@reallyme/codec 0.1.22 → 0.2.1

package/dist/cbor.js

@@ -2,12 +2,156 @@
 //
 // SPDX-License-Identifier: Apache-2.0
 import { create } from "@bufbuild/protobuf";
-import { MAX_CODEC_BOUNDARY_NODES, stringifyBoundaryJson, } from "./boundary.js";
+import { MAX_CODEC_BOUNDARY_NODES, strictUtf8ByteLength, } from "./boundary.js";
+import { DETERMINISTIC_CBOR_I64_MIN, DETERMINISTIC_CBOR_NEGATIVE_MAX, DETERMINISTIC_CBOR_U64_MAX, MAX_DETERMINISTIC_CBOR_AGGREGATE_BYTE_STRING_BYTES, MAX_DETERMINISTIC_CBOR_AGGREGATE_TEXT_BYTES, MAX_DETERMINISTIC_CBOR_CONTAINER_ENTRIES, MAX_DETERMINISTIC_CBOR_INPUT_LEN, MAX_DETERMINISTIC_CBOR_NESTING_DEPTH, MAX_DETERMINISTIC_CBOR_NODES, MAX_DETERMINISTIC_CBOR_OUTPUT_LEN, } from "./deterministicCborBoundary.js";
 import { ReallyMeCodecError } from "./errors.js";
-import { CodecDagCborVerifyCidRequestSchema, CodecOperationRequestSchema, } from "./proto/generated/reallyme/codec/v1/codec_pb.js";
-import { processGeneratedProtoRequest, protoPayloadOrThrow, } from "./protoProcess.js";
-import { ensureBytesInput, ensureStringValue, readBooleanProperty, readBytesOutput, readObjectOutput, readStringOutput, readStringProperty, readStringValueProperty, readNumberOutput, } from "./readOutput.js";
+import { CodecDagCborDecodeRequestSchema, CodecDagCborEncodeRequestSchema, CodecDagCborVerifyCidRequestSchema, CodecDeterministicCborArraySchema, CodecDeterministicCborBoolSchema, CodecDeterministicCborBytesSchema, CodecDeterministicCborDecodeRequestSchema, CodecDeterministicCborEncodeRequestSchema, CodecDeterministicCborIntegerSchema, CodecDeterministicCborMapEntrySchema, CodecDeterministicCborMapKeySchema, CodecDeterministicCborMapSchema, CodecDeterministicCborNegativeIntegerSchema, CodecDeterministicCborNullSchema, CodecDeterministicCborTextSchema, CodecDeterministicCborUnsignedIntegerSchema, CodecDeterministicCborValueSchema, CodecOperationRequestSchema, } from "./proto/generated/reallyme/codec/v1/codec_pb.js";
+import { clearGeneratedOperationResult, processGeneratedOperationRequest, } from "./operationContract.js";
+import { ensureBytesInput, ensureStringValue, readBytesOutput, readStringOutput, readNumberOutput, } from "./readOutput.js";
 import { requireReallyMeCodecWasmProvider } from "./wasmProvider.js";
+export const ReallyMeDeterministicCbor = {
+    null() {
+        return { type: "null" };
+    },
+    bool(value) {
+        if (typeof value !== "boolean") {
+            return invalidCborInput();
+        }
+        return { type: "bool", value };
+    },
+    unsigned(value) {
+        if (typeof value !== "bigint" || value < 0n || value > DETERMINISTIC_CBOR_U64_MAX) {
+            return invalidCborInput();
+        }
+        return { type: "integer", value: { type: "unsigned", value } };
+    },
+    negative(value) {
+        if (typeof value !== "bigint" ||
+            value < DETERMINISTIC_CBOR_I64_MIN ||
+            value > DETERMINISTIC_CBOR_NEGATIVE_MAX) {
+            return invalidCborInput();
+        }
+        return { type: "integer", value: { type: "negative", value } };
+    },
+    text(value) {
+        ensureStringValue(value);
+        return { type: "text", value };
+    },
+    bytes(value) {
+        ensureBytesInput(value);
+        return { type: "bytes", value: value.slice() };
+    },
+    array(value) {
+        return { type: "array", value: [...value] };
+    },
+    mapInt(entries) {
+        const seen = new Set();
+        return {
+            type: "map",
+            value: entries.map(([key, value]) => {
+                if (typeof key !== "bigint" || key < 0n || key > DETERMINISTIC_CBOR_U64_MAX) {
+                    return invalidCborInput();
+                }
+                if (seen.has(key)) {
+                    return invalidCborInput();
+                }
+                seen.add(key);
+                return {
+                    key: { type: "integer", value: { type: "unsigned", value: key } },
+                    value,
+                };
+            }),
+        };
+    },
+    mapText(entries) {
+        const seen = new Set();
+        return {
+            type: "map",
+            value: entries.map(([key, value]) => {
+                ensureStringValue(key);
+                if (seen.has(key)) {
+                    return invalidCborInput();
+                }
+                seen.add(key);
+                return { key: { type: "text", value: key }, value };
+            }),
+        };
+    },
+    intKey(value) {
+        if (typeof value !== "bigint") {
+            return invalidCborInput();
+        }
+        if (value >= 0n && value <= DETERMINISTIC_CBOR_U64_MAX) {
+            return { type: "integer", value: { type: "unsigned", value } };
+        }
+        if (value >= DETERMINISTIC_CBOR_I64_MIN && value <= DETERMINISTIC_CBOR_NEGATIVE_MAX) {
+            return { type: "integer", value: { type: "negative", value } };
+        }
+        return invalidCborInput();
+    },
+    textKey(value) {
+        ensureStringValue(value);
+        return { type: "text", value };
+    },
+    entry(key, value) {
+        return { key, value };
+    },
+};
+export const ReallyMeDagCbor = {
+    null() {
+        return { type: "null" };
+    },
+    bool(value) {
+        if (typeof value !== "boolean") {
+            return invalidCborInput();
+        }
+        return { type: "bool", value };
+    },
+    int(value) {
+        return { type: "int", value: validateCborInteger(value) };
+    },
+    unsigned(value) {
+        const integer = validateCborInteger(value);
+        if ((typeof integer === "bigint" && integer < 0n) ||
+            (typeof integer === "number" && integer < 0)) {
+            return invalidCborInput();
+        }
+        return { type: "int", value: integer };
+    },
+    negative(value) {
+        const integer = validateCborInteger(value);
+        if ((typeof integer === "bigint" && integer >= 0n) ||
+            (typeof integer === "number" && integer >= 0)) {
+            return invalidCborInput();
+        }
+        return { type: "int", value: integer };
+    },
+    text(value) {
+        ensureStringValue(value);
+        return { type: "string", value };
+    },
+    bytes(value) {
+        ensureBytesInput(value);
+        return { type: "bytes", value: value.slice() };
+    },
+    array(value) {
+        return { type: "array", value: [...value] };
+    },
+    mapText(entries) {
+        const seen = new Set();
+        return {
+            type: "map",
+            value: entries.map(([key, value]) => {
+                ensureStringValue(key);
+                if (seen.has(key)) {
+                    return invalidCborInput();
+                }
+                seen.add(key);
+                return { key, value };
+            }),
+        };
+    },
+};
 const invalidCborInput = () => {
     throw new ReallyMeCodecError("invalid-input");
 };
@@ -25,7 +169,7 @@ const readDataProperty = (value, name) => {
     }
     return descriptor.value;
 };
-const snapshotArray = (value) => {
+const snapshotArray = (value, maximumLength = MAX_CODEC_BOUNDARY_NODES) => {
     if (!Array.isArray(value) || Object.getPrototypeOf(value) !== Array.prototype) {
         return invalidCborInput();
     }
@@ -36,7 +180,7 @@ const snapshotArray = (value) => {
     const length = rawLength;
     if (!Number.isSafeInteger(length) ||
         length < 0 ||
-        length > MAX_CODEC_BOUNDARY_NODES) {
+        length > maximumLength) {
         return invalidCborInput();
     }
     const entries = [];
@@ -53,6 +197,32 @@ const i64Min = -(1n << 63n);
 const i64Max = (1n << 63n) - 1n;
 const decimalIntegerPattern = /^-?(0|[1-9][0-9]*)$/u;
 const maxCborContainerDepth = 128;
+const maxDagCborInputLength = 1024 * 1024;
+const wipeDagCborValueBytes = (value) => {
+    if (value === undefined) {
+        return;
+    }
+    switch (value.type) {
+        case "bytes":
+            value.value.fill(0);
+            break;
+        case "array":
+            for (const child of value.value) {
+                wipeDagCborValueBytes(child);
+            }
+            break;
+        case "map":
+            for (const entry of value.value) {
+                wipeDagCborValueBytes(entry.value);
+            }
+            break;
+        case "null":
+        case "bool":
+        case "int":
+        case "string":
+            break;
+    }
+};
 const childContainerDepth = (depth) => {
     const nextDepth = depth + 1;
     if (nextDepth > maxCborContainerDepth) {
@@ -85,8 +255,8 @@ const validateCborInteger = (value) => {
     }
     throw new ReallyMeCodecError("invalid-input");
 };
-const validateCborValue = (value, depth = 0, seen = new WeakSet(), state = { nodes: 0 }) => {
-    if (state.nodes >= MAX_CODEC_BOUNDARY_NODES) {
+const validateCborValue = (value, depth = 0, seen = new WeakSet(), state = { nodes: 0, byteStringBytes: 0 }) => {
+    if (state.nodes >= MAX_DETERMINISTIC_CBOR_NODES) {
         throw new ReallyMeCodecError("invalid-input");
     }
     state.nodes += 1;
@@ -117,34 +287,52 @@ const validateCborValue = (value, depth = 0, seen = new WeakSet(), state = { nod
                     type: "int",
                     value: validateCborInteger(readDataProperty(value, "value")),
                 };
-            case "string":
-            case "bytes": {
+            case "string": {
                 const child = readDataProperty(value, "value");
                 if (typeof child !== "string") {
                     throw new ReallyMeCodecError("invalid-input");
                 }
-                return { type, value: child };
+                return { type: "string", value: child };
             }
-            case "array": {
-                const children = snapshotArray(readDataProperty(value, "value"));
-                if (children.length > MAX_CODEC_BOUNDARY_NODES - state.nodes) {
+            case "bytes": {
+                const child = readDataProperty(value, "value");
+                if (!(child instanceof Uint8Array)) {
                     throw new ReallyMeCodecError("invalid-input");
                 }
-                return {
-                    type: "array",
-                    value: children.map((entry) => validateCborValue(entry, childContainerDepth(depth), seen, state)),
-                };
-            }
-            case "map": {
-                const entries = snapshotArray(readDataProperty(value, "value"));
-                if (entries.length > MAX_CODEC_BOUNDARY_NODES - state.nodes) {
+                ensureBytesInput(child);
+                if (child.length >
+                    MAX_DETERMINISTIC_CBOR_AGGREGATE_BYTE_STRING_BYTES - state.byteStringBytes) {
                     throw new ReallyMeCodecError("invalid-input");
                 }
+                state.byteStringBytes += child.length;
+                return { type: "bytes", value: child.slice() };
+            }
+            case "array": {
+                const children = snapshotArray(readDataProperty(value, "value"), MAX_DETERMINISTIC_CBOR_NODES - state.nodes);
+                const normalizedChildren = [];
+                try {
+                    for (const entry of children) {
+                        normalizedChildren.push(validateCborValue(entry, childContainerDepth(depth), seen, state));
+                    }
+                    return {
+                        type: "array",
+                        value: normalizedChildren,
+                    };
+                }
+                catch (error) {
+                    for (const child of normalizedChildren) {
+                        wipeDagCborValueBytes(child);
+                    }
+                    throw error;
+                }
+            }
+            case "map": {
+                const entries = snapshotArray(readDataProperty(value, "value"), MAX_DETERMINISTIC_CBOR_NODES - state.nodes);
                 state.nodes += entries.length;
                 const keys = new Set();
-                return {
-                    type: "map",
-                    value: entries.map((entry) => {
+                const normalizedEntries = [];
+                try {
+                    for (const entry of entries) {
                         if (!isRecord(entry)) {
                             throw new ReallyMeCodecError("invalid-input");
                         }
@@ -153,62 +341,810 @@ const validateCborValue = (value, depth = 0, seen = new WeakSet(), state = { nod
                             throw new ReallyMeCodecError("invalid-input");
                         }
                         keys.add(key);
-                        return {
+                        normalizedEntries.push({
                             key,
                             value: validateCborValue(readDataProperty(entry, "value"), childContainerDepth(depth), seen, state),
+                        });
+                    }
+                    return {
+                        type: "map",
+                        value: normalizedEntries,
+                    };
+                }
+                catch (error) {
+                    for (const entry of normalizedEntries) {
+                        wipeDagCborValueBytes(entry.value);
+                    }
+                    throw error;
+                }
+            }
+            default:
+                throw new ReallyMeCodecError("invalid-input");
+        }
+    }
+    finally {
+        seen.delete(value);
+    }
+};
+const deterministicCborMapKeySet = () => ({
+    integerKeys: new Set(),
+    textKeys: new Set(),
+});
+const recordDeterministicCborMapKey = (key, keys, duplicate) => {
+    switch (key.type) {
+        case "integer":
+            // The supported positive and negative domains do not overlap, so the
+            // bigint itself is the exact semantic integer-key identity.
+            if (keys.integerKeys.has(key.value.value)) {
+                duplicate();
+            }
+            keys.integerKeys.add(key.value.value);
+            break;
+        case "text":
+            // Valid JavaScript scalar strings compare equal exactly when their
+            // UTF-8 encodings do. Deliberately do not normalize or locale-fold PII.
+            if (keys.textKeys.has(key.value)) {
+                duplicate();
+            }
+            keys.textKeys.add(key.value);
+            break;
+    }
+};
+const deterministicCborValidationState = () => ({
+    nodes: 0,
+    textBytes: 0,
+    byteStringBytes: 0,
+    ownedBytes: [],
+});
+const wipeOwnedByteSnapshots = (state) => {
+    for (const value of state.ownedBytes) {
+        value.fill(0);
+    }
+};
+const consumeDeterministicCborBudget = (current, amount, maximum) => {
+    if (!Number.isSafeInteger(amount) ||
+        amount < 0 ||
+        current > maximum - amount) {
+        return invalidCborInput();
+    }
+    return current + amount;
+};
+const consumeDeterministicCborText = (state, value) => {
+    // Every UTF-16 code unit requires at least one UTF-8 byte. Reject an
+    // impossible aggregate before walking an attacker-sized managed string.
+    if (state.textBytes >
+        MAX_DETERMINISTIC_CBOR_AGGREGATE_TEXT_BYTES - value.length) {
+        invalidCborInput();
+    }
+    state.textBytes = consumeDeterministicCborBudget(state.textBytes, strictUtf8ByteLength(value), MAX_DETERMINISTIC_CBOR_AGGREGATE_TEXT_BYTES);
+};
+const requireDeterministicCborObject = (value, allowedKeys) => {
+    if (!isRecord(value)) {
+        return invalidCborInput();
+    }
+    const properties = new Map();
+    for (const key of Reflect.ownKeys(value)) {
+        if (typeof key !== "string" || !allowedKeys.includes(key)) {
+            return invalidCborInput();
+        }
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        if (descriptor === undefined || !("value" in descriptor)) {
+            return invalidCborInput();
+        }
+        if (properties.has(key)) {
+            return invalidCborInput();
+        }
+        properties.set(key, descriptor.value);
+    }
+    return { owner: value, properties };
+};
+const readDeterministicCborDataProperty = (properties, key) => {
+    if (!properties.has(key)) {
+        return invalidCborInput();
+    }
+    return properties.get(key);
+};
+const snapshotDeterministicCborArray = (value) => {
+    if (!Array.isArray(value) || Object.getPrototypeOf(value) !== Array.prototype) {
+        return invalidCborInput();
+    }
+    const properties = new Map();
+    for (const key of Reflect.ownKeys(value)) {
+        if (typeof key !== "string") {
+            return invalidCborInput();
+        }
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        if (descriptor === undefined || !("value" in descriptor) || properties.has(key)) {
+            return invalidCborInput();
+        }
+        properties.set(key, descriptor.value);
+    }
+    const rawLength = readDeterministicCborDataProperty(properties, "length");
+    if (typeof rawLength !== "number") {
+        return invalidCborInput();
+    }
+    const length = rawLength;
+    if (!Number.isSafeInteger(length) ||
+        length < 0 ||
+        length > MAX_DETERMINISTIC_CBOR_CONTAINER_ENTRIES) {
+        return invalidCborInput();
+    }
+    if (properties.size !== length + 1) {
+        return invalidCborInput();
+    }
+    const entries = [];
+    for (let index = 0; index < length; index += 1) {
+        entries.push(readDeterministicCborDataProperty(properties, String(index)));
+    }
+    return entries;
+};
+const uint8ArraySubarray = Uint8Array.prototype.subarray;
+const uint8ArraySet = Uint8Array.prototype.set;
+/**
+ * Copies one bounded, fixed-length view and then revalidates the source view.
+ * This avoids allocating from a second attacker-controlled length observation
+ * when a length-tracking resizable buffer changes during validation.
+ */
+const snapshotDeterministicCborBytes = (value, maximum) => {
+    const expectedLength = value.length;
+    if (expectedLength > maximum) {
+        return invalidCborInput();
+    }
+    let snapshot;
+    try {
+        const boundedView = uint8ArraySubarray.call(value, 0, expectedLength);
+        if (boundedView.length !== expectedLength) {
+            return invalidCborInput();
+        }
+        snapshot = new Uint8Array(expectedLength);
+        uint8ArraySet.call(snapshot, boundedView, 0);
+        if (value.length !== expectedLength ||
+            boundedView.length !== expectedLength ||
+            snapshot.length !== expectedLength) {
+            snapshot.fill(0);
+            return invalidCborInput();
+        }
+        return snapshot;
+    }
+    catch (error) {
+        snapshot?.fill(0);
+        if (error instanceof ReallyMeCodecError) {
+            throw error;
+        }
+        return invalidCborInput();
+    }
+};
+const requireDeterministicCborDepth = (depth) => {
+    const nextDepth = depth + 1;
+    if (nextDepth > MAX_DETERMINISTIC_CBOR_NESTING_DEPTH) {
+        return invalidCborInput();
+    }
+    return nextDepth;
+};
+const validateDeterministicCborInteger = (value) => {
+    const object = requireDeterministicCborObject(value, ["type", "value"]);
+    const type = readDeterministicCborDataProperty(object.properties, "type");
+    const rawValue = readDeterministicCborDataProperty(object.properties, "value");
+    if (typeof type !== "string" || typeof rawValue !== "bigint") {
+        return invalidCborInput();
+    }
+    switch (type) {
+        case "unsigned":
+            if (rawValue < 0n || rawValue > DETERMINISTIC_CBOR_U64_MAX) {
+                return invalidCborInput();
+            }
+            return { type: "unsigned", value: rawValue };
+        case "negative":
+            if (rawValue < DETERMINISTIC_CBOR_I64_MIN ||
+                rawValue > DETERMINISTIC_CBOR_NEGATIVE_MAX) {
+                return invalidCborInput();
+            }
+            return { type: "negative", value: rawValue };
+        default:
+            return invalidCborInput();
+    }
+};
+const validateDeterministicCborMapKey = (value, state) => {
+    state.nodes = consumeDeterministicCborBudget(state.nodes, 1, MAX_DETERMINISTIC_CBOR_NODES);
+    const object = requireDeterministicCborObject(value, ["type", "value"]);
+    const type = readDeterministicCborDataProperty(object.properties, "type");
+    if (typeof type !== "string") {
+        return invalidCborInput();
+    }
+    switch (type) {
+        case "integer":
+            return {
+                type: "integer",
+                value: validateDeterministicCborInteger(readDeterministicCborDataProperty(object.properties, "value")),
+            };
+        case "text": {
+            const text = readDeterministicCborDataProperty(object.properties, "value");
+            if (typeof text !== "string") {
+                return invalidCborInput();
+            }
+            consumeDeterministicCborText(state, text);
+            return { type: "text", value: text };
+        }
+        default:
+            return invalidCborInput();
+    }
+};
+const validateDeterministicCborValue = (value, depth, seen, state) => {
+    state.nodes = consumeDeterministicCborBudget(state.nodes, 1, MAX_DETERMINISTIC_CBOR_NODES);
+    const object = requireDeterministicCborObject(value, ["type", "value"]);
+    const type = readDeterministicCborDataProperty(object.properties, "type");
+    if (typeof type !== "string" || seen.has(object.owner)) {
+        return invalidCborInput();
+    }
+    seen.add(object.owner);
+    try {
+        switch (type) {
+            case "null":
+                if (object.properties.has("value")) {
+                    return invalidCborInput();
+                }
+                return { type: "null" };
+            case "bool": {
+                const child = readDeterministicCborDataProperty(object.properties, "value");
+                if (typeof child !== "boolean") {
+                    return invalidCborInput();
+                }
+                return { type: "bool", value: child };
+            }
+            case "integer":
+                return {
+                    type: "integer",
+                    value: validateDeterministicCborInteger(readDeterministicCborDataProperty(object.properties, "value")),
+                };
+            case "text": {
+                const child = readDeterministicCborDataProperty(object.properties, "value");
+                if (typeof child !== "string") {
+                    return invalidCborInput();
+                }
+                consumeDeterministicCborText(state, child);
+                return { type: "text", value: child };
+            }
+            case "bytes": {
+                const child = readDeterministicCborDataProperty(object.properties, "value");
+                if (!(child instanceof Uint8Array)) {
+                    return invalidCborInput();
+                }
+                const copy = snapshotDeterministicCborBytes(child, MAX_DETERMINISTIC_CBOR_AGGREGATE_BYTE_STRING_BYTES);
+                // Register ownership before any subsequent budget check can fail so
+                // the outer cleanup scope wipes this snapshot on every error path.
+                state.ownedBytes.push(copy);
+                state.byteStringBytes = consumeDeterministicCborBudget(state.byteStringBytes, copy.length, MAX_DETERMINISTIC_CBOR_AGGREGATE_BYTE_STRING_BYTES);
+                return { type: "bytes", value: copy };
+            }
+            case "array": {
+                const children = snapshotDeterministicCborArray(readDeterministicCborDataProperty(object.properties, "value"));
+                return {
+                    type: "array",
+                    value: children.map((entry) => validateDeterministicCborValue(entry, requireDeterministicCborDepth(depth), seen, state)),
+                };
+            }
+            case "map": {
+                const entries = snapshotDeterministicCborArray(readDeterministicCborDataProperty(object.properties, "value"));
+                const keys = deterministicCborMapKeySet();
+                return {
+                    type: "map",
+                    value: entries.map((entry) => {
+                        const mapEntry = requireDeterministicCborObject(entry, [
+                            "key",
+                            "value",
+                        ]);
+                        const key = validateDeterministicCborMapKey(readDeterministicCborDataProperty(mapEntry.properties, "key"), state);
+                        recordDeterministicCborMapKey(key, keys, invalidCborInput);
+                        return {
+                            key,
+                            value: validateDeterministicCborValue(readDeterministicCborDataProperty(mapEntry.properties, "value"), requireDeterministicCborDepth(depth), seen, state),
                         };
                     }),
                 };
             }
             default:
-                throw new ReallyMeCodecError("invalid-input");
+                return invalidCborInput();
         }
     }
     finally {
-        seen.delete(value);
+        seen.delete(object.owner);
+    }
+};
+const normalizeDeterministicCborValue = (value) => {
+    const state = deterministicCborValidationState();
+    try {
+        return validateDeterministicCborValue(value, 0, new WeakSet(), state);
+    }
+    catch (error) {
+        wipeOwnedByteSnapshots(state);
+        if (error instanceof ReallyMeCodecError) {
+            throw error;
+        }
+        return invalidCborInput();
+    }
+};
+const deterministicCborIntegerToProto = (integer) => {
+    switch (integer.type) {
+        case "unsigned":
+            return create(CodecDeterministicCborIntegerSchema, {
+                value: {
+                    case: "unsignedValue",
+                    value: create(CodecDeterministicCborUnsignedIntegerSchema, {
+                        value: integer.value,
+                    }),
+                },
+            });
+        case "negative":
+            return create(CodecDeterministicCborIntegerSchema, {
+                value: {
+                    case: "negativeValue",
+                    value: create(CodecDeterministicCborNegativeIntegerSchema, {
+                        value: integer.value,
+                    }),
+                },
+            });
     }
 };
-const cborValueForJson = (value) => {
+const deterministicCborMapKeyToProto = (key) => {
+    switch (key.type) {
+        case "integer":
+            return create(CodecDeterministicCborMapKeySchema, {
+                key: {
+                    case: "integerKey",
+                    value: deterministicCborIntegerToProto(key.value),
+                },
+            });
+        case "text":
+            return create(CodecDeterministicCborMapKeySchema, {
+                key: {
+                    case: "textKey",
+                    value: create(CodecDeterministicCborTextSchema, { value: key.value }),
+                },
+            });
+    }
+};
+const deterministicCborValueToProto = (value) => {
     switch (value.type) {
         case "null":
-            return { type: "null" };
+            return create(CodecDeterministicCborValueSchema, {
+                value: {
+                    case: "nullValue",
+                    value: create(CodecDeterministicCborNullSchema),
+                },
+            });
         case "bool":
-        case "string":
+            return create(CodecDeterministicCborValueSchema, {
+                value: {
+                    case: "boolValue",
+                    value: create(CodecDeterministicCborBoolSchema, { value: value.value }),
+                },
+            });
+        case "integer":
+            return create(CodecDeterministicCborValueSchema, {
+                value: {
+                    case: "integerValue",
+                    value: deterministicCborIntegerToProto(value.value),
+                },
+            });
+        case "text":
+            return create(CodecDeterministicCborValueSchema, {
+                value: {
+                    case: "textValue",
+                    value: create(CodecDeterministicCborTextSchema, { value: value.value }),
+                },
+            });
         case "bytes":
-            return value;
-        case "int":
-            return {
-                type: "int",
-                value: typeof value.value === "bigint" ? value.value.toString() : value.value,
-            };
+            return create(CodecDeterministicCborValueSchema, {
+                value: {
+                    case: "bytesValue",
+                    value: create(CodecDeterministicCborBytesSchema, { value: value.value }),
+                },
+            });
         case "array":
-            return { type: "array", value: value.value.map(cborValueForJson) };
+            return create(CodecDeterministicCborValueSchema, {
+                value: {
+                    case: "arrayValue",
+                    value: create(CodecDeterministicCborArraySchema, {
+                        values: value.value.map(deterministicCborValueToProto),
+                    }),
+                },
+            });
         case "map":
+            return create(CodecDeterministicCborValueSchema, {
+                value: {
+                    case: "mapValue",
+                    value: create(CodecDeterministicCborMapSchema, {
+                        entries: value.value.map((entry) => create(CodecDeterministicCborMapEntrySchema, {
+                            key: deterministicCborMapKeyToProto(entry.key),
+                            value: deterministicCborValueToProto(entry.value),
+                        })),
+                    }),
+                },
+            });
+    }
+};
+const providerFailure = () => {
+    throw new ReallyMeCodecError("provider-failure");
+};
+const requireNoProviderUnknownFields = (message) => {
+    if (message.$unknown !== undefined && message.$unknown.length !== 0) {
+        providerFailure();
+    }
+};
+const consumeProviderDeterministicCborBudget = (current, amount, maximum) => {
+    if (!Number.isSafeInteger(amount) ||
+        amount < 0 ||
+        current > maximum - amount) {
+        return providerFailure();
+    }
+    return current + amount;
+};
+const providerDeterministicCborUtf8ByteLength = (value) => {
+    try {
+        return strictUtf8ByteLength(value);
+    }
+    catch (_error) {
+        return providerFailure();
+    }
+};
+const consumeProviderDeterministicCborText = (state, value) => {
+    if (state.textBytes >
+        MAX_DETERMINISTIC_CBOR_AGGREGATE_TEXT_BYTES - value.length) {
+        providerFailure();
+    }
+    state.textBytes = consumeProviderDeterministicCborBudget(state.textBytes, providerDeterministicCborUtf8ByteLength(value), MAX_DETERMINISTIC_CBOR_AGGREGATE_TEXT_BYTES);
+};
+const deterministicCborIntegerFromProto = (integer) => {
+    requireNoProviderUnknownFields(integer);
+    switch (integer.value.case) {
+        case "unsignedValue": {
+            requireNoProviderUnknownFields(integer.value.value);
+            const value = integer.value.value.value;
+            if (value < 0n || value > DETERMINISTIC_CBOR_U64_MAX) {
+                return providerFailure();
+            }
+            return { type: "unsigned", value };
+        }
+        case "negativeValue": {
+            requireNoProviderUnknownFields(integer.value.value);
+            const value = integer.value.value.value;
+            if (value < DETERMINISTIC_CBOR_I64_MIN ||
+                value > DETERMINISTIC_CBOR_NEGATIVE_MAX) {
+                return providerFailure();
+            }
+            return { type: "negative", value };
+        }
+        case undefined:
+            return providerFailure();
+    }
+};
+const deterministicCborMapKeyFromProto = (key, state) => {
+    requireNoProviderUnknownFields(key);
+    state.nodes = consumeProviderDeterministicCborBudget(state.nodes, 1, MAX_DETERMINISTIC_CBOR_NODES);
+    switch (key.key.case) {
+        case "integerKey":
+            return {
+                type: "integer",
+                value: deterministicCborIntegerFromProto(key.key.value),
+            };
+        case "textKey": {
+            requireNoProviderUnknownFields(key.key.value);
+            consumeProviderDeterministicCborText(state, key.key.value.value);
+            return { type: "text", value: key.key.value.value };
+        }
+        case undefined:
+            return providerFailure();
+    }
+};
+const deterministicCborValueFromProto = (value, depth, state) => {
+    if (value === undefined) {
+        return providerFailure();
+    }
+    requireNoProviderUnknownFields(value);
+    state.nodes = consumeProviderDeterministicCborBudget(state.nodes, 1, MAX_DETERMINISTIC_CBOR_NODES);
+    switch (value.value.case) {
+        case "nullValue":
+            requireNoProviderUnknownFields(value.value.value);
+            return { type: "null" };
+        case "boolValue":
+            requireNoProviderUnknownFields(value.value.value);
+            return { type: "bool", value: value.value.value.value };
+        case "integerValue":
+            return {
+                type: "integer",
+                value: deterministicCborIntegerFromProto(value.value.value),
+            };
+        case "textValue": {
+            requireNoProviderUnknownFields(value.value.value);
+            const text = value.value.value.value;
+            consumeProviderDeterministicCborText(state, text);
+            return { type: "text", value: text };
+        }
+        case "bytesValue": {
+            requireNoProviderUnknownFields(value.value.value);
+            const bytes = value.value.value.value;
+            state.byteStringBytes = consumeProviderDeterministicCborBudget(state.byteStringBytes, bytes.length, MAX_DETERMINISTIC_CBOR_AGGREGATE_BYTE_STRING_BYTES);
+            const copy = bytes.slice();
+            state.ownedBytes.push(copy);
+            return { type: "bytes", value: copy };
+        }
+        case "arrayValue": {
+            requireNoProviderUnknownFields(value.value.value);
+            const values = value.value.value.values;
+            if (values.length > MAX_DETERMINISTIC_CBOR_CONTAINER_ENTRIES ||
+                depth >= MAX_DETERMINISTIC_CBOR_NESTING_DEPTH) {
+                return providerFailure();
+            }
+            return {
+                type: "array",
+                value: values.map((entry) => deterministicCborValueFromProto(entry, depth + 1, state)),
+            };
+        }
+        case "mapValue": {
+            requireNoProviderUnknownFields(value.value.value);
+            const entries = value.value.value.entries;
+            if (entries.length > MAX_DETERMINISTIC_CBOR_CONTAINER_ENTRIES ||
+                depth >= MAX_DETERMINISTIC_CBOR_NESTING_DEPTH) {
+                return providerFailure();
+            }
+            const keys = deterministicCborMapKeySet();
             return {
                 type: "map",
-                value: value.value.map((entry) => ({
-                    key: entry.key,
-                    value: cborValueForJson(entry.value),
-                })),
+                value: entries.map((entry) => {
+                    requireNoProviderUnknownFields(entry);
+                    if (entry.key === undefined) {
+                        return providerFailure();
+                    }
+                    const key = deterministicCborMapKeyFromProto(entry.key, state);
+                    recordDeterministicCborMapKey(key, keys, providerFailure);
+                    return {
+                        key,
+                        value: deterministicCborValueFromProto(entry.value, depth + 1, state),
+                    };
+                }),
             };
+        }
+        case undefined:
+            return providerFailure();
     }
 };
-const readCborValue = (json) => {
-    try {
-        const parsed = JSON.parse(json);
-        return validateCborValue(parsed);
+const wipeDeterministicCborValueBytes = (value) => {
+    switch (value.type) {
+        case "bytes":
+            value.value.fill(0);
+            break;
+        case "array":
+            for (const child of value.value) {
+                wipeDeterministicCborValueBytes(child);
+            }
+            break;
+        case "map":
+            for (const entry of value.value) {
+                wipeDeterministicCborValueBytes(entry.value);
+            }
+            break;
+        case "null":
+        case "bool":
+        case "integer":
+        case "text":
+            break;
     }
-    catch (_error) {
-        throw new ReallyMeCodecError("provider-failure");
+};
+const wipeProtoDeterministicCborValueBytes = (value) => {
+    if (value === undefined) {
+        return;
+    }
+    switch (value.value.case) {
+        case "bytesValue":
+            value.value.value.value.fill(0);
+            break;
+        case "arrayValue":
+            for (const child of value.value.value.values) {
+                wipeProtoDeterministicCborValueBytes(child);
+            }
+            break;
+        case "mapValue":
+            for (const entry of value.value.value.entries) {
+                wipeProtoDeterministicCborValueBytes(entry.value);
+            }
+            break;
+        case "nullValue":
+        case "boolValue":
+        case "integerValue":
+        case "textValue":
+        case undefined:
+            break;
+    }
+};
+const dagCborIntegerToProto = (value) => {
+    const integer = typeof value === "bigint" ? value : BigInt(value);
+    if (integer < i64Min || integer > i64Max) {
+        return invalidCborInput();
+    }
+    if (integer < 0n) {
+        return create(CodecDeterministicCborIntegerSchema, {
+            value: {
+                case: "negativeValue",
+                value: create(CodecDeterministicCborNegativeIntegerSchema, {
+                    value: integer,
+                }),
+            },
+        });
+    }
+    return create(CodecDeterministicCborIntegerSchema, {
+        value: {
+            case: "unsignedValue",
+            value: create(CodecDeterministicCborUnsignedIntegerSchema, {
+                value: integer,
+            }),
+        },
+    });
+};
+const dagCborValueToProto = (value) => {
+    switch (value.type) {
+        case "null":
+            return create(CodecDeterministicCborValueSchema, {
+                value: {
+                    case: "nullValue",
+                    value: create(CodecDeterministicCborNullSchema),
+                },
+            });
+        case "bool":
+            return create(CodecDeterministicCborValueSchema, {
+                value: {
+                    case: "boolValue",
+                    value: create(CodecDeterministicCborBoolSchema, { value: value.value }),
+                },
+            });
+        case "int":
+            return create(CodecDeterministicCborValueSchema, {
+                value: {
+                    case: "integerValue",
+                    value: dagCborIntegerToProto(value.value),
+                },
+            });
+        case "string":
+            return create(CodecDeterministicCborValueSchema, {
+                value: {
+                    case: "textValue",
+                    value: create(CodecDeterministicCborTextSchema, { value: value.value }),
+                },
+            });
+        case "bytes": {
+            const bytes = value.value.slice();
+            try {
+                const bytesValue = create(CodecDeterministicCborBytesSchema, { value: bytes });
+                return create(CodecDeterministicCborValueSchema, {
+                    value: {
+                        case: "bytesValue",
+                        value: bytesValue,
+                    },
+                });
+            }
+            catch (error) {
+                bytes.fill(0);
+                throw error;
+            }
+        }
+        case "array": {
+            const values = [];
+            try {
+                for (const child of value.value) {
+                    values.push(dagCborValueToProto(child));
+                }
+                return create(CodecDeterministicCborValueSchema, {
+                    value: {
+                        case: "arrayValue",
+                        value: create(CodecDeterministicCborArraySchema, { values }),
+                    },
+                });
+            }
+            catch (error) {
+                for (const child of values) {
+                    wipeProtoDeterministicCborValueBytes(child);
+                }
+                throw error;
+            }
+        }
+        case "map": {
+            const entries = [];
+            try {
+                for (const entry of value.value) {
+                    const entryValue = dagCborValueToProto(entry.value);
+                    try {
+                        entries.push(create(CodecDeterministicCborMapEntrySchema, {
+                            key: create(CodecDeterministicCborMapKeySchema, {
+                                key: {
+                                    case: "textKey",
+                                    value: create(CodecDeterministicCborTextSchema, {
+                                        value: entry.key,
+                                    }),
+                                },
+                            }),
+                            value: entryValue,
+                        }));
+                    }
+                    catch (error) {
+                        wipeProtoDeterministicCborValueBytes(entryValue);
+                        throw error;
+                    }
+                }
+                return create(CodecDeterministicCborValueSchema, {
+                    value: {
+                        case: "mapValue",
+                        value: create(CodecDeterministicCborMapSchema, { entries }),
+                    },
+                });
+            }
+            catch (error) {
+                for (const entry of entries) {
+                    wipeProtoDeterministicCborValueBytes(entry.value);
+                }
+                throw error;
+            }
+        }
     }
 };
-const readCidVerification = (value) => {
-    const object = readObjectOutput(value);
-    return {
-        valid: readBooleanProperty(object, "valid"),
-        expectedCid: readStringProperty(object, "expectedCid"),
-        actualCid: readStringValueProperty(object, "actualCid"),
-    };
+const dagCborValueFromDeterministic = (value) => {
+    switch (value.type) {
+        case "null":
+            return { type: "null" };
+        case "bool":
+            return { type: "bool", value: value.value };
+        case "integer": {
+            const integer = value.value.value;
+            if (integer < i64Min || integer > i64Max) {
+                return providerFailure();
+            }
+            return { type: "int", value: integer };
+        }
+        case "text":
+            return { type: "string", value: value.value };
+        case "bytes":
+            return { type: "bytes", value: value.value.slice() };
+        case "array": {
+            const values = [];
+            try {
+                for (const child of value.value) {
+                    values.push(dagCborValueFromDeterministic(child));
+                }
+                return {
+                    type: "array",
+                    value: values,
+                };
+            }
+            catch (error) {
+                for (const child of values) {
+                    wipeDagCborValueBytes(child);
+                }
+                throw error;
+            }
+        }
+        case "map": {
+            const entries = [];
+            try {
+                for (const entry of value.value) {
+                    if (entry.key.type !== "text") {
+                        return providerFailure();
+                    }
+                    entries.push({
+                        key: entry.key.value,
+                        value: dagCborValueFromDeterministic(entry.value),
+                    });
+                }
+                return {
+                    type: "map",
+                    value: entries,
+                };
+            }
+            catch (error) {
+                for (const entry of entries) {
+                    wipeDagCborValueBytes(entry.value);
+                }
+                throw error;
+            }
+        }
+    }
 };
 export const dagCborEncode = (value) => {
     let normalized;
@@ -221,11 +1157,161 @@ export const dagCborEncode = (value) => {
         }
         return invalidCborInput();
     }
-    return readBytesOutput(requireReallyMeCodecWasmProvider().dagCborEncode(stringifyBoundaryJson(cborValueForJson(normalized))));
+    let protoValue;
+    try {
+        protoValue = dagCborValueToProto(normalized);
+        const operationResult = processGeneratedOperationRequest(create(CodecOperationRequestSchema, {
+            operation: {
+                case: "dagCborEncode",
+                value: create(CodecDagCborEncodeRequestSchema, {
+                    value: protoValue,
+                }),
+            },
+        }));
+        if (operationResult.result.case !== "dagCborEncode") {
+            clearGeneratedOperationResult(operationResult);
+            throw new ReallyMeCodecError("provider-failure");
+        }
+        const result = operationResult.result.value;
+        try {
+            requireNoProviderUnknownFields(result);
+            if (result.encoded.length === 0 ||
+                result.encoded.length > maxDagCborInputLength) {
+                return providerFailure();
+            }
+            return result.encoded.slice();
+        }
+        catch (error) {
+            if (error instanceof ReallyMeCodecError) {
+                throw error;
+            }
+            throw new ReallyMeCodecError("provider-failure");
+        }
+        finally {
+            result.encoded.fill(0);
+        }
+    }
+    finally {
+        wipeProtoDeterministicCborValueBytes(protoValue);
+        wipeDagCborValueBytes(normalized);
+    }
 };
 export const dagCborDecode = (bytes) => {
     ensureBytesInput(bytes);
-    return readCborValue(readStringOutput(requireReallyMeCodecWasmProvider().dagCborDecode(bytes)));
+    if (bytes.length > maxDagCborInputLength) {
+        throw new ReallyMeCodecError("invalid-input");
+    }
+    const requestBytes = snapshotDeterministicCborBytes(bytes, maxDagCborInputLength);
+    try {
+        const operationResult = processGeneratedOperationRequest(create(CodecOperationRequestSchema, {
+            operation: {
+                case: "dagCborDecode",
+                value: create(CodecDagCborDecodeRequestSchema, {
+                    encoded: requestBytes,
+                }),
+            },
+        }));
+        if (operationResult.result.case !== "dagCborDecode") {
+            clearGeneratedOperationResult(operationResult);
+            throw new ReallyMeCodecError("provider-failure");
+        }
+        const result = operationResult.result.value;
+        const state = deterministicCborValidationState();
+        let normalized;
+        try {
+            requireNoProviderUnknownFields(result);
+            normalized = deterministicCborValueFromProto(result.value, 0, state);
+            return dagCborValueFromDeterministic(normalized);
+        }
+        catch (error) {
+            if (error instanceof ReallyMeCodecError) {
+                throw error;
+            }
+            throw new ReallyMeCodecError("provider-failure");
+        }
+        finally {
+            wipeOwnedByteSnapshots(state);
+            if (normalized !== undefined) {
+                wipeDeterministicCborValueBytes(normalized);
+            }
+            wipeProtoDeterministicCborValueBytes(result.value);
+        }
+    }
+    finally {
+        requestBytes.fill(0);
+    }
+};
+export const deterministicCborEncode = (value) => {
+    const normalized = normalizeDeterministicCborValue(value);
+    let protoValue;
+    try {
+        protoValue = deterministicCborValueToProto(normalized);
+        const operationResult = processGeneratedOperationRequest(create(CodecOperationRequestSchema, {
+            operation: {
+                case: "deterministicCborEncode",
+                value: create(CodecDeterministicCborEncodeRequestSchema, {
+                    value: protoValue,
+                }),
+            },
+        }));
+        if (operationResult.result.case !== "deterministicCborEncode") {
+            clearGeneratedOperationResult(operationResult);
+            throw new ReallyMeCodecError("provider-failure");
+        }
+        const result = operationResult.result.value;
+        try {
+            requireNoProviderUnknownFields(result);
+            if (result.encoded.length === 0 ||
+                result.encoded.length > MAX_DETERMINISTIC_CBOR_OUTPUT_LEN) {
+                throw new ReallyMeCodecError("provider-failure");
+            }
+            return result.encoded.slice();
+        }
+        finally {
+            result.encoded.fill(0);
+        }
+    }
+    finally {
+        wipeProtoDeterministicCborValueBytes(protoValue);
+        wipeDeterministicCborValueBytes(normalized);
+    }
+};
+export const deterministicCborDecode = (bytes) => {
+    ensureBytesInput(bytes);
+    if (bytes.length > MAX_DETERMINISTIC_CBOR_INPUT_LEN) {
+        throw new ReallyMeCodecError("invalid-input");
+    }
+    const requestBytes = snapshotDeterministicCborBytes(bytes, MAX_DETERMINISTIC_CBOR_INPUT_LEN);
+    try {
+        const operationResult = processGeneratedOperationRequest(create(CodecOperationRequestSchema, {
+            operation: {
+                case: "deterministicCborDecode",
+                value: create(CodecDeterministicCborDecodeRequestSchema, {
+                    encoded: requestBytes,
+                }),
+            },
+        }));
+        if (operationResult.result.case !== "deterministicCborDecode") {
+            clearGeneratedOperationResult(operationResult);
+            throw new ReallyMeCodecError("provider-failure");
+        }
+        const result = operationResult.result.value;
+        const state = deterministicCborValidationState();
+        try {
+            requireNoProviderUnknownFields(result);
+            return deterministicCborValueFromProto(result.value, 0, state);
+        }
+        catch (error) {
+            wipeOwnedByteSnapshots(state);
+            throw error;
+        }
+        finally {
+            wipeProtoDeterministicCborValueBytes(result.value);
+        }
+    }
+    finally {
+        requestBytes.fill(0);
+    }
 };
 export const dagCborComputeCid = (bytes) => {
     ensureBytesInput(bytes);
@@ -234,24 +1320,34 @@ export const dagCborComputeCid = (bytes) => {
 export const dagCborVerifyCid = (cid, bytes) => {
     ensureStringValue(cid);
     ensureBytesInput(bytes);
-    return readCidVerification(requireReallyMeCodecWasmProvider().dagCborVerifyCid(cid, bytes));
-};
-export const dagCborVerifyCidProto = (cid, bytes) => {
-    return protoPayloadOrThrow(dagCborVerifyCidProtoResult(cid, bytes));
-};
-export const dagCborVerifyCidProtoResult = (cid, bytes) => {
-    ensureStringValue(cid);
-    ensureBytesInput(bytes);
-    return processGeneratedProtoRequest(create(CodecOperationRequestSchema, {
-        operation: {
-            case: "dagCborVerifyCid",
-            value: create(CodecDagCborVerifyCidRequestSchema, {
-                cid,
-                payload: bytes,
-            }),
-        },
-    }));
+    const payloadSnapshot = snapshotDeterministicCborBytes(bytes, maxDagCborInputLength);
+    try {
+        const operationResult = processGeneratedOperationRequest(dagCborVerifyCidRequest(cid, payloadSnapshot));
+        if (operationResult.result.case !== "dagCborVerifyCid") {
+            clearGeneratedOperationResult(operationResult);
+            throw new ReallyMeCodecError("provider-failure");
+        }
+        const result = operationResult.result.value;
+        requireNoProviderUnknownFields(result);
+        return {
+            valid: result.valid,
+            expectedCid: result.expectedCid,
+            actualCid: result.actualCid,
+        };
+    }
+    finally {
+        payloadSnapshot.fill(0);
+    }
 };
+const dagCborVerifyCidRequest = (cid, bytes) => create(CodecOperationRequestSchema, {
+    operation: {
+        case: "dagCborVerifyCid",
+        value: create(CodecDagCborVerifyCidRequestSchema, {
+            cid,
+            payload: bytes,
+        }),
+    },
+});
 export const dagCborSha256ContentHash = (bytes) => {
     ensureBytesInput(bytes);
     return readBytesOutput(requireReallyMeCodecWasmProvider().dagCborSha256ContentHash(bytes));