import-limits.ts

1// Import-path resource bounds — audit fixes MV-4 (decompression bomb) and2// MV-5 (unbounded file/string allocation).3//4// Every untrusted import surface (pasted PeachScript/backup strings, .peach /5// .json files, Codex PDFs) must check these BEFORE allocating or inflating.67export const IMPORT_LIMITS = {8  /** Hard ceiling on any decompressed output (zstd sections, pako inflate). */9  MAX_DECOMPRESSED_BYTES: 64 * 1024 * 1024, // 64 MiB10  /** Ceiling on an attacker-declared pre-decompress length field. */11  MAX_DECLARED_LENGTH: 64 * 1024 * 1024, // 64 MiB12  /** Max PDF file size accepted by the Codex importer. */13  MAX_PDF_BYTES: 25 * 1024 * 1024, // 25 MiB14  /** Max raw JSON/CSV/PeachScript string length accepted by import/restore. */15  MAX_JSON_BYTES: 10 * 1024 * 1024, // 10 MiB16} as const;1718/**19 * Error code shared by all import-path size rejections. The import UI maps20 * it to a user-readable message ("This file is too large to be a Peach21 * backup …") instead of surfacing a raw thrown error.22 */23export const IMPORT_TOO_LARGE = "IMPORT_TOO_LARGE";2425export function importTooLarge(detail: string): Error {26  return new Error(`${IMPORT_TOO_LARGE}: ${detail}`);27}