@marcuspuchalla/nachos 0.1.3 → 0.2.0

package/dist/parser/index.d.cts

@@ -1,5 +1,5 @@
-export { c as useCborCollection, d as useCborFloat, a as useCborInteger, u as useCborParser, b as useCborString, e as useCborTag } from '../useCborTag-Cs1CZuXZ.cjs';
-export { o as CborAdditionalInfo, C as CborContext, n as CborMajorType, f as CborMap, p as CborSimpleValue, q as CborTag, e as CborValue, m as DEFAULT_LIMITS, D as DEFAULT_OPTIONS, r as DupMapKeyMode, c as ParseError, P as ParseOptions, a as ParseResult, b as ParseResultWithMap, d as ParserLimits, l as PlutusBytes, h as PlutusConstr, g as PlutusData, k as PlutusInt, j as PlutusList, i as PlutusMap, R as Result, S as SourceMapEntry, T as TaggedValue } from '../types-DvNlfbKB.cjs';
+export { c as useCborCollection, d as useCborFloat, a as useCborInteger, u as useCborParser, b as useCborString, e as useCborTag } from '../useCborTag-D4d7xG3-.cjs';
+export { o as CborAdditionalInfo, C as CborContext, n as CborMajorType, f as CborMap, p as CborSimpleValue, q as CborTag, e as CborValue, m as DEFAULT_LIMITS, D as DEFAULT_OPTIONS, r as DupMapKeyMode, c as ParseError, P as ParseOptions, a as ParseResult, b as ParseResultWithMap, d as ParserLimits, l as PlutusBytes, h as PlutusConstr, g as PlutusData, k as PlutusInt, j as PlutusList, i as PlutusMap, R as Result, S as SourceMapEntry, T as TaggedValue } from '../types-eG2qalpr.cjs';
 
 /**
  * Common utility functions for CBOR parsing
@@ -7,6 +7,8 @@ export { o as CborAdditionalInfo, C as CborContext, n as CborMajorType, f as Cbo
 /**
  * Converts hex string to Uint8Array
  *
+ * Validates even length and hex-only characters.
+ *
  * @param hex - Hex string (e.g., "1864")
  * @returns Byte array
  */

package/dist/parser/index.d.ts

@@ -1,5 +1,5 @@
-export { c as useCborCollection, d as useCborFloat, a as useCborInteger, u as useCborParser, b as useCborString, e as useCborTag } from '../useCborTag-xV2Pz2VY.js';
-export { o as CborAdditionalInfo, C as CborContext, n as CborMajorType, f as CborMap, p as CborSimpleValue, q as CborTag, e as CborValue, m as DEFAULT_LIMITS, D as DEFAULT_OPTIONS, r as DupMapKeyMode, c as ParseError, P as ParseOptions, a as ParseResult, b as ParseResultWithMap, d as ParserLimits, l as PlutusBytes, h as PlutusConstr, g as PlutusData, k as PlutusInt, j as PlutusList, i as PlutusMap, R as Result, S as SourceMapEntry, T as TaggedValue } from '../types-DvNlfbKB.js';
+export { c as useCborCollection, d as useCborFloat, a as useCborInteger, u as useCborParser, b as useCborString, e as useCborTag } from '../useCborTag-TYst1KR6.js';
+export { o as CborAdditionalInfo, C as CborContext, n as CborMajorType, f as CborMap, p as CborSimpleValue, q as CborTag, e as CborValue, m as DEFAULT_LIMITS, D as DEFAULT_OPTIONS, r as DupMapKeyMode, c as ParseError, P as ParseOptions, a as ParseResult, b as ParseResultWithMap, d as ParserLimits, l as PlutusBytes, h as PlutusConstr, g as PlutusData, k as PlutusInt, j as PlutusList, i as PlutusMap, R as Result, S as SourceMapEntry, T as TaggedValue } from '../types-eG2qalpr.js';
 
 /**
  * Common utility functions for CBOR parsing
@@ -7,6 +7,8 @@ export { o as CborAdditionalInfo, C as CborContext, n as CborMajorType, f as Cbo
 /**
  * Converts hex string to Uint8Array
  *
+ * Validates even length and hex-only characters.
+ *
  * @param hex - Hex string (e.g., "1864")
  * @returns Byte array
  */

package/dist/parser/index.js

@@ -1,4 +1,4 @@
-export { bytesToHex, extractCborHeader, hexToBytes, readBigUint, readByte, readUint, useCborCollection, useCborFloat, useCborInteger, useCborParser, useCborString, useCborTag, validateUtf8Strict } from '../chunk-5A5T56JB.js';
-export { CborAdditionalInfo, CborMajorType, CborSimpleValue, CborTag, DEFAULT_LIMITS, DEFAULT_OPTIONS } from '../chunk-ZDZ2B5PE.js';
+export { bytesToHex, extractCborHeader, hexToBytes, readBigUint, readByte, readUint, useCborCollection, useCborFloat, useCborInteger, useCborParser, useCborString, useCborTag, validateUtf8Strict } from '../chunk-LWNWC2O7.js';
+export { CborAdditionalInfo, CborMajorType, CborSimpleValue, CborTag, DEFAULT_LIMITS, DEFAULT_OPTIONS } from '../chunk-JESIF5IF.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/{types-DvNlfbKB.d.cts → types-eG2qalpr.d.cts}

@@ -30,6 +30,19 @@ interface ParserLimits {
  * Following RFC 8949 Section 5.6 guidance
  */
 type DupMapKeyMode = 'allow' | 'warn' | 'reject';
+/**
+ * Map key ordering for canonical/deterministic encoding and validation.
+ *
+ * - 'length-first': RFC 7049 Section 3.9 "Old Canonical CBOR" — shorter encoded
+ *   keys sort first, ties broken bytewise. This is what Cardano CIP-21 mandates
+ *   for transaction serialization, and is the default in this library.
+ * - 'bytewise': RFC 8949 Section 4.2.1 "Core Deterministic Encoding" — pure
+ *   bytewise lexicographic order of the encoded keys (the modern generic default).
+ *
+ * @see https://cips.cardano.org/cip/CIP-21
+ * @see https://www.rfc-editor.org/rfc/rfc8949.html#section-4.2.1
+ */
+type MapKeyOrder = 'length-first' | 'bytewise';
 /**
  * Parser options for controlling behavior
  */
@@ -55,6 +68,19 @@ interface ParseOptions {
     validateTagSemantics?: boolean;
     /** Validate Plutus constructor semantics (Tags 102, 121-127, 1280-1400) */
     validatePlutusSemantics?: boolean;
+    /**
+     * Map key ordering enforced when validateCanonical is set.
+     * Defaults to 'length-first' (Cardano CIP-21 / RFC 7049 Section 3.9).
+     * Use 'bytewise' for RFC 8949 Section 4.2.1 core deterministic order.
+     */
+    mapKeyOrder?: MapKeyOrder;
+    /**
+     * Reject trailing bytes after the top-level data item (well-formedness).
+     * Defaults to true for backward compatibility (decode returns bytesRead so
+     * callers can detect leftover data); automatically false-tightened, i.e. set
+     * to reject, in strict mode. Set explicitly to override.
+     */
+    allowTrailingData?: boolean;
     /** Resource limits */
     limits?: ParserLimits;
 }
@@ -298,4 +324,4 @@ type Result<T, E> = {
     error: E;
 };
 
-export { type CborContext as C, DEFAULT_OPTIONS as D, type ParseOptions as P, type Result as R, type SourceMapEntry as S, type TaggedValue as T, type ParseResult as a, type ParseResultWithMap as b, type ParseError as c, type ParserLimits as d, type CborValue as e, type CborMap as f, type PlutusData as g, type PlutusConstr as h, type PlutusMap as i, type PlutusList as j, type PlutusInt as k, type PlutusBytes as l, DEFAULT_LIMITS as m, CborMajorType as n, CborAdditionalInfo as o, CborSimpleValue as p, CborTag as q, type DupMapKeyMode as r, type CborByteString as s, type CborTextString as t };
+export { type CborContext as C, DEFAULT_OPTIONS as D, type MapKeyOrder as M, type ParseOptions as P, type Result as R, type SourceMapEntry as S, type TaggedValue as T, type ParseResult as a, type ParseResultWithMap as b, type ParseError as c, type ParserLimits as d, type CborValue as e, type CborMap as f, type PlutusData as g, type PlutusConstr as h, type PlutusMap as i, type PlutusList as j, type PlutusInt as k, type PlutusBytes as l, DEFAULT_LIMITS as m, CborMajorType as n, CborAdditionalInfo as o, CborSimpleValue as p, CborTag as q, type DupMapKeyMode as r, type CborByteString as s, type CborTextString as t };

package/dist/{types-DvNlfbKB.d.ts → types-eG2qalpr.d.ts}

@@ -30,6 +30,19 @@ interface ParserLimits {
  * Following RFC 8949 Section 5.6 guidance
  */
 type DupMapKeyMode = 'allow' | 'warn' | 'reject';
+/**
+ * Map key ordering for canonical/deterministic encoding and validation.
+ *
+ * - 'length-first': RFC 7049 Section 3.9 "Old Canonical CBOR" — shorter encoded
+ *   keys sort first, ties broken bytewise. This is what Cardano CIP-21 mandates
+ *   for transaction serialization, and is the default in this library.
+ * - 'bytewise': RFC 8949 Section 4.2.1 "Core Deterministic Encoding" — pure
+ *   bytewise lexicographic order of the encoded keys (the modern generic default).
+ *
+ * @see https://cips.cardano.org/cip/CIP-21
+ * @see https://www.rfc-editor.org/rfc/rfc8949.html#section-4.2.1
+ */
+type MapKeyOrder = 'length-first' | 'bytewise';
 /**
  * Parser options for controlling behavior
  */
@@ -55,6 +68,19 @@ interface ParseOptions {
     validateTagSemantics?: boolean;
     /** Validate Plutus constructor semantics (Tags 102, 121-127, 1280-1400) */
     validatePlutusSemantics?: boolean;
+    /**
+     * Map key ordering enforced when validateCanonical is set.
+     * Defaults to 'length-first' (Cardano CIP-21 / RFC 7049 Section 3.9).
+     * Use 'bytewise' for RFC 8949 Section 4.2.1 core deterministic order.
+     */
+    mapKeyOrder?: MapKeyOrder;
+    /**
+     * Reject trailing bytes after the top-level data item (well-formedness).
+     * Defaults to true for backward compatibility (decode returns bytesRead so
+     * callers can detect leftover data); automatically false-tightened, i.e. set
+     * to reject, in strict mode. Set explicitly to override.
+     */
+    allowTrailingData?: boolean;
     /** Resource limits */
     limits?: ParserLimits;
 }
@@ -298,4 +324,4 @@ type Result<T, E> = {
     error: E;
 };
 
-export { type CborContext as C, DEFAULT_OPTIONS as D, type ParseOptions as P, type Result as R, type SourceMapEntry as S, type TaggedValue as T, type ParseResult as a, type ParseResultWithMap as b, type ParseError as c, type ParserLimits as d, type CborValue as e, type CborMap as f, type PlutusData as g, type PlutusConstr as h, type PlutusMap as i, type PlutusList as j, type PlutusInt as k, type PlutusBytes as l, DEFAULT_LIMITS as m, CborMajorType as n, CborAdditionalInfo as o, CborSimpleValue as p, CborTag as q, type DupMapKeyMode as r, type CborByteString as s, type CborTextString as t };
+export { type CborContext as C, DEFAULT_OPTIONS as D, type MapKeyOrder as M, type ParseOptions as P, type Result as R, type SourceMapEntry as S, type TaggedValue as T, type ParseResult as a, type ParseResultWithMap as b, type ParseError as c, type ParserLimits as d, type CborValue as e, type CborMap as f, type PlutusData as g, type PlutusConstr as h, type PlutusMap as i, type PlutusList as j, type PlutusInt as k, type PlutusBytes as l, DEFAULT_LIMITS as m, CborMajorType as n, CborAdditionalInfo as o, CborSimpleValue as p, CborTag as q, type DupMapKeyMode as r, type CborByteString as s, type CborTextString as t };

package/dist/{useCborSimpleEncoder-TVxzNJ_9.d.ts → useCborSimpleEncoder-CamvS-_N.d.ts}

@@ -1,4 +1,4 @@
-import { h as PlutusConstr, s as CborByteString, t as CborTextString } from './types-DvNlfbKB.js';
+import { h as PlutusConstr, M as MapKeyOrder, s as CborByteString, t as CborTextString } from './types-eG2qalpr.js';
 
 /**
  * CBOR Encoder Type Definitions
@@ -15,6 +15,12 @@ interface EncodeOptions {
     allowIndefinite?: boolean;
     /** Reject duplicate map keys */
     rejectDuplicateKeys?: boolean;
+    /**
+     * Map key ordering used in canonical mode.
+     * Defaults to 'length-first' (Cardano CIP-21 / RFC 7049 §3.9).
+     * Use 'bytewise' for RFC 8949 §4.2.1 core deterministic order.
+     */
+    mapKeyOrder?: MapKeyOrder;
     /** Maximum nesting depth */
     maxDepth?: number;
     /** Maximum output size in bytes */
@@ -56,8 +62,6 @@ interface TaggedValue {
 interface EncodeContext {
     /** Current nesting depth */
     depth: number;
-    /** Bytes written so far */
-    bytesWritten: number;
     /** Encoder options */
     options: Required<EncodeOptions>;
 }

package/dist/{useCborSimpleEncoder-ButVU988.d.cts → useCborSimpleEncoder-DXgPx62d.d.cts}

@@ -1,4 +1,4 @@
-import { h as PlutusConstr, s as CborByteString, t as CborTextString } from './types-DvNlfbKB.cjs';
+import { h as PlutusConstr, M as MapKeyOrder, s as CborByteString, t as CborTextString } from './types-eG2qalpr.cjs';
 
 /**
  * CBOR Encoder Type Definitions
@@ -15,6 +15,12 @@ interface EncodeOptions {
     allowIndefinite?: boolean;
     /** Reject duplicate map keys */
     rejectDuplicateKeys?: boolean;
+    /**
+     * Map key ordering used in canonical mode.
+     * Defaults to 'length-first' (Cardano CIP-21 / RFC 7049 §3.9).
+     * Use 'bytewise' for RFC 8949 §4.2.1 core deterministic order.
+     */
+    mapKeyOrder?: MapKeyOrder;
     /** Maximum nesting depth */
     maxDepth?: number;
     /** Maximum output size in bytes */
@@ -56,8 +62,6 @@ interface TaggedValue {
 interface EncodeContext {
     /** Current nesting depth */
     depth: number;
-    /** Bytes written so far */
-    bytesWritten: number;
     /** Encoder options */
     options: Required<EncodeOptions>;
 }

package/dist/{useCborTag-xV2Pz2VY.d.ts → useCborTag-D4d7xG3-.d.cts}

@@ -1,4 +1,4 @@
-import { P as ParseOptions, a as ParseResult, b as ParseResultWithMap, e as CborValue, S as SourceMapEntry } from './types-DvNlfbKB.js';
+import { P as ParseOptions, a as ParseResult, b as ParseResultWithMap, e as CborValue, S as SourceMapEntry, h as PlutusConstr } from './types-eG2qalpr.cjs';
 
 /**
  * CBOR Main Parser Composable
@@ -19,9 +19,9 @@ import { P as ParseOptions, a as ParseResult, b as ParseResultWithMap, e as Cbor
  * ```
  */
 declare function useCborParser(): {
-    parse: (hexString: string, options?: ParseOptions) => ParseResult;
-    parseWithSourceMap: (hexString: string, options?: ParseOptions) => ParseResultWithMap;
-    parseSequence: (hexString: string, options?: ParseOptions) => CborValue[];
+    parse: (input: string | Uint8Array, options?: ParseOptions) => ParseResult;
+    parseWithSourceMap: (input: string | Uint8Array, options?: ParseOptions) => ParseResultWithMap;
+    parseSequence: (input: string | Uint8Array, options?: ParseOptions) => CborValue[];
     parseSequenceWithSourceMap: (hexString: string, options?: ParseOptions) => {
         values: CborValue[];
         sourceMaps: SourceMapEntry[][];
@@ -47,6 +47,7 @@ declare function useCborParser(): {
  */
 declare function useCborInteger(): {
     parseInteger: (hexString: string, options?: ParseOptions) => ParseResult;
+    parseIntegerFromBuffer: (buffer: Uint8Array, offset: number, options?: ParseOptions) => ParseResult;
 };
 
 /**
@@ -115,6 +116,7 @@ declare function useCborFloat(): {
     parse: (hexString: string, options?: ParseOptions) => ParseResult;
     parseFloat: (hexString: string, options?: ParseOptions) => ParseResult;
     parseSimple: (hexString: string, _options?: ParseOptions) => ParseResult;
+    parseFromBuffer: (buffer: Uint8Array, offset: number, options?: ParseOptions) => ParseResult;
 };
 
 /**
@@ -137,6 +139,9 @@ declare function useCborFloat(): {
 declare function useCborTag(): {
     parseTag: (hexString: string, options?: ParseOptions) => ParseResult;
     parse: (hexString: string, options?: ParseOptions) => ParseResult;
+    parseTagFromBuffer: (buffer: Uint8Array, offset: number, options?: ParseOptions, tagDepth?: number) => ParseResult;
+    validateTagSemantics: (tagNumber: number, value: CborValue, options?: ParseOptions) => void;
+    decodePlutusConstructor: (tagNumber: number, value: CborValue) => PlutusConstr | null;
 };
 
 export { useCborInteger as a, useCborString as b, useCborCollection as c, useCborFloat as d, useCborTag as e, useCborParser as u };

package/dist/{useCborTag-Cs1CZuXZ.d.cts → useCborTag-TYst1KR6.d.ts}

@@ -1,4 +1,4 @@
-import { P as ParseOptions, a as ParseResult, b as ParseResultWithMap, e as CborValue, S as SourceMapEntry } from './types-DvNlfbKB.cjs';
+import { P as ParseOptions, a as ParseResult, b as ParseResultWithMap, e as CborValue, S as SourceMapEntry, h as PlutusConstr } from './types-eG2qalpr.js';
 
 /**
  * CBOR Main Parser Composable
@@ -19,9 +19,9 @@ import { P as ParseOptions, a as ParseResult, b as ParseResultWithMap, e as Cbor
  * ```
  */
 declare function useCborParser(): {
-    parse: (hexString: string, options?: ParseOptions) => ParseResult;
-    parseWithSourceMap: (hexString: string, options?: ParseOptions) => ParseResultWithMap;
-    parseSequence: (hexString: string, options?: ParseOptions) => CborValue[];
+    parse: (input: string | Uint8Array, options?: ParseOptions) => ParseResult;
+    parseWithSourceMap: (input: string | Uint8Array, options?: ParseOptions) => ParseResultWithMap;
+    parseSequence: (input: string | Uint8Array, options?: ParseOptions) => CborValue[];
     parseSequenceWithSourceMap: (hexString: string, options?: ParseOptions) => {
         values: CborValue[];
         sourceMaps: SourceMapEntry[][];
@@ -47,6 +47,7 @@ declare function useCborParser(): {
  */
 declare function useCborInteger(): {
     parseInteger: (hexString: string, options?: ParseOptions) => ParseResult;
+    parseIntegerFromBuffer: (buffer: Uint8Array, offset: number, options?: ParseOptions) => ParseResult;
 };
 
 /**
@@ -115,6 +116,7 @@ declare function useCborFloat(): {
     parse: (hexString: string, options?: ParseOptions) => ParseResult;
     parseFloat: (hexString: string, options?: ParseOptions) => ParseResult;
     parseSimple: (hexString: string, _options?: ParseOptions) => ParseResult;
+    parseFromBuffer: (buffer: Uint8Array, offset: number, options?: ParseOptions) => ParseResult;
 };
 
 /**
@@ -137,6 +139,9 @@ declare function useCborFloat(): {
 declare function useCborTag(): {
     parseTag: (hexString: string, options?: ParseOptions) => ParseResult;
     parse: (hexString: string, options?: ParseOptions) => ParseResult;
+    parseTagFromBuffer: (buffer: Uint8Array, offset: number, options?: ParseOptions, tagDepth?: number) => ParseResult;
+    validateTagSemantics: (tagNumber: number, value: CborValue, options?: ParseOptions) => void;
+    decodePlutusConstructor: (tagNumber: number, value: CborValue) => PlutusConstr | null;
 };
 
 export { useCborInteger as a, useCborString as b, useCborCollection as c, useCborFloat as d, useCborTag as e, useCborParser as u };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marcuspuchalla/nachos",
-  "version": "0.1.3",
+  "version": "0.2.0",
   "description": "NACHOS - Not Another CBOR Handling Object System. RFC 8949 CBOR encoder/decoder with full source map support for interactive debugging. Zero dependencies, TypeScript, works in Node.js and browsers.",
   "keywords": [
     "nachos",

package/src/__tests__/audit-fixes.test.ts

@@ -0,0 +1,141 @@
+/**
+ * Audit Remediation Regression Tests
+ *
+ * Locks in the fixes from the June 2026 RFC 8949 conformance/security audit.
+ * Each test maps to a finding ID (H1, H2, M1-M5, L1, L3, L5).
+ */
+
+import { describe, it, expect } from 'vitest'
+import { decode, decodeWithSourceMap, encode, encodeToHex, toDiagnostic } from '../index'
+
+describe('Audit fixes', () => {
+  describe('H1 — source-map parse path enforces tag-depth limit', () => {
+    const deepTag = 'c2'.repeat(60000) + '00'
+
+    it('decode() rejects deeply nested tags cleanly', () => {
+      expect(() => decode(deepTag, { limits: { maxTagDepth: 100 } }))
+        .toThrow(/Tag nesting depth/)
+    })
+
+    it('decodeWithSourceMap() rejects deeply nested tags cleanly (no stack overflow)', () => {
+      let err: Error | null = null
+      try { decodeWithSourceMap(deepTag, { limits: { maxTagDepth: 100 } }) }
+      catch (e) { err = e as Error }
+      expect(err).not.toBeNull()
+      expect(err!.constructor.name).toBe('Error') // NOT RangeError
+      expect(err!.message).toMatch(/Tag nesting depth/)
+    })
+
+    it('still decodes legitimately nested tags', () => {
+      const r = decode('c1c0' + '60', { limits: { maxTagDepth: 100 } }) // tag1(tag0(""))
+      expect((r.value as any).tag).toBe(1)
+    })
+  })
+
+  describe('H2 — map key ordering (CIP-21 length-first default, bytewise option)', () => {
+    // key "aa" -> 62 61 61 (len 3); key 1000000 -> 1a 00 0f 42 40 (len 5)
+    const m = new Map<any, any>([['aa', 1], [1000000, 2]])
+
+    it('canonical default is length-first (Cardano CIP-21)', () => {
+      expect(encodeToHex(m, { canonical: true })).toBe('a2' + '626161' + '01' + '1a000f4240' + '02')
+    })
+
+    it('mapKeyOrder:bytewise yields RFC 8949 §4.2.1 order', () => {
+      expect(encodeToHex(m, { canonical: true, mapKeyOrder: 'bytewise' }))
+        .toBe('a2' + '1a000f4240' + '02' + '626161' + '01')
+    })
+
+    const lenFirst = 'a2' + '626161' + '01' + '1a000f4240' + '02'
+    const byteWise = 'a2' + '1a000f4240' + '02' + '626161' + '01'
+
+    it('decoder (default) accepts length-first order', () => {
+      expect(() => decode(lenFirst, { validateCanonical: true })).not.toThrow()
+    })
+    it('decoder (bytewise) accepts bytewise order', () => {
+      expect(() => decode(byteWise, { validateCanonical: true, mapKeyOrder: 'bytewise' })).not.toThrow()
+    })
+    it('decoder (bytewise) rejects length-first order', () => {
+      expect(() => decode(lenFirst, { validateCanonical: true, mapKeyOrder: 'bytewise' }))
+        .toThrow(/not in canonical order/)
+    })
+
+    it('encoder output round-trips through its own canonical decoder (both orders)', () => {
+      const lf = encodeToHex(m, { canonical: true })
+      const bw = encodeToHex(m, { canonical: true, mapKeyOrder: 'bytewise' })
+      expect(() => decode(lf, { validateCanonical: true })).not.toThrow()
+      expect(() => decode(bw, { validateCanonical: true, mapKeyOrder: 'bytewise' })).not.toThrow()
+    })
+  })
+
+  describe('M1 — trailing data well-formedness', () => {
+    it('default lenient: reports bytesRead and ignores trailing', () => {
+      expect(decode('000102').bytesRead).toBe(1)
+    })
+    it('allowTrailingData:false rejects trailing bytes', () => {
+      expect(() => decode('000102', { allowTrailingData: false })).toThrow(/Trailing data/)
+    })
+    it('strict mode rejects trailing bytes', () => {
+      expect(() => decode('000102', { strict: true })).toThrow(/Trailing data/)
+    })
+    it('strict mode accepts an exact single item', () => {
+      expect(decode('00', { strict: true }).value).toBe(0)
+    })
+  })
+
+  describe('M2 — encoder maxDepth enforced across tag boundary', () => {
+    it('rejects deeply nested tagged values', () => {
+      let v: any = 0
+      for (let i = 0; i < 300; i++) v = { tag: 6, value: v }
+      expect(() => encode(v)).toThrow(/Maximum nesting depth/)
+    })
+    it('allows shallow nested tagged values', () => {
+      let v: any = 0
+      for (let i = 0; i < 10; i++) v = { tag: 6, value: v }
+      expect(() => encode(v)).not.toThrow()
+    })
+  })
+
+  describe('M4 — canonical mode enforces shortest-form tag numbers', () => {
+    it('rejects non-shortest tag number (d80100)', () => {
+      expect(() => decode('d80100', { validateCanonical: true }))
+        .toThrow(/Non-canonical/)
+    })
+    it('accepts shortest tag number (c100)', () => {
+      expect(() => decode('c100', { validateCanonical: true })).not.toThrow()
+    })
+  })
+
+  describe('M5 — float16 subnormals encode to shortest form and stay self-canonical', () => {
+    it('encode(2^-24) uses float16, not float32', () => {
+      expect(encodeToHex(5.960464477539063e-8)).toMatch(/^f9/)
+    })
+    it('encoder float output passes its own canonical validation', () => {
+      for (const v of [1.5, 65504, 5.960464477539063e-8, 0.1]) {
+        const h = encodeToHex(v)
+        expect(() => decode(h, { validateCanonical: true }), `value ${v} -> ${h}`).not.toThrow()
+      }
+    })
+  })
+
+  describe('L3 — readUint refuses values above MAX_SAFE_INTEGER (via decode)', () => {
+    it('8-byte integer above 2^53 decodes as BigInt without loss', () => {
+      // 0x1b + 0102030405060708 -> tag-free uint, larger than MAX_SAFE_INTEGER
+      const r = decode('1b0102030405060708')
+      expect(typeof r.value).toBe('bigint')
+      expect(r.value).toBe(0x0102030405060708n)
+    })
+  })
+
+  describe('L5 — diagnostic notation', () => {
+    it('renders indefinite-length arrays', () => {
+      expect(toDiagnostic(decode('9f0102ff').value)).toBe('[_ 1, 2]')
+    })
+    it('renders unassigned simple values', () => {
+      expect(toDiagnostic(decode('f820').value)).toBe('simple(32)')
+    })
+    it('renders indefinite-length text strings', () => {
+      const v = decode('7f626162ff').value // (_ "ab")  from chunks "ab"
+      expect(toDiagnostic(v)).toContain('_')
+    })
+  })
+})

package/src/__tests__/public-api.test.ts

@@ -123,6 +123,14 @@ describe('Public API - Functional Encode', () => {
     expect(result.hex).toBe('010203')
     expect(result.bytes).toEqual(new Uint8Array([0x01, 0x02, 0x03]))
   })
+
+  it('encode() should preserve -0', () => {
+    const result = encode(-0)
+    expect(result.hex).toBe('f98000')
+
+    const decoded = decode(result.hex)
+    expect(Object.is(decoded.value, -0)).toBe(true)
+  })
 })
 
 describe('Public API - Diagnostic Notation', () => {
@@ -277,6 +285,151 @@ describe('Public API - Utilities', () => {
   })
 })
 
+describe('Public API - Uint8Array Decode', () => {
+  it('decode() should accept Uint8Array input for integers', () => {
+    const result = decode(new Uint8Array([0x18, 0x64]))
+    expect(result.value).toBe(100)
+    expect(result.bytesRead).toBe(2)
+  })
+
+  it('decode() should accept Uint8Array for small integers', () => {
+    const result = decode(new Uint8Array([0x01]))
+    expect(result.value).toBe(1)
+    expect(result.bytesRead).toBe(1)
+  })
+
+  it('decode(Uint8Array) should produce identical results to decode(hexString)', () => {
+    // Integer 100
+    const hexResult = decode('1864')
+    const bytesResult = decode(new Uint8Array([0x18, 0x64]))
+    expect(bytesResult.value).toEqual(hexResult.value)
+    expect(bytesResult.bytesRead).toEqual(hexResult.bytesRead)
+
+    // String "IETF"
+    const hexStr = decode('6449455446')
+    const bytesStr = decode(new Uint8Array([0x64, 0x49, 0x45, 0x54, 0x46]))
+    expect(bytesStr.value).toEqual(hexStr.value)
+    expect(bytesStr.bytesRead).toEqual(hexStr.bytesRead)
+
+    // Array [1, 2, 3]
+    const hexArr = decode('83010203')
+    const bytesArr = decode(new Uint8Array([0x83, 0x01, 0x02, 0x03]))
+    expect(bytesArr.value).toEqual(hexArr.value)
+    expect(bytesArr.bytesRead).toEqual(hexArr.bytesRead)
+  })
+
+  it('decode(Uint8Array) should enforce maxInputSize limit', () => {
+    const bytes = new Uint8Array([0x01])
+    // Should succeed with a large enough limit
+    expect(() => decode(bytes, { limits: { maxInputSize: 100 } })).not.toThrow()
+
+    // Should throw when bytes exceed the limit
+    const largeBytes = new Uint8Array(200)
+    largeBytes[0] = 0x01 // valid CBOR integer 1
+    expect(() => decode(largeBytes, { limits: { maxInputSize: 10 } })).toThrow(/exceeds limit/)
+  })
+
+  it('decode(Uint8Array) should handle tagged values', () => {
+    // d87980 = tag 121, empty array
+    const result = decode(new Uint8Array([0xd8, 0x79, 0x80]))
+    expect(result.value).toMatchObject({ tag: 121, value: [] })
+  })
+
+  it('decode(Uint8Array) should handle maps', () => {
+    // a16161 01 = {"a": 1}
+    const result = decode(new Uint8Array([0xa1, 0x61, 0x61, 0x01]))
+    expect(result.bytesRead).toBe(4)
+    // Map with string key "a" -> 1
+    expect(result.value).toBeInstanceOf(Map)
+    expect((result.value as Map<string, number>).get('a')).toBe(1)
+  })
+
+  it('decode(Uint8Array) should handle boolean and null', () => {
+    expect(decode(new Uint8Array([0xf5])).value).toBe(true)
+    expect(decode(new Uint8Array([0xf4])).value).toBe(false)
+    expect(decode(new Uint8Array([0xf6])).value).toBe(null)
+  })
+
+  it('decode(Uint8Array) should reject empty Uint8Array', () => {
+    expect(() => decode(new Uint8Array([]))).toThrow()
+  })
+
+  it('decode(Uint8Array) should accept options', () => {
+    const result = decode(new Uint8Array([0x18, 0x64]), { strict: true })
+    expect(result.value).toBe(100)
+  })
+})
+
+describe('Public API - Uint8Array DecodeWithSourceMap', () => {
+  it('decodeWithSourceMap() should accept Uint8Array input', () => {
+    // d87980 = tag 121, empty array
+    const result = decodeWithSourceMap(new Uint8Array([0xd8, 0x79, 0x80]))
+    expect(result.value).toMatchObject({ tag: 121, value: [] })
+    expect(result.sourceMap).toBeDefined()
+    expect(Array.isArray(result.sourceMap)).toBe(true)
+    expect(result.sourceMap.length).toBeGreaterThan(0)
+  })
+
+  it('decodeWithSourceMap(Uint8Array) should match hex string results', () => {
+    const hexResult = decodeWithSourceMap('d87980')
+    const bytesResult = decodeWithSourceMap(new Uint8Array([0xd8, 0x79, 0x80]))
+    expect(bytesResult.value).toEqual(hexResult.value)
+    expect(bytesResult.sourceMap.length).toBe(hexResult.sourceMap.length)
+  })
+})
+
+describe('Public API - Uint8Array CborDecoder Class', () => {
+  it('CborDecoder.decode() should accept Uint8Array', () => {
+    const decoder = new CborDecoder()
+    const result = decoder.decode(new Uint8Array([0x18, 0x64]))
+    expect(result.value).toBe(100)
+    expect(result.bytesRead).toBe(2)
+  })
+
+  it('CborDecoder.decodeWithSourceMap() should accept Uint8Array', () => {
+    const decoder = new CborDecoder()
+    const result = decoder.decodeWithSourceMap(new Uint8Array([0xd8, 0x79, 0x80]))
+    expect(result.value).toMatchObject({ tag: 121, value: [] })
+    expect(result.sourceMap).toBeDefined()
+  })
+
+  it('CborDecoder with options should work with Uint8Array', () => {
+    const decoder = new CborDecoder({ strict: true })
+    const result = decoder.decode(new Uint8Array([0x18, 0x64]))
+    expect(result.value).toBe(100)
+  })
+})
+
+describe('Public API - Uint8Array useCborParser', () => {
+  it('parse() should accept Uint8Array', () => {
+    const { parse } = useCborParser()
+    const result = parse(new Uint8Array([0x18, 0x64]))
+    expect(result.value).toBe(100)
+    expect(result.bytesRead).toBe(2)
+  })
+
+  it('parseWithSourceMap() should accept Uint8Array', () => {
+    const { parseWithSourceMap } = useCborParser()
+    const result = parseWithSourceMap(new Uint8Array([0xd8, 0x79, 0x80]))
+    expect(result.value).toMatchObject({ tag: 121, value: [] })
+    expect(result.sourceMap).toBeDefined()
+  })
+
+  it('parseSequence() should accept Uint8Array', () => {
+    const { parseSequence } = useCborParser()
+    // Three separate integers: 1, 2, 3
+    const result = parseSequence(new Uint8Array([0x01, 0x02, 0x03]))
+    expect(result).toEqual([1, 2, 3])
+  })
+
+  it('parseSequence(Uint8Array) should match hex string results', () => {
+    const { parseSequence } = useCborParser()
+    const hexResult = parseSequence('010203')
+    const bytesResult = parseSequence(new Uint8Array([0x01, 0x02, 0x03]))
+    expect(bytesResult).toEqual(hexResult)
+  })
+})
+
 describe('Public API - Constants and Enums', () => {
   it('DEFAULT_OPTIONS should be exported', () => {
     expect(DEFAULT_OPTIONS).toBeDefined()

package/src/__tests__/roundtrip.test.ts

@@ -155,13 +155,12 @@ describe('Round-trip: Floats', () => {
     expect(roundTrip(0.0)).toBe(0)
   })
 
-  it('should encode -0.0 as integer 0 (encoder treats -0 as integer)', () => {
-    // -0.0 passes Number.isInteger() and Number.isSafeInteger(), so the
-    // encoder uses integer encoding (producing 0x00), which decodes as 0.
-    // This is expected CBOR behavior: -0 only preserves via float encoding.
+  it('should encode -0.0 as float16 preserving sign', () => {
+    // -0.0 is detected by the encoder and encoded as float16 (f98000),
+    // which correctly preserves the negative zero sign bit.
     const encoded = encode(-0.0)
-    expect(encoded.hex).toBe('00')
-    expect(roundTrip(-0.0)).toBe(0)
+    expect(encoded.hex).toBe('f98000')
+    expect(Object.is(roundTrip(-0.0), -0)).toBe(true)
   })
 
   it('should round-trip 1.5 (exact in float16)', () => {