@sig-net/midnight 0.24.0-rc.8 → 0.24.0

package/dist/abi-serde.js

@@ -8,10 +8,10 @@ import { ethers } from "ethers";
  * into named values, driven by the request's outputDeserializationSchema.
  * The decode-side counterpart of {@link serializeRespondOutput}. Type
  * validation is FULLY delegated to ethers: this function checks the schema's
- * shape only. An empty schema decodes to an empty object. The MPC never
- * decodes under an empty schema: {@link executedEvmRespondOutput} carries
- * its rule for that case. Returns a plain object (never an ethers
- * `Result`), so it survives JSON round-trips and structural comparison.
+ * shape only, so it decodes ABI types the respond side refuses. An empty
+ * schema decodes to an empty object. Returns a plain object (never an
+ * ethers `Result`), so it survives JSON round-trips and structural
+ * comparison.
  *
  * @param schema - The outputDeserializationSchema: parsed, JSON text, or the raw NUL-padded on-chain bytes.
  * @param callResult - The ABI-encoded return data (hex string or bytes).
@@ -23,99 +23,211 @@ export function deserializeEvmOutput(schema, callResult) {
         return {};
     }
     const decoded = ethers.AbiCoder.defaultAbiCoder().decode(fields.map((field) => field.type), callResult);
-    const output = {};
-    fields.forEach((field, i) => {
-        output[field.name] = toPlainValue(decoded[i], field.name);
-    });
-    return output;
+    return Object.fromEntries(fields.map((field, i) => [
+        field.name,
+        toPlainValue(decoded[i], field.name),
+    ]));
 }
 // ---------------------------------------------------------------------------
-// 2. decoded values -> respond bytes  (respondSerializationSchema)
+// 2. decoded values -> respond bytes  (Borsh schema derived from the output schema)
 // ---------------------------------------------------------------------------
 /**
- * Parse native Borsh schema JSON from an on-chain field.
+ * The ABI output types the MPC attests, and what each maps to. The respond
+ * bytes are the Borsh serialisation of a struct with one member per output
+ * field, in schema order, typed by this mapping:
+ *
+ * - {@link EvmOutputTypeKind.Bool}: ABI `bool`, Borsh `bool`, Compact `Boolean` (1 byte).
+ * - {@link EvmOutputTypeKind.Uint256}: ABI `uint256`, Borsh `[u8; 32]`
+ *   holding the value LITTLE-endian, the byte order of every Borsh and
+ *   Compact integer, Compact `Bytes<32>` (32 bytes). A circuit that wants a
+ *   number narrows it with `checkedTruncationU128`, which aborts above
+ *   2^128 - 1. The ABI wire word is big-endian: the MPC reverses it once,
+ *   here, so no circuit has to.
+ * - {@link EvmOutputTypeKind.Address}: ABI `address`, Borsh `[u8; 20]`
+ *   holding the address bytes, Compact `Bytes<20>` (20 bytes).
+ * - {@link EvmOutputTypeKind.FixedBytes}: ABI `bytes1` to `bytes32`, Borsh
+ *   `[u8; N]`, Compact `Bytes<N>` (N bytes).
  *
- * @param schema - Native schema, JSON text, or NUL-padded bytes.
- * @returns The native Borsh schema.
- * @throws {Error} If schema JSON is malformed.
+ * Every other ABI type is unsupported: the MPC drops a request whose output
+ * schema names one, and {@link deriveRespondSchema} throws on it.
  */
-function respondSchema(schema) {
-    if (schema instanceof Uint8Array)
-        return JSON.parse(schemaText(schema));
-    if (typeof schema === "string" && /^\s*[{["]/.test(schema)) {
-        return JSON.parse(schema);
+export var EvmOutputTypeKind;
+(function (EvmOutputTypeKind) {
+    EvmOutputTypeKind["Bool"] = "bool";
+    EvmOutputTypeKind["Uint256"] = "uint256";
+    EvmOutputTypeKind["Address"] = "address";
+    EvmOutputTypeKind["FixedBytes"] = "bytesN";
+})(EvmOutputTypeKind || (EvmOutputTypeKind = {}));
+/** The byte width of an ABI word, and of the Borsh array a `uint256` output maps to. */
+const ABI_WORD_BYTES = 32;
+/** The byte width of an EVM address, and of the Borsh array an `address` output maps to. */
+const EVM_ADDRESS_BYTES = 20;
+/**
+ * Classify an ABI type string into the supported output subset. The match is
+ * on the raw string, so `uint` is unsupported although the ABI library reads
+ * it as `uint256`: the MPC matches the same raw string.
+ *
+ * @param type - The ABI type string of an output schema field.
+ * @returns The field's kind and respond byte width, or `undefined` for an unsupported type.
+ */
+function classifyEvmOutputType(type) {
+    if (type === "bool")
+        return { kind: EvmOutputTypeKind.Bool, bytes: 1 };
+    if (type === "uint256")
+        return { kind: EvmOutputTypeKind.Uint256, bytes: ABI_WORD_BYTES };
+    if (type === "address")
+        return { kind: EvmOutputTypeKind.Address, bytes: EVM_ADDRESS_BYTES };
+    const fixedBytes = /^bytes([1-9]|[12][0-9]|3[0-2])$/.exec(type);
+    if (fixedBytes !== null) {
+        return { kind: EvmOutputTypeKind.FixedBytes, bytes: Number(fixedBytes[1]) };
     }
-    return schema;
+    return undefined;
 }
 /**
- * Convert ABI numeric and byte representations into native Borsh values.
- * Integer narrowing must fail before the value reaches Borsh's truncating writes.
+ * The fields of an outputDeserializationSchema whose ABI type is outside the
+ * supported subset ({@link EvmOutputTypeKind}). The check itself never
+ * throws on an unsupported type: an empty result means the MPC attests the
+ * request, a non-empty one means it drops it.
  *
- * @param schema - Native Borsh schema.
- * @param value - Decoded EVM value.
- * @returns Value in the Borsh representation.
- * @throws {RangeError} If an integer cannot be represented without loss.
+ * @param schema - The outputDeserializationSchema: parsed, JSON text, or the raw NUL-padded on-chain bytes.
+ * @returns The unsupported fields in schema order, empty when every field is supported.
+ * @throws {Error} If the schema is not an array of uniquely named fields (its shape, not its types).
  */
-function toBorshValue(schema, value) {
-    if (typeof schema === "string") {
-        const integer = /^([ui])(8|16|32|64|128)$/.exec(schema);
-        if (integer) {
-            if (typeof value !== "bigint" && typeof value !== "number" && typeof value !== "string") {
-                throw new TypeError(`Expected an integer for ${schema}`);
-            }
-            if (typeof value === "number" && !Number.isSafeInteger(value)) {
-                throw new RangeError(`Unsafe integer for ${schema}`);
-            }
-            const number = BigInt(value);
-            const bits = Number(integer[2]);
-            const signed = integer[1] === "i";
-            const bound = 1n << BigInt(signed ? bits - 1 : bits);
-            if (number < (signed ? -bound : 0n) || number >= bound) {
-                throw new RangeError(`EVM integer ${String(number)} does not fit Borsh ${schema}`);
-            }
-            return bits <= 32 ? Number(number) : number;
-        }
-        return value;
+export function unsupportedEvmOutputFields(schema) {
+    return parseSchemaShape(schema).filter((field) => classifyEvmOutputType(field.type) === undefined);
+}
+/**
+ * Parse an output schema and classify every field, refusing the schema as a
+ * whole when any field is unsupported.
+ *
+ * @param schema - The outputDeserializationSchema: parsed, JSON text, or the raw NUL-padded on-chain bytes.
+ * @returns The classified fields in schema order.
+ * @throws {Error} If the schema is malformed or names an unsupported ABI type.
+ */
+function classifiedEvmOutputFields(schema) {
+    const fields = parseSchemaShape(schema);
+    const unsupported = fields.filter((field) => classifyEvmOutputType(field.type) === undefined);
+    if (unsupported.length > 0) {
+        throw new Error(`respond output: unsupported ABI output type${unsupported.length > 1 ? "s" : ""} ` +
+            unsupported.map((field) => `'${field.name}' (${field.type})`).join(", ") +
+            ": the MPC attests bool, uint256, address and bytes1 to bytes32 only");
+    }
+    return fields.flatMap((field) => {
+        const classified = classifyEvmOutputType(field.type);
+        return classified === undefined ? [] : [{ ...field, ...classified }];
+    });
+}
+/**
+ * The Borsh schema the respond bytes of an executed call are serialised
+ * with: a struct with one member per output field, in schema order, each
+ * typed by {@link EvmOutputTypeKind}. An empty output schema derives an
+ * empty struct, which serialises to zero bytes. Borsh writes struct members
+ * in the struct object's key order, which equals schema order because field
+ * names are Solidity identifiers (see {@link parseSchemaShape}).
+ *
+ * @param schema - The outputDeserializationSchema: parsed, JSON text, or the raw NUL-padded on-chain bytes.
+ * @returns The derived Borsh struct schema.
+ * @throws {Error} If the schema is malformed or names an unsupported ABI type.
+ */
+export function deriveRespondSchema(schema) {
+    return {
+        struct: Object.fromEntries(classifiedEvmOutputFields(schema).map((field) => [
+            field.name,
+            field.kind === EvmOutputTypeKind.Bool
+                ? "bool"
+                : { array: { type: "u8", len: field.bytes } },
+        ])),
+    };
+}
+/**
+ * The byte width of the respond bytes an output schema derives: the sum of
+ * its fields' widths under {@link EvmOutputTypeKind}, what a settle circuit
+ * declares as its `Bytes<N>` output argument.
+ *
+ * @param schema - The outputDeserializationSchema: parsed, JSON text, or the raw NUL-padded on-chain bytes.
+ * @returns The exact serialised width, 0 for an empty schema.
+ * @throws {Error} If the schema is malformed or names an unsupported ABI type.
+ */
+export function respondOutputWidth(schema) {
+    return classifiedEvmOutputFields(schema).reduce((width, field) => width + field.bytes, 0);
+}
+/**
+ * The 32-byte LITTLE-endian encoding of a `uint256` output value, as ethers
+ * decodes it (bigint) or as indexer JSON renders it (a number or a decimal
+ * string). This is the ABI wire word reversed: the Borsh integer byte order,
+ * which a Compact `Uint<128>` reads directly.
+ *
+ * @param value - The decoded value.
+ * @param name - The field name, for the error message.
+ * @returns The value's 32 little-endian bytes.
+ * @throws {RangeError} If the value is not an integer in `0 <= value < 2^256`.
+ */
+function uint256Word(value, name) {
+    if (typeof value !== "bigint" && typeof value !== "number" && typeof value !== "string") {
+        throw new TypeError(`respond output: '${name}' (uint256) expects an integer`);
     }
-    if ("struct" in schema && typeof value === "object" && value !== null) {
-        const record = value;
-        return Object.fromEntries(Object.entries(schema.struct).map(([name, child]) => {
-            const field = record[name];
-            if (field === undefined)
-                throw new Error(`Missing response field '${name}'`);
-            return [name, toBorshValue(child, field)];
-        }));
+    if (typeof value === "number" && !Number.isSafeInteger(value)) {
+        throw new RangeError(`respond output: '${name}' (uint256) is not a safe integer`);
     }
-    if ("array" in schema) {
-        const array = typeof value === "string" && schema.array.type === "u8"
-            ? Array.from(ethers.getBytes(value))
-            : value instanceof Uint8Array
-                ? Array.from(value)
-                : value;
-        if (Array.isArray(array)) {
-            return array.map((element) => toBorshValue(schema.array.type, element));
-        }
+    if (typeof value === "string" && !/^\s*\d+\s*$/.test(value)) {
+        throw new RangeError(`respond output: '${name}' (uint256) is not a decimal integer string`);
     }
-    if ("option" in schema && value !== null)
-        return toBorshValue(schema.option, value);
-    if ("enum" in schema && typeof value === "object" && value !== null) {
-        const variant = schema.enum.find((item) => Object.keys(item.struct).some((key) => Object.hasOwn(value, key)));
-        if (variant !== undefined)
-            return toBorshValue(variant, value);
+    const integer = BigInt(value);
+    if (integer < 0n || integer >= 1n << 256n) {
+        throw new RangeError(`respond output: '${name}' (uint256) ${String(integer)} is outside uint256`);
     }
-    return value;
+    return Array.from(ethers.getBytes(ethers.toBeHex(integer, ABI_WORD_BYTES))).reverse();
+}
+/**
+ * The bytes of an `address` or `bytesN` output value, as ethers decodes it
+ * (a hex string, checksummed for an address) or as bytes. Byte order is the
+ * wire's: these are byte strings, not numbers.
+ *
+ * @param value - The decoded value.
+ * @param field - The field, for the error message.
+ * @returns The value's bytes, length-checked by Borsh against the schema.
+ * @throws {TypeError} If the value is neither a hex string nor bytes.
+ */
+function byteString(value, field) {
+    if (value instanceof Uint8Array)
+        return Array.from(value);
+    if (typeof value === "string")
+        return Array.from(ethers.getBytes(value));
+    throw new TypeError(`respond output: '${field.name}' (${field.type}) expects hex or bytes`);
 }
 /**
- * Encode ABI-decoded output using the request's native Borsh response schema.
+ * Serialise ABI-decoded output into the respond bytes the MPC attests: the
+ * Borsh encoding of {@link deriveRespondSchema}'s struct over the output's
+ * values. A `uint256` is carried whole as 32 little-endian bytes, so no
+ * value is narrowed off chain: a circuit that wants a number narrows the
+ * `Bytes<32>` with `checkedTruncationU128`.
  *
- * @param schema - Native schema, JSON text, or NUL-padded on-chain JSON.
- * @param output - Named decoded EVM values.
- * @returns Unpadded Borsh bytes.
- * @throws {Error} If conversion loses integer precision or Borsh rejects the input.
+ * @param schema - The outputDeserializationSchema: parsed, JSON text, or the raw NUL-padded on-chain bytes.
+ * @param output - The decoded values keyed by field name, as {@link deserializeEvmOutput} returns them.
+ * @returns The unpadded respond bytes, {@link respondOutputWidth} long.
+ * @throws {Error} If the schema is malformed or names an unsupported type, a
+ *   field is missing from `output`, or a value is outside its type.
  */
 export function serializeRespondOutput(schema, output) {
-    const parsed = respondSchema(schema);
-    return compactSerialize(parsed, toBorshValue(parsed, output));
+    const values = Object.fromEntries(classifiedEvmOutputFields(schema).map((field) => {
+        const value = output[field.name];
+        if (value === undefined) {
+            throw new Error(`respond output: missing value for '${field.name}'`);
+        }
+        switch (field.kind) {
+            case EvmOutputTypeKind.Bool:
+                if (typeof value !== "boolean") {
+                    throw new TypeError(`respond output: '${field.name}' (bool) expects a boolean`);
+                }
+                return [field.name, value];
+            case EvmOutputTypeKind.Uint256:
+                return [field.name, uint256Word(value, field.name)];
+            case EvmOutputTypeKind.Address:
+            case EvmOutputTypeKind.FixedBytes:
+                return [field.name, byteString(value, field)];
+        }
+    }));
+    return compactSerialize(deriveRespondSchema(schema), values);
 }
 // ---------------------------------------------------------------------------
 // 3. executed EVM transaction -> attested respond bytes
@@ -152,89 +264,102 @@ export var EvmTraceOutputKind;
     /** The top call frame carries no string `output` field. */
     EvmTraceOutputKind["NoReturnData"] = "NoReturnData";
 })(EvmTraceOutputKind || (EvmTraceOutputKind = {}));
-/** The string default the MPC synthesises for an execution without call output. */
-const NON_FUNCTION_CALL_SUCCESS = "non_function_call_success";
 /**
- * The per-field values the MPC synthesises for an execution without call
- * output (its `default_value_for_kind`): `true` for a bool field,
- * {@link NON_FUNCTION_CALL_SUCCESS} for a string field.
+ * Refuse return data that is not canonical ABI before it is decoded: whole
+ * 32-byte words, at least one per declared field, a `bool` word of 0 or 1,
+ * an `address` word with zero high bytes and a `bytesN` word zero-padded
+ * after its N bytes. Words past the declared fields are not checked. The ABI
+ * library decodes such data leniently (a `bool` word of 2 reads as true), so
+ * the check sits here, where the MPC decides whether to attest.
  *
- * @param schema - The respondSerializationSchema.
- * @returns The synthesised values keyed by field name.
- * @throws {Error} If the schema is one {@link serializeRespondOutput}
- *   rejects, or a field is of any other kind.
+ * @param fields - The schema's classified fields, in order.
+ * @param returnData - The traced return data, non-empty.
+ * @throws {Error} If the data is not whole words, holds fewer words than
+ *   fields, or a field's word is not canonical for its type.
  */
-function nonFunctionCallDefaults(schema) {
-    const parsed = respondSchema(schema);
-    if (typeof parsed === "string" || !("struct" in parsed)) {
-        throw new Error("Non-function-call defaults require a Borsh struct");
+function checkCanonicalReturnData(fields, returnData) {
+    if (returnData.length % ABI_WORD_BYTES !== 0) {
+        throw new Error(`respond output: return data of ${String(returnData.length)} bytes is not whole ABI words`);
     }
-    const output = {};
-    for (const [name, type] of Object.entries(parsed.struct)) {
-        if (type === "bool")
-            output[name] = true;
-        else if (type === "string")
-            output[name] = NON_FUNCTION_CALL_SUCCESS;
-        else
-            throw new Error(`Response field '${name}' has no non-function-call default`);
+    const words = returnData.length / ABI_WORD_BYTES;
+    if (words < fields.length) {
+        throw new Error(`respond output: return data holds ${String(words)} word${words === 1 ? "" : "s"} but the output schema declares ${String(fields.length)} fields`);
     }
-    return output;
+    const isZero = (bytes) => bytes.every((byte) => byte === 0);
+    fields.forEach((field, i) => {
+        const word = returnData.subarray(i * ABI_WORD_BYTES, (i + 1) * ABI_WORD_BYTES);
+        const last = word[ABI_WORD_BYTES - 1];
+        const canonical = field.kind === EvmOutputTypeKind.Bool
+            ? isZero(word.subarray(0, ABI_WORD_BYTES - 1)) && (last === 0 || last === 1)
+            : field.kind === EvmOutputTypeKind.Address
+                ? isZero(word.subarray(0, ABI_WORD_BYTES - EVM_ADDRESS_BYTES))
+                : field.kind === EvmOutputTypeKind.FixedBytes
+                    ? isZero(word.subarray(field.bytes))
+                    : true;
+        if (!canonical) {
+            throw new Error(`respond output: '${field.name}' (${field.type}) word 0x${ethers.hexlify(word).slice(2)} is not canonical ABI`);
+        }
+    });
 }
 /**
- * The exact serialised respond output the MPC attests for an EVM transaction
- * that executed (the payload of an `OutputKind.executed` attestation),
- * mirroring the MPC's `build_serialized_output` under the Midnight respond
- * format:
+ * The exact respond output the MPC attests for an EVM transaction that
+ * executed (the payload of an `OutputKind.executed` attestation), derived
+ * from the request's outputDeserializationSchema alone. The schema and the
+ * execution's return data MUST agree: an empty schema declares that the
+ * execution returns nothing, a non-empty schema that it returns data.
  *
- * - Not a contract call: the output schema and the trace are ignored, and
- *   the respond fields get synthesised defaults (bool `true`, string
- *   `"non_function_call_success"`, any other kind
- *   throws).
- * - A contract call under an EMPTY output schema (a void call): the same
- *   defaults when the trace has no or empty return data, a throw when it
- *   returned data.
- * - A contract call under a non-empty output schema: the return data
- *   decoded by {@link deserializeEvmOutput} and packed by
- *   {@link serializeRespondOutput}, a throw when the trace has no return
- *   data.
+ * - Not a contract call (a plain transfer): there is no return data, so the
+ *   schema must be empty and the output is EMPTY.
+ * - A contract call whose trace carries no return data, or empty return
+ *   data (`0x`): the schema must be empty and the output is EMPTY.
+ * - A contract call that returned data: the schema must be non-empty, and
+ *   the output is the return data decoded by {@link deserializeEvmOutput}
+ *   and serialised by {@link serializeRespondOutput}.
  *
- * A contract call that was not traced always throws. A failed or unviable
- * execution is attested over an empty output instead, which needs no call.
+ * The schema's types are checked on every path, a plain transfer included,
+ * so a request the MPC should have dropped never attests anything. A failed
+ * or unviable execution is attested over an empty output instead, which
+ * needs no call. An empty output under `executed` is therefore ordinary for
+ * an empty schema: its settle circuit verifies at width 0 and must route on
+ * the verified `outputKind`, never on the width.
  *
- * @param schemas - The request's two schemas (a request record satisfies this).
+ * @param schema - The request's outputDeserializationSchema (a request record's field satisfies this).
  * @param isContractCall - Whether the transaction is a contract call, as {@link isEvmContractCall} decides it.
  * @param trace - The transaction's traced return data (`NotTraced` for an untraced plain transfer).
- * @returns The packed respond bytes, unpadded.
+ * @returns The respond bytes, unpadded, empty for an empty schema.
  * @throws {Error} Exactly where the MPC refuses to attest an execution: a
- *   contract call not traced, an empty output schema with return data, a
- *   non-empty output schema with no or undecodable return data, a malformed
- *   output schema on a contract call, a respond field without a synthesised
- *   default, and every {@link serializeRespondOutput} rejection.
+ *   malformed schema or an unsupported output type, a contract call not
+ *   traced, return data under an empty schema, no or empty return data
+ *   under a non-empty schema, return data that is not canonical ABI
+ *   ({@link checkCanonicalReturnData}) or that the schema cannot decode, and
+ *   every {@link serializeRespondOutput} rejection.
  */
-export function executedEvmRespondOutput(schemas, isContractCall, trace) {
-    const { outputDeserializationSchema, respondSerializationSchema } = schemas;
+export function executedEvmRespondOutput(schema, isContractCall, trace) {
+    const fields = classifiedEvmOutputFields(schema);
+    const expectsOutput = fields.length > 0;
     if (!isContractCall) {
-        return serializeRespondOutput(respondSerializationSchema, nonFunctionCallDefaults(respondSerializationSchema));
+        if (expectsOutput) {
+            throw new Error("respond output: a plain transfer returns nothing, but the output schema declares return values");
+        }
+        return new Uint8Array(0);
+    }
+    if (trace.kind === EvmTraceOutputKind.NotTraced) {
+        throw new Error("respond output: a contract call's output needs its trace");
     }
-    const expectsNoOutput = parseSchemaShape(outputDeserializationSchema).length === 0;
-    switch (trace.kind) {
-        case EvmTraceOutputKind.NotTraced:
-            throw new Error("respond output: a contract call's output needs its trace");
-        case EvmTraceOutputKind.NoReturnData:
-            if (!expectsNoOutput) {
-                throw new Error("respond output: the contract call's trace has no return data for a non-empty output schema");
-            }
-            break;
-        case EvmTraceOutputKind.Output:
-            if (!expectsNoOutput) {
-                return serializeRespondOutput(respondSerializationSchema, deserializeEvmOutput(outputDeserializationSchema, trace.returnData));
-            }
-            if (ethers.getBytes(trace.returnData).length > 0) {
-                throw new Error("respond output: the contract call returned data but its output schema declares no return values");
-            }
-            break;
+    const returnData = trace.kind === EvmTraceOutputKind.Output
+        ? ethers.getBytes(trace.returnData)
+        : new Uint8Array(0);
+    if (returnData.length === 0) {
+        if (expectsOutput) {
+            throw new Error("respond output: the contract call returned no data, but the output schema declares return values");
+        }
+        return new Uint8Array(0);
+    }
+    if (!expectsOutput) {
+        throw new Error("respond output: the contract call returned data, but the output schema declares no return values");
     }
-    return serializeRespondOutput(respondSerializationSchema, nonFunctionCallDefaults(respondSerializationSchema));
+    checkCanonicalReturnData(fields, returnData);
+    return serializeRespondOutput(schema, deserializeEvmOutput(schema, returnData));
 }
 /**
  * Whether a JSON value is an object. A type guard, as `Array.isArray` does
@@ -323,39 +448,96 @@ function toPlainValue(value, label) {
 // Schema parsing + validation
 // ---------------------------------------------------------------------------
 /**
- * Parse schema text as JSON with the parse failure named. Blank text (an
- * unset all-NUL on-chain schema field) is the empty schema.
+ * The canonical text of an output schema: `JSON.stringify` of its fields
+ * reduced to `{name, type}` in schema order, with no whitespace. A schema's
+ * on-chain bytes must be exactly this text followed by NUL padding, so one
+ * schema has exactly one byte form. Write a contract's schema literal with
+ * this function's output.
  *
- * @param text - The schema text, NUL-trimmed.
- * @returns The parsed JSON value, `[]` for blank text.
- * @throws {Error} If non-blank text is not valid JSON.
+ * @param fields - The schema's fields in order.
+ * @returns The canonical JSON text, `[]` for an empty schema.
  */
-function parseSchemaJson(text) {
-    if (text.trim() === "") {
+export function canonicalSchemaText(fields) {
+    return JSON.stringify(fields.map(({ name, type }) => ({ name, type })));
+}
+/**
+ * Parse a schema's bytes, requiring the canonical form: the bytes before the
+ * first NUL are exactly {@link canonicalSchemaText} of the fields they
+ * encode, every byte from the first NUL on is NUL, and an empty schema is
+ * `[]` or no bytes at all (an unset all-NUL field).
+ *
+ * @param bytes - The schema text's UTF-8 bytes, NUL-padded or not.
+ * @returns The schema's fields.
+ * @throws {Error} If the padding holds a non-NUL byte, the text is not JSON,
+ *   the fields fail {@link checkSchemaFields}, or the text is not canonical.
+ */
+function parseCanonicalSchema(bytes) {
+    const nul = bytes.indexOf(0);
+    const body = nul === -1 ? bytes : bytes.subarray(0, nul);
+    if (nul !== -1 && bytes.subarray(nul).some((byte) => byte !== 0)) {
+        throw new Error("schema: every byte from the first NUL on must be NUL");
+    }
+    if (body.length === 0) {
         return [];
     }
+    let parsed;
     try {
-        return JSON.parse(text);
+        parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(body));
     }
     catch (error) {
         throw new Error(`schema is not valid JSON (${String(error)})`, { cause: error });
     }
+    const fields = checkSchemaFields(parsed);
+    const canonical = new TextEncoder().encode(canonicalSchemaText(fields));
+    if (canonical.length !== body.length || canonical.some((byte, i) => byte !== body[i])) {
+        throw new Error(`schema is not canonical: expected exactly ${canonicalSchemaText(fields)}`);
+    }
+    return fields;
 }
 /**
- * Parse a schema in any input form and check its SHAPE only: an array of
- * fields with non-empty, unique names and non-empty type strings. An empty
- * schema is valid here: emptiness policy belongs to the callers
- * ({@link deserializeEvmOutput} decodes nothing and
- * {@link executedEvmRespondOutput} synthesises defaults for a void call).
+ * A Solidity identifier, the only form a field name takes. A name outside
+ * this grammar can start with a digit, and a JavaScript object orders
+ * integer-like keys first, which would move the derived Borsh struct's
+ * members out of schema order.
+ */
+const SOLIDITY_IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+/**
+ * The one identifier no field may use: assigning it on a JavaScript object
+ * reaches the prototype accessor, so an output object cannot carry it.
+ */
+const PROTOTYPE_ACCESSOR_NAME = "__proto__";
+/**
+ * Parse a schema in any input form and check its SHAPE only: text and bytes
+ * must be the canonical form ({@link parseCanonicalSchema}), and every form
+ * passes {@link checkSchemaFields}. Whether a type is in the attested subset
+ * is decided later, by {@link classifyEvmOutputType}. An empty schema is
+ * valid here: {@link deserializeEvmOutput} decodes nothing from it and
+ * {@link executedEvmRespondOutput} attests an empty output.
  *
- * @param schema - The schema as JSON text, packed bytes, or a field array.
- * @returns The schema's fields, names and type strings unvalidated beyond shape.
- * @throws {Error} If the schema is not an array of uniquely named fields.
+ * @param schema - The schema as canonical JSON text, NUL-padded bytes, or a field array.
+ * @returns The schema's fields, type strings as written.
+ * @throws {Error} If the text or bytes are not canonical, or the fields fail {@link checkSchemaFields}.
  */
 function parseSchemaShape(schema) {
-    const parsed = typeof schema === "string" || schema instanceof Uint8Array
-        ? parseSchemaJson(schemaText(schema))
-        : schema;
+    if (typeof schema === "string") {
+        return parseCanonicalSchema(new TextEncoder().encode(schema));
+    }
+    if (schema instanceof Uint8Array) {
+        return parseCanonicalSchema(schema);
+    }
+    return checkSchemaFields(schema);
+}
+/**
+ * Check a parsed schema value's shape: an array of fields with unique
+ * Solidity-identifier names and ABI type strings `ethers.ParamType` accepts.
+ *
+ * @param parsed - The schema as parsed JSON or a field array.
+ * @returns The schema's fields, type strings as written.
+ * @throws {Error} If the value is not an array of fields, a name is not a
+ *   Solidity identifier or is `__proto__`, a name repeats, or a type is
+ *   missing or not an ABI type.
+ */
+function checkSchemaFields(parsed) {
     if (!Array.isArray(parsed)) {
         throw new Error("schema must be a JSON array of fields");
     }
@@ -368,6 +550,12 @@ function parseSchemaShape(schema) {
         if (typeof name !== "string" || name.length === 0) {
             throw new Error(`schema field ${String(i)} needs a non-empty name`);
         }
+        if (!SOLIDITY_IDENTIFIER.test(name)) {
+            throw new Error(`schema: field name '${name}' is not a Solidity identifier`);
+        }
+        if (name === PROTOTYPE_ACCESSOR_NAME) {
+            throw new Error(`schema: field name '${name}' is refused`);
+        }
         if (seen.has(name)) {
             throw new Error(`schema: duplicate field name '${name}'`);
         }
@@ -375,18 +563,13 @@ function parseSchemaShape(schema) {
         if (typeof type !== "string" || type.length === 0) {
             throw new Error(`schema: '${name}' needs a type`);
         }
+        try {
+            ethers.ParamType.from(type);
+        }
+        catch (error) {
+            throw new Error(`schema: '${name}' has an invalid ABI type '${type}'`, { cause: error });
+        }
         return { name, type };
     });
 }
-/**
- * Cut a NUL-padded on-chain schema at the first NUL and decode to text.
- *
- * @param schema - Schema text, or the NUL-padded bytes read from the ledger.
- * @returns The schema text with the padding removed.
- */
-function schemaText(schema) {
-    const raw = typeof schema === "string" ? schema : new TextDecoder().decode(schema);
-    const nul = raw.indexOf("\0");
-    return nul === -1 ? raw : raw.slice(0, nul);
-}
 //# sourceMappingURL=abi-serde.js.map