rea-agents 6.3.0 → 6.5.0

package/dist/domain/process/processTraceSpecification.js

@@ -3,7 +3,16 @@ import { z } from "zod";
 import { IDENTIFIER_PATTERN } from "../stringPatterns.js";
 import { jsonValueSchema } from "../jsonValue.js";
 import { comparableProcessObservationPayload, processObservationSourceSchema, } from "./processObservation.js";
-const identifierSchema = z.string().regex(IDENTIFIER_PATTERN);
+/**
+ * A declared trace, event or variant identifier. The specification owns this
+ * vocabulary and the comparison result echoes those identifiers verbatim, so
+ * the result module must reuse this schema rather than restate the pattern:
+ * two bounds on the same identifier would reject the result of an accepted
+ * specification.
+ */
+export const processTraceIdentifierSchema = z
+    .string()
+    .regex(IDENTIFIER_PATTERN);
 const cardinalitySchema = z.discriminatedUnion("kind", [
     z.strictObject({ kind: z.literal("required") }),
     z.strictObject({ kind: z.literal("optional") }),
@@ -23,7 +32,7 @@ const cardinalitySchema = z.discriminatedUnion("kind", [
     }),
 ]);
 const eventDeclarationSchema = z.strictObject({
-    id: identifierSchema,
+    id: processTraceIdentifierSchema,
     source: processObservationSourceSchema,
     exact: jsonValueSchema,
     ignore_fields: z
@@ -44,31 +53,31 @@ const partialOrderLanguageSchema = z.strictObject({
     kind: z.literal("partial_order"),
     happens_before: z
         .array(z.strictObject({
-        before: identifierSchema,
-        after: identifierSchema,
+        before: processTraceIdentifierSchema,
+        after: processTraceIdentifierSchema,
     }))
         .default([]),
     not_before: z
         .array(z.strictObject({
-        event: identifierSchema,
-        anchor: identifierSchema,
+        event: processTraceIdentifierSchema,
+        anchor: processTraceIdentifierSchema,
     }))
         .default([]),
     unordered_groups: z
-        .array(z.strictObject({ events: z.array(identifierSchema).min(2) }))
+        .array(z.strictObject({ events: z.array(processTraceIdentifierSchema).min(2) }))
         .default([]),
-    prefix: z.array(identifierSchema).default([]),
-    suffix: z.array(identifierSchema).default([]),
+    prefix: z.array(processTraceIdentifierSchema).default([]),
+    suffix: z.array(processTraceIdentifierSchema).default([]),
 });
 const finiteTraceTokenSchema = z.union([
-    identifierSchema,
-    z.strictObject({ unordered: z.array(identifierSchema).min(2) }),
+    processTraceIdentifierSchema,
+    z.strictObject({ unordered: z.array(processTraceIdentifierSchema).min(2) }),
 ]);
 const finiteTraceLanguageSchema = z.strictObject({
     kind: z.literal("finite_traces"),
     variants: z
         .array(z.strictObject({
-        id: identifierSchema,
+        id: processTraceIdentifierSchema,
         trace: z.array(finiteTraceTokenSchema),
     }))
         .min(1),
@@ -106,7 +115,7 @@ const addReferenceIssue = (context, known, id, path) => {
             path,
         });
 };
-const pairKey = (left, right) => [left, right].sort().join("\0");
+const pairKey = (left, right) => left <= right ? `${left}\0${right}` : `${right}\0${left}`;
 const buildAdjacency = (language, context, known) => {
     const adjacency = new Map([...known].map((id) => [id, new Set()]));
     for (const [index, edge] of language.happens_before.entries()) {
@@ -123,7 +132,7 @@ const buildAdjacency = (language, context, known) => {
     }
     return adjacency;
 };
-const validateNotBefore = (language, context, known, reachable) => {
+const validateNotBefore = (language, context, known) => {
     const pairs = new Set();
     for (const [index, constraint] of language.not_before.entries()) {
         const path = ["language", "not_before", index];
@@ -143,54 +152,87 @@ const validateNotBefore = (language, context, known, reachable) => {
                 path,
             });
         pairs.add(key);
-        if (reachable.get(constraint.event)?.has(constraint.anchor) === true)
-            context.addIssue({
-                code: "custom",
-                message: "not-before constraint conflicts with happens-before order",
-                path,
-            });
     }
     return pairs;
 };
-const graphHasCycle = (ids, adjacency) => {
-    const active = new Set();
-    const complete = new Set();
-    const visit = (current) => {
-        if (active.has(current))
-            return true;
-        if (complete.has(current))
-            return false;
-        active.add(current);
-        const cyclic = [...(adjacency.get(current) ?? [])].some(visit);
-        active.delete(current);
-        complete.add(current);
-        return cyclic;
-    };
-    return ids.some(visit);
-};
-const computeReachability = (ids, adjacency) => {
-    const reachable = new Map();
-    for (const origin of ids) {
-        const seen = new Set();
-        const pending = [...(adjacency.get(origin) ?? [])];
-        while (pending.length > 0) {
-            const current = pending.pop();
-            if (current === undefined || seen.has(current))
+const classifyGraph = (ids, adjacency) => {
+    const incoming = new Map(ids.map((id) => [id, 0]));
+    let hasUnknownSuccessor = false;
+    for (const successors of adjacency.values())
+        for (const successor of successors) {
+            const count = incoming.get(successor);
+            if (count === undefined)
+                hasUnknownSuccessor = true;
+            else
+                incoming.set(successor, count + 1);
+        }
+    const ready = [...incoming].flatMap(([id, count]) => count === 0 ? [id] : []);
+    const order = [];
+    let unique = true;
+    while (ready.length > 0) {
+        if (ready.length !== 1)
+            unique = false;
+        const current = ready.pop();
+        if (current === undefined)
+            continue;
+        order.push(current);
+        for (const successor of adjacency.get(current) ?? []) {
+            const count = incoming.get(successor);
+            if (count === undefined)
                 continue;
-            seen.add(current);
-            pending.push(...(adjacency.get(current) ?? []));
+            incoming.set(successor, count - 1);
+            if (count === 1)
+                ready.push(successor);
         }
-        reachable.set(origin, seen);
     }
-    return reachable;
+    if (order.length !== incoming.size)
+        return { kind: "cyclic" };
+    if (unique && order.length === ids.length && !hasUnknownSuccessor) {
+        return {
+            kind: "total-order",
+            rank: new Map(order.map((id, index) => [id, index])),
+        };
+    }
+    const reverseAdjacency = new Map([...incoming.keys()].map((id) => [id, new Set()]));
+    for (const [before, successors] of adjacency)
+        for (const after of successors)
+            reverseAdjacency.get(after)?.add(before);
+    return { kind: "partial-order", reverseAdjacency };
 };
-const isOrdered = (reachable, left, right) => reachable.get(left)?.has(right) === true ||
-    reachable.get(right)?.has(left) === true;
-const validateUnorderedGroups = (language, context, known, relations) => {
-    const pairs = new Set();
+const collectReachable = (origin, adjacency) => {
+    const seen = new Set();
+    const pending = [...(adjacency.get(origin) ?? [])];
+    while (pending.length > 0) {
+        const current = pending.pop();
+        if (current === undefined || seen.has(current))
+            continue;
+        seen.add(current);
+        for (const successor of adjacency.get(current) ?? [])
+            pending.push(successor);
+    }
+    return seen;
+};
+const validateUnorderedGroups = (language, context, known) => {
+    const memberships = new Map();
+    const groups = [];
+    const repeatedMemberships = new Map();
     for (const [groupIndex, group] of language.unordered_groups.entries()) {
         const path = ["language", "unordered_groups", groupIndex];
-        if (new Set(group.events).size !== group.events.length)
+        const uniqueIds = new Set();
+        const repeatedIds = new Set();
+        for (const id of group.events) {
+            if (uniqueIds.has(id))
+                repeatedIds.add(id);
+            else
+                uniqueIds.add(id);
+        }
+        groups.push(uniqueIds);
+        for (const id of repeatedIds) {
+            const groupIndexes = repeatedMemberships.get(id) ?? new Set();
+            groupIndexes.add(groupIndex);
+            repeatedMemberships.set(id, groupIndexes);
+        }
+        if (uniqueIds.size !== group.events.length)
             context.addIssue({
                 code: "custom",
                 message: "unordered groups must not repeat event ids",
@@ -198,39 +240,145 @@ const validateUnorderedGroups = (language, context, known, relations) => {
             });
         for (const [eventIndex, id] of group.events.entries())
             addReferenceIssue(context, known, id, [...path, "events", eventIndex]);
-        for (const [leftIndex, leftId] of group.events.entries()) {
-            for (const rightId of group.events.slice(leftIndex + 1)) {
-                const key = pairKey(leftId, rightId);
-                if (pairs.has(key))
-                    context.addIssue({
-                        code: "custom",
-                        message: "unordered event pairs must be declared once",
-                        path,
-                    });
-                pairs.add(key);
-                if (isOrdered(relations.reachable, leftId, rightId) ||
-                    relations.notBeforePairs.has(key))
-                    context.addIssue({
-                        code: "custom",
-                        message: "ordered events cannot also be declared unordered",
-                        path,
-                    });
-            }
+        const overlaps = new Map();
+        for (const id of uniqueIds) {
+            const priorGroups = memberships.get(id) ?? new Set();
+            for (const prior of priorGroups)
+                overlaps.set(prior, (overlaps.get(prior) ?? 0) + 1);
+            priorGroups.add(groupIndex);
+            memberships.set(id, priorGroups);
         }
+        if ([...overlaps.values()].some((count) => count > 1))
+            context.addIssue({
+                code: "custom",
+                message: "unordered event pairs must be declared once",
+                path,
+            });
     }
-    return pairs;
+    const markSharedGroups = (left, right, conflicts) => {
+        if (left === right) {
+            for (const groupIndex of repeatedMemberships.get(left) ?? [])
+                conflicts[groupIndex] = true;
+            return;
+        }
+        const rightGroups = memberships.get(right);
+        for (const group of memberships.get(left) ?? [])
+            if (rightGroups?.has(group) === true)
+                conflicts[group] = true;
+    };
+    return {
+        groups,
+        hasPair(left, right) {
+            if (left === right)
+                return memberships.has(left);
+            const rightGroups = memberships.get(right);
+            for (const group of memberships.get(left) ?? [])
+                if (rightGroups?.has(group) === true)
+                    return true;
+            return false;
+        },
+        markDeclaredPairConflicts(pairs, conflicts) {
+            for (const key of pairs) {
+                const separator = key.indexOf("\0");
+                const left = key.slice(0, separator);
+                const right = key.slice(separator + 1);
+                markSharedGroups(left, right, conflicts);
+            }
+        },
+        markSharedGroups,
+    };
 };
-const validateCompletePairDeclarations = (ids, relations, unorderedPairs, context) => {
-    for (const [leftIndex, leftId] of ids.entries())
-        for (const rightId of ids.slice(leftIndex + 1))
-            if (!isOrdered(relations.reachable, leftId, rightId) &&
-                !relations.notBeforePairs.has(pairKey(leftId, rightId)) &&
-                !unorderedPairs.has(pairKey(leftId, rightId)))
-                context.addIssue({
-                    code: "custom",
-                    message: `event pair ${leftId}/${rightId} must be explicitly ordered or unordered`,
-                    path: ["language"],
-                });
+const validateTotalOrderRelations = (language, graph, unorderedGroups, notBeforePairs, context) => {
+    for (const [index, constraint] of language.not_before.entries()) {
+        const before = graph.rank.get(constraint.event);
+        const after = graph.rank.get(constraint.anchor);
+        if (before !== undefined && after !== undefined && before < after)
+            context.addIssue({
+                code: "custom",
+                message: "not-before constraint conflicts with happens-before order",
+                path: ["language", "not_before", index],
+            });
+    }
+    const conflicts = new Array(language.unordered_groups.length).fill(false);
+    for (const [groupIndex, group] of unorderedGroups.groups.entries()) {
+        let comparableEvents = 0;
+        for (const id of group)
+            if (graph.rank.has(id) && ++comparableEvents === 2) {
+                conflicts[groupIndex] = true;
+                break;
+            }
+    }
+    unorderedGroups.markDeclaredPairConflicts(notBeforePairs, conflicts);
+    addUnorderedConflictIssues(conflicts, context);
+};
+const addUnorderedConflictIssues = (conflicts, context) => {
+    for (const [groupIndex, conflict] of conflicts.entries())
+        if (conflict)
+            context.addIssue({
+                code: "custom",
+                message: "ordered events cannot also be declared unordered",
+                path: ["language", "unordered_groups", groupIndex],
+            });
+};
+const validatePartialOrderRelations = (ids, language, adjacency, graph, unorderedGroups, notBeforePairs, context) => {
+    let missingPairCount = 0;
+    let firstMissingPair = "";
+    const groupConflicts = new Array(language.unordered_groups.length).fill(false);
+    unorderedGroups.markDeclaredPairConflicts(notBeforePairs, groupConflicts);
+    const notBeforeConflictFlags = new Uint8Array(language.not_before.length);
+    const constraintsBySource = new Map();
+    for (const [index, constraint] of language.not_before.entries()) {
+        const indexes = constraintsBySource.get(constraint.event) ?? [];
+        indexes.push(index);
+        constraintsBySource.set(constraint.event, indexes);
+    }
+    // Keep only one origin's forward and backward closure live at a time. Pair
+    // iteration stays in declaration order so the count and first missing pair
+    // retain the established diagnostic semantics.
+    for (const [leftIndex, leftId] of ids.entries()) {
+        const forward = collectReachable(leftId, adjacency);
+        const backward = collectReachable(leftId, graph.reverseAdjacency);
+        for (const constraintIndex of constraintsBySource.get(leftId) ?? []) {
+            const constraint = language.not_before[constraintIndex];
+            if (constraint !== undefined && forward.has(constraint.anchor))
+                notBeforeConflictFlags[constraintIndex] = 1;
+        }
+        for (let rightIndex = leftIndex + 1; rightIndex < ids.length; rightIndex++) {
+            const rightId = ids[rightIndex];
+            if (rightId === undefined)
+                continue;
+            const sameEvent = leftId === rightId;
+            const ordered = !sameEvent && (forward.has(rightId) || backward.has(rightId));
+            const key = pairKey(leftId, rightId);
+            const notBefore = notBeforePairs.has(key);
+            const unordered = unorderedGroups.hasPair(leftId, rightId);
+            if (ordered || notBefore) {
+                if (!sameEvent)
+                    unorderedGroups.markSharedGroups(leftId, rightId, groupConflicts);
+            }
+            if (!ordered && !notBefore && !unordered) {
+                if (missingPairCount === 0)
+                    firstMissingPair = `${leftId}/${rightId}`;
+                missingPairCount++;
+            }
+        }
+    }
+    for (const [index, conflict] of notBeforeConflictFlags.entries())
+        if (conflict === 1)
+            context.addIssue({
+                code: "custom",
+                message: "not-before constraint conflicts with happens-before order",
+                path: ["language", "not_before", index],
+            });
+    addUnorderedConflictIssues(groupConflicts, context);
+    if (missingPairCount > 0)
+        context.addIssue({
+            code: "custom",
+            message: missingPairCount === 1
+                ? `event pair ${firstMissingPair} must be explicitly ordered or unordered`
+                : `${String(missingPairCount)} event pairs must be explicitly ordered or unordered; first undeclared pair: ${firstMissingPair}`,
+            path: ["language"],
+        });
 };
 const validatePartialOrder = (specification, context) => {
     if (specification.language.kind !== "partial_order")
@@ -238,17 +386,23 @@ const validatePartialOrder = (specification, context) => {
     const ids = specification.events.map(({ id }) => id);
     const known = new Set(ids);
     const adjacency = buildAdjacency(specification.language, context, known);
-    if (graphHasCycle(ids, adjacency))
+    const graph = classifyGraph(ids, adjacency);
+    if (graph.kind === "cyclic")
         context.addIssue({
             code: "custom",
             message: "happens-before graph must be acyclic",
             path: ["language"],
         });
-    const reachable = computeReachability(ids, adjacency);
-    const notBeforePairs = validateNotBefore(specification.language, context, known, reachable);
-    const relations = { reachable, notBeforePairs };
-    const unorderedPairs = validateUnorderedGroups(specification.language, context, known, relations);
-    validateCompletePairDeclarations(ids, relations, unorderedPairs, context);
+    const notBeforePairs = validateNotBefore(specification.language, context, known);
+    const unorderedGroups = validateUnorderedGroups(specification.language, context, known);
+    // Preserve independent declaration diagnostics on cyclic input. Computing
+    // all pair relations cannot establish a valid partial order in that case.
+    if (graph.kind === "total-order") {
+        validateTotalOrderRelations(specification.language, graph, unorderedGroups, notBeforePairs, context);
+    }
+    else if (graph.kind === "partial-order") {
+        validatePartialOrderRelations(ids, specification.language, adjacency, graph, unorderedGroups, notBeforePairs, context);
+    }
     for (const [kind, values] of [
         ["prefix", specification.language.prefix],
         ["suffix", specification.language.suffix],

package/dist/domain/propertyListKeys.js

@@ -1,8 +1,12 @@
+import { DOMParser, normalizeLineEndings, } from "@xmldom/xmldom";
 import { parse } from "plist";
+import { MAX_PLIST_DEPTH } from "./apple/plistValue.js";
 /** The dictionary key REA results cannot carry: validation strips it. */
 const PROTOTYPE_KEY = "__proto__";
 /** Limitation for results whose source plist held `__proto__` entries. */
-export const omittedPrototypeKeysLimitation = (count) => `${String(count)} dictionary ${count === 1 ? "entry" : "entries"} keyed __proto__ ${count === 1 ? "was" : "were"} omitted because REA results cannot represent that key.`;
+export const omittedPrototypeKeysLimitation = (count) => count === null
+    ? "Dictionary entries keyed __proto__ were omitted because REA results cannot represent that key."
+    : `${String(count)} dictionary ${count === 1 ? "entry" : "entries"} keyed __proto__ ${count === 1 ? "was" : "were"} omitted because REA results cannot represent that key.`;
 const withoutKey = (value, key) => {
     let omitted = 0;
     const strip = (item) => {
@@ -25,8 +29,6 @@ const withoutKey = (value, key) => {
 };
 /** Remove own `__proto__` entries, such as JSON.parse creates, and count them. */
 export const omitPrototypeKeys = (value) => withoutKey(value, PROTOTYPE_KEY);
-// Comments and CDATA text are consumed whole so only element keys match.
-const KEY_TOKEN = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<key>([^<]*)<\/key>|<key><!\[CDATA\[([\s\S]*?)\]\]><\/key>/gu;
 const XML_ENTITIES = {
     amp: "&",
     apos: "'",
@@ -55,15 +57,215 @@ export const decodeXmlText = (text) => text.replace(/&(?:#x([\da-f]+)|#(\d+)|([a
  * counted so callers can report them instead of failing the whole document.
  */
 export const parseXmlPropertyList = (text) => {
-    // The decoded text holds every key the decoder can produce, including
-    // entity-encoded spellings of the placeholder, so no source key aliases it.
-    // Decoding comment or CDATA text too can only lengthen the placeholder.
-    const decoded = decodeXmlText(text);
+    // Preserve the pinned decoder's existing OpenStep autodetection, also used
+    // by app Info.plist resolution. Only XML needs the key-element substitution.
+    const first = text.trimStart()[0];
+    if (first === "{" || first === "(") {
+        assertOpenStepDepthWithinLimit(text);
+        return omitPrototypeKeys(parse(text));
+    }
+    // Normalize only the literal line endings the pinned decoder normalizes.
+    // Preserve character references in the source: serializing a DOM would turn
+    // e.g. an encoded carriage return into a literal newline on the second parse.
+    const normalized = normalizeLineEndings(text);
+    // The pinned XML parser is iterative. Reuse its document for the depth
+    // preflight and key lookup so quoted attributes and declarations have the
+    // same meaning at both boundaries, before plist's recursive value decode.
+    const document = new DOMParser().parseFromString(normalized, "text/xml");
+    assertXmlPlistDepthWithinLimit(document);
+    const { substituted, placeholder } = substitutePrototypeKeys(normalized, document);
+    return withoutKey(parse(substituted), placeholder);
+};
+/** Consume only the punctuation expected between the pinned decoder's values. */
+const consumeOpenStepSeparator = (parent, character) => {
+    if (parent?.next === "after-value") {
+        parent.next = "key";
+        return character === ";" ? "consumed" : "none";
+    }
+    if (parent?.next !== "equals" && parent?.next !== "separator")
+        return "none";
+    if (character !== (parent.next === "equals" ? "=" : ","))
+        return "invalid";
+    parent.next = "value";
+    return "consumed";
+};
+/** An array may close after a comma; a dictionary still needs its assigned value. */
+const admitsOpenStepCloser = (parent, character) => parent?.end === character &&
+    parent.next !== "equals" &&
+    !(parent.end === "}" && parent.next === "value");
+/** Bound OpenStep value nesting before the pinned decoder recursively reads it. */
+const assertOpenStepDepthWithinLimit = (text) => {
+    const containers = [];
+    const completeValue = () => {
+        const parent = containers.at(-1);
+        if (parent !== undefined)
+            parent.next =
+                parent.next === "key"
+                    ? "equals"
+                    : parent.end === "}"
+                        ? "after-value"
+                        : "separator";
+    };
+    const assertDepth = () => {
+        if (containers.length > MAX_PLIST_DEPTH)
+            throw new RangeError(`Plist exceeds ${String(MAX_PLIST_DEPTH)} nesting levels`);
+    };
+    let cursor = 0;
+    while (cursor < text.length) {
+        const afterTrivia = skipOpenStepTrivia(text, cursor);
+        if (afterTrivia !== cursor) {
+            cursor = afterTrivia;
+            continue;
+        }
+        const character = text[cursor] ?? "";
+        const parent = containers.at(-1);
+        // Stop at the first impossible token: only the pinned decoder owns syntax
+        // diagnostics. A later deep suffix cannot change that failure into a limit.
+        if (character === "}" || character === ")") {
+            if (!admitsOpenStepCloser(parent, character))
+                return;
+            containers.pop();
+            // parseOpenStep returns the first root value without reading trailing text.
+            if (containers.length === 0)
+                return;
+            completeValue();
+            cursor += 1;
+            continue;
+        }
+        const separator = consumeOpenStepSeparator(parent, character);
+        if (separator === "invalid")
+            return;
+        if (separator === "consumed") {
+            cursor += 1;
+            continue;
+        }
+        if (character === "{" || character === "(") {
+            assertDepth();
+            containers.push({
+                end: character === "{" ? "}" : ")",
+                next: character === "{" ? "key" : "value",
+            });
+            cursor += 1;
+            continue;
+        }
+        const end = skipOpenStepScalar(text, cursor);
+        if (end === cursor)
+            return;
+        if (parent?.next !== "key")
+            assertDepth();
+        cursor = end;
+        completeValue();
+    }
+};
+/** Skip grammar trivia without interpreting delimiter examples inside comments. */
+const skipOpenStepTrivia = (text, cursor) => {
+    if (/\s/u.test(text[cursor] ?? ""))
+        return cursor + 1;
+    if (!text.startsWith("//", cursor) && !text.startsWith("/*", cursor))
+        return cursor;
+    const line = text[cursor + 1] === "/";
+    const end = text.indexOf(line ? "\n" : "*/", cursor + 2);
+    return end === -1 ? text.length : end + (line ? 1 : 2);
+};
+/** Read the extent of one opaque scalar; the pinned decoder still owns its value. */
+const skipOpenStepScalar = (text, start) => {
+    let cursor = start;
+    const character = text[cursor];
+    if (character === '"') {
+        cursor += 1;
+        while (cursor < text.length) {
+            const next = text[cursor];
+            cursor += next === "\\" ? 2 : 1;
+            if (next === '"')
+                break;
+        }
+    }
+    else if (character === "<") {
+        const end = text.indexOf(">", cursor + 1);
+        cursor = end === -1 ? text.length : end + 1;
+    }
+    else {
+        // Match the pinned OpenStep decoder's unquoted-string alphabet. Other
+        // syntax remains for the decoder to reject; preflight only owns depth.
+        while (cursor < text.length &&
+            /[a-zA-Z0-9._/$:-]/u.test(text[cursor] ?? ""))
+            cursor += 1;
+    }
+    return cursor;
+};
+/** Elements whose children the pinned plist value decoder visits recursively. */
+const PLIST_CONTAINER_ELEMENTS = new Set(["plist", "dict", "array"]);
+/**
+ * Reject XML plists nested deeper than the projection supports before any
+ * recursive value pass runs. `plist` and the prototype-key traversal recurse once
+ * per nesting level, so a deeply nested document exhausts the call stack
+ * before the projection limit can report the resource bound. The failure
+ * matches `projectPlistValue` so callers classify it as a limit failure.
+ *
+ * Depth counts values the way the projection does: the root value is level 0
+ * and every container member is one level deeper. A dictionary key names a
+ * member instead of nesting one, and a self-closing element is the value at
+ * its own level. The outer plist envelope is unwrapped by the decoder;
+ * nested plist elements decode as arrays and must count toward the bound.
+ */
+const assertXmlPlistDepthWithinLimit = (document) => {
+    const root = document.documentElement;
+    if (root === null)
+        return;
+    const pending = [
+        { node: root, depth: -1 },
+    ];
+    while (pending.length > 0) {
+        const entry = pending.pop();
+        if (entry === undefined)
+            break;
+        const { node, depth } = entry;
+        // Schedule only the next sibling, keeping traversal storage proportional
+        // to depth rather than the number of members in a wide container.
+        if (node.nextSibling !== null)
+            pending.push({ node: node.nextSibling, depth });
+        if (node.nodeType !== node.ELEMENT_NODE)
+            continue;
+        if (node.nodeName !== "key" && depth > MAX_PLIST_DEPTH)
+            throw new RangeError(`Plist exceeds ${String(MAX_PLIST_DEPTH)} nesting levels`);
+        if (PLIST_CONTAINER_ELEMENTS.has(node.nodeName) && node.firstChild !== null)
+            pending.push({ node: node.firstChild, depth: depth + 1 });
+    }
+};
+/** Locate keys with the same XML parser and first-child semantics as plist. */
+const substitutePrototypeKeys = (text, document) => {
+    const keys = Array.from(document.getElementsByTagName("key"));
+    const decodedKeys = new Set(keys.map((key) => key.firstChild?.nodeValue));
     let placeholder = "__rea_prototype_key__";
-    while (decoded.includes(placeholder))
+    while (decodedKeys.has(placeholder))
         placeholder = `_${placeholder}`;
-    const substituted = text.replace(KEY_TOKEN, (token, plain, cdata) => (plain === undefined ? cdata : decodeXmlText(plain)) === PROTOTYPE_KEY
-        ? `<key>${placeholder}</key>`
-        : token);
-    return withoutKey(parse(substituted), placeholder);
+    const omitted = keys
+        .map((key) => key.firstChild)
+        .filter((node) => node?.nodeValue === PROTOTYPE_KEY);
+    if (omitted.length === 0)
+        return { substituted: text, placeholder };
+    // xmldom uses one-based locators in document order. Scan forward only to
+    // needed lines instead of retaining an offset for every source newline.
+    let line = 1;
+    let lineStart = 0;
+    const parts = [];
+    let cursor = 0;
+    for (const node of omitted) {
+        const nodeLine = node?.lineNumber;
+        const column = node?.columnNumber;
+        if (nodeLine === undefined || column === undefined)
+            throw new TypeError("XML plist key has no source location");
+        while (line < nodeLine) {
+            const newline = text.indexOf("\n", lineStart);
+            if (newline === -1)
+                throw new TypeError("XML plist key has an invalid source location");
+            lineStart = newline + 1;
+            line += 1;
+        }
+        const offset = lineStart + column - 1;
+        parts.push(text.slice(cursor, offset), `<![CDATA[${placeholder}]]>`);
+        cursor = offset;
+    }
+    parts.push(text.slice(cursor));
+    return { substituted: parts.join(""), placeholder };
 };