@reallyme/codec 0.1.20 → 0.1.22

package/README.md

@@ -47,8 +47,22 @@ const decoded = ReallyMeCodec.base64urlDecode(encoded);
 | Multiformats | `base58btcEncode`, `base58btcDecode`, `multibase*`, `multicodec*`, `multikey*`, binding validation |
 | DAG-CBOR and CID | `dagCborEncode`, `dagCborDecode`, `dagCborComputeCid`, `dagCborVerifyCid`, content hash and multihash helpers |
 | JCS | `canonicalizeJson`, `canonicalizeJsonText` |
-| PEM | `encodePem`, `decodePem` with strict label and size policy |
-| Protobuf | `@reallyme/codec/proto` exports `reallyme.codec.v1` generated types |
+| PEM | wipeable `Uint8Array` armor through `encodePem`, `decodePem`, with strict label and size policy |
+| Protobuf | `processProto`, `processProtoJson`, and `@reallyme/codec/proto` generated types |
+
+`processProto` accepts binary generated `CodecOperationRequest` bytes.
+`processProtoJson` accepts UTF-8 bytes containing the generated ProtoJSON view
+of that same message. Both return binary `CodecProtoResultEnvelope` bytes;
+expected validation failures are represented in the envelope and are not
+thrown as backend exceptions.
+
+The operation-specific `*Proto` helpers remain ergonomic request builders. They
+encode generated messages and enter the same single WASM boundary rather than
+calling operation-specific WASM exports.
+
+Swift and Kotlin/Java expose the same generic `processProto` and
+`processProtoJson` methods through the Rust C/JNI boundary. The method names
+and envelope semantics are intentionally identical across SDKs.
 
 Errors are typed as `ReallyMeCodecError`; they do not include raw input bytes
 or backend exception text.

package/dist/boundary.d.ts

@@ -0,0 +1,11 @@
+export declare const MAX_CODEC_FFI_INPUT_BYTES = 1048576;
+export declare const MAX_CODEC_FFI_OUTPUT_BYTES = 67108864;
+export declare const MAX_CODEC_PROTO_MESSAGE_BYTES = 1048576;
+export declare const MAX_CODEC_PROTO_JSON_BYTES = 1572864;
+export declare const MAX_CODEC_BOUNDARY_NODES = 1048576;
+export declare const requireBoundaryAggregate: (lengths: ReadonlyArray<number>, maximum?: number) => void;
+/** Returns UTF-8 length without allocating an encoded copy. */
+export declare const utf8ByteLength: (value: string) => number;
+export declare const requireBoundaryUtf8String: (value: string, allowEmpty?: boolean, maximum?: number) => number;
+/** Validates, snapshots, and serializes untrusted JSON within a fixed budget. */
+export declare const stringifyBoundaryJson: (value: unknown) => string;

package/dist/boundary.js

@@ -0,0 +1,250 @@
+// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+//
+// SPDX-License-Identifier: Apache-2.0
+import { ReallyMeCodecError } from "./errors.js";
+export const MAX_CODEC_FFI_INPUT_BYTES = 1_048_576;
+export const MAX_CODEC_FFI_OUTPUT_BYTES = 67_108_864;
+export const MAX_CODEC_PROTO_MESSAGE_BYTES = 1_048_576;
+export const MAX_CODEC_PROTO_JSON_BYTES = 1_572_864;
+// Every JSON node needs at least one serialized byte. Deriving this traversal
+// guard from the wire limit prevents hostile in-memory graphs from causing
+// unbounded work without rejecting a document the byte-bounded Rust lane accepts.
+export const MAX_CODEC_BOUNDARY_NODES = MAX_CODEC_FFI_INPUT_BYTES;
+const MAX_JSON_CONTAINER_DEPTH = 128;
+const invalidInput = () => {
+    throw new ReallyMeCodecError("invalid-input");
+};
+const consumeBudget = (budget, field, amount, maximum) => {
+    if (!Number.isSafeInteger(amount) || amount < 0 || budget[field] > maximum - amount) {
+        invalidInput();
+    }
+    budget[field] += amount;
+};
+export const requireBoundaryAggregate = (lengths, maximum = MAX_CODEC_FFI_INPUT_BYTES) => {
+    let aggregate = 0;
+    for (const length of lengths) {
+        if (!Number.isSafeInteger(length) ||
+            length < 0 ||
+            aggregate > maximum - length) {
+            invalidInput();
+        }
+        aggregate += length;
+    }
+};
+/** Returns UTF-8 length without allocating an encoded copy. */
+export const utf8ByteLength = (value) => {
+    if (typeof value !== "string") {
+        invalidInput();
+    }
+    let length = 0;
+    for (let index = 0; index < value.length; index += 1) {
+        const codeUnit = value.charCodeAt(index);
+        let increment;
+        if (codeUnit <= 0x7f) {
+            increment = 1;
+        }
+        else if (codeUnit <= 0x7ff) {
+            increment = 2;
+        }
+        else if (codeUnit >= 0xd800 &&
+            codeUnit <= 0xdbff &&
+            index + 1 < value.length) {
+            const next = value.charCodeAt(index + 1);
+            if (next >= 0xdc00 && next <= 0xdfff) {
+                increment = 4;
+                index += 1;
+            }
+            else {
+                increment = 3;
+            }
+        }
+        else {
+            increment = 3;
+        }
+        if (length > Number.MAX_SAFE_INTEGER - increment) {
+            invalidInput();
+        }
+        length += increment;
+    }
+    return length;
+};
+export const requireBoundaryUtf8String = (value, allowEmpty = true, maximum = MAX_CODEC_FFI_INPUT_BYTES) => {
+    if (typeof value !== "string" || (!allowEmpty && value.length === 0)) {
+        invalidInput();
+    }
+    // Every UTF-16 code unit contributes at least one UTF-8 byte. This rejects
+    // obviously oversized strings before walking their full contents.
+    if (value.length > maximum) {
+        invalidInput();
+    }
+    const length = utf8ByteLength(value);
+    requireBoundaryAggregate([length], maximum);
+    return length;
+};
+const jsonStringByteLength = (value) => {
+    let length = 2;
+    for (let index = 0; index < value.length; index += 1) {
+        const codeUnit = value.charCodeAt(index);
+        let increment;
+        if (codeUnit === 0x22 || codeUnit === 0x5c) {
+            increment = 2;
+        }
+        else if (codeUnit <= 0x1f) {
+            increment =
+                codeUnit === 0x08 ||
+                    codeUnit === 0x09 ||
+                    codeUnit === 0x0a ||
+                    codeUnit === 0x0c ||
+                    codeUnit === 0x0d
+                    ? 2
+                    : 6;
+        }
+        else if (codeUnit <= 0x7f) {
+            increment = 1;
+        }
+        else if (codeUnit <= 0x7ff) {
+            increment = 2;
+        }
+        else if (codeUnit >= 0xd800 && codeUnit <= 0xdbff) {
+            if (index + 1 < value.length) {
+                const next = value.charCodeAt(index + 1);
+                if (next >= 0xdc00 && next <= 0xdfff) {
+                    increment = 4;
+                    index += 1;
+                }
+                else {
+                    increment = 6;
+                }
+            }
+            else {
+                increment = 6;
+            }
+        }
+        else if (codeUnit >= 0xdc00 && codeUnit <= 0xdfff) {
+            increment = 6;
+        }
+        else {
+            increment = 3;
+        }
+        if (length > Number.MAX_SAFE_INTEGER - increment) {
+            invalidInput();
+        }
+        length += increment;
+    }
+    return length;
+};
+const readOwnDataProperty = (value, key) => {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (descriptor === undefined || !("value" in descriptor)) {
+        return invalidInput();
+    }
+    return descriptor.value;
+};
+const normalizeJson = (value, depth, seen, budget) => {
+    consumeBudget(budget, "nodes", 1, MAX_CODEC_BOUNDARY_NODES);
+    if (value === null) {
+        consumeBudget(budget, "bytes", 4, MAX_CODEC_FFI_INPUT_BYTES);
+        return null;
+    }
+    switch (typeof value) {
+        case "boolean":
+            consumeBudget(budget, "bytes", value ? 4 : 5, MAX_CODEC_FFI_INPUT_BYTES);
+            return value;
+        case "string":
+            consumeBudget(budget, "bytes", jsonStringByteLength(value), MAX_CODEC_FFI_INPUT_BYTES);
+            return value;
+        case "number": {
+            if (!Number.isFinite(value)) {
+                invalidInput();
+            }
+            const encoded = JSON.stringify(value);
+            if (typeof encoded !== "string") {
+                invalidInput();
+            }
+            consumeBudget(budget, "bytes", encoded.length, MAX_CODEC_FFI_INPUT_BYTES);
+            return value;
+        }
+        case "bigint":
+        case "function":
+        case "symbol":
+        case "undefined":
+            return invalidInput();
+        case "object":
+            break;
+    }
+    if (seen.has(value) || depth >= MAX_JSON_CONTAINER_DEPTH) {
+        invalidInput();
+    }
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null && !Array.isArray(value)) {
+        invalidInput();
+    }
+    seen.add(value);
+    try {
+        if (Array.isArray(value)) {
+            const rawLength = readOwnDataProperty(value, "length");
+            if (typeof rawLength !== "number") {
+                return invalidInput();
+            }
+            const length = rawLength;
+            if (!Number.isSafeInteger(length) ||
+                length < 0 ||
+                length > MAX_CODEC_BOUNDARY_NODES - budget.nodes) {
+                invalidInput();
+            }
+            consumeBudget(budget, "bytes", length === 0 ? 2 : length + 1, MAX_CODEC_FFI_INPUT_BYTES);
+            const normalized = [];
+            for (let index = 0; index < length; index += 1) {
+                // Indexed access and iteration both invoke array accessors. Snapshot
+                // only own data properties so validation cannot execute untrusted code.
+                const entry = readOwnDataProperty(value, String(index));
+                normalized.push(normalizeJson(entry, depth + 1, seen, budget));
+            }
+            return normalized;
+        }
+        const keys = Object.keys(value);
+        if (keys.length > MAX_CODEC_BOUNDARY_NODES - budget.nodes) {
+            invalidInput();
+        }
+        consumeBudget(budget, "bytes", keys.length === 0 ? 2 : keys.length + 1, MAX_CODEC_FFI_INPUT_BYTES);
+        const entries = [];
+        for (const key of keys) {
+            const descriptor = Object.getOwnPropertyDescriptor(value, key);
+            if (descriptor === undefined) {
+                return invalidInput();
+            }
+            if (!("value" in descriptor)) {
+                return invalidInput();
+            }
+            consumeBudget(budget, "bytes", jsonStringByteLength(key), MAX_CODEC_FFI_INPUT_BYTES);
+            consumeBudget(budget, "bytes", 1, MAX_CODEC_FFI_INPUT_BYTES);
+            const propertyValue = descriptor.value;
+            entries.push([key, normalizeJson(propertyValue, depth + 1, seen, budget)]);
+        }
+        return Object.fromEntries(entries);
+    }
+    finally {
+        seen.delete(value);
+    }
+};
+/** Validates, snapshots, and serializes untrusted JSON within a fixed budget. */
+export const stringifyBoundaryJson = (value) => {
+    try {
+        const normalized = normalizeJson(value, 0, new WeakSet(), {
+            bytes: 0,
+            nodes: 0,
+        });
+        const encoded = JSON.stringify(normalized);
+        if (typeof encoded !== "string") {
+            invalidInput();
+        }
+        requireBoundaryAggregate([utf8ByteLength(encoded)]);
+        return encoded;
+    }
+    catch (error) {
+        if (error instanceof ReallyMeCodecError) {
+            throw error;
+        }
+        return invalidInput();
+    }
+};

package/dist/cbor.js

@@ -1,10 +1,54 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
 // SPDX-License-Identifier: Apache-2.0
+import { create } from "@bufbuild/protobuf";
+import { MAX_CODEC_BOUNDARY_NODES, stringifyBoundaryJson, } from "./boundary.js";
 import { ReallyMeCodecError } from "./errors.js";
-import { ensureBytesInput, ensureStringValue, readBooleanProperty, readBytesOutput, readObjectOutput, readProtoResultOutput, readStringOutput, readStringProperty, readStringValueProperty, readNumberOutput, } from "./readOutput.js";
+import { CodecDagCborVerifyCidRequestSchema, CodecOperationRequestSchema, } from "./proto/generated/reallyme/codec/v1/codec_pb.js";
+import { processGeneratedProtoRequest, protoPayloadOrThrow, } from "./protoProcess.js";
+import { ensureBytesInput, ensureStringValue, readBooleanProperty, readBytesOutput, readObjectOutput, readStringOutput, readStringProperty, readStringValueProperty, readNumberOutput, } from "./readOutput.js";
 import { requireReallyMeCodecWasmProvider } from "./wasmProvider.js";
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const invalidCborInput = () => {
+    throw new ReallyMeCodecError("invalid-input");
+};
+const isRecord = (value) => {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return false;
+    }
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+};
+const readDataProperty = (value, name) => {
+    const descriptor = Object.getOwnPropertyDescriptor(value, name);
+    if (descriptor === undefined || !("value" in descriptor)) {
+        return invalidCborInput();
+    }
+    return descriptor.value;
+};
+const snapshotArray = (value) => {
+    if (!Array.isArray(value) || Object.getPrototypeOf(value) !== Array.prototype) {
+        return invalidCborInput();
+    }
+    const rawLength = readDataProperty(value, "length");
+    if (typeof rawLength !== "number") {
+        return invalidCborInput();
+    }
+    const length = rawLength;
+    if (!Number.isSafeInteger(length) ||
+        length < 0 ||
+        length > MAX_CODEC_BOUNDARY_NODES) {
+        return invalidCborInput();
+    }
+    const entries = [];
+    for (let index = 0; index < length; index += 1) {
+        const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+        if (descriptor === undefined || !("value" in descriptor)) {
+            return invalidCborInput();
+        }
+        entries.push(descriptor.value);
+    }
+    return entries;
+};
 const i64Min = -(1n << 63n);
 const i64Max = (1n << 63n) - 1n;
 const decimalIntegerPattern = /^-?(0|[1-9][0-9]*)$/u;
@@ -41,8 +85,16 @@ const validateCborInteger = (value) => {
     }
     throw new ReallyMeCodecError("invalid-input");
 };
-const validateCborValue = (value, depth = 0, seen = new WeakSet()) => {
-    if (!isRecord(value) || typeof value.type !== "string") {
+const validateCborValue = (value, depth = 0, seen = new WeakSet(), state = { nodes: 0 }) => {
+    if (state.nodes >= MAX_CODEC_BOUNDARY_NODES) {
+        throw new ReallyMeCodecError("invalid-input");
+    }
+    state.nodes += 1;
+    if (!isRecord(value)) {
+        throw new ReallyMeCodecError("invalid-input");
+    }
+    const type = readDataProperty(value, "type");
+    if (typeof type !== "string") {
         throw new ReallyMeCodecError("invalid-input");
     }
     if (seen.has(value)) {
@@ -50,46 +102,64 @@ const validateCborValue = (value, depth = 0, seen = new WeakSet()) => {
     }
     seen.add(value);
     try {
-        switch (value.type) {
+        switch (type) {
             case "null":
                 return { type: "null" };
-            case "bool":
-                if (typeof value.value !== "boolean") {
+            case "bool": {
+                const child = readDataProperty(value, "value");
+                if (typeof child !== "boolean") {
                     throw new ReallyMeCodecError("invalid-input");
                 }
-                return { type: "bool", value: value.value };
+                return { type: "bool", value: child };
+            }
             case "int":
-                return { type: "int", value: validateCborInteger(value.value) };
+                return {
+                    type: "int",
+                    value: validateCborInteger(readDataProperty(value, "value")),
+                };
             case "string":
-            case "bytes":
-                if (typeof value.value !== "string") {
+            case "bytes": {
+                const child = readDataProperty(value, "value");
+                if (typeof child !== "string") {
                     throw new ReallyMeCodecError("invalid-input");
                 }
-                return { type: value.type, value: value.value };
-            case "array":
-                if (!Array.isArray(value.value)) {
+                return { type, value: child };
+            }
+            case "array": {
+                const children = snapshotArray(readDataProperty(value, "value"));
+                if (children.length > MAX_CODEC_BOUNDARY_NODES - state.nodes) {
                     throw new ReallyMeCodecError("invalid-input");
                 }
                 return {
                     type: "array",
-                    value: value.value.map((entry) => validateCborValue(entry, childContainerDepth(depth), seen)),
+                    value: children.map((entry) => validateCborValue(entry, childContainerDepth(depth), seen, state)),
                 };
-            case "map":
-                if (!Array.isArray(value.value)) {
+            }
+            case "map": {
+                const entries = snapshotArray(readDataProperty(value, "value"));
+                if (entries.length > MAX_CODEC_BOUNDARY_NODES - state.nodes) {
                     throw new ReallyMeCodecError("invalid-input");
                 }
+                state.nodes += entries.length;
+                const keys = new Set();
                 return {
                     type: "map",
-                    value: value.value.map((entry) => {
-                        if (!isRecord(entry) || typeof entry.key !== "string") {
+                    value: entries.map((entry) => {
+                        if (!isRecord(entry)) {
+                            throw new ReallyMeCodecError("invalid-input");
+                        }
+                        const key = readDataProperty(entry, "key");
+                        if (typeof key !== "string" || keys.has(key)) {
                             throw new ReallyMeCodecError("invalid-input");
                         }
+                        keys.add(key);
                         return {
-                            key: entry.key,
-                            value: validateCborValue(entry.value, childContainerDepth(depth), seen),
+                            key,
+                            value: validateCborValue(readDataProperty(entry, "value"), childContainerDepth(depth), seen, state),
                         };
                     }),
                 };
+            }
             default:
                 throw new ReallyMeCodecError("invalid-input");
         }
@@ -124,8 +194,13 @@ const cborValueForJson = (value) => {
     }
 };
 const readCborValue = (json) => {
-    const parsed = JSON.parse(json);
-    return validateCborValue(parsed);
+    try {
+        const parsed = JSON.parse(json);
+        return validateCborValue(parsed);
+    }
+    catch (_error) {
+        throw new ReallyMeCodecError("provider-failure");
+    }
 };
 const readCidVerification = (value) => {
     const object = readObjectOutput(value);
@@ -136,8 +211,17 @@ const readCidVerification = (value) => {
     };
 };
 export const dagCborEncode = (value) => {
-    const normalized = validateCborValue(value);
-    return readBytesOutput(requireReallyMeCodecWasmProvider().dagCborEncode(JSON.stringify(cborValueForJson(normalized))));
+    let normalized;
+    try {
+        normalized = validateCborValue(value);
+    }
+    catch (error) {
+        if (error instanceof ReallyMeCodecError) {
+            throw error;
+        }
+        return invalidCborInput();
+    }
+    return readBytesOutput(requireReallyMeCodecWasmProvider().dagCborEncode(stringifyBoundaryJson(cborValueForJson(normalized))));
 };
 export const dagCborDecode = (bytes) => {
     ensureBytesInput(bytes);
@@ -153,14 +237,20 @@ export const dagCborVerifyCid = (cid, bytes) => {
     return readCidVerification(requireReallyMeCodecWasmProvider().dagCborVerifyCid(cid, bytes));
 };
 export const dagCborVerifyCidProto = (cid, bytes) => {
-    ensureStringValue(cid);
-    ensureBytesInput(bytes);
-    return readBytesOutput(requireReallyMeCodecWasmProvider().dagCborVerifyCidProto(cid, bytes));
+    return protoPayloadOrThrow(dagCborVerifyCidProtoResult(cid, bytes));
 };
 export const dagCborVerifyCidProtoResult = (cid, bytes) => {
     ensureStringValue(cid);
     ensureBytesInput(bytes);
-    return readProtoResultOutput(requireReallyMeCodecWasmProvider().dagCborVerifyCidProtoResult(cid, bytes));
+    return processGeneratedProtoRequest(create(CodecOperationRequestSchema, {
+        operation: {
+            case: "dagCborVerifyCid",
+            value: create(CodecDagCborVerifyCidRequestSchema, {
+                cid,
+                payload: bytes,
+            }),
+        },
+    }));
 };
 export const dagCborSha256ContentHash = (bytes) => {
     ensureBytesInput(bytes);

package/dist/index.d.ts

@@ -7,6 +7,7 @@ export { dagCborCodecCode, dagCborComputeCid, dagCborDecode, dagCborEncode, dagC
 export type { ReallyMeCborMapEntry, ReallyMeCborValue, ReallyMeDagCborCidVerification, } from "./cbor.js";
 export { canonicalizeJson, canonicalizeJsonText } from "./jcs.js";
 export { decodePem, decodePemProto, decodePemProtoResult, encodePem } from "./pem.js";
+export { processProto, processProtoJson } from "./protoProcess.js";
 export type { ReallyMeCodecProtoResult, ReallyMeCodecProtoStatus } from "./readOutput.js";
 export type { ReallyMePemDecodePolicy, ReallyMePemDocument, ReallyMePemEncodeOptions, ReallyMePemLabel, ReallyMePemLineEnding, } from "./pem.js";
 export { REALLYME_CODEC_WASM_EXPORTS, installReallyMeCodecWasmProvider, requireReallyMeCodecWasmProvider, } from "./wasmProvider.js";
@@ -54,8 +55,10 @@ export declare const ReallyMeCodec: {
     readonly tryParseCid: (cid: string) => string | undefined;
     readonly canonicalizeJson: (value: unknown) => string;
     readonly canonicalizeJsonText: (json: string) => string;
-    readonly decodePem: (input: string, policy?: import("./pem.js").ReallyMePemDecodePolicy) => import("./pem.js").ReallyMePemDocument;
-    readonly decodePemProto: (input: string, policy?: import("./pem.js").ReallyMePemDecodePolicy) => Uint8Array;
-    readonly decodePemProtoResult: (input: string, policy?: import("./pem.js").ReallyMePemDecodePolicy) => import("./readOutput.js").ReallyMeCodecProtoResult;
-    readonly encodePem: (label: import("./pem.js").ReallyMePemLabel, der: Uint8Array, options?: import("./pem.js").ReallyMePemEncodeOptions) => string;
+    readonly decodePem: (input: Uint8Array, policy?: import("./pem.js").ReallyMePemDecodePolicy) => import("./pem.js").ReallyMePemDocument;
+    readonly decodePemProto: (input: Uint8Array, policy?: import("./pem.js").ReallyMePemDecodePolicy) => Uint8Array;
+    readonly decodePemProtoResult: (input: Uint8Array, policy?: import("./pem.js").ReallyMePemDecodePolicy) => import("./readOutput.js").ReallyMeCodecProtoResult;
+    readonly encodePem: (label: import("./pem.js").ReallyMePemLabel, der: Uint8Array, options?: import("./pem.js").ReallyMePemEncodeOptions) => Uint8Array;
+    readonly processProto: (requestBytes: Uint8Array) => Uint8Array;
+    readonly processProtoJson: (requestJson: Uint8Array) => Uint8Array;
 };

package/dist/index.js

@@ -7,12 +7,14 @@ export { base58btcDecode, base58btcEncode, bindingTypeMatchesCodec, multibaseBas
 export { dagCborCodecCode, dagCborComputeCid, dagCborDecode, dagCborEncode, dagCborMultihash, dagCborSha256ContentHash, dagCborVerifyCid, dagCborVerifyCidProto, dagCborVerifyCidProtoResult, isValidCidString, tryParseCid, } from "./cbor.js";
 export { canonicalizeJson, canonicalizeJsonText } from "./jcs.js";
 export { decodePem, decodePemProto, decodePemProtoResult, encodePem } from "./pem.js";
+export { processProto, processProtoJson } from "./protoProcess.js";
 export { REALLYME_CODEC_WASM_EXPORTS, installReallyMeCodecWasmProvider, requireReallyMeCodecWasmProvider, } from "./wasmProvider.js";
 import { base64Decode, base64Encode, base64urlDecode, base64urlDecodeBytes, base64urlEncode, bytesToLowerHex, lowerHexToBytes, } from "./baseEncoding.js";
 import { dagCborCodecCode, dagCborComputeCid, dagCborDecode, dagCborEncode, dagCborMultihash, dagCborSha256ContentHash, dagCborVerifyCid, dagCborVerifyCidProto, dagCborVerifyCidProtoResult, isValidCidString, tryParseCid, } from "./cbor.js";
 import { canonicalizeJson, canonicalizeJsonText } from "./jcs.js";
 import { base58btcDecode, base58btcEncode, bindingTypeMatchesCodec, multibaseBase58btcEncode, multibaseBase64urlEncode, multibaseDecode, multicodecLookupPrefixProto, multicodecLookupPrefixProtoResult, multicodecLookupPrefix, multicodecPrefixForNameProto, multicodecPrefixForNameProtoResult, multicodecPrefixForName, multicodecStripPrefix, multicodecTable, multicodecTableProto, multicodecTableProtoResult, multikeyEncode, multikeyParse, multikeyParseProto, multikeyParseProtoResult, requireSupportedMulticodec, validateKeyBinding, } from "./multiformat.js";
 import { decodePem, decodePemProto, decodePemProtoResult, encodePem } from "./pem.js";
+import { processProto, processProtoJson } from "./protoProcess.js";
 export const ReallyMeCodec = {
     base64Decode,
     base64Encode,
@@ -60,4 +62,6 @@ export const ReallyMeCodec = {
     decodePemProto,
     decodePemProtoResult,
     encodePem,
+    processProto,
+    processProtoJson,
 };

package/dist/jcs.js

@@ -1,71 +1,14 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
 // SPDX-License-Identifier: Apache-2.0
-import { ReallyMeCodecError } from "./errors.js";
+import { requireBoundaryUtf8String, stringifyBoundaryJson } from "./boundary.js";
 import { readStringOutput } from "./readOutput.js";
 import { requireReallyMeCodecWasmProvider } from "./wasmProvider.js";
-const maxJsonContainerDepth = 128;
-const validateJsonCompatible = (value, depth = 0, seen = new WeakSet()) => {
-    if (value === null) {
-        return;
-    }
-    switch (typeof value) {
-        case "boolean":
-        case "string":
-            return;
-        case "number":
-            if (!Number.isFinite(value)) {
-                throw new ReallyMeCodecError("invalid-input");
-            }
-            return;
-        case "bigint":
-        case "function":
-        case "symbol":
-        case "undefined":
-            throw new ReallyMeCodecError("invalid-input");
-        case "object":
-            break;
-    }
-    if (seen.has(value)) {
-        throw new ReallyMeCodecError("invalid-input");
-    }
-    if (depth >= maxJsonContainerDepth) {
-        throw new ReallyMeCodecError("invalid-input");
-    }
-    if (typeof Reflect.get(value, "toJSON") === "function") {
-        throw new ReallyMeCodecError("invalid-input");
-    }
-    const prototype = Object.getPrototypeOf(value);
-    if (prototype !== Object.prototype && prototype !== null && !Array.isArray(value)) {
-        throw new ReallyMeCodecError("invalid-input");
-    }
-    seen.add(value);
-    try {
-        if (Array.isArray(value)) {
-            for (const entry of value) {
-                validateJsonCompatible(entry, depth + 1, seen);
-            }
-            return;
-        }
-        for (const key of Object.keys(value)) {
-            validateJsonCompatible(Reflect.get(value, key), depth + 1, seen);
-        }
-    }
-    finally {
-        seen.delete(value);
-    }
-};
 export const canonicalizeJson = (value) => {
-    validateJsonCompatible(value);
-    const encoded = JSON.stringify(value);
-    if (encoded === undefined) {
-        throw new ReallyMeCodecError("invalid-input");
-    }
+    const encoded = stringifyBoundaryJson(value);
     return readStringOutput(requireReallyMeCodecWasmProvider().canonicalizeJson(encoded));
 };
 export const canonicalizeJsonText = (json) => {
-    if (typeof json !== "string" || json.length === 0) {
-        throw new ReallyMeCodecError("invalid-input");
-    }
+    requireBoundaryUtf8String(json, false);
     return readStringOutput(requireReallyMeCodecWasmProvider().canonicalizeJson(json));
 };