Web chunk(): build the blank signature inside the call, not at import

CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## Unreleased
+
+- The WebCrypto entry no longer builds a 64-character constant when it is imported, so a bundle that imports only `getAuthHeaders` is 22 bytes smaller again: 5,235 bytes minified, as in 1.0.4 (1.0.5 was 5,257).
+
 ## 1.0.5 - 2026-11-06
 
 - In Cloudflare Workers and browsers (the WebCrypto entry), a refused `eventSigner` `sign` call, for example one with a `now` of `NaN` or a `null` message, no longer makes every later call on that signer reject. It now leaves the signer where it was, as the Node, Bun and Deno entries do.

src/web.js

@@ -283,7 +283,6 @@ const copyOf = (data) => Uint8Array.prototype.slice.call(data);
 /** @param {unknown} data */
 const isBytes = (data) =>
   ArrayBuffer.isView(data) && /** @type {any} */ (data).BYTES_PER_ELEMENT === 1; // a Uint8Array of any realm or a Node Buffer; not a DataView or a wider array
-const blankSignature = '0'.repeat(64); // a signature is 64 hex digits
 
 /**
  * Runs the signing steps of a stream one after the other. A step that throws rejects its own call only: the next one still runs, as on the
@@ -336,9 +335,10 @@ export function chunkSigner(authHeaders, credentials) {
       if (!isBytes(data)) {
         throw new TypeError('data must be a Uint8Array');
       }
-      const frame = frameChunk(blankSignature, data);
+      const blank = '0'.repeat(64); // a signature is 64 hex digits; built here, not at the top of the module, so a bundle of other signers does not carry it
+      const frame = frameChunk(blank, data);
       const body = frame.length - 2 - data.length; // the data ends the frame, followed by CR LF; the signature ends the line before it
-      const at = body - 2 - blankSignature.length;
+      const at = body - 2 - blank.length;
       const signature = await sign(frame.subarray(body, frame.length - 2));
       utf8.encodeInto(signature, frame.subarray(at, at + signature.length));
       return frame;