@overdeck/desktop 0.47.0 → 0.48.0

package/server/{merge-train-deps-D_uGX91G.js → merge-train-deps-D_-C0Pk2.js}

@@ -1,6 +1,6 @@
-import { Gn as init_projects, ar as resolveProjectFromIssueSync } from "./config-yaml-CxdwhAIA.js";
-import { b as init_agents, dt as spawnRun } from "./queries-C-MUZaIy.js";
-import { c as init_review_status_sync, r as getAllReviewStatusesFromDb } from "./review-status-sync-0GxOqeqF.js";
+import { Sn as resolveProjectFromIssueSync, cn as init_projects } from "./config-yaml-BSCqwmX0.js";
+import { Et as spawnRun, b as init_agents } from "./queries-DVpl1vsU.js";
+import { c as init_review_status_sync, r as getAllReviewStatusesFromDb } from "./review-status-sync-BxBeHRde.js";
 import { join } from "path";
 import { exec } from "child_process";
 import { promisify } from "util";
@@ -72,4 +72,4 @@ function buildRealReconcileDeps() {
 //#endregion
 export { buildRealReconcileDeps };
 
-//# sourceMappingURL=merge-train-deps-D_uGX91G.js.map
+//# sourceMappingURL=merge-train-deps-D_-C0Pk2.js.map

package/server/{merge-verification-NvaAd8CZ.js → merge-verification-DN1Ov9bU.js}

@@ -1,9 +1,9 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { Gn as init_projects, ar as resolveProjectFromIssueSync } from "./config-yaml-CxdwhAIA.js";
-import { n as resolveGitHubIssueSync, t as init_tracker_utils } from "./tracker-utils-CJ6BHjcD.js";
-import { i as init_merge_set, r as getMergeSetSync } from "./merge-set-CBgHfwM0.js";
-import { f as init_github_app, p as isGitHubAppConfigured, v as listPullRequestsForHead } from "./github-app-CmNk0zLU.js";
-import { i as init_merge_completeness, r as hasPositiveMergedEvidence, t as assessMergeCompleteness } from "./merge-completeness-B46KqhtY.js";
+import { Sn as resolveProjectFromIssueSync, cn as init_projects } from "./config-yaml-BSCqwmX0.js";
+import { n as resolveGitHubIssueSync, t as init_tracker_utils } from "./tracker-utils-BDeAXC-q.js";
+import { i as init_merge_set, r as getMergeSetSync } from "./merge-set-DsLjjLEV.js";
+import { f as init_github_app, p as isGitHubAppConfigured, v as listPullRequestsForHead } from "./github-app-D2QuvZ3j.js";
+import { i as init_merge_completeness, r as hasPositiveMergedEvidence, t as assessMergeCompleteness } from "./merge-completeness-C1FevcDT.js";
 import { Effect } from "effect";
 import { exec } from "node:child_process";
 import { promisify } from "node:util";
@@ -217,4 +217,4 @@ var init_merge_verification = __esmMin((() => {
 //#endregion
 export { verifyMergedBeforeLifecycle as i, init_merge_verification as n, shouldSkipDispatchAsMerged as r, handlePostRebaseVerificationDeferral as t };
 
-//# sourceMappingURL=merge-verification-NvaAd8CZ.js.map
+//# sourceMappingURL=merge-verification-DN1Ov9bU.js.map

package/server/{merged-docker-cleanup-worker-Y1R06TEl.js → merged-docker-cleanup-worker-CfXSr2pA.js}

@@ -1,6 +1,6 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { o as init_activity_logger, r as emitActivityEntrySync } from "./activity-logger-CyteR4JO.js";
-import { n as init_review_status_source, s as resolveCanonicalReviewStatus } from "./review-status-source-DIk1JSow.js";
+import { a as emitActivityEntrySync, c as init_activity_logger } from "./activity-logger-Co5qljIj.js";
+import { n as init_review_status_source, s as resolveCanonicalReviewStatus } from "./review-status-source-7nU3Z2wL.js";
 //#region ../../lib/cloister/merged-docker-cleanup-worker.ts
 function retryDelayMs(attempts) {
 	return Math.min(RETRY_BASE_MS * 2 ** Math.max(0, attempts - 1), RETRY_MAX_MS);
@@ -30,7 +30,7 @@ function recordFailure(entry, reason) {
 	console.warn(`[deacon] Merged-issue Docker cleanup failed for ${entry.issueId}; retry ${entry.attempts} after ${new Date(entry.nextAttemptAt).toISOString()}: ${reason}`);
 }
 async function drainQueue() {
-	const { teardownWorkspaceDockerByNamePromise } = await import("./docker-Y3PElJb0.js");
+	const { teardownWorkspaceDockerByNamePromise } = await import("./docker-DH3jUYg1.js");
 	for (let entry = nextEligibleEntry(); entry; entry = nextEligibleEntry()) {
 		entry.running = true;
 		const eligibility = resolveCanonicalReviewStatus(entry.issueId);
@@ -104,4 +104,4 @@ var init_merged_docker_cleanup_worker = __esmMin((() => {
 //#endregion
 export { init_merged_docker_cleanup_worker as n, reconcileMergedDockerCleanupQueue as r, enqueueMergedDockerCleanup as t };
 
-//# sourceMappingURL=merged-docker-cleanup-worker-Y1R06TEl.js.map
+//# sourceMappingURL=merged-docker-cleanup-worker-CfXSr2pA.js.map

package/server/{merged-docker-cleanup-worker-DH_hrGPI.js → merged-docker-cleanup-worker-ybsPyHjB.js}

@@ -1,3 +1,3 @@
-import { n as init_merged_docker_cleanup_worker, r as reconcileMergedDockerCleanupQueue } from "./merged-docker-cleanup-worker-Y1R06TEl.js";
+import { n as init_merged_docker_cleanup_worker, r as reconcileMergedDockerCleanupQueue } from "./merged-docker-cleanup-worker-CfXSr2pA.js";
 init_merged_docker_cleanup_worker();
 export { reconcileMergedDockerCleanupQueue };

package/server/{multipart-parser-R-oC8dQg.js → multipart-parser-CL5QG8iv.js}

@@ -1,5 +1,5 @@
 import { n as __esmMin } from "./rolldown-runtime-DNCzzKnI.js";
-import { a as File, i as init_esm_min, n as FormData, t as init_from } from "./from-B3tZbB55.js";
+import { a as File, i as init_esm_min, n as FormData, t as init_from } from "./from-BogSwvr2.js";
 //#region ../../../node_modules/.bun/node-fetch@3.3.2/node_modules/node-fetch/src/utils/multipart-parser.js
 function _fileName(headerValue) {
 	const m = headerValue.match(/\bfilename=("(.*?)"|([^()<>@,;:\\"/[\]?={}\s\t]+))($|;\s)/i);
@@ -293,4 +293,4 @@ __esmMin((() => {
 }))();
 export { toFormData };
 
-//# sourceMappingURL=multipart-parser-R-oC8dQg.js.map
+//# sourceMappingURL=multipart-parser-CL5QG8iv.js.map

package/server/{no-resume-mode-BgD0JUmM.js → no-resume-mode-DUR7Hi98.js}

@@ -89,4 +89,4 @@ var init_no_resume_mode = __esmMin((() => {
 //#endregion
 export { init_boot_gates as a, formatBootGateState as i, isExplicitNoResumeRequest as n, resolveBootGates as o, isNoResumeValueEnabled as r, init_no_resume_mode as t };
 
-//# sourceMappingURL=no-resume-mode-BgD0JUmM.js.map
+//# sourceMappingURL=no-resume-mode-DUR7Hi98.js.map

package/server/node_modules/.package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@overdeck/desktop-server",
-  "version": "0.47.0",
+  "version": "0.48.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
@@ -407,9 +407,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz",
-      "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==",
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
+      "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0"
@@ -1245,9 +1245,9 @@
       "license": "MIT"
     },
     "node_modules/msgpackr": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/msgpackr/-/msgpackr-2.0.4.tgz",
-      "integrity": "sha512-o1C5KRmuRt+apqMr1HuGSqWStZoRBUpEsCsl15uM9VdAF1qHLtvMOU2En747EnTyEl6c4pzPewRMFF31s1CNbA==",
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/msgpackr/-/msgpackr-2.0.5.tgz",
+      "integrity": "sha512-cef05H/dSYpLpqp3sj/qyZh5vhUYCalnaLO7j1yOmpsR0y/XwLVtK7r5gn+U/F7CTEfMowcGhlUQJDLcLf7jcA==",
       "license": "MIT",
       "optionalDependencies": {
         "msgpackr-extract": "^3.0.4"

package/server/node_modules/brace-expansion/README.md

@@ -51,11 +51,33 @@ expand('ppp{,config,oe{,conf}}')
 var expand = require('brace-expansion');
 ```
 
-### var expanded = expand(str)
+### var expanded = expand(str, [options])
 
 Return an array of all possible and valid expansions of `str`. If none are
 found, `[str]` is returned.
 
+The `options` object can provide a `max` value to cap the number
+of expansions allowed. This is limited to `100_000` by default,
+to prevent DoS attacks.
+
+```js
+const expansions = expand('{1..100}'.repeat(5), {
+  max: 100,
+})
+// expansions.length will be 100, not 100^5
+```
+
+The `options` object can also provide a `maxLength` value to cap the
+total number of characters across all expansions. This is limited to
+`4_000_000` by default, to prevent memory exhaustion from inputs whose
+result count stays under `max` while each result grows very long.
+
+```js
+const expansions = expand('{a,b}'.repeat(1500), {
+  maxLength: 10_000,
+})
+```
+
 Valid expansions are:
 
 ```js

package/server/node_modules/brace-expansion/index.js

@@ -8,6 +8,20 @@ var escClose = '\0CLOSE'+Math.random()+'\0';
 var escComma = '\0COMMA'+Math.random()+'\0';
 var escPeriod = '\0PERIOD'+Math.random()+'\0';
 
+var EXPANSION_MAX = 100000
+
+// `EXPANSION_MAX` caps the *number* of expansions, but not their length. An
+// input like `'{a,b}'.repeat(1500)` stays under that count - its output is
+// truncated to 100k results - while making every result ~1500 characters
+// long. The result set, and the intermediate arrays built while combining
+// brace sets, then grow large enough to exhaust memory and crash the process
+// (CVE-2026-14257). `EXPANSION_MAX_LENGTH` bounds the total number of
+// characters the accumulator may hold at any point, so memory stays flat no
+// matter how many brace groups are chained. The limit sits well above any
+// realistic expansion (100k results hitting `EXPANSION_MAX` measure ~1M
+// characters) so legitimate input is unaffected.
+var EXPANSION_MAX_LENGTH = 4000000
+
 function numeric(str) {
   return parseInt(str, 10) == str
     ? parseInt(str, 10)
@@ -66,7 +80,8 @@ function expandTop(str, options) {
     return [];
 
   options = options || {};
-  var max = options.max == null ? Infinity : options.max;
+  var max = options.max == null ? EXPANSION_MAX : options.max;
+  var maxLength = options.maxLength == null ? EXPANSION_MAX_LENGTH : options.maxLength;
 
   // I don't know why Bash 4.3 does this, but it does.
   // Anything starting with {} will have the first two bytes preserved
@@ -78,7 +93,7 @@ function expandTop(str, options) {
     str = '\\{\\}' + str.substr(2);
   }
 
-  return expand(escapeBraces(str), max, true).map(unescapeBraces);
+  return expand(escapeBraces(str), max, maxLength, true).map(unescapeBraces);
 }
 
 function embrace(str) {
@@ -95,27 +110,142 @@ function gte(i, y) {
   return i >= y;
 }
 
-function expand(str, max, isTop) {
-  var expansions = [];
+// Build `{ acc[a] + pre + values[v] }` for every combination, capping the
+// number of results at `max` and the total number of characters at `maxLength`.
+// This is the one place output grows, so bounding it here keeps the single
+// accumulator - and therefore memory - flat regardless of how many brace groups
+// are combined (CVE-2026-14257).
+function combine(
+  acc,
+  pre,
+  values,
+  max,
+  maxLength,
+  dropEmpties
+) {
+  var out = []
+  var length = 0
+  for (var a = 0; a < acc.length; a++) {
+    for (var v = 0; v < values.length; v++) {
+      if (out.length >= max) return out
+      var expansion = acc[a] + pre + values[v]
+      // Bash drops empty results at the top level. Skip them before they count
+      // against `max`, so `max` bounds the number of *kept* results.
+      if (dropEmpties && !expansion) continue
+      if (length + expansion.length > maxLength) return out
+      out.push(expansion)
+      length += expansion.length
+    }
+  }
+  return out
+}
+
+// The expansion values of a single numeric (`1..5`) or alphabetic (`a..e..2`)
+// sequence body.
+function expandSequence(
+  body,
+  isAlphaSequence,
+  max,
+  maxLength
+) {
+  var n = body.split(/\.\./)
+  var N = []
+  // A sequence body always splits into two or three parts, but the compiler
+  // can't know that.
+  /* c8 ignore start */
+  if (n[0] === undefined || n[1] === undefined) {
+    return N
+  }
+  /* c8 ignore stop */
+  var x = numeric(n[0])
+  var y = numeric(n[1])
+  var width = Math.max(n[0].length, n[1].length)
+  var incr =
+    n.length === 3 && n[2] !== undefined ?
+      Math.max(Math.abs(numeric(n[2])), 1)
+    : 1
+  var test = lte
+  var reverse = y < x
+  if (reverse) {
+    incr *= -1
+    test = gte
+  }
+  var pad = n.some(isPadded)
+
+  var length = 0
+  for (var i = x; test(i, y) && N.length < max; i += incr) {
+    var c
+    if (isAlphaSequence) {
+      c = String.fromCharCode(i)
+      if (c === '\\') {
+        c = ''
+      }
+    } else {
+      c = String(i)
+      if (pad) {
+        var need = width - c.length
+        if (need > 0) {
+          var z = new Array(need + 1).join('0')
+          if (i < 0) {
+            c = '-' + z + c.slice(1)
+          } else {
+            c = z + c
+          }
+        }
+      }
+    }
+    if (length + c.length > maxLength) break
+    N.push(c)
+    length += c.length
+  }
+  return N
+}
+
+function expand(
+  str,
+  max,
+  maxLength,
+  isTop
+) {
+  // Consume the string's top-level brace groups left to right, threading a
+  // running set of combined prefixes (`acc`). Expanding the tail iteratively -
+  // rather than recursing on `m.post` once per group - keeps the native stack
+  // depth constant, so deeply chained input (`'{a,b}'.repeat(3000)`) can no
+  // longer overflow the stack, and leaves a single accumulator whose size
+  // `maxLength` bounds directly (CVE-2026-14257).
+  var acc = ['']
+
+  // Bash drops empty results, but only when the *first* top-level group is a
+  // comma set - a sequence like `{a..\}` may legitimately yield ''. The drop
+  // is on the final strings, so it is applied to whichever `combine` produces
+  // them (the one with no brace set left in the tail).
+  var dropEmpties = false
+  var firstGroup = true
 
-  // The `{a},b}` rewrite below restarts expansion on a rewritten string with
-  // the same `max` and `isTop = true`. Loop instead of recursing so a long run
-  // of non-expanding `{}` groups can't exhaust the call stack.
   for (;;) {
     const m = balanced('{', '}', str)
-    if (!m) return [str]
+
+    // No brace set left: the rest of the string is literal.
+    if (!m) {
+      return combine(acc, str, [''], max, maxLength, dropEmpties)
+    }
 
     // no need to expand pre, since it is guaranteed to be free of brace-sets
     const pre = m.pre
 
-    if (/\$$/.test(m.pre)) {
-      const post =
-        m.post.length ? expand(m.post, max, false) : ['']
-      for (let k = 0; k < post.length && k < max; k++) {
-        const expansion = pre + '{' + m.body + '}' + post[k]
-        expansions.push(expansion)
-      }
-      return expansions
+    if (/\$$/.test(pre)) {
+      acc = combine(
+        acc,
+        pre + '{' + m.body + '}',
+        [''],
+        max,
+        maxLength,
+        dropEmpties && !m.post.length
+      )
+      firstGroup = false
+      if (!m.post.length) break
+      str = m.post
+      continue
     }
 
     var isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body);
@@ -129,89 +259,80 @@ function expand(str, max, isTop) {
         isTop = true;
         continue;
       }
-      return [str];
+      // Nothing here expands, so the whole remaining string is literal.
+      return combine(
+        acc,
+        pre + '{' + m.body + '}' + m.post,
+        [''],
+        max,
+        maxLength,
+        dropEmpties
+      )
+    }
+
+    if (firstGroup) {
+      dropEmpties = isTop && !isSequence
+      firstGroup = false
     }
 
-    // Only expand post once we know this brace set actually expands. Computing
-    // it before the early returns above expanded post a second time on every
-    // non-expanding `{}`, which is what made inputs like `a{},{},{}...` blow up
-    // exponentially.
-    const post =
-      m.post.length ? expand(m.post, max, false) : ['']
-    var n;
+    var values;
     if (isSequence) {
-      n = m.body.split(/\.\./);
+      values = expandSequence(m.body, isAlphaSequence, max, maxLength);
     } else {
-      n = parseCommaParts(m.body);
-      if (n.length === 1) {
+      var n = parseCommaParts(m.body);
+      if (n.length === 1 && n[0] !== undefined) {
         // x{{a,b}}y ==> x{a}y x{b}y
-        n = expand(n[0], max, false).map(embrace);
+        n = expand(n[0], max, maxLength, false).map(embrace);
+        //XXX is this necessary? Can't seem to hit it in tests.
+        /* c8 ignore start */
         if (n.length === 1) {
-          return post.map(function(p) {
-            return m.pre + n[0] + p;
-          });
+          acc = combine(
+            acc,
+            pre + n[0],
+            [''],
+            max,
+            maxLength,
+            dropEmpties && !m.post.length
+          )
+          if (!m.post.length) break
+          str = m.post
+          continue
         }
+        /* c8 ignore stop */
       }
-    }
-
-    // at this point, n is the parts, and we know it's not a comma set
-    // with a single entry.
-    var N;
 
-    if (isSequence) {
-      var x = numeric(n[0]);
-      var y = numeric(n[1]);
-      var width = Math.max(n[0].length, n[1].length)
-      var incr = n.length == 3
-        ? Math.max(Math.abs(numeric(n[2])), 1)
-        : 1;
-      var test = lte;
-      var reverse = y < x;
-      if (reverse) {
-        incr *= -1;
-        test = gte;
-      }
-      var pad = n.some(isPadded);
-
-      N = [];
-
-      for (var i = x; test(i, y) && N.length < max; i += incr) {
-        var c;
-        if (isAlphaSequence) {
-          c = String.fromCharCode(i);
-          if (c === '\\')
-            c = '';
-        } else {
-          c = String(i);
-          if (pad) {
-            var need = width - c.length;
-            if (need > 0) {
-              var z = new Array(need + 1).join('0');
-              if (i < 0)
-                c = '-' + z + c.slice(1);
-              else
-                c = z + c;
-            }
-          }
+      // Values that `combine` is going to drop as empty produce no result, so
+      // they must not count against `max` - otherwise `{a,,b}` with `max: 2`
+      // would stop at `['a', '']` and yield one result instead of two. Skipping
+      // them outright keeps `values` bounded while leaving `max` a bound on
+      // *kept* results.
+      var dropsEmpties = dropEmpties && !m.post.length && !pre
+      for (var d = 0; dropsEmpties && d < acc.length; d++) {
+        if (acc[d]) {
+          dropsEmpties = false
         }
-        N.push(c);
-      }
-    } else {
-      N = [];
-
-      for (var j = 0; j < n.length; j++) {
-        N.push.apply(N, expand(n[j], max, false));
       }
-    }
 
-    for (var j = 0; j < N.length; j++) {
-      for (var k = 0; k < post.length && expansions.length < max; k++) {
-        var expansion = pre + N[j] + post[k];
-        if (!isTop || isSequence || expansion)
-          expansions.push(expansion);
+      values = []
+      var valuesLength = 0
+      outer: for (var j = 0; j < n.length; j++) {
+        var expanded = expand(n[j], max, maxLength, false)
+        for (var k = 0; k < expanded.length; k++) {
+          var v = expanded[k]
+          if (dropsEmpties && !v) continue
+          if (values.length >= max || valuesLength + v.length > maxLength) {
+            break outer
+          }
+          values.push(v)
+          valuesLength += v.length
+        }
       }
     }
 
-    return expansions;
+    acc = combine(acc, pre, values, max, maxLength, dropEmpties && !m.post.length)
+    if (!m.post.length) break
+    str = m.post
   }
+
+  return acc
 }

package/server/node_modules/brace-expansion/package.json

@@ -1,7 +1,7 @@
 {
   "name": "brace-expansion",
   "description": "Brace expansion as known from sh/bash",
-  "version": "2.1.2",
+  "version": "2.1.4",
   "repository": {
     "type": "git",
     "url": "git://github.com/juliangruber/brace-expansion.git"

package/server/node_modules/msgpackr/dist/index-no-eval.cjs

@@ -583,43 +583,49 @@
 				units.push(byte1);
 			} else if ((byte1 & 0xe0) === 0xc0) {
 				// 2 bytes
-				const byte2 = src[position$1++] & 0x3f;
-				const codePoint = ((byte1 & 0x1f) << 6) | byte2;
-				// Reject overlong encoding: 2-byte sequences must encode values >= 0x80
-				if (codePoint < 0x80) {
-					units.push(0xFFFD); // replacement character
+				if (byte1 < 0xc2 || position$1 >= end || (src[position$1] & 0xc0) !== 0x80) {
+					units.push(0xFFFD);
 				} else {
-					units.push(codePoint);
+					const byte2 = src[position$1++] & 0x3f;
+					units.push(((byte1 & 0x1f) << 6) | byte2);
 				}
 			} else if ((byte1 & 0xf0) === 0xe0) {
 				// 3 bytes
-				const byte2 = src[position$1++] & 0x3f;
-				const byte3 = src[position$1++] & 0x3f;
-				const codePoint = ((byte1 & 0x1f) << 12) | (byte2 << 6) | byte3;
-				// Reject overlong encoding: 3-byte sequences must encode values >= 0x800
-				// Also reject surrogates (0xD800-0xDFFF)
-				if (codePoint < 0x800 || (codePoint >= 0xD800 && codePoint <= 0xDFFF)) {
-					units.push(0xFFFD); // replacement character
+				const byte2 = position$1 < end ? src[position$1] : 0;
+				if (position$1 >= end || (byte2 & 0xc0) !== 0x80 ||
+					(byte1 === 0xe0 && byte2 < 0xa0) || (byte1 === 0xed && byte2 >= 0xa0)) {
+					units.push(0xFFFD);
 				} else {
-					units.push(codePoint);
+					position$1++;
+					if (position$1 >= end || (src[position$1] & 0xc0) !== 0x80) {
+						units.push(0xFFFD);
+					} else {
+						const byte3 = src[position$1++] & 0x3f;
+						units.push(((byte1 & 0x1f) << 12) | ((byte2 & 0x3f) << 6) | byte3);
+					}
 				}
 			} else if ((byte1 & 0xf8) === 0xf0) {
 				// 4 bytes
-				const byte2 = src[position$1++] & 0x3f;
-				const byte3 = src[position$1++] & 0x3f;
-				const byte4 = src[position$1++] & 0x3f;
-				let unit = ((byte1 & 0x07) << 0x12) | (byte2 << 0x0c) | (byte3 << 0x06) | byte4;
-				// Reject overlong encoding: 4-byte sequences must encode values >= 0x10000
-				// Also reject values > 0x10FFFF (maximum valid Unicode)
-				if (unit < 0x10000 || unit > 0x10FFFF) {
-					units.push(0xFFFD); // replacement character
-				} else if (unit > 0xffff) {
-					unit -= 0x10000;
-					units.push(((unit >>> 10) & 0x3ff) | 0xd800);
-					unit = 0xdc00 | (unit & 0x3ff);
-					units.push(unit);
+				const byte2 = position$1 < end ? src[position$1] : 0;
+				if (byte1 > 0xf4 || position$1 >= end || (byte2 & 0xc0) !== 0x80 ||
+					(byte1 === 0xf0 && byte2 < 0x90) || (byte1 === 0xf4 && byte2 >= 0x90)) {
+					units.push(0xFFFD);
 				} else {
-					units.push(unit);
+					position$1++;
+					if (position$1 >= end || (src[position$1] & 0xc0) !== 0x80) {
+						units.push(0xFFFD);
+					} else {
+						const byte3 = src[position$1++] & 0x3f;
+						if (position$1 >= end || (src[position$1] & 0xc0) !== 0x80) {
+							units.push(0xFFFD);
+						} else {
+							const byte4 = src[position$1++] & 0x3f;
+							let unit = ((byte1 & 0x07) << 0x12) | ((byte2 & 0x3f) << 0x0c) | (byte3 << 0x06) | byte4;
+							unit -= 0x10000;
+							units.push(((unit >>> 10) & 0x3ff) | 0xd800);
+							units.push(0xdc00 | (unit & 0x3ff));
+						}
+					}
 				}
 			} else {
 				units.push(0xFFFD); // replacement character for invalid lead byte