@adcp/sdk 16.0.0-beta.2 → 16.0.0-beta.3

package/dist/lib/protocols/responseSizeLimit.js

@@ -18,6 +18,9 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var responseSizeLimit_exports = {};
 __export(responseSizeLimit_exports, {
+  DEFAULT_MAX_RESPONSE_BYTES: () => DEFAULT_MAX_RESPONSE_BYTES,
+  SSE_CUMULATIVE_BUDGET_MULTIPLIER: () => SSE_CUMULATIVE_BUDGET_MULTIPLIER,
+  responseSizeCapCacheKey: () => responseSizeCapCacheKey,
   responseSizeLimitStorage: () => responseSizeLimitStorage,
   withResponseSizeLimit: () => withResponseSizeLimit,
   wrapFetchWithSizeLimit: () => wrapFetchWithSizeLimit
@@ -25,52 +28,116 @@ __export(responseSizeLimit_exports, {
 module.exports = __toCommonJS(responseSizeLimit_exports);
 var import_global_async_local_storage = require('../utils/global-async-local-storage.js');
 var import_errors = require('../errors/index.js');
+var import_transportDiagnostics = require('./transportDiagnostics.js');
+const DEFAULT_MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
+const SSE_CUMULATIVE_BUDGET_MULTIPLIER = 2;
 const responseSizeLimitStorage = (0, import_global_async_local_storage.globalAsyncLocalStorage)("responseSizeLimit");
+function resolveResponseSizeCap(maxResponseBytes) {
+  if (maxResponseBytes === void 0) return DEFAULT_MAX_RESPONSE_BYTES;
+  if (maxResponseBytes === 0) return null;
+  if (!Number.isFinite(maxResponseBytes) || maxResponseBytes < 0) return DEFAULT_MAX_RESPONSE_BYTES;
+  return maxResponseBytes;
+}
+function newSlot(maxResponseBytes) {
+  const resolved = resolveResponseSizeCap(maxResponseBytes);
+  if (resolved === null) return { maxResponseBytes: null };
+  const enclosing = responseSizeLimitStorage.getStore();
+  const limit = sseBudgetFor(resolved);
+  return {
+    // Nesting narrows both numbers. `?? resolved` deliberately also covers an
+    // enclosing opt-out (`null`): an inner scope that asks for a cap is the
+    // more specific instruction, so it still gets one.
+    maxResponseBytes: Math.min(resolved, enclosing?.maxResponseBytes ?? resolved),
+    streamLimit: Math.min(limit, enclosing?.streamLimit ?? limit),
+    streamMeter: enclosing?.streamMeter ?? { consumed: 0 }
+  };
+}
+function sseBudgetFor(maxResponseBytes) {
+  return Math.min(maxResponseBytes * SSE_CUMULATIVE_BUDGET_MULTIPLIER, Number.MAX_SAFE_INTEGER);
+}
+function responseSizeCapCacheKey() {
+  const slot = responseSizeLimitStorage.getStore();
+  const cap = slot ? slot.maxResponseBytes : DEFAULT_MAX_RESPONSE_BYTES;
+  return `max-response-bytes:${cap === null ? "off" : cap}`;
+}
 function withResponseSizeLimit(maxResponseBytes, fn) {
-  if (!maxResponseBytes || !Number.isFinite(maxResponseBytes) || maxResponseBytes <= 0) {
+  if (maxResponseBytes === void 0 && responseSizeLimitStorage.getStore()) {
     return fn();
   }
-  return responseSizeLimitStorage.run({ maxResponseBytes }, fn);
+  const slot = newSlot(maxResponseBytes);
+  return responseSizeLimitStorage.run(slot, () => rethrowRecordedViolation(slot, fn));
+}
+async function rethrowRecordedViolation(slot, fn) {
+  try {
+    return await fn();
+  } catch (error) {
+    const violation = slot.violation;
+    if (!violation || error instanceof import_errors.ResponseTooLargeError) throw error;
+    const surfaced = new import_errors.ResponseTooLargeError(
+      violation.limit,
+      violation.bytesRead,
+      violation.url,
+      violation.contentLengthHeader
+    );
+    Object.defineProperty(surfaced, "cause", { value: error, configurable: true });
+    throw surfaced;
+  }
+}
+function recordViolation(slot, error) {
+  if (slot && !slot.violation) slot.violation = error;
+  return error;
 }
 function urlOfInput(input) {
   if (typeof input === "string") return input;
   if (input instanceof URL) return input.toString();
   return input.url;
 }
-function redactUrlForError(url) {
-  try {
-    const parsed = new URL(url);
-    parsed.search = "";
-    return parsed.toString();
-  } catch {
-    return url;
-  }
-}
-function withIdentityEncoding(init) {
-  const headers = new Headers(init?.headers);
-  if (!headers.has("accept-encoding")) {
-    headers.set("accept-encoding", "identity");
-  }
-  return { ...init ?? {}, headers };
-}
 function wrapFetchWithSizeLimit(upstream) {
   const wrapped = async (input, init) => {
     const slot = responseSizeLimitStorage.getStore();
-    if (!slot) return upstream(input, init);
-    const response = await upstream(input, withIdentityEncoding(init));
-    return enforceSizeLimit(response, slot.maxResponseBytes, redactUrlForError(urlOfInput(input)));
+    const maxBytes = slot ? slot.maxResponseBytes : DEFAULT_MAX_RESPONSE_BYTES;
+    if (maxBytes === null) return upstream(input, init);
+    const response = await upstream(input, init);
+    if (NULL_BODY_STATUSES.has(response.status)) return response;
+    const skipDeclaredLength = methodOf(input, init) === "HEAD";
+    const url = (0, import_transportDiagnostics.sanitizeTransportUrl)(urlOfInput(input));
+    if (isEventStream(response)) {
+      const connectionScoped = methodOf(input, init) === "GET";
+      const { limit, meter } = streamBudgetFor(connectionScoped, slot, maxBytes);
+      return enforceEventStreamLimit(
+        response,
+        maxBytes,
+        limit,
+        meter,
+        url,
+        connectionScoped ? void 0 : slot,
+        skipDeclaredLength
+      );
+    }
+    return enforceSizeLimit(response, maxBytes, url, slot, skipDeclaredLength);
   };
   return wrapped;
 }
-function enforceSizeLimit(response, maxBytes, url) {
-  if (response.headers.get("content-type")?.toLowerCase().startsWith("text/event-stream")) {
-    return response;
-  }
-  const declared = parseContentLength(response.headers.get("content-length"));
+function streamBudgetFor(connectionScoped, slot, maxBytes) {
+  if (connectionScoped) return { limit: sseBudgetFor(maxBytes), meter: { consumed: 0 } };
+  return {
+    limit: slot?.streamLimit ?? sseBudgetFor(maxBytes),
+    meter: slot?.streamMeter ?? { consumed: 0 }
+  };
+}
+function methodOf(input, init) {
+  const method = init?.method ?? (typeof Request !== "undefined" && input instanceof Request ? input.method : "GET");
+  return method.toUpperCase();
+}
+const NULL_BODY_STATUSES = /* @__PURE__ */ new Set([101, 103, 204, 205, 304]);
+function isEventStream(response) {
+  return response.headers.get("content-type")?.toLowerCase().startsWith("text/event-stream") === true;
+}
+function enforceSizeLimit(response, maxBytes, url, slot, skipDeclaredLength = false) {
+  const declared = skipDeclaredLength ? void 0 : parseContentLength(response.headers.get("content-length"));
   if (declared !== void 0 && declared > maxBytes) {
-    response.body?.cancel().catch(() => {
-    });
-    throw new import_errors.ResponseTooLargeError(maxBytes, 0, url, declared);
+    cancelBody(response);
+    throw recordViolation(slot, new import_errors.ResponseTooLargeError(maxBytes, 0, url, declared));
   }
   if (!response.body) return response;
   let bytesRead = 0;
@@ -78,13 +145,107 @@ function enforceSizeLimit(response, maxBytes, url) {
     transform(chunk, controller) {
       bytesRead += chunk.byteLength;
       if (bytesRead > maxBytes) {
-        controller.error(new import_errors.ResponseTooLargeError(maxBytes, bytesRead, url));
+        controller.error(recordViolation(slot, new import_errors.ResponseTooLargeError(maxBytes, bytesRead, url)));
         return;
       }
       controller.enqueue(chunk);
     }
   });
-  return new Response(response.body.pipeThrough(counter), {
+  return respondWith(response, response.body.pipeThrough(counter));
+}
+const CR = 13;
+const LF = 10;
+function enforceEventStreamLimit(response, maxBytes, streamLimit, meter, url, slot, skipDeclaredLength = false) {
+  const remaining = streamLimit - meter.consumed;
+  const declared = skipDeclaredLength ? void 0 : parseContentLength(response.headers.get("content-length"));
+  if (declared !== void 0 && declared > remaining) {
+    cancelBody(response);
+    throw recordViolation(slot, new import_errors.ResponseTooLargeError(streamLimit, meter.consumed, url, declared));
+  }
+  if (!response.body) return response;
+  let bytesInEvent = 0;
+  let lineEndings = 0;
+  let pendingCR = false;
+  let separatorTail = false;
+  let pendingReset = false;
+  const counter = new TransformStream({
+    transform(chunk, controller) {
+      meter.consumed += chunk.byteLength;
+      if (meter.consumed > streamLimit) {
+        controller.error(recordViolation(slot, new import_errors.ResponseTooLargeError(streamLimit, meter.consumed, url)));
+        return;
+      }
+      if (chunk.length === 0) {
+        controller.enqueue(chunk);
+        return;
+      }
+      if (chunk.indexOf(LF) === -1 && chunk.indexOf(CR) === -1) {
+        if (pendingReset) {
+          pendingReset = false;
+          separatorTail = false;
+          bytesInEvent = 0;
+        }
+        bytesInEvent += chunk.length;
+        lineEndings = 0;
+        pendingCR = false;
+        if (bytesInEvent > maxBytes) {
+          controller.error(recordViolation(slot, new import_errors.ResponseTooLargeError(maxBytes, bytesInEvent, url)));
+          return;
+        }
+        controller.enqueue(chunk);
+        return;
+      }
+      for (let i = 0; i < chunk.length; i += 1) {
+        const byte = chunk[i];
+        if (pendingReset) {
+          pendingReset = false;
+          if (separatorTail && byte === LF) {
+            separatorTail = false;
+            pendingCR = false;
+            bytesInEvent += 1;
+            if (bytesInEvent > maxBytes) {
+              controller.error(recordViolation(slot, new import_errors.ResponseTooLargeError(maxBytes, bytesInEvent, url)));
+              return;
+            }
+            bytesInEvent = 0;
+            continue;
+          }
+          separatorTail = false;
+          bytesInEvent = 0;
+        }
+        bytesInEvent += 1;
+        if (byte === CR) {
+          lineEndings += 1;
+          pendingCR = true;
+        } else if (byte === LF) {
+          if (!pendingCR) lineEndings += 1;
+          pendingCR = false;
+        } else {
+          lineEndings = 0;
+          pendingCR = false;
+        }
+        if (bytesInEvent > maxBytes) {
+          controller.error(recordViolation(slot, new import_errors.ResponseTooLargeError(maxBytes, bytesInEvent, url)));
+          return;
+        }
+        if (lineEndings >= 2) {
+          lineEndings = 0;
+          pendingReset = true;
+          separatorTail = pendingCR;
+          pendingCR = false;
+        }
+      }
+      controller.enqueue(chunk);
+    }
+  });
+  return respondWith(response, response.body.pipeThrough(counter));
+}
+function cancelBody(response) {
+  response.body?.cancel().catch(() => {
+  });
+}
+function respondWith(response, body) {
+  return new Response(body, {
     status: response.status,
     statusText: response.statusText,
     headers: response.headers
@@ -99,6 +260,9 @@ function parseContentLength(value) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  DEFAULT_MAX_RESPONSE_BYTES,
+  SSE_CUMULATIVE_BUDGET_MULTIPLIER,
+  responseSizeCapCacheKey,
   responseSizeLimitStorage,
   withResponseSizeLimit,
   wrapFetchWithSizeLimit

package/dist/lib/protocols/responseSizeLimit.mjs

@@ -5,52 +5,116 @@ const __dirname = __adcpDirname(__adcpFileURLToPath(import.meta.url));
 const require2 = __adcpCreateRequire(import.meta.url);
 import { globalAsyncLocalStorage } from "../utils/global-async-local-storage.mjs";
 import { ResponseTooLargeError } from "../errors/index.mjs";
+import { sanitizeTransportUrl } from "./transportDiagnostics.mjs";
+const DEFAULT_MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
+const SSE_CUMULATIVE_BUDGET_MULTIPLIER = 2;
 const responseSizeLimitStorage = globalAsyncLocalStorage("responseSizeLimit");
+function resolveResponseSizeCap(maxResponseBytes) {
+  if (maxResponseBytes === void 0) return DEFAULT_MAX_RESPONSE_BYTES;
+  if (maxResponseBytes === 0) return null;
+  if (!Number.isFinite(maxResponseBytes) || maxResponseBytes < 0) return DEFAULT_MAX_RESPONSE_BYTES;
+  return maxResponseBytes;
+}
+function newSlot(maxResponseBytes) {
+  const resolved = resolveResponseSizeCap(maxResponseBytes);
+  if (resolved === null) return { maxResponseBytes: null };
+  const enclosing = responseSizeLimitStorage.getStore();
+  const limit = sseBudgetFor(resolved);
+  return {
+    // Nesting narrows both numbers. `?? resolved` deliberately also covers an
+    // enclosing opt-out (`null`): an inner scope that asks for a cap is the
+    // more specific instruction, so it still gets one.
+    maxResponseBytes: Math.min(resolved, enclosing?.maxResponseBytes ?? resolved),
+    streamLimit: Math.min(limit, enclosing?.streamLimit ?? limit),
+    streamMeter: enclosing?.streamMeter ?? { consumed: 0 }
+  };
+}
+function sseBudgetFor(maxResponseBytes) {
+  return Math.min(maxResponseBytes * SSE_CUMULATIVE_BUDGET_MULTIPLIER, Number.MAX_SAFE_INTEGER);
+}
+function responseSizeCapCacheKey() {
+  const slot = responseSizeLimitStorage.getStore();
+  const cap = slot ? slot.maxResponseBytes : DEFAULT_MAX_RESPONSE_BYTES;
+  return `max-response-bytes:${cap === null ? "off" : cap}`;
+}
 function withResponseSizeLimit(maxResponseBytes, fn) {
-  if (!maxResponseBytes || !Number.isFinite(maxResponseBytes) || maxResponseBytes <= 0) {
+  if (maxResponseBytes === void 0 && responseSizeLimitStorage.getStore()) {
     return fn();
   }
-  return responseSizeLimitStorage.run({ maxResponseBytes }, fn);
+  const slot = newSlot(maxResponseBytes);
+  return responseSizeLimitStorage.run(slot, () => rethrowRecordedViolation(slot, fn));
+}
+async function rethrowRecordedViolation(slot, fn) {
+  try {
+    return await fn();
+  } catch (error) {
+    const violation = slot.violation;
+    if (!violation || error instanceof ResponseTooLargeError) throw error;
+    const surfaced = new ResponseTooLargeError(
+      violation.limit,
+      violation.bytesRead,
+      violation.url,
+      violation.contentLengthHeader
+    );
+    Object.defineProperty(surfaced, "cause", { value: error, configurable: true });
+    throw surfaced;
+  }
+}
+function recordViolation(slot, error) {
+  if (slot && !slot.violation) slot.violation = error;
+  return error;
 }
 function urlOfInput(input) {
   if (typeof input === "string") return input;
   if (input instanceof URL) return input.toString();
   return input.url;
 }
-function redactUrlForError(url) {
-  try {
-    const parsed = new URL(url);
-    parsed.search = "";
-    return parsed.toString();
-  } catch {
-    return url;
-  }
-}
-function withIdentityEncoding(init) {
-  const headers = new Headers(init?.headers);
-  if (!headers.has("accept-encoding")) {
-    headers.set("accept-encoding", "identity");
-  }
-  return { ...init ?? {}, headers };
-}
 function wrapFetchWithSizeLimit(upstream) {
   const wrapped = async (input, init) => {
     const slot = responseSizeLimitStorage.getStore();
-    if (!slot) return upstream(input, init);
-    const response = await upstream(input, withIdentityEncoding(init));
-    return enforceSizeLimit(response, slot.maxResponseBytes, redactUrlForError(urlOfInput(input)));
+    const maxBytes = slot ? slot.maxResponseBytes : DEFAULT_MAX_RESPONSE_BYTES;
+    if (maxBytes === null) return upstream(input, init);
+    const response = await upstream(input, init);
+    if (NULL_BODY_STATUSES.has(response.status)) return response;
+    const skipDeclaredLength = methodOf(input, init) === "HEAD";
+    const url = sanitizeTransportUrl(urlOfInput(input));
+    if (isEventStream(response)) {
+      const connectionScoped = methodOf(input, init) === "GET";
+      const { limit, meter } = streamBudgetFor(connectionScoped, slot, maxBytes);
+      return enforceEventStreamLimit(
+        response,
+        maxBytes,
+        limit,
+        meter,
+        url,
+        connectionScoped ? void 0 : slot,
+        skipDeclaredLength
+      );
+    }
+    return enforceSizeLimit(response, maxBytes, url, slot, skipDeclaredLength);
   };
   return wrapped;
 }
-function enforceSizeLimit(response, maxBytes, url) {
-  if (response.headers.get("content-type")?.toLowerCase().startsWith("text/event-stream")) {
-    return response;
-  }
-  const declared = parseContentLength(response.headers.get("content-length"));
+function streamBudgetFor(connectionScoped, slot, maxBytes) {
+  if (connectionScoped) return { limit: sseBudgetFor(maxBytes), meter: { consumed: 0 } };
+  return {
+    limit: slot?.streamLimit ?? sseBudgetFor(maxBytes),
+    meter: slot?.streamMeter ?? { consumed: 0 }
+  };
+}
+function methodOf(input, init) {
+  const method = init?.method ?? (typeof Request !== "undefined" && input instanceof Request ? input.method : "GET");
+  return method.toUpperCase();
+}
+const NULL_BODY_STATUSES = /* @__PURE__ */ new Set([101, 103, 204, 205, 304]);
+function isEventStream(response) {
+  return response.headers.get("content-type")?.toLowerCase().startsWith("text/event-stream") === true;
+}
+function enforceSizeLimit(response, maxBytes, url, slot, skipDeclaredLength = false) {
+  const declared = skipDeclaredLength ? void 0 : parseContentLength(response.headers.get("content-length"));
   if (declared !== void 0 && declared > maxBytes) {
-    response.body?.cancel().catch(() => {
-    });
-    throw new ResponseTooLargeError(maxBytes, 0, url, declared);
+    cancelBody(response);
+    throw recordViolation(slot, new ResponseTooLargeError(maxBytes, 0, url, declared));
   }
   if (!response.body) return response;
   let bytesRead = 0;
@@ -58,13 +122,107 @@ function enforceSizeLimit(response, maxBytes, url) {
     transform(chunk, controller) {
       bytesRead += chunk.byteLength;
       if (bytesRead > maxBytes) {
-        controller.error(new ResponseTooLargeError(maxBytes, bytesRead, url));
+        controller.error(recordViolation(slot, new ResponseTooLargeError(maxBytes, bytesRead, url)));
         return;
       }
       controller.enqueue(chunk);
     }
   });
-  return new Response(response.body.pipeThrough(counter), {
+  return respondWith(response, response.body.pipeThrough(counter));
+}
+const CR = 13;
+const LF = 10;
+function enforceEventStreamLimit(response, maxBytes, streamLimit, meter, url, slot, skipDeclaredLength = false) {
+  const remaining = streamLimit - meter.consumed;
+  const declared = skipDeclaredLength ? void 0 : parseContentLength(response.headers.get("content-length"));
+  if (declared !== void 0 && declared > remaining) {
+    cancelBody(response);
+    throw recordViolation(slot, new ResponseTooLargeError(streamLimit, meter.consumed, url, declared));
+  }
+  if (!response.body) return response;
+  let bytesInEvent = 0;
+  let lineEndings = 0;
+  let pendingCR = false;
+  let separatorTail = false;
+  let pendingReset = false;
+  const counter = new TransformStream({
+    transform(chunk, controller) {
+      meter.consumed += chunk.byteLength;
+      if (meter.consumed > streamLimit) {
+        controller.error(recordViolation(slot, new ResponseTooLargeError(streamLimit, meter.consumed, url)));
+        return;
+      }
+      if (chunk.length === 0) {
+        controller.enqueue(chunk);
+        return;
+      }
+      if (chunk.indexOf(LF) === -1 && chunk.indexOf(CR) === -1) {
+        if (pendingReset) {
+          pendingReset = false;
+          separatorTail = false;
+          bytesInEvent = 0;
+        }
+        bytesInEvent += chunk.length;
+        lineEndings = 0;
+        pendingCR = false;
+        if (bytesInEvent > maxBytes) {
+          controller.error(recordViolation(slot, new ResponseTooLargeError(maxBytes, bytesInEvent, url)));
+          return;
+        }
+        controller.enqueue(chunk);
+        return;
+      }
+      for (let i = 0; i < chunk.length; i += 1) {
+        const byte = chunk[i];
+        if (pendingReset) {
+          pendingReset = false;
+          if (separatorTail && byte === LF) {
+            separatorTail = false;
+            pendingCR = false;
+            bytesInEvent += 1;
+            if (bytesInEvent > maxBytes) {
+              controller.error(recordViolation(slot, new ResponseTooLargeError(maxBytes, bytesInEvent, url)));
+              return;
+            }
+            bytesInEvent = 0;
+            continue;
+          }
+          separatorTail = false;
+          bytesInEvent = 0;
+        }
+        bytesInEvent += 1;
+        if (byte === CR) {
+          lineEndings += 1;
+          pendingCR = true;
+        } else if (byte === LF) {
+          if (!pendingCR) lineEndings += 1;
+          pendingCR = false;
+        } else {
+          lineEndings = 0;
+          pendingCR = false;
+        }
+        if (bytesInEvent > maxBytes) {
+          controller.error(recordViolation(slot, new ResponseTooLargeError(maxBytes, bytesInEvent, url)));
+          return;
+        }
+        if (lineEndings >= 2) {
+          lineEndings = 0;
+          pendingReset = true;
+          separatorTail = pendingCR;
+          pendingCR = false;
+        }
+      }
+      controller.enqueue(chunk);
+    }
+  });
+  return respondWith(response, response.body.pipeThrough(counter));
+}
+function cancelBody(response) {
+  response.body?.cancel().catch(() => {
+  });
+}
+function respondWith(response, body) {
+  return new Response(body, {
     status: response.status,
     statusText: response.statusText,
     headers: response.headers
@@ -78,6 +236,9 @@ function parseContentLength(value) {
   return Number.isFinite(parsed) ? parsed : void 0;
 }
 export {
+  DEFAULT_MAX_RESPONSE_BYTES,
+  SSE_CUMULATIVE_BUDGET_MULTIPLIER,
+  responseSizeCapCacheKey,
   responseSizeLimitStorage,
   withResponseSizeLimit,
   wrapFetchWithSizeLimit

package/dist/lib/schemas-data/v2.5/_provenance.json

@@ -4,5 +4,5 @@
   "source_sha": "4e553ad955f83b49c7d221ab5c3ff78237ad02e3",
   "source_tarball_sha256": "580656d6466ef9f0d1119985e6726c2efea718dc671e2ad30957fcb2fd54af0f",
   "upstream_adcp_version": "2.5.3",
-  "synced_at": "2026-10-15T16:11:40.051Z"
+  "synced_at": "2026-10-15T19:30:04.842Z"
 }

package/dist/lib/signing/crypto.d.mts

@@ -2,3 +2,18 @@ import { type KeyObject } from 'crypto';
 import type { AdcpJsonWebKey } from './types.mjs';
 export declare function jwkToPublicKey(jwk: AdcpJsonWebKey): KeyObject;
 export declare function verifySignature(alg: string, publicKey: KeyObject, data: Uint8Array, signature: Uint8Array): boolean;
+/**
+ * Verify with WebCrypto when available. ES256 uses `crypto.subtle`, whose
+ * ECDSA signatures are IEEE P1363 (r||s) natively, so edge runtimes such as
+ * Cloudflare workerd verify without node:crypto option-shape differences
+ * (#3243). Other algorithms, and runtimes without WebCrypto, use
+ * {@link verifySignature}.
+ */
+export declare function verifySignatureAsync(alg: string, publicKey: KeyObject | AdcpJsonWebKey, data: Uint8Array, signature: Uint8Array): Promise<boolean>;
+/**
+ * Sign with a private JWK. ES256 output is IEEE P1363 (r||s). The node:crypto
+ * path passes the key as a JWK so workerd accepts it (#3243).
+ */
+export declare function signWithPrivateJwk(alg: string, privateJwk: AdcpJsonWebKey, data: Uint8Array): Uint8Array;
+/** {@link signWithPrivateJwk}, preferring WebCrypto for ES256 when available. */
+export declare function signWithPrivateJwkAsync(alg: string, privateJwk: AdcpJsonWebKey, data: Uint8Array): Promise<Uint8Array>;

package/dist/lib/signing/crypto.d.ts

@@ -2,3 +2,18 @@ import { type KeyObject } from 'crypto';
 import type { AdcpJsonWebKey } from './types';
 export declare function jwkToPublicKey(jwk: AdcpJsonWebKey): KeyObject;
 export declare function verifySignature(alg: string, publicKey: KeyObject, data: Uint8Array, signature: Uint8Array): boolean;
+/**
+ * Verify with WebCrypto when available. ES256 uses `crypto.subtle`, whose
+ * ECDSA signatures are IEEE P1363 (r||s) natively, so edge runtimes such as
+ * Cloudflare workerd verify without node:crypto option-shape differences
+ * (#3243). Other algorithms, and runtimes without WebCrypto, use
+ * {@link verifySignature}.
+ */
+export declare function verifySignatureAsync(alg: string, publicKey: KeyObject | AdcpJsonWebKey, data: Uint8Array, signature: Uint8Array): Promise<boolean>;
+/**
+ * Sign with a private JWK. ES256 output is IEEE P1363 (r||s). The node:crypto
+ * path passes the key as a JWK so workerd accepts it (#3243).
+ */
+export declare function signWithPrivateJwk(alg: string, privateJwk: AdcpJsonWebKey, data: Uint8Array): Uint8Array;
+/** {@link signWithPrivateJwk}, preferring WebCrypto for ES256 when available. */
+export declare function signWithPrivateJwkAsync(alg: string, privateJwk: AdcpJsonWebKey, data: Uint8Array): Promise<Uint8Array>;