seroval 1.4.0 → 1.4.2

package/src/core/context/deserializer.ts

@@ -1,6 +1,8 @@
+import { ALL_ENABLED, Feature } from '../compat';
 import {
   CONSTANT_VAL,
   ERROR_CONSTRUCTOR,
+  NIL,
   SerovalNodeType,
   SerovalObjectFlags,
   SYMBOL_REF,
@@ -11,7 +13,9 @@ import {
   type PromiseConstructorResolver,
 } from '../constructors';
 import {
+  SerovalDepthLimitError,
   SerovalDeserializationError,
+  SerovalMalformedNodeError,
   SerovalMissingInstanceError,
   SerovalMissingPluginError,
   SerovalUnsupportedNodeError,
@@ -20,8 +24,14 @@ import type { PluginAccessOptions } from '../plugin';
 import { SerovalMode } from '../plugin';
 import { getReference } from '../reference';
 import type { Stream } from '../stream';
-import { createStream, streamToAsyncIterable } from '../stream';
+import { createStream, isStream, streamToAsyncIterable } from '../stream';
 import { deserializeString } from '../string';
+import {
+  SYM_ASYNC_ITERATOR,
+  SYM_IS_CONCAT_SPREADABLE,
+  SYM_ITERATOR,
+  SYM_TO_STRING_TAG,
+} from '../symbols';
 import type {
   SerovalAggregateErrorNode,
   SerovalArrayBufferNode,
@@ -39,7 +49,6 @@ import type {
   SerovalNode,
   SerovalNullConstructorNode,
   SerovalObjectNode,
-  SerovalObjectRecordKey,
   SerovalObjectRecordNode,
   SerovalPluginNode,
   SerovalPromiseConstructorNode,
@@ -63,6 +72,10 @@ import type {
 } from '../utils/typed-array';
 import { getTypedArrayConstructor } from '../utils/typed-array';
 
+const MAX_BASE64_LENGTH = 1_000_000; // ~0.75MB decoded
+const MAX_BIGINT_LENGTH = 10_000;
+const MAX_REGEXP_SOURCE_LENGTH = 20_000;
+
 function applyObjectFlag(obj: unknown, flag: SerovalObjectFlags): unknown {
   switch (flag) {
     case SerovalObjectFlags.Frozen:
@@ -81,6 +94,9 @@ type AssignableNode = SerovalAggregateErrorNode | SerovalErrorNode;
 
 export interface BaseDeserializerContextOptions extends PluginAccessOptions {
   refs?: Map<number, unknown>;
+  features?: number;
+  disabledFeatures?: number;
+  depthLimit?: number;
 }
 
 export interface BaseDeserializerContext extends PluginAccessOptions {
@@ -89,8 +105,12 @@ export interface BaseDeserializerContext extends PluginAccessOptions {
    * Mapping ids to values
    */
   refs: Map<number, unknown>;
+  features: number;
+  depthLimit: number;
 }
 
+const DEFAULT_DEPTH_LIMIT = 1000;
+
 export function createBaseDeserializerContext(
   mode: SerovalMode,
   options: BaseDeserializerContextOptions,
@@ -99,6 +119,8 @@ export function createBaseDeserializerContext(
     mode,
     plugins: options.plugins,
     refs: options.refs || new Map(),
+    features: options.features ?? ALL_ENABLED ^ (options.disabledFeatures || 0),
+    depthLimit: options.depthLimit || DEFAULT_DEPTH_LIMIT,
   };
 }
 
@@ -124,7 +146,7 @@ export function createVanillaDeserializerContext(
   return {
     mode: SerovalMode.Vanilla,
     base: createBaseDeserializerContext(SerovalMode.Vanilla, options),
-    child: undefined,
+    child: NIL,
     state: {
       marked: new Set(options.markedRefs),
     },
@@ -145,7 +167,7 @@ export function createCrossDeserializerContext(
   return {
     mode: SerovalMode.Cross,
     base: createBaseDeserializerContext(SerovalMode.Cross, options),
-    child: undefined,
+    child: NIL,
   };
 }
 
@@ -154,10 +176,25 @@ type DeserializerContext =
   | CrossDeserializerContext;
 
 export class DeserializePluginContext {
-  constructor(private _p: DeserializerContext) {}
+  constructor(
+    private _p: DeserializerContext,
+    private depth: number,
+  ) {}
 
   deserialize<T>(node: SerovalNode): T {
-    return deserialize(this._p, node) as T;
+    return deserialize(this._p, this.depth, node) as T;
+  }
+}
+
+function guardIndexedValue(ctx: BaseDeserializerContext, id: number): void {
+  if (id < 0 || !Number.isFinite(id) || !Number.isInteger(id)) {
+    throw new SerovalMalformedNodeError({
+      t: SerovalNodeType.IndexedValue,
+      i: id,
+    } as SerovalNode);
+  }
+  if (ctx.refs.has(id)) {
+    throw new Error('Conflicted ref id: ' + id);
   }
 }
 
@@ -166,6 +203,7 @@ function assignIndexedValueVanilla<T>(
   id: number,
   value: T,
 ): T {
+  guardIndexedValue(ctx.base, id);
   if (ctx.state.marked.has(id)) {
     ctx.base.refs.set(id, value);
   }
@@ -177,9 +215,8 @@ function assignIndexedValueCross<T>(
   id: number,
   value: T,
 ): T {
-  if (!ctx.base.refs.has(id)) {
-    ctx.base.refs.set(id, value);
-  }
+  guardIndexedValue(ctx.base, id);
+  ctx.base.refs.set(id, value);
   return value;
 }
 
@@ -193,6 +230,16 @@ function assignIndexedValue<T>(
     : assignIndexedValueCross(ctx, id, value);
 }
 
+function deserializeKnownValue<
+  T extends Record<string, unknown>,
+  K extends keyof T,
+>(node: SerovalNode, record: T, key: K): T[K] {
+  if (Object.hasOwn(record, key)) {
+    return record[key];
+  }
+  throw new SerovalMalformedNodeError(node);
+}
+
 function deserializeReference(
   ctx: DeserializerContext,
   node: SerovalReferenceNode,
@@ -206,41 +253,108 @@ function deserializeReference(
 
 function deserializeArray(
   ctx: DeserializerContext,
+  depth: number,
   node: SerovalArrayNode,
 ): unknown[] {
-  const len = node.l;
+  const items = node.a;
+  const len = items.length;
   const result: unknown[] = assignIndexedValue(
     ctx,
     node.i,
     new Array<unknown>(len),
   );
-  let item: SerovalNode | undefined;
-  for (let i = 0; i < len; i++) {
-    item = node.a[i];
+  for (let i = 0, item: SerovalNode | 0; i < len; i++) {
+    item = items[i];
     if (item) {
-      result[i] = deserialize(ctx, item);
+      result[i] = deserialize(ctx, depth, item);
     }
   }
   applyObjectFlag(result, node.o);
   return result;
 }
 
+function isValidKey(key: string): boolean {
+  switch (key) {
+    case 'constructor':
+    case '__proto__':
+    case 'prototype':
+    case '__defineGetter__':
+    case '__defineSetter__':
+    case '__lookupGetter__':
+    case '__lookupSetter__':
+      // case 'then':
+      return false;
+    default:
+      return true;
+  }
+}
+
+function isValidSymbol(symbol: symbol): boolean {
+  switch (symbol) {
+    case SYM_ASYNC_ITERATOR:
+    case SYM_IS_CONCAT_SPREADABLE:
+    case SYM_TO_STRING_TAG:
+    case SYM_ITERATOR:
+      return true;
+    default:
+      return false;
+  }
+}
+
+function assignStringProperty(
+  object: Record<string | symbol, unknown>,
+  key: string,
+  value: unknown,
+): void {
+  if (isValidKey(key)) {
+    object[key] = value;
+  } else {
+    Object.defineProperty(object, key, {
+      value,
+      configurable: true,
+      enumerable: true,
+      writable: true,
+    });
+  }
+}
+
+function assignProperty(
+  ctx: DeserializerContext,
+  depth: number,
+  object: Record<string | symbol, unknown>,
+  key: string | SerovalNode,
+  value: SerovalNode,
+): void {
+  if (typeof key === 'string') {
+    assignStringProperty(object, key, deserialize(ctx, depth, value));
+  } else {
+    const actual = deserialize(ctx, depth, key);
+    switch (typeof actual) {
+      case 'string':
+        assignStringProperty(object, actual, deserialize(ctx, depth, value));
+        break;
+      case 'symbol':
+        if (isValidSymbol(actual)) {
+          object[actual] = deserialize(ctx, depth, value);
+        }
+        break;
+      default:
+        throw new SerovalMalformedNodeError(key);
+    }
+  }
+}
+
 function deserializeProperties(
   ctx: DeserializerContext,
+  depth: number,
   node: SerovalObjectRecordNode,
   result: Record<string | symbol, unknown>,
 ): Record<string | symbol, unknown> {
-  const len = node.s;
-  if (len) {
-    const keys = node.k;
-    const vals = node.v;
-    for (let i = 0, key: SerovalObjectRecordKey; i < len; i++) {
-      key = keys[i];
-      if (typeof key === 'string') {
-        result[deserializeString(key)] = deserialize(ctx, vals[i]);
-      } else {
-        result[deserialize(ctx, key) as symbol] = deserialize(ctx, vals[i]);
-      }
+  const keys = node.k;
+  const len = keys.length;
+  if (len > 0) {
+    for (let i = 0, vals = node.v, len = keys.length; i < len; i++) {
+      assignProperty(ctx, depth, result, keys[i], vals[i]);
     }
   }
   return result;
@@ -248,6 +362,7 @@ function deserializeProperties(
 
 function deserializeObject(
   ctx: DeserializerContext,
+  depth: number,
   node: SerovalObjectNode | SerovalNullConstructorNode,
 ): Record<string, unknown> {
   const result = assignIndexedValue(
@@ -258,7 +373,7 @@ function deserializeObject(
       unknown
     >,
   );
-  deserializeProperties(ctx, node.p, result);
+  deserializeProperties(ctx, depth, node.p, result);
   applyObjectFlag(result, node.o);
   return result;
 }
@@ -274,34 +389,43 @@ function deserializeRegExp(
   ctx: DeserializerContext,
   node: SerovalRegExpNode,
 ): RegExp {
-  return assignIndexedValue(
-    ctx,
-    node.i,
-    new RegExp(deserializeString(node.c), node.m),
-  );
+  if (ctx.base.features & Feature.RegExp) {
+    const source = deserializeString(node.c);
+    if (source.length > MAX_REGEXP_SOURCE_LENGTH) {
+      throw new SerovalMalformedNodeError(node);
+    }
+    return assignIndexedValue(ctx, node.i, new RegExp(source, node.m));
+  }
+  throw new SerovalUnsupportedNodeError(node);
 }
 
 function deserializeSet(
   ctx: DeserializerContext,
+  depth: number,
   node: SerovalSetNode,
 ): Set<unknown> {
   const result = assignIndexedValue(ctx, node.i, new Set<unknown>());
-  const items = node.a;
-  for (let i = 0, len = node.l; i < len; i++) {
-    result.add(deserialize(ctx, items[i]));
+  for (let i = 0, items = node.a, len = items.length; i < len; i++) {
+    result.add(deserialize(ctx, depth, items[i]));
   }
   return result;
 }
 
 function deserializeMap(
   ctx: DeserializerContext,
+  depth: number,
   node: SerovalMapNode,
 ): Map<unknown, unknown> {
   const result = assignIndexedValue(ctx, node.i, new Map<unknown, unknown>());
-  const keys = node.e.k;
-  const vals = node.e.v;
-  for (let i = 0, len = node.e.s; i < len; i++) {
-    result.set(deserialize(ctx, keys[i]), deserialize(ctx, vals[i]));
+  for (
+    let i = 0, keys = node.e.k, vals = node.e.v, len = keys.length;
+    i < len;
+    i++
+  ) {
+    result.set(
+      deserialize(ctx, depth, keys[i]),
+      deserialize(ctx, depth, vals[i]),
+    );
   }
   return result;
 }
@@ -310,55 +434,70 @@ function deserializeArrayBuffer(
   ctx: DeserializerContext,
   node: SerovalArrayBufferNode,
 ): ArrayBuffer {
+  if (node.s.length > MAX_BASE64_LENGTH) {
+    throw new SerovalMalformedNodeError(node);
+  }
   const result = assignIndexedValue(
     ctx,
     node.i,
-    ARRAY_BUFFER_CONSTRUCTOR(node.l, deserializeString(node.s)),
+    ARRAY_BUFFER_CONSTRUCTOR(deserializeString(node.s)),
   );
   return result;
 }
 
 function deserializeTypedArray(
   ctx: DeserializerContext,
+  depth: number,
   node: SerovalTypedArrayNode | SerovalBigIntTypedArrayNode,
 ): TypedArrayValue | BigIntTypedArrayValue {
   const construct = getTypedArrayConstructor(node.c) as Int8ArrayConstructor;
-  const source = deserialize(ctx, node.f) as ArrayBuffer;
+  const source = deserialize(ctx, depth, node.f) as ArrayBuffer;
+  const offset = node.b ?? 0;
+  if (offset < 0 || offset > source.byteLength) {
+    throw new SerovalMalformedNodeError(node);
+  }
   const result = assignIndexedValue(
     ctx,
     node.i,
-    new construct(source, node.b, node.l),
+    new construct(source, offset, node.l),
   );
   return result;
 }
 
 function deserializeDataView(
   ctx: DeserializerContext,
+  depth: number,
   node: SerovalDataViewNode,
 ): DataView {
-  const source = deserialize(ctx, node.f) as ArrayBuffer;
+  const source = deserialize(ctx, depth, node.f) as ArrayBuffer;
+  const offset = node.b ?? 0;
+  if (offset < 0 || offset > source.byteLength) {
+    throw new SerovalMalformedNodeError(node);
+  }
   const result = assignIndexedValue(
     ctx,
     node.i,
-    new DataView(source, node.b, node.l),
+    new DataView(source, offset, node.l),
   );
   return result;
 }
 
 function deserializeDictionary<T extends AssignableValue>(
   ctx: DeserializerContext,
+  depth: number,
   node: AssignableNode,
   result: T,
 ): T {
   if (node.p) {
-    const fields = deserializeProperties(ctx, node.p, {});
-    Object.assign(result, fields);
+    const fields = deserializeProperties(ctx, depth, node.p, {});
+    Object.defineProperties(result, Object.getOwnPropertyDescriptors(fields));
   }
   return result;
 }
 
 function deserializeAggregateError(
   ctx: DeserializerContext,
+  depth: number,
   node: SerovalAggregateErrorNode,
 ): AggregateError {
   // Serialize the required arguments
@@ -370,29 +509,31 @@ function deserializeAggregateError(
   // `AggregateError` might've been extended
   // either through class or custom properties
   // Make sure to assign extra properties
-  return deserializeDictionary(ctx, node, result);
+  return deserializeDictionary(ctx, depth, node, result);
 }
 
 function deserializeError(
   ctx: DeserializerContext,
+  depth: number,
   node: SerovalErrorNode,
 ): Error {
-  const construct = ERROR_CONSTRUCTOR[node.s];
+  const construct = deserializeKnownValue(node, ERROR_CONSTRUCTOR, node.s);
   const result = assignIndexedValue(
     ctx,
     node.i,
     new construct(deserializeString(node.m)),
   );
-  return deserializeDictionary(ctx, node, result);
+  return deserializeDictionary(ctx, depth, node, result);
 }
 
 function deserializePromise(
   ctx: DeserializerContext,
+  depth: number,
   node: SerovalPromiseNode,
 ): Promise<unknown> {
   const deferred = PROMISE_CONSTRUCTOR();
   const result = assignIndexedValue(ctx, node.i, deferred.p);
-  const deserialized = deserialize(ctx, node.f);
+  const deserialized = deserialize(ctx, depth, node.f);
   if (node.s) {
     deferred.s(deserialized);
   } else {
@@ -403,14 +544,20 @@ function deserializePromise(
 
 function deserializeBoxed(
   ctx: DeserializerContext,
+  depth: number,
   node: SerovalBoxedNode,
 ): unknown {
-  // biome-ignore lint/style/useConsistentBuiltinInstantiation: intended
-  return assignIndexedValue(ctx, node.i, Object(deserialize(ctx, node.f)));
+  return assignIndexedValue(
+    ctx,
+    node.i,
+    // biome-ignore lint/style/useConsistentBuiltinInstantiation: intended
+    Object(deserialize(ctx, depth, node.f)),
+  );
 }
 
 function deserializePlugin(
   ctx: DeserializerContext,
+  depth: number,
   node: SerovalPluginNode,
 ): unknown {
   const currentPlugins = ctx.base.plugins;
@@ -419,13 +566,10 @@ function deserializePlugin(
     for (let i = 0, len = currentPlugins.length; i < len; i++) {
       const plugin = currentPlugins[i];
       if (plugin.tag === tag) {
-        if (ctx.child == null) {
-          ctx.child = new DeserializePluginContext(ctx);
-        }
         return assignIndexedValue(
           ctx,
           node.i,
-          plugin.deserialize(node.s, ctx.child, {
+          plugin.deserialize(node.s, new DeserializePluginContext(ctx, depth), {
             id: node.i,
           }),
         );
@@ -448,59 +592,65 @@ function deserializePromiseConstructor(
 
 function deserializePromiseResolve(
   ctx: DeserializerContext,
+  depth: number,
   node: SerovalPromiseResolveNode,
 ): unknown {
   const deferred = ctx.base.refs.get(node.i) as
     | PromiseConstructorResolver
     | undefined;
   if (deferred) {
-    deferred.s(deserialize(ctx, node.a[1]));
-    return undefined;
+    deferred.s(deserialize(ctx, depth, node.a[1]));
+    return NIL;
   }
   throw new SerovalMissingInstanceError('Promise');
 }
 
 function deserializePromiseReject(
   ctx: DeserializerContext,
+  depth: number,
   node: SerovalPromiseRejectNode,
 ): unknown {
   const deferred = ctx.base.refs.get(node.i) as
     | PromiseConstructorResolver
     | undefined;
   if (deferred) {
-    deferred.f(deserialize(ctx, node.a[1]));
-    return undefined;
+    deferred.f(deserialize(ctx, depth, node.a[1]));
+    return NIL;
   }
   throw new SerovalMissingInstanceError('Promise');
 }
 
 function deserializeIteratorFactoryInstance(
   ctx: DeserializerContext,
+  depth: number,
   node: SerovalIteratorFactoryInstanceNode,
 ): unknown {
-  deserialize(ctx, node.a[0]);
-  const source = deserialize(ctx, node.a[1]);
+  deserialize(ctx, depth, node.a[0]);
+  const source = deserialize(ctx, depth, node.a[1]);
   return sequenceToIterator(source as Sequence);
 }
 
 function deserializeAsyncIteratorFactoryInstance(
   ctx: DeserializerContext,
+  depth: number,
   node: SerovalAsyncIteratorFactoryInstanceNode,
 ): unknown {
-  deserialize(ctx, node.a[0]);
-  const source = deserialize(ctx, node.a[1]);
+  deserialize(ctx, depth, node.a[0]);
+  const source = deserialize(ctx, depth, node.a[1]);
   return streamToAsyncIterable(source as Stream<any>);
 }
 
 function deserializeStreamConstructor(
   ctx: DeserializerContext,
+  depth: number,
   node: SerovalStreamConstructorNode,
 ): unknown {
   const result = assignIndexedValue(ctx, node.i, createStream());
-  const len = node.a.length;
+  const items = node.a;
+  const len = items.length;
   if (len) {
     for (let i = 0; i < len; i++) {
-      deserialize(ctx, node.a[i]);
+      deserialize(ctx, depth, items[i]);
     }
   }
   return result;
@@ -508,126 +658,140 @@ function deserializeStreamConstructor(
 
 function deserializeStreamNext(
   ctx: DeserializerContext,
+  depth: number,
   node: SerovalStreamNextNode,
 ): unknown {
   const deferred = ctx.base.refs.get(node.i) as Stream<unknown> | undefined;
-  if (deferred) {
-    deferred.next(deserialize(ctx, node.f));
-    return undefined;
+  if (deferred && isStream(deferred)) {
+    deferred.next(deserialize(ctx, depth, node.f));
+    return NIL;
   }
   throw new SerovalMissingInstanceError('Stream');
 }
 
 function deserializeStreamThrow(
   ctx: DeserializerContext,
+  depth: number,
   node: SerovalStreamThrowNode,
 ): unknown {
   const deferred = ctx.base.refs.get(node.i) as Stream<unknown> | undefined;
-  if (deferred) {
-    deferred.throw(deserialize(ctx, node.f));
-    return undefined;
+  if (deferred && isStream(deferred)) {
+    deferred.throw(deserialize(ctx, depth, node.f));
+    return NIL;
   }
   throw new SerovalMissingInstanceError('Stream');
 }
 
 function deserializeStreamReturn(
   ctx: DeserializerContext,
+  depth: number,
   node: SerovalStreamReturnNode,
 ): unknown {
   const deferred = ctx.base.refs.get(node.i) as Stream<unknown> | undefined;
-  if (deferred) {
-    deferred.return(deserialize(ctx, node.f));
-    return undefined;
+  if (deferred && isStream(deferred)) {
+    deferred.return(deserialize(ctx, depth, node.f));
+    return NIL;
   }
   throw new SerovalMissingInstanceError('Stream');
 }
 
 function deserializeIteratorFactory(
   ctx: DeserializerContext,
+  depth: number,
   node: SerovalIteratorFactoryNode,
 ): unknown {
-  deserialize(ctx, node.f);
-  return undefined;
+  deserialize(ctx, depth, node.f);
+  return NIL;
 }
 
 function deserializeAsyncIteratorFactory(
   ctx: DeserializerContext,
+  depth: number,
   node: SerovalAsyncIteratorFactoryNode,
 ): unknown {
-  deserialize(ctx, node.a[1]);
-  return undefined;
+  deserialize(ctx, depth, node.a[1]);
+  return NIL;
 }
-export function deserialize(
+
+function deserialize(
   ctx: DeserializerContext,
+  depth: number,
   node: SerovalNode,
 ): unknown {
+  if (depth > ctx.base.depthLimit) {
+    throw new SerovalDepthLimitError(ctx.base.depthLimit);
+  }
+  depth += 1;
   switch (node.t) {
     case SerovalNodeType.Constant:
-      return CONSTANT_VAL[node.s];
+      return deserializeKnownValue(node, CONSTANT_VAL, node.s);
     case SerovalNodeType.Number:
-      return node.s;
+      return Number(node.s);
     case SerovalNodeType.String:
-      return deserializeString(node.s);
+      return deserializeString(String(node.s));
     case SerovalNodeType.BigInt:
+      if (String(node.s).length > MAX_BIGINT_LENGTH) {
+        throw new SerovalMalformedNodeError(node);
+      }
       return BigInt(node.s);
     case SerovalNodeType.IndexedValue:
       return ctx.base.refs.get(node.i);
     case SerovalNodeType.Reference:
       return deserializeReference(ctx, node);
     case SerovalNodeType.Array:
-      return deserializeArray(ctx, node);
+      return deserializeArray(ctx, depth, node);
     case SerovalNodeType.Object:
     case SerovalNodeType.NullConstructor:
-      return deserializeObject(ctx, node);
+      return deserializeObject(ctx, depth, node);
     case SerovalNodeType.Date:
       return deserializeDate(ctx, node);
     case SerovalNodeType.RegExp:
       return deserializeRegExp(ctx, node);
     case SerovalNodeType.Set:
-      return deserializeSet(ctx, node);
+      return deserializeSet(ctx, depth, node);
     case SerovalNodeType.Map:
-      return deserializeMap(ctx, node);
+      return deserializeMap(ctx, depth, node);
     case SerovalNodeType.ArrayBuffer:
       return deserializeArrayBuffer(ctx, node);
     case SerovalNodeType.BigIntTypedArray:
     case SerovalNodeType.TypedArray:
-      return deserializeTypedArray(ctx, node);
+      return deserializeTypedArray(ctx, depth, node);
     case SerovalNodeType.DataView:
-      return deserializeDataView(ctx, node);
+      return deserializeDataView(ctx, depth, node);
     case SerovalNodeType.AggregateError:
-      return deserializeAggregateError(ctx, node);
+      return deserializeAggregateError(ctx, depth, node);
     case SerovalNodeType.Error:
-      return deserializeError(ctx, node);
+      return deserializeError(ctx, depth, node);
     case SerovalNodeType.Promise:
-      return deserializePromise(ctx, node);
+      return deserializePromise(ctx, depth, node);
     case SerovalNodeType.WKSymbol:
-      return SYMBOL_REF[node.s];
+      return deserializeKnownValue(node, SYMBOL_REF, node.s);
     case SerovalNodeType.Boxed:
-      return deserializeBoxed(ctx, node);
+      return deserializeBoxed(ctx, depth, node);
     case SerovalNodeType.Plugin:
-      return deserializePlugin(ctx, node);
+      return deserializePlugin(ctx, depth, node);
     case SerovalNodeType.PromiseConstructor:
       return deserializePromiseConstructor(ctx, node);
     case SerovalNodeType.PromiseSuccess:
-      return deserializePromiseResolve(ctx, node);
+      return deserializePromiseResolve(ctx, depth, node);
     case SerovalNodeType.PromiseFailure:
-      return deserializePromiseReject(ctx, node);
+      return deserializePromiseReject(ctx, depth, node);
     case SerovalNodeType.IteratorFactoryInstance:
-      return deserializeIteratorFactoryInstance(ctx, node);
+      return deserializeIteratorFactoryInstance(ctx, depth, node);
     case SerovalNodeType.AsyncIteratorFactoryInstance:
-      return deserializeAsyncIteratorFactoryInstance(ctx, node);
+      return deserializeAsyncIteratorFactoryInstance(ctx, depth, node);
     case SerovalNodeType.StreamConstructor:
-      return deserializeStreamConstructor(ctx, node);
+      return deserializeStreamConstructor(ctx, depth, node);
     case SerovalNodeType.StreamNext:
-      return deserializeStreamNext(ctx, node);
+      return deserializeStreamNext(ctx, depth, node);
     case SerovalNodeType.StreamThrow:
-      return deserializeStreamThrow(ctx, node);
+      return deserializeStreamThrow(ctx, depth, node);
     case SerovalNodeType.StreamReturn:
-      return deserializeStreamReturn(ctx, node);
+      return deserializeStreamReturn(ctx, depth, node);
     case SerovalNodeType.IteratorFactory:
-      return deserializeIteratorFactory(ctx, node);
+      return deserializeIteratorFactory(ctx, depth, node);
     case SerovalNodeType.AsyncIteratorFactory:
-      return deserializeAsyncIteratorFactory(ctx, node);
+      return deserializeAsyncIteratorFactory(ctx, depth, node);
     // case SerovalNodeType.SpecialReference:
     default:
       throw new SerovalUnsupportedNodeError(node);
@@ -639,7 +803,7 @@ export function deserializeTop(
   node: SerovalNode,
 ): unknown {
   try {
-    return deserialize(ctx, node);
+    return deserialize(ctx, 0, node);
   } catch (error) {
     throw new SerovalDeserializationError(error);
   }