sigflint 1.0.1 → 1.0.3

package/src/web.js

@@ -3,41 +3,91 @@
 import { payloadHashOf, prepare, stringToSign, authorize } from './base.js';
 import { preparePresign, presignedUrl } from './presign.js';
 import { asymmetric, withRegionSet, regionSetQuery, kdfInput, scalarFrom } from './v4a.js';
-import { seedOf, chunkStringToSign, trailerStringToSign, canonicalTrailers, frameChunk, frameEnd } from './chunks.js';
+import {
+  seedOf,
+  chunkStringToSign,
+  trailerStringToSign,
+  canonicalTrailers,
+  frameChunk,
+  frameEnd,
+} from './chunks.js';
 import { dateHeader, frameEvent, eventStringToSign, eventScope } from './events.js';
 
 const subtle = /* @__PURE__ */ (() => globalThis.crypto.subtle)();
 const utf8 = /* @__PURE__ */ new TextEncoder();
 
-const hexOfByte = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, '0'));
+const hexOfByte = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) =>
+  i.toString(16).padStart(2, '0'),
+);
+/** @param {ArrayBuffer | Uint8Array} buffer */
 function toHex(buffer) {
   const bytes = new Uint8Array(buffer);
   let out = '';
-  for (let i = 0; i < bytes.length; i++) out += hexOfByte[bytes[i]];
+  for (let i = 0; i < bytes.length; i++) {
+    out += hexOfByte[/** @type {number} */ (bytes[i])];
+  }
   return out;
 }
 
-const hexHash = async (data) => toHex(await subtle.digest('SHA-256', typeof data === 'string' ? utf8.encode(data) : data));
-const importKey = (raw) => subtle.importKey('raw', raw, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+/** @param {string | Uint8Array} data */
+const hexHash = async (data) =>
+  toHex(
+    await subtle.digest(
+      'SHA-256',
+      typeof data === 'string' ? utf8.encode(data) : /** @type {Uint8Array<ArrayBuffer>} */ (data),
+    ),
+  );
+/** @param {Uint8Array<ArrayBuffer> | ArrayBuffer} raw */
+const importKey = (raw) =>
+  subtle.importKey('raw', raw, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
 // the next key in the derivation chain: the HMAC of data, as a key
+/**
+ * @param {CryptoKey} key
+ * @param {string} data
+ */
 const deriveKey = async (key, data) => importKey(await subtle.sign('HMAC', key, utf8.encode(data)));
 
+/** @type {Map<string, CryptoKey>} */
 const signingKeys = new Map();
 const maxSigningKeys = 1000;
+/** @type {string | undefined} */
 let lastSecret;
+/** @type {string | undefined} */
 let lastDate;
+/** @type {string | undefined} */
 let lastRegion;
+/** @type {string | undefined} */
 let lastService;
+/** @type {CryptoKey | undefined} */
 let lastKey;
 
+/**
+ * @param {string} secretAccessKey
+ * @param {string} date
+ * @param {string} region
+ * @param {string} service
+ * @returns {Promise<CryptoKey>}
+ */
 async function getSigningKey(secretAccessKey, date, region, service) {
-  if (secretAccessKey === lastSecret && date === lastDate && region === lastRegion && service === lastService) return lastKey;
+  if (
+    secretAccessKey === lastSecret &&
+    date === lastDate &&
+    region === lastRegion &&
+    service === lastService
+  ) {
+    return /** @type {CryptoKey} */ (lastKey);
+  }
   const cacheKey = `${date}\n${region}\n${service}\n${secretAccessKey}`;
   let signingKey = signingKeys.get(cacheKey);
   if (signingKey === undefined) {
     const dateKey = await deriveKey(await importKey(utf8.encode('AWS4' + secretAccessKey)), date);
-    signingKey = await deriveKey(await deriveKey(await deriveKey(dateKey, region), service), 'aws4_request');
-    if (signingKeys.size >= maxSigningKeys) signingKeys.delete(signingKeys.keys().next().value);
+    signingKey = await deriveKey(
+      await deriveKey(await deriveKey(dateKey, region), service),
+      'aws4_request',
+    );
+    if (signingKeys.size >= maxSigningKeys) {
+      signingKeys.delete(/** @type {string} */ (signingKeys.keys().next().value));
+    }
     signingKeys.set(cacheKey, signingKey);
   }
   lastSecret = secretAccessKey;
@@ -48,44 +98,88 @@ async function getSigningKey(secretAccessKey, date, region, service) {
   return signingKey;
 }
 
+/**
+ * @param {import('./base.js').Credentials} credentials
+ * @param {{ date: string, region: string, service: string }} prepared
+ * @param {string} text
+ */
 const signSymmetric = async (credentials, prepared, text) =>
-  toHex(await subtle.sign('HMAC', await getSigningKey(credentials.secretAccessKey, prepared.date, prepared.region, prepared.service), utf8.encode(text)));
+  toHex(
+    await subtle.sign(
+      'HMAC',
+      await getSigningKey(
+        credentials.secretAccessKey,
+        prepared.date,
+        prepared.region,
+        prepared.service,
+      ),
+      utf8.encode(text),
+    ),
+  );
 
 // SigV4a: the derived scalar goes in as a PKCS#8 private key without the public point, which WebCrypto computes itself
 const pkcs8 = /* @__PURE__ */ Uint8Array.from([
-  0x30, 0x41, 0x02, 0x01, 0x00, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x04, 0x27, 0x30,
-  0x25, 0x02, 0x01, 0x01, 0x04, 0x20,
+  0x30, 0x41, 0x02, 0x01, 0x00, 0x30, 0x13, 0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01,
+  0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07, 0x04, 0x27, 0x30, 0x25, 0x02, 0x01,
+  0x01, 0x04, 0x20,
 ]);
+/** @type {Map<string, CryptoKey>} */
 const asymmetricKeys = new Map();
+/** @param {import('./base.js').Credentials} credentials */
 async function getAsymmetricKey({ accessKeyId, secretAccessKey }) {
   const id = `${accessKeyId}/${secretAccessKey}`;
   let key = asymmetricKeys.get(id);
   if (key === undefined) {
     const root = await importKey(utf8.encode('AWS4A' + secretAccessKey));
     for (let counter = 1; key === undefined; counter++) {
-      if (counter > 127) throw new Error('no SigV4a key for these credentials');
-      const d = scalarFrom(new Uint8Array(await subtle.sign('HMAC', root, utf8.encode(kdfInput(accessKeyId, counter)))));
+      if (counter > 127) {
+        throw new Error('no SigV4a key for these credentials');
+      }
+      const d = scalarFrom(
+        new Uint8Array(
+          await subtle.sign('HMAC', root, utf8.encode(kdfInput(accessKeyId, counter))),
+        ),
+      );
       if (d !== undefined) {
         const der = new Uint8Array(pkcs8.length + 32);
         der.set(pkcs8);
         der.set(d, pkcs8.length);
-        key = await subtle.importKey('pkcs8', der, { name: 'ECDSA', namedCurve: 'P-256' }, false, ['sign']);
+        key = await subtle.importKey('pkcs8', der, { name: 'ECDSA', namedCurve: 'P-256' }, false, [
+          'sign',
+        ]);
       }
     }
-    if (asymmetricKeys.size >= 1000) asymmetricKeys.delete(asymmetricKeys.keys().next().value);
+    if (asymmetricKeys.size >= 1000) {
+      asymmetricKeys.delete(/** @type {string} */ (asymmetricKeys.keys().next().value));
+    }
     asymmetricKeys.set(id, key);
   }
   return key;
 }
 // r and s as DER integers: leading zeros dropped, a zero byte in front when the top bit is set
+/** @param {Uint8Array} bytes */
 function derInteger(bytes) {
   let start = 0;
-  while (start < bytes.length - 1 && bytes[start] === 0) start++;
+  while (start < bytes.length - 1 && bytes[start] === 0) {
+    start++;
+  }
   const body = bytes.subarray(start);
-  return body[0] & 0x80 ? [0x02, body.length + 1, 0, ...body] : [0x02, body.length, ...body];
+  return /** @type {number} */ (body[0]) & 0x80
+    ? [0x02, body.length + 1, 0, ...body]
+    : [0x02, body.length, ...body];
 }
+/**
+ * @param {import('./base.js').Credentials} credentials
+ * @param {string} text
+ */
 async function signAsymmetric(credentials, text) {
-  const raw = new Uint8Array(await subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, await getAsymmetricKey(credentials), utf8.encode(text)));
+  const raw = new Uint8Array(
+    await subtle.sign(
+      { name: 'ECDSA', hash: 'SHA-256' },
+      await getAsymmetricKey(credentials),
+      utf8.encode(text),
+    ),
+  );
   const body = [...derInteger(raw.subarray(0, 32)), ...derInteger(raw.subarray(32))];
   return toHex(Uint8Array.from([0x30, body.length, ...body]));
 }
@@ -98,7 +192,15 @@ async function signAsymmetric(credentials, text) {
  */
 export async function getAuthHeaders(request, credentials) {
   const prepared = prepare(request, credentials, await payloadHashOf(request, hexHash));
-  return authorize(prepared, credentials.accessKeyId, await signSymmetric(credentials, prepared, stringToSign(prepared, await hexHash(prepared.canonicalRequest))));
+  return authorize(
+    prepared,
+    credentials.accessKeyId,
+    await signSymmetric(
+      credentials,
+      prepared,
+      stringToSign(prepared, await hexHash(prepared.canonicalRequest)),
+    ),
+  );
 }
 
 /**
@@ -108,8 +210,20 @@ export async function getAuthHeaders(request, credentials) {
  * @returns {Promise<import('./base.js').AuthHeaders>}
  */
 export async function getAuthHeadersV4a(request, credentials) {
-  const prepared = prepare(withRegionSet(request), credentials, await payloadHashOf(request, hexHash), asymmetric);
-  return authorize(prepared, credentials.accessKeyId, await signAsymmetric(credentials, stringToSign(prepared, await hexHash(prepared.canonicalRequest))));
+  const prepared = prepare(
+    withRegionSet(request),
+    credentials,
+    await payloadHashOf(request, hexHash),
+    asymmetric,
+  );
+  return authorize(
+    prepared,
+    credentials.accessKeyId,
+    await signAsymmetric(
+      credentials,
+      stringToSign(prepared, await hexHash(prepared.canonicalRequest)),
+    ),
+  );
 }
 
 /**
@@ -120,7 +234,14 @@ export async function getAuthHeadersV4a(request, credentials) {
  */
 export async function presign(request, credentials) {
   const prepared = preparePresign(request, credentials, await payloadHashOf(request, hexHash));
-  return presignedUrl(prepared, await signSymmetric(credentials, prepared, stringToSign(prepared, await hexHash(prepared.canonicalRequest))));
+  return presignedUrl(
+    prepared,
+    await signSymmetric(
+      credentials,
+      prepared,
+      stringToSign(prepared, await hexHash(prepared.canonicalRequest)),
+    ),
+  );
 }
 
 /**
@@ -130,10 +251,26 @@ export async function presign(request, credentials) {
  * @returns {Promise<string>}
  */
 export async function presignV4a(request, credentials) {
-  const prepared = preparePresign(request, credentials, await payloadHashOf(request, hexHash), asymmetric, regionSetQuery(request));
-  return presignedUrl(prepared, await signAsymmetric(credentials, stringToSign(prepared, await hexHash(prepared.canonicalRequest))));
+  const prepared = preparePresign(
+    request,
+    credentials,
+    await payloadHashOf(request, hexHash),
+    asymmetric,
+    regionSetQuery(request),
+  );
+  return presignedUrl(
+    prepared,
+    await signAsymmetric(
+      credentials,
+      stringToSign(prepared, await hexHash(prepared.canonicalRequest)),
+    ),
+  );
 }
 
+/**
+ * @param {CryptoKey} key
+ * @param {string} text
+ */
 const signWith = async (key, text) => toHex(await subtle.sign('HMAC', key, utf8.encode(text)));
 
 /**
@@ -145,18 +282,40 @@ const signWith = async (key, text) => toHex(await subtle.sign('HMAC', key, utf8.
 export function chunkSigner(authHeaders, credentials) {
   const seed = seedOf(authHeaders);
   let previous = seed.signature;
-  const keyPromise = getSigningKey(credentials.secretAccessKey, seed.date, seed.region, seed.service);
+  const keyPromise = getSigningKey(
+    credentials.secretAccessKey,
+    seed.date,
+    seed.region,
+    seed.service,
+  );
   // chunks are signed one after the other: a call waits for the one before it
   /** @type {Promise<any>} */
   let turn = Promise.resolve();
-  const sign = (data) => (turn = turn.then(async () => (previous = await signWith(await keyPromise, chunkStringToSign(seed.datetime, seed.scope, previous, await hexHash(data))))));
+  /** @param {Uint8Array} data */
+  const sign = (data) =>
+    (turn = turn.then(
+      async () =>
+        (previous = await signWith(
+          await keyPromise,
+          chunkStringToSign(seed.datetime, seed.scope, previous, await hexHash(data)),
+        )),
+    ));
   return {
     chunk: async (data) => (data.length === 0 ? data : frameChunk(await sign(data), data)),
     async end(trailers) {
       const text = trailers === undefined ? undefined : canonicalTrailers(trailers); // before sign(), so a refused trailer leaves the chain where it was
       const signature = await sign(new Uint8Array(0));
-      if (text === undefined) return frameEnd(signature);
-      return frameEnd(signature, text, await signWith(await keyPromise, trailerStringToSign(seed.datetime, seed.scope, signature, await hexHash(text))));
+      if (text === undefined) {
+        return frameEnd(signature);
+      }
+      return frameEnd(
+        signature,
+        text,
+        await signWith(
+          await keyPromise,
+          trailerStringToSign(seed.datetime, seed.scope, signature, await hexHash(text)),
+        ),
+      );
     },
   };
 }
@@ -179,7 +338,13 @@ export function eventSigner(authHeaders, credentials) {
         const header = dateHeader(now);
         previous = await signWith(
           await getSigningKey(credentials.secretAccessKey, date, seed.region, seed.service),
-          eventStringToSign(datetime, scope, previous, await hexHash(header), await hexHash(message)),
+          eventStringToSign(
+            datetime,
+            scope,
+            previous,
+            await hexHash(header),
+            await hexHash(message),
+          ),
         );
         return frameEvent(header, previous, message);
       })),

package/types/base.d.ts

@@ -1,23 +1,48 @@
 export declare const emptyBodyHash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
-/** The scheme of a signature: its algorithm name and how the credential scope is written. SigV4a (v4a.js) has its own. */
-export declare const symmetric: {
+export type Scheme = {
     algorithm: string;
-    scope: (date: any, region: any, service: any) => string;
+    scope: (date: string, region: string, service: string) => string;
 };
-/** The canonical path for a service. */
-export declare const canonicalPath: (service: any, pathname: any) => any;
-/** search is url.search, which is '' or starts with '?' */
-export declare function canonicalQuery(search: any): string;
-/** inserts into the name-ordered lists, replacing an entry with the same name */
-export declare function insert(names: any, values: any, name: any, value: any): void;
+/**
+ * @typedef {Object} Scheme
+ * @property {string} algorithm
+ * @property {(date: string, region: string, service: string) => string} scope
+ */
+/**
+ * The scheme of a signature: its algorithm name and how the credential scope is written. SigV4a (v4a.js) has its own.
+ * @type {Scheme}
+ */
+export declare const symmetric: Scheme;
+/**
+ * The canonical path for a service.
+ * @param {string} service
+ * @param {string} pathname
+ */
+export declare const canonicalPath: (service: string, pathname: string) => string;
+/** @param {string} search - url.search, which is '' or starts with '?' */
+export declare function canonicalQuery(search: string): string;
+/**
+ * Inserts into the name-ordered lists, replacing an entry with the same name.
+ * @param {string[]} names
+ * @param {string[]} values
+ * @param {string} name
+ * @param {string} value
+ */
+export declare function insert(names: string[], values: string[], name: string, value: string): void;
 /**
  * Refuses a signHeaders entry that cannot be signed as given: x-amz-date and authorization are set by the signer, `__proto__` cannot be a property of the
  * returned headers, and a line break in a value would start another canonical header line. Returns the lowercase name.
+ * @param {string} name
+ * @param {string} value
+ */
+export declare function signHeaderName(name: string, value: string): string;
+/**
+ * A header value as it is signed: trimmed, runs of spaces and tabs collapsed.
+ * @param {unknown} value
  */
-export declare function signHeaderName(name: any, value: any): any;
-/** A header value as it is signed: trimmed, runs of spaces and tabs collapsed. */
-export declare const headerValue: (value: any) => string;
-export declare function amzDatetime(now: any): string;
+export declare const headerValue: (value: unknown) => string;
+/** @param {number} now - milliseconds since the epoch */
+export declare function amzDatetime(now: number): string;
 export type SignRequest = {
     /**
      * - GET, HEAD, PUT, POST, DELETE; any case, signed in upper case (as botocore does)
@@ -111,33 +136,55 @@ export type Primitives = {
  * @property {(key: Uint8Array, data: string) => string} hmacHex - HMAC-SHA-256 as lowercase hex
  * @property {ReturnType<typeof createKeys>} getSigningKey - the entry's one signing-key cache, shared by every symmetric signer
  */
-/** The payload hash for x-amz-content-sha256. The hash function may return a promise, which is then the result. */
-export declare function payloadHashOf(request: any, hexHash: any): any;
-/** Everything up to the hashing: the headers to return, the canonical request and the credential scope. */
-export declare function prepare(request: any, credentials: any, payloadHash: any, scheme?: {
-    algorithm: string;
-    scope: (date: any, region: any, service: any) => string;
-}): {
-    headers: {
-        'x-amz-date': string;
-        'x-amz-content-sha256': any;
-    } | {
-        'x-amz-content-sha256'?: undefined;
-        'x-amz-date': string;
-    };
+/**
+ * The payload hash for x-amz-content-sha256. The hash function may return a promise, which is then the result.
+ * @template {string | Promise<string>} H
+ * @param {SignRequest} request
+ * @param {(data: string) => H} hexHash
+ * @returns {string | H}
+ */
+export declare function payloadHashOf<H extends string | Promise<string>>(request: SignRequest, hexHash: (data: string) => H): string | H;
+/**
+ * Everything up to the hashing: the headers to return, the canonical request and the credential scope.
+ * @param {SignRequest} request
+ * @param {Credentials} credentials
+ * @param {string} payloadHash
+ * @param {Scheme} [scheme]
+ */
+export declare function prepare(request: SignRequest, credentials: Credentials, payloadHash: string, scheme?: Scheme): {
+    headers: AuthHeaders;
     canonicalRequest: string;
     datetime: string;
     date: string;
-    region: any;
-    service: any;
+    region: string;
+    service: string;
     credentialScope: string;
     signedHeaders: any;
     algorithm: string;
 };
-export declare const stringToSign: (prepared: any, canonicalRequestHash: any) => string;
-/** Adds the authorization header to the headers to return. */
-export declare function authorize(prepared: any, accessKeyId: any, signature: any): any;
-export declare function createKeys(hmac: any): (secretAccessKey: any, date: any, region: any, service: any) => any;
+export type StringToSignParts = {
+    algorithm: string;
+    datetime: string;
+    credentialScope: string;
+};
+/** @typedef {{ algorithm: string, datetime: string, credentialScope: string }} StringToSignParts */
+/**
+ * @param {StringToSignParts} prepared
+ * @param {string} canonicalRequestHash
+ */
+export declare const stringToSign: (prepared: StringToSignParts, canonicalRequestHash: string) => string;
+/**
+ * Adds the authorization header to the headers to return.
+ * @param {ReturnType<typeof prepare>} prepared
+ * @param {string} accessKeyId
+ * @param {string} signature
+ */
+export declare function authorize(prepared: ReturnType<typeof prepare>, accessKeyId: string, signature: string): AuthHeaders;
+/**
+ * @param {(key: string | Uint8Array, data: string) => Uint8Array} hmac
+ * @returns {(secretAccessKey: string, date: string, region: string, service: string) => Uint8Array}
+ */
+export declare function createKeys(hmac: (key: string | Uint8Array, data: string) => Uint8Array): (secretAccessKey: string, date: string, region: string, service: string) => Uint8Array;
 /**
  * @param {Primitives} primitives
  * @returns {(request: SignRequest, credentials: Credentials) => AuthHeaders}

package/types/chunks.d.ts

@@ -1,21 +1,47 @@
 export declare const utf8: TextEncoder;
-/** The seed signature, timestamp and scope of a signed request, from the headers getAuthHeaders returned. */
-export declare function seedOf(authHeaders: any): {
+/**
+ * The seed signature, timestamp and scope of a signed request, from the headers getAuthHeaders returned.
+ * @param {import('./base.js').AuthHeaders} authHeaders
+ */
+export declare function seedOf(authHeaders: import('./base.js').AuthHeaders): {
     signature: string;
-    datetime: any;
+    datetime: string;
     date: string;
     region: string;
     service: string;
     scope: string;
 };
-export declare const chunkStringToSign: (datetime: any, scope: any, previous: any, payloadHash: any) => string;
-export declare const trailerStringToSign: (datetime: any, scope: any, previous: any, trailerHash: any) => string;
-/** Trailing headers in canonical form: lowercase names in name order, each line ending in a newline. A line break in a name or value would start another trailer line, so it throws. */
-export declare function canonicalTrailers(trailers: any): string;
-/** The bytes of one chunk on the wire: size in hex, signature, the data. */
-export declare function frameChunk(signature: any, data: any): Uint8Array<any>;
-/** The last chunk (no data), with the signed trailing headers when there are any. */
-export declare function frameEnd(signature: any, trailers: any, trailerSignature: any): Uint8Array<ArrayBuffer>;
+/**
+ * @param {string} datetime
+ * @param {string} scope
+ * @param {string} previous
+ * @param {string} payloadHash
+ */
+export declare const chunkStringToSign: (datetime: string, scope: string, previous: string, payloadHash: string) => string;
+/**
+ * @param {string} datetime
+ * @param {string} scope
+ * @param {string} previous
+ * @param {string} trailerHash
+ */
+export declare const trailerStringToSign: (datetime: string, scope: string, previous: string, trailerHash: string) => string;
+/** Trailing headers in canonical form: lowercase names in name order, each line ending in a newline. A line break in a name or value would start another trailer line, so it throws.
+ * @param {Record<string, string>} trailers
+ */
+export declare function canonicalTrailers(trailers: Record<string, string>): string;
+/**
+ * The bytes of one chunk on the wire: size in hex, signature, the data.
+ * @param {string} signature
+ * @param {Uint8Array} data
+ */
+export declare function frameChunk(signature: string, data: Uint8Array): Uint8Array<ArrayBuffer>;
+/**
+ * The last chunk (no data), with the signed trailing headers when there are any.
+ * @param {string} signature
+ * @param {string} [trailers] - canonical trailing headers
+ * @param {string} [trailerSignature]
+ */
+export declare function frameEnd(signature: string, trailers?: string, trailerSignature?: string): Uint8Array<ArrayBuffer>;
 export type ChunkSigner = {
     /**
      * - the bytes to send for one chunk of the body

package/types/ecdsa-node.d.ts

@@ -1,5 +1,10 @@
 import crypto from 'node:crypto';
 export declare const ecdsa: {
-    key(d: any): crypto.KeyObject;
-    sign: (key: any, text: any) => string;
+    /** @param {Uint8Array} d */
+    key(d: Uint8Array): crypto.KeyObject;
+    /**
+     * @param {crypto.KeyObject} key
+     * @param {string} text
+     */
+    sign: (key: crypto.KeyObject, text: string) => string;
 };

package/types/events.d.ts

@@ -1,9 +1,29 @@
-/** The :date header of an event: name, type 8 (timestamp), milliseconds since the epoch as 8 bytes. */
-export declare function dateHeader(ms: any): Uint8Array<ArrayBuffer>;
-/** The signed event: prelude, the :date and :chunk-signature headers, the inner message as payload, checksums. */
-export declare function frameEvent(dateBytes: any, signatureHex: any, inner: any): Uint8Array<any>;
-export declare const eventStringToSign: (datetime: any, scope: any, previous: any, headersHash: any, payloadHash: any) => string;
-export declare const eventScope: (ms: any, region: any, service: any) => {
+/**
+ * The :date header of an event: name, type 8 (timestamp), milliseconds since the epoch as 8 bytes.
+ * @param {number} ms
+ */
+export declare function dateHeader(ms: number): Uint8Array<ArrayBuffer>;
+/**
+ * The signed event: prelude, the :date and :chunk-signature headers, the inner message as payload, checksums.
+ * @param {Uint8Array} dateBytes
+ * @param {string} signatureHex
+ * @param {Uint8Array} inner
+ */
+export declare function frameEvent(dateBytes: Uint8Array, signatureHex: string, inner: Uint8Array): Uint8Array<ArrayBuffer>;
+/**
+ * @param {string} datetime
+ * @param {string} scope
+ * @param {string} previous
+ * @param {string} headersHash
+ * @param {string} payloadHash
+ */
+export declare const eventStringToSign: (datetime: string, scope: string, previous: string, headersHash: string, payloadHash: string) => string;
+/**
+ * @param {number} ms
+ * @param {string} region
+ * @param {string} service
+ */
+export declare const eventScope: (ms: number, region: string, service: string) => {
     datetime: string;
     scope: string;
     date: string;

package/types/presign.d.ts

@@ -1,25 +1,35 @@
-export declare const encodeQueryPart: (text: any) => string;
+/** @param {string} text */
+export declare const encodeQueryPart: (text: string) => string;
 /**
  * Everything up to the hashing for a presigned URL. `request.expires` is the lifetime in seconds (default 3600). Only the host and request.signHeaders are
  * signed; S3 URLs are always UNSIGNED-PAYLOAD, other services sign the body hash. `extra` is appended to the authentication parameters.
+ * @param {import('./base.js').SignRequest} request
+ * @param {import('./base.js').Credentials} credentials
+ * @param {string} payloadHash
+ * @param {import('./base.js').Scheme} [scheme]
+ * @param {string} [extra]
  */
-export declare function preparePresign(request: any, credentials: any, payloadHash: any, scheme?: {
-    algorithm: string;
-    scope: (date: any, region: any, service: any) => string;
-}, extra?: string): {
+export declare function preparePresign(request: import('./base.js').SignRequest, credentials: import('./base.js').Credentials, payloadHash: string, scheme?: import('./base.js').Scheme, extra?: string): {
     canonicalRequest: string;
     datetime: string;
     date: string;
-    region: any;
-    service: any;
+    region: string;
+    service: string;
     credentialScope: string;
     signedHeaders: string;
     algorithm: string;
-    base: any;
+    base: string;
     query: string;
 };
-/** The URL to hand out: the original URL with the authentication query parameters and the signature appended. */
-export declare const presignedUrl: (prepared: any, signature: any) => string;
+/**
+ * The URL to hand out: the original URL with the authentication query parameters and the signature appended.
+ * @param {{ base: string, query: string }} prepared
+ * @param {string} signature
+ */
+export declare const presignedUrl: (prepared: {
+    base: string;
+    query: string;
+}, signature: string) => string;
 /**
  * @param {import('./base.js').Primitives} primitives
  * @returns {(request: import('./base.js').SignRequest, credentials: import('./base.js').Credentials) => string}