@marcuspuchalla/nachos 0.1.1 → 0.1.4

package/dist/{chunk-2HBCILJS.cjs → chunk-RVG2BY32.cjs}

@@ -4,6 +4,15 @@ var chunkPD72MVTX_cjs = require('./chunk-PD72MVTX.cjs');
 
 // src/parser/utils.ts
 var hexToBytes = (hex) => {
+  if (hex.length === 0) {
+    return new Uint8Array(0);
+  }
+  if (hex.length % 2 !== 0) {
+    throw new Error("Hex string must have even length");
+  }
+  if (!/^[0-9a-fA-F]+$/.test(hex)) {
+    throw new Error(`Invalid hex character in: ${hex}`);
+  }
   const bytes = hex.match(/.{1,2}/g);
   if (!bytes) return new Uint8Array(0);
   return new Uint8Array(bytes.map((byte) => parseInt(byte, 16)));
@@ -235,9 +244,8 @@ function hasDuplicates(items) {
 
 // src/parser/composables/useCborInteger.ts
 function useCborInteger() {
-  const parseInteger = (hexString, options) => {
-    const buffer = hexToBytes(hexString);
-    const initialByte = readByte(buffer, 0);
+  const parseIntegerFromBuffer = (buffer, offset, options) => {
+    const initialByte = readByte(buffer, offset);
     const { majorType, additionalInfo } = extractCborHeader(initialByte);
     let rawValue;
     let bytesRead;
@@ -245,16 +253,16 @@ function useCborInteger() {
       rawValue = additionalInfo;
       bytesRead = 1;
     } else if (additionalInfo === 24) {
-      rawValue = readByte(buffer, 1);
+      rawValue = readByte(buffer, offset + 1);
       bytesRead = 2;
     } else if (additionalInfo === 25) {
-      rawValue = readUint(buffer, 1, 2);
+      rawValue = readUint(buffer, offset + 1, 2);
       bytesRead = 3;
     } else if (additionalInfo === 26) {
-      rawValue = readUint(buffer, 1, 4);
+      rawValue = readUint(buffer, offset + 1, 4);
       bytesRead = 5;
     } else if (additionalInfo === 27) {
-      const bigValue = readBigUint(buffer, 1, 8);
+      const bigValue = readBigUint(buffer, offset + 1, 8);
       if (bigValue <= BigInt(Number.MAX_SAFE_INTEGER)) {
         rawValue = Number(bigValue);
       } else {
@@ -294,8 +302,13 @@ function useCborInteger() {
       bytesRead
     };
   };
+  const parseInteger = (hexString, options) => {
+    const buffer = hexToBytes(hexString);
+    return parseIntegerFromBuffer(buffer, 0, options);
+  };
   return {
-    parseInteger
+    parseInteger,
+    parseIntegerFromBuffer
   };
 }
 
@@ -363,6 +376,14 @@ function useCborString() {
           currentOffset++;
           break;
         }
+        const chunkInitialByte = readByte(buffer, currentOffset);
+        const chunkHeader = extractCborHeader(chunkInitialByte);
+        if (chunkHeader.majorType !== 2) {
+          throw new Error(`Indefinite byte string chunks must be byte strings (major type 2), got ${chunkHeader.majorType}`);
+        }
+        if (chunkHeader.additionalInfo === 31) {
+          throw new Error("Indefinite byte string chunks must be definite-length (RFC 8949 Section 3.2.3)");
+        }
         let chunkResult;
         try {
           chunkResult = parseByteString(buffer, currentOffset, options);
@@ -426,6 +447,14 @@ function useCborString() {
           currentOffset++;
           break;
         }
+        const chunkInitialByte = readByte(buffer, currentOffset);
+        const chunkHeader = extractCborHeader(chunkInitialByte);
+        if (chunkHeader.majorType !== 3) {
+          throw new Error(`Indefinite text string chunks must be text strings (major type 3), got ${chunkHeader.majorType}`);
+        }
+        if (chunkHeader.additionalInfo === 31) {
+          throw new Error("Indefinite text string chunks must be definite-length (RFC 8949 Section 3.2.3)");
+        }
         let chunkResult;
         try {
           chunkResult = parseTextString(buffer, currentOffset, options);
@@ -508,6 +537,45 @@ function useCborFloat() {
     }
     return (sign === 0 ? 1 : -1) * Math.pow(2, exponent - 15) * (1 + fraction / 1024);
   };
+  const fitsInFloat16 = (value) => {
+    if (Number.isNaN(value) || value === Infinity || value === -Infinity) return true;
+    if (Object.is(value, 0) || Object.is(value, -0)) return true;
+    const abs = Math.abs(value);
+    if (abs > 65504) return false;
+    if (abs < 5960464477539063e-23) return false;
+    const sign = value < 0 ? 1 : 0;
+    const buf = new ArrayBuffer(8);
+    const view = new DataView(buf);
+    view.setFloat64(0, abs, false);
+    const bits64 = view.getBigUint64(0, false);
+    const exp64 = Number(bits64 >> 52n & 0x7ffn) - 1023;
+    const mant64 = Number(bits64 & 0xfffffffffffffn);
+    let exp16;
+    let mant16;
+    if (exp64 < -14) {
+      exp16 = 0;
+      const shift = -14 - exp64;
+      mant16 = (1 << 10 | mant64 >> 42) >> shift;
+    } else if (exp64 > 15) {
+      return false;
+    } else {
+      exp16 = exp64 + 15;
+      mant16 = mant64 >> 42;
+    }
+    const float16Bits = sign << 15 | exp16 << 10 | mant16;
+    const s = (float16Bits & 32768) >> 15;
+    const e = (float16Bits & 31744) >> 10;
+    const f = float16Bits & 1023;
+    let reconstructed;
+    if (e === 0) {
+      reconstructed = (s === 0 ? 1 : -1) * Math.pow(2, -14) * (f / 1024);
+    } else if (e === 31) {
+      reconstructed = f === 0 ? s === 0 ? Infinity : -Infinity : NaN;
+    } else {
+      reconstructed = (s === 0 ? 1 : -1) * Math.pow(2, e - 15) * (1 + f / 1024);
+    }
+    return reconstructed === value;
+  };
   const parseSimpleFromBuffer = (buffer, offset) => {
     const initialByte = readByte(buffer, offset);
     const { majorType, additionalInfo } = extractCborHeader(initialByte);
@@ -558,7 +626,7 @@ function useCborFloat() {
         throw new Error(`Invalid additional info: ${additionalInfo}`);
     }
   };
-  const parseFloatFromBuffer = (buffer, offset) => {
+  const parseFloatFromBuffer = (buffer, offset, options) => {
     const initialByte = readByte(buffer, offset);
     const { majorType, additionalInfo } = extractCborHeader(initialByte);
     if (majorType !== 7) {
@@ -569,6 +637,16 @@ function useCborFloat() {
         if (offset + 2 >= buffer.length) {
           throw new Error("Unexpected end of buffer while reading Float16");
         }
+        if (options?.validateCanonical) {
+          const byte1 = readByte(buffer, offset + 1);
+          const byte2 = readByte(buffer, offset + 2);
+          const bits = byte1 << 8 | byte2;
+          const exp = bits >> 10 & 31;
+          const mant = bits & 1023;
+          if (exp === 31 && mant !== 0 && bits !== 32256) {
+            throw new Error("Non-canonical NaN encoding: use 0xf97e00");
+          }
+        }
         const value = float16ToFloat64(buffer, offset + 1);
         return { value, bytesRead: 3 };
       }
@@ -578,6 +656,14 @@ function useCborFloat() {
         }
         const dataView = new DataView(buffer.buffer, buffer.byteOffset + offset + 1, 4);
         const value = dataView.getFloat32(0, false);
+        if (options?.validateCanonical) {
+          if (Number.isNaN(value)) {
+            throw new Error("Non-canonical NaN encoding: NaN must use float16 0xf97e00");
+          }
+          if (fitsInFloat16(value)) {
+            throw new Error("Non-canonical float32: value fits in float16, use shortest encoding");
+          }
+        }
         return { value, bytesRead: 5 };
       }
       case 27: {
@@ -586,20 +672,32 @@ function useCborFloat() {
         }
         const dataView = new DataView(buffer.buffer, buffer.byteOffset + offset + 1, 8);
         const value = dataView.getFloat64(0, false);
+        if (options?.validateCanonical) {
+          if (Number.isNaN(value)) {
+            throw new Error("Non-canonical NaN encoding: NaN must use float16 0xf97e00");
+          }
+          if (fitsInFloat16(value)) {
+            throw new Error("Non-canonical float64: value fits in float16/float32, use shortest encoding");
+          }
+          const f32 = Math.fround(value);
+          if (f32 === value || Object.is(value, -0) && Object.is(f32, -0)) {
+            throw new Error("Non-canonical float64: value fits in float16/float32, use shortest encoding");
+          }
+        }
         return { value, bytesRead: 9 };
       }
       default:
         throw new Error(`Additional info ${additionalInfo} is not a float type`);
     }
   };
-  const parseFromBuffer = (buffer, offset) => {
+  const parseFromBuffer = (buffer, offset, options) => {
     const initialByte = readByte(buffer, offset);
     const { majorType, additionalInfo } = extractCborHeader(initialByte);
     if (majorType !== 7) {
       throw new Error(`Expected major type 7 (simple/float), got ${majorType}`);
     }
     if (additionalInfo === 25 || additionalInfo === 26 || additionalInfo === 27) {
-      return parseFloatFromBuffer(buffer, offset);
+      return parseFloatFromBuffer(buffer, offset, options);
     } else {
       return parseSimpleFromBuffer(buffer, offset);
     }
@@ -608,70 +706,75 @@ function useCborFloat() {
     const buffer = hexToBytes(hexString);
     return parseSimpleFromBuffer(buffer, 0);
   };
-  const parseFloat = (hexString, _options) => {
+  const parseFloat = (hexString, options) => {
     const buffer = hexToBytes(hexString);
-    return parseFloatFromBuffer(buffer, 0);
+    return parseFloatFromBuffer(buffer, 0, options);
   };
-  const parse = (hexString, _options) => {
+  const parse = (hexString, options) => {
     const buffer = hexToBytes(hexString);
-    return parseFromBuffer(buffer, 0);
+    return parseFromBuffer(buffer, 0, options);
   };
   return {
     parse,
     parseFloat,
-    parseSimple
+    parseSimple,
+    parseFromBuffer
   };
 }
 
 // src/parser/composables/useCborTag.ts
 function useCborTag() {
-  const { parseInteger } = useCborInteger();
+  const { parseIntegerFromBuffer } = useCborInteger();
   const { parseByteString, parseTextString } = useCborString();
-  const { parseFloat, parseSimple } = useCborFloat();
-  const parseItem = (buffer, offset, options, tagDepth = 0) => {
+  const { parseFromBuffer: parseFloatOrSimpleFromBuffer } = useCborFloat();
+  let parseStartTime = 0;
+  const parseItem = (buffer, offset, options, tagDepth = 0, collectionDepth = 0) => {
+    if (parseStartTime > 0 && options?.limits?.maxParseTime) {
+      const elapsed = Date.now() - parseStartTime;
+      if (elapsed > options.limits.maxParseTime) {
+        throw new Error(`Parse timeout: exceeded ${options.limits.maxParseTime}ms limit`);
+      }
+    }
     if (offset >= buffer.length) {
       throw new Error(`Unexpected end of buffer at offset ${offset}`);
     }
     const initialByte = readByte(buffer, offset);
-    const { majorType, additionalInfo } = extractCborHeader(initialByte);
+    const { majorType } = extractCborHeader(initialByte);
     switch (majorType) {
       case 0:
       // Unsigned integer
-      case 1: {
-        const intHex = Array.from(buffer.slice(offset)).map((b) => b.toString(16).padStart(2, "0")).join("");
-        const result = parseInteger(intHex, options);
-        return { value: result.value, bytesRead: result.bytesRead };
-      }
+      case 1:
+        return parseIntegerFromBuffer(buffer, offset, options);
       case 2:
         return parseByteString(buffer, offset, options);
       case 3:
         return parseTextString(buffer, offset, options);
       case 4:
-        return parseArrayInternal(buffer, offset, options);
+        return parseArrayInternal(buffer, offset, options, collectionDepth);
       case 5:
-        return parseMapInternal(buffer, offset, options);
+        return parseMapInternal(buffer, offset, options, collectionDepth);
       case 6:
         return parseTagFromBuffer(buffer, offset, options, tagDepth);
-      case 7: {
-        const simpleHex = Array.from(buffer.slice(offset)).map((b) => b.toString(16).padStart(2, "0")).join("");
-        if (additionalInfo >= 25 && additionalInfo <= 27) {
-          const result = parseFloat(simpleHex, options);
-          return { value: result.value, bytesRead: result.bytesRead };
-        } else {
-          const result = parseSimple(simpleHex, options);
-          return { value: result.value, bytesRead: result.bytesRead };
-        }
-      }
+      case 7:
+        return parseFloatOrSimpleFromBuffer(buffer, offset, options);
       default:
         throw new Error(`Unknown major type: ${majorType}`);
     }
   };
-  const parseArrayInternal = (buffer, offset, options) => {
+  const parseArrayInternal = (buffer, offset, options, depth = 0) => {
     const initialByte = readByte(buffer, offset);
     const { majorType, additionalInfo } = extractCborHeader(initialByte);
     if (majorType !== 4) {
       throw new Error(`Expected major type 4 (array), got ${majorType}`);
     }
+    const isIndefiniteAllowed = options?.allowIndefinite ?? !(options?.validateCanonical || options?.strict);
+    if (additionalInfo === 31 && !isIndefiniteAllowed) {
+      throw new Error("Indefinite-length encoding is not allowed (strict/canonical mode)");
+    }
+    const maxDepth = options?.limits?.maxDepth ?? chunkPD72MVTX_cjs.DEFAULT_LIMITS.maxDepth;
+    if (depth >= maxDepth) {
+      throw new Error(`Maximum nesting depth ${maxDepth} exceeded`);
+    }
     let length;
     let bytesConsumed;
     if (additionalInfo < 24) {
@@ -699,23 +802,39 @@ function useCborTag() {
     } else {
       throw new Error(`Invalid additional info for array: ${additionalInfo}`);
     }
+    if (length !== null && options?.limits?.maxArrayLength && length > options.limits.maxArrayLength) {
+      throw new Error(`Array length ${length} exceeds limit of ${options.limits.maxArrayLength}`);
+    }
     let currentOffset = offset + 1 + bytesConsumed;
     const items = [];
     if (length === null) {
+      let index = 0;
+      let foundBreak = false;
       while (currentOffset < buffer.length) {
         const nextByte = readByte(buffer, currentOffset);
         if (nextByte === 255) {
           currentOffset++;
+          foundBreak = true;
           break;
         }
-        const itemResult = parseItem(buffer, currentOffset, options);
+        if (options?.limits?.maxArrayLength && index >= options.limits.maxArrayLength) {
+          throw new Error(`Array length exceeds limit of ${options.limits.maxArrayLength}`);
+        }
+        const itemResult = parseItem(buffer, currentOffset, options, 0, depth + 1);
         items.push(itemResult.value);
         currentOffset += itemResult.bytesRead;
+        index++;
+      }
+      if (!foundBreak) {
+        throw new Error("Indefinite-length array missing break code (0xFF)");
       }
       items[chunkPD72MVTX_cjs.INDEFINITE_SYMBOL] = true;
     } else {
       for (let i = 0; i < length; i++) {
-        const itemResult = parseItem(buffer, currentOffset, options);
+        if (currentOffset >= buffer.length) {
+          throw new Error(`Unexpected end of buffer while parsing array element ${i}/${length}`);
+        }
+        const itemResult = parseItem(buffer, currentOffset, options, 0, depth + 1);
         items.push(itemResult.value);
         currentOffset += itemResult.bytesRead;
       }
@@ -725,12 +844,20 @@ function useCborTag() {
       bytesRead: currentOffset - offset
     };
   };
-  const parseMapInternal = (buffer, offset, options) => {
+  const parseMapInternal = (buffer, offset, options, depth = 0) => {
     const initialByte = readByte(buffer, offset);
     const { majorType, additionalInfo } = extractCborHeader(initialByte);
     if (majorType !== 5) {
       throw new Error(`Expected major type 5 (map), got ${majorType}`);
     }
+    const isIndefiniteAllowed = options?.allowIndefinite ?? !(options?.validateCanonical || options?.strict);
+    if (additionalInfo === 31 && !isIndefiniteAllowed) {
+      throw new Error("Indefinite-length encoding is not allowed (strict/canonical mode)");
+    }
+    const maxDepth = options?.limits?.maxDepth ?? chunkPD72MVTX_cjs.DEFAULT_LIMITS.maxDepth;
+    if (depth >= maxDepth) {
+      throw new Error(`Maximum nesting depth ${maxDepth} exceeded`);
+    }
     let length;
     let bytesConsumed;
     if (additionalInfo < 24) {
@@ -758,27 +885,43 @@ function useCborTag() {
     } else {
       throw new Error(`Invalid additional info for map: ${additionalInfo}`);
     }
+    if (length !== null && options?.limits?.maxMapSize && length > options.limits.maxMapSize) {
+      throw new Error(`Map size ${length} exceeds limit of ${options.limits.maxMapSize}`);
+    }
     let currentOffset = offset + 1 + bytesConsumed;
     const map = /* @__PURE__ */ new Map();
     if (length === null) {
+      let index = 0;
+      let foundBreak = false;
       while (currentOffset < buffer.length) {
         const nextByte = readByte(buffer, currentOffset);
         if (nextByte === 255) {
           currentOffset++;
+          foundBreak = true;
           break;
         }
-        const keyResult = parseItem(buffer, currentOffset, options);
+        if (options?.limits?.maxMapSize && index >= options.limits.maxMapSize) {
+          throw new Error(`Map size exceeds limit of ${options.limits.maxMapSize}`);
+        }
+        const keyResult = parseItem(buffer, currentOffset, options, 0, depth + 1);
         currentOffset += keyResult.bytesRead;
-        const valueResult = parseItem(buffer, currentOffset, options);
+        const valueResult = parseItem(buffer, currentOffset, options, 0, depth + 1);
         currentOffset += valueResult.bytesRead;
         map.set(keyResult.value, valueResult.value);
+        index++;
+      }
+      if (!foundBreak) {
+        throw new Error("Indefinite-length map missing break code (0xFF)");
       }
       map[chunkPD72MVTX_cjs.INDEFINITE_SYMBOL] = true;
     } else {
       for (let i = 0; i < length; i++) {
-        const keyResult = parseItem(buffer, currentOffset, options);
+        if (currentOffset >= buffer.length) {
+          throw new Error(`Unexpected end of buffer while parsing map entry ${i}/${length}`);
+        }
+        const keyResult = parseItem(buffer, currentOffset, options, 0, depth + 1);
         currentOffset += keyResult.bytesRead;
-        const valueResult = parseItem(buffer, currentOffset, options);
+        const valueResult = parseItem(buffer, currentOffset, options, 0, depth + 1);
         currentOffset += valueResult.bytesRead;
         map.set(keyResult.value, valueResult.value);
       }
@@ -828,6 +971,13 @@ function useCborTag() {
     }
     return false;
   };
+  const isByteString = (value) => {
+    if (value instanceof Uint8Array) return true;
+    if (value && typeof value === "object" && "type" in value && value.type === "cbor-byte-string") {
+      return true;
+    }
+    return false;
+  };
   const getTextStringValue = (value) => {
     if (typeof value === "string") return value;
     if (value && typeof value === "object" && "text" in value) {
@@ -854,6 +1004,14 @@ function useCborTag() {
           throw new Error(`Tag 1 (epoch time) must contain a number (integer or float), got ${typeof value}`);
         }
         break;
+      case 2:
+      // Positive bignum
+      case 3:
+        if (!shouldValidateStandard) break;
+        if (!isByteString(value)) {
+          throw new Error(`Tag ${tagNumber} (bignum) must contain a byte string, got ${typeof value}`);
+        }
+        break;
       case 4:
         if (!shouldValidateStandard) break;
         if (!Array.isArray(value)) {
@@ -862,11 +1020,11 @@ function useCborTag() {
         if (value.length !== 2) {
           throw new Error(`Tag 4 (decimal fraction) array must have exactly 2 elements [exponent, mantissa], got ${value.length}`);
         }
-        if (typeof value[0] !== "number" && typeof value[0] !== "bigint") {
-          throw new Error(`Tag 4 (decimal fraction) exponent must be an integer, got ${typeof value[0]}`);
+        if (typeof value[0] !== "number" && typeof value[0] !== "bigint" || typeof value[0] === "number" && !Number.isInteger(value[0])) {
+          throw new Error(`Tag 4 (decimal fraction) exponent must be an integer, got ${value[0]}`);
         }
-        if (typeof value[1] !== "number" && typeof value[1] !== "bigint") {
-          throw new Error(`Tag 4 (decimal fraction) mantissa must be an integer, got ${typeof value[1]}`);
+        if (typeof value[1] !== "number" && typeof value[1] !== "bigint" || typeof value[1] === "number" && !Number.isInteger(value[1])) {
+          throw new Error(`Tag 4 (decimal fraction) mantissa must be an integer, got ${value[1]}`);
         }
         break;
       case 5:
@@ -877,11 +1035,11 @@ function useCborTag() {
         if (value.length !== 2) {
           throw new Error(`Tag 5 (bigfloat) array must have exactly 2 elements [exponent, mantissa], got ${value.length}`);
         }
-        if (typeof value[0] !== "number" && typeof value[0] !== "bigint") {
-          throw new Error(`Tag 5 (bigfloat) exponent must be an integer, got ${typeof value[0]}`);
+        if (typeof value[0] !== "number" && typeof value[0] !== "bigint" || typeof value[0] === "number" && !Number.isInteger(value[0])) {
+          throw new Error(`Tag 5 (bigfloat) exponent must be an integer, got ${value[0]}`);
         }
-        if (typeof value[1] !== "number" && typeof value[1] !== "bigint") {
-          throw new Error(`Tag 5 (bigfloat) mantissa must be an integer, got ${typeof value[1]}`);
+        if (typeof value[1] !== "number" && typeof value[1] !== "bigint" || typeof value[1] === "number" && !Number.isInteger(value[1])) {
+          throw new Error(`Tag 5 (bigfloat) mantissa must be an integer, got ${value[1]}`);
         }
         break;
       case 32:
@@ -1041,7 +1199,7 @@ function useCborTag() {
     if (majorType !== 6) {
       throw new Error(`Expected major type 6 (tag), got ${majorType}`);
     }
-    const maxTagDepth = options?.limits?.maxTagDepth ?? 64;
+    const maxTagDepth = options?.limits?.maxTagDepth ?? chunkPD72MVTX_cjs.DEFAULT_LIMITS.maxTagDepth;
     if (tagDepth >= maxTagDepth) {
       throw new Error(`Tag nesting depth ${tagDepth} exceeds limit of ${maxTagDepth}`);
     }
@@ -1085,12 +1243,25 @@ function useCborTag() {
   const parseTag = (hexString, options) => {
     const cleanHex = hexString.replace(/\s+/g, "");
     const buffer = hexToBytes(cleanHex);
-    return parseTagFromBuffer(buffer, 0, options);
+    const isTopLevel = parseStartTime === 0;
+    if (isTopLevel && options?.limits?.maxParseTime) {
+      parseStartTime = Date.now();
+    }
+    try {
+      return parseTagFromBuffer(buffer, 0, options);
+    } finally {
+      if (isTopLevel) {
+        parseStartTime = 0;
+      }
+    }
   };
   const parse = parseTag;
   return {
     parseTag,
-    parse
+    parse,
+    parseTagFromBuffer,
+    validateTagSemantics,
+    decodePlutusConstructor
   };
 }
 
@@ -1149,17 +1320,18 @@ var logger = {
 
 // src/parser/composables/useCborCollection.ts
 function useCborCollection() {
-  const { parseInteger } = useCborInteger();
+  const { parseIntegerFromBuffer } = useCborInteger();
   const { parseByteString, parseTextString } = useCborString();
-  const { parse: parseFloatOrSimple } = useCborFloat();
-  const { parseTag } = useCborTag();
-  const convertKeyToString = (key) => {
-    if (key instanceof Uint8Array) {
-      return bytesToHex(key);
-    }
-    return String(key);
-  };
+  const { parseFromBuffer: parseFloatOrSimpleFromBuffer } = useCborFloat();
+  const { parseTagFromBuffer } = useCborTag();
+  let parseStartTime = 0;
   const parseItem = (buffer, offset, options, depth = 0) => {
+    if (parseStartTime > 0 && options?.limits?.maxParseTime) {
+      const elapsed = Date.now() - parseStartTime;
+      if (elapsed > options.limits.maxParseTime) {
+        throw new Error(`Parse timeout: exceeded ${options.limits.maxParseTime}ms limit`);
+      }
+    }
     if (offset >= buffer.length) {
       throw new Error(`Unexpected end of buffer at offset ${offset}`);
     }
@@ -1168,11 +1340,8 @@ function useCborCollection() {
     switch (majorType) {
       case 0:
       // Unsigned integer
-      case 1: {
-        const intHex = Array.from(buffer.slice(offset)).map((b) => b.toString(16).padStart(2, "0")).join("");
-        const result = parseInteger(intHex, options);
-        return { value: result.value, bytesRead: result.bytesRead };
-      }
+      case 1:
+        return parseIntegerFromBuffer(buffer, offset, options);
       case 2:
         return parseByteString(buffer, offset, options);
       case 3:
@@ -1181,16 +1350,10 @@ function useCborCollection() {
         return parseArrayFromBuffer(buffer, offset, options, depth);
       case 5:
         return parseMapFromBuffer(buffer, offset, options, depth);
-      case 6: {
-        const tagHex = Array.from(buffer.slice(offset)).map((b) => b.toString(16).padStart(2, "0")).join("");
-        const result = parseTag(tagHex, options);
-        return { value: result.value, bytesRead: result.bytesRead };
-      }
-      case 7: {
-        const floatHex = Array.from(buffer.slice(offset)).map((b) => b.toString(16).padStart(2, "0")).join("");
-        const result = parseFloatOrSimple(floatHex, options);
-        return { value: result.value, bytesRead: result.bytesRead };
-      }
+      case 6:
+        return parseTagFromBuffer(buffer, offset, options);
+      case 7:
+        return parseFloatOrSimpleFromBuffer(buffer, offset, options);
       default:
         throw new Error(`Unknown major type: ${majorType}`);
     }
@@ -1332,7 +1495,7 @@ function useCborCollection() {
         }
         const valueResult = parseItem(buffer, currentOffset, options, depth + 1);
         currentOffset += valueResult.bytesRead;
-        const keyString = convertKeyToString(keyResult.value);
+        const keyString = serializeValueForComparison(keyResult.value);
         if (seenKeys.has(keyString)) {
           const mode = options?.dupMapKeyMode || "allow";
           if (mode === "reject") {
@@ -1370,7 +1533,7 @@ function useCborCollection() {
         }
         const valueResult = parseItem(buffer, currentOffset, options, depth + 1);
         currentOffset += valueResult.bytesRead;
-        const keyString = convertKeyToString(keyResult.value);
+        const keyString = serializeValueForComparison(keyResult.value);
         if (seenKeys.has(keyString)) {
           const mode = options?.dupMapKeyMode || "allow";
           if (mode === "reject") {
@@ -1410,12 +1573,26 @@ function useCborCollection() {
   const parseArray = (hexString, options) => {
     const cleanHex = hexString.replace(/\s+/g, "");
     const buffer = hexToBytes(cleanHex);
-    return parseArrayFromBuffer(buffer, 0, options, 0);
+    if (options?.limits?.maxParseTime) {
+      parseStartTime = Date.now();
+    }
+    try {
+      return parseArrayFromBuffer(buffer, 0, options, 0);
+    } finally {
+      parseStartTime = 0;
+    }
   };
   const parseMap = (hexString, options) => {
     const cleanHex = hexString.replace(/\s+/g, "");
     const buffer = hexToBytes(cleanHex);
-    return parseMapFromBuffer(buffer, 0, options, 0);
+    if (options?.limits?.maxParseTime) {
+      parseStartTime = Date.now();
+    }
+    try {
+      return parseMapFromBuffer(buffer, 0, options, 0);
+    } finally {
+      parseStartTime = 0;
+    }
   };
   return {
     parseArray,
@@ -1459,13 +1636,23 @@ function useCborParser() {
       throw new Error(`Parse timeout: exceeded ${ctx.options.limits.maxParseTime}ms limit (elapsed: ${elapsed}ms)`);
     }
   };
-  const { parseInteger } = useCborInteger();
-  const { parseString } = useCborString();
+  const { parseInteger, parseIntegerFromBuffer: integerFromBuffer } = useCborInteger();
+  const { parseString, parseByteString: byteStringFromBuffer, parseTextString: textStringFromBuffer } = useCborString();
   const { parseArray, parseMap } = useCborCollection();
-  const { parseTag } = useCborTag();
-  const { parse: parseFloatOrSimple } = useCborFloat();
-  const parse = (hexString, options) => {
-    const cleanHex = hexString.replace(/\s+/g, "");
+  const { parseTag, validateTagSemantics, decodePlutusConstructor } = useCborTag();
+  const { parse: parseFloatOrSimple, parseFromBuffer: floatOrSimpleFromBuffer } = useCborFloat();
+  const parse = (input, options) => {
+    const mergedOptions = mergeOptions(options);
+    if (input instanceof Uint8Array) {
+      if (input.length === 0) {
+        throw new Error("Empty input");
+      }
+      if (mergedOptions.limits?.maxInputSize && input.length > mergedOptions.limits.maxInputSize) {
+        throw new Error(`Input size ${input.length} bytes exceeds limit of ${mergedOptions.limits.maxInputSize} bytes`);
+      }
+      return dispatchFromBuffer(input, 0, mergedOptions);
+    }
+    const cleanHex = input.replace(/\s+/g, "");
     if (!cleanHex || cleanHex.length === 0) {
       throw new Error("Empty hex string");
     }
@@ -1475,7 +1662,6 @@ function useCborParser() {
     if (!/^[0-9a-fA-F]+$/.test(cleanHex)) {
       throw new Error(`Invalid hex character in: ${cleanHex}`);
     }
-    const mergedOptions = mergeOptions(options);
     const inputSize = cleanHex.length / 2;
     if (mergedOptions.limits?.maxInputSize && inputSize > mergedOptions.limits.maxInputSize) {
       throw new Error(`Input size ${inputSize} bytes exceeds limit of ${mergedOptions.limits.maxInputSize} bytes`);
@@ -1504,26 +1690,40 @@ function useCborParser() {
         throw new Error(`Unknown major type: ${majorType}`);
     }
   };
-  const parseWithSourceMap = (hexString, options) => {
-    const cleanHex = hexString.replace(/\s+/g, "");
-    if (!cleanHex || cleanHex.length === 0) {
-      throw new Error("Empty hex string");
-    }
-    if (cleanHex.length % 2 !== 0) {
-      throw new Error("Hex string must have even length");
-    }
-    if (!/^[0-9a-fA-F]+$/.test(cleanHex)) {
-      throw new Error(`Invalid hex character in: ${cleanHex}`);
-    }
+  const parseWithSourceMap = (input, options) => {
     const mergedOptions = mergeOptions(options);
-    const inputSize = cleanHex.length / 2;
-    if (mergedOptions.limits?.maxInputSize && inputSize > mergedOptions.limits.maxInputSize) {
-      throw new Error(`Input size ${inputSize} bytes exceeds limit of ${mergedOptions.limits.maxInputSize} bytes`);
+    let buffer;
+    if (input instanceof Uint8Array) {
+      if (input.length === 0) {
+        throw new Error("Empty input");
+      }
+      if (mergedOptions.limits?.maxInputSize && input.length > mergedOptions.limits.maxInputSize) {
+        throw new Error(`Input size ${input.length} bytes exceeds limit of ${mergedOptions.limits.maxInputSize} bytes`);
+      }
+      buffer = input;
+    } else {
+      const cleanHex = input.replace(/\s+/g, "");
+      if (!cleanHex || cleanHex.length === 0) {
+        throw new Error("Empty hex string");
+      }
+      if (cleanHex.length % 2 !== 0) {
+        throw new Error("Hex string must have even length");
+      }
+      if (!/^[0-9a-fA-F]+$/.test(cleanHex)) {
+        throw new Error(`Invalid hex character in: ${cleanHex}`);
+      }
+      const inputSize = cleanHex.length / 2;
+      if (mergedOptions.limits?.maxInputSize && inputSize > mergedOptions.limits.maxInputSize) {
+        throw new Error(`Input size ${inputSize} bytes exceeds limit of ${mergedOptions.limits.maxInputSize} bytes`);
+      }
+      buffer = hexToBytes(cleanHex);
     }
-    const buffer = hexToBytes(cleanHex);
     const sourceMap = [];
     const ctx = {
       buffer,
+      offset: 0,
+      sourceMap,
+      currentDepth: 0,
       startTime: Date.now(),
       bytesAllocated: 0,
       options: mergedOptions
@@ -1666,19 +1866,57 @@ function useCborParser() {
     }
     return result;
   };
+  const dispatchFromBuffer = (buffer, offset, options) => {
+    const initialByte = readByte(buffer, offset);
+    const { majorType } = extractCborHeader(initialByte);
+    switch (majorType) {
+      case 0:
+      // Unsigned integer
+      case 1:
+        return integerFromBuffer(buffer, offset, options);
+      case 2:
+        return byteStringFromBuffer(buffer, offset, options);
+      case 3:
+        return textStringFromBuffer(buffer, offset, options);
+      case 4: {
+        const hexString = Array.from(buffer.slice(offset)).map((b) => b.toString(16).padStart(2, "0")).join("");
+        return parseArray(hexString, options);
+      }
+      case 5: {
+        const hexString = Array.from(buffer.slice(offset)).map((b) => b.toString(16).padStart(2, "0")).join("");
+        return parseMap(hexString, options);
+      }
+      case 6: {
+        const hexString = Array.from(buffer.slice(offset)).map((b) => b.toString(16).padStart(2, "0")).join("");
+        return parseTag(hexString, options);
+      }
+      case 7:
+        return floatOrSimpleFromBuffer(buffer, offset, options);
+      default:
+        throw new Error(`Unknown major type: ${majorType}`);
+    }
+  };
   const parseIntegerFromBuffer = (buffer, offset, options) => {
-    const hexString = Array.from(buffer.slice(offset)).map((b) => b.toString(16).padStart(2, "0")).join("");
-    return parseInteger(hexString, options);
+    return integerFromBuffer(buffer, offset, options);
   };
   const parseStringFromBuffer = (buffer, offset, options) => {
-    const hexString = Array.from(buffer.slice(offset)).map((b) => b.toString(16).padStart(2, "0")).join("");
-    return parseString(hexString, options);
+    const initialByte = readByte(buffer, offset);
+    const { majorType } = extractCborHeader(initialByte);
+    if (majorType === 2) {
+      return byteStringFromBuffer(buffer, offset, options);
+    }
+    return textStringFromBuffer(buffer, offset, options);
   };
   const parseFloatFromBuffer = (buffer, offset, options) => {
-    const hexString = Array.from(buffer.slice(offset)).map((b) => b.toString(16).padStart(2, "0")).join("");
-    return parseFloatOrSimple(hexString, options);
+    return floatOrSimpleFromBuffer(buffer, offset, options);
   };
   const parseArrayWithMap = (ctx, offset, path, sourceMap) => {
+    const previousDepth = ctx.currentDepth ?? 0;
+    const maxDepth = ctx.options?.limits?.maxDepth;
+    if (maxDepth !== void 0 && previousDepth >= maxDepth) {
+      throw new Error(`Maximum nesting depth ${maxDepth} exceeded`);
+    }
+    ctx.currentDepth = previousDepth + 1;
     const startOffset = offset;
     const initialByte = readByte(ctx.buffer, offset);
     const { additionalInfo } = extractCborHeader(initialByte);
@@ -1705,6 +1943,10 @@ function useCborParser() {
       length = Number(bigLength);
       currentOffset += 8;
     } else if (additionalInfo === 31) {
+      const isIndefiniteAllowed = ctx.options?.allowIndefinite ?? !(ctx.options?.validateCanonical || ctx.options?.strict);
+      if (!isIndefiniteAllowed) {
+        throw new Error("Indefinite-length encoding is not allowed (strict/canonical mode)");
+      }
       isIndefinite = true;
       length = 0;
     } else {
@@ -1721,49 +1963,70 @@ function useCborParser() {
       isHeader: true,
       headerEnd
     });
-    const childPaths = [];
-    if (isIndefinite) {
-      let index = 0;
-      while (currentOffset < ctx.buffer.length) {
-        const nextByte = readByte(ctx.buffer, currentOffset);
-        if (nextByte === 255) {
-          currentOffset++;
-          break;
+    try {
+      const childPaths = [];
+      if (isIndefinite) {
+        let index = 0;
+        let foundBreak = false;
+        while (currentOffset < ctx.buffer.length) {
+          const nextByte = readByte(ctx.buffer, currentOffset);
+          if (nextByte === 255) {
+            currentOffset++;
+            foundBreak = true;
+            break;
+          }
+          if (ctx.options?.limits?.maxArrayLength && index >= ctx.options.limits.maxArrayLength) {
+            throw new Error(`Array length exceeds limit of ${ctx.options.limits.maxArrayLength}`);
+          }
+          const elementPath = `${path}[${index}]`;
+          childPaths.push(elementPath);
+          const elementResult = parseValueWithMap(ctx, currentOffset, elementPath, sourceMap);
+          items.push(elementResult.value);
+          currentOffset += elementResult.bytesRead;
+          const elementEntry = sourceMap.find((e) => e.path === elementPath);
+          if (elementEntry) {
+            elementEntry.parent = path;
+          }
+          index++;
         }
-        const elementPath = `${path}[${index}]`;
-        childPaths.push(elementPath);
-        const elementResult = parseValueWithMap(ctx, currentOffset, elementPath, sourceMap);
-        items.push(elementResult.value);
-        currentOffset += elementResult.bytesRead;
-        const elementEntry = sourceMap.find((e) => e.path === elementPath);
-        if (elementEntry) {
-          elementEntry.parent = path;
+        if (!foundBreak) {
+          throw new Error("Indefinite-length array missing break code (0xFF)");
         }
-        index++;
-      }
-    } else {
-      for (let i = 0; i < length; i++) {
-        const elementPath = `${path}[${i}]`;
-        childPaths.push(elementPath);
-        const elementResult = parseValueWithMap(ctx, currentOffset, elementPath, sourceMap);
-        items.push(elementResult.value);
-        currentOffset += elementResult.bytesRead;
-        const elementEntry = sourceMap.find((e) => e.path === elementPath);
-        if (elementEntry) {
-          elementEntry.parent = path;
+      } else {
+        if (ctx.options?.limits?.maxArrayLength && length > ctx.options.limits.maxArrayLength) {
+          throw new Error(`Array length ${length} exceeds limit of ${ctx.options.limits.maxArrayLength}`);
+        }
+        for (let i = 0; i < length; i++) {
+          const elementPath = `${path}[${i}]`;
+          childPaths.push(elementPath);
+          const elementResult = parseValueWithMap(ctx, currentOffset, elementPath, sourceMap);
+          items.push(elementResult.value);
+          currentOffset += elementResult.bytesRead;
+          const elementEntry = sourceMap.find((e) => e.path === elementPath);
+          if (elementEntry) {
+            elementEntry.parent = path;
+          }
         }
       }
+      const bytesRead = currentOffset - offset;
+      if (childPaths.length > 0 && sourceMap[arrayEntryIndex]) {
+        sourceMap[arrayEntryIndex].children = childPaths;
+      }
+      return {
+        value: items,
+        bytesRead
+      };
+    } finally {
+      ctx.currentDepth = previousDepth;
     }
-    const bytesRead = currentOffset - offset;
-    if (childPaths.length > 0 && sourceMap[arrayEntryIndex]) {
-      sourceMap[arrayEntryIndex].children = childPaths;
-    }
-    return {
-      value: items,
-      bytesRead
-    };
   };
   const parseMapWithMap = (ctx, offset, path, sourceMap) => {
+    const previousDepth = ctx.currentDepth ?? 0;
+    const maxDepth = ctx.options?.limits?.maxDepth;
+    if (maxDepth !== void 0 && previousDepth >= maxDepth) {
+      throw new Error(`Maximum nesting depth ${maxDepth} exceeded`);
+    }
+    ctx.currentDepth = previousDepth + 1;
     const startOffset = offset;
     const initialByte = readByte(ctx.buffer, offset);
     const { additionalInfo } = extractCborHeader(initialByte);
@@ -1790,6 +2053,10 @@ function useCborParser() {
       length = Number(bigLength);
       currentOffset += 8;
     } else if (additionalInfo === 31) {
+      const isIndefiniteAllowed = ctx.options?.allowIndefinite ?? !(ctx.options?.validateCanonical || ctx.options?.strict);
+      if (!isIndefiniteAllowed) {
+        throw new Error("Indefinite-length encoding is not allowed (strict/canonical mode)");
+      }
       isIndefinite = true;
       length = 0;
     } else {
@@ -1806,72 +2073,91 @@ function useCborParser() {
       isHeader: true,
       headerEnd
     });
-    const childPaths = [];
-    const seenKeys = /* @__PURE__ */ new Set();
-    if (isIndefinite) {
-      while (currentOffset < ctx.buffer.length) {
-        const nextByte = readByte(ctx.buffer, currentOffset);
-        if (nextByte === 255) {
-          currentOffset++;
-          break;
-        }
-        const keyPath = `${path}${path ? "." : ""}#key`;
-        const keyResult = parseValueWithMap(ctx, currentOffset, keyPath, sourceMap);
-        currentOffset += keyResult.bytesRead;
-        const keyString = keyResult.value instanceof Uint8Array ? Array.from(keyResult.value).map((b) => b.toString(16).padStart(2, "0")).join("") : String(keyResult.value);
-        if (seenKeys.has(keyString)) {
-          const mode = ctx.options?.dupMapKeyMode || "allow";
-          if (mode === "reject") {
-            throw new Error(`Duplicate map key detected: ${keyString} at offset ${currentOffset}`);
-          } else if (mode === "warn") {
-            logger.warn(`Duplicate map key detected: ${keyString} at offset ${currentOffset}`);
+    try {
+      const childPaths = [];
+      const seenKeys = /* @__PURE__ */ new Set();
+      if (isIndefinite) {
+        let count = 0;
+        let foundBreak = false;
+        while (currentOffset < ctx.buffer.length) {
+          const nextByte = readByte(ctx.buffer, currentOffset);
+          if (nextByte === 255) {
+            currentOffset++;
+            foundBreak = true;
+            break;
+          }
+          if (ctx.options?.limits?.maxMapSize && count >= ctx.options.limits.maxMapSize) {
+            throw new Error(`Map size exceeds limit of ${ctx.options.limits.maxMapSize}`);
+          }
+          const keyPath = `${path}${path ? "." : ""}#key`;
+          const keyResult = parseValueWithMap(ctx, currentOffset, keyPath, sourceMap);
+          currentOffset += keyResult.bytesRead;
+          const keyForDupCheck = serializeValueForComparison(keyResult.value);
+          const keyString = keyResult.value instanceof Uint8Array ? Array.from(keyResult.value).map((b) => b.toString(16).padStart(2, "0")).join("") : String(keyResult.value);
+          if (seenKeys.has(keyForDupCheck)) {
+            const mode = ctx.options?.dupMapKeyMode || "allow";
+            if (mode === "reject") {
+              throw new Error(`Duplicate map key detected: ${keyString} at offset ${currentOffset}`);
+            } else if (mode === "warn") {
+              logger.warn(`Duplicate map key detected: ${keyString} at offset ${currentOffset}`);
+            }
+          }
+          seenKeys.add(keyForDupCheck);
+          const valuePath = path ? `${path}.${keyString}` : `.${keyString}`;
+          childPaths.push(valuePath);
+          const valueResult = parseValueWithMap(ctx, currentOffset, valuePath, sourceMap);
+          map.set(keyResult.value, valueResult.value);
+          currentOffset += valueResult.bytesRead;
+          const valueEntry = sourceMap.find((e) => e.path === valuePath);
+          if (valueEntry) {
+            valueEntry.parent = path;
           }
+          count++;
         }
-        seenKeys.add(keyString);
-        const valuePath = path ? `${path}.${keyString}` : `.${keyString}`;
-        childPaths.push(valuePath);
-        const valueResult = parseValueWithMap(ctx, currentOffset, valuePath, sourceMap);
-        map.set(keyResult.value, valueResult.value);
-        currentOffset += valueResult.bytesRead;
-        const valueEntry = sourceMap.find((e) => e.path === valuePath);
-        if (valueEntry) {
-          valueEntry.parent = path;
+        if (!foundBreak) {
+          throw new Error("Indefinite-length map missing break code (0xFF)");
         }
-      }
-    } else {
-      for (let i = 0; i < length; i++) {
-        const keyPath = `${path}${path ? "." : ""}#key${i}`;
-        const keyResult = parseValueWithMap(ctx, currentOffset, keyPath, sourceMap);
-        currentOffset += keyResult.bytesRead;
-        const keyString = keyResult.value instanceof Uint8Array ? Array.from(keyResult.value).map((b) => b.toString(16).padStart(2, "0")).join("") : String(keyResult.value);
-        if (seenKeys.has(keyString)) {
-          const mode = ctx.options?.dupMapKeyMode || "allow";
-          if (mode === "reject") {
-            throw new Error(`Duplicate map key detected: ${keyString} at offset ${currentOffset}`);
-          } else if (mode === "warn") {
-            logger.warn(`Duplicate map key detected: ${keyString} at offset ${currentOffset}`);
-          }
+      } else {
+        if (ctx.options?.limits?.maxMapSize && length > ctx.options.limits.maxMapSize) {
+          throw new Error(`Map size ${length} exceeds limit of ${ctx.options.limits.maxMapSize}`);
         }
-        seenKeys.add(keyString);
-        const valuePath = path ? `${path}.${keyString}` : `.${keyString}`;
-        childPaths.push(valuePath);
-        const valueResult = parseValueWithMap(ctx, currentOffset, valuePath, sourceMap);
-        map.set(keyResult.value, valueResult.value);
-        currentOffset += valueResult.bytesRead;
-        const valueEntry = sourceMap.find((e) => e.path === valuePath);
-        if (valueEntry) {
-          valueEntry.parent = path;
+        for (let i = 0; i < length; i++) {
+          const keyPath = `${path}${path ? "." : ""}#key${i}`;
+          const keyResult = parseValueWithMap(ctx, currentOffset, keyPath, sourceMap);
+          currentOffset += keyResult.bytesRead;
+          const keyForDupCheck = serializeValueForComparison(keyResult.value);
+          const keyString = keyResult.value instanceof Uint8Array ? Array.from(keyResult.value).map((b) => b.toString(16).padStart(2, "0")).join("") : String(keyResult.value);
+          if (seenKeys.has(keyForDupCheck)) {
+            const mode = ctx.options?.dupMapKeyMode || "allow";
+            if (mode === "reject") {
+              throw new Error(`Duplicate map key detected: ${keyString} at offset ${currentOffset}`);
+            } else if (mode === "warn") {
+              logger.warn(`Duplicate map key detected: ${keyString} at offset ${currentOffset}`);
+            }
+          }
+          seenKeys.add(keyForDupCheck);
+          const valuePath = path ? `${path}.${keyString}` : `.${keyString}`;
+          childPaths.push(valuePath);
+          const valueResult = parseValueWithMap(ctx, currentOffset, valuePath, sourceMap);
+          map.set(keyResult.value, valueResult.value);
+          currentOffset += valueResult.bytesRead;
+          const valueEntry = sourceMap.find((e) => e.path === valuePath);
+          if (valueEntry) {
+            valueEntry.parent = path;
+          }
         }
       }
+      const bytesRead = currentOffset - offset;
+      if (sourceMap[mapEntryIndex]) {
+        sourceMap[mapEntryIndex].children = childPaths;
+      }
+      return {
+        value: map,
+        bytesRead
+      };
+    } finally {
+      ctx.currentDepth = previousDepth;
     }
-    const bytesRead = currentOffset - offset;
-    if (sourceMap[mapEntryIndex]) {
-      sourceMap[mapEntryIndex].children = childPaths;
-    }
-    return {
-      value: map,
-      bytesRead
-    };
   };
   const parseTagNumberHelper = (buffer, offset, ai) => {
     if (ai < 24) {
@@ -1930,10 +2216,29 @@ function useCborParser() {
     if (valueEntry) {
       valueEntry.parent = path;
     }
-    const hexString = Array.from(ctx.buffer.slice(startOffset, currentOffset)).map((b) => b.toString(16).padStart(2, "0")).join("");
-    const tagResult = parseTag(hexString, ctx.options);
+    let finalValue = valueResult.value;
+    if ((tagNumber === 2 || tagNumber === 3) && finalValue instanceof Uint8Array) {
+      const maxBignumBytes = ctx.options?.limits?.maxBignumBytes ?? chunkPD72MVTX_cjs.DEFAULT_LIMITS.maxBignumBytes;
+      if (finalValue.length > maxBignumBytes) {
+        throw new Error(
+          `Bignum (tag ${tagNumber}) size ${finalValue.length} bytes exceeds limit of ${maxBignumBytes} bytes`
+        );
+      }
+      let bigintValue = 0n;
+      for (let i = 0; i < finalValue.length; i++) {
+        bigintValue = bigintValue << 8n | BigInt(finalValue[i]);
+      }
+      finalValue = tagNumber === 2 ? bigintValue : -1n - bigintValue;
+    }
+    validateTagSemantics(tagNumber, finalValue, ctx.options);
+    const plutusConstr = decodePlutusConstructor(tagNumber, finalValue);
+    const taggedValue = {
+      tag: tagNumber,
+      value: finalValue,
+      ...plutusConstr && { plutus: plutusConstr }
+    };
     return {
-      value: tagResult.value,
+      value: taggedValue,
       bytesRead: currentOffset - startOffset
     };
   };
@@ -1948,28 +2253,42 @@ function useCborParser() {
     if (ai < 20) return `Simple Value ${ai}`;
     return "Simple Value";
   };
-  const parseSequence = (hexString, options) => {
-    const cleanHex = hexString.replace(/\s+/g, "");
-    if (!cleanHex || cleanHex.length === 0) {
-      return [];
-    }
-    if (cleanHex.length % 2 !== 0) {
-      throw new Error("Hex string must have even length");
-    }
-    if (!/^[0-9a-fA-F]+$/.test(cleanHex)) {
-      throw new Error(`Invalid hex character in: ${cleanHex}`);
-    }
+  const parseSequence = (input, options) => {
     const mergedOptions = mergeOptions(options);
-    const buffer = hexToBytes(cleanHex);
+    let buffer;
+    if (input instanceof Uint8Array) {
+      if (input.length === 0) {
+        return [];
+      }
+      buffer = input;
+    } else {
+      const cleanHex = input.replace(/\s+/g, "");
+      if (!cleanHex || cleanHex.length === 0) {
+        return [];
+      }
+      if (cleanHex.length % 2 !== 0) {
+        throw new Error("Hex string must have even length");
+      }
+      if (!/^[0-9a-fA-F]+$/.test(cleanHex)) {
+        throw new Error(`Invalid hex character in: ${cleanHex}`);
+      }
+      buffer = hexToBytes(cleanHex);
+    }
     const results = [];
     let offset = 0;
+    const sequenceStartTime = mergedOptions.limits?.maxParseTime ? Date.now() : 0;
     while (offset < buffer.length) {
+      if (sequenceStartTime > 0 && mergedOptions.limits?.maxParseTime) {
+        const elapsed = Date.now() - sequenceStartTime;
+        if (elapsed > mergedOptions.limits.maxParseTime) {
+          throw new Error(`Parse timeout: exceeded ${mergedOptions.limits.maxParseTime}ms limit`);
+        }
+      }
       const byte = readByte(buffer, offset);
       if (byte === 255) {
         throw new Error(`Unexpected break code (0xff) at offset ${offset} - not inside indefinite-length item`);
       }
-      const remainingHex = Array.from(buffer.slice(offset)).map((b) => b.toString(16).padStart(2, "0")).join("");
-      const result = parse(remainingHex, mergedOptions);
+      const result = dispatchFromBuffer(buffer, offset, mergedOptions);
       results.push(result.value);
       offset += result.bytesRead;
     }
@@ -2030,5 +2349,5 @@ exports.useCborParser = useCborParser;
 exports.useCborString = useCborString;
 exports.useCborTag = useCborTag;
 exports.validateUtf8Strict = validateUtf8Strict;
-//# sourceMappingURL=chunk-2HBCILJS.cjs.map
-//# sourceMappingURL=chunk-2HBCILJS.cjs.map
+//# sourceMappingURL=chunk-RVG2BY32.cjs.map
+//# sourceMappingURL=chunk-RVG2BY32.cjs.map