vole_document/limits.rs
1//! Centralized resource bounds.
2//!
3//! Every decode and encode path takes a [`Limits`]. Untrusted descriptors must
4//! be rejected *before* catastrophic work is performed, so all arithmetic on
5//! declared lengths and offsets is checked against these bounds and uses
6//! checked integer operations.
7
8/// Hard upper bounds applied while parsing and materializing a descriptor.
9#[derive(Debug, Clone, Copy, PartialEq, Eq)]
10pub struct Limits {
11 /// Maximum accepted source/descriptor input size.
12 pub max_input_bytes: u64,
13 /// Maximum reconstructed output size for a single materialization.
14 pub max_output_bytes: u64,
15 /// Admission cap on the output of a single `DEFLATE_REPLAY`.
16 ///
17 /// This is a **VOLE replay-profile policy limit**, not an RFC 1951 maximum.
18 /// RFC 1951 permits arbitrarily many empty non-final stored blocks, so it
19 /// gives no finite `f(decompressed_size)` bound on `compressed_size`; a
20 /// bitstream that inflates to zero bytes may be arbitrarily large. VOLE
21 /// therefore declines to replay a descriptor whose declared output exceeds
22 /// this policy cap (see ADR-0016).
23 pub max_replay_bytes: u64,
24 /// Maximum length of a single record payload.
25 pub max_record_len: u32,
26 /// Maximum number of records in a container.
27 pub max_record_count: u32,
28 /// Maximum number of distinct byte objects (`OBJECT` records).
29 pub max_object_count: u32,
30 /// Maximum number of DRA instructions in a reconstruction graph.
31 pub max_graph_ops: u32,
32 /// Maximum repeat count for a single `REPEAT_LAST` instruction.
33 pub max_repeat_count: u64,
34 /// Maximum number of symbols in a single entropy channel.
35 pub max_channel_symbols: u64,
36 /// Maximum number of distinct entropy models (`MODEL` records).
37 pub max_model_count: u32,
38 /// Maximum number of entropy channels (`ENTROPY_CHANNEL` records).
39 pub max_channel_count: u32,
40 /// Maximum encoded size of a single entropy model payload.
41 pub max_entropy_model_bytes: u32,
42 /// Maximum number of lexical spans produced for a PDF input.
43 pub max_pdf_spans: u32,
44 /// Maximum number of selectors in a single `OBSERVATION_INDEX` record.
45 ///
46 /// Bounds the admissions of the optional partial-decode index (Phase 7.3)
47 /// before allocation: an index whose selector table would exceed this is
48 /// rejected at parse and declined by the index builder. It mirrors the
49 /// object/graph scale so the table cannot dwarf the document it describes.
50 pub max_index_selectors: u32,
51 /// Maximum accepted size of an optional `DIRECTORY` record payload.
52 ///
53 /// Bounds the seek directory (Phase 8) before allocation: a directory larger
54 /// than this is declined at decode rather than trusted. A directory is roughly
55 /// `13 * record_count` bytes, so this also caps the record count a directory
56 /// can describe.
57 pub max_directory_bytes: u32,
58 /// Maximum accepted size of an optional `CHECKPOINT` record payload.
59 ///
60 /// Bounds the byte-level partial-materialization checkpoint (Phase 13.4)
61 /// before allocation: a checkpoint larger than this is declined at decode
62 /// rather than trusted. A checkpoint is `20 + 16 * op_count` bytes, so this
63 /// also caps the op count a checkpoint can describe.
64 pub max_checkpoint_bytes: u32,
65 // The ZIP caps below mirror the threat model and DEFAULT/STRICT values frozen
66 // in `research/subagents/phase-12/I-security.md` §6 (threat ids Z1–Z15), as
67 // required by plan §DEC-3/§DEC-9.
68 /// Maximum number of ZIP members accepted in one archive (Phase 12, Z2).
69 pub max_zip_members: u32,
70 /// Maximum declared compressed size of a single ZIP member (Phase 12, Z1).
71 pub max_zip_member_compressed: u64,
72 /// Maximum declared uncompressed size of a single ZIP member (Phase 12, Z1).
73 pub max_zip_member_uncompressed: u64,
74 /// Maximum sum of declared uncompressed sizes across all members (Z2).
75 pub max_zip_aggregate_uncompressed: u64,
76 /// Maximum declared uncompressed/compressed ratio for one member (Z1).
77 pub max_zip_compression_ratio: u32,
78 /// Maximum raw name byte length of one member (Phase 12, Z13/Z14).
79 pub max_zip_name_bytes: u32,
80 /// Maximum raw extra-field byte length of one member (Z7/Z14).
81 pub max_zip_extra_bytes: u32,
82 /// Maximum per-entry comment byte length (Z14).
83 pub max_zip_entry_comment_bytes: u32,
84 /// Maximum archive comment byte length (Z14/Z15).
85 pub max_zip_archive_comment_bytes: u32,
86 /// Maximum central-directory byte length (Z14).
87 pub max_zip_central_dir_bytes: u64,
88 /// Maximum leading bytes before the first local header (Z14).
89 pub max_zip_prefix_bytes: u64,
90 /// Maximum trailing bytes after the EOCD record (Z14).
91 pub max_zip_trailing_bytes: u64,
92 // The XML/OPC caps below mirror the threat model and DEFAULT/STRICT values
93 // frozen in `research/subagents/phase-12/I-security.md` §6 (§2 XML, §3 OPC),
94 // as required by plan §DEC-4/§DEC-9. XML is derived (`Q_gen`) state only.
95 /// Maximum XML element nesting depth before a typed decline (Phase 12, §2).
96 pub max_xml_depth: u32,
97 /// Maximum decoded byte length of a single XML part (Phase 12, §2).
98 pub max_xml_part_bytes: u64,
99 /// Maximum number of XML pull events in a single part (Phase 12, §2).
100 pub max_xml_events: u64,
101 /// Maximum number of XML element nodes in a single part (Phase 12, §2).
102 pub max_xml_nodes: u64,
103 /// Maximum number of attributes on a single XML element (Phase 12, §2).
104 pub max_xml_attrs_per_element: u32,
105 /// Maximum total text bytes accepted across a single XML part (Phase 12, §2).
106 pub max_xml_text_bytes: u64,
107 /// Maximum source length admitted for byte-based standalone XML detection
108 /// (Phase 21.9). A bare XML source above this cap — whose adapter reads the
109 /// whole source as one `DocumentExact` — falls back to
110 /// [`crate::field::document_format::DocumentFormat::Opaque`].
111 pub max_xml_document_bytes: u64,
112 /// Maximum relationships across all `.rels` parts (Phase 12, §3).
113 pub max_opc_rels: u32,
114 /// Maximum internal relationship traversal depth (Phase 12 cycles, §3).
115 pub max_opc_rel_depth: u32,
116 /// Maximum `Default`+`Override` entries in `[Content_Types].xml` (Phase 12, §3).
117 pub max_opc_content_types_overrides: u32,
118 /// Maximum byte length of an OPC part name (Phase 12, §3).
119 pub max_opc_part_name_bytes: u32,
120 // The EPUB/OCF caps below mirror the threat model and DEFAULT/STRICT values
121 // frozen in `research/subagents/phase-12/I-security.md` §6 (§4 EPUB), as
122 // required by plan §DEC-5/§DEC-9. EPUB semantics are derived (`Q_gen`) only.
123 /// Maximum `rootfile` entries accepted in `META-INF/container.xml` (Phase 12, §4).
124 pub max_epub_rootfiles: u32,
125 /// Maximum Package Document manifest items accepted (Phase 12, §4).
126 pub max_epub_manifest_items: u32,
127 /// Maximum Package Document spine `itemref`s accepted (Phase 12, §4).
128 pub max_epub_spine_items: u32,
129 /// Maximum navigation-document nesting depth accepted (Phase 12, §4).
130 pub max_epub_nav_depth: u32,
131 /// Maximum manifest `fallback` chain length followed (Phase 12, §4).
132 pub max_epub_fallback_chain: u32,
133 /// Maximum XHTML element nodes accepted in one content/nav document (Phase 12, §4).
134 pub max_xhtml_nodes: u32,
135 // The ODT/ODF caps below mirror the EPUB caps above (Phase 13.3 applies the same
136 // bounded-XML policy to the OpenDocument content model). ODT semantics are derived
137 // (`Q_gen`) only.
138 /// Maximum `file-entry` elements accepted in `META-INF/manifest.xml` (Phase 13.3).
139 pub max_odt_manifest_entries: u32,
140 /// Maximum block elements accepted in one OpenDocument content part (Phase 13.3).
141 pub max_odt_blocks: u32,
142 /// Maximum notes accepted in one OpenDocument content part (Phase 13.3).
143 pub max_odt_notes: u32,
144 // The ODS/OpenDocument-Spreadsheet caps below bound the derived spreadsheet
145 // model (Phase 21.3.1). ODS semantics are derived (`Q_gen`) only.
146 /// Maximum `table:table` sheets accepted in one OpenDocument spreadsheet
147 /// content part (Phase 21.3.1).
148 pub max_ods_sheets: u32,
149 /// Maximum *expanded* grid slots accepted across one spreadsheet, after
150 /// `table:number-rows-repeated`/`table:number-columns-repeated` expansion
151 /// (Phase 21.3.1). Each expanded row charges at least one slot even when it
152 /// declares no cells, so an empty-row repeat bomb still declines. This is the
153 /// ODS analogue of the XLSX coordinate bound (ADR-0059): a repeated span is
154 /// bounded and the *expanded* count declines typed rather than allocating.
155 pub max_ods_cells: u64,
156 /// Maximum repeat count admitted for a single
157 /// `table:number-columns-repeated`/`table:number-rows-repeated` attribute
158 /// (Phase 21.3.1). A declaration above this bound is a typed resource-limit
159 /// decline, never an allocation.
160 pub max_ods_repeated_span: u32,
161 /// Maximum merged spans (`table:number-columns-spanned`>1 or
162 /// `table:number-rows-spanned`>1) accepted across one spreadsheet
163 /// (Phase 21.3.1).
164 pub max_ods_merges: u32,
165 /// Maximum named expressions
166 /// (`table:named-range`/`table:named-expression`) accepted across one
167 /// spreadsheet (Phase 21.3.1).
168 pub max_ods_named_expressions: u32,
169 /// Maximum `style:style` cell-style records accepted in one spreadsheet's
170 /// automatic styles or styles part (Phase 21.3.1).
171 pub max_ods_styles: u32,
172 /// Maximum `office:annotation` cell comments accepted across one spreadsheet
173 /// (Phase 21.3.1).
174 pub max_ods_comments: u32,
175 // The XLSX/SpreadsheetML caps below bound the derived semantic model
176 // (Phase 21.1.1). XLSX semantics are derived (`Q_gen`) only.
177 /// Maximum `<sheet>` declarations accepted in one workbook (Phase 21.1.1).
178 pub max_xlsx_sheets: u32,
179 /// Maximum cells accepted in one worksheet part (Phase 21.1.1).
180 pub max_xlsx_cells: u64,
181 /// Maximum shared strings accepted in `xl/sharedStrings.xml` (Phase 21.1.1).
182 pub max_xlsx_shared_strings: u32,
183 /// Maximum merged ranges accepted in one worksheet (Phase 21.1.1).
184 pub max_xlsx_merges: u32,
185 /// Maximum hyperlinks accepted in one worksheet (Phase 21.1.2).
186 pub max_xlsx_hyperlinks: u32,
187 /// Maximum comments accepted in one comments part (Phase 21.1.2).
188 pub max_xlsx_comments: u32,
189 /// Maximum table parts accepted across a workbook (Phase 21.1.2).
190 pub max_xlsx_tables: u32,
191 /// Maximum columns accepted in one table part (Phase 21.1.2).
192 pub max_xlsx_table_columns: u32,
193 /// Maximum defined/named ranges accepted in one workbook (Phase 21.1.2).
194 pub max_xlsx_defined_names: u32,
195 /// Maximum drawing parts accepted across a workbook (Phase 21.1.2).
196 pub max_xlsx_drawings: u32,
197 /// Maximum style records (fonts/fills/`cellXfs`) accepted in `styles.xml` (Phase 21.1.2).
198 pub max_xlsx_style_records: u32,
199 /// Maximum 0-based column index accepted in a cell reference (Phase 21.1.2).
200 ///
201 /// The Excel-conformant grid is 16,384 columns wide (A..XFD), so a valid
202 /// 0-based column is `< 16384`; a coordinate at or beyond this bound is a
203 /// typed resource-limit decline. Bounding the coordinate here keeps a single
204 /// hostile reference from driving an unbounded projection downstream.
205 pub max_xlsx_col: u32,
206 /// Maximum 0-based row index accepted in a cell/row reference (Phase 21.1.2).
207 ///
208 /// The Excel-conformant grid is 1,048,576 rows tall (1..1048576), so a valid
209 /// 0-based row is `< 1 << 20`; a coordinate at or beyond this bound is a
210 /// typed resource-limit decline.
211 pub max_xlsx_row: u32,
212 // The PPTX/PresentationML caps below bound the derived semantic model
213 // (Phase 21.2.1). PPTX semantics are derived (`Q_gen`) only.
214 /// Maximum slides accepted in one presentation (Phase 21.2.1).
215 pub max_pptx_slides: u32,
216 /// Maximum shapes accepted in one slide's shape tree, including group
217 /// descendants (Phase 21.2.1).
218 pub max_pptx_shapes_per_slide: u32,
219 /// Maximum text runs (`a:t`) accepted in one slide (Phase 21.2.1).
220 pub max_pptx_text_runs: u32,
221 /// Maximum group-shape nesting depth accepted in one slide (Phase 21.2.1).
222 pub max_pptx_group_depth: u32,
223 /// Maximum media parts (images/audio/video) exposed by one presentation
224 /// (Phase 21.2.1).
225 pub max_pptx_media: u32,
226 /// Maximum embedded tables accepted in one slide (Phase 21.2.1).
227 pub max_pptx_tables: u32,
228 /// Maximum table cells accepted across one slide's tables (Phase 21.2.1).
229 pub max_pptx_table_cells: u32,
230 /// Maximum notes-slide parts accepted in one presentation (Phase 21.2.1).
231 pub max_pptx_notes: u32,
232 /// Maximum slide-layout parts accepted in one presentation (Phase 21.2.1).
233 pub max_pptx_layouts: u32,
234 /// Maximum slide-master parts accepted in one presentation, and the bound
235 /// applied to theme parts (Phase 21.2.1).
236 pub max_pptx_masters: u32,
237 // The ODP/OpenDocument-Presentation caps below bound the derived presentation
238 // model (Phase 21.4.1). ODP semantics are derived (`Q_gen`) only.
239 /// Maximum `draw:page` slides accepted in one OpenDocument presentation
240 /// content part (Phase 21.4.1).
241 pub max_odp_slides: u32,
242 /// Maximum shapes accepted in one slide, including group descendants
243 /// (Phase 21.4.1).
244 pub max_odp_shapes_per_slide: u32,
245 /// Maximum text runs (`text:span`) accepted in one slide (Phase 21.4.1).
246 pub max_odp_text_runs: u32,
247 /// Maximum `draw:g` group nesting depth accepted in one slide (Phase 21.4.1).
248 pub max_odp_group_depth: u32,
249 /// Maximum `Pictures/*` media parts exposed by one presentation (Phase 21.4.1).
250 pub max_odp_media: u32,
251 /// Maximum embedded tables (`table:table`) accepted in one slide
252 /// (Phase 21.4.1).
253 pub max_odp_tables: u32,
254 /// Maximum table cells accepted across one slide's tables, after
255 /// `table:number-columns-repeated`/`table:number-rows-repeated` expansion
256 /// (Phase 21.4.1). An over-large repeat declines typed rather than allocating.
257 pub max_odp_table_cells: u32,
258 /// Maximum notes pages (`presentation:notes`) accepted in one presentation
259 /// (Phase 21.4.1).
260 pub max_odp_notes: u32,
261 /// Maximum `style:master-page` master pages accepted, and the bound applied to
262 /// `style:style` records, in one presentation (Phase 21.4.1).
263 pub max_odp_masters: u32,
264 // The JSON caps below bound the derived, span-preserving structured-tree model
265 // (Phase 21.5.1). JSON is not a package: the whole source parses as exactly one
266 // JSON value beneath these caps, and everything derived is `Q_gen` only.
267 /// Maximum JSON container nesting depth accepted (objects/arrays). A deeper
268 /// document is not detected as JSON (and any direct parse declines typed)
269 /// rather than risking unbounded recursion (Phase 21.5.1).
270 pub max_json_depth: u32,
271 /// Maximum JSON nodes (values plus object member keys) accepted in one
272 /// document. An over-large document declines typed rather than allocating
273 /// (Phase 21.5.1).
274 pub max_json_nodes: u32,
275 /// Maximum total raw string-token bytes accepted across one JSON document
276 /// (the bytes between the quotes, escapes included). A conservative upper
277 /// bound on the decoded text (Phase 21.5.1).
278 pub max_json_string_bytes: u64,
279 /// Maximum source length admitted for byte-based JSON detection. Larger inputs
280 /// fall back to [`crate::field::document_format::DocumentFormat::Opaque`]
281 /// (Phase 21.5.1).
282 pub max_json_document_bytes: u64,
283 // The JSON5/JSONC caps below bound the derived, span-preserving structured
284 // model (Phase 21.17.1). Like JSON, JSON5 is not a package: the whole source
285 // parses as exactly one JSON5 value beneath these caps, and everything derived
286 // is `Q_gen` only.
287 /// Maximum JSON5 container nesting depth accepted (objects/arrays). A deeper
288 /// document is not detected as JSON5 (and any direct parse declines typed)
289 /// rather than risking unbounded recursion (Phase 21.17.1).
290 pub max_json5_depth: u32,
291 /// Maximum JSON5 nodes (values plus object member keys) accepted in one
292 /// document. An over-large document declines typed rather than allocating
293 /// (Phase 21.17.1).
294 pub max_json5_nodes: u32,
295 /// Maximum total raw string-token bytes accepted across one JSON5 document
296 /// (the bytes between the quotes, escapes included). A conservative upper bound
297 /// on the decoded text (Phase 21.17.1).
298 pub max_json5_string_bytes: u64,
299 /// Maximum comments (`//` and `/* … */`) accepted in one JSON5 document. An
300 /// over-commented document declines typed rather than allocating (Phase
301 /// 21.17.1).
302 pub max_json5_comments: u32,
303 /// Maximum source length admitted for byte-based JSON5/JSONC detection. Larger
304 /// inputs fall back to [`crate::field::document_format::DocumentFormat::Opaque`]
305 /// (Phase 21.17.1).
306 pub max_json5_document_bytes: u64,
307 // The YAML caps below bound the derived, span-preserving structured-tree model
308 // (Phase 21.6.1). Like JSON, YAML is not a package: the whole source parses as a
309 // bounded stream of documents beneath these caps, and everything derived is
310 // `Q_gen` only.
311 /// Maximum YAML container nesting depth accepted (mappings/sequences). A deeper
312 /// document is not detected as YAML (and any direct parse declines typed) rather
313 /// than risking unbounded recursion (Phase 21.6.1).
314 pub max_yaml_depth: u32,
315 /// Maximum YAML nodes (containers, scalars, aliases, empties) accepted in one
316 /// stream. An over-large document declines typed rather than allocating
317 /// (Phase 21.6.1).
318 pub max_yaml_nodes: u32,
319 /// Maximum YAML scalar nodes accepted in one stream (Phase 21.6.1).
320 pub max_yaml_scalars: u32,
321 /// Maximum YAML anchors (`&a`) accepted in one stream (Phase 21.6.1).
322 pub max_yaml_anchors: u32,
323 /// Maximum documents accepted in one YAML stream (Phase 21.6.1).
324 pub max_yaml_documents: u32,
325 /// Maximum total raw scalar-token bytes accepted across one YAML stream. A
326 /// conservative upper bound on the decoded text (Phase 21.6.1).
327 pub max_yaml_string_bytes: u64,
328 /// Maximum source length admitted for byte-based YAML detection. Larger inputs
329 /// fall back to [`crate::field::document_format::DocumentFormat::Opaque`]
330 /// (Phase 21.6.1).
331 pub max_yaml_document_bytes: u64,
332 // The CSV/TSV caps below bound the derived, span-preserving tabular model and
333 // its streaming reads (Phase 21.7.1). CSV/TSV is not a package: the whole
334 // source is the exact leaf, and everything derived is `Q_gen` only.
335 /// Maximum records accepted in one CSV/TSV table for a **built** span model
336 /// (including the header row). A larger table declines typed rather than
337 /// allocating; the streaming read selectors (`csv-row`/`csv-cell`/...) are not
338 /// bounded by this (they are bounded by one record at a time) (Phase 21.7.1).
339 pub max_csv_rows: u32,
340 /// Maximum fields accepted in a single CSV/TSV record. A record above this
341 /// bound is a typed resource-limit decline, never an allocation (Phase 21.7.1).
342 pub max_csv_cols: u32,
343 /// Maximum byte length of a single CSV/TSV record (terminator included) when a
344 /// span is retained; a longer record declines typed (Phase 21.7.1).
345 pub max_csv_record_bytes: u32,
346 /// Maximum byte length of a single CSV/TSV field (quotes included); a longer
347 /// field declines typed (Phase 21.7.1).
348 pub max_csv_field_bytes: u32,
349 /// Maximum source length admitted for byte-based CSV/TSV detection and parsing.
350 /// Larger inputs fall back to
351 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 21.7.1).
352 pub max_csv_document_bytes: u64,
353 /// Maximum records scanned when deciding whether a source is a CSV/TSV table.
354 /// Detection is a bounded sample, so a huge source is classified in bounded
355 /// memory (Phase 21.7.1).
356 pub max_csv_sampled_records_for_detection: u32,
357 // The Markdown caps below bound the derived, span-preserving prose model and its
358 // inline extraction (Phase 21.8.1). Markdown is not a package: the whole source
359 // is the exact leaf, and everything derived is `Q_gen` only.
360 /// Maximum container nesting depth accepted (list item depth, blockquote marker
361 /// depth). A deeper document is a typed resource-limit decline (Phase 21.8.1).
362 pub max_markdown_depth: u32,
363 /// Maximum nodes (blocks plus inline spans) accepted in one document. An
364 /// over-large document declines typed rather than allocating (Phase 21.8.1).
365 pub max_markdown_nodes: u32,
366 /// Maximum blocks accepted in one document (Phase 21.8.1).
367 pub max_markdown_blocks: u32,
368 /// Maximum inline spans accepted in one document (Phase 21.8.1).
369 pub max_markdown_inline_spans: u32,
370 /// Maximum total code content bytes accepted across one document (fenced and
371 /// indented code). A larger document declines typed (Phase 21.8.1).
372 pub max_markdown_code_bytes: u64,
373 /// Maximum source length admitted for byte-based Markdown detection and
374 /// parsing. Larger inputs fall back to
375 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 21.8.1).
376 pub max_markdown_document_bytes: u64,
377 // The HTML caps below bound the derived, span-preserving, error-recovering HTML
378 // model (Phase 21.10). HTML is not a package: the whole source is the exact
379 // leaf, and everything derived is `Q_gen` only. Unlike XML the HTML scanner is
380 // **error-recovering** (implicit tag closing, void elements, unquoted
381 // attributes, stray end tags), so a malformed document is recovered rather than
382 // declined — only a bound or a forbidden DOCTYPE internal subset declines.
383 /// Maximum element (and raw-text) nesting depth accepted. A deeper document is
384 /// a typed resource-limit decline (Phase 21.10).
385 pub max_html_depth: u32,
386 /// Maximum nodes (elements, text runs, comments, DOCTYPE, raw text) accepted in
387 /// one document. An over-large document declines typed rather than allocating
388 /// (Phase 21.10).
389 pub max_html_nodes: u32,
390 /// Maximum attributes accepted across one document (Phase 21.10).
391 pub max_html_attrs: u64,
392 /// Maximum total text bytes accepted across one document. A larger document
393 /// declines typed (Phase 21.10).
394 pub max_html_text_bytes: u64,
395 /// Maximum total raw `<script>`/`<style>` content bytes accepted across one
396 /// document (their raw text is captured, never executed or parsed) (Phase
397 /// 21.10).
398 pub max_html_script_bytes: u64,
399 /// Maximum source length admitted for byte-based HTML detection and parsing.
400 /// Larger inputs fall back to
401 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 21.10).
402 pub max_html_document_bytes: u64,
403 // The TOML caps below bound the derived, span-preserving TOML model (Phase
404 // 21.11). TOML is not a package: the whole source is the exact leaf, and
405 // everything derived is `Q_gen` only. TOML's duplicate-key and redefinition
406 // rules are enforced (a violation is a typed decline).
407 /// Maximum table/key nesting depth accepted. A deeper document is a typed
408 /// resource-limit decline (Phase 21.11).
409 pub max_toml_depth: u32,
410 /// Maximum nodes (tables, arrays, keys, scalars) accepted in one document. An
411 /// over-large document declines typed rather than allocating (Phase 21.11).
412 pub max_toml_nodes: u32,
413 /// Maximum keys accepted across one document (Phase 21.11).
414 pub max_toml_keys: u64,
415 /// Maximum total string/key bytes accepted across one document. A larger
416 /// document declines typed (Phase 21.11).
417 pub max_toml_string_bytes: u64,
418 /// Maximum source length admitted for byte-based TOML detection and parsing.
419 /// Larger inputs fall back to
420 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 21.11).
421 pub max_toml_document_bytes: u64,
422 // The JSONL/NDJSON caps below bound the derived, per-line span-preserving model
423 // (Phase 21.12). JSONL is not a package: the whole source is the exact leaf, and
424 // everything derived is `Q_gen` only. Each non-blank line is parsed by the
425 // shared JSON parser (never a second parser), so a line is bounded by the JSON
426 // depth cap as well.
427 /// Maximum non-blank record lines accepted in one JSONL document. A larger
428 /// document declines typed rather than allocating (Phase 21.12).
429 pub max_jsonl_records: u32,
430 /// Maximum byte length of one record line's JSON text (the terminator
431 /// excluded). A longer line declines typed (Phase 21.12).
432 pub max_jsonl_line_bytes: u64,
433 /// Maximum total JSON nodes (values plus object member keys) accepted across
434 /// **all** records of one JSONL document. This is a whole-document budget (a
435 /// single line is additionally bounded by the JSON node cap); an over-large
436 /// document declines typed rather than allocating (Phase 21.12).
437 pub max_jsonl_nodes: u32,
438 /// Maximum source length admitted for byte-based JSONL detection and parsing.
439 /// Larger inputs fall back to
440 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 21.12).
441 pub max_jsonl_document_bytes: u64,
442 // The EML/MIME caps below bound the derived, span-preserving message model
443 // (Phase 21.13). EML is not a package: the whole source is the exact leaf, and
444 // everything derived is `Q_gen` only. Every part is a leaf or a
445 // `multipart/*`/`message/rfc822` container, so the tree is bounded by depth and
446 // part count.
447 /// Maximum MIME part nesting depth accepted (root = 0). A deeper message is a
448 /// typed resource-limit decline (Phase 21.13).
449 pub max_eml_depth: u32,
450 /// Maximum MIME parts accepted in one message (the root counts). An over-large
451 /// message declines typed rather than allocating (Phase 21.13).
452 pub max_eml_parts: u32,
453 /// Maximum headers accepted across one message (all parts). A message with more
454 /// declines typed (Phase 21.13).
455 pub max_eml_headers: u32,
456 /// Maximum byte length of one part's entity (headers + body). A larger part
457 /// declines typed (Phase 21.13).
458 pub max_eml_part_bytes: u64,
459 /// Maximum total decoded bytes produced by a transfer-encoding decode (base64 /
460 /// quoted-printable). A larger decode declines typed (Phase 21.13).
461 pub max_eml_decoded_bytes: u64,
462 /// Maximum source length admitted for byte-based EML detection and parsing.
463 /// Larger inputs fall back to
464 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 21.13).
465 pub max_eml_document_bytes: u64,
466 // The Parquet caps below bound the derived, span-preserving analytical model
467 // (Phase 21.14). Parquet is not a package: the whole source is the exact leaf,
468 // and everything derived is `Q_gen` only.
469 /// Maximum number of row groups accepted in one Parquet file (Phase 21.14).
470 pub max_parquet_row_groups: u32,
471 /// Maximum number of leaf columns accepted in one Parquet file (Phase 21.14).
472 pub max_parquet_columns: u32,
473 /// Maximum number of pages accepted in one column chunk (Phase 21.14). A
474 /// page-bomb chunk declines typed rather than looping.
475 pub max_parquet_pages_per_chunk: u32,
476 /// Maximum number of decoded values across a Parquet column (Phase 21.14).
477 pub max_parquet_values: u64,
478 /// Maximum total decompressed page bytes across one decompression (Phase
479 /// 21.14). A decompression bomb declines typed.
480 pub max_parquet_decompressed_bytes: u64,
481 /// Maximum source length admitted for byte-based Parquet detection and parsing.
482 /// Larger inputs fall back to
483 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 21.14).
484 pub max_parquet_document_bytes: u64,
485 /// Maximum accepted Thrift-Compact footer byte length (Phase 21.14). A larger
486 /// footer declines typed before it is parsed.
487 pub max_parquet_footer_bytes: u64,
488 // The Arrow IPC caps below bound the derived, span-preserving analytical model
489 // (Phase 21.16). Arrow is not a package: the whole source is the exact leaf, and
490 // everything derived is `Q_gen` only.
491 /// Maximum number of encapsulated IPC messages (schema + dictionary + record
492 /// batches) accepted in one Arrow file/stream (Phase 21.16).
493 pub max_arrow_messages: u32,
494 /// Maximum number of schema columns (fields, flattened pre-order) accepted in
495 /// one Arrow file (Phase 21.16).
496 pub max_arrow_columns: u32,
497 /// Maximum number of record batches accepted in one Arrow file/stream (Phase
498 /// 21.16).
499 pub max_arrow_batches: u32,
500 /// Maximum number of logical rows accepted across one Arrow file/stream (Phase
501 /// 21.16). A larger file declines typed rather than allocating.
502 pub max_arrow_rows: u64,
503 /// Maximum number of buffers accepted across one record batch (Phase 21.16).
504 pub max_arrow_buffers: u64,
505 /// Maximum number of decoded values across an Arrow column (Phase 21.16).
506 pub max_arrow_values: u64,
507 /// Maximum total declared body/decompressed bytes across one decode (Phase
508 /// 21.16). A body bomb declines typed.
509 pub max_arrow_decompressed_bytes: u64,
510 /// Maximum source length admitted for byte-based Arrow detection and parsing.
511 /// Larger inputs fall back to
512 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 21.16).
513 pub max_arrow_document_bytes: u64,
514 /// Maximum accepted Flatbuffers metadata (footer or message) byte length (Phase
515 /// 21.16). A larger metadata declares typed before it is parsed.
516 pub max_arrow_metadata_bytes: u64,
517 // The CBOR caps below bound the derived, span-preserving structured-tree model
518 // (Phase 21.18). CBOR is not a package: the whole source is the exact leaf, and
519 // everything derived is `Q_gen` only.
520 /// Maximum CBOR nesting depth accepted (arrays/maps/tags). A deeper document is
521 /// not detected as CBOR (and any direct parse declines typed) rather than risking
522 /// unbounded recursion (Phase 21.18).
523 pub max_cbor_depth: u32,
524 /// Maximum CBOR items accepted in one document. An over-large document declines
525 /// typed rather than allocating (Phase 21.18).
526 pub max_cbor_nodes: u32,
527 /// Maximum total raw byte-/text-string payload bytes accepted across one CBOR
528 /// document. An over-large document declines typed (Phase 21.18).
529 pub max_cbor_string_bytes: u64,
530 /// Maximum source length admitted for byte-based CBOR detection and parsing.
531 /// Larger inputs fall back to
532 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 21.18).
533 pub max_cbor_document_bytes: u64,
534 // The MessagePack caps below bound the derived, span-preserving structured-tree
535 // model (Phase 21.19). MessagePack is not a package: the whole source is the
536 // exact leaf, and everything derived is `Q_gen` only.
537 /// Maximum MessagePack nesting depth accepted (arrays/maps). A deeper document
538 /// is not detected as MessagePack (and any direct parse declines typed) rather
539 /// than risking unbounded recursion (Phase 21.19).
540 pub max_msgpack_depth: u32,
541 /// Maximum MessagePack items accepted in one document. An over-large document
542 /// declines typed rather than allocating (Phase 21.19).
543 pub max_msgpack_nodes: u32,
544 /// Maximum total raw `str` payload bytes accepted across one MessagePack
545 /// document. An over-large document declines typed (Phase 21.19).
546 pub max_msgpack_str_bytes: u64,
547 /// Maximum total raw `bin` payload bytes accepted across one MessagePack
548 /// document. An over-large document declines typed (Phase 21.19).
549 pub max_msgpack_bin_bytes: u64,
550 /// Maximum total raw extension payload bytes accepted across one MessagePack
551 /// document. An over-large document declines typed (Phase 21.19).
552 pub max_msgpack_ext_bytes: u64,
553 /// Maximum source length admitted for byte-based MessagePack detection and
554 /// parsing. Larger inputs fall back to
555 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 21.19).
556 pub max_msgpack_document_bytes: u64,
557 // The config-family caps below bound the derived, span-preserving key/value
558 // model (Phase 21.20). The config family (INI / `.env` / `.properties`) is not
559 // a package: the whole source is the exact leaf, and everything derived is
560 // `Q_gen` only.
561 /// Maximum physical lines accepted across one config document. An over-large
562 /// document declines typed rather than allocating (Phase 21.20).
563 pub max_config_lines: u32,
564 /// Maximum total model nodes (lines) accepted across one config document
565 /// (Phase 21.20).
566 pub max_config_nodes: u32,
567 /// Maximum entries accepted across one config document (Phase 21.20).
568 pub max_config_entries: u32,
569 /// Maximum `properties` logical-line continuation depth accepted (the number
570 /// of physical lines merged by trailing `\` continuations). A deeper logical
571 /// line is not detected as config (and any direct parse declines typed) rather
572 /// than risking an unbounded scan (Phase 21.20).
573 pub max_config_depth: u32,
574 /// Maximum length of one (logical) config line in bytes (Phase 21.20).
575 pub max_config_line_bytes: u64,
576 /// Maximum length of one config key token in bytes (Phase 21.20).
577 pub max_config_key_bytes: u64,
578 /// Maximum length of one config value token in bytes (Phase 21.20).
579 pub max_config_value_bytes: u64,
580 /// Maximum source length admitted for byte-based config detection and parsing.
581 /// Larger inputs fall back to
582 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 21.20).
583 pub max_config_document_bytes: u64,
584 // The RSS/Atom feed caps below bound the derived, span-preserving feed model
585 // (Phase 21.21). A feed is not a package: the whole source is the exact leaf,
586 // and everything derived (the embedded span-preserving XML tree and the
587 // recognized channel/entry field arena) is `Q_gen` only.
588 /// Maximum record (`<item>`/`<entry>`) count accepted across one feed. An
589 /// over-large feed declines typed rather than allocating (Phase 21.21).
590 pub max_feed_entries: u32,
591 /// Maximum recognized field count (channel/feed fields plus every entry's
592 /// fields) accepted across one feed (Phase 21.21).
593 pub max_feed_fields: u32,
594 /// Maximum length of one recognized field element's whole span in bytes
595 /// (Phase 21.21).
596 pub max_feed_field_bytes: u64,
597 /// Maximum length of the canonical feed text projection in bytes (Phase 21.21).
598 pub max_feed_text_bytes: u64,
599 /// Maximum source length admitted for byte-based feed detection and parsing.
600 /// Larger inputs fall back to
601 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 21.21).
602 pub max_feed_document_bytes: u64,
603 // The GeoJSON caps below bound the derived, span-preserving GeoJSON model
604 // (Phase 21.22). GeoJSON's physical bytes are JSON, so the shared JSON parser's
605 // caps also apply; these add the semantic bounds on top. GeoJSON is not a
606 // package: the whole source is the exact leaf, and everything derived is `Q_gen`.
607 /// Maximum `Feature` count accepted across one GeoJSON document (the root
608 /// `Feature`, or every element of a `FeatureCollection`'s `features` array). An
609 /// over-large document declines typed rather than allocating (Phase 21.22).
610 pub max_geojson_features: u32,
611 /// Maximum geometry object count accepted across one GeoJSON document (in
612 /// pre-order; a `GeometryCollection`'s members are included) (Phase 21.22).
613 pub max_geojson_geometries: u32,
614 /// Maximum total coordinate-number count accepted across one GeoJSON
615 /// document's `coordinates` subtrees (Phase 21.22).
616 pub max_geojson_coordinates: u64,
617 /// Maximum GeoJSON structural recursion depth (geometry/`GeometryCollection`
618 /// nesting and `coordinates` nesting) (Phase 21.22).
619 pub max_geojson_depth: u32,
620 /// Maximum embedded JSON node count accepted for one GeoJSON document, in
621 /// addition to the JSON caps the shared parser already enforces (Phase 21.22).
622 pub max_geojson_nodes: u32,
623 /// Maximum source length admitted for byte-based GeoJSON detection and parsing.
624 /// Larger inputs fall back to
625 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 21.22).
626 pub max_geojson_document_bytes: u64,
627 // The KML/GPX geospatial caps below bound the derived, span-preserving GIS model
628 // (Phase 21.23). KML and GPX are XML, so the shared XML parser's caps also apply;
629 // these add the semantic bounds on top. GIS is not a package: the whole source is
630 // the exact leaf, and everything derived is `Q_gen`.
631 /// Maximum record count accepted across one GIS document (KML `<Placemark>`
632 /// features, or GPX top-level `<wpt>`/`<rte>`/`<trk>` records). An over-large
633 /// document declines typed rather than allocating (Phase 21.23).
634 pub max_gis_placemarks: u32,
635 /// Maximum GPX `<trk>` track count accepted across one GIS document
636 /// (Phase 21.23).
637 pub max_gis_tracks: u32,
638 /// Maximum point count accepted across one GIS document (KML geometry elements,
639 /// or GPX `<wpt>`/`<rtept>`/`<trkpt>` point elements) (Phase 21.23).
640 pub max_gis_points: u32,
641 /// Maximum GIS element nesting depth accepted (Phase 21.23).
642 pub max_gis_depth: u32,
643 /// Maximum embedded XML node count accepted for one GIS document, in addition
644 /// to the XML caps the shared parser already enforces (Phase 21.23).
645 pub max_gis_nodes: u32,
646 /// Maximum aggregate recognized-field bytes (and canonical text projection)
647 /// accepted across one GIS document (Phase 21.23).
648 pub max_gis_text_bytes: u64,
649 /// Maximum source length admitted for byte-based GIS detection and parsing.
650 /// Larger inputs fall back to
651 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 21.23).
652 pub max_gis_document_bytes: u64,
653 // The Jupyter notebook caps below bound the derived, span-preserving notebook model
654 // (Phase 21.24). A notebook's physical bytes are JSON, so the shared JSON parser's
655 // caps also apply; these add the semantic bounds on top. A notebook is not a
656 // package: the whole source is the exact leaf, and everything derived is `Q_gen`.
657 /// Maximum cell count accepted across one notebook. An over-large document
658 /// declines typed rather than allocating (Phase 21.24).
659 pub max_notebook_cells: u32,
660 /// Maximum total output count accepted across one notebook (every code cell's
661 /// `outputs` array) (Phase 21.24).
662 pub max_notebook_outputs: u32,
663 /// Maximum embedded JSON node count accepted for one notebook, in addition to the
664 /// JSON caps the shared parser already enforces (Phase 21.24).
665 pub max_notebook_nodes: u32,
666 /// Maximum notebook structural nesting depth accepted (Phase 21.24).
667 pub max_notebook_depth: u32,
668 /// Maximum aggregate cell `source` token bytes accepted across one notebook
669 /// (Phase 21.24).
670 pub max_notebook_source_bytes: u64,
671 /// Maximum source length admitted for byte-based notebook detection and parsing.
672 /// Larger inputs fall back to
673 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 21.24).
674 pub max_notebook_document_bytes: u64,
675 // The fixed-width (column-position) caps below bound the derived, span-preserving
676 // fixed-width table model and its selective reads (Phase 21.25). Fixed-width is not
677 // a package: the whole source is the exact leaf, and everything derived is `Q_gen`.
678 /// Maximum records (lines, including the header) accepted in one fixed-width table.
679 /// A larger table declines typed rather than allocating (Phase 21.25).
680 pub max_fixedwidth_rows: u32,
681 /// Maximum columns accepted in a fixed-width table. A table above this bound is a
682 /// typed resource-limit decline, never an allocation (Phase 21.25).
683 pub max_fixedwidth_cols: u32,
684 /// Maximum byte length of a single fixed-width record (content, terminator
685 /// excluded); a longer record declines typed (Phase 21.25).
686 pub max_fixedwidth_record_bytes: u32,
687 /// Maximum byte length of a single fixed-width field (padding included); a longer
688 /// field declines typed (Phase 21.25).
689 pub max_fixedwidth_field_bytes: u32,
690 /// Maximum source length admitted for byte-based fixed-width detection and parsing.
691 /// Larger inputs fall back to
692 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 21.25).
693 pub max_fixedwidth_document_bytes: u64,
694 /// Maximum records sampled when deciding whether a source is a fixed-width table.
695 /// Detection is a bounded sample, so a huge source is classified in bounded
696 /// memory (Phase 21.25).
697 pub max_fixedwidth_sampled_lines_for_detection: u32,
698 // The reStructuredText caps below bound the derived, span-preserving reST prose
699 // model and its inline extraction (Phase 21.26.1). reST is not a package: the
700 // whole source is the exact leaf, and everything derived is `Q_gen` only.
701 /// Maximum blocks accepted in one reStructuredText document (Phase 21.26.1).
702 pub max_rst_blocks: u32,
703 /// Maximum inline spans accepted in one reStructuredText document (Phase
704 /// 21.26.1).
705 pub max_rst_inline_spans: u32,
706 /// Maximum nodes (blocks plus inline spans) accepted in one reStructuredText
707 /// document. An over-large document declines typed rather than allocating
708 /// (Phase 21.26.1).
709 pub max_rst_nodes: u32,
710 /// Maximum section-title/list nesting depth accepted (Phase 21.26.1). A deeper
711 /// document is a typed resource-limit decline.
712 pub max_rst_depth: u32,
713 /// Maximum byte length of one physical line (content, terminator excluded) in a
714 /// reStructuredText document. A longer line declines typed (Phase 21.26.1).
715 pub max_rst_line_bytes: u64,
716 /// Maximum source length admitted for byte-based reStructuredText detection and
717 /// parsing. Larger inputs fall back to
718 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 21.26.1).
719 pub max_rst_document_bytes: u64,
720 // The AsciiDoc caps below bound the derived, span-preserving AsciiDoc prose model
721 // and its inline extraction (Phase 21.26.2). AsciiDoc is not a package: the whole
722 // source is the exact leaf, and everything derived is `Q_gen` only.
723 /// Maximum blocks accepted in one AsciiDoc document (Phase 21.26.2).
724 pub max_asciidoc_blocks: u32,
725 /// Maximum inline spans accepted in one AsciiDoc document (Phase 21.26.2).
726 pub max_asciidoc_inline_spans: u32,
727 /// Maximum nodes (blocks plus inline spans) accepted in one AsciiDoc document. An
728 /// over-large document declines typed rather than allocating (Phase 21.26.2).
729 pub max_asciidoc_nodes: u32,
730 /// Maximum section/list nesting depth accepted (Phase 21.26.2). A deeper document
731 /// is a typed resource-limit decline.
732 pub max_asciidoc_depth: u32,
733 /// Maximum byte length of one physical line (content, terminator excluded) in an
734 /// AsciiDoc document. A longer line declines typed (Phase 21.26.2).
735 pub max_asciidoc_line_bytes: u64,
736 /// Maximum source length admitted for byte-based AsciiDoc detection and parsing.
737 /// Larger inputs fall back to
738 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 21.26.2).
739 pub max_asciidoc_document_bytes: u64,
740 // The MDX caps below bound the derived, span-preserving MDX (Markdown + JSX/ESM)
741 // model. MDX is a superset of Markdown that **reuses the Markdown parser/model**
742 // (Phase 21.26.3) and layers ESM statements, JSX elements/fragments, and MDX
743 // expressions on top, each with an exact source span. MDX is not a package: the
744 // whole source is the exact leaf, and everything derived is `Q_gen` only.
745 /// Maximum ESM statements accepted in one MDX document (Phase 21.26.3).
746 pub max_mdx_esm_statements: u32,
747 /// Maximum JSX elements/fragments accepted in one MDX document (Phase 21.26.3).
748 pub max_mdx_jsx_blocks: u32,
749 /// Maximum MDX expressions accepted in one MDX document (Phase 21.26.3).
750 pub max_mdx_expressions: u32,
751 /// Maximum nodes (ESM statements plus JSX elements plus expressions) accepted in
752 /// one MDX document. An over-large document declines typed rather than allocating
753 /// (Phase 21.26.3).
754 pub max_mdx_nodes: u32,
755 /// Maximum JSX nesting depth accepted (Phase 21.26.3). A deeper document is a
756 /// typed resource-limit decline.
757 pub max_mdx_depth: u32,
758 /// Maximum byte length of one physical line (content, terminator excluded) in an
759 /// MDX document. A longer line declines typed (Phase 21.26.3).
760 pub max_mdx_line_bytes: u64,
761 /// Maximum source length admitted for byte-based MDX detection and parsing.
762 /// Larger inputs fall back to
763 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 21.26.3).
764 pub max_mdx_document_bytes: u64,
765 // The MHTML (MIME HTML) caps below bound the derived, span-preserving model
766 // (Phase 21.27). MHTML reuses the EML MIME layer and the HTML scanner, so their
767 // caps also apply; these add the MHTML-specific bounds on top. MHTML is not a
768 // package: the whole source is the exact leaf, and everything derived is `Q_gen`.
769 /// Maximum MIME part count accepted across one MHTML document (the root counts).
770 /// An over-large document declines typed rather than allocating (Phase 21.27).
771 pub max_mhtml_parts: u32,
772 /// Maximum header count accepted across one MHTML document (all parts). A
773 /// document with more declines typed (Phase 21.27).
774 pub max_mhtml_headers: u32,
775 /// Maximum MIME nesting depth accepted (root = 0). A deeper document declines
776 /// typed (Phase 21.27).
777 pub max_mhtml_depth: u32,
778 /// Maximum sub-resource count accepted across one MHTML document (parts carrying
779 /// a `Content-Location`/`Content-ID`). An over-large document declines typed
780 /// rather than allocating (Phase 21.27).
781 pub max_mhtml_resources: u32,
782 /// Maximum total decoded bytes accepted across one MHTML document (the root
783 /// part's decoded body plus every sub-resource). A larger decode declines typed
784 /// (Phase 21.27).
785 pub max_mhtml_decoded_bytes: u64,
786 /// Maximum embedded HTML node count accepted for the root part (Phase 21.27).
787 pub max_mhtml_nodes: u32,
788 /// Maximum source length admitted for byte-based MHTML detection and parsing.
789 /// Larger inputs fall back to
790 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 21.27).
791 pub max_mhtml_document_bytes: u64,
792 // The syslog / log-stream caps below bound the derived, span-preserving model
793 // (Phase 21.28). A log stream is not a package: the whole source is the exact
794 // leaf, and everything derived is `Q_gen` only. The model is a flat arena of
795 // records with exact-span fields, so it is bounded by record, field, and
796 // structured-data-element counts, one line's length, the deepest
797 // structured-data nesting, and the source length.
798 /// Maximum non-blank record lines accepted in one log stream. A larger document
799 /// declines typed rather than allocating (Phase 21.28).
800 pub max_logstream_records: u32,
801 /// Maximum total field spans accepted across **all** records of one log stream.
802 /// This is a whole-document budget; an over-large document declines typed rather
803 /// than allocating (Phase 21.28).
804 pub max_logstream_fields: u64,
805 /// Maximum total RFC 5424 structured-data elements accepted across one log
806 /// stream. An over-large document declines typed rather than allocating
807 /// (Phase 21.28).
808 pub max_logstream_sd_elements: u64,
809 /// Maximum byte length of one record line's content (the terminator excluded). A
810 /// longer line declines typed (Phase 21.28).
811 pub max_logstream_line_bytes: u64,
812 /// Maximum structured-data nesting depth accepted (record = 1, an element = 2, a
813 /// parameter = 3). A deeper record declines typed (Phase 21.28).
814 pub max_logstream_depth: u32,
815 /// Maximum source length admitted for byte-based log-stream detection and
816 /// parsing. Larger inputs fall back to
817 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 21.28).
818 pub max_logstream_document_bytes: u64,
819 // The package-metadata caps below bound the derived, span-preserving model
820 // (Phase 21.29). A manifest is not a package: the whole source is the exact leaf,
821 // and everything derived is `Q_gen` only. The model embeds the reused JSON/TOML
822 // arena and a flat section/entry projection, so it is bounded by node, section,
823 // entry, and structural-recursion counts plus the source length.
824 /// Maximum reused-arena node count accepted for a package manifest (in addition
825 /// to the JSON/TOML caps the shared parsers enforce). A larger document declines
826 /// typed (Phase 21.29).
827 pub max_pkgmeta_nodes: u32,
828 /// Maximum section count accepted for a package manifest. An over-large document
829 /// declines typed rather than allocating (Phase 21.29).
830 pub max_pkgmeta_sections: u32,
831 /// Maximum key/value entry count accepted for a package manifest. An over-large
832 /// document declines typed rather than allocating (Phase 21.29).
833 pub max_pkgmeta_entries: u32,
834 /// Maximum structural recursion depth accepted (root = 1). A deeper document
835 /// declines typed (Phase 21.29).
836 pub max_pkgmeta_depth: u32,
837 /// Maximum source length admitted for byte-based package-metadata detection and
838 /// parsing. Larger inputs fall back to
839 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 21.29).
840 pub max_pkgmeta_document_bytes: u64,
841 // The API-specification caps below bound the derived, span-preserving model
842 // (Phase 21.30). An API spec's physical bytes are JSON, so the shared JSON parser's
843 // caps also apply; these add the semantic bounds on top. An API spec is not a
844 // package: the whole source is the exact leaf, and everything derived is `Q_gen`.
845 /// Maximum embedded JSON node count accepted for one API-spec document, in
846 /// addition to the JSON caps the shared parser already enforces (Phase 21.30).
847 pub max_apispec_nodes: u32,
848 /// Maximum recorded object count accepted across one API-spec document. An
849 /// over-large document declines typed rather than allocating (Phase 21.30).
850 pub max_apispec_objects: u32,
851 /// Maximum recorded key/value member count accepted across one API-spec document.
852 /// An over-large document declines typed rather than allocating (Phase 21.30).
853 pub max_apispec_members: u32,
854 /// Maximum recorded `$ref` count accepted across one API-spec document. An
855 /// over-large document declines typed rather than allocating (Phase 21.30).
856 pub max_apispec_refs: u32,
857 /// Maximum structural recursion depth accepted (root = 1). A deeper document
858 /// declines typed (Phase 21.30).
859 pub max_apispec_depth: u32,
860 /// Maximum source length admitted for byte-based API-spec detection and parsing.
861 /// Larger inputs fall back to
862 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 21.30).
863 pub max_apispec_document_bytes: u64,
864 // The bibliography caps below bound the derived, span-preserving model
865 // (Phase 21.31). One adapter covers three dialects (BibTeX, RIS, CSL-JSON); the
866 // text dialects are bounded directly, and the CSL-JSON dialect reuses the shared
867 // JSON parser (whose caps also apply), so these add the semantic bounds on top. A
868 // bibliography is not a package: the whole source is the exact leaf, and
869 // everything derived is `Q_gen`.
870 /// Maximum entry (BibTeX/RIS) or item (CSL-JSON) count accepted for one
871 /// bibliography. An over-large document declines typed rather than allocating
872 /// (Phase 21.31).
873 pub max_bib_entries: u32,
874 /// Maximum total field (BibTeX/RIS) or member (CSL-JSON) count accepted across one
875 /// bibliography. This is a whole-document budget; an over-large document declines
876 /// typed rather than allocating (Phase 21.31).
877 pub max_bib_fields: u64,
878 /// Maximum byte length of one BibTeX/RIS value (delimiters included) or one
879 /// recorded CSL-JSON string value. A longer value declines typed (Phase 21.31).
880 pub max_bib_value_bytes: u64,
881 /// Maximum embedded JSON node count accepted for one CSL-JSON document, in
882 /// addition to the JSON caps the shared parser already enforces (Phase 21.31).
883 pub max_bib_nodes: u32,
884 /// Maximum structural recursion depth accepted (BibTeX/RIS brace nesting, or
885 /// CSL-JSON container nesting; root = 1). A deeper document declines typed
886 /// (Phase 21.31).
887 pub max_bib_depth: u32,
888 /// Maximum source length admitted for byte-based bibliography detection and
889 /// parsing. Larger inputs fall back to
890 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 21.31).
891 pub max_bib_document_bytes: u64,
892 // The RTF caps below bound the derived, span-preserving model (Phase 21.32). RTF
893 // is a text group-brace grammar with control words; it is not a package: the whole
894 // source is the exact leaf, and everything derived is `Q_gen`.
895 /// Maximum group (`{ … }`) count accepted for one RTF document. An over-large
896 /// document declines typed rather than allocating (Phase 21.32).
897 pub max_rtf_groups: u32,
898 /// Maximum group nesting depth accepted (the outermost group is depth 1). A deeper
899 /// document declines typed (Phase 21.32).
900 pub max_rtf_depth: u32,
901 /// Maximum control word / control symbol / hex escape / Unicode escape count
902 /// accepted across one RTF document. An over-large document declines typed rather
903 /// than allocating (Phase 21.32).
904 pub max_rtf_control_words: u64,
905 /// Maximum total plain-text byte count accepted across one RTF document. An
906 /// over-large document declines typed rather than allocating (Phase 21.32).
907 pub max_rtf_text_bytes: u64,
908 /// Maximum `\'hh` hex-escape count accepted across one RTF document. An over-large
909 /// document declines typed rather than allocating (Phase 21.32).
910 pub max_rtf_hex_escapes: u64,
911 /// Maximum source length admitted for byte-based RTF detection and parsing. Larger
912 /// inputs fall back to
913 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 21.32).
914 pub max_rtf_document_bytes: u64,
915 // The container caps below bound the derived, span-preserving model (Phase 21.33).
916 // A generic ZIP/TAR archive has no package layer: the whole source is the exact
917 // leaf, and everything derived is `Q_gen`.
918 /// Maximum member count accepted for one archive container. An over-large
919 /// archive declines typed rather than allocating (Phase 21.33).
920 pub max_container_members: u64,
921 /// Maximum **aggregate** name byte count accepted across one container's members.
922 /// This is a whole-archive budget; an over-large archive declines typed (Phase
923 /// 21.33).
924 pub max_container_name_bytes: u64,
925 /// Maximum byte length of one member name. A longer name declines typed (Phase
926 /// 21.33).
927 pub max_container_entry_name_bytes: u64,
928 /// Maximum TAR extension-record (GNU `L`/`K`, PAX `x`/`g`) count accepted across
929 /// one archive. An over-large archive declines typed (Phase 21.33).
930 pub max_container_extensions: u64,
931 /// Maximum member path depth (number of `/`-separated components; a flat name is
932 /// depth 1) accepted. A deeper path declines typed (Phase 21.33).
933 pub max_container_path_depth: u64,
934 /// Maximum source length admitted for byte-based container detection and parsing.
935 /// Larger inputs fall back to
936 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 21.33).
937 pub max_container_document_bytes: u64,
938 // The scientific-container caps below bound the derived, span-preserving model
939 // (Phase 21.34). A NetCDF classic or HDF5 source has no package layer: the whole
940 // source is the exact leaf, and everything derived is `Q_gen`.
941 /// Maximum object (group / dataset / variable) count accepted for one scientific
942 /// container. An over-large source declines typed (Phase 21.34).
943 pub max_hdf_objects: u64,
944 /// Maximum dimension count accepted (NetCDF dimension table, or an HDF5 dataspace
945 /// rank). An over-large source declines typed (Phase 21.34).
946 pub max_hdf_dimensions: u64,
947 /// Maximum **aggregate** attribute count accepted across one source (global /
948 /// root-group + every object's attributes). An over-large source declines typed
949 /// (Phase 21.34).
950 pub max_hdf_attributes: u64,
951 /// Maximum group nesting depth accepted (root = 0). A deeper source declines
952 /// typed (Phase 21.34).
953 pub max_hdf_depth: u32,
954 /// Maximum **aggregate** name byte count accepted across one source. This is a
955 /// whole-source budget; an over-large source declines typed (Phase 21.34).
956 pub max_hdf_name_bytes: u64,
957 /// Maximum byte length of one name. A longer name declines typed (Phase 21.34).
958 pub max_hdf_entry_name_bytes: u64,
959 /// Maximum byte length of one attribute value. A larger value declines typed
960 /// (Phase 21.34).
961 pub max_hdf_attr_value_bytes: u64,
962 /// Maximum source length admitted for scientific-container detection and parsing.
963 /// Larger inputs fall back to
964 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 21.34).
965 pub max_hdf_document_bytes: u64,
966 // The compound-file (CFBF/OLE2) caps below bound the derived, span-preserving model
967 // (Phase 21.35). A CFBF source has no package layer: the whole source is the exact
968 // leaf, and everything derived is `Q_gen`.
969 /// Maximum directory-entry count accepted for one compound file. An over-large
970 /// source declines typed (Phase 21.35).
971 pub max_cfbf_entries: u64,
972 /// Maximum stream count accepted for one compound file. An over-large source
973 /// declines typed (Phase 21.35).
974 pub max_cfbf_streams: u64,
975 /// Maximum reconstructed directory-tree depth accepted (the root is depth 0). A
976 /// deeper tree declines typed (Phase 21.35).
977 pub max_cfbf_depth: u32,
978 /// Maximum **aggregate** name byte count accepted across one compound file. This is
979 /// a whole-source budget; an over-large source declines typed (Phase 21.35).
980 pub max_cfbf_name_bytes: u64,
981 /// Maximum byte length of one entry name (a CFBF name is at most 62 bytes). A
982 /// longer name declines typed (Phase 21.35).
983 pub max_cfbf_entry_name_bytes: u64,
984 /// Maximum FAT/MiniFAT entry count accepted (bounds the allocation and every chain
985 /// traversal). An over-large source declines typed (Phase 21.35).
986 pub max_cfbf_chain_sectors: u64,
987 /// Maximum source length admitted for compound-file detection and parsing. Larger
988 /// inputs fall back to
989 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 21.35).
990 pub max_cfbf_document_bytes: u64,
991 // The legacy Word 97–2003 (`.doc`, MS-DOC) caps below bound the derived,
992 // span-preserving semantic model (Phase 26.1). A `.doc` reuses the CFBF physical
993 // layer; the whole source is the exact leaf and everything derived is `Q_gen`.
994 /// Maximum piece-table piece count accepted for one document. An over-large
995 /// piece table declines typed (Phase 26.1).
996 pub max_doc_pieces: u64,
997 /// Maximum aggregate raw text byte length accepted across one document's pieces
998 /// (the sum of each piece's `WordDocument`-stream byte span; a compressed piece is
999 /// one byte per character, an uncompressed piece two). This whole-document budget
1000 /// bounds the decoded text; an over-large document declines typed (Phase 26.1).
1001 pub max_doc_text_bytes: u64,
1002 /// Maximum `fibRgFcLcb` pair count (`cbRgFcLcb`) accepted. It bounds the FIB walk
1003 /// (the piece-table location lives at pair index 33). An over-large FIB declines
1004 /// typed (Phase 26.1).
1005 pub max_doc_fib_fields: u64,
1006 /// Maximum byte length of the `WordDocument` or table stream accepted. A larger
1007 /// stream declines typed (Phase 26.1).
1008 pub max_doc_stream_bytes: u64,
1009 /// Maximum source length admitted for legacy-DOC detection and parsing. Larger
1010 /// inputs fall back to
1011 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 26.1).
1012 pub max_doc_document_bytes: u64,
1013 // The legacy Excel 97–2003 (`.xls`, BIFF8) caps below bound the derived,
1014 // span-preserving semantic model (Phase 26.2). A `.xls` reuses the CFBF physical
1015 // layer; the whole source is the exact leaf and everything derived is `Q_gen`.
1016 /// Maximum sheet (`BOUNDSHEET`) count accepted for one workbook. An over-large
1017 /// sheet inventory declines typed (Phase 26.2).
1018 pub max_xls_sheets: u64,
1019 /// Maximum BIFF record count accepted for one workbook stream (bounds the record
1020 /// scan and the model). An over-large stream declines typed (Phase 26.2).
1021 pub max_xls_records: u64,
1022 /// Maximum unique `SST` string count accepted. An over-large shared-string table
1023 /// declines typed (Phase 26.2).
1024 pub max_xls_sst_strings: u64,
1025 /// Maximum cell count accepted across all sheets (bounds the cell arena). An
1026 /// over-large workbook declines typed (Phase 26.2).
1027 pub max_xls_cells: u64,
1028 /// Maximum aggregate derived text code-unit count accepted (the sum of every `SST`
1029 /// string, sheet name, and `FORMULA` string result). This whole-workbook budget
1030 /// bounds the derived text; an over-large workbook declines typed (Phase 26.2).
1031 pub max_xls_text_bytes: u64,
1032 /// Maximum source length admitted for legacy-XLS detection and parsing. Larger
1033 /// inputs fall back to
1034 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 26.2).
1035 pub max_xls_document_bytes: u64,
1036 // The legacy PowerPoint 97–2003 (`.ppt`, MS-PPT) caps below bound the derived,
1037 // span-preserving semantic model (Phase 26.3). A `.ppt` reuses the CFBF physical
1038 // layer; the whole source is the exact leaf and everything derived is `Q_gen`.
1039 /// Maximum record count accepted for one `PowerPoint Document` stream (bounds the
1040 /// record scan and the model). An over-large stream declines typed (Phase 26.3).
1041 pub max_ppt_records: u64,
1042 /// Maximum slide (`SlidePersistAtom`) count accepted for one presentation. An
1043 /// over-large slide inventory declines typed (Phase 26.3).
1044 pub max_ppt_slides: u64,
1045 /// Maximum text-run (`TextCharsAtom`/`TextBytesAtom`) count accepted (bounds the run
1046 /// arena). An over-large presentation declines typed (Phase 26.3).
1047 pub max_ppt_runs: u64,
1048 /// Maximum record nesting depth accepted (the `Document` container is depth 0). A
1049 /// deeper nesting declines typed (Phase 26.3).
1050 pub max_ppt_depth: u32,
1051 /// Maximum aggregate decoded text code-unit count accepted (the sum of every text
1052 /// run). This whole-presentation budget bounds the derived text; an over-large
1053 /// presentation declines typed (Phase 26.3).
1054 pub max_ppt_text_bytes: u64,
1055 /// Maximum source length admitted for legacy-PPT detection and parsing. Larger
1056 /// inputs fall back to
1057 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 26.3).
1058 pub max_ppt_document_bytes: u64,
1059 // The legacy Outlook message (`.msg`, MS-OXMSG) caps below bound the derived,
1060 // span-preserving semantic model (Phase 26.4). A `.msg` reuses the CFBF physical
1061 // layer (21.35); the caps bound the property entries, the variable-size substreams,
1062 // the recipient/attachment sub-storages, the aggregate stream-name bytes, the
1063 // aggregate value bytes, the derived text, and the whole source.
1064 /// Maximum fixed-size property entries accepted across the message and every
1065 /// sub-storage. An over-large property list declines typed (Phase 26.4).
1066 pub max_msg_properties: u64,
1067 /// Maximum variable-size substreams accepted across the message and every
1068 /// sub-storage. An over-large message declines typed (Phase 26.4).
1069 pub max_msg_substreams: u64,
1070 /// Maximum recipient sub-storages accepted. An over-large recipient inventory
1071 /// declines typed (Phase 26.4).
1072 pub max_msg_recipients: u64,
1073 /// Maximum attachment sub-storages accepted. An over-large attachment inventory
1074 /// declines typed (Phase 26.4).
1075 pub max_msg_attachments: u64,
1076 /// Maximum aggregate substream-name byte count accepted across one message. An
1077 /// over-large message declines typed (Phase 26.4).
1078 pub max_msg_name_bytes: u64,
1079 /// Maximum aggregate substream value byte length accepted across one message (the
1080 /// sum of every substream's exact byte span). This whole-message budget bounds the
1081 /// decoded values; an over-large message declines typed (Phase 26.4).
1082 pub max_msg_value_bytes: u64,
1083 /// Maximum aggregate decoded text code-unit count accepted (the sum of every
1084 /// `PT_UNICODE`/`PT_STRING8` substream's decoded text). This whole-message budget
1085 /// bounds the derived text; an over-large message declines typed (Phase 26.4).
1086 pub max_msg_text_bytes: u64,
1087 /// Maximum source length admitted for legacy-MSG detection and parsing. Larger
1088 /// inputs fall back to
1089 /// [`crate::field::document_format::DocumentFormat::Opaque`] (Phase 26.4).
1090 pub max_msg_document_bytes: u64,
1091}
1092
1093impl Limits {
1094 /// The default archival limits: generous, but always finite.
1095 pub const DEFAULT: Limits = Limits {
1096 max_input_bytes: 1 << 40, // 1 TiB
1097 max_output_bytes: 1 << 40, // 1 TiB
1098 max_replay_bytes: 1 << 34, // 16 GiB
1099 max_record_len: 1 << 31, // 2 GiB
1100 max_record_count: 1 << 20, // ~1M records
1101 max_object_count: 1 << 20,
1102 max_graph_ops: 1 << 20,
1103 max_repeat_count: 1 << 32,
1104 max_channel_symbols: 1 << 40,
1105 max_model_count: 1 << 16,
1106 max_channel_count: 1 << 16,
1107 max_entropy_model_bytes: 4096,
1108 max_pdf_spans: 1 << 26,
1109 max_index_selectors: 1 << 20,
1110 max_directory_bytes: 1 << 20,
1111 max_checkpoint_bytes: 1 << 20,
1112 max_zip_members: 1 << 20,
1113 max_zip_member_compressed: 1 << 34,
1114 max_zip_member_uncompressed: 1 << 34,
1115 max_zip_aggregate_uncompressed: 1 << 36,
1116 max_zip_compression_ratio: 1024,
1117 max_zip_name_bytes: 1 << 16,
1118 max_zip_extra_bytes: 1 << 16,
1119 max_zip_entry_comment_bytes: 1 << 16,
1120 max_zip_archive_comment_bytes: 1 << 16,
1121 max_zip_central_dir_bytes: 1 << 28,
1122 max_zip_prefix_bytes: 1 << 20,
1123 max_zip_trailing_bytes: 1 << 20,
1124 max_xml_depth: 256,
1125 max_xml_part_bytes: 1 << 28,
1126 max_xml_events: 1 << 24,
1127 max_xml_nodes: 1 << 24,
1128 max_xml_attrs_per_element: 4096,
1129 max_xml_text_bytes: 1 << 28,
1130 max_xml_document_bytes: 1 << 34,
1131 max_opc_rels: 1 << 20,
1132 max_opc_rel_depth: 64,
1133 max_opc_content_types_overrides: 1 << 20,
1134 max_opc_part_name_bytes: 1 << 16,
1135 max_epub_rootfiles: 16,
1136 max_epub_manifest_items: 1 << 20,
1137 max_epub_spine_items: 1 << 20,
1138 max_epub_nav_depth: 64,
1139 max_epub_fallback_chain: 32,
1140 max_xhtml_nodes: 1 << 24,
1141 max_odt_manifest_entries: 1 << 20,
1142 max_odt_blocks: 1 << 20,
1143 max_odt_notes: 1 << 20,
1144 max_ods_sheets: 4096,
1145 max_ods_cells: 1 << 24,
1146 max_ods_repeated_span: 1 << 20,
1147 max_ods_merges: 1 << 20,
1148 max_ods_named_expressions: 1 << 20,
1149 max_ods_styles: 1 << 16,
1150 max_ods_comments: 1 << 20,
1151 max_xlsx_sheets: 4096,
1152 max_xlsx_cells: 1 << 24,
1153 max_xlsx_shared_strings: 1 << 20,
1154 max_xlsx_merges: 1 << 20,
1155 max_xlsx_hyperlinks: 1 << 20,
1156 max_xlsx_comments: 1 << 20,
1157 max_xlsx_tables: 1 << 20,
1158 max_xlsx_table_columns: 1 << 16,
1159 max_xlsx_defined_names: 1 << 20,
1160 max_xlsx_drawings: 1 << 14,
1161 max_xlsx_style_records: 1 << 16,
1162 max_xlsx_col: 16384,
1163 max_xlsx_row: 1 << 20,
1164 max_pptx_slides: 4096,
1165 max_pptx_shapes_per_slide: 1 << 20,
1166 max_pptx_text_runs: 1 << 22,
1167 max_pptx_group_depth: 64,
1168 max_pptx_media: 1 << 14,
1169 max_pptx_tables: 1 << 14,
1170 max_pptx_table_cells: 1 << 20,
1171 max_pptx_notes: 1 << 16,
1172 max_pptx_layouts: 1 << 14,
1173 max_pptx_masters: 1 << 14,
1174 max_odp_slides: 4096,
1175 max_odp_shapes_per_slide: 1 << 20,
1176 max_odp_text_runs: 1 << 22,
1177 max_odp_group_depth: 64,
1178 max_odp_media: 1 << 14,
1179 max_odp_tables: 1 << 14,
1180 max_odp_table_cells: 1 << 20,
1181 max_odp_notes: 1 << 16,
1182 max_odp_masters: 1 << 14,
1183 max_json_depth: 256,
1184 max_json_nodes: 1 << 24,
1185 max_json_string_bytes: 1 << 28,
1186 max_json_document_bytes: 1 << 34,
1187 max_json5_depth: 256,
1188 max_json5_nodes: 1 << 24,
1189 max_json5_string_bytes: 1 << 28,
1190 max_json5_comments: 1 << 22,
1191 max_json5_document_bytes: 1 << 34,
1192 max_yaml_depth: 256,
1193 max_yaml_nodes: 1 << 24,
1194 max_yaml_scalars: 1 << 24,
1195 max_yaml_anchors: 1 << 20,
1196 max_yaml_documents: 1 << 16,
1197 max_yaml_string_bytes: 1 << 28,
1198 max_yaml_document_bytes: 1 << 34,
1199 max_csv_rows: 1 << 24,
1200 max_csv_cols: 1 << 16,
1201 max_csv_record_bytes: 1 << 26,
1202 max_csv_field_bytes: 1 << 24,
1203 max_csv_document_bytes: 1 << 34,
1204 max_csv_sampled_records_for_detection: 1024,
1205 max_markdown_depth: 256,
1206 max_markdown_nodes: 1 << 24,
1207 max_markdown_blocks: 1 << 22,
1208 max_markdown_inline_spans: 1 << 24,
1209 max_markdown_code_bytes: 1 << 28,
1210 max_markdown_document_bytes: 1 << 34,
1211 max_html_depth: 256,
1212 max_html_nodes: 1 << 24,
1213 max_html_attrs: 1 << 26,
1214 max_html_text_bytes: 1 << 28,
1215 max_html_script_bytes: 1 << 28,
1216 max_html_document_bytes: 1 << 34,
1217 max_toml_depth: 256,
1218 max_toml_nodes: 1 << 24,
1219 max_toml_keys: 1 << 22,
1220 max_toml_string_bytes: 1 << 28,
1221 max_toml_document_bytes: 1 << 34,
1222 max_jsonl_records: 1 << 22,
1223 max_jsonl_line_bytes: 1 << 26,
1224 max_jsonl_nodes: 1 << 24,
1225 max_jsonl_document_bytes: 1 << 34,
1226 max_eml_depth: 64,
1227 max_eml_parts: 1 << 20,
1228 max_eml_headers: 1 << 20,
1229 max_eml_part_bytes: 1 << 28,
1230 max_eml_decoded_bytes: 1 << 28,
1231 max_eml_document_bytes: 1 << 34,
1232 max_parquet_row_groups: 1 << 20,
1233 max_parquet_columns: 1 << 20,
1234 max_parquet_pages_per_chunk: 1 << 20,
1235 max_parquet_values: 1 << 30,
1236 max_parquet_decompressed_bytes: 1 << 28,
1237 max_parquet_document_bytes: 1 << 34,
1238 max_parquet_footer_bytes: 1 << 26,
1239 max_arrow_messages: 1 << 20,
1240 max_arrow_columns: 1 << 20,
1241 max_arrow_batches: 1 << 20,
1242 max_arrow_rows: 1 << 40,
1243 max_arrow_buffers: 1 << 26,
1244 max_arrow_values: 1 << 30,
1245 max_arrow_decompressed_bytes: 1 << 30,
1246 max_arrow_document_bytes: 1 << 34,
1247 max_arrow_metadata_bytes: 1 << 26,
1248 max_cbor_depth: 256,
1249 max_cbor_nodes: 1 << 24,
1250 max_cbor_string_bytes: 1 << 28,
1251 max_cbor_document_bytes: 1 << 34,
1252 max_msgpack_depth: 256,
1253 max_msgpack_nodes: 1 << 24,
1254 max_msgpack_str_bytes: 1 << 28,
1255 max_msgpack_bin_bytes: 1 << 28,
1256 max_msgpack_ext_bytes: 1 << 28,
1257 max_msgpack_document_bytes: 1 << 34,
1258 max_config_lines: 1 << 24,
1259 max_config_nodes: 1 << 24,
1260 max_config_entries: 1 << 24,
1261 max_config_depth: 4096,
1262 max_config_line_bytes: 1 << 26,
1263 max_config_key_bytes: 1 << 20,
1264 max_config_value_bytes: 1 << 28,
1265 max_config_document_bytes: 1 << 34,
1266 max_feed_entries: 1 << 20,
1267 max_feed_fields: 1 << 22,
1268 max_feed_field_bytes: 1 << 26,
1269 max_feed_text_bytes: 1 << 28,
1270 max_feed_document_bytes: 1 << 34,
1271 max_geojson_features: 1 << 20,
1272 max_geojson_geometries: 1 << 20,
1273 max_geojson_coordinates: 1 << 28,
1274 max_geojson_depth: 1024,
1275 max_geojson_nodes: 1 << 24,
1276 max_geojson_document_bytes: 1 << 34,
1277 max_gis_placemarks: 1 << 20,
1278 max_gis_tracks: 1 << 20,
1279 max_gis_points: 1 << 22,
1280 max_gis_depth: 256,
1281 max_gis_nodes: 1 << 24,
1282 max_gis_text_bytes: 1 << 28,
1283 max_gis_document_bytes: 1 << 34,
1284 max_notebook_cells: 1 << 20,
1285 max_notebook_outputs: 1 << 22,
1286 max_notebook_nodes: 1 << 24,
1287 max_notebook_depth: 256,
1288 max_notebook_source_bytes: 1 << 28,
1289 max_notebook_document_bytes: 1 << 34,
1290 max_fixedwidth_rows: 1 << 24,
1291 max_fixedwidth_cols: 1 << 16,
1292 max_fixedwidth_record_bytes: 1 << 26,
1293 max_fixedwidth_field_bytes: 1 << 24,
1294 max_fixedwidth_document_bytes: 1 << 34,
1295 max_fixedwidth_sampled_lines_for_detection: 1024,
1296 max_rst_blocks: 1 << 22,
1297 max_rst_inline_spans: 1 << 24,
1298 max_rst_nodes: 1 << 24,
1299 max_rst_depth: 256,
1300 max_rst_line_bytes: 1 << 26,
1301 max_rst_document_bytes: 1 << 34,
1302 max_asciidoc_blocks: 1 << 22,
1303 max_asciidoc_inline_spans: 1 << 24,
1304 max_asciidoc_nodes: 1 << 24,
1305 max_asciidoc_depth: 256,
1306 max_asciidoc_line_bytes: 1 << 26,
1307 max_asciidoc_document_bytes: 1 << 34,
1308 max_mdx_esm_statements: 1 << 22,
1309 max_mdx_jsx_blocks: 1 << 22,
1310 max_mdx_expressions: 1 << 24,
1311 max_mdx_nodes: 1 << 24,
1312 max_mdx_depth: 256,
1313 max_mdx_line_bytes: 1 << 26,
1314 max_mdx_document_bytes: 1 << 34,
1315 max_mhtml_parts: 1 << 20,
1316 max_mhtml_headers: 1 << 20,
1317 max_mhtml_depth: 64,
1318 max_mhtml_resources: 1 << 20,
1319 max_mhtml_decoded_bytes: 1 << 28,
1320 max_mhtml_nodes: 1 << 24,
1321 max_mhtml_document_bytes: 1 << 34,
1322 max_logstream_records: 1 << 22,
1323 max_logstream_fields: 1 << 24,
1324 max_logstream_sd_elements: 1 << 20,
1325 max_logstream_line_bytes: 1 << 20,
1326 max_logstream_depth: 8,
1327 max_logstream_document_bytes: 1 << 34,
1328 max_pkgmeta_nodes: 1 << 24,
1329 max_pkgmeta_sections: 1 << 20,
1330 max_pkgmeta_entries: 1 << 22,
1331 max_pkgmeta_depth: 32,
1332 max_pkgmeta_document_bytes: 1 << 34,
1333 max_apispec_nodes: 1 << 24,
1334 max_apispec_objects: 1 << 22,
1335 max_apispec_members: 1 << 24,
1336 max_apispec_refs: 1 << 22,
1337 max_apispec_depth: 256,
1338 max_apispec_document_bytes: 1 << 34,
1339 max_bib_entries: 1 << 22,
1340 max_bib_fields: 1 << 24,
1341 max_bib_value_bytes: 1 << 26,
1342 max_bib_nodes: 1 << 24,
1343 max_bib_depth: 256,
1344 max_bib_document_bytes: 1 << 34,
1345 max_rtf_groups: 1 << 22,
1346 max_rtf_depth: 256,
1347 max_rtf_control_words: 1 << 24,
1348 max_rtf_text_bytes: 1 << 30,
1349 max_rtf_hex_escapes: 1 << 24,
1350 max_rtf_document_bytes: 1 << 34,
1351 max_container_members: 1 << 20,
1352 max_container_name_bytes: 1 << 26,
1353 max_container_entry_name_bytes: 1 << 16,
1354 max_container_extensions: 1 << 20,
1355 max_container_path_depth: 256,
1356 max_container_document_bytes: 1 << 34,
1357 max_hdf_objects: 1 << 20,
1358 max_hdf_dimensions: 1 << 20,
1359 max_hdf_attributes: 1 << 22,
1360 max_hdf_depth: 64,
1361 max_hdf_name_bytes: 1 << 26,
1362 max_hdf_entry_name_bytes: 1 << 16,
1363 max_hdf_attr_value_bytes: 1 << 24,
1364 max_hdf_document_bytes: 1 << 34,
1365 max_cfbf_entries: 1 << 20,
1366 max_cfbf_streams: 1 << 20,
1367 max_cfbf_depth: 256,
1368 max_cfbf_name_bytes: 1 << 26,
1369 max_cfbf_entry_name_bytes: 1 << 16,
1370 max_cfbf_chain_sectors: 1 << 24,
1371 max_cfbf_document_bytes: 1 << 34,
1372 max_doc_pieces: 1 << 20,
1373 max_doc_text_bytes: 1 << 31,
1374 max_doc_fib_fields: 1 << 12,
1375 max_doc_stream_bytes: 1 << 34,
1376 max_doc_document_bytes: 1 << 34,
1377 max_xls_sheets: 1 << 12,
1378 max_xls_records: 1 << 20,
1379 max_xls_sst_strings: 1 << 20,
1380 max_xls_cells: 1 << 22,
1381 max_xls_text_bytes: 1 << 31,
1382 max_xls_document_bytes: 1 << 34,
1383 max_ppt_records: 1 << 20,
1384 max_ppt_slides: 1 << 12,
1385 max_ppt_runs: 1 << 22,
1386 max_ppt_depth: 64,
1387 max_ppt_text_bytes: 1 << 31,
1388 max_ppt_document_bytes: 1 << 34,
1389 max_msg_properties: 1 << 20,
1390 max_msg_substreams: 1 << 20,
1391 max_msg_recipients: 1 << 12,
1392 max_msg_attachments: 1 << 12,
1393 max_msg_name_bytes: 1 << 26,
1394 max_msg_value_bytes: 1 << 31,
1395 max_msg_text_bytes: 1 << 31,
1396 max_msg_document_bytes: 1 << 34,
1397 };
1398
1399 /// Tight limits for hostile-input testing and fuzzing.
1400 pub const STRICT: Limits = Limits {
1401 max_input_bytes: 1 << 26, // 64 MiB
1402 max_output_bytes: 1 << 26, // 64 MiB
1403 max_replay_bytes: 1 << 26, // 64 MiB
1404 max_record_len: 1 << 24, // 16 MiB
1405 max_record_count: 1 << 16, // 65536
1406 max_object_count: 1 << 16,
1407 max_graph_ops: 1 << 16,
1408 max_repeat_count: 1 << 24,
1409 max_channel_symbols: 1 << 26,
1410 max_model_count: 1 << 12,
1411 max_channel_count: 1 << 12,
1412 max_entropy_model_bytes: 4096,
1413 max_pdf_spans: 1 << 16,
1414 max_index_selectors: 1 << 16,
1415 max_directory_bytes: 1 << 18,
1416 max_checkpoint_bytes: 1 << 18,
1417 max_zip_members: 1 << 16,
1418 max_zip_member_compressed: 1 << 26,
1419 max_zip_member_uncompressed: 1 << 26,
1420 max_zip_aggregate_uncompressed: 1 << 27,
1421 max_zip_compression_ratio: 256,
1422 max_zip_name_bytes: 4096,
1423 max_zip_extra_bytes: 4096,
1424 max_zip_entry_comment_bytes: 4096,
1425 max_zip_archive_comment_bytes: 4096,
1426 max_zip_central_dir_bytes: 1 << 20,
1427 max_zip_prefix_bytes: 1 << 16,
1428 max_zip_trailing_bytes: 1 << 16,
1429 max_xml_depth: 64,
1430 max_xml_part_bytes: 1 << 20,
1431 max_xml_events: 1 << 16,
1432 max_xml_nodes: 1 << 16,
1433 max_xml_attrs_per_element: 256,
1434 max_xml_text_bytes: 1 << 20,
1435 max_xml_document_bytes: 1 << 26,
1436 max_opc_rels: 1 << 14,
1437 max_opc_rel_depth: 16,
1438 max_opc_content_types_overrides: 1 << 12,
1439 max_opc_part_name_bytes: 4096,
1440 max_epub_rootfiles: 4,
1441 max_epub_manifest_items: 1 << 14,
1442 max_epub_spine_items: 1 << 14,
1443 max_epub_nav_depth: 16,
1444 max_epub_fallback_chain: 8,
1445 max_xhtml_nodes: 1 << 16,
1446 max_odt_manifest_entries: 1 << 14,
1447 max_odt_blocks: 1 << 14,
1448 max_odt_notes: 1 << 12,
1449 max_ods_sheets: 64,
1450 max_ods_cells: 1 << 16,
1451 max_ods_repeated_span: 1 << 14,
1452 max_ods_merges: 1 << 14,
1453 max_ods_named_expressions: 1 << 14,
1454 max_ods_styles: 1 << 12,
1455 max_ods_comments: 1 << 14,
1456 max_xlsx_sheets: 64,
1457 max_xlsx_cells: 1 << 16,
1458 max_xlsx_shared_strings: 1 << 14,
1459 max_xlsx_merges: 1 << 14,
1460 max_xlsx_hyperlinks: 1 << 14,
1461 max_xlsx_comments: 1 << 14,
1462 max_xlsx_tables: 1 << 14,
1463 max_xlsx_table_columns: 1 << 12,
1464 max_xlsx_defined_names: 1 << 14,
1465 max_xlsx_drawings: 1 << 12,
1466 max_xlsx_style_records: 1 << 12,
1467 max_xlsx_col: 16384,
1468 max_xlsx_row: 1 << 20,
1469 max_pptx_slides: 64,
1470 max_pptx_shapes_per_slide: 1 << 16,
1471 max_pptx_text_runs: 1 << 18,
1472 max_pptx_group_depth: 16,
1473 max_pptx_media: 1 << 12,
1474 max_pptx_tables: 1 << 12,
1475 max_pptx_table_cells: 1 << 16,
1476 max_pptx_notes: 1 << 12,
1477 max_pptx_layouts: 1 << 12,
1478 max_pptx_masters: 1 << 12,
1479 max_odp_slides: 64,
1480 max_odp_shapes_per_slide: 1 << 16,
1481 max_odp_text_runs: 1 << 18,
1482 max_odp_group_depth: 16,
1483 max_odp_media: 1 << 12,
1484 max_odp_tables: 1 << 12,
1485 max_odp_table_cells: 1 << 16,
1486 max_odp_notes: 1 << 12,
1487 max_odp_masters: 1 << 12,
1488 max_json_depth: 64,
1489 max_json_nodes: 1 << 16,
1490 max_json_string_bytes: 1 << 20,
1491 max_json_document_bytes: 1 << 26,
1492 max_json5_depth: 64,
1493 max_json5_nodes: 1 << 16,
1494 max_json5_string_bytes: 1 << 20,
1495 max_json5_comments: 1 << 12,
1496 max_json5_document_bytes: 1 << 26,
1497 max_yaml_depth: 64,
1498 max_yaml_nodes: 1 << 16,
1499 max_yaml_scalars: 1 << 16,
1500 max_yaml_anchors: 1 << 12,
1501 max_yaml_documents: 1 << 10,
1502 max_yaml_string_bytes: 1 << 20,
1503 max_yaml_document_bytes: 1 << 26,
1504 max_csv_rows: 1 << 16,
1505 max_csv_cols: 1 << 12,
1506 max_csv_record_bytes: 1 << 20,
1507 max_csv_field_bytes: 1 << 18,
1508 max_csv_document_bytes: 1 << 26,
1509 max_csv_sampled_records_for_detection: 64,
1510 max_markdown_depth: 64,
1511 max_markdown_nodes: 1 << 16,
1512 max_markdown_blocks: 1 << 14,
1513 max_markdown_inline_spans: 1 << 16,
1514 max_markdown_code_bytes: 1 << 20,
1515 max_markdown_document_bytes: 1 << 26,
1516 max_html_depth: 64,
1517 max_html_nodes: 1 << 16,
1518 max_html_attrs: 1 << 16,
1519 max_html_text_bytes: 1 << 20,
1520 max_html_script_bytes: 1 << 20,
1521 max_html_document_bytes: 1 << 26,
1522 max_toml_depth: 64,
1523 max_toml_nodes: 1 << 16,
1524 max_toml_keys: 1 << 14,
1525 max_toml_string_bytes: 1 << 20,
1526 max_toml_document_bytes: 1 << 26,
1527 max_jsonl_records: 1 << 12,
1528 max_jsonl_line_bytes: 1 << 20,
1529 max_jsonl_nodes: 1 << 16,
1530 max_jsonl_document_bytes: 1 << 26,
1531 max_eml_depth: 16,
1532 max_eml_parts: 1 << 12,
1533 max_eml_headers: 1 << 12,
1534 max_eml_part_bytes: 1 << 20,
1535 max_eml_decoded_bytes: 1 << 20,
1536 max_eml_document_bytes: 1 << 26,
1537 max_parquet_row_groups: 1 << 12,
1538 max_parquet_columns: 1 << 12,
1539 max_parquet_pages_per_chunk: 1 << 12,
1540 max_parquet_values: 1 << 16,
1541 max_parquet_decompressed_bytes: 1 << 20,
1542 max_parquet_document_bytes: 1 << 26,
1543 max_parquet_footer_bytes: 1 << 20,
1544 max_arrow_messages: 1 << 12,
1545 max_arrow_columns: 1 << 12,
1546 max_arrow_batches: 1 << 12,
1547 max_arrow_rows: 1 << 24,
1548 max_arrow_buffers: 1 << 20,
1549 max_arrow_values: 1 << 16,
1550 max_arrow_decompressed_bytes: 1 << 20,
1551 max_arrow_document_bytes: 1 << 26,
1552 max_arrow_metadata_bytes: 1 << 20,
1553 max_cbor_depth: 64,
1554 max_cbor_nodes: 1 << 16,
1555 max_cbor_string_bytes: 1 << 20,
1556 max_cbor_document_bytes: 1 << 26,
1557 max_msgpack_depth: 64,
1558 max_msgpack_nodes: 1 << 16,
1559 max_msgpack_str_bytes: 1 << 20,
1560 max_msgpack_bin_bytes: 1 << 20,
1561 max_msgpack_ext_bytes: 1 << 20,
1562 max_msgpack_document_bytes: 1 << 26,
1563 max_config_lines: 1 << 16,
1564 max_config_nodes: 1 << 16,
1565 max_config_entries: 1 << 16,
1566 max_config_depth: 64,
1567 max_config_line_bytes: 1 << 20,
1568 max_config_key_bytes: 1 << 14,
1569 max_config_value_bytes: 1 << 20,
1570 max_config_document_bytes: 1 << 26,
1571 max_feed_entries: 1 << 12,
1572 max_feed_fields: 1 << 14,
1573 max_feed_field_bytes: 1 << 20,
1574 max_feed_text_bytes: 1 << 20,
1575 max_feed_document_bytes: 1 << 26,
1576 max_geojson_features: 1 << 12,
1577 max_geojson_geometries: 1 << 12,
1578 max_geojson_coordinates: 1 << 16,
1579 max_geojson_depth: 64,
1580 max_geojson_nodes: 1 << 16,
1581 max_geojson_document_bytes: 1 << 26,
1582 max_gis_placemarks: 1 << 12,
1583 max_gis_tracks: 1 << 12,
1584 max_gis_points: 1 << 14,
1585 max_gis_depth: 64,
1586 max_gis_nodes: 1 << 16,
1587 max_gis_text_bytes: 1 << 20,
1588 max_gis_document_bytes: 1 << 26,
1589 max_notebook_cells: 1 << 12,
1590 max_notebook_outputs: 1 << 12,
1591 max_notebook_nodes: 1 << 16,
1592 max_notebook_depth: 64,
1593 max_notebook_source_bytes: 1 << 20,
1594 max_notebook_document_bytes: 1 << 26,
1595 max_fixedwidth_rows: 1 << 16,
1596 max_fixedwidth_cols: 1 << 12,
1597 max_fixedwidth_record_bytes: 1 << 20,
1598 max_fixedwidth_field_bytes: 1 << 18,
1599 max_fixedwidth_document_bytes: 1 << 26,
1600 max_fixedwidth_sampled_lines_for_detection: 64,
1601 max_rst_blocks: 1 << 14,
1602 max_rst_inline_spans: 1 << 16,
1603 max_rst_nodes: 1 << 16,
1604 max_rst_depth: 64,
1605 max_rst_line_bytes: 1 << 20,
1606 max_rst_document_bytes: 1 << 26,
1607 max_asciidoc_blocks: 1 << 14,
1608 max_asciidoc_inline_spans: 1 << 16,
1609 max_asciidoc_nodes: 1 << 16,
1610 max_asciidoc_depth: 64,
1611 max_asciidoc_line_bytes: 1 << 20,
1612 max_asciidoc_document_bytes: 1 << 26,
1613 max_mdx_esm_statements: 1 << 14,
1614 max_mdx_jsx_blocks: 1 << 14,
1615 max_mdx_expressions: 1 << 16,
1616 max_mdx_nodes: 1 << 16,
1617 max_mdx_depth: 64,
1618 max_mdx_line_bytes: 1 << 20,
1619 max_mdx_document_bytes: 1 << 26,
1620 max_mhtml_parts: 1 << 12,
1621 max_mhtml_headers: 1 << 12,
1622 max_mhtml_depth: 16,
1623 max_mhtml_resources: 1 << 12,
1624 max_mhtml_decoded_bytes: 1 << 20,
1625 max_mhtml_nodes: 1 << 16,
1626 max_mhtml_document_bytes: 1 << 26,
1627 max_logstream_records: 1 << 12,
1628 max_logstream_fields: 1 << 16,
1629 max_logstream_sd_elements: 1 << 12,
1630 max_logstream_line_bytes: 1 << 16,
1631 max_logstream_depth: 4,
1632 max_logstream_document_bytes: 1 << 26,
1633 max_pkgmeta_nodes: 1 << 16,
1634 max_pkgmeta_sections: 1 << 12,
1635 max_pkgmeta_entries: 1 << 14,
1636 max_pkgmeta_depth: 8,
1637 max_pkgmeta_document_bytes: 1 << 26,
1638 max_apispec_nodes: 1 << 16,
1639 max_apispec_objects: 1 << 14,
1640 max_apispec_members: 1 << 16,
1641 max_apispec_refs: 1 << 14,
1642 max_apispec_depth: 64,
1643 max_apispec_document_bytes: 1 << 26,
1644 max_bib_entries: 1 << 12,
1645 max_bib_fields: 1 << 14,
1646 max_bib_value_bytes: 1 << 16,
1647 max_bib_nodes: 1 << 16,
1648 max_bib_depth: 64,
1649 max_bib_document_bytes: 1 << 26,
1650 max_rtf_groups: 1 << 12,
1651 max_rtf_depth: 64,
1652 max_rtf_control_words: 1 << 16,
1653 max_rtf_text_bytes: 1 << 20,
1654 max_rtf_hex_escapes: 1 << 16,
1655 max_rtf_document_bytes: 1 << 26,
1656 max_container_members: 1 << 12,
1657 max_container_name_bytes: 1 << 18,
1658 max_container_entry_name_bytes: 1 << 14,
1659 max_container_extensions: 1 << 12,
1660 max_container_path_depth: 64,
1661 max_container_document_bytes: 1 << 26,
1662 max_hdf_objects: 1 << 12,
1663 max_hdf_dimensions: 1 << 12,
1664 max_hdf_attributes: 1 << 14,
1665 max_hdf_depth: 32,
1666 max_hdf_name_bytes: 1 << 18,
1667 max_hdf_entry_name_bytes: 1 << 14,
1668 max_hdf_attr_value_bytes: 1 << 16,
1669 max_hdf_document_bytes: 1 << 26,
1670 max_cfbf_entries: 1 << 12,
1671 max_cfbf_streams: 1 << 12,
1672 max_cfbf_depth: 64,
1673 max_cfbf_name_bytes: 1 << 18,
1674 max_cfbf_entry_name_bytes: 1 << 14,
1675 max_cfbf_chain_sectors: 1 << 16,
1676 max_cfbf_document_bytes: 1 << 26,
1677 max_doc_pieces: 1 << 12,
1678 max_doc_text_bytes: 1 << 20,
1679 max_doc_fib_fields: 1 << 10,
1680 max_doc_stream_bytes: 1 << 26,
1681 max_doc_document_bytes: 1 << 26,
1682 max_xls_sheets: 1 << 10,
1683 max_xls_records: 1 << 14,
1684 max_xls_sst_strings: 1 << 14,
1685 max_xls_cells: 1 << 16,
1686 max_xls_text_bytes: 1 << 20,
1687 max_xls_document_bytes: 1 << 26,
1688 max_ppt_records: 1 << 14,
1689 max_ppt_slides: 1 << 10,
1690 max_ppt_runs: 1 << 16,
1691 max_ppt_depth: 32,
1692 max_ppt_text_bytes: 1 << 20,
1693 max_ppt_document_bytes: 1 << 26,
1694 max_msg_properties: 1 << 14,
1695 max_msg_substreams: 1 << 14,
1696 max_msg_recipients: 1 << 10,
1697 max_msg_attachments: 1 << 10,
1698 max_msg_name_bytes: 1 << 18,
1699 max_msg_value_bytes: 1 << 20,
1700 max_msg_text_bytes: 1 << 20,
1701 max_msg_document_bytes: 1 << 26,
1702 };
1703}
1704
1705impl Default for Limits {
1706 fn default() -> Self {
1707 Limits::DEFAULT
1708 }
1709}