Validate DAML map keys and values

[HardlyDifficult]

Summary

• detach generated decoder input from a separate losslessness snapshot so decoder mutation cannot rewrite the oracle
• preserve null prototypes, dangerous own keys, and negative zero while rejecting accessors, proxies, and lossy decode/encode cycles
• validate active Canton event envelopes against the installed upstream schemas, then explicitly admit and type-check current OpenAPI fields (representativePackageId, acsDelta, and contractKeyHash)
• reject unknown, stale, or malformed envelope fields
• validate every DAML map key and value, reject duplicate contract-ID values, and require all four issuance indexes to contain the same one-to-one contract-ID set

Validation

• npm run test:ci — 96 suites / 5,510 tests passed
• npm run test:declarations
• npm run test:package-consumer
• npm run test:exact-public-config
• npm run typecheck
• npm run build
• npm run lint
• npm run format
• parent-relative diff checks pass
• CI and OCP QuickStart pass on exact head 1a54bcb2fd62bfbeb8d449622f4d56242762ac36

Stack

• stacked on Validate generated DAML reader payloads #427
• remains draft until its parent reaches the final review gate

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 2c1cf642-d7f0-4520-b78a-18ba3ebcab25

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Note

Reviews paused

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/strict-daml-map-decoding

---

_{Comment @coderabbitai help to get the list of available commands.}

[HardlyDifficult]

@coderabbitai pause

[coderabbitai]

✅ Action performed

Reviews paused.

[HardlyDifficult]

Prepared and independently audited exact head 22905e3e327479214ffdd2494d7a2602ab5fb0eb on the finalized #427 stack using normal commits; no history rewrite. The strict typed map API and exact duplicate/index/key/value diagnostics are preserved and strengthened with safe-JSON preflight before traversal, full generated CapTable wrapper decode/encode losslessness, own/non-empty/matching issuer context, wrapper/context/payload extra rejection, 51-map roundtrip coverage, and bounded proxy/accessor/cycle/sparse/oversized/hostile diagnostics. Independent validation is green: focused 112 tests; full 88 suites / 4,522 tests; 87.78% statements / 79.11% branches / 86.66% functions / 87.99% lines; build, declarations, exact config, lint, formatting, deterministic 49-object inventory, and diff checks. The PR remains draft/unassigned pending exact-head CI and Copilot-first review.

[HardlyDifficult]

@copilot review

Please perform a formal review of exact current head 22905e3e327479214ffdd2494d7a2602ab5fb0eb. Independent adversarial audit confirmed full 51-map/53-field CapTable decode/encode losslessness, safe preflight before traversal, exact issuer-context correlation, strict duplicate/index/key/value diagnostics, and bounded proxy/accessor/cycle/sparse/oversized handling. Build-and-test, the 8m25s QuickStart run, 88 suites / 4,522 local tests, declarations, exact config, lint, formatting, deterministic inventory, mergeability, and all threads are clean. Copilot is being requested first for this material revision.

[Copilot]

@copilot review

Please perform a formal review of exact current head 22905e3e327479214ffdd2494d7a2602ab5fb0eb. Independent adversarial audit confirmed full 51-map/53-field CapTable decode/encode lo...

Formal review completed on exact head 22905e3. I did not find any blocking correctness or security issues requiring code changes.

[HardlyDifficult]

cursor review

Copilot completed a no-findings formal review of exact current head 22905e3e327479214ffdd2494d7a2602ab5fb0eb. Please perform the next exact-head automated review, including full CapTable wrapper losslessness, strict typed maps, issuer-context correlation, safe preflight, and bounded hostile diagnostics.

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 22905e3. Configure here.}

[HardlyDifficult]

@copilot review

Please review exact current head 4c42bad296271a8b5e93d81f4f276673e6bac890. Exact CI and LocalNet QuickStart are green, GitHub reports CLEAN/MERGEABLE, and all prior threads are resolved. Focus on strict DAML map key/value decoding, duplicate detection, and hostile-input bounds plus refreshed-parent integration; report any current-head actionable issue before Cursor review.

[Copilot]

@copilot review

Please review exact current head 4c42bad296271a8b5e93d81f4f276673e6bac890. Exact CI and LocalNet QuickStart are green, GitHub reports CLEAN/MERGEABLE, and all prior threads are reso...

Formal review completed on exact head 4c42bad. I found no current-head actionable correctness or security issues in strict DAML map key/value decoding, duplicate detection, issuer-context correlation, safe preflight, or hostile-input bounds. I also re-ran focused suites (typeConversions, getCapTableState, archiveFullCapTable) and they passed.

[HardlyDifficult]

@cursor review

Please review exact current head 4c42bad296271a8b5e93d81f4f276673e6bac890. Copilot completed an explicit exact-head no-findings response; exact CI and LocalNet QuickStart are green, GitHub reports CLEAN/MERGEABLE, and all prior threads are resolved. Focus on strict DAML map key/value decoding, duplicate detection, and hostile-input bounds.

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 4c42bad. Configure here.}

[Copilot]

@copilot review

Formal review completed on exact head 1d90f56. I found no current-head actionable correctness or security issues in strict DAML map key/value decoding, duplicate detection, issuer-context correlation, safe preflight, or hostile-input bounds. I also re-ran focused suites (test/utils/typeConversions.test.ts, test/capTable/getCapTableState.test.ts, test/capTable/archiveFullCapTable.test.ts): all passed (116 tests).

[HardlyDifficult]

@cursor review

Please review exact head 1d90f5663adc36128277df5ca5a04d31118ad7f4. Copilot completed an exact-head no-actionable review: #428 (comment). Exact-head build-and-test and full QuickStart are green, the branch is CLEAN/MERGEABLE, and unresolved-thread count is zero.

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 1d90f56. Configure here.}

[HardlyDifficult]

Material parent propagation complete at exact head 5394ea3, incorporating #427 at 818053e. Source typecheck passed on canton-node-sdk 0.0.227, preserving strict DAML-map decoding, the dependency-aware sorter, exhaustive relationships, and symmetric vesting-graph validation. The PR remains draft and unassigned while CI runs.

[HardlyDifficult]

Fresh GenMap audit hardening is pushed at exact head 00cf5626a293cfd9af98402c52fcb01335126896.

The prior lossless decoder compared generated maps positionally, so valid unsorted GenMap tuples were rejected after the DAML codec re-encoded them in key order. Configured GenMap paths are now compared semantically by collision-free structural key identity, while all ordinary arrays remain order-sensitive. Valid arbitrary tuple order is accepted and public insertion order is preserved; duplicate keys, malformed tuples/keys/values, dangerous string keys, proxies/accessors, and actual loss/coercion still reject with structured paths.

Coverage derives all 51 CapTable map fields, permutes them independently, exercises __proto__/constructor, structured generic keys, duplicate/malformed matrices, and zero getter/proxy traps. The old reversed-map reproduction now succeeds and preserves key order [z,a].

Validation: focused 4 suites / 127 tests; full 90 suites / 4,626 tests; build; typecheck; declarations; exact public-config checks; lint; format; diff check. The PR remains draft/unassigned; no parent merge or reviews were requested.

[HardlyDifficult]

Corrected propagation is pushed at 7ab9993eee7e82876cc7717b3692726b305faa3f, incorporating exact parent #427 97603e8b4d0c8ccc4f30d2dc7fad2b241828df58.

Exact-head validation:

• focused strict-map/reader/sorter suite: 6 suites / 243 tests, including all 51 map-specific cases
• full test:ci: 94 suites / 5,423 tests, coverage passing
• configured DAML GenMaps compare semantically by collision-free structural key identity while preserving source insertion order
• dangerous keys, duplicate semantic keys, malformed tuple/key/value shapes, and all CapTable map fields retain exact bounded diagnostics
• non-GenMap arrays remain strictly positional
• all exact reader/template/contract, Numeric10/Monetary, immutable map, and 500-case sorter parent invariants remain green
• clean build, hardened declarations/package consumer/built cardinality, exact public config, typecheck, ESLint, Prettier, and diff checks pass
• source and built inventories agree: 55 variants, 0 aliases, fingerprint 39418162cb257fc316d7a15efc24d825223fac9a9d9d4d2d5104cc53ebb444c0

The PR remains draft and unassigned while fresh CI runs. No reviewer requests were made.

[HardlyDifficult]

@copilot review

Please review exact current head 7ab9993eee7e82876cc7717b3692726b305faa3f. Pre-review gate: both required checks are successful, GitHub is CLEAN/MERGEABLE, the PR is unassigned, and zero review threads are unresolved. Focus on strict DAML map decoding, own data-descriptor and sparse/custom container handling, trap safety, and exact diagnostics. Report every actionable current-head issue before the other reviewers.

[Copilot]

@copilot review

Please review exact current head 7ab9993eee7e82876cc7717b3692726b305faa3f. Pre-review gate: both required checks are successful, GitHub is CLEAN/MERGEABLE, the PR is unassigned, and...

Formal exact-head review completed for 7ab9993. I found no current-head actionable correctness or security issues in strict DAML map decoding, sparse/custom container handling, trap safety, or diagnostics. I also validated with focused suites: typeConversions, generatedDamlValidation, getCapTableState, and archiveFullCapTable (127/127 passing), plus source typecheck.

[HardlyDifficult]

@copilot review

Retrying the required exact-head gate for 7ab9993eee7e82876cc7717b3692726b305faa3f; the first request received no explicit response. The PR remains green, CLEAN/MERGEABLE, unassigned, and has zero unresolved threads. Please provide actionable findings or an explicit no-findings response for this exact revision before Cursor and CodeRabbit.

[Copilot]

@copilot review

Retrying the required exact-head gate for 7ab9993eee7e82876cc7717b3692726b305faa3f; the first request received no explicit response. The PR remains green, CLEAN/MERGEABLE, unassigne...

Formal exact-head review completed for 7ab9993eee7e82876cc7717b3692726b305faa3f.

I found no current-head actionable correctness or security issues in strict DAML map key/value decoding, duplicate detection, issuer-context correlation, safe preflight, hostile-input bounds, or diagnostics.

[HardlyDifficult]

@cursor review

Please review exact current head 7ab9993eee7e82876cc7717b3692726b305faa3f. Copilot completed its required exact-head pass with no actionable findings: #428 (comment). Both required checks are green, GitHub is CLEAN/MERGEABLE, and zero review threads are unresolved. Focus on strict DAML map decoding, own/sparse/custom container handling, trap safety, duplicate detection, and exact diagnostics.

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 7ab9993. Configure here.}

[HardlyDifficult]

Parent propagation is complete at exact head c45265e. This is a normal conflict-free merge of audited #427 c448a7e; both stack layers remain byte-identical to their pre-merge blobs with zero overlapping changed files. Validation passes: 12 focused suites / 890 tests, full 94 suites / 5,428 tests, typecheck, lint, formatting, declarations, exact-public/cardinality, and package-consumer gates. Independent inspection found no issue. Keeping this PR in draft until fresh remote CI is green.

[HardlyDifficult]

Audit remediation and the refreshed #427 parent are now pushed at exact head 1a54bcb2fd62bfbeb8d449622f4d56242762ac36. Full validation passes: 96 suites / 5,510 tests, declarations, build, package-consumer, exact-public-config, lint, formatting, and parent-relative diff checks. Hosted CI and OCP QuickStart are running.