From ef682ad7b08774fe343e166e13c016fe6434493c Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Mon, 12 Oct 2026 01:04:26 +0200
Subject: [PATCH] cultcache-ts inspector: recoverCatalogEntry reads through the
 same bounded door as previewPayload

Finding inspector-recover-unwalked: one decodeBoundedPayload (walk, then decode) serves both the stamp recovery and the preview, so a payload past the limit is never decoded by either.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 packages/cultcache-ts/src/cult-cache-inspector.ts | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/packages/cultcache-ts/src/cult-cache-inspector.ts b/packages/cultcache-ts/src/cult-cache-inspector.ts
index 43fc41cd..f1f13bbb 100644
--- a/packages/cultcache-ts/src/cult-cache-inspector.ts
+++ b/packages/cultcache-ts/src/cult-cache-inspector.ts
@@ -219,7 +219,7 @@ function decodeV1Record(value: unknown, catalogBySchemaId: Map<string, Inspected
 function recoverCatalogEntry(schemaId: string, payload: Uint8Array): InspectedCatalogEntry | undefined {
   let payloadPreview: unknown;
   try {
-    payloadPreview = decode(payload);
+    payloadPreview = decodeBoundedPayload(payload);
   } catch {
     return undefined;
   }
@@ -287,6 +287,12 @@ function decodeLegacyEnvelope(value: unknown): InspectedRecord {
   };
 }
 
+// The inspector's one payload read: the depth walk first, so a payload past the limit is refused before any decoder sees it.
+function decodeBoundedPayload(payload: Uint8Array): unknown {
+  checkPayloadDepth(payload);
+  return decode(payload);
+}
+
 function previewPayload(payload: Uint8Array): Pick<InspectedRecord, "payloadPreview" | "payloadDecodeError"> {
   try {
     checkPayloadDepth(payload);