@k2b/cloud 0.40.0 → 0.42.0

package/src/services/outgoing-mail/store.ts

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 import { type SQL, sql } from "bun";
 import { listApps } from "../../_internal/registry";
 import {
@@ -25,7 +26,7 @@ export class OutgoingMailError extends Error {
   constructor(
     public readonly code: MailErrorCode,
     message: string,
-    public readonly status: 400 | 403 | 404 | 409 | 502 = 400,
+    public readonly status: 400 | 403 | 404 | 409 | 502 | 503 = 400,
   ) {
     super(message);
   }
@@ -245,8 +246,8 @@ const appsState = async (
   const registered = registeredApps ?? (await listApps());
   const { access, grants } = await accessRows(db);
   const [profile] = await db<{ key: string }[]>`SELECT key FROM outgoing_mail.profiles WHERE is_default`;
-  const logGrants = await db<{ app_id: string; source_app_id: string }[]>`
-    SELECT app_id, source_app_id FROM outgoing_mail.app_log_access ORDER BY source_app_id`;
+  const logGrants = await db<{ app_id: string; source_app_id: string; level: string }[]>`
+    SELECT app_id, source_app_id, level FROM outgoing_mail.app_log_access ORDER BY source_app_id`;
   const ids = new Set([...registered.map((app) => app.id), ...access.map((a) => a.app_id), ...logGrants.map((g) => g.app_id)]);
   const items = [...ids]
     .map((appId): AdminMailApp => {
@@ -264,6 +265,12 @@ const appsState = async (
             : logGrants
                 .filter((g) => g.app_id === appId && g.source_app_id !== "core" && g.source_app_id !== appId)
                 .map((g) => g.source_app_id),
+        logContentApps:
+          appId === "core"
+            ? []
+            : logGrants
+                .filter((g) => g.app_id === appId && g.source_app_id !== "core" && g.source_app_id !== appId && g.level === "content")
+                .map((g) => g.source_app_id),
         mode,
         profiles: mode === "selected" ? grants.filter((g) => g.app_id === appId).map((g) => g.key) : [],
       };
@@ -300,6 +307,7 @@ const setAppAccess = async (appId: string, value: MailAppAccess, context: MailAu
         declared: false,
         readDeclared: false,
         logApps: [],
+        logContentApps: [],
         mode: "default",
         profiles: [],
       }
@@ -312,19 +320,40 @@ const logAppsFor = async (appId: string): Promise<string[]> => {
     WHERE app_id = ${appId} AND source_app_id <> 'core' AND source_app_id <> app_id ORDER BY source_app_id`;
   return rows.map((row) => row.source_app_id);
 };
+/** Full exact IDs remain distinguishable after audit metadata string truncation. */
+export const mailAppIdSha256 = (appId: string): string => createHash("sha256").update(appId, "utf8").digest("hex");
+const grantAuditGroups = (grants: { source_app_id: string; level: string }[]) => {
+  const entries = grants.map((grant) => ({
+    appId: grant.source_app_id,
+    appIdSha256: mailAppIdSha256(grant.source_app_id),
+    level: grant.level,
+  }));
+  // Audit arrays retain at most 50 entries; the public grant limit is 100.
+  return [entries.slice(0, 50), entries.slice(50)];
+};
 const setAppLogAccess = async (appId: string, value: MailLogAccess, context: MailAuditContext): Promise<AdminMailApp> => {
   const reader = MailLogAppIdSchema.safeParse(appId);
   const parsed = MailLogAccessSchema.safeParse(value);
   if (!reader.success || appId === "core" || !parsed.success || parsed.data.apps.includes(appId))
     throw new OutgoingMailError("bad_input", "Choose a valid reader and distinct source apps other than Core or the reader itself.");
   const apps = [...parsed.data.apps].sort();
+  const contentApps = parsed.data.contentApps ?? [];
   const registered = await listApps();
   return locked(async (tx) => {
+    const before = await tx<{ source_app_id: string; level: string }[]>`
+      SELECT source_app_id, level FROM outgoing_mail.app_log_access WHERE app_id = ${appId} ORDER BY source_app_id`;
     await tx`DELETE FROM outgoing_mail.app_log_access WHERE app_id = ${appId}`;
-    await tx`INSERT INTO outgoing_mail.app_log_access(app_id, source_app_id, created_by)
-      SELECT ${appId}, source_app_id, ${context.actor.userId ?? null}
+    await tx`INSERT INTO outgoing_mail.app_log_access(app_id, source_app_id, created_by, level)
+      SELECT ${appId}, source_app_id, ${context.actor.userId ?? null},
+        CASE WHEN source_app_id = ANY(${toPgTextArray(contentApps)}::text[]) THEN 'content' ELSE 'metadata' END
       FROM unnest(${toPgTextArray(apps)}::text[]) AS source_app_id`;
-    await record(tx, context, "app_log_access.update", appId, { apps });
+    await record(tx, context, "app_log_access.update", appId, {
+      apps,
+      readingAppId: appId,
+      readingAppIdSha256: mailAppIdSha256(appId),
+      before: grantAuditGroups(before),
+      after: grantAuditGroups(apps.map((id) => ({ source_app_id: id, level: contentApps.includes(id) ? "content" : "metadata" }))),
+    });
     return (
       (await appsState(tx, registered)).items.find((app) => app.appId === appId) ?? {
         appId,
@@ -333,6 +362,7 @@ const setAppLogAccess = async (appId: string, value: MailLogAccess, context: Mai
         declared: false,
         readDeclared: false,
         logApps: [],
+        logContentApps: [],
         mode: "default",
         profiles: [],
       }

package/src/services/outgoing-mail/test-send.ts

@@ -1,4 +1,6 @@
+import { Socket } from "node:net";
 import { audit } from "../audit";
+import { DownstreamBusyError, downstreamBudget } from "../downstream-budget";
 import { get } from "../settings";
 import { type MailAuditContext, OutgoingMailError, resolveMailCredentials } from "./store";
 import { resolveMailTransport } from "./transport";
@@ -18,22 +20,48 @@ export const outgoingMailTest = {
     // Fail before the external effect if audit storage is unavailable.
     await audit.record({ ...event, outcome: "allowed" });
     let transport: ReturnType<Awaited<ReturnType<typeof resolveMailTransport>>["build"]> | undefined;
+    const signal = AbortSignal.timeout(60_000);
+    let socket: Socket | undefined;
+    const stop = () => {
+      socket?.destroy();
+      transport?.close();
+    };
+    signal.addEventListener("abort", stop, { once: true });
+    let releaseSmtp: (() => void) | undefined;
     try {
-      const resolved = await resolveMailTransport(profile);
+      releaseSmtp = await downstreamBudget.acquire({ downstream: "smtp", timeoutMs: 60_000, signal });
+      const resolved = await resolveMailTransport(profile, signal);
+      const build = (index: number) => {
+        socket = new Socket();
+        const ownedSocket = socket;
+        ownedSocket.once("connect", () => {
+          if (signal.aborted) ownedSocket.destroy();
+        });
+        return resolved.build(index, ownedSocket);
+      };
+      let selected = 0;
       for (let index = 0; index < resolved.count; index++) {
-        transport = resolved.build(index);
+        signal.throwIfAborted();
+        transport = build(index);
         try {
           // CONN also labels socket errors after DATA. Only fall back during a
           // preflight that cannot send a message, then send once to that address.
           await transport.verify();
+          selected = index;
           break;
         } catch (error) {
+          socket?.destroy();
           transport.close();
           transport = undefined;
           if (!(error instanceof Error) || !("command" in error) || error.command !== "CONN" || index === resolved.count - 1) throw error;
         }
       }
       if (!transport) throw new Error("No validated SMTP address.");
+      // verify() closes its SMTP connection. The actual send gets a fresh
+      // owned socket to the same checked address, with no delivery fallback.
+      stop();
+      signal.throwIfAborted();
+      transport = build(selected);
       await transport.sendMail({
         from: { address: profile.fromAddress, name: profile.fromName ?? (await get<string>("app.name")) },
         to: recipient,
@@ -47,9 +75,11 @@ export const outgoingMailTest = {
         profile.smtpUser ? `\0${profile.smtpUser}\0${profile.smtpPassword ?? ""}` : null,
       ]);
       await audit.recordResultAfterSideEffect({ ...event, result: { ok: false, error: { code: "smtp_failed", message, status: 500 } } });
-      throw new OutgoingMailError("smtp_failed", message, 502);
+      throw new OutgoingMailError("smtp_failed", message, error instanceof DownstreamBusyError ? 503 : 502);
     } finally {
-      transport?.close();
+      signal.removeEventListener("abort", stop);
+      stop();
+      releaseSmtp?.();
     }
   },
 };

package/src/services/outgoing-mail/transport.ts

@@ -4,7 +4,7 @@ import { resolveMailHost } from "./resolve-host";
 import type { resolveMailCredentials } from "./store";
 
 export const resolveMailTransport = async (profile: Awaited<ReturnType<typeof resolveMailCredentials>>, signal?: AbortSignal) => {
-  const target = await resolveMailHost(profile.smtpHost, signal);
+  const target = await resolveMailHost(profile.smtpHost, signal, undefined, profile.smtpPort);
   signal?.throwIfAborted();
   const count = target.addresses.length;
   return {

package/src/services/pdf/gotenberg.ts

@@ -1,7 +1,9 @@
+import { DownstreamBusyError, downstreamBudget } from "../downstream-budget";
 import * as settings from "../settings";
 import { offlineHtml } from "./offline-html";
 
 export type GotenbergRenderErrorCode =
+  | "busy"
   | "bad_input"
   | "not_configured"
   | "html_too_large"
@@ -117,6 +119,7 @@ const abortSignal = (timeoutMs: number): AbortSignal => {
 
 const sanitizeFetchError = (error: unknown): GotenbergRenderError => {
   if (error instanceof GotenbergRenderError) return error;
+  if (error instanceof DownstreamBusyError) return new GotenbergRenderError("busy", "PDF renderer is busy; retry later.", 503);
   if (error instanceof DOMException && error.name === "TimeoutError") {
     return new GotenbergRenderError("timeout", "Gotenberg request timed out.");
   }
@@ -179,10 +182,14 @@ async function requestPdf(
   const headers = new Headers();
   const auth = basicAuthHeader(config);
   if (auth) headers.set("Authorization", auth);
+  const baseUrl = normalizeBaseUrl(config.url);
   const signal = options.signal ? AbortSignal.any([options.signal, abortSignal(config.timeoutMs)]) : abortSignal(config.timeoutMs);
+  let release: (() => void) | undefined;
   let reader: ReadableStreamDefaultReader<Uint8Array> | undefined;
   try {
-    const response = await (options.fetch ?? fetch)(`${normalizeBaseUrl(config.url)}${route}`, {
+    release = await downstreamBudget.acquire({ downstream: "gotenberg", timeoutMs: config.timeoutMs, signal });
+    signal.throwIfAborted();
+    const response = await (options.fetch ?? fetch)(`${baseUrl}${route}`, {
       method: "POST",
       headers,
       body: form,
@@ -221,6 +228,7 @@ async function requestPdf(
     throw sanitizeFetchError(error);
   } finally {
     reader?.releaseLock();
+    release?.();
   }
 }
 
@@ -285,47 +293,12 @@ export const mergePdfsWithConfig = async (
     throw new GotenbergRenderError("bad_input", "At least one PDF file is required.");
   }
 
-  const baseUrl = normalizeBaseUrl(config.url);
   const form = new FormData();
   input.files.forEach((file, index) => {
     const filename = `${String(index + 1).padStart(6, "0")}.pdf`;
-    const bytes = file.pdf.buffer.slice(file.pdf.byteOffset, file.pdf.byteOffset + file.pdf.byteLength) as ArrayBuffer;
-    form.append("files", new Blob([bytes], { type: DEFAULT_PDF_CONTENT_TYPE }), filename);
+    form.append("files", new Blob([new Uint8Array(file.pdf)], { type: DEFAULT_PDF_CONTENT_TYPE }), filename);
   });
-
-  const headers = new Headers();
-  const authHeader = basicAuthHeader(config);
-  if (authHeader) headers.set("Authorization", authHeader);
-
-  const transport = options.fetch ?? fetch;
-  let response: Response;
-  try {
-    response = await transport(`${baseUrl}/forms/pdfengines/merge`, {
-      method: "POST",
-      headers,
-      body: form,
-      signal: abortSignal(config.timeoutMs),
-    });
-  } catch (error) {
-    throw sanitizeFetchError(error);
-  }
-
-  if (!response.ok) {
-    throw new GotenbergRenderError("bad_response", `Gotenberg returned HTTP ${response.status}.`, response.status);
-  }
-
-  const buffer = await response.arrayBuffer();
-  if (buffer.byteLength > config.maxPdfBytes) {
-    throw new GotenbergRenderError(
-      "pdf_too_large",
-      `PDF output is too large (${buffer.byteLength} bytes, limit ${config.maxPdfBytes} bytes).`,
-    );
-  }
-
-  return {
-    pdf: new Uint8Array(buffer),
-    contentType: response.headers.get("content-type") || DEFAULT_PDF_CONTENT_TYPE,
-  };
+  return requestPdf("/forms/pdfengines/merge", form, config, options);
 };
 
 export const getGotenbergConfig = async (): Promise<GotenbergConfig> => ({

package/src/services/pdf/markdown.ts

@@ -1,4 +1,5 @@
 import { markdownInfoBlocks, markdownLinkReference, renderMarkdownLink } from "@k2b/ui";
+import { decodeHTML } from "entities";
 import { Marked, Renderer, type Tokens } from "marked";
 import postcss from "postcss";
 import {
@@ -165,6 +166,161 @@ a.k2b-reference { padding: .05em .3em; border-radius: .3em; background: #eeeff2;
 .k2b-reference__icon, .k2b-text-link__external { display: none; }
 `;
 
+/**
+ * Break-anywhere lowers table column width to one character, splitting even
+ * short numbers. Cells keep words whole; long runs get explicit break points.
+ */
+const TABLE_CELL_PRINT_CSS = `
+th, td { overflow-wrap: break-word; word-break: normal; }
+`;
+
+// Up to 20 characters covers nearly every real word, including German
+// compounds and IBAN-like values below that length. Longer URLs, code, hashes
+// or paths need a 10-character step: even nine columns fit the document
+// preset's narrowest row (about 90 table characters). A 20-character step
+// clipped six columns of long inline code that fitted before this protection.
+const MAX_WHOLE_CELL_RUN = 20;
+const CELL_RUN_BREAK_STEP = 10;
+
+// References (including semicolonless ones) and literal code points are raw
+// pieces. Decode for whitespace and grapheme boundaries, but preserve spelling.
+// Limit names to 32 characters, the longest HTML reference name.
+const CHARACTER_REFERENCE = /&(?:#[xX][0-9a-fA-F]+|#[0-9]+|[A-Za-z][A-Za-z0-9]{0,31});?/gu;
+const GRAPHEMES = new Intl.Segmenter(undefined, { granularity: "grapheme" });
+
+const runUnits = (pieces: { raw: string; decoded: string }[]): string[] => {
+  const decoded = pieces.map((piece) => piece.decoded).join("");
+  const ends = new Set(Array.from(GRAPHEMES.segment(decoded), ({ index, segment }) => index + segment.length));
+  const units: string[] = [];
+  let at = 0;
+  let unit = "";
+  // A boundary must end both a grapheme and a raw piece, even if it decodes
+  // to several graphemes (such as &ampx or an unknown reference-like name).
+  for (const piece of pieces) {
+    unit += piece.raw;
+    at += piece.decoded.length;
+    if (ends.has(at)) {
+      units.push(unit);
+      unit = "";
+    }
+  }
+  return units;
+};
+
+// Inline formatting does not end a run: `aaa**bbb**ccc` prints one unbroken
+// word. Any other element, such as <br>, <wbr>, an image, a span, or a
+// block, starts a new run, so a short value beside it never breaks.
+const INLINE_FORMATTING = new Set([
+  "a",
+  "b",
+  "code",
+  "del",
+  "em",
+  "i",
+  "ins",
+  "kbd",
+  "mark",
+  "s",
+  "samp",
+  "small",
+  "strong",
+  "sub",
+  "sup",
+  "u",
+  "var",
+]);
+
+// Graphics and formulas keep their own layout. In raw-text and RCDATA elements
+// a <wbr> would be literal text, not markup.
+const SKIPPED_IN_CELLS = new Set([
+  "svg",
+  "math",
+  "style",
+  "script",
+  "textarea",
+  "title",
+  "xmp",
+  "iframe",
+  "noembed",
+  "noframes",
+  "noscript",
+]);
+
+const breakLongCellRuns = (html: string): string => {
+  let skippedDepth = 0;
+  let buffer = "";
+  // Units of the run that the previous text node in the cell ended with.
+  let carried = 0;
+  const pieces = new RegExp(`(${CHARACTER_REFERENCE.source})|.`, "gsu");
+  const breakText = (text: string): string => {
+    let output = "";
+    let run: { raw: string; decoded: string }[] = [];
+    const flushRun = () => {
+      const units = runUnits(run);
+      run = [];
+      const start = carried;
+      carried += units.length;
+      // A run that continues in a later text node is counted when it gets
+      // there; earlier nodes stay as written, so at most 30 units stay whole.
+      if (carried <= MAX_WHOLE_CELL_RUN) {
+        output += units.join("");
+        return;
+      }
+      output += units
+        .map((unit, index) => ((start + index) % CELL_RUN_BREAK_STEP === 0 && start + index > 0 ? `<wbr>${unit}` : unit))
+        .join("");
+    };
+    for (const [raw, reference] of text.matchAll(pieces)) {
+      const decoded = reference === undefined ? raw : decodeHTML(raw);
+      // Literal and referenced whitespace end runs, except no-break characters.
+      if (/^[^\S\u00a0\u2007\u202f\ufeff]+$/u.test(decoded)) {
+        flushRun();
+        carried = 0;
+        output += raw;
+      } else {
+        run.push({ raw, decoded });
+      }
+    }
+    flushRun();
+    return output;
+  };
+
+  return new HTMLRewriter()
+    .on("td *, th *", {
+      element(element) {
+        if (INLINE_FORMATTING.has(element.tagName)) return;
+        carried = 0;
+        // Void elements and self-closing foreign elements have no end tag. HTML
+        // ignores the self-closing flag elsewhere: <textarea/> still opens raw text.
+        if (!element.canHaveContent) return;
+        const skipped = SKIPPED_IN_CELLS.has(element.tagName);
+        if (skipped) skippedDepth += 1;
+        // One end tag handler per element: a second registration would replace this one.
+        element.onEndTag(() => {
+          carried = 0;
+          if (skipped) skippedDepth -= 1;
+        });
+      },
+    })
+    .on("td, th", {
+      element() {
+        carried = 0;
+      },
+      text(chunk) {
+        if (skippedDepth) return;
+        // HTMLRewriter may split one text node (even an entity) into chunks.
+        buffer += chunk.text;
+        if (chunk.lastInTextNode) {
+          chunk.replace(breakText(buffer), { html: true });
+          buffer = "";
+        } else {
+          chunk.remove();
+        }
+      },
+    })
+    .transform(html);
+};
+
 const byteLength = (value: string): number => new TextEncoder().encode(value).byteLength;
 
 const escapeHtml = (value: string): string =>
@@ -258,7 +414,9 @@ export const buildPresetPdfHtml = (input: BuildPresetPdfHtmlInput): string => {
   const suppliedCustomCss = input.customCss?.trim() ?? "";
   const customCss = suppliedCustomCss ? validateCustomCss(input.customCss ?? "") : "";
   const presetCss = templateId ? TEMPLATE_CSS[templateId] : customCss ? "" : TEMPLATE_CSS.document;
-  const baseCss = [presetCss, INFO_BLOCK_PRINT_CSS, LINK_PRINT_CSS, input.css ? styleText(input.css) : ""].filter(Boolean).join("\n");
+  const baseCss = [presetCss, INFO_BLOCK_PRINT_CSS, LINK_PRINT_CSS, TABLE_CELL_PRINT_CSS, input.css ? styleText(input.css) : ""]
+    .filter(Boolean)
+    .join("\n");
   const stylesheet = `${baseCss}${baseCss && customCss ? `\n/* Custom CSS overrides */\n` : ""}${customCss}`;
   return `<!doctype html>
 <html lang="en">
@@ -268,7 +426,7 @@ export const buildPresetPdfHtml = (input: BuildPresetPdfHtmlInput): string => {
 <meta http-equiv="Content-Security-Policy" content="default-src 'none'; base-uri 'none'; connect-src 'none'; font-src 'none'; form-action 'none'; frame-src 'none'; img-src 'none'; media-src 'none'; object-src 'none'; script-src 'none'; style-src 'unsafe-inline'">
 <style>${stylesheet}</style>
 </head>
-<body><main class="markdown-document">${input.html}</main></body>
+<body><main class="markdown-document">${breakLongCellRuns(input.html)}</main></body>
 </html>`;
 };
 

package/src/services/pdf/template-preview.ts

@@ -47,7 +47,7 @@ export type RenderTemplatePdfPreviewOptions = RenderHtmlToPdfOptions & {
   config?: GotenbergConfig;
 };
 
-const pdfErrorStatus = (error: GotenbergRenderError): number => (error.code === "not_configured" ? 400 : 502);
+const pdfErrorStatus = (error: GotenbergRenderError): number => (error.code === "busy" ? 503 : error.code === "not_configured" ? 400 : 502);
 
 const renderPart = (
   template: string | null | undefined,

package/src/services/public-http.ts

@@ -1,6 +1,7 @@
 import type { ClientRequest, IncomingMessage } from "node:http";
 import { type RequestOptions, request } from "node:https";
 import { resolvePublicNetworkAddresses } from "./network-security";
+import { awaitNetworkOperation, readNetworkResponse } from "./network-transport";
 
 export type PublicHttpInput = {
   url: string;
@@ -24,29 +25,21 @@ export async function requestPublicHttps(
   const url = new URL(input.url);
   if (url.protocol !== "https:" || url.username || url.password) throw new Error("HTTPS_REQUIRED");
   input.signal.throwIfAborted();
-  let cancelLookup = () => {};
-  const addresses = await Promise.race([
-    dependencies.resolve(url.hostname),
-    new Promise<never>((_, reject) => {
-      cancelLookup = () => reject(new Error("HTTP_CANCELLED"));
-      input.signal.addEventListener("abort", cancelLookup, { once: true });
-      if (input.signal.aborted) cancelLookup();
-    }),
-  ]).finally(() => input.signal.removeEventListener("abort", cancelLookup));
+  let addresses: Awaited<ReturnType<typeof resolvePublicNetworkAddresses>>;
+  try {
+    addresses = await awaitNetworkOperation(dependencies.resolve(url.hostname), input.signal);
+  } catch (error) {
+    if (input.signal.aborted) throw new Error("HTTP_CANCELLED");
+    throw error;
+  }
   input.signal.throwIfAborted();
   const target = addresses[0]!;
-  return new Promise<{ status: number; headers: Record<string, string>; body: Uint8Array }>((resolve, reject) => {
-    let settled = false;
-    const fail = () => finish(undefined);
-    const finish = (value?: { status: number; headers: Record<string, string>; body: Uint8Array }) => {
-      if (settled) return;
-      settled = true;
-      input.signal.removeEventListener("abort", abort);
-      if (value) resolve(value);
-      else reject(new Error("HTTP_FAILED"));
-    };
-    const outgoing = dependencies.request(
-      {
+  try {
+    return await readNetworkResponse<{ status: number; headers: Record<string, string>; body: Uint8Array }>({
+      request: dependencies.request,
+      signal: input.signal,
+      body: input.body,
+      options: {
         hostname: target.address,
         family: target.family,
         port: url.port || 443,
@@ -56,7 +49,7 @@ export async function requestPublicHttps(
         method: input.method,
         headers: { ...input.headers, host: url.host, "accept-encoding": "identity" },
       },
-      (incoming) => {
+      read: (incoming, finish, fail) => {
         const status = incoming.statusCode ?? 0;
         const headers: Record<string, string> = {};
         for (const name of ["content-type", "retry-after", "etag", "last-modified"]) {
@@ -65,37 +58,32 @@ export async function requestPublicHttps(
         }
         // A redirect never receives a second request or exposes a Location token.
         if (status >= 300 && status < 400 && status !== 304) {
-          incoming.destroy();
           finish({ status, headers, body: new Uint8Array() });
           return;
         }
         if (incoming.headers["content-encoding"] && incoming.headers["content-encoding"] !== "identity") {
-          incoming.destroy();
-          fail();
+          fail(new Error("HTTP_FAILED"));
+          return;
+        }
+        if (Number(incoming.headers["content-length"]) > input.maxBytes) {
+          fail(new Error("HTTP_TOO_LARGE"));
           return;
         }
         const chunks: Uint8Array[] = [];
         let bytes = 0;
         incoming.on("data", (chunk: Buffer) => {
-          if (settled) return;
+          if (incoming.destroyed) return;
           bytes += chunk.byteLength;
           if (bytes > input.maxBytes) {
-            incoming.destroy();
-            fail();
+            fail(new Error("HTTP_TOO_LARGE"));
           } else chunks.push(chunk);
         });
         incoming.on("end", () => finish({ status, headers, body: Buffer.concat(chunks, bytes) }));
-        incoming.on("error", fail);
-        incoming.on("aborted", fail);
       },
-    );
-    const abort = () => {
-      outgoing.destroy();
-      fail();
-    };
-    outgoing.on("error", fail); // Never expose errors containing injected headers.
-    input.signal.addEventListener("abort", abort, { once: true });
-    if (input.signal.aborted) abort();
-    else outgoing.end(input.body);
-  });
+    });
+  } catch (error) {
+    if (error instanceof Error && error.message === "HTTP_TOO_LARGE") throw error;
+    // Never expose errors containing injected headers.
+    throw new Error("HTTP_FAILED");
+  }
 }