sigflint 0.0.0 → 1.0.0

package/dist/node.js

@@ -0,0 +1,585 @@
+// src/node.js
+import crypto2 from "node:crypto";
+
+// src/base.js
+var emptyBodyHash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
+var symmetric = { algorithm: "AWS4-HMAC-SHA256", scope: (date, region, service) => `${date}/${region}/${service}/aws4_request` };
+var reSafePath = /^[A-Za-z0-9\-._~/]*$/;
+var reSafeQuery = /^[A-Za-z0-9\-._~=&]*$/;
+var reSpaces = /[ \t]+/g;
+var reDirty = /\t|  /;
+var pathTable;
+var queryTable;
+function tables() {
+  if (pathTable !== void 0) return;
+  pathTable = new Array(256);
+  queryTable = new Array(256);
+  for (let b = 0; b < 256; b++) {
+    const c = String.fromCharCode(b);
+    const unreserved = /[A-Za-z0-9\-._~]/.test(c);
+    const escaped = (b < 16 ? "%0" : "%") + b.toString(16).toUpperCase();
+    pathTable[b] = unreserved || c === "/" ? c : escaped;
+    queryTable[b] = unreserved ? c : escaped;
+  }
+}
+function hexValue(code) {
+  if (code >= 48 && code <= 57) return code - 48;
+  if (code >= 65 && code <= 70) return code - 55;
+  if (code >= 97 && code <= 102) return code - 87;
+  return -1;
+}
+function canonicalEncode(string, table) {
+  let out = "";
+  let start = 0;
+  for (let i = 0; i < string.length; i++) {
+    const code = string.charCodeAt(i);
+    const same = table[code];
+    if (same.length === 1 && code !== 43) continue;
+    out += string.slice(start, i);
+    start = i + 1;
+    if (code === 37) {
+      const hi = hexValue(string.charCodeAt(i + 1));
+      const lo = hexValue(string.charCodeAt(i + 2));
+      if (hi >= 0 && lo >= 0) {
+        out += table[hi << 4 | lo];
+        i += 2;
+        start = i + 1;
+      } else {
+        out += "%25";
+      }
+    } else {
+      out += code === 43 ? "%20" : same;
+    }
+  }
+  return start === 0 ? string : out + string.slice(start);
+}
+function canonicalPathGeneral(pathname) {
+  const parts = pathname.split("/");
+  const kept = [];
+  for (let i = 0; i < parts.length; i++) {
+    const part = parts[i];
+    if (part === "" || part === ".") continue;
+    if (part === "..") kept.pop();
+    else kept.push(part);
+  }
+  const path = (pathname.startsWith("/") ? "/" : "") + kept.join("/") + (pathname.endsWith("/") && kept.length > 0 ? "/" : "");
+  if (reSafePath.test(path)) return path === "" ? "/" : path;
+  tables();
+  let out = "";
+  for (let i = 0; i < path.length; i++) out += queryTable[path.charCodeAt(i)] === path[i] || path[i] === "/" ? path[i] : queryTable[path.charCodeAt(i)];
+  return out;
+}
+function canonicalPathS3(pathname) {
+  if (reSafePath.test(pathname)) return pathname === "" ? "/" : pathname;
+  tables();
+  return canonicalEncode(pathname, pathTable);
+}
+var canonicalPath = (service, pathname) => service === "s3" ? canonicalPathS3(pathname) : canonicalPathGeneral(pathname);
+function comparePairs(a, b) {
+  return a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : a[1] < b[1] ? -1 : a[1] > b[1] ? 1 : 0;
+}
+function canonicalQuery(search) {
+  if (search.length < 2) return "";
+  const query = search.slice(1);
+  const simple = reSafeQuery.test(query);
+  if (simple) {
+    let out2 = "";
+    let previousName = "";
+    let previousValue = "";
+    let start = 0;
+    for (; ; ) {
+      let end = query.indexOf("&", start);
+      if (end === -1) end = query.length;
+      let eq = query.indexOf("=", start);
+      if (eq === -1 || eq > end) eq = end;
+      const name = query.slice(start, eq);
+      const value = query.slice(eq + 1, end);
+      if (end === start || eq === start || value.includes("=") || start > 0 && (name < previousName || name === previousName && value <= previousValue)) break;
+      out2 += (start === 0 ? "" : "&") + name + "=" + value;
+      if (end === query.length) return out2;
+      previousName = name;
+      previousValue = value;
+      start = end + 1;
+    }
+  }
+  tables();
+  const pairs = [];
+  for (const part of query.split("&")) {
+    if (part === "") continue;
+    const eq = part.indexOf("=");
+    const rawName = eq === -1 ? part : part.slice(0, eq);
+    const rawValue = eq === -1 ? "" : part.slice(eq + 1);
+    pairs.push(simple && !rawValue.includes("=") ? [rawName, rawValue] : [canonicalEncode(rawName, queryTable), canonicalEncode(rawValue, queryTable)]);
+  }
+  if (pairs.length > 1) pairs.sort(comparePairs);
+  let out = "";
+  for (let i = 0; i < pairs.length; i++) out += (i === 0 ? "" : "&") + pairs[i][0] + "=" + pairs[i][1];
+  return out;
+}
+function insert(names, values, name, value) {
+  let i = names.length;
+  while (i > 0 && names[i - 1] > name) i--;
+  if (i > 0 && names[i - 1] === name) {
+    values[i - 1] = value;
+    return;
+  }
+  for (let j = names.length; j > i; j--) {
+    names[j] = names[j - 1];
+    values[j] = values[j - 1];
+  }
+  names[i] = name;
+  values[i] = value;
+}
+function signHeaderName(name, value) {
+  const lowerName = name.toLowerCase();
+  if (lowerName === "x-amz-date" || lowerName === "authorization" || lowerName === "__proto__") throw new TypeError(`signHeaders cannot contain ${lowerName}`);
+  if (/[\r\n]/.test(value)) throw new TypeError(`signHeaders ${lowerName} has a line break in its value`);
+  return lowerName;
+}
+var headerValue = (value) => {
+  const trimmed = String(value).trim();
+  return reDirty.test(trimmed) ? trimmed.replace(reSpaces, " ") : trimmed;
+};
+var lastSecond = NaN;
+var lastDatetime = "";
+function amzDatetime(now) {
+  const second = Math.floor(now / 1e3);
+  if (second !== lastSecond) {
+    const iso = new Date(second * 1e3).toISOString();
+    lastDatetime = iso.slice(0, 4) + iso.slice(5, 7) + iso.slice(8, 10) + "T" + iso.slice(11, 13) + iso.slice(14, 16) + iso.slice(17, 19) + "Z";
+    lastSecond = second;
+  }
+  return lastDatetime;
+}
+function payloadHashOf(request, hexHash2) {
+  const body = request.body ?? "";
+  return request.unsignedPayload ? "UNSIGNED-PAYLOAD" : body.length === 0 ? emptyBodyHash : hexHash2(body);
+}
+function prepare(request, credentials, payloadHash, scheme = symmetric) {
+  const { method, url, signHeaders } = request;
+  const region = request.region ?? "";
+  const service = request.service ?? "s3";
+  const withHash = service === "s3" || request.unsignedPayload === true;
+  const sessionToken = credentials.sessionToken;
+  const datetime = amzDatetime(request.now ?? Date.now());
+  const date = datetime.slice(0, 8);
+  const headers = withHash ? { "x-amz-date": datetime, "x-amz-content-sha256": payloadHash } : { "x-amz-date": datetime };
+  const extraNames = signHeaders === void 0 ? [] : Object.keys(signHeaders);
+  let canonicalHeaders;
+  let signedHeaders;
+  if (extraNames.length === 0 && !sessionToken) {
+    canonicalHeaders = withHash ? `host:${url.host}
+x-amz-content-sha256:${payloadHash}
+x-amz-date:${datetime}
+` : `host:${url.host}
+x-amz-date:${datetime}
+`;
+    signedHeaders = withHash ? "host;x-amz-content-sha256;x-amz-date" : "host;x-amz-date";
+  } else {
+    const names = [];
+    const values = [];
+    if (sessionToken) {
+      headers["x-amz-security-token"] = sessionToken;
+      insert(names, values, "x-amz-security-token", sessionToken.trim());
+    }
+    for (const name of extraNames) {
+      const value = (
+        /** @type {Record<string, string>} */
+        signHeaders[name]
+      );
+      const lowerName = signHeaderName(name, value);
+      headers[lowerName] = value;
+      insert(names, values, lowerName, headerValue(value));
+    }
+    const baseNames = withHash ? ["host", "x-amz-content-sha256", "x-amz-date"] : ["host", "x-amz-date"];
+    const baseValues = withHash ? [url.host, payloadHash, datetime] : [url.host, datetime];
+    const nBase = baseNames.length;
+    canonicalHeaders = "";
+    signedHeaders = "";
+    let i = 0;
+    let j = 0;
+    while (i < names.length || j < nBase) {
+      let name;
+      let value;
+      if (j === nBase || i < names.length && names[i] <= baseNames[j]) {
+        name = names[i];
+        value = values[i++];
+        if (j < nBase && name === baseNames[j]) j++;
+      } else {
+        name = baseNames[j];
+        value = baseValues[j++];
+      }
+      if (name === "x-amz-content-sha256") payloadHash = value;
+      canonicalHeaders += `${name}:${value}
+`;
+      signedHeaders += signedHeaders === "" ? name : ";" + name;
+    }
+  }
+  const canonicalRequest = `${method}
+${canonicalPath(service, url.pathname)}
+${canonicalQuery(url.search)}
+${canonicalHeaders}
+${signedHeaders}
+${payloadHash}`;
+  return { headers, canonicalRequest, datetime, date, region, service, credentialScope: scheme.scope(date, region, service), signedHeaders, algorithm: scheme.algorithm };
+}
+var stringToSign = (prepared, canonicalRequestHash) => `${prepared.algorithm}
+${prepared.datetime}
+${prepared.credentialScope}
+${canonicalRequestHash}`;
+function authorize(prepared, accessKeyId, signature) {
+  prepared.headers.authorization = `${prepared.algorithm} Credential=${accessKeyId}/${prepared.credentialScope}, SignedHeaders=${prepared.signedHeaders}, Signature=${signature}`;
+  return prepared.headers;
+}
+function createKeys(hmac2) {
+  const signingKeys = /* @__PURE__ */ new Map();
+  const maxSigningKeys = 1e3;
+  let lastSecret;
+  let lastDate;
+  let lastRegion;
+  let lastService;
+  let lastKey;
+  return function getSigningKey2(secretAccessKey, date, region, service) {
+    if (secretAccessKey === lastSecret && date === lastDate && region === lastRegion && service === lastService) return lastKey;
+    const cacheKey = `${date}
+${region}
+${service}
+${secretAccessKey}`;
+    let signingKey = signingKeys.get(cacheKey);
+    if (signingKey === void 0) {
+      signingKey = hmac2(hmac2(hmac2(hmac2("AWS4" + secretAccessKey, date), region), service), "aws4_request");
+      if (signingKeys.size >= maxSigningKeys) signingKeys.delete(signingKeys.keys().next().value);
+      signingKeys.set(cacheKey, signingKey);
+    }
+    lastSecret = secretAccessKey;
+    lastDate = date;
+    lastRegion = region;
+    lastService = service;
+    lastKey = signingKey;
+    return signingKey;
+  };
+}
+function createSigner({ hexHash: hexHash2, hmacHex: hmacHex2, getSigningKey: getSigningKey2 }) {
+  return function getAuthHeaders2(request, credentials) {
+    const prepared = prepare(request, credentials, payloadHashOf(request, hexHash2));
+    return authorize(
+      prepared,
+      credentials.accessKeyId,
+      hmacHex2(getSigningKey2(credentials.secretAccessKey, prepared.date, prepared.region, prepared.service), stringToSign(prepared, hexHash2(prepared.canonicalRequest)))
+    );
+  };
+}
+
+// src/presign.js
+var encodeQueryPart = (text) => encodeURIComponent(text).replace(/[!'()*]/g, (c) => "%" + c.charCodeAt(0).toString(16).toUpperCase());
+function preparePresign(request, credentials, payloadHash, scheme = symmetric, extra = "") {
+  const { method, url, signHeaders } = request;
+  if (url.protocol !== "https:" && url.protocol !== "http:") throw new TypeError("presign needs an http or https URL");
+  if (url.search.length > 1 && (url.search.includes("X-Amz-Signature=") || url.search.includes("X-Amz-Algorithm="))) throw new TypeError("the URL is already presigned");
+  const expires = request.expires ?? 3600;
+  if (!Number.isInteger(expires) || expires < 1 || expires > 604800) throw new RangeError("expires must be a whole number of seconds from 1 to 604800 (7 days)");
+  const region = request.region ?? "";
+  const service = request.service ?? "s3";
+  const datetime = amzDatetime(request.now ?? Date.now());
+  const date = datetime.slice(0, 8);
+  const credentialScope = scheme.scope(date, region, service);
+  const names = ["host"];
+  const values = [url.host];
+  if (signHeaders !== void 0) for (const name of Object.keys(signHeaders)) insert(names, values, signHeaderName(name, signHeaders[name]), headerValue(signHeaders[name]));
+  let canonicalHeaders = "";
+  for (let i = 0; i < names.length; i++) canonicalHeaders += `${names[i]}:${values[i]}
+`;
+  const signedHeaders = names.join(";");
+  let auth = `X-Amz-Algorithm=${scheme.algorithm}&X-Amz-Credential=${encodeQueryPart(`${credentials.accessKeyId}/${credentialScope}`)}&X-Amz-Date=${datetime}&X-Amz-Expires=${expires}&X-Amz-SignedHeaders=${encodeQueryPart(signedHeaders)}`;
+  if (credentials.sessionToken) auth += `&X-Amz-Security-Token=${encodeQueryPart(credentials.sessionToken)}`;
+  auth += extra;
+  const query = url.search.length > 1 ? url.search + "&" + auth : "?" + auth;
+  const hash = service === "s3" || request.unsignedPayload ? "UNSIGNED-PAYLOAD" : payloadHash;
+  const canonicalRequest = `${method}
+${canonicalPath(service, url.pathname)}
+${canonicalQuery(query)}
+${canonicalHeaders}
+${signedHeaders}
+${hash}`;
+  return { canonicalRequest, datetime, date, region, service, credentialScope, signedHeaders, algorithm: scheme.algorithm, base: url.origin + url.pathname, query };
+}
+var presignedUrl = (prepared, signature) => `${prepared.base}${prepared.query}&X-Amz-Signature=${signature}`;
+function createPresigner({ hexHash: hexHash2, hmacHex: hmacHex2, getSigningKey: getSigningKey2 }) {
+  return function presign2(request, credentials) {
+    const prepared = preparePresign(request, credentials, payloadHashOf(request, hexHash2));
+    return presignedUrl(
+      prepared,
+      hmacHex2(getSigningKey2(credentials.secretAccessKey, prepared.date, prepared.region, prepared.service), stringToSign(prepared, hexHash2(prepared.canonicalRequest)))
+    );
+  };
+}
+
+// src/v4a.js
+var asymmetric = { algorithm: "AWS4-ECDSA-P256-SHA256", scope: (date, _region, service) => `${date}/${service}/aws4_request` };
+function regionSetOf(request) {
+  const regionSet = request.regionSet;
+  if (typeof regionSet !== "string" || regionSet === "") throw new TypeError("SigV4a needs request.regionSet, for example 'us-east-1,us-west-2' or '*'");
+  return regionSet;
+}
+var withRegionSet = (request) => ({ ...request, signHeaders: { ...request.signHeaders, "x-amz-region-set": regionSetOf(request) } });
+var regionSetQuery = (request) => `&X-Amz-Region-Set=${encodeQueryPart(regionSetOf(request))}`;
+var kdfInput = (accessKeyId, counter) => `\0\0\0
AWS4-ECDSA-P256-SHA256\0${accessKeyId}${String.fromCharCode(counter)}\0\0
\0`;
+function scalarFrom(k) {
+  const nMinusTwo = 0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254fn;
+  let c = 0n;
+  for (let i = 0; i < 32; i++) c = c << 8n | BigInt(k[i]);
+  if (c > nMinusTwo) return void 0;
+  c += 1n;
+  const d = new Uint8Array(32);
+  for (let i = 31; i >= 0; i--, c >>= 8n) d[i] = Number(c & 0xffn);
+  return d;
+}
+function deriveP256(hmac2, accessKeyId, secretAccessKey) {
+  for (let counter = 1; counter < 128; counter++) {
+    const d = scalarFrom(hmac2("AWS4A" + secretAccessKey, kdfInput(accessKeyId, counter)));
+    if (d !== void 0) return d;
+  }
+  throw new Error("no SigV4a key for these credentials");
+}
+var signers = /* @__PURE__ */ new WeakMap();
+function createAsymmetric(hmac2, ecdsa2) {
+  let sign = signers.get(ecdsa2);
+  if (sign === void 0) signers.set(ecdsa2, sign = signerFor(hmac2, ecdsa2));
+  return sign;
+}
+function signerFor(hmac2, ecdsa2) {
+  const keys = /* @__PURE__ */ new Map();
+  return function sign(credentials, text) {
+    const id = `${credentials.accessKeyId}/${credentials.secretAccessKey}`;
+    let key = keys.get(id);
+    if (key === void 0) {
+      key = ecdsa2.key(deriveP256(hmac2, credentials.accessKeyId, credentials.secretAccessKey));
+      if (keys.size >= 1e3) keys.delete(keys.keys().next().value);
+      keys.set(id, key);
+    }
+    return ecdsa2.sign(key, text);
+  };
+}
+function createSignerV4a({ hexHash: hexHash2, hmac: hmac2, ecdsa: ecdsa2 }) {
+  const sign = createAsymmetric(hmac2, ecdsa2);
+  return function getAuthHeadersV4a2(request, credentials) {
+    const prepared = prepare(withRegionSet(request), credentials, payloadHashOf(request, hexHash2), asymmetric);
+    return authorize(prepared, credentials.accessKeyId, sign(credentials, stringToSign(prepared, hexHash2(prepared.canonicalRequest))));
+  };
+}
+function createPresignerV4a({ hexHash: hexHash2, hmac: hmac2, ecdsa: ecdsa2 }) {
+  const sign = createAsymmetric(hmac2, ecdsa2);
+  return function presignV4a2(request, credentials) {
+    const prepared = preparePresign(request, credentials, payloadHashOf(request, hexHash2), asymmetric, regionSetQuery(request));
+    return presignedUrl(prepared, sign(credentials, stringToSign(prepared, hexHash2(prepared.canonicalRequest))));
+  };
+}
+
+// src/ecdsa-node.js
+import crypto from "node:crypto";
+var b64url = (bytes) => Buffer.from(bytes).toString("base64url");
+var ecdsa = {
+  key(d) {
+    const ecdh = crypto.createECDH("prime256v1");
+    ecdh.setPrivateKey(d);
+    const point = ecdh.getPublicKey();
+    return crypto.createPrivateKey({ key: { kty: "EC", crv: "P-256", d: b64url(d), x: b64url(point.subarray(1, 33)), y: b64url(point.subarray(33)) }, format: "jwk" });
+  },
+  sign: (key, text) => crypto.sign("sha256", text, { key, dsaEncoding: "der" }).toString("hex")
+};
+
+// src/chunks.js
+var utf8 = /* @__PURE__ */ new TextEncoder();
+function seedOf(authHeaders) {
+  const auth = authHeaders.authorization;
+  if (typeof auth !== "string" || !auth.startsWith("AWS4-HMAC-SHA256 "))
+    throw new TypeError("authHeaders must be the headers getAuthHeaders returned (a SigV4a signature cannot start a chunk or event stream)");
+  const scope = auth.slice(auth.indexOf("Credential=") + 11, auth.indexOf(",")).split("/");
+  return {
+    signature: auth.slice(auth.lastIndexOf("Signature=") + 10),
+    datetime: authHeaders["x-amz-date"],
+    date: scope[1],
+    region: scope[2],
+    service: scope[3],
+    scope: scope.slice(1).join("/")
+  };
+}
+var chunkStringToSign = (datetime, scope, previous, payloadHash) => `AWS4-HMAC-SHA256-PAYLOAD
+${datetime}
+${scope}
+${previous}
+${emptyBodyHash}
+${payloadHash}`;
+var trailerStringToSign = (datetime, scope, previous, trailerHash) => `AWS4-HMAC-SHA256-TRAILER
+${datetime}
+${scope}
+${previous}
+${trailerHash}`;
+function canonicalTrailers(trailers) {
+  return Object.keys(trailers).map((name) => [name.toLowerCase(), String(trailers[name]).trim()]).sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0).map(([name, value]) => `${name}:${value}
+`).join("");
+}
+function frameChunk(signature, data2) {
+  const head = utf8.encode(`${data2.length.toString(16)};chunk-signature=${signature}\r
+`);
+  const out = new Uint8Array(head.length + data2.length + 2);
+  out.set(head);
+  out.set(data2, head.length);
+  out[out.length - 2] = 13;
+  out[out.length - 1] = 10;
+  return out;
+}
+function frameEnd(signature, trailers, trailerSignature) {
+  return utf8.encode(
+    trailers === void 0 ? `0;chunk-signature=${signature}\r
+\r
+` : `0;chunk-signature=${signature}\r
+${trailers.replace(/\n/g, "\r\n")}x-amz-trailer-signature:${trailerSignature}\r
+\r
+`
+  );
+}
+function createChunkSigner({ hexHash: hexHash2, hmacHex: hmacHex2, getSigningKey: getSigningKey2 }) {
+  return function chunkSigner2(authHeaders, credentials) {
+    const seed = seedOf(authHeaders);
+    const key = getSigningKey2(credentials.secretAccessKey, seed.date, seed.region, seed.service);
+    let previous = seed.signature;
+    const sign = (data2) => previous = hmacHex2(key, chunkStringToSign(seed.datetime, seed.scope, previous, hexHash2(data2)));
+    return {
+      chunk: (data2) => data2.length === 0 ? data2 : frameChunk(sign(data2), data2),
+      // a zero-length chunk would end the upload; it is not sent
+      end(trailers) {
+        const signature = sign(new Uint8Array(0));
+        if (trailers === void 0) return frameEnd(signature);
+        const text = canonicalTrailers(trailers);
+        const trailerSignature = hmacHex2(key, trailerStringToSign(seed.datetime, seed.scope, signature, hexHash2(text)));
+        return frameEnd(signature, text, trailerSignature);
+      }
+    };
+  };
+}
+
+// src/events.js
+var crcTable;
+function crc32(bytes, start, end) {
+  if (crcTable === void 0) {
+    crcTable = new Int32Array(256);
+    for (let n = 0; n < 256; n++) {
+      let c = n;
+      for (let k = 0; k < 8; k++) c = c & 1 ? 3988292384 ^ c >>> 1 : c >>> 1;
+      crcTable[n] = c;
+    }
+  }
+  let crc = -1;
+  for (let i = start; i < end; i++) crc = crcTable[(crc ^ bytes[i]) & 255] ^ crc >>> 8;
+  return ~crc >>> 0;
+}
+function dateHeader(ms) {
+  const out = new Uint8Array(15);
+  out[0] = 5;
+  out.set(utf8.encode(":date"), 1);
+  out[6] = 8;
+  new DataView(out.buffer).setBigInt64(7, BigInt(Math.floor(ms)));
+  return out;
+}
+function frameEvent(dateBytes, signatureHex, inner2) {
+  const headersLength = dateBytes.length + 52;
+  const out = new Uint8Array(16 + headersLength + inner2.length);
+  const view = new DataView(out.buffer);
+  view.setUint32(0, out.length);
+  view.setUint32(4, headersLength);
+  view.setUint32(8, crc32(out, 0, 8));
+  out.set(dateBytes, 12);
+  let at = 12 + dateBytes.length;
+  out[at++] = 16;
+  out.set(utf8.encode(":chunk-signature"), at);
+  at += 16;
+  out[at++] = 6;
+  view.setUint16(at, 32);
+  at += 2;
+  for (let i = 0; i < 32; i++) out[at + i] = parseInt(signatureHex.slice(2 * i, 2 * i + 2), 16);
+  at += 32;
+  out.set(inner2, at);
+  view.setUint32(out.length - 4, crc32(out, 0, out.length - 4));
+  return out;
+}
+var eventStringToSign = (datetime, scope, previous, headersHash, payloadHash) => `AWS4-HMAC-SHA256-PAYLOAD
+${datetime}
+${scope}
+${previous}
+${headersHash}
+${payloadHash}`;
+var eventScope = (ms, region, service) => {
+  const datetime = amzDatetime(ms);
+  return { datetime, scope: `${datetime.slice(0, 8)}/${region}/${service}/aws4_request`, date: datetime.slice(0, 8) };
+};
+function createEventSigner({ hexHash: hexHash2, hmacHex: hmacHex2, getSigningKey: getSigningKey2 }) {
+  return function eventSigner2(authHeaders, credentials) {
+    const seed = seedOf(authHeaders);
+    let previous = seed.signature;
+    return {
+      sign(message, now = Date.now()) {
+        const { datetime, scope, date } = eventScope(now, seed.region, seed.service);
+        const header = dateHeader(now);
+        previous = hmacHex2(
+          getSigningKey2(credentials.secretAccessKey, date, seed.region, seed.service),
+          eventStringToSign(datetime, scope, previous, hexHash2(header), hexHash2(message))
+        );
+        return frameEvent(header, previous, message);
+      }
+    };
+  };
+}
+
+// src/node.js
+var utf82 = /* @__PURE__ */ new TextEncoder();
+var maxData = 1024;
+var inner = /* @__PURE__ */ new Uint8Array(64 + maxData);
+var outer = /* @__PURE__ */ new Uint8Array(64 + 32);
+var data = /* @__PURE__ */ inner.subarray(64);
+var innerViews = [];
+var blockKey;
+var nibble = (c) => c > 96 ? c - 87 : c - 48;
+function hmacHexOneShot(key, text) {
+  if (key !== blockKey) {
+    blockKey = key;
+    inner.fill(54, 0, 64);
+    outer.fill(92, 0, 64);
+    for (let i = 0; i < key.length; i++) {
+      inner[i] ^= key[i];
+      outer[i] ^= key[i];
+    }
+  }
+  const end = 64 + utf82.encodeInto(text, data).written;
+  const hex = crypto2.hash("sha256", innerViews[end] ??= inner.subarray(0, end), "hex");
+  for (let i = 0; i < 32; i++) outer[64 + i] = nibble(hex.charCodeAt(2 * i)) << 4 | nibble(hex.charCodeAt(2 * i + 1));
+  return crypto2.hash("sha256", outer, "hex");
+}
+var hmacHexStreaming = (key, text) => crypto2.createHmac("sha256", key).update(text).digest("hex");
+var hmac = (key, text) => crypto2.createHmac("sha256", key).update(text).digest();
+var oneShotWorks;
+function probe() {
+  const key = hmac("probe", "key");
+  const text = "AWS4-HMAC-SHA256\n20130524T000000Z";
+  const works = hmacHexOneShot(key, text) === hmacHexStreaming(key, text);
+  blockKey = void 0;
+  return works;
+}
+var hmacHex = (key, text) => (oneShotWorks ??= probe()) && text.length * 3 <= maxData && key.length <= 64 ? hmacHexOneShot(key, text) : hmacHexStreaming(key, text);
+var getSigningKey = /* @__PURE__ */ createKeys(hmac);
+var hexHash = (text) => crypto2.hash("sha256", text, "hex");
+var primitives = { hexHash, hmac, hmacHex, getSigningKey };
+var getAuthHeaders = /* @__PURE__ */ createSigner(primitives);
+var presign = /* @__PURE__ */ createPresigner(primitives);
+var getAuthHeadersV4a = /* @__PURE__ */ createSignerV4a({ hexHash, hmac, ecdsa });
+var presignV4a = /* @__PURE__ */ createPresignerV4a({ hexHash, hmac, ecdsa });
+var chunkSigner = /* @__PURE__ */ createChunkSigner(primitives);
+var eventSigner = /* @__PURE__ */ createEventSigner(primitives);
+export {
+  chunkSigner,
+  eventSigner,
+  getAuthHeaders,
+  getAuthHeadersV4a,
+  presign,
+  presignV4a
+};

package/index.d.ts

@@ -0,0 +1,44 @@
+import type { SignRequest, Credentials, AuthHeaders } from './types/base.js';
+
+export type { SignRequest, Credentials, AuthHeaders };
+
+/** A SigV4a request: a SignRequest whose `regionSet` is required, for example 'us-east-1,us-west-2' or '*'. */
+export type SignRequestV4a = SignRequest & { regionSet: string };
+
+/** A value that is a promise on Cloudflare Workers and in browsers (WebCrypto has only promises) and the value itself on Node.js, Bun and Deno. Always `await` it. */
+export type MaybePromise<T> = T | Promise<T>;
+
+/** Signs an aws-chunked upload: `chunk` for each piece of the body in order, then `end`. */
+export interface ChunkSigner {
+  chunk(data: Uint8Array): MaybePromise<Uint8Array>;
+  end(trailers?: Record<string, string>): MaybePromise<Uint8Array>;
+}
+
+/** Signs the messages of an event stream in order. */
+export interface EventSigner {
+  sign(message: Uint8Array, now?: number): MaybePromise<Uint8Array>;
+}
+
+/**
+ * The headers to send with a request: authorization, x-amz-date, the session token header when there is one, any extra headers that were signed and, for S3 (or
+ * when `unsignedPayload` is set), x-amz-content-sha256. `request.service` defaults to 's3'.
+ *
+ * Node.js, Bun and Deno return the headers directly. Cloudflare Workers and browsers have only promise-based
+ * WebCrypto and return a promise. Always `await` the result and the same code runs everywhere.
+ */
+export function getAuthHeaders(request: SignRequest, credentials: Credentials): MaybePromise<AuthHeaders>;
+
+/** A presigned URL: the original URL with the authentication parameters and the signature added. `request.expires` is the lifetime in seconds (default 3600). */
+export function presign(request: SignRequest, credentials: Credentials): MaybePromise<string>;
+
+/** SigV4a (multi-region) headers; `request.regionSet` is required, for example 'us-east-1,us-west-2' or '*'. */
+export function getAuthHeadersV4a(request: SignRequestV4a, credentials: Credentials): MaybePromise<AuthHeaders>;
+
+/** A SigV4a presigned URL; `request.regionSet` is required. */
+export function presignV4a(request: SignRequestV4a, credentials: Credentials): MaybePromise<string>;
+
+/** Chunk signer for an upload sent with `x-amz-content-sha256: STREAMING-AWS4-HMAC-SHA256-PAYLOAD`; `authHeaders` are the headers getAuthHeaders returned for it. */
+export function chunkSigner(authHeaders: AuthHeaders, credentials: Credentials): ChunkSigner;
+
+/** Event-stream signer; `authHeaders` are the headers getAuthHeaders returned for the request that opened the stream. */
+export function eventSigner(authHeaders: AuthHeaders, credentials: Credentials): EventSigner;