@request-seal/core 0.1.0 → 0.3.0

package/dist/accept-signature.d.ts

@@ -1,26 +1,37 @@
 import { type InnerList } from "./structured-fields/index.ts";
 import { type Message as HttpMessage } from "./message/index.ts";
 import { type Result } from "./result.ts";
+/** A requested signature label, component list, and negotiation parameters. */
 export type SignatureRequest = Readonly<{
     label: string;
     components: InnerList;
     parameters: Readonly<Record<string, string | true>>;
 }>;
+/** A branded ordered collection of signature negotiation requests. */
 export type AcceptSignature = readonly SignatureRequest[];
+/** Check the private brand of parsed signature negotiation requests. */
 export declare function isAcceptSignature(v: unknown): v is AcceptSignature;
 export declare function applicable(requests: AcceptSignature, target: "request" | "response"): Result<AcceptSignature>;
+/** Parse and validate Accept-Signature fields into negotiation requests. */
 export declare function parseAcceptSignature(wire: unknown, options: unknown): Result<AcceptSignature>;
+/** Serialize branded negotiation requests as an Accept-Signature dictionary. */
 export declare function serializeAcceptSignature(requests: unknown): Result<Uint8Array>;
+/** A chooser's selected algorithm and optional creation and expiration times. */
 export type SignatureChoice = Readonly<{
     algorithm: string;
     created: number | null;
     expires: number | null;
 }>;
+/** Select signing parameters for a signature negotiation request. */
 export type SignatureChooser = (request: SignatureRequest) => Result<SignatureChoice> | Promise<Result<SignatureChoice>>;
 /** Fulfill atomically through caller-owned selection and the single-signature API. */
 export declare function fulfillAcceptSignature(message: unknown, requests: unknown, chooser: unknown, signer: unknown, options?: unknown): Promise<Result<HttpMessage>>;
+/** Signature negotiation parsing, serialization, and fulfillment. */
 export declare const AcceptSignature: Readonly<{
+    /** Parse and validate the supported wire representation. */
     parse: typeof parseAcceptSignature;
+    /** Serialize validated values to their canonical wire representation. */
     serialize: typeof serializeAcceptSignature;
+    /** Select and add applicable requested signatures with caller-owned signing custody. */
     fulfill: typeof fulfillAcceptSignature;
 }>;

package/dist/accept-signature.js

@@ -24,6 +24,7 @@ const requestDerived = [
     "@query",
     "@query-param",
 ];
+/** Check the private brand of parsed signature negotiation requests. */
 export function isAcceptSignature(v) {
     return typeof v === "object" && v !== null && requestsBrand.has(v);
 }
@@ -43,6 +44,7 @@ export function applicable(requests, target) {
         return err(bounded(e, "invalid_accept_signature", "negotiation"));
     }
 }
+/** Parse and validate Accept-Signature fields into negotiation requests. */
 export function parseAcceptSignature(wire, options) {
     try {
         const a = snapshotOptions(options, ["target"]);
@@ -117,6 +119,7 @@ export function parseAcceptSignature(wire, options) {
         return err(bounded(e, "invalid_accept_signature", "negotiation"));
     }
 }
+/** Serialize branded negotiation requests as an Accept-Signature dictionary. */
 export function serializeAcceptSignature(requests) {
     try {
         ensure(isAcceptSignature(requests), "invalid_accept_signature", "negotiation");
@@ -218,8 +221,12 @@ export async function fulfillAcceptSignature(message, requests, chooser, signer,
         return err(bounded(e, "negotiation_unfulfillable", "negotiation"));
     }
 }
+/** Signature negotiation parsing, serialization, and fulfillment. */
 export const AcceptSignature = Object.freeze({
+    /** Parse and validate the supported wire representation. */
     parse: parseAcceptSignature,
+    /** Serialize validated values to their canonical wire representation. */
     serialize: serializeAcceptSignature,
+    /** Select and add applicable requested signatures with caller-owned signing custody. */
     fulfill: fulfillAcceptSignature,
 });

package/dist/adapters/fetch/index.d.ts

@@ -2,32 +2,42 @@ import { type Message as HttpMessage } from "../../message/index.ts";
 import type { Verification } from "../../verification.ts";
 import { type Result } from "../../result.ts";
 export { FETCH_VERIFICATION_RUNTIMES } from "./runtime.ts";
+/** A Fetch request and its signed lossless message. */
 export type SignedRequest = Readonly<{
     request: Request;
     message: HttpMessage;
 }>;
+/** A Fetch response and its signed lossless message. */
 export type SignedResponse = Readonly<{
     response: Response;
     message: HttpMessage;
 }>;
+/** Captured Fetch request bytes accompanied by verification facts. */
 export type VerifiedRequest = Readonly<{
     request: Request;
     message: HttpMessage;
     verification: Verification;
     bytes: Uint8Array;
 }>;
+/** Captured Fetch response bytes accompanied by verification facts. */
 export type VerifiedResponse = Readonly<{
     response: Response;
     message: HttpMessage;
     verification: Verification;
     bytes: Uint8Array;
 }>;
+/** A signed Fetch request, its response, and optional response verification. */
 export type SignedExchange = Readonly<{
     response: Response;
     request: SignedRequest;
 }>;
+/** Construct a signed Fetch request from an owned body snapshot. */
 export declare function signRequest(request: unknown, input: unknown, signer: unknown, options?: unknown): Promise<Result<SignedRequest>>;
+/** Construct a signed Fetch response from an owned body snapshot. */
 export declare function signResponse(response: unknown, input: unknown, signer: unknown, options?: unknown): Promise<Result<SignedResponse>>;
+/** Verify a Fetch request on an explicitly supported wire runtime. */
 export declare function verifyRequest(request: unknown, policy: unknown, options: unknown): Promise<Result<VerifiedRequest>>;
+/** Verify a Fetch response on an explicitly supported wire runtime. */
 export declare function verifyResponse(response: unknown, policy: unknown, options: unknown): Promise<Result<VerifiedResponse>>;
+/** Send a signed Fetch request with explicit redirect and response policies. */
 export declare function signedFetch(input: unknown, init: unknown, signing: unknown, options?: unknown): Promise<Result<SignedExchange>>;

package/dist/adapters/fetch/index.js

@@ -32,10 +32,14 @@ function headers(message) {
         h.append(f.name, S.latin(f.value));
     return h;
 }
+// Captured once: a runtime without this accessor cannot carry Request streams.
+const requestBodyAccessor = typeof Request === "function"
+    ? Object.getOwnPropertyDescriptor(Request.prototype, "body")
+    : undefined;
 function requestBodySupported(request, stage) {
     // Native ingress can omit GET/HEAD bodies while retaining their declared length.
     S.need(!["GET", "HEAD"].includes(request.method.toUpperCase()) ||
-        (request.body === null &&
+        (request.body == null &&
             !(Number(request.headers.get("content-length")) > 0)), "fetch", stage, "invalid_request");
 }
 async function bytes(value, max, c, stage) {
@@ -44,6 +48,14 @@ async function bytes(value, max, c, stage) {
             S.need(!value.bodyUsed, "fetch", stage, "body_unavailable");
             if (value.body === null)
                 return ok(new Uint8Array());
+            if (value instanceof Request && requestBodyAccessor === undefined) {
+                // Runtimes without the body accessor cannot accept Request streams.
+                // The input is already materialized; this read allocates a complete copy
+                // before maxBytes can bound the bytes accepted for signing.
+                const data = new Uint8Array(await value.clone().arrayBuffer());
+                S.need(data.length <= max, "fetch", stage, "limit");
+                return ok(data);
+            }
             const reader = value.body.getReader();
             const cancel = () => {
                 void reader.cancel().catch(() => { });
@@ -136,6 +148,7 @@ function verifySupported(message, policy, label) {
         }
     }
 }
+/** Construct a signed Fetch request from an owned body snapshot. */
 export async function signRequest(request, input, signer, options = {}) {
     return signRequestOperation(request, input, signer, options);
 }
@@ -173,6 +186,7 @@ async function signRequestOperation(request, input, signer, options, exchangeCon
         return S.caught(e, "fetch", "sign", "signing_failed");
     }
 }
+/** Construct a signed Fetch response from an owned body snapshot. */
 export async function signResponse(response, input, signer, options = {}) {
     try {
         const a = S.take(options, ["context", "maxBytes", "request", "clock", "nonce", "signingTimeout"], "fetch", "sign");
@@ -206,6 +220,7 @@ function related(value, stage = "verify") {
     }
     throw S.failure("fetch", stage, "invalid_options");
 }
+/** Verify a Fetch request on an explicitly supported wire runtime. */
 export async function verifyRequest(request, policy, options) {
     // This guard precedes all option access, stream reads, clocks, and resolvers.
     if (!canVerify)
@@ -246,6 +261,7 @@ export async function verifyRequest(request, policy, options) {
         return S.caught(e, "fetch", "verify", "request_rejected");
     }
 }
+/** Verify a Fetch response on an explicitly supported wire runtime. */
 export async function verifyResponse(response, policy, options) {
     if (!canVerify)
         return err(S.failure("fetch", "verify", "invalid_request"));
@@ -277,6 +293,7 @@ export async function verifyResponse(response, policy, options) {
         return S.caught(e, "fetch", "verify", "response_rejected");
     }
 }
+/** Send a signed Fetch request with explicit redirect and response policies. */
 export async function signedFetch(input, init, signing, options = {}) {
     let attempt = 0;
     try {
@@ -312,6 +329,9 @@ export async function signedFetch(input, init, signing, options = {}) {
         S.need(typeof input === "string" ||
             input instanceof URL ||
             input instanceof Request, "fetch", "attach", "invalid_request");
+        if (a.verify !== undefined) {
+            S.need(canVerify, "fetch", "verify", "invalid_request");
+        }
         // Constructing from another Request resets referrerPolicy unless explicit.
         const initialOptions = input instanceof Request &&
             !Object.hasOwn(i, "referrerPolicy")
@@ -340,9 +360,6 @@ export async function signedFetch(input, init, signing, options = {}) {
         let data = S.unwrap(await bytes(current, S.maximum(a, "fetch", "attach"), c, "sign"), "fetch", "attach", "body_unavailable");
         const maxRedirects = S.limitNumber(a.maxRedirects ?? 0, 10, "fetch"), maxRetries = S.limitNumber(a.maxRetries ?? 0, 10, "fetch");
         let redirects = 0, retries = 0;
-        if (a.verify !== undefined) {
-            S.need(canVerify, "fetch", "verify", "invalid_request");
-        }
         for (;;) {
             attempt++;
             const h = new Headers(current.headers);

package/dist/adapters/fetch/runtime.d.ts

@@ -1,3 +1,4 @@
+/** Exact Deno releases permitted for Fetch wire verification. */
 export declare const FETCH_VERIFICATION_RUNTIMES: readonly ["deno:2.5.6"];
 export declare const runtime: string;
 export declare const canVerify: boolean;

package/dist/adapters/fetch/runtime.js

@@ -1,5 +1,6 @@
 import { RUNTIME_MANAGED_FIELDS } from "../support.js";
 // Evidence: test/fixtures/adapters-fetch-wire.json and adapters-fetch-wire.test.ts.
+/** Exact Deno releases permitted for Fetch wire verification. */
 export const FETCH_VERIFICATION_RUNTIMES = Object.freeze([
     "deno:2.5.6",
 ]);

package/dist/adapters/node-http/index.d.ts

@@ -6,6 +6,7 @@ export type { WebBotAuthVerification } from "../../web-bot-auth/verification.ts"
 import type { Verification } from "../../verification.ts";
 import { type Context } from "../../context.ts";
 import { type Result } from "../../result.ts";
+/** Lossless incoming Node HTTP method, target, field, and transport facts. */
 export type Ingress = Readonly<{
     evidence: "observed";
     httpVersion: string;
@@ -19,6 +20,7 @@ export type Ingress = Readonly<{
     scheme: string;
     declaredScheme: string | null;
 }>;
+/** Branded Node request capture with owned body bytes and replay access. */
 export type Capture = Readonly<{
     message: HttpMessage;
     ingress: Ingress;
@@ -27,44 +29,65 @@ export type Capture = Readonly<{
         authority: string;
         source: "connection" | "forwarded";
     }>;
+    /** Open a fresh readable stream over the retained request body. */
     replay: () => Result<Readable>;
 }>;
+/** Captured request bytes accompanied by a single-signature verification. */
 export type VerifiedRequest = Readonly<{
     capture: Capture;
     verification: Verification;
     bytes: Uint8Array;
 }>;
+/** Captured request bytes accompanied by a quorum verification. */
 export type VerifiedQuorumRequest = Readonly<{
     capture: Capture;
     verification: QuorumVerification;
     bytes: Uint8Array;
 }>;
+/** Captured request bytes accompanied by a Web Bot Auth verification. */
 export type VerifiedWebBotAuthRequest = Readonly<{
     capture: Capture;
     verification: WebBotAuthVerification;
     bytes: Uint8Array;
 }>;
+/** A signed Node client response with owned bytes and optional verification. */
 export type ClientResponse = Readonly<{
     request: HttpMessage;
     message: HttpMessage;
     status: number;
     bytes: Uint8Array;
 }>;
+/** Capture and retain a Node incoming request before body parsing. */
 export declare function captureRequest(req: unknown, options?: unknown): Promise<Result<Capture>>;
+/**
+ * Install early Node request capture on a server with explicit limits.
+ *
+ * Options are `maxBytes`, `timeoutMs` (1 to 300,000 ms, default 5,000), and
+ * `trustedProxies`. Each request is captured under its own fresh `timeoutMs` deadline.
+ * A `context` is refused with `invalid_options`: one Context is one absolute deadline,
+ * and the registration outlives it.
+ */
 export declare function capture(server: unknown, options?: unknown): Result<Readonly<{
+    /** Close this capability and release its retained state. */
     close: () => Result<true>;
 }>>;
+/** Return a defensive copy of captured Node request body bytes. */
 export declare function captureBody(req: unknown, bytes: unknown, options?: unknown): Result<Capture>;
+/** Verify a captured Node request once and retain its verification result. */
 export declare function verifyRequest(req: unknown, policy: unknown, options: unknown): Promise<Result<VerifiedRequest>>;
 /** Composite verification over the same captured facts. */
 export declare function verifyQuorum(req: unknown, quorum: unknown, options?: unknown): Promise<Result<VerifiedQuorumRequest>>;
 /** Web Bot Auth verification over the same captured facts and shared attempt. */
 export declare function verifyWebBotAuth(req: unknown, policy: unknown, options?: unknown): Promise<Result<VerifiedWebBotAuthRequest>>;
+/** Read the verification result associated with a captured Node request. */
 export declare function verification(req: unknown): Result<Verification | QuorumVerification | WebBotAuthVerification>;
+/** Sign and write a Node HTTP response using retained body bytes. */
 export declare function signResponse(res: unknown, input: unknown, signer: unknown, options?: unknown): Promise<Result<HttpMessage>>;
+/** Verify a retained Node client response against its related request. */
 export declare function verifyResponse(response: unknown, request: unknown, policy: unknown, options: unknown): Promise<Result<Readonly<{
     message: HttpMessage;
     verification: Verification;
     bytes: Uint8Array;
 }>>>;
+/** Send a signed Node HTTP request with explicit redirect and response policies. */
 export declare function signedRequest(options: unknown, input: unknown, signer: unknown, ctx?: Context): Promise<Result<ClientResponse>>;

package/dist/adapters/node-http/index.js

@@ -12,7 +12,8 @@ import { verifyWebBotAuth as coreVerifyWebBotAuth } from "../../web-bot-auth/ver
 import { parseAddress } from "../../discovery/address.js";
 import { isPolicy } from "../../policy.js";
 import { isAcceptSignature } from "../../accept-signature.js";
-import { run } from "../../context.js";
+import { run, withDeadline } from "../../context.js";
+import { timeoutMs as validTimeout } from "../../numbers.js";
 import { err, ok } from "../../result.js";
 import { MESSAGE_MAX_FIELD_BYTES, MESSAGE_MAX_FIELDS_BYTES, MESSAGE_MAX_OCCURRENCES, } from "../../constants.js";
 import * as S from "../support.js";
@@ -20,7 +21,6 @@ import { deepFreeze } from "../../brand.js";
 const captures = new WeakMap();
 const states = new WeakMap();
 const branded = new WeakSet();
-const verified = new WeakSet();
 const clientResponses = new WeakSet();
 const registrations = new WeakSet();
 function pairs(raw, section, h2) {
@@ -385,6 +385,7 @@ function prepare(req, a, bytes, metadata) {
     });
     return capture;
 }
+/** Capture and retain a Node incoming request before body parsing. */
 export async function captureRequest(req, options = {}) {
     try {
         S.need(req instanceof IncomingMessage || req instanceof Http2ServerRequest, "node-http", "capture", "invalid_request");
@@ -428,11 +429,26 @@ export async function captureRequest(req, options = {}) {
         return S.caught(e, "node-http", "capture", "invalid_options");
     }
 }
+/**
+ * Install early Node request capture on a server with explicit limits.
+ *
+ * Options are `maxBytes`, `timeoutMs` (1 to 300,000 ms, default 5,000), and
+ * `trustedProxies`. Each request is captured under its own fresh `timeoutMs` deadline.
+ * A `context` is refused with `invalid_options`: one Context is one absolute deadline,
+ * and the registration outlives it.
+ */
 export function capture(server, options = {}) {
     try {
-        const a = captureOptions(options, ["maxBytes", "context", "trustedProxies"], "attach");
+        // A Context is one absolute deadline, so a registration that outlives it takes
+        // a per-request timeoutMs instead; each request gets its own fresh deadline.
+        const a = captureOptions(options, ["maxBytes", "timeoutMs", "trustedProxies"], "attach");
         S.maximum(a, "node-http", "attach");
-        S.context(a, "node-http", "attach");
+        const timeout = validTimeout(Object.hasOwn(a, "timeoutMs") ? a.timeoutMs : 5000);
+        S.need(timeout.ok, "node-http", "attach", "invalid_options");
+        const perRequest = Object.create(null);
+        for (const key of ["maxBytes", "trustedProxies"])
+            if (Object.hasOwn(a, key))
+                perRequest[key] = a[key];
         S.need(server !== null &&
             typeof server === "object" &&
             "prependListener" in server &&
@@ -440,7 +456,8 @@ export function capture(server, options = {}) {
             "removeListener" in server &&
             typeof server.removeListener === "function", "node-http", "attach", "invalid_options");
         const listener = (req) => {
-            void captureRequest(req, a);
+            const context = withDeadline({ timeoutMs: timeout.ok ? timeout.value : 5000 });
+            void captureRequest(req, context.ok ? Object.freeze({ ...perRequest, context: context.value }) : perRequest);
         };
         server.prependListener("request", listener);
         const close = () => {
@@ -460,6 +477,7 @@ export function capture(server, options = {}) {
         return S.caught(e, "node-http", "attach", "invalid_options");
     }
 }
+/** Return a defensive copy of captured Node request body bytes. */
 export function captureBody(req, bytes, options = {}) {
     try {
         S.need(req instanceof IncomingMessage || req instanceof Http2ServerRequest, "node-http", "capture", "invalid_request");
@@ -491,6 +509,7 @@ function beginVerification(req, c) {
     state.verified = err(S.failure("node-http", "verify", "already_verified"));
     return state;
 }
+/** Verify a captured Node request once and retain its verification result. */
 export async function verifyRequest(req, policy, options) {
     try {
         const a = S.take(options, ["label", "context", "representation", "digestState"], "node-http", "verify");
@@ -512,7 +531,6 @@ export async function verifyRequest(req, policy, options) {
                 return new Uint8Array(bytes);
             },
         });
-        verified.add(v);
         const result = ok(v);
         state.verified = result;
         return result;
@@ -546,7 +564,6 @@ export async function verifyQuorum(req, quorum, options = {}) {
                 return new Uint8Array(bytes);
             },
         });
-        verified.add(result);
         state.verified = ok(result);
         return ok(result);
     }
@@ -580,7 +597,6 @@ export async function verifyWebBotAuth(req, policy, options = {}) {
                 return new Uint8Array(bytes);
             },
         });
-        verified.add(result);
         state.verified = ok(result);
         return ok(result);
     }
@@ -588,6 +604,7 @@ export async function verifyWebBotAuth(req, policy, options = {}) {
         return S.caught(e, "node-http", "verify", "request_rejected");
     }
 }
+/** Read the verification result associated with a captured Node request. */
 export function verification(req) {
     const s = typeof req === "object" && req !== null
         ? states.get(req)
@@ -598,6 +615,7 @@ export function verification(req) {
             ? s.verified
             : err(S.failure("node-http", "verify", "not_captured"));
 }
+/** Sign and write a Node HTTP response using retained body bytes. */
 export async function signResponse(res, input, signer, options = {}) {
     let previousHeaders;
     let response;
@@ -684,6 +702,7 @@ export async function signResponse(res, input, signer, options = {}) {
         return S.caught(e, "node-http", "sign", "signing_failed");
     }
 }
+/** Verify a retained Node client response against its related request. */
 export async function verifyResponse(response, request, policy, options) {
     try {
         S.need(typeof response === "object" &&
@@ -770,6 +789,7 @@ async function send(url, m, body, a, c, attempt) {
         req.end(body);
     }));
 }
+/** Send a signed Node HTTP request with explicit redirect and response policies. */
 export async function signedRequest(options, input, signer, ctx) {
     let attempt = 0;
     try {

package/dist/brand.d.ts

@@ -1,4 +1,9 @@
 import { type Result } from './result.ts';
+/** Node and Deno inspection that shows only `view()`. Deno passes a render callback
+ * and prints the string it returns; Node formats the returned object itself. */
+export declare function inspection(view: () => unknown): PropertyDescriptorMap;
+/** Deno.customInspect body: render the redacted view through Deno's callback when given. */
+export declare function denoInspection(render: unknown, view: unknown): unknown;
 /** Snapshot plain data, then freeze the owned structures. Uint8Array copies remain mutable:
  * JavaScript cannot freeze nonempty typed arrays; caller buffers are never retained.
  * Accessors and other object types reject without being invoked or frozen.

package/dist/brand.js

@@ -1,5 +1,17 @@
 import { err, ok } from './result.js';
 import { coreError } from './errors/types.js';
+/** Node and Deno inspection that shows only `view()`. Deno passes a render callback
+ * and prints the string it returns; Node formats the returned object itself. */
+export function inspection(view) {
+    return {
+        [Symbol.for('nodejs.util.inspect.custom')]: { value: view },
+        [Symbol.for('Deno.customInspect')]: { value: (render) => denoInspection(render, view()) },
+    };
+}
+/** Deno.customInspect body: render the redacted view through Deno's callback when given. */
+export function denoInspection(render, view) {
+    return typeof render === 'function' ? render(view) : view;
+}
 /** Snapshot plain data, then freeze the owned structures. Uint8Array copies remain mutable:
  * JavaScript cannot freeze nonempty typed arrays; caller buffers are never retained.
  * Accessors and other object types reject without being invoked or frozen.

package/dist/bytes.d.ts

@@ -1,7 +1,11 @@
 import { type Result } from './result.ts';
 /** Fetch ByteString: every UTF-16 code unit represents one octet. Always copied. */
 export declare function byteString(input: unknown): Result<Uint8Array<ArrayBuffer>>;
+/** Encode bytes using the padded standard Base64 alphabet. */
 export declare const encodeBase64: (bytes: Uint8Array) => string;
+/** Encode bytes using the unpadded URL-safe Base64 alphabet. */
 export declare const encodeBase64Url: (bytes: Uint8Array) => string;
+/** Decode canonical padded Base64 into owned bytes. */
 export declare const decodeBase64: (input: unknown) => Result<Uint8Array<ArrayBuffer>>;
+/** Decode canonical unpadded Base64url into owned bytes. */
 export declare const decodeBase64Url: (input: unknown) => Result<Uint8Array<ArrayBuffer>>;

package/dist/bytes.js

@@ -11,6 +11,7 @@ export function byteString(input) {
         const bytes = new Uint8Array(input.length);
         for (let i = 0; i < input.length; i++) {
             const code = input.charCodeAt(i);
+            // boundedData in crypto/primitive.ts checks the same rule before copying.
             if (code > 255)
                 return err(messageError('invalid_message'));
             bytes[i] = code;
@@ -39,7 +40,9 @@ function encode(bytes, url) {
     }
     return out.join('');
 }
+/** Encode bytes using the padded standard Base64 alphabet. */
 export const encodeBase64 = (bytes) => encode(bytes, false);
+/** Encode bytes using the unpadded URL-safe Base64 alphabet. */
 export const encodeBase64Url = (bytes) => encode(bytes, true);
 function decode(input, url) {
     const invalid = () => err(joseError('invalid_base64', 'input'));
@@ -67,5 +70,7 @@ function decode(input, url) {
         return invalid();
     return ok(bytes);
 }
+/** Decode canonical padded Base64 into owned bytes. */
 export const decodeBase64 = (input) => decode(input, false);
+/** Decode canonical unpadded Base64url into owned bytes. */
 export const decodeBase64Url = (input) => decode(input, true);

package/dist/constants.d.ts

@@ -1,9 +1,12 @@
-export declare const VERSION = "0.1.0";
+/** The public package version. */
+export declare const VERSION = "0.3.0";
+/** The immutable public conformance corpus release and index digest. */
 export declare const CORPUS_PIN: Readonly<{
-    tag: "v0.4.0";
-    commit: "b2392871933d99641a7cb2ca2726aefd20081dee";
-    indexSha256: "f37435eca377666ab45c2b8f580287263145268e03d9224c76e324e4afaded6f";
+    tag: "v0.5.2";
+    commit: "53b6690ccd5036d58b280d08cf0cacc6427262fe";
+    indexSha256: "ceb30bf713a6e34e6a15847b658a618d8f7568ee6a6c07bfbbf58fa5d143995e";
 }>;
+/** Default bounded Structured Fields parser limits. */
 export declare const STRUCTURED_FIELDS_LIMITS: Readonly<{
     maxBytes: 65536;
     maxMembers: 1024;
@@ -13,6 +16,7 @@ export declare const STRUCTURED_FIELDS_LIMITS: Readonly<{
     maxValueBytes: 16384;
     maxNodes: 4096;
 }>;
+/** Default bounded JSON parser limits. */
 export declare const JSON_LIMITS: Readonly<{
     maxBytes: 16384;
     maxDepth: 4;
@@ -20,53 +24,109 @@ export declare const JSON_LIMITS: Readonly<{
     maxArrayLength: 64;
     maxStringBytes: 16384;
 }>;
+/** Maximum compact JOSE wire bytes. */
 export declare const JOSE_MAX_COMPACT_BYTES = 1048576;
+/** Maximum JOSE plaintext bytes. */
 export declare const JOSE_MAX_PLAINTEXT_BYTES = 1048576;
+/** Default maximum retained body bytes. */
 export declare const BODY_MAX_BYTES = 1048576;
+/** Default maximum digest input bytes. */
 export declare const DIGEST_MAX_BYTES = 16777216;
+/** Fixed maximum cryptographic input byte limit. */
+export declare const CRYPTO_MAX_BYTES_CEILING = 16777216;
+/** Default cryptographic input byte limit. */
+export declare const CRYPTO_DEFAULT_MAX_BYTES = 1048576;
+/** Maximum signature-base bytes. */
 export declare const SIGNATURE_BASE_MAX_BYTES = 1048576;
+/** Maximum covered signature-base components. */
 export declare const SIGNATURE_BASE_MAX_COMPONENTS = 256;
+/** Maximum encoded signature or nonce bytes. */
 export declare const SIGNATURE_MAX_BYTES = 1024;
+/** Maximum raw HTTP target bytes. */
 export declare const MESSAGE_MAX_TARGET_BYTES = 16384;
+/** Maximum bytes in one HTTP field. */
 export declare const MESSAGE_MAX_FIELD_BYTES = 65536;
+/** Maximum total HTTP field bytes. */
 export declare const MESSAGE_MAX_FIELDS_BYTES = 1048576;
+/** Maximum quorum evaluation nodes. */
 export declare const QUORUM_MAX_NODES = 131072;
+/** Maximum signatures evaluated by a quorum. */
 export declare const QUORUM_MAX_SIGNATURES = 64;
+/** Default maximum discovery response bytes. */
 export declare const DISCOVERY_DEFAULT_MAX_BYTES = 65536;
+/** Fixed maximum discovery response bytes. */
 export declare const DISCOVERY_MAX_BYTES = 1048576;
+/** Maximum supported Unix timestamp in seconds. */
 export declare const CLOCK_MAX_SECONDS = 253402300799;
+/** Maximum operation timeout in milliseconds. */
 export declare const TIMEOUT_MAX_MS = 300000;
+/** Default operation timeout in milliseconds. */
 export declare const TIMEOUT_DEFAULT_MS = 5000;
+/** Maximum absolute Structured Fields integer value. */
 export declare const SF_MAX_INTEGER = 999999999999999;
+/** Maximum profile metadata members. */
 export declare const PROFILE_MAX_MEMBERS = 8;
+/** Maximum profile metadata value bytes. */
 export declare const PROFILE_MAX_VALUE_BYTES = 256;
+/** Maximum profile name or key code points. */
+export declare const PROFILE_MAX_ATOM_CODE_POINTS = 255;
+/** Maximum explicitly permitted discovery addresses. */
 export declare const DISCOVERY_MAX_PERMITTED_ADDRESSES = 16;
+/** Fixed maximum discovery keys per source. */
 export declare const DISCOVERY_MAX_KEYS = 256;
+/** Default maximum discovery keys per source. */
 export declare const DISCOVERY_DEFAULT_MAX_KEYS = 32;
+/** Maximum discovery redirect hops. */
 export declare const DISCOVERY_MAX_REDIRECTS = 3;
+/** Maximum discovery cache lifetime in seconds. */
 export declare const DISCOVERY_MAX_TTL_SECONDS = 604800;
+/** Maximum negative discovery cache lifetime in seconds. */
 export declare const DISCOVERY_MAX_NEGATIVE_TTL_SECONDS = 300;
+/** Maximum client metadata document bytes. */
 export declare const DISCOVERY_CIMD_MAX_BYTES = 5120;
+/** Maximum encoded key container bytes. */
 export declare const KEY_MAX_BYTES = 16384;
+/** Maximum key container members. */
 export declare const KEY_MAX_MEMBERS = 32;
+/** Maximum encoded public key component bytes. */
 export declare const KEY_COMPONENT_MAX_ENCODED_BYTES = 21846;
+/** Maximum encoded RSA component bytes. */
 export declare const RSA_COMPONENT_MAX_ENCODED_BYTES = 1366;
+/** Minimum permitted RSA modulus bits. */
 export declare const RSA_MIN_BITS = 2048;
+/** Maximum permitted RSA modulus bits. */
 export declare const RSA_MAX_BITS = 8192;
+/** Maximum permitted RSA public exponent. */
 export declare const RSA_MAX_EXPONENT = 4294967295;
+/** Maximum caller-supplied key identity bytes. */
 export declare const KEY_IDENTITY_MAX_BYTES = 256;
+/** Minimum HMAC secret bytes. */
 export declare const HMAC_MIN_BYTES = 32;
+/** Maximum HMAC secret bytes. */
 export declare const HMAC_MAX_BYTES = 16384;
+/** Maximum DER container nesting depth. */
 export declare const DER_MAX_DEPTH = 32;
+/** Maximum DER traversal nodes. */
 export declare const DER_MAX_NODES = 4096;
+/** Maximum JWK algorithm identifier bytes. */
 export declare const JWK_ALGORITHM_MAX_BYTES = 64;
+/** Maximum JWK operation identifiers. */
 export declare const JWK_MAX_OPERATIONS = 8;
+/** Maximum custody signature bytes. */
 export declare const CUSTODY_SIGNATURE_MAX_BYTES = 16384;
+/** Maximum combined HTTP header and trailer occurrences. */
 export declare const MESSAGE_MAX_OCCURRENCES = 1024;
+/** Maximum HTTP method or field-name bytes. */
 export declare const MESSAGE_MAX_TOKEN_BYTES = 256;
+/** Maximum HTTP scheme bytes. */
 export declare const MESSAGE_MAX_SCHEME_BYTES = 64;
+/** Maximum HTTP authority bytes. */
 export declare const MESSAGE_MAX_AUTHORITY_BYTES = 1024;
+/** Maximum combined HTTP URL bytes. */
 export declare const MESSAGE_MAX_URL_BYTES: number;
+/** Default maximum signature dictionary members. */
 export declare const SIGNATURE_DEFAULT_MAX_MEMBERS = 16;
+/** Maximum freshness clock skew in seconds. */
 export declare const FRESHNESS_MAX_SKEW_SECONDS = 86400;
+/** Random nonce bytes generated during signing. */
 export declare const SIGNING_NONCE_BYTES = 32;