@bgx4k3p/huly-mcp-server 2.2.3 → 2.2.5

package/node_modules/markdown-it/lib/common/utils.mjs

@@ -179,6 +179,10 @@ function isPunctChar (ch) {
   return ucmicro.P.test(ch) || ucmicro.S.test(ch)
 }
 
+function isPunctCharCode (code) {
+  return isPunctChar(fromCodePoint(code))
+}
+
 // Markdown ASCII punctuation characters.
 //
 // !, ", #, $, %, &, ', (, ), *, +, ,, -, ., /, :, ;, <, =, >, ?, @, [, \, ], ^, _, `, {, |, }, or ~
@@ -240,6 +244,7 @@ function normalizeReference (str) {
   // (remove this when node v10 is no longer supported).
   //
   if ('ẞ'.toLowerCase() === 'Ṿ') {
+    /* c8 ignore next 2 */
     str = str.replace(/ẞ/g, 'ß')
   }
 
@@ -278,6 +283,28 @@ function normalizeReference (str) {
   return str.toLowerCase().toUpperCase()
 }
 
+function isAsciiTrimmable (c) {
+  return c === 0x20 || c === 0x09 || c === 0x0a || c === 0x0d
+}
+
+// "Light" .trim() for blocks (headers, paragraphs), where unicode spaces
+// should be preserved.
+function asciiTrim (str) {
+  let start = 0
+  for (; start < str.length; start++) {
+    if (!isAsciiTrimmable(str.charCodeAt(start))) {
+      break
+    }
+  }
+  let end = str.length - 1
+  for (; end >= start; end--) {
+    if (!isAsciiTrimmable(str.charCodeAt(end))) {
+      break
+    }
+  }
+  return str.slice(start, end + 1)
+}
+
 // Re-export libraries commonly used in both markdown-it and its plugins,
 // so plugins won't have to depend on them explicitly, which reduces their
 // bundled size (e.g. a browser build).
@@ -299,6 +326,8 @@ export {
   isWhiteSpace,
   isMdAsciiPunct,
   isPunctChar,
+  isPunctCharCode,
   escapeRE,
-  normalizeReference
+  normalizeReference,
+  asciiTrim
 }

package/node_modules/markdown-it/lib/index.mjs

@@ -352,7 +352,7 @@ function MarkdownIt (presetName, options) {
  * ```javascript
  * var md = require('markdown-it')()
  *             .set({ html: true, breaks: true })
- *             .set({ typographer, true });
+ *             .set({ typographer: true });
  * ```
  *
  * __Note:__ To achieve the best possible performance, don't modify a

package/node_modules/markdown-it/lib/rules_block/heading.mjs

@@ -1,6 +1,6 @@
 // heading (#, ##, ...)
 
-import { isSpace } from '../common/utils.mjs'
+import { isSpace, asciiTrim } from '../common/utils.mjs'
 
 export default function heading (state, startLine, endLine, silent) {
   let pos = state.bMarks[startLine] + state.tShift[startLine]
@@ -40,7 +40,7 @@ export default function heading (state, startLine, endLine, silent) {
   token_o.map    = [startLine, state.line]
 
   const token_i    = state.push('inline', '', 0)
-  token_i.content  = state.src.slice(pos, max).trim()
+  token_i.content  = asciiTrim(state.src.slice(pos, max))
   token_i.map      = [startLine, state.line]
   token_i.children = []
 

package/node_modules/markdown-it/lib/rules_block/html_block.mjs

@@ -42,11 +42,22 @@ export default function html_block (state, startLine, endLine, silent) {
 
   let nextLine = startLine + 1
 
+  // Block types 6 and 7 (the only ones whose end condition is a blank line)
+  // have `/^$/` as their closing regexp. For all other types (1-5, e.g.
+  // `<!--` comments), a blank line is regular content and must not terminate
+  // the block - it ends only when its closing sequence is found.
+  const endsOnBlankLine = HTML_SEQUENCES[i][1].test('')
+
   // If we are here - we detected HTML block.
   // Let's roll down till block end.
   if (!HTML_SEQUENCES[i][1].test(lineText)) {
     for (; nextLine < endLine; nextLine++) {
-      if (state.sCount[nextLine] < state.blkIndent) { break }
+      if (state.sCount[nextLine] < state.blkIndent) {
+        // An outdented blank line shouldn't end a block that doesn't end on a
+        // blank line (e.g. a `<!--` comment inside a list item). Such blocks
+        // must continue until their closing sequence regardless of indent.
+        if (endsOnBlankLine || !state.isEmpty(nextLine)) { break }
+      }
 
       pos = state.bMarks[nextLine] + state.tShift[nextLine]
       max = state.eMarks[nextLine]

package/node_modules/markdown-it/lib/rules_block/lheading.mjs

@@ -1,5 +1,7 @@
 // lheading (---, ===)
 
+import { asciiTrim } from '../common/utils.mjs'
+
 export default function lheading (state, startLine, endLine/*, silent */) {
   const terminatorRules = state.md.block.ruler.getRules('paragraph')
 
@@ -57,10 +59,11 @@ export default function lheading (state, startLine, endLine/*, silent */) {
 
   if (!level) {
     // Didn't find valid underline
+    state.parentType = oldParentType
     return false
   }
 
-  const content = state.getLines(startLine, nextLine, state.blkIndent, false).trim()
+  const content = asciiTrim(state.getLines(startLine, nextLine, state.blkIndent, false))
 
   state.line = nextLine + 1
 

package/node_modules/markdown-it/lib/rules_block/paragraph.mjs

@@ -1,5 +1,7 @@
 // Paragraph
 
+import { asciiTrim } from '../common/utils.mjs'
+
 export default function paragraph (state, startLine, endLine) {
   const terminatorRules = state.md.block.ruler.getRules('paragraph')
   const oldParentType = state.parentType
@@ -26,7 +28,7 @@ export default function paragraph (state, startLine, endLine) {
     if (terminate) { break }
   }
 
-  const content = state.getLines(startLine, nextLine, state.blkIndent, false).trim()
+  const content = asciiTrim(state.getLines(startLine, nextLine, state.blkIndent, false))
 
   state.line = nextLine
 

package/node_modules/markdown-it/lib/rules_core/smartquotes.mjs

@@ -1,20 +1,42 @@
 // Convert straight quotation marks to typographic ones
 //
 
-import { isWhiteSpace, isPunctChar, isMdAsciiPunct } from '../common/utils.mjs'
+import { isWhiteSpace, isPunctCharCode, isMdAsciiPunct } from '../common/utils.mjs'
 
 const QUOTE_TEST_RE = /['"]/
 const QUOTE_RE = /['"]/g
 const APOSTROPHE = '\u2019' /* ’ */
 
-function replaceAt (str, index, ch) {
-  return str.slice(0, index) + ch + str.slice(index + 1)
+function addReplacement (replacements, tokenIdx, pos, ch) {
+  if (!replacements[tokenIdx]) {
+    replacements[tokenIdx] = []
+  }
+
+  replacements[tokenIdx].push({ pos, ch })
+}
+
+function applyReplacements (str, replacements) {
+  let result = ''
+  let lastPos = 0
+
+  replacements.sort((a, b) => a.pos - b.pos)
+
+  for (let i = 0; i < replacements.length; i++) {
+    const replacement = replacements[i]
+
+    result += str.slice(lastPos, replacement.pos) + replacement.ch
+    lastPos = replacement.pos + 1
+  }
+
+  return result + str.slice(lastPos)
 }
 
 function process_inlines (tokens, state) {
   let j
 
   const stack = []
+  // token index -> list of replacements in the original token content
+  const replacements = {}
 
   for (let i = 0; i < tokens.length; i++) {
     const token = tokens[i]
@@ -28,9 +50,9 @@ function process_inlines (tokens, state) {
 
     if (token.type !== 'text') { continue }
 
-    let text = token.content
+    const text = token.content
     let pos = 0
-    let max = text.length
+    const max = text.length
 
     /* eslint no-labels:0,block-scoped-var:0 */
     OUTER:
@@ -78,8 +100,8 @@ function process_inlines (tokens, state) {
         }
       }
 
-      const isLastPunctChar = isMdAsciiPunct(lastChar) || isPunctChar(String.fromCharCode(lastChar))
-      const isNextPunctChar = isMdAsciiPunct(nextChar) || isPunctChar(String.fromCharCode(nextChar))
+      const isLastPunctChar = isMdAsciiPunct(lastChar) || isPunctCharCode(lastChar)
+      const isNextPunctChar = isMdAsciiPunct(nextChar) || isPunctCharCode(nextChar)
 
       const isLastWhiteSpace = isWhiteSpace(lastChar)
       const isNextWhiteSpace = isWhiteSpace(nextChar)
@@ -122,7 +144,7 @@ function process_inlines (tokens, state) {
       if (!canOpen && !canClose) {
         // middle of word
         if (isSingle) {
-          token.content = replaceAt(token.content, t.index, APOSTROPHE)
+          addReplacement(replacements, i, t.index, APOSTROPHE)
         }
         continue
       }
@@ -145,18 +167,8 @@ function process_inlines (tokens, state) {
               closeQuote = state.md.options.quotes[1]
             }
 
-            // replace token.content *before* tokens[item.token].content,
-            // because, if they are pointing at the same token, replaceAt
-            // could mess up indices when quote length != 1
-            token.content = replaceAt(token.content, t.index, closeQuote)
-            tokens[item.token].content = replaceAt(
-              tokens[item.token].content, item.pos, openQuote)
-
-            pos += closeQuote.length - 1
-            if (item.token === i) { pos += openQuote.length - 1 }
-
-            text = token.content
-            max = text.length
+            addReplacement(replacements, i, t.index, closeQuote)
+            addReplacement(replacements, item.token, item.pos, openQuote)
 
             stack.length = j
             continue OUTER
@@ -172,10 +184,14 @@ function process_inlines (tokens, state) {
           level: thisLevel
         })
       } else if (canClose && isSingle) {
-        token.content = replaceAt(token.content, t.index, APOSTROPHE)
+        addReplacement(replacements, i, t.index, APOSTROPHE)
       }
     }
   }
+
+  Object.keys(replacements).forEach(function (tokenIdx) {
+    tokens[tokenIdx].content = applyReplacements(tokens[tokenIdx].content, replacements[tokenIdx])
+  })
 }
 
 export default function smartquotes (state) {

package/node_modules/markdown-it/lib/rules_inline/entity.mjs

@@ -1,6 +1,6 @@
 // Process html entity - {, ¯, ", ...
 
-import { decodeHTML } from 'entities'
+import { decodeHTMLStrict } from 'entities'
 import { isValidEntityCode, fromCodePoint } from '../common/utils.mjs'
 
 const DIGITAL_RE = /^&#((?:x[a-f0-9]{1,6}|[0-9]{1,7}));/i
@@ -33,7 +33,7 @@ export default function entity (state, silent) {
   } else {
     const match = state.src.slice(pos).match(NAMED_RE)
     if (match) {
-      const decoded = decodeHTML(match[0])
+      const decoded = decodeHTMLStrict(match[0])
       if (decoded !== match[0]) {
         if (!silent) {
           const token   = state.push('text_special', '', 0)

package/node_modules/markdown-it/lib/rules_inline/state_inline.mjs

@@ -1,7 +1,7 @@
 // Inline parser state
 
 import Token from '../token.mjs'
-import { isWhiteSpace, isPunctChar, isMdAsciiPunct } from '../common/utils.mjs'
+import { isWhiteSpace, isPunctCharCode, isMdAsciiPunct } from '../common/utils.mjs'
 
 function StateInline (src, md, env, outTokens) {
   this.src = src
@@ -89,8 +89,30 @@ StateInline.prototype.scanDelims = function (start, canSplitWord) {
   const max = this.posMax
   const marker = this.src.charCodeAt(start)
 
-  // treat beginning of the line as a whitespace
-  const lastChar = start > 0 ? this.src.charCodeAt(start - 1) : 0x20
+  // Astral characters below are combined manually, because .codePointAt()
+  // does not guarantee numeric type output. And we don't wish JIT cache issues.
+  // The broken surrogate pairs are evaluated as U+FFFD to prevent possible
+  // crashes.
+
+  let lastChar
+  if (start === 0) {
+    // treat beginning of the line as a whitespace
+    lastChar = 0x20
+  } else if (start === 1) {
+    lastChar = this.src.charCodeAt(0)
+    if ((lastChar & 0xF800) === 0xD800) { lastChar = 0xFFFD }
+  } else {
+    lastChar = this.src.charCodeAt(start - 1)
+    if ((lastChar & 0xFC00) === 0xDC00) {
+      // low surrogate => add high one, replace broken pair with U+FFFD
+      const highSurr = this.src.charCodeAt(start - 2)
+      lastChar = (highSurr & 0xFC00) === 0xD800
+        ? 0x10000 + ((highSurr - 0xD800) << 10) + (lastChar - 0xDC00)
+        : 0xFFFD
+    } else if ((lastChar & 0xFC00) === 0xD800) {
+      lastChar = 0xFFFD
+    }
+  }
 
   let pos = start
   while (pos < max && this.src.charCodeAt(pos) === marker) { pos++ }
@@ -98,10 +120,19 @@ StateInline.prototype.scanDelims = function (start, canSplitWord) {
   const count = pos - start
 
   // treat end of the line as a whitespace
-  const nextChar = pos < max ? this.src.charCodeAt(pos) : 0x20
+  let nextChar = pos < max ? this.src.charCodeAt(pos) : 0x20
+  if ((nextChar & 0xFC00) === 0xD800) {
+    // high surrogate => add low one, replace broken pair with U+FFFD
+    const lowSurr = this.src.charCodeAt(pos + 1)
+    nextChar = (lowSurr & 0xFC00) === 0xDC00
+      ? 0x10000 + ((nextChar - 0xD800) << 10) + (lowSurr - 0xDC00)
+      : 0xFFFD
+  } else if ((nextChar & 0xFC00) === 0xDC00) {
+    nextChar = 0xFFFD
+  }
 
-  const isLastPunctChar = isMdAsciiPunct(lastChar) || isPunctChar(String.fromCharCode(lastChar))
-  const isNextPunctChar = isMdAsciiPunct(nextChar) || isPunctChar(String.fromCharCode(nextChar))
+  const isLastPunctChar = isMdAsciiPunct(lastChar) || isPunctCharCode(lastChar)
+  const isNextPunctChar = isMdAsciiPunct(nextChar) || isPunctCharCode(nextChar)
 
   const isLastWhiteSpace = isWhiteSpace(lastChar)
   const isNextWhiteSpace = isWhiteSpace(nextChar)

package/node_modules/markdown-it/package.json

@@ -1,6 +1,6 @@
 {
   "name": "markdown-it",
-  "version": "14.1.1",
+  "version": "14.2.0",
   "description": "Markdown-it - modern pluggable markdown parser.",
   "keywords": [
     "markdown",
@@ -11,6 +11,16 @@
   ],
   "repository": "markdown-it/markdown-it",
   "license": "MIT",
+  "funding": [
+    {
+      "type": "github",
+      "url": "https://github.com/sponsors/puzrin"
+    },
+    {
+      "type": "github",
+      "url": "https://github.com/sponsors/markdown-it"
+    }
+  ],
   "main": "dist/index.cjs.js",
   "module": "index.mjs",
   "exports": {
@@ -28,7 +38,7 @@
   },
   "scripts": {
     "lint": "eslint .",
-    "test": "npm run lint && CJS_ONLY=1 npm run build && c8 --exclude dist --exclude test -r text -r html -r lcov mocha && node support/specsplit.mjs",
+    "test": "npm run lint && cross-env CJS_ONLY=1 npm run build && c8 --exclude dist --exclude test -r text -r html -r lcov mocha && node support/specsplit.mjs",
     "doc": "node support/build_doc.mjs",
     "gh-doc": "npm run doc && gh-pages -d apidoc -f",
     "demo": "npm run lint && node support/build_demo.mjs",
@@ -47,7 +57,7 @@
   "dependencies": {
     "argparse": "^2.0.1",
     "entities": "^4.4.0",
-    "linkify-it": "^5.0.0",
+    "linkify-it": "^5.0.1",
     "mdurl": "^2.0.0",
     "punycode.js": "^2.3.1",
     "uc.micro": "^2.1.0"
@@ -61,6 +71,7 @@
     "benchmark": "~2.1.0",
     "c8": "^8.0.1",
     "chai": "^4.2.0",
+    "cross-env": "^7.0.3",
     "eslint": "^8.4.1",
     "eslint-config-standard": "^17.1.0",
     "express": "^4.14.0",

package/node_modules/msgpackr/README.md

@@ -7,8 +7,6 @@
 [![module](https://img.shields.io/badge/module-ESM%2FCJS-blue)](README.md)
 [![license](https://img.shields.io/badge/license-MIT-brightgreen)](LICENSE)
 
-<img align="right" src="./assets/performance.png" width="380"/>
-
 The msgpackr package is an extremely fast MessagePack NodeJS/JavaScript implementation. Currently, it is significantly faster than any other known implementations, faster than Avro (for JS), and generally faster than native V8 JSON.stringify/parse, on NodeJS. It also includes an optional record extension (the `r` in msgpackr), for defining record structures that makes MessagePack even faster and more compact, often over twice as fast as even native JSON functions, several times faster than other JS implementations, and 15-50% more compact. See the performance section for more details. Structured cloning (with support for cyclical references) is also supported through optional extensions.
 
 ## Basic Usage
@@ -104,7 +102,7 @@ packr.pack(bigDataWithLotsOfObjects);
 
 Another way to further leverage the benefits of the msgpackr record structures is to use streams that naturally allow for data to reuse based on previous record structures. The stream classes have the record structure extension enabled by default and provide excellent out-of-the-box performance.
 
-When creating a new `Packr`, `Unpackr`, `PackrStream`, or `UnpackrStream` instance, we can enable or disable the record structure extension with the `useRecords` property. When this is `false`, the record structure extension will be disabled (standard/compatibility mode), and all objects will revert to being serialized using MessageMap `map`s, and all `map`s will be deserialized to JS `Object`s as properties (like the standalone `pack` and `unpack` functions).
+When creating a new `Packr`, `Unpackr`, `PackrStream`, or `UnpackrStream` instance, we can enable or disable the record structure extension with the `useRecords` property. When this is `false`, the record structure extension will be disabled (standard/compatibility mode), and all objects will revert to being serialized using MessagePack `map`s, and all `map`s will be deserialized to JS `Object`s as properties (like the standalone `pack` and `unpack` functions).
 
 Streaming with record structures works by encoding a structure the first time it is seen in a stream and referencing the structure in later messages that are sent across that stream. When an encoder can expect a decoder to understand previous structure references, this can be configured using the `sequential: true` flag, which is auto-enabled by streams, but can also be used with Packr instances.
 

package/node_modules/msgpackr/benchmark.md

@@ -1,24 +1,34 @@
 Here are more comprehensive benchmarks. This is comparison with the next fastest JS projects using the benchmark tool from `msgpack-lite` (and data is from some clinical research data we use that has a good mix of different value types and structures). It also includes comparison to V8 native JSON functionality, and JavaScript Avro (`avsc`, a very optimized Avro implementation):
 
-operation                                                  |   op   |   ms  |  op/s
----------------------------------------------------------- | ------: | ----: | -----:
-buf = Buffer(JSON.stringify(obj));                         |   82000 |  5004 |  16386
-obj = JSON.parse(buf);                                     |   88600 |  5000 |  17720
-require("msgpackr").pack(obj);                             |  161500 |  5002 |  32287
-require("msgpackr").unpack(buf);                           |   94600 |  5004 |  18904
-msgpackr w/ shared structures: packr.pack(obj);            |  178400 |  5002 |  35665
-msgpackr w/ shared structures: packr.unpack(buf);          |  376700 |  5000 |  75340
-buf = require("msgpack-lite").encode(obj);                 |   30100 |  5012 |   6005
-obj = require("msgpack-lite").decode(buf);                 |   16200 |  5001 |   3239
-buf = require("notepack").encode(obj);                     |   62600 |  5005 |  12507
-obj = require("notepack").decode(buf);                     |   32400 |  5007 |   6470
-require("what-the-pack")... encoder.encode(obj);           |   63500 |  5002 |  12694
-require("what-the-pack")... encoder.decode(buf);           |   32000 |  5001 |   6398
-require("avsc")...make schema/type...type.toBuffer(obj);   |   84600 |  5003 |  16909
-require("avsc")...make schema/type...type.toBuffer(obj);   |   99300 |  5001 |  19856
+---------------------------------------------------------- | ------: | ----: | -----: | -----:
+msgpackr w/ shared structures: packr.pack(obj);            |  254700 |  5001 |  50929
+msgpackr w/ shared structures: packr.unpack(buf);          |  711700 |  5000 | 142340
+require("msgpackr").pack(obj);                             |  234000 |  5000 |  46800
+require("msgpackr").unpack(buf);                           |  186500 |  5000 |  37300
+buf = Buffer(JSON.stringify(obj));                         |  297900 |  5000 |  59580
+obj = JSON.parse(buf);                                     |  216600 |  5001 |  43311
+buf = require("msgpack-lite").encode(obj);                 |  114000 |  5001 |  22795
+obj = require("msgpack-lite").decode(buf);                 |   40700 |  5006 |   8130
+buf = require("@msgpack/msgpack").encode(obj);             |  166100 |  5000 |  33220
+obj = require("@msgpack/msgpack").decode(buf);             |  136500 |  5002 |  27289
+buf = require("msgpack-js-v5").encode(obj);                |   41600 |  5000 |   8320
+obj = require("msgpack-js-v5").decode(buf);                |   70200 |  5004 |  14028
+buf = require("msgpack-js").encode(obj);                   |   40400 |  5012 |   8060
+obj = require("msgpack-js").decode(buf);                   |   67100 |  5002 |  13414
+buf = require("msgpack5")().encode(obj);                   |   15800 |  5024 |   3144
+obj = require("msgpack5")().decode(buf);                   |   30600 |  5004 |   6115
+buf = require("notepack").encode(obj);                     |  125100 |  5002 |  25009
+obj = require("notepack").decode(buf);                     |   98600 |  5004 |  19704
+require("what-the-pack")... encoder.encode(obj);           |  150300 |  5001 |  30053
+require("what-the-pack")... encoder.decode(buf);           |  100100 |  5000 |  20020
+obj = require("msgpack-unpack").decode(buf);               |   14900 |  5031 |   2961
+require("avsc")...make schema/type...type.toBuffer(obj);   |  266600 |  5000 |  53320
+require("avsc")...make schema/type...type.fromBuffer(obj); |  370200 |  5000 |  74040
 
 (`avsc` is schema-based and more comparable in style to msgpackr with shared structures).
 
+(note that benchmarks below are several years old)
+
 Here is a benchmark of streaming data (again borrowed from `msgpack-lite`'s benchmarking), where msgpackr is able to take advantage of the structured record extension and really pull away from other tools:
 
 operation (1000000 x 2)                          |   op    |  ms   |  op/s

package/node_modules/msgpackr/dist/index-no-eval.cjs

@@ -31,13 +31,6 @@
 	var inlineObjectReadThreshold = 2;
 	var readStruct;
 	var BlockedFunction; // we use search and replace to change the next call to BlockedFunction to avoid CSP issues for
-	// no-eval build
-	try {
-		new BlockedFunction ('');
-	} catch(error) {
-		// if eval variants are not supported, do not create inline object readers ever
-		inlineObjectReadThreshold = Infinity;
-	}
 
 	class Unpackr {
 		constructor(options) {
@@ -503,11 +496,18 @@
 		function readObject() {
 			// This initial function is quick to instantiate, but runs slower. After several iterations pay the cost to build the faster function
 			if (readObject.count++ > inlineObjectReadThreshold) {
-				let readObject = structure.read = (new BlockedFunction ('r', 'return function(){return ' + (currentUnpackr.freezeData ? 'Object.freeze' : '') +
-					'({' + structure.map(key => key === '__proto__' ? '__proto_:r()' : validName.test(key) ? key + ':r()' : ('[' + JSON.stringify(key) + ']:r()')).join(',') + '})}'))(read);
+				let optimizedReadObject;
+				try {
+					optimizedReadObject = structure.read = (new BlockedFunction ('r', 'return function(){return ' + (currentUnpackr.freezeData ? 'Object.freeze' : '') +
+						'({' + structure.map(key => key === '__proto__' ? '__proto_:r()' : validName.test(key) ? key + ':r()' : ('[' + JSON.stringify(key) + ']:r()')).join(',') + '})}'))(read);
+				} catch(error) {
+					// in CF workers, the new BlockedFunction  call could begin to fail at any point in time
+					inlineObjectReadThreshold = Infinity; // disable going forward
+					return readObject(); // recursively try again
+				}
 				if (structure.highByte === 0)
 					structure.read = createSecondByteReader(firstId, structure.read);
-				return readObject() // second byte is already read, if there is one so immediately read object
+				return optimizedReadObject() // second byte is already read, if there is one so immediately read object
 			}
 			let object = {};
 			for (let i = 0, l = structure.length; i < l; i++) {
@@ -576,26 +576,45 @@
 			} else if ((byte1 & 0xe0) === 0xc0) {
 				// 2 bytes
 				const byte2 = src[position$1++] & 0x3f;
-				units.push(((byte1 & 0x1f) << 6) | byte2);
+				const codePoint = ((byte1 & 0x1f) << 6) | byte2;
+				// Reject overlong encoding: 2-byte sequences must encode values >= 0x80
+				if (codePoint < 0x80) {
+					units.push(0xFFFD); // replacement character
+				} else {
+					units.push(codePoint);
+				}
 			} else if ((byte1 & 0xf0) === 0xe0) {
 				// 3 bytes
 				const byte2 = src[position$1++] & 0x3f;
 				const byte3 = src[position$1++] & 0x3f;
-				units.push(((byte1 & 0x1f) << 12) | (byte2 << 6) | byte3);
+				const codePoint = ((byte1 & 0x1f) << 12) | (byte2 << 6) | byte3;
+				// Reject overlong encoding: 3-byte sequences must encode values >= 0x800
+				// Also reject surrogates (0xD800-0xDFFF)
+				if (codePoint < 0x800 || (codePoint >= 0xD800 && codePoint <= 0xDFFF)) {
+					units.push(0xFFFD); // replacement character
+				} else {
+					units.push(codePoint);
+				}
 			} else if ((byte1 & 0xf8) === 0xf0) {
 				// 4 bytes
 				const byte2 = src[position$1++] & 0x3f;
 				const byte3 = src[position$1++] & 0x3f;
 				const byte4 = src[position$1++] & 0x3f;
 				let unit = ((byte1 & 0x07) << 0x12) | (byte2 << 0x0c) | (byte3 << 0x06) | byte4;
-				if (unit > 0xffff) {
+				// Reject overlong encoding: 4-byte sequences must encode values >= 0x10000
+				// Also reject values > 0x10FFFF (maximum valid Unicode)
+				if (unit < 0x10000 || unit > 0x10FFFF) {
+					units.push(0xFFFD); // replacement character
+				} else if (unit > 0xffff) {
 					unit -= 0x10000;
 					units.push(((unit >>> 10) & 0x3ff) | 0xd800);
 					unit = 0xdc00 | (unit & 0x3ff);
+					units.push(unit);
+				} else {
+					units.push(unit);
 				}
-				units.push(unit);
 			} else {
-				units.push(byte1);
+				units.push(0xFFFD); // replacement character for invalid lead byte
 			}
 
 			if (units.length >= 0x1000) {
@@ -958,7 +977,7 @@
 				if (length <= 40) {
 					let out = view.getBigUint64(start);
 					for (let i = start + 8; i < end; i += 8) {
-						out <<= BigInt(64n);
+						out <<= BigInt(64);
 						out |= view.getBigUint64(i);
 					}
 					return out