@fedify/vocab-runtime 2.4.0-dev.1567 → 2.4.0-dev.1570

package/dist/mod.js

@@ -1,8 +1,9 @@
 
-import { a as isValidPublicIPv4Address, c as parseJsonLdId, i as haveSameIriOrigin, l as validatePublicUrl, n as expandIPv6Address, o as isValidPublicIPv6Address, r as formatIri, s as parseIri, t as UrlError } from "./url-BuxPHxK2.js";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 import process from "node:process";
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
 import { Integer, Sequence } from "asn1js";
 import { decodeBase64, encodeBase64 } from "byte-encodings/base64";
 import { decodeBase64Url } from "byte-encodings/base64url";
@@ -4283,28 +4284,6 @@ const preloadedContexts = {
 			"@type": "@id"
 		}
 	} },
-	"https://w3id.org/fep/7aa9": { "@context": {
-		"FeaturedCollection": "https://w3id.org/fep/7aa9#FeaturedCollection",
-		"FeaturedItem": "https://w3id.org/fep/7aa9#FeaturedItem",
-		"FeatureRequest": "https://w3id.org/fep/7aa9#FeatureRequest",
-		"FeatureAuthorization": "https://w3id.org/fep/7aa9#FeatureAuthorization",
-		"topic": {
-			"@id": "https://w3id.org/fep/7aa9#topic",
-			"@type": "@id"
-		},
-		"featuredObject": {
-			"@id": "https://w3id.org/fep/7aa9#featuredObject",
-			"@type": "@id"
-		},
-		"canFeature": {
-			"@id": "https://w3id.org/fep/7aa9#canFeature",
-			"@type": "@id"
-		},
-		"featureAuthorization": {
-			"@id": "https://w3id.org/fep/7aa9#featureAuthorization",
-			"@type": "@id"
-		}
-	} },
 	"https://join-lemmy.org/context.json": { "@context": ["https://w3id.org/security/v1", {
 		"as": "https://www.w3.org/ns/activitystreams#",
 		"lemmy": "https://join-lemmy.org/ns#",
@@ -4363,7 +4342,7 @@ const preloadedContexts = {
 //#endregion
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.4.0-dev.1567+12e6a3c0";
+var version = "2.4.0-dev.1570+f1b6aaa3";
 //#endregion
 //#region src/link.ts
 const parametersNeedLowerCase = ["rel", "type"];
@@ -4616,6 +4595,179 @@ function logRequest(logger, request) {
 	});
 }
 //#endregion
+//#region src/url.ts
+var UrlError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "UrlError";
+	}
+};
+/**
+* Validates a URL to prevent SSRF attacks.
+*/
+async function validatePublicUrl(url) {
+	const parsed = new URL(url);
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new UrlError(`Unsupported protocol: ${parsed.protocol}`);
+	let hostname = parsed.hostname;
+	if (hostname.startsWith("[") && hostname.endsWith("]")) hostname = hostname.slice(1, -1);
+	if (hostname === "localhost") throw new UrlError("Localhost is not allowed");
+	const hostnameFamily = isIP(hostname);
+	if (hostnameFamily !== 0) {
+		validatePublicIpAddress(hostname, hostnameFamily);
+		return;
+	}
+	if ("Deno" in globalThis && !isIP(hostname)) {
+		if ((await Deno.permissions.query({ name: "net" })).state !== "granted") return;
+	}
+	if ("Bun" in globalThis) {
+		if (hostname === "example.com" || hostname.endsWith(".example.com")) return;
+		else if (hostname === "fedify-test.internal") throw new UrlError("Invalid or private address: fedify-test.internal");
+	}
+	let addresses;
+	try {
+		addresses = await lookup(hostname, { all: true });
+	} catch {
+		addresses = [];
+	}
+	for (const { address, family } of addresses) validatePublicIpAddress(address, family);
+}
+function validatePublicIpAddress(address, family) {
+	if (family === 4 && isValidPublicIPv4Address(address) || family === 6 && isValidPublicIPv6Address(address)) return;
+	throw new UrlError(`Invalid or private address: ${address}`);
+}
+function isValidPublicIPv4Address(address) {
+	const parts = parseIPv4Address(address);
+	if (parts == null) return false;
+	const value = ipv4PartsToNumber(parts);
+	return !nonPublicIPv4Prefixes.some(({ base, prefix }) => matchesIPv4Prefix(value, base, prefix));
+}
+function isValidPublicIPv6Address(address) {
+	const words = parseIPv6Address(address);
+	if (words == null) return false;
+	if (nonPublicIPv6Prefixes.some(({ words: prefixWords, prefix }) => matchesIPv6Prefix(words, prefixWords, prefix))) return false;
+	for (const { extractIPv4, prefix, words: prefixWords } of ipv6WithIPv4Prefixes) {
+		if (!matchesIPv6Prefix(words, prefixWords, prefix)) continue;
+		const ipv4Address = extractIPv4(words);
+		if (ipv4Address != null && !isValidPublicIPv4Address(ipv4Address)) return false;
+	}
+	return true;
+}
+function expandIPv6Address(address) {
+	address = address.toLowerCase();
+	const ipv4Delimiter = address.lastIndexOf(":");
+	if (address.includes(".") && ipv4Delimiter >= 0) {
+		const ipv4Parts = parseIPv4Address(address.substring(ipv4Delimiter + 1));
+		if (ipv4Parts == null) return address;
+		const high = (ipv4Parts[0] << 8) + ipv4Parts[1];
+		const low = (ipv4Parts[2] << 8) + ipv4Parts[3];
+		address = address.substring(0, ipv4Delimiter + 1) + high.toString(16) + ":" + low.toString(16);
+	}
+	if (address === "::") return "0000:0000:0000:0000:0000:0000:0000:0000";
+	if (address.startsWith("::")) address = "0000" + address;
+	if (address.endsWith("::")) address = address + "0000";
+	address = address.replace("::", ":0000".repeat(8 - (address.match(/:/g) || []).length) + ":");
+	return address.split(":").map((part) => part.padStart(4, "0")).join(":");
+}
+const nonPublicIPv4Prefixes = [
+	ipv4Prefix("0.0.0.0/8", "RFC 6890"),
+	ipv4Prefix("10.0.0.0/8", "RFC 1918"),
+	ipv4Prefix("100.64.0.0/10", "RFC 6598"),
+	ipv4Prefix("127.0.0.0/8", "RFC 1122"),
+	ipv4Prefix("169.254.0.0/16", "RFC 3927"),
+	ipv4Prefix("172.16.0.0/12", "RFC 1918"),
+	ipv4Prefix("192.0.0.0/24", "RFC 6890"),
+	ipv4Prefix("192.0.2.0/24", "RFC 5737"),
+	ipv4Prefix("192.88.99.0/24", "RFC 7526"),
+	ipv4Prefix("192.168.0.0/16", "RFC 1918"),
+	ipv4Prefix("198.18.0.0/15", "RFC 2544"),
+	ipv4Prefix("198.51.100.0/24", "RFC 5737"),
+	ipv4Prefix("203.0.113.0/24", "RFC 5737"),
+	ipv4Prefix("224.0.0.0/4", "RFC 5771"),
+	ipv4Prefix("240.0.0.0/4", "RFC 1112")
+];
+const nonPublicIPv6Prefixes = [
+	ipv6Prefix("::/16", "RFC 4291"),
+	ipv6Prefix("2001::/32", "RFC 4380"),
+	ipv6Prefix("2002::/16", "RFC 3056"),
+	ipv6Prefix("64:ff9b:1::/48", "RFC 8215"),
+	ipv6Prefix("fc00::/7", "RFC 4193"),
+	ipv6Prefix("fe80::/10", "RFC 4291"),
+	ipv6Prefix("ff00::/8", "RFC 4291")
+];
+const ipv6WithIPv4Prefixes = [{
+	...ipv6Prefix("64:ff9b::/96", "RFC 6052"),
+	extractIPv4: (words) => ipv4FromWords(words[6], words[7])
+}];
+function ipv4Prefix(cidr, rfc) {
+	const [address, prefixText] = cidr.split("/");
+	const prefix = parseInt(prefixText, 10);
+	const parts = parseIPv4Address(address);
+	if (parts == null || !Number.isInteger(prefix) || prefix < 0 || prefix > 32) throw new Error(`Invalid IPv4 prefix: ${cidr}`);
+	return {
+		cidr,
+		base: ipv4PartsToNumber(parts),
+		prefix,
+		rfc
+	};
+}
+function ipv6Prefix(cidr, rfc) {
+	const [address, prefixText] = cidr.split("/");
+	const prefix = parseInt(prefixText, 10);
+	const words = parseIPv6Address(address);
+	if (words == null || !Number.isInteger(prefix) || prefix < 0 || prefix > 128) throw new Error(`Invalid IPv6 prefix: ${cidr}`);
+	return {
+		cidr,
+		words,
+		prefix,
+		rfc
+	};
+}
+function parseIPv4Address(address) {
+	const parts = address.split(".").map((part) => {
+		if (!/^\d+$/.test(part)) return NaN;
+		return parseInt(part, 10);
+	});
+	if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) return null;
+	return parts;
+}
+function parseIPv6Address(address) {
+	const parts = expandIPv6Address(address).split(":");
+	if (parts.length !== 8) return null;
+	const words = parts.map((part) => {
+		if (!/^[0-9a-f]{1,4}$/i.test(part)) return NaN;
+		return parseInt(part, 16);
+	});
+	if (words.some((word) => !Number.isInteger(word) || word < 0 || word > 65535)) return null;
+	return words;
+}
+function ipv4PartsToNumber(parts) {
+	return parts[0] * 2 ** 24 + parts[1] * 2 ** 16 + parts[2] * 2 ** 8 + parts[3];
+}
+function ipv4FromWords(highWord, lowWord) {
+	return [
+		highWord >> 8,
+		highWord & 255,
+		lowWord >> 8,
+		lowWord & 255
+	].join(".");
+}
+function matchesIPv4Prefix(address, prefixBase, prefixLength) {
+	const blockSize = 2 ** (32 - prefixLength);
+	return Math.floor(address / blockSize) === Math.floor(prefixBase / blockSize);
+}
+function matchesIPv6Prefix(address, prefixWords, prefixLength) {
+	let remaining = prefixLength;
+	for (let i = 0; i < 8 && remaining > 0; i++) if (remaining >= 16) {
+		if (address[i] !== prefixWords[i]) return false;
+		remaining -= 16;
+	} else {
+		const mask = 65535 << 16 - remaining & 65535;
+		if ((address[i] & mask) !== (prefixWords[i] & mask)) return false;
+		remaining = 0;
+	}
+	return true;
+}
+//#endregion
 //#region src/docloader.ts
 const logger = getLogger([
 	"fedify",
@@ -4623,66 +4775,6 @@ const logger = getLogger([
 	"docloader"
 ]);
 const DEFAULT_MAX_REDIRECTION = 20;
-const MAX_HTML_SIZE = 1024 * 1024;
-function createResponseMetadata(response) {
-	return new Response(null, {
-		headers: response.headers,
-		status: response.status,
-		statusText: response.statusText
-	});
-}
-async function cancelResponseBody(response) {
-	if (response.body != null) await response.body.cancel();
-}
-async function readBoundedText(response, maxBytes) {
-	const contentLength = response.headers.get("Content-Length");
-	if (contentLength != null) {
-		const size = Number(contentLength);
-		if (size > maxBytes) {
-			await cancelResponseBody(response);
-			return {
-				text: "",
-				size,
-				tooLarge: true
-			};
-		}
-	}
-	if (response.body == null) return {
-		text: "",
-		size: 0,
-		tooLarge: false
-	};
-	const reader = response.body.getReader();
-	const decoder = new TextDecoder();
-	let text = "";
-	let size = 0;
-	try {
-		while (true) {
-			const result = await reader.read();
-			if (result.done) break;
-			const chunkSize = result.value.byteLength;
-			if (size + chunkSize > maxBytes) {
-				size += chunkSize;
-				await reader.cancel();
-				return {
-					text: "",
-					size,
-					tooLarge: true
-				};
-			}
-			size += chunkSize;
-			text += decoder.decode(result.value, { stream: true });
-		}
-		text += decoder.decode();
-		return {
-			text,
-			size,
-			tooLarge: false
-		};
-	} finally {
-		reader.releaseLock();
-	}
-}
 /**
 * Gets a {@link RemoteDocument} from the given response.
 * @param url The URL of the document to load.
@@ -4737,19 +4829,19 @@ async function getRemoteDocument(url, response, fetch) {
 	}
 	let document;
 	if (!jsonLd && (contentType === "text/html" || contentType?.startsWith("text/html;") || contentType === "application/xhtml+xml" || contentType?.startsWith("application/xhtml+xml;"))) {
-		const errorResponse = createResponseMetadata(response);
-		const html = await readBoundedText(response, MAX_HTML_SIZE);
-		if (html.tooLarge) {
+		const MAX_HTML_SIZE = 1024 * 1024;
+		const html = await response.text();
+		if (html.length > MAX_HTML_SIZE) {
 			logger.warn("HTML response too large, skipping alternate link discovery: {url}", {
 				url: documentUrl,
-				size: html.size
+				size: html.length
 			});
-			throw new FetchError(documentUrl, `HTML document is too large to scan for an ActivityPub alternate link (Content-Type: ${contentType})`, errorResponse);
+			document = JSON.parse(html);
 		} else {
 			const tagPattern = /<(a|link)\s+([^>]*?)\s*\/?>/gi;
 			const attrPattern = /([a-z][a-z:_-]*)=(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi;
 			let tagMatch;
-			while ((tagMatch = tagPattern.exec(html.text)) !== null) {
+			while ((tagMatch = tagPattern.exec(html)) !== null) {
 				const tagContent = tagMatch[2];
 				let attrMatch;
 				const attribs = {};
@@ -4766,12 +4858,7 @@ async function getRemoteDocument(url, response, fetch) {
 					return await fetch(new URL(attribs.href, docUrl).href);
 				}
 			}
-			try {
-				document = JSON.parse(html.text);
-			} catch (error) {
-				if (!(error instanceof SyntaxError)) throw error;
-				throw new FetchError(documentUrl, `HTML document has no ActivityPub alternate link (Content-Type: ${contentType})`, errorResponse);
-			}
+			document = JSON.parse(html);
 		}
 	} else document = await response.json();
 	logger.debug("Fetched document: {status} {url} {headers}", {
@@ -5249,11 +5336,6 @@ const algorithms = {
 	},
 	"1.3.101.112": "Ed25519"
 };
-const DID_KEY_PREFIX = "did:key:";
-const ED25519_PUBLIC_KEY_MULTICODEC = 237;
-const ED25519_PUBLIC_KEY_LENGTH = 32;
-const DID_KEY_PATTERN = /^did:key:([^/?#]+)$/;
-const DID_KEY_VERIFICATION_METHOD_PATTERN = /^did:key:([^/?#]+)#([^/?#]+)$/;
 /**
 * Imports a PEM-SPKI formatted public key.
 * @param pem The PEM-SPKI formatted public key.
@@ -5315,69 +5397,6 @@ const PKCS1_HEADER = /^\s*-----BEGIN\s+RSA\s+PUBLIC\s+KEY-----\s*\n/;
 function importPem(pem) {
 	return PKCS1_HEADER.test(pem) ? importPkcs1(pem) : importSpki(pem);
 }
-function decodeEd25519DidKeyMultibase(multibaseKey) {
-	if (!multibaseKey.startsWith("z")) throw new TypeError("did:key must use base58-btc Multibase encoding.");
-	let decoded;
-	try {
-		decoded = decodeMultibase(multibaseKey);
-	} catch (error) {
-		throw new TypeError("Invalid did:key Multibase encoding.", { cause: error });
-	}
-	const { code } = getMulticodecPrefix(decoded);
-	if (code !== ED25519_PUBLIC_KEY_MULTICODEC) throw new TypeError("Unsupported did:key type: 0x" + code.toString(16));
-	const content = removeMulticodecPrefix(decoded);
-	if (content.length !== ED25519_PUBLIC_KEY_LENGTH) throw new TypeError("Invalid Ed25519 did:key length.");
-	return content;
-}
-/**
-* Imports an Ed25519 `did:key` DID.
-*
-* @param did The `did:key` DID.
-* @returns The imported Ed25519 public key.
-* @throws {TypeError} If the DID is malformed or uses an unsupported key type.
-* @since 2.4.0
-*/
-async function importDidKey(did) {
-	const match = (did instanceof URL ? did.href : did).match(DID_KEY_PATTERN);
-	if (match == null) throw new TypeError("Invalid did:key DID.");
-	const content = decodeEd25519DidKeyMultibase(match[1]);
-	return await crypto.subtle.importKey("raw", content.slice(), "Ed25519", true, ["verify"]);
-}
-/**
-* Exports an Ed25519 public key as a `did:key` DID.
-*
-* @param key The Ed25519 public key.
-* @returns The `did:key` DID.
-* @throws {TypeError} If the key is invalid or unsupported.
-* @since 2.4.0
-*/
-async function exportDidKey(key) {
-	if (key.algorithm.name !== "Ed25519") throw new TypeError("Unsupported key type: " + JSON.stringify(key.algorithm));
-	return DID_KEY_PREFIX + await exportMultibaseKey(key);
-}
-/**
-* Parses an Ed25519 `did:key` verification method DID URL.
-*
-* @param didUrl The `did:key` DID URL.
-* @returns The parsed verification method.
-* @throws {TypeError} If the DID URL is malformed, unsupported, or its
-*                     fragment does not identify the same key as the DID.
-* @since 2.4.0
-*/
-async function parseDidKeyVerificationMethod(didUrl) {
-	const didUrlString = didUrl instanceof URL ? didUrl.href : didUrl;
-	const match = didUrlString.match(DID_KEY_VERIFICATION_METHOD_PATTERN);
-	if (match == null) throw new TypeError("Invalid did:key verification method.");
-	const [, publicKeyMultibase, fragment] = match;
-	if (publicKeyMultibase !== fragment) throw new TypeError("Invalid did:key verification method fragment.");
-	const publicKey = await importDidKey(DID_KEY_PREFIX + publicKeyMultibase);
-	return {
-		id: new URL(didUrlString),
-		controller: new URL(DID_KEY_PREFIX + publicKeyMultibase),
-		publicKeyMultibase,
-		publicKey
-	};
-}
 /**
 * Imports a [Multibase]-encoded public key.
 *
@@ -5544,4 +5563,4 @@ LanguageString.prototype[Symbol.for("nodejs.util.inspect.custom")] = function(_d
 	return `<${this.locale.baseName}> ${inspect(this.toString(), options)}`;
 };
 //#endregion
-export { FetchError, LanguageString, UrlError, canParseDecimal, createActivityPubRequest, decodeMultibase, encodeMultibase, encodingFromBaseData, expandIPv6Address, exportDidKey, exportMultibaseKey, exportSpki, formatIri, getDocumentLoader, getRemoteDocument, getUserAgent, haveSameIriOrigin, importDidKey, importMultibaseKey, importPem, importPkcs1, importSpki, isDecimal, isValidPublicIPv4Address, isValidPublicIPv6Address, logRequest, parseDecimal, parseDidKeyVerificationMethod, parseIri, parseJsonLdId, preloadedContexts, validatePublicUrl };
+export { FetchError, LanguageString, UrlError, canParseDecimal, createActivityPubRequest, decodeMultibase, encodeMultibase, encodingFromBaseData, expandIPv6Address, exportMultibaseKey, exportSpki, getDocumentLoader, getRemoteDocument, getUserAgent, importMultibaseKey, importPem, importPkcs1, importSpki, isDecimal, isValidPublicIPv4Address, isValidPublicIPv6Address, logRequest, parseDecimal, preloadedContexts, validatePublicUrl };

package/dist/tests/decimal.test.cjs

@@ -1,7 +1,7 @@
 require("./chunk-C2EiDwsr.cjs");
-require("./docloader-BcaQHb0Q.cjs");
-require("./url-2XwVbUS_.cjs");
-require("./key-_wXwomh_.cjs");
+require("./docloader-mvgIWKI7.cjs");
+require("./url-C20FhC7p.cjs");
+require("./key-pMmqUKuo.cjs");
 require("./multibase-Bz_UUDtL.cjs");
 require("./langstr-CbAxaeEZ.cjs");
 let node_assert = require("node:assert");

package/dist/tests/decimal.test.mjs

@@ -1,6 +1,6 @@
-import "./docloader-D61oV0K1.mjs";
-import "./url-YWJbnRlf.mjs";
-import "./key-CDGDH_vC.mjs";
+import "./docloader-C76ldE5C.mjs";
+import "./url-m9Qzxy-Y.mjs";
+import "./key-CrrK9mYh.mjs";
 import "./multibase-B4bvakyA.mjs";
 import "./langstr-Di5AvKpB.mjs";
 import { deepStrictEqual, throws } from "node:assert";

package/dist/tests/{docloader-D61oV0K1.mjs → docloader-C76ldE5C.mjs}

@@ -1,6 +1,6 @@
-import { a as name, i as logRequest, n as createActivityPubRequest, o as version, t as FetchError } from "./request-Cn0vP7Hj.mjs";
+import { a as name, i as logRequest, n as createActivityPubRequest, o as version, t as FetchError } from "./request-BEXkv1ul.mjs";
 import { t as HttpHeaderLink } from "./link-NUUWCdnK.mjs";
-import { l as validatePublicUrl, t as UrlError } from "./url-YWJbnRlf.mjs";
+import { a as validatePublicUrl, t as UrlError } from "./url-m9Qzxy-Y.mjs";
 import { getLogger } from "@logtape/logtape";
 import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
 //#endregion
@@ -4277,28 +4277,6 @@ const preloadedContexts = {
 			"@type": "@id"
 		}
 	} },
-	"https://w3id.org/fep/7aa9": { "@context": {
-		"FeaturedCollection": "https://w3id.org/fep/7aa9#FeaturedCollection",
-		"FeaturedItem": "https://w3id.org/fep/7aa9#FeaturedItem",
-		"FeatureRequest": "https://w3id.org/fep/7aa9#FeatureRequest",
-		"FeatureAuthorization": "https://w3id.org/fep/7aa9#FeatureAuthorization",
-		"topic": {
-			"@id": "https://w3id.org/fep/7aa9#topic",
-			"@type": "@id"
-		},
-		"featuredObject": {
-			"@id": "https://w3id.org/fep/7aa9#featuredObject",
-			"@type": "@id"
-		},
-		"canFeature": {
-			"@id": "https://w3id.org/fep/7aa9#canFeature",
-			"@type": "@id"
-		},
-		"featureAuthorization": {
-			"@id": "https://w3id.org/fep/7aa9#featureAuthorization",
-			"@type": "@id"
-		}
-	} },
 	"https://join-lemmy.org/context.json": { "@context": ["https://w3id.org/security/v1", {
 		"as": "https://www.w3.org/ns/activitystreams#",
 		"lemmy": "https://join-lemmy.org/ns#",
@@ -4362,66 +4340,6 @@ const logger = getLogger([
 	"docloader"
 ]);
 const DEFAULT_MAX_REDIRECTION = 20;
-const MAX_HTML_SIZE = 1024 * 1024;
-function createResponseMetadata(response) {
-	return new Response(null, {
-		headers: response.headers,
-		status: response.status,
-		statusText: response.statusText
-	});
-}
-async function cancelResponseBody(response) {
-	if (response.body != null) await response.body.cancel();
-}
-async function readBoundedText(response, maxBytes) {
-	const contentLength = response.headers.get("Content-Length");
-	if (contentLength != null) {
-		const size = Number(contentLength);
-		if (size > maxBytes) {
-			await cancelResponseBody(response);
-			return {
-				text: "",
-				size,
-				tooLarge: true
-			};
-		}
-	}
-	if (response.body == null) return {
-		text: "",
-		size: 0,
-		tooLarge: false
-	};
-	const reader = response.body.getReader();
-	const decoder = new TextDecoder();
-	let text = "";
-	let size = 0;
-	try {
-		while (true) {
-			const result = await reader.read();
-			if (result.done) break;
-			const chunkSize = result.value.byteLength;
-			if (size + chunkSize > maxBytes) {
-				size += chunkSize;
-				await reader.cancel();
-				return {
-					text: "",
-					size,
-					tooLarge: true
-				};
-			}
-			size += chunkSize;
-			text += decoder.decode(result.value, { stream: true });
-		}
-		text += decoder.decode();
-		return {
-			text,
-			size,
-			tooLarge: false
-		};
-	} finally {
-		reader.releaseLock();
-	}
-}
 /**
 * Gets a {@link RemoteDocument} from the given response.
 * @param url The URL of the document to load.
@@ -4476,19 +4394,19 @@ async function getRemoteDocument(url, response, fetch) {
 	}
 	let document;
 	if (!jsonLd && (contentType === "text/html" || contentType?.startsWith("text/html;") || contentType === "application/xhtml+xml" || contentType?.startsWith("application/xhtml+xml;"))) {
-		const errorResponse = createResponseMetadata(response);
-		const html = await readBoundedText(response, MAX_HTML_SIZE);
-		if (html.tooLarge) {
+		const MAX_HTML_SIZE = 1024 * 1024;
+		const html = await response.text();
+		if (html.length > MAX_HTML_SIZE) {
 			logger.warn("HTML response too large, skipping alternate link discovery: {url}", {
 				url: documentUrl,
-				size: html.size
+				size: html.length
 			});
-			throw new FetchError(documentUrl, `HTML document is too large to scan for an ActivityPub alternate link (Content-Type: ${contentType})`, errorResponse);
+			document = JSON.parse(html);
 		} else {
 			const tagPattern = /<(a|link)\s+([^>]*?)\s*\/?>/gi;
 			const attrPattern = /([a-z][a-z:_-]*)=(?:"([^"]*)"|'([^']*)'|([^\s>]+))/gi;
 			let tagMatch;
-			while ((tagMatch = tagPattern.exec(html.text)) !== null) {
+			while ((tagMatch = tagPattern.exec(html)) !== null) {
 				const tagContent = tagMatch[2];
 				let attrMatch;
 				const attribs = {};
@@ -4505,12 +4423,7 @@ async function getRemoteDocument(url, response, fetch) {
 					return await fetch(new URL(attribs.href, docUrl).href);
 				}
 			}
-			try {
-				document = JSON.parse(html.text);
-			} catch (error) {
-				if (!(error instanceof SyntaxError)) throw error;
-				throw new FetchError(documentUrl, `HTML document has no ActivityPub alternate link (Content-Type: ${contentType})`, errorResponse);
-			}
+			document = JSON.parse(html);
 		}
 	} else document = await response.json();
 	logger.debug("Fetched document: {status} {url} {headers}", {
@@ -4615,4 +4528,4 @@ function getDocumentLoader({ allowPrivateAddress, maxRedirection, skipPreloadedC
 	return load;
 }
 //#endregion
-export { getRemoteDocument as n, preloadedContexts as r, getDocumentLoader as t };
+export { preloadedContexts as n, getDocumentLoader as t };