sigv4-lite 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ProfessionalFlare
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,88 @@
+# sigv4-lite
+
+AWS SigV4 signing for runtimes without Node's `crypto` module — Cloudflare Workers, Deno, Bun, browsers. Works with S3, R2, B2, Wasabi, and any other SigV4-compatible endpoint.
+
+Zero dependencies. Uses Web Crypto (`crypto.subtle`) only.
+
+By ProfessionalFlare.
+
+## Install
+
+```
+npm install sigv4-lite
+```
+
+## Usage
+
+### Sign a request
+
+```js
+import { signRequest } from "sigv4-lite";
+
+const headers = await signRequest({
+  method: "PUT",
+  url: "https://s3.us-west-002.backblazeb2.com/my-bucket/my-file.txt",
+  body: "hello world",
+  accessKeyId: env.B2_KEY_ID,
+  secretAccessKey: env.B2_APP_KEY,
+  region: "us-west-002",
+});
+
+const response = await fetch("https://s3.us-west-002.backblazeb2.com/my-bucket/my-file.txt", {
+  method: "PUT",
+  headers,
+  body: "hello world",
+});
+```
+
+### Presign a URL
+
+```js
+import { presignUrl } from "sigv4-lite";
+
+const url = await presignUrl({
+  method: "GET",
+  url: "https://s3.us-west-002.backblazeb2.com/my-bucket/my-file.txt",
+  accessKeyId: env.B2_KEY_ID,
+  secretAccessKey: env.B2_APP_KEY,
+  region: "us-west-002",
+  expiresIn: 3600,
+});
+```
+
+## API
+
+### `signRequest(options)`
+
+Returns a headers object with `authorization`, `x-amz-date`, and `x-amz-content-sha256` set.
+
+| option | type | default | required |
+|---|---|---|---|
+| `method` | string | `"GET"` | no |
+| `url` | string | — | yes |
+| `headers` | object | `{}` | no |
+| `body` | string | `""` | no |
+| `accessKeyId` | string | — | yes |
+| `secretAccessKey` | string | — | yes |
+| `region` | string | — | yes |
+| `service` | string | `"s3"` | no |
+| `date` | Date | `new Date()` | no |
+
+### `presignUrl(options)`
+
+Returns a signed URL string valid for `expiresIn` seconds.
+
+| option | type | default | required |
+|---|---|---|---|
+| `method` | string | `"GET"` | no |
+| `url` | string | — | yes |
+| `accessKeyId` | string | — | yes |
+| `secretAccessKey` | string | — | yes |
+| `region` | string | — | yes |
+| `service` | string | `"s3"` | no |
+| `expiresIn` | number | `3600` | no |
+| `date` | Date | `new Date()` | no |
+
+## License
+
+MIT

package/package.json

@@ -0,0 +1,25 @@
+{
+  "name": "sigv4-lite",
+  "version": "1.0.0",
+  "description": "Minimal AWS SigV4 signer for runtimes without Node's crypto module",
+  "type": "module",
+  "main": "src/index.js",
+  "exports": {
+    ".": "./src/index.js"
+  },
+  "files": [
+    "src"
+  ],
+  "keywords": [
+    "sigv4",
+    "aws4",
+    "s3",
+    "cloudflare-workers",
+    "deno",
+    "bun",
+    "b2",
+    "r2"
+  ],
+  "author": "ProfessionalFlare",
+  "license": "MIT"
+}

package/src/index.js

@@ -0,0 +1,147 @@
+const encoder = new TextEncoder();
+
+function toHex(buffer) {
+  return [...new Uint8Array(buffer)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+async function sha256(data) {
+  const buf = typeof data === "string" ? encoder.encode(data) : data;
+  const hash = await crypto.subtle.digest("SHA-256", buf);
+  return toHex(hash);
+}
+
+async function hmac(key, data) {
+  const cryptoKey = await crypto.subtle.importKey(
+    "raw",
+    typeof key === "string" ? encoder.encode(key) : key,
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  return crypto.subtle.sign("HMAC", cryptoKey, encoder.encode(data));
+}
+
+function toAmzDate(date) {
+  return date.toISOString().replace(/[:-]|\.\d{3}/g, "");
+}
+
+function encodeRfc3986(str) {
+  return encodeURIComponent(str).replace(/[!'()*]/g, (c) => "%" + c.charCodeAt(0).toString(16).toUpperCase());
+}
+
+function canonicalQueryString(url) {
+  const params = [...url.searchParams.entries()].sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+  return params.map(([k, v]) => `${encodeRfc3986(k)}=${encodeRfc3986(v)}`).join("&");
+}
+
+export async function signRequest({
+  method = "GET",
+  url,
+  headers = {},
+  body = "",
+  accessKeyId,
+  secretAccessKey,
+  region,
+  service = "s3",
+  date = new Date(),
+}) {
+  const parsedUrl = new URL(url);
+  const amzDate = toAmzDate(date);
+  const dateStamp = amzDate.slice(0, 8);
+  const payloadHash = await sha256(body);
+
+  const canonicalHeaders = { ...headers };
+  canonicalHeaders["host"] = parsedUrl.host;
+  canonicalHeaders["x-amz-date"] = amzDate;
+  canonicalHeaders["x-amz-content-sha256"] = payloadHash;
+
+  const sortedHeaderKeys = Object.keys(canonicalHeaders)
+    .map((k) => k.toLowerCase())
+    .sort();
+
+  const canonicalHeadersStr =
+    sortedHeaderKeys.map((k) => `${k}:${String(canonicalHeaders[k]).trim()}\n`).join("");
+
+  const signedHeaders = sortedHeaderKeys.join(";");
+
+  const canonicalRequest = [
+    method.toUpperCase(),
+    parsedUrl.pathname || "/",
+    canonicalQueryString(parsedUrl),
+    canonicalHeadersStr,
+    signedHeaders,
+    payloadHash,
+  ].join("\n");
+
+  const credentialScope = `${dateStamp}/${region}/${service}/aws4_request`;
+  const stringToSign = [
+    "AWS4-HMAC-SHA256",
+    amzDate,
+    credentialScope,
+    await sha256(canonicalRequest),
+  ].join("\n");
+
+  const kDate = await hmac(`AWS4${secretAccessKey}`, dateStamp);
+  const kRegion = await hmac(kDate, region);
+  const kService = await hmac(kRegion, service);
+  const kSigning = await hmac(kService, "aws4_request");
+  const signature = toHex(await hmac(kSigning, stringToSign));
+
+  const authorizationHeader = `AWS4-HMAC-SHA256 Credential=${accessKeyId}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
+
+  return {
+    ...headers,
+    host: parsedUrl.host,
+    "x-amz-date": amzDate,
+    "x-amz-content-sha256": payloadHash,
+    authorization: authorizationHeader,
+  };
+}
+
+export async function presignUrl({
+  url,
+  method = "GET",
+  accessKeyId,
+  secretAccessKey,
+  region,
+  service = "s3",
+  expiresIn = 3600,
+  date = new Date(),
+}) {
+  const parsedUrl = new URL(url);
+  const amzDate = toAmzDate(date);
+  const dateStamp = amzDate.slice(0, 8);
+  const credentialScope = `${dateStamp}/${region}/${service}/aws4_request`;
+
+  parsedUrl.searchParams.set("X-Amz-Algorithm", "AWS4-HMAC-SHA256");
+  parsedUrl.searchParams.set("X-Amz-Credential", `${accessKeyId}/${credentialScope}`);
+  parsedUrl.searchParams.set("X-Amz-Date", amzDate);
+  parsedUrl.searchParams.set("X-Amz-Expires", String(expiresIn));
+  parsedUrl.searchParams.set("X-Amz-SignedHeaders", "host");
+
+  const canonicalRequest = [
+    method.toUpperCase(),
+    parsedUrl.pathname || "/",
+    canonicalQueryString(parsedUrl),
+    `host:${parsedUrl.host}\n`,
+    "host",
+    "UNSIGNED-PAYLOAD",
+  ].join("\n");
+
+  const stringToSign = [
+    "AWS4-HMAC-SHA256",
+    amzDate,
+    credentialScope,
+    await sha256(canonicalRequest),
+  ].join("\n");
+
+  const kDate = await hmac(`AWS4${secretAccessKey}`, dateStamp);
+  const kRegion = await hmac(kDate, region);
+  const kService = await hmac(kRegion, service);
+  const kSigning = await hmac(kService, "aws4_request");
+  const signature = toHex(await hmac(kSigning, stringToSign));
+
+  parsedUrl.searchParams.set("X-Amz-Signature", signature);
+
+  return parsedUrl.toString();
+}