sigflint 0.0.0 → 1.0.0

package/src/node.js

@@ -0,0 +1,61 @@
+// Node.js, Deno and Cloudflare Workers with the nodejs_compat flag: node:crypto.
+import crypto from 'node:crypto';
+import { createSigner, createKeys } from './base.js';
+import { createPresigner } from './presign.js';
+import { createSignerV4a, createPresignerV4a } from './v4a.js';
+import { ecdsa } from './ecdsa-node.js';
+import { createChunkSigner } from './chunks.js';
+import { createEventSigner } from './events.js';
+
+const utf8 = /* @__PURE__ */ new TextEncoder();
+const maxData = 1024;
+const inner = /* @__PURE__ */ new Uint8Array(64 + maxData); // the ipad block, then the data
+const outer = /* @__PURE__ */ new Uint8Array(64 + 32); // the opad block, then the inner digest
+const data = /* @__PURE__ */ inner.subarray(64);
+const innerViews = [];
+let blockKey;
+const nibble = (c) => (c > 96 ? c - 87 : c - 48);
+
+// HMAC-SHA-256 as two one-shot hashes over preallocated buffers: it avoids creating a Hmac object per signature.
+// Only a key of at most 64 bytes is handled; the signing key is always 32 bytes.
+function hmacHexOneShot(key, text) {
+  if (key !== blockKey) {
+    blockKey = key;
+    inner.fill(0x36, 0, 64);
+    outer.fill(0x5c, 0, 64);
+    for (let i = 0; i < key.length; i++) {
+      inner[i] ^= key[i];
+      outer[i] ^= key[i];
+    }
+  }
+  const end = 64 + utf8.encodeInto(text, data).written;
+  const hex = crypto.hash('sha256', (innerViews[end] ??= inner.subarray(0, end)), 'hex');
+  for (let i = 0; i < 32; i++) outer[64 + i] = (nibble(hex.charCodeAt(2 * i)) << 4) | nibble(hex.charCodeAt(2 * i + 1));
+  return crypto.hash('sha256', outer, 'hex');
+}
+
+const hmacHexStreaming = (key, text) => crypto.createHmac('sha256', key).update(text).digest('hex');
+
+const hmac = (key, text) => crypto.createHmac('sha256', key).update(text).digest();
+
+// The one-shot form is used only when it agrees with the streaming one on a sample, and only for short data. The sample is checked on first use.
+let oneShotWorks;
+function probe() {
+  const key = hmac('probe', 'key');
+  const text = 'AWS4-HMAC-SHA256\n20130524T000000Z';
+  const works = hmacHexOneShot(key, text) === hmacHexStreaming(key, text);
+  blockKey = undefined;
+  return works;
+}
+const hmacHex = (key, text) => ((oneShotWorks ??= probe()) && text.length * 3 <= maxData && key.length <= 64 ? hmacHexOneShot(key, text) : hmacHexStreaming(key, text));
+
+const getSigningKey = /* @__PURE__ */ createKeys(hmac);
+const hexHash = (text) => crypto.hash('sha256', text, 'hex');
+const primitives = { hexHash, hmac, hmacHex, getSigningKey };
+
+export const getAuthHeaders = /* @__PURE__ */ createSigner(primitives);
+export const presign = /* @__PURE__ */ createPresigner(primitives);
+export const getAuthHeadersV4a = /* @__PURE__ */ createSignerV4a({ hexHash, hmac, ecdsa });
+export const presignV4a = /* @__PURE__ */ createPresignerV4a({ hexHash, hmac, ecdsa });
+export const chunkSigner = /* @__PURE__ */ createChunkSigner(primitives);
+export const eventSigner = /* @__PURE__ */ createEventSigner(primitives);

package/src/presign.js

@@ -0,0 +1,51 @@
+// Presigned URLs: the signature goes in the query string instead of the authorization header.
+import { symmetric, canonicalPath, canonicalQuery, insert, headerValue, signHeaderName, amzDatetime, payloadHashOf, stringToSign } from './base.js';
+
+export const encodeQueryPart = (text) => encodeURIComponent(text).replace(/[!'()*]/g, (c) => '%' + c.charCodeAt(0).toString(16).toUpperCase());
+
+/**
+ * Everything up to the hashing for a presigned URL. `request.expires` is the lifetime in seconds (default 3600). Only the host and request.signHeaders are
+ * signed; S3 URLs are always UNSIGNED-PAYLOAD, other services sign the body hash. `extra` is appended to the authentication parameters.
+ */
+export function preparePresign(request, credentials, payloadHash, scheme = symmetric, extra = '') {
+  const { method, url, signHeaders } = request;
+  if (url.protocol !== 'https:' && url.protocol !== 'http:') throw new TypeError('presign needs an http or https URL');
+  if (url.search.length > 1 && (url.search.includes('X-Amz-Signature=') || url.search.includes('X-Amz-Algorithm='))) throw new TypeError('the URL is already presigned');
+  const expires = request.expires ?? 3600;
+  if (!Number.isInteger(expires) || expires < 1 || expires > 604800) throw new RangeError('expires must be a whole number of seconds from 1 to 604800 (7 days)');
+  const region = request.region ?? '';
+  const service = request.service ?? 's3';
+  const datetime = amzDatetime(request.now ?? Date.now());
+  const date = datetime.slice(0, 8);
+  const credentialScope = scheme.scope(date, region, service);
+  const names = ['host'];
+  const values = [url.host];
+  if (signHeaders !== undefined) for (const name of Object.keys(signHeaders)) insert(names, values, signHeaderName(name, signHeaders[name]), headerValue(signHeaders[name]));
+  let canonicalHeaders = '';
+  for (let i = 0; i < names.length; i++) canonicalHeaders += `${names[i]}:${values[i]}\n`;
+  const signedHeaders = names.join(';');
+  let auth = `X-Amz-Algorithm=${scheme.algorithm}&X-Amz-Credential=${encodeQueryPart(`${credentials.accessKeyId}/${credentialScope}`)}&X-Amz-Date=${datetime}&X-Amz-Expires=${expires}&X-Amz-SignedHeaders=${encodeQueryPart(signedHeaders)}`;
+  if (credentials.sessionToken) auth += `&X-Amz-Security-Token=${encodeQueryPart(credentials.sessionToken)}`;
+  auth += extra;
+  const query = url.search.length > 1 ? url.search + '&' + auth : '?' + auth;
+  const hash = service === 's3' || request.unsignedPayload ? 'UNSIGNED-PAYLOAD' : payloadHash;
+  const canonicalRequest = `${method}\n${canonicalPath(service, url.pathname)}\n${canonicalQuery(query)}\n${canonicalHeaders}\n${signedHeaders}\n${hash}`;
+  return { canonicalRequest, datetime, date, region, service, credentialScope, signedHeaders, algorithm: scheme.algorithm, base: url.origin + url.pathname, query };
+}
+
+/** The URL to hand out: the original URL with the authentication query parameters and the signature appended. */
+export const presignedUrl = (prepared, signature) => `${prepared.base}${prepared.query}&X-Amz-Signature=${signature}`;
+
+/**
+ * @param {import('./base.js').Primitives} primitives
+ * @returns {(request: import('./base.js').SignRequest, credentials: import('./base.js').Credentials) => string}
+ */
+export function createPresigner({ hexHash, hmacHex, getSigningKey }) {
+  return function presign(request, credentials) {
+    const prepared = preparePresign(request, credentials, payloadHashOf(request, hexHash));
+    return presignedUrl(
+      prepared,
+      hmacHex(getSigningKey(credentials.secretAccessKey, prepared.date, prepared.region, prepared.service), stringToSign(prepared, hexHash(prepared.canonicalRequest))),
+    );
+  };
+}

package/src/v4a.js

@@ -0,0 +1,96 @@
+// SigV4a (multi-region): ECDSA P-256 instead of HMAC, a credential scope without the region, and the region set as a signed header (or a query parameter when
+// presigning). The runtime entries supply the ECDSA primitive. Nothing in the symmetric path imports this file.
+import { prepare, payloadHashOf, stringToSign, authorize } from './base.js';
+import { preparePresign, presignedUrl, encodeQueryPart } from './presign.js';
+
+export const asymmetric = { algorithm: 'AWS4-ECDSA-P256-SHA256', scope: (date, _region, service) => `${date}/${service}/aws4_request` };
+
+function regionSetOf(request) {
+  const regionSet = request.regionSet;
+  if (typeof regionSet !== 'string' || regionSet === '') throw new TypeError("SigV4a needs request.regionSet, for example 'us-east-1,us-west-2' or '*'");
+  return regionSet;
+}
+
+/** The request with the region set added as a signed header; `regionSet` is 'us-east-1,us-west-2' or '*'. */
+export const withRegionSet = (request) => ({ ...request, signHeaders: { ...request.signHeaders, 'x-amz-region-set': regionSetOf(request) } });
+
+export const regionSetQuery = (request) => `&X-Amz-Region-Set=${encodeQueryPart(regionSetOf(request))}`;
+
+// 4-byte counter 1, label, 0x00, the access key id, the external counter, 256 as 4 bytes
+export const kdfInput = (accessKeyId, counter) => `\0\0\0\x01AWS4-ECDSA-P256-SHA256\0${accessKeyId}${String.fromCharCode(counter)}\0\0\x01\0`;
+
+/** The private scalar (HMAC output + 1) when the HMAC output is at most the curve order minus 2, else undefined. */
+export function scalarFrom(k) {
+  const nMinusTwo = 0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254fn;
+  let c = 0n;
+  for (let i = 0; i < 32; i++) c = (c << 8n) | BigInt(k[i]);
+  if (c > nMinusTwo) return undefined;
+  c += 1n;
+  const d = new Uint8Array(32);
+  for (let i = 31; i >= 0; i--, c >>= 8n) d[i] = Number(c & 0xffn);
+  return d;
+}
+
+/** The SigV4a private key: the P-256 scalar derived from the secret key by the counter-mode HMAC construction in the AWS documentation (32 bytes, big-endian). */
+export function deriveP256(hmac, accessKeyId, secretAccessKey) {
+  for (let counter = 1; counter < 128; counter++) {
+    const d = scalarFrom(hmac('AWS4A' + secretAccessKey, kdfInput(accessKeyId, counter)));
+    if (d !== undefined) return d;
+  }
+  throw new Error('no SigV4a key for these credentials');
+}
+
+const signers = /* @__PURE__ */ new WeakMap(); // ecdsa -> its signer, so the header and presign functions of one entry share one key cache
+
+/** A signer from the string to sign to a hex DER ECDSA signature, with a cache of the keys built from credentials. Asking again for the same `ecdsa` returns the same signer. */
+export function createAsymmetric(hmac, ecdsa) {
+  let sign = signers.get(ecdsa);
+  if (sign === undefined) signers.set(ecdsa, (sign = signerFor(hmac, ecdsa)));
+  return sign;
+}
+
+function signerFor(hmac, ecdsa) {
+  const keys = new Map();
+  return function sign(credentials, text) {
+    const id = `${credentials.accessKeyId}/${credentials.secretAccessKey}`;
+    let key = keys.get(id);
+    if (key === undefined) {
+      key = ecdsa.key(deriveP256(hmac, credentials.accessKeyId, credentials.secretAccessKey));
+      if (keys.size >= 1000) keys.delete(keys.keys().next().value);
+      keys.set(id, key);
+    }
+    return ecdsa.sign(key, text);
+  };
+}
+
+/**
+ * @typedef {Object} AsymmetricPrimitives
+ * @property {(data: string | Uint8Array) => string} hexHash - SHA-256 as lowercase hex
+ * @property {(key: string | Uint8Array, data: string) => Uint8Array} hmac - HMAC-SHA-256 as bytes
+ * @property {{ key: (scalar: Uint8Array) => unknown, sign: (key: any, text: string) => string }} ecdsa - the entry's ECDSA P-256 primitive; built here rather than in the entry so a bundle without SigV4a does not carry it
+ */
+
+/**
+ * The synchronous entries' SigV4a header signer.
+ * @param {AsymmetricPrimitives} primitives
+ * @returns {(request: import('./base.js').SignRequest, credentials: import('./base.js').Credentials) => import('./base.js').AuthHeaders}
+ */
+export function createSignerV4a({ hexHash, hmac, ecdsa }) {
+  const sign = createAsymmetric(hmac, ecdsa);
+  return function getAuthHeadersV4a(request, credentials) {
+    const prepared = prepare(withRegionSet(request), credentials, payloadHashOf(request, hexHash), asymmetric);
+    return authorize(prepared, credentials.accessKeyId, sign(credentials, stringToSign(prepared, hexHash(prepared.canonicalRequest))));
+  };
+}
+
+/**
+ * @param {AsymmetricPrimitives} primitives
+ * @returns {(request: import('./base.js').SignRequest, credentials: import('./base.js').Credentials) => string}
+ */
+export function createPresignerV4a({ hexHash, hmac, ecdsa }) {
+  const sign = createAsymmetric(hmac, ecdsa);
+  return function presignV4a(request, credentials) {
+    const prepared = preparePresign(request, credentials, payloadHashOf(request, hexHash), asymmetric, regionSetQuery(request));
+    return presignedUrl(prepared, sign(credentials, stringToSign(prepared, hexHash(prepared.canonicalRequest))));
+  };
+}

package/src/web.js

@@ -0,0 +1,187 @@
+// Cloudflare Workers without nodejs_compat, browsers, and anywhere else that has WebCrypto but not node:crypto.
+// WebCrypto only offers promises, so this entry returns a promise; everything else matches the other entries.
+import { payloadHashOf, prepare, stringToSign, authorize } from './base.js';
+import { preparePresign, presignedUrl } from './presign.js';
+import { asymmetric, withRegionSet, regionSetQuery, kdfInput, scalarFrom } from './v4a.js';
+import { seedOf, chunkStringToSign, trailerStringToSign, canonicalTrailers, frameChunk, frameEnd } from './chunks.js';
+import { dateHeader, frameEvent, eventStringToSign, eventScope } from './events.js';
+
+const subtle = /* @__PURE__ */ (() => globalThis.crypto.subtle)();
+const utf8 = /* @__PURE__ */ new TextEncoder();
+
+const hexOfByte = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, '0'));
+function toHex(buffer) {
+  const bytes = new Uint8Array(buffer);
+  let out = '';
+  for (let i = 0; i < bytes.length; i++) out += hexOfByte[bytes[i]];
+  return out;
+}
+
+const hexHash = async (data) => toHex(await subtle.digest('SHA-256', typeof data === 'string' ? utf8.encode(data) : data));
+const importKey = (raw) => subtle.importKey('raw', raw, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+// the next key in the derivation chain: the HMAC of data, as a key
+const deriveKey = async (key, data) => importKey(await subtle.sign('HMAC', key, utf8.encode(data)));
+
+const signingKeys = new Map();
+const maxSigningKeys = 1000;
+let lastSecret;
+let lastDate;
+let lastRegion;
+let lastService;
+let lastKey;
+
+async function getSigningKey(secretAccessKey, date, region, service) {
+  if (secretAccessKey === lastSecret && date === lastDate && region === lastRegion && service === lastService) return lastKey;
+  const cacheKey = `${date}\n${region}\n${service}\n${secretAccessKey}`;
+  let signingKey = signingKeys.get(cacheKey);
+  if (signingKey === undefined) {
+    const dateKey = await deriveKey(await importKey(utf8.encode('AWS4' + secretAccessKey)), date);
+    signingKey = await deriveKey(await deriveKey(await deriveKey(dateKey, region), service), 'aws4_request');
+    if (signingKeys.size >= maxSigningKeys) signingKeys.delete(signingKeys.keys().next().value);
+    signingKeys.set(cacheKey, signingKey);
+  }
+  lastSecret = secretAccessKey;
+  lastDate = date;
+  lastRegion = region;
+  lastService = service;
+  lastKey = signingKey;
+  return signingKey;
+}
+
+const signSymmetric = async (credentials, prepared, text) =>
+  toHex(await subtle.sign('HMAC', await getSigningKey(credentials.secretAccessKey, prepared.date, prepared.region, prepared.service), utf8.encode(text)));
+
+// SigV4a: the derived scalar goes in as a PKCS#8 private key without the public point, which WebCrypto computes itself
+const pkcs8 = /* @__PURE__ */ Uint8Array.from([
+  0x30, 0x41, 0x02, 0x01, 0x00, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x04, 0x27, 0x30,
+  0x25, 0x02, 0x01, 0x01, 0x04, 0x20,
+]);
+const asymmetricKeys = new Map();
+async function getAsymmetricKey({ accessKeyId, secretAccessKey }) {
+  const id = `${accessKeyId}/${secretAccessKey}`;
+  let key = asymmetricKeys.get(id);
+  if (key === undefined) {
+    const root = await importKey(utf8.encode('AWS4A' + secretAccessKey));
+    for (let counter = 1; key === undefined; counter++) {
+      if (counter > 127) throw new Error('no SigV4a key for these credentials');
+      const d = scalarFrom(new Uint8Array(await subtle.sign('HMAC', root, utf8.encode(kdfInput(accessKeyId, counter)))));
+      if (d !== undefined) {
+        const der = new Uint8Array(pkcs8.length + 32);
+        der.set(pkcs8);
+        der.set(d, pkcs8.length);
+        key = await subtle.importKey('pkcs8', der, { name: 'ECDSA', namedCurve: 'P-256' }, false, ['sign']);
+      }
+    }
+    if (asymmetricKeys.size >= 1000) asymmetricKeys.delete(asymmetricKeys.keys().next().value);
+    asymmetricKeys.set(id, key);
+  }
+  return key;
+}
+// r and s as DER integers: leading zeros dropped, a zero byte in front when the top bit is set
+function derInteger(bytes) {
+  let start = 0;
+  while (start < bytes.length - 1 && bytes[start] === 0) start++;
+  const body = bytes.subarray(start);
+  return body[0] & 0x80 ? [0x02, body.length + 1, 0, ...body] : [0x02, body.length, ...body];
+}
+async function signAsymmetric(credentials, text) {
+  const raw = new Uint8Array(await subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, await getAsymmetricKey(credentials), utf8.encode(text)));
+  const body = [...derInteger(raw.subarray(0, 32)), ...derInteger(raw.subarray(32))];
+  return toHex(Uint8Array.from([0x30, body.length, ...body]));
+}
+
+/**
+ * Same request and credentials as the other entries; resolves to the headers to send.
+ * @param {import('./base.js').SignRequest} request
+ * @param {import('./base.js').Credentials} credentials
+ * @returns {Promise<import('./base.js').AuthHeaders>}
+ */
+export async function getAuthHeaders(request, credentials) {
+  const prepared = prepare(request, credentials, await payloadHashOf(request, hexHash));
+  return authorize(prepared, credentials.accessKeyId, await signSymmetric(credentials, prepared, stringToSign(prepared, await hexHash(prepared.canonicalRequest))));
+}
+
+/**
+ * SigV4a: the same, signed with ECDSA for the regions in `request.regionSet` ('us-east-1,us-west-2' or '*').
+ * @param {import('./base.js').SignRequest} request
+ * @param {import('./base.js').Credentials} credentials
+ * @returns {Promise<import('./base.js').AuthHeaders>}
+ */
+export async function getAuthHeadersV4a(request, credentials) {
+  const prepared = prepare(withRegionSet(request), credentials, await payloadHashOf(request, hexHash), asymmetric);
+  return authorize(prepared, credentials.accessKeyId, await signAsymmetric(credentials, stringToSign(prepared, await hexHash(prepared.canonicalRequest))));
+}
+
+/**
+ * A presigned URL for the same request and credentials; `request.expires` is the lifetime in seconds (default 3600).
+ * @param {import('./base.js').SignRequest} request
+ * @param {import('./base.js').Credentials} credentials
+ * @returns {Promise<string>}
+ */
+export async function presign(request, credentials) {
+  const prepared = preparePresign(request, credentials, await payloadHashOf(request, hexHash));
+  return presignedUrl(prepared, await signSymmetric(credentials, prepared, stringToSign(prepared, await hexHash(prepared.canonicalRequest))));
+}
+
+/**
+ * SigV4a presigned URL for the regions in `request.regionSet`.
+ * @param {import('./base.js').SignRequest} request
+ * @param {import('./base.js').Credentials} credentials
+ * @returns {Promise<string>}
+ */
+export async function presignV4a(request, credentials) {
+  const prepared = preparePresign(request, credentials, await payloadHashOf(request, hexHash), asymmetric, regionSetQuery(request));
+  return presignedUrl(prepared, await signAsymmetric(credentials, stringToSign(prepared, await hexHash(prepared.canonicalRequest))));
+}
+
+const signWith = async (key, text) => toHex(await subtle.sign('HMAC', key, utf8.encode(text)));
+
+/**
+ * Signs an aws-chunked upload chunk by chunk; the same shape as the other entries, with promises.
+ * @param {import('./base.js').AuthHeaders} authHeaders - the headers getAuthHeaders returned for the request
+ * @param {import('./base.js').Credentials} credentials
+ * @returns {{ chunk: (data: Uint8Array) => Promise<Uint8Array>, end: (trailers?: Record<string, string>) => Promise<Uint8Array> }}
+ */
+export function chunkSigner(authHeaders, credentials) {
+  const seed = seedOf(authHeaders);
+  let previous = seed.signature;
+  const keyPromise = getSigningKey(credentials.secretAccessKey, seed.date, seed.region, seed.service);
+  // chunks are signed one after the other: a call waits for the one before it
+  /** @type {Promise<any>} */
+  let turn = Promise.resolve();
+  const sign = (data) => (turn = turn.then(async () => (previous = await signWith(await keyPromise, chunkStringToSign(seed.datetime, seed.scope, previous, await hexHash(data))))));
+  return {
+    chunk: async (data) => (data.length === 0 ? data : frameChunk(await sign(data), data)),
+    async end(trailers) {
+      const signature = await sign(new Uint8Array(0));
+      if (trailers === undefined) return frameEnd(signature);
+      const text = canonicalTrailers(trailers);
+      return frameEnd(signature, text, await signWith(await keyPromise, trailerStringToSign(seed.datetime, seed.scope, signature, await hexHash(text))));
+    },
+  };
+}
+
+/**
+ * Signs event-stream messages in order.
+ * @param {import('./base.js').AuthHeaders} authHeaders - the headers getAuthHeaders returned for the request
+ * @param {import('./base.js').Credentials} credentials
+ * @returns {{ sign: (message: Uint8Array, now?: number) => Promise<Uint8Array> }}
+ */
+export function eventSigner(authHeaders, credentials) {
+  const seed = seedOf(authHeaders);
+  let previous = seed.signature;
+  /** @type {Promise<any>} */
+  let turn = Promise.resolve();
+  return {
+    sign: (message, now = Date.now()) =>
+      (turn = turn.then(async () => {
+        const { datetime, scope, date } = eventScope(now, seed.region, seed.service);
+        const header = dateHeader(now);
+        previous = await signWith(
+          await getSigningKey(credentials.secretAccessKey, date, seed.region, seed.service),
+          eventStringToSign(datetime, scope, previous, await hexHash(header), await hexHash(message)),
+        );
+        return frameEvent(header, previous, message);
+      })),
+  };
+}

package/types/base.d.ts

@@ -0,0 +1,145 @@
+export declare const emptyBodyHash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
+/** The scheme of a signature: its algorithm name and how the credential scope is written. SigV4a (v4a.js) has its own. */
+export declare const symmetric: {
+    algorithm: string;
+    scope: (date: any, region: any, service: any) => string;
+};
+/** The canonical path for a service. */
+export declare const canonicalPath: (service: any, pathname: any) => any;
+/** search is url.search, which is '' or starts with '?' */
+export declare function canonicalQuery(search: any): string;
+/** inserts into the name-ordered lists, replacing an entry with the same name */
+export declare function insert(names: any, values: any, name: any, value: any): void;
+/**
+ * Refuses a signHeaders entry that cannot be signed as given: x-amz-date and authorization are set by the signer, `__proto__` cannot be a property of the
+ * returned headers, and a line break in a value would start another canonical header line. Returns the lowercase name.
+ */
+export declare function signHeaderName(name: any, value: any): any;
+/** A header value as it is signed: trimmed, runs of spaces and tabs collapsed. */
+export declare const headerValue: (value: any) => string;
+export declare function amzDatetime(now: any): string;
+export type SignRequest = {
+    /**
+     * - GET, HEAD, PUT, POST, DELETE
+     */
+    method: string;
+    url: URL;
+    /**
+     * - default 's3'
+     */
+    service?: string;
+    /**
+     * - for example us-west-2
+     */
+    region?: string;
+    /**
+     * - hashed into x-amz-content-sha256; an empty or missing body is the hash of an empty string
+     */
+    body?: string;
+    /**
+     * - send UNSIGNED-PAYLOAD as x-amz-content-sha256 instead of hashing the body
+     */
+    unsignedPayload?: boolean;
+    /**
+     * - extra headers to sign and return; names are lowercased in the result
+     */
+    signHeaders?: Record<string, string>;
+    /**
+     * - signing time in milliseconds since the epoch; defaults to the current time
+     */
+    now?: number;
+    /**
+     * - presigned URLs: lifetime in seconds, default 3600
+     */
+    expires?: number;
+    /**
+     * - SigV4a: the regions the signature is valid for, 'us-east-1,us-west-2' or '*'
+     */
+    regionSet?: string;
+};
+export type Credentials = {
+    accessKeyId: string;
+    secretAccessKey: string;
+    /**
+     * - temporary credentials: signed and returned as x-amz-security-token
+     */
+    sessionToken?: string;
+};
+export type AuthHeaders = Record<string, string>;
+export type Primitives = {
+    /**
+     * - SHA-256 as lowercase hex
+     */
+    hexHash: (data: string | Uint8Array) => string;
+    /**
+     * - HMAC-SHA-256 as bytes
+     */
+    hmac: (key: string | Uint8Array, data: string) => Uint8Array;
+    /**
+     * - HMAC-SHA-256 as lowercase hex
+     */
+    hmacHex: (key: Uint8Array, data: string) => string;
+    /**
+     * - the entry's one signing-key cache, shared by every symmetric signer
+     */
+    getSigningKey: ReturnType<typeof createKeys>;
+};
+/**
+ * @typedef {Object} SignRequest
+ * @property {string} method - GET, HEAD, PUT, POST, DELETE
+ * @property {URL} url
+ * @property {string} [service] - default 's3'
+ * @property {string} [region] - for example us-west-2
+ * @property {string} [body] - hashed into x-amz-content-sha256; an empty or missing body is the hash of an empty string
+ * @property {boolean} [unsignedPayload] - send UNSIGNED-PAYLOAD as x-amz-content-sha256 instead of hashing the body
+ * @property {Record<string, string>} [signHeaders] - extra headers to sign and return; names are lowercased in the result
+ * @property {number} [now] - signing time in milliseconds since the epoch; defaults to the current time
+ * @property {number} [expires] - presigned URLs: lifetime in seconds, default 3600
+ * @property {string} [regionSet] - SigV4a: the regions the signature is valid for, 'us-east-1,us-west-2' or '*'
+ */
+/**
+ * @typedef {Object} Credentials
+ * @property {string} accessKeyId
+ * @property {string} secretAccessKey
+ * @property {string} [sessionToken] - temporary credentials: signed and returned as x-amz-security-token
+ */
+/** @typedef {Record<string, string>} AuthHeaders */
+/**
+ * @typedef {Object} Primitives
+ * @property {(data: string | Uint8Array) => string} hexHash - SHA-256 as lowercase hex
+ * @property {(key: string | Uint8Array, data: string) => Uint8Array} hmac - HMAC-SHA-256 as bytes
+ * @property {(key: Uint8Array, data: string) => string} hmacHex - HMAC-SHA-256 as lowercase hex
+ * @property {ReturnType<typeof createKeys>} getSigningKey - the entry's one signing-key cache, shared by every symmetric signer
+ */
+/** The payload hash for x-amz-content-sha256. The hash function may return a promise, which is then the result. */
+export declare function payloadHashOf(request: any, hexHash: any): any;
+/** Everything up to the hashing: the headers to return, the canonical request and the credential scope. */
+export declare function prepare(request: any, credentials: any, payloadHash: any, scheme?: {
+    algorithm: string;
+    scope: (date: any, region: any, service: any) => string;
+}): {
+    headers: {
+        'x-amz-date': string;
+        'x-amz-content-sha256': any;
+    } | {
+        'x-amz-content-sha256'?: undefined;
+        'x-amz-date': string;
+    };
+    canonicalRequest: string;
+    datetime: string;
+    date: string;
+    region: any;
+    service: any;
+    credentialScope: string;
+    signedHeaders: any;
+    algorithm: string;
+};
+export declare const stringToSign: (prepared: any, canonicalRequestHash: any) => string;
+/** Adds the authorization header to the headers to return. */
+export declare function authorize(prepared: any, accessKeyId: any, signature: any): any;
+export declare function createKeys(hmac: any): (secretAccessKey: any, date: any, region: any, service: any) => any;
+/**
+ * @param {Primitives} primitives
+ * @returns {(request: SignRequest, credentials: Credentials) => AuthHeaders}
+ */
+export declare function createSigner({ hexHash, hmacHex, getSigningKey }: Primitives): (request: SignRequest, credentials: Credentials) => AuthHeaders;

package/types/bun.d.ts

@@ -0,0 +1,6 @@
+export declare const getAuthHeaders: (request: import("./base.js").SignRequest, credentials: import("./base.js").Credentials) => import("./base.js").AuthHeaders;
+export declare const presign: (request: import('./base.js').SignRequest, credentials: import('./base.js').Credentials) => string;
+export declare const getAuthHeadersV4a: (request: import('./base.js').SignRequest, credentials: import('./base.js').Credentials) => import('./base.js').AuthHeaders;
+export declare const presignV4a: (request: import('./base.js').SignRequest, credentials: import('./base.js').Credentials) => string;
+export declare const chunkSigner: (authHeaders: import('./base.js').AuthHeaders, credentials: import('./base.js').Credentials) => import("./chunks.js").ChunkSigner;
+export declare const eventSigner: (authHeaders: import('./base.js').AuthHeaders, credentials: import('./base.js').Credentials) => import("./events.js").EventSigner;

package/types/chunks.d.ts

@@ -0,0 +1,38 @@
+export declare const utf8: TextEncoder;
+/** The seed signature, timestamp and scope of a signed request, from the headers getAuthHeaders returned. */
+export declare function seedOf(authHeaders: any): {
+    signature: string;
+    datetime: any;
+    date: string;
+    region: string;
+    service: string;
+    scope: string;
+};
+export declare const chunkStringToSign: (datetime: any, scope: any, previous: any, payloadHash: any) => string;
+export declare const trailerStringToSign: (datetime: any, scope: any, previous: any, trailerHash: any) => string;
+/** Trailing headers in canonical form: lowercase names in name order, each line ending in a newline. */
+export declare function canonicalTrailers(trailers: any): string;
+/** The bytes of one chunk on the wire: size in hex, signature, the data. */
+export declare function frameChunk(signature: any, data: any): Uint8Array<any>;
+/** The last chunk (no data), with the signed trailing headers when there are any. */
+export declare function frameEnd(signature: any, trailers: any, trailerSignature: any): Uint8Array<ArrayBuffer>;
+export type ChunkSigner = {
+    /**
+     * - the bytes to send for one chunk of the body
+     */
+    chunk: (data: Uint8Array) => Uint8Array;
+    /**
+     * - the last chunk, with the signed trailing headers when there are any
+     */
+    end: (trailers?: Record<string, string>) => Uint8Array;
+};
+/**
+ * @typedef {Object} ChunkSigner
+ * @property {(data: Uint8Array) => Uint8Array} chunk - the bytes to send for one chunk of the body
+ * @property {(trailers?: Record<string, string>) => Uint8Array} end - the last chunk, with the signed trailing headers when there are any
+ */
+/**
+ * @param {import('./base.js').Primitives} primitives
+ * @returns {(authHeaders: import('./base.js').AuthHeaders, credentials: import('./base.js').Credentials) => ChunkSigner}
+ */
+export declare function createChunkSigner({ hexHash, hmacHex, getSigningKey }: import('./base.js').Primitives): (authHeaders: import('./base.js').AuthHeaders, credentials: import('./base.js').Credentials) => ChunkSigner;

package/types/ecdsa-node.d.ts

@@ -0,0 +1,5 @@
+import crypto from 'node:crypto';
+export declare const ecdsa: {
+    key(d: any): crypto.KeyObject;
+    sign: (key: any, text: any) => string;
+};

package/types/events.d.ts

@@ -0,0 +1,25 @@
+/** The :date header of an event: name, type 8 (timestamp), milliseconds since the epoch as 8 bytes. */
+export declare function dateHeader(ms: any): Uint8Array<ArrayBuffer>;
+/** The signed event: prelude, the :date and :chunk-signature headers, the inner message as payload, checksums. */
+export declare function frameEvent(dateBytes: any, signatureHex: any, inner: any): Uint8Array<any>;
+export declare const eventStringToSign: (datetime: any, scope: any, previous: any, headersHash: any, payloadHash: any) => string;
+export declare const eventScope: (ms: any, region: any, service: any) => {
+    datetime: string;
+    scope: string;
+    date: string;
+};
+export type EventSigner = {
+    /**
+     * - the signed event to send for one encoded message
+     */
+    sign: (message: Uint8Array, now?: number) => Uint8Array;
+};
+/**
+ * @typedef {Object} EventSigner
+ * @property {(message: Uint8Array, now?: number) => Uint8Array} sign - the signed event to send for one encoded message
+ */
+/**
+ * @param {import('./base.js').Primitives} primitives
+ * @returns {(authHeaders: import('./base.js').AuthHeaders, credentials: import('./base.js').Credentials) => EventSigner}
+ */
+export declare function createEventSigner({ hexHash, hmacHex, getSigningKey }: import('./base.js').Primitives): (authHeaders: import('./base.js').AuthHeaders, credentials: import('./base.js').Credentials) => EventSigner;

package/types/node.d.ts

@@ -0,0 +1,6 @@
+export declare const getAuthHeaders: (request: import("./base.js").SignRequest, credentials: import("./base.js").Credentials) => import("./base.js").AuthHeaders;
+export declare const presign: (request: import('./base.js').SignRequest, credentials: import('./base.js').Credentials) => string;
+export declare const getAuthHeadersV4a: (request: import('./base.js').SignRequest, credentials: import('./base.js').Credentials) => import('./base.js').AuthHeaders;
+export declare const presignV4a: (request: import('./base.js').SignRequest, credentials: import('./base.js').Credentials) => string;
+export declare const chunkSigner: (authHeaders: import('./base.js').AuthHeaders, credentials: import('./base.js').Credentials) => import("./chunks.js").ChunkSigner;
+export declare const eventSigner: (authHeaders: import('./base.js').AuthHeaders, credentials: import('./base.js').Credentials) => import("./events.js").EventSigner;

package/types/presign.d.ts

@@ -0,0 +1,27 @@
+export declare const encodeQueryPart: (text: any) => string;
+/**
+ * Everything up to the hashing for a presigned URL. `request.expires` is the lifetime in seconds (default 3600). Only the host and request.signHeaders are
+ * signed; S3 URLs are always UNSIGNED-PAYLOAD, other services sign the body hash. `extra` is appended to the authentication parameters.
+ */
+export declare function preparePresign(request: any, credentials: any, payloadHash: any, scheme?: {
+    algorithm: string;
+    scope: (date: any, region: any, service: any) => string;
+}, extra?: string): {
+    canonicalRequest: string;
+    datetime: string;
+    date: string;
+    region: any;
+    service: any;
+    credentialScope: string;
+    signedHeaders: string;
+    algorithm: string;
+    base: any;
+    query: string;
+};
+/** The URL to hand out: the original URL with the authentication query parameters and the signature appended. */
+export declare const presignedUrl: (prepared: any, signature: any) => string;
+/**
+ * @param {import('./base.js').Primitives} primitives
+ * @returns {(request: import('./base.js').SignRequest, credentials: import('./base.js').Credentials) => string}
+ */
+export declare function createPresigner({ hexHash, hmacHex, getSigningKey }: import('./base.js').Primitives): (request: import('./base.js').SignRequest, credentials: import('./base.js').Credentials) => string;