Fix denial of service from malicious indexed source maps (CVE-2026-93749)

[7rulnik]

Summary

A crafted source map could exhaust CPU or memory. This fixes four amplification paths reachable from untrusted map input (CVE-2026-93749).

• Huge section offset.line copied into a generator. An indexed section with an enormous offset.line, once its mappings were copied into a SourceMapGenerator, expanded into one ; per generated line. Section offsets are now validated as non-negative safe integers, and offset.line is capped at 10,000,000, counting summed offsets of nested sections.
• Exponential sources getter. IndexedSourceMapConsumer's sources getter re-read each nested consumer's sources once per item, which is exponential in nesting depth. It now reads each section's sources a single time.
• Rope blowup in _serializeMappings. Large ; runs were built one node at a time, forming a rope that could exhaust the heap. Large gaps are now built with a single flat string.
• Per-line padding in fromStringWithSourceMap. Padding past the end of the generated code added one empty line at a time. It now stops once the code is exhausted, which also fixes literal undefined text being emitted for those lines.

Testing

• npm test passes (145/145), including six new regression tests covering each path above.
• Reproduced each path against the pre-patch code under a capped heap and a kill deadline: the original OOMs or times out, the patched code either rejects the input immediately or completes in bounded time and memory.

Path	Malicious input	Before	After
offset into generator	offset.line 1e8	OOM at 512MB	throws instantly
nested sources getter	nesting depth 40	killed at 45s	~1ms at depth 500
serialize line gap	gap 1e8	OOM at 512MB	flat string, ok
source-node offset	offset.line 1e8	OOM at 512MB	throws instantly

The exponential path, measured on the pre-patch getter (ms by nesting depth), roughly triples per level:

depth  10   11   12   13   14   15    16    17
ms      3    5   11   28   79  213   608  1700