Pre-push review: T-2132 remote raster image memory exhaustion

diff --git a/prism/Services/ImageLoader.swift b/prism/Services/ImageLoader.swiftindex e772af9..f33a4d2 100644--- a/prism/Services/ImageLoader.swift+++ b/prism/Services/ImageLoader.swift@@ -1,11 +1,19 @@ import Foundation+import ImageIO import SwiftUI +#if canImport(UIKit)+import UIKit+#elseif canImport(AppKit)+import AppKit+#endif+ // MARK: - AsyncSemaphore  /// Cancellation-safe async semaphore for limiting concurrency. ///-/// Used by ImageLoader to cap concurrent remote image fetches.+/// Used via `SharedConcurrency` to cap concurrent remote fetches+/// (ImageLoader, SVGSourceLoader) and guarded image decodes. /// Waiters are resumed in FIFO order when slots become available. actor AsyncSemaphore {     private let limit: Int@@ -88,6 +96,7 @@ actor ImageLoader {     }      private var networkSemaphore: AsyncSemaphore { SharedConcurrency.networkSemaphore }+    private var decodeSemaphore: AsyncSemaphore { SharedConcurrency.decodeSemaphore }      /// Loads an image from the given resolved source.     ///@@ -120,10 +129,7 @@ actor ImageLoader {         } catch {             throw .fileNotFound         }-        guard let image = PlatformImage(data: data) else {-            throw .decodeFailed-        }-        return image+        return try decodeImageData(data)     }      /// Maximum size for remote image downloads (50 MB).@@ -137,23 +143,62 @@ actor ImageLoader {             throw .networkError("Cancelled")         } -        let image: PlatformImage+        let data: Data         do {-            image = try await performRemoteLoad(url)+            data = try await performRemoteLoad(url)         } catch {             await networkSemaphore.release()             throw error         }         await networkSemaphore.release()+        // Decode after releasing the network slot: the guarded decode can be+        // genuinely heavy (up to a 64 MB downsample), and holding one of the+        // shared network-semaphore slots through it would stall unrelated+        // remote fetches for CPU work. Decode still needs its own bound,+        // shared across ImageLoader instances: PrismDocSchemeHandler+        // constructs a fresh loader per remote-image request, so actor+        // isolation alone cannot serialize decodes across requests — without+        // this semaphore, N in-flight images would mean N concurrent ~64 MB+        // decodes, reopening the memory spike T-2132 closes.+        //+        // Trade-off of releasing before acquiring: a task queued on the+        // decode semaphore holds its compressed body (≤ 50 MB) while it+        // waits, and nothing but WebKit's per-page request fan-out bounds+        // how many bodies are parked. Swapping the order (acquire decode,+        // then release network) would bound parked bodies at the network+        // limit but stall unrelated fetches whenever decode saturates;+        // fetch throughput is deliberately favoured here since compressed+        // bodies are typically far smaller than their 50 MB cap.+        do {+            try await decodeSemaphore.acquire()+        } catch {+            throw .networkError("Cancelled")+        }+        // The semaphore's fast path does not observe cancellation, and the+        // request may have been cancelled during the download — don't spend+        // up to a 64 MB decode on a dead request.+        guard !Task.isCancelled else {+            await decodeSemaphore.release()+            throw .networkError("Cancelled")+        }+        let image: PlatformImage+        do {+            image = try decodeImageData(data)+        } catch {+            await decodeSemaphore.release()+            throw error+        }+        await decodeSemaphore.release()         return image     } -    /// Performs the actual remote image fetch with validation.+    /// Performs the actual remote image fetch with validation, returning the+    /// validated (still compressed) response body.     ///     /// The body is streamed via `URLSession.bytes(from:)` so the 50 MB cap is     /// enforced without ever buffering an oversized payload. The Content-Length     /// header (when present) is checked first for early rejection.-    private func performRemoteLoad(_ url: URL) async throws(ImageLoadError) -> PlatformImage {+    private func performRemoteLoad(_ url: URL) async throws(ImageLoadError) -> Data {         do {             let (data, response) = try await streamDownload(url: url)             guard let httpResponse = response as? HTTPURLResponse else {@@ -168,7 +213,7 @@ actor ImageLoader {                !ImagePathResolver.allowedRemoteSchemes.contains(scheme) {                 throw ImageLoadError.blockedScheme             }-            return try decodeImageData(data)+            return data         } catch let error as ImageLoadError {             throw error         } catch is CancellationError {@@ -215,12 +260,187 @@ actor ImageLoader {         return (data, response)     } +    /// Largest width/height (in pixels) a fully decoded bitmap is allowed to+    /// have. Also used as the target edge for downsampled thumbnails.+    ///+    /// 4096 comfortably covers real-world document images (well past typical+    /// screen resolutions) while bounding worst-case decoded RGBA memory to+    /// `maxDecodedByteBudget`.+    static let maxDecodedDimension = 4_096++    /// Maximum estimated decoded byte cost — width * height * 4 (RGBA) —+    /// **including every frame** of a multi-frame image (GIF/APNG/HEIC+    /// sequences). Frame count matters because `NSImage(data:)` on macOS+    /// eagerly materializes every frame of an animated image as a separate+    /// bitmap representation, so a modest-resolution image with thousands of+    /// frames can still exhaust memory even though no single frame is large.+    ///+    /// Sized to match `maxDecodedDimension` (4096 * 4096 * 4 bytes ≈ 64 MB) —+    /// a quarter of `ImageCache`'s 256 MB total budget (see+    /// specs/operational-hardening/decision_log.md, Decision 4).+    static let maxDecodedByteBudget = maxDecodedDimension * maxDecodedDimension * 4++    /// Upper bound on how many frames the pre-flight dimension scan inspects.+    ///+    /// The budget must consider every frame's declared dimensions, not just+    /// frame 0's — container formats with per-frame sizes (multi-page TIFF,+    /// HEIC sequences) could otherwise hide an enormous page behind a tiny+    /// first one. Scanning is a header parse per frame, so it must itself be+    /// bounded: a container with more frames than this routes straight to the+    /// bounded downsample path. That is barely a behaviour change — at 65++    /// frames the per-frame budget is under ~1 MB (≈512×512 px), so almost+    /// any real animation that long would be downsampled anyway.+    static let maxScannedFrames = 64++    /// Whether a bitmap with these dimensions/frame count would exceed the+    /// decode budget and must be downsampled instead of fully decoded.+    ///+    /// A pure, `nonisolated` decision so it can be unit tested directly+    /// without constructing real (and potentially memory-heavy) image data.+    nonisolated static func exceedsDecodeBudget(width: Int, height: Int, frameCount: Int) -> Bool {+        guard width > 0, height > 0 else { return true }+        let frames = max(frameCount, 1)+        if width > maxDecodedDimension || height > maxDecodedDimension {+            return true+        }+        // The dimension guard above bounds perFrameBytes to at most+        // maxDecodedByteBudget, so this integer-division compare is exact+        // (a > b / c ⟺ a * c > b for positive integers) and cannot overflow+        // for any frame count — no staged multiplication needed. It also+        // stays correct if maxDecodedByteBudget is ever decoupled from+        // maxDecodedDimension: the frames == 1 case degenerates to+        // perFrameBytes > maxDecodedByteBudget.+        let perFrameBytes = width * height * 4+        return perFrameBytes > maxDecodedByteBudget / frames+    }++    /// Largest declared pixel dimensions across every frame of the source,+    /// or `nil` when any frame's dimensions are unreported.+    ///+    /// Per-axis maxima can pair one frame's width with another frame's+    /// height (10×400 plus 300×20 is budgeted as 300×400 per frame), so the+    /// estimate may overstate the true decoded footprint — it only ever errs+    /// toward downsampling, never toward an unbounded decode.+    ///+    /// Frame 0 alone is not enough (T-2132 review): multi-page TIFF and HEIC+    /// sequences allow per-frame dimensions to differ, so a tiny first page+    /// could otherwise vouch for an enormous later one. Any unreported frame+    /// makes the whole image unprovable — the caller must treat it like an+    /// unknown-size single frame and take the bounded downsample path.+    nonisolated private static func maxDeclaredDimensions(+        in source: CGImageSource, frameCount: Int+    ) -> (width: Int, height: Int)? {+        maxDeclaredDimensions(frameCount: frameCount) { index in+            guard let properties = CGImageSourceCopyPropertiesAtIndex(source, index, nil) as? [CFString: Any],+                  let width = properties[kCGImagePropertyPixelWidth] as? Int,+                  let height = properties[kCGImagePropertyPixelHeight] as? Int else {+                return nil+            }+            return (width, height)+        }+    }++    /// Core of the per-frame dimension scan, parameterised over the frame+    /// lookup so the "any unreported frame makes the whole image unprovable"+    /// contract is directly unit-testable. ImageIO drops any frame it cannot+    /// size from `CGImageSourceGetCount`, so a real fixture with a+    /// counted-but-dimensionless later frame cannot be constructed — the+    /// injected lookup is the only way to pin that branch.+    nonisolated static func maxDeclaredDimensions(+        frameCount: Int,+        dimensionsForFrame: (Int) -> (width: Int, height: Int)?+    ) -> (width: Int, height: Int)? {+        var maxWidth = 0+        var maxHeight = 0+        for index in 0..<frameCount {+            guard let dimensions = dimensionsForFrame(index) else {+                return nil+            }+            maxWidth = max(maxWidth, dimensions.width)+            maxHeight = max(maxHeight, dimensions.height)+        }+        return (maxWidth, maxHeight)+    }++    /// Whether the source's declared shape (frame count plus every frame's+    /// declared dimensions) proves that a full `PlatformImage(data:)` decode+    /// fits `maxDecodedByteBudget`. `false` routes to the bounded downsample+    /// path — including when the frame count exceeds `maxScannedFrames`, so+    /// an unscannable container fails closed rather than decoding unbounded.+    ///+    /// `nonisolated` and source-driven so the `maxScannedFrames` boundary can+    /// be unit tested against real encoded fixtures without a loader.+    nonisolated static func declaredShapeAllowsFullDecode(_ source: CGImageSource) -> Bool {+        let frameCount = CGImageSourceGetCount(source)+        guard frameCount >= 1, frameCount <= maxScannedFrames,+              let dimensions = maxDeclaredDimensions(in: source, frameCount: frameCount) else {+            return false+        }+        return !exceedsDecodeBudget(+            width: dimensions.width, height: dimensions.height, frameCount: frameCount+        )+    }+     /// Decodes raw image data into a platform image.+    ///+    /// Inspects declared pixel dimensions and frame count via `ImageIO`+    /// *before* materializing a full bitmap (T-2132). A small, highly+    /// compressed file can declare an enormous pixel count — decoding it+    /// directly via `PlatformImage(data:)` would allocate memory proportional+    /// to the decoded pixels regardless of the compressed download size. When+    /// the declared size exceeds the decode budget, the image is downsampled+    /// via `CGImageSourceCreateThumbnailAtIndex`, which keeps the *retained*+    /// bitmap bounded by the requested pixel size (transient decode peaks are+    /// format-dependent, but far below materializing the full-resolution,+    /// all-frame bitmap).+    ///+    /// Only the remote path wraps this in `SharedConcurrency.decodeSemaphore`:+    /// `PrismDocSchemeHandler` constructs a fresh loader per remote request,+    /// while local-file and data-URI decodes run through long-lived loader+    /// actors whose isolation already serializes them per instance (and the+    /// scheme handler serves local bytes to WebKit undecoded). If local loads+    /// ever gain per-request loaders, they need the semaphore too.     private func decodeImageData(_ data: Data) throws(ImageLoadError) -> PlatformImage {-        guard let image = PlatformImage(data: data) else {+        guard let source = CGImageSourceCreateWithData(data as CFData, nil) else {             throw .decodeFailed         }-        return image+        // When ImageIO recognises the data but reports no pixel dimensions+        // (for any frame), the image's decoded size cannot be proven safe, so+        // it takes the bounded downsample path below rather than the unbounded+        // `PlatformImage(data:)` decode — an unknown size must be treated as+        // potentially a bomb, but the thumbnail decode is capped by+        // `maxDecodedDimension` regardless of the true size, so an+        // unusual-but-valid format still renders instead of failing.+        if Self.declaredShapeAllowsFullDecode(source) {+            guard let image = PlatformImage(data: data) else {+                throw .decodeFailed+            }+            return image+        }++        // Oversized, unknown-size, or decompression-bomb image: downsample a+        // single frame bounded by maxDecodedDimension instead of materializing+        // the full-resolution — and, for animated formats, all-frame — bitmap.+        // The downsample always renders frame 0, so a legitimate multi-page+        // container whose first page is a small thumbnail renders as that+        // page — acceptable for bomb defence, worth knowing for TIFFs.+        let thumbnailOptions: [CFString: Any] = [+            kCGImageSourceCreateThumbnailFromImageAlways: true,+            kCGImageSourceShouldCacheImmediately: true,+            kCGImageSourceCreateThumbnailWithTransform: true,+            kCGImageSourceThumbnailMaxPixelSize: Self.maxDecodedDimension,+        ]+        guard let thumbnail = CGImageSourceCreateThumbnailAtIndex(+            source, 0, thumbnailOptions as CFDictionary+        ) else {+            throw .decodeFailed+        }++        #if canImport(UIKit)+        return PlatformImage(cgImage: thumbnail)+        #elseif canImport(AppKit)+        return PlatformImage(cgImage: thumbnail, size: NSSize(width: thumbnail.width, height: thumbnail.height))+        #endif     } } 

diff --git a/prism/Services/SharedConcurrency.swift b/prism/Services/SharedConcurrency.swiftindex 008d969..58e10d5 100644--- a/prism/Services/SharedConcurrency.swift+++ b/prism/Services/SharedConcurrency.swift@@ -13,6 +13,20 @@ enum SharedConcurrency {     /// Limits total concurrent network fetches to 6.     /// Used by ImageLoader and SVGSourceLoader.     nonisolated static let networkSemaphore = AsyncSemaphore(limit: 6)++    /// Limits concurrent guarded image decodes to 4 (T-2132).+    ///+    /// The remote image path releases its network slot before decoding so+    /// CPU-bound decode work never stalls unrelated fetches, but decode then+    /// needs its own shared bound: `PrismDocSchemeHandler` constructs a fresh+    /// `ImageLoader` per request, so actor isolation alone cannot serialize+    /// decodes across requests. Four slots x `ImageLoader.maxDecodedByteBudget`+    /// (~64 MB) caps concurrently *retained* decoded bitmaps at ~256 MB —+    /// matching `ImageCache`'s total budget (specs/operational-hardening,+    /// Decision 4). Transient peaks inside the downsample can momentarily+    /// exceed the per-image budget for formats without subsampled decode+    /// (e.g. PNG); the semaphore bounds how many such peaks can coincide.+    nonisolated static let decodeSemaphore = AsyncSemaphore(limit: 4) }  /// Validates HTTP redirects for remote image/SVG fetches, rejecting targets

diff --git a/prismTests/ImageLoaderTests.swift b/prismTests/ImageLoaderTests.swiftindex bc23011..a90c3f3 100644--- a/prismTests/ImageLoaderTests.swift+++ b/prismTests/ImageLoaderTests.swift@@ -1,5 +1,7 @@ import Testing import Foundation+import CoreGraphics+import ImageIO  #if canImport(UIKit) import UIKit@@ -662,4 +664,444 @@ enum ImageLoaderTestHelpers {         return bitmap.representation(using: .png, properties: [:])!         #endif     }++    /// Builds a solid-color PNG at the given pixel dimensions directly via+    /// CoreGraphics/ImageIO (platform-independent — no UIKit/AppKit+    /// rendering path involved).+    ///+    /// A single solid color compresses to a tiny file regardless of declared+    /// dimensions, which is exactly the "small compressed size, huge decoded+    /// size" shape T-2132 is about: this lets tests build a realistic+    /// decompression-bomb-shaped fixture without needing a genuinely+    /// adversarial encoder.+    static func makeSolidColorPNGData(width: Int, height: Int) -> Data {+        let colorSpace = CGColorSpaceCreateDeviceRGB()+        guard let context = CGContext(+            data: nil,+            width: width,+            height: height,+            bitsPerComponent: 8,+            bytesPerRow: 0,+            space: colorSpace,+            bitmapInfo: CGImageAlphaInfo.premultipliedLast.rawValue+        ) else {+            fatalError("Failed to create bitmap context for \(width)x\(height) fixture")+        }+        context.setFillColor(CGColor(red: 1, green: 0, blue: 0, alpha: 1))+        context.fill(CGRect(x: 0, y: 0, width: width, height: height))+        guard let cgImage = context.makeImage() else {+            fatalError("Failed to create CGImage for \(width)x\(height) fixture")+        }++        let data = NSMutableData()+        guard let destination = CGImageDestinationCreateWithData(data, "public.png" as CFString, 1, nil) else {+            fatalError("Failed to create image destination")+        }+        CGImageDestinationAddImage(destination, cgImage, nil)+        guard CGImageDestinationFinalize(destination) else {+            fatalError("Failed to finalize PNG encoding")+        }+        return data as Data+    }++    /// Builds an animated GIF with `frameCount` identical solid-color frames+    /// at the given pixel dimensions.+    ///+    /// Solid-color frames compress to a tiny file, so a modest per-frame+    /// resolution with many frames reproduces the multi-frame variant of the+    /// T-2132 shape: a small download whose *total* decoded footprint+    /// (frames x width x height x 4) blows past the decode budget even though+    /// no single frame does.+    static func makeAnimatedGIFData(width: Int, height: Int, frameCount: Int) -> Data {+        let colorSpace = CGColorSpaceCreateDeviceRGB()+        guard let context = CGContext(+            data: nil,+            width: width,+            height: height,+            bitsPerComponent: 8,+            bytesPerRow: 0,+            space: colorSpace,+            bitmapInfo: CGImageAlphaInfo.premultipliedLast.rawValue+        ) else {+            fatalError("Failed to create bitmap context for \(width)x\(height) GIF frame")+        }+        context.setFillColor(CGColor(red: 0, green: 0, blue: 1, alpha: 1))+        context.fill(CGRect(x: 0, y: 0, width: width, height: height))+        guard let frame = context.makeImage() else {+            fatalError("Failed to create CGImage for GIF frame")+        }++        let data = NSMutableData()+        guard let destination = CGImageDestinationCreateWithData(+            data, "com.compuserve.gif" as CFString, frameCount, nil+        ) else {+            fatalError("Failed to create GIF image destination")+        }+        let frameProperties = [+            kCGImagePropertyGIFDictionary: [kCGImagePropertyGIFDelayTime: 0.1]+        ] as CFDictionary+        for _ in 0..<frameCount {+            CGImageDestinationAddImage(destination, frame, frameProperties)+        }+        guard CGImageDestinationFinalize(destination) else {+            fatalError("Failed to finalize GIF encoding")+        }+        return data as Data+    }++    /// Builds a multi-page TIFF whose pages have the given pixel sizes.+    ///+    /// Multi-page TIFF is the container shape where per-frame dimensions can+    /// legitimately differ — the fixture for the frame-0-only budgeting+    /// bypass: a tiny first page must not vouch for a huge later one.+    static func makeMultiPageTIFFData(pageSizes: [(width: Int, height: Int)]) -> Data {+        let data = NSMutableData()+        guard let destination = CGImageDestinationCreateWithData(+            data, "public.tiff" as CFString, pageSizes.count, nil+        ) else {+            fatalError("Failed to create TIFF image destination")+        }+        let colorSpace = CGColorSpaceCreateDeviceRGB()+        for size in pageSizes {+            guard let context = CGContext(+                data: nil,+                width: size.width,+                height: size.height,+                bitsPerComponent: 8,+                bytesPerRow: 0,+                space: colorSpace,+                bitmapInfo: CGImageAlphaInfo.premultipliedLast.rawValue+            ), let page = context.makeImage() else {+                fatalError("Failed to create \(size.width)x\(size.height) TIFF page")+            }+            CGImageDestinationAddImage(destination, page, nil)+        }+        guard CGImageDestinationFinalize(destination) else {+            fatalError("Failed to finalize TIFF encoding")+        }+        return data as Data+    }++    /// Reads back the decoded pixel dimensions of a platform image.+    static func pixelDimensions(of image: PlatformImage) -> (width: Int, height: Int)? {+        #if canImport(UIKit)+        guard let cgImage = image.cgImage else { return nil }+        #else+        guard let cgImage = image.cgImage(forProposedRect: nil, context: nil, hints: nil) else { return nil }+        #endif+        return (cgImage.width, cgImage.height)+    }+}++// MARK: - Decompression Bomb Protection Tests (T-2132)++/// Tests that `ImageLoader` bounds decoded bitmap memory independently of the+/// compressed download size.+///+/// Bug T-2132: `ImageLoader.decodeImageData` passed raw bytes straight to+/// `PlatformImage(data:)`. A small, highly compressed file that declares an+/// enormous pixel count (a "decompression bomb") would decode to a bitmap+/// proportional to the declared pixel count, not the compressed byte count —+/// allocating memory far beyond the 50 MB network cap enforced elsewhere in+/// `ImageLoader`. The fix inspects width/height/frame count via `ImageIO`+/// before decoding and downsamples oversized images instead of fully+/// decoding them.+@Suite("ImageLoader decompression bomb protection (T-2132)")+struct ImageLoaderDecompressionBombTests {++    // MARK: - Pure Budget Decision Logic++    @Test("Image within budget does not require downsampling")+    func withinBudgetDoesNotExceed() {+        #expect(ImageLoader.exceedsDecodeBudget(width: 1_920, height: 1_080, frameCount: 1) == false)+    }++    @Test("Dimensions exactly at the decode budget do not require downsampling")+    func exactlyAtBudgetDoesNotExceed() {+        #expect(+            ImageLoader.exceedsDecodeBudget(+                width: ImageLoader.maxDecodedDimension,+                height: ImageLoader.maxDecodedDimension,+                frameCount: 1+            ) == false+        )+    }++    @Test("Width one pixel over the max dimension requires downsampling")+    func widthJustOverMaxDimensionExceeds() {+        #expect(+            ImageLoader.exceedsDecodeBudget(+                width: ImageLoader.maxDecodedDimension + 1,+                height: 100,+                frameCount: 1+            )+        )+    }++    @Test("Height one pixel over the max dimension requires downsampling")+    func heightJustOverMaxDimensionExceeds() {+        #expect(+            ImageLoader.exceedsDecodeBudget(+                width: 100,+                height: ImageLoader.maxDecodedDimension + 1,+                frameCount: 1+            )+        )+    }++    @Test("Declared dimensions far beyond the budget require downsampling")+    func extremeDimensionsExceed() {+        // The exact shape of the ticket's decompression-bomb scenario: huge+        // declared pixel dimensions that would allocate gigabytes if decoded+        // directly.+        #expect(ImageLoader.exceedsDecodeBudget(width: 50_000, height: 50_000, frameCount: 1))+    }++    @Test("Many animation frames of an otherwise modest image require downsampling")+    func manyFramesOfModestImageExceeds() {+        // Each frame alone (2000x2000) is well under maxDecodedDimension, but+        // NSImage(data:) on macOS materializes every frame of an animated+        // image, so frame count must be folded into the estimate.+        #expect(ImageLoader.exceedsDecodeBudget(width: 2_000, height: 2_000, frameCount: 50))+    }++    @Test("A single frame of that same modest image does not require downsampling")+    func singleFrameOfModestImageDoesNotExceed() {+        #expect(ImageLoader.exceedsDecodeBudget(width: 2_000, height: 2_000, frameCount: 1) == false)+    }++    @Test("Zero or negative declared dimensions are treated as unsafe")+    func nonPositiveDimensionsExceed() {+        #expect(ImageLoader.exceedsDecodeBudget(width: 0, height: 100, frameCount: 1))+        #expect(ImageLoader.exceedsDecodeBudget(width: 100, height: 0, frameCount: 1))+        #expect(ImageLoader.exceedsDecodeBudget(width: -1, height: 100, frameCount: 1))+    }++    // MARK: - End-to-End Decode++    /// A small, highly-compressible solid-color PNG declaring dimensions well+    /// past `maxDecodedDimension`. Decoded naively via `PlatformImage(data:)`+    /// this would allocate ~5000*5000*4 ≈ 95 MB despite a compressed file+    /// size of only a few KB — the exact "small download, huge decode"+    /// mismatch the ticket describes.+    @Test("Oversized image is downsampled to the decode budget, not rejected")+    func oversizedImageIsDownsampledNotRejected() async throws {+        let bombWidth = 5_000+        let bombHeight = 5_000+        let pngData = ImageLoaderTestHelpers.makeSolidColorPNGData(width: bombWidth, height: bombHeight)++        // Sanity-check the fixture actually has the "small compressed, huge+        // decoded" shape this bug is about. ImageIO's PNG encoder emits+        // ~450 KB for this solid-color image — still around 200x smaller+        // than the ~95 MB decoded bitmap, which is the mismatch that matters.+        #expect(+            pngData.count < 1_000_000,+            "Fixture should compress far below its decoded size despite huge declared dimensions"+        )+        #expect(bombWidth > ImageLoader.maxDecodedDimension)++        let loader = ImageLoader()+        let image = try await loader.load(.dataURI(pngData, mimeType: "image/png"))++        let dimensions = try #require(ImageLoaderTestHelpers.pixelDimensions(of: image))+        #expect(dimensions.width <= ImageLoader.maxDecodedDimension)+        #expect(dimensions.height <= ImageLoader.maxDecodedDimension)+        #expect(image.estimatedMemoryCost <= ImageLoader.maxDecodedByteBudget)+    }++    @Test("Local file with oversized declared dimensions is downsampled, not rejected")+    func oversizedLocalFileIsDownsampled() async throws {+        let bombWidth = 5_000+        let bombHeight = 4_500+        let pngData = ImageLoaderTestHelpers.makeSolidColorPNGData(width: bombWidth, height: bombHeight)++        let tempDir = FileManager.default.temporaryDirectory+        let imageURL = tempDir.appendingPathComponent("bomb-\(UUID().uuidString).png")+        try pngData.write(to: imageURL)+        defer { try? FileManager.default.removeItem(at: imageURL) }++        let loader = ImageLoader()+        let image = try await loader.load(.localFile(imageURL))++        let dimensions = try #require(ImageLoaderTestHelpers.pixelDimensions(of: image))+        #expect(dimensions.width <= ImageLoader.maxDecodedDimension)+        #expect(dimensions.height <= ImageLoader.maxDecodedDimension)+    }++    /// Multi-frame variant of the bomb shape: each 1024x1024 frame is well+    /// within the per-frame budget, but 20 frames total ~80 MB decoded —+    /// past the 64 MB budget — so the loader must downsample to a single+    /// bounded frame rather than eagerly materializing every frame (which is+    /// what `NSImage(data:)` does on macOS for animated images).+    @Test("Animated image whose total frame footprint exceeds the budget decodes to a single bounded frame")+    func animatedImageOverBudgetDecodesToSingleBoundedFrame() async throws {+        let frameWidth = 1_024+        let frameHeight = 1_024+        let frameCount = 20+        let gifData = ImageLoaderTestHelpers.makeAnimatedGIFData(+            width: frameWidth, height: frameHeight, frameCount: frameCount+        )++        // Sanity-check the fixture: small file, genuinely multi-frame, and a+        // total footprint the budget decision rejects while a single frame+        // alone would pass.+        let source = try #require(CGImageSourceCreateWithData(gifData as CFData, nil))+        #expect(CGImageSourceGetCount(source) == frameCount)+        #expect(ImageLoader.exceedsDecodeBudget(width: frameWidth, height: frameHeight, frameCount: frameCount))+        #expect(ImageLoader.exceedsDecodeBudget(width: frameWidth, height: frameHeight, frameCount: 1) == false)++        let loader = ImageLoader()+        let image = try await loader.load(.dataURI(gifData, mimeType: "image/gif"))++        let dimensions = try #require(ImageLoaderTestHelpers.pixelDimensions(of: image))+        #expect(dimensions.width <= ImageLoader.maxDecodedDimension)+        #expect(dimensions.height <= ImageLoader.maxDecodedDimension)+        #expect(image.estimatedMemoryCost <= ImageLoader.maxDecodedByteBudget)++        // The downsampled result must be a single still frame, not an+        // animation carrying every frame's bitmap.+        #if canImport(UIKit)+        #expect(image.images == nil)+        #else+        #expect(image.representations.count == 1)+        #endif+    }++    /// A file ImageIO recognises but cannot report pixel dimensions for (a+    /// bare PNG signature with a truncated header) must not crash or decode+    /// unbounded: it takes the bounded downsample path, which fails cleanly+    /// with `.decodeFailed` when no image can be produced. A *valid* image+    /// with unreported dimensions cannot be constructed deterministically+    /// (ImageIO reports dimensions for every format it can actually decode),+    /// so this pins the reachable half of that branch: unknown size never+    /// falls through to the unbounded `PlatformImage(data:)` decode.+    @Test("Recognised data without reported pixel dimensions fails cleanly instead of decoding unbounded")+    func recognisedDataWithoutDimensionsFailsCleanly() async {+        // PNG magic bytes + truncated IHDR: enough for type sniffing, not+        // enough for CGImageSourceCopyPropertiesAtIndex to report dimensions.+        let truncatedPNG = Data([0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A, 0x00, 0x00, 0x00, 0x0D])++        let loader = ImageLoader()+        await #expect(throws: ImageLoadError.decodeFailed) {+            _ = try await loader.load(.dataURI(truncatedPNG, mimeType: "image/png"))+        }+    }++    @Test("Image within budget decodes at full resolution, unaffected by the fix")+    func withinBudgetImageDecodesAtFullResolution() async throws {+        let width = 200+        let height = 150+        let pngData = ImageLoaderTestHelpers.makeSolidColorPNGData(width: width, height: height)++        let loader = ImageLoader()+        let image = try await loader.load(.dataURI(pngData, mimeType: "image/png"))++        let dimensions = try #require(ImageLoaderTestHelpers.pixelDimensions(of: image))+        #expect(dimensions.width == width)+        #expect(dimensions.height == height)+    }++    // MARK: - maxScannedFrames Boundary++    /// Exactly `maxScannedFrames` (64) frames: the per-frame dimension scan+    /// still runs, the declared shape passes the budget, and the image+    /// qualifies for a full decode.+    @Test("An image with exactly maxScannedFrames frames is still scanned and fully decoded")+    func exactlyMaxScannedFramesIsStillScanned() throws {+        let frameCount = ImageLoader.maxScannedFrames+        let gifData = ImageLoaderTestHelpers.makeAnimatedGIFData(+            width: 16, height: 16, frameCount: frameCount+        )++        let source = try #require(CGImageSourceCreateWithData(gifData as CFData, nil))+        #expect(CGImageSourceGetCount(source) == frameCount)+        #expect(ImageLoader.declaredShapeAllowsFullDecode(source))+    }++    /// One frame past the cap: the scan is skipped entirely and the image+    /// fails closed to the bounded downsample path — even though the byte+    /// budget alone would approve this shape, proving the rejection comes+    /// from the frame-count cap and not the budget.+    @Test("One frame past maxScannedFrames fails closed to the downsample path")+    func onePastMaxScannedFramesFailsClosed() throws {+        let frameCount = ImageLoader.maxScannedFrames + 1+        let gifData = ImageLoaderTestHelpers.makeAnimatedGIFData(+            width: 16, height: 16, frameCount: frameCount+        )++        let source = try #require(CGImageSourceCreateWithData(gifData as CFData, nil))+        #expect(CGImageSourceGetCount(source) == frameCount)+        #expect(ImageLoader.exceedsDecodeBudget(width: 16, height: 16, frameCount: frameCount) == false)+        #expect(ImageLoader.declaredShapeAllowsFullDecode(source) == false)+    }++    /// End-to-end companion to the boundary pin: past the cap the image must+    /// still render (as a bounded single frame), never be rejected.+    @Test("An image past the frame-scan cap still renders bounded, not rejected")+    func overFrameScanCapStillRendersBounded() async throws {+        let gifData = ImageLoaderTestHelpers.makeAnimatedGIFData(+            width: 16, height: 16, frameCount: ImageLoader.maxScannedFrames + 1+        )++        let loader = ImageLoader()+        let image = try await loader.load(.dataURI(gifData, mimeType: "image/gif"))++        let dimensions = try #require(ImageLoaderTestHelpers.pixelDimensions(of: image))+        #expect(dimensions.width <= ImageLoader.maxDecodedDimension)+        #expect(dimensions.height <= ImageLoader.maxDecodedDimension)+        #expect(image.estimatedMemoryCost <= ImageLoader.maxDecodedByteBudget)+    }++    // MARK: - Unreported Frame Dimensions++    /// A *later* frame (not frame 0) with unreported dimensions must make the+    /// whole image unprovable, so it takes the bounded downsample path.+    /// ImageIO drops any frame it cannot size from `CGImageSourceGetCount`,+    /// so a real fixture with a counted-but-dimensionless later frame cannot+    /// be constructed; the scan core is parameterised over the per-frame+    /// lookup to keep this contract directly testable.+    @Test("A non-first frame with unreported dimensions makes the whole image unprovable")+    func laterFrameWithoutDimensionsMakesImageUnprovable() {+        let result = ImageLoader.maxDeclaredDimensions(frameCount: 3) { index in+            index == 1 ? nil : (width: 100, height: 100)+        }+        #expect(result == nil)+    }++    @Test("All frames reporting dimensions yields the per-axis maxima")+    func allFramesReportedYieldsPerAxisMaxima() {+        let sizes = [(width: 10, height: 400), (width: 300, height: 20)]+        let result = ImageLoader.maxDeclaredDimensions(frameCount: sizes.count) { sizes[$0] }+        #expect(result?.width == 300)+        #expect(result?.height == 400)+    }++    /// Mixed-frame-size variant of the bomb (pre-push review finding): the+    /// budget must consider every frame's declared dimensions. A frame-0-only+    /// estimate sees a 1x1 first page, multiplies by the frame count, and+    /// approves the file — while a later page over `maxDecodedDimension`+    /// then decodes unbounded. Multi-page TIFF is the container format where+    /// per-frame dimensions legitimately differ.+    @Test("A huge page hidden behind a tiny first page is still bounded")+    func mixedFrameSizesCannotBypassBudgetViaTinyFirstFrame() async throws {+        let hugeWidth = ImageLoader.maxDecodedDimension + 104+        let tiffData = ImageLoaderTestHelpers.makeMultiPageTIFFData(+            pageSizes: [(width: 1, height: 1), (width: hugeWidth, height: 600)]+        )++        // Fixture sanity: genuinely two pages, and a frame-0-only estimate+        // would (wrongly) pass the budget while the true worst page fails it.+        let source = try #require(CGImageSourceCreateWithData(tiffData as CFData, nil))+        #expect(CGImageSourceGetCount(source) == 2)+        #expect(ImageLoader.exceedsDecodeBudget(width: 1, height: 1, frameCount: 2) == false)+        #expect(ImageLoader.exceedsDecodeBudget(width: hugeWidth, height: 600, frameCount: 2))++        let loader = ImageLoader()+        let image = try await loader.load(.dataURI(tiffData, mimeType: "image/tiff"))++        let dimensions = try #require(ImageLoaderTestHelpers.pixelDimensions(of: image))+        #expect(dimensions.width <= ImageLoader.maxDecodedDimension)+        #expect(dimensions.height <= ImageLoader.maxDecodedDimension)+        #expect(image.estimatedMemoryCost <= ImageLoader.maxDecodedByteBudget)+    } }