@fedify/vocab-runtime 2.4.0-dev.1962 → 2.4.0-dev.1988

package/dist/tests/docloader.test.mjs

@@ -1,8 +1,10 @@
-import { i as cid_v1_default, n as getRemoteDocument, r as preloadedContexts, t as getDocumentLoader } from "./docloader-cQ5_cV6R.mjs";
-import { t as FetchError } from "./request-CywSvOoa.mjs";
+import { t as FetchError } from "./request-Bo1iqGDW.mjs";
+import { i as cid_v1_default, n as getRemoteDocument, r as preloadedContexts, t as getDocumentLoader } from "./docloader-ZSduXDDg.mjs";
 import { t as UrlError } from "./url-Basm1L_c.mjs";
-import { deepStrictEqual, ok, rejects } from "node:assert";
 import { test } from "node:test";
+import { gzipSync } from "node:zlib";
+import { deepStrictEqual, ok, rejects } from "node:assert";
+import { createServer } from "node:http";
 //#region \0rolldown/runtime.js
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -1490,9 +1492,9 @@ test("getDocumentLoader()", async (t) => {
 			"Content-Length": String(1048577),
 			"Content-Type": "text/html; charset=utf-8"
 		} });
-		Object.defineProperty(response, "body", { value: { cancel: () => {
+		Object.defineProperty(response, "body", { value: new ReadableStream({ cancel() {
 			canceled = true;
-		} } });
+		} }) });
 		await rejects(() => getRemoteDocument("https://example.com/large-html-cancel", response, () => {
 			throw new Error("unexpected alternate fetch");
 		}), FetchError);
@@ -1645,5 +1647,82 @@ test("getDocumentLoader()", async (t) => {
 	});
 	esm_default.hardReset();
 });
+test("getDocumentLoader() bounds JSON, HTML, and alternate documents", async () => {
+	const url = "https://example.com/bounded";
+	esm_default.mockGlobal();
+	let oversized = true;
+	try {
+		esm_default.get(url, () => new Response("{\"name\":\"hello\"}", { headers: {
+			"Content-Type": "application/activity+json",
+			...oversized ? { "Content-Length": String(16777217) } : {}
+		} }));
+		const loader = getDocumentLoader({ allowPrivateAddress: true });
+		await rejects(loader(url), FetchError);
+		oversized = false;
+		deepStrictEqual((await loader(url)).document, { name: "hello" });
+		oversized = true;
+		esm_default.get(`${url}/html`, () => new Response(" ".repeat(1048577), { headers: { "Content-Type": "text/html" } }));
+		await rejects(getDocumentLoader({ allowPrivateAddress: true })(`${url}/html`), FetchError);
+		esm_default.get(`${url}/alternate`, () => new Response("", { headers: {
+			"Content-Type": "text/html",
+			Link: `<${url}>; rel="alternate"; type="application/activity+json"`
+		} }));
+		await rejects(loader(`${url}/alternate`), FetchError);
+		esm_default.get(`${url}/redirect`, {
+			status: 302,
+			headers: { Location: url }
+		});
+		await rejects(loader(`${url}/redirect`), FetchError);
+	} finally {
+		esm_default.hardReset();
+	}
+});
+test("getDocumentLoader() rejects oversized gzip responses from fetch", async () => {
+	const document = { name: "a".repeat(16 * 1024 * 1024) };
+	const compressed = gzipSync(JSON.stringify(document));
+	ok(compressed.byteLength < 64 * 1024);
+	const server = createServer((request, response) => {
+		const body = request.url === "/small" ? gzipSync("{\"name\":\"hello\"}") : compressed;
+		response.writeHead(200, {
+			"Content-Type": "application/activity+json",
+			"Content-Encoding": "gzip",
+			"Content-Length": body.byteLength
+		});
+		response.end(body);
+	});
+	await new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(0, "127.0.0.1", resolve);
+	});
+	try {
+		const address = server.address();
+		ok(address != null && typeof address !== "string");
+		const url = `http://127.0.0.1:${address.port}/document`;
+		await rejects(getDocumentLoader({ allowPrivateAddress: true })(url), FetchError);
+		deepStrictEqual((await getDocumentLoader({ allowPrivateAddress: true })(new URL("/small", url).href)).document, { name: "hello" });
+	} finally {
+		await new Promise((resolve, reject) => {
+			server.close((error) => error == null ? resolve() : reject(error));
+			server.closeAllConnections();
+		});
+	}
+});
+test("getRemoteDocument() bounds JSON by default", async () => {
+	let canceled = false;
+	let pulls = 0;
+	await rejects(getRemoteDocument("https://example.com/document", new Response(new ReadableStream({
+		pull(controller) {
+			pulls++;
+			controller.enqueue(new Uint8Array(64 * 1024).fill(32));
+		},
+		cancel() {
+			canceled = true;
+		}
+	}, { highWaterMark: 0 })), () => {
+		throw new Error("Unexpected alternate document");
+	}), FetchError);
+	deepStrictEqual(canceled, true);
+	deepStrictEqual(pulls, 257);
+});
 //#endregion
 export {};

package/dist/tests/internal/multicodec.test.cjs

@@ -1,6 +1,6 @@
 const require_multicodec = require("../multicodec-CLRPeW4N.cjs");
-let node_assert = require("node:assert");
 let node_test = require("node:test");
+let node_assert = require("node:assert");
 //#region src/internal/multicodec.test.ts
 (0, node_test.test)("getMulticodecPrefix() decodes supported multicodec prefixes", () => {
 	(0, node_assert.deepStrictEqual)(require_multicodec.getMulticodecPrefix(Uint8Array.from([

package/dist/tests/internal/multicodec.test.mjs

@@ -1,6 +1,6 @@
 import { n as getMulticodecPrefix, r as removeMulticodecPrefix, t as addMulticodecPrefix } from "../multicodec-CRIj_05H.mjs";
-import { deepStrictEqual, throws } from "node:assert";
 import { test } from "node:test";
+import { deepStrictEqual, throws } from "node:assert";
 //#region src/internal/multicodec.test.ts
 test("getMulticodecPrefix() decodes supported multicodec prefixes", () => {
 	deepStrictEqual(getMulticodecPrefix(Uint8Array.from([

package/dist/tests/jsonld-cache.test.cjs

@@ -1,7 +1,7 @@
 const require_rolldown_runtime = require("./rolldown-runtime-emK7D4bc.cjs");
 const require_url = require("./url-CPfMatUL.cjs");
-let node_assert = require("node:assert");
 let node_test = require("node:test");
+let node_assert = require("node:assert");
 let jsonld_dist_jsonld_esm_js = require("jsonld/dist/jsonld.esm.js");
 jsonld_dist_jsonld_esm_js = require_rolldown_runtime.__toESM(jsonld_dist_jsonld_esm_js, 1);
 //#region src/jsonld.ts

package/dist/tests/jsonld-cache.test.mjs

@@ -1,6 +1,6 @@
 import { a as formatIri, c as haveSameIriOrigin, p as parseIri, s as haveSameFe34Origin } from "./url-Basm1L_c.mjs";
-import { deepStrictEqual, ok, strictEqual } from "node:assert";
 import { test } from "node:test";
+import { deepStrictEqual, ok, strictEqual } from "node:assert";
 import jsonld from "jsonld/dist/jsonld.esm.js";
 //#region src/jsonld.ts
 var jsonld_default = jsonld;

package/dist/tests/key.test.cjs

@@ -1,8 +1,8 @@
 const require_multicodec = require("./multicodec-CLRPeW4N.cjs");
 const require_key = require("./key-8Qg2SbZi.cjs");
 const require_multibase = require("./multibase-B5Mea7Ip.cjs");
-let node_assert = require("node:assert");
 let node_test = require("node:test");
+let node_assert = require("node:assert");
 //#region src/key.test.ts
 const rsaSpki = "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxsRuvCkgJtflBTl4OVsm\nnt/J1mQfZasfJtN33dcZ3d1lJroxmgmMu69zjGEAwkNbMQaWNLqC4eogkJaeJ4RR\n5MHYXkL9nNilVoTkjX5BVit3puzs7XJ7WQnKQgQMI+ezn24GHsZ/v1JIo77lerX5\nk4HNwTNVt+yaZVQWaOMR3+6FwziQR6kd0VuG9/a9dgAnz2cEoORRC1i4W7IZaB1s\nZnh1WbHbevlGd72HSXll5rocPIHn8gq6xpBgpHwRphlRsgn4KHaJ6brXDIJjrnQh\nIe/YUBOGj/ImSEXhRwlFerKsoAVnZ0Hwbfa46qk44TAt8CyoPMWmpK6pt0ng4pQ2\nuwIDAQAB\n-----END PUBLIC KEY-----\n";
 const rsaPkcs1 = "-----BEGIN RSA PUBLIC KEY-----\nMIIBCgKCAQEAxsRuvCkgJtflBTl4OVsmnt/J1mQfZasfJtN33dcZ3d1lJroxmgmM\nu69zjGEAwkNbMQaWNLqC4eogkJaeJ4RR5MHYXkL9nNilVoTkjX5BVit3puzs7XJ7\nWQnKQgQMI+ezn24GHsZ/v1JIo77lerX5k4HNwTNVt+yaZVQWaOMR3+6FwziQR6kd\n0VuG9/a9dgAnz2cEoORRC1i4W7IZaB1sZnh1WbHbevlGd72HSXll5rocPIHn8gq6\nxpBgpHwRphlRsgn4KHaJ6brXDIJjrnQhIe/YUBOGj/ImSEXhRwlFerKsoAVnZ0Hw\nbfa46qk44TAt8CyoPMWmpK6pt0ng4pQ2uwIDAQAB\n-----END RSA PUBLIC KEY-----\n";

package/dist/tests/key.test.mjs

@@ -1,8 +1,8 @@
 import { t as addMulticodecPrefix } from "./multicodec-CRIj_05H.mjs";
 import { a as importMultibaseKey, c as importSpki, d as importJwk, i as importDidKey, l as parseDidKeyVerificationMethod, n as exportMultibaseKey, o as importPem, r as exportSpki, s as importPkcs1, t as exportDidKey, u as exportJwk } from "./key-C7MNhlkO.mjs";
 import { n as encodeMultibase } from "./multibase-BPnF_L4e.mjs";
-import { deepStrictEqual, rejects } from "node:assert";
 import { test } from "node:test";
+import { deepStrictEqual, rejects } from "node:assert";
 //#region src/key.test.ts
 const rsaSpki = "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxsRuvCkgJtflBTl4OVsm\nnt/J1mQfZasfJtN33dcZ3d1lJroxmgmMu69zjGEAwkNbMQaWNLqC4eogkJaeJ4RR\n5MHYXkL9nNilVoTkjX5BVit3puzs7XJ7WQnKQgQMI+ezn24GHsZ/v1JIo77lerX5\nk4HNwTNVt+yaZVQWaOMR3+6FwziQR6kd0VuG9/a9dgAnz2cEoORRC1i4W7IZaB1s\nZnh1WbHbevlGd72HSXll5rocPIHn8gq6xpBgpHwRphlRsgn4KHaJ6brXDIJjrnQh\nIe/YUBOGj/ImSEXhRwlFerKsoAVnZ0Hwbfa46qk44TAt8CyoPMWmpK6pt0ng4pQ2\nuwIDAQAB\n-----END PUBLIC KEY-----\n";
 const rsaPkcs1 = "-----BEGIN RSA PUBLIC KEY-----\nMIIBCgKCAQEAxsRuvCkgJtflBTl4OVsmnt/J1mQfZasfJtN33dcZ3d1lJroxmgmM\nu69zjGEAwkNbMQaWNLqC4eogkJaeJ4RR5MHYXkL9nNilVoTkjX5BVit3puzs7XJ7\nWQnKQgQMI+ezn24GHsZ/v1JIo77lerX5k4HNwTNVt+yaZVQWaOMR3+6FwziQR6kd\n0VuG9/a9dgAnz2cEoORRC1i4W7IZaB1sZnh1WbHbevlGd72HSXll5rocPIHn8gq6\nxpBgpHwRphlRsgn4KHaJ6brXDIJjrnQhIe/YUBOGj/ImSEXhRwlFerKsoAVnZ0Hw\nbfa46qk44TAt8CyoPMWmpK6pt0ng4pQ2uwIDAQAB\n-----END RSA PUBLIC KEY-----\n";

package/dist/tests/langstr.test.cjs

@@ -1,7 +1,7 @@
 const require_rolldown_runtime = require("./rolldown-runtime-emK7D4bc.cjs");
 const require_langstr = require("./langstr-C4Fl80ae.cjs");
-let node_assert = require("node:assert");
 let node_test = require("node:test");
+let node_assert = require("node:assert");
 let node_util = require("node:util");
 node_util = require_rolldown_runtime.__toESM(node_util, 1);
 //#region src/langstr.test.ts

package/dist/tests/langstr.test.mjs

@@ -1,6 +1,6 @@
 import { t as LanguageString } from "./langstr-CQ26J_L7.mjs";
-import { deepStrictEqual } from "node:assert";
 import { test } from "node:test";
+import { deepStrictEqual } from "node:assert";
 import util from "node:util";
 //#region src/langstr.test.ts
 test("new LanguageString()", () => {

package/dist/tests/link.test.cjs

@@ -1,6 +1,6 @@
 const require_link = require("./link-DlKm8bEr.cjs");
-let node_assert = require("node:assert");
 let node_test = require("node:test");
+let node_assert = require("node:assert");
 //#region src/link.test.ts
 (0, node_test.test)("String Good 1", () => {
 	const instance = new require_link.HttpHeaderLink(`<https://example.com>; rel="preconnect"`);

package/dist/tests/link.test.mjs

@@ -1,6 +1,6 @@
 import { t as HttpHeaderLink } from "./link-Cevmc87v.mjs";
-import { deepStrictEqual, throws } from "node:assert";
 import { test } from "node:test";
+import { deepStrictEqual, throws } from "node:assert";
 //#region src/link.test.ts
 test("String Good 1", () => {
 	const instance = new HttpHeaderLink(`<https://example.com>; rel="preconnect"`);

package/dist/tests/multibase/multibase.test.cjs

@@ -1,6 +1,6 @@
 const require_multibase = require("../multibase-B5Mea7Ip.cjs");
-let node_assert = require("node:assert");
 let node_test = require("node:test");
+let node_assert = require("node:assert");
 //#region src/multibase/multibase.test.ts
 (0, node_test.test)("multibase.encode and decode", async (t) => {
 	const testCases = [

package/dist/tests/multibase/multibase.test.mjs

@@ -1,6 +1,6 @@
 import { a as names, i as codes, n as encodeMultibase, o as decodeText, s as encodeText, t as decodeMultibase } from "../multibase-BPnF_L4e.mjs";
-import { deepStrictEqual } from "node:assert";
 import { test } from "node:test";
+import { deepStrictEqual } from "node:assert";
 //#region src/multibase/multibase.test.ts
 test("multibase.encode and decode", async (t) => {
 	const testCases = [

package/dist/tests/{request-me46Cb_a.cjs → request-B3YkikPO.cjs}

@@ -3,7 +3,7 @@ let node_process = require("node:process");
 node_process = require_rolldown_runtime.__toESM(node_process, 1);
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.4.0-dev.1962+8aaa5348";
+var version = "2.4.0-dev.1988+c5c9d617";
 //#endregion
 //#region src/request.ts
 /**

package/dist/tests/{request-CywSvOoa.mjs → request-Bo1iqGDW.mjs}

@@ -1,7 +1,7 @@
 import process from "node:process";
 //#region deno.json
 var name = "@fedify/vocab-runtime";
-var version = "2.4.0-dev.1962+8aaa5348";
+var version = "2.4.0-dev.1988+c5c9d617";
 //#endregion
 //#region src/request.ts
 /**

package/dist/tests/request.test.cjs

@@ -1,9 +1,9 @@
 const require_rolldown_runtime = require("./rolldown-runtime-emK7D4bc.cjs");
-const require_request = require("./request-me46Cb_a.cjs");
-let node_assert = require("node:assert");
+const require_request = require("./request-B3YkikPO.cjs");
 let node_test = require("node:test");
 let node_process = require("node:process");
 node_process = require_rolldown_runtime.__toESM(node_process, 1);
+let node_assert = require("node:assert");
 //#region src/request.test.ts
 (0, node_test.test)("getUserAgent()", () => {
 	if ("Deno" in globalThis) {

package/dist/tests/request.test.mjs

@@ -1,7 +1,7 @@
-import { o as version, r as getUserAgent } from "./request-CywSvOoa.mjs";
-import { deepStrictEqual } from "node:assert";
+import { o as version, r as getUserAgent } from "./request-Bo1iqGDW.mjs";
 import { test } from "node:test";
 import process from "node:process";
+import { deepStrictEqual } from "node:assert";
 //#region src/request.test.ts
 test("getUserAgent()", () => {
 	if ("Deno" in globalThis) {

package/dist/tests/temporal.test.cjs

@@ -1,5 +1,5 @@
-let node_assert = require("node:assert");
 let node_test = require("node:test");
+let node_assert = require("node:assert");
 let _js_temporal_polyfill = require("@js-temporal/polyfill");
 //#region src/temporal.ts
 /**

package/dist/tests/temporal.test.mjs

@@ -1,5 +1,5 @@
-import { strictEqual } from "node:assert";
 import { test } from "node:test";
+import { strictEqual } from "node:assert";
 import { Temporal } from "@js-temporal/polyfill";
 //#region src/temporal.ts
 /**

package/dist/tests/url.test.cjs

@@ -1,6 +1,6 @@
 const require_url = require("./url-CPfMatUL.cjs");
-let node_assert = require("node:assert");
 let node_test = require("node:test");
+let node_assert = require("node:assert");
 //#region src/url.test.ts
 (0, node_test.test)("parseIri() accepts portable ActivityPub URI schemes", () => {
 	for (const iri of [

package/dist/tests/url.test.mjs

@@ -1,6 +1,6 @@
 import { a as formatIri, c as haveSameIriOrigin, d as isValidPublicIPv6Address, f as parseGatewayUrl, g as validatePublicUrl, h as validateLookupAddresses, i as expandIPv6Address, l as isGatewayUrl, m as parseJsonLdId, n as arePortableUrisEqual, o as getFe34Origin, p as parseIri, r as canonicalizePortableUri, s as haveSameFe34Origin, t as UrlError, u as isValidPublicIPv4Address } from "./url-Basm1L_c.mjs";
-import { deepStrictEqual, ok, rejects, throws } from "node:assert";
 import { test } from "node:test";
+import { deepStrictEqual, ok, rejects, throws } from "node:assert";
 //#region src/url.test.ts
 test("parseIri() accepts portable ActivityPub URI schemes", () => {
 	for (const iri of [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fedify/vocab-runtime",
-  "version": "2.4.0-dev.1962+8aaa5348",
+  "version": "2.4.0-dev.1988+c5c9d617",
   "homepage": "https://fedify.dev/",
   "repository": {
     "type": "git",

package/src/body.test.ts

@@ -0,0 +1,125 @@
+import { deepStrictEqual, ok, rejects } from "node:assert/strict";
+import { test } from "node:test";
+import { gunzipSync, gzipSync } from "node:zlib";
+import { BodyTooLargeError, readBoundedText } from "./body.ts";
+
+const url = "https://example.com/document";
+
+test("readBoundedText handles empty bodies and flushes incomplete UTF-8", async () => {
+  deepStrictEqual(await readBoundedText(new Response(null), 1, url), "");
+  deepStrictEqual(await readBoundedText(new Response(""), 1, url), "");
+  deepStrictEqual(
+    await readBoundedText(new Response(new Uint8Array([0xe2, 0x82])), 2, url),
+    "\ufffd",
+  );
+});
+
+test("readBoundedText counts bytes and preserves split UTF-8", async () => {
+  const bytes = new TextEncoder().encode('"안녕"');
+  const stream = new ReadableStream<Uint8Array>({
+    start(controller) {
+      for (const byte of bytes) controller.enqueue(new Uint8Array([byte]));
+      controller.close();
+    },
+  });
+  deepStrictEqual(
+    await readBoundedText(new Response(stream), bytes.length, url),
+    '"안녕"',
+  );
+  await rejects(
+    readBoundedText(new Response(bytes), bytes.length - 1, url),
+    BodyTooLargeError,
+  );
+});
+
+test("readBoundedText rejects a declared oversized body without pulling", async () => {
+  let pulled = false;
+  let canceled = false;
+  const response = new Response(
+    new ReadableStream({
+      pull() {
+        pulled = true;
+      },
+      cancel() {
+        canceled = true;
+      },
+    }, { highWaterMark: 0 }),
+    { headers: { "Content-Length": "100" } },
+  );
+  await rejects(readBoundedText(response, 10, url), BodyTooLargeError);
+  deepStrictEqual(pulled, false);
+  deepStrictEqual(canceled, true);
+  deepStrictEqual(response.body?.locked, false);
+});
+
+test("readBoundedText cancels chunked bodies despite absent or false lengths", async () => {
+  for (const length of [undefined, "1", "invalid"]) {
+    let pulls = 0;
+    let canceled = false;
+    const stream = new ReadableStream<Uint8Array>({
+      pull(controller) {
+        pulls++;
+        controller.enqueue(new Uint8Array(4));
+      },
+      cancel() {
+        canceled = true;
+      },
+    }, { highWaterMark: 0 });
+    const response = new Response(stream, {
+      headers: length == null ? {} : { "Content-Length": length },
+    });
+    await rejects(readBoundedText(response, 8, url), BodyTooLargeError);
+    deepStrictEqual(pulls, 3);
+    deepStrictEqual(canceled, true);
+    deepStrictEqual(response.body?.locked, false);
+  }
+});
+
+test("readBoundedText limits decoded gzip bytes, not the compressed length", async () => {
+  const compressed = gzipSync('"' + "a".repeat(4096) + '"');
+  ok(compressed.length < 128);
+  const decoded = gunzipSync(compressed);
+  await rejects(
+    readBoundedText(
+      new Response(decoded, {
+        headers: {
+          "Content-Encoding": "gzip",
+          "Content-Length": String(compressed.length),
+        },
+      }),
+      128,
+      url,
+    ),
+    BodyTooLargeError,
+  );
+  // The encoded representation can also be larger than a valid decoded body.
+  deepStrictEqual(
+    await readBoundedText(
+      new Response("{}", {
+        headers: { "Content-Encoding": "gzip", "Content-Length": "22" },
+      }),
+      2,
+      url,
+    ),
+    "{}",
+  );
+});
+
+test("readBoundedText rejects invalid limits and releases failed streams", async () => {
+  for (const limit of [0, -1, NaN, Infinity, 1.5]) {
+    await rejects(readBoundedText(new Response("{}"), limit, url), RangeError);
+  }
+  const failure = new Error("broken stream");
+  const response = new Response(
+    new ReadableStream({
+      pull(controller) {
+        controller.error(failure);
+      },
+    }),
+  );
+  await rejects(
+    readBoundedText(response, 10, url),
+    (error) => error === failure,
+  );
+  deepStrictEqual(response.body?.locked, false);
+});

package/src/body.ts

@@ -0,0 +1,95 @@
+// Kept private in each package to avoid adding public API in a patch release.
+// TODO(Jiwon Kwon): Consolidate the duplicated body helpers in @fedify/vocab-runtime,
+// @fedify/webfinger, and @fedify/fedify into a shared implementation.
+import { getLogger } from "@logtape/logtape";
+import { FetchError } from "./request.ts";
+
+/** Decoded JSON body limit: 16 MiB.  @internal */
+export const MAX_BODY_SIZE: number = 16 * 1024 * 1024;
+
+/** A body exceeded the byte limit.  @internal */
+export class BodyTooLargeError extends FetchError {
+  /** Creates an error for a body exceeding the given limit. */
+  constructor(url: string | URL, maxBytes: number) {
+    super(url, `Body exceeds the limit of ${maxBytes} bytes`);
+    this.name = "BodyTooLargeError";
+  }
+}
+
+/** Validates a finite, positive byte limit.  @internal */
+function validateBodySizeLimit(maxBytes: number): void {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) {
+    throw new RangeError(
+      "The body size limit must be a positive safe integer.",
+    );
+  }
+}
+
+/**
+ * Reads UTF-8 text while limiting bytes received from the body stream.
+ * Fetch responses are already decompressed, so the stream count is authoritative.
+ * @param message The response or request to read.
+ * @param maxBytes The maximum number of decoded bytes to read.
+ * @param url The URL to include in errors and logs.
+ * @returns The decoded body text.
+ * @throws {BodyTooLargeError} If the body exceeds the limit.
+ * @internal
+ */
+export async function readBoundedText(
+  message: Pick<Request, "body" | "headers">,
+  maxBytes: number,
+  url: string | URL,
+): Promise<string> {
+  validateBodySizeLimit(maxBytes);
+  const reader = message.body?.getReader();
+  const tooLarge = (): never => {
+    getLogger(["fedify", "runtime", "body"]).warn(
+      "Body from {url} exceeds the limit of {maxBytes} bytes.",
+      { url: url.toString(), maxBytes },
+    );
+    throw new BodyTooLargeError(url, maxBytes);
+  };
+  try {
+    // Content-Length describes the encoded body when compression is used.
+    // Only use it as an early rejection for an unencoded body.
+    const length = message.headers.get("Content-Length");
+    const encoding = message.headers.get("Content-Encoding");
+    if (
+      (encoding == null || encoding.toLowerCase() === "identity") &&
+      length != null && /^\d+$/.test(length) && Number(length) > maxBytes
+    ) tooLarge();
+    if (reader == null) return "";
+    let size = 0;
+    const bounded = new ReadableStream<BufferSource>({
+      async pull(controller) {
+        const { done, value } = await reader.read();
+        if (done) {
+          controller.close();
+          return;
+        }
+        size += value.byteLength;
+        if (size > maxBytes) tooLarge();
+        controller.enqueue(value);
+      },
+    }, { highWaterMark: 0 });
+    const textReader = bounded.pipeThrough(new TextDecoderStream()).getReader();
+    try {
+      const chunks: string[] = [];
+      while (true) {
+        const { done, value } = await textReader.read();
+        if (done) break;
+        chunks.push(value);
+      }
+      return chunks.join("");
+    } finally {
+      textReader.releaseLock();
+    }
+  } catch (error) {
+    // A cloned inbox request is a tee.  Awaiting one branch's cancellation
+    // would deadlock until the other branch is canceled by the inbox handler.
+    if (reader != null) void reader.cancel(error).catch(() => {});
+    throw error;
+  } finally {
+    reader?.releaseLock();
+  }
+}

package/src/contexts/fep-22cd.json

@@ -0,0 +1,21 @@
+{
+  "@context": {
+    "fep-22cd": "https://w3id.org/fep/22cd#",
+    "schema": "https://schema.org/",
+    "xsd": "http://www.w3.org/2001/XMLSchema#",
+    "translations": { "@id": "fep-22cd:translations", "@container": "@set" },
+    "Translation": "fep-22cd:Translation",
+    "sourceUpdated": {
+      "@id": "fep-22cd:sourceUpdated",
+      "@type": "xsd:dateTime"
+    },
+    "translator": {
+      "@id": "schema:translator",
+      "@type": "@id",
+      "@container": "@set"
+    },
+    "inLanguage": "schema:inLanguage",
+    "translationOfWork": { "@id": "schema:translationOfWork", "@type": "@id" },
+    "isBasedOn": { "@id": "schema:isBasedOn", "@type": "@id" }
+  }
+}

package/src/contexts.ts

@@ -7,6 +7,7 @@ import activitystreams from "./contexts/activitystreams.json" with {
 };
 import cidV1Context from "./contexts/cid-v1.json" with { type: "json" };
 import didV1 from "./contexts/did-v1.json" with { type: "json" };
+import fep22cd from "./contexts/fep-22cd.json" with { type: "json" };
 import fep5711 from "./contexts/fep-5711.json" with { type: "json" };
 import fep7aa9 from "./contexts/fep-7aa9.json" with { type: "json" };
 import fepEf61 from "./contexts/fep-ef61.json" with { type: "json" };
@@ -38,6 +39,7 @@ const preloadedContexts: Record<string, unknown> = {
   "https://purl.archive.org/socialweb/webfinger": webfinger,
   "http://schema.org/": schemaorg,
   "https://gotosocial.org/ns": gotosocial,
+  "https://w3id.org/fep/22cd": fep22cd,
   "https://w3id.org/fep/5711": fep5711,
   "https://w3id.org/fep/7aa9": fep7aa9,