rea-agents 5.0.0 → 6.1.0

package/dist/artifacts/apple/InterfaceBuilderAnalysis.js

@@ -4,36 +4,72 @@ import { DirectoryArtifactReader } from "../DirectoryArtifactReader.js";
 import { projectPlistValue } from "../../domain/apple/plistValue.js";
 import { omittedPrototypeKeysLimitation, parseXmlPropertyList, } from "../../domain/propertyListKeys.js";
 import { decodeNibArchive } from "./NibArchive.js";
+import { estimatePropertyListDecodeBytes, InterfaceBuilderDecodeBudget, InterfaceBuilderDecodeBudgetExceeded, } from "./InterfaceBuilderDecodeBudget.js";
 import { buildInterfaceBuilderAnalysis, interfaceBuilderLimitsSchema, } from "../../domain/apple/interfaceBuilderGraph.js";
 import { mergeNibHierarchies, projectNibViewHierarchy, } from "./NibViewHierarchy.js";
 import { jsonValueSchema } from "../../domain/jsonValue.js";
-const MAX_DOCUMENT_BYTES = 64 * 1024 * 1024;
+import { decodeXmlPlistText } from "../../domain/propertyListXmlText.js";
+const MAX_AGGREGATE_INPUT_BYTES = 32 * 1024 * 1024;
+const MAX_AGGREGATE_DECODE_BYTES = 256 * 1024 * 1024;
+const MAX_REPORTED_OMITTED_ARCHIVES = 64;
 /** Decode compiled Interface Builder archives from a local app bundle. */
 export const analyzeInterfaceBuilderBundle = async (input) => {
     const limits = interfaceBuilderLimitsSchema.parse(input.limits ?? {});
     const reader = new DirectoryArtifactReader(input.bundlePath);
     const documents = [];
     const invalid = [];
+    const omittedArchives = [];
+    let unreportedOmittedArchives = 0;
     const incompleteHierarchies = new Map();
     const prototypeKeyOmissions = new Map();
     let omitted = 0;
     let attempted = 0;
+    let candidates = 0;
+    let aggregateInputBytes = 0;
+    const decodeBudget = new InterfaceBuilderDecodeBudget(MAX_AGGREGATE_DECODE_BYTES);
+    const recordOmittedArchive = (path, reason) => {
+        if (omittedArchives.length < MAX_REPORTED_OMITTED_ARCHIVES)
+            omittedArchives.push({ path, reason });
+        else
+            unreportedOmittedArchives += 1;
+    };
     try {
         for await (const entry of reader.entries(input.signal)) {
             if (entry.kind !== "file" || !isInterfaceBuilderArchive(entry.path))
                 continue;
-            if (attempted >= limits.max_documents) {
+            candidates += 1;
+            if (candidates > limits.max_documents) {
                 omitted += 1;
+                recordOmittedArchive(entry.path, "max_documents");
                 continue;
             }
-            attempted += 1;
             try {
-                const bytes = await readEntry(reader, entry, input.signal);
-                const nib = bytes.subarray(0, 10).toString("ascii") === "NIBArchive"
-                    ? projectNibArchive(decodeNibArchive(bytes))
-                    : null;
+                const remainingInputBytes = MAX_AGGREGATE_INPUT_BYTES - aggregateInputBytes;
+                if (entry.declaredSize !== null &&
+                    entry.declaredSize > remainingInputBytes) {
+                    omitted += 1;
+                    recordOmittedArchive(entry.path, "aggregate_decode_budget_exhausted");
+                    continue;
+                }
+                attempted += 1;
+                const bytes = await readEntry(reader, entry, input.signal, remainingInputBytes);
+                aggregateInputBytes += bytes.length;
+                const isNibArchive = bytes.subarray(0, 10).toString("ascii") === "NIBArchive";
+                let nib = null;
+                let xmlText;
+                if (isNibArchive) {
+                    const documentBudget = new InterfaceBuilderDecodeBudget(decodeBudget.remainingBytes);
+                    nib = projectNibArchive(decodeNibArchive(bytes, documentBudget), documentBudget, limits.max_objects);
+                    decodeBudget.reserve(documentBudget.usedBytes, "NIBArchive representation exceeds the aggregate Interface Builder decode budget");
+                }
+                else {
+                    if (bytes.subarray(0, 8).toString("ascii") !== "bplist00")
+                        xmlText = decodeXmlPlistText(bytes);
+                    const decodedReservation = estimatePropertyListDecodeBytes(bytes, decodeBudget.remainingBytes, xmlText);
+                    decodeBudget.reserve(decodedReservation, "plist representation exceeds the aggregate Interface Builder decode budget");
+                }
                 const { value: raw, omittedPrototypeKeys } = nib === null
-                    ? decodePlist(bytes)
+                    ? decodePlist(bytes, xmlText)
                     : { value: nib.raw, omittedPrototypeKeys: 0 };
                 if (nib !== null && nib.omitted > 0)
                     incompleteHierarchies.set(entry.path, nib.omitted);
@@ -52,6 +88,11 @@ export const analyzeInterfaceBuilderBundle = async (input) => {
             catch (cause) {
                 if (input.signal?.aborted === true)
                     throw cause;
+                if (cause instanceof InterfaceBuilderDecodeBudgetExceeded) {
+                    omitted += 1;
+                    recordOmittedArchive(entry.path, cause.reason);
+                    continue;
+                }
                 invalid.push(`${entry.path}: ${cause instanceof Error ? cause.message : "archive decode failed"}`);
             }
         }
@@ -69,13 +110,17 @@ export const analyzeInterfaceBuilderBundle = async (input) => {
         incompleteHierarchies,
         prototypeKeyOmissions,
         invalid,
+        omittedArchives,
+        unreportedOmittedArchives,
         attempted,
         omitted,
     });
 };
 const finalizeHierarchyCoverage = (result, counts) => {
-    const { incompleteHierarchies, prototypeKeyOmissions, invalid } = counts;
-    const archiveDecodePartial = invalid.length > 0 || prototypeKeyOmissions.size > 0;
+    const { incompleteHierarchies, prototypeKeyOmissions, invalid, omittedArchives, unreportedOmittedArchives, } = counts;
+    const archiveDecodePartial = invalid.length > 0 ||
+        prototypeKeyOmissions.size > 0 ||
+        omittedArchives.length > 0;
     return {
         ...result,
         documents: result.documents.map((document) => ({
@@ -102,11 +147,17 @@ const finalizeHierarchyCoverage = (result, counts) => {
                     status: archiveDecodePartial
                         ? "partial"
                         : "complete",
-                    reason: invalid.length > 0
-                        ? "one_or_more_archives_invalid"
-                        : prototypeKeyOmissions.size > 0
-                            ? "dictionary_entries_omitted"
-                            : null,
+                    reason: omittedArchives.some(({ reason }) => reason === "aggregate_decode_budget_exhausted")
+                        ? "aggregate_decode_budget_exhausted"
+                        : omittedArchives.some(({ reason }) => reason === "max_documents")
+                            ? "document_limit_reached"
+                            : omittedArchives.length > 0
+                                ? "archive_decode_budget_exhausted"
+                                : invalid.length > 0
+                                    ? "one_or_more_archives_invalid"
+                                    : prototypeKeyOmissions.size > 0
+                                        ? "dictionary_entries_omitted"
+                                        : null,
                     examined: counts.attempted,
                     omitted: counts.omitted,
                 },
@@ -130,27 +181,70 @@ const finalizeHierarchyCoverage = (result, counts) => {
                     `Some Interface Builder archives could not be decoded: ${invalid.slice(0, 16).join("; ")}`,
                 ]),
             ...[...prototypeKeyOmissions].map(([path, count]) => `${path}: ${omittedPrototypeKeysLimitation(count)}`),
+            ...omittedArchives.map(({ path, reason }) => `${path}: omitted because ${reason.replaceAll("_", " ")}.`),
+            ...(unreportedOmittedArchives === 0
+                ? []
+                : [
+                    `${unreportedOmittedArchives} additional omitted archive path(s) and their reasons were not retained; reporting is bounded to ${MAX_REPORTED_OMITTED_ARCHIVES} paths.`,
+                ]),
         ],
     };
 };
 /** Project decoded NIB records into the same bounded graph input as ibtool. */
-const projectNibArchive = (archive) => {
+const projectNibArchive = (archive, budget, maxHierarchyNodes) => {
     const byId = new Map(archive.objects.map((object) => [object.id, object]));
+    const normalizedClassNames = new Map();
+    const normalizeClassName = (value) => {
+        const known = normalizedClassNames.get(value);
+        if (known !== undefined)
+            return known;
+        const normalized = value.replace(/\0+$/u, "");
+        normalizedClassNames.set(value, normalized);
+        return normalized;
+    };
+    const decodedStrings = new Map();
+    const decodedString = (objectId, object) => {
+        if (decodedStrings.has(objectId))
+            return decodedStrings.get(objectId) ?? null;
+        const data = object.values["NS.bytes"];
+        if (typeof data !== "object" || data === null || Array.isArray(data)) {
+            decodedStrings.set(objectId, null);
+            return null;
+        }
+        const encoded = data.$nib_data_base64;
+        if (typeof encoded !== "string") {
+            decodedStrings.set(objectId, null);
+            return null;
+        }
+        budget.reserve(64 + encoded.length * 2, "NIBArchive string projection exceeds the aggregate Interface Builder decode budget");
+        const value = Buffer.from(encoded, "base64").toString("utf8");
+        decodedStrings.set(objectId, value);
+        return value;
+    };
+    let projectedFields = 0;
+    for (const object of archive.objects)
+        projectedFields += Object.keys(object.values).length;
+    budget.reserve(archive.objects.length * 128 + projectedFields * 128, "NIBArchive graph projection exceeds the aggregate Interface Builder decode budget");
+    budget.reserve(archive.classes.length * 96, "NIBArchive class projection exceeds the aggregate Interface Builder decode budget");
     const dereference = (value) => {
         if (typeof value !== "object" || value === null || Array.isArray(value))
             return value;
+        const encodedData = value.$nib_data_base64;
+        if (typeof encodedData === "string") {
+            budget.reserveBase64JsonStringOccurrence(encodedData);
+            return value;
+        }
         const ref = value.$nib_object_ref;
         if (typeof ref !== "number")
             return value;
         const target = byId.get(ref);
         if (target === undefined)
             return undefined;
-        if (target.class_name.replace(/\0+$/u, "") === "NSString") {
-            const data = target.values["NS.bytes"];
-            if (typeof data === "object" && data !== null && !Array.isArray(data)) {
-                const encoded = data.$nib_data_base64;
-                if (typeof encoded === "string")
-                    return Buffer.from(encoded, "base64").toString("utf8");
+        if (normalizeClassName(target.class_name) === "NSString") {
+            const string = decodedString(ref, target);
+            if (string !== null) {
+                budget.reserveJsonStringOccurrence(string);
+                return string;
             }
         }
         return { objectID: String(ref) };
@@ -162,26 +256,30 @@ const projectNibArchive = (archive) => {
         if (typeof ref !== "number")
             return null;
         const target = byId.get(ref);
-        const data = target?.values["NS.bytes"];
-        if (target?.class_name.replace(/\0+$/u, "") !== "NSString")
+        if (target === undefined ||
+            normalizeClassName(target.class_name) !== "NSString")
             return null;
-        if (typeof data !== "object" || data === null || Array.isArray(data))
+        const string = decodedString(ref, target);
+        if (string === null)
             return null;
-        const encoded = data.$nib_data_base64;
-        return typeof encoded === "string"
-            ? Buffer.from(encoded, "base64").toString("utf8")
-            : null;
+        budget.reserveJsonStringOccurrence(string);
+        return string;
     };
+    const runtimeClasses = new Map();
     const runtimeClass = (objectId) => {
+        if (runtimeClasses.has(objectId))
+            return runtimeClasses.get(objectId) ?? null;
         const object = byId.get(objectId);
         if (object === undefined)
             return null;
-        const storedClass = object.class_name.replace(/\0+$/u, "");
-        if (storedClass === "NSClassSwapper")
-            return referencedString(object.values.NSClassName) ?? storedClass;
-        return storedClass === "UIClassSwapper"
-            ? (referencedString(object.values.UIClassName) ?? storedClass)
-            : storedClass;
+        const storedClass = normalizeClassName(object.class_name);
+        const resolvedClass = storedClass === "NSClassSwapper"
+            ? (referencedString(object.values.NSClassName) ?? storedClass)
+            : storedClass === "UIClassSwapper"
+                ? (referencedString(object.values.UIClassName) ?? storedClass)
+                : storedClass;
+        runtimeClasses.set(objectId, resolvedClass);
+        return resolvedClass;
     };
     const objects = Object.fromEntries(archive.objects
         .filter((object) => {
@@ -189,22 +287,29 @@ const projectNibArchive = (archive) => {
         return !/^(?:NSObject|NSIBObjectData|NSString|NSMutableString|NSNumber|NSArray|NSMutableArray|NSSet|NSMutableSet|NSDictionary|NSMutableDictionary|NSApplication|NSNib.*Connector|UIRuntime\w*Connection)$/u.test(name);
     })
         .map((object) => {
-        const className = runtimeClass(object.id) ?? object.class_name.replace(/\0+$/u, "");
-        const strings = Object.entries(object.values).flatMap(([key, value]) => {
+        const className = runtimeClass(object.id) ?? normalizeClassName(object.class_name);
+        budget.reserveJsonStringOccurrence(className);
+        let name = className;
+        for (const [key, value] of Object.entries(object.values)) {
+            if (!/(?:title|label|identifier|accessibility|name|contents)/iu.test(key))
+                continue;
             const resolved = dereference(value);
-            return typeof resolved === "string" ? [[key, resolved]] : [];
-        });
-        const name = strings.find(([key]) => /(?:title|label|identifier|accessibility|name|contents)/iu.test(key ?? ""))?.[1] ?? className;
+            if (typeof resolved !== "string")
+                continue;
+            name = resolved;
+            break;
+        }
+        budget.reserveJsonStringOccurrence(name);
         return [
             String(object.id),
             {
                 customClass: className,
                 label: name,
                 objectID: String(object.id),
-                nibValues: Object.fromEntries(Object.entries(object.values).map(([key, value]) => [
-                    key,
-                    dereference(value) ?? null,
-                ])),
+                nibValues: Object.fromEntries(Object.entries(object.values).map(([key, value]) => {
+                    budget.reserveJsonPropertyNameOccurrence(key);
+                    return [key, dereference(value) ?? null];
+                })),
             },
         ];
     }));
@@ -218,7 +323,7 @@ const projectNibArchive = (archive) => {
             : null;
     };
     for (const object of archive.objects) {
-        const className = object.class_name.replace(/\0+$/u, "");
+        const className = normalizeClassName(object.class_name);
         // AppKit connectors use NS-prefixed keys; UIKit's runtime outlet and
         // event connections use UI-prefixed keys with the same roles.
         const uiKit = /^UIRuntime\w*Connection$/u.test(className);
@@ -235,6 +340,7 @@ const projectNibArchive = (archive) => {
             : className.includes("Control") || className.includes("Event")
                 ? "action"
                 : className;
+        budget.reserveJsonStringOccurrence(type);
         const eventMask = values.UIEventMask;
         // The source is the outlet owner or the sending control; the destination
         // is the outlet value or the action target, and a nil target is the
@@ -249,16 +355,26 @@ const projectNibArchive = (archive) => {
         });
     }
     let hierarchyOmitted = 0;
+    let hierarchyNodeCount = 0;
     const hierarchyFor = (objectId, seen, depth) => {
         if (depth > 32 || seen.has(objectId)) {
             hierarchyOmitted += 1;
             return null;
         }
+        if (hierarchyNodeCount >= maxHierarchyNodes) {
+            hierarchyOmitted += 1;
+            return null;
+        }
+        if (!budget.tryReserve(128)) {
+            hierarchyOmitted += 1;
+            return null;
+        }
         const object = byId.get(objectId);
         if (object === undefined) {
             hierarchyOmitted += 1;
             return null;
         }
+        hierarchyNodeCount += 1;
         const nextSeen = new Set(seen).add(objectId);
         const children = [];
         for (const [key, value] of Object.entries(object.values)) {
@@ -288,7 +404,7 @@ const projectNibArchive = (archive) => {
         }
         return { objectID: String(objectId), children };
     };
-    const ibData = archive.objects.find(({ class_name }) => class_name.replace(/\0+$/u, "") === "NSIBObjectData");
+    const ibData = archive.objects.find(({ class_name }) => normalizeClassName(class_name) === "NSIBObjectData");
     const rootId = reference(ibData?.values.NSRoot);
     const hierarchyRoots = rootId === null ? [] : [rootId];
     for (const hierarchyRoot of hierarchyRoots) {
@@ -296,15 +412,19 @@ const projectNibArchive = (archive) => {
         if (root !== null)
             hierarchy.push(root);
     }
-    const viewHierarchy = projectNibViewHierarchy(archive.objects, new Set(Object.keys(objects).map(Number)));
-    const merged = mergeNibHierarchies(hierarchy, viewHierarchy.hierarchy ?? []);
+    const viewHierarchy = projectNibViewHierarchy(archive.objects, new Set(Object.keys(objects).map(Number)), () => budget.tryReserve(128), maxHierarchyNodes);
+    const merged = mergeNibHierarchies(hierarchy, viewHierarchy.hierarchy ?? [], () => budget.tryReserve(96), maxHierarchyNodes);
     return {
         omitted: viewHierarchy.omitted + hierarchyOmitted + merged.omitted,
         raw: jsonValueSchema.parse({
             "com.apple.ibtool.document.objects": objects,
             "com.apple.ibtool.document.connections": connections,
             "com.apple.ibtool.document.hierarchy": merged.hierarchy,
-            "com.apple.ibtool.document.classes": Object.fromEntries(archive.classes.map((name) => [name.replace(/\0+$/u, ""), {}])),
+            "com.apple.ibtool.document.classes": Object.fromEntries(archive.classes.map((name) => {
+                const className = normalizeClassName(name);
+                budget.reserveJsonPropertyNameOccurrence(className);
+                return [className, {}];
+            })),
         }),
     };
 };
@@ -312,9 +432,9 @@ const isInterfaceBuilderArchive = (path) => {
     const lower = path.toLowerCase();
     return lower.endsWith(".nib") || lower.endsWith("/objects.nib");
 };
-const readEntry = async (reader, entry, signal) => {
-    if (entry.declaredSize !== null && entry.declaredSize > MAX_DOCUMENT_BYTES)
-        throw new RangeError("archive exceeds the 64 MiB per-document decode limit");
+const readEntry = async (reader, entry, signal, maxInputBytes = MAX_AGGREGATE_INPUT_BYTES) => {
+    if (entry.declaredSize !== null && entry.declaredSize > maxInputBytes)
+        throw new InterfaceBuilderDecodeBudgetExceeded("aggregate_decode_budget_exhausted", "archive exceeds the aggregate Interface Builder decode budget");
     const stream = await reader.open(entry, signal);
     const chunks = [];
     let length = 0;
@@ -323,18 +443,18 @@ const readEntry = async (reader, entry, signal) => {
             ? chunk
             : Buffer.from(chunk);
         length += bytes.length;
-        if (length > MAX_DOCUMENT_BYTES) {
+        if (length > maxInputBytes) {
             stream.destroy();
-            throw new RangeError("archive exceeded the 64 MiB per-document decode limit");
+            throw new InterfaceBuilderDecodeBudgetExceeded("aggregate_decode_budget_exhausted", "archive exceeded the aggregate Interface Builder decode budget");
         }
         chunks.push(bytes);
     }
     return Buffer.concat(chunks, length);
 };
 /** Project decoded plist data and dates while retaining omitted-key coverage. */
-const decodePlist = (bytes) => {
+const decodePlist = (bytes, xmlText) => {
     const { value, omittedPrototypeKeys } = bytes.subarray(0, 8).toString("ascii") === "bplist00"
         ? { value: parseBinary(bytes), omittedPrototypeKeys: 0 }
-        : parseXmlPropertyList(bytes.toString("utf8"));
+        : parseXmlPropertyList(xmlText ?? decodeXmlPlistText(bytes));
     return { value: projectPlistValue(value).value, omittedPrototypeKeys };
 };

package/dist/artifacts/apple/InterfaceBuilderDecodeBudget.js

@@ -0,0 +1,195 @@
+import { decodeXmlPlistText } from "../../domain/propertyListXmlText.js";
+/** A named resource-limit failure that keeps budget exhaustion out of decode errors. */
+export class InterfaceBuilderDecodeBudgetExceeded extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.reason = reason;
+        this.name = "InterfaceBuilderDecodeBudgetExceeded";
+    }
+}
+/** Shared byte budget for decoder records and projected archive data. */
+export class InterfaceBuilderDecodeBudget {
+    #initialBytes;
+    #remainingBytes;
+    constructor(maxBytes) {
+        this.#initialBytes = maxBytes;
+        this.#remainingBytes = maxBytes;
+    }
+    /** Representation bytes still available for the current inspection. */
+    get remainingBytes() {
+        return this.#remainingBytes;
+    }
+    /** Representation bytes reserved so far. */
+    get usedBytes() {
+        return this.#initialBytes - this.#remainingBytes;
+    }
+    /** Reserve representation bytes before allocation, or report exhaustion. */
+    reserve(bytes, message) {
+        if (!Number.isSafeInteger(bytes) ||
+            bytes < 0 ||
+            bytes > this.#remainingBytes)
+            throw new InterfaceBuilderDecodeBudgetExceeded("aggregate_decode_budget_exhausted", message);
+        this.#remainingBytes -= bytes;
+    }
+    /** Reserve an upper bound for one JSON-serialized string occurrence. */
+    reserveJsonStringOccurrence(value) {
+        // JSON escaping uses at most six ASCII bytes per UTF-16 code unit, plus
+        // quotes. Count occurrences even when the source string is shared.
+        this.reserve(value.length * 6 + 2, "projected JSON strings exceed the aggregate Interface Builder decode budget");
+    }
+    /** Reserve the exact JSON string length for a base64 value from Buffer. */
+    reserveBase64JsonStringOccurrence(value) {
+        // Buffer's base64 alphabet contains no JSON-escaped characters.
+        this.reserve(value.length + 2, "projected NIB base64 values exceed the aggregate Interface Builder decode budget");
+    }
+    /** Reserve an upper bound for one JSON object property name occurrence. */
+    reserveJsonPropertyNameOccurrence(value) {
+        this.reserve(value.length * 6 + 3, "projected JSON property names exceed the aggregate Interface Builder decode budget");
+    }
+    /** Reserve bytes for an optional projection without throwing on exhaustion. */
+    tryReserve(bytes) {
+        if (!Number.isSafeInteger(bytes) ||
+            bytes < 0 ||
+            bytes > this.#remainingBytes)
+            return false;
+        this.#remainingBytes -= bytes;
+        return true;
+    }
+}
+/** Preflight the representation created by the pinned plist decoder. */
+export const estimatePropertyListDecodeBytes = (bytes, maxBytes, xmlText) => {
+    const estimate = bytes.subarray(0, 8).toString("ascii") === "bplist00"
+        ? estimateBinaryPlistExpansion(bytes, maxBytes)
+        : estimateXmlPlistExpansion(bytes, maxBytes, xmlText);
+    if (estimate > maxBytes)
+        throw new InterfaceBuilderDecodeBudgetExceeded("aggregate_decode_budget_exhausted", "plist representation exceeds the aggregate Interface Builder decode budget");
+    return estimate;
+};
+const estimateXmlPlistExpansion = (bytes, maxBytes, xmlText) => {
+    const xml = xmlText ?? decodeXmlPlistText(bytes);
+    if (/<!DOCTYPE\b[^>]*\[/iu.test(xml))
+        throw new InterfaceBuilderDecodeBudgetExceeded("aggregate_decode_budget_exhausted", "XML plist internal entity expansion exceeds the aggregate Interface Builder decode budget");
+    const elementPattern = /<!--[^]*?-->|<!\[CDATA\[[^]*?\]\]>|<!DOCTYPE[^>]*>|<\?[^]*?\?>|<\/?[A-Za-z][^>]*>/giu;
+    const decodedSourceBytes = xml.length * 2;
+    let elementCount = 0;
+    let xmlDepth = 0;
+    for (const match of xml.matchAll(elementPattern)) {
+        const token = match[0] ?? "";
+        if (token.startsWith("<!--") ||
+            token.startsWith("<![CDATA[") ||
+            token.startsWith("<!DOCTYPE") ||
+            token.startsWith("<?"))
+            continue;
+        elementCount += 1;
+        if (token.startsWith("</"))
+            xmlDepth -= 1;
+        else if (!token.endsWith("/>")) {
+            xmlDepth += 1;
+            if (xmlDepth > 128)
+                throw new InterfaceBuilderDecodeBudgetExceeded("aggregate_decode_budget_exhausted", "XML plist nesting exceeds the aggregate Interface Builder decode budget");
+        }
+        if (decodedSourceBytes * 2 + elementCount * 128 > maxBytes)
+            return maxBytes + 1;
+    }
+    return decodedSourceBytes * 2 + elementCount * 128;
+};
+/** Count every expanded binary-plist reference before calling plist.parseBinary. */
+const estimateBinaryPlistExpansion = (bytes, maxBytes) => {
+    if (bytes.length < 40)
+        throw new TypeError("binary plist trailer is truncated");
+    const trailer = bytes.length - 32;
+    const offsetSize = bytes[trailer + 6] ?? 0;
+    const referenceSize = bytes[trailer + 7] ?? 0;
+    if (![1, 2, 4, 8].includes(offsetSize) ||
+        ![1, 2, 4, 8].includes(referenceSize))
+        throw new TypeError("binary plist trailer integer sizes are invalid");
+    const readInteger = (offset, size) => {
+        if (offset < 0 || size < 1 || offset + size > bytes.length)
+            return -1;
+        let value = 0;
+        for (let index = 0; index < size; index += 1)
+            value = value * 256 + (bytes[offset + index] ?? 0);
+        return Number.isSafeInteger(value) ? value : -1;
+    };
+    const objectCount = readInteger(trailer + 8, 8);
+    const topObject = readInteger(trailer + 16, 8);
+    const offsetTable = readInteger(trailer + 24, 8);
+    if (objectCount < 1 ||
+        topObject < 0 ||
+        topObject >= objectCount ||
+        offsetTable < 8 ||
+        offsetTable + objectCount * offsetSize > trailer)
+        throw new TypeError("binary plist trailer or object table is invalid");
+    let estimate = bytes.length * 2 + objectCount * 16;
+    if (estimate > maxBytes)
+        throw new InterfaceBuilderDecodeBudgetExceeded("aggregate_decode_budget_exhausted", "binary plist object table exceeds the aggregate Interface Builder decode budget");
+    const active = new Set();
+    const pending = [
+        { object: topObject, depth: 0, exit: false },
+    ];
+    let pendingObjectCount = 1;
+    while (pending.length > 0) {
+        const entry = pending.pop();
+        if (entry === undefined)
+            break;
+        if (entry.exit) {
+            active.delete(entry.object);
+            continue;
+        }
+        pendingObjectCount -= 1;
+        if (entry.depth > 128)
+            throw new InterfaceBuilderDecodeBudgetExceeded("aggregate_decode_budget_exhausted", "binary plist nesting exceeds the aggregate Interface Builder decode budget");
+        if (active.has(entry.object))
+            throw new InterfaceBuilderDecodeBudgetExceeded("aggregate_decode_budget_exhausted", "binary plist reference cycle exceeds the aggregate Interface Builder decode budget");
+        estimate += 96;
+        if (estimate > maxBytes)
+            throw new InterfaceBuilderDecodeBudgetExceeded("aggregate_decode_budget_exhausted", "binary plist reference expansion exceeds the aggregate Interface Builder decode budget");
+        const offset = readInteger(offsetTable + entry.object * offsetSize, offsetSize);
+        if (offset < 8 || offset >= offsetTable)
+            throw new TypeError("binary plist object offset is invalid");
+        const marker = bytes[offset] ?? 0;
+        const type = marker >> 4;
+        let size = marker & 0x0f;
+        let cursor = offset + 1;
+        if (size === 0x0f && type !== 0 && type !== 8) {
+            const extMarker = bytes[cursor] ?? 0;
+            if (extMarker >> 4 !== 1 || (extMarker & 0x0f) > 3)
+                throw new TypeError("binary plist extended object size is invalid");
+            cursor += 1;
+            const integerSize = 1 << (extMarker & 0x0f);
+            size = readInteger(cursor, integerSize);
+            cursor += integerSize;
+            if (size < 0 || cursor > offsetTable)
+                throw new TypeError("binary plist extended object size is invalid");
+        }
+        if (type === 4 || type === 5 || type === 6) {
+            const byteLength = type === 6 ? size * 2 : size;
+            if (cursor + byteLength > offsetTable)
+                throw new TypeError("binary plist scalar object is truncated");
+            estimate += type === 4 ? size + 4 * Math.ceil(size / 3) : byteLength * 2;
+            if (estimate > maxBytes)
+                throw new InterfaceBuilderDecodeBudgetExceeded("aggregate_decode_budget_exhausted", "binary plist scalar expansion exceeds the aggregate Interface Builder decode budget");
+            continue;
+        }
+        if (type !== 10 && type !== 13)
+            continue;
+        const childCount = type === 13 ? size * 2 : size;
+        const refsEnd = cursor + childCount * referenceSize;
+        if (!Number.isSafeInteger(refsEnd) || refsEnd > offsetTable)
+            throw new TypeError("binary plist reference table is truncated");
+        const availableNodes = Math.floor((maxBytes - estimate) / 96);
+        if (childCount > availableNodes - pendingObjectCount)
+            throw new InterfaceBuilderDecodeBudgetExceeded("aggregate_decode_budget_exhausted", "binary plist reference expansion exceeds the aggregate Interface Builder decode budget");
+        active.add(entry.object);
+        pending.push({ object: entry.object, depth: entry.depth, exit: true });
+        for (let index = childCount - 1; index >= 0; index -= 1) {
+            const reference = readInteger(cursor + index * referenceSize, referenceSize);
+            if (reference < 0 || reference >= objectCount)
+                throw new TypeError("binary plist reference is invalid");
+            pending.push({ object: reference, depth: entry.depth + 1, exit: false });
+        }
+        pendingObjectCount += childCount;
+    }
+    return estimate;
+};