Module codec 

Length-prefixed framing over an async byte stream (phase D, #406).

Each frame is a 4-byte big-endian length followed by that many CBOR bytes. The length is capped so a peer cannot announce a multi-gigabyte frame and force an unbounded read before the frame is even parsed — the transport-level half of “bounded frames, no amplification”. This layer is transport-agnostic: it runs over an iroh bi-stream in production and over an in-memory duplex in tests, so the session logic is exercised without the network.

Enums

CodecError

What can go wrong moving a frame over the wire.

Constants

MAX_FRAME_BYTES

The largest frame this codec will read. Chosen well above one full Frame::Entries page of account entries (each entry is at most the §18a envelope, 64 KiB) plus overhead. A larger declared length is refused before any allocation.

Functions

read_frame

Read one frame, or CodecError::Eof if the stream ends cleanly before the next length prefix.

read_frame_within

read_frame with a caller-supplied maximum, checked against the length prefix BEFORE any allocation. The auth phase passes a tight bound so an unauthenticated peer cannot force the full MAX_FRAME_BYTES allocation with its first frame (#881) — the frame-level cap is what actually bounds the pre-auth allocation, since the body is sized from the length prefix.

write_frame

Write one frame: a 4-byte big-endian length prefix, then the CBOR body.