@psnext/slingcli 2.5.20260728-1 → 2.5.20260731-1

package/node_modules/@smithy/core/dist-cjs/submodules/schema/index.js

@@ -529,9 +529,6 @@ class NormalizedSchema {
         }
         struct[anno.it] = it;
     }
-    structIteratorCbor() {
-        throw new Error("@smithy/core/schema - structIteratorCbor not loaded.");
-    }
 }
 function member(memberSchema, memberName) {
     if (memberSchema instanceof NormalizedSchema) {

package/node_modules/@smithy/core/dist-es/submodules/cbor/CborCodec.js

@@ -1,14 +1,14 @@
 import { SerdeContext } from "@smithy/core/protocols";
-import { CborShapeSerializer } from "./codec-v1/CborShapeSerializer";
-import { CborShapeDeserializer } from "./codec-v1/CborShapeDeserializer";
+import { CborShapeSerializer2 } from "./codec-v2/CborShapeSerializer2";
+import { CborShapeDeserializer2 } from "./codec-v2/CborShapeDeserializer2";
 export class CborCodec extends SerdeContext {
     createSerializer() {
-        const serializer = new CborShapeSerializer();
+        const serializer = new CborShapeSerializer2();
         serializer.setSerdeContext(this.serdeContext);
         return serializer;
     }
     createDeserializer() {
-        const deserializer = new CborShapeDeserializer();
+        const deserializer = new CborShapeDeserializer2();
         deserializer.setSerdeContext(this.serdeContext);
         return deserializer;
     }

package/node_modules/@smithy/core/dist-es/submodules/cbor/cbor-encode.js

@@ -59,7 +59,7 @@ export function encode(_input) {
             ensureSpace(64);
         }
         if (typeof input === "number") {
-            if (Number.isInteger(input)) {
+            if (Number.isInteger(input) && input >= -0x20000000000000 && input <= 0x1fffffffffffff) {
                 const nonNegative = input >= 0;
                 const major = nonNegative ? majorUint64 : majorNegativeInt64;
                 const value = nonNegative ? input : -input - 1;

package/node_modules/@smithy/core/dist-es/submodules/cbor/codec-v1/CborShapeSerializer.js

@@ -76,6 +76,14 @@ export class CborShapeSerializer extends SerdeContext {
                 }
             }
             else if (ns.isDocumentSchema()) {
+                if (Array.isArray(sourceObject)) {
+                    const newArray = [];
+                    let i = 0;
+                    for (const item of sourceObject) {
+                        newArray[i++] = this.serialize(ns.getValueSchema(), item);
+                    }
+                    return newArray;
+                }
                 for (const key in sourceObject) {
                     newObject[key] = this.serialize(ns.getValueSchema(), sourceObject[key]);
                 }

package/node_modules/@smithy/core/dist-es/submodules/cbor/codec-v2/{SinglePassCborShapeDeserializer.js → CborShapeDeserializer2.js}

@@ -2,12 +2,8 @@ import { SerdeContext } from "@smithy/core/protocols";
 import { NormalizedSchema } from "@smithy/core/schema";
 import { NumericValue, _parseEpochTimestamp, nv } from "@smithy/core/serde";
 import { extendedFloat16, extendedFloat32, extendedFloat64, extendedOneByte, majorList, majorMap, majorNegativeInt64, majorSpecial, majorTag, majorUint64, majorUnstructuredByteString, majorUtf8String, minorIndefinite, specialFalse, specialNull, specialTrue, specialUndefined, } from "../cbor-types";
-import { activateCborStructIterator } from "./SinglePassCborShapeSerializer";
-export class SinglePassCborShapeDeserializer extends SerdeContext {
-    constructor() {
-        super();
-        activateCborStructIterator();
-    }
+import { loadCborStructIterator } from "./CborShapeSerializer2";
+export class CborShapeDeserializer2 extends SerdeContext {
     read(schema, bytes) {
         payload = bytes;
         isBuffer = USE_BUFFER && bytes instanceof Buffer;
@@ -74,7 +70,8 @@ function readList(ns) {
 function readMap(ns) {
     const count = decodeCount();
     if (ns.isStructSchema()) {
-        return readStruct(ns, count);
+        const startPos = pos;
+        return readStruct(ns, count, startPos);
     }
     const valueSchema = ns.isMapSchema() ? ns.getValueSchema() : ns;
     const map = {};
@@ -84,15 +81,16 @@ function readMap(ns) {
     }
     return map;
 }
-function readStruct(ns, count) {
+function readStruct(ns, count, startPos) {
     const isUnion = ns.isUnionSchema();
-    const cache = ns.structIteratorCbor();
+    const cache = loadCborStructIterator(ns);
     const { memberSchemas, encodedKeys, memberNames } = cache;
     const z = encodedKeys.length;
     const result = {};
     let unknownKey;
     let unknownValue;
     let unknownCount = 0;
+    let hasType = false;
     let hint = 0;
     for (let i = 0; i < count; ++i) {
         const matchIdx = matchStructKey(encodedKeys, z, hint);
@@ -109,7 +107,10 @@ function readStruct(ns, count) {
         else {
             const key = readUtf8String();
             const val = readValue(NormalizedSchema.of(15));
-            if (key !== "__type") {
+            if (key === "__type" && typeof val === "string") {
+                hasType = true;
+            }
+            else {
                 unknownKey = key;
                 unknownValue = val;
                 ++unknownCount;
@@ -126,6 +127,17 @@ function readStruct(ns, count) {
             result.$unknown = [unknownKey, unknownValue];
         }
     }
+    else if (hasType) {
+        pos = startPos;
+        const docSchema = NormalizedSchema.of(15);
+        for (let i = 0; i < count; ++i) {
+            const key = readUtf8String();
+            const val = readValue(docSchema);
+            if (!(key in result)) {
+                result[key] = val;
+            }
+        }
+    }
     return result;
 }
 function readTag(ns) {
@@ -245,7 +257,7 @@ function readListIndefinite(ns) {
 function readMapIndefinite(ns) {
     pos += 1;
     if (ns.isStructSchema()) {
-        const cache = ns.structIteratorCbor();
+        const cache = loadCborStructIterator(ns);
         const { memberSchemas, encodedKeys, memberNames } = cache;
         const z = encodedKeys.length;
         const isUnion = ns.isUnionSchema();

package/node_modules/@smithy/core/dist-es/submodules/cbor/codec-v2/{SinglePassCborShapeSerializer.js → CborShapeSerializer2.js}

@@ -2,11 +2,7 @@ import { SerdeContext } from "@smithy/core/protocols";
 import { NormalizedSchema } from "@smithy/core/schema";
 import { NumericValue, fromBase64, generateIdempotencyToken } from "@smithy/core/serde";
 import { extendedFloat16, extendedFloat32, extendedFloat64, majorList, majorMap, majorNegativeInt64, majorSpecial, majorTag, majorUint64, majorUnstructuredByteString, majorUtf8String, specialFalse, specialNull, specialTrue, tagSymbol, } from "../cbor-types";
-export class SinglePassCborShapeSerializer extends SerdeContext {
-    constructor() {
-        super();
-        activateCborStructIterator();
-    }
+export class CborShapeSerializer2 extends SerdeContext {
     write(schema, value) {
         cursor = 0;
         const ns = NormalizedSchema.of(schema);
@@ -24,13 +20,8 @@ export function advanceSinglePassEncodingEpoch() {
     encodeCacheEpoch = (encodeCacheEpoch + 1) & 0xffff;
     encodeCacheSaturated = false;
 }
-export function activateCborStructIterator() {
-    NormalizedSchema.prototype.structIteratorCbor = function () {
-        return loadCborStructIterator(this);
-    };
-}
 const CBOR_STRUCT_CACHE = Symbol.for("@smithy/cbor-struct-cache");
-function loadCborStructIterator(ns) {
+export function loadCborStructIterator(ns) {
     const schema = ns.getSchema();
     const existing = schema[CBOR_STRUCT_CACHE];
     if (existing) {
@@ -104,15 +95,15 @@ function writeValue(ns, value, container, serdeContext) {
             writeString(generateIdempotencyToken());
             return;
         }
-        if (value === undefined) {
-            ensure(1);
-            buf[cursor++] = (majorSpecial << 5) | specialNull;
-            return;
-        }
         ensure(1);
         buf[cursor++] = (majorSpecial << 5) | specialNull;
         return;
     }
+    if (ns.isUnitSchema()) {
+        ensure(1);
+        encodeHeader(majorMap, 0);
+        return;
+    }
     const isObject = typeof value === "object";
     if (isObject) {
         if (ns.isBlobSchema()) {
@@ -231,7 +222,7 @@ function writeStruct(ns, value, serdeContext) {
         }
         return;
     }
-    const cache = ns.structIteratorCbor();
+    const cache = loadCborStructIterator(ns);
     const { memberNames, memberSchemas, encodedKeys } = cache;
     const z = memberNames.length;
     let headerSize;

package/node_modules/@smithy/core/dist-es/submodules/cbor/index.js

@@ -5,3 +5,5 @@ export { SmithyRpcV2CborProtocol } from "./SmithyRpcV2CborProtocol";
 export { CborCodec } from "./CborCodec";
 export { CborShapeSerializer } from "./codec-v1/CborShapeSerializer";
 export { CborShapeDeserializer } from "./codec-v1/CborShapeDeserializer";
+export { CborShapeSerializer2 } from "./codec-v2/CborShapeSerializer2";
+export { CborShapeDeserializer2 } from "./codec-v2/CborShapeDeserializer2";

package/node_modules/@smithy/core/dist-es/submodules/schema/schemas/NormalizedSchema.js

@@ -288,9 +288,6 @@ export class NormalizedSchema {
         }
         struct[anno.it] = it;
     }
-    structIteratorCbor() {
-        throw new Error("@smithy/core/schema - structIteratorCbor not loaded.");
-    }
 }
 function member(memberSchema, memberName) {
     if (memberSchema instanceof NormalizedSchema) {

package/node_modules/@smithy/core/dist-types/submodules/cbor/CborCodec.d.ts

@@ -1,11 +1,11 @@
 import { SerdeContext } from "@smithy/core/protocols";
 import type { Codec } from "@smithy/types";
-import { CborShapeSerializer } from "./codec-v1/CborShapeSerializer";
-import { CborShapeDeserializer } from "./codec-v1/CborShapeDeserializer";
+import { CborShapeSerializer2 } from "./codec-v2/CborShapeSerializer2";
+import { CborShapeDeserializer2 } from "./codec-v2/CborShapeDeserializer2";
 /**
  * @public
  */
 export declare class CborCodec extends SerdeContext implements Codec<Uint8Array, Uint8Array> {
-    createSerializer(): CborShapeSerializer;
-    createDeserializer(): CborShapeDeserializer;
+    createSerializer(): CborShapeSerializer2;
+    createDeserializer(): CborShapeDeserializer2;
 }

package/node_modules/@smithy/core/dist-types/submodules/cbor/SmithyRpcV2CborProtocol.d.ts

@@ -13,8 +13,8 @@ export declare class SmithyRpcV2CborProtocol extends RpcProtocol {
      */
     protected compositeErrorRegistry: TypeRegistry;
     private codec;
-    protected serializer: import(".").CborShapeSerializer;
-    protected deserializer: import(".").CborShapeDeserializer;
+    protected serializer: import(".").CborShapeSerializer2;
+    protected deserializer: import(".").CborShapeDeserializer2;
     constructor({ defaultNamespace, errorTypeRegistries, }: {
         defaultNamespace: string;
         errorTypeRegistries?: TypeRegistry[];

package/node_modules/@smithy/core/dist-types/submodules/cbor/codec-v2/{SinglePassCborShapeDeserializer.d.ts → CborShapeDeserializer2.d.ts}

@@ -6,8 +6,7 @@ import type { Schema, ShapeDeserializer } from "@smithy/types";
  *
  * @internal
  */
-export declare class SinglePassCborShapeDeserializer extends SerdeContext implements ShapeDeserializer<Uint8Array> {
-    constructor();
+export declare class CborShapeDeserializer2 extends SerdeContext implements ShapeDeserializer<Uint8Array> {
     read(schema: Schema, bytes: Uint8Array): any;
     /**
      * Deserialize a pre-decoded JS object per schema.

package/node_modules/@smithy/core/dist-types/submodules/cbor/codec-v2/CborShapeSerializer2.d.ts

@@ -0,0 +1,35 @@
+import { SerdeContext } from "@smithy/core/protocols";
+import { NormalizedSchema } from "@smithy/core/schema";
+import type { Schema, ShapeSerializer } from "@smithy/types";
+/**
+ * Single-pass CBOR serializer that walks the Smithy schema and writes CBOR bytes
+ * directly to a module-level buffer in one traversal. Eliminates the intermediate
+ * JS object tree that the multi-pass CborShapeSerializer builds.
+ *
+ * @internal
+ */
+export declare class CborShapeSerializer2 extends SerdeContext implements ShapeSerializer<Uint8Array> {
+    write(schema: Schema, value: unknown): void;
+    flush(): Uint8Array;
+}
+/**
+ * Advance the encoding epoch. Call between serialization batches
+ * to allow stale cache entries to be evicted.
+ *
+ * @internal
+ */
+export declare function advanceSinglePassEncodingEpoch(): void;
+/**
+ * Cached CBOR struct iteration data: parallel arrays for direct indexed access.
+ */
+export interface CborStructCache {
+    memberNames: string[];
+    memberSchemas: NormalizedSchema[];
+    encodedKeys: Uint8Array[];
+}
+/**
+ * Builds or retrieves the CBOR-specific struct cache for a given NormalizedSchema.
+ * On first call, iterates structIterator() to populate NormalizedSchema's own cache,
+ * then builds pre-encoded CBOR key bytes for each member.
+ */
+export declare function loadCborStructIterator(ns: NormalizedSchema): CborStructCache;

package/node_modules/@smithy/core/dist-types/submodules/cbor/index.d.ts

@@ -5,3 +5,5 @@ export { SmithyRpcV2CborProtocol } from "./SmithyRpcV2CborProtocol";
 export { CborCodec } from "./CborCodec";
 export { CborShapeSerializer } from "./codec-v1/CborShapeSerializer";
 export { CborShapeDeserializer } from "./codec-v1/CborShapeDeserializer";
+export { CborShapeSerializer2 } from "./codec-v2/CborShapeSerializer2";
+export { CborShapeDeserializer2 } from "./codec-v2/CborShapeDeserializer2";

package/node_modules/@smithy/core/dist-types/submodules/schema/schemas/NormalizedSchema.d.ts

@@ -136,18 +136,6 @@ export declare class NormalizedSchema implements INormalizedSchema {
      * This avoids the overhead of calling Object.entries(ns.getMemberSchemas()).
      */
     structIterator(): Generator<[string, NormalizedSchema], undefined, undefined>;
-    /**
-     * CBOR-optimized struct iteration. Returns a cache of parallel arrays
-     * (memberNames, memberSchemas, encodedKeys) for direct indexed iteration.
-     * Implementation is patched by the cbor submodule on load.
-     *
-     * @internal
-     */
-    structIteratorCbor(): {
-        memberNames: string[];
-        memberSchemas: NormalizedSchema[];
-        encodedKeys: Uint8Array[];
-    };
 }
 /**
  * @internal

package/node_modules/@smithy/core/dist-types/ts3.4/submodules/cbor/CborCodec.d.ts

@@ -1,11 +1,11 @@
 import { SerdeContext } from "@smithy/core/protocols";
 import { Codec } from "@smithy/types";
-import { CborShapeSerializer } from "./codec-v1/CborShapeSerializer";
-import { CborShapeDeserializer } from "./codec-v1/CborShapeDeserializer";
+import { CborShapeSerializer2 } from "./codec-v2/CborShapeSerializer2";
+import { CborShapeDeserializer2 } from "./codec-v2/CborShapeDeserializer2";
 /**
  * @public
  */
 export declare class CborCodec extends SerdeContext implements Codec<Uint8Array, Uint8Array> {
-    createSerializer(): CborShapeSerializer;
-    createDeserializer(): CborShapeDeserializer;
+    createSerializer(): CborShapeSerializer2;
+    createDeserializer(): CborShapeDeserializer2;
 }

package/node_modules/@smithy/core/dist-types/ts3.4/submodules/cbor/SmithyRpcV2CborProtocol.d.ts

@@ -13,8 +13,8 @@ export declare class SmithyRpcV2CborProtocol extends RpcProtocol {
      */
     protected compositeErrorRegistry: TypeRegistry;
     private codec;
-    protected serializer: import(".").CborShapeSerializer;
-    protected deserializer: import(".").CborShapeDeserializer;
+    protected serializer: import(".").CborShapeSerializer2;
+    protected deserializer: import(".").CborShapeDeserializer2;
     constructor({ defaultNamespace, errorTypeRegistries, }: {
         defaultNamespace: string;
         errorTypeRegistries?: TypeRegistry[];

package/node_modules/@smithy/core/dist-types/ts3.4/submodules/cbor/codec-v2/{SinglePassCborShapeDeserializer.d.ts → CborShapeDeserializer2.d.ts}

@@ -6,8 +6,7 @@ import { Schema, ShapeDeserializer } from "@smithy/types";
  *
  * @internal
  */
-export declare class SinglePassCborShapeDeserializer extends SerdeContext implements ShapeDeserializer<Uint8Array> {
-    constructor();
+export declare class CborShapeDeserializer2 extends SerdeContext implements ShapeDeserializer<Uint8Array> {
     read(schema: Schema, bytes: Uint8Array): any;
     /**
      * Deserialize a pre-decoded JS object per schema.

package/node_modules/@smithy/core/dist-types/ts3.4/submodules/cbor/codec-v2/CborShapeSerializer2.d.ts

@@ -0,0 +1,35 @@
+import { SerdeContext } from "@smithy/core/protocols";
+import { NormalizedSchema } from "@smithy/core/schema";
+import { Schema, ShapeSerializer } from "@smithy/types";
+/**
+ * Single-pass CBOR serializer that walks the Smithy schema and writes CBOR bytes
+ * directly to a module-level buffer in one traversal. Eliminates the intermediate
+ * JS object tree that the multi-pass CborShapeSerializer builds.
+ *
+ * @internal
+ */
+export declare class CborShapeSerializer2 extends SerdeContext implements ShapeSerializer<Uint8Array> {
+    write(schema: Schema, value: unknown): void;
+    flush(): Uint8Array;
+}
+/**
+ * Advance the encoding epoch. Call between serialization batches
+ * to allow stale cache entries to be evicted.
+ *
+ * @internal
+ */
+export declare function advanceSinglePassEncodingEpoch(): void;
+/**
+ * Cached CBOR struct iteration data: parallel arrays for direct indexed access.
+ */
+export interface CborStructCache {
+    memberNames: string[];
+    memberSchemas: NormalizedSchema[];
+    encodedKeys: Uint8Array[];
+}
+/**
+ * Builds or retrieves the CBOR-specific struct cache for a given NormalizedSchema.
+ * On first call, iterates structIterator() to populate NormalizedSchema's own cache,
+ * then builds pre-encoded CBOR key bytes for each member.
+ */
+export declare function loadCborStructIterator(ns: NormalizedSchema): CborStructCache;

package/node_modules/@smithy/core/dist-types/ts3.4/submodules/cbor/index.d.ts

@@ -5,3 +5,5 @@ export { SmithyRpcV2CborProtocol } from "./SmithyRpcV2CborProtocol";
 export { CborCodec } from "./CborCodec";
 export { CborShapeSerializer } from "./codec-v1/CborShapeSerializer";
 export { CborShapeDeserializer } from "./codec-v1/CborShapeDeserializer";
+export { CborShapeSerializer2 } from "./codec-v2/CborShapeSerializer2";
+export { CborShapeDeserializer2 } from "./codec-v2/CborShapeDeserializer2";

package/node_modules/@smithy/core/dist-types/ts3.4/submodules/schema/schemas/NormalizedSchema.d.ts

@@ -139,18 +139,6 @@ export declare class NormalizedSchema implements INormalizedSchema {
         string,
         NormalizedSchema
     ], undefined, undefined>;
-    /**
-     * CBOR-optimized struct iteration. Returns a cache of parallel arrays
-     * (memberNames, memberSchemas, encodedKeys) for direct indexed iteration.
-     * Implementation is patched by the cbor submodule on load.
-     *
-     * @internal
-     */
-    structIteratorCbor(): {
-        memberNames: string[];
-        memberSchemas: NormalizedSchema[];
-        encodedKeys: Uint8Array[];
-    };
 }
 /**
  * @internal

package/node_modules/@smithy/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smithy/core",
-  "version": "3.31.0",
+  "version": "3.31.1",
   "homepage": "https://github.com/smithy-lang/smithy-typescript/tree/main/packages/core",
   "license": "Apache-2.0",
   "author": {

package/node_modules/@smithy/credential-provider-imds/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smithy/credential-provider-imds",
-  "version": "4.4.15",
+  "version": "4.4.16",
   "description": "AWS credential provider that sources credentials from the EC2 instance metadata service and ECS container metadata service",
   "keywords": [
     "aws",
@@ -45,7 +45,7 @@
     "test:watch": "yarn g:vitest watch"
   },
   "dependencies": {
-    "@smithy/core": "^3.31.0",
+    "@smithy/core": "^3.31.1",
     "@smithy/types": "^4.16.1",
     "tslib": "^2.6.2"
   },

package/node_modules/@smithy/fetch-http-handler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smithy/fetch-http-handler",
-  "version": "5.6.12",
+  "version": "5.6.13",
   "description": "Provides a way to make requests",
   "homepage": "https://github.com/smithy-lang/smithy-typescript/tree/main/packages/fetch-http-handler",
   "license": "Apache-2.0",
@@ -44,7 +44,7 @@
     "test:browser:watch": "yarn g:vitest watch -c vitest.config.browser.mts"
   },
   "dependencies": {
-    "@smithy/core": "^3.31.0",
+    "@smithy/core": "^3.31.1",
     "@smithy/types": "^4.16.1",
     "tslib": "^2.6.2"
   },

package/node_modules/@smithy/signature-v4/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smithy/signature-v4",
-  "version": "5.6.11",
+  "version": "5.6.12",
   "description": "A standalone implementation of the AWS Signature V4 request signing algorithm",
   "homepage": "https://github.com/smithy-lang/smithy-typescript/tree/main/packages/signature-v4",
   "license": "Apache-2.0",
@@ -42,7 +42,7 @@
     "test:watch": "yarn g:vitest watch"
   },
   "dependencies": {
-    "@smithy/core": "^3.31.0",
+    "@smithy/core": "^3.31.1",
     "@smithy/types": "^4.16.1",
     "tslib": "^2.6.2"
   },

package/node_modules/brace-expansion/README.md

@@ -71,9 +71,8 @@ result count stays under `max` while each result grows very long.
 
 ```js
 const expansions = expand('{a,b}'.repeat(1500), {
-  maxLength: 100,
+  maxLength: 10_000,
 })
-// the combined length of expansions will not exceed 100 characters
 ```
 
 Valid expansions are:

package/node_modules/brace-expansion/dist/commonjs/index.js

@@ -130,7 +130,7 @@ function combine(acc, pre, values, max, maxLength, dropEmpties) {
 }
 // The expansion values of a single numeric (`1..5`) or alphabetic (`a..e..2`)
 // sequence body.
-function expandSequence(body, isAlphaSequence, max) {
+function expandSequence(body, isAlphaSequence, max, maxLength) {
     const n = body.split(/\.\./);
     const N = [];
     // A sequence body always splits into two or three parts, but the compiler
@@ -153,6 +153,7 @@ function expandSequence(body, isAlphaSequence, max) {
         test = gte;
     }
     const pad = n.some(isPadded);
+    let length = 0;
     for (let i = x; test(i, y) && N.length < max; i += incr) {
         let c;
         if (isAlphaSequence) {
@@ -176,7 +177,10 @@ function expandSequence(body, isAlphaSequence, max) {
                 }
             }
         }
+        if (length + c.length > maxLength)
+            break;
         N.push(c);
+        length += c.length;
     }
     return N;
 }
@@ -230,7 +234,7 @@ function expand_(str, max, maxLength, isTop) {
         }
         let values;
         if (isSequence) {
-            values = expandSequence(m.body, isAlphaSequence, max);
+            values = expandSequence(m.body, isAlphaSequence, max, maxLength);
         }
         else {
             let n = parseCommaParts(m.body);
@@ -248,9 +252,31 @@ function expand_(str, max, maxLength, isTop) {
                 }
                 /* c8 ignore stop */
             }
+            // Values that `combine` is going to drop as empty produce no result, so
+            // they must not count against `max` - otherwise `{a,,b}` with `max: 2`
+            // would stop at `['a', '']` and yield one result instead of two. Skipping
+            // them outright keeps `values` bounded while leaving `max` a bound on
+            // *kept* results.
+            let dropsEmpties = dropEmpties && !m.post.length && !pre;
+            for (let d = 0; dropsEmpties && d < acc.length; d++) {
+                if (acc[d]) {
+                    dropsEmpties = false;
+                }
+            }
             values = [];
-            for (let j = 0; j < n.length; j++) {
-                values.push.apply(values, expand_(n[j], max, maxLength, false));
+            let valuesLength = 0;
+            outer: for (let j = 0; j < n.length; j++) {
+                const expanded = expand_(n[j], max, maxLength, false);
+                for (let k = 0; k < expanded.length; k++) {
+                    const v = expanded[k];
+                    if (dropsEmpties && !v)
+                        continue;
+                    if (values.length >= max || valuesLength + v.length > maxLength) {
+                        break outer;
+                    }
+                    values.push(v);
+                    valuesLength += v.length;
+                }
             }
         }
         acc = combine(acc, pre, values, max, maxLength, dropEmpties && !m.post.length);