@tabnas/proto 0.6.7 → 0.6.8

package/README.md

@@ -47,6 +47,9 @@ agree (`reconcile: true`, the default) or `parse` throws; set
   grammar so `tn.parse(src)` returns the raw `{rule, src, kids}` CST.
 - `toDescriptor(cst, options?)`. Turn a parsed CST into a
   FileDescriptorProto.
+- `preflight(src)`. Refuse a source nesting deeper than
+  `MAX_NESTING_DEPTH`, which is 100 levels. `parse` runs it first, and a
+  caller who drives the engine runs it before `tn.parse`.
 
 Options: `{ version?: 'proto2'|'proto3'|'2023'|'2024' | null,
 reconcile?: boolean }`.

package/dist/preflight.d.ts

@@ -0,0 +1,2 @@
+export declare const MAX_NESTING_DEPTH = 100;
+export declare function preflight(src: string): void;

package/dist/preflight.js

@@ -0,0 +1,140 @@
+"use strict";
+/* Copyright (c) 2026 Richard Rodger and other contributors, MIT License */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_NESTING_DEPTH = void 0;
+exports.preflight = preflight;
+// The nesting preflight: a `.proto` document nesting deeper than
+// MAX_NESTING_DEPTH is refused before the engine builds a tree that deep.
+//
+// The tree costs more than its nesting suggests. A CST node's `src` holds
+// every token beneath it, so a document nested `d` levels deep builds
+// source text that grows with d squared, and so do the parse's time and
+// memory: the walk here overflows its stack from about 3,000 levels, after
+// seconds and hundreds of megabytes; Go's parse grows past any memory a
+// machine has; and a Rust stack that runs out aborts the process.
+// DIVERGENCE.md section 2 has the measurements. So every runtime refuses
+// the same documents, with the same message, at the same cap: the Rust
+// port's, which sits more than an order of magnitude past anything a
+// hand-written `.proto` nests and matches the recursion budget protoc's
+// own parser carries.
+//
+// Port of `preflight` and `brace_depth` in the Rust crate (`rs/src/lib.rs`,
+// `rs/src/build_descriptor.rs`); `go/preflight.go` is the Go one.
+// How deep a document may nest, in braces. `parse` refuses a deeper one.
+exports.MAX_NESTING_DEPTH = 100;
+// Refuse a `.proto` source that nests deeper than MAX_NESTING_DEPTH,
+// before anything builds a tree that deep. `parse` runs it; a caller who
+// drives the engine directly (`new Tabnas().use(Proto)` and `tn.parse`)
+// runs it on the source first. Throws an Error whose message names the
+// depth; like every refusal the plugin makes itself, it carries no code.
+function preflight(src) {
+    const depth = braceDepth(src);
+    if (depth > exports.MAX_NESTING_DEPTH) {
+        throw new Error(`proto: document nests ${depth} levels deep, past the ` +
+            `${exports.MAX_NESTING_DEPTH} this parser accepts`);
+    }
+}
+// The grammar's keywords: its match tokens, each a word the lexer takes
+// whole when no word character follows it. A token starts after one, so a
+// quote straight after a keyword opens a string (`reserved"x";` reserves
+// `x`). ts/test/preflight.test.ts holds this list to proto-grammar.json.
+const KEYWORDS = new Set([
+    'edition', 'enum', 'export', 'extend', 'extensions', 'group', 'import',
+    'local', 'map', 'max', 'message', 'oneof', 'option', 'optional', 'package',
+    'public', 'repeated', 'required', 'reserved', 'returns', 'rpc', 'service',
+    'stream', 'syntax', 'to', 'weak',
+]);
+// Where a token ends and the next starts: a space, a line break, or one of
+// the grammar's fixed tokens other than the braces, which the scan counts
+// on their own. The test holds these to proto-grammar.json too.
+const SEPARATORS = ' \t\r\n[]:,;=()<>-.+';
+// A word character, as the keywords' `(?![A-Za-z0-9_])` reads one.
+function isWord(ch) {
+    return (0x30 <= ch && ch <= 0x39) || (0x41 <= ch && ch <= 0x5a) ||
+        (0x61 <= ch && ch <= 0x7a) || 0x5f === ch;
+}
+// The nesting depth of a `.proto` source, counted in braces, skipping the
+// string literals and the comments the tabnas lexer skips, where it skips
+// them:
+//
+// - A line comment, `//` or `#`, runs to the next line break, and the
+//   lexer breaks a line at a carriage return as well as a line feed.
+// - A string is double, single or backtick quoted, a backslash escaping
+//   the character after it, and a backtick string runs across lines.
+// - A quote opens a string only where the lexer starts a token: at the
+//   start, and after a space, a line break, a fixed token, a string, a
+//   comment or a keyword. Inside a word, `a"b`, the lexer reads the quote
+//   as part of the word, and the braces after it count.
+//
+// Over-counting is safe and under-counting is not, so an unterminated
+// string or comment counts every brace inside it: the engine rejects that
+// source anyway. Only ASCII characters decide anything here, so scanning
+// UTF-16 code units counts exactly what the Rust and Go ports count
+// scanning UTF-8 bytes.
+function braceDepth(src) {
+    const length = src.length;
+    let at = 0;
+    let depth = 0;
+    let deepest = 0;
+    // Whether a token starts at `at`.
+    let start = true;
+    while (at < length) {
+        const ch = src.charCodeAt(at);
+        if (0x7b === ch) { // {
+            depth++;
+            if (depth > deepest)
+                deepest = depth;
+            at++;
+            start = true;
+        }
+        else if (0x7d === ch) { // }
+            if (0 < depth)
+                depth--;
+            at++;
+            start = true;
+        }
+        else if (SEPARATORS.includes(src[at])) {
+            at++;
+            start = true;
+        }
+        else if (0x23 === ch || (0x2f === ch && 0x2f === src.charCodeAt(at + 1))) {
+            // `#` or `//`. The shared tabnas lexer reads `#` as a line comment;
+            // `.proto` does not, which the leniency corpus records.
+            while (at < length && 0x0a !== src.charCodeAt(at) &&
+                0x0d !== src.charCodeAt(at)) {
+                at++;
+            }
+            start = true;
+        }
+        else if (0x2f === ch && 0x2a === src.charCodeAt(at + 1)) { // /*
+            at += 2;
+            while (at < length &&
+                !(0x2a === src.charCodeAt(at) && 0x2f === src.charCodeAt(at + 1))) {
+                at++;
+            }
+            at += 2;
+            start = true;
+        }
+        else if (start && (0x22 === ch || 0x27 === ch || 0x60 === ch)) {
+            // " or ' or `
+            at++;
+            while (at < length && src.charCodeAt(at) !== ch) {
+                at += 0x5c === src.charCodeAt(at) ? 2 : 1; // a backslash escapes one
+            }
+            at++;
+            start = true;
+        }
+        else if (start && isWord(ch)) {
+            const from = at;
+            while (at < length && isWord(src.charCodeAt(at)))
+                at++;
+            start = KEYWORDS.has(src.slice(from, at));
+        }
+        else {
+            at++;
+            start = false;
+        }
+    }
+    return deepest;
+}
+//# sourceMappingURL=preflight.js.map

package/dist/preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../src/preflight.ts"],"names":[],"mappings":";AAAA,2EAA2E;;;;AAE3E,iEAAiE;AACjE,0EAA0E;AAC1E,EAAE;AACF,0EAA0E;AAC1E,sEAAsE;AACtE,wEAAwE;AACxE,2EAA2E;AAC3E,wEAAwE;AACxE,kEAAkE;AAClE,yEAAyE;AACzE,uEAAuE;AACvE,qEAAqE;AACrE,wEAAwE;AACxE,sBAAsB;AACtB,EAAE;AACF,4EAA4E;AAC5E,kEAAkE;AAElE,yEAAyE;AAC5D,QAAA,iBAAiB,GAAG,GAAG,CAAA;AAEpC,qEAAqE;AACrE,yEAAyE;AACzE,wEAAwE;AACxE,uEAAuE;AACvE,yEAAyE;AACzE,mBAA0B,GAAW;IACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;IAC7B,IAAI,KAAK,GAAG,QAAA,iBAAiB,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,yBAAyB,KAAK,yBAAyB;YACvD,GAAG,QAAA,iBAAiB,sBAAsB,CAC3C,CAAA;IACH,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,0EAA0E;AAC1E,yEAAyE;AACzE,yEAAyE;AACzE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;IACvB,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ;IACtE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS;IAC1E,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS;IACzE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM;CACjC,CAAC,CAAA;AAEF,2EAA2E;AAC3E,0EAA0E;AAC1E,gEAAgE;AAChE,MAAM,UAAU,GAAG,sBAAsB,CAAA;AAEzC,mEAAmE;AACnE,SAAS,MAAM,CAAC,EAAU;IACxB,OAAO,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;QAC7D,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,IAAI,KAAK,EAAE,CAAA;AAC7C,CAAC;AAED,0EAA0E;AAC1E,0EAA0E;AAC1E,QAAQ;AACR,EAAE;AACF,sEAAsE;AACtE,qEAAqE;AACrE,wEAAwE;AACxE,qEAAqE;AACrE,uEAAuE;AACvE,uEAAuE;AACvE,0EAA0E;AAC1E,wDAAwD;AACxD,EAAE;AACF,sEAAsE;AACtE,0EAA0E;AAC1E,yEAAyE;AACzE,oEAAoE;AACpE,wBAAwB;AACxB,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAA;IACzB,IAAI,EAAE,GAAG,CAAC,CAAA;IACV,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,kCAAkC;IAClC,IAAI,KAAK,GAAG,IAAI,CAAA;IAChB,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;QACnB,MAAM,EAAE,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;QAC7B,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI;YACrB,KAAK,EAAE,CAAA;YACP,IAAI,KAAK,GAAG,OAAO;gBAAE,OAAO,GAAG,KAAK,CAAA;YACpC,EAAE,EAAE,CAAA;YACJ,KAAK,GAAG,IAAI,CAAA;QACd,CAAC;aAAM,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI;YAC5B,IAAI,CAAC,GAAG,KAAK;gBAAE,KAAK,EAAE,CAAA;YACtB,EAAE,EAAE,CAAA;YACJ,KAAK,GAAG,IAAI,CAAA;QACd,CAAC;aAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACxC,EAAE,EAAE,CAAA;YACJ,KAAK,GAAG,IAAI,CAAA;QACd,CAAC;aAAM,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,oEAAoE;YACpE,wDAAwD;YACxD,OAAO,EAAE,GAAG,MAAM,IAAI,IAAI,KAAK,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/C,IAAI,KAAK,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC9B,EAAE,EAAE,CAAA;YACN,CAAC;YACD,KAAK,GAAG,IAAI,CAAA;QACd,CAAC;aAAM,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK;YAChE,EAAE,IAAI,CAAC,CAAA;YACP,OAAO,EAAE,GAAG,MAAM;gBAChB,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,EAAE,EAAE,CAAA;YACN,CAAC;YACD,EAAE,IAAI,CAAC,CAAA;YACP,KAAK,GAAG,IAAI,CAAA;QACd,CAAC;aAAM,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,CAAC,EAAE,CAAC;YAChE,cAAc;YACd,EAAE,EAAE,CAAA;YACJ,OAAO,EAAE,GAAG,MAAM,IAAI,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;gBAChD,EAAE,IAAI,IAAI,KAAK,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA,CAAC,0BAA0B;YACtE,CAAC;YACD,EAAE,EAAE,CAAA;YACJ,KAAK,GAAG,IAAI,CAAA;QACd,CAAC;aAAM,IAAI,KAAK,IAAI,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,EAAE,CAAA;YACf,OAAO,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;gBAAE,EAAE,EAAE,CAAA;YACtD,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;QAC3C,CAAC;aAAM,CAAC;YACN,EAAE,EAAE,CAAA;YACJ,KAAK,GAAG,KAAK,CAAA;QACf,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/proto.d.ts

@@ -1,4 +1,5 @@
 import { Tabnas } from '@tabnas/parser';
+import { MAX_NESTING_DEPTH, preflight } from './preflight';
 import { ProtoVersion } from './detect-version';
 import { FileDescriptorProto } from './descriptor';
 export interface ProtoOptions {
@@ -11,8 +12,8 @@ declare const Proto: {
 };
 declare function toDescriptor(cst: any, options?: Partial<ProtoOptions>): FileDescriptorProto;
 declare function parse(src: string, options?: Partial<ProtoOptions>): FileDescriptorProto;
-declare const VERSION = "0.6.7";
-export { Proto, parse, toDescriptor, VERSION };
+declare const VERSION = "0.6.8";
+export { Proto, parse, toDescriptor, preflight, MAX_NESTING_DEPTH, VERSION };
 export type { ProtoVersion };
 export * from './descriptor';
 export { translate } from './translate';

package/dist/proto.js

@@ -18,7 +18,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.translate = exports.VERSION = exports.Proto = void 0;
+exports.translate = exports.VERSION = exports.MAX_NESTING_DEPTH = exports.preflight = exports.Proto = void 0;
 exports.parse = parse;
 exports.toDescriptor = toDescriptor;
 // @tabnas/proto — a Tabnas plugin that parses Protocol Buffers `.proto`
@@ -31,6 +31,9 @@ const parser_1 = require("@tabnas/parser");
 const proto_grammar_json_1 = __importDefault(require("./proto-grammar.json"));
 const build_descriptor_1 = require("./build-descriptor");
 const aggregate_1 = require("./aggregate");
+const preflight_1 = require("./preflight");
+Object.defineProperty(exports, "MAX_NESTING_DEPTH", { enumerable: true, get: function () { return preflight_1.MAX_NESTING_DEPTH; } });
+Object.defineProperty(exports, "preflight", { enumerable: true, get: function () { return preflight_1.preflight; } });
 const detect_version_1 = require("./detect-version");
 // The engine's GrammarSpec type describes a match token as a RegExp; the
 // serialized form carries it as an `@~/…/` string, which `tn.grammar()`
@@ -72,8 +75,12 @@ function toDescriptor(cst, options) {
 // Convenience: parse a `.proto` source string to a FileDescriptorProto in
 // one call. Builds a fresh engine each time; for repeated parsing reuse an
 // engine via `const j = new Tabnas().use(Proto)` and call
-// `toDescriptor(j.parse(src), opts)`.
+// `toDescriptor(j.parse(src), opts)`, running `preflight(src)` first.
+//
+// A document nesting deeper than MAX_NESTING_DEPTH is refused before the
+// engine runs: see ./preflight.ts.
 function parse(src, options) {
+    (0, preflight_1.preflight)(src);
     const tn = new parser_1.Tabnas({ rewind: { history: 8192 } });
     Proto(tn, options);
     return toDescriptor(tn.parse(src), options);
@@ -81,7 +88,7 @@ function parse(src, options) {
 // VERSION is this package's version. It MUST equal package.json "version":
 // the release orchestrator rewrites both, and test/version.test.ts fails the
 // build if they drift. Mirrors `const VERSION` in go/proto.go.
-const VERSION = '0.6.7';
+const VERSION = '0.6.8';
 exports.VERSION = VERSION;
 __exportStar(require("./descriptor"), exports);
 var translate_1 = require("./translate");

package/dist/proto.js.map

@@ -1 +1 @@
-{"version":3,"file":"proto.js","sourceRoot":"","sources":["../src/proto.ts"],"names":[],"mappings":";AAAA,2EAA2E;;;;;;;;;;;;;;;;;;;;QAwF3D,KAAK;QAAE,YAAY;AAtFnC,wEAAwE;AACxE,0EAA0E;AAC1E,wEAAwE;AACxE,wDAAwD;AAExD,2CAAuC;AAGvC,wEAAwE;AACxE,+DAA+D;AAC/D,8EAAkD;AAClD,yDAA8C;AAC9C,2CAA6C;AAC7C,qDAEyB;AAYzB,yEAAyE;AACzE,wEAAwE;AACxE,uCAAuC;AACvC,MAAM,QAAQ,GAAG,4BAAyC,CAAA;AAE1D,wEAAwE;AACxE,yEAAyE;AACzE,4EAA4E;AAC5E,MAAM,KAAK,GAAG,CAAC,CAAC,EAAU,EAAE,QAAgC,EAAE,EAAE;IAC9D,wEAAwE;IACxE,mEAAmE;IACnE,uEAAuE;IACvE,iEAAiE;IACjE,qEAAqE;IACrE,wEAAwE;IACxE,gEAAgE;IAChE,mEAAmE;IACnE,gEAAgE;IAChE,uEAAuE;IACvE,4BAA4B;IAC5B,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IACpB,wEAAwE;IACxE,qEAAqE;IACrE,sEAAsE;IACtE,0DAA0D;IAC1D,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,EAAO,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,2BAAe,CAAC,CAAC,CAAA;AAC1D,CAAC,CAGA,CAAA;QA8BQ,KAAK;AA5Bd,KAAK,CAAC,QAAQ,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;AAEnD,oEAAoE;AACpE,gEAAgE;AAChE,SAAS,YAAY,CAAC,GAAQ,EAAE,OAA+B;IAC7D,MAAM,IAAI,GAAiB,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAA;IACpE,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAA;IAC7E,MAAM,QAAQ,GACZ,KAAK,IAAI,iBAAiB,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,gCAAe,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3E,MAAM,OAAO,GAAG,IAAA,+BAAc,EAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IACtE,OAAO,IAAA,4BAAS,EAAC,GAAG,EAAE,OAAO,CAAC,CAAA;AAChC,CAAC;AAED,0EAA0E;AAC1E,2EAA2E;AAC3E,0DAA0D;AAC1D,sCAAsC;AACtC,SAAS,KAAK,CAAC,GAAW,EAAE,OAA+B;IACzD,MAAM,EAAE,GAAG,IAAI,eAAM,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;IACpD,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IAClB,OAAO,YAAY,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAA;AAC7C,CAAC;AAED,2EAA2E;AAC3E,6EAA6E;AAC7E,+DAA+D;AAC/D,MAAM,OAAO,GAAG,OAAO,CAAA;QAEc,OAAO;AAE5C,+CAA4B;AAC5B,yCAAuC;AAA9B,sGAAA,SAAS,OAAA"}
+{"version":3,"file":"proto.js","sourceRoot":"","sources":["../src/proto.ts"],"names":[],"mappings":";AAAA,2EAA2E;;;;;;;;;;;;;;;;;;;;QA6F3D,KAAK;QAAE,YAAY;AA3FnC,wEAAwE;AACxE,0EAA0E;AAC1E,wEAAwE;AACxE,wDAAwD;AAExD,2CAAuC;AAGvC,wEAAwE;AACxE,+DAA+D;AAC/D,8EAAkD;AAClD,yDAA8C;AAC9C,2CAA6C;AAC7C,2CAA0D;kGAAjD,6BAAiB;0FAAE,qBAAS;AACrC,qDAEyB;AAYzB,yEAAyE;AACzE,wEAAwE;AACxE,uCAAuC;AACvC,MAAM,QAAQ,GAAG,4BAAyC,CAAA;AAE1D,wEAAwE;AACxE,yEAAyE;AACzE,4EAA4E;AAC5E,MAAM,KAAK,GAAG,CAAC,CAAC,EAAU,EAAE,QAAgC,EAAE,EAAE;IAC9D,wEAAwE;IACxE,mEAAmE;IACnE,uEAAuE;IACvE,iEAAiE;IACjE,qEAAqE;IACrE,wEAAwE;IACxE,gEAAgE;IAChE,mEAAmE;IACnE,gEAAgE;IAChE,uEAAuE;IACvE,4BAA4B;IAC5B,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IACpB,wEAAwE;IACxE,qEAAqE;IACrE,sEAAsE;IACtE,0DAA0D;IAC1D,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,EAAO,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,2BAAe,CAAC,CAAC,CAAA;AAC1D,CAAC,CAGA,CAAA;QAkCQ,KAAK;AAhCd,KAAK,CAAC,QAAQ,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;AAEnD,oEAAoE;AACpE,gEAAgE;AAChE,SAAS,YAAY,CAAC,GAAQ,EAAE,OAA+B;IAC7D,MAAM,IAAI,GAAiB,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAA;IACpE,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAA;IAC7E,MAAM,QAAQ,GACZ,KAAK,IAAI,iBAAiB,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,gCAAe,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3E,MAAM,OAAO,GAAG,IAAA,+BAAc,EAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IACtE,OAAO,IAAA,4BAAS,EAAC,GAAG,EAAE,OAAO,CAAC,CAAA;AAChC,CAAC;AAED,0EAA0E;AAC1E,2EAA2E;AAC3E,0DAA0D;AAC1D,sEAAsE;AACtE,EAAE;AACF,yEAAyE;AACzE,mCAAmC;AACnC,SAAS,KAAK,CAAC,GAAW,EAAE,OAA+B;IACzD,IAAA,qBAAS,EAAC,GAAG,CAAC,CAAA;IACd,MAAM,EAAE,GAAG,IAAI,eAAM,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;IACpD,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IAClB,OAAO,YAAY,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAA;AAC7C,CAAC;AAED,2EAA2E;AAC3E,6EAA6E;AAC7E,+DAA+D;AAC/D,MAAM,OAAO,GAAG,OAAO,CAAA;QAE4C,OAAO;AAE1E,+CAA4B;AAC5B,yCAAuC;AAA9B,sGAAA,SAAS,OAAA"}

package/dist/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"version":"7.0.2","root":["../src/aggregate.ts","../src/build-descriptor.ts","../src/descriptor.ts","../src/detect-version.ts","../src/grammar.ts","../src/proto.ts","../src/translate.ts"],"packageJsons":["../node_modules/@tabnas/parser/package.json","../package.json"],"missingPackageJsons":["../node_modules/@tabnas/parser/dist/package.json"]}
+{"version":"7.0.2","root":["../src/aggregate.ts","../src/build-descriptor.ts","../src/descriptor.ts","../src/detect-version.ts","../src/grammar.ts","../src/preflight.ts","../src/proto.ts","../src/translate.ts"],"packageJsons":["../node_modules/@tabnas/parser/package.json","../package.json"],"missingPackageJsons":["../node_modules/@tabnas/parser/dist/package.json"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tabnas/proto",
-  "version": "0.6.7",
+  "version": "0.6.8",
   "description": "Parse Protocol Buffers .proto IDL (proto2, proto3, edition 2023/2024) into FileDescriptorProto-shaped JSON, using the Tabnas parser and an ABNF grammar.",
   "main": "dist/proto.js",
   "type": "commonjs",

package/src/preflight.ts

@@ -0,0 +1,134 @@
+/* Copyright (c) 2026 Richard Rodger and other contributors, MIT License */
+
+// The nesting preflight: a `.proto` document nesting deeper than
+// MAX_NESTING_DEPTH is refused before the engine builds a tree that deep.
+//
+// The tree costs more than its nesting suggests. A CST node's `src` holds
+// every token beneath it, so a document nested `d` levels deep builds
+// source text that grows with d squared, and so do the parse's time and
+// memory: the walk here overflows its stack from about 3,000 levels, after
+// seconds and hundreds of megabytes; Go's parse grows past any memory a
+// machine has; and a Rust stack that runs out aborts the process.
+// DIVERGENCE.md section 2 has the measurements. So every runtime refuses
+// the same documents, with the same message, at the same cap: the Rust
+// port's, which sits more than an order of magnitude past anything a
+// hand-written `.proto` nests and matches the recursion budget protoc's
+// own parser carries.
+//
+// Port of `preflight` and `brace_depth` in the Rust crate (`rs/src/lib.rs`,
+// `rs/src/build_descriptor.rs`); `go/preflight.go` is the Go one.
+
+// How deep a document may nest, in braces. `parse` refuses a deeper one.
+export const MAX_NESTING_DEPTH = 100
+
+// Refuse a `.proto` source that nests deeper than MAX_NESTING_DEPTH,
+// before anything builds a tree that deep. `parse` runs it; a caller who
+// drives the engine directly (`new Tabnas().use(Proto)` and `tn.parse`)
+// runs it on the source first. Throws an Error whose message names the
+// depth; like every refusal the plugin makes itself, it carries no code.
+export function preflight(src: string): void {
+  const depth = braceDepth(src)
+  if (depth > MAX_NESTING_DEPTH) {
+    throw new Error(
+      `proto: document nests ${depth} levels deep, past the ` +
+      `${MAX_NESTING_DEPTH} this parser accepts`,
+    )
+  }
+}
+
+// The grammar's keywords: its match tokens, each a word the lexer takes
+// whole when no word character follows it. A token starts after one, so a
+// quote straight after a keyword opens a string (`reserved"x";` reserves
+// `x`). ts/test/preflight.test.ts holds this list to proto-grammar.json.
+const KEYWORDS = new Set([
+  'edition', 'enum', 'export', 'extend', 'extensions', 'group', 'import',
+  'local', 'map', 'max', 'message', 'oneof', 'option', 'optional', 'package',
+  'public', 'repeated', 'required', 'reserved', 'returns', 'rpc', 'service',
+  'stream', 'syntax', 'to', 'weak',
+])
+
+// Where a token ends and the next starts: a space, a line break, or one of
+// the grammar's fixed tokens other than the braces, which the scan counts
+// on their own. The test holds these to proto-grammar.json too.
+const SEPARATORS = ' \t\r\n[]:,;=()<>-.+'
+
+// A word character, as the keywords' `(?![A-Za-z0-9_])` reads one.
+function isWord(ch: number): boolean {
+  return (0x30 <= ch && ch <= 0x39) || (0x41 <= ch && ch <= 0x5a) ||
+    (0x61 <= ch && ch <= 0x7a) || 0x5f === ch
+}
+
+// The nesting depth of a `.proto` source, counted in braces, skipping the
+// string literals and the comments the tabnas lexer skips, where it skips
+// them:
+//
+// - A line comment, `//` or `#`, runs to the next line break, and the
+//   lexer breaks a line at a carriage return as well as a line feed.
+// - A string is double, single or backtick quoted, a backslash escaping
+//   the character after it, and a backtick string runs across lines.
+// - A quote opens a string only where the lexer starts a token: at the
+//   start, and after a space, a line break, a fixed token, a string, a
+//   comment or a keyword. Inside a word, `a"b`, the lexer reads the quote
+//   as part of the word, and the braces after it count.
+//
+// Over-counting is safe and under-counting is not, so an unterminated
+// string or comment counts every brace inside it: the engine rejects that
+// source anyway. Only ASCII characters decide anything here, so scanning
+// UTF-16 code units counts exactly what the Rust and Go ports count
+// scanning UTF-8 bytes.
+function braceDepth(src: string): number {
+  const length = src.length
+  let at = 0
+  let depth = 0
+  let deepest = 0
+  // Whether a token starts at `at`.
+  let start = true
+  while (at < length) {
+    const ch = src.charCodeAt(at)
+    if (0x7b === ch) { // {
+      depth++
+      if (depth > deepest) deepest = depth
+      at++
+      start = true
+    } else if (0x7d === ch) { // }
+      if (0 < depth) depth--
+      at++
+      start = true
+    } else if (SEPARATORS.includes(src[at])) {
+      at++
+      start = true
+    } else if (0x23 === ch || (0x2f === ch && 0x2f === src.charCodeAt(at + 1))) {
+      // `#` or `//`. The shared tabnas lexer reads `#` as a line comment;
+      // `.proto` does not, which the leniency corpus records.
+      while (at < length && 0x0a !== src.charCodeAt(at) &&
+        0x0d !== src.charCodeAt(at)) {
+        at++
+      }
+      start = true
+    } else if (0x2f === ch && 0x2a === src.charCodeAt(at + 1)) { // /*
+      at += 2
+      while (at < length &&
+        !(0x2a === src.charCodeAt(at) && 0x2f === src.charCodeAt(at + 1))) {
+        at++
+      }
+      at += 2
+      start = true
+    } else if (start && (0x22 === ch || 0x27 === ch || 0x60 === ch)) {
+      // " or ' or `
+      at++
+      while (at < length && src.charCodeAt(at) !== ch) {
+        at += 0x5c === src.charCodeAt(at) ? 2 : 1 // a backslash escapes one
+      }
+      at++
+      start = true
+    } else if (start && isWord(ch)) {
+      const from = at
+      while (at < length && isWord(src.charCodeAt(at))) at++
+      start = KEYWORDS.has(src.slice(from, at))
+    } else {
+      at++
+      start = false
+    }
+  }
+  return deepest
+}

package/src/proto.ts

@@ -13,6 +13,7 @@ import type { GrammarSpec } from '@tabnas/parser'
 import compiledGrammar from './proto-grammar.json'
 import { buildFile } from './build-descriptor'
 import { recordAggregate } from './aggregate'
+import { MAX_NESTING_DEPTH, preflight } from './preflight'
 import {
   ProtoVersion, declaredVersion, resolveVersion,
 } from './detect-version'
@@ -74,8 +75,12 @@ function toDescriptor(cst: any, options?: Partial<ProtoOptions>): FileDescriptor
 // Convenience: parse a `.proto` source string to a FileDescriptorProto in
 // one call. Builds a fresh engine each time; for repeated parsing reuse an
 // engine via `const j = new Tabnas().use(Proto)` and call
-// `toDescriptor(j.parse(src), opts)`.
+// `toDescriptor(j.parse(src), opts)`, running `preflight(src)` first.
+//
+// A document nesting deeper than MAX_NESTING_DEPTH is refused before the
+// engine runs: see ./preflight.ts.
 function parse(src: string, options?: Partial<ProtoOptions>): FileDescriptorProto {
+  preflight(src)
   const tn = new Tabnas({ rewind: { history: 8192 } })
   Proto(tn, options)
   return toDescriptor(tn.parse(src), options)
@@ -84,9 +89,9 @@ function parse(src: string, options?: Partial<ProtoOptions>): FileDescriptorProt
 // VERSION is this package's version. It MUST equal package.json "version":
 // the release orchestrator rewrites both, and test/version.test.ts fails the
 // build if they drift. Mirrors `const VERSION` in go/proto.go.
-const VERSION = '0.6.7'
+const VERSION = '0.6.8'
 
-export { Proto, parse, toDescriptor, VERSION }
+export { Proto, parse, toDescriptor, preflight, MAX_NESTING_DEPTH, VERSION }
 export type { ProtoVersion }
 export * from './descriptor'
 export { translate } from './translate'