@stigmer/outbound 3.34.0 → 3.35.0

package/README.md

@@ -4,7 +4,7 @@ The rules a Stigmer process follows when it dials a URL a user supplied, shared
 
 Two entry points:
 
-- `@stigmer/outbound/egress`: which addresses a process refuses to dial (`blockedReason`, two postures, `strict` for managed cloud processes and `relaxed` for a machine that belongs to the user), the check that applies a policy to a URL after resolving every address it has (`checkEgress`), and the fetch that applies it to every redirect hop (`guardedFetch`). A process composes one guarded fetch at its root and hands it to every module that dials; the modules hold no `fetch` of their own.
+- `@stigmer/outbound/egress`: which addresses a process refuses to dial (`blockedReason`, two postures, `strict` for managed cloud processes and `relaxed` for a machine that belongs to the user), the check that applies a policy to a URL after resolving every address it has (`checkEgress`), and the fetch that applies it to every redirect hop and bounds every response body (`guardedFetch`). A process composes one guarded fetch at its root and hands it to every module that dials; the modules hold no `fetch` of their own.
 - `@stigmer/outbound/mcp-oauth`: how an MCP endpoint's authentication is read without a credential (`isOAuthChallenge`, the complete `initializeRequest`, `probeEndpointAuth`) and how its login server is found (`resolveAuthorizationServers` over RFC 9728, `readAuthorizationServerMetadata` over RFC 8414 with the issuer's path and OpenID's document).
 
 ## Why one library

package/egress/check.d.ts

@@ -24,6 +24,10 @@ export type EgressRefusal = {
     readonly kind: "too-many-redirects";
     readonly url: URL;
     readonly hops: number;
+} | {
+    readonly kind: "response-too-large";
+    readonly url: URL;
+    readonly maxBytes: number;
 };
 export type EgressCheck = {
     readonly ok: true;

package/egress/check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/egress/check.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;AAExE,uFAAuF;AACvF,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnF;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC/E;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtF,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC/E;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AAE5D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAC;CAClD;AAED,gEAAgE;AAChE,wBAAgB,eAAe,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAiB9D;AAED,2DAA2D;AAC3D,qBAAa,WAAY,SAAQ,KAAK;IACxB,QAAQ,CAAC,OAAO,EAAE,aAAa;gBAAtB,OAAO,EAAE,aAAa;CAI5C;AAED,uEAAuE;AACvE,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CAyB/H"}
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/egress/check.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;AAExE,uFAAuF;AACvF,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnF;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC/E;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACjF;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1F,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC/E;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;CAAE,CAAC;AAE5D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,CAAC;CAClD;AAED,gEAAgE;AAChE,wBAAgB,eAAe,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAmB9D;AAED,2DAA2D;AAC3D,qBAAa,WAAY,SAAQ,KAAK;IACxB,QAAQ,CAAC,OAAO,EAAE,aAAa;gBAAtB,OAAO,EAAE,aAAa;CAI5C;AAED,uEAAuE;AACvE,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CAyB/H"}

package/egress/check.js

@@ -39,6 +39,8 @@ export function describeRefusal(refusal) {
             return `Refusing to reach ${refusal.hostname}: it resolves to ${refusal.address}, a ${refusal.reason} address the ${refusal.policy} egress policy does not dial.`;
         case "too-many-redirects":
             return `Refusing to follow more than ${refusal.hops} redirects from ${refusal.url.href}.`;
+        case "response-too-large":
+            return `Refusing to read more than ${refusal.maxBytes} bytes from ${refusal.url.href}.`;
         default: {
             const exhaustive = refusal;
             return exhaustive;

package/egress/check.js.map

@@ -1 +1 @@
-{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/egress/check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAgChC,gEAAgE;AAChE,MAAM,UAAU,eAAe,CAAC,OAAsB;IACpD,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,aAAa;YAChB,OAAO,gBAAgB,OAAO,CAAC,GAAG,EAAE,CAAC;QACvC,KAAK,oBAAoB;YACvB,OAAO,2BAA2B,OAAO,CAAC,MAAM,qCAAqC,CAAC;QACxF,KAAK,cAAc;YACjB,OAAO,+BAA+B,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC3D,KAAK,SAAS;YACZ,OAAO,qBAAqB,OAAO,CAAC,QAAQ,oBAAoB,OAAO,CAAC,OAAO,OAAO,OAAO,CAAC,MAAM,gBAAgB,OAAO,CAAC,MAAM,+BAA+B,CAAC;QACpK,KAAK,oBAAoB;YACvB,OAAO,gCAAgC,OAAO,CAAC,IAAI,mBAAmB,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;QAC5F,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,OAAO,CAAC;YAClC,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;AACH,CAAC;AAED,2DAA2D;AAC3D,MAAM,OAAO,WAAY,SAAQ,KAAK;IACf;IAArB,YAAqB,OAAsB;QACzC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QADb,YAAO,GAAP,OAAO,CAAe;QAEzC,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAoB,EAAE,MAAoB,EAAE,OAA2B;IACvG,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;IAC9E,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;IAC7G,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAChE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;IACvF,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACxH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,OAA2B;IAC3E,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACjD,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,OAAO,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3E,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI;YAAE,MAAM,KAAK,CAAC;QAClD,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAI,OAAmB,EAAE,MAAsC;IAChF,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAC5D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,uEAAuE;QACvE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC/B,OAAO,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC/B,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9B,CAAC,CAAC;QACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE;YACR,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;YACjB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAAmB;IACtC,OAAO,MAAM,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,4BAA4B,EAAE,YAAY,CAAC,CAAC;AACvF,CAAC"}
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/egress/check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAiChC,gEAAgE;AAChE,MAAM,UAAU,eAAe,CAAC,OAAsB;IACpD,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,aAAa;YAChB,OAAO,gBAAgB,OAAO,CAAC,GAAG,EAAE,CAAC;QACvC,KAAK,oBAAoB;YACvB,OAAO,2BAA2B,OAAO,CAAC,MAAM,qCAAqC,CAAC;QACxF,KAAK,cAAc;YACjB,OAAO,+BAA+B,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC3D,KAAK,SAAS;YACZ,OAAO,qBAAqB,OAAO,CAAC,QAAQ,oBAAoB,OAAO,CAAC,OAAO,OAAO,OAAO,CAAC,MAAM,gBAAgB,OAAO,CAAC,MAAM,+BAA+B,CAAC;QACpK,KAAK,oBAAoB;YACvB,OAAO,gCAAgC,OAAO,CAAC,IAAI,mBAAmB,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;QAC5F,KAAK,oBAAoB;YACvB,OAAO,8BAA8B,OAAO,CAAC,QAAQ,eAAe,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;QAC1F,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,OAAO,CAAC;YAClC,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;AACH,CAAC;AAED,2DAA2D;AAC3D,MAAM,OAAO,WAAY,SAAQ,KAAK;IACf;IAArB,YAAqB,OAAsB;QACzC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QADb,YAAO,GAAP,OAAO,CAAe;QAEzC,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAoB,EAAE,MAAoB,EAAE,OAA2B;IACvG,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;IAC9E,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;IAC7G,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAChE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;IACvF,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACxH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,OAA2B;IAC3E,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACjD,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,OAAO,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3E,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI;YAAE,MAAM,KAAK,CAAC;QAClD,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAI,OAAmB,EAAE,MAAsC;IAChF,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAC5D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,uEAAuE;QACvE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC/B,OAAO,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC/B,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9B,CAAC,CAAC;QACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE;YACR,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;YACjB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAAmB;IACtC,OAAO,MAAM,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,4BAA4B,EAAE,YAAY,CAAC,CAAC;AACvF,CAAC"}

package/egress/fetch.d.ts

@@ -20,6 +20,17 @@
  * one host never travels to another. A 303, or a 301/302 answering a
  * non-GET, becomes a GET without a body; 307 and 308 keep method and body.
  *
+ * Every response body is bounded (`maxResponseBytes`, a mebibyte by
+ * default). The URLs these callers dial are written by users, so a document
+ * that never ends is an attack on the process that reads it, and every
+ * caller today reads a small document: a JWKS, a discovery or metadata
+ * document, a token response. The bound applies to the body, not the dial:
+ * the response resolves as it came, and reading past the bound rejects with
+ * an `EgressError` whose refusal is `response-too-large`, so each caller's
+ * existing "could not read the document" arm answers it. A declared
+ * `Content-Length` over the bound rejects on the first read, before any byte
+ * is buffered. A caller that streams passes `Number.POSITIVE_INFINITY`.
+ *
  * `OutboundFetch` takes a string or a URL, never a `Request`: a Request
  * carries its own headers and body that a wrapper would have to merge, and
  * no caller here builds one. The global `fetch` is assignable to it, so a
@@ -36,9 +47,13 @@ export interface GuardedFetchOptions {
     readonly lookup: LookupFn;
     /** Hops followed before refusing; default 3. */
     readonly maxRedirects?: number;
+    /** Bytes of a response body read before refusing; default one mebibyte. */
+    readonly maxResponseBytes?: number;
 }
 /** The default hop budget: a scheme upgrade and a canonicalisation, with one to spare. */
 export declare const DEFAULT_MAX_REDIRECTS = 3;
+/** The default body bound: a thousand times a large JWKS, far below what a pod can buffer. */
+export declare const DEFAULT_MAX_RESPONSE_BYTES: number;
 /**
  * An `OutboundFetch` in the global `fetch`'s shape, for a seam typed
  * `typeof fetch`. A `Request` input is refused rather than flattened: this

package/egress/fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../src/egress/fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAA4B,KAAK,QAAQ,EAAE,MAAM,YAAY,CAAC;AAErE,6FAA6F;AAC7F,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEzF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,gDAAgD;IAChD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,0FAA0F;AAC1F,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAIvC;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,KAAK,CAK7D;AAED,0EAA0E;AAC1E,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,mBAAmB,GAAG,aAAa,CAyC9F"}
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../src/egress/fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAA4B,KAAK,QAAQ,EAAE,MAAM,YAAY,CAAC;AAErE,6FAA6F;AAC7F,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEzF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,gDAAgD;IAChD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,0FAA0F;AAC1F,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC,8FAA8F;AAC9F,eAAO,MAAM,0BAA0B,QAAc,CAAC;AAOtD;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,KAAK,CAK7D;AAED,0EAA0E;AAC1E,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,mBAAmB,GAAG,aAAa,CA0C9F"}

package/egress/fetch.js

@@ -1,7 +1,11 @@
 import { checkEgress, EgressError } from "./check.js";
 /** The default hop budget: a scheme upgrade and a canonicalisation, with one to spare. */
 export const DEFAULT_MAX_REDIRECTS = 3;
+/** The default body bound: a thousand times a large JWKS, far below what a pod can buffer. */
+export const DEFAULT_MAX_RESPONSE_BYTES = 1024 * 1024;
 const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+/** Statuses whose responses carry no body, which `new Response` refuses to give one. */
+const NULL_BODY_STATUSES = new Set([101, 204, 205, 304]);
 /**
  * An `OutboundFetch` in the global `fetch`'s shape, for a seam typed
  * `typeof fetch`. A `Request` input is refused rather than flattened: this
@@ -19,6 +23,7 @@ export function asFetch(outbound) {
 /** Compose a fetch that judges every URL and every hop under `policy`. */
 export function guardedFetch(policy, options) {
     const maxRedirects = options.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
+    const maxResponseBytes = options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES;
     return async (input, init) => {
         let url = new URL(input);
         let method = (init?.method ?? "GET").toUpperCase();
@@ -32,7 +37,7 @@ export function guardedFetch(policy, options) {
             const response = await options.fetchImpl(url, { ...init, method, body, headers, redirect: "manual" });
             const location = response.headers.get("location");
             if (!REDIRECT_STATUSES.has(response.status) || location === null || callerRedirect === "manual") {
-                return response;
+                return boundedResponse(response, url, maxResponseBytes);
             }
             if (callerRedirect === "error") {
                 await response.body?.cancel();
@@ -56,4 +61,32 @@ export function guardedFetch(policy, options) {
         }
     };
 }
+/**
+ * The response with its body bounded: the same status and headers over a
+ * body that errors once it passes `maxBytes`, or at once when the declared
+ * length already does.
+ */
+function boundedResponse(response, url, maxBytes) {
+    if (response.body === null || NULL_BODY_STATUSES.has(response.status) || !Number.isFinite(maxBytes)) {
+        return response;
+    }
+    const tooLarge = () => new EgressError({ kind: "response-too-large", url, maxBytes });
+    const declared = Number(response.headers.get("content-length") ?? Number.NaN);
+    let read = 0;
+    const body = response.body.pipeThrough(new TransformStream({
+        start(controller) {
+            if (Number.isFinite(declared) && declared > maxBytes)
+                controller.error(tooLarge());
+        },
+        transform(chunk, controller) {
+            read += chunk.byteLength;
+            if (read > maxBytes) {
+                controller.error(tooLarge());
+                return;
+            }
+            controller.enqueue(chunk);
+        },
+    }));
+    return new Response(body, { status: response.status, statusText: response.statusText, headers: response.headers });
+}
 //# sourceMappingURL=fetch.js.map

package/egress/fetch.js.map

@@ -1 +1 @@
-{"version":3,"file":"fetch.js","sourceRoot":"","sources":["../../src/egress/fetch.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAiB,MAAM,YAAY,CAAC;AAYrE,0FAA0F;AAC1F,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEvC,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAElF;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CAAC,QAAuB;IAC7C,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,YAAY,GAAG;YAAE,OAAO,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACpF,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,0CAA0C,CAAC,CAAC,CAAC;IACnF,CAAC,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,YAAY,CAAC,MAAoB,EAAE,OAA4B;IAC7E,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC;IAEnE,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC3B,IAAI,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,IAAI,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC;QACtB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,cAAc,GAAG,IAAI,EAAE,QAAQ,IAAI,QAAQ,CAAC;QAElD,KAAK,IAAI,GAAG,GAAG,CAAC,GAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC/F,IAAI,CAAC,KAAK,CAAC,EAAE;gBAAE,MAAM,IAAI,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAEpD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;YAEtG,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,cAAc,KAAK,QAAQ,EAAE,CAAC;gBAChG,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC;gBAC/B,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;gBAC9B,MAAM,IAAI,SAAS,CAAC,2CAA2C,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,IAAI,GAAG,IAAI,YAAY,EAAE,CAAC;gBACxB,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;gBAC9B,MAAM,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;YACjF,CAAC;YAED,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACpC,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;gBAAE,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAChE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;gBAC/H,MAAM,GAAG,KAAK,CAAC;gBACf,IAAI,GAAG,SAAS,CAAC;gBACjB,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;gBAC/B,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACnC,CAAC;YACD,GAAG,GAAG,IAAI,CAAC;QACb,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"fetch.js","sourceRoot":"","sources":["../../src/egress/fetch.ts"],"names":[],"mappings":"AAyCA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAiB,MAAM,YAAY,CAAC;AAcrE,0FAA0F;AAC1F,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEvC,8FAA8F;AAC9F,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,GAAG,IAAI,CAAC;AAEtD,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAElF,wFAAwF;AACxF,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CAAC,QAAuB;IAC7C,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,YAAY,GAAG;YAAE,OAAO,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACpF,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,0CAA0C,CAAC,CAAC,CAAC;IACnF,CAAC,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,YAAY,CAAC,MAAoB,EAAE,OAA4B;IAC7E,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC;IACnE,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,CAAC;IAEhF,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC3B,IAAI,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACnD,IAAI,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC;QACtB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,cAAc,GAAG,IAAI,EAAE,QAAQ,IAAI,QAAQ,CAAC;QAElD,KAAK,IAAI,GAAG,GAAG,CAAC,GAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC/F,IAAI,CAAC,KAAK,CAAC,EAAE;gBAAE,MAAM,IAAI,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAEpD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;YAEtG,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,cAAc,KAAK,QAAQ,EAAE,CAAC;gBAChG,OAAO,eAAe,CAAC,QAAQ,EAAE,GAAG,EAAE,gBAAgB,CAAC,CAAC;YAC1D,CAAC;YACD,IAAI,cAAc,KAAK,OAAO,EAAE,CAAC;gBAC/B,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;gBAC9B,MAAM,IAAI,SAAS,CAAC,2CAA2C,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,IAAI,GAAG,IAAI,YAAY,EAAE,CAAC;gBACxB,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;gBAC9B,MAAM,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;YACjF,CAAC;YAED,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YACpC,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;gBAAE,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAChE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;gBAC/H,MAAM,GAAG,KAAK,CAAC;gBACf,IAAI,GAAG,SAAS,CAAC;gBACjB,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;gBAC/B,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACnC,CAAC;YACD,GAAG,GAAG,IAAI,CAAC;QACb,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,QAAkB,EAAE,GAAQ,EAAE,QAAgB;IACrE,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpG,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,GAAgB,EAAE,CAAC,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnG,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;IAC9E,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,CACpC,IAAI,eAAe,CAAyB;QAC1C,KAAK,CAAC,UAAU;YACd,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,QAAQ;gBAAE,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,SAAS,CAAC,KAAK,EAAE,UAAU;YACzB,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;YACzB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACpB,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;YACD,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;KACF,CAAC,CACH,CAAC;IACF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;AACrH,CAAC"}

package/egress/index.d.ts

@@ -5,6 +5,6 @@
  */
 export { blockedReason, egressPolicyForPosture, type EgressPolicy, type EgressPosture } from "./address.js";
 export { checkEgress, describeRefusal, EgressError, type EgressCheck, type EgressCheckOptions, type EgressRefusal, type LookupFn, } from "./check.js";
-export { asFetch, DEFAULT_MAX_REDIRECTS, guardedFetch, type GuardedFetchOptions, type OutboundFetch } from "./fetch.js";
+export { asFetch, DEFAULT_MAX_REDIRECTS, DEFAULT_MAX_RESPONSE_BYTES, guardedFetch, type GuardedFetchOptions, type OutboundFetch } from "./fetch.js";
 export { nodeLookup } from "./node-lookup.js";
 //# sourceMappingURL=index.d.ts.map

package/egress/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/egress/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAC5G,OAAO,EACL,WAAW,EACX,eAAe,EACf,WAAW,EACX,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,QAAQ,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AACxH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/egress/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAC5G,OAAO,EACL,WAAW,EACX,eAAe,EACf,WAAW,EACX,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,QAAQ,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AACpJ,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC"}

package/egress/index.js

@@ -5,6 +5,6 @@
  */
 export { blockedReason, egressPolicyForPosture } from "./address.js";
 export { checkEgress, describeRefusal, EgressError, } from "./check.js";
-export { asFetch, DEFAULT_MAX_REDIRECTS, guardedFetch } from "./fetch.js";
+export { asFetch, DEFAULT_MAX_REDIRECTS, DEFAULT_MAX_RESPONSE_BYTES, guardedFetch } from "./fetch.js";
 export { nodeLookup } from "./node-lookup.js";
 //# sourceMappingURL=index.js.map

package/egress/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/egress/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAyC,MAAM,cAAc,CAAC;AAC5G,OAAO,EACL,WAAW,EACX,eAAe,EACf,WAAW,GAKZ,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAgD,MAAM,YAAY,CAAC;AACxH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/egress/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAyC,MAAM,cAAc,CAAC;AAC5G,OAAO,EACL,WAAW,EACX,eAAe,EACf,WAAW,GAKZ,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,YAAY,EAAgD,MAAM,YAAY,CAAC;AACpJ,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/outbound",
-  "version": "3.34.0",
+  "version": "3.35.0",
   "description": "The rules Stigmer's TypeScript processes dial a user-supplied endpoint by, shared by the control plane, the runner and the catalogue audit: the egress address policy and its guarded fetch, and the way an MCP endpoint's authentication is read (the OAuth-challenge rule, the complete initialize handshake, the RFC 9728 / RFC 8414 / OpenID resolution of its login server)",
   "license": "Apache-2.0",
   "type": "module",

package/src/__tests__/fetch.test.ts

@@ -2,13 +2,17 @@
  * Pins the guarded fetch: the first URL and every hop judged, a caller's
  * `redirect: "manual"` honoured, `redirect: "error"` thrown like fetch, the
  * hop budget, the Authorization header dropped across origins, and the
- * method rewrite a 303 (or a 301/302 on a POST) implies.
+ * method rewrite a 303 (or a 301/302 on a POST) implies. Then the body
+ * bound: a body within it reads whole, one that runs past it or declares
+ * a length past it rejects its read (never the dial) as
+ * `response-too-large`, the default is a mebibyte, and an unbounded caller
+ * reads everything.
  */
 import { describe, expect, it } from "vitest";
 
 import { egressPolicyForPosture } from "../egress/address.js";
 import { EgressError, type LookupFn } from "../egress/check.js";
-import { asFetch, guardedFetch, type OutboundFetch } from "../egress/fetch.js";
+import { asFetch, DEFAULT_MAX_RESPONSE_BYTES, guardedFetch, type OutboundFetch } from "../egress/fetch.js";
 
 const strict = egressPolicyForPosture("strict");
 
@@ -159,3 +163,74 @@ describe("guardedFetch", () => {
     await expect(pending).rejects.toThrow("deadline");
   });
 });
+
+/** A body served in chunks with no declared length, as a streaming server sends it. */
+function chunked(...chunks: readonly string[]): () => Response {
+  return () => {
+    const encoder = new TextEncoder();
+    const stream = new ReadableStream<Uint8Array>({
+      start(controller) {
+        for (const chunk of chunks) controller.enqueue(encoder.encode(chunk));
+        controller.close();
+      },
+    });
+    return new Response(stream, { status: 200 });
+  };
+}
+
+async function refusalOf(pending: Promise<unknown>): Promise<unknown> {
+  try {
+    await pending;
+  } catch (error) {
+    return error instanceof EgressError ? error.refusal : error;
+  }
+  throw new Error("the read resolved");
+}
+
+describe("guardedFetch's body bound", () => {
+  it("reads a body within the bound whole, with the status and headers it came with", async () => {
+    const { fetchImpl } = scripted({
+      "https://a.vendor.test/jwks": () => new Response('{"keys":[]}', { status: 200, headers: { "content-type": "application/json" } }),
+    });
+    const response = await guardedFetch(strict, { fetchImpl, lookup, maxResponseBytes: 64 })("https://a.vendor.test/jwks");
+    expect(response.status).toBe(200);
+    expect(response.headers.get("content-type")).toBe("application/json");
+    await expect(response.json()).resolves.toEqual({ keys: [] });
+  });
+
+  it("resolves the dial and rejects the read of a body that runs past the bound", async () => {
+    const { fetchImpl } = scripted({ "https://a.vendor.test/jwks": chunked("0123456789", "0123456789") });
+    const response = await guardedFetch(strict, { fetchImpl, lookup, maxResponseBytes: 15 })("https://a.vendor.test/jwks");
+    expect(response.status).toBe(200);
+    expect(await refusalOf(response.text())).toMatchObject({ kind: "response-too-large", maxBytes: 15 });
+  });
+
+  it("rejects the first read of a body whose declared length is past the bound", async () => {
+    const { fetchImpl } = scripted({
+      "https://a.vendor.test/jwks": () => new Response("0123456789", { status: 200, headers: { "content-length": "10" } }),
+    });
+    const response = await guardedFetch(strict, { fetchImpl, lookup, maxResponseBytes: 9 })("https://a.vendor.test/jwks");
+    const refusal = await refusalOf(response.arrayBuffer());
+    expect(refusal).toMatchObject({ kind: "response-too-large", maxBytes: 9 });
+    expect((refusal as { url: URL }).url.href).toBe("https://a.vendor.test/jwks");
+  });
+
+  it("bounds every caller by a mebibyte unless it says otherwise", async () => {
+    expect(DEFAULT_MAX_RESPONSE_BYTES).toBe(1024 * 1024);
+    const oversized = "x".repeat(DEFAULT_MAX_RESPONSE_BYTES + 1);
+    const { fetchImpl } = scripted({ "https://a.vendor.test/doc": chunked(oversized) });
+    const response = await guardedFetch(strict, { fetchImpl, lookup })("https://a.vendor.test/doc");
+    expect(await refusalOf(response.text())).toMatchObject({ kind: "response-too-large", maxBytes: DEFAULT_MAX_RESPONSE_BYTES });
+  });
+
+  it("reads everything for a caller that streams", async () => {
+    const { fetchImpl } = scripted({ "https://a.vendor.test/events": chunked("a".repeat(32), "b".repeat(32)) });
+    const response = await guardedFetch(strict, { fetchImpl, lookup, maxResponseBytes: Number.POSITIVE_INFINITY })("https://a.vendor.test/events");
+    await expect(response.text()).resolves.toHaveLength(64);
+  });
+
+  it("describes the refusal with the bound and the URL", () => {
+    const error = new EgressError({ kind: "response-too-large", url: new URL("https://a.vendor.test/jwks"), maxBytes: 9 });
+    expect(error.message).toBe("Refusing to read more than 9 bytes from https://a.vendor.test/jwks.");
+  });
+});

package/src/egress/check.ts

@@ -45,7 +45,8 @@ export type EgressRefusal =
       readonly reason: string;
       readonly policy: string;
     }
-  | { readonly kind: "too-many-redirects"; readonly url: URL; readonly hops: number };
+  | { readonly kind: "too-many-redirects"; readonly url: URL; readonly hops: number }
+  | { readonly kind: "response-too-large"; readonly url: URL; readonly maxBytes: number };
 
 export type EgressCheck =
   | { readonly ok: true; readonly url: URL; readonly addresses: readonly string[] }
@@ -70,6 +71,8 @@ export function describeRefusal(refusal: EgressRefusal): string {
       return `Refusing to reach ${refusal.hostname}: it resolves to ${refusal.address}, a ${refusal.reason} address the ${refusal.policy} egress policy does not dial.`;
     case "too-many-redirects":
       return `Refusing to follow more than ${refusal.hops} redirects from ${refusal.url.href}.`;
+    case "response-too-large":
+      return `Refusing to read more than ${refusal.maxBytes} bytes from ${refusal.url.href}.`;
     default: {
       const exhaustive: never = refusal;
       return exhaustive;

package/src/egress/fetch.ts

@@ -20,6 +20,17 @@
  * one host never travels to another. A 303, or a 301/302 answering a
  * non-GET, becomes a GET without a body; 307 and 308 keep method and body.
  *
+ * Every response body is bounded (`maxResponseBytes`, a mebibyte by
+ * default). The URLs these callers dial are written by users, so a document
+ * that never ends is an attack on the process that reads it, and every
+ * caller today reads a small document: a JWKS, a discovery or metadata
+ * document, a token response. The bound applies to the body, not the dial:
+ * the response resolves as it came, and reading past the bound rejects with
+ * an `EgressError` whose refusal is `response-too-large`, so each caller's
+ * existing "could not read the document" arm answers it. A declared
+ * `Content-Length` over the bound rejects on the first read, before any byte
+ * is buffered. A caller that streams passes `Number.POSITIVE_INFINITY`.
+ *
  * `OutboundFetch` takes a string or a URL, never a `Request`: a Request
  * carries its own headers and body that a wrapper would have to merge, and
  * no caller here builds one. The global `fetch` is assignable to it, so a
@@ -38,13 +49,21 @@ export interface GuardedFetchOptions {
   readonly lookup: LookupFn;
   /** Hops followed before refusing; default 3. */
   readonly maxRedirects?: number;
+  /** Bytes of a response body read before refusing; default one mebibyte. */
+  readonly maxResponseBytes?: number;
 }
 
 /** The default hop budget: a scheme upgrade and a canonicalisation, with one to spare. */
 export const DEFAULT_MAX_REDIRECTS = 3;
 
+/** The default body bound: a thousand times a large JWKS, far below what a pod can buffer. */
+export const DEFAULT_MAX_RESPONSE_BYTES = 1024 * 1024;
+
 const REDIRECT_STATUSES: ReadonlySet<number> = new Set([301, 302, 303, 307, 308]);
 
+/** Statuses whose responses carry no body, which `new Response` refuses to give one. */
+const NULL_BODY_STATUSES: ReadonlySet<number> = new Set([101, 204, 205, 304]);
+
 /**
  * An `OutboundFetch` in the global `fetch`'s shape, for a seam typed
  * `typeof fetch`. A `Request` input is refused rather than flattened: this
@@ -62,6 +81,7 @@ export function asFetch(outbound: OutboundFetch): typeof fetch {
 /** Compose a fetch that judges every URL and every hop under `policy`. */
 export function guardedFetch(policy: EgressPolicy, options: GuardedFetchOptions): OutboundFetch {
   const maxRedirects = options.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
+  const maxResponseBytes = options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES;
 
   return async (input, init) => {
     let url = new URL(input);
@@ -78,7 +98,7 @@ export function guardedFetch(policy: EgressPolicy, options: GuardedFetchOptions)
 
       const location = response.headers.get("location");
       if (!REDIRECT_STATUSES.has(response.status) || location === null || callerRedirect === "manual") {
-        return response;
+        return boundedResponse(response, url, maxResponseBytes);
       }
       if (callerRedirect === "error") {
         await response.body?.cancel();
@@ -102,3 +122,33 @@ export function guardedFetch(policy: EgressPolicy, options: GuardedFetchOptions)
     }
   };
 }
+
+/**
+ * The response with its body bounded: the same status and headers over a
+ * body that errors once it passes `maxBytes`, or at once when the declared
+ * length already does.
+ */
+function boundedResponse(response: Response, url: URL, maxBytes: number): Response {
+  if (response.body === null || NULL_BODY_STATUSES.has(response.status) || !Number.isFinite(maxBytes)) {
+    return response;
+  }
+  const tooLarge = (): EgressError => new EgressError({ kind: "response-too-large", url, maxBytes });
+  const declared = Number(response.headers.get("content-length") ?? Number.NaN);
+  let read = 0;
+  const body = response.body.pipeThrough(
+    new TransformStream<Uint8Array, Uint8Array>({
+      start(controller) {
+        if (Number.isFinite(declared) && declared > maxBytes) controller.error(tooLarge());
+      },
+      transform(chunk, controller) {
+        read += chunk.byteLength;
+        if (read > maxBytes) {
+          controller.error(tooLarge());
+          return;
+        }
+        controller.enqueue(chunk);
+      },
+    }),
+  );
+  return new Response(body, { status: response.status, statusText: response.statusText, headers: response.headers });
+}

package/src/egress/index.ts

@@ -13,5 +13,5 @@ export {
   type EgressRefusal,
   type LookupFn,
 } from "./check.js";
-export { asFetch, DEFAULT_MAX_REDIRECTS, guardedFetch, type GuardedFetchOptions, type OutboundFetch } from "./fetch.js";
+export { asFetch, DEFAULT_MAX_REDIRECTS, DEFAULT_MAX_RESPONSE_BYTES, guardedFetch, type GuardedFetchOptions, type OutboundFetch } from "./fetch.js";
 export { nodeLookup } from "./node-lookup.js";