sigflint 1.0.0 → 1.0.2

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## Unreleased
+
+## 1.0.2 - 2026-10-29
+
+- Node and Bun load unminified files bundled with Bun instead of esbuild. The files are 24,690 and 23,518 bytes, compared with 24,374 and 23,200 bytes in the published 1.0.1 package. Builds, checks and publishing use Bun 1.4.4.
+- Speed, memory, import and size measurements were repeated on the shipped build with Node 26.12.1 and Bun 1.4.4. The five-round comparison against published 1.0.1 found no clear S3 signing-speed change. Charts and tables in `docs/benchmarks.md` show the new figures and limits. Header signing alone is 5,677 bytes minified and 2,769 bytes gzipped for the Node entry.
+- Formatting, lint and strict type checks now cover the library, tests, conformance generators and benchmark tools. Bun formats and checks types; TypeScript emits declarations. Public signing APIs and types are unchanged. Generated declarations for internal helpers now have parameter types instead of `any`.
+
+## 1.0.1 - 2026-10-18
+
+- A lowercase `method` (`get`) is signed as upper case (`GET`), as botocore does. `fetch` sends `get`, `put`, `post`, `delete`, `head` and `options` in upper case, so before this the signature did not match and the service answered `SignatureDoesNotMatch`. Node's `fetch` sends `patch` as written, so pass `PATCH` in upper case to both sigflint and `fetch`.
+- `end(trailers)` on a chunk signer throws a `TypeError` when a trailer name or value holds a line break. Before, the break was signed as another trailer line.
+- Correction to the 1.0.0 entry: a raw `+` in an S3 path is signed as a space, but "as S3 reads it" was not verified. Nothing has been tried against AWS S3, and a local `s3s-fs` 0.17.0 server reads a raw `+` as a plus sign and rejected the signature. Write `%2B` in the URL to mean a plus: that server accepted it from sigflint and from botocore. The signing is unchanged (`docs/guide.md`).
+- Correction to the 1.0.0 entry: a bundler that picks the `node` or `bun` condition gets the built file (`dist/`) and drops unused signers just as well; the per-signer modules (`src/`) go to the `workerd`, `worker` and `browser` conditions and to bundlers that match none of them.
+
 ## 1.0.0 - 2026-10-16
 
 First version: AWS Signature Version 4 signing for every AWS service.

package/README.md

@@ -5,8 +5,24 @@
   </picture>
 </h1>
 
+<p align="center">
+  <a href="https://github.com/bompus/sigflint/actions/workflows/ci.yml"><img src="https://github.com/bompus/sigflint/actions/workflows/ci.yml/badge.svg" alt="CI status"></a>
+  <a href="https://github.com/bompus/sigflint/releases/latest"><img src="https://badgen.net/github/release/bompus/sigflint" alt="Latest GitHub release"></a>
+  <a href="https://www.npmjs.com/package/sigflint"><img src="https://badgen.net/npm/v/sigflint" alt="Latest sigflint version on npm"></a>
+  <a href="LICENSE"><img src="https://badgen.net/badge/license/MIT/blue" alt="MIT license"></a>
+</p>
+
+<p align="center">
+  <a href="docs/guide.md#usage">Headers and presigned URLs</a>&nbsp;·
+  <a href="docs/guide.md#sigv4a-multi-region">SigV4a</a>&nbsp;·
+  <a href="docs/guide.md#chunked-uploads">Chunked uploads and event streams</a>&nbsp;·
+  <a href="package.json">No dependencies</a>
+</p>
+
 Fast AWS Signature Version 4 request signing for every AWS service, with no dependencies. It runs on Node.js, Bun, Deno, Cloudflare Workers and browsers.
 
+Signs an S3 GET in 0.97 µs on Node, 5.3 times as fast as `aws4`, with the same signatures as botocore on 6,582 test requests.
+
 ```js
 import { getAuthHeaders } from 'sigflint';
 
@@ -20,11 +36,18 @@ const response = await fetch(url, { headers });
 
 It signs requests with the `Authorization` header or as a presigned URL, for S3 and for any other service (`service: 'dynamodb'`, `'sqs'`, `'execute-api'`, ...), and it also does multi-region signatures (SigV4a), chunked uploads and event streams.
 
-- **Correct.** It returns the same signature as botocore for all 3,360 S3 requests in its test corpus, and for 1,622 requests to other services and 1,600 presigned URLs. For S3, botocore signs the request after this repository's own path and query normalization (`conformance/oracle.py`), so that step is not checked independently by the corpus; the four S3 examples published by AWS, which are in it, are. SigV4a signatures verify against the AWS CRT's, and chunk and event signatures match the AWS SDK's. See [how it is tested](docs/benchmarks.md#how-it-is-tested).
-- **Fast.** 1.3 to 3.7 µs per header or presigned-URL signature on Node and 1.5 to 5.1 µs on Bun. The other libraries take 2.4 to 507 times as long on the requests they sign correctly (one Bun presigned-URL comparison with `minio` is not clear and is left out). See [speed](docs/benchmarks.md#speed).
+- **Correct.** It returns the same signature as botocore for all 3,360 S3 requests in its test corpus, and for 1,622 requests to other services and 1,600 presigned URLs. For S3, botocore signs the request after this repository's own path and query normalization (`conformance/oracle.py`), so that step is not checked independently by the corpus; the four S3 examples published by AWS, which are in it, are. SigV4a signatures verify against the AWS CRT's, and every chunk and event signature in the test corpus matches the AWS SDK's. See [how it is tested](docs/benchmarks.md#how-it-is-tested).
+- **Fast.** 1.0 to 3.2 µs per header or presigned-URL signature on Node and 0.7 to 3.0 µs on Bun. The other libraries take 2.0 to 75 times as long on the requests they sign correctly. Measured on Node 26.12.1 and Bun 1.4.4; see [speed](docs/benchmarks.md#speed).
 - **Small, and you pay only for what you import.** Signing headers is 5.7 kB minified, 2.8 kB gzipped; presigned URLs, SigV4a, chunked uploads and event streams each add to a bundle only when imported. Nothing to install with it. See [size](docs/benchmarks.md#size).
 - **Everywhere.** One import on Node, Bun, Deno and Cloudflare Workers, with or without `nodejs_compat`. See [runtimes](#runtimes).
 
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="docs/speed-dark.svg">
+  <img alt="Bar chart: time in microseconds to sign one S3 request on Node.js and Bun, for sigflint and six other libraries" src="docs/speed-light.svg">
+</picture>
+
+Microseconds per signature; lower is better. On Node 26.12.1, signing a plain S3 GET takes 0.97 µs with sigflint and 5.11 µs with `aws4`, the fastest of the other libraries.
+
 ## Install
 
 ```sh
@@ -58,7 +81,7 @@ For a large or binary body, skip hashing and send `unsignedPayload: true`. S3 ac
 const headers = await getAuthHeaders({ method: 'PUT', url, region, unsignedPayload: true }, credentials);
 ```
 
-For another S3-compatible service, pass its region name and URL (`https://us-sea-1.linodeobjects.com/bucket/key`, `http://127.0.0.1:9000/bucket/key`). These are examples of the form, not endpoints that were tried: signatures are checked against botocore, the AWS CRT, the AWS SDK's signer and the AWS documentation examples, and nothing has been sent to AWS S3 or any other server, so a service that canonicalizes requests differently from S3 may reject them.
+For another S3-compatible service, pass its region name and URL (`https://us-sea-1.linodeobjects.com/bucket/key`, `http://127.0.0.1:9000/bucket/key`). These are examples of the form, not endpoints that were tried. Signatures are checked against botocore, the AWS CRT, the AWS SDK's signer and the AWS documentation examples. Nothing has been sent to AWS S3, so a service that canonicalizes requests differently from S3 may reject them. The only server tried is a local `s3s-fs` 0.17.0 test server on loopback, once, with header-signed requests (create a bucket, `PUT`, `GET`, list): it accepted them, except that it rejected sigflint's signature for a raw `+` in the path, so write `%2B` ([how the path is read](docs/guide.md#how-it-reads-the-url)).
 
 More in the [guide](docs/guide.md): [other services](docs/guide.md#other-services), [presigned URLs](docs/guide.md#presigned-urls), [SigV4a](docs/guide.md#sigv4a-multi-region), [chunked uploads](docs/guide.md#chunked-uploads), [event streams](docs/guide.md#event-streams), why to always `await`, and the [full API](docs/guide.md#api).
 
@@ -68,11 +91,6 @@ Node.js 22.12 and later, Bun, Deno, and Cloudflare Workers with or without `node
 
 ## Benchmarks
 
-<picture>
-  <source media="(prefers-color-scheme: dark)" srcset="docs/speed-dark.svg">
-  <img alt="Bar chart: time in microseconds to sign one S3 request on Node.js and Bun, for sigflint and six other libraries" src="docs/speed-light.svg">
-</picture>
-
 Correctness, [speed](docs/benchmarks.md#speed), [memory](docs/benchmarks.md#memory) and [size](docs/benchmarks.md#size), the [test corpora](docs/benchmarks.md#how-it-is-tested) and the [methodology and limits](docs/benchmarks.md#methodology-and-limits) are in [docs/benchmarks.md](docs/benchmarks.md). Every figure there comes from raw results committed in `bench/results/`. The speed, memory and import figures were measured on the code in this release and are re-run before each release.
 
 ## Scope