@minnowdb/core 0.3.0 → 0.4.0

package/dist/storage/toolkit/sync-file.d.ts

@@ -26,4 +26,13 @@ export interface SyncFileHandle {
     /** Releases the handle (and any exclusive lock the platform ties to it). */
     close(): void;
 }
-//# sourceMappingURL=sync-file.d.ts.map
+/**
+ * Writes the complete buffer, retrying the short transfers permitted by sync-access handles.
+ * The common path is one `write` call; retries pass subarray views and never copy payload bytes.
+ */
+export declare function writeFully(handle: SyncFileHandle, buffer: Uint8Array, at: number, operation?: string): void;
+/**
+ * Reads exactly `buffer.byteLength` bytes, retrying short transfers without copying data. A zero
+ * transfer before the requested range is complete is an unexpected EOF, not a successful read.
+ */
+export declare function readFully(handle: SyncFileHandle, buffer: Uint8Array, at: number, operation?: string): void;

package/dist/storage/toolkit/sync-file.js

@@ -1,2 +1,50 @@
-export {};
-//# sourceMappingURL=sync-file.js.map
+/**
+ * Writes the complete buffer, retrying the short transfers permitted by sync-access handles.
+ * The common path is one `write` call; retries pass subarray views and never copy payload bytes.
+ */
+export function writeFully(handle, buffer, at, operation = "writing file bytes") {
+    assertTransferRange(at, buffer.byteLength, "write", operation);
+    let transferred = 0;
+    while (transferred < buffer.byteLength) {
+        const remaining = buffer.byteLength - transferred;
+        const chunk = transferred === 0 ? buffer : buffer.subarray(transferred);
+        const count = handle.write(chunk, { at: at + transferred });
+        assertTransferCount(count, remaining, "write", operation, at + transferred);
+        if (count === 0) {
+            throw new Error(`OPFS write made no progress while ${operation}: wrote ${String(transferred)} of ` +
+                `${String(buffer.byteLength)} bytes (stalled at file offset ${String(at + transferred)})`);
+        }
+        transferred += count;
+    }
+}
+/**
+ * Reads exactly `buffer.byteLength` bytes, retrying short transfers without copying data. A zero
+ * transfer before the requested range is complete is an unexpected EOF, not a successful read.
+ */
+export function readFully(handle, buffer, at, operation = "reading file bytes") {
+    assertTransferRange(at, buffer.byteLength, "read", operation);
+    let transferred = 0;
+    while (transferred < buffer.byteLength) {
+        const remaining = buffer.byteLength - transferred;
+        const chunk = transferred === 0 ? buffer : buffer.subarray(transferred);
+        const count = handle.read(chunk, { at: at + transferred });
+        assertTransferCount(count, remaining, "read", operation, at + transferred);
+        if (count === 0) {
+            throw new Error(`Unexpected EOF while ${operation}: read ${String(transferred)} of ` +
+                `${String(buffer.byteLength)} bytes (EOF at file offset ${String(at + transferred)})`);
+        }
+        transferred += count;
+    }
+}
+function assertTransferRange(at, length, kind, operation) {
+    if (!Number.isSafeInteger(at) || at < 0 || length > Number.MAX_SAFE_INTEGER - at) {
+        throw new RangeError(`Invalid OPFS ${kind} range while ${operation}: ${String(at)}+${String(length)} ` +
+            `must be a non-negative safe-integer byte range`);
+    }
+}
+function assertTransferCount(count, remaining, kind, operation, at) {
+    if (!Number.isSafeInteger(count) || count < 0 || count > remaining) {
+        throw new Error(`Invalid OPFS ${kind} result while ${operation}: handle reported ${String(count)} bytes ` +
+            `for a ${String(remaining)}-byte request at file offset ${String(at)}`);
+    }
+}

package/dist/storage/toolkit/wal.d.ts

@@ -1,4 +1,15 @@
-import type { SyncFileHandle } from "./sync-file.js";
+import { type SyncFileHandle } from "./sync-file.js";
+/**
+ * A WAL frame is control data, never bulk block data.  Bounding it prevents a corrupt length
+ * field (or an accidentally enormous catalog mutation) from turning recovery into an
+ * unbounded allocation.  Snapshot/block payloads live in extents, so 64 MiB leaves generous
+ * headroom for legitimate schema and transaction records.
+ */
+export declare const MAX_WAL_FRAME_BYTES: number;
+export interface ReplayedWalFrame {
+    payload: unknown;
+    frameEnd: number;
+}
 export declare class WalWriter {
     #private;
     constructor(handle: SyncFileHandle, offset: number);
@@ -11,12 +22,19 @@ export declare class WalWriter {
     close(): void;
 }
 /**
- * Reads every whole, checksum-valid frame from the handle's current content, in order,
- * stopping at the first torn or foreign bytes. Returns the payloads and the byte offset where
- * appending should resume (the end of the last valid frame — a torn tail is overwritten).
+ * Reads every whole, checksum-valid frame from the handle's current content, in order. A
+ * truncated final frame is ignored; complete foreign or corrupt bytes are rejected. Returns the
+ * payloads and the byte offset where appending should resume (the end of the last valid frame —
+ * a truncated tail is overwritten).
  */
 export declare function replayWalFrames(handle: SyncFileHandle): {
     payloads: unknown[];
+    /** End offset of each corresponding payload frame. */
+    frameEnds: number[];
     endOffset: number;
 };
-//# sourceMappingURL=wal.d.ts.map
+/**
+ * Streams checksum-valid frames with O(max-frame) memory. A truncated final frame is ignored;
+ * complete foreign or checksum-invalid bytes are corruption and fail closed.
+ */
+export declare function iterateWalFrames(handle: SyncFileHandle): Generator<ReplayedWalFrame>;

package/dist/storage/toolkit/wal.js

@@ -1,21 +1,34 @@
 import { crc32 } from "../../block-format/index.js";
 import { decodeRecordJson, encodeRecordJson } from "./wire.js";
+import { readFully, writeFully } from "./sync-file.js";
 /**
  * The write-ahead log, framed over one synchronous file handle its single writer holds open.
  *
  * Frame layout, little-endian: `u32 magic | u32 payloadLength | u32 crc32(payload) | payload`.
- * An append is a single synchronous write at the tail — measured at microseconds on a held
- * handle — and the only artifact a crash can leave is a torn final frame, which fails its
- * checksum and reads as "not written". Frames carry a global sequence number inside the
- * payload; the file is truncated to zero only after a checkpoint covering every frame has
- * been flushed, so replay is always newest-checkpoint-plus-tail.
+ * An append is one complete synchronous transfer at the tail — normally one microsecond-scale
+ * write on a held handle, with retries if the platform reports a short transfer. The only
+ * artifact a crash can leave is a truncated final frame, which reads as "not written". A
+ * complete frame with foreign marker or checksum-invalid bytes is corruption and fails closed.
+ * Frames carry a global sequence number inside the payload; the file is truncated to zero only
+ * after a checkpoint covering every frame has been flushed, so replay is always
+ * newest-checkpoint-plus-tail.
  */
 const FRAME_MAGIC = 0x4c574e4d; // "MNWL"
 const FRAME_HEADER_BYTES = 12;
+/**
+ * A WAL frame is control data, never bulk block data.  Bounding it prevents a corrupt length
+ * field (or an accidentally enormous catalog mutation) from turning recovery into an
+ * unbounded allocation.  Snapshot/block payloads live in extents, so 64 MiB leaves generous
+ * headroom for legitimate schema and transaction records.
+ */
+export const MAX_WAL_FRAME_BYTES = 64 * 1024 * 1024;
 export class WalWriter {
     #handle;
     #offset;
     constructor(handle, offset) {
+        if (!Number.isSafeInteger(offset) || offset < 0) {
+            throw new RangeError("WAL offset is outside the safe integer range");
+        }
         this.#handle = handle;
         this.#offset = offset;
     }
@@ -25,21 +38,47 @@ export class WalWriter {
     /** Appends one frame; with `flush`, durable before return. Synchronous — never yields. */
     append(payload, flush) {
         const bytes = encodeRecordJson(payload);
+        if (bytes.byteLength > MAX_WAL_FRAME_BYTES) {
+            throw new RangeError(`WAL frame payload exceeds the ${String(MAX_WAL_FRAME_BYTES)} byte limit: ` +
+                String(bytes.byteLength));
+        }
         const frame = new Uint8Array(FRAME_HEADER_BYTES + bytes.byteLength);
+        if (this.#offset > Number.MAX_SAFE_INTEGER - frame.byteLength) {
+            throw new RangeError("WAL offset exceeds the safe integer range");
+        }
         const view = new DataView(frame.buffer);
         view.setUint32(0, FRAME_MAGIC, true);
         view.setUint32(4, bytes.byteLength, true);
         view.setUint32(8, crc32(bytes), true);
         frame.set(bytes, FRAME_HEADER_BYTES);
-        this.#handle.write(frame, { at: this.#offset });
-        if (flush)
-            this.#handle.flush();
-        this.#offset += frame.byteLength;
+        const start = this.#offset;
+        try {
+            writeFully(this.#handle, frame, start, "appending a WAL frame");
+            if (flush)
+                this.#handle.flush();
+            this.#offset = start + frame.byteLength;
+        }
+        catch (error) {
+            // A complete write followed by a failed flush is not an acknowledged frame either.
+            // Remove it before unpublished extent bytes are rolled back.  If truncation itself
+            // fails, recovery will fail closed when it verifies the frame's referenced payloads.
+            try {
+                this.#handle.truncate(start);
+            }
+            catch {
+                // Preserve the original quota/I/O error.
+            }
+            throw error;
+        }
     }
     /** Empties the log after a flushed checkpoint has covered every frame in it. */
     reset() {
         this.#handle.truncate(0);
+        // truncate() already changed the handle's logical file position. Keep the writer aligned
+        // with it even if the durability flush is refused; a later append must start at zero rather
+        // than leave a sparse, unreplayable gap after the checkpoint.
         this.#offset = 0;
+        this.#handle.flush();
     }
     flush() {
         this.#handle.flush();
@@ -49,31 +88,54 @@ export class WalWriter {
     }
 }
 /**
- * Reads every whole, checksum-valid frame from the handle's current content, in order,
- * stopping at the first torn or foreign bytes. Returns the payloads and the byte offset where
- * appending should resume (the end of the last valid frame — a torn tail is overwritten).
+ * Reads every whole, checksum-valid frame from the handle's current content, in order. A
+ * truncated final frame is ignored; complete foreign or corrupt bytes are rejected. Returns the
+ * payloads and the byte offset where appending should resume (the end of the last valid frame —
+ * a truncated tail is overwritten).
  */
 export function replayWalFrames(handle) {
-    const size = handle.getSize();
-    const bytes = new Uint8Array(size);
-    handle.read(bytes, { at: 0 });
-    const view = new DataView(bytes.buffer);
     const payloads = [];
+    const frameEnds = [];
+    let endOffset = 0;
+    for (const frame of iterateWalFrames(handle)) {
+        payloads.push(frame.payload);
+        frameEnds.push(frame.frameEnd);
+        endOffset = frame.frameEnd;
+    }
+    return { payloads, frameEnds, endOffset };
+}
+/**
+ * Streams checksum-valid frames with O(max-frame) memory. A truncated final frame is ignored;
+ * complete foreign or checksum-invalid bytes are corruption and fail closed.
+ */
+export function* iterateWalFrames(handle) {
+    const size = handle.getSize();
+    if (!Number.isSafeInteger(size) || size < 0) {
+        throw new Error(`Invalid WAL byte length: ${String(size)}`);
+    }
+    const header = new Uint8Array(FRAME_HEADER_BYTES);
+    const headerView = new DataView(header.buffer);
     let offset = 0;
     while (offset + FRAME_HEADER_BYTES <= size) {
-        if (view.getUint32(offset, true) !== FRAME_MAGIC)
-            break;
-        const length = view.getUint32(offset + 4, true);
-        const checksum = view.getUint32(offset + 8, true);
+        readFully(handle, header, offset, "reading a WAL frame header for recovery");
+        if (headerView.getUint32(0, true) !== FRAME_MAGIC) {
+            throw new Error(`WAL frame marker mismatch at offset ${String(offset)}`);
+        }
+        const length = headerView.getUint32(4, true);
+        const checksum = headerView.getUint32(8, true);
+        if (length > MAX_WAL_FRAME_BYTES) {
+            throw new Error(`WAL frame at offset ${String(offset)} exceeds the ${String(MAX_WAL_FRAME_BYTES)} ` +
+                `byte limit: ${String(length)}`);
+        }
         const end = offset + FRAME_HEADER_BYTES + length;
-        if (end > size)
-            break;
-        const payload = bytes.subarray(offset + FRAME_HEADER_BYTES, end);
-        if (crc32(payload) !== checksum)
+        if (!Number.isSafeInteger(end) || end > size)
             break;
-        payloads.push(decodeRecordJson(payload));
+        const payloadBytes = new Uint8Array(length);
+        readFully(handle, payloadBytes, offset + FRAME_HEADER_BYTES, "reading a WAL frame payload for recovery");
+        if (crc32(payloadBytes) !== checksum) {
+            throw new Error(`WAL frame checksum mismatch at offset ${String(offset)}`);
+        }
+        yield { payload: decodeRecordJson(payloadBytes), frameEnd: end };
         offset = end;
     }
-    return { payloads, endOffset: offset };
 }
-//# sourceMappingURL=wal.js.map

package/dist/storage/toolkit/wire.d.ts

@@ -9,7 +9,7 @@
  * can produce that object naturally — keys are ids and column names, values are JSON scalars —
  * and the reviver only converts an object whose sole key is `$n`.
  */
-export declare const LOG_FORMAT_VERSION = 2;
+export declare const LOG_FORMAT_VERSION = 5;
 export declare function encodeRecordJson(value: unknown): Uint8Array;
 export declare function decodeRecordJson(bytes: Uint8Array): unknown;
 /** Immutable artifact payloads (full-text base chunks) inside extents. */
@@ -22,13 +22,12 @@ export interface PostingChunkEntry {
     tf: number[];
 }
 /**
- * Compact postings payload for OPFS. The old generic JSON encoding spelled every bigint row
- * locator as `{\"$n\":\"123\"}`; secondary indexes therefore took more space than the compressed
- * table they accelerated. Terms are UTF-8 and the already-sorted row locators are delta-varints.
+ * Compact postings payload for OPFS. Terms are UTF-8 and the already-sorted row locators are
+ * delta-varints, keeping secondary indexes smaller than the table they accelerate.
  * The envelope keeps the same version and checksum guarantees as every other immutable chunk.
  */
 export declare function encodePostingChunk(entries: readonly PostingChunkEntry[]): Uint8Array;
-/** `undefined` means this is an older generic chunk; callers then use the JSON decoder. */
+/** `undefined` means the bytes are torn or are not a canonical postings envelope. */
 export declare function decodePostingChunk(bytes: Uint8Array): PostingChunkEntry[] | undefined;
 /**
  * The leader's checkpoint slots are written synchronously (no compression — that needs an
@@ -37,4 +36,3 @@ export declare function decodePostingChunk(bytes: Uint8Array): PostingChunkEntry
  */
 export declare function encodeSyncCheckpoint(state: unknown): Uint8Array;
 export declare function decodeSyncCheckpoint(bytes: Uint8Array): unknown;
-//# sourceMappingURL=wire.d.ts.map

package/dist/storage/toolkit/wire.js

@@ -1,4 +1,5 @@
 import { crc32 } from "../../block-format/index.js";
+import { MAX_ROW_ID_EXCLUSIVE_END, StorageFormatVersionError } from "../types.js";
 /**
  * Payload encodings for a log-structured adapter's control data: checkpoint files, immutable
  * artifact chunks, and the JSON codec write-ahead-log frames carry. Every envelope is
@@ -10,9 +11,9 @@ import { crc32 } from "../../block-format/index.js";
  * can produce that object naturally — keys are ids and column names, values are JSON scalars —
  * and the reviver only converts an object whose sole key is `$n`.
  */
-export const LOG_FORMAT_VERSION = 2;
+export const LOG_FORMAT_VERSION = 5;
 const textEncoder = new TextEncoder();
-const textDecoder = new TextDecoder();
+const textDecoder = new TextDecoder("utf-8", { fatal: true });
 export function encodeRecordJson(value) {
     // The replacer costs ~3x on big payloads because it runs per node; most frames carry no
     // bigints at all, and stringify announces one by throwing.
@@ -21,8 +22,17 @@ export function encodeRecordJson(value) {
         json = JSON.stringify(value);
     }
     catch {
-        json = JSON.stringify(value, (_key, entry) => typeof entry === "bigint" ? { $n: entry.toString() } : entry);
+        json = JSON.stringify(value, (_key, entry) => {
+            if (typeof entry !== "bigint")
+                return entry;
+            if (entry < 0n || entry > MAX_ROW_ID_EXCLUSIVE_END) {
+                throw new RangeError("Record bigint exceeds the unsigned 64-bit persisted range");
+            }
+            return { $n: entry.toString() };
+        });
     }
+    if (typeof json !== "string")
+        throw new TypeError("Record value is not JSON-serializable");
     return textEncoder.encode(json);
 }
 export function decodeRecordJson(bytes) {
@@ -33,7 +43,15 @@ export function decodeRecordJson(bytes) {
             !Array.isArray(entry) &&
             Object.keys(entry).length === 1 &&
             typeof entry.$n === "string") {
-            return BigInt(entry.$n);
+            const decimal = entry.$n;
+            if (!/^(?:0|[1-9][0-9]{0,19})$/.test(decimal)) {
+                throw new TypeError("Record bigint is not a canonical bounded unsigned decimal");
+            }
+            const value = BigInt(decimal);
+            if (value > MAX_ROW_ID_EXCLUSIVE_END) {
+                throw new RangeError("Record bigint exceeds the unsigned 64-bit persisted range");
+            }
+            return value;
         }
         return entry;
     });
@@ -51,8 +69,8 @@ function encodeEnvelope(magic, payload) {
 }
 /**
  * `undefined` means the bytes are torn or foreign — treat as "not written". A recognized magic
- * with an unknown format version throws instead: that file was written by a newer build and
- * ignoring it would silently roll the database back.
+ * with an unknown format version throws instead: reading a different layout as the current one
+ * would silently corrupt or roll back the database.
  */
 function decodeEnvelope(magic, bytes) {
     if (bytes.byteLength < ENVELOPE_HEADER_BYTES)
@@ -64,11 +82,10 @@ function decodeEnvelope(magic, bytes) {
     const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
     const version = view.getUint32(8, true);
     if (version !== LOG_FORMAT_VERSION) {
-        throw new Error(`This database was written by a newer format (version ${String(version)}); ` +
-            `this build reads version ${String(LOG_FORMAT_VERSION)}`);
+        throw new StorageFormatVersionError("opfs", `envelope/${magic}`, version, LOG_FORMAT_VERSION, version < LOG_FORMAT_VERSION ? "older" : "newer");
     }
     const payloadLength = view.getUint32(12, true);
-    if (bytes.byteLength < ENVELOPE_HEADER_BYTES + payloadLength)
+    if (bytes.byteLength !== ENVELOPE_HEADER_BYTES + payloadLength)
         return undefined;
     const payload = bytes.subarray(ENVELOPE_HEADER_BYTES, ENVELOPE_HEADER_BYTES + payloadLength);
     if (crc32(payload) !== view.getUint32(16, true))
@@ -87,9 +104,8 @@ export function decodeChunk(bytes) {
     return payload === undefined ? undefined : decodeRecordJson(payload);
 }
 /**
- * Compact postings payload for OPFS. The old generic JSON encoding spelled every bigint row
- * locator as `{\"$n\":\"123\"}`; secondary indexes therefore took more space than the compressed
- * table they accelerated. Terms are UTF-8 and the already-sorted row locators are delta-varints.
+ * Compact postings payload for OPFS. Terms are UTF-8 and the already-sorted row locators are
+ * delta-varints, keeping secondary indexes smaller than the table they accelerate.
  * The envelope keeps the same version and checksum guarantees as every other immutable chunk.
  */
 export function encodePostingChunk(entries) {
@@ -100,46 +116,69 @@ export function encodePostingChunk(entries) {
             throw new TypeError("Posting row IDs and term frequencies must have the same length");
         }
         const term = textEncoder.encode(entry.term);
+        if (term.byteLength === 0)
+            throw new TypeError("Posting terms cannot be empty");
+        if (entry.rowIds.length === 0)
+            throw new TypeError("Postings cannot have no row IDs");
         writer.varuint(BigInt(term.byteLength));
         writer.bytes(term);
         writer.varuint(BigInt(entry.rowIds.length));
         let previous = 0n;
         for (const rowId of entry.rowIds) {
-            if (rowId < previous)
-                throw new TypeError("Posting row IDs must be sorted");
+            if (rowId <= previous || rowId > MAX_ROW_ID_EXCLUSIVE_END - 1n) {
+                throw new TypeError("Posting row IDs must be positive, uint64, and strictly sorted");
+            }
             writer.varuint(rowId - previous);
             previous = rowId;
         }
         for (const frequency of entry.tf) {
-            if (!Number.isSafeInteger(frequency) || frequency < 0) {
-                throw new TypeError("Posting term frequencies must be non-negative whole numbers");
+            if (!Number.isSafeInteger(frequency) || frequency <= 0) {
+                throw new TypeError("Posting term frequencies must be positive whole numbers");
             }
             writer.varuint(BigInt(frequency));
         }
     }
     return encodeEnvelope(POSTING_CHUNK_MAGIC, writer.finish());
 }
-/** `undefined` means this is an older generic chunk; callers then use the JSON decoder. */
+/** `undefined` means the bytes are torn or are not a canonical postings envelope. */
 export function decodePostingChunk(bytes) {
     const payload = decodeEnvelope(POSTING_CHUNK_MAGIC, bytes);
     if (payload === undefined)
         return undefined;
     const reader = new BinaryReader(payload);
     const count = reader.safeInteger("posting count");
+    if (count > Math.floor(reader.remaining / 5)) {
+        throw new Error("Posting count exceeds the remaining payload");
+    }
     const entries = new Array(count);
     for (let entryIndex = 0; entryIndex < count; entryIndex += 1) {
         const termLength = reader.safeInteger("posting term length");
+        if (termLength < 1 || termLength > reader.remaining) {
+            throw new Error("Posting term length exceeds the remaining payload");
+        }
         const term = textDecoder.decode(reader.bytes(termLength));
         const rowCount = reader.safeInteger("posting row count");
+        if (rowCount < 1 || rowCount > Math.floor(reader.remaining / 2)) {
+            throw new Error("Posting row count exceeds the remaining payload");
+        }
         const rowIds = new Array(rowCount);
         let previous = 0n;
         for (let rowIndex = 0; rowIndex < rowCount; rowIndex += 1) {
             previous += reader.varuint();
+            if (previous < 1n || previous > MAX_ROW_ID_EXCLUSIVE_END - 1n) {
+                throw new RangeError("Posting row ID exceeds the uint64 range");
+            }
+            if (rowIndex > 0 && previous <= (rowIds[rowIndex - 1] ?? 0n)) {
+                throw new TypeError("Posting row IDs are not strictly sorted");
+            }
             rowIds[rowIndex] = previous;
         }
         const tf = new Array(rowCount);
         for (let rowIndex = 0; rowIndex < rowCount; rowIndex += 1) {
-            tf[rowIndex] = reader.safeInteger("posting term frequency");
+            const frequency = reader.safeInteger("posting term frequency");
+            if (frequency <= 0)
+                throw new TypeError("Posting term frequency must be positive");
+            tf[rowIndex] = frequency;
         }
         entries[entryIndex] = { term, rowIds, tf };
     }
@@ -156,8 +195,9 @@ class BinaryWriter {
         this.#length += bytes.byteLength;
     }
     varuint(value) {
-        if (value < 0n)
-            throw new RangeError("A varuint cannot be negative");
+        if (value < 0n || value >= MAX_ROW_ID_EXCLUSIVE_END) {
+            throw new RangeError("A varuint must fit canonical uint64");
+        }
         do {
             this.#reserve(1);
             const byte = Number(value & 0x7fn);
@@ -170,12 +210,18 @@ class BinaryWriter {
         return this.#buffer.slice(0, this.#length);
     }
     #reserve(extra) {
+        if (!Number.isSafeInteger(extra) || extra < 0)
+            throw new RangeError("Invalid binary growth");
         const needed = this.#length + extra;
+        if (!Number.isSafeInteger(needed))
+            throw new RangeError("Binary payload is too large");
         if (needed <= this.#buffer.byteLength)
             return;
         let capacity = this.#buffer.byteLength;
-        while (capacity < needed)
-            capacity *= 2;
+        while (capacity < needed) {
+            const doubled = capacity * 2;
+            capacity = Number.isSafeInteger(doubled) ? doubled : needed;
+        }
         const grown = new Uint8Array(capacity);
         grown.set(this.#buffer);
         this.#buffer = grown;
@@ -190,8 +236,11 @@ class BinaryReader {
     get done() {
         return this.#offset === this.source.byteLength;
     }
+    get remaining() {
+        return this.source.byteLength - this.#offset;
+    }
     bytes(length) {
-        if (this.#offset + length > this.source.byteLength)
+        if (!Number.isSafeInteger(length) || length < 0 || length > this.remaining)
             throw new Error("Posting chunk is truncated");
         const bytes = this.source.subarray(this.#offset, this.#offset + length);
         this.#offset += length;
@@ -205,9 +254,16 @@ class BinaryReader {
             if (byte === undefined)
                 throw new Error("Posting chunk is truncated");
             this.#offset += 1;
+            if (byteIndex === 9 && (byte & 0xfe) !== 0) {
+                throw new Error("Posting chunk varuint exceeds uint64");
+            }
             value |= BigInt(byte & 0x7f) << shift;
-            if ((byte & 0x80) === 0)
+            if ((byte & 0x80) === 0) {
+                if (byteIndex > 0 && (byte & 0x7f) === 0) {
+                    throw new Error("Posting chunk varuint is overlong");
+                }
                 return value;
+            }
             shift += 7n;
         }
         throw new Error("Posting chunk varuint is too wide");
@@ -231,4 +287,3 @@ export function decodeSyncCheckpoint(bytes) {
     const payload = decodeEnvelope(SYNC_CHECKPOINT_MAGIC, bytes);
     return payload === undefined ? undefined : decodeRecordJson(payload);
 }
-//# sourceMappingURL=wire.js.map