@fedify/vocab-runtime 2.4.0-pr.934.40 → 2.4.0

package/dist/portable-DqtfLy_1.d.cts

@@ -0,0 +1,160 @@
+/// <reference lib="esnext.temporal" />
+import { n as DocumentLoader } from "./docloader-CYwqh5Df.cjs";
+import { TracerProvider } from "@opentelemetry/api";
+
+//#region src/portable.d.ts
+/**
+* Options passed to a {@link PortableObjectVerifier}.
+* @since 2.4.0
+*/
+interface PortableObjectVerifierOptions {
+  /**
+  * The document loader for fetching remote documents, such as verification
+  * methods that are not `did:key` URLs.
+  */
+  readonly documentLoader?: DocumentLoader;
+  /**
+  * The document loader for fetching remote JSON-LD contexts.  During
+  * gateway dereferencing, this loader returns the same context documents
+  * that the vocabulary parser sees.
+  */
+  readonly contextLoader?: DocumentLoader;
+  /**
+  * The OpenTelemetry tracer provider.
+  */
+  readonly tracerProvider?: TracerProvider;
+  /**
+  * The URL the document was finally retrieved from, i.e., the `documentUrl`
+  * of the document loader's result, which may differ from the requested URL
+  * after redirects.  Trust decisions such as the [FEP-ef61] gateway trust
+  * policy for unsecured collections depend on it, so custom document loaders
+  * must report it truthfully.
+  *
+  * [FEP-ef61]: https://w3id.org/fep/ef61
+  * @since 2.4.0
+  */
+  readonly documentUrl?: URL;
+  /**
+  * The gateways that the caller explicitly passed to the accessor through
+  * its `gateways` option, in order.  It is `undefined` if the caller did not
+  * pass the option, and can be empty.
+  * @since 2.4.0
+  */
+  readonly gateways?: readonly URL[];
+  /**
+  * The gateways inferred from the reference, in order, when the caller did
+  * not pass the `gateways` option: the `@gateway` location hints of
+  * a portable IRI, the gateway named by an FEP-ef61 compatible identifier,
+  * or the WebFinger server of a portable actor.  They only tell where the
+  * document and related objects might be retrieved, and must not be
+  * trusted to act for the portable object's DID.
+  * @since 2.4.0
+  */
+  readonly gatewayHints?: readonly URL[];
+  /**
+  * The object whose property referred to the document, if the document was
+  * dereferenced through a property accessor.
+  * @since 2.4.0
+  */
+  readonly referrer?: PortableObjectReferrer;
+}
+/**
+* An object whose property referred to a portable object being verified.
+* Referrers form a chain: {@link PortableObjectReferrer.referrer} is the
+* object through which this referrer itself was obtained, and so on.
+* @since 2.4.0
+*/
+interface PortableObjectReferrer {
+  /**
+  * The referring vocabulary object.
+  */
+  readonly object: unknown;
+  /**
+  * The `@id` of the referring object, if any.
+  */
+  readonly id: URL | null;
+  /**
+  * The expanded URI of the property through which the referring object
+  * referred to the next object in the chain, e.g.,
+  * `https://www.w3.org/ns/activitystreams#outbox`.
+  */
+  readonly property: string;
+  /**
+  * How the referring object itself was accepted by a
+  * {@link PortableObjectVerifier} when it was dereferenced through gateways:
+  *
+  * - `"verified"`: accepted as verified, e.g., with a valid integrity proof.
+  * - `"unsecured"`: accepted without an integrity proof, e.g., as an
+  *   unsecured collection served by a trusted gateway.
+  *
+  * It is `undefined` if the referring object was not dereferenced through
+  * gateways, e.g., if it was embedded in another object or constructed by
+  * the application.
+  */
+  readonly acceptance?: "verified" | "unsecured";
+  /**
+  * The opaque collection context that a {@link PortableObjectVerifier}
+  * attached to the referring object when it accepted it.  See
+  * {@link PortableObjectVerification}.
+  */
+  readonly collectionContext?: unknown;
+  /**
+  * The referrer of the referring object, if any.
+  */
+  readonly referrer?: PortableObjectReferrer;
+  /**
+  * Whether the chain was cut off here because it was too long.  If `true`,
+  * the referring object may have a referrer which is not included.
+  */
+  readonly truncated?: boolean;
+}
+/**
+* The result of a {@link PortableObjectVerifier}.
+* @since 2.4.0
+*/
+type PortableObjectVerification = {
+  /** Whether the document is accepted. */readonly verified: false;
+} | {
+  /** Whether the document is accepted. */readonly verified: true;
+  /**
+  * Whether the document was accepted without an integrity proof, e.g., as
+  * an unsecured [FEP-ef61] collection served by a gateway that its owner
+  * lists.  Objects embedded in such a document are not trusted because of
+  * their origin; property accessors dereference and verify them one by
+  * one instead.
+  *
+  * [FEP-ef61]: https://w3id.org/fep/ef61
+  */
+  readonly unsecured?: boolean;
+  /**
+  * An opaque value that the verifier wants to receive again as
+  * {@link PortableObjectReferrer.collectionContext} when objects referred
+  * to by this document, such as collection pages, are verified.
+  */
+  readonly collectionContext?: unknown;
+};
+/**
+* A function that applies the [FEP-ef61] trust policy to a portable object
+* fetched through a gateway.
+*
+* It receives the fetched JSON-LD document as is, and resolves to an object
+* whose `verified` property tells whether the document is acceptable, e.g.,
+* whether it carries a valid [FEP-8b32] Object Integrity Proof made by the
+* DID in its portable ID.  `verifyPortableObject()` and
+* `verifyPortableObjectProof()` from `@fedify/fedify` satisfy this type, so
+* they can be passed as the `verifyPortableObject` option of generated
+* vocabulary accessors such as `Activity.getObject()`.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* [FEP-8b32]: https://w3id.org/fep/8b32
+*
+* @param document The fetched JSON-LD document.
+* @param options Loaders, tracing options, and where the document came from.
+* @returns An object whose `verified` property is `true` if and only if the
+*          document satisfies the policy.  Other properties, such as
+*          a failure reason, are logged when verification fails.
+* @since 2.4.0
+*/
+type PortableObjectVerifier = (document: unknown, options: PortableObjectVerifierOptions) => Promise<PortableObjectVerification>;
+//#endregion
+export { PortableObjectVerifierOptions as i, PortableObjectVerification as n, PortableObjectVerifier as r, PortableObjectReferrer as t };

package/dist/portable-DtWsu2yU.d.ts

@@ -0,0 +1,160 @@
+/// <reference lib="esnext.temporal" />
+import { n as DocumentLoader } from "./docloader-CYwqh5Df.js";
+import { TracerProvider } from "@opentelemetry/api";
+
+//#region src/portable.d.ts
+/**
+* Options passed to a {@link PortableObjectVerifier}.
+* @since 2.4.0
+*/
+interface PortableObjectVerifierOptions {
+  /**
+  * The document loader for fetching remote documents, such as verification
+  * methods that are not `did:key` URLs.
+  */
+  readonly documentLoader?: DocumentLoader;
+  /**
+  * The document loader for fetching remote JSON-LD contexts.  During
+  * gateway dereferencing, this loader returns the same context documents
+  * that the vocabulary parser sees.
+  */
+  readonly contextLoader?: DocumentLoader;
+  /**
+  * The OpenTelemetry tracer provider.
+  */
+  readonly tracerProvider?: TracerProvider;
+  /**
+  * The URL the document was finally retrieved from, i.e., the `documentUrl`
+  * of the document loader's result, which may differ from the requested URL
+  * after redirects.  Trust decisions such as the [FEP-ef61] gateway trust
+  * policy for unsecured collections depend on it, so custom document loaders
+  * must report it truthfully.
+  *
+  * [FEP-ef61]: https://w3id.org/fep/ef61
+  * @since 2.4.0
+  */
+  readonly documentUrl?: URL;
+  /**
+  * The gateways that the caller explicitly passed to the accessor through
+  * its `gateways` option, in order.  It is `undefined` if the caller did not
+  * pass the option, and can be empty.
+  * @since 2.4.0
+  */
+  readonly gateways?: readonly URL[];
+  /**
+  * The gateways inferred from the reference, in order, when the caller did
+  * not pass the `gateways` option: the `@gateway` location hints of
+  * a portable IRI, the gateway named by an FEP-ef61 compatible identifier,
+  * or the WebFinger server of a portable actor.  They only tell where the
+  * document and related objects might be retrieved, and must not be
+  * trusted to act for the portable object's DID.
+  * @since 2.4.0
+  */
+  readonly gatewayHints?: readonly URL[];
+  /**
+  * The object whose property referred to the document, if the document was
+  * dereferenced through a property accessor.
+  * @since 2.4.0
+  */
+  readonly referrer?: PortableObjectReferrer;
+}
+/**
+* An object whose property referred to a portable object being verified.
+* Referrers form a chain: {@link PortableObjectReferrer.referrer} is the
+* object through which this referrer itself was obtained, and so on.
+* @since 2.4.0
+*/
+interface PortableObjectReferrer {
+  /**
+  * The referring vocabulary object.
+  */
+  readonly object: unknown;
+  /**
+  * The `@id` of the referring object, if any.
+  */
+  readonly id: URL | null;
+  /**
+  * The expanded URI of the property through which the referring object
+  * referred to the next object in the chain, e.g.,
+  * `https://www.w3.org/ns/activitystreams#outbox`.
+  */
+  readonly property: string;
+  /**
+  * How the referring object itself was accepted by a
+  * {@link PortableObjectVerifier} when it was dereferenced through gateways:
+  *
+  * - `"verified"`: accepted as verified, e.g., with a valid integrity proof.
+  * - `"unsecured"`: accepted without an integrity proof, e.g., as an
+  *   unsecured collection served by a trusted gateway.
+  *
+  * It is `undefined` if the referring object was not dereferenced through
+  * gateways, e.g., if it was embedded in another object or constructed by
+  * the application.
+  */
+  readonly acceptance?: "verified" | "unsecured";
+  /**
+  * The opaque collection context that a {@link PortableObjectVerifier}
+  * attached to the referring object when it accepted it.  See
+  * {@link PortableObjectVerification}.
+  */
+  readonly collectionContext?: unknown;
+  /**
+  * The referrer of the referring object, if any.
+  */
+  readonly referrer?: PortableObjectReferrer;
+  /**
+  * Whether the chain was cut off here because it was too long.  If `true`,
+  * the referring object may have a referrer which is not included.
+  */
+  readonly truncated?: boolean;
+}
+/**
+* The result of a {@link PortableObjectVerifier}.
+* @since 2.4.0
+*/
+type PortableObjectVerification = {
+  /** Whether the document is accepted. */readonly verified: false;
+} | {
+  /** Whether the document is accepted. */readonly verified: true;
+  /**
+  * Whether the document was accepted without an integrity proof, e.g., as
+  * an unsecured [FEP-ef61] collection served by a gateway that its owner
+  * lists.  Objects embedded in such a document are not trusted because of
+  * their origin; property accessors dereference and verify them one by
+  * one instead.
+  *
+  * [FEP-ef61]: https://w3id.org/fep/ef61
+  */
+  readonly unsecured?: boolean;
+  /**
+  * An opaque value that the verifier wants to receive again as
+  * {@link PortableObjectReferrer.collectionContext} when objects referred
+  * to by this document, such as collection pages, are verified.
+  */
+  readonly collectionContext?: unknown;
+};
+/**
+* A function that applies the [FEP-ef61] trust policy to a portable object
+* fetched through a gateway.
+*
+* It receives the fetched JSON-LD document as is, and resolves to an object
+* whose `verified` property tells whether the document is acceptable, e.g.,
+* whether it carries a valid [FEP-8b32] Object Integrity Proof made by the
+* DID in its portable ID.  `verifyPortableObject()` and
+* `verifyPortableObjectProof()` from `@fedify/fedify` satisfy this type, so
+* they can be passed as the `verifyPortableObject` option of generated
+* vocabulary accessors such as `Activity.getObject()`.
+*
+* [FEP-ef61]: https://w3id.org/fep/ef61
+* [FEP-8b32]: https://w3id.org/fep/8b32
+*
+* @param document The fetched JSON-LD document.
+* @param options Loaders, tracing options, and where the document came from.
+* @returns An object whose `verified` property is `true` if and only if the
+*          document satisfies the policy.  Other properties, such as
+*          a failure reason, are logged when verification fails.
+* @since 2.4.0
+*/
+type PortableObjectVerifier = (document: unknown, options: PortableObjectVerifierOptions) => Promise<PortableObjectVerification>;
+//#endregion
+export { PortableObjectVerifierOptions as i, PortableObjectVerification as n, PortableObjectVerifier as r, PortableObjectReferrer as t };

package/dist/tests/body-CYiu9CO-.mjs

@@ -0,0 +1,130 @@
+import { t as FetchError } from "./request-DRaOaTqD.mjs";
+import { getLogger } from "@logtape/logtape";
+//#region src/body.ts
+/** Decoded JSON body limit: 16 MiB.  @internal */
+const MAX_BODY_SIZE = 16 * 1024 * 1024;
+/** A body exceeded the byte limit.  @internal */
+var BodyTooLargeError = class extends FetchError {
+	/** Creates an error for a body exceeding the given limit. */
+	constructor(url, maxBytes) {
+		super(url, `Body exceeds the limit of ${maxBytes} bytes`);
+		this.name = "BodyTooLargeError";
+	}
+};
+/** Validates a finite, positive byte limit.  @internal */
+function validateBodySizeLimit(maxBytes) {
+	if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new RangeError("The body size limit must be a positive safe integer.");
+}
+/**
+* Reads UTF-8 text while limiting bytes received from the body stream.
+* Fetch responses are already decompressed, so the stream count is authoritative.
+* @param message The response or request to read.
+* @param maxBytes The maximum number of decoded bytes to read.
+* @param url The URL to include in errors and logs.
+* @returns The decoded body text.
+* @throws {BodyTooLargeError} If the body exceeds the limit.
+* @internal
+*/
+async function readBoundedText(message, maxBytes, url) {
+	validateBodySizeLimit(maxBytes);
+	const reader = message.body?.getReader();
+	const tooLarge = () => {
+		getLogger([
+			"fedify",
+			"runtime",
+			"body"
+		]).warn("Body from {url} exceeds the limit of {maxBytes} bytes.", {
+			url: url.toString(),
+			maxBytes
+		});
+		throw new BodyTooLargeError(url, maxBytes);
+	};
+	try {
+		const length = message.headers.get("Content-Length");
+		const encoding = message.headers.get("Content-Encoding");
+		if ((encoding == null || encoding.toLowerCase() === "identity") && length != null && /^\d+$/.test(length) && Number(length) > maxBytes) tooLarge();
+		if (reader == null) return "";
+		let size = 0;
+		const textReader = new ReadableStream({ async pull(controller) {
+			const { done, value } = await reader.read();
+			if (done) {
+				controller.close();
+				return;
+			}
+			size += value.byteLength;
+			if (size > maxBytes) tooLarge();
+			controller.enqueue(value);
+		} }, { highWaterMark: 0 }).pipeThrough(new TextDecoderStream()).getReader();
+		try {
+			const chunks = [];
+			while (true) {
+				const { done, value } = await textReader.read();
+				if (done) break;
+				chunks.push(value);
+			}
+			return chunks.join("");
+		} finally {
+			textReader.releaseLock();
+		}
+	} catch (error) {
+		if (reader != null) reader.cancel(error).catch(() => {});
+		throw error;
+	} finally {
+		reader?.releaseLock();
+	}
+}
+/**
+* Reads raw bytes while limiting bytes received from the body stream.
+* Unlike {@link readBoundedText}, the bytes are returned as they were
+* received, without decoding.
+* @param message The response or request to read.
+* @param maxBytes The maximum number of decoded bytes to read.
+* @param url The URL to include in errors and logs.
+* @returns The body bytes.
+* @throws {BodyTooLargeError} If the body exceeds the limit.
+* @internal
+*/
+async function readBoundedBytes(message, maxBytes, url) {
+	validateBodySizeLimit(maxBytes);
+	const reader = message.body?.getReader();
+	const tooLarge = () => {
+		getLogger([
+			"fedify",
+			"runtime",
+			"body"
+		]).warn("Body from {url} exceeds the limit of {maxBytes} bytes.", {
+			url: url.toString(),
+			maxBytes
+		});
+		throw new BodyTooLargeError(url, maxBytes);
+	};
+	try {
+		const length = message.headers.get("Content-Length");
+		const encoding = message.headers.get("Content-Encoding");
+		if ((encoding == null || encoding.toLowerCase() === "identity") && length != null && /^\d+$/.test(length) && Number(length) > maxBytes) tooLarge();
+		if (reader == null) return /* @__PURE__ */ new Uint8Array(0);
+		const chunks = [];
+		let size = 0;
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			size += value.byteLength;
+			if (size > maxBytes) tooLarge();
+			chunks.push(value);
+		}
+		const bytes = new Uint8Array(size);
+		let offset = 0;
+		for (const chunk of chunks) {
+			bytes.set(chunk, offset);
+			offset += chunk.byteLength;
+		}
+		return bytes;
+	} catch (error) {
+		if (reader != null) reader.cancel(error).catch(() => {});
+		throw error;
+	} finally {
+		reader?.releaseLock();
+	}
+}
+//#endregion
+export { readBoundedText as i, MAX_BODY_SIZE as n, readBoundedBytes as r, BodyTooLargeError as t };

package/dist/tests/body-CkEwROsn.cjs

@@ -0,0 +1,153 @@
+const require_request = require("./request-8vPWtV1-.cjs");
+let _logtape_logtape = require("@logtape/logtape");
+//#region src/body.ts
+/** Decoded JSON body limit: 16 MiB.  @internal */
+const MAX_BODY_SIZE = 16 * 1024 * 1024;
+/** A body exceeded the byte limit.  @internal */
+var BodyTooLargeError = class extends require_request.FetchError {
+	/** Creates an error for a body exceeding the given limit. */
+	constructor(url, maxBytes) {
+		super(url, `Body exceeds the limit of ${maxBytes} bytes`);
+		this.name = "BodyTooLargeError";
+	}
+};
+/** Validates a finite, positive byte limit.  @internal */
+function validateBodySizeLimit(maxBytes) {
+	if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) throw new RangeError("The body size limit must be a positive safe integer.");
+}
+/**
+* Reads UTF-8 text while limiting bytes received from the body stream.
+* Fetch responses are already decompressed, so the stream count is authoritative.
+* @param message The response or request to read.
+* @param maxBytes The maximum number of decoded bytes to read.
+* @param url The URL to include in errors and logs.
+* @returns The decoded body text.
+* @throws {BodyTooLargeError} If the body exceeds the limit.
+* @internal
+*/
+async function readBoundedText(message, maxBytes, url) {
+	validateBodySizeLimit(maxBytes);
+	const reader = message.body?.getReader();
+	const tooLarge = () => {
+		(0, _logtape_logtape.getLogger)([
+			"fedify",
+			"runtime",
+			"body"
+		]).warn("Body from {url} exceeds the limit of {maxBytes} bytes.", {
+			url: url.toString(),
+			maxBytes
+		});
+		throw new BodyTooLargeError(url, maxBytes);
+	};
+	try {
+		const length = message.headers.get("Content-Length");
+		const encoding = message.headers.get("Content-Encoding");
+		if ((encoding == null || encoding.toLowerCase() === "identity") && length != null && /^\d+$/.test(length) && Number(length) > maxBytes) tooLarge();
+		if (reader == null) return "";
+		let size = 0;
+		const textReader = new ReadableStream({ async pull(controller) {
+			const { done, value } = await reader.read();
+			if (done) {
+				controller.close();
+				return;
+			}
+			size += value.byteLength;
+			if (size > maxBytes) tooLarge();
+			controller.enqueue(value);
+		} }, { highWaterMark: 0 }).pipeThrough(new TextDecoderStream()).getReader();
+		try {
+			const chunks = [];
+			while (true) {
+				const { done, value } = await textReader.read();
+				if (done) break;
+				chunks.push(value);
+			}
+			return chunks.join("");
+		} finally {
+			textReader.releaseLock();
+		}
+	} catch (error) {
+		if (reader != null) reader.cancel(error).catch(() => {});
+		throw error;
+	} finally {
+		reader?.releaseLock();
+	}
+}
+/**
+* Reads raw bytes while limiting bytes received from the body stream.
+* Unlike {@link readBoundedText}, the bytes are returned as they were
+* received, without decoding.
+* @param message The response or request to read.
+* @param maxBytes The maximum number of decoded bytes to read.
+* @param url The URL to include in errors and logs.
+* @returns The body bytes.
+* @throws {BodyTooLargeError} If the body exceeds the limit.
+* @internal
+*/
+async function readBoundedBytes(message, maxBytes, url) {
+	validateBodySizeLimit(maxBytes);
+	const reader = message.body?.getReader();
+	const tooLarge = () => {
+		(0, _logtape_logtape.getLogger)([
+			"fedify",
+			"runtime",
+			"body"
+		]).warn("Body from {url} exceeds the limit of {maxBytes} bytes.", {
+			url: url.toString(),
+			maxBytes
+		});
+		throw new BodyTooLargeError(url, maxBytes);
+	};
+	try {
+		const length = message.headers.get("Content-Length");
+		const encoding = message.headers.get("Content-Encoding");
+		if ((encoding == null || encoding.toLowerCase() === "identity") && length != null && /^\d+$/.test(length) && Number(length) > maxBytes) tooLarge();
+		if (reader == null) return /* @__PURE__ */ new Uint8Array(0);
+		const chunks = [];
+		let size = 0;
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			size += value.byteLength;
+			if (size > maxBytes) tooLarge();
+			chunks.push(value);
+		}
+		const bytes = new Uint8Array(size);
+		let offset = 0;
+		for (const chunk of chunks) {
+			bytes.set(chunk, offset);
+			offset += chunk.byteLength;
+		}
+		return bytes;
+	} catch (error) {
+		if (reader != null) reader.cancel(error).catch(() => {});
+		throw error;
+	} finally {
+		reader?.releaseLock();
+	}
+}
+//#endregion
+Object.defineProperty(exports, "BodyTooLargeError", {
+	enumerable: true,
+	get: function() {
+		return BodyTooLargeError;
+	}
+});
+Object.defineProperty(exports, "MAX_BODY_SIZE", {
+	enumerable: true,
+	get: function() {
+		return MAX_BODY_SIZE;
+	}
+});
+Object.defineProperty(exports, "readBoundedBytes", {
+	enumerable: true,
+	get: function() {
+		return readBoundedBytes;
+	}
+});
+Object.defineProperty(exports, "readBoundedText", {
+	enumerable: true,
+	get: function() {
+		return readBoundedText;
+	}
+});

package/dist/tests/body.test.cjs

@@ -0,0 +1,89 @@
+const require_body = require("./body-CkEwROsn.cjs");
+let node_assert_strict = require("node:assert/strict");
+let node_test = require("node:test");
+let node_zlib = require("node:zlib");
+//#region src/body.test.ts
+const url = "https://example.com/document";
+(0, node_test.test)("readBoundedText handles empty bodies and flushes incomplete UTF-8", async () => {
+	(0, node_assert_strict.deepStrictEqual)(await require_body.readBoundedText(new Response(null), 1, url), "");
+	(0, node_assert_strict.deepStrictEqual)(await require_body.readBoundedText(new Response(""), 1, url), "");
+	(0, node_assert_strict.deepStrictEqual)(await require_body.readBoundedText(new Response(new Uint8Array([226, 130])), 2, url), "�");
+});
+(0, node_test.test)("readBoundedText counts bytes and preserves split UTF-8", async () => {
+	const bytes = new TextEncoder().encode("\"안녕\"");
+	const stream = new ReadableStream({ start(controller) {
+		for (const byte of bytes) controller.enqueue(new Uint8Array([byte]));
+		controller.close();
+	} });
+	(0, node_assert_strict.deepStrictEqual)(await require_body.readBoundedText(new Response(stream), bytes.length, url), "\"안녕\"");
+	await (0, node_assert_strict.rejects)(require_body.readBoundedText(new Response(bytes), bytes.length - 1, url), require_body.BodyTooLargeError);
+});
+(0, node_test.test)("readBoundedText rejects a declared oversized body without pulling", async () => {
+	let pulled = false;
+	let canceled = false;
+	const response = new Response(new ReadableStream({
+		pull() {
+			pulled = true;
+		},
+		cancel() {
+			canceled = true;
+		}
+	}, { highWaterMark: 0 }), { headers: { "Content-Length": "100" } });
+	await (0, node_assert_strict.rejects)(require_body.readBoundedText(response, 10, url), require_body.BodyTooLargeError);
+	(0, node_assert_strict.deepStrictEqual)(pulled, false);
+	(0, node_assert_strict.deepStrictEqual)(canceled, true);
+	(0, node_assert_strict.deepStrictEqual)(response.body?.locked, false);
+});
+(0, node_test.test)("readBoundedText cancels chunked bodies despite absent or false lengths", async () => {
+	for (const length of [
+		void 0,
+		"1",
+		"invalid"
+	]) {
+		let pulls = 0;
+		let canceled = false;
+		const stream = new ReadableStream({
+			pull(controller) {
+				pulls++;
+				controller.enqueue(/* @__PURE__ */ new Uint8Array(4));
+			},
+			cancel() {
+				canceled = true;
+			}
+		}, { highWaterMark: 0 });
+		const response = new Response(stream, { headers: length == null ? {} : { "Content-Length": length } });
+		await (0, node_assert_strict.rejects)(require_body.readBoundedText(response, 8, url), require_body.BodyTooLargeError);
+		(0, node_assert_strict.deepStrictEqual)(pulls, 3);
+		(0, node_assert_strict.deepStrictEqual)(canceled, true);
+		(0, node_assert_strict.deepStrictEqual)(response.body?.locked, false);
+	}
+});
+(0, node_test.test)("readBoundedText limits decoded gzip bytes, not the compressed length", async () => {
+	const compressed = (0, node_zlib.gzipSync)("\"" + "a".repeat(4096) + "\"");
+	(0, node_assert_strict.ok)(compressed.length < 128);
+	const decoded = (0, node_zlib.gunzipSync)(compressed);
+	await (0, node_assert_strict.rejects)(require_body.readBoundedText(new Response(decoded, { headers: {
+		"Content-Encoding": "gzip",
+		"Content-Length": String(compressed.length)
+	} }), 128, url), require_body.BodyTooLargeError);
+	(0, node_assert_strict.deepStrictEqual)(await require_body.readBoundedText(new Response("{}", { headers: {
+		"Content-Encoding": "gzip",
+		"Content-Length": "22"
+	} }), 2, url), "{}");
+});
+(0, node_test.test)("readBoundedText rejects invalid limits and releases failed streams", async () => {
+	for (const limit of [
+		0,
+		-1,
+		NaN,
+		Infinity,
+		1.5
+	]) await (0, node_assert_strict.rejects)(require_body.readBoundedText(new Response("{}"), limit, url), RangeError);
+	const failure = /* @__PURE__ */ new Error("broken stream");
+	const response = new Response(new ReadableStream({ pull(controller) {
+		controller.error(failure);
+	} }));
+	await (0, node_assert_strict.rejects)(require_body.readBoundedText(response, 10, url), (error) => error === failure);
+	(0, node_assert_strict.deepStrictEqual)(response.body?.locked, false);
+});
+//#endregion

package/dist/tests/body.test.d.cts

@@ -0,0 +1 @@
+export { };