC,CACV,QAAQ,SAAS,SAAS,EAAE,CAAC,CAC7B,KAAK,SAAS;EACb,MAAM,KAAK,KAAK,QAAQ,GAAG;EAC3B,MAAM,OAAO,OAAO,KAAK,OAAO,KAAK,MAAM,GAAG,EAAE;EAChD,MAAM,QAAQ,OAAO,KAAK,KAAK,KAAK,MAAM,KAAK,CAAC;EAChD,OAAO,CAAC,OAAO,mBAAmB,IAAI,CAAC,GAAG,OAAO,mBAAmB,KAAK,CAAC,CAAC;CAC7E,CAAC,CAAC,CACD,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,QAAS,MAAM,IAAK,KAAK,KAAK,KAAK,KAAK,KAAK,IAAI,IAAK,IAAI,IAAI,KAAK,CAAE,CAAC,CACzF,KAAK,CAAC,MAAM,WAAW,GAAG,KAAK,GAAG,OAAO,CAAC,CAC1C,KAAK,GAAG;AACb;;AAGA,eAAsB,YAAY,SAAwD;CACxF,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;CAC/B,MAAM,WAAW,QAAQ,6BAAY,IAAI,KAAK,EAAA,CAAE,YAAY,CAAC,CAAC,QAAQ,iBAAiB,EAAE;CACzF,MAAM,OAAO,SAAS,MAAM,GAAG,CAAC;CAChC,MAAM,EAAE,aAAa,iBAAiB,iBAAiB,QAAQ;CAE/D,MAAM,UAAkC,CAAC;CACzC,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,QAAQ,WAAW,CAAC,CAAC,GAC9D,QAAQ,KAAK,YAAY,KAAK,MAAM,KAAK,CAAC,CAAC,QAAQ,QAAQ,GAAG;CAEhE,QAAQ,OAAO,IAAI;CACnB,QAAQ,gBAAgB;CACxB,IAAI,iBAAiB,KAAA,GAAW,QAAQ,0BAA0B;CAElE,MAAM,QAAQ,OAAO,KAAK,OAAO,CAAC,CAAC,KAAK;CACxC,MAAM,gBAAgB,MAAM,KAAK,GAAG;CACpC,MAAM,YAAY;EAChB,QAAQ,OAAO,YAAY;EAC3B,cAAc,IAAI,QAAQ;EAC1B,eAAe,IAAI,MAAM;EACzB,GAAG,MAAM,KAAK,SAAS,GAAG,KAAK,GAAG,QAAQ,OAAO;EACjD;EACA;EACA,MAAM,OAAO,QAAQ,QAAQ,EAAE;CACjC,CAAC,CAAC,KAAK,IAAI;CAEX,MAAM,QAAQ,GAAG,KAAK,GAAG,QAAQ,OAAO,GAAG,QAAQ,QAAQ;CAC3D,MAAM,SAAS;EAAC;EAAoB;EAAU;EAAO,MAAM,OAAO,SAAS;CAAC,CAAC,CAAC,KAAK,IAAI;CAEvF,IAAI,MAAM,MAAM,KAAK,KAAK,OAAO,OAAO,iBAAiB,GAAG,IAAI;CAChE,KAAK,MAAM,QAAQ;EAAC,QAAQ;EAAQ,QAAQ;EAAS;CAAc,GACjE,MAAM,MAAM,KAAK,KAAK,IAAI;CAE5B,MAAM,YAAY,IAAI,MAAM,KAAK,KAAK,MAAM,CAAC;CAE7C,MAAM,EAAE,MAAM,OAAO,GAAG,SAAS;CACjC,OAAO;EACL,GAAG;EACH,eAAe,+BAA+B,YAAY,GAAG,MAAM,kBAAkB,cAAc,cAAc;CACnH;AACF"}

package/dist/transports/sigv4.d.cts

@@ -0,0 +1,27 @@
+//#region src/transports/sigv4.d.ts
+/**
+ * AWS Signature Version 4 over WebCrypto, which a Worker and Node both have: enough to sign
+ * the JSON API calls the transports make. Headers are signed as given (plus `host` and
+ * `x-amz-date`); the payload hash is the body's SHA-256.
+ * https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html
+ */
+export interface SigV4Credentials {
+  accessKeyId: string;
+  secretAccessKey: string;
+  sessionToken?: string | undefined;
+}
+export interface SigV4Request {
+  method: string;
+  url: string;
+  headers?: Record<string, string>;
+  body?: string;
+  credentials: SigV4Credentials;
+  region: string;
+  service: string;
+  /** `YYYYMMDD'T'HHMMSS'Z'`; now by default. */
+  datetime?: string;
+}
+/** The request's headers with `authorization` (and `x-amz-date`, the session token) added. */
+export declare function signRequest(request: SigV4Request): Promise<Record<string, string>>;
+//#endregion
+//# sourceMappingURL=sigv4.d.cts.map

package/dist/transports/sigv4.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigv4.d.cts","names":[],"sources":["../../src/transports/sigv4.ts"],"mappings":";;;;;;;iBAOiB;EACf;EACA;EACA;;iBAGe;EACf;EACA;EACA,UAAU;EACV;EACA,aAAa;EACb;EACA;;EAEA;;;wBAiEoB,YAAY,SAAS,eAAe,QAAQ"}

package/dist/transports/sigv4.d.mts

@@ -0,0 +1,27 @@
+//#region src/transports/sigv4.d.ts
+/**
+ * AWS Signature Version 4 over WebCrypto, which a Worker and Node both have: enough to sign
+ * the JSON API calls the transports make. Headers are signed as given (plus `host` and
+ * `x-amz-date`); the payload hash is the body's SHA-256.
+ * https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html
+ */
+export interface SigV4Credentials {
+  accessKeyId: string;
+  secretAccessKey: string;
+  sessionToken?: string | undefined;
+}
+export interface SigV4Request {
+  method: string;
+  url: string;
+  headers?: Record<string, string>;
+  body?: string;
+  credentials: SigV4Credentials;
+  region: string;
+  service: string;
+  /** `YYYYMMDD'T'HHMMSS'Z'`; now by default. */
+  datetime?: string;
+}
+/** The request's headers with `authorization` (and `x-amz-date`, the session token) added. */
+export declare function signRequest(request: SigV4Request): Promise<Record<string, string>>;
+//#endregion
+//# sourceMappingURL=sigv4.d.mts.map

package/dist/transports/sigv4.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sigv4.d.mts","names":[],"sources":["../../src/transports/sigv4.ts"],"mappings":";;;;;;;iBAOiB;EACf;EACA;EACA;;iBAGe;EACf;EACA;EACA,UAAU;EACV;EACA,aAAa;EACb;EACA;;EAEA;;;wBAiEoB,YAAY,SAAS,eAAe,QAAQ"}