/**
 * T2 · Boundary Zod validation of control-frame payloads (OPEN / WINDOW_UPDATE / GOAWAY).
 *
 * The decode+validate functions live in `relay-contracts` (they CBOR/int-decode then Zod-guard,
 * throwing `ContractDecodeError` on a bad shape — never a partial value, INV boundary validation).
 * P1 re-exports them plus a small `assertWithinFrameCeiling` helper the mux session uses to reject
 * an oversized `payloadLen` before allocating (kills the OOM footgun, T6 frame-ceiling case).
 *
 * Security: NEVER validates DATA content (INV2) — DATA is opaque bytes.
 */
import { ContractDecodeError } from 'relay-contracts'

export { decodeOpen, decodeWindowUpdate, decodeGoaway } from 'relay-contracts'

/** Throw if a decoded `payloadLen` exceeds the configured ceiling (caller RSTs the stream). */
export function assertWithinFrameCeiling(payloadLen: number, maxFrameBytes: number): void {
  if (payloadLen > maxFrameBytes) {
    throw new ContractDecodeError(
      `frame payloadLen ${payloadLen} exceeds ceiling ${maxFrameBytes}`,
    )
  }
}