@psnext/slingcli 3.3.20260911-1 → 3.3.20260915-1

package/node_modules/@types/node/zlib/iter.d.ts

@@ -0,0 +1,131 @@
+declare module "node:zlib/iter" {
+    import { StatefulTransform, SyncStatefulTransform } from "node:stream/iter";
+    interface BrotliOptions {
+        chunkSize?: number | undefined;
+        params?: { [key: number]: number | boolean } | undefined;
+        dictionary?: NodeJS.ArrayBufferView | undefined;
+    }
+    interface ZlibOptions {
+        chunkSize?: number | undefined;
+        windowBits?: number | undefined;
+        dictionary?: NodeJS.ArrayBufferView | undefined;
+    }
+    interface ZlibCompressionOptions extends ZlibOptions {
+        level?: number | undefined;
+        memLevel?: number | undefined;
+        strategy?: number | undefined;
+    }
+    interface ZstdOptions {
+        chunkSize?: number | undefined;
+        params?: { [key: number]: number | boolean } | undefined;
+        dictionary?: NodeJS.ArrayBufferView | undefined;
+    }
+    interface ZstdCompressionOptions extends ZstdOptions {
+        pledgedSrcSize?: number | undefined;
+    }
+    /**
+     * Create a Brotli compression transform. Output is compatible with
+     * `zlib.brotliDecompress()` and `decompressBrotli()`/`decompressBrotliSync()`.
+     * @since v25.9.0
+     * @returns A stateful transform.
+     */
+    function compressBrotli(options?: BrotliOptions): StatefulTransform;
+    /**
+     * Create a Brotli compression transform. Output is compatible with
+     * `zlib.brotliDecompress()` and `decompressBrotli()`/`decompressBrotliSync()`.
+     * @since v25.9.0
+     * @returns A stateful transform.
+     */
+    function compressBrotliSync(options?: BrotliOptions): SyncStatefulTransform;
+    /**
+     * Create a deflate compression transform. Output is compatible with
+     * `zlib.inflate()` and `decompressDeflate()`/`decompressDeflateSync()`.
+     * @since v25.9.0
+     * @returns A stateful transform.
+     */
+    function compressDeflate(options?: ZlibCompressionOptions): StatefulTransform;
+    /**
+     * Create a deflate compression transform. Output is compatible with
+     * `zlib.inflate()` and `decompressDeflate()`/`decompressDeflateSync()`.
+     * @since v25.9.0
+     * @returns A stateful transform.
+     */
+    function compressDeflateSync(options?: ZlibCompressionOptions): SyncStatefulTransform;
+    /**
+     * Create a gzip compression transform. Output is compatible with `zlib.gunzip()`
+     * and `decompressGzip()`/`decompressGzipSync()`.
+     * @returns A stateful transform.
+     */
+    function compressGzip(options?: ZlibCompressionOptions): StatefulTransform;
+    /**
+     * Create a gzip compression transform. Output is compatible with `zlib.gunzip()`
+     * and `decompressGzip()`/`decompressGzipSync()`.
+     * @returns A stateful transform.
+     */
+    function compressGzipSync(options?: ZlibCompressionOptions): SyncStatefulTransform;
+    /**
+     * Create a Zstandard compression transform. Output is compatible with
+     * `zlib.zstdDecompress()` and `decompressZstd()`/`decompressZstdSync()`.
+     * @since v25.9.0
+     * @returns A stateful transform.
+     */
+    function compressZstd(options?: ZstdCompressionOptions): StatefulTransform;
+    /**
+     * Create a Zstandard compression transform. Output is compatible with
+     * `zlib.zstdDecompress()` and `decompressZstd()`/`decompressZstdSync()`.
+     * @since v25.9.0
+     * @returns A stateful transform.
+     */
+    function compressZstdSync(options?: ZstdCompressionOptions): SyncStatefulTransform;
+    /**
+     * Create a Brotli decompression transform.
+     * @since v25.9.0
+     * @returns A stateful transform.
+     */
+    function decompressBrotli(options?: BrotliOptions): StatefulTransform;
+    /**
+     * Create a Brotli decompression transform.
+     * @since v25.9.0
+     * @returns A stateful transform.
+     */
+    function decompressBrotliSync(options?: BrotliOptions): SyncStatefulTransform;
+    /**
+     * Create a deflate decompression transform.
+     * @since v25.9.0
+     * @returns A stateful transform.
+     */
+    function decompressDeflate(options?: ZlibOptions): StatefulTransform;
+    /**
+     * Create a deflate decompression transform.
+     * @since v25.9.0
+     * @returns A stateful transform.
+     */
+    function decompressDeflateSync(options?: ZlibOptions): SyncStatefulTransform;
+    /**
+     * Create a gzip decompression transform.
+     * @since v25.9.0
+     * @returns A stateful transform.
+     */
+    function decompressGzip(options?: ZlibOptions): StatefulTransform;
+    /**
+     * Create a gzip decompression transform.
+     * @since v25.9.0
+     * @returns A stateful transform.
+     */
+    function decompressGzipSync(options?: ZlibOptions): SyncStatefulTransform;
+    /**
+     * Create a Zstandard decompression transform.
+     * @since v25.9.0
+     * @returns A stateful transform.
+     */
+    function decompressZstd(options?: ZstdOptions): StatefulTransform;
+    /**
+     * Create a Zstandard decompression transform.
+     * @since v25.9.0
+     * @returns A stateful transform.
+     */
+    function decompressZstdSync(options?: ZstdOptions): SyncStatefulTransform;
+}
+declare module "zlib/iter" {
+    export * from "node:zlib/iter";
+}

package/node_modules/@types/node/zlib.d.ts

@@ -1,97 +1,4 @@
-/**
- * The `node:zlib` module provides compression functionality implemented using
- * Gzip, Deflate/Inflate, and Brotli.
- *
- * To access it:
- *
- * ```js
- * import zlib from 'node:zlib';
- * ```
- *
- * Compression and decompression are built around the Node.js
- * [Streams API](https://nodejs.org/docs/latest-v22.x/api/stream.html).
- *
- * Compressing or decompressing a stream (such as a file) can be accomplished by
- * piping the source stream through a `zlib` `Transform` stream into a destination
- * stream:
- *
- * ```js
- * import { createGzip } from 'node:zlib';
- * import { pipeline } from 'node:stream';
- * import {
- *   createReadStream,
- *   createWriteStream,
- * } from 'node:fs';
- *
- * const gzip = createGzip();
- * const source = createReadStream('input.txt');
- * const destination = createWriteStream('input.txt.gz');
- *
- * pipeline(source, gzip, destination, (err) => {
- *   if (err) {
- *     console.error('An error occurred:', err);
- *     process.exitCode = 1;
- *   }
- * });
- *
- * // Or, Promisified
- *
- * import { promisify } from 'node:util';
- * const pipe = promisify(pipeline);
- *
- * async function do_gzip(input, output) {
- *   const gzip = createGzip();
- *   const source = createReadStream(input);
- *   const destination = createWriteStream(output);
- *   await pipe(source, gzip, destination);
- * }
- *
- * do_gzip('input.txt', 'input.txt.gz')
- *   .catch((err) => {
- *     console.error('An error occurred:', err);
- *     process.exitCode = 1;
- *   });
- * ```
- *
- * It is also possible to compress or decompress data in a single step:
- *
- * ```js
- * import { deflate, unzip } from 'node:zlib';
- *
- * const input = '.................................';
- * deflate(input, (err, buffer) => {
- *   if (err) {
- *     console.error('An error occurred:', err);
- *     process.exitCode = 1;
- *   }
- *   console.log(buffer.toString('base64'));
- * });
- *
- * const buffer = Buffer.from('eJzT0yMAAGTvBe8=', 'base64');
- * unzip(buffer, (err, buffer) => {
- *   if (err) {
- *     console.error('An error occurred:', err);
- *     process.exitCode = 1;
- *   }
- *   console.log(buffer.toString());
- * });
- *
- * // Or, Promisified
- *
- * import { promisify } from 'node:util';
- * const do_unzip = promisify(unzip);
- *
- * do_unzip(buffer)
- *   .then((buf) => console.log(buf.toString()))
- *   .catch((err) => {
- *     console.error('An error occurred:', err);
- *     process.exitCode = 1;
- *   });
- * ```
- * @since v0.5.8
- * @see [source](https://github.com/nodejs/node/blob/v22.x/lib/zlib.js)
- */
-declare module "zlib" {
+declare module "node:zlib" {
     import { NonSharedBuffer } from "node:buffer";
     import * as stream from "node:stream";
     interface ZlibOptions {
@@ -125,6 +32,13 @@ declare module "zlib" {
          * @default buffer.kMaxLength
          */
         maxOutputLength?: number | undefined;
+        /**
+         * If `true`, decompression fails when
+         * trailing input is detected after the end of the compressed stream. This
+         * includes unreadable bytes and, when decompressing gzip, additional gzip
+         * members following the first member. **Default:** `false`
+         */
+        rejectGarbageAfterEnd?: boolean | undefined;
     }
     interface BrotliOptions {
         /**
@@ -148,7 +62,7 @@ declare module "zlib" {
             }
             | undefined;
         /**
-         * Limits output size when using [convenience methods](https://nodejs.org/docs/latest-v22.x/api/zlib.html#convenience-methods).
+         * Limits output size when using [convenience methods](https://nodejs.org/docs/latest-v26.x/api/zlib.html#convenience-methods).
          * @default buffer.kMaxLength
          */
         maxOutputLength?: number | undefined;
@@ -156,6 +70,11 @@ declare module "zlib" {
          * If `true`, returns an object with `buffer` and `engine`.
          */
         info?: boolean | undefined;
+        /**
+         * If `true`, decompression fails when
+         * input remains after the first complete compressed stream. **Default:** `false`
+         */
+        rejectGarbageAfterEnd?: boolean | undefined;
     }
     interface ZstdOptions {
         /**
@@ -172,12 +91,12 @@ declare module "zlib" {
         chunkSize?: number | undefined;
         /**
          * Key-value object containing indexed
-         * [Zstd parameters](https://nodejs.org/docs/latest-v22.x/api/zlib.html#zstd-constants).
+         * [Zstd parameters](https://nodejs.org/docs/latest-v26.x/api/zlib.html#zstd-constants).
          */
         params?: { [key: number]: number | boolean } | undefined;
         /**
          * Limits output size when using
-         * [convenience methods](https://nodejs.org/docs/latest-v22.x/api/zlib.html#convenience-methods).
+         * [convenience methods](https://nodejs.org/docs/latest-v26.x/api/zlib.html#convenience-methods).
          * @default buffer.kMaxLength
          */
         maxOutputLength?: number | undefined;
@@ -188,13 +107,16 @@ declare module "zlib" {
         /**
          * Optional dictionary used to improve compression efficiency when compressing or decompressing data that
          * shares common patterns with the dictionary.
-         * @since v22.19.0
+         * @since v24.6.0
          */
         dictionary?: NodeJS.ArrayBufferView | undefined;
+        /**
+         * If `true`, decompression fails when
+         * input remains after the first complete compressed stream. **Default:** `false`
+         */
+        rejectGarbageAfterEnd?: boolean | undefined;
     }
     interface Zlib {
-        /** @deprecated Use bytesWritten instead. */
-        readonly bytesRead: number;
         readonly bytesWritten: number;
         shell?: boolean | string | undefined;
         close(callback?: () => void): void;
@@ -678,70 +600,7 @@ declare module "zlib" {
         const Z_SYNC_FLUSH: number;
         const Z_VERSION_ERROR: number;
     }
-    // Allowed flush values.
-    /** @deprecated Use `constants.Z_NO_FLUSH` */
-    const Z_NO_FLUSH: number;
-    /** @deprecated Use `constants.Z_PARTIAL_FLUSH` */
-    const Z_PARTIAL_FLUSH: number;
-    /** @deprecated Use `constants.Z_SYNC_FLUSH` */
-    const Z_SYNC_FLUSH: number;
-    /** @deprecated Use `constants.Z_FULL_FLUSH` */
-    const Z_FULL_FLUSH: number;
-    /** @deprecated Use `constants.Z_FINISH` */
-    const Z_FINISH: number;
-    /** @deprecated Use `constants.Z_BLOCK` */
-    const Z_BLOCK: number;
-    // Return codes for the compression/decompression functions.
-    // Negative values are errors, positive values are used for special but normal events.
-    /** @deprecated Use `constants.Z_OK` */
-    const Z_OK: number;
-    /** @deprecated Use `constants.Z_STREAM_END` */
-    const Z_STREAM_END: number;
-    /** @deprecated Use `constants.Z_NEED_DICT` */
-    const Z_NEED_DICT: number;
-    /** @deprecated Use `constants.Z_ERRNO` */
-    const Z_ERRNO: number;
-    /** @deprecated Use `constants.Z_STREAM_ERROR` */
-    const Z_STREAM_ERROR: number;
-    /** @deprecated Use `constants.Z_DATA_ERROR` */
-    const Z_DATA_ERROR: number;
-    /** @deprecated Use `constants.Z_MEM_ERROR` */
-    const Z_MEM_ERROR: number;
-    /** @deprecated Use `constants.Z_BUF_ERROR` */
-    const Z_BUF_ERROR: number;
-    /** @deprecated Use `constants.Z_VERSION_ERROR` */
-    const Z_VERSION_ERROR: number;
-    // Compression levels.
-    /** @deprecated Use `constants.Z_NO_COMPRESSION` */
-    const Z_NO_COMPRESSION: number;
-    /** @deprecated Use `constants.Z_BEST_SPEED` */
-    const Z_BEST_SPEED: number;
-    /** @deprecated Use `constants.Z_BEST_COMPRESSION` */
-    const Z_BEST_COMPRESSION: number;
-    /** @deprecated Use `constants.Z_DEFAULT_COMPRESSION` */
-    const Z_DEFAULT_COMPRESSION: number;
-    // Compression strategy.
-    /** @deprecated Use `constants.Z_FILTERED` */
-    const Z_FILTERED: number;
-    /** @deprecated Use `constants.Z_HUFFMAN_ONLY` */
-    const Z_HUFFMAN_ONLY: number;
-    /** @deprecated Use `constants.Z_RLE` */
-    const Z_RLE: number;
-    /** @deprecated Use `constants.Z_FIXED` */
-    const Z_FIXED: number;
-    /** @deprecated Use `constants.Z_DEFAULT_STRATEGY` */
-    const Z_DEFAULT_STRATEGY: number;
-    /** @deprecated */
-    const Z_BINARY: number;
-    /** @deprecated */
-    const Z_TEXT: number;
-    /** @deprecated */
-    const Z_ASCII: number;
-    /** @deprecated  */
-    const Z_UNKNOWN: number;
-    /** @deprecated */
-    const Z_DEFLATED: number;
 }
-declare module "node:zlib" {
-    export * from "zlib";
+declare module "zlib" {
+    export * from "node:zlib";
 }

package/node_modules/brace-expansion/dist/commonjs/index.d.ts

@@ -1,8 +1,12 @@
 export declare const EXPANSION_MAX = 100000;
 export declare const EXPANSION_MAX_LENGTH = 4000000;
+export declare const EXPANSION_MAX_DEPTH = 1000;
+export declare const EXPANSION_MAX_REWRITES = 1000;
 export type BraceExpansionOptions = {
     max?: number;
     maxLength?: number;
+    maxDepth?: number;
+    maxRewrites?: number;
 };
 export declare function expand(str: string, options?: BraceExpansionOptions): string[];
 //# sourceMappingURL=index.d.ts.map

package/node_modules/brace-expansion/dist/commonjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,aAAa,SAAU,CAAA;AAYpC,eAAO,MAAM,oBAAoB,UAAY,CAAA;AAwD7C,MAAM,MAAM,qBAAqB,GAAG;IAClC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,YAkBtE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,aAAa,SAAU,CAAA;AAYpC,eAAO,MAAM,oBAAoB,UAAY,CAAA;AAU7C,eAAO,MAAM,mBAAmB,OAAQ,CAAA;AAUxC,eAAO,MAAM,sBAAsB,OAAQ,CAAA;AAyE3C,MAAM,MAAM,qBAAqB,GAAG;IAClC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,YA+BtE"}

package/node_modules/brace-expansion/dist/commonjs/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EXPANSION_MAX_LENGTH = exports.EXPANSION_MAX = void 0;
+exports.EXPANSION_MAX_REWRITES = exports.EXPANSION_MAX_DEPTH = exports.EXPANSION_MAX_LENGTH = exports.EXPANSION_MAX = void 0;
 exports.expand = expand;
 const balanced_match_1 = require("balanced-match");
 const escSlash = '\0SLASH' + Math.random() + '\0';
@@ -30,6 +30,24 @@ exports.EXPANSION_MAX = 100_000;
 // realistic expansion (100k results hitting `EXPANSION_MAX` measure ~1M
 // characters) so legitimate input is unaffected.
 exports.EXPANSION_MAX_LENGTH = 4_000_000;
+// `expand_` recurses once per level of brace *nesting* - both when expanding a
+// set's comma members and when re-wrapping a set whose body is a single part.
+// The CVE-2026-14257 fix made the *tail* iterative (recursion on `m.post`, one
+// level per chained group), which left nesting depth unbounded: about 3,100
+// levels of `{{{...a,b...}}}` - only ~6KB of input - exhausted the native stack
+// and crashed the process. `EXPANSION_MAX_DEPTH` bounds how deep the parser
+// will follow nesting. It sits far above any realistic pattern and well below
+// the depth at which the stack runs out.
+exports.EXPANSION_MAX_DEPTH = 1_000;
+// Bash keeps a quirk where a brace group followed by a comma set still expands
+// (`{a},b}`). The parser implements it by rewriting the string and restarting
+// the scan, absorbing one `}` per pass. `n` trailing braces therefore cost `n`
+// full passes over a string that itself grows by one `escClose` sentinel each
+// time - quadratic in `n`, with a ~26x constant from the sentinel's length.
+// 128KB of `'{a}' + '}'.repeat(n) + ',z}'` blocked the event loop for 27
+// seconds to produce two results. `EXPANSION_MAX_REWRITES` bounds how many
+// times the scan may restart. Real `{a},b}` input needs a handful.
+exports.EXPANSION_MAX_REWRITES = 1_000;
 function numeric(str) {
     return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0);
 }
@@ -49,37 +67,52 @@ function unescapeBraces(str) {
         .replace(escCommaPattern, ',')
         .replace(escPeriodPattern, '.');
 }
+// Like `target.push(...items)` but doesn't overflow the stack
+function pushAll(target, items) {
+    for (let i = 0; i < items.length; i++) {
+        target.push(items[i]);
+    }
+}
 /**
  * Basically just str.split(","), but handling cases
  * where we have nested braced sections, which should be
  * treated as individual members, like {a,{b,c},d}
  */
 function parseCommaParts(str) {
-    if (!str) {
-        return [''];
-    }
     const parts = [];
-    const m = (0, balanced_match_1.balanced)('{', '}', str);
-    if (!m) {
-        return str.split(',');
-    }
-    const { pre, body, post } = m;
-    const p = pre.split(',');
-    p[p.length - 1] += '{' + body + '}';
-    const postParts = parseCommaParts(post);
-    if (post.length) {
-        ;
-        p[p.length - 1] += postParts.shift();
-        p.push.apply(p, postParts);
+    // Walk the brace groups iteratively. Recursing on `post` once per group let a
+    // chain of them exhaust the stack - the parsing-side counterpart to
+    // the `expand_` overflow fixed for CVE-2026-14257, and not something `max` or
+    // `maxLength` can bound, since it happens before expansion.
+    //
+    // The part the next chunk continues
+    let carry = '';
+    for (;;) {
+        const m = (0, balanced_match_1.balanced)('{', '}', str);
+        if (!m) {
+            const tail = str.split(',');
+            tail[0] = carry + tail[0];
+            pushAll(parts, tail);
+            return parts;
+        }
+        const { pre, body, post } = m;
+        const p = pre.split(',');
+        p[0] = carry + p[0];
+        p[p.length - 1] += '{' + body + '}';
+        if (!post.length) {
+            pushAll(parts, p);
+            return parts;
+        }
+        carry = p.pop();
+        pushAll(parts, p);
+        str = post;
     }
-    parts.push.apply(parts, p);
-    return parts;
 }
 function expand(str, options = {}) {
     if (!str) {
         return [];
     }
-    const { max = exports.EXPANSION_MAX, maxLength = exports.EXPANSION_MAX_LENGTH } = options;
+    const { max = exports.EXPANSION_MAX, maxLength = exports.EXPANSION_MAX_LENGTH, maxDepth = exports.EXPANSION_MAX_DEPTH, maxRewrites = exports.EXPANSION_MAX_REWRITES, } = options;
     // I don't know why Bash 4.3 does this, but it does.
     // Anything starting with {} will have the first two bytes preserved
     // but *only* at the top level, so {},a}b will not expand to anything,
@@ -89,7 +122,7 @@ function expand(str, options = {}) {
     if (str.slice(0, 2) === '{}') {
         str = '\\{\\}' + str.slice(2);
     }
-    return expand_(escapeBraces(str), max, maxLength, true).map(unescapeBraces);
+    return expand_(escapeBraces(str), max, maxLength, maxDepth, 0, maxRewrites, true).map(unescapeBraces);
 }
 function embrace(str) {
     return '{' + str + '}';
@@ -184,7 +217,13 @@ function expandSequence(body, isAlphaSequence, max, maxLength) {
     }
     return N;
 }
-function expand_(str, max, maxLength, isTop) {
+function expand_(str, max, maxLength, maxDepth, depth, maxRewrites, isTop) {
+    // Too deeply nested to keep following: treat the rest as literal, the same
+    // way a group that cannot expand is already handled. Truncating rather than
+    // throwing keeps `expand` total, matching `max` and `maxLength`.
+    if (depth > maxDepth) {
+        return [str];
+    }
     // Consume the string's top-level brace groups left to right, threading a
     // running set of combined prefixes (`acc`). Expanding the tail iteratively -
     // rather than recursing on `m.post` once per group - keeps the native stack
@@ -196,6 +235,9 @@ function expand_(str, max, maxLength, isTop) {
     // comma set - a sequence like `{a..\}` may legitimately yield ''. The drop
     // is on the final strings, so it is applied to whichever `combine` produces
     // them (the one with no brace set left in the tail).
+    // How many times the `{a},b}` rewrite below has restarted the scan. Each pass
+    // re-reads the whole string, so leaving this unbounded is quadratic.
+    let rewrites = 0;
     let dropEmpties = false;
     let firstGroup = true;
     for (;;) {
@@ -220,7 +262,8 @@ function expand_(str, max, maxLength, isTop) {
         const isOptions = m.body.indexOf(',') >= 0;
         if (!isSequence && !isOptions) {
             // {a},b}
-            if (m.post.match(/,(?!,).*\}/)) {
+            if (rewrites < maxRewrites && m.post.match(/,(?!,).*\}/)) {
+                rewrites++;
                 str = m.pre + '{' + m.body + escClose + m.post;
                 isTop = true;
                 continue;
@@ -240,7 +283,7 @@ function expand_(str, max, maxLength, isTop) {
             let n = parseCommaParts(m.body);
             if (n.length === 1 && n[0] !== undefined) {
                 // x{{a,b}}y ==> x{a}y x{b}y
-                n = expand_(n[0], max, maxLength, false).map(embrace);
+                n = expand_(n[0], max, maxLength, maxDepth, depth + 1, maxRewrites, false).map(embrace);
                 //XXX is this necessary? Can't seem to hit it in tests.
                 /* c8 ignore start */
                 if (n.length === 1) {
@@ -266,12 +309,13 @@ function expand_(str, max, maxLength, isTop) {
             values = [];
             let valuesLength = 0;
             outer: for (let j = 0; j < n.length; j++) {
-                const expanded = expand_(n[j], max, maxLength, false);
+                const expanded = expand_(n[j], max, maxLength, maxDepth, depth + 1, maxRewrites, false);
                 for (let k = 0; k < expanded.length; k++) {
                     const v = expanded[k];
                     if (dropsEmpties && !v)
                         continue;
-                    if (values.length >= max || valuesLength + v.length > maxLength) {
+                    if (values.length >= max ||
+                        valuesLength + v.length > maxLength) {
                         break outer;
                     }
                     values.push(v);