@peers-app/peers-sdk 0.25.13 → 0.25.15

package/dist/invites/invite-token.d.ts

@@ -21,15 +21,37 @@ export declare const inviteIdentitySchema: z.ZodObject<{
     publicKey: z.ZodString;
     publicBoxKey: z.ZodString;
     displayName: z.ZodOptional<z.ZodString>;
+    /**
+     * Anchor list to store on first contact. A peer that already has a list
+     * keeps it; this is only the bootstrap that arrives with the invitation.
+     */
+    anchors: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        type: z.ZodEnum<["peers-services", "https"]>;
+        url: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        type: "peers-services" | "https";
+        url: string;
+    }, {
+        type: "peers-services" | "https";
+        url: string;
+    }>, "many">>;
 }, "strict", z.ZodTypeAny, {
     publicKey: string;
-    publicBoxKey: string;
     userId: string;
+    publicBoxKey: string;
+    anchors?: {
+        type: "peers-services" | "https";
+        url: string;
+    }[] | undefined;
     displayName?: string | undefined;
 }, {
     publicKey: string;
-    publicBoxKey: string;
     userId: string;
+    publicBoxKey: string;
+    anchors?: {
+        type: "peers-services" | "https";
+        url: string;
+    }[] | undefined;
     displayName?: string | undefined;
 }>;
 /** Public identity of a party to an invite. */
@@ -50,15 +72,15 @@ export declare const inviteGroupSchema: z.ZodObject<{
     name: string;
     role: GroupMemberRole;
     publicKey: string;
-    groupId: string;
     publicBoxKey: string;
+    groupId: string;
     mode: "open" | "approve";
 }, {
     name: string;
     role: GroupMemberRole;
     publicKey: string;
-    groupId: string;
     publicBoxKey: string;
+    groupId: string;
     mode: "open" | "approve";
 }>;
 /** Group facts embedded in a group token. */
@@ -74,15 +96,37 @@ export declare const peersInviteContentsSchema: z.ZodEffects<z.ZodObject<{
         publicKey: z.ZodString;
         publicBoxKey: z.ZodString;
         displayName: z.ZodOptional<z.ZodString>;
+        /**
+         * Anchor list to store on first contact. A peer that already has a list
+         * keeps it; this is only the bootstrap that arrives with the invitation.
+         */
+        anchors: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            type: z.ZodEnum<["peers-services", "https"]>;
+            url: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            type: "peers-services" | "https";
+            url: string;
+        }, {
+            type: "peers-services" | "https";
+            url: string;
+        }>, "many">>;
     }, "strict", z.ZodTypeAny, {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
+        publicBoxKey: string;
+        anchors?: {
+            type: "peers-services" | "https";
+            url: string;
+        }[] | undefined;
         displayName?: string | undefined;
     }, {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
+        publicBoxKey: string;
+        anchors?: {
+            type: "peers-services" | "https";
+            url: string;
+        }[] | undefined;
         displayName?: string | undefined;
     }>;
     /** ISO 8601 instant after which the token is invalid. */
@@ -103,15 +147,15 @@ export declare const peersInviteContentsSchema: z.ZodEffects<z.ZodObject<{
         name: string;
         role: GroupMemberRole;
         publicKey: string;
-        groupId: string;
         publicBoxKey: string;
+        groupId: string;
         mode: "open" | "approve";
     }, {
         name: string;
         role: GroupMemberRole;
         publicKey: string;
-        groupId: string;
         publicBoxKey: string;
+        groupId: string;
         mode: "open" | "approve";
     }>>;
 }, "strict", z.ZodTypeAny, {
@@ -121,8 +165,12 @@ export declare const peersInviteContentsSchema: z.ZodEffects<z.ZodObject<{
     v: 1;
     inviter: {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
+        publicBoxKey: string;
+        anchors?: {
+            type: "peers-services" | "https";
+            url: string;
+        }[] | undefined;
         displayName?: string | undefined;
     };
     epoch: number;
@@ -131,8 +179,8 @@ export declare const peersInviteContentsSchema: z.ZodEffects<z.ZodObject<{
         name: string;
         role: GroupMemberRole;
         publicKey: string;
-        groupId: string;
         publicBoxKey: string;
+        groupId: string;
         mode: "open" | "approve";
     } | undefined;
 }, {
@@ -142,8 +190,12 @@ export declare const peersInviteContentsSchema: z.ZodEffects<z.ZodObject<{
     v: 1;
     inviter: {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
+        publicBoxKey: string;
+        anchors?: {
+            type: "peers-services" | "https";
+            url: string;
+        }[] | undefined;
         displayName?: string | undefined;
     };
     epoch: number;
@@ -152,8 +204,8 @@ export declare const peersInviteContentsSchema: z.ZodEffects<z.ZodObject<{
         name: string;
         role: GroupMemberRole;
         publicKey: string;
-        groupId: string;
         publicBoxKey: string;
+        groupId: string;
         mode: "open" | "approve";
     } | undefined;
 }>, {
@@ -163,8 +215,12 @@ export declare const peersInviteContentsSchema: z.ZodEffects<z.ZodObject<{
     v: 1;
     inviter: {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
+        publicBoxKey: string;
+        anchors?: {
+            type: "peers-services" | "https";
+            url: string;
+        }[] | undefined;
         displayName?: string | undefined;
     };
     epoch: number;
@@ -173,8 +229,8 @@ export declare const peersInviteContentsSchema: z.ZodEffects<z.ZodObject<{
         name: string;
         role: GroupMemberRole;
         publicKey: string;
-        groupId: string;
         publicBoxKey: string;
+        groupId: string;
         mode: "open" | "approve";
     } | undefined;
 }, {
@@ -184,8 +240,12 @@ export declare const peersInviteContentsSchema: z.ZodEffects<z.ZodObject<{
     v: 1;
     inviter: {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
+        publicBoxKey: string;
+        anchors?: {
+            type: "peers-services" | "https";
+            url: string;
+        }[] | undefined;
         displayName?: string | undefined;
     };
     epoch: number;
@@ -194,8 +254,8 @@ export declare const peersInviteContentsSchema: z.ZodEffects<z.ZodObject<{
         name: string;
         role: GroupMemberRole;
         publicKey: string;
-        groupId: string;
         publicBoxKey: string;
+        groupId: string;
         mode: "open" | "approve";
     } | undefined;
 }>;
@@ -210,15 +270,37 @@ export declare const peersInviteSchema: z.ZodObject<{
         publicKey: z.ZodString;
         publicBoxKey: z.ZodString;
         displayName: z.ZodOptional<z.ZodString>;
+        /**
+         * Anchor list to store on first contact. A peer that already has a list
+         * keeps it; this is only the bootstrap that arrives with the invitation.
+         */
+        anchors: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            type: z.ZodEnum<["peers-services", "https"]>;
+            url: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            type: "peers-services" | "https";
+            url: string;
+        }, {
+            type: "peers-services" | "https";
+            url: string;
+        }>, "many">>;
     }, "strict", z.ZodTypeAny, {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
+        publicBoxKey: string;
+        anchors?: {
+            type: "peers-services" | "https";
+            url: string;
+        }[] | undefined;
         displayName?: string | undefined;
     }, {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
+        publicBoxKey: string;
+        anchors?: {
+            type: "peers-services" | "https";
+            url: string;
+        }[] | undefined;
         displayName?: string | undefined;
     }>;
     expiresAt: z.ZodString;
@@ -236,15 +318,15 @@ export declare const peersInviteSchema: z.ZodObject<{
         name: string;
         role: GroupMemberRole;
         publicKey: string;
-        groupId: string;
         publicBoxKey: string;
+        groupId: string;
         mode: "open" | "approve";
     }, {
         name: string;
         role: GroupMemberRole;
         publicKey: string;
-        groupId: string;
         publicBoxKey: string;
+        groupId: string;
         mode: "open" | "approve";
     }>>;
     signature: z.ZodString;
@@ -256,8 +338,12 @@ export declare const peersInviteSchema: z.ZodObject<{
     v: 1;
     inviter: {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
+        publicBoxKey: string;
+        anchors?: {
+            type: "peers-services" | "https";
+            url: string;
+        }[] | undefined;
         displayName?: string | undefined;
     };
     epoch: number;
@@ -266,8 +352,8 @@ export declare const peersInviteSchema: z.ZodObject<{
         name: string;
         role: GroupMemberRole;
         publicKey: string;
-        groupId: string;
         publicBoxKey: string;
+        groupId: string;
         mode: "open" | "approve";
     } | undefined;
 }, {
@@ -278,8 +364,12 @@ export declare const peersInviteSchema: z.ZodObject<{
     v: 1;
     inviter: {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
+        publicBoxKey: string;
+        anchors?: {
+            type: "peers-services" | "https";
+            url: string;
+        }[] | undefined;
         displayName?: string | undefined;
     };
     epoch: number;
@@ -288,8 +378,8 @@ export declare const peersInviteSchema: z.ZodObject<{
         name: string;
         role: GroupMemberRole;
         publicKey: string;
-        groupId: string;
         publicBoxKey: string;
+        groupId: string;
         mode: "open" | "approve";
     } | undefined;
 }>;

package/dist/invites/invite-token.js

@@ -12,6 +12,7 @@ exports.inviteDeepLink = inviteDeepLink;
 exports.clampInviteExpiry = clampInviteExpiry;
 const zod_1 = require("zod");
 const group_member_roles_1 = require("../data/group-member-roles");
+const anchor_document_1 = require("../identity/anchor-document");
 const keys_1 = require("../keys");
 const zod_types_1 = require("../types/zod-types");
 const base64UrlSchema = zod_1.z.string().regex(/^[A-Za-z0-9_-]+$/);
@@ -38,6 +39,11 @@ exports.inviteIdentitySchema = zod_1.z
     publicKey: base64UrlSchema.length(43),
     publicBoxKey: base64UrlSchema.length(43),
     displayName: zod_1.z.string().max(100).optional(),
+    /**
+     * Anchor list to store on first contact. A peer that already has a list
+     * keeps it; this is only the bootstrap that arrives with the invitation.
+     */
+    anchors: zod_1.z.array(anchor_document_1.anchorRefSchema).max(8).optional(),
 })
     .strict();
 /** How joiners are admitted by a group token. */

package/dist/keys.d.ts

@@ -55,6 +55,13 @@ export interface IDataBox {
 export declare function newKeys(): IPublicPrivateKeys;
 /** Re-derives public and box keys from an Ed25519 `secretKey` (same encoding as {@link newKeys}). */
 export declare function hydrateKeys(secretKey: string): IPublicPrivateKeys;
+/**
+ * Derives the X25519 box public key for an Ed25519 verification key, without the secret side.
+ * Produces the same `publicBoxKey` that {@link newKeys} / {@link hydrateKeys} compute from the
+ * secret, so a peer can check that an advertised box key really belongs to a signing key.
+ * @returns base64url box key, or `null` when `publicKey` is not a decodable 32-byte Ed25519 point
+ */
+export declare function derivePublicBoxKey(publicKey: string): string | null;
 /** Signs a UTF-8 message with Ed25519; returns base64url signed message (NaCl `sign` combined format). */
 export declare function signMessageWithSecretKey(msg: string, secretKey: string): string;
 /**

package/dist/keys.js

@@ -11,6 +11,7 @@ exports.decodeBase64 = decodeBase64;
 exports.newToken = newToken;
 exports.newKeys = newKeys;
 exports.hydrateKeys = hydrateKeys;
+exports.derivePublicBoxKey = derivePublicBoxKey;
 exports.signMessageWithSecretKey = signMessageWithSecretKey;
 exports.openMessageWithPublicKey = openMessageWithPublicKey;
 exports.signObjectWithSecretKey = signObjectWithSecretKey;
@@ -157,6 +158,25 @@ function hydrateKeys(secretKey) {
         publicBoxKey: encodeBase64(box.publicKey),
     };
 }
+/**
+ * Derives the X25519 box public key for an Ed25519 verification key, without the secret side.
+ * Produces the same `publicBoxKey` that {@link newKeys} / {@link hydrateKeys} compute from the
+ * secret, so a peer can check that an advertised box key really belongs to a signing key.
+ * @returns base64url box key, or `null` when `publicKey` is not a decodable 32-byte Ed25519 point
+ */
+function derivePublicBoxKey(publicKey) {
+    let bytes;
+    try {
+        bytes = decodeBase64(publicKey);
+    }
+    catch {
+        return null;
+    }
+    if (bytes.length !== 32)
+        return null;
+    const converted = ed2curve.convertPublicKey(bytes);
+    return converted ? encodeBase64(converted) : null;
+}
 /** Signs a UTF-8 message with Ed25519; returns base64url signed message (NaCl `sign` combined format). */
 function signMessageWithSecretKey(msg, secretKey) {
     const _secretKey = decodeBase64(secretKey);

package/dist/package-installer/package-author-signing.test.js

@@ -128,6 +128,17 @@ describe("package-author-signing", () => {
             const result = (0, package_author_signing_1.verifyPackageAuthorSignature)(tampered, keys.publicKey);
             expect(result.valid).toBe(false);
         });
+        it("fails when a signed createdBy is changed", () => {
+            const signed = makePV({ createdBy: "00author0000000000000000a" });
+            const signedSignature = (0, package_author_signing_1.signPackageAuthor)(signed, keys.secretKey);
+            const tampered = {
+                ...signed,
+                createdBy: "00attacker000000000000000a",
+                packageAuthorSignature: signedSignature,
+            };
+            const result = (0, package_author_signing_1.verifyPackageAuthorSignature)(tampered, keys.publicKey);
+            expect(result.valid).toBe(false);
+        });
     });
     describe("verification fails with wrong key", () => {
         it("rejects when verified against a different key", () => {

package/dist/package-installer/package-publisher.d.ts

@@ -33,7 +33,11 @@ export interface IBuildPublishArtifactsOpts {
     packageVersionId?: string;
     /** App navigation items to include in the tarball metadata. */
     appNavs?: IAppNav[];
-    /** Peer ID of the publisher. Recorded as `createdBy` on the PV. */
+    /**
+     * Peer ID recorded as `createdBy` and covered by the author signature.
+     * Defaults to `packageId`. The remote installer persists this field, and
+     * clients reject the version when the stored value is not the one that was signed.
+     */
     createdBy?: string;
 }
 /** Artifacts produced by {@link buildPublishArtifacts}. */

package/dist/package-installer/package-publisher.js

@@ -42,7 +42,7 @@ async function buildPublishArtifacts(opts) {
         routesBundleFileHash,
         uiBundleFileHash,
         appNavs: opts.appNavs,
-        createdBy: opts.createdBy,
+        createdBy: opts.createdBy || packageId,
         createdAt: now,
     };
     const payload = (0, package_author_signing_1.buildAuthorSignedPayload)(pvFields, publicKey);

package/dist/package-installer/package-publisher.test.js

@@ -93,6 +93,17 @@ describe("package-publisher", () => {
             const sigResult = (0, package_author_signing_1.verifyPackageAuthorSignature)(result.payload, wrongKeys.publicKey);
             expect(sigResult.valid).toBe(false);
         });
+        it("signs the package id as createdBy when the caller omits it", async () => {
+            const keys = (0, keys_1.newKeys)();
+            const opts = makeOpts({
+                publicKey: keys.publicKey,
+                sign: (payload) => (0, package_author_signing_1.signPackageAuthor)(payload, keys.secretKey),
+            });
+            const result = await (0, package_publisher_1.buildPublishArtifacts)(opts);
+            const unpacked = await (0, package_tarball_1.unpackPeersTarball)(result.tarball);
+            expect(unpacked.payload.createdBy).toBe(opts.packageId);
+            expect((0, package_author_signing_1.verifyPackageAuthorSignature)({ ...unpacked.payload, createdBy: opts.packageId }, keys.publicKey).valid).toBe(true);
+        });
         it("defaults versionTag to stable", async () => {
             const result = await (0, package_publisher_1.buildPublishArtifacts)(makeOpts());
             expect(result.pointer.versionTag).toBe("stable");

package/dist/package-installer/package-remote-checker.js

@@ -172,6 +172,9 @@ async function installRemotePackageVersion(dataContext, result) {
         appNavs: unpacked.payload.appNavs,
         packageAuthorSignature: unpacked.payload.packageAuthorSignature,
         signature: "",
+        // New publications include createdBy in the signed payload. Legacy
+        // tarballs omitted it, so their required database value defaults to the
+        // package id but does not pass later record-level author verification.
         createdBy: unpacked.payload.createdBy ?? packageId,
         createdAt: unpacked.payload.createdAt ?? new Date().toISOString(),
     };

package/dist/system-ids.d.ts

@@ -112,6 +112,22 @@ export declare const identityToolIds: {
     readonly signIn: "00muc9mlzx456ecfmzp1xn0db";
     readonly signOut: "00muc9mlzxwdm2yj5p5wkjvz7";
     readonly registerWithPeersServices: "00muc9mlzx07q98l3f9x49o10";
+    readonly getKeyInfo: "00mus1g5sfmu8vhazy7grwtjz";
+    readonly rotateKey: "00mus1g5sfrifcnula9crst8s";
+    readonly getRecoveryEmail: "00mustp0jrvoxpgion9dfgizc";
+    readonly bindEmailStart: "00mustox69twakb9sss2cto4g";
+    readonly bindEmailVerify: "00mustox6brb044r1ms5gylw5";
+    readonly unbindEmail: "00mustox6b3afftshfac8vc04";
+    readonly startAnchorSession: "00mustox6bjv7mo0jtywuzehm";
+    readonly confirmAnchorSession: "00mustox6bvmiuzzq4t7kg18q";
+    readonly contestRecovery: "00musvcrtk1bkhivlo3d9e51z";
+    readonly acceptRecovery: "00musvcrtlpgic1r6w2boo4k4";
+    readonly recoverKey: "00musvcrtl6ruaysm9f8he39x";
+    readonly setAnchors: "00musw0he8emme6dxl16ks885";
+    readonly passkeyRegisterStart: "00musw0he9s4v0lz8bn4qpk7w";
+    readonly passkeyRegisterFinish: "00musw0he9w4smpnzer0gqy22";
+    readonly passkeyAuthStart: "00musw0he9ad5zggw924sqd05";
+    readonly passkeyAuthFinish: "00musw0he9yq03hf7qyk3b8dn";
 };
 /**
  * Contract id for the local-only System Local Folders surface (`system.fs`).

package/dist/system-ids.js

@@ -119,6 +119,22 @@ exports.identityToolIds = {
     signIn: "00muc9mlzx456ecfmzp1xn0db",
     signOut: "00muc9mlzxwdm2yj5p5wkjvz7",
     registerWithPeersServices: "00muc9mlzx07q98l3f9x49o10",
+    getKeyInfo: "00mus1g5sfmu8vhazy7grwtjz",
+    rotateKey: "00mus1g5sfrifcnula9crst8s",
+    getRecoveryEmail: "00mustp0jrvoxpgion9dfgizc",
+    bindEmailStart: "00mustox69twakb9sss2cto4g",
+    bindEmailVerify: "00mustox6brb044r1ms5gylw5",
+    unbindEmail: "00mustox6b3afftshfac8vc04",
+    startAnchorSession: "00mustox6bjv7mo0jtywuzehm",
+    confirmAnchorSession: "00mustox6bvmiuzzq4t7kg18q",
+    contestRecovery: "00musvcrtk1bkhivlo3d9e51z",
+    acceptRecovery: "00musvcrtlpgic1r6w2boo4k4",
+    recoverKey: "00musvcrtl6ruaysm9f8he39x",
+    setAnchors: "00musw0he8emme6dxl16ks885",
+    passkeyRegisterStart: "00musw0he9s4v0lz8bn4qpk7w",
+    passkeyRegisterFinish: "00musw0he9w4smpnzer0gqy22",
+    passkeyAuthStart: "00musw0he9ad5zggw924sqd05",
+    passkeyAuthFinish: "00musw0he9yq03hf7qyk3b8dn",
 };
 /**
  * Contract id for the local-only System Local Folders surface (`system.fs`).

package/dist/types/workflow.d.ts

@@ -44,8 +44,8 @@ export declare const workflowSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     name: string;
     description: string;
-    createdAt: Date;
     updatedAt: Date;
+    createdAt: Date;
     workflowId: string;
     defaultAssistantId: string;
     instructions: {
@@ -62,9 +62,9 @@ export declare const workflowSchema: z.ZodObject<{
     workflowId: string;
     defaultAssistantId: string;
     createdBy: string;
+    updatedAt?: Date | undefined;
     packageId?: string | undefined;
     createdAt?: Date | undefined;
-    updatedAt?: Date | undefined;
     instructions?: {
         markdown?: string | undefined;
         onError?: string | undefined;

package/dist/utils.d.ts

@@ -128,6 +128,16 @@ export declare function retryOnErrorOrTimeout<T>({ fn, connection, opts, }: {
         retriesOnTimeout?: number;
     };
 }): Promise<T>;
+/**
+ * Read a fetch response body as text, giving up once it exceeds `maxBytes`.
+ *
+ * The body is streamed and the connection is cancelled as soon as the cap is passed, so a
+ * hostile server cannot make the caller download an arbitrarily large response before the
+ * size is checked. Falls back to `text()` when the body is not streamable (test doubles).
+ *
+ * @returns the decoded text, or `undefined` when the body is larger than `maxBytes`
+ */
+export declare function readResponseTextCapped(response: Response, maxBytes: number): Promise<string | undefined>;
 /**
  * Return a table's physical storage name.
  *

package/dist/utils.js

@@ -21,6 +21,7 @@ exports.memoizePromise = memoizePromise;
 exports.debounceByArgs = debounceByArgs;
 exports.getTimestamp = getTimestamp;
 exports.retryOnErrorOrTimeout = retryOnErrorOrTimeout;
+exports.readResponseTextCapped = readResponseTextCapped;
 exports.getFullTableName = getFullTableName;
 const _ = require("lodash");
 const nacl = require("tweetnacl");
@@ -389,6 +390,48 @@ async function retryOnErrorOrTimeout({ fn, connection, opts = {}, }) {
         throw new Error(`Timeout after ${timeoutCount} retries waiting for ${timeout}ms`);
     }
 }
+/**
+ * Read a fetch response body as text, giving up once it exceeds `maxBytes`.
+ *
+ * The body is streamed and the connection is cancelled as soon as the cap is passed, so a
+ * hostile server cannot make the caller download an arbitrarily large response before the
+ * size is checked. Falls back to `text()` when the body is not streamable (test doubles).
+ *
+ * @returns the decoded text, or `undefined` when the body is larger than `maxBytes`
+ */
+async function readResponseTextCapped(response, maxBytes) {
+    const body = response.body;
+    if (!body || typeof body.getReader !== "function") {
+        const text = await response.text();
+        return new TextEncoder().encode(text).byteLength > maxBytes ? undefined : text;
+    }
+    const reader = body.getReader();
+    const chunks = [];
+    let received = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            received += value.byteLength;
+            if (received > maxBytes) {
+                await reader.cancel().catch(() => undefined);
+                return undefined;
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const joined = new Uint8Array(received);
+    let offset = 0;
+    for (const chunk of chunks) {
+        joined.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return new TextDecoder().decode(joined);
+}
 /**
  * Return a table's physical storage name.
  *

package/dist/utils.test.js

@@ -2,6 +2,29 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const lodash_1 = require("lodash");
 const utils_1 = require("./utils");
+describe("readResponseTextCapped", () => {
+    it("returns a body within the cap and refuses one over it", async () => {
+        await expect((0, utils_1.readResponseTextCapped)(new Response("hello"), 5)).resolves.toBe("hello");
+        await expect((0, utils_1.readResponseTextCapped)(new Response("hello!"), 5)).resolves.toBeUndefined();
+    });
+    it("stops reading a streamed body as soon as the cap is passed", async () => {
+        let pulled = 0;
+        let cancelled = false;
+        const stream = new ReadableStream({
+            pull(controller) {
+                pulled++;
+                controller.enqueue(new Uint8Array(1024));
+            },
+            cancel() {
+                cancelled = true;
+            },
+        });
+        await expect((0, utils_1.readResponseTextCapped)(new Response(stream), 4096)).resolves.toBeUndefined();
+        expect(cancelled).toBe(true);
+        // Five chunks pass the cap; an unbounded reader would never stop.
+        expect(pulled).toBeLessThanOrEqual(8);
+    });
+});
 describe("getTimestamp", () => {
     afterEach(() => {
         jest.restoreAllMocks();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peers-app/peers-sdk",
-  "version": "0.25.13",
+  "version": "0.25.15",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/peers-app/peers-sdk.git"