@marcuspuchalla/nachos 0.1.3 → 0.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (55) hide show
  1. package/CHANGELOG.md +23 -0
  2. package/dist/{chunk-5A5T56JB.js → chunk-5IWW5H47.js} +378 -207
  3. package/dist/chunk-5IWW5H47.js.map +1 -0
  4. package/dist/{chunk-PTWN7K3Y.cjs → chunk-RVG2BY32.cjs} +378 -207
  5. package/dist/chunk-RVG2BY32.cjs.map +1 -0
  6. package/dist/{chunk-R62CQQNI.cjs → chunk-S4RXO6IB.cjs} +195 -165
  7. package/dist/chunk-S4RXO6IB.cjs.map +1 -0
  8. package/dist/{chunk-2MTLSQ7E.js → chunk-UMAX5MX5.js} +195 -165
  9. package/dist/chunk-UMAX5MX5.js.map +1 -0
  10. package/dist/encoder/index.cjs +13 -13
  11. package/dist/encoder/index.d.cts +2 -2
  12. package/dist/encoder/index.d.ts +2 -2
  13. package/dist/encoder/index.js +1 -1
  14. package/dist/index.cjs +32 -32
  15. package/dist/index.cjs.map +1 -1
  16. package/dist/index.d.cts +28 -19
  17. package/dist/index.d.ts +28 -19
  18. package/dist/index.js +16 -16
  19. package/dist/index.js.map +1 -1
  20. package/dist/metafile-cjs.json +1 -1
  21. package/dist/metafile-esm.json +1 -1
  22. package/dist/parser/index.cjs +14 -14
  23. package/dist/parser/index.d.cts +3 -1
  24. package/dist/parser/index.d.ts +3 -1
  25. package/dist/parser/index.js +1 -1
  26. package/dist/{useCborSimpleEncoder-TVxzNJ_9.d.ts → useCborSimpleEncoder-BoKEmjP9.d.ts} +0 -2
  27. package/dist/{useCborSimpleEncoder-ButVU988.d.cts → useCborSimpleEncoder-C_OHxoB8.d.cts} +0 -2
  28. package/dist/{useCborTag-Cs1CZuXZ.d.cts → useCborTag-BD6Sqp7p.d.ts} +9 -4
  29. package/dist/{useCborTag-xV2Pz2VY.d.ts → useCborTag-QpZR-Er2.d.cts} +9 -4
  30. package/package.json +1 -1
  31. package/src/__tests__/public-api.test.ts +153 -0
  32. package/src/__tests__/roundtrip.test.ts +5 -6
  33. package/src/encoder/__tests__/cbor-collection-encoder.test.ts +103 -5
  34. package/src/encoder/__tests__/cbor-encoder-errors.test.ts +40 -5
  35. package/src/encoder/__tests__/cbor-simple-encoder.test.ts +126 -0
  36. package/src/encoder/composables/useCborCollectionEncoder.ts +28 -25
  37. package/src/encoder/composables/useCborEncoder.ts +21 -0
  38. package/src/encoder/composables/useCborSimpleEncoder.ts +34 -7
  39. package/src/encoder/types.ts +0 -2
  40. package/src/index.ts +29 -20
  41. package/src/parser/__tests__/buffer-native-parsing.test.ts +338 -0
  42. package/src/parser/__tests__/cbor-map-duplicate-keys.test.ts +97 -7
  43. package/src/parser/__tests__/cbor-security-dos-protection.test.ts +164 -31
  44. package/src/parser/__tests__/cbor-standard-tags.test.ts +75 -7
  45. package/src/parser/__tests__/cbor-tag-reparse-fix.test.ts +268 -0
  46. package/src/parser/composables/useCborCollection.ts +45 -42
  47. package/src/parser/composables/useCborFloat.ts +2 -1
  48. package/src/parser/composables/useCborInteger.ts +24 -10
  49. package/src/parser/composables/useCborParser.ts +387 -197
  50. package/src/parser/composables/useCborTag.ts +45 -37
  51. package/src/parser/utils.ts +11 -0
  52. package/dist/chunk-2MTLSQ7E.js.map +0 -1
  53. package/dist/chunk-5A5T56JB.js.map +0 -1
  54. package/dist/chunk-PTWN7K3Y.cjs.map +0 -1
  55. package/dist/chunk-R62CQQNI.cjs.map +0 -1
package/CHANGELOG.md CHANGED
@@ -5,6 +5,29 @@ All notable changes to this project will be documented in this file.
5
5
  The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
6
6
  and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
7
7
 
8
+ ## [0.1.4] - 2026-02-22
9
+
10
+ ### Fixed
11
+
12
+ #### Security
13
+ - **Duplicate map key bypass** - Semantic comparison now used for duplicate detection; different encodings of the same integer key (e.g. `0x01`, `0x1801`, `0x190001`) are correctly identified as duplicates (RFC 8949 Section 5.6)
14
+ - **maxParseTime bypass** - Timeout is now enforced in standard `decode()`/`parse()` path, not only in `decodeWithSourceMap()`
15
+ - **bytesWritten double-counting** - Removed broken value-copy tracking from `EncodeContext`; `maxOutputSize` is now checked once at root level after encoding completes
16
+
17
+ #### Correctness
18
+ - **Tag 4/5 integer validation** - `Number.isInteger()` check added to reject floats in exponent/mantissa positions (RFC 8949 requirement)
19
+ - **Float16 IEEE 754 rounding** - Replaced truncating `>> 42` shift with guard/round/sticky round-half-to-even; also fixed 32-bit truncation bug that corrupted most float16 mantissas
20
+ - **Exponential source-map re-parsing** - `validateTagSemantics` and `decodePlutusConstructor` now called directly on already-parsed values instead of re-parsing the entire tag subtree (O(D²) → O(D))
21
+
22
+ ### Performance
23
+ - **Eliminated O(N²) parsing** - `parseItem` and `parseSequence` no longer slice and hex-encode the full remaining buffer on each element; all types now use buffer+offset native dispatch
24
+ - **Map canonical sort** - Keys pre-encoded once before sort instead of re-encoded O(N log N) times inside comparator
25
+
26
+ ### Added
27
+ - **Uint8Array input support** - `decode()`, `decodeWithSourceMap()`, `parseSequence()`, and `CborDecoder` class methods now accept `Uint8Array` directly, skipping hex conversion entirely
28
+ - **Buffer-native parser exports** - `parseIntegerFromBuffer`, `parseFromBuffer` (float), `parseTagFromBuffer`, `validateTagSemantics`, `decodePlutusConstructor` exported for advanced use
29
+ - 115 new tests
30
+
8
31
  ## [0.1.3] - 2026-02-09
9
32
 
10
33
  ### Fixed