sigflint 1.0.0 → 1.0.2

package/dist/node.js

@@ -3,18 +3,23 @@ import crypto2 from "node:crypto";
 
 // src/base.js
 var emptyBodyHash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
-var symmetric = { algorithm: "AWS4-HMAC-SHA256", scope: (date, region, service) => `${date}/${region}/${service}/aws4_request` };
+var symmetric = {
+  algorithm: "AWS4-HMAC-SHA256",
+  scope: (date, region, service) => `${date}/${region}/${service}/aws4_request`
+};
 var reSafePath = /^[A-Za-z0-9\-._~/]*$/;
 var reSafeQuery = /^[A-Za-z0-9\-._~=&]*$/;
 var reSpaces = /[ \t]+/g;
-var reDirty = /\t|  /;
+var reDirty = /\t| {2}/;
 var pathTable;
 var queryTable;
 function tables() {
-  if (pathTable !== void 0) return;
+  if (pathTable !== undefined) {
+    return;
+  }
   pathTable = new Array(256);
   queryTable = new Array(256);
-  for (let b = 0; b < 256; b++) {
+  for (let b = 0;b < 256; b++) {
     const c = String.fromCharCode(b);
     const unreserved = /[A-Za-z0-9\-._~]/.test(c);
     const escaped = (b < 16 ? "%0" : "%") + b.toString(16).toUpperCase();
@@ -23,18 +28,26 @@ function tables() {
   }
 }
 function hexValue(code) {
-  if (code >= 48 && code <= 57) return code - 48;
-  if (code >= 65 && code <= 70) return code - 55;
-  if (code >= 97 && code <= 102) return code - 87;
+  if (code >= 48 && code <= 57) {
+    return code - 48;
+  }
+  if (code >= 65 && code <= 70) {
+    return code - 55;
+  }
+  if (code >= 97 && code <= 102) {
+    return code - 87;
+  }
   return -1;
 }
 function canonicalEncode(string, table) {
   let out = "";
   let start = 0;
-  for (let i = 0; i < string.length; i++) {
+  for (let i = 0;i < string.length; i++) {
     const code = string.charCodeAt(i);
     const same = table[code];
-    if (same.length === 1 && code !== 43) continue;
+    if (same.length === 1 && code !== 43) {
+      continue;
+    }
     out += string.slice(start, i);
     start = i + 1;
     if (code === 37) {
@@ -56,21 +69,32 @@ function canonicalEncode(string, table) {
 function canonicalPathGeneral(pathname) {
   const parts = pathname.split("/");
   const kept = [];
-  for (let i = 0; i < parts.length; i++) {
+  for (let i = 0;i < parts.length; i++) {
     const part = parts[i];
-    if (part === "" || part === ".") continue;
-    if (part === "..") kept.pop();
-    else kept.push(part);
+    if (part === "" || part === ".") {
+      continue;
+    }
+    if (part === "..") {
+      kept.pop();
+    } else {
+      kept.push(part);
+    }
   }
   const path = (pathname.startsWith("/") ? "/" : "") + kept.join("/") + (pathname.endsWith("/") && kept.length > 0 ? "/" : "");
-  if (reSafePath.test(path)) return path === "" ? "/" : path;
+  if (reSafePath.test(path)) {
+    return path === "" ? "/" : path;
+  }
   tables();
   let out = "";
-  for (let i = 0; i < path.length; i++) out += queryTable[path.charCodeAt(i)] === path[i] || path[i] === "/" ? path[i] : queryTable[path.charCodeAt(i)];
+  for (let i = 0;i < path.length; i++) {
+    out += queryTable[path.charCodeAt(i)] === path[i] || path[i] === "/" ? path[i] : queryTable[path.charCodeAt(i)];
+  }
   return out;
 }
 function canonicalPathS3(pathname) {
-  if (reSafePath.test(pathname)) return pathname === "" ? "/" : pathname;
+  if (reSafePath.test(pathname)) {
+    return pathname === "" ? "/" : pathname;
+  }
   tables();
   return canonicalEncode(pathname, pathTable);
 }
@@ -79,24 +103,34 @@ function comparePairs(a, b) {
   return a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : a[1] < b[1] ? -1 : a[1] > b[1] ? 1 : 0;
 }
 function canonicalQuery(search) {
-  if (search.length < 2) return "";
+  if (search.length < 2) {
+    return "";
+  }
   const query = search.slice(1);
   const simple = reSafeQuery.test(query);
   if (simple) {
-    let out2 = "";
+    let out = "";
     let previousName = "";
     let previousValue = "";
     let start = 0;
-    for (; ; ) {
+    for (;; ) {
       let end = query.indexOf("&", start);
-      if (end === -1) end = query.length;
+      if (end === -1) {
+        end = query.length;
+      }
       let eq = query.indexOf("=", start);
-      if (eq === -1 || eq > end) eq = end;
+      if (eq === -1 || eq > end) {
+        eq = end;
+      }
       const name = query.slice(start, eq);
       const value = query.slice(eq + 1, end);
-      if (end === start || eq === start || value.includes("=") || start > 0 && (name < previousName || name === previousName && value <= previousValue)) break;
-      out2 += (start === 0 ? "" : "&") + name + "=" + value;
-      if (end === query.length) return out2;
+      if (end === start || eq === start || value.includes("=") || start > 0 && (name < previousName || name === previousName && value <= previousValue)) {
+        break;
+      }
+      out += (start === 0 ? "" : "&") + name + "=" + value;
+      if (end === query.length) {
+        return out;
+      }
       previousName = name;
       previousValue = value;
       start = end + 1;
@@ -105,25 +139,36 @@ function canonicalQuery(search) {
   tables();
   const pairs = [];
   for (const part of query.split("&")) {
-    if (part === "") continue;
+    if (part === "") {
+      continue;
+    }
     const eq = part.indexOf("=");
     const rawName = eq === -1 ? part : part.slice(0, eq);
     const rawValue = eq === -1 ? "" : part.slice(eq + 1);
-    pairs.push(simple && !rawValue.includes("=") ? [rawName, rawValue] : [canonicalEncode(rawName, queryTable), canonicalEncode(rawValue, queryTable)]);
+    pairs.push(simple && !rawValue.includes("=") ? [rawName, rawValue] : [
+      canonicalEncode(rawName, queryTable),
+      canonicalEncode(rawValue, queryTable)
+    ]);
+  }
+  if (pairs.length > 1) {
+    pairs.sort(comparePairs);
   }
-  if (pairs.length > 1) pairs.sort(comparePairs);
   let out = "";
-  for (let i = 0; i < pairs.length; i++) out += (i === 0 ? "" : "&") + pairs[i][0] + "=" + pairs[i][1];
+  for (let i = 0;i < pairs.length; i++) {
+    out += (i === 0 ? "" : "&") + pairs[i][0] + "=" + pairs[i][1];
+  }
   return out;
 }
 function insert(names, values, name, value) {
   let i = names.length;
-  while (i > 0 && names[i - 1] > name) i--;
+  while (i > 0 && names[i - 1] > name) {
+    i--;
+  }
   if (i > 0 && names[i - 1] === name) {
     values[i - 1] = value;
     return;
   }
-  for (let j = names.length; j > i; j--) {
+  for (let j = names.length;j > i; j--) {
     names[j] = names[j - 1];
     values[j] = values[j - 1];
   }
@@ -132,8 +177,12 @@ function insert(names, values, name, value) {
 }
 function signHeaderName(name, value) {
   const lowerName = name.toLowerCase();
-  if (lowerName === "x-amz-date" || lowerName === "authorization" || lowerName === "__proto__") throw new TypeError(`signHeaders cannot contain ${lowerName}`);
-  if (/[\r\n]/.test(value)) throw new TypeError(`signHeaders ${lowerName} has a line break in its value`);
+  if (lowerName === "x-amz-date" || lowerName === "authorization" || lowerName === "__proto__") {
+    throw new TypeError(`signHeaders cannot contain ${lowerName}`);
+  }
+  if (/[\r\n]/.test(value)) {
+    throw new TypeError(`signHeaders ${lowerName} has a line break in its value`);
+  }
   return lowerName;
 }
 var headerValue = (value) => {
@@ -143,20 +192,21 @@ var headerValue = (value) => {
 var lastSecond = NaN;
 var lastDatetime = "";
 function amzDatetime(now) {
-  const second = Math.floor(now / 1e3);
+  const second = Math.floor(now / 1000);
   if (second !== lastSecond) {
-    const iso = new Date(second * 1e3).toISOString();
+    const iso = new Date(second * 1000).toISOString();
     lastDatetime = iso.slice(0, 4) + iso.slice(5, 7) + iso.slice(8, 10) + "T" + iso.slice(11, 13) + iso.slice(14, 16) + iso.slice(17, 19) + "Z";
     lastSecond = second;
   }
   return lastDatetime;
 }
-function payloadHashOf(request, hexHash2) {
+function payloadHashOf(request, hexHash) {
   const body = request.body ?? "";
-  return request.unsignedPayload ? "UNSIGNED-PAYLOAD" : body.length === 0 ? emptyBodyHash : hexHash2(body);
+  return request.unsignedPayload ? "UNSIGNED-PAYLOAD" : body.length === 0 ? emptyBodyHash : hexHash(body);
 }
 function prepare(request, credentials, payloadHash, scheme = symmetric) {
-  const { method, url, signHeaders } = request;
+  const { url, signHeaders } = request;
+  const method = request.method.toUpperCase();
   const region = request.region ?? "";
   const service = request.service ?? "s3";
   const withHash = service === "s3" || request.unsignedPayload === true;
@@ -164,7 +214,7 @@ function prepare(request, credentials, payloadHash, scheme = symmetric) {
   const datetime = amzDatetime(request.now ?? Date.now());
   const date = datetime.slice(0, 8);
   const headers = withHash ? { "x-amz-date": datetime, "x-amz-content-sha256": payloadHash } : { "x-amz-date": datetime };
-  const extraNames = signHeaders === void 0 ? [] : Object.keys(signHeaders);
+  const extraNames = signHeaders === undefined ? [] : Object.keys(signHeaders);
   let canonicalHeaders;
   let signedHeaders;
   if (extraNames.length === 0 && !sessionToken) {
@@ -183,10 +233,7 @@ x-amz-date:${datetime}
       insert(names, values, "x-amz-security-token", sessionToken.trim());
     }
     for (const name of extraNames) {
-      const value = (
-        /** @type {Record<string, string>} */
-        signHeaders[name]
-      );
+      const value = signHeaders[name];
       const lowerName = signHeaderName(name, value);
       headers[lowerName] = value;
       insert(names, values, lowerName, headerValue(value));
@@ -204,12 +251,16 @@ x-amz-date:${datetime}
       if (j === nBase || i < names.length && names[i] <= baseNames[j]) {
         name = names[i];
         value = values[i++];
-        if (j < nBase && name === baseNames[j]) j++;
+        if (j < nBase && name === baseNames[j]) {
+          j++;
+        }
       } else {
         name = baseNames[j];
         value = baseValues[j++];
       }
-      if (name === "x-amz-content-sha256") payloadHash = value;
+      if (name === "x-amz-content-sha256") {
+        payloadHash = value;
+      }
       canonicalHeaders += `${name}:${value}
 `;
       signedHeaders += signedHeaders === "" ? name : ";" + name;
@@ -221,7 +272,17 @@ ${canonicalQuery(url.search)}
 ${canonicalHeaders}
 ${signedHeaders}
 ${payloadHash}`;
-  return { headers, canonicalRequest, datetime, date, region, service, credentialScope: scheme.scope(date, region, service), signedHeaders, algorithm: scheme.algorithm };
+  return {
+    headers,
+    canonicalRequest,
+    datetime,
+    date,
+    region,
+    service,
+    credentialScope: scheme.scope(date, region, service),
+    signedHeaders,
+    algorithm: scheme.algorithm
+  };
 }
 var stringToSign = (prepared, canonicalRequestHash) => `${prepared.algorithm}
 ${prepared.datetime}
@@ -231,24 +292,28 @@ function authorize(prepared, accessKeyId, signature) {
   prepared.headers.authorization = `${prepared.algorithm} Credential=${accessKeyId}/${prepared.credentialScope}, SignedHeaders=${prepared.signedHeaders}, Signature=${signature}`;
   return prepared.headers;
 }
-function createKeys(hmac2) {
-  const signingKeys = /* @__PURE__ */ new Map();
-  const maxSigningKeys = 1e3;
+function createKeys(hmac) {
+  const signingKeys = new Map;
+  const maxSigningKeys = 1000;
   let lastSecret;
   let lastDate;
   let lastRegion;
   let lastService;
   let lastKey;
-  return function getSigningKey2(secretAccessKey, date, region, service) {
-    if (secretAccessKey === lastSecret && date === lastDate && region === lastRegion && service === lastService) return lastKey;
+  return function getSigningKey(secretAccessKey, date, region, service) {
+    if (secretAccessKey === lastSecret && date === lastDate && region === lastRegion && service === lastService) {
+      return lastKey;
+    }
     const cacheKey = `${date}
 ${region}
 ${service}
 ${secretAccessKey}`;
     let signingKey = signingKeys.get(cacheKey);
-    if (signingKey === void 0) {
-      signingKey = hmac2(hmac2(hmac2(hmac2("AWS4" + secretAccessKey, date), region), service), "aws4_request");
-      if (signingKeys.size >= maxSigningKeys) signingKeys.delete(signingKeys.keys().next().value);
+    if (signingKey === undefined) {
+      signingKey = hmac(hmac(hmac(hmac("AWS4" + secretAccessKey, date), region), service), "aws4_request");
+      if (signingKeys.size >= maxSigningKeys) {
+        signingKeys.delete(signingKeys.keys().next().value);
+      }
       signingKeys.set(cacheKey, signingKey);
     }
     lastSecret = secretAccessKey;
@@ -259,25 +324,28 @@ ${secretAccessKey}`;
     return signingKey;
   };
 }
-function createSigner({ hexHash: hexHash2, hmacHex: hmacHex2, getSigningKey: getSigningKey2 }) {
-  return function getAuthHeaders2(request, credentials) {
-    const prepared = prepare(request, credentials, payloadHashOf(request, hexHash2));
-    return authorize(
-      prepared,
-      credentials.accessKeyId,
-      hmacHex2(getSigningKey2(credentials.secretAccessKey, prepared.date, prepared.region, prepared.service), stringToSign(prepared, hexHash2(prepared.canonicalRequest)))
-    );
+function createSigner({ hexHash, hmacHex, getSigningKey }) {
+  return function getAuthHeaders(request, credentials) {
+    const prepared = prepare(request, credentials, payloadHashOf(request, hexHash));
+    return authorize(prepared, credentials.accessKeyId, hmacHex(getSigningKey(credentials.secretAccessKey, prepared.date, prepared.region, prepared.service), stringToSign(prepared, hexHash(prepared.canonicalRequest))));
   };
 }
 
 // src/presign.js
 var encodeQueryPart = (text) => encodeURIComponent(text).replace(/[!'()*]/g, (c) => "%" + c.charCodeAt(0).toString(16).toUpperCase());
 function preparePresign(request, credentials, payloadHash, scheme = symmetric, extra = "") {
-  const { method, url, signHeaders } = request;
-  if (url.protocol !== "https:" && url.protocol !== "http:") throw new TypeError("presign needs an http or https URL");
-  if (url.search.length > 1 && (url.search.includes("X-Amz-Signature=") || url.search.includes("X-Amz-Algorithm="))) throw new TypeError("the URL is already presigned");
+  const { url, signHeaders } = request;
+  const method = request.method.toUpperCase();
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    throw new TypeError("presign needs an http or https URL");
+  }
+  if (url.search.length > 1 && (url.search.includes("X-Amz-Signature=") || url.search.includes("X-Amz-Algorithm="))) {
+    throw new TypeError("the URL is already presigned");
+  }
   const expires = request.expires ?? 3600;
-  if (!Number.isInteger(expires) || expires < 1 || expires > 604800) throw new RangeError("expires must be a whole number of seconds from 1 to 604800 (7 days)");
+  if (!Number.isInteger(expires) || expires < 1 || expires > 604800) {
+    throw new RangeError("expires must be a whole number of seconds from 1 to 604800 (7 days)");
+  }
   const region = request.region ?? "";
   const service = request.service ?? "s3";
   const datetime = amzDatetime(request.now ?? Date.now());
@@ -285,13 +353,21 @@ function preparePresign(request, credentials, payloadHash, scheme = symmetric, e
   const credentialScope = scheme.scope(date, region, service);
   const names = ["host"];
   const values = [url.host];
-  if (signHeaders !== void 0) for (const name of Object.keys(signHeaders)) insert(names, values, signHeaderName(name, signHeaders[name]), headerValue(signHeaders[name]));
+  if (signHeaders !== undefined) {
+    for (const name of Object.keys(signHeaders)) {
+      insert(names, values, signHeaderName(name, signHeaders[name]), headerValue(signHeaders[name]));
+    }
+  }
   let canonicalHeaders = "";
-  for (let i = 0; i < names.length; i++) canonicalHeaders += `${names[i]}:${values[i]}
+  for (let i = 0;i < names.length; i++) {
+    canonicalHeaders += `${names[i]}:${values[i]}
 `;
+  }
   const signedHeaders = names.join(";");
   let auth = `X-Amz-Algorithm=${scheme.algorithm}&X-Amz-Credential=${encodeQueryPart(`${credentials.accessKeyId}/${credentialScope}`)}&X-Amz-Date=${datetime}&X-Amz-Expires=${expires}&X-Amz-SignedHeaders=${encodeQueryPart(signedHeaders)}`;
-  if (credentials.sessionToken) auth += `&X-Amz-Security-Token=${encodeQueryPart(credentials.sessionToken)}`;
+  if (credentials.sessionToken) {
+    auth += `&X-Amz-Security-Token=${encodeQueryPart(credentials.sessionToken)}`;
+  }
   auth += extra;
   const query = url.search.length > 1 ? url.search + "&" + auth : "?" + auth;
   const hash = service === "s3" || request.unsignedPayload ? "UNSIGNED-PAYLOAD" : payloadHash;
@@ -301,77 +377,105 @@ ${canonicalQuery(query)}
 ${canonicalHeaders}
 ${signedHeaders}
 ${hash}`;
-  return { canonicalRequest, datetime, date, region, service, credentialScope, signedHeaders, algorithm: scheme.algorithm, base: url.origin + url.pathname, query };
+  return {
+    canonicalRequest,
+    datetime,
+    date,
+    region,
+    service,
+    credentialScope,
+    signedHeaders,
+    algorithm: scheme.algorithm,
+    base: url.origin + url.pathname,
+    query
+  };
 }
 var presignedUrl = (prepared, signature) => `${prepared.base}${prepared.query}&X-Amz-Signature=${signature}`;
-function createPresigner({ hexHash: hexHash2, hmacHex: hmacHex2, getSigningKey: getSigningKey2 }) {
-  return function presign2(request, credentials) {
-    const prepared = preparePresign(request, credentials, payloadHashOf(request, hexHash2));
-    return presignedUrl(
-      prepared,
-      hmacHex2(getSigningKey2(credentials.secretAccessKey, prepared.date, prepared.region, prepared.service), stringToSign(prepared, hexHash2(prepared.canonicalRequest)))
-    );
+function createPresigner({ hexHash, hmacHex, getSigningKey }) {
+  return function presign(request, credentials) {
+    const prepared = preparePresign(request, credentials, payloadHashOf(request, hexHash));
+    return presignedUrl(prepared, hmacHex(getSigningKey(credentials.secretAccessKey, prepared.date, prepared.region, prepared.service), stringToSign(prepared, hexHash(prepared.canonicalRequest))));
   };
 }
 
 // src/v4a.js
-var asymmetric = { algorithm: "AWS4-ECDSA-P256-SHA256", scope: (date, _region, service) => `${date}/${service}/aws4_request` };
+var asymmetric = {
+  algorithm: "AWS4-ECDSA-P256-SHA256",
+  scope: (date, _region, service) => `${date}/${service}/aws4_request`
+};
 function regionSetOf(request) {
   const regionSet = request.regionSet;
-  if (typeof regionSet !== "string" || regionSet === "") throw new TypeError("SigV4a needs request.regionSet, for example 'us-east-1,us-west-2' or '*'");
+  if (typeof regionSet !== "string" || regionSet === "") {
+    throw new TypeError("SigV4a needs request.regionSet, for example 'us-east-1,us-west-2' or '*'");
+  }
   return regionSet;
 }
-var withRegionSet = (request) => ({ ...request, signHeaders: { ...request.signHeaders, "x-amz-region-set": regionSetOf(request) } });
+var withRegionSet = (request) => ({
+  ...request,
+  signHeaders: { ...request.signHeaders, "x-amz-region-set": regionSetOf(request) }
+});
 var regionSetQuery = (request) => `&X-Amz-Region-Set=${encodeQueryPart(regionSetOf(request))}`;
-var kdfInput = (accessKeyId, counter) => `\0\0\0
AWS4-ECDSA-P256-SHA256\0${accessKeyId}${String.fromCharCode(counter)}\0\0
\0`;
+var kdfInput = (accessKeyId, counter) => `\x00\x00\x00\x01AWS4-ECDSA-P256-SHA256\x00${accessKeyId}${String.fromCharCode(counter)}\x00\x00\x01\x00`;
 function scalarFrom(k) {
   const nMinusTwo = 0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc63254fn;
   let c = 0n;
-  for (let i = 0; i < 32; i++) c = c << 8n | BigInt(k[i]);
-  if (c > nMinusTwo) return void 0;
+  for (let i = 0;i < 32; i++) {
+    c = c << 8n | BigInt(k[i]);
+  }
+  if (c > nMinusTwo) {
+    return;
+  }
   c += 1n;
   const d = new Uint8Array(32);
-  for (let i = 31; i >= 0; i--, c >>= 8n) d[i] = Number(c & 0xffn);
+  for (let i = 31;i >= 0; i--, c >>= 8n) {
+    d[i] = Number(c & 0xffn);
+  }
   return d;
 }
-function deriveP256(hmac2, accessKeyId, secretAccessKey) {
-  for (let counter = 1; counter < 128; counter++) {
-    const d = scalarFrom(hmac2("AWS4A" + secretAccessKey, kdfInput(accessKeyId, counter)));
-    if (d !== void 0) return d;
+function deriveP256(hmac, accessKeyId, secretAccessKey) {
+  for (let counter = 1;counter < 128; counter++) {
+    const d = scalarFrom(hmac("AWS4A" + secretAccessKey, kdfInput(accessKeyId, counter)));
+    if (d !== undefined) {
+      return d;
+    }
   }
   throw new Error("no SigV4a key for these credentials");
 }
-var signers = /* @__PURE__ */ new WeakMap();
-function createAsymmetric(hmac2, ecdsa2) {
-  let sign = signers.get(ecdsa2);
-  if (sign === void 0) signers.set(ecdsa2, sign = signerFor(hmac2, ecdsa2));
+var signers = /* @__PURE__ */ new WeakMap;
+function createAsymmetric(hmac, ecdsa) {
+  let sign = signers.get(ecdsa);
+  if (sign === undefined) {
+    signers.set(ecdsa, sign = signerFor(hmac, ecdsa));
+  }
   return sign;
 }
-function signerFor(hmac2, ecdsa2) {
-  const keys = /* @__PURE__ */ new Map();
+function signerFor(hmac, ecdsa) {
+  const keys = new Map;
   return function sign(credentials, text) {
     const id = `${credentials.accessKeyId}/${credentials.secretAccessKey}`;
     let key = keys.get(id);
-    if (key === void 0) {
-      key = ecdsa2.key(deriveP256(hmac2, credentials.accessKeyId, credentials.secretAccessKey));
-      if (keys.size >= 1e3) keys.delete(keys.keys().next().value);
+    if (key === undefined) {
+      key = ecdsa.key(deriveP256(hmac, credentials.accessKeyId, credentials.secretAccessKey));
+      if (keys.size >= 1000) {
+        keys.delete(keys.keys().next().value);
+      }
       keys.set(id, key);
     }
-    return ecdsa2.sign(key, text);
+    return ecdsa.sign(key, text);
   };
 }
-function createSignerV4a({ hexHash: hexHash2, hmac: hmac2, ecdsa: ecdsa2 }) {
-  const sign = createAsymmetric(hmac2, ecdsa2);
-  return function getAuthHeadersV4a2(request, credentials) {
-    const prepared = prepare(withRegionSet(request), credentials, payloadHashOf(request, hexHash2), asymmetric);
-    return authorize(prepared, credentials.accessKeyId, sign(credentials, stringToSign(prepared, hexHash2(prepared.canonicalRequest))));
+function createSignerV4a({ hexHash, hmac, ecdsa }) {
+  const sign = createAsymmetric(hmac, ecdsa);
+  return function getAuthHeadersV4a(request, credentials) {
+    const prepared = prepare(withRegionSet(request), credentials, payloadHashOf(request, hexHash), asymmetric);
+    return authorize(prepared, credentials.accessKeyId, sign(credentials, stringToSign(prepared, hexHash(prepared.canonicalRequest))));
   };
 }
-function createPresignerV4a({ hexHash: hexHash2, hmac: hmac2, ecdsa: ecdsa2 }) {
-  const sign = createAsymmetric(hmac2, ecdsa2);
-  return function presignV4a2(request, credentials) {
-    const prepared = preparePresign(request, credentials, payloadHashOf(request, hexHash2), asymmetric, regionSetQuery(request));
-    return presignedUrl(prepared, sign(credentials, stringToSign(prepared, hexHash2(prepared.canonicalRequest))));
+function createPresignerV4a({ hexHash, hmac, ecdsa }) {
+  const sign = createAsymmetric(hmac, ecdsa);
+  return function presignV4a(request, credentials) {
+    const prepared = preparePresign(request, credentials, payloadHashOf(request, hexHash), asymmetric, regionSetQuery(request));
+    return presignedUrl(prepared, sign(credentials, stringToSign(prepared, hexHash(prepared.canonicalRequest))));
   };
 }
 
@@ -383,17 +487,27 @@ var ecdsa = {
     const ecdh = crypto.createECDH("prime256v1");
     ecdh.setPrivateKey(d);
     const point = ecdh.getPublicKey();
-    return crypto.createPrivateKey({ key: { kty: "EC", crv: "P-256", d: b64url(d), x: b64url(point.subarray(1, 33)), y: b64url(point.subarray(33)) }, format: "jwk" });
+    return crypto.createPrivateKey({
+      key: {
+        kty: "EC",
+        crv: "P-256",
+        d: b64url(d),
+        x: b64url(point.subarray(1, 33)),
+        y: b64url(point.subarray(33))
+      },
+      format: "jwk"
+    });
   },
   sign: (key, text) => crypto.sign("sha256", text, { key, dsaEncoding: "der" }).toString("hex")
 };
 
 // src/chunks.js
-var utf8 = /* @__PURE__ */ new TextEncoder();
+var utf8 = /* @__PURE__ */ new TextEncoder;
 function seedOf(authHeaders) {
   const auth = authHeaders.authorization;
-  if (typeof auth !== "string" || !auth.startsWith("AWS4-HMAC-SHA256 "))
+  if (typeof auth !== "string" || !auth.startsWith("AWS4-HMAC-SHA256 ")) {
     throw new TypeError("authHeaders must be the headers getAuthHeaders returned (a SigV4a signature cannot start a chunk or event stream)");
+  }
   const scope = auth.slice(auth.indexOf("Credential=") + 11, auth.indexOf(",")).split("/");
   return {
     signature: auth.slice(auth.lastIndexOf("Signature=") + 10),
@@ -416,43 +530,49 @@ ${scope}
 ${previous}
 ${trailerHash}`;
 function canonicalTrailers(trailers) {
-  return Object.keys(trailers).map((name) => [name.toLowerCase(), String(trailers[name]).trim()]).sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0).map(([name, value]) => `${name}:${value}
+  return Object.keys(trailers).map((name) => {
+    const value = String(trailers[name]);
+    if (/[\r\n]/.test(name) || /[\r\n]/.test(value)) {
+      throw new TypeError("a trailer name or value cannot hold a line break");
+    }
+    return [name.toLowerCase(), value.trim()];
+  }).sort((a, b) => a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0).map(([name, value]) => `${name}:${value}
 `).join("");
 }
-function frameChunk(signature, data2) {
-  const head = utf8.encode(`${data2.length.toString(16)};chunk-signature=${signature}\r
+function frameChunk(signature, data) {
+  const head = utf8.encode(`${data.length.toString(16)};chunk-signature=${signature}\r
 `);
-  const out = new Uint8Array(head.length + data2.length + 2);
+  const out = new Uint8Array(head.length + data.length + 2);
   out.set(head);
-  out.set(data2, head.length);
+  out.set(data, head.length);
   out[out.length - 2] = 13;
   out[out.length - 1] = 10;
   return out;
 }
 function frameEnd(signature, trailers, trailerSignature) {
-  return utf8.encode(
-    trailers === void 0 ? `0;chunk-signature=${signature}\r
+  return utf8.encode(trailers === undefined ? `0;chunk-signature=${signature}\r
 \r
 ` : `0;chunk-signature=${signature}\r
-${trailers.replace(/\n/g, "\r\n")}x-amz-trailer-signature:${trailerSignature}\r
+${trailers.replace(/\n/g, `\r
+`)}x-amz-trailer-signature:${trailerSignature}\r
 \r
-`
-  );
+`);
 }
-function createChunkSigner({ hexHash: hexHash2, hmacHex: hmacHex2, getSigningKey: getSigningKey2 }) {
-  return function chunkSigner2(authHeaders, credentials) {
+function createChunkSigner({ hexHash, hmacHex, getSigningKey }) {
+  return function chunkSigner(authHeaders, credentials) {
     const seed = seedOf(authHeaders);
-    const key = getSigningKey2(credentials.secretAccessKey, seed.date, seed.region, seed.service);
+    const key = getSigningKey(credentials.secretAccessKey, seed.date, seed.region, seed.service);
     let previous = seed.signature;
-    const sign = (data2) => previous = hmacHex2(key, chunkStringToSign(seed.datetime, seed.scope, previous, hexHash2(data2)));
+    const sign = (data) => previous = hmacHex(key, chunkStringToSign(seed.datetime, seed.scope, previous, hexHash(data)));
     return {
-      chunk: (data2) => data2.length === 0 ? data2 : frameChunk(sign(data2), data2),
-      // a zero-length chunk would end the upload; it is not sent
+      chunk: (data) => data.length === 0 ? data : frameChunk(sign(data), data),
       end(trailers) {
+        const text = trailers === undefined ? undefined : canonicalTrailers(trailers);
         const signature = sign(new Uint8Array(0));
-        if (trailers === void 0) return frameEnd(signature);
-        const text = canonicalTrailers(trailers);
-        const trailerSignature = hmacHex2(key, trailerStringToSign(seed.datetime, seed.scope, signature, hexHash2(text)));
+        if (text === undefined) {
+          return frameEnd(signature);
+        }
+        const trailerSignature = hmacHex(key, trailerStringToSign(seed.datetime, seed.scope, signature, hexHash(text)));
         return frameEnd(signature, text, trailerSignature);
       }
     };
@@ -462,16 +582,20 @@ function createChunkSigner({ hexHash: hexHash2, hmacHex: hmacHex2, getSigningKey
 // src/events.js
 var crcTable;
 function crc32(bytes, start, end) {
-  if (crcTable === void 0) {
+  if (crcTable === undefined) {
     crcTable = new Int32Array(256);
-    for (let n = 0; n < 256; n++) {
+    for (let n = 0;n < 256; n++) {
       let c = n;
-      for (let k = 0; k < 8; k++) c = c & 1 ? 3988292384 ^ c >>> 1 : c >>> 1;
+      for (let k = 0;k < 8; k++) {
+        c = c & 1 ? 3988292384 ^ c >>> 1 : c >>> 1;
+      }
       crcTable[n] = c;
     }
   }
   let crc = -1;
-  for (let i = start; i < end; i++) crc = crcTable[(crc ^ bytes[i]) & 255] ^ crc >>> 8;
+  for (let i = start;i < end; i++) {
+    crc = crcTable[(crc ^ bytes[i]) & 255] ^ crc >>> 8;
+  }
   return ~crc >>> 0;
 }
 function dateHeader(ms) {
@@ -482,9 +606,9 @@ function dateHeader(ms) {
   new DataView(out.buffer).setBigInt64(7, BigInt(Math.floor(ms)));
   return out;
 }
-function frameEvent(dateBytes, signatureHex, inner2) {
+function frameEvent(dateBytes, signatureHex, inner) {
   const headersLength = dateBytes.length + 52;
-  const out = new Uint8Array(16 + headersLength + inner2.length);
+  const out = new Uint8Array(16 + headersLength + inner.length);
   const view = new DataView(out.buffer);
   view.setUint32(0, out.length);
   view.setUint32(4, headersLength);
@@ -497,9 +621,11 @@ function frameEvent(dateBytes, signatureHex, inner2) {
   out[at++] = 6;
   view.setUint16(at, 32);
   at += 2;
-  for (let i = 0; i < 32; i++) out[at + i] = parseInt(signatureHex.slice(2 * i, 2 * i + 2), 16);
+  for (let i = 0;i < 32; i++) {
+    out[at + i] = parseInt(signatureHex.slice(2 * i, 2 * i + 2), 16);
+  }
   at += 32;
-  out.set(inner2, at);
+  out.set(inner, at);
   view.setUint32(out.length - 4, crc32(out, 0, out.length - 4));
   return out;
 }
@@ -511,20 +637,21 @@ ${headersHash}
 ${payloadHash}`;
 var eventScope = (ms, region, service) => {
   const datetime = amzDatetime(ms);
-  return { datetime, scope: `${datetime.slice(0, 8)}/${region}/${service}/aws4_request`, date: datetime.slice(0, 8) };
+  return {
+    datetime,
+    scope: `${datetime.slice(0, 8)}/${region}/${service}/aws4_request`,
+    date: datetime.slice(0, 8)
+  };
 };
-function createEventSigner({ hexHash: hexHash2, hmacHex: hmacHex2, getSigningKey: getSigningKey2 }) {
-  return function eventSigner2(authHeaders, credentials) {
+function createEventSigner({ hexHash, hmacHex, getSigningKey }) {
+  return function eventSigner(authHeaders, credentials) {
     const seed = seedOf(authHeaders);
     let previous = seed.signature;
     return {
       sign(message, now = Date.now()) {
         const { datetime, scope, date } = eventScope(now, seed.region, seed.service);
         const header = dateHeader(now);
-        previous = hmacHex2(
-          getSigningKey2(credentials.secretAccessKey, date, seed.region, seed.service),
-          eventStringToSign(datetime, scope, previous, hexHash2(header), hexHash2(message))
-        );
+        previous = hmacHex(getSigningKey(credentials.secretAccessKey, date, seed.region, seed.service), eventStringToSign(datetime, scope, previous, hexHash(header), hexHash(message)));
         return frameEvent(header, previous, message);
       }
     };
@@ -532,7 +659,7 @@ function createEventSigner({ hexHash: hexHash2, hmacHex: hmacHex2, getSigningKey
 }
 
 // src/node.js
-var utf82 = /* @__PURE__ */ new TextEncoder();
+var utf82 = /* @__PURE__ */ new TextEncoder;
 var maxData = 1024;
 var inner = /* @__PURE__ */ new Uint8Array(64 + maxData);
 var outer = /* @__PURE__ */ new Uint8Array(64 + 32);
@@ -545,14 +672,16 @@ function hmacHexOneShot(key, text) {
     blockKey = key;
     inner.fill(54, 0, 64);
     outer.fill(92, 0, 64);
-    for (let i = 0; i < key.length; i++) {
-      inner[i] ^= key[i];
-      outer[i] ^= key[i];
+    for (let i = 0;i < key.length; i++) {
+      inner[i] = inner[i] ^ key[i];
+      outer[i] = outer[i] ^ key[i];
     }
   }
   const end = 64 + utf82.encodeInto(text, data).written;
   const hex = crypto2.hash("sha256", innerViews[end] ??= inner.subarray(0, end), "hex");
-  for (let i = 0; i < 32; i++) outer[64 + i] = nibble(hex.charCodeAt(2 * i)) << 4 | nibble(hex.charCodeAt(2 * i + 1));
+  for (let i = 0;i < 32; i++) {
+    outer[64 + i] = nibble(hex.charCodeAt(2 * i)) << 4 | nibble(hex.charCodeAt(2 * i + 1));
+  }
   return crypto2.hash("sha256", outer, "hex");
 }
 var hmacHexStreaming = (key, text) => crypto2.createHmac("sha256", key).update(text).digest("hex");
@@ -560,9 +689,10 @@ var hmac = (key, text) => crypto2.createHmac("sha256", key).update(text).digest(
 var oneShotWorks;
 function probe() {
   const key = hmac("probe", "key");
-  const text = "AWS4-HMAC-SHA256\n20130524T000000Z";
+  const text = `AWS4-HMAC-SHA256
+20130524T000000Z`;
   const works = hmacHexOneShot(key, text) === hmacHexStreaming(key, text);
-  blockKey = void 0;
+  blockKey = undefined;
   return works;
 }
 var hmacHex = (key, text) => (oneShotWorks ??= probe()) && text.length * 3 <= maxData && key.length <= 64 ? hmacHexOneShot(key, text) : hmacHexStreaming(key, text);