Constant MAXIMUM_ALLOWED_WINDOW_SIZE 

pub const MAXIMUM_ALLOWED_WINDOW_SIZE: u64 = _; // 134_217_728u64

Largest window a frame may declare before this decoder refuses it.

The bound is what makes decoding untrusted input safe: a frame header can ask for a window far larger than the data behind it, and honouring that would let a few bytes of input demand gigabytes of memory. Callers that impose their own ceiling can compare against this one to see which is the stricter, and tools can report the bound they actually enforce. Decoder window-size limit (128 MiB = 1 << 27), matching upstream zstd’s default ZSTD_d_windowLogMax (ZSTD_WINDOWLOG_LIMIT_DEFAULT = 27). Frames advertising a larger window are rejected to bound allocation on untrusted input. The spec permits larger windows, but no standard zstd encoder emits them by default, so matching the upstream limit keeps the drop-in contract: every frame a stock zstd decoder accepts, we accept too — and crucially, every frame OUR encoder emits (up to window_log 27 at level 22) round-trips through our own decoder. A non-power-of-two cap below 1 << 27 would reject our own level-22 / streaming output (whose window header carries the full 128 MiB). Decompression-bomb protection lives on the OUTPUT path, not here.