@juspay/neurolink 13.8.11 → 13.8.12

package/dist/cli/commands/proxy.js

@@ -13,6 +13,8 @@ import { ensureTelemetry, getLangfuseHealthStatus, } from "../../services/server
 import { logger } from "../../utils/logger.js";
 import { applyAllClients, applyClientsOnProxyStart, restoreAllClients, } from "../proxy-clients/registry.js";
 import { resolveProxyConfigPath } from "../../proxy/proxyConfig.js";
+import { readProxyRequestText } from "../../proxy/requestBodyLimit.js";
+import { RawBodyTooLargeError } from "../../server/utils/rawBody.js";
 import { redactUrlsInText, sanitizeForLog, } from "../../utils/logSanitize.js";
 import { raceWithAbort, withTimeout, } from "../../utils/async/withTimeout.js";
 import { startProxyHttpTrace } from "../../proxy/proxyTracer.js";
@@ -1511,6 +1513,13 @@ export async function createProxyStartApp(params) {
             }),
         ]);
     };
+    /** 413 in the wire format this proxy answers its other request errors in. */
+    const respondRequestTooLarge = async (c, metadata, message) => {
+        if (metadata) {
+            await recordRuntimeError(metadata, 413, "request_too_large", message);
+        }
+        return c.json({ type: "error", error: { type: "request_too_large", message } }, 413);
+    };
     app.onError(async (err, c) => {
         const errMsg = err instanceof Error ? err.message : String(err);
         logger.always(`[proxy] unhandled error: ${errMsg}`);
@@ -1703,7 +1712,13 @@ export async function createProxyStartApp(params) {
             let body;
             let rawBody;
             if (method === "post") {
-                rawBody = await c.req.text().catch(() => undefined);
+                // Bounded before it is parsed, and so before the share gate below
+                // (which needs the model), the way the server adapters bound theirs.
+                const read = await readProxyRequestText(c.req.raw, route.path);
+                if (read instanceof RawBodyTooLargeError) {
+                    return respondRequestTooLarge(c, metadata, read.message);
+                }
+                rawBody = read;
                 try {
                     body = rawBody ? JSON.parse(rawBody) : emptyBody;
                 }

package/dist/proxy/requestBodyLimit.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Request-body ceiling for the proxy's POST routes.
+ *
+ * The body is read before anything else about the request is known (the model,
+ * the share token), so it is bounded first, chunk by chunk, the way the server
+ * adapters bound theirs. Each route gets the request size limit its API
+ * documents; one environment variable overrides all of them.
+ *
+ * @module proxy/requestBodyLimit
+ */
+import { RawBodyTooLargeError } from "../server/utils/rawBody.js";
+/**
+ * Environment variable that sets the ceiling for every POST route, replacing
+ * the per-route defaults below: a byte count, or `64mb` / `512kb` / `1gb`.
+ */
+export declare const PROXY_MAX_REQUEST_BODY_ENV = "NEUROLINK_PROXY_MAX_REQUEST_BODY_BYTES";
+/**
+ * 32 MiB. The Claude Messages API and Token Counting API document a 32 MB
+ * maximum request size and answer a larger request with 413 `request_too_large`:
+ * https://platform.claude.com/docs/en/api/errors#request-size-limits
+ *
+ * Also the limit for a POST route with no upstream API of its own (the peer
+ * endpoints), which has nothing documented to follow.
+ */
+export declare const DEFAULT_PROXY_MAX_REQUEST_BODY_BYTES: number;
+/**
+ * 100 MiB. The Gemini API documents inline data as "100 MB per request or
+ * payload (50 MB for PDFs)":
+ * https://ai.google.dev/gemini-api/docs/file-input-methods
+ */
+export declare const GEMINI_PROXY_MAX_REQUEST_BODY_BYTES: number;
+/**
+ * 64 MiB. A local cap, not an OpenAI figure: OpenAI documents no general
+ * request-body limit for the Responses or Chat Completions APIs. The only
+ * per-request payload figure it states is the image input requirement, "Up to
+ * 512 MB total payload per request":
+ * https://developers.openai.com/api/docs/guides/images-vision
+ * (file inputs are separately limited to 50 MB combined:
+ * https://developers.openai.com/api/docs/guides/file-inputs). The proxy holds
+ * a body in memory while it reads it, about four times its size, so it does
+ * not take the 512 MB figure as its ceiling; a client that sends more raises
+ * `NEUROLINK_PROXY_MAX_REQUEST_BODY_BYTES`. The Codex route speaks the
+ * Responses format and documents nothing of its own, so it uses the same cap.
+ */
+export declare const OPENAI_PROXY_MAX_REQUEST_BODY_BYTES: number;
+/**
+ * The ceiling in bytes for one route: the environment override when it is a
+ * positive size, else that route's documented limit.
+ *
+ * @param routePath - The route as registered, for example `/v1/messages`.
+ */
+export declare function resolveProxyMaxRequestBodyBytes(routePath: string, env?: Record<string, string | undefined>): number;
+/**
+ * The request body as text, `undefined` when it cannot be read (a client that
+ * hung up mid-body), or the error when it is over the route's ceiling. Over the
+ * ceiling the stream is cancelled, so nothing past it is buffered.
+ *
+ * @param routePath - The route as registered, for example `/v1/messages`.
+ */
+export declare function readProxyRequestText(request: Request, routePath: string, env?: Record<string, string | undefined>): Promise<string | undefined | RawBodyTooLargeError>;

package/dist/proxy/requestBodyLimit.js

@@ -0,0 +1,97 @@
+/**
+ * Request-body ceiling for the proxy's POST routes.
+ *
+ * The body is read before anything else about the request is known (the model,
+ * the share token), so it is bounded first, chunk by chunk, the way the server
+ * adapters bound theirs. Each route gets the request size limit its API
+ * documents; one environment variable overrides all of them.
+ *
+ * @module proxy/requestBodyLimit
+ */
+import { RawBodyTooLargeError, readBoundedRequestBody, tryParseByteLimit, } from "../server/utils/rawBody.js";
+import { logger } from "../utils/logger.js";
+/**
+ * Environment variable that sets the ceiling for every POST route, replacing
+ * the per-route defaults below: a byte count, or `64mb` / `512kb` / `1gb`.
+ */
+export const PROXY_MAX_REQUEST_BODY_ENV = "NEUROLINK_PROXY_MAX_REQUEST_BODY_BYTES";
+const MIB = 1024 * 1024;
+/**
+ * 32 MiB. The Claude Messages API and Token Counting API document a 32 MB
+ * maximum request size and answer a larger request with 413 `request_too_large`:
+ * https://platform.claude.com/docs/en/api/errors#request-size-limits
+ *
+ * Also the limit for a POST route with no upstream API of its own (the peer
+ * endpoints), which has nothing documented to follow.
+ */
+export const DEFAULT_PROXY_MAX_REQUEST_BODY_BYTES = 32 * MIB;
+/**
+ * 100 MiB. The Gemini API documents inline data as "100 MB per request or
+ * payload (50 MB for PDFs)":
+ * https://ai.google.dev/gemini-api/docs/file-input-methods
+ */
+export const GEMINI_PROXY_MAX_REQUEST_BODY_BYTES = 100 * MIB;
+/**
+ * 64 MiB. A local cap, not an OpenAI figure: OpenAI documents no general
+ * request-body limit for the Responses or Chat Completions APIs. The only
+ * per-request payload figure it states is the image input requirement, "Up to
+ * 512 MB total payload per request":
+ * https://developers.openai.com/api/docs/guides/images-vision
+ * (file inputs are separately limited to 50 MB combined:
+ * https://developers.openai.com/api/docs/guides/file-inputs). The proxy holds
+ * a body in memory while it reads it, about four times its size, so it does
+ * not take the 512 MB figure as its ceiling; a client that sends more raises
+ * `NEUROLINK_PROXY_MAX_REQUEST_BODY_BYTES`. The Codex route speaks the
+ * Responses format and documents nothing of its own, so it uses the same cap.
+ */
+export const OPENAI_PROXY_MAX_REQUEST_BODY_BYTES = 64 * MIB;
+/**
+ * Registered route path (a suffix, so a base path does not matter) to limit.
+ * The first match wins; no match means the default above.
+ */
+const ROUTE_LIMITS = [
+    [/\/v1\/messages(?:\/count_tokens)?$/, DEFAULT_PROXY_MAX_REQUEST_BODY_BYTES],
+    [/\/v1\/chat\/completions$/, OPENAI_PROXY_MAX_REQUEST_BODY_BYTES],
+    [/\/backend-api\/codex\/responses$/, OPENAI_PROXY_MAX_REQUEST_BODY_BYTES],
+    [/\/v1beta\/models\/[^/]+$/, GEMINI_PROXY_MAX_REQUEST_BODY_BYTES],
+];
+let warnedAbout;
+/**
+ * The ceiling in bytes for one route: the environment override when it is a
+ * positive size, else that route's documented limit.
+ *
+ * @param routePath - The route as registered, for example `/v1/messages`.
+ */
+export function resolveProxyMaxRequestBodyBytes(routePath, env = process.env) {
+    const raw = env[PROXY_MAX_REQUEST_BODY_ENV]?.trim();
+    if (raw) {
+        const parsed = tryParseByteLimit(raw);
+        if (parsed !== undefined && parsed > 0) {
+            return parsed;
+        }
+        if (warnedAbout !== raw) {
+            warnedAbout = raw;
+            logger.always(`[proxy] ignoring ${PROXY_MAX_REQUEST_BODY_ENV}=${JSON.stringify(raw)}: expected a positive byte count or a size such as 64mb; using each route's documented limit`);
+        }
+    }
+    return (ROUTE_LIMITS.find(([pattern]) => pattern.test(routePath))?.[1] ??
+        DEFAULT_PROXY_MAX_REQUEST_BODY_BYTES);
+}
+/**
+ * The request body as text, `undefined` when it cannot be read (a client that
+ * hung up mid-body), or the error when it is over the route's ceiling. Over the
+ * ceiling the stream is cancelled, so nothing past it is buffered.
+ *
+ * @param routePath - The route as registered, for example `/v1/messages`.
+ */
+export async function readProxyRequestText(request, routePath, env = process.env) {
+    try {
+        const bytes = await readBoundedRequestBody(request, resolveProxyMaxRequestBodyBytes(routePath, env));
+        return bytes instanceof RawBodyTooLargeError
+            ? bytes
+            : new TextDecoder().decode(bytes);
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/server/adapters/honoAdapter.d.ts

@@ -6,6 +6,10 @@
 import type { NeuroLink } from "../../neurolink.js";
 import { BaseServerAdapter } from "../abstract/baseServerAdapter.js";
 import type { MiddlewareDefinition, RouteDefinition, ServerAdapterConfig } from "../../types/index.js";
+/**
+ * Hono-specific server adapter
+ * Supports multiple runtimes: Bun, Deno, Node.js
+ */
 export declare class HonoServerAdapter extends BaseServerAdapter {
     private app;
     private server?;
@@ -14,6 +18,7 @@ export declare class HonoServerAdapter extends BaseServerAdapter {
     private requestContextStore;
     private HTTPExceptionCtor;
     private streamSSEFn;
+    private parseFormBody;
     constructor(neurolink: NeuroLink, config?: ServerAdapterConfig);
     /**
      * Create rate limiter middleware for Hono
@@ -74,5 +79,13 @@ export declare class HonoServerAdapter extends BaseServerAdapter {
     getNativeServer(): unknown;
     private extractHeaders;
     private extractQuery;
+    /**
+     * A request's context, or the 413 that answers a JSON or form body over its
+     * limit. That answer is built here, before the context exists, so no
+     * middleware (an auth check included) and no route runs for the request.
+     * An upload over the limit still reaches its route as the error itself,
+     * which answers in its own wire format.
+     */
+    private createRequestContext;
     private extractBody;
 }

package/dist/server/adapters/honoAdapter.js

@@ -7,31 +7,11 @@ import { logger } from "../../utils/logger.js";
 import { AlreadyRunningError, ServerAdapterError, ServerStopError, wrapError, } from "../errors.js";
 import { BaseServerAdapter } from "../abstract/baseServerAdapter.js";
 import { isErrorResponse } from "../utils/validation.js";
-import { isRawBodyContentType, isWebResponse, parseByteLimit, RawBodyTooLargeError, readRawBody, } from "../utils/rawBody.js";
+import { isRawBodyContentType, isWebResponse, parseByteLimit, RawBodyTooLargeError, readBoundedRequestBody, } from "../utils/rawBody.js";
 /**
  * Hono-specific server adapter
  * Supports multiple runtimes: Bun, Deno, Node.js
  */
-/** Raw bodies already read for a request, so a second extraction never hits a consumed stream. */
-const rawBodies = new WeakMap();
-/** A web `ReadableStream` of bytes as an async iterable of Buffers, releasing the reader on exit. */
-async function* webStreamChunks(stream) {
-    const reader = stream.getReader();
-    try {
-        for (;;) {
-            const { value, done } = await reader.read();
-            if (done) {
-                return;
-            }
-            if (value) {
-                yield Buffer.from(value.buffer, value.byteOffset, value.byteLength);
-            }
-        }
-    }
-    finally {
-        reader.releaseLock();
-    }
-}
 export class HonoServerAdapter extends BaseServerAdapter {
     app;
     server;
@@ -44,6 +24,7 @@ export class HonoServerAdapter extends BaseServerAdapter {
     // rely on initializeFramework's own local closure variables.
     HTTPExceptionCtor;
     streamSSEFn;
+    parseFormBody;
     constructor(neurolink, config = {}) {
         super(neurolink, config);
     }
@@ -136,7 +117,7 @@ export class HonoServerAdapter extends BaseServerAdapter {
      * adapter (Express/Fastify/Koa) never pulls Hono's import graph in.
      */
     async initializeFramework() {
-        const [{ Hono }, { cors }, { HTTPException }, { logger: honoLogger }, { secureHeaders }, { streamSSE }, { timeout },] = await Promise.all([
+        const [{ Hono }, { cors }, { HTTPException }, { logger: honoLogger }, { secureHeaders }, { streamSSE }, { timeout }, { parseBody },] = await Promise.all([
             this.importFrameworkDependency("hono", "hono"),
             this.importFrameworkDependency("hono/cors", "hono"),
             this.importFrameworkDependency("hono/http-exception", "hono"),
@@ -144,9 +125,11 @@ export class HonoServerAdapter extends BaseServerAdapter {
             this.importFrameworkDependency("hono/secure-headers", "hono"),
             this.importFrameworkDependency("hono/streaming", "hono"),
             this.importFrameworkDependency("hono/timeout", "hono"),
+            this.importFrameworkDependency("hono/utils/body", "hono"),
         ]);
         this.HTTPExceptionCtor = HTTPException;
         this.streamSSEFn = streamSSE;
+        this.parseFormBody = parseBody;
         this.app = new Hono();
         // Add secure headers
         this.app.use("*", secureHeaders());
@@ -243,17 +226,12 @@ export class HonoServerAdapter extends BaseServerAdapter {
                 // Extract path parameters
                 const params = c.req.param();
                 // Reuse existing context from middleware if available, otherwise create new one
-                const existingCtx = this.requestContextStore.get(requestId);
-                const ctx = existingCtx ||
-                    this.createContext({
-                        requestId,
-                        method: c.req.method,
-                        path: c.req.path,
-                        headers: this.extractHeaders(c),
-                        query: this.extractQuery(c),
-                        params,
-                        body: await this.extractBody(c),
-                    });
+                const created = this.requestContextStore.get(requestId) ||
+                    (await this.createRequestContext(c, requestId, params));
+                if (isWebResponse(created)) {
+                    return created;
+                }
+                const ctx = created;
                 // Emit request event
                 this.emit("request", {
                     requestId,
@@ -484,15 +462,11 @@ export class HonoServerAdapter extends BaseServerAdapter {
                 let ctx = this.requestContextStore.get(requestId);
                 if (!ctx) {
                     // Create new context for the first middleware
-                    ctx = this.createContext({
-                        requestId,
-                        method: c.req.method,
-                        path: c.req.path,
-                        headers: this.extractHeaders(c),
-                        query: this.extractQuery(c),
-                        params,
-                        body: await this.extractBody(c),
-                    });
+                    const created = await this.createRequestContext(c, requestId, params);
+                    if (isWebResponse(created)) {
+                        return created;
+                    }
+                    ctx = created;
                     // Store context for sharing between middleware and route handlers
                     this.requestContextStore.set(requestId, ctx);
                 }
@@ -667,22 +641,68 @@ export class HonoServerAdapter extends BaseServerAdapter {
         });
         return query;
     }
+    /**
+     * A request's context, or the 413 that answers a JSON or form body over its
+     * limit. That answer is built here, before the context exists, so no
+     * middleware (an auth check included) and no route runs for the request.
+     * An upload over the limit still reaches its route as the error itself,
+     * which answers in its own wire format.
+     */
+    async createRequestContext(c, requestId, params) {
+        const body = await this.extractBody(c);
+        if (body instanceof RawBodyTooLargeError &&
+            !isRawBodyContentType(c.req.header("Content-Type"))) {
+            logger.warn("[HonoAdapter] Request rejected", {
+                requestId,
+                code: "PAYLOAD_TOO_LARGE",
+                error: body.message,
+            });
+            this.emitRequestError({
+                requestId,
+                error: body,
+                timestamp: new Date(),
+            });
+            return c.json({
+                error: { code: "PAYLOAD_TOO_LARGE", message: body.message },
+                metadata: { requestId, timestamp: new Date().toISOString() },
+            }, 413);
+        }
+        return this.createContext({
+            requestId,
+            method: c.req.method,
+            path: c.req.path,
+            headers: this.extractHeaders(c),
+            query: this.extractQuery(c),
+            params,
+            body,
+        });
+    }
     async extractBody(c) {
         if (!this.config.bodyParser.enabled) {
             return undefined;
         }
         const contentType = c.req.header("Content-Type") || "";
-        if (contentType.includes("application/json")) {
-            try {
-                return await c.req.json();
-            }
-            catch {
-                return undefined;
-            }
-        }
-        if (contentType.includes("application/x-www-form-urlencoded")) {
+        // JSON and url-encoded forms are read through the same bounded read as
+        // uploads, with the limits the other adapters apply: `jsonLimit` for JSON,
+        // `maxSize` for forms. The bytes are then parsed the way Hono parses a
+        // body it has already buffered. A body that cannot be read or parsed is
+        // `undefined`, as it was when Hono did the reading.
+        const isJson = contentType.includes("application/json");
+        if (isJson || contentType.includes("application/x-www-form-urlencoded")) {
             try {
-                return await c.req.parseBody();
+                const bytes = await readBoundedRequestBody(c.req.raw, parseByteLimit(isJson
+                    ? this.config.bodyParser.jsonLimit
+                    : this.config.bodyParser.maxSize));
+                if (bytes instanceof RawBodyTooLargeError) {
+                    return bytes;
+                }
+                return isJson
+                    ? JSON.parse(new TextDecoder().decode(bytes))
+                    : await this.parseFormBody(new Request(c.req.url, {
+                        method: "POST",
+                        headers: { "Content-Type": contentType },
+                        body: new Uint8Array(bytes),
+                    }));
             }
             catch {
                 return undefined;
@@ -693,37 +713,7 @@ export class HonoServerAdapter extends BaseServerAdapter {
         // a throw from the middleware path would land in onError, which answers
         // 500. The route answers 413 (or a validation error) from it.
         if (isRawBodyContentType(contentType)) {
-            const limit = parseByteLimit(this.config.bodyParser.rawMaxSize);
-            if (Number(c.req.header("Content-Length") ?? 0) > limit) {
-                return new RawBodyTooLargeError(limit);
-            }
-            // Read the web stream chunk by chunk and stop at the limit, so a
-            // chunked upload without a Content-Length cannot be buffered whole
-            // (and that before any route logic, including the API-key check, runs).
-            // The body is extracted more than once per request (middleware and
-            // route); a web stream can only be read once, so the outcome is kept
-            // per request the way Hono caches `arrayBuffer()`.
-            const cached = rawBodies.get(c.req.raw);
-            if (cached !== undefined) {
-                return cached;
-            }
-            const stream = c.req.raw.body;
-            if (!stream) {
-                return Buffer.alloc(0);
-            }
-            let outcome;
-            try {
-                outcome = await readRawBody(webStreamChunks(stream), limit);
-            }
-            catch (error) {
-                if (!(error instanceof RawBodyTooLargeError)) {
-                    throw error;
-                }
-                await stream.cancel().catch(() => undefined);
-                outcome = error;
-            }
-            rawBodies.set(c.req.raw, outcome);
-            return outcome;
+            return readBoundedRequestBody(c.req.raw, parseByteLimit(this.config.bodyParser.rawMaxSize));
         }
         return undefined;
     }

package/dist/server/utils/rawBody.d.ts

@@ -13,6 +13,8 @@
  */
 /** `true` for a content type whose body the adapters pass through unparsed. */
 export declare function isRawBodyContentType(contentType: unknown): boolean;
+/** "10mb" / "512kb" / "1gb" / a byte count → bytes, or `undefined` when it is none of those. */
+export declare function tryParseByteLimit(limit: string | number | undefined): number | undefined;
 /** "10mb" / "512kb" / "1gb" / a byte count → bytes. Falls back to 10 MB. */
 export declare function parseByteLimit(limit: string | number | undefined): number;
 /** Thrown when a raw body grows past the adapter's `maxSize`. */
@@ -22,6 +24,21 @@ export declare class RawBodyTooLargeError extends Error {
 }
 /** Read a Node request stream into one `Buffer`, refusing more than `maxBytes`. */
 export declare function readRawBody(stream: AsyncIterable<Buffer | string>, maxBytes: number): Promise<Buffer>;
+/** A web `ReadableStream` of bytes as an async iterable of Buffers, releasing the reader on exit. */
+export declare function webStreamChunks(stream: ReadableStream<Uint8Array>): AsyncIterable<Buffer>;
+/**
+ * Read a web `Request` body, refusing more than `maxBytes`.
+ *
+ * A declared `Content-Length` over the limit is refused without reading
+ * anything. Otherwise the stream is read chunk by chunk and stopped at the
+ * limit, so a chunked body without a `Content-Length` cannot be buffered whole.
+ * Over the limit the result is the error itself rather than a throw: a throw
+ * from a middleware lands in the framework's error handler, which answers 500.
+ *
+ * The outcome is kept per request, because a web stream can only be read once
+ * and the body may be asked for more than once (middleware, then route).
+ */
+export declare function readBoundedRequestBody(request: Request, maxBytes: number): Promise<Buffer | RawBodyTooLargeError>;
 /** A web `Response` returned by a route handler. */
 export declare function isWebResponse(value: unknown): value is Response;
 /** Status, headers and body bytes of a web `Response`, for adapters that write to a Node response. */

package/dist/server/utils/rawBody.js

@@ -17,8 +17,8 @@ const RAW_BODY_CONTENT_TYPE = /^\s*(multipart\/form-data|application\/octet-stre
 export function isRawBodyContentType(contentType) {
     return (typeof contentType === "string" && RAW_BODY_CONTENT_TYPE.test(contentType));
 }
-/** "10mb" / "512kb" / "1gb" / a byte count → bytes. Falls back to 10 MB. */
-export function parseByteLimit(limit) {
+/** "10mb" / "512kb" / "1gb" / a byte count → bytes, or `undefined` when it is none of those. */
+export function tryParseByteLimit(limit) {
     if (typeof limit === "number" && Number.isFinite(limit) && limit > 0) {
         return limit;
     }
@@ -26,7 +26,7 @@ export function parseByteLimit(limit) {
         ? limit.trim().match(/^(\d+(?:\.\d+)?)\s*(b|kb|mb|gb)?$/i)
         : null;
     if (!match) {
-        return 10 * 1024 * 1024;
+        return undefined;
     }
     const units = {
         b: 1,
@@ -34,7 +34,14 @@ export function parseByteLimit(limit) {
         mb: 1024 * 1024,
         gb: 1024 * 1024 * 1024,
     };
-    return Math.floor(Number(match[1]) * units[(match[2] ?? "b").toLowerCase()]);
+    const bytes = Math.floor(Number(match[1]) * units[(match[2] ?? "b").toLowerCase()]);
+    // A digit string long enough to overflow reads as Infinity, which no body
+    // can exceed: treat it as unparseable so the caller's default applies.
+    return Number.isFinite(bytes) ? bytes : undefined;
+}
+/** "10mb" / "512kb" / "1gb" / a byte count → bytes. Falls back to 10 MB. */
+export function parseByteLimit(limit) {
+    return tryParseByteLimit(limit) ?? 10 * 1024 * 1024;
 }
 /** Thrown when a raw body grows past the adapter's `maxSize`. */
 export class RawBodyTooLargeError extends Error {
@@ -58,6 +65,64 @@ export async function readRawBody(stream, maxBytes) {
     }
     return Buffer.concat(chunks);
 }
+/** A web `ReadableStream` of bytes as an async iterable of Buffers, releasing the reader on exit. */
+export async function* webStreamChunks(stream) {
+    const reader = stream.getReader();
+    try {
+        for (;;) {
+            const { value, done } = await reader.read();
+            if (done) {
+                return;
+            }
+            if (value) {
+                yield Buffer.from(value.buffer, value.byteOffset, value.byteLength);
+            }
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+/** Bodies already read for a request, so a second read never hits a consumed stream. */
+const boundedBodies = new WeakMap();
+/**
+ * Read a web `Request` body, refusing more than `maxBytes`.
+ *
+ * A declared `Content-Length` over the limit is refused without reading
+ * anything. Otherwise the stream is read chunk by chunk and stopped at the
+ * limit, so a chunked body without a `Content-Length` cannot be buffered whole.
+ * Over the limit the result is the error itself rather than a throw: a throw
+ * from a middleware lands in the framework's error handler, which answers 500.
+ *
+ * The outcome is kept per request, because a web stream can only be read once
+ * and the body may be asked for more than once (middleware, then route).
+ */
+export async function readBoundedRequestBody(request, maxBytes) {
+    if (Number(request.headers.get("content-length") ?? 0) > maxBytes) {
+        return new RawBodyTooLargeError(maxBytes);
+    }
+    const cached = boundedBodies.get(request);
+    if (cached !== undefined) {
+        return cached;
+    }
+    const stream = request.body;
+    if (!stream) {
+        return Buffer.alloc(0);
+    }
+    let outcome;
+    try {
+        outcome = await readRawBody(webStreamChunks(stream), maxBytes);
+    }
+    catch (error) {
+        if (!(error instanceof RawBodyTooLargeError)) {
+            throw error;
+        }
+        await stream.cancel().catch(() => undefined);
+        outcome = error;
+    }
+    boundedBodies.set(request, outcome);
+    return outcome;
+}
 /** A web `Response` returned by a route handler. */
 export function isWebResponse(value) {
     return typeof Response !== "undefined" && value instanceof Response;