sigflint 0.0.0 → 1.0.0

package/types/v4a.d.ts

@@ -0,0 +1,48 @@
+export declare const asymmetric: {
+    algorithm: string;
+    scope: (date: any, _region: any, service: any) => string;
+};
+/** The request with the region set added as a signed header; `regionSet` is 'us-east-1,us-west-2' or '*'. */
+export declare const withRegionSet: (request: any) => any;
+export declare const regionSetQuery: (request: any) => string;
+export declare const kdfInput: (accessKeyId: any, counter: any) => string;
+/** The private scalar (HMAC output + 1) when the HMAC output is at most the curve order minus 2, else undefined. */
+export declare function scalarFrom(k: any): Uint8Array<ArrayBuffer> | undefined;
+/** The SigV4a private key: the P-256 scalar derived from the secret key by the counter-mode HMAC construction in the AWS documentation (32 bytes, big-endian). */
+export declare function deriveP256(hmac: any, accessKeyId: any, secretAccessKey: any): Uint8Array<ArrayBuffer>;
+/** A signer from the string to sign to a hex DER ECDSA signature, with a cache of the keys built from credentials. Asking again for the same `ecdsa` returns the same signer. */
+export declare function createAsymmetric(hmac: any, ecdsa: any): any;
+export type AsymmetricPrimitives = {
+    /**
+     * - SHA-256 as lowercase hex
+     */
+    hexHash: (data: string | Uint8Array) => string;
+    /**
+     * - HMAC-SHA-256 as bytes
+     */
+    hmac: (key: string | Uint8Array, data: string) => Uint8Array;
+    /**
+     * - the entry's ECDSA P-256 primitive; built here rather than in the entry so a bundle without SigV4a does not carry it
+     */
+    ecdsa: {
+        key: (scalar: Uint8Array) => unknown;
+        sign: (key: any, text: string) => string;
+    };
+};
+/**
+ * @typedef {Object} AsymmetricPrimitives
+ * @property {(data: string | Uint8Array) => string} hexHash - SHA-256 as lowercase hex
+ * @property {(key: string | Uint8Array, data: string) => Uint8Array} hmac - HMAC-SHA-256 as bytes
+ * @property {{ key: (scalar: Uint8Array) => unknown, sign: (key: any, text: string) => string }} ecdsa - the entry's ECDSA P-256 primitive; built here rather than in the entry so a bundle without SigV4a does not carry it
+ */
+/**
+ * The synchronous entries' SigV4a header signer.
+ * @param {AsymmetricPrimitives} primitives
+ * @returns {(request: import('./base.js').SignRequest, credentials: import('./base.js').Credentials) => import('./base.js').AuthHeaders}
+ */
+export declare function createSignerV4a({ hexHash, hmac, ecdsa }: AsymmetricPrimitives): (request: import('./base.js').SignRequest, credentials: import('./base.js').Credentials) => import('./base.js').AuthHeaders;
+/**
+ * @param {AsymmetricPrimitives} primitives
+ * @returns {(request: import('./base.js').SignRequest, credentials: import('./base.js').Credentials) => string}
+ */
+export declare function createPresignerV4a({ hexHash, hmac, ecdsa }: AsymmetricPrimitives): (request: import('./base.js').SignRequest, credentials: import('./base.js').Credentials) => string;

package/types/web.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Same request and credentials as the other entries; resolves to the headers to send.
+ * @param {import('./base.js').SignRequest} request
+ * @param {import('./base.js').Credentials} credentials
+ * @returns {Promise<import('./base.js').AuthHeaders>}
+ */
+export declare function getAuthHeaders(request: import('./base.js').SignRequest, credentials: import('./base.js').Credentials): Promise<import('./base.js').AuthHeaders>;
+/**
+ * SigV4a: the same, signed with ECDSA for the regions in `request.regionSet` ('us-east-1,us-west-2' or '*').
+ * @param {import('./base.js').SignRequest} request
+ * @param {import('./base.js').Credentials} credentials
+ * @returns {Promise<import('./base.js').AuthHeaders>}
+ */
+export declare function getAuthHeadersV4a(request: import('./base.js').SignRequest, credentials: import('./base.js').Credentials): Promise<import('./base.js').AuthHeaders>;
+/**
+ * A presigned URL for the same request and credentials; `request.expires` is the lifetime in seconds (default 3600).
+ * @param {import('./base.js').SignRequest} request
+ * @param {import('./base.js').Credentials} credentials
+ * @returns {Promise<string>}
+ */
+export declare function presign(request: import('./base.js').SignRequest, credentials: import('./base.js').Credentials): Promise<string>;
+/**
+ * SigV4a presigned URL for the regions in `request.regionSet`.
+ * @param {import('./base.js').SignRequest} request
+ * @param {import('./base.js').Credentials} credentials
+ * @returns {Promise<string>}
+ */
+export declare function presignV4a(request: import('./base.js').SignRequest, credentials: import('./base.js').Credentials): Promise<string>;
+/**
+ * Signs an aws-chunked upload chunk by chunk; the same shape as the other entries, with promises.
+ * @param {import('./base.js').AuthHeaders} authHeaders - the headers getAuthHeaders returned for the request
+ * @param {import('./base.js').Credentials} credentials
+ * @returns {{ chunk: (data: Uint8Array) => Promise<Uint8Array>, end: (trailers?: Record<string, string>) => Promise<Uint8Array> }}
+ */
+export declare function chunkSigner(authHeaders: import('./base.js').AuthHeaders, credentials: import('./base.js').Credentials): {
+    chunk: (data: Uint8Array) => Promise<Uint8Array>;
+    end: (trailers?: Record<string, string>) => Promise<Uint8Array>;
+};
+/**
+ * Signs event-stream messages in order.
+ * @param {import('./base.js').AuthHeaders} authHeaders - the headers getAuthHeaders returned for the request
+ * @param {import('./base.js').Credentials} credentials
+ * @returns {{ sign: (message: Uint8Array, now?: number) => Promise<Uint8Array> }}
+ */
+export declare function eventSigner(authHeaders: import('./base.js').AuthHeaders, credentials: import('./base.js').Credentials): {
+    sign: (message: Uint8Array, now?: number) => Promise<Uint8Array>;
+};