documonster 0.19.0 → 0.20.0

package/README.md

@@ -211,7 +211,7 @@ const buffer = await Workbook.toBuffer(wb);
 
 ```html
 <!-- Script tag (no bundler) — one IIFE per module, each under the shared `Documonster` global -->
-<script src="https://unpkg.com/documonster@0.19.0/dist/iife/documonster.excel.iife.min.js"></script>
+<script src="https://unpkg.com/documonster@0.20.0/dist/iife/documonster.excel.iife.min.js"></script>
 <script>
   const { Workbook, Cell } = Documonster.Excel;
   const wb = Workbook.create();

package/README_zh.md

@@ -198,7 +198,7 @@ const buffer = await Workbook.toBuffer(wb);
 
 ```html
 <!-- Script 标签（无需打包工具）— 每个模块一个 IIFE，共享同一个 `Documonster` 全局 -->
-<script src="https://unpkg.com/documonster@0.19.0/dist/iife/documonster.excel.iife.min.js"></script>
+<script src="https://unpkg.com/documonster@0.20.0/dist/iife/documonster.excel.iife.min.js"></script>
 <script>
   const { Workbook, Cell } = Documonster.Excel;
   const wb = Workbook.create();

package/dist/esm/modules/archive/compression/compress.base.js

@@ -9,7 +9,7 @@
  * see deflate-fallback.ts for pure JS implementation
  */
 import { ByteQueue } from "../core/byte-queue.js";
-import { ArchiveError } from "../core/errors.js";
+import { ArchiveError, ArchiveLimitError } from "../core/errors.js";
 /**
  * Default threshold (in bytes) to choose the lower-overhead path.
  *
@@ -106,18 +106,23 @@ export function hasDeflateRawDecompressionStream() {
 export function hasDeflateRawWebStreams() {
     return hasDeflateRawCompressionStream() && hasDeflateRawDecompressionStream();
 }
-export async function streamToUint8Array(reader) {
+export async function streamToUint8Array(reader, maxOutputLength) {
     const out = new ByteQueue();
     while (true) {
         const { done, value } = await reader.read();
         if (done) {
             break;
         }
+        if (maxOutputLength !== undefined && out.length + value.length > maxOutputLength) {
+            // Stop pulling: the transform is cancelled by the caller, so nothing
+            // beyond this chunk is ever produced or buffered.
+            throw new ArchiveLimitError("maxOutputLength", maxOutputLength);
+        }
         out.append(value);
     }
     return out.read(out.length);
 }
-export async function transformWithStream(data, stream) {
+export async function transformWithStream(data, stream, maxOutputLength) {
     const writer = stream.writable.getWriter();
     const reader = stream.readable.getReader();
     // Start reading immediately to avoid potential backpressure deadlocks
@@ -132,7 +137,16 @@ export async function transformWithStream(data, stream) {
     // though the caller had caught the failure and recovered via the pure-JS
     // fallback. A promise with both handlers already attached can never become
     // one, so abandoning it is safe on every path below.
-    const read = streamToUint8Array(reader).then(value => ({ ok: true, value }), (error) => ({ ok: false, error }));
+    const read = streamToUint8Array(reader, maxOutputLength).then(value => ({ ok: true, value }), (error) => {
+        // A limit hit leaves the transform mid-flight; cancel it so the
+        // pending write settles and no further output is produced.
+        if (error instanceof ArchiveLimitError) {
+            reader.cancel(error).catch(() => {
+                // ignore
+            });
+        }
+        return { ok: false, error };
+    });
     try {
         let writeError;
         try {
@@ -191,9 +205,9 @@ export async function compressWithStream(data) {
  * @param data - Compressed data (deflate-raw format)
  * @returns Decompressed data
  */
-export async function decompressWithStream(data) {
+export async function decompressWithStream(data, maxOutputLength) {
     const ds = new DecompressionStream("deflate-raw");
-    return transformWithStream(data, ds);
+    return transformWithStream(data, ds, maxOutputLength);
 }
 // =============================================================================
 // Adler-32 Checksum (RFC 1950)

package/dist/esm/modules/archive/compression/compress.browser.js

@@ -16,9 +16,10 @@ import { crc32 } from "./crc32.browser.js";
 import { inflateRaw, deflateRawCompressed, deflateRawStore } from "./deflate-fallback.js";
 import { deflateWithPool, inflateWithPool, hasWorkerSupport } from "./worker-pool/index.browser.js";
 import { DEFAULT_COMPRESS_LEVEL } from "../core/defaults.js";
-import { ArchiveError, createAbortError, isAbortError, throwIfAborted } from "../core/errors.js";
+import { ArchiveError, ArchiveLimitError, createAbortError, isAbortError, throwIfAborted } from "../core/errors.js";
 import { readUint32LE } from "../zip-spec/binary.js";
 import { concatUint8Arrays } from "../../../utils/binary.js";
+import { assertLimitOption } from "../../../utils/limits.js";
 // Re-export shared types and GZIP utilities
 export {};
 export { hasCompressionStream, hasWorkerSupport, 
@@ -59,15 +60,17 @@ function rethrowIfAborted(err, signal) {
 }
 const deflateStrategy = {
     hasNative: hasDeflateRawCompressionStream,
-    native: compressWithStream,
-    worker: deflateWithPool,
-    jsFallback: deflateRawCompressed
+    native: data => compressWithStream(data),
+    worker: (data, { level, signal, allowTransfer }) => deflateWithPool(data, { level, signal, allowTransfer }),
+    jsFallback: (data, options) => deflateRawCompressed(data, options.level)
 };
 const inflateStrategy = {
     hasNative: hasDeflateRawDecompressionStream,
-    native: decompressWithStream,
-    worker: inflateWithPool,
-    jsFallback: inflateRaw
+    native: (data, options) => decompressWithStream(data, options.maxOutputLength),
+    // The worker enforces the bound while it inflates and reports a hit as an
+    // ArchiveLimitError, exactly like the in-process paths.
+    worker: (data, { signal, allowTransfer, maxOutputLength }) => inflateWithPool(data, { signal, allowTransfer, maxOutputLength }),
+    jsFallback: (data, options) => inflateRaw(data, options.maxOutputLength)
 };
 /**
  * Unified compression/decompression with automatic strategy selection.
@@ -79,26 +82,31 @@ async function processWithStrategy(strategy, data, options) {
     // If the user explicitly requested workers, honor it.
     if (useWorker === true && workerSupported) {
         try {
-            return await strategy.worker(data, {
-                level: options.level,
-                signal: options.signal,
-                allowTransfer: options.allowTransfer
-            });
+            return await strategy.worker(data, options);
         }
         catch (err) {
             // If the user aborts, do NOT fall back to main-thread work.
             rethrowIfAborted(err, options.signal);
+            // A limit hit is a verdict on the data; retrying elsewhere would only
+            // reach the same one.
+            if (err instanceof ArchiveLimitError) {
+                throw err;
+            }
             // Fall through to best available in-process path.
         }
     }
     // Default: use native stream if supported (fastest, no worker overhead).
     if (canUseNative) {
         try {
-            return await strategy.native(data);
+            return await strategy.native(data, options);
         }
         catch (err) {
             // Respect aborts — never silently retry an aborted operation.
             rethrowIfAborted(err, options.signal);
+            // A limit hit is a verdict on the data, not a spurious native failure.
+            if (err instanceof ArchiveLimitError) {
+                throw err;
+            }
             // Native CompressionStream / DecompressionStream can intermittently
             // reject input that is in fact valid (observed in Chromium under heavy
             // concurrent stream creation: a `DecompressionStream` rejects a deflate
@@ -107,19 +115,15 @@ async function processWithStrategy(strategy, data, options) {
             // set" / corruption error, fall back to the deterministic pure-JS
             // implementation. If the data is genuinely corrupt the JS path throws
             // too, so this never masks a real error.
-            return strategy.jsFallback(data, options.level);
+            return strategy.jsFallback(data, options);
         }
     }
     // Use worker in fallback environments (no native deflate-raw) when appropriate.
     if (useWorker !== true && shouldUseWorker(data, options)) {
-        return strategy.worker(data, {
-            level: options.level,
-            signal: options.signal,
-            allowTransfer: options.allowTransfer
-        });
+        return strategy.worker(data, options);
     }
     // Fallback to pure JS implementation.
-    return strategy.jsFallback(data, options.level);
+    return strategy.jsFallback(data, options);
 }
 // =============================================================================
 // Public API
@@ -150,13 +154,15 @@ export function compressSync(data, options = {}) {
  * Decompress data using browser's native DecompressionStream or JS fallback
  */
 export async function decompress(data, options = {}) {
+    assertLimitOption("maxOutputLength", options.maxOutputLength);
     return processWithStrategy(inflateStrategy, data, options);
 }
 /**
  * Decompress data synchronously using pure JS implementation
  */
-export function decompressSync(data) {
-    return inflateRaw(data);
+export function decompressSync(data, options = {}) {
+    assertLimitOption("maxOutputLength", options.maxOutputLength);
+    return inflateRaw(data, options.maxOutputLength);
 }
 // =============================================================================
 // GZIP API
@@ -269,10 +275,11 @@ export function gzipSync(data, options = {}) {
  *    - Inherits Worker Pool support from decompress() for large files
  */
 export async function gunzip(data, options = {}) {
+    assertLimitOption("maxOutputLength", options.maxOutputLength);
     throwIfAborted(options.signal);
     if (hasGzipDecompressionStream()) {
         const ds = new DecompressionStream("gzip");
-        const out = await transformWithStream(data, ds);
+        const out = await transformWithStream(data, ds, options.maxOutputLength);
         throwIfAborted(options.signal);
         return out;
     }
@@ -284,9 +291,10 @@ export async function gunzip(data, options = {}) {
 /**
  * Gunzip data synchronously using the JS fallback.
  */
-export function gunzipSync(data) {
+export function gunzipSync(data, options = {}) {
+    assertLimitOption("maxOutputLength", options.maxOutputLength);
     const { deflateData, expectedCrc32, expectedSize } = parseGzipPayload(data);
-    const out = inflateRaw(deflateData);
+    const out = inflateRaw(deflateData, options.maxOutputLength);
     verifyGzipOutput(out, expectedCrc32, expectedSize);
     return out;
 }
@@ -344,11 +352,12 @@ export function zlibSync(data, options = {}) {
  * 2. Fallback: parse header + decompress (inflate-raw) + verify Adler-32
  */
 export async function unzlib(data, options = {}) {
+    assertLimitOption("maxOutputLength", options.maxOutputLength);
     throwIfAborted(options.signal);
     // Native "deflate" format is Zlib
     if (hasDeflateDecompressionStream()) {
         const ds = new DecompressionStream("deflate");
-        const out = await transformWithStream(data, ds);
+        const out = await transformWithStream(data, ds, options.maxOutputLength);
         throwIfAborted(options.signal);
         return out;
     }
@@ -359,10 +368,14 @@ export async function unzlib(data, options = {}) {
 }
 /**
  * Decompress Zlib data (sync)
+ *
+ * @param options - `maxOutputLength` bounds the output; decoding stops with a
+ *   `ArchiveLimitError` as soon as it is exceeded
  */
-export function unzlibSync(data) {
+export function unzlibSync(data, options = {}) {
+    assertLimitOption("maxOutputLength", options.maxOutputLength);
     const { deflateData, expectedAdler32 } = parseZlibPayload(data);
-    const out = inflateRaw(deflateData);
+    const out = inflateRaw(deflateData, options.maxOutputLength);
     verifyAdler32(out, expectedAdler32);
     return out;
 }
@@ -397,14 +410,14 @@ export async function decompressAuto(data, options = {}) {
 /**
  * Decompress data synchronously, automatically detecting the format
  */
-export function decompressAutoSync(data) {
+export function decompressAutoSync(data, options = {}) {
     const format = detectCompressionFormat(data);
     switch (format) {
         case "gzip":
-            return gunzipSync(data);
+            return gunzipSync(data, options);
         case "zlib":
-            return unzlibSync(data);
+            return unzlibSync(data, options);
         case "deflate-raw":
-            return decompressSync(data);
+            return decompressSync(data, options);
     }
 }

package/dist/esm/modules/archive/compression/compress.js

@@ -5,9 +5,11 @@
  * - deflate-raw: Raw DEFLATE (for ZIP files)
  * - gzip: GZIP format (for tar.gz, HTTP compression)
  */
+import { kMaxLength } from "buffer";
 import { promisify } from "util";
 import * as nodeZlib from "zlib";
 import { DEFAULT_COMPRESS_LEVEL } from "../core/defaults.js";
+import { ArchiveLimitError } from "../core/errors.js";
 import { uint8ArrayToNodeBufferView } from "../../../utils/binary.js";
 // Re-export shared types and utilities
 export { hasCompressionStream, 
@@ -35,6 +37,7 @@ export function bufferToUint8Array(buffer) {
 const deflateRawAsync = promisify(nodeZlib.deflateRaw);
 const inflateRawAsync = promisify(nodeZlib.inflateRaw);
 import { resolveCompressThresholdBytes, detectCompressionFormat } from "./compress.base.js";
+import { assertLimitOption } from "../../../utils/limits.js";
 /**
  * Compress data using Node.js native zlib
  *
@@ -79,30 +82,75 @@ export function compressSync(data, options = {}) {
     const zlibOptions = { level };
     return bufferToUint8Array(nodeZlib.deflateRawSync(input, zlibOptions));
 }
+/**
+ * zlib options for an optional output bound. zlib rejects a bound below 1, so
+ * a zero bound is requested as 1 and {@link inflateBounded} rejects any output.
+ */
+function boundOptions(maxOutputLength) {
+    // Every decompressing entry point resolves its bound here first.
+    assertLimitOption("maxOutputLength", maxOutputLength);
+    return maxOutputLength === undefined
+        ? undefined
+        : { maxOutputLength: Math.max(1, Math.min(maxOutputLength, kMaxLength)) };
+}
+/**
+ * Settle a zlib inflate run with {@link boundOptions}: zlib stops as soon as
+ * the inflater crosses the bound and throws `ERR_BUFFER_TOO_LARGE`, which
+ * becomes the archive's own error.
+ */
+function inflateBounded(inflate, maxOutputLength) {
+    let out;
+    try {
+        out = inflate();
+    }
+    catch (err) {
+        if (maxOutputLength !== undefined &&
+            err.code === "ERR_BUFFER_TOO_LARGE") {
+            throw new ArchiveLimitError("maxOutputLength", maxOutputLength, { cause: err });
+        }
+        throw err;
+    }
+    if (maxOutputLength !== undefined && out.byteLength > maxOutputLength) {
+        throw new ArchiveLimitError("maxOutputLength", maxOutputLength);
+    }
+    return bufferToUint8Array(out);
+}
+/** {@link inflateBounded} for a run settled on the thread pool. */
+async function inflateBoundedAsync(pending, maxOutputLength) {
+    const settled = await pending.then(out => () => out, (err) => () => {
+        throw err;
+    });
+    return inflateBounded(settled, maxOutputLength);
+}
 /**
  * Decompress data using Node.js native zlib
  *
  * @param data - Compressed data (deflate-raw format)
+ * @param options - `maxOutputLength` bounds the output; inflation stops early
+ *   with an `ArchiveLimitError` when it is exceeded
  * @returns Decompressed data
  */
 export async function decompress(data, options = {}) {
-    const thresholdBytes = resolveCompressThresholdBytes(options);
     const input = uint8ArrayToBuffer(data);
+    const { maxOutputLength } = options;
+    const zlibOptions = boundOptions(maxOutputLength);
     // Small-input fast path: avoid threadpool overhead.
-    if (data.byteLength <= thresholdBytes) {
-        return bufferToUint8Array(nodeZlib.inflateRawSync(input));
+    if (data.byteLength <= resolveCompressThresholdBytes(options)) {
+        return inflateBounded(() => nodeZlib.inflateRawSync(input, zlibOptions), maxOutputLength);
     }
-    return bufferToUint8Array(await inflateRawAsync(input));
+    return inflateBoundedAsync(inflateRawAsync(input, zlibOptions), maxOutputLength);
 }
 /**
  * Decompress data synchronously using Node.js zlib
  *
  * @param data - Compressed data (deflate-raw format)
+ * @param options - `maxOutputLength` bounds the output (see {@link decompress})
  * @returns Decompressed data
  */
-export function decompressSync(data) {
+export function decompressSync(data, options = {}) {
     const input = uint8ArrayToBuffer(data);
-    return bufferToUint8Array(nodeZlib.inflateRawSync(input));
+    const { maxOutputLength } = options;
+    return inflateBounded(() => nodeZlib.inflateRawSync(input, boundOptions(maxOutputLength)), maxOutputLength);
 }
 // =============================================================================
 // GZIP API
@@ -129,11 +177,13 @@ export async function gzip(data, options = {}) {
 export async function gunzip(data, options = {}) {
     const thresholdBytes = resolveCompressThresholdBytes(options);
     const input = uint8ArrayToBuffer(data);
+    const { maxOutputLength } = options;
+    const zlibOptions = boundOptions(maxOutputLength);
     // Small-input fast path
     if (data.byteLength <= thresholdBytes) {
-        return bufferToUint8Array(nodeZlib.gunzipSync(input));
+        return inflateBounded(() => nodeZlib.gunzipSync(input, zlibOptions), maxOutputLength);
     }
-    return bufferToUint8Array(await gunzipAsync(input));
+    return inflateBoundedAsync(gunzipAsync(input, zlibOptions), maxOutputLength);
 }
 /**
  * Compress data with gzip (sync)
@@ -147,9 +197,10 @@ export function gzipSync(data, options = {}) {
 /**
  * Decompress gzip data (sync)
  */
-export function gunzipSync(data) {
+export function gunzipSync(data, options = {}) {
     const input = uint8ArrayToBuffer(data);
-    return bufferToUint8Array(nodeZlib.gunzipSync(input));
+    const { maxOutputLength } = options;
+    return inflateBounded(() => nodeZlib.gunzipSync(input, boundOptions(maxOutputLength)), maxOutputLength);
 }
 // =============================================================================
 // ZLIB API (RFC 1950: DEFLATE with zlib header/trailer + Adler-32)
@@ -179,11 +230,13 @@ export async function zlib(data, options = {}) {
 export async function unzlib(data, options = {}) {
     const thresholdBytes = resolveCompressThresholdBytes(options);
     const input = uint8ArrayToBuffer(data);
+    const { maxOutputLength } = options;
+    const zlibOptions = boundOptions(maxOutputLength);
     // Small-input fast path
     if (data.byteLength <= thresholdBytes) {
-        return bufferToUint8Array(nodeZlib.inflateSync(input));
+        return inflateBounded(() => nodeZlib.inflateSync(input, zlibOptions), maxOutputLength);
     }
-    return bufferToUint8Array(await unzlibAsync(input));
+    return inflateBoundedAsync(unzlibAsync(input, zlibOptions), maxOutputLength);
 }
 /**
  * Compress data with Zlib wrapper (sync)
@@ -196,10 +249,13 @@ export function zlibSync(data, options = {}) {
 }
 /**
  * Decompress Zlib data (sync)
+ *
+ * @param options - `maxOutputLength` bounds the output (see {@link decompress})
  */
-export function unzlibSync(data) {
+export function unzlibSync(data, options = {}) {
     const input = uint8ArrayToBuffer(data);
-    return bufferToUint8Array(nodeZlib.inflateSync(input));
+    const { maxOutputLength } = options;
+    return inflateBounded(() => nodeZlib.inflateSync(input, boundOptions(maxOutputLength)), maxOutputLength);
 }
 // =============================================================================
 // AUTO-DETECT DECOMPRESSION
@@ -232,14 +288,14 @@ export async function decompressAuto(data, options = {}) {
 /**
  * Decompress data synchronously, automatically detecting the format
  */
-export function decompressAutoSync(data) {
+export function decompressAutoSync(data, options = {}) {
     const format = detectCompressionFormat(data);
     switch (format) {
         case "gzip":
-            return gunzipSync(data);
+            return gunzipSync(data, options);
         case "zlib":
-            return unzlibSync(data);
+            return unzlibSync(data, options);
         case "deflate-raw":
-            return decompressSync(data);
+            return decompressSync(data, options);
     }
 }

package/dist/esm/modules/archive/compression/deflate-fallback.js

@@ -10,8 +10,9 @@
  * - Safari < 16.4
  * - Chrome < 103
  */
-import { ArchiveError } from "../core/errors.js";
+import { ArchiveError, ArchiveLimitError } from "../core/errors.js";
 import { concatUint8Arrays } from "../../../utils/binary.js";
+import { assertLimitOption } from "../../../utils/limits.js";
 // ============================================================================
 // DEFLATE Decompression (Full implementation)
 // ============================================================================
@@ -199,19 +200,28 @@ class BitReader {
  * Decompress DEFLATE data (raw format, no zlib header)
  *
  * @param data - Compressed data in deflate-raw format
+ * @param maxOutputLength - Optional output bound; decoding stops with a
+ *   `ArchiveLimitError` before the output buffer grows past it
  * @returns Decompressed data
  */
-export function inflateRaw(data) {
+export function inflateRaw(data, maxOutputLength) {
     const reader = new BitReader(data);
     // Output accumulator. DEFLATE has no length prefix, so we grow a typed array
     // geometrically instead of pushing into a `number[]` (which boxes every byte
     // at ~8x the memory and forces a final full copy). Seed with a heuristic
     // based on the compressed size; deflate ratios on OOXML/text are commonly
     // 3-5x, so 4x is a reasonable starting capacity that avoids most regrowths.
-    let output = new Uint8Array(Math.max(64, data.length * 4));
+    assertLimitOption("maxOutputLength", maxOutputLength);
+    const limit = maxOutputLength ?? Infinity;
+    // Never larger than the bound; with a positive bound never empty, so the
+    // doubling below always makes progress (a zero bound throws before growing).
+    let output = new Uint8Array(Math.min(Math.max(64, data.length * 4), limit));
     let outLen = 0;
     const ensureCapacity = (additional) => {
         const required = outLen + additional;
+        if (required > limit) {
+            throw new ArchiveLimitError("maxOutputLength", limit);
+        }
         if (required <= output.length) {
             return;
         }
@@ -219,6 +229,7 @@ export function inflateRaw(data) {
         while (capacity < required) {
             capacity *= 2;
         }
+        capacity = Math.min(capacity, limit);
         const grown = new Uint8Array(capacity);
         grown.set(output.subarray(0, outLen));
         output = grown;

package/dist/esm/modules/archive/compression/worker-pool/pool.browser.js

@@ -14,7 +14,7 @@
  */
 import { resolvePoolOptions, getPriorityValue, hasWorkerSupport, createAbortError } from "./pool.base.js";
 import { getWorkerBlobUrl, releaseWorkerBlobUrl } from "./worker-script.js";
-import { ArchiveError } from "../../core/errors.js";
+import { ArchiveError, ArchiveLimitError } from "../../core/errors.js";
 export { hasWorkerSupport };
 const EMPTY_CHUNK = new Uint8Array(0);
 const DEFAULT_MAX_INFLIGHT_STREAM_CHUNKS = 8;
@@ -153,6 +153,7 @@ export class WorkerPool {
                 taskType,
                 data,
                 level: options?.level,
+                maxOutputLength: options?.maxOutputLength,
                 priority,
                 priorityValue,
                 resolve,
@@ -362,7 +363,8 @@ export class WorkerPool {
             taskId: task.taskId,
             taskType: task.taskType,
             data,
-            level: task.level
+            level: task.level,
+            maxOutputLength: task.maxOutputLength
         };
         // Use transferables for zero-copy
         if (shouldTransfer) {
@@ -485,7 +487,11 @@ export class WorkerPool {
                 }
                 else {
                     this._failedTasks++;
-                    task.reject(new Error(message.error ?? "Unknown worker error"));
+                    // An Error does not survive postMessage with its class, so a limit
+                    // hit travels as the bound and is rebuilt as the archive's own error.
+                    task.reject(message.limit !== undefined
+                        ? new ArchiveLimitError("maxOutputLength", message.limit)
+                        : new Error(message.error ?? "Unknown worker error"));
                 }
                 this._workerBecameIdle(poolWorker);
                 return;

package/dist/esm/modules/archive/compression/worker-pool/worker-script.js

@@ -32,16 +32,25 @@ const hasDeflateRaw = (() => {
 
 const EMPTY_UINT8ARRAY = new Uint8Array(0);
 
+/** Output exceeded the task's maxOutputLength; reported to the pool as \`limit\`. */
+class LimitError extends Error {
+  constructor(limit) {
+    super('Decompressed output exceeds maxOutputLength (' + limit + ' bytes)');
+    this.limit = limit;
+  }
+}
+
 /**
  * Process data through a TransformStream (compress or decompress)
  */
-async function processWithStream(stream, data) {
+async function processWithStream(stream, data, maxOutputLength) {
   const writer = stream.writable.getWriter();
   const reader = stream.readable.getReader();
 
   // Start reading output
   let firstChunk = null;
   let chunks = null;
+  let produced = 0;
   const readPromise = (async () => {
     while (true) {
       const { done, value } = await reader.read();
@@ -49,6 +58,13 @@ async function processWithStream(stream, data) {
       if (!value) {
         continue;
       }
+      produced += value.length;
+      if (maxOutputLength !== undefined && produced > maxOutputLength) {
+        // Stop pulling so nothing past the bound is produced or buffered.
+        const limitError = new LimitError(maxOutputLength);
+        reader.cancel(limitError).catch(() => {});
+        throw limitError;
+      }
       if (firstChunk === null) {
         firstChunk = value;
       } else if (chunks === null) {
@@ -59,12 +75,19 @@ async function processWithStream(stream, data) {
     }
   })();
 
-  // Write input and close
-  await writer.write(data);
-  await writer.close();
+  // Write input and close. Once the reader has failed the writes reject
+  // too; the read's verdict is the one to report.
+  const read = readPromise.then(() => null, err => err);
+  try {
+    await writer.write(data);
+    await writer.close();
+  } catch (err) {
+    throw (await read) ?? err;
+  }
 
   // Wait for all output
-  await readPromise;
+  const readError = await read;
+  if (readError) throw readError;
 
   // Fast path for common cases
   if (firstChunk === null) return EMPTY_UINT8ARRAY;
@@ -121,6 +144,7 @@ function postError(taskId, err, startTime) {
     type: 'error',
     taskId,
     error,
+    limit: err instanceof LimitError ? err.limit : undefined,
     duration
   });
 }
@@ -274,7 +298,7 @@ self.onmessage = async function(event) {
 
   // Handle task request
   if (msg.type === 'task') {
-    const { taskId, taskType, data } = msg;
+    const { taskId, taskType, data, maxOutputLength } = msg;
     const startTime = performance.now();
 
     try {
@@ -294,7 +318,11 @@ self.onmessage = async function(event) {
           throw new Error('Unknown task type: ' + taskType);
       }
 
-      const result = await processWithStream(stream, data);
+      const result = await processWithStream(
+        stream,
+        data,
+        taskType === 'inflate' ? maxOutputLength : undefined
+      );
 
       // Transfer the result buffer for zero-copy
       postResult(taskId, result, startTime);