sigflint 1.0.1 → 1.0.3

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## Unreleased
+
+## 1.0.3 - 2026-10-29
+
+- Document installing with Bun (`bun add sigflint`) and running a script with `bun run`, alongside npm. Documentation only; no code or benchmark change.
+
+## 1.0.2 - 2026-10-29
+
+- Node and Bun load unminified files bundled with Bun instead of esbuild. The files are 24,690 and 23,518 bytes, compared with 24,374 and 23,200 bytes in the published 1.0.1 package. Builds, checks and publishing use Bun 1.4.4.
+- Speed, memory, import and size measurements were repeated on the shipped build with Node 26.12.1 and Bun 1.4.4. The five-round comparison against published 1.0.1 found no clear S3 signing-speed change. Charts and tables in `docs/benchmarks.md` show the new figures and limits. Header signing alone is 5,677 bytes minified and 2,769 bytes gzipped for the Node entry.
+- Formatting, lint and strict type checks now cover the library, tests, conformance generators and benchmark tools. Bun formats and checks types; TypeScript emits declarations. Public signing APIs and types are unchanged. Generated declarations for internal helpers now have parameter types instead of `any`.
+
 ## 1.0.1 - 2026-10-18
 
 - A lowercase `method` (`get`) is signed as upper case (`GET`), as botocore does. `fetch` sends `get`, `put`, `post`, `delete`, `head` and `options` in upper case, so before this the signature did not match and the service answered `SignatureDoesNotMatch`. Node's `fetch` sends `patch` as written, so pass `PATCH` in upper case to both sigflint and `fetch`.

package/README.md

@@ -21,6 +21,8 @@
 
 Fast AWS Signature Version 4 request signing for every AWS service, with no dependencies. It runs on Node.js, Bun, Deno, Cloudflare Workers and browsers.
 
+Signs an S3 GET in 0.97 µs on Node, 5.3 times as fast as `aws4`, with the same signatures as botocore on 6,582 test requests.
+
 ```js
 import { getAuthHeaders } from 'sigflint';
 
@@ -35,17 +37,34 @@ const response = await fetch(url, { headers });
 It signs requests with the `Authorization` header or as a presigned URL, for S3 and for any other service (`service: 'dynamodb'`, `'sqs'`, `'execute-api'`, ...), and it also does multi-region signatures (SigV4a), chunked uploads and event streams.
 
 - **Correct.** It returns the same signature as botocore for all 3,360 S3 requests in its test corpus, and for 1,622 requests to other services and 1,600 presigned URLs. For S3, botocore signs the request after this repository's own path and query normalization (`conformance/oracle.py`), so that step is not checked independently by the corpus; the four S3 examples published by AWS, which are in it, are. SigV4a signatures verify against the AWS CRT's, and every chunk and event signature in the test corpus matches the AWS SDK's. See [how it is tested](docs/benchmarks.md#how-it-is-tested).
-- **Fast.** 1.3 to 3.6 µs per header or presigned-URL signature on Node and 1.4 to 5.0 µs on Bun. The other libraries take 2.6 to 552 times as long on the requests they sign correctly (five Bun presigned-URL comparisons, with `aws4`, `@smithy/signature-v4` and `minio`, are not clear and are left out). See [speed](docs/benchmarks.md#speed).
+- **Fast.** 1.0 to 3.2 µs per header or presigned-URL signature on Node and 0.7 to 3.0 µs on Bun. The other libraries take 2.0 to 75 times as long on the requests they sign correctly. Measured on Node 26.12.1 and Bun 1.4.4; see [speed](docs/benchmarks.md#speed).
 - **Small, and you pay only for what you import.** Signing headers is 5.7 kB minified, 2.8 kB gzipped; presigned URLs, SigV4a, chunked uploads and event streams each add to a bundle only when imported. Nothing to install with it. See [size](docs/benchmarks.md#size).
 - **Everywhere.** One import on Node, Bun, Deno and Cloudflare Workers, with or without `nodejs_compat`. See [runtimes](#runtimes).
 
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="docs/speed-dark.svg">
+  <img alt="Bar chart: time in microseconds to sign one S3 request on Node.js and Bun, for sigflint and six other libraries" src="docs/speed-light.svg">
+</picture>
+
+Microseconds per signature; lower is better. On Node 26.12.1, signing a plain S3 GET takes 0.97 µs with sigflint and 5.11 µs with `aws4`, the fastest of the other libraries.
+
 ## Install
 
+With npm:
+
 ```sh
 npm install sigflint
 ```
 
-Node.js 22.12 or newer (it is an ES module; Node 22.12 can also `require()` it). Bun and Deno need no setup.
+With Bun:
+
+```sh
+bun add sigflint
+```
+
+Bun loads its own build directly; run your script with `bun run <file>`.
+
+Node.js 22.12 or newer (it is an ES module; Node 22.12 can also `require()` it). Bun and Deno need no build step.
 
 ## Usage
 
@@ -82,11 +101,6 @@ Node.js 22.12 and later, Bun, Deno, and Cloudflare Workers with or without `node
 
 ## Benchmarks
 
-<picture>
-  <source media="(prefers-color-scheme: dark)" srcset="docs/speed-dark.svg">
-  <img alt="Bar chart: time in microseconds to sign one S3 request on Node.js and Bun, for sigflint and six other libraries" src="docs/speed-light.svg">
-</picture>
-
 Correctness, [speed](docs/benchmarks.md#speed), [memory](docs/benchmarks.md#memory) and [size](docs/benchmarks.md#size), the [test corpora](docs/benchmarks.md#how-it-is-tested) and the [methodology and limits](docs/benchmarks.md#methodology-and-limits) are in [docs/benchmarks.md](docs/benchmarks.md). Every figure there comes from raw results committed in `bench/results/`. The speed, memory and import figures were measured on the code in this release and are re-run before each release.
 
 ## Scope