feat: serialize documents iteratively

[nikku]

Proposed Changes

Related to GHSA-x3vc-q6mj-47vp.

Writing previously recursed once per document level (in both serializer construction and output), so deeply nested documents grew the call stack with depth and eventually threw RangeError: Maximum call stack size exceeded — exhausting resources on large inputs. The reader is already iterative and unaffected.

This reworks the writer to walk an explicit stack instead of recursing, in both phases:

• build → buildTree: an element serializer enters (registers namespaces, tag, attributes) and returns its children as ordered, deferred work; buildTree drives that work and runs exit (generic attributes) once a subtree is built. Pre-order traversal preserves document-order namespace logging.
• serializeTo → serializeTree: output is emitted from a frame stack rather than nested recursion.

Deeply nested documents now stay flat and scale linearly. Output is byte-identical — guarded by the existing exact-string writer suite and verified with a differential fuzz against the previous implementation (byte-for-byte match across diverse structures).

How to try out

New test/spec/performance.js exercises write, read and round-trip at depth 50000 under a 5s timeout — a stack-recursive or quadratic regression crashes or blows past it.

npm run all

Checklist

• Contribution meets our definition of done
• Pull request establishes context
  • Link to related issue(s): Related to GHSA-x3vc-q6mj-47vp
  • Brief textual description of the changes
  • Screenshots or short videos showing UI/UX changes — n/a (no UI)
  • Steps to try out: npm run all

[nikku]

Note

🤖 run analysis. Numbers are reproducible via steps below.

Performance assessment

Setup: Node v24.16.0. before = 54407ac (v12.1.0, recursive writer), after = this branch (iterative). Both built via npm run build and measured on identical inputs.

1. Small-file regression — full existing suite (180 tests)

Existing reader + writer + roundtrip specs (all small documents), 3 runs, mocha-reported execution time:

	run 1	run 2	run 3	min
before	273 ms	265 ms	254 ms	254 ms
after	257 ms	272 ms	265 ms	257 ms

No regression — within noise (~±3%). Everyday small-document serialization is unaffected.

2. Scaling — deeply nested write (depth kept below the old crash point)

Self-nested props:ComplexNesting, median of 25 runs, warm:

depth	before (ms)	after (ms)	speedup
100	0.56–0.86	0.41–0.48	~1.4–1.8×
250	1.85–2.09	0.47–0.53	~4.0×
500	6.60–7.09	0.89–0.97	~7.3×
800	15.4–15.5	1.23–1.24	~12.5×

The old writer scales super-linearly (~quadratic: doubling depth ~4×s the time) because each node re-walks the namespace parent chain (O(depth²) total). The iterative writer memoizes that walk and scales linearly, so the gap widens with depth.

3. Stack safety

• before: throws RangeError: Maximum call stack size exceeded at depth 2000.
• after: the same depth 2000 serializes in ~19 ms; the dedicated perf spec round-trips at depth 50 000 well under the 5 s gate (write ~390 ms / read ~230 ms / round-trip ~375 ms).

Summary

Same speed on small documents, linear instead of quadratic on large ones, and no depth ceiling. Output is byte-identical (182 exact-string tests + differential fuzz against the previous implementation).

[Copilot]

Pull request overview

This PR updates the moddle-xml writer implementation to avoid stack overflows when serializing deeply nested documents (related to GHSA-x3vc-q6mj-47vp) by replacing recursive build/serialize walks with explicit stack-driven traversals.

Changes:

• Refactor serializer tree construction to an explicit stack walk (buildTree) using enter/exit phases.
• Refactor XML output emission to an explicit frame stack (serializeTree) instead of recursive serializeTo calls.
• Add a performance/regression test that exercises write/read/round-trip at depth 50,000 within a 5s timeout, plus a changelog entry.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
test/spec/performance.js	Adds deep nesting performance/regression coverage for writer/reader/round-trip at depth 50,000.
lib/write.js	Reworks writer internals to iterative build + iterative serialization; adds namespace scope helpers.
CHANGELOG.md	Notes the new stack-safe serialization behavior in the unreleased section.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[barmac]

Looks good and indeed the error can be reproduced when write.js changes are reverted.