space-data-module-sdk 0.5.3 → 0.5.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "space-data-module-sdk",
-  "version": "0.5.3",
+  "version": "0.5.5",
   "description": "Module SDK for building, validating, signing, and deploying WebAssembly modules on the Space Data Network.",
   "type": "module",
   "types": "./src/index.d.ts",

package/src/compiler/emception.d.ts

@@ -54,6 +54,7 @@ export interface SharedEmceptionSession {
 }
 
 export function createSharedEmceptionSession(): SharedEmceptionSession;
+export function createIsolatedEmceptionSession(): SharedEmceptionSession;
 export function loadSharedEmception(): Promise<unknown>;
 export function withSharedEmception<T>(
   task: (handle: SharedEmceptionHandle) => T | Promise<T>,

package/src/compiler/emception.js

@@ -1,6 +1,7 @@
 import path from "node:path";
 
 import {
+  createEmceptionController,
   getSharedEmceptionController,
   loadEmception,
   runWithEmceptionLock,
@@ -180,6 +181,10 @@ export function createSharedEmceptionSession() {
   return new SharedEmceptionSession();
 }
 
+export function createIsolatedEmceptionSession() {
+  return new SharedEmceptionSession(createEmceptionController());
+}
+
 export async function loadSharedEmception() {
   return loadEmception();
 }

package/src/compiler/emceptionNode.js

@@ -225,6 +225,10 @@ export function getSharedEmceptionController() {
   return sharedEmceptionController;
 }
 
+export function createEmceptionController() {
+  return new EmceptionController();
+}
+
 export async function loadEmception() {
   return sharedEmceptionController.load();
 }

package/src/compiler/index.d.ts

@@ -18,6 +18,7 @@ export type {
 } from "./emception.js";
 
 export {
+  createIsolatedEmceptionSession,
   createSharedEmceptionSession,
   loadSharedEmception,
   withSharedEmception,

package/src/compiler/index.js

@@ -6,6 +6,7 @@ export {
 } from "./compileModule.js";
 
 export {
+  createIsolatedEmceptionSession,
   createSharedEmceptionSession,
   loadSharedEmception,
   withSharedEmception,

package/src/compliance/pluginCompliance.js

@@ -175,6 +175,44 @@ function validateStringField(issues, value, location, label) {
   return true;
 }
 
+function validateCapabilityEntry(capability, issues, location) {
+  if (isNonEmptyString(capability)) {
+    return capability;
+  }
+  if (!capability || typeof capability !== "object" || Array.isArray(capability)) {
+    pushIssue(
+      issues,
+      "error",
+      "invalid-capability",
+      "Capability entries must be non-empty strings or host capability records.",
+      location,
+    );
+    return null;
+  }
+  if (!validateStringField(issues, capability.capability, `${location}.capability`, "Capability id")) {
+    return null;
+  }
+  validateOptionalStringField(
+    issues,
+    capability.scope,
+    `${location}.scope`,
+    "Capability scope",
+  );
+  validateOptionalBooleanField(
+    issues,
+    capability.required,
+    `${location}.required`,
+    "Capability required",
+  );
+  validateOptionalStringField(
+    issues,
+    capability.description,
+    `${location}.description`,
+    "Capability description",
+  );
+  return capability.capability;
+}
+
 function validateIntegerField(
   issues,
   value,
@@ -1066,8 +1104,9 @@ export function validatePluginManifest(manifest, options = {}) {
   validateStringField(issues, manifest.version, `${sourceName}.version`, "version");
   validateStringField(issues, manifest.pluginFamily, `${sourceName}.pluginFamily`, "pluginFamily");
 
-  const declaredCapabilities = manifest.capabilities;
-  if (!Array.isArray(declaredCapabilities)) {
+  const rawDeclaredCapabilities = manifest.capabilities;
+  let declaredCapabilities = null;
+  if (!Array.isArray(rawDeclaredCapabilities)) {
     pushIssue(
       issues,
       "warning",
@@ -1076,38 +1115,39 @@ export function validatePluginManifest(manifest, options = {}) {
       `${sourceName}.capabilities`,
     );
   } else {
+    declaredCapabilities = [];
     const seenCapabilities = new Set();
-    for (const capability of declaredCapabilities) {
-      if (!isNonEmptyString(capability)) {
-        pushIssue(
-          issues,
-          "error",
-          "invalid-capability",
-          "Capability entries must be non-empty strings.",
-          `${sourceName}.capabilities`,
-        );
-        continue;
+    rawDeclaredCapabilities.forEach((capability, index) => {
+      const normalizedCapability = validateCapabilityEntry(
+        capability,
+        issues,
+        `${sourceName}.capabilities[${index}]`,
+      );
+      if (!normalizedCapability) {
+        return;
       }
-      if (seenCapabilities.has(capability)) {
+      declaredCapabilities.push(normalizedCapability);
+      if (seenCapabilities.has(normalizedCapability)) {
         pushIssue(
           issues,
           "warning",
           "duplicate-capability",
-          `Capability "${capability}" is declared more than once.`,
+          `Capability "${normalizedCapability}" is declared more than once.`,
           `${sourceName}.capabilities`,
         );
+        return;
       }
-      seenCapabilities.add(capability);
-      if (!RecommendedCapabilitySet.has(capability)) {
+      seenCapabilities.add(normalizedCapability);
+      if (!RecommendedCapabilitySet.has(normalizedCapability)) {
         pushIssue(
           issues,
           "warning",
           "noncanonical-capability",
-          `Capability "${capability}" is not in the current canonical SDN coarse capability set.`,
+          `Capability "${normalizedCapability}" is not in the current canonical SDN coarse capability set.`,
           `${sourceName}.capabilities`,
         );
       }
-    }
+    });
   }
   validateRuntimeTargets(
     manifest.runtimeTargets,

package/src/host/abi.js

@@ -1,3 +1,5 @@
+import { bytesToBase64 } from "../utils/encoding.js";
+
 const textDecoder = new TextDecoder();
 const textEncoder = new TextEncoder();
 
@@ -14,6 +16,7 @@ export const NodeHostSyncHostcallOperations = Object.freeze([
   "clock.now",
   "clock.monotonicNow",
   "clock.nowIso",
+  "random.bytes",
   "schedule.parse",
   "schedule.matches",
   "schedule.next",
@@ -105,6 +108,47 @@ function isPromiseLike(value) {
   );
 }
 
+function encodeHostcallValue(value) {
+  if (value === undefined) {
+    return undefined;
+  }
+  if (
+    value instanceof Uint8Array ||
+    value instanceof ArrayBuffer ||
+    ArrayBuffer.isView(value)
+  ) {
+    const bytes =
+      value instanceof Uint8Array
+        ? value
+        : new Uint8Array(
+            value.buffer ?? value,
+            value.byteOffset ?? 0,
+            value.byteLength ?? value.byteLength,
+          );
+    return {
+      __type: "bytes",
+      base64: bytesToBase64(bytes),
+    };
+  }
+  if (value instanceof Date) {
+    return value.toISOString();
+  }
+  if (typeof value === "bigint") {
+    return value.toString();
+  }
+  if (Array.isArray(value)) {
+    return value.map((entry) => encodeHostcallValue(entry));
+  }
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value)
+        .filter(([, entry]) => entry !== undefined)
+        .map(([key, entry]) => [key, encodeHostcallValue(entry)]),
+    );
+  }
+  return value;
+}
+
 export function dispatchNodeHostSyncOperation(host, operation, params = null) {
   const normalized = assertNonEmptyString(operation, "Hostcall operation");
   switch (normalized) {
@@ -124,6 +168,8 @@ export function dispatchNodeHostSyncOperation(host, operation, params = null) {
       return host.clock.monotonicNow();
     case "clock.nowIso":
       return host.clock.nowIso();
+    case "random.bytes":
+      return host.random.bytes(params?.length);
     case "schedule.parse":
       return host.schedule.parse(params?.expression);
     case "schedule.matches":
@@ -202,7 +248,7 @@ export function createJsonHostcallBridge(options = {}) {
       }
       setEnvelope(HOSTCALL_STATUS_OK, {
         ok: true,
-        result,
+        result: encodeHostcallValue(result),
       });
       return HOSTCALL_STATUS_OK;
     } catch (error) {

package/src/host/nodeHost.js

@@ -1,6 +1,7 @@
 import dgram from "node:dgram";
 import net from "node:net";
 import path from "node:path";
+import { randomBytes as nodeRandomBytes } from "node:crypto";
 import { spawn } from "node:child_process";
 import { mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { performance } from "node:perf_hooks";
@@ -21,7 +22,6 @@ import {
   ed25519Sign,
   ed25519Verify,
   hkdfBytes,
-  randomBytes,
   secp256k1PublicKey,
   secp256k1SignDigest,
   secp256k1VerifyDigest,
@@ -1422,10 +1422,10 @@ export class NodeHost {
     });
 
     this.random = Object.freeze({
-      bytes: async (length) =>
-        this.#withCapability("random", "random.bytes", async () => {
+      bytes: (length) =>
+        this.#withCapability("random", "random.bytes", () => {
           const size = assertNonNegativeInteger(length, "Random byte length");
-          return randomBytes(size);
+          return nodeRandomBytes(size);
         }),
     });
 

package/src/index.d.ts

@@ -638,6 +638,7 @@ export type {
 } from "./compiler/emception.js";
 
 export {
+  createIsolatedEmceptionSession,
   createSharedEmceptionSession,
   loadSharedEmception,
   withSharedEmception,
@@ -924,7 +925,7 @@ export class NodeHost {
     nowIso(): string;
   };
   random: {
-    bytes(length: number): Promise<Uint8Array>;
+    bytes(length: number): Uint8Array;
   };
   timers: {
     delay(ms: number, options?: { signal?: unknown }): Promise<void>;

package/src/manifest/codec.js

@@ -1,6 +1,10 @@
 import * as flatbuffers from "flatbuffers";
 
 import {
+  CapabilityKind,
+  DrainPolicy,
+  HostCapabilityT,
+  PluginFamily,
   PluginManifest,
   PluginManifestT,
 } from "../generated/orbpro/manifest.js";
@@ -21,6 +25,88 @@ function toByteBuffer(data) {
   );
 }
 
+function normalizeEnumName(name, { separator = "_", lowercase = true } = {}) {
+  if (typeof name !== "string" || name.length === 0) {
+    return null;
+  }
+  const normalized = name.trim();
+  if (!normalized) {
+    return null;
+  }
+  const joined = normalized.replace(/_/g, separator);
+  return lowercase ? joined.toLowerCase() : joined;
+}
+
+function normalizePluginFamilyName(value) {
+  if (typeof value === "number" && typeof PluginFamily[value] === "string") {
+    return normalizeEnumName(PluginFamily[value], { separator: "_" });
+  }
+  return normalizeEnumName(value, { separator: "_" });
+}
+
+function normalizeDrainPolicyName(value) {
+  if (typeof value === "number" && typeof DrainPolicy[value] === "string") {
+    return normalizeEnumName(DrainPolicy[value], { separator: "-" });
+  }
+  return normalizeEnumName(value, { separator: "-" });
+}
+
+function normalizeCapabilityName(value) {
+  if (
+    typeof value === "number" &&
+    typeof CapabilityKind[value] === "string"
+  ) {
+    return normalizeEnumName(CapabilityKind[value], { separator: "_" });
+  }
+  return normalizeEnumName(value, { separator: "_" });
+}
+
+function normalizeDecodedCapabilities(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return value
+    .map((entry) => {
+      if (typeof entry === "string") {
+        return normalizeCapabilityName(entry);
+      }
+      if (!(entry instanceof HostCapabilityT) && (!entry || typeof entry !== "object")) {
+        return null;
+      }
+      const capability = normalizeCapabilityName(entry.capability);
+      if (!capability) {
+        return null;
+      }
+      const scope =
+        typeof entry.scope === "string" && entry.scope.trim().length > 0
+          ? entry.scope.trim()
+          : null;
+      const description =
+        typeof entry.description === "string" &&
+        entry.description.trim().length > 0
+          ? entry.description.trim()
+          : null;
+      const required = entry.required !== false;
+      if (!scope && !description && required) {
+        return capability;
+      }
+      return {
+        capability,
+        ...(scope ? { scope } : {}),
+        ...(required === false ? { required: false } : {}),
+        ...(description ? { description } : {}),
+      };
+    })
+    .filter(Boolean);
+}
+
+function normalizeDecodedMethod(method = {}) {
+  return {
+    ...method,
+    drainPolicy: normalizeDrainPolicyName(method.drainPolicy),
+  };
+}
+
 export function decodePluginManifest(data) {
   const bb = toByteBuffer(data);
   if (!PluginManifest.bufferHasIdentifier(bb)) {
@@ -29,6 +115,11 @@ export function decodePluginManifest(data) {
   const unpacked = PluginManifest.getRootAsPluginManifest(bb).unpack();
   return {
     ...unpacked,
+    pluginFamily: normalizePluginFamilyName(unpacked.pluginFamily),
+    capabilities: normalizeDecodedCapabilities(unpacked.capabilities),
+    methods: Array.isArray(unpacked.methods)
+      ? unpacked.methods.map((method) => normalizeDecodedMethod(method))
+      : [],
     invokeSurfaces: Array.isArray(unpacked.invokeSurfaces)
       ? unpacked.invokeSurfaces
           .map((value) => normalizeInvokeSurfaceName(value))

package/src/testing/index.js

@@ -32,11 +32,11 @@ const CapabilitySurfaceMatrix = Object.freeze({
     wasi: true,
     standaloneWasi: true,
     wasmedge: true,
-    syncHostcall: false,
+    syncHostcall: true,
     nodeHostApi: true,
     notes: [
       "WASI random_get is available to standalone guests.",
-      "The current sync hostcall ABI does not expose random.bytes.",
+      "The sync hostcall ABI exposes random.bytes through a canonical base64 byte envelope.",
     ],
   }),
   timers: Object.freeze({

package/src/transport/records.js

@@ -3,7 +3,7 @@ import * as flatbuffers from "flatbuffers";
 import { ENC, ENCT, KDF, KeyExchange, SymmetricAlgo } from "spacedatastandards.org/lib/js/ENC/main.js";
 import { PNM, PNMT } from "spacedatastandards.org/lib/js/PNM/main.js";
 import { REC, RECT } from "spacedatastandards.org/lib/js/REC/REC.js";
-import { RecordT } from "spacedatastandards.org/lib/js/REC/Record.js";
+import { Record, RecordT } from "spacedatastandards.org/lib/js/REC/Record.js";
 import { RecordType } from "spacedatastandards.org/lib/js/REC/RecordType.js";
 
 import {
@@ -58,6 +58,281 @@ const STANDARD_BY_RECORD_TYPE = Object.freeze(
 );
 const textEncoder = new TextEncoder();
 
+function assertBounds(buffer, offset, length, label) {
+  if (
+    !Number.isSafeInteger(offset) ||
+    !Number.isSafeInteger(length) ||
+    offset < 0 ||
+    length < 0 ||
+    offset + length > buffer.length
+  ) {
+    throw new Error(`${label} is out of bounds.`);
+  }
+}
+
+function readUint16LE(buffer, offset, label) {
+  assertBounds(buffer, offset, 2, label);
+  return buffer[offset] | (buffer[offset + 1] << 8);
+}
+
+function readUint32LE(buffer, offset, label) {
+  assertBounds(buffer, offset, 4, label);
+  return (
+    buffer[offset] |
+    (buffer[offset + 1] << 8) |
+    (buffer[offset + 2] << 16) |
+    (buffer[offset + 3] << 24)
+  ) >>> 0;
+}
+
+function readInt32LE(buffer, offset, label) {
+  return readUint32LE(buffer, offset, label) | 0;
+}
+
+function readTableFieldOffset(buffer, tableMeta, vtableFieldOffset) {
+  const fieldEntryOffset = tableMeta.vtableStart + vtableFieldOffset;
+  if (fieldEntryOffset + 2 > tableMeta.vtableEnd) {
+    return 0;
+  }
+  return readUint16LE(buffer, fieldEntryOffset, `${tableMeta.label} field offset`);
+}
+
+function resolveRelativeOffset(buffer, offset, label) {
+  const relativeOffset = readInt32LE(buffer, offset, label);
+  const target = offset + relativeOffset;
+  if (!Number.isSafeInteger(target) || target < 0 || target > buffer.length - 4) {
+    throw new Error(`${label} points outside the FlatBuffer.`);
+  }
+  return target;
+}
+
+function assertFlatbufferIdentifier(buffer, identifier, label) {
+  if (identifier.length !== flatbuffers.FILE_IDENTIFIER_LENGTH) {
+    throw new Error(`FlatBuffer identifier "${identifier}" must be 4 bytes.`);
+  }
+  assertBounds(
+    buffer,
+    flatbuffers.SIZEOF_INT,
+    flatbuffers.FILE_IDENTIFIER_LENGTH,
+    `${label} identifier`,
+  );
+  for (let index = 0; index < identifier.length; index += 1) {
+    if (buffer[flatbuffers.SIZEOF_INT + index] !== identifier.charCodeAt(index)) {
+      throw new Error(`${label} is missing the ${identifier} file identifier.`);
+    }
+  }
+}
+
+function assertFlatbufferTable(buffer, tableStart, label) {
+  assertBounds(buffer, tableStart, 4, `${label} table header`);
+  const vtableDistance = readInt32LE(buffer, tableStart, `${label} vtable offset`);
+  const vtableStart = tableStart - vtableDistance;
+  if (
+    !Number.isSafeInteger(vtableStart) ||
+    vtableStart < 0 ||
+    vtableStart > buffer.length - 4
+  ) {
+    throw new Error(`${label} vtable offset is invalid.`);
+  }
+  const vtableLength = readUint16LE(buffer, vtableStart, `${label} vtable length`);
+  const objectLength = readUint16LE(
+    buffer,
+    vtableStart + 2,
+    `${label} object length`,
+  );
+  if (vtableLength < 4 || (vtableLength & 1) !== 0) {
+    throw new Error(`${label} vtable length is invalid.`);
+  }
+  if (objectLength < 4) {
+    throw new Error(`${label} object length is invalid.`);
+  }
+  assertBounds(buffer, vtableStart, vtableLength, `${label} vtable`);
+  assertBounds(buffer, tableStart, objectLength, `${label} object`);
+  for (let entryOffset = vtableStart + 4; entryOffset < vtableStart + vtableLength; entryOffset += 2) {
+    const fieldOffset = readUint16LE(buffer, entryOffset, `${label} field entry`);
+    if (fieldOffset !== 0 && (fieldOffset < 4 || fieldOffset >= objectLength)) {
+      throw new Error(`${label} field offset is invalid.`);
+    }
+  }
+  return {
+    label,
+    tableStart,
+    tableEnd: tableStart + objectLength,
+    objectLength,
+    vtableStart,
+    vtableEnd: vtableStart + vtableLength,
+    vtableLength,
+  };
+}
+
+function assertRootFlatbufferTable(buffer, identifier, label) {
+  assertFlatbufferIdentifier(buffer, identifier, label);
+  const rootTableStart = readUint32LE(buffer, 0, `${label} root offset`);
+  if (
+    !Number.isSafeInteger(rootTableStart) ||
+    rootTableStart < flatbuffers.SIZEOF_INT + flatbuffers.FILE_IDENTIFIER_LENGTH ||
+    rootTableStart > buffer.length - 4
+  ) {
+    throw new Error(`${label} root offset is invalid.`);
+  }
+  return assertFlatbufferTable(buffer, rootTableStart, label);
+}
+
+function assertOptionalStringField(buffer, tableMeta, vtableFieldOffset, label) {
+  const fieldOffset = readTableFieldOffset(buffer, tableMeta, vtableFieldOffset);
+  if (fieldOffset === 0) {
+    return null;
+  }
+  const fieldStart = tableMeta.tableStart + fieldOffset;
+  const stringStart = resolveRelativeOffset(buffer, fieldStart, label);
+  const stringLength = readUint32LE(buffer, stringStart, `${label} length`);
+  assertBounds(buffer, stringStart + 4, stringLength, `${label} data`);
+  return {
+    fieldStart,
+    stringStart,
+    stringLength,
+  };
+}
+
+function assertOptionalByteVectorField(
+  buffer,
+  tableMeta,
+  vtableFieldOffset,
+  label,
+  { minLength = 0, maxLength = Number.MAX_SAFE_INTEGER } = {},
+) {
+  const fieldOffset = readTableFieldOffset(buffer, tableMeta, vtableFieldOffset);
+  if (fieldOffset === 0) {
+    return null;
+  }
+  const fieldStart = tableMeta.tableStart + fieldOffset;
+  const vectorStart = resolveRelativeOffset(buffer, fieldStart, label);
+  const vectorLength = readUint32LE(buffer, vectorStart, `${label} length`);
+  if (vectorLength < minLength || vectorLength > maxLength) {
+    throw new Error(`${label} length is invalid.`);
+  }
+  assertBounds(buffer, vectorStart + 4, vectorLength, `${label} data`);
+  return {
+    fieldStart,
+    vectorStart,
+    vectorLength,
+  };
+}
+
+function assertTableVectorField(buffer, tableMeta, vtableFieldOffset, label) {
+  const fieldOffset = readTableFieldOffset(buffer, tableMeta, vtableFieldOffset);
+  if (fieldOffset === 0) {
+    return [];
+  }
+  const fieldStart = tableMeta.tableStart + fieldOffset;
+  const vectorStart = resolveRelativeOffset(buffer, fieldStart, label);
+  const vectorLength = readUint32LE(buffer, vectorStart, `${label} length`);
+  const vectorDataStart = vectorStart + 4;
+  assertBounds(
+    buffer,
+    vectorDataStart,
+    vectorLength * 4,
+    `${label} offsets`,
+  );
+  const elements = [];
+  for (let index = 0; index < vectorLength; index += 1) {
+    const elementOffset = vectorDataStart + index * 4;
+    const tableStart = resolveRelativeOffset(
+      buffer,
+      elementOffset,
+      `${label}[${index}]`,
+    );
+    elements.push(
+      assertFlatbufferTable(buffer, tableStart, `${label}[${index}]`),
+    );
+  }
+  return elements;
+}
+
+function assertUnionTableField(buffer, tableMeta, vtableFieldOffset, label) {
+  const fieldOffset = readTableFieldOffset(buffer, tableMeta, vtableFieldOffset);
+  if (fieldOffset === 0) {
+    return null;
+  }
+  const fieldStart = tableMeta.tableStart + fieldOffset;
+  const tableStart = resolveRelativeOffset(buffer, fieldStart, label);
+  return assertFlatbufferTable(buffer, tableStart, label);
+}
+
+function validateEncTable(table, buffer, label) {
+  const tableMeta = assertFlatbufferTable(buffer, table.bb_pos, label);
+  assertOptionalByteVectorField(buffer, tableMeta, 12, `${label} ephemeral public key`, {
+    minLength: 1,
+    maxLength: 65,
+  });
+  assertOptionalByteVectorField(buffer, tableMeta, 14, `${label} nonce start`, {
+    minLength: 12,
+    maxLength: 12,
+  });
+  assertOptionalByteVectorField(buffer, tableMeta, 16, `${label} recipient key id`, {
+    maxLength: 32,
+  });
+  assertOptionalStringField(buffer, tableMeta, 18, `${label} context`);
+  assertOptionalByteVectorField(buffer, tableMeta, 20, `${label} schema hash`, {
+    maxLength: 32,
+  });
+  assertOptionalStringField(buffer, tableMeta, 22, `${label} root type`);
+  const record = normalizeEncTable(table.unpack());
+  if (!record.ephemeralPublicKey?.length) {
+    throw new Error(`${label} is missing the ephemeral public key.`);
+  }
+  if (!record.nonceStart || record.nonceStart.length !== 12) {
+    throw new Error(`${label} nonce start must be 12 bytes.`);
+  }
+  if (
+    record.keyExchange === "X25519" &&
+    record.ephemeralPublicKey.length !== 32
+  ) {
+    throw new Error(`${label} X25519 ephemeral public key must be 32 bytes.`);
+  }
+  if (
+    record.keyExchange !== "X25519" &&
+    (record.ephemeralPublicKey.length < 32 || record.ephemeralPublicKey.length > 65)
+  ) {
+    throw new Error(`${label} ephemeral public key length is invalid.`);
+  }
+  if (record.recipientKeyId && record.recipientKeyId.length > 32) {
+    throw new Error(`${label} recipient key id is too large.`);
+  }
+  if (record.schemaHash && record.schemaHash.length !== 32) {
+    throw new Error(`${label} schema hash must be 32 bytes when present.`);
+  }
+  return record;
+}
+
+function validatePnmTable(table, buffer, label) {
+  const tableMeta = assertFlatbufferTable(buffer, table.bb_pos, label);
+  assertOptionalStringField(buffer, tableMeta, 4, `${label} multiformat address`);
+  assertOptionalStringField(buffer, tableMeta, 6, `${label} publish timestamp`);
+  assertOptionalStringField(buffer, tableMeta, 8, `${label} cid`);
+  assertOptionalStringField(buffer, tableMeta, 10, `${label} file name`);
+  assertOptionalStringField(buffer, tableMeta, 12, `${label} file id`);
+  assertOptionalStringField(buffer, tableMeta, 14, `${label} signature`);
+  assertOptionalStringField(buffer, tableMeta, 16, `${label} timestamp signature`);
+  assertOptionalStringField(buffer, tableMeta, 18, `${label} signature type`);
+  assertOptionalStringField(buffer, tableMeta, 20, `${label} timestamp signature type`);
+  const record = normalizePnmTable(table.unpack());
+  if (
+    !record.multiformatAddress &&
+    !record.publishTimestamp &&
+    !record.cid &&
+    !record.fileName &&
+    !record.fileId &&
+    !record.signature &&
+    !record.timestampSignature &&
+    !record.signatureType &&
+    !record.timestampSignatureType
+  ) {
+    throw new Error(`${label} must contain at least one populated field.`);
+  }
+  return record;
+}
+
 function concatBytes(chunks) {
   const totalLength = chunks.reduce((total, chunk) => total + chunk.length, 0);
   const out = new Uint8Array(totalLength);
@@ -73,7 +348,8 @@ function normalizeByteField(value) {
   if (value === undefined || value === null) {
     return null;
   }
-  return toUint8Array(value);
+  const normalized = toUint8Array(value);
+  return normalized.length > 0 ? normalized : null;
 }
 
 function normalizeStringField(value) {
@@ -264,12 +540,10 @@ export function encodeEncRecord(record = {}) {
 }
 
 export function decodeEncRecord(bytes) {
-  const bb = new flatbuffers.ByteBuffer(toUint8Array(bytes));
-  if (!ENC.bufferHasIdentifier(bb)) {
-    throw new Error("ENC record is missing the $ENC file identifier.");
-  }
-  const record = ENC.getRootAsENC(bb).unpack();
-  return normalizeEncTable(record);
+  const buffer = toUint8Array(bytes);
+  assertRootFlatbufferTable(buffer, "$ENC", "ENC record");
+  const bb = new flatbuffers.ByteBuffer(buffer);
+  return validateEncTable(ENC.getRootAsENC(bb), buffer, "ENC record");
 }
 
 export function encodePnmRecord(record = {}) {
@@ -281,12 +555,10 @@ export function encodePnmRecord(record = {}) {
 }
 
 export function decodePnmRecord(bytes) {
-  const bb = new flatbuffers.ByteBuffer(toUint8Array(bytes));
-  if (!PNM.bufferHasIdentifier(bb)) {
-    throw new Error("PNM record is missing the $PNM file identifier.");
-  }
-  const record = PNM.getRootAsPNM(bb).unpack();
-  return normalizePnmTable(record);
+  const buffer = toUint8Array(bytes);
+  assertRootFlatbufferTable(buffer, "$PNM", "PNM record");
+  const bb = new flatbuffers.ByteBuffer(buffer);
+  return validatePnmTable(PNM.getRootAsPNM(bb), buffer, "PNM record");
 }
 
 export function encodePublicationRecordCollection(options = {}) {
@@ -311,33 +583,104 @@ export function encodePublicationRecordCollection(options = {}) {
 
 export function decodePublicationRecordCollection(bytes) {
   const buffer = toUint8Array(bytes);
+  assertRootFlatbufferTable(buffer, "$REC", "REC trailer");
   const bb = new flatbuffers.ByteBuffer(buffer);
-  if (!REC.bufferHasIdentifier(bb)) {
-    throw new Error("REC trailer is missing the $REC file identifier.");
+  const collectionTable = REC.getRootAsREC(bb);
+  const collectionMeta = assertFlatbufferTable(
+    buffer,
+    collectionTable.bb_pos,
+    "REC trailer",
+  );
+  assertOptionalStringField(buffer, collectionMeta, 4, "REC trailer version");
+  const recordTables = assertTableVectorField(
+    buffer,
+    collectionMeta,
+    6,
+    "REC trailer records",
+  );
+  if (recordTables.length === 0) {
+    throw new Error("REC trailer does not contain any records.");
   }
-  const collection = REC.getRootAsREC(bb).unpack();
+  const collection = collectionTable.unpack();
   const records = [];
   let enc = null;
   let pnm = null;
-  for (const unpackedRecord of Array.isArray(collection.RECORDS) ? collection.RECORDS : []) {
+  for (let index = 0; index < recordTables.length; index += 1) {
+    const recordTable =
+      collectionTable.RECORDS(index, new Record()) ?? null;
+    if (!recordTable) {
+      throw new Error(`REC trailer record ${index} could not be loaded.`);
+    }
+    const recordMeta = assertFlatbufferTable(
+      buffer,
+      recordTable.bb_pos,
+      `REC trailer record ${index}`,
+    );
+    assertOptionalStringField(
+      buffer,
+      recordMeta,
+      8,
+      `REC trailer record ${index} standard`,
+    );
+    const unpackedRecord = collection.RECORDS[index];
+    const recordType = recordTable.value_type();
     const standard =
-      normalizeStringField(unpackedRecord.standard) ??
-      STANDARD_BY_RECORD_TYPE[unpackedRecord.value_type] ??
+      normalizeStringField(unpackedRecord?.standard) ??
+      STANDARD_BY_RECORD_TYPE[recordType] ??
       null;
+    const expectedStandard =
+      STANDARD_BY_RECORD_TYPE[recordType] ?? null;
+    if (standard && expectedStandard && standard !== expectedStandard) {
+      throw new Error(
+        `REC trailer record ${index} standard/type mismatch (${standard} vs ${expectedStandard}).`,
+      );
+    }
+    const valueMeta = assertUnionTableField(
+      buffer,
+      recordMeta,
+      6,
+      `REC trailer record ${index} value`,
+    );
+    if (!valueMeta) {
+      throw new Error(`REC trailer record ${index} is missing a value.`);
+    }
+    let value =
+      standard === "ENC" || standard === "PNM"
+        ? null
+        : unpackedRecord?.value ?? null;
     if (standard === "ENC") {
-      enc = normalizeEncTable(unpackedRecord.value);
+      const encTable = recordTable.value(new ENC());
+      if (!encTable) {
+        throw new Error(`REC trailer record ${index} ENC payload is missing.`);
+      }
+      if (enc) {
+        throw new Error("REC trailer contains multiple ENC records.");
+      }
+      enc = validateEncTable(
+        encTable,
+        buffer,
+        `REC trailer record ${index} ENC payload`,
+      );
+      value = enc;
     } else if (standard === "PNM") {
-      pnm = normalizePnmTable(unpackedRecord.value);
+      const pnmTable = recordTable.value(new PNM());
+      if (!pnmTable) {
+        throw new Error(`REC trailer record ${index} PNM payload is missing.`);
+      }
+      if (pnm) {
+        throw new Error("REC trailer contains multiple PNM records.");
+      }
+      pnm = validatePnmTable(
+        pnmTable,
+        buffer,
+        `REC trailer record ${index} PNM payload`,
+      );
+      value = pnm;
     }
     records.push({
       standard,
-      recordType: unpackedRecord.value_type,
-      value:
-        standard === "ENC"
-          ? enc
-          : standard === "PNM"
-            ? pnm
-            : unpackedRecord.value,
+      recordType,
+      value,
     });
   }
   return {