@mcp-z/client 1.2.0 → 1.3.0

package/dist/cjs/auth/discovery-fetch.js

@@ -25,9 +25,19 @@ _export(exports, {
         return readDiscoveryJson;
     }
 });
-var _promises = /*#__PURE__*/ _interop_require_default(require("node:dns/promises"));
+var _nodedns = /*#__PURE__*/ _interop_require_default(require("node:dns"));
+var _nodehttp = /*#__PURE__*/ _interop_require_default(require("node:http"));
+var _nodehttps = /*#__PURE__*/ _interop_require_default(require("node:https"));
 var _nodenet = require("node:net");
 var _ipaddr = /*#__PURE__*/ _interop_require_default(require("ipaddr.js"));
+function _array_like_to_array(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_with_holes(arr) {
+    if (Array.isArray(arr)) return arr;
+}
 function _assert_this_initialized(self) {
     if (self === void 0) throw new ReferenceError("this hasn't been initialised - super() hasn't been called");
     return self;
@@ -81,17 +91,6 @@ function _construct(Parent, args, Class) {
     }
     return _construct.apply(null, arguments);
 }
-function _define_property(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else obj[key] = value;
-    return obj;
-}
 function _get_prototype_of(o) {
     _get_prototype_of = Object.setPrototypeOf ? Object.getPrototypeOf : function getPrototypeOf(o) {
         return o.__proto__ || Object.getPrototypeOf(o);
@@ -111,6 +110,12 @@ function _inherits(subClass, superClass) {
     });
     if (superClass) _set_prototype_of(subClass, superClass);
 }
+function _instanceof(left, right) {
+    "@swc/helpers - instanceof";
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else return left instanceof right;
+}
 function _interop_require_default(obj) {
     return obj && obj.__esModule ? obj : {
         default: obj
@@ -127,43 +132,32 @@ function _is_native_reflect_construct() {
         return !!result;
     })();
 }
-function _object_spread(target) {
-    for(var i = 1; i < arguments.length; i++){
-        var source = arguments[i] != null ? arguments[i] : {};
-        var ownKeys = Object.keys(source);
-        if (typeof Object.getOwnPropertySymbols === "function") {
-            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
-                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
-            }));
+function _iterable_to_array_limit(arr, i) {
+    var _i = arr == null ? null : typeof Symbol !== "undefined" && arr[Symbol.iterator] || arr["@@iterator"];
+    if (_i == null) return;
+    var _arr = [];
+    var _n = true;
+    var _d = false;
+    var _s, _e;
+    try {
+        for(_i = _i.call(arr); !(_n = (_s = _i.next()).done); _n = true){
+            _arr.push(_s.value);
+            if (i && _arr.length === i) break;
         }
-        ownKeys.forEach(function(key) {
-            _define_property(target, key, source[key]);
-        });
-    }
-    return target;
-}
-function ownKeys(object, enumerableOnly) {
-    var keys = Object.keys(object);
-    if (Object.getOwnPropertySymbols) {
-        var symbols = Object.getOwnPropertySymbols(object);
-        if (enumerableOnly) {
-            symbols = symbols.filter(function(sym) {
-                return Object.getOwnPropertyDescriptor(object, sym).enumerable;
-            });
+    } catch (err) {
+        _d = true;
+        _e = err;
+    } finally{
+        try {
+            if (!_n && _i["return"] != null) _i["return"]();
+        } finally{
+            if (_d) throw _e;
         }
-        keys.push.apply(keys, symbols);
     }
-    return keys;
+    return _arr;
 }
-function _object_spread_props(target, source) {
-    source = source != null ? source : {};
-    if (Object.getOwnPropertyDescriptors) Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
-    else {
-        ownKeys(Object(source)).forEach(function(key) {
-            Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
-        });
-    }
-    return target;
+function _non_iterable_rest() {
+    throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
 }
 function _possible_constructor_return(self, call) {
     if (call && (_type_of(call) === "object" || typeof call === "function")) return call;
@@ -176,6 +170,9 @@ function _set_prototype_of(o, p) {
     };
     return _set_prototype_of(o, p);
 }
+function _sliced_to_array(arr, i) {
+    return _array_with_holes(arr) || _iterable_to_array_limit(arr, i) || _unsupported_iterable_to_array(arr, i) || _non_iterable_rest();
+}
 function _ts_generator(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
@@ -279,6 +276,14 @@ function _type_of(obj) {
     "@swc/helpers - typeof";
     return obj && typeof Symbol !== "undefined" && obj.constructor === Symbol ? "symbol" : typeof obj;
 }
+function _unsupported_iterable_to_array(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array(o, minLen);
+}
 function _wrap_native_super(Class) {
     var _cache = typeof Map === "function" ? new Map() : undefined;
     _wrap_native_super = function(Class) {
@@ -350,6 +355,13 @@ function isLoopbackUrl(rawUrl) {
         return true; // unparseable - fail closed
     }
 }
+function isLoopbackAddress(address) {
+    try {
+        return _ipaddr.default.process(address).range() === 'loopback';
+    } catch (unused) {
+        return false;
+    }
+}
 /**
  * Validates scheme and, for literal-IP hosts, address range. `allowLoopback`
  * reflects trust in the calling server, never in `rawUrl` itself.
@@ -374,22 +386,61 @@ function isLoopbackUrl(rawUrl) {
     }
     return url;
 }
+function lookupAll(hostname, lookup, timeoutMs) {
+    return new Promise(function(resolve, reject) {
+        var settled = false;
+        var deadline = setTimeout(function() {
+            if (!settled) {
+                settled = true;
+                reject(new Error('DNS resolution timed out'));
+            }
+        }, timeoutMs);
+        try {
+            lookup(hostname, {
+                all: true,
+                verbatim: true
+            }, function(error, addresses) {
+                if (settled) return;
+                settled = true;
+                clearTimeout(deadline);
+                if (error || addresses.length === 0) reject(new Error('DNS resolution failed'));
+                else resolve(addresses);
+            });
+        } catch (unused) {
+            if (!settled) {
+                settled = true;
+                clearTimeout(deadline);
+                reject(new Error('DNS resolution failed'));
+            }
+        }
+    });
+}
 /**
- * Resolves the hostname and rejects it if any address is private/reserved.
- * Does not close the DNS-rebinding TOCTOU race against `fetch`'s own resolution a moment later.
- */ function assertResolvesToSafeAddress(url, context, allowLoopback) {
+ * Resolves the hostname once, rejects it unless every returned address is
+ * acceptable, and returns the validated set. The set is pinned into the
+ * request itself (see `requestOnce`), which is what closes the DNS-rebinding
+ * TOCTOU: the transport can only dial addresses that were already validated,
+ * and it never resolves the hostname a second time.
+ */ function resolveSafeAddresses(url, context, allowLoopback, lookup, timeoutMs) {
     return _async_to_generator(function() {
-        var host, addresses, records, unused;
+        var host, loopbackGrant, addresses, unused;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
                     host = stripBrackets(url.hostname);
                     if ((0, _nodenet.isIP)(host)) return [
-                        2
+                        2,
+                        [
+                            {
+                                address: host,
+                                family: host.includes(':') ? 6 : 4
+                            }
+                        ]
                     ]; // literal IP already fully checked in assertSafeUrl
-                    if (allowLoopback && isLoopbackHost(host)) return [
-                        2
-                    ]; // literal "localhost" under a trusted-loopback grant
+                    // Literal `localhost` under a trusted-loopback grant: still resolved, and the
+                    // answers must be loopback - the grant covers loopback, not "wherever
+                    // localhost happens to point".
+                    loopbackGrant = allowLoopback && isLoopbackHost(host);
                     _state.label = 1;
                 case 1:
                     _state.trys.push([
@@ -400,16 +451,10 @@ function isLoopbackUrl(rawUrl) {
                     ]);
                     return [
                         4,
-                        _promises.default.lookup(host, {
-                            all: true,
-                            verbatim: true
-                        })
+                        lookupAll(host, lookup, timeoutMs)
                     ];
                 case 2:
-                    records = _state.sent();
-                    addresses = records.map(function(record) {
-                        return record.address;
-                    });
+                    addresses = _state.sent();
                     return [
                         3,
                         4
@@ -418,49 +463,120 @@ function isLoopbackUrl(rawUrl) {
                     unused = _state.sent();
                     throw new DiscoveryFetchError("Refusing to fetch ".concat(context, ": host could not be resolved"));
                 case 4:
-                    if (addresses.length === 0 || addresses.some(function(address) {
-                        return isBlockedAddress(address);
+                    if (loopbackGrant) {
+                        if (!addresses.every(function(record) {
+                            return isLoopbackAddress(record.address);
+                        })) {
+                            throw new DiscoveryFetchError("Refusing to fetch ".concat(context, ": host does not resolve to a loopback address"));
+                        }
+                    } else if (addresses.some(function(record) {
+                        return isBlockedAddress(record.address);
                     })) {
                         throw new DiscoveryFetchError("Refusing to fetch ".concat(context, ": host resolves to an address that is not publicly routable"));
                     }
                     return [
-                        2
+                        2,
+                        addresses
                     ];
             }
         });
     })();
 }
-function readLimited(response, context, maxBytes) {
+/**
+ * A `net` lookup that can only ever answer with `addresses` - the set already
+ * validated for this URL. The request is built against the original URL (so
+ * SNI and certificate verification still see the hostname), but the
+ * connection can only land on a validated address.
+ */ function pinnedLookup(addresses) {
+    return function(_hostname, options, callback) {
+        if ((typeof options === "undefined" ? "undefined" : _type_of(options)) === 'object' && options.all === true) {
+            callback(null, addresses);
+            return;
+        }
+        var first = addresses[0];
+        if (!first) {
+            callback(Object.assign(new Error('no validated address'), {
+                code: 'ENOTFOUND'
+            }), '', 0);
+            return;
+        }
+        callback(null, first.address, first.family);
+    };
+}
+function toRequestHeaders(init) {
+    var headers = new Headers(init.headers);
+    var out = {};
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+    try {
+        for(var _iterator = headers[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var _step_value = _sliced_to_array(_step.value, 2), name = _step_value[0], value = _step_value[1];
+            out[name] = value;
+        }
+    } catch (err) {
+        _didIteratorError = true;
+        _iteratorError = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion && _iterator.return != null) {
+                _iterator.return();
+            }
+        } finally{
+            if (_didIteratorError) {
+                throw _iteratorError;
+            }
+        }
+    }
+    return out;
+}
+function toRequestBody(body) {
     return _async_to_generator(function() {
-        var _response_body, contentLength, reader, text, chunks, total, _ref, done, value;
+        var _, reader, chunks, _ref, done, value;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
-                    contentLength = response.headers.get('content-length');
-                    if (contentLength && Number(contentLength) > maxBytes) {
-                        throw new DiscoveryFetchError("Refusing to read ".concat(context, ": response too large"));
-                    }
-                    reader = (_response_body = response.body) === null || _response_body === void 0 ? void 0 : _response_body.getReader();
-                    if (!!reader) return [
+                    if (body === undefined || body === null) return [
+                        2,
+                        undefined
+                    ];
+                    if (typeof body === 'string') return [
+                        2,
+                        Buffer.from(body)
+                    ];
+                    if (_instanceof(body, URLSearchParams)) return [
+                        2,
+                        Buffer.from(body.toString())
+                    ];
+                    if (!_instanceof(body, Blob)) return [
                         3,
                         2
                     ];
+                    _ = Buffer.from;
                     return [
                         4,
-                        response.text()
+                        body.arrayBuffer()
                     ];
                 case 1:
-                    text = _state.sent();
-                    if (Buffer.byteLength(text, 'utf8') > maxBytes) {
-                        throw new DiscoveryFetchError("Refusing to read ".concat(context, ": response too large"));
-                    }
                     return [
                         2,
-                        text
+                        _.apply(Buffer, [
+                            _state.sent()
+                        ])
                     ];
                 case 2:
+                    if (_instanceof(body, ArrayBuffer)) return [
+                        2,
+                        Buffer.from(body)
+                    ];
+                    if (ArrayBuffer.isView(body)) return [
+                        2,
+                        Buffer.from(body.buffer, body.byteOffset, body.byteLength)
+                    ];
+                    if (!(typeof ReadableStream !== 'undefined' && _instanceof(body, ReadableStream))) return [
+                        3,
+                        10
+                    ];
+                    reader = body.getReader();
                     chunks = [];
-                    total = 0;
                     _state.label = 3;
                 case 3:
                     _state.trys.push([
@@ -481,15 +597,7 @@ function readLimited(response, context, maxBytes) {
                         3,
                         7
                     ];
-                    if (!value) return [
-                        3,
-                        6
-                    ];
-                    total += value.byteLength;
-                    if (total > maxBytes) {
-                        throw new DiscoveryFetchError("Refusing to read ".concat(context, ": response too large"));
-                    }
-                    chunks.push(value);
+                    if (value) chunks.push(value);
                     _state.label = 6;
                 case 6:
                     return [
@@ -511,60 +619,181 @@ function readLimited(response, context, maxBytes) {
                         2,
                         Buffer.concat(chunks.map(function(chunk) {
                             return Buffer.from(chunk);
-                        })).toString('utf8')
+                        }))
                     ];
+                case 10:
+                    throw new Error('unsupported request body');
             }
         });
     })();
 }
-function fetchOnce(url, init, context, allowLoopback, timeoutMs) {
+function toResponse(status, statusText, headers, body) {
+    var responseHeaders = new Headers();
+    var _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+    try {
+        for(var _iterator = Object.entries(headers)[Symbol.iterator](), _step; !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+            var _step_value = _sliced_to_array(_step.value, 2), name = _step_value[0], value = _step_value[1];
+            if (value === undefined) continue;
+            if (Array.isArray(value)) {
+                var _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
+                try {
+                    for(var _iterator1 = value[Symbol.iterator](), _step1; !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
+                        var entry = _step1.value;
+                        responseHeaders.append(name, entry);
+                    }
+                } catch (err) {
+                    _didIteratorError1 = true;
+                    _iteratorError1 = err;
+                } finally{
+                    try {
+                        if (!_iteratorNormalCompletion1 && _iterator1.return != null) {
+                            _iterator1.return();
+                        }
+                    } finally{
+                        if (_didIteratorError1) {
+                            throw _iteratorError1;
+                        }
+                    }
+                }
+            } else {
+                responseHeaders.append(name, value);
+            }
+        }
+    } catch (err) {
+        _didIteratorError = true;
+        _iteratorError = err;
+    } finally{
+        try {
+            if (!_iteratorNormalCompletion && _iterator.return != null) {
+                _iterator.return();
+            }
+        } finally{
+            if (_didIteratorError) {
+                throw _iteratorError;
+            }
+        }
+    }
+    // The fetch spec gives these statuses a null body, and the Response
+    // constructor rejects a body for them.
+    var nullBody = status === 204 || status === 205 || status === 304;
+    return new Response(nullBody ? null : body, {
+        status: status,
+        statusText: statusText,
+        headers: responseHeaders
+    });
+}
+function requestOnce(url, init, context, addresses, timeoutMs) {
     return _async_to_generator(function() {
-        var controller, timeout, unused;
+        var _init_method, body, unused, transport, options;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
-                    return [
-                        4,
-                        assertResolvesToSafeAddress(url, context, allowLoopback)
-                    ];
-                case 1:
-                    _state.sent();
-                    controller = new AbortController();
-                    timeout = setTimeout(function() {
-                        return controller.abort();
-                    }, timeoutMs);
-                    _state.label = 2;
-                case 2:
                     _state.trys.push([
+                        0,
                         2,
-                        4,
-                        5,
-                        6
+                        ,
+                        3
                     ]);
                     return [
                         4,
-                        fetch(url, _object_spread_props(_object_spread({}, init), {
-                            redirect: 'manual',
-                            signal: controller.signal
-                        }))
+                        toRequestBody(init.body)
                     ];
-                case 3:
+                case 1:
+                    body = _state.sent();
                     return [
-                        2,
-                        _state.sent()
+                        3,
+                        3
                     ];
-                case 4:
+                case 2:
                     unused = _state.sent();
-                    // Never surface the underlying error (ECONNREFUSED host/port, DNS detail, etc.)
                     throw new DiscoveryFetchError("Failed to fetch ".concat(context));
-                case 5:
-                    clearTimeout(timeout);
+                case 3:
+                    transport = url.protocol === 'https:' ? _nodehttps.default : _nodehttp.default;
+                    options = {
+                        method: ((_init_method = init.method) !== null && _init_method !== void 0 ? _init_method : 'GET').toUpperCase(),
+                        headers: toRequestHeaders(init),
+                        agent: false,
+                        lookup: pinnedLookup(addresses)
+                    };
                     return [
-                        7
+                        2,
+                        new Promise(function(resolve, reject) {
+                            var settled = false;
+                            var req;
+                            var res;
+                            var fail = function fail(message) {
+                                if (!settled) {
+                                    settled = true;
+                                    clearTimeout(deadline);
+                                    reject(new DiscoveryFetchError(message));
+                                }
+                            };
+                            var deadline = setTimeout(function() {
+                                res === null || res === void 0 ? void 0 : res.destroy();
+                                req === null || req === void 0 ? void 0 : req.destroy();
+                                fail("Failed to fetch ".concat(context));
+                            }, timeoutMs);
+                            try {
+                                req = transport.request(url, options, function(response) {
+                                    var _response_statusMessage;
+                                    res = response;
+                                    var status = response.statusCode;
+                                    var statusText = (_response_statusMessage = response.statusMessage) !== null && _response_statusMessage !== void 0 ? _response_statusMessage : '';
+                                    if (status === undefined || status < 200 || status > 599) {
+                                        response.destroy();
+                                        fail("Failed to fetch ".concat(context));
+                                        return;
+                                    }
+                                    var chunks = [];
+                                    var total = 0;
+                                    response.on('data', function(chunk) {
+                                        total += chunk.length;
+                                        if (total > MAX_BODY_BYTES) {
+                                            response.destroy();
+                                            fail("Refusing to read ".concat(context, ": response too large"));
+                                            return;
+                                        }
+                                        chunks.push(chunk);
+                                    });
+                                    response.once('error', function() {
+                                        return fail("Failed to fetch ".concat(context));
+                                    });
+                                    response.once('end', function() {
+                                        if (settled) return;
+                                        settled = true;
+                                        clearTimeout(deadline);
+                                        resolve(toResponse(status, statusText, response.headers, Buffer.concat(chunks)));
+                                    });
+                                });
+                            } catch (unused) {
+                                fail("Failed to fetch ".concat(context));
+                                return;
+                            }
+                            req.once('error', function() {
+                                return fail("Failed to fetch ".concat(context));
+                            });
+                            req.end(body);
+                        })
                     ];
-                case 6:
+            }
+        });
+    })();
+}
+function fetchOnce(url, init, context, allowLoopback, timeoutMs, lookup) {
+    return _async_to_generator(function() {
+        var addresses;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
                     return [
-                        2
+                        4,
+                        resolveSafeAddresses(url, context, allowLoopback, lookup, timeoutMs)
+                    ];
+                case 1:
+                    addresses = _state.sent();
+                    return [
+                        2,
+                        requestOnce(url, init, context, addresses, timeoutMs)
                     ];
             }
         });
@@ -572,17 +801,17 @@ function fetchOnce(url, init, context, allowLoopback, timeoutMs) {
 }
 function discoveryFetch(_0) {
     return _async_to_generator(function(rawUrl) {
-        var init, context, options, _options_allowLoopback, allowLoopback, _options_timeoutMs, timeoutMs, url, response, redirectsLeft, location, nextUrl;
+        var init, context, options, _options_allowLoopback, allowLoopback, _options_timeoutMs, timeoutMs, _options_lookup, lookup, url, response, redirectsLeft, location, nextUrl;
         var _arguments = arguments;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
                     init = _arguments.length > 1 && _arguments[1] !== void 0 ? _arguments[1] : {}, context = _arguments.length > 2 && _arguments[2] !== void 0 ? _arguments[2] : 'discovery URL', options = _arguments.length > 3 && _arguments[3] !== void 0 ? _arguments[3] : {};
-                    _options_allowLoopback = options.allowLoopback, allowLoopback = _options_allowLoopback === void 0 ? false : _options_allowLoopback, _options_timeoutMs = options.timeoutMs, timeoutMs = _options_timeoutMs === void 0 ? DEFAULT_TIMEOUT_MS : _options_timeoutMs;
+                    _options_allowLoopback = options.allowLoopback, allowLoopback = _options_allowLoopback === void 0 ? false : _options_allowLoopback, _options_timeoutMs = options.timeoutMs, timeoutMs = _options_timeoutMs === void 0 ? DEFAULT_TIMEOUT_MS : _options_timeoutMs, _options_lookup = options.lookup, lookup = _options_lookup === void 0 ? _nodedns.default.lookup : _options_lookup;
                     url = assertSafeUrl(rawUrl, context, allowLoopback);
                     return [
                         4,
-                        fetchOnce(url, init, context, allowLoopback, timeoutMs)
+                        fetchOnce(url, init, context, allowLoopback, timeoutMs, lookup)
                     ];
                 case 1:
                     response = _state.sent();
@@ -611,7 +840,7 @@ function discoveryFetch(_0) {
                     url = assertSafeUrl(nextUrl.toString(), context, allowLoopback);
                     return [
                         4,
-                        fetchOnce(url, init, context, allowLoopback, timeoutMs)
+                        fetchOnce(url, init, context, allowLoopback, timeoutMs, lookup)
                     ];
                 case 3:
                     response = _state.sent();
@@ -655,4 +884,91 @@ function readDiscoveryJson(response, context) {
         });
     })();
 }
+function readLimited(response, context, maxBytes) {
+    return _async_to_generator(function() {
+        var _response_body, contentLength, reader, text, chunks, total, _ref, done, value;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    contentLength = response.headers.get('content-length');
+                    if (contentLength && Number(contentLength) > maxBytes) {
+                        throw new DiscoveryFetchError("Refusing to read ".concat(context, ": response too large"));
+                    }
+                    reader = (_response_body = response.body) === null || _response_body === void 0 ? void 0 : _response_body.getReader();
+                    if (!!reader) return [
+                        3,
+                        2
+                    ];
+                    return [
+                        4,
+                        response.text()
+                    ];
+                case 1:
+                    text = _state.sent();
+                    if (Buffer.byteLength(text, 'utf8') > maxBytes) {
+                        throw new DiscoveryFetchError("Refusing to read ".concat(context, ": response too large"));
+                    }
+                    return [
+                        2,
+                        text
+                    ];
+                case 2:
+                    chunks = [];
+                    total = 0;
+                    _state.label = 3;
+                case 3:
+                    _state.trys.push([
+                        3,
+                        ,
+                        8,
+                        9
+                    ]);
+                    _state.label = 4;
+                case 4:
+                    return [
+                        4,
+                        reader.read()
+                    ];
+                case 5:
+                    _ref = _state.sent(), done = _ref.done, value = _ref.value;
+                    if (done) return [
+                        3,
+                        7
+                    ];
+                    if (!value) return [
+                        3,
+                        6
+                    ];
+                    total += value.byteLength;
+                    if (total > maxBytes) {
+                        throw new DiscoveryFetchError("Refusing to read ".concat(context, ": response too large"));
+                    }
+                    chunks.push(value);
+                    _state.label = 6;
+                case 6:
+                    return [
+                        3,
+                        4
+                    ];
+                case 7:
+                    return [
+                        3,
+                        9
+                    ];
+                case 8:
+                    reader.releaseLock();
+                    return [
+                        7
+                    ];
+                case 9:
+                    return [
+                        2,
+                        Buffer.concat(chunks.map(function(chunk) {
+                            return Buffer.from(chunk);
+                        })).toString('utf8')
+                    ];
+            }
+        });
+    })();
+}
 /* CJS INTEROP */ if (exports.__esModule && exports.default) { try { Object.defineProperty(exports.default, '__esModule', { value: true }); for (var key in exports) { exports.default[key] = exports[key]; } } catch (_) {}; module.exports = exports.default; }