@trevrpc/trevrpc-js 1.5.0 → 1.6.0

package/src/wire.js

@@ -1,9 +1,10 @@
-import protobuf from "protobufjs";
-
-import { byteView } from "./bytes.js";
-import { setInt64Representation } from "./int64.js";
-
-export { protobuf };
+// The protobuf codec of the REQUEST, HEADERS, ANSWER and STATUS payloads, written against the wire
+// format directly, as the Go and Kotlin runtimes do (see "Protocol and Wire Format" in the wiki).
+// Encoding is canonical proto3: fields in number order, zero values left out, and both fields of a
+// map entry always written. Decoding accepts only what a conforming sender produces: a known field
+// with another wire type, a uint32 above 2^32 - 1, a varint above 64 bits, invalid UTF-8 and
+// truncated data are all errors, while unknown fields of every wire type are skipped.
+import { BinaryReader, BinaryWriter, WireType } from "@bufbuild/protobuf/wire";
 
 export const RpcKind = Object.freeze({
   Unary: 0,
@@ -19,373 +20,460 @@ export const StreamCompression = Object.freeze({
   Optimistic: 2,
 });
 
-const wireRoot = protobuf.Root.fromJSON({
-  nested: {
-    trevrpc: {
-      nested: {
-        RpcKind: {
-          values: {
-            Unary: 0,
-            ClientStreaming: 1,
-            ServerStreaming: 2,
-            BidirectionalStreaming: 3,
-          },
-        },
-        StreamCompression: {
-          values: {
-            STREAM_COMPRESSION_NONE: 0,
-            STREAM_COMPRESSION_ENABLED: 1,
-            STREAM_COMPRESSION_OPTIMISTIC: 2,
-          },
-        },
-        RpcRequest: {
-          fields: {
-            method: { type: "string", id: 1 },
-            metadata: { keyType: "string", type: "bytes", id: 2 },
-            kind: { type: "RpcKind", id: 3 },
-            timeoutNanos: { type: "uint64", id: 4 },
-            datagramFlow: { type: "uint64", id: 5 },
-            acceptDictionaries: { rule: "repeated", type: "uint32", id: 6 },
-            dictionaryQuery: { rule: "repeated", type: "DictionaryInfo", id: 7 },
-            streamCompression: { type: "StreamCompression", id: 8 },
-            connectionMetadata: { type: "ConnectionMetadata", id: 9 },
-          },
-        },
-        RpcHeaders: {
-          fields: {
-            metadata: { keyType: "string", type: "bytes", id: 1 },
-          },
-        },
-        RpcAnswer: {
-          fields: {
-            dictionaries: { rule: "repeated", type: "DictionaryInfo", id: 1 },
-            streamCompression: { type: "bool", id: 2 },
-            connectionMetadata: { type: "uint32", id: 3 },
-          },
-        },
-        ConnectionMetadata: {
-          fields: {
-            id: { type: "uint32", id: 1 },
-            metadata: { keyType: "string", type: "bytes", id: 2 },
-          },
-        },
-        DictionaryInfo: {
-          fields: {
-            id: { type: "uint32", id: 1 },
-            fingerprint: { type: "bytes", id: 2 },
-          },
-        },
-        RpcStatus: {
-          fields: {
-            code: { type: "uint32", id: 1 },
-            message: { type: "string", id: 2 },
-            metadata: { keyType: "string", type: "bytes", id: 3 },
-            refusedStreamCompression: { type: "bool", id: 4 },
-          },
-        },
-      },
-    },
+/** How deeply unknown groups may nest. */
+const MaxGroupDepth = 64;
+
+/**
+ * The REQUEST payload: `{ method, metadata, kind, timeoutNanos, datagramFlow, acceptDictionaries,
+ * dictionaryQuery, streamCompression, connectionMetadata }`. 64-bit fields encode from a bigint, a
+ * number or a decimal string and decode as bigints; `connectionMetadata` is `{ id, metadata }`, or
+ * undefined when absent.
+ */
+export const RpcRequest = Object.freeze({
+  name: "RpcRequest",
+  encode(request) {
+    const writer = new BinaryWriter();
+    writeString(writer, 1, request.method);
+    writeMetadata(writer, 2, request.metadata);
+    writeInt32(writer, 3, request.kind);
+    writeUint64(writer, 4, request.timeoutNanos);
+    writeUint64(writer, 5, request.datagramFlow);
+    const accept = request.acceptDictionaries;
+    if (accept != null && accept.length > 0) {
+      writer.tag(6, WireType.LengthDelimited).fork();
+      for (const id of accept) {
+        writer.uint32(id);
+      }
+      writer.join();
+    }
+    writeDictionaries(writer, 7, request.dictionaryQuery);
+    writeInt32(writer, 8, request.streamCompression);
+    const connection = request.connectionMetadata;
+    if (connection != null) {
+      writer.tag(9, WireType.LengthDelimited).fork();
+      writeUint32(writer, 1, connection.id);
+      writeMetadata(writer, 2, connection.metadata);
+      writer.join();
+    }
+    return writer.finish();
+  },
+  decode(bytes) {
+    const request = {
+      method: "",
+      metadata: emptyMetadata(),
+      kind: 0,
+      timeoutNanos: 0n,
+      datagramFlow: 0n,
+      acceptDictionaries: [],
+      dictionaryQuery: [],
+      streamCompression: 0,
+      connectionMetadata: undefined,
+    };
+    const reader = new WireReader(bytes);
+    while (reader.more()) {
+      const [field, wireType] = reader.tag();
+      switch (field) {
+        case 1:
+          request.method = reader.string(wireType, "method");
+          break;
+        case 2:
+          reader.metadataEntry(wireType, request.metadata, "metadata");
+          break;
+        case 3:
+          request.kind = reader.int32(wireType, "kind");
+          break;
+        case 4:
+          request.timeoutNanos = reader.uint64(wireType, "timeout_nanos");
+          break;
+        case 5:
+          request.datagramFlow = reader.uint64(wireType, "datagram_flow");
+          break;
+        case 6:
+          reader.repeatedUint32(wireType, request.acceptDictionaries, "accept_dictionaries");
+          break;
+        case 7:
+          request.dictionaryQuery.push(reader.dictionaryInfo(wireType, "dictionary_query"));
+          break;
+        case 8:
+          request.streamCompression = reader.int32(wireType, "stream_compression");
+          break;
+        case 9:
+          request.connectionMetadata = reader.connectionMetadata(wireType, "connection_metadata");
+          break;
+        default:
+          reader.skip(field, wireType);
+      }
+    }
+    return request;
+  },
+});
+
+/** The HEADERS payload: `{ metadata }`. */
+export const RpcHeaders = Object.freeze({
+  name: "RpcHeaders",
+  encode(headers) {
+    const writer = new BinaryWriter();
+    writeMetadata(writer, 1, headers.metadata);
+    return writer.finish();
+  },
+  decode(bytes) {
+    const headers = { metadata: emptyMetadata() };
+    const reader = new WireReader(bytes);
+    while (reader.more()) {
+      const [field, wireType] = reader.tag();
+      if (field === 1) {
+        reader.metadataEntry(wireType, headers.metadata, "metadata");
+      } else {
+        reader.skip(field, wireType);
+      }
+    }
+    return headers;
   },
 });
 
-export const RpcRequest = wireRoot.lookupType("trevrpc.RpcRequest");
-export const RpcHeaders = wireRoot.lookupType("trevrpc.RpcHeaders");
-export const RpcAnswer = wireRoot.lookupType("trevrpc.RpcAnswer");
-export const RpcStatus = wireRoot.lookupType("trevrpc.RpcStatus");
+/** The ANSWER payload: `{ dictionaries, streamCompression, connectionMetadata }`. */
+export const RpcAnswer = Object.freeze({
+  name: "RpcAnswer",
+  encode(answer) {
+    const writer = new BinaryWriter();
+    writeDictionaries(writer, 1, answer.dictionaries);
+    writeBool(writer, 2, answer.streamCompression);
+    writeUint32(writer, 3, answer.connectionMetadata);
+    return writer.finish();
+  },
+  decode(bytes) {
+    const answer = { dictionaries: [], streamCompression: false, connectionMetadata: 0 };
+    const reader = new WireReader(bytes);
+    while (reader.more()) {
+      const [field, wireType] = reader.tag();
+      switch (field) {
+        case 1:
+          answer.dictionaries.push(reader.dictionaryInfo(wireType, "dictionaries"));
+          break;
+        case 2:
+          answer.streamCompression = reader.bool(wireType, "stream_compression");
+          break;
+        case 3:
+          answer.connectionMetadata = reader.uint32(wireType, "connection_metadata");
+          break;
+        default:
+          reader.skip(field, wireType);
+      }
+    }
+    return answer;
+  },
+});
 
-const MaxFieldNumber = 0x1fffffff;
-const MaxUint32 = 0xffffffffn;
-const MaxUint64 = 0xffffffffffffffffn;
-const fatalUtf8Decoder = new TextDecoder("utf-8", { fatal: true });
+/** The STATUS payload: `{ code, message, metadata, refusedStreamCompression }`. */
+export const RpcStatus = Object.freeze({
+  name: "RpcStatus",
+  encode(status) {
+    const writer = new BinaryWriter();
+    writeUint32(writer, 1, status.code);
+    writeString(writer, 2, status.message);
+    writeMetadata(writer, 3, status.metadata);
+    writeBool(writer, 4, status.refusedStreamCompression);
+    return writer.finish();
+  },
+  decode(bytes) {
+    const status = {
+      code: 0,
+      message: "",
+      metadata: emptyMetadata(),
+      refusedStreamCompression: false,
+    };
+    const reader = new WireReader(bytes);
+    while (reader.more()) {
+      const [field, wireType] = reader.tag();
+      switch (field) {
+        case 1:
+          status.code = reader.uint32(wireType, "code");
+          break;
+        case 2:
+          status.message = reader.string(wireType, "message");
+          break;
+        case 3:
+          reader.metadataEntry(wireType, status.metadata, "metadata");
+          break;
+        case 4:
+          status.refusedStreamCompression = reader.bool(wireType, "refused_stream_compression");
+          break;
+        default:
+          reader.skip(field, wireType);
+      }
+    }
+    return status;
+  },
+});
 
-/** Checks protobuf tags and known-field wire types before protobuf.js decoding. */
-export function preflightWireMessage(messageType, body) {
-  scanMessage(messageType, byteView(body), 0);
+function emptyMetadata() {
+  return {};
 }
 
 /**
- * Creates a protobuf root from a JSON namespace definition. `options.int64` sets how calls decode
- * its messages' 64-bit integers (see `setInt64Representation`); without it they stay Long objects.
+ * Sets a decoded metadata entry as an own property, so that a key such as `__proto__` is an entry
+ * like any other and never replaces the object's prototype.
  */
-export function createRoot(json, options = {}) {
-  const root = protobuf.Root.fromJSON(json);
-  if (options.int64 !== undefined) {
-    setInt64Representation(root, options.int64);
+function setEntry(metadata, key, value) {
+  Object.defineProperty(metadata, key, {
+    value,
+    enumerable: true,
+    writable: true,
+    configurable: true,
+  });
+}
+
+function writeString(writer, field, value) {
+  if (value != null && value !== "") {
+    writer.tag(field, WireType.LengthDelimited).string(value);
   }
-  return root;
 }
 
-function scanMessage(messageType, bytes, depth) {
-  if (depth > 64) {
-    throw malformedWire("protobuf message nesting exceeded limit");
+function writeInt32(writer, field, value) {
+  if (value != null && value !== 0) {
+    writer.tag(field, WireType.Varint).int32(value);
   }
+}
 
-  const cursor = { offset: 0 };
-  while (cursor.offset < bytes.byteLength) {
-    const tag = readVarint(bytes, cursor, "truncated protobuf field tag");
-    const fieldNumber = Number(tag >> 3n);
-    const wireType = Number(tag & 7n);
-    if (fieldNumber === 0 || fieldNumber > MaxFieldNumber) {
-      throw malformedWire("invalid protobuf field tag");
-    }
+function writeUint32(writer, field, value) {
+  if (value != null && value !== 0) {
+    writer.tag(field, WireType.Varint).uint32(value);
+  }
+}
 
-    const field = messageType.fieldsById?.[fieldNumber];
-    if (field == null) {
-      skipUnknownField(bytes, cursor, fieldNumber, wireType, depth);
-      continue;
-    }
+function writeUint64(writer, field, value) {
+  if (value != null && value !== 0 && value !== 0n && value !== "0") {
+    writer.tag(field, WireType.Varint).uint64(value);
+  }
+}
 
-    if (!acceptedWireTypes(field).includes(wireType)) {
-      throw malformedWire(`field ${field.name} used incompatible protobuf wire type ${wireType}`);
-    }
-    scanKnownField(field, bytes, cursor, wireType, depth);
+function writeBool(writer, field, value) {
+  if (value) {
+    writer.tag(field, WireType.Varint).bool(true);
   }
 }
 
-function scanKnownField(field, bytes, cursor, wireType, depth) {
-  if (wireType === 0) {
-    const value = readVarint(bytes, cursor, `truncated protobuf field ${field.name}`);
-    if (isUint32Field(field) && value > MaxUint32) {
-      throw malformedWire(`protobuf field ${field.name} exceeded uint32`);
-    }
+/** Writes a `map<string, bytes>` field; both fields of every entry, even when empty. */
+function writeMetadata(writer, field, metadata) {
+  if (metadata == null) {
     return;
   }
-  if (wireType === 1) {
-    skipFixed(bytes, cursor, 8, field.name);
-    return;
+  for (const key of Object.keys(metadata)) {
+    writer
+      .tag(field, WireType.LengthDelimited)
+      .fork()
+      .tag(1, WireType.LengthDelimited)
+      .string(key)
+      .tag(2, WireType.LengthDelimited)
+      .bytes(metadata[key])
+      .join();
   }
-  if (wireType === 5) {
-    skipFixed(bytes, cursor, 4, field.name);
+}
+
+/** Writes a repeated DictionaryInfo field `{ id, fingerprint }`; an empty entry is still sent. */
+function writeDictionaries(writer, field, infos) {
+  if (infos == null) {
     return;
   }
-  if (wireType !== 2) {
-    throw malformedWire(`unsupported protobuf wire type ${wireType}`);
-  }
-
-  const value = readLengthDelimited(bytes, cursor, `truncated protobuf field ${field.name}`);
-  if (field.map) {
-    scanMapEntry(field, value, depth + 1);
-  } else if (field.resolvedType?.fieldsById != null) {
-    scanMessage(field.resolvedType, value, depth + 1);
-  } else if (field.type === "string") {
-    validateUtf8(value, field.name);
-  } else if (field.repeated && isPackableField(field)) {
-    scanPackedField(field, value);
+  for (const info of infos) {
+    writer.tag(field, WireType.LengthDelimited).fork();
+    writeUint32(writer, 1, info.id);
+    if (info.fingerprint != null && info.fingerprint.byteLength > 0) {
+      writer.tag(2, WireType.LengthDelimited).bytes(info.fingerprint);
+    }
+    writer.join();
   }
 }
 
-function scanMapEntry(field, bytes, depth) {
-  if (depth > 64) {
-    throw malformedWire("protobuf message nesting exceeded limit");
-  }
-
-  const cursor = { offset: 0 };
-  while (cursor.offset < bytes.byteLength) {
-    const tag = readVarint(bytes, cursor, "truncated protobuf map entry tag");
-    const fieldNumber = Number(tag >> 3n);
-    const wireType = Number(tag & 7n);
-    if (fieldNumber === 0 || fieldNumber > MaxFieldNumber) {
-      throw malformedWire("invalid protobuf map entry tag");
-    }
+/**
+ * Reads the fields of one wire message, checking each known field's wire type and range. Every
+ * failure is an Error, which the frame layer reports as InvalidArgument.
+ */
+class WireReader {
+  #bytes;
+  #reader;
 
-    if (fieldNumber === 1) {
-      scanSyntheticField(field.keyType, `${field.name}.key`, bytes, cursor, wireType, depth);
-    } else if (fieldNumber === 2) {
-      const messageType = field.resolvedType?.fieldsById != null ? field.resolvedType : undefined;
-      scanSyntheticField(
-        field.type,
-        `${field.name}.value`,
-        bytes,
-        cursor,
-        wireType,
-        depth,
-        messageType,
-      );
-    } else {
-      skipUnknownField(bytes, cursor, fieldNumber, wireType, depth);
-    }
+  constructor(bytes) {
+    this.#bytes = bytes;
+    this.#reader = new BinaryReader(bytes);
   }
-}
 
-/** Scans a map key or value: a scalar of `type`, or a message of `messageType` when it is set. */
-function scanSyntheticField(type, name, bytes, cursor, wireType, depth, messageType) {
-  const expected = messageType === undefined ? scalarWireType(type) : 2;
-  if (wireType !== expected) {
-    throw malformedWire(`field ${name} used incompatible protobuf wire type ${wireType}`);
+  more() {
+    return this.#reader.pos < this.#reader.len;
   }
-  if (wireType === 0) {
-    const value = readVarint(bytes, cursor, `truncated protobuf field ${name}`);
-    if (isUint32Type(type) && value > MaxUint32) {
-      throw malformedWire(`protobuf field ${name} exceeded uint32`);
-    }
-  } else if (wireType === 1) {
-    skipFixed(bytes, cursor, 8, name);
-  } else if (wireType === 5) {
-    skipFixed(bytes, cursor, 4, name);
-  } else if (wireType === 2) {
-    const value = readLengthDelimited(bytes, cursor, `truncated protobuf field ${name}`);
-    if (messageType !== undefined) {
-      scanMessage(messageType, value, depth + 1);
-    } else if (type === "string") {
-      validateUtf8(value, name);
-    }
-  } else {
-    skipUnknownField(bytes, cursor, 0, wireType, depth);
+
+  /** The next field's number, at least 1, and wire type. */
+  tag() {
+    return this.#reader.tag();
   }
-}
 
-function scanPackedField(field, bytes) {
-  const cursor = { offset: 0 };
-  const wireType = scalarWireType(field.type);
-  while (cursor.offset < bytes.byteLength) {
-    if (wireType === 0) {
-      const value = readVarint(bytes, cursor, `truncated packed protobuf field ${field.name}`);
-      if (isUint32Field(field) && value > MaxUint32) {
-        throw malformedWire(`protobuf field ${field.name} exceeded uint32`);
-      }
-    } else if (wireType === 1) {
-      skipFixed(bytes, cursor, 8, field.name);
-    } else if (wireType === 5) {
-      skipFixed(bytes, cursor, 4, field.name);
-    } else {
-      throw malformedWire(`protobuf field ${field.name} cannot be packed`);
-    }
+  string(wireType, name) {
+    expectWireType(wireType, WireType.LengthDelimited, name);
+    return this.#reader.string(true);
   }
-}
 
-function acceptedWireTypes(field) {
-  // A map entry is a length-delimited message, whatever its value type.
-  if (field.map) {
-    return [2];
+  bytes(wireType, name) {
+    expectWireType(wireType, WireType.LengthDelimited, name);
+    return this.#reader.bytes();
   }
-  const expected = field.resolvedType?.fieldsById != null ? 2 : scalarWireType(field.type);
-  return field.repeated && isPackableField(field) ? [expected, 2] : [expected];
-}
 
-function scalarWireType(type) {
-  switch (type) {
-    case "double":
-    case "fixed64":
-    case "sfixed64":
-      return 1;
-    case "string":
-    case "bytes":
-      return 2;
-    case "float":
-    case "fixed32":
-    case "sfixed32":
-      return 5;
-    default:
-      return 0;
+  bool(wireType, name) {
+    expectWireType(wireType, WireType.Varint, name);
+    return this.#reader.bool();
   }
-}
 
-function isPackableField(field) {
-  return (
-    field.type !== "string" && field.type !== "bytes" && field.resolvedType?.fieldsById == null
-  );
-}
+  int32(wireType, name) {
+    expectWireType(wireType, WireType.Varint, name);
+    return this.#reader.int32();
+  }
 
-function isUint32Field(field) {
-  return isUint32Type(field.type) || field.resolvedType?.values != null;
-}
+  uint32(wireType, name) {
+    expectWireType(wireType, WireType.Varint, name);
+    return this.#uint32Value(name);
+  }
 
-function isUint32Type(type) {
-  return type === "uint32" || type === "fixed32";
-}
+  uint64(wireType, name) {
+    expectWireType(wireType, WireType.Varint, name);
+    return BigInt(this.#reader.uint64());
+  }
 
-function readVarint(bytes, cursor, message) {
-  let value = 0n;
-  for (let index = 0; index < 10; index += 1) {
-    if (cursor.offset >= bytes.byteLength) {
-      throw malformedWire(message);
+  /** Appends one value, or a packed run of values, of a repeated uint32 field to `values`. */
+  repeatedUint32(wireType, values, name) {
+    if (wireType === WireType.Varint) {
+      values.push(this.#uint32Value(name));
+      return;
     }
-    const byte = bytes[cursor.offset++];
-    if (index === 9 && byte > 1) {
-      throw malformedWire("protobuf varint exceeded 64 bits");
+    const packed = this.#nested(wireType, name);
+    while (packed.more()) {
+      values.push(packed.#uint32Value(name));
     }
-    value |= BigInt(byte & 0x7f) << BigInt(index * 7);
-    if (byte < 0x80) {
-      if (value > MaxUint64) {
-        throw malformedWire("protobuf varint exceeded 64 bits");
+  }
+
+  /** A DictionaryInfo message, `{ id, fingerprint }`. */
+  dictionaryInfo(wireType, name) {
+    const reader = this.#nested(wireType, name);
+    const info = { id: 0, fingerprint: new Uint8Array(0) };
+    while (reader.more()) {
+      const [field, fieldWireType] = reader.tag();
+      if (field === 1) {
+        info.id = reader.uint32(fieldWireType, `${name}.id`);
+      } else if (field === 2) {
+        info.fingerprint = reader.bytes(fieldWireType, `${name}.fingerprint`);
+      } else {
+        reader.skip(field, fieldWireType);
       }
-      return value;
     }
+    return info;
   }
-  throw malformedWire("protobuf varint exceeded 64 bits");
-}
 
-function readLengthDelimited(bytes, cursor, message) {
-  const length = readVarint(bytes, cursor, message);
-  if (length > BigInt(Number.MAX_SAFE_INTEGER)) {
-    throw malformedWire(message);
+  /** A ConnectionMetadata message, `{ id, metadata }`. */
+  connectionMetadata(wireType, name) {
+    const reader = this.#nested(wireType, name);
+    const connection = { id: 0, metadata: emptyMetadata() };
+    while (reader.more()) {
+      const [field, fieldWireType] = reader.tag();
+      if (field === 1) {
+        connection.id = reader.uint32(fieldWireType, `${name}.id`);
+      } else if (field === 2) {
+        reader.metadataEntry(fieldWireType, connection.metadata, `${name}.metadata`);
+      } else {
+        reader.skip(field, fieldWireType);
+      }
+    }
+    return connection;
   }
-  const end = cursor.offset + Number(length);
-  if (!Number.isSafeInteger(end) || end > bytes.byteLength) {
-    throw malformedWire(message);
+
+  /** Adds one `map<string, bytes>` entry to `metadata`; a later entry for a key replaces it. */
+  metadataEntry(wireType, metadata, name) {
+    const reader = this.#nested(wireType, name);
+    let key = "";
+    let value = new Uint8Array(0);
+    while (reader.more()) {
+      const [field, fieldWireType] = reader.tag();
+      if (field === 1) {
+        key = reader.string(fieldWireType, `${name}.key`);
+      } else if (field === 2) {
+        value = reader.bytes(fieldWireType, `${name}.value`);
+      } else {
+        reader.skip(field, fieldWireType);
+      }
+    }
+    setEntry(metadata, key, value);
   }
-  const value = bytes.subarray(cursor.offset, end);
-  cursor.offset = end;
-  return value;
-}
 
-function skipUnknownField(bytes, cursor, fieldNumber, wireType, depth) {
-  switch (wireType) {
-    case 0:
-      readVarint(bytes, cursor, "truncated protobuf varint");
-      return;
-    case 1:
-      skipFixed(bytes, cursor, 8, "unknown");
-      return;
-    case 2:
-      readLengthDelimited(bytes, cursor, "truncated protobuf field");
-      return;
-    case 3:
-      skipGroup(bytes, cursor, fieldNumber, depth + 1);
-      return;
-    case 5:
-      skipFixed(bytes, cursor, 4, "unknown");
-      return;
-    default:
-      throw malformedWire(`unsupported protobuf wire type ${wireType}`);
+  /** Skips an unknown field of any wire type. */
+  skip(field, wireType, depth = 0) {
+    switch (wireType) {
+      case WireType.Varint:
+        this.#skipVarint();
+        return;
+      case WireType.StartGroup:
+        this.#skipGroup(field, depth + 1);
+        return;
+      case WireType.EndGroup:
+        throw new Error("protobuf end group tag without a start group");
+      default:
+        this.#reader.skip(wireType, field);
+    }
   }
-}
 
-function skipGroup(bytes, cursor, fieldNumber, depth) {
-  if (depth > 64) {
-    throw malformedWire("protobuf group nesting exceeded limit");
+  #skipGroup(field, depth) {
+    if (depth > MaxGroupDepth) {
+      throw new Error("protobuf group nesting exceeded limit");
+    }
+    while (this.more()) {
+      const [nested, wireType] = this.tag();
+      if (wireType === WireType.EndGroup) {
+        if (nested !== field) {
+          throw new Error("protobuf group end tag did not match start tag");
+        }
+        return;
+      }
+      this.skip(nested, wireType, depth);
+    }
+    throw new Error("unterminated protobuf group");
   }
-  while (cursor.offset < bytes.byteLength) {
-    const tag = readVarint(bytes, cursor, "truncated protobuf group tag");
-    const nestedField = Number(tag >> 3n);
-    const wireType = Number(tag & 7n);
-    if (wireType === 4) {
-      if (nestedField !== fieldNumber) {
-        throw malformedWire("protobuf group end tag did not match start tag");
+
+  /** Skips a varint of at most 64 bits (10 bytes, the last at most 1). */
+  #skipVarint() {
+    const bytes = this.#bytes;
+    const reader = this.#reader;
+    for (let index = 0; index < 10; index += 1) {
+      if (reader.pos >= reader.len) {
+        throw new Error("truncated protobuf varint");
+      }
+      const byte = bytes[reader.pos++];
+      if (byte < 0x80) {
+        if (index === 9 && byte > 1) {
+          break;
+        }
+        return;
       }
-      return;
     }
-    skipUnknownField(bytes, cursor, nestedField, wireType, depth);
+    throw new Error("protobuf varint exceeded 64 bits");
   }
-  throw malformedWire("unterminated protobuf group");
-}
 
-function skipFixed(bytes, cursor, length, name) {
-  const end = cursor.offset + length;
-  if (end > bytes.byteLength) {
-    throw malformedWire(`truncated protobuf field ${name}`);
+  /** Reads a varint that must fit in 32 bits: at most 5 bytes, the last at most 0x0f. */
+  #uint32Value(name) {
+    const reader = this.#reader;
+    const start = reader.pos;
+    const value = reader.uint32();
+    const length = reader.pos - start;
+    if (length > 5 || (length === 5 && this.#bytes[reader.pos - 1] > 0x0f)) {
+      throw new Error(`protobuf field ${name} exceeded uint32`);
+    }
+    return value;
   }
-  cursor.offset = end;
-}
 
-function validateUtf8(bytes, name) {
-  try {
-    fatalUtf8Decoder.decode(bytes);
-  } catch {
-    throw malformedWire(`protobuf field ${name} was not valid UTF-8`);
+  /** A reader over the length-delimited value of field `name`. */
+  #nested(wireType, name) {
+    expectWireType(wireType, WireType.LengthDelimited, name);
+    return new WireReader(this.#reader.bytes());
   }
 }
 
-function malformedWire(message) {
-  return new Error(message);
+function expectWireType(wireType, expected, name) {
+  if (wireType !== expected) {
+    throw new Error(`field ${name} used incompatible protobuf wire type ${wireType}`);
+  }
 }