@reallyme/codec 0.1.21 → 0.2.0

package/dist/readOutput.js

@@ -1,9 +1,80 @@
 // SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
 //
 // SPDX-License-Identifier: Apache-2.0
+import { MAX_CODEC_FFI_INPUT_BYTES, MAX_CODEC_FFI_OUTPUT_BYTES, requireBoundaryUtf8String, } from "./boundary.js";
 import { ReallyMeCodecError } from "./errors.js";
+const uint8ArraySubarray = Uint8Array.prototype.subarray;
+const uint8ArraySet = Uint8Array.prototype.set;
+const readProviderProperty = (object, name, allowMissing = false) => {
+    try {
+        const descriptor = Object.getOwnPropertyDescriptor(object, name);
+        if (descriptor === undefined) {
+            if (allowMissing) {
+                return undefined;
+            }
+            throw new ReallyMeCodecError("provider-failure");
+        }
+        if (!("value" in descriptor)) {
+            throw new ReallyMeCodecError("provider-failure");
+        }
+        return descriptor.value;
+    }
+    catch (error) {
+        if (error instanceof ReallyMeCodecError) {
+            throw error;
+        }
+        throw new ReallyMeCodecError("provider-failure");
+    }
+};
+const requireBoundedProviderString = (value, allowEmpty) => {
+    try {
+        requireBoundaryUtf8String(value, allowEmpty, MAX_CODEC_FFI_OUTPUT_BYTES);
+        return value;
+    }
+    catch (_error) {
+        throw new ReallyMeCodecError("provider-failure");
+    }
+};
 export const ensureBytesInput = (value) => {
-    if (!(value instanceof Uint8Array)) {
+    if (!(value instanceof Uint8Array) ||
+        !ArrayBuffer.isView(value) ||
+        value.constructor !== Uint8Array) {
+        throw new ReallyMeCodecError("invalid-input");
+    }
+};
+/**
+ * Copies one bounded caller-owned byte view and verifies that the same length
+ * was copied. Length-tracking resizable buffers, detached buffers, and exotic
+ * typed-array wrappers must not let validation observe one length while the
+ * provider or protobuf serializer consumes another.
+ */
+export const snapshotBoundedBytesInput = (value, maximumLength = MAX_CODEC_FFI_INPUT_BYTES) => {
+    ensureBytesInput(value);
+    const expectedLength = value.length;
+    if (expectedLength > maximumLength) {
+        throw new ReallyMeCodecError("invalid-input");
+    }
+    let snapshot;
+    try {
+        const boundedView = uint8ArraySubarray.call(value, 0, expectedLength);
+        if (boundedView.length !== expectedLength) {
+            throw new ReallyMeCodecError("invalid-input");
+        }
+        snapshot = new Uint8Array(expectedLength);
+        uint8ArraySet.call(snapshot, boundedView, 0);
+        if (value.length !== expectedLength ||
+            boundedView.length !== expectedLength ||
+            snapshot.length !== expectedLength) {
+            snapshot.fill(0);
+            throw new ReallyMeCodecError("invalid-input");
+        }
+        return snapshot;
+    }
+    catch (error) {
+        snapshot?.fill(0);
+        if (error instanceof ReallyMeCodecError) {
+            throw error;
+        }
         throw new ReallyMeCodecError("invalid-input");
     }
 };
@@ -27,8 +98,38 @@ export const readBytesOutput = (value) => {
     if (!(value instanceof Uint8Array)) {
         throw new ReallyMeCodecError("provider-failure");
     }
+    if (value.length > MAX_CODEC_FFI_OUTPUT_BYTES) {
+        value.fill(0);
+        throw new ReallyMeCodecError("provider-failure");
+    }
     return value;
 };
+export const readIndependentBoundedBytesOutput = (value, input, maximumLength) => {
+    try {
+        if (!(value instanceof Uint8Array)) {
+            throw new ReallyMeCodecError("provider-failure");
+        }
+        // Even non-overlapping views into one ArrayBuffer share transfer and detach
+        // semantics, so they do not provide independent result ownership.
+        if (value.buffer === input.buffer) {
+            throw new ReallyMeCodecError("provider-failure");
+        }
+        if (value.length === 0 || value.length > maximumLength) {
+            value.fill(0);
+            throw new ReallyMeCodecError("provider-failure");
+        }
+        return value;
+    }
+    catch (error) {
+        if (error instanceof ReallyMeCodecError) {
+            throw error;
+        }
+        // Detached views and proxy-wrapped typed arrays can throw while reading
+        // buffer metadata or clearing storage. They are malformed provider output,
+        // never platform exceptions that should escape the typed SDK contract.
+        throw new ReallyMeCodecError("provider-failure");
+    }
+};
 export const readNumberOutput = (value) => {
     if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) {
         throw new ReallyMeCodecError("provider-failure");
@@ -39,56 +140,60 @@ export const readObjectOutput = (value) => {
     if (typeof value !== "object" || value === null) {
         throw new ReallyMeCodecError("provider-failure");
     }
-    return value;
+    try {
+        const prototype = Object.getPrototypeOf(value);
+        if (prototype !== Object.prototype && prototype !== null) {
+            throw new ReallyMeCodecError("provider-failure");
+        }
+        return value;
+    }
+    catch (error) {
+        if (error instanceof ReallyMeCodecError) {
+            throw error;
+        }
+        throw new ReallyMeCodecError("provider-failure");
+    }
 };
 export const readStringOutput = (value) => {
     if (typeof value !== "string") {
         throw new ReallyMeCodecError("provider-failure");
     }
-    return value;
+    return requireBoundedProviderString(value, true);
 };
 export const readStringProperty = (object, name) => {
-    const value = Reflect.get(object, name);
+    const value = readProviderProperty(object, name);
     if (typeof value !== "string" || value.length === 0) {
         throw new ReallyMeCodecError("provider-failure");
     }
-    return value;
+    return requireBoundedProviderString(value, false);
 };
 export const readStringValueProperty = (object, name) => {
-    const value = Reflect.get(object, name);
+    const value = readProviderProperty(object, name);
     if (typeof value !== "string") {
         throw new ReallyMeCodecError("provider-failure");
     }
-    return value;
+    return requireBoundedProviderString(value, true);
 };
 export const readBooleanProperty = (object, name) => {
-    const value = Reflect.get(object, name);
+    const value = readProviderProperty(object, name);
     if (typeof value !== "boolean") {
         throw new ReallyMeCodecError("provider-failure");
     }
     return value;
 };
 export const readBytesProperty = (object, name) => {
-    const value = Reflect.get(object, name);
+    const value = readProviderProperty(object, name);
     if (!(value instanceof Uint8Array)) {
         throw new ReallyMeCodecError("provider-failure");
     }
-    return value;
-};
-export const readProtoResultOutput = (value) => {
-    const object = readObjectOutput(value);
-    const status = readStringProperty(object, "status");
-    if (status !== "result" && status !== "codec-error") {
+    if (value.length > MAX_CODEC_FFI_OUTPUT_BYTES) {
+        value.fill(0);
         throw new ReallyMeCodecError("provider-failure");
     }
-    return {
-        status,
-        bytes: readBytesProperty(object, "bytes"),
-        isCodecError: status === "codec-error",
-    };
+    return value;
 };
 export const readOptionalLengthProperty = (object, name) => {
-    const value = Reflect.get(object, name);
+    const value = readProviderProperty(object, name, true);
     if (value === undefined) {
         return undefined;
     }
@@ -98,8 +203,17 @@ export const readOptionalLengthProperty = (object, name) => {
     return value;
 };
 export const asciiBytesToString = (bytes) => {
+    if (bytes.length > MAX_CODEC_FFI_INPUT_BYTES) {
+        throw new ReallyMeCodecError("invalid-input");
+    }
     let value = "";
-    for (const byte of bytes) {
+    // Indexed access avoids executing an attacker-supplied iterator installed
+    // on an otherwise valid Uint8Array instance.
+    for (let index = 0; index < bytes.length; index += 1) {
+        const byte = bytes[index];
+        if (byte === undefined) {
+            throw new ReallyMeCodecError("invalid-input");
+        }
         if (byte > 0x7f) {
             throw new ReallyMeCodecError("invalid-input");
         }

package/dist/wasm/reallyme_codec_wasm.d.ts

@@ -56,16 +56,6 @@ export function dagCborCodecCode(): number;
  */
 export function dagCborComputeCid(bytes: Uint8Array): string;
 
-/**
- * Decode canonical DAG-CBOR bytes into the tagged JSON representation.
- */
-export function dagCborDecode(bytes: Uint8Array): string;
-
-/**
- * Encode a tagged JSON representation as canonical DAG-CBOR bytes.
- */
-export function dagCborEncode(value_json: string): Uint8Array;
-
 /**
  * Return the sha2-256 multihash envelope for canonical DAG-CBOR bytes.
  */
@@ -76,21 +66,6 @@ export function dagCborMultihash(bytes: Uint8Array): Uint8Array;
  */
 export function dagCborSha256ContentHash(bytes: Uint8Array): Uint8Array;
 
-/**
- * Recompute and compare a CIDv1 dag-cbor/sha2-256 string.
- */
-export function dagCborVerifyCid(cid: string, bytes: Uint8Array): any;
-
-/**
- * Recompute and compare a CID as a `CodecDagCborVerifyCidResult` protobuf message.
- */
-export function dagCborVerifyCidProto(cid: string, bytes: Uint8Array): Uint8Array;
-
-/**
- * Recompute and compare a CID protobuf message with an explicit result status.
- */
-export function dagCborVerifyCidProtoResult(cid: string, bytes: Uint8Array): any;
-
 /**
  * Return whether a string parses as a CID.
  */
@@ -116,95 +91,25 @@ export function multibaseBase64urlEncode(bytes: Uint8Array): string;
  */
 export function multibaseDecode(encoded: string): Uint8Array;
 
-/**
- * Resolve a byte slice that starts with a known multicodec prefix.
- */
-export function multicodecLookupPrefix(bytes: Uint8Array): any;
-
-/**
- * Resolve a prefix as a `CodecMulticodecLookupResult` protobuf message.
- */
-export function multicodecLookupPrefixProto(bytes: Uint8Array): Uint8Array;
-
-/**
- * Resolve a prefix protobuf message with an explicit result status.
- */
-export function multicodecLookupPrefixProtoResult(bytes: Uint8Array): any;
-
-/**
- * Return multicodec metadata for a canonical codec name.
- */
-export function multicodecPrefixForName(codec_name: string): any;
-
-/**
- * Return multicodec metadata as a `CodecMulticodecSpec` protobuf message.
- */
-export function multicodecPrefixForNameProto(codec_name: string): Uint8Array;
-
-/**
- * Return multicodec metadata protobuf bytes with an explicit result status.
- */
-export function multicodecPrefixForNameProtoResult(codec_name: string): any;
-
 /**
  * Strip a known multicodec prefix, or return the original bytes when none is found.
  */
 export function multicodecStripPrefix(bytes: Uint8Array): Uint8Array;
 
-/**
- * Return the supported multicodec table.
- */
-export function multicodecTable(): any;
-
-/**
- * Return the supported multicodec table as protobuf bytes.
- */
-export function multicodecTableProto(): Uint8Array;
-
-/**
- * Return the supported multicodec table protobuf bytes with an explicit result status.
- */
-export function multicodecTableProtoResult(): any;
-
 /**
  * Encode a public key as a multibase base58btc multikey.
  */
 export function multikeyEncode(codec_name: string, public_key: Uint8Array): string;
 
 /**
- * Parse and validate a multikey string.
- */
-export function multikeyParse(multikey: string): any;
-
-/**
- * Parse and validate a multikey as a `CodecMultikeyParseResult` protobuf message.
- */
-export function multikeyParseProto(multikey: string): Uint8Array;
-
-/**
- * Parse and validate a multikey protobuf message with an explicit result status.
- */
-export function multikeyParseProtoResult(multikey: string): any;
-
-/**
- * Decode PEM text armor with caller-supplied size and label policy.
- */
-export function pemDecode(input: string, options_json: string): any;
-
-/**
- * Decode PEM text armor as a `CodecPemDecodeResult` protobuf message.
+ * Execute one generated binary protobuf request and return a fully discriminated response.
  */
-export function pemDecodeProto(input: string, options_json: string): Uint8Array;
+export function processOperation(request: Uint8Array): Uint8Array;
 
 /**
- * Decode PEM text armor protobuf bytes with an explicit result status.
+ * Execute one generated ProtoJSON request and return a discriminated response.
  */
-export function pemDecodeProtoResult(input: string, options_json: string): any;
-
-/**
- * Encode DER bytes as PEM text armor.
- */
-export function pemEncode(label: string, der: Uint8Array, options_json: string): string;
+export function processOperationJson(request_json: Uint8Array): Uint8Array;
 
 /**
  * Fail closed when a codec name is not in the supported table.
@@ -225,57 +130,37 @@ export type InitInput = RequestInfo | URL | Response | BufferSource | WebAssembl
 
 export interface InitOutput {
     readonly memory: WebAssembly.Memory;
-    readonly base58btcDecode: (a: number, b: number) => [number, number, number];
+    readonly base58btcDecode: (a: any) => [number, number, number];
     readonly base58btcEncode: (a: any) => [number, number, number, number];
-    readonly base64Decode: (a: number, b: number) => [number, number, number];
-    readonly base64Encode: (a: any) => [number, number];
-    readonly base64urlDecode: (a: number, b: number) => [number, number, number];
-    readonly base64urlEncode: (a: any) => [number, number];
-    readonly bindingTypeMatchesCodec: (a: number, b: number, c: number, d: number) => number;
-    readonly bytesToLowerHex: (a: any) => [number, number];
-    readonly canonicalizeJson: (a: number, b: number) => [number, number, number, number];
+    readonly base64Decode: (a: any) => [number, number, number];
+    readonly base64Encode: (a: any) => [number, number, number, number];
+    readonly base64urlDecode: (a: any) => [number, number, number];
+    readonly base64urlEncode: (a: any) => [number, number, number, number];
+    readonly bindingTypeMatchesCodec: (a: any, b: any) => [number, number, number];
+    readonly bytesToLowerHex: (a: any) => [number, number, number, number];
+    readonly canonicalizeJson: (a: any) => [number, number, number, number];
     readonly dagCborCodecCode: () => number;
     readonly dagCborComputeCid: (a: any) => [number, number, number, number];
-    readonly dagCborDecode: (a: any) => [number, number, number, number];
-    readonly dagCborEncode: (a: number, b: number) => [number, number, number];
     readonly dagCborMultihash: (a: any) => [number, number, number];
     readonly dagCborSha256ContentHash: (a: any) => [number, number, number];
-    readonly dagCborVerifyCid: (a: number, b: number, c: any) => [number, number, number];
-    readonly dagCborVerifyCidProto: (a: number, b: number, c: any) => [number, number, number];
-    readonly dagCborVerifyCidProtoResult: (a: number, b: number, c: any) => [number, number, number];
-    readonly isValidCidString: (a: number, b: number) => number;
-    readonly lowerHexToBytes: (a: number, b: number) => [number, number, number];
+    readonly isValidCidString: (a: any) => [number, number, number];
+    readonly lowerHexToBytes: (a: any) => [number, number, number];
     readonly multibaseBase58btcEncode: (a: any) => [number, number, number, number];
-    readonly multibaseBase64urlEncode: (a: any) => [number, number];
-    readonly multibaseDecode: (a: number, b: number) => [number, number, number];
-    readonly multicodecLookupPrefix: (a: any) => [number, number, number];
-    readonly multicodecLookupPrefixProto: (a: any) => [number, number, number];
-    readonly multicodecLookupPrefixProtoResult: (a: any) => [number, number, number];
-    readonly multicodecPrefixForName: (a: number, b: number) => [number, number, number];
-    readonly multicodecPrefixForNameProto: (a: number, b: number) => [number, number, number];
-    readonly multicodecPrefixForNameProtoResult: (a: number, b: number) => [number, number, number];
-    readonly multicodecStripPrefix: (a: any) => any;
-    readonly multicodecTable: () => [number, number, number];
-    readonly multicodecTableProto: () => [number, number, number];
-    readonly multicodecTableProtoResult: () => [number, number, number];
-    readonly multikeyEncode: (a: number, b: number, c: any) => [number, number, number, number];
-    readonly multikeyParse: (a: number, b: number) => [number, number, number];
-    readonly multikeyParseProto: (a: number, b: number) => [number, number, number];
-    readonly multikeyParseProtoResult: (a: number, b: number) => [number, number, number];
-    readonly pemDecode: (a: number, b: number, c: number, d: number) => [number, number, number];
-    readonly pemDecodeProto: (a: number, b: number, c: number, d: number) => [number, number, number];
-    readonly pemDecodeProtoResult: (a: number, b: number, c: number, d: number) => [number, number, number];
-    readonly pemEncode: (a: number, b: number, c: any, d: number, e: number) => [number, number, number, number];
-    readonly requireSupportedMulticodec: (a: number, b: number) => [number, number];
-    readonly tryParseCid: (a: number, b: number) => any;
-    readonly validateKeyBinding: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number];
-    readonly __wbindgen_exn_store: (a: number) => void;
-    readonly __externref_table_alloc: () => number;
-    readonly __wbindgen_externrefs: WebAssembly.Table;
+    readonly multibaseBase64urlEncode: (a: any) => [number, number, number, number];
+    readonly multibaseDecode: (a: any) => [number, number, number];
+    readonly multicodecStripPrefix: (a: any) => [number, number, number];
+    readonly multikeyEncode: (a: any, b: any) => [number, number, number, number];
+    readonly processOperation: (a: any) => [number, number, number];
+    readonly processOperationJson: (a: any) => [number, number, number];
+    readonly requireSupportedMulticodec: (a: any) => [number, number];
+    readonly tryParseCid: (a: any) => [number, number, number];
+    readonly validateKeyBinding: (a: any, b: number, c: any) => [number, number];
     readonly __wbindgen_malloc: (a: number, b: number) => number;
     readonly __wbindgen_realloc: (a: number, b: number, c: number, d: number) => number;
+    readonly __wbindgen_externrefs: WebAssembly.Table;
     readonly __externref_table_dealloc: (a: number) => void;
     readonly __wbindgen_free: (a: number, b: number, c: number) => void;
+    readonly __externref_table_alloc: () => number;
     readonly __wbindgen_start: () => void;
 }