rea-agents 5.0.0 → 6.1.0

package/dist/artifacts/apple/KeyedArchiveReader.js

@@ -1,49 +1,55 @@
 import { createHash } from "node:crypto";
-import { TextDecoder } from "node:util";
 import { parseBinary } from "plist";
 import { z } from "zod";
+import { AnalysisInputError } from "../../domain/analysisErrorCore.js";
 import { projectPlistValue } from "../../domain/apple/plistValue.js";
+import { createPlistNumberProjection } from "../../domain/apple/plistNumbers.js";
+import { binaryPlistNumberLiterals, xmlPlistNumberLiterals, } from "./PlistNumberLiterals.js";
 import { omittedPrototypeKeysLimitation, parseXmlPropertyList, } from "../../domain/propertyListKeys.js";
 import { keyedArchiveInputSchema, keyedArchiveResultSchema, projectKeyedArchive, } from "../../domain/apple/keyedArchive.js";
 import { DirectoryArtifactReader } from "../DirectoryArtifactReader.js";
 import { ArtifactReaderFailure } from "../ArtifactReader.js";
+import { decodeXmlPlistText } from "../../domain/propertyListXmlText.js";
 const MAX_BYTES = 64 * 1024 * 1024;
 /** Parse inert plist bytes, preserving data and dates with explicit typed values. */
 export const decodeKeyedArchiveBytes = (bytes, selection) => {
     if (bytes.length > MAX_BYTES)
         throw new RangeError("Keyed archive exceeds 64 MiB");
+    if (bytes.subarray(0, 10).toString("ascii") === "NIBArchive")
+        throw new TypeError("Selected file is a compiled NIBArchive, not a Foundation plist archive; decode it with decode_interface_builder");
     const binary = bytes.subarray(0, 8).toString("ascii") === "bplist00";
+    const xmlText = binary ? undefined : decodeXmlPlistText(bytes);
     const parsed = binary
         ? { value: parseBinary(bytes), omittedPrototypeKeys: 0 }
-        : parseXmlPropertyList(decodeXmlPlistText(bytes));
+        : parseXmlPropertyList(xmlText ?? "");
     const graph = projectKeyedArchive(normalizePlist(parsed.value), selection);
+    const numbers = createPlistNumberProjection(binary
+        ? binaryPlistNumberLiterals(bytes)
+        : xmlPlistNumberLiterals(xmlText ?? ""));
+    // Classify the serialized graph before projecting values to typed decimals.
+    // Numeric IDs, node kinds, references and pagination retain their original meaning.
+    const roots = Object.fromEntries(Object.entries(graph.roots).map(([name, value]) => [
+        name,
+        numbers.project(value),
+    ]));
+    const objects = graph.objects.map((object) => ({
+        ...object,
+        value: numbers.project(object.value),
+    }));
     return {
         archive_format: binary ? "binary-plist" : "xml-plist",
         ...graph,
+        roots,
+        objects,
         limitations: [
             ...graph.limitations,
+            ...numbers.limitations(),
             ...(parsed.omittedPrototypeKeys === 0
                 ? []
                 : [omittedPrototypeKeysLimitation(parsed.omittedPrototypeKeys)]),
         ],
     };
 };
-const decodeXmlPlistText = (bytes) => {
-    const encoding = bytes[0] === 0xff && bytes[1] === 0xfe
-        ? "utf-16le"
-        : bytes[0] === 0xfe && bytes[1] === 0xff
-            ? "utf-16be"
-            : "utf-8";
-    const text = new TextDecoder(encoding, { fatal: true }).decode(bytes);
-    const declared = /^<\?xml\s[^?]*\bencoding\s*=\s*["']([^"']+)["']/u
-        .exec(text)?.[1]
-        ?.toLowerCase();
-    if (declared !== undefined &&
-        ((encoding !== "utf-8" && declared !== encoding && declared !== "utf-16") ||
-            (encoding === "utf-8" && declared.startsWith("utf-16"))))
-        throw new TypeError("XML encoding declaration disagrees with its bytes");
-    return text;
-};
 const normalizePlist = (value) => {
     const projected = projectPlistValue(value);
     if (projected.unknownRealCount > 0)
@@ -57,14 +63,16 @@ export const inspectBundleKeyedArchive = async (input) => {
         selected.path
             .split("/")
             .some((part) => part === ".." || part === "." || part.length === 0))
-        throw new ArtifactReaderFailure("path", "Archive path must be a canonical relative bundle path");
+        throw archivePathError("invalid_format", selected.path === "."
+            ? "Select a keyed archive path relative to the active app bundle."
+            : `Archive path must be a canonical relative bundle path without empty, '.', or '..' segments: ${selected.path}`);
     const reader = new DirectoryArtifactReader(input.bundlePath);
     try {
         for await (const entry of reader.entries(input.signal)) {
             if (entry.path !== selected.path)
                 continue;
             if (entry.kind !== "file")
-                throw new ArtifactReaderFailure("path", "Archive must be a regular file, not a symlink or directory");
+                throw archivePathError("invalid_value", `Archive path selects a ${entry.kind}, not a regular file: ${selected.path}`);
             if ((entry.declaredSize ?? 0) > MAX_BYTES)
                 throw new ArtifactReaderFailure("limit", "Keyed archive exceeds 64 MiB");
             const stream = await reader.open(entry, input.signal);
@@ -93,12 +101,18 @@ export const inspectBundleKeyedArchive = async (input) => {
                 });
             }
             catch (cause) {
-                throw new ArtifactReaderFailure(cause instanceof RangeError ? "limit" : "format", "Cannot decode selected Foundation keyed archive", { cause });
+                if (cause instanceof AnalysisInputError)
+                    throw cause;
+                throw new ArtifactReaderFailure(cause instanceof RangeError ? "limit" : "format", `Cannot decode selected Foundation keyed archive: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
             }
         }
-        throw new ArtifactReaderFailure("path", `Archive not found in bundle: ${selected.path}`);
+        throw archivePathError("invalid_value", `No regular file exists at ${selected.path} in the active app bundle.`);
     }
     finally {
         await reader.close();
     }
 };
+/** A caller-selected archive path, not the artifact, failed its constraint. */
+const archivePathError = (reason, message) => new AnalysisInputError("inspect_keyed_archive", undefined, [
+    { path: ["path"], reason, message },
+]);

package/dist/artifacts/apple/MachoLoadCommandReader.js

@@ -0,0 +1,355 @@
+import { readFatSliceDeclarations, validateFatSlice, } from "../../domain/apple/machoContainer.js";
+/** Load commands larger than this are refused instead of buffered. */
+export const MAX_LOAD_COMMAND_BYTES = 16 * 1024 * 1024;
+/** Target opening accepts up to 128 FAT records; Java class files share the FAT magic. */
+const MAX_FAT_ARCHITECTURES = 128;
+/** CPU types of real Mach-O slices (x86, x86_64, arm, arm64, arm64_32, ppc, ppc64). */
+const KNOWN_CPU_TYPES = [
+    7, 0x01000007, 12, 0x0100000c, 0x0200000c, 18, 0x01000012,
+];
+const MH_MAGIC = 0xfeedface;
+const MH_MAGIC_64 = 0xfeedfacf;
+const MH_CIGAM = 0xcefaedfe;
+const MH_CIGAM_64 = 0xcffaedfe;
+const FAT_MAGIC = 0xcafebabe;
+const FAT_MAGIC_64 = 0xcafebabf;
+const FAT_CIGAM = 0xbebafeca;
+const FAT_CIGAM_64 = 0xbfbafeca;
+const LC_ID_DYLIB = 0xd;
+const LC_LOAD_DYLIB = 0xc;
+const LC_LOAD_WEAK_DYLIB = 0x80000018;
+const LC_REEXPORT_DYLIB = 0x8000001f;
+const LC_LAZY_LOAD_DYLIB = 0x20;
+const LC_LOAD_UPWARD_DYLIB = 0x80000023;
+const LC_RPATH = 0x8000001c;
+const LC_DYLD_ENVIRONMENT = 0x27;
+const LC_CODE_SIGNATURE = 0x1d;
+const LC_VERSION_MIN_MACOSX = 0x24;
+const LC_VERSION_MIN_IPHONEOS = 0x25;
+const LC_VERSION_MIN_TVOS = 0x2f;
+const LC_VERSION_MIN_WATCHOS = 0x30;
+const LC_BUILD_VERSION = 0x32;
+/** `mach-o/loader.h` `dylib_use_command`: `nameoff == 28` and this marker. */
+const DYLIB_USE_MARKER = 0x1a741800;
+const DYLIB_USE_WEAK_LINK = 0x1;
+const DYLIB_USE_REEXPORT = 0x2;
+const DYLIB_USE_UPWARD = 0x4;
+const DYLIB_USE_DELAYED_INIT = 0x8;
+const DEPENDENCY_COMMANDS = new Map([
+    [LC_LOAD_DYLIB, "LC_LOAD_DYLIB"],
+    [LC_LOAD_WEAK_DYLIB, "LC_LOAD_WEAK_DYLIB"],
+    [LC_REEXPORT_DYLIB, "LC_REEXPORT_DYLIB"],
+    [LC_LAZY_LOAD_DYLIB, "LC_LAZY_LOAD_DYLIB"],
+    [LC_LOAD_UPWARD_DYLIB, "LC_LOAD_UPWARD_DYLIB"],
+]);
+/** Malformed or unsupported structure found while decoding one image. */
+class MachoFormatIssue extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+/** Report whether the first bytes carry a Mach-O or FAT magic number. */
+export const hasMachoMagic = (head) => {
+    if (head.byteLength < 4)
+        return false;
+    const magic = new DataView(head.buffer, head.byteOffset, head.byteLength).getUint32(0, false);
+    return [
+        MH_MAGIC,
+        MH_MAGIC_64,
+        MH_CIGAM,
+        MH_CIGAM_64,
+        FAT_MAGIC,
+        FAT_MAGIC_64,
+        FAT_CIGAM,
+        FAT_CIGAM_64,
+    ].includes(magic);
+};
+/** Decode every slice's dylib-loading load commands without reading code. */
+export const readMachoImage = async (readAt, size) => {
+    try {
+        const head = await readAt(0, Math.min(size, 8));
+        if (head.byteLength < 8)
+            // A recognized magic with no room for a header is a truncated image.
+            return hasMachoMagic(head)
+                ? { status: "malformed", reason: "Mach-O header is truncated" }
+                : { status: "not-mach-o" };
+        const view = viewOf(head);
+        const magic = view.getUint32(0, false);
+        if ([FAT_MAGIC, FAT_MAGIC_64, FAT_CIGAM, FAT_CIGAM_64].includes(magic)) {
+            // FAT headers are big-endian; the swapped magics store them little-endian.
+            const littleEndian = magic === FAT_CIGAM || magic === FAT_CIGAM_64;
+            const count = view.getUint32(4, littleEndian);
+            const wide = magic === FAT_MAGIC_64 || magic === FAT_CIGAM_64;
+            // A Java class file's nonzero major version reads as the count, so an
+            // empty architecture table can only be a malformed universal header.
+            if (count === 0)
+                return {
+                    status: "malformed",
+                    reason: "FAT header declares no architectures",
+                };
+            if (count > MAX_FAT_ARCHITECTURES || 8 + count * (wide ? 32 : 20) > size)
+                return { status: "not-mach-o" };
+            const tableBytes = await readExact(readAt, 8, count * (wide ? 32 : 20), "FAT table");
+            const declarations = readFatSliceDeclarations(tableBytes, {
+                count,
+                wide,
+                littleEndian,
+            });
+            if (declarations.status !== "parsed")
+                throw new MachoFormatIssue("malformed", declarations.reason);
+            // A Java class file's version fields read as a FAT count; its "table" names no CPU.
+            if (!declarations.slices.some(({ cpuType }) => KNOWN_CPU_TYPES.includes(cpuType))) {
+                let hasMachOSliceHeader = false;
+                for (const declaration of declarations.slices) {
+                    if (validateFatSlice(declaration, size, 8 + count * (wide ? 32 : 20)) !== null)
+                        continue;
+                    const bytes = await readAt(declaration.offset, 4);
+                    if (bytes.byteLength < 4)
+                        continue;
+                    const sliceMagic = viewOf(bytes).getUint32(0, false);
+                    if ([MH_MAGIC, MH_MAGIC_64, MH_CIGAM, MH_CIGAM_64].includes(sliceMagic)) {
+                        hasMachOSliceHeader = true;
+                        break;
+                    }
+                }
+                if (!hasMachOSliceHeader)
+                    return { status: "not-mach-o" };
+            }
+            return {
+                status: "parsed",
+                slices: await readFatSlices(readAt, size, 8 + count * (wide ? 32 : 20), declarations.slices),
+            };
+        }
+        if (magic === MH_CIGAM || magic === MH_CIGAM_64)
+            return { status: "parsed", slices: [await readSlice(readAt, 0, size)] };
+        if (magic === MH_MAGIC || magic === MH_MAGIC_64)
+            throw new MachoFormatIssue("unsupported", "big-endian Mach-O images are not supported");
+        return { status: "not-mach-o" };
+    }
+    catch (cause) {
+        if (cause instanceof MachoFormatIssue)
+            return { status: cause.status, reason: cause.message };
+        throw cause;
+    }
+};
+const readFatSlices = async (readAt, size, tableEnd, declarations) => {
+    const slices = [];
+    for (const declaration of declarations) {
+        const { index, offset, size: length, cpuType, cpuSubtype } = declaration;
+        const rangeIssue = validateFatSlice(declaration, size, tableEnd);
+        if (rangeIssue !== null)
+            throw new MachoFormatIssue(rangeIssue.includes("unsupported") ? "unsupported" : "malformed", rangeIssue);
+        const slice = await readSlice(readAt, offset, length, {
+            fatCpuType: cpuType,
+            fatCpuSubtype: cpuSubtype,
+            alignmentExponent: declaration.alignmentExponent,
+        });
+        const identityIssue = validateFatSlice(declaration, size, tableEnd, {
+            cpuType: slice.cpu_type,
+            cpuSubtype: slice.cpu_subtype,
+        });
+        if (identityIssue !== null)
+            throw new MachoFormatIssue("malformed", identityIssue);
+        slices.push(slice);
+    }
+    return slices;
+};
+const readSlice = async (readAt, base, length, fat = null) => {
+    const header = viewOf(await readExact(readAt, base, 28, "Mach-O header"));
+    const magic = header.getUint32(0, true);
+    if (magic === MH_MAGIC_64 || magic === MH_MAGIC) {
+        const wide = magic === MH_MAGIC_64;
+        const headerSize = wide ? 32 : 28;
+        const commandCount = header.getUint32(16, true);
+        const commandBytes = header.getUint32(20, true);
+        if (commandBytes > MAX_LOAD_COMMAND_BYTES)
+            throw new MachoFormatIssue("unsupported", `load commands occupy ${commandBytes} bytes, above the ${MAX_LOAD_COMMAND_BYTES}-byte limit`);
+        if (headerSize + commandBytes > length)
+            throw new MachoFormatIssue("malformed", "load commands extend beyond the Mach-O slice");
+        const commands = await readExact(readAt, base + headerSize, commandBytes, "load commands");
+        const slice = decodeCommands(commands, {
+            wide,
+            cpuType: header.getUint32(4, true),
+            cpuSubtype: header.getUint32(8, true),
+            fileType: header.getUint32(12, true),
+            commandCount,
+            sliceOffset: base,
+            sliceSize: length,
+            fatCpuType: fat?.fatCpuType ?? null,
+            fatCpuSubtype: fat?.fatCpuSubtype ?? null,
+            fatAlignmentExponent: fat?.alignmentExponent ?? null,
+        });
+        const distinctPlatforms = [...new Set(slice.platforms)];
+        slice.platform =
+            distinctPlatforms.length === 1 ? (distinctPlatforms[0] ?? null) : null;
+        return slice;
+    }
+    throw new MachoFormatIssue(magic === swap(MH_MAGIC) || magic === swap(MH_MAGIC_64)
+        ? "unsupported"
+        : "malformed", magic === swap(MH_MAGIC) || magic === swap(MH_MAGIC_64)
+        ? "big-endian Mach-O slices are not supported"
+        : `slice at offset ${base} has no Mach-O header`);
+};
+const decodeCommands = (bytes, header) => {
+    // loader.h: load commands are 8-byte aligned in 64-bit images, 4 in 32-bit.
+    const alignment = header.wide ? 8 : 4;
+    const view = viewOf(bytes);
+    const slice = {
+        architecture: architectureName(header.cpuType, header.cpuSubtype),
+        slice_offset: header.sliceOffset,
+        slice_size: header.sliceSize,
+        cpu_type: header.cpuType,
+        cpu_subtype: header.cpuSubtype,
+        fat_cpu_type: header.fatCpuType,
+        fat_cpu_subtype: header.fatCpuSubtype,
+        fat_alignment_exponent: header.fatAlignmentExponent,
+        file_type: fileTypeName(header.fileType),
+        file_type_code: header.fileType,
+        platform: null,
+        platforms: [],
+        install_name: null,
+        dependencies: [],
+        rpaths: [],
+        dyld_environment: [],
+        code_signature_present: false,
+    };
+    let offset = 0;
+    for (let index = 0; index < header.commandCount; index++) {
+        if (offset + 8 > bytes.byteLength)
+            throw new MachoFormatIssue("malformed", `load command ${index} starts beyond sizeofcmds`);
+        const command = view.getUint32(offset, true);
+        const size = view.getUint32(offset + 4, true);
+        if (size < 8 || size % alignment !== 0 || offset + size > bytes.byteLength)
+            throw new MachoFormatIssue("malformed", `load command ${index} at offset ${offset} has invalid cmdsize ${size}`);
+        const body = bytes.subarray(offset, offset + size);
+        decodeCommand(command, body, index, slice);
+        offset += size;
+    }
+    if (offset !== bytes.byteLength)
+        throw new MachoFormatIssue("malformed", `load commands declare ${header.commandCount} commands but sizeofcmds holds ${bytes.byteLength} bytes`);
+    return slice;
+};
+const decodeCommand = (command, body, index, slice) => {
+    if (command === LC_ID_DYLIB) {
+        slice.install_name = commandString(body, 24, index);
+        return;
+    }
+    if (command === LC_RPATH) {
+        slice.rpaths.push(commandString(body, 12, index));
+        return;
+    }
+    if (command === LC_DYLD_ENVIRONMENT) {
+        slice.dyld_environment.push(commandString(body, 12, index));
+        return;
+    }
+    if (command === LC_CODE_SIGNATURE) {
+        // linkedit_data_command: cmd, cmdsize, dataoff, datasize.
+        if (body.byteLength < 16)
+            throw new MachoFormatIssue("malformed", `load command ${index} is too short for LC_CODE_SIGNATURE`);
+        slice.code_signature_present = true;
+        return;
+    }
+    if (command === LC_BUILD_VERSION) {
+        if (body.byteLength < 24)
+            throw new MachoFormatIssue("malformed", `load command ${index} is too short for LC_BUILD_VERSION`);
+        const platform = viewOf(body).getUint32(8, true);
+        slice.platforms.push(platform);
+        return;
+    }
+    const legacyPlatform = new Map([
+        [LC_VERSION_MIN_MACOSX, 1],
+        [LC_VERSION_MIN_IPHONEOS, 2],
+        [LC_VERSION_MIN_TVOS, 3],
+        [LC_VERSION_MIN_WATCHOS, 4],
+    ]).get(command);
+    if (legacyPlatform !== undefined) {
+        if (body.byteLength < 16)
+            throw new MachoFormatIssue("malformed", `load command ${index} is too short for a version-min command`);
+        slice.platforms.push(legacyPlatform);
+        return;
+    }
+    const name = DEPENDENCY_COMMANDS.get(command);
+    if (name !== undefined)
+        slice.dependencies.push(decodeDependency(name, body, index));
+};
+const decodeDependency = (command, body, index) => {
+    if (body.byteLength < 24)
+        throw new MachoFormatIssue("malformed", `load command ${index} is too short for a dylib command`);
+    const view = viewOf(body);
+    const nameOffset = view.getUint32(8, true);
+    const usesFlags = nameOffset === 28 &&
+        body.byteLength >= 28 &&
+        view.getUint32(12, true) === DYLIB_USE_MARKER;
+    const flags = usesFlags ? view.getUint32(24, true) : 0;
+    return {
+        command,
+        encoding: usesFlags ? "dylib_use_command" : "dylib_command",
+        install_name: commandString(body, usesFlags ? 28 : 24, index),
+        weak: command === "LC_LOAD_WEAK_DYLIB" || (flags & DYLIB_USE_WEAK_LINK) !== 0,
+        upward: command === "LC_LOAD_UPWARD_DYLIB" || (flags & DYLIB_USE_UPWARD) !== 0,
+        reexport: command === "LC_REEXPORT_DYLIB" || (flags & DYLIB_USE_REEXPORT) !== 0,
+        delayed_init: (flags & DYLIB_USE_DELAYED_INIT) !== 0,
+        current_version: version(view.getUint32(16, true)),
+        compatibility_version: version(view.getUint32(20, true)),
+    };
+};
+/** NUL-terminated UTF-8 string at a `lc_str` offset inside one command. */
+const commandString = (body, minimumOffset, index) => {
+    if (body.byteLength < 12)
+        throw new MachoFormatIssue("malformed", `load command ${index} is too short to hold a string offset`);
+    const offset = viewOf(body).getUint32(8, true);
+    if (offset < minimumOffset || offset >= body.byteLength)
+        throw new MachoFormatIssue("malformed", `load command ${index} has string offset ${offset} outside the command`);
+    const end = body.indexOf(0, offset);
+    if (end < 0)
+        throw new MachoFormatIssue("malformed", `load command ${index} has an unterminated string`);
+    try {
+        return new TextDecoder("utf-8", { fatal: true }).decode(body.subarray(offset, end));
+    }
+    catch {
+        throw new MachoFormatIssue("malformed", `load command ${index} has a string that is not UTF-8`);
+    }
+};
+const readExact = async (readAt, offset, length, label) => {
+    const bytes = await readAt(offset, length);
+    if (bytes.byteLength < length)
+        throw new MachoFormatIssue("malformed", `${label} is truncated`);
+    return bytes;
+};
+const CPU_ARCH_ABI64 = 0x01000000;
+const CPU_ARCH_ABI64_32 = 0x02000000;
+const CPU_TYPE_X86 = 7;
+const CPU_TYPE_ARM = 12;
+const CPU_SUBTYPE_MASK = 0xff000000;
+const CPU_SUBTYPE_ARM64E = 2;
+const CPU_SUBTYPE_X86_64_H = 8;
+const architectureName = (cpuType, cpuSubtype) => {
+    const subtype = cpuSubtype & ~CPU_SUBTYPE_MASK;
+    if (cpuType === (CPU_TYPE_ARM | CPU_ARCH_ABI64))
+        return subtype === CPU_SUBTYPE_ARM64E ? "arm64e" : "arm64";
+    if (cpuType === (CPU_TYPE_ARM | CPU_ARCH_ABI64_32))
+        return "arm64_32";
+    if (cpuType === (CPU_TYPE_X86 | CPU_ARCH_ABI64))
+        return subtype === CPU_SUBTYPE_X86_64_H ? "x86_64h" : "x86_64";
+    if (cpuType === CPU_TYPE_X86)
+        return "i386";
+    if (cpuType === CPU_TYPE_ARM)
+        return "arm";
+    return `cpu-${cpuType.toString(16)}`;
+};
+const fileTypeName = (fileType) => fileType === 2
+    ? "execute"
+    : fileType === 6
+        ? "dylib"
+        : fileType === 8
+            ? "bundle"
+            : "other";
+const version = (value) => `${value >>> 16}.${(value >>> 8) & 0xff}.${value & 0xff}`;
+const swap = (value) => (((value & 0xff) << 24) |
+    ((value & 0xff00) << 8) |
+    ((value >>> 8) & 0xff00) |
+    (value >>> 24)) >>>
+    0;
+const viewOf = (bytes) => new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);

package/dist/artifacts/apple/NibArchive.js

@@ -1,8 +1,9 @@
 import { TextDecoder } from "node:util";
+import { InterfaceBuilderDecodeBudget, InterfaceBuilderDecodeBudgetExceeded, } from "./InterfaceBuilderDecodeBudget.js";
 const MAGIC = Buffer.from("NIBArchive", "ascii");
-const MAX_RECORDS = 1_000_000;
+const DEFAULT_DECODE_BUDGET_BYTES = 128 * 1024 * 1024;
 /** Decode Apple's length-prefixed NIBArchive representation without loading UI classes. */
-export const decodeNibArchive = (bytes) => {
+export const decodeNibArchive = (bytes, budget = new InterfaceBuilderDecodeBudget(DEFAULT_DECODE_BUDGET_BYTES)) => {
     if (bytes.length < 50 || !bytes.subarray(0, MAGIC.length).equals(MAGIC))
         throw new TypeError("NIBArchive magic or header is invalid");
     const formatVersion = readU32(bytes, 10);
@@ -23,11 +24,13 @@ export const decodeNibArchive = (bytes) => {
         valuesOffset,
         classesOffset,
     ]);
+    const projectedFieldCount = preflightProjectedFieldCount(bytes, objectsOffset, keysOffset, objectCount, valueCount, classCount, budget.remainingBytes);
+    budget.reserve(objectCount * 96 + projectedFieldCount * 96, "NIBArchive object and projected field counts exceed the aggregate Interface Builder decode budget");
     const objectRecords = parseObjects(bytes, objectsOffset, keysOffset, objectCount, valueCount, classCount);
-    const keys = parseStrings(bytes, keysOffset, valuesOffset, keyCount, "key");
-    const classes = parseClasses(bytes, classesOffset, bytes.length, classCount);
+    const keys = parseStrings(bytes, keysOffset, valuesOffset, keyCount, "key", budget);
+    const classes = parseClasses(bytes, classesOffset, bytes.length, classCount, budget);
     const neededValues = valueIndexes(objectRecords, valueCount);
-    const values = parseValues(bytes, valuesOffset, classesOffset, valueCount, keyCount, neededValues);
+    const values = parseValues(bytes, valuesOffset, classesOffset, valueCount, keyCount, neededValues, budget);
     for (const { value } of values.values()) {
         if (typeof value === "object" &&
             value !== null &&
@@ -89,19 +92,40 @@ const parseObjects = (bytes, start, end, count, valueCount, classCount) => {
         throw new TypeError("NIBArchive object table overlaps the next table");
     return output;
 };
-const parseStrings = (bytes, start, end, count, label) => {
+const preflightProjectedFieldCount = (bytes, start, end, objectCount, valueCount, classCount, maxBytes) => {
+    if (objectCount * 96 > maxBytes)
+        throw new InterfaceBuilderDecodeBudgetExceeded("aggregate_decode_budget_exhausted", "NIBArchive object count exceeds the aggregate Interface Builder decode budget");
+    const cursor = { offset: start };
+    let projectedFields = 0;
+    for (let index = 0; index < objectCount; index += 1) {
+        const classIndex = readVarint(bytes, cursor, end);
+        const valueStart = readVarint(bytes, cursor, end);
+        const fieldCount = readVarint(bytes, cursor, end);
+        if (classIndex >= classCount ||
+            valueStart > valueCount ||
+            fieldCount > valueCount - valueStart)
+            throw new TypeError(`NIBArchive object ${index} references an invalid table range`);
+        projectedFields += fieldCount;
+        if (!Number.isSafeInteger(projectedFields) ||
+            projectedFields * 96 > maxBytes - objectCount * 96)
+            throw new InterfaceBuilderDecodeBudgetExceeded("aggregate_decode_budget_exhausted", "NIBArchive projected field ranges exceed the aggregate Interface Builder decode budget");
+    }
+    return projectedFields;
+};
+const parseStrings = (bytes, start, end, count, label, budget) => {
     const cursor = { offset: start };
     const output = [];
     for (let index = 0; index < count; index += 1) {
         const length = readVarint(bytes, cursor, end);
         const next = checkedEnd(cursor.offset, length, end, `${label} ${index}`);
+        budget.reserve(32 + length * 2, `NIBArchive ${label} strings exceed the aggregate Interface Builder decode budget`);
         const value = decodeUtf8(bytes, cursor.offset, next, `${label} ${index}`);
         cursor.offset = next;
         output.push(value);
     }
     return output;
 };
-const parseClasses = (bytes, start, end, count) => {
+const parseClasses = (bytes, start, end, count, budget) => {
     const cursor = { offset: start };
     const output = [];
     for (let index = 0; index < count; index += 1) {
@@ -112,13 +136,14 @@ const parseClasses = (bytes, start, end, count) => {
         ensureRange(cursor.offset, extraCount * 4, end, `class ${index} extensions`);
         cursor.offset += extraCount * 4;
         const next = checkedEnd(cursor.offset, length, end, `class ${index}`);
+        budget.reserve(32 + length * 2, "NIBArchive class names exceed the aggregate Interface Builder decode budget");
         const name = decodeUtf8(bytes, cursor.offset, next, `class ${index}`).replace(/\0+$/u, "");
         cursor.offset = next;
         output.push(name);
     }
     return output;
 };
-const parseValues = (bytes, start, end, count, keyCount, needed) => {
+const parseValues = (bytes, start, end, count, keyCount, needed, budget) => {
     const cursor = { offset: start };
     const output = new Map();
     for (let index = 0; index < count; index += 1) {
@@ -127,15 +152,19 @@ const parseValues = (bytes, start, end, count, keyCount, needed) => {
             throw new TypeError(`NIBArchive value ${index} references an invalid key`);
         ensureRange(cursor.offset, 1, end, `value ${index} type`);
         const type = bytes[cursor.offset++] ?? -1;
-        const value = readValue(bytes, cursor, end, type, index);
-        if (needed.has(index))
-            output.set(index, { key_index: keyIndex, value });
+        if (!needed.has(index)) {
+            skipValue(bytes, cursor, end, type, index);
+            continue;
+        }
+        budget.reserve(64, "NIBArchive decoded values exceed the aggregate Interface Builder decode budget");
+        const value = readValue(bytes, cursor, end, type, index, budget);
+        output.set(index, { key_index: keyIndex, value });
     }
     if (cursor.offset > end)
         throw new TypeError("NIBArchive value table overlaps the next table");
     return output;
 };
-const readValue = (bytes, cursor, end, type, index) => {
+const readValue = (bytes, cursor, end, type, index, budget) => {
     switch (type) {
         case 0:
             ensureRange(cursor.offset, 1, end, `value ${index}`);
@@ -185,6 +214,7 @@ const readValue = (bytes, cursor, end, type, index) => {
         case 8: {
             const length = readVarint(bytes, cursor, end);
             const next = checkedEnd(cursor.offset, length, end, `value ${index} data`);
+            budget.reserve(32 + 4 * Math.ceil(length / 3), `NIBArchive data value ${index} exceeds the aggregate Interface Builder decode budget`);
             const encoded = bytes.subarray(cursor.offset, next).toString("base64");
             cursor.offset = next;
             return { $nib_data_base64: encoded };
@@ -202,6 +232,43 @@ const readValue = (bytes, cursor, end, type, index) => {
             throw new TypeError(`NIBArchive value ${index} has unsupported type ${type}`);
     }
 };
+const skipValue = (bytes, cursor, end, type, index) => {
+    switch (type) {
+        case 0:
+            ensureRange(cursor.offset, 1, end, `value ${index}`);
+            cursor.offset += 1;
+            return;
+        case 1:
+            ensureRange(cursor.offset, 2, end, `value ${index}`);
+            cursor.offset += 2;
+            return;
+        case 2:
+        case 10:
+            ensureRange(cursor.offset, 4, end, `value ${index}`);
+            cursor.offset += 4;
+            return;
+        case 3:
+        case 7:
+            ensureRange(cursor.offset, 8, end, `value ${index}`);
+            cursor.offset += 8;
+            return;
+        case 6:
+            ensureRange(cursor.offset, 4, end, `value ${index}`);
+            cursor.offset += 4;
+            return;
+        case 4:
+        case 5:
+        case 9:
+            return;
+        case 8: {
+            const length = readVarint(bytes, cursor, end);
+            cursor.offset = checkedEnd(cursor.offset, length, end, `value ${index} data`);
+            return;
+        }
+        default:
+            throw new TypeError(`NIBArchive value ${index} has unsupported type ${type}`);
+    }
+};
 const valueIndexes = (objects, total) => {
     const indexes = new Set();
     for (const object of objects)
@@ -213,8 +280,8 @@ const valueIndexes = (objects, total) => {
 };
 const readCount = (bytes, offset, label) => {
     const count = readU32(bytes, offset);
-    if (count > MAX_RECORDS)
-        throw new TypeError(`NIBArchive ${label} count exceeds the decoder bound`);
+    if (count > bytes.length)
+        throw new TypeError(`NIBArchive ${label} count exceeds the archive length`);
     return count;
 };
 const readOffset = (bytes, offset, fileLength, label) => {