@fedify/vocab-runtime 2.4.0-dev.1528 → 2.4.0-dev.1531

package/deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab-runtime",
-  "version": "2.4.0-dev.1528+fea670ad",
+  "version": "2.4.0-dev.1531+0896bc51",
   "license": "MIT",
   "exports": {
     ".": "./src/mod.ts",

package/dist/mod.cjs

@@ -4345,7 +4345,7 @@ const preloadedContexts = {
 //#endregion
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.4.0-dev.1528+fea670ad";
+var version = "2.4.0-dev.1531+0896bc51";
 //#endregion
 //#region src/link.ts
 const parametersNeedLowerCase = ["rel", "type"];
@@ -4605,6 +4605,66 @@ const logger = (0, _logtape_logtape.getLogger)([
 	"docloader"
 ]);
 const DEFAULT_MAX_REDIRECTION = 20;
+const MAX_HTML_SIZE = 1024 * 1024;
+function createResponseMetadata(response) {
+	return new Response(null, {
+		headers: response.headers,
+		status: response.status,
+		statusText: response.statusText
+	});
+}
+async function cancelResponseBody(response) {
+	if (response.body != null) await response.body.cancel();
+}
+async function readBoundedText(response, maxBytes) {
+	const contentLength = response.headers.get("Content-Length");
+	if (contentLength != null) {
+		const size = Number(contentLength);
+		if (size > maxBytes) {
+			await cancelResponseBody(response);
+			return {
+				text: "",
+				size,
+				tooLarge: true
+			};
+		}
+	}
+	if (response.body == null) return {
+		text: "",
+		size: 0,
+		tooLarge: false
+	};
+	const reader = response.body.getReader();
+	const decoder = new TextDecoder();
+	let text = "";
+	let size = 0;
+	try {
+		while (true) {
+			const result = await reader.read();
+			if (result.done) break;
+			const chunkSize = result.value.byteLength;
+			if (size + chunkSize > maxBytes) {
+				size += chunkSize;
+				await reader.cancel();
+				return {
+					text: "",
+					size,
+					tooLarge: true
+				};
+			}
+			size += chunkSize;
+			text += decoder.decode(result.value, { stream: true });
+		}
+		text += decoder.decode();
+		return {
+			text,
+			size,
+			tooLarge: false
+		};
+	} finally {
+		reader.releaseLock();
+	}
+}
 /**
 * Gets a {@link RemoteDocument} from the given response.
 * @param url The URL of the document to load.
@@ -4659,19 +4719,19 @@ async function getRemoteDocument(url, response, fetch) {
 	}
 	let document;
 	if (!jsonLd && (contentType === "text/html" || contentType?.startsWith("text/html;") || contentType === "application/xhtml+xml" || contentType?.startsWith("application/xhtml+xml;"))) {
-		const MAX_HTML_SIZE = 1024 * 1024;
-		const html = await response.text();
-		if (html.length > MAX_HTML_SIZE) {
+		const errorResponse = createResponseMetadata(response);
+		const html = await readBoundedText(response, MAX_HTML_SIZE);
+		if (html.tooLarge) {
 			logger.warn("HTML response too large, skipping alternate link discovery: {url}", {
 				url: documentUrl,
-				size: html.length
+				size: html.size
 			});
-			document = JSON.parse(html);
+			throw new FetchError(documentUrl, `HTML document is too large to scan for an ActivityPub alternate link (Content-Type: ${contentType})`, errorResponse);
 		} else {
 			const tagPattern = /<(a|link)\s+([^>]*?)\s*\/?>/gi;
 			const attrPattern = /([a-z][a-z:_-]*)=(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi;
 			let tagMatch;
-			while ((tagMatch = tagPattern.exec(html)) !== null) {
+			while ((tagMatch = tagPattern.exec(html.text)) !== null) {
 				const tagContent = tagMatch[2];
 				let attrMatch;
 				const attribs = {};
@@ -4688,7 +4748,12 @@ async function getRemoteDocument(url, response, fetch) {
 					return await fetch(new URL(attribs.href, docUrl).href);
 				}
 			}
-			document = JSON.parse(html);
+			try {
+				document = JSON.parse(html.text);
+			} catch (error) {
+				if (!(error instanceof SyntaxError)) throw error;
+				throw new FetchError(documentUrl, `HTML document has no ActivityPub alternate link (Content-Type: ${contentType})`, errorResponse);
+			}
 		}
 	} else document = await response.json();
 	logger.debug("Fetched document: {status} {url} {headers}", {

package/dist/mod.js

@@ -4341,7 +4341,7 @@ const preloadedContexts = {
 //#endregion
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.4.0-dev.1528+fea670ad";
+var version = "2.4.0-dev.1531+0896bc51";
 //#endregion
 //#region src/link.ts
 const parametersNeedLowerCase = ["rel", "type"];
@@ -4601,6 +4601,66 @@ const logger = getLogger([
 	"docloader"
 ]);
 const DEFAULT_MAX_REDIRECTION = 20;
+const MAX_HTML_SIZE = 1024 * 1024;
+function createResponseMetadata(response) {
+	return new Response(null, {
+		headers: response.headers,
+		status: response.status,
+		statusText: response.statusText
+	});
+}
+async function cancelResponseBody(response) {
+	if (response.body != null) await response.body.cancel();
+}
+async function readBoundedText(response, maxBytes) {
+	const contentLength = response.headers.get("Content-Length");
+	if (contentLength != null) {
+		const size = Number(contentLength);
+		if (size > maxBytes) {
+			await cancelResponseBody(response);
+			return {
+				text: "",
+				size,
+				tooLarge: true
+			};
+		}
+	}
+	if (response.body == null) return {
+		text: "",
+		size: 0,
+		tooLarge: false
+	};
+	const reader = response.body.getReader();
+	const decoder = new TextDecoder();
+	let text = "";
+	let size = 0;
+	try {
+		while (true) {
+			const result = await reader.read();
+			if (result.done) break;
+			const chunkSize = result.value.byteLength;
+			if (size + chunkSize > maxBytes) {
+				size += chunkSize;
+				await reader.cancel();
+				return {
+					text: "",
+					size,
+					tooLarge: true
+				};
+			}
+			size += chunkSize;
+			text += decoder.decode(result.value, { stream: true });
+		}
+		text += decoder.decode();
+		return {
+			text,
+			size,
+			tooLarge: false
+		};
+	} finally {
+		reader.releaseLock();
+	}
+}
 /**
 * Gets a {@link RemoteDocument} from the given response.
 * @param url The URL of the document to load.
@@ -4655,19 +4715,19 @@ async function getRemoteDocument(url, response, fetch) {
 	}
 	let document;
 	if (!jsonLd && (contentType === "text/html" || contentType?.startsWith("text/html;") || contentType === "application/xhtml+xml" || contentType?.startsWith("application/xhtml+xml;"))) {
-		const MAX_HTML_SIZE = 1024 * 1024;
-		const html = await response.text();
-		if (html.length > MAX_HTML_SIZE) {
+		const errorResponse = createResponseMetadata(response);
+		const html = await readBoundedText(response, MAX_HTML_SIZE);
+		if (html.tooLarge) {
 			logger.warn("HTML response too large, skipping alternate link discovery: {url}", {
 				url: documentUrl,
-				size: html.length
+				size: html.size
 			});
-			document = JSON.parse(html);
+			throw new FetchError(documentUrl, `HTML document is too large to scan for an ActivityPub alternate link (Content-Type: ${contentType})`, errorResponse);
 		} else {
 			const tagPattern = /<(a|link)\s+([^>]*?)\s*\/?>/gi;
 			const attrPattern = /([a-z][a-z:_-]*)=(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi;
 			let tagMatch;
-			while ((tagMatch = tagPattern.exec(html)) !== null) {
+			while ((tagMatch = tagPattern.exec(html.text)) !== null) {
 				const tagContent = tagMatch[2];
 				let attrMatch;
 				const attribs = {};
@@ -4684,7 +4744,12 @@ async function getRemoteDocument(url, response, fetch) {
 					return await fetch(new URL(attribs.href, docUrl).href);
 				}
 			}
-			document = JSON.parse(html);
+			try {
+				document = JSON.parse(html.text);
+			} catch (error) {
+				if (!(error instanceof SyntaxError)) throw error;
+				throw new FetchError(documentUrl, `HTML document has no ActivityPub alternate link (Content-Type: ${contentType})`, errorResponse);
+			}
 		}
 	} else document = await response.json();
 	logger.debug("Fetched document: {status} {url} {headers}", {

package/dist/tests/decimal.test.cjs

@@ -1,5 +1,5 @@
 require("./chunk-C2EiDwsr.cjs");
-require("./docloader-yxXccHZv.cjs");
+require("./docloader-Cvdl8PIZ.cjs");
 require("./url-2XwVbUS_.cjs");
 require("./key-pMmqUKuo.cjs");
 require("./multibase-Bz_UUDtL.cjs");

package/dist/tests/decimal.test.mjs

@@ -1,4 +1,4 @@
-import "./docloader-9JRkIgYh.mjs";
+import "./docloader-Bfj7NaT_.mjs";
 import "./url-YWJbnRlf.mjs";
 import "./key-CrrK9mYh.mjs";
 import "./multibase-B4bvakyA.mjs";

package/dist/tests/{docloader-9JRkIgYh.mjs → docloader-Bfj7NaT_.mjs}

@@ -1,4 +1,4 @@
-import { a as name, i as logRequest, n as createActivityPubRequest, o as version, t as FetchError } from "./request-4-bNhrbG.mjs";
+import { a as name, i as logRequest, n as createActivityPubRequest, o as version, t as FetchError } from "./request-B5Su2gl0.mjs";
 import { t as HttpHeaderLink } from "./link-NUUWCdnK.mjs";
 import { l as validatePublicUrl, t as UrlError } from "./url-YWJbnRlf.mjs";
 import { getLogger } from "@logtape/logtape";
@@ -4340,6 +4340,66 @@ const logger = getLogger([
 	"docloader"
 ]);
 const DEFAULT_MAX_REDIRECTION = 20;
+const MAX_HTML_SIZE = 1024 * 1024;
+function createResponseMetadata(response) {
+	return new Response(null, {
+		headers: response.headers,
+		status: response.status,
+		statusText: response.statusText
+	});
+}
+async function cancelResponseBody(response) {
+	if (response.body != null) await response.body.cancel();
+}
+async function readBoundedText(response, maxBytes) {
+	const contentLength = response.headers.get("Content-Length");
+	if (contentLength != null) {
+		const size = Number(contentLength);
+		if (size > maxBytes) {
+			await cancelResponseBody(response);
+			return {
+				text: "",
+				size,
+				tooLarge: true
+			};
+		}
+	}
+	if (response.body == null) return {
+		text: "",
+		size: 0,
+		tooLarge: false
+	};
+	const reader = response.body.getReader();
+	const decoder = new TextDecoder();
+	let text = "";
+	let size = 0;
+	try {
+		while (true) {
+			const result = await reader.read();
+			if (result.done) break;
+			const chunkSize = result.value.byteLength;
+			if (size + chunkSize > maxBytes) {
+				size += chunkSize;
+				await reader.cancel();
+				return {
+					text: "",
+					size,
+					tooLarge: true
+				};
+			}
+			size += chunkSize;
+			text += decoder.decode(result.value, { stream: true });
+		}
+		text += decoder.decode();
+		return {
+			text,
+			size,
+			tooLarge: false
+		};
+	} finally {
+		reader.releaseLock();
+	}
+}
 /**
 * Gets a {@link RemoteDocument} from the given response.
 * @param url The URL of the document to load.
@@ -4394,19 +4454,19 @@ async function getRemoteDocument(url, response, fetch) {
 	}
 	let document;
 	if (!jsonLd && (contentType === "text/html" || contentType?.startsWith("text/html;") || contentType === "application/xhtml+xml" || contentType?.startsWith("application/xhtml+xml;"))) {
-		const MAX_HTML_SIZE = 1024 * 1024;
-		const html = await response.text();
-		if (html.length > MAX_HTML_SIZE) {
+		const errorResponse = createResponseMetadata(response);
+		const html = await readBoundedText(response, MAX_HTML_SIZE);
+		if (html.tooLarge) {
 			logger.warn("HTML response too large, skipping alternate link discovery: {url}", {
 				url: documentUrl,
-				size: html.length
+				size: html.size
 			});
-			document = JSON.parse(html);
+			throw new FetchError(documentUrl, `HTML document is too large to scan for an ActivityPub alternate link (Content-Type: ${contentType})`, errorResponse);
 		} else {
 			const tagPattern = /<(a|link)\s+([^>]*?)\s*\/?>/gi;
 			const attrPattern = /([a-z][a-z:_-]*)=(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi;
 			let tagMatch;
-			while ((tagMatch = tagPattern.exec(html)) !== null) {
+			while ((tagMatch = tagPattern.exec(html.text)) !== null) {
 				const tagContent = tagMatch[2];
 				let attrMatch;
 				const attribs = {};
@@ -4423,7 +4483,12 @@ async function getRemoteDocument(url, response, fetch) {
 					return await fetch(new URL(attribs.href, docUrl).href);
 				}
 			}
-			document = JSON.parse(html);
+			try {
+				document = JSON.parse(html.text);
+			} catch (error) {
+				if (!(error instanceof SyntaxError)) throw error;
+				throw new FetchError(documentUrl, `HTML document has no ActivityPub alternate link (Content-Type: ${contentType})`, errorResponse);
+			}
 		}
 	} else document = await response.json();
 	logger.debug("Fetched document: {status} {url} {headers}", {
@@ -4528,4 +4593,4 @@ function getDocumentLoader({ allowPrivateAddress, maxRedirection, skipPreloadedC
 	return load;
 }
 //#endregion
-export { preloadedContexts as n, getDocumentLoader as t };
+export { getRemoteDocument as n, preloadedContexts as r, getDocumentLoader as t };

package/dist/tests/{docloader-yxXccHZv.cjs → docloader-Cvdl8PIZ.cjs}

@@ -1,5 +1,5 @@
 require("./chunk-C2EiDwsr.cjs");
-const require_request = require("./request-_LWX0dnv.cjs");
+const require_request = require("./request-DJvOZdo7.cjs");
 const require_link = require("./link-FguCydMA.cjs");
 const require_url = require("./url-2XwVbUS_.cjs");
 let _logtape_logtape = require("@logtape/logtape");
@@ -4341,6 +4341,66 @@ const logger = (0, _logtape_logtape.getLogger)([
 	"docloader"
 ]);
 const DEFAULT_MAX_REDIRECTION = 20;
+const MAX_HTML_SIZE = 1024 * 1024;
+function createResponseMetadata(response) {
+	return new Response(null, {
+		headers: response.headers,
+		status: response.status,
+		statusText: response.statusText
+	});
+}
+async function cancelResponseBody(response) {
+	if (response.body != null) await response.body.cancel();
+}
+async function readBoundedText(response, maxBytes) {
+	const contentLength = response.headers.get("Content-Length");
+	if (contentLength != null) {
+		const size = Number(contentLength);
+		if (size > maxBytes) {
+			await cancelResponseBody(response);
+			return {
+				text: "",
+				size,
+				tooLarge: true
+			};
+		}
+	}
+	if (response.body == null) return {
+		text: "",
+		size: 0,
+		tooLarge: false
+	};
+	const reader = response.body.getReader();
+	const decoder = new TextDecoder();
+	let text = "";
+	let size = 0;
+	try {
+		while (true) {
+			const result = await reader.read();
+			if (result.done) break;
+			const chunkSize = result.value.byteLength;
+			if (size + chunkSize > maxBytes) {
+				size += chunkSize;
+				await reader.cancel();
+				return {
+					text: "",
+					size,
+					tooLarge: true
+				};
+			}
+			size += chunkSize;
+			text += decoder.decode(result.value, { stream: true });
+		}
+		text += decoder.decode();
+		return {
+			text,
+			size,
+			tooLarge: false
+		};
+	} finally {
+		reader.releaseLock();
+	}
+}
 /**
 * Gets a {@link RemoteDocument} from the given response.
 * @param url The URL of the document to load.
@@ -4395,19 +4455,19 @@ async function getRemoteDocument(url, response, fetch) {
 	}
 	let document;
 	if (!jsonLd && (contentType === "text/html" || contentType?.startsWith("text/html;") || contentType === "application/xhtml+xml" || contentType?.startsWith("application/xhtml+xml;"))) {
-		const MAX_HTML_SIZE = 1024 * 1024;
-		const html = await response.text();
-		if (html.length > MAX_HTML_SIZE) {
+		const errorResponse = createResponseMetadata(response);
+		const html = await readBoundedText(response, MAX_HTML_SIZE);
+		if (html.tooLarge) {
 			logger.warn("HTML response too large, skipping alternate link discovery: {url}", {
 				url: documentUrl,
-				size: html.length
+				size: html.size
 			});
-			document = JSON.parse(html);
+			throw new require_request.FetchError(documentUrl, `HTML document is too large to scan for an ActivityPub alternate link (Content-Type: ${contentType})`, errorResponse);
 		} else {
 			const tagPattern = /<(a|link)\s+([^>]*?)\s*\/?>/gi;
 			const attrPattern = /([a-z][a-z:_-]*)=(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi;
 			let tagMatch;
-			while ((tagMatch = tagPattern.exec(html)) !== null) {
+			while ((tagMatch = tagPattern.exec(html.text)) !== null) {
 				const tagContent = tagMatch[2];
 				let attrMatch;
 				const attribs = {};
@@ -4424,7 +4484,12 @@ async function getRemoteDocument(url, response, fetch) {
 					return await fetch(new URL(attribs.href, docUrl).href);
 				}
 			}
-			document = JSON.parse(html);
+			try {
+				document = JSON.parse(html.text);
+			} catch (error) {
+				if (!(error instanceof SyntaxError)) throw error;
+				throw new require_request.FetchError(documentUrl, `HTML document has no ActivityPub alternate link (Content-Type: ${contentType})`, errorResponse);
+			}
 		}
 	} else document = await response.json();
 	logger.debug("Fetched document: {status} {url} {headers}", {
@@ -4535,6 +4600,12 @@ Object.defineProperty(exports, "getDocumentLoader", {
 		return getDocumentLoader;
 	}
 });
+Object.defineProperty(exports, "getRemoteDocument", {
+	enumerable: true,
+	get: function() {
+		return getRemoteDocument;
+	}
+});
 Object.defineProperty(exports, "preloadedContexts", {
 	enumerable: true,
 	get: function() {

package/dist/tests/docloader.test.cjs

@@ -1,6 +1,6 @@
 const require_chunk = require("./chunk-C2EiDwsr.cjs");
-const require_docloader = require("./docloader-yxXccHZv.cjs");
-const require_request = require("./request-_LWX0dnv.cjs");
+const require_docloader = require("./docloader-Cvdl8PIZ.cjs");
+const require_request = require("./request-DJvOZdo7.cjs");
 const require_url = require("./url-2XwVbUS_.cjs");
 let node_assert = require("node:assert");
 let node_test = require("node:test");
@@ -1267,7 +1267,7 @@ var esm_default = new class FetchMock {
 			type: "Object"
 		},
 		headers: {
-			"Content-Type": "text/html; charset=utf-8",
+			"Content-Type": "application/activity+json",
 			Link: "<https://example.com/object>; rel=\"alternate\"; type=\"application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"\""
 		}
 	});
@@ -1399,6 +1399,27 @@ var esm_default = new class FetchMock {
 			}
 		});
 	});
+	esm_default.get("https://example.com/html-no-alternate", {
+		body: `<!DOCTYPE html>
+      <html>
+        <head>
+          <title>Not an ActivityPub document</title>
+        </head>
+        <body>Not found</body>
+      </html>`,
+		headers: { "Content-Type": "text/html; charset=utf-8" }
+	});
+	await t.test("HTML without ActivityPub alternate link", async () => {
+		await (0, node_assert.rejects)(() => fetchDocumentLoader("https://example.com/html-no-alternate"), (error) => {
+			(0, node_assert.ok)(error instanceof require_request.FetchError);
+			(0, node_assert.ok)(error.message.includes("HTML document has no ActivityPub alternate link"));
+			(0, node_assert.ok)(error.message.includes("Content-Type: text/html; charset=utf-8"));
+			(0, node_assert.deepStrictEqual)(error.url, new URL("https://example.com/html-no-alternate"));
+			(0, node_assert.ok)(error.response != null);
+			(0, node_assert.deepStrictEqual)(error.response.headers.get("Content-Type"), "text/html; charset=utf-8");
+			return true;
+		});
+	});
 	esm_default.get("https://example.com/wrong-content-type", {
 		body: {
 			"@context": "https://www.w3.org/ns/activitystreams",
@@ -1408,7 +1429,7 @@ var esm_default = new class FetchMock {
 		},
 		headers: { "Content-Type": "text/html; charset=utf-8" }
 	});
-	await t.test("Wrong Content-Type", async () => {
+	await t.test("wrong Content-Type with JSON body", async () => {
 		(0, node_assert.deepStrictEqual)(await fetchDocumentLoader("https://example.com/wrong-content-type"), {
 			contextUrl: null,
 			documentUrl: "https://example.com/wrong-content-type",
@@ -1420,6 +1441,37 @@ var esm_default = new class FetchMock {
 			}
 		});
 	});
+	esm_default.get("https://example.com/large-html", {
+		body: "<!DOCTYPE html>",
+		headers: {
+			"Content-Length": String(1048577),
+			"Content-Type": "text/html; charset=utf-8"
+		}
+	});
+	await t.test("HTML Content-Length over limit", async () => {
+		await (0, node_assert.rejects)(() => fetchDocumentLoader("https://example.com/large-html"), (error) => {
+			(0, node_assert.ok)(error instanceof require_request.FetchError);
+			(0, node_assert.ok)(error.message.includes("HTML document is too large to scan for an ActivityPub alternate link"));
+			(0, node_assert.ok)(error.response != null);
+			(0, node_assert.deepStrictEqual)(error.response.status, 200);
+			(0, node_assert.deepStrictEqual)(error.response.headers.get("Content-Type"), "text/html; charset=utf-8");
+			return true;
+		});
+	});
+	await t.test("HTML Content-Length over limit cancels body", async () => {
+		let canceled = false;
+		const response = new Response("<!DOCTYPE html>", { headers: {
+			"Content-Length": String(1048577),
+			"Content-Type": "text/html; charset=utf-8"
+		} });
+		Object.defineProperty(response, "body", { value: { cancel: () => {
+			canceled = true;
+		} } });
+		await (0, node_assert.rejects)(() => require_docloader.getRemoteDocument("https://example.com/large-html-cancel", response, () => {
+			throw new Error("unexpected alternate fetch");
+		}), require_request.FetchError);
+		(0, node_assert.deepStrictEqual)(canceled, true);
+	});
 	esm_default.get("https://example.com/404", { status: 404 });
 	await t.test("not ok", async () => {
 		await (0, node_assert.rejects)(() => fetchDocumentLoader("https://example.com/404"), require_request.FetchError, "HTTP 404: https://example.com/404");
@@ -1536,7 +1588,7 @@ var esm_default = new class FetchMock {
 	});
 	await t.test("ReDoS resistance (CVE-2025-68475)", async () => {
 		const start = performance.now();
-		await (0, node_assert.rejects)(() => fetchDocumentLoader("https://example.com/redos"), SyntaxError);
+		await (0, node_assert.rejects)(() => fetchDocumentLoader("https://example.com/redos"), require_request.FetchError);
 		const elapsed = performance.now() - start;
 		(0, node_assert.ok)(elapsed < 1e3, `Potential ReDoS vulnerability detected: ${elapsed}ms (expected < 1000ms)`);
 	});

package/dist/tests/docloader.test.mjs

@@ -1,5 +1,5 @@
-import { n as preloadedContexts, t as getDocumentLoader } from "./docloader-9JRkIgYh.mjs";
-import { t as FetchError } from "./request-4-bNhrbG.mjs";
+import { n as getRemoteDocument, r as preloadedContexts, t as getDocumentLoader } from "./docloader-Bfj7NaT_.mjs";
+import { t as FetchError } from "./request-B5Su2gl0.mjs";
 import { t as UrlError } from "./url-YWJbnRlf.mjs";
 import { deepStrictEqual, ok, rejects } from "node:assert";
 import { test } from "node:test";
@@ -1286,7 +1286,7 @@ test("getDocumentLoader()", async (t) => {
 			type: "Object"
 		},
 		headers: {
-			"Content-Type": "text/html; charset=utf-8",
+			"Content-Type": "application/activity+json",
 			Link: "<https://example.com/object>; rel=\"alternate\"; type=\"application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\"\""
 		}
 	});
@@ -1418,6 +1418,27 @@ test("getDocumentLoader()", async (t) => {
 			}
 		});
 	});
+	esm_default.get("https://example.com/html-no-alternate", {
+		body: `<!DOCTYPE html>
+      <html>
+        <head>
+          <title>Not an ActivityPub document</title>
+        </head>
+        <body>Not found</body>
+      </html>`,
+		headers: { "Content-Type": "text/html; charset=utf-8" }
+	});
+	await t.test("HTML without ActivityPub alternate link", async () => {
+		await rejects(() => fetchDocumentLoader("https://example.com/html-no-alternate"), (error) => {
+			ok(error instanceof FetchError);
+			ok(error.message.includes("HTML document has no ActivityPub alternate link"));
+			ok(error.message.includes("Content-Type: text/html; charset=utf-8"));
+			deepStrictEqual(error.url, new URL("https://example.com/html-no-alternate"));
+			ok(error.response != null);
+			deepStrictEqual(error.response.headers.get("Content-Type"), "text/html; charset=utf-8");
+			return true;
+		});
+	});
 	esm_default.get("https://example.com/wrong-content-type", {
 		body: {
 			"@context": "https://www.w3.org/ns/activitystreams",
@@ -1427,7 +1448,7 @@ test("getDocumentLoader()", async (t) => {
 		},
 		headers: { "Content-Type": "text/html; charset=utf-8" }
 	});
-	await t.test("Wrong Content-Type", async () => {
+	await t.test("wrong Content-Type with JSON body", async () => {
 		deepStrictEqual(await fetchDocumentLoader("https://example.com/wrong-content-type"), {
 			contextUrl: null,
 			documentUrl: "https://example.com/wrong-content-type",
@@ -1439,6 +1460,37 @@ test("getDocumentLoader()", async (t) => {
 			}
 		});
 	});
+	esm_default.get("https://example.com/large-html", {
+		body: "<!DOCTYPE html>",
+		headers: {
+			"Content-Length": String(1048577),
+			"Content-Type": "text/html; charset=utf-8"
+		}
+	});
+	await t.test("HTML Content-Length over limit", async () => {
+		await rejects(() => fetchDocumentLoader("https://example.com/large-html"), (error) => {
+			ok(error instanceof FetchError);
+			ok(error.message.includes("HTML document is too large to scan for an ActivityPub alternate link"));
+			ok(error.response != null);
+			deepStrictEqual(error.response.status, 200);
+			deepStrictEqual(error.response.headers.get("Content-Type"), "text/html; charset=utf-8");
+			return true;
+		});
+	});
+	await t.test("HTML Content-Length over limit cancels body", async () => {
+		let canceled = false;
+		const response = new Response("<!DOCTYPE html>", { headers: {
+			"Content-Length": String(1048577),
+			"Content-Type": "text/html; charset=utf-8"
+		} });
+		Object.defineProperty(response, "body", { value: { cancel: () => {
+			canceled = true;
+		} } });
+		await rejects(() => getRemoteDocument("https://example.com/large-html-cancel", response, () => {
+			throw new Error("unexpected alternate fetch");
+		}), FetchError);
+		deepStrictEqual(canceled, true);
+	});
 	esm_default.get("https://example.com/404", { status: 404 });
 	await t.test("not ok", async () => {
 		await rejects(() => fetchDocumentLoader("https://example.com/404"), FetchError, "HTTP 404: https://example.com/404");
@@ -1555,7 +1607,7 @@ test("getDocumentLoader()", async (t) => {
 	});
 	await t.test("ReDoS resistance (CVE-2025-68475)", async () => {
 		const start = performance.now();
-		await rejects(() => fetchDocumentLoader("https://example.com/redos"), SyntaxError);
+		await rejects(() => fetchDocumentLoader("https://example.com/redos"), FetchError);
 		const elapsed = performance.now() - start;
 		ok(elapsed < 1e3, `Potential ReDoS vulnerability detected: ${elapsed}ms (expected < 1000ms)`);
 	});

package/dist/tests/{request-4-bNhrbG.mjs → request-B5Su2gl0.mjs}

@@ -1,7 +1,7 @@
 import process from "node:process";
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.4.0-dev.1528+fea670ad";
+var version = "2.4.0-dev.1531+0896bc51";
 //#endregion
 //#region src/request.ts
 /**

package/dist/tests/{request-_LWX0dnv.cjs → request-DJvOZdo7.cjs}

@@ -3,7 +3,7 @@ let node_process = require("node:process");
 node_process = require_chunk.__toESM(node_process, 1);
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.4.0-dev.1528+fea670ad";
+var version = "2.4.0-dev.1531+0896bc51";
 //#endregion
 //#region src/request.ts
 /**

package/dist/tests/request.test.cjs

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-C2EiDwsr.cjs");
-const require_request = require("./request-_LWX0dnv.cjs");
+const require_request = require("./request-DJvOZdo7.cjs");
 let node_assert = require("node:assert");
 let node_test = require("node:test");
 let node_process = require("node:process");

package/dist/tests/request.test.mjs

@@ -1,4 +1,4 @@
-import { o as version, r as getUserAgent } from "./request-4-bNhrbG.mjs";
+import { o as version, r as getUserAgent } from "./request-B5Su2gl0.mjs";
 import { deepStrictEqual } from "node:assert";
 import { test } from "node:test";
 import process from "node:process";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab-runtime",
-  "version": "2.4.0-dev.1528+fea670ad",
+  "version": "2.4.0-dev.1531+0896bc51",
   "homepage": "https://fedify.dev/",
   "repository": {
     "type": "git",

package/src/docloader.test.ts

@@ -2,7 +2,7 @@ import fetchMock from "fetch-mock";
 import { deepStrictEqual, ok, rejects } from "node:assert";
 import { test } from "node:test";
 import preloadedContexts from "./contexts.ts";
-import { getDocumentLoader } from "./docloader.ts";
+import { getDocumentLoader, getRemoteDocument } from "./docloader.ts";
 import { FetchError } from "./request.ts";
 import { UrlError } from "./url.ts";
 
@@ -90,7 +90,7 @@ test("getDocumentLoader()", async (t) => {
       type: "Object",
     },
     headers: {
-      "Content-Type": "text/html; charset=utf-8",
+      "Content-Type": "application/activity+json",
       Link: '<https://example.com/object>; rel="alternate"; ' +
         'type="application/ld+json; profile="https://www.w3.org/ns/activitystreams""',
     },
@@ -247,6 +247,44 @@ test("getDocumentLoader()", async (t) => {
     });
   });
 
+  fetchMock.get("https://example.com/html-no-alternate", {
+    body: `<!DOCTYPE html>
+      <html>
+        <head>
+          <title>Not an ActivityPub document</title>
+        </head>
+        <body>Not found</body>
+      </html>`,
+    headers: { "Content-Type": "text/html; charset=utf-8" },
+  });
+
+  await t.test("HTML without ActivityPub alternate link", async () => {
+    await rejects(
+      () => fetchDocumentLoader("https://example.com/html-no-alternate"),
+      (error) => {
+        ok(error instanceof FetchError);
+        ok(
+          error.message.includes(
+            "HTML document has no ActivityPub alternate link",
+          ),
+        );
+        ok(
+          error.message.includes("Content-Type: text/html; charset=utf-8"),
+        );
+        deepStrictEqual(
+          error.url,
+          new URL("https://example.com/html-no-alternate"),
+        );
+        ok(error.response != null);
+        deepStrictEqual(
+          error.response.headers.get("Content-Type"),
+          "text/html; charset=utf-8",
+        );
+        return true;
+      },
+    );
+  });
+
   fetchMock.get("https://example.com/wrong-content-type", {
     body: {
       "@context": "https://www.w3.org/ns/activitystreams",
@@ -257,7 +295,7 @@ test("getDocumentLoader()", async (t) => {
     headers: { "Content-Type": "text/html; charset=utf-8" },
   });
 
-  await t.test("Wrong Content-Type", async () => {
+  await t.test("wrong Content-Type with JSON body", async () => {
     deepStrictEqual(
       await fetchDocumentLoader("https://example.com/wrong-content-type"),
       {
@@ -273,6 +311,64 @@ test("getDocumentLoader()", async (t) => {
     );
   });
 
+  fetchMock.get("https://example.com/large-html", {
+    body: "<!DOCTYPE html>",
+    headers: {
+      "Content-Length": String(1024 * 1024 + 1),
+      "Content-Type": "text/html; charset=utf-8",
+    },
+  });
+
+  await t.test("HTML Content-Length over limit", async () => {
+    await rejects(
+      () => fetchDocumentLoader("https://example.com/large-html"),
+      (error) => {
+        ok(error instanceof FetchError);
+        ok(
+          error.message.includes(
+            "HTML document is too large to scan for an ActivityPub alternate link",
+          ),
+        );
+        ok(error.response != null);
+        deepStrictEqual(error.response.status, 200);
+        deepStrictEqual(
+          error.response.headers.get("Content-Type"),
+          "text/html; charset=utf-8",
+        );
+        return true;
+      },
+    );
+  });
+
+  await t.test("HTML Content-Length over limit cancels body", async () => {
+    let canceled = false;
+    const response = new Response("<!DOCTYPE html>", {
+      headers: {
+        "Content-Length": String(1024 * 1024 + 1),
+        "Content-Type": "text/html; charset=utf-8",
+      },
+    });
+    Object.defineProperty(response, "body", {
+      value: {
+        cancel: () => {
+          canceled = true;
+        },
+      },
+    });
+    await rejects(
+      () =>
+        getRemoteDocument(
+          "https://example.com/large-html-cancel",
+          response,
+          () => {
+            throw new Error("unexpected alternate fetch");
+          },
+        ),
+      FetchError,
+    );
+    deepStrictEqual(canceled, true);
+  });
+
   fetchMock.get("https://example.com/404", { status: 404 });
 
   await t.test("not ok", async () => {
@@ -459,11 +555,11 @@ test("getDocumentLoader()", async (t) => {
 
   await t.test("ReDoS resistance (CVE-2025-68475)", async () => {
     const start = performance.now();
-    // The malicious HTML will fail JSON parsing, but the important thing is
-    // that it should complete quickly (not hang due to ReDoS)
+    // The malicious HTML will fail alternate discovery, but the important
+    // thing is that it should complete quickly (not hang due to ReDoS).
     await rejects(
       () => fetchDocumentLoader("https://example.com/redos"),
-      SyntaxError,
+      FetchError,
     );
     const elapsed = performance.now() - start;
 

package/src/docloader.ts

@@ -13,6 +13,7 @@ import { UrlError, validatePublicUrl } from "./url.ts";
 
 const logger = getLogger(["fedify", "runtime", "docloader"]);
 const DEFAULT_MAX_REDIRECTION = 20;
+const MAX_HTML_SIZE = 1024 * 1024; // 1MB
 
 /**
  * A remote JSON-LD document and its context fetched by
@@ -112,6 +113,59 @@ export type AuthenticatedDocumentLoaderFactory = (
   options?: DocumentLoaderFactoryOptions,
 ) => DocumentLoader;
 
+function createResponseMetadata(response: Response): Response {
+  return new Response(null, {
+    headers: response.headers,
+    status: response.status,
+    statusText: response.statusText,
+  });
+}
+
+async function cancelResponseBody(response: Response): Promise<void> {
+  if (response.body != null) {
+    await response.body.cancel();
+  }
+}
+
+async function readBoundedText(
+  response: Response,
+  maxBytes: number,
+): Promise<{ text: string; size: number; tooLarge: boolean }> {
+  const contentLength = response.headers.get("Content-Length");
+  if (contentLength != null) {
+    const size = Number(contentLength);
+    if (size > maxBytes) {
+      await cancelResponseBody(response);
+      return { text: "", size, tooLarge: true };
+    }
+  }
+
+  if (response.body == null) return { text: "", size: 0, tooLarge: false };
+
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder();
+  let text = "";
+  let size = 0;
+  try {
+    while (true) {
+      const result = await reader.read();
+      if (result.done) break;
+      const chunkSize = result.value.byteLength;
+      if (size + chunkSize > maxBytes) {
+        size += chunkSize;
+        await reader.cancel();
+        return { text: "", size, tooLarge: true };
+      }
+      size += chunkSize;
+      text += decoder.decode(result.value, { stream: true });
+    }
+    text += decoder.decode();
+    return { text, size, tooLarge: false };
+  } finally {
+    reader.releaseLock();
+  }
+}
+
 /**
  * Gets a {@link RemoteDocument} from the given response.
  * @param url The URL of the document to load.
@@ -200,15 +254,19 @@ export async function getRemoteDocument(
       contentType === "application/xhtml+xml" ||
       contentType?.startsWith("application/xhtml+xml;"))
   ) {
-    // Security: Limit HTML response size to mitigate ReDoS attacks
-    const MAX_HTML_SIZE = 1024 * 1024; // 1MB
-    const html = await response.text();
-    if (html.length > MAX_HTML_SIZE) {
+    const errorResponse = createResponseMetadata(response);
+    const html = await readBoundedText(response, MAX_HTML_SIZE);
+    if (html.tooLarge) {
       logger.warn(
         "HTML response too large, skipping alternate link discovery: {url}",
-        { url: documentUrl, size: html.length },
+        { url: documentUrl, size: html.size },
+      );
+      throw new FetchError(
+        documentUrl,
+        `HTML document is too large to scan for an ActivityPub alternate link ` +
+          `(Content-Type: ${contentType})`,
+        errorResponse,
       );
-      document = JSON.parse(html);
     } else {
       // Safe regex patterns without nested quantifiers to prevent ReDoS
       // (CVE-2025-68475)
@@ -219,7 +277,7 @@ export async function getRemoteDocument(
         /([a-z][a-z:_-]*)=(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi;
 
       let tagMatch: RegExpExecArray | null;
-      while ((tagMatch = tagPattern.exec(html)) !== null) {
+      while ((tagMatch = tagPattern.exec(html.text)) !== null) {
         const tagContent = tagMatch[2];
         let attrMatch: RegExpExecArray | null;
         const attribs: Record<string, string> = {};
@@ -247,7 +305,17 @@ export async function getRemoteDocument(
           return await fetch(new URL(attribs.href, docUrl).href);
         }
       }
-      document = JSON.parse(html);
+      try {
+        document = JSON.parse(html.text);
+      } catch (error) {
+        if (!(error instanceof SyntaxError)) throw error;
+        throw new FetchError(
+          documentUrl,
+          `HTML document has no ActivityPub alternate link ` +
+            `(Content-Type: ${contentType})`,
+          errorResponse,
+        );
+      }
     }
   } else {
     document = await response.json();