///|
/// Bounds applied before OCF decoding allocates memory or visits records.
pub(all) struct OcfLimits {
  max_metadata_entries : Int
  max_metadata_bytes : Int
  max_block_bytes : Int
  max_records_per_block : Int
} derive(Debug, Eq)

///|
/// Conservative defaults suitable for untrusted in-memory OCF input.
pub fn default_limits() -> OcfLimits {
  {
    max_metadata_entries: 256,
    max_metadata_bytes: 4 * 1024 * 1024,
    max_block_bytes: 64 * 1024 * 1024,
    max_records_per_block: 1_000_000,
  }
}

///|
/// Build explicit OCF bounds. All bounds must be positive.
pub fn OcfLimits::new(
  max_metadata_entries~ : Int,
  max_metadata_bytes~ : Int,
  max_block_bytes~ : Int,
  max_records_per_block~ : Int,
) -> OcfLimits raise OcfError {
  if max_metadata_entries <= 0 ||
    max_metadata_bytes <= 0 ||
    max_block_bytes <= 0 ||
    max_records_per_block <= 0 {
    raise Compression(codec="limits", message="all OCF limits must be positive")
  }
  {
    max_metadata_entries,
    max_metadata_bytes,
    max_block_bytes,
    max_records_per_block,
  }
}