@reallyme/codec 0.1.21 → 0.2.0

package/dist/deterministicCborBoundary.d.ts

@@ -0,0 +1,11 @@
+export declare const MAX_DETERMINISTIC_CBOR_INPUT_LEN = 1048576;
+export declare const MAX_DETERMINISTIC_CBOR_OUTPUT_LEN = 1048576;
+export declare const MAX_DETERMINISTIC_CBOR_NESTING_DEPTH = 64;
+export declare const MAX_DETERMINISTIC_CBOR_NODES = 65536;
+export declare const MAX_DETERMINISTIC_CBOR_CONTAINER_ENTRIES = 16384;
+export declare const MAX_DETERMINISTIC_CBOR_AGGREGATE_TEXT_BYTES = 1048576;
+export declare const MAX_DETERMINISTIC_CBOR_AGGREGATE_BYTE_STRING_BYTES = 1048576;
+export declare const MAX_DETERMINISTIC_CBOR_PROTO_RECURSION_DEPTH: number;
+export declare const DETERMINISTIC_CBOR_U64_MAX: bigint;
+export declare const DETERMINISTIC_CBOR_I64_MIN: bigint;
+export declare const DETERMINISTIC_CBOR_NEGATIVE_MAX = -1n;

package/dist/deterministicCborBoundary.js

@@ -0,0 +1,17 @@
+// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+//
+// SPDX-License-Identifier: Apache-2.0
+export const MAX_DETERMINISTIC_CBOR_INPUT_LEN = 1_048_576;
+export const MAX_DETERMINISTIC_CBOR_OUTPUT_LEN = 1_048_576;
+export const MAX_DETERMINISTIC_CBOR_NESTING_DEPTH = 64;
+export const MAX_DETERMINISTIC_CBOR_NODES = 65_536;
+export const MAX_DETERMINISTIC_CBOR_CONTAINER_ENTRIES = 16_384;
+export const MAX_DETERMINISTIC_CBOR_AGGREGATE_TEXT_BYTES = 1_048_576;
+export const MAX_DETERMINISTIC_CBOR_AGGREGATE_BYTE_STRING_BYTES = 1_048_576;
+// A nested map expands to Value -> Map -> MapEntry on the protobuf wire. The
+// five additional layers cover the result/request and deepest scalar wrapper.
+// Buf's default recursion limit of 100 cannot represent semantic depth 64.
+export const MAX_DETERMINISTIC_CBOR_PROTO_RECURSION_DEPTH = MAX_DETERMINISTIC_CBOR_NESTING_DEPTH * 3 + 5;
+export const DETERMINISTIC_CBOR_U64_MAX = (1n << 64n) - 1n;
+export const DETERMINISTIC_CBOR_I64_MIN = -(1n << 63n);
+export const DETERMINISTIC_CBOR_NEGATIVE_MAX = -1n;

package/dist/index.d.ts

@@ -1,13 +1,13 @@
 export { ReallyMeCodecError } from "./errors.js";
 export type { ReallyMeCodecErrorCode } from "./errors.js";
 export { base64Decode, base64Encode, base64urlDecode, base64urlDecodeBytes, base64urlEncode, bytesToLowerHex, lowerHexToBytes, } from "./baseEncoding.js";
-export { base58btcDecode, base58btcEncode, bindingTypeMatchesCodec, multibaseBase58btcEncode, multibaseBase64urlEncode, multibaseDecode, multicodecLookupPrefixProto, multicodecLookupPrefixProtoResult, multicodecLookupPrefix, multicodecPrefixForNameProto, multicodecPrefixForNameProtoResult, multicodecPrefixForName, multicodecStripPrefix, multicodecTable, multicodecTableProto, multicodecTableProtoResult, multikeyEncode, multikeyParse, multikeyParseProto, multikeyParseProtoResult, requireSupportedMulticodec, validateKeyBinding, } from "./multiformat.js";
-export type { ReallyMeKeyMaterialKind, ReallyMeMulticodecMetadata, ReallyMeMulticodecTag, ReallyMeParsedMultikey, } from "./multiformat.js";
-export { dagCborCodecCode, dagCborComputeCid, dagCborDecode, dagCborEncode, dagCborMultihash, dagCborSha256ContentHash, dagCborVerifyCid, dagCborVerifyCidProto, dagCborVerifyCidProtoResult, isValidCidString, tryParseCid, } from "./cbor.js";
-export type { ReallyMeCborMapEntry, ReallyMeCborValue, ReallyMeDagCborCidVerification, } from "./cbor.js";
+export { base58btcDecode, base58btcEncode, bindingTypeMatchesCodec, multibaseBase58btcEncode, multibaseBase64urlEncode, multibaseDecode, multicodecLookupPrefix, multicodecPrefixForName, multicodecStripPrefix, multicodecTable, multikeyEncode, multikeyParse, requireSupportedMulticodec, validateKeyBinding, } from "./multiformat.js";
+export type { ReallyMeKeyMaterialKind, ReallyMeMulticodecLookupResult, ReallyMeMulticodecMetadata, ReallyMeMulticodecTable, ReallyMeMulticodecTag, ReallyMeParsedMultikey, } from "./multiformat.js";
+export { dagCborCodecCode, dagCborComputeCid, dagCborDecode, dagCborEncode, dagCborMultihash, dagCborSha256ContentHash, dagCborVerifyCid, deterministicCborDecode, deterministicCborEncode, isValidCidString, ReallyMeDagCbor, ReallyMeDeterministicCbor, tryParseCid, } from "./cbor.js";
+export type { ReallyMeDeterministicCborInteger, ReallyMeDeterministicCborMapEntry, ReallyMeDeterministicCborMapKey, ReallyMeDeterministicCborValue, ReallyMeCborMapEntry, ReallyMeCborValue, ReallyMeDagCborCidVerification, } from "./cbor.js";
 export { canonicalizeJson, canonicalizeJsonText } from "./jcs.js";
-export { decodePem, decodePemProto, decodePemProtoResult, encodePem } from "./pem.js";
-export type { ReallyMeCodecProtoResult, ReallyMeCodecProtoStatus } from "./readOutput.js";
+export { decodePem, encodePem } from "./pem.js";
+export { processOperation, processOperationJson } from "./operationContract.js";
 export type { ReallyMePemDecodePolicy, ReallyMePemDocument, ReallyMePemEncodeOptions, ReallyMePemLabel, ReallyMePemLineEnding, } from "./pem.js";
 export { REALLYME_CODEC_WASM_EXPORTS, installReallyMeCodecWasmProvider, requireReallyMeCodecWasmProvider, } from "./wasmProvider.js";
 export type { ReallyMeCodecWasmProvider } from "./wasmProvider.js";
@@ -25,20 +25,12 @@ export declare const ReallyMeCodec: {
     readonly multibaseBase58btcEncode: (bytes: Uint8Array) => string;
     readonly multibaseBase64urlEncode: (bytes: Uint8Array) => string;
     readonly multibaseDecode: (encoded: string) => Uint8Array;
-    readonly multicodecLookupPrefixProto: (bytes: Uint8Array) => Uint8Array;
-    readonly multicodecLookupPrefixProtoResult: (bytes: Uint8Array) => import("./readOutput.js").ReallyMeCodecProtoResult;
-    readonly multicodecLookupPrefix: (bytes: Uint8Array) => import("./multiformat.js").ReallyMeMulticodecMetadata;
-    readonly multicodecPrefixForNameProto: (codecName: string) => Uint8Array;
-    readonly multicodecPrefixForNameProtoResult: (codecName: string) => import("./readOutput.js").ReallyMeCodecProtoResult;
+    readonly multicodecLookupPrefix: (bytes: Uint8Array) => import("./multiformat.js").ReallyMeMulticodecLookupResult;
     readonly multicodecPrefixForName: (codecName: string) => import("./multiformat.js").ReallyMeMulticodecMetadata;
     readonly multicodecStripPrefix: (bytes: Uint8Array) => Uint8Array;
-    readonly multicodecTable: () => ReadonlyArray<import("./multiformat.js").ReallyMeMulticodecMetadata>;
-    readonly multicodecTableProto: () => Uint8Array;
-    readonly multicodecTableProtoResult: () => import("./readOutput.js").ReallyMeCodecProtoResult;
+    readonly multicodecTable: () => import("./multiformat.js").ReallyMeMulticodecTable;
     readonly multikeyEncode: (codecName: string, publicKey: Uint8Array) => string;
     readonly multikeyParse: (multikey: string) => import("./multiformat.js").ReallyMeParsedMultikey;
-    readonly multikeyParseProto: (multikey: string) => Uint8Array;
-    readonly multikeyParseProtoResult: (multikey: string) => import("./readOutput.js").ReallyMeCodecProtoResult;
     readonly requireSupportedMulticodec: (codecName: string) => void;
     readonly validateKeyBinding: (bindingType: string, algorithm: string | undefined, multikey: string) => void;
     readonly dagCborCodecCode: () => number;
@@ -48,14 +40,39 @@ export declare const ReallyMeCodec: {
     readonly dagCborMultihash: (bytes: Uint8Array) => Uint8Array;
     readonly dagCborSha256ContentHash: (bytes: Uint8Array) => Uint8Array;
     readonly dagCborVerifyCid: (cid: string, bytes: Uint8Array) => import("./cbor.js").ReallyMeDagCborCidVerification;
-    readonly dagCborVerifyCidProto: (cid: string, bytes: Uint8Array) => Uint8Array;
-    readonly dagCborVerifyCidProtoResult: (cid: string, bytes: Uint8Array) => import("./readOutput.js").ReallyMeCodecProtoResult;
+    readonly deterministicCborDecode: (bytes: Uint8Array) => import("./cbor.js").ReallyMeDeterministicCborValue;
+    readonly deterministicCborEncode: (value: unknown) => Uint8Array;
     readonly isValidCidString: (cid: string) => boolean;
+    readonly ReallyMeDagCbor: {
+        readonly null: () => import("./cbor.js").ReallyMeCborValue;
+        readonly bool: (value: boolean) => import("./cbor.js").ReallyMeCborValue;
+        readonly int: (value: number | bigint) => import("./cbor.js").ReallyMeCborValue;
+        readonly unsigned: (value: number | bigint) => import("./cbor.js").ReallyMeCborValue;
+        readonly negative: (value: number | bigint) => import("./cbor.js").ReallyMeCborValue;
+        readonly text: (value: string) => import("./cbor.js").ReallyMeCborValue;
+        readonly bytes: (value: Uint8Array) => import("./cbor.js").ReallyMeCborValue;
+        readonly array: (value: ReadonlyArray<import("./cbor.js").ReallyMeCborValue>) => import("./cbor.js").ReallyMeCborValue;
+        readonly mapText: (entries: ReadonlyArray<readonly [string, import("./cbor.js").ReallyMeCborValue]>) => import("./cbor.js").ReallyMeCborValue;
+    };
+    readonly ReallyMeDeterministicCbor: {
+        readonly null: () => import("./cbor.js").ReallyMeDeterministicCborValue;
+        readonly bool: (value: boolean) => import("./cbor.js").ReallyMeDeterministicCborValue;
+        readonly unsigned: (value: bigint) => import("./cbor.js").ReallyMeDeterministicCborValue;
+        readonly negative: (value: bigint) => import("./cbor.js").ReallyMeDeterministicCborValue;
+        readonly text: (value: string) => import("./cbor.js").ReallyMeDeterministicCborValue;
+        readonly bytes: (value: Uint8Array) => import("./cbor.js").ReallyMeDeterministicCborValue;
+        readonly array: (value: ReadonlyArray<import("./cbor.js").ReallyMeDeterministicCborValue>) => import("./cbor.js").ReallyMeDeterministicCborValue;
+        readonly mapInt: (entries: ReadonlyArray<readonly [bigint, import("./cbor.js").ReallyMeDeterministicCborValue]>) => import("./cbor.js").ReallyMeDeterministicCborValue;
+        readonly mapText: (entries: ReadonlyArray<readonly [string, import("./cbor.js").ReallyMeDeterministicCborValue]>) => import("./cbor.js").ReallyMeDeterministicCborValue;
+        readonly intKey: (value: bigint) => import("./cbor.js").ReallyMeDeterministicCborMapKey;
+        readonly textKey: (value: string) => import("./cbor.js").ReallyMeDeterministicCborMapKey;
+        readonly entry: (key: import("./cbor.js").ReallyMeDeterministicCborMapKey, value: import("./cbor.js").ReallyMeDeterministicCborValue) => import("./cbor.js").ReallyMeDeterministicCborMapEntry;
+    };
     readonly tryParseCid: (cid: string) => string | undefined;
     readonly canonicalizeJson: (value: unknown) => string;
     readonly canonicalizeJsonText: (json: string) => string;
-    readonly decodePem: (input: string, policy?: import("./pem.js").ReallyMePemDecodePolicy) => import("./pem.js").ReallyMePemDocument;
-    readonly decodePemProto: (input: string, policy?: import("./pem.js").ReallyMePemDecodePolicy) => Uint8Array;
-    readonly decodePemProtoResult: (input: string, policy?: import("./pem.js").ReallyMePemDecodePolicy) => import("./readOutput.js").ReallyMeCodecProtoResult;
-    readonly encodePem: (label: import("./pem.js").ReallyMePemLabel, der: Uint8Array, options?: import("./pem.js").ReallyMePemEncodeOptions) => string;
+    readonly decodePem: (input: Uint8Array, policy?: import("./pem.js").ReallyMePemDecodePolicy) => import("./pem.js").ReallyMePemDocument;
+    readonly encodePem: (label: import("./pem.js").ReallyMePemLabel, der: Uint8Array, options?: import("./pem.js").ReallyMePemEncodeOptions) => Uint8Array;
+    readonly processOperation: (requestBytes: Uint8Array) => Uint8Array;
+    readonly processOperationJson: (requestJson: Uint8Array) => Uint8Array;
 };

package/dist/index.js

@@ -3,16 +3,18 @@
 // SPDX-License-Identifier: Apache-2.0
 export { ReallyMeCodecError } from "./errors.js";
 export { base64Decode, base64Encode, base64urlDecode, base64urlDecodeBytes, base64urlEncode, bytesToLowerHex, lowerHexToBytes, } from "./baseEncoding.js";
-export { base58btcDecode, base58btcEncode, bindingTypeMatchesCodec, multibaseBase58btcEncode, multibaseBase64urlEncode, multibaseDecode, multicodecLookupPrefixProto, multicodecLookupPrefixProtoResult, multicodecLookupPrefix, multicodecPrefixForNameProto, multicodecPrefixForNameProtoResult, multicodecPrefixForName, multicodecStripPrefix, multicodecTable, multicodecTableProto, multicodecTableProtoResult, multikeyEncode, multikeyParse, multikeyParseProto, multikeyParseProtoResult, requireSupportedMulticodec, validateKeyBinding, } from "./multiformat.js";
-export { dagCborCodecCode, dagCborComputeCid, dagCborDecode, dagCborEncode, dagCborMultihash, dagCborSha256ContentHash, dagCborVerifyCid, dagCborVerifyCidProto, dagCborVerifyCidProtoResult, isValidCidString, tryParseCid, } from "./cbor.js";
+export { base58btcDecode, base58btcEncode, bindingTypeMatchesCodec, multibaseBase58btcEncode, multibaseBase64urlEncode, multibaseDecode, multicodecLookupPrefix, multicodecPrefixForName, multicodecStripPrefix, multicodecTable, multikeyEncode, multikeyParse, requireSupportedMulticodec, validateKeyBinding, } from "./multiformat.js";
+export { dagCborCodecCode, dagCborComputeCid, dagCborDecode, dagCborEncode, dagCborMultihash, dagCborSha256ContentHash, dagCborVerifyCid, deterministicCborDecode, deterministicCborEncode, isValidCidString, ReallyMeDagCbor, ReallyMeDeterministicCbor, tryParseCid, } from "./cbor.js";
 export { canonicalizeJson, canonicalizeJsonText } from "./jcs.js";
-export { decodePem, decodePemProto, decodePemProtoResult, encodePem } from "./pem.js";
+export { decodePem, encodePem } from "./pem.js";
+export { processOperation, processOperationJson } from "./operationContract.js";
 export { REALLYME_CODEC_WASM_EXPORTS, installReallyMeCodecWasmProvider, requireReallyMeCodecWasmProvider, } from "./wasmProvider.js";
 import { base64Decode, base64Encode, base64urlDecode, base64urlDecodeBytes, base64urlEncode, bytesToLowerHex, lowerHexToBytes, } from "./baseEncoding.js";
-import { dagCborCodecCode, dagCborComputeCid, dagCborDecode, dagCborEncode, dagCborMultihash, dagCborSha256ContentHash, dagCborVerifyCid, dagCborVerifyCidProto, dagCborVerifyCidProtoResult, isValidCidString, tryParseCid, } from "./cbor.js";
+import { dagCborCodecCode, dagCborComputeCid, dagCborDecode, dagCborEncode, dagCborMultihash, dagCborSha256ContentHash, dagCborVerifyCid, deterministicCborDecode, deterministicCborEncode, isValidCidString, ReallyMeDagCbor, ReallyMeDeterministicCbor, tryParseCid, } from "./cbor.js";
 import { canonicalizeJson, canonicalizeJsonText } from "./jcs.js";
-import { base58btcDecode, base58btcEncode, bindingTypeMatchesCodec, multibaseBase58btcEncode, multibaseBase64urlEncode, multibaseDecode, multicodecLookupPrefixProto, multicodecLookupPrefixProtoResult, multicodecLookupPrefix, multicodecPrefixForNameProto, multicodecPrefixForNameProtoResult, multicodecPrefixForName, multicodecStripPrefix, multicodecTable, multicodecTableProto, multicodecTableProtoResult, multikeyEncode, multikeyParse, multikeyParseProto, multikeyParseProtoResult, requireSupportedMulticodec, validateKeyBinding, } from "./multiformat.js";
-import { decodePem, decodePemProto, decodePemProtoResult, encodePem } from "./pem.js";
+import { base58btcDecode, base58btcEncode, bindingTypeMatchesCodec, multibaseBase58btcEncode, multibaseBase64urlEncode, multibaseDecode, multicodecLookupPrefix, multicodecPrefixForName, multicodecStripPrefix, multicodecTable, multikeyEncode, multikeyParse, requireSupportedMulticodec, validateKeyBinding, } from "./multiformat.js";
+import { decodePem, encodePem } from "./pem.js";
+import { processOperation, processOperationJson } from "./operationContract.js";
 export const ReallyMeCodec = {
     base64Decode,
     base64Encode,
@@ -27,20 +29,12 @@ export const ReallyMeCodec = {
     multibaseBase58btcEncode,
     multibaseBase64urlEncode,
     multibaseDecode,
-    multicodecLookupPrefixProto,
-    multicodecLookupPrefixProtoResult,
     multicodecLookupPrefix,
-    multicodecPrefixForNameProto,
-    multicodecPrefixForNameProtoResult,
     multicodecPrefixForName,
     multicodecStripPrefix,
     multicodecTable,
-    multicodecTableProto,
-    multicodecTableProtoResult,
     multikeyEncode,
     multikeyParse,
-    multikeyParseProto,
-    multikeyParseProtoResult,
     requireSupportedMulticodec,
     validateKeyBinding,
     dagCborCodecCode,
@@ -50,14 +44,16 @@ export const ReallyMeCodec = {
     dagCborMultihash,
     dagCborSha256ContentHash,
     dagCborVerifyCid,
-    dagCborVerifyCidProto,
-    dagCborVerifyCidProtoResult,
+    deterministicCborDecode,
+    deterministicCborEncode,
     isValidCidString,
+    ReallyMeDagCbor,
+    ReallyMeDeterministicCbor,
     tryParseCid,
     canonicalizeJson,
     canonicalizeJsonText,
     decodePem,
-    decodePemProto,
-    decodePemProtoResult,
     encodePem,
+    processOperation,
+    processOperationJson,
 };

package/dist/jcs.js

@@ -1,71 +1,14 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
 // SPDX-License-Identifier: Apache-2.0
-import { ReallyMeCodecError } from "./errors.js";
+import { requireBoundaryUtf8String, stringifyBoundaryJson } from "./boundary.js";
 import { readStringOutput } from "./readOutput.js";
 import { requireReallyMeCodecWasmProvider } from "./wasmProvider.js";
-const maxJsonContainerDepth = 128;
-const validateJsonCompatible = (value, depth = 0, seen = new WeakSet()) => {
-    if (value === null) {
-        return;
-    }
-    switch (typeof value) {
-        case "boolean":
-        case "string":
-            return;
-        case "number":
-            if (!Number.isFinite(value)) {
-                throw new ReallyMeCodecError("invalid-input");
-            }
-            return;
-        case "bigint":
-        case "function":
-        case "symbol":
-        case "undefined":
-            throw new ReallyMeCodecError("invalid-input");
-        case "object":
-            break;
-    }
-    if (seen.has(value)) {
-        throw new ReallyMeCodecError("invalid-input");
-    }
-    if (depth >= maxJsonContainerDepth) {
-        throw new ReallyMeCodecError("invalid-input");
-    }
-    if (typeof Reflect.get(value, "toJSON") === "function") {
-        throw new ReallyMeCodecError("invalid-input");
-    }
-    const prototype = Object.getPrototypeOf(value);
-    if (prototype !== Object.prototype && prototype !== null && !Array.isArray(value)) {
-        throw new ReallyMeCodecError("invalid-input");
-    }
-    seen.add(value);
-    try {
-        if (Array.isArray(value)) {
-            for (const entry of value) {
-                validateJsonCompatible(entry, depth + 1, seen);
-            }
-            return;
-        }
-        for (const key of Object.keys(value)) {
-            validateJsonCompatible(Reflect.get(value, key), depth + 1, seen);
-        }
-    }
-    finally {
-        seen.delete(value);
-    }
-};
 export const canonicalizeJson = (value) => {
-    validateJsonCompatible(value);
-    const encoded = JSON.stringify(value);
-    if (encoded === undefined) {
-        throw new ReallyMeCodecError("invalid-input");
-    }
+    const encoded = stringifyBoundaryJson(value);
     return readStringOutput(requireReallyMeCodecWasmProvider().canonicalizeJson(encoded));
 };
 export const canonicalizeJsonText = (json) => {
-    if (typeof json !== "string" || json.length === 0) {
-        throw new ReallyMeCodecError("invalid-input");
-    }
+    requireBoundaryUtf8String(json, false);
     return readStringOutput(requireReallyMeCodecWasmProvider().canonicalizeJson(json));
 };

package/dist/multiformat.d.ts

@@ -1,4 +1,3 @@
-import type { ReallyMeCodecProtoResult } from "./readOutput.js";
 export type ReallyMeMulticodecTag = "encryption" | "hash" | "key" | "multihash" | "multikey";
 export type ReallyMeKeyMaterialKind = "not-key" | "public-key" | "private-key" | "symmetric-key";
 export type ReallyMeMulticodecMetadata = Readonly<{
@@ -9,32 +8,31 @@ export type ReallyMeMulticodecMetadata = Readonly<{
     prefix: Uint8Array;
     expectedKeyLength?: number;
 }>;
+export type ReallyMeMulticodecLookupResult = Readonly<{
+    name: string;
+    prefixLength: number;
+    metadata: ReallyMeMulticodecMetadata;
+}>;
+export type ReallyMeMulticodecTable = Readonly<{
+    entries: ReadonlyArray<ReallyMeMulticodecMetadata>;
+}>;
 export type ReallyMeParsedMultikey = Readonly<{
     codecName: string;
     algorithmName: string;
     publicKey: Uint8Array;
     expectedPublicKeyLength?: number;
 }>;
-export declare const readMulticodecMetadata: (value: unknown) => ReallyMeMulticodecMetadata;
 export declare const base58btcEncode: (bytes: Uint8Array) => string;
 export declare const base58btcDecode: (encoded: string) => Uint8Array;
 export declare const multibaseBase64urlEncode: (bytes: Uint8Array) => string;
 export declare const multibaseBase58btcEncode: (bytes: Uint8Array) => string;
 export declare const multibaseDecode: (encoded: string) => Uint8Array;
 export declare const multicodecPrefixForName: (codecName: string) => ReallyMeMulticodecMetadata;
-export declare const multicodecPrefixForNameProto: (codecName: string) => Uint8Array;
-export declare const multicodecPrefixForNameProtoResult: (codecName: string) => ReallyMeCodecProtoResult;
-export declare const multicodecLookupPrefix: (bytes: Uint8Array) => ReallyMeMulticodecMetadata;
-export declare const multicodecLookupPrefixProto: (bytes: Uint8Array) => Uint8Array;
-export declare const multicodecLookupPrefixProtoResult: (bytes: Uint8Array) => ReallyMeCodecProtoResult;
+export declare const multicodecLookupPrefix: (bytes: Uint8Array) => ReallyMeMulticodecLookupResult;
 export declare const multicodecStripPrefix: (bytes: Uint8Array) => Uint8Array;
-export declare const multicodecTable: () => ReadonlyArray<ReallyMeMulticodecMetadata>;
-export declare const multicodecTableProto: () => Uint8Array;
-export declare const multicodecTableProtoResult: () => ReallyMeCodecProtoResult;
+export declare const multicodecTable: () => ReallyMeMulticodecTable;
 export declare const multikeyEncode: (codecName: string, publicKey: Uint8Array) => string;
 export declare const multikeyParse: (multikey: string) => ReallyMeParsedMultikey;
-export declare const multikeyParseProto: (multikey: string) => Uint8Array;
-export declare const multikeyParseProtoResult: (multikey: string) => ReallyMeCodecProtoResult;
 export declare const bindingTypeMatchesCodec: (bindingType: string, codecName: string) => boolean;
 export declare const validateKeyBinding: (bindingType: string, algorithm: string | undefined, multikey: string) => void;
 export declare const requireSupportedMulticodec: (codecName: string) => void;

package/dist/multiformat.js

@@ -1,86 +1,68 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
 // SPDX-License-Identifier: Apache-2.0
+import { create } from "@bufbuild/protobuf";
 import { ReallyMeCodecError } from "./errors.js";
-import { ensureBytesInput, ensureStringInput, ensureStringValue, readBooleanOutput, readBytesOutput, readBytesProperty, readObjectOutput, readProtoResultOutput, readOptionalLengthProperty, readStringOutput, readStringProperty, } from "./readOutput.js";
+import { CodecMulticodecLookupPrefixRequestSchema, CodecMulticodecPrefixForNameRequestSchema, CodecMulticodecTableRequestSchema, CodecMultikeyParseRequestSchema, CodecOperationRequestSchema, CodecKeyMaterialKind, CodecTag, } from "./proto/generated/reallyme/codec/v1/codec_pb.js";
+import { clearGeneratedOperationResult, processGeneratedOperationRequest, } from "./operationContract.js";
+import { ensureBytesInput, ensureStringInput, ensureStringValue, readBooleanOutput, readBytesOutput, readStringOutput, snapshotBoundedBytesInput, } from "./readOutput.js";
 import { requireReallyMeCodecWasmProvider } from "./wasmProvider.js";
-const validTags = new Set([
-    "encryption",
-    "hash",
-    "key",
-    "multihash",
-    "multikey",
-]);
-const validKeyMaterialKinds = new Set([
-    "not-key",
-    "public-key",
-    "private-key",
-    "symmetric-key",
-]);
-const readTag = (object) => {
-    const tag = readStringProperty(object, "tag");
-    if (!validTags.has(tag)) {
+const MAX_MULTICODEC_TABLE_ENTRIES = 1_024;
+const requireNoProviderUnknownFields = (message) => {
+    if (message.$unknown !== undefined && message.$unknown.length !== 0) {
         throw new ReallyMeCodecError("provider-failure");
     }
+};
+const sdkTag = (tag) => {
     switch (tag) {
-        case "encryption":
-        case "hash":
-        case "key":
-        case "multihash":
-        case "multikey":
-            return tag;
+        case CodecTag.ENCRYPTION:
+            return "encryption";
+        case CodecTag.HASH:
+            return "hash";
+        case CodecTag.KEY:
+            return "key";
+        case CodecTag.MULTIHASH:
+            return "multihash";
+        case CodecTag.MULTIKEY:
+            return "multikey";
+        case CodecTag.UNSPECIFIED:
         default:
             throw new ReallyMeCodecError("provider-failure");
     }
 };
-const readKeyMaterial = (object) => {
-    const keyMaterial = readStringProperty(object, "keyMaterial");
-    if (!validKeyMaterialKinds.has(keyMaterial)) {
-        throw new ReallyMeCodecError("provider-failure");
-    }
+const sdkKeyMaterial = (keyMaterial) => {
     switch (keyMaterial) {
-        case "not-key":
-        case "public-key":
-        case "private-key":
-        case "symmetric-key":
-            return keyMaterial;
+        case CodecKeyMaterialKind.NOT_KEY:
+            return "not-key";
+        case CodecKeyMaterialKind.PUBLIC_KEY:
+            return "public-key";
+        case CodecKeyMaterialKind.PRIVATE_KEY:
+            return "private-key";
+        case CodecKeyMaterialKind.SYMMETRIC_KEY:
+            return "symmetric-key";
+        case CodecKeyMaterialKind.UNSPECIFIED:
         default:
             throw new ReallyMeCodecError("provider-failure");
     }
 };
-export const readMulticodecMetadata = (value) => {
-    const object = readObjectOutput(value);
-    const expectedKeyLength = readOptionalLengthProperty(object, "expectedKeyLength");
+const readMulticodecMetadata = (value) => {
+    validateMulticodecMetadata(value);
     const metadata = {
-        name: readStringProperty(object, "name"),
-        alg: readStringProperty(object, "alg"),
-        tag: readTag(object),
-        keyMaterial: readKeyMaterial(object),
-        prefix: readBytesProperty(object, "prefix"),
+        name: value.name,
+        alg: value.algorithmName,
+        tag: sdkTag(value.tag),
+        keyMaterial: sdkKeyMaterial(value.keyMaterialKind),
+        prefix: value.prefix.slice(),
     };
-    if (expectedKeyLength === undefined) {
+    if (value.variableLength || value.fixedLength === 0) {
         return metadata;
     }
-    return { ...metadata, expectedKeyLength };
-};
-const readParsedMultikey = (value) => {
-    const object = readObjectOutput(value);
-    const expectedPublicKeyLength = readOptionalLengthProperty(object, "expectedPublicKeyLength");
-    const parsed = {
-        codecName: readStringProperty(object, "codecName"),
-        algorithmName: readStringProperty(object, "algorithmName"),
-        publicKey: readBytesProperty(object, "publicKey"),
-    };
-    if (expectedPublicKeyLength === undefined) {
-        return parsed;
-    }
-    return { ...parsed, expectedPublicKeyLength };
+    return { ...metadata, expectedKeyLength: value.fixedLength };
 };
-const readMulticodecTable = (value) => {
-    if (!Array.isArray(value)) {
-        throw new ReallyMeCodecError("provider-failure");
-    }
-    return value.map(readMulticodecMetadata);
+const validateMulticodecMetadata = (value) => {
+    requireNoProviderUnknownFields(value);
+    sdkTag(value.tag);
+    sdkKeyMaterial(value.keyMaterialKind);
 };
 export const base58btcEncode = (bytes) => {
     ensureBytesInput(bytes);
@@ -104,35 +86,99 @@ export const multibaseDecode = (encoded) => {
 };
 export const multicodecPrefixForName = (codecName) => {
     ensureStringInput(codecName);
-    return readMulticodecMetadata(requireReallyMeCodecWasmProvider().multicodecPrefixForName(codecName));
-};
-export const multicodecPrefixForNameProto = (codecName) => {
-    ensureStringInput(codecName);
-    return readBytesOutput(requireReallyMeCodecWasmProvider().multicodecPrefixForNameProto(codecName));
-};
-export const multicodecPrefixForNameProtoResult = (codecName) => {
-    ensureStringInput(codecName);
-    return readProtoResultOutput(requireReallyMeCodecWasmProvider().multicodecPrefixForNameProtoResult(codecName));
+    const result = processGeneratedOperationRequest(multicodecPrefixForNameRequest(codecName));
+    if (result.result.case !== "multicodecPrefixForName") {
+        clearGeneratedOperationResult(result);
+        throw new ReallyMeCodecError("provider-failure");
+    }
+    try {
+        return readMulticodecMetadata(result.result.value);
+    }
+    finally {
+        result.result.value.prefix.fill(0);
+    }
 };
+const multicodecPrefixForNameRequest = (codecName) => create(CodecOperationRequestSchema, {
+    operation: {
+        case: "multicodecPrefixForName",
+        value: create(CodecMulticodecPrefixForNameRequestSchema, {
+            name: codecName,
+        }),
+    },
+});
 export const multicodecLookupPrefix = (bytes) => {
     ensureBytesInput(bytes);
-    return readMulticodecMetadata(requireReallyMeCodecWasmProvider().multicodecLookupPrefix(bytes));
-};
-export const multicodecLookupPrefixProto = (bytes) => {
-    ensureBytesInput(bytes);
-    return readBytesOutput(requireReallyMeCodecWasmProvider().multicodecLookupPrefixProto(bytes));
-};
-export const multicodecLookupPrefixProtoResult = (bytes) => {
-    ensureBytesInput(bytes);
-    return readProtoResultOutput(requireReallyMeCodecWasmProvider().multicodecLookupPrefixProtoResult(bytes));
+    const bytesSnapshot = snapshotBoundedBytesInput(bytes);
+    try {
+        const operationResult = processGeneratedOperationRequest(multicodecLookupPrefixRequest(bytesSnapshot));
+        if (operationResult.result.case !== "multicodecLookupPrefix") {
+            clearGeneratedOperationResult(operationResult);
+            throw new ReallyMeCodecError("provider-failure");
+        }
+        const result = operationResult.result.value;
+        try {
+            requireNoProviderUnknownFields(result);
+            if (result.metadata === undefined) {
+                throw new ReallyMeCodecError("provider-failure");
+            }
+            return {
+                name: result.name,
+                prefixLength: result.prefixLength,
+                metadata: readMulticodecMetadata(result.metadata),
+            };
+        }
+        finally {
+            result.metadata?.prefix.fill(0);
+        }
+    }
+    finally {
+        bytesSnapshot.fill(0);
+    }
 };
+const multicodecLookupPrefixRequest = (bytes) => create(CodecOperationRequestSchema, {
+    operation: {
+        case: "multicodecLookupPrefix",
+        value: create(CodecMulticodecLookupPrefixRequestSchema, {
+            value: bytes,
+        }),
+    },
+});
 export const multicodecStripPrefix = (bytes) => {
     ensureBytesInput(bytes);
     return readBytesOutput(requireReallyMeCodecWasmProvider().multicodecStripPrefix(bytes));
 };
-export const multicodecTable = () => readMulticodecTable(requireReallyMeCodecWasmProvider().multicodecTable());
-export const multicodecTableProto = () => readBytesOutput(requireReallyMeCodecWasmProvider().multicodecTableProto());
-export const multicodecTableProtoResult = () => readProtoResultOutput(requireReallyMeCodecWasmProvider().multicodecTableProtoResult());
+export const multicodecTable = () => {
+    const operationResult = processGeneratedOperationRequest(multicodecTableRequest());
+    if (operationResult.result.case !== "multicodecTable") {
+        clearGeneratedOperationResult(operationResult);
+        throw new ReallyMeCodecError("provider-failure");
+    }
+    const result = operationResult.result.value;
+    try {
+        requireNoProviderUnknownFields(result);
+        if (result.entries.length > MAX_MULTICODEC_TABLE_ENTRIES) {
+            throw new ReallyMeCodecError("provider-failure");
+        }
+        // Validate every entry before making caller-owned byte copies. If one
+        // entry is malformed, no earlier prefix copy can become unreachable
+        // without an explicit wipe while the generated response is rejected.
+        for (const entry of result.entries) {
+            validateMulticodecMetadata(entry);
+        }
+        return { entries: result.entries.map((entry) => readMulticodecMetadata(entry)) };
+    }
+    finally {
+        for (const entry of result.entries) {
+            entry.prefix.fill(0);
+        }
+    }
+};
+const multicodecTableRequest = () => create(CodecOperationRequestSchema, {
+    operation: {
+        case: "multicodecTable",
+        value: create(CodecMulticodecTableRequestSchema),
+    },
+});
 export const multikeyEncode = (codecName, publicKey) => {
     ensureStringInput(codecName);
     ensureBytesInput(publicKey);
@@ -140,16 +186,34 @@ export const multikeyEncode = (codecName, publicKey) => {
 };
 export const multikeyParse = (multikey) => {
     ensureStringInput(multikey);
-    return readParsedMultikey(requireReallyMeCodecWasmProvider().multikeyParse(multikey));
-};
-export const multikeyParseProto = (multikey) => {
-    ensureStringInput(multikey);
-    return readBytesOutput(requireReallyMeCodecWasmProvider().multikeyParseProto(multikey));
-};
-export const multikeyParseProtoResult = (multikey) => {
-    ensureStringInput(multikey);
-    return readProtoResultOutput(requireReallyMeCodecWasmProvider().multikeyParseProtoResult(multikey));
+    const operationResult = processGeneratedOperationRequest(multikeyParseRequest(multikey));
+    if (operationResult.result.case !== "multikeyParse") {
+        clearGeneratedOperationResult(operationResult);
+        throw new ReallyMeCodecError("provider-failure");
+    }
+    const result = operationResult.result.value;
+    try {
+        requireNoProviderUnknownFields(result);
+        const parsed = {
+            codecName: result.codecName,
+            algorithmName: result.algorithmName,
+            publicKey: result.publicKey.slice(),
+        };
+        if (result.variablePublicKeyLength || result.expectedPublicKeyLength === 0) {
+            return parsed;
+        }
+        return { ...parsed, expectedPublicKeyLength: result.expectedPublicKeyLength };
+    }
+    finally {
+        result.publicKey.fill(0);
+    }
 };
+const multikeyParseRequest = (multikey) => create(CodecOperationRequestSchema, {
+    operation: {
+        case: "multikeyParse",
+        value: create(CodecMultikeyParseRequestSchema, { multikey }),
+    },
+});
 export const bindingTypeMatchesCodec = (bindingType, codecName) => {
     ensureStringInput(bindingType);
     ensureStringInput(codecName);

package/dist/operationContract.d.ts

@@ -0,0 +1,31 @@
+import type { CodecOperationRequest, CodecOperationResult } from "./proto/generated/reallyme/codec/v1/codec_pb.js";
+/**
+ * Execute one binary generated-protobuf request and return the fully
+ * discriminated binary `CodecOperationResponse`.
+ *
+ * Oversized requests are rejected before the provider call. Malformed and
+ * unsupported in-limit requests are represented by the response error oneof
+ * rather than a boundary-local exception.
+ */
+export declare const processOperation: (requestBytes: Uint8Array) => Uint8Array;
+/**
+ * Execute one generated ProtoJSON request and return the same discriminated
+ * binary response used by `processOperation`.
+ */
+export declare const processOperationJson: (requestJson: Uint8Array) => Uint8Array;
+/**
+ * Execute a generated request through the fully discriminated response lane.
+ *
+ * Structured convenience methods use this boundary so a provider cannot
+ * return a valid payload of the wrong operation-specific result type.
+ */
+export declare const processGeneratedOperationRequest: (request: CodecOperationRequest) => CodecOperationResult;
+/**
+ * Clears mutable byte owners held by a generated operation result.
+ *
+ * Callers invoke this before rejecting an unexpected valid oneof variant and
+ * after copying a sensitive result into its public SDK owner. JavaScript
+ * strings remain subject to the managed-runtime memory model, but every
+ * mutable `Uint8Array` created by this adapter is released promptly.
+ */
+export declare const clearGeneratedOperationResult: (result: CodecOperationResult) => void;