feat: bound the encoder walk and add UnmarshalWithOptions

Assisted-by: GLM 5.3 Flash

interpres.go

@@ -327,6 +327,35 @@ func (d *Decoder) DecodeContext(ctx context.Context, data []byte, v any) error {
 	return dec.decode(tree, v)
 }
 
+// DecodeOptions gathers the options a one-shot decode call can set, the
+// struct-shaped alternative to building a Decoder for a single document. The
+// zero value decodes with the defaults: unknown keys ignored, numbers
+// evaluated, and no limit beyond the nesting default.
+type DecodeOptions struct {
+	// DisallowUnknownFields rejects a key with no matching struct field.
+	DisallowUnknownFields bool
+	// UseNumber keeps the numbers of the document as Number literals.
+	UseNumber bool
+	// MaxDepth bounds how deeply arrays and inline tables may nest; 0 takes
+	// the default of 10000.
+	MaxDepth int
+	// MaxInputSize bounds the document size in bytes; 0 takes no limit.
+	MaxInputSize int
+}
+
+// UnmarshalWithOptions decodes data into v with the options set, the one-shot
+// form of building a Decoder. See DecodeOptions for the fields and their
+// defaults.
+func UnmarshalWithOptions(data []byte, v any, opts DecodeOptions) error {
+	dec := &Decoder{
+		disallowUnknown: opts.DisallowUnknownFields,
+		useNumber:       opts.UseNumber,
+		maxDepth:        opts.MaxDepth,
+		maxInputSize:    opts.MaxInputSize,
+	}
+	return dec.DecodeContext(context.Background(), data, v)
+}
+
 // Marshaler is the interface implemented by types that can produce a custom
 // TOML representation of themselves. MarshalTOML returns a value that Marshal
 // then encodes as if the returned value had been passed in its place, which
@@ -407,8 +436,9 @@ type UnmarshalerContext interface {
 //     returns. time.Duration is written in its canonical Go form, `1h30m0s`.
 //   - nil pointer fields are omitted.
 //
-// Marshal cannot encode cyclic data structures; passing one will loop until
-// the stack overflows. The output is not guaranteed to be byte-identical to
+// Marshal rejects a value that nests deeper than 10000 levels with an error
+// naming the limit, so cyclic data is reported instead of running the stack
+// out. The output is not guaranteed to be byte-identical to
 // the input that produced v: comments, whitespace, key order (for maps),
 // string quoting style, and the choice between `[table]` headers and inline
 // tables are not preserved.