documonster 0.19.0 → 0.20.0

package/dist/esm/modules/archive/core/errors.js

@@ -68,10 +68,17 @@ export class Crc32MismatchError extends ArchiveError {
  * This is a security feature to detect ZIP bombs and corrupted archives.
  */
 export class EntrySizeMismatchError extends ArchiveError {
-    constructor(path, expected, actual, reason, options) {
-        const msg = reason === "too-many-bytes"
-            ? `Entry "${path}" produced more bytes than declared: expected ${expected}, got at least ${actual}`
-            : `Entry "${path}" produced fewer bytes than declared: expected ${expected}, got ${actual}`;
+    constructor(path, expected, 
+    /**
+     * Bytes produced. `undefined` when the inflater was stopped at the
+     * declared size, so no count beyond it exists.
+     */
+    actual, reason, options) {
+        const msg = reason === "too-few-bytes"
+            ? `Entry "${path}" produced fewer bytes than declared: expected ${expected}, got ${actual}`
+            : actual === undefined
+                ? `Entry "${path}" exceeds its declared ${expected} bytes`
+                : `Entry "${path}" produced more bytes than declared: expected ${expected}, got at least ${actual}`;
         super(msg, options);
         this.path = path;
         this.expected = expected;
@@ -92,6 +99,21 @@ export class EntrySizeMismatchError extends ArchiveError {
         return this.reason === "too-few-bytes";
     }
 }
+/**
+ * Error thrown when decompressing or extracting would exceed a configured limit.
+ */
+export class ArchiveLimitError extends ArchiveError {
+    constructor(limit, allowed, options) {
+        super(limit === "maxOutputLength"
+            ? `Decompressed output exceeds maxOutputLength (${allowed} bytes)`
+            : limit === "maxEntries"
+                ? `Archive entry count exceeds maxEntries (${allowed})`
+                : `Archive uncompressed size exceeds maxTotalUncompressedSize (${allowed} bytes)`, options);
+        this.limit = limit;
+        this.allowed = allowed;
+        this.name = "ArchiveLimitError";
+    }
+}
 // -----------------------------------------------------------------------------
 // Encryption Errors
 // -----------------------------------------------------------------------------

package/dist/esm/modules/archive/index.base.js

@@ -37,4 +37,4 @@ export {
 // Abort error class
 AbortError, 
 // Error classes
-ArchiveError, ZipParseError, InvalidZipSignatureError, EocdNotFoundError, Crc32MismatchError, DecryptionError, PasswordRequiredError, RangeNotSupportedError, HttpRangeError, FileTooLargeError, UnsupportedCompressionError, EntrySizeMismatchError } from "./core/errors.js";
+ArchiveError, ZipParseError, InvalidZipSignatureError, EocdNotFoundError, Crc32MismatchError, DecryptionError, PasswordRequiredError, RangeNotSupportedError, HttpRangeError, FileTooLargeError, UnsupportedCompressionError, EntrySizeMismatchError, ArchiveLimitError } from "./core/errors.js";

package/dist/esm/modules/archive/unzip/zip-extract-core.js

@@ -12,7 +12,7 @@
 import { decompress, decompressSync } from "#platform/modules/archive/compression/compress";
 import { crc32, crc32Finalize, crc32Update } from "#platform/modules/archive/compression/crc32";
 import { createInflateStream } from "#platform/modules/archive/compression/streaming-compress";
-import { ArchiveError, Crc32MismatchError, DecryptionError, EntrySizeMismatchError, FileTooLargeError, PasswordRequiredError, UnsupportedCompressionError, throwIfAborted, toError } from "../core/errors.js";
+import { ArchiveError, ArchiveLimitError, Crc32MismatchError, DecryptionError, EntrySizeMismatchError, FileTooLargeError, PasswordRequiredError, UnsupportedCompressionError, throwIfAborted, toError } from "../core/errors.js";
 import { ZIP_CRYPTO_HEADER_SIZE, aesDecrypt, zipCryptoDecrypt, zipCryptoDecryptByte, zipCryptoInitKeys } from "../crypto/index.js";
 import { collect } from "../io/archive-sink.js";
 import { BinaryReader } from "../zip-spec/binary.js";
@@ -25,11 +25,45 @@ import { concatUint8Arrays } from "../../../utils/binary.js";
 export const LOCAL_HEADER_FIXED_SIZE = 30;
 /**
  * Maximum allowed uncompressed entry size for non-streaming extraction (512 MB).
- * This is a pre-decompression check based on the declared size in the ZIP metadata.
- * It prevents memory exhaustion from archives that declare very large output sizes.
+ *
+ * Enforced twice: against the *declared* size before anything is inflated, and
+ * as the inflater's output bound, so an entry that lies about its size is
+ * stopped as soon as it overruns rather than after it has been materialised.
  * The streaming extraction path (processEntryDataStream) has its own byte-level checks.
  */
 const DEFAULT_MAX_ENTRY_SIZE = 512 * 1024 * 1024;
+/**
+ * Reject an entry whose declared size exceeds `maxEntrySize`, and fix the
+ * output bound to inflate it under.
+ *
+ * With size validation on, the bound is the declared size exactly: any byte
+ * past it already makes the entry invalid, so there is no reason to produce
+ * it. With validation off the declared size is not trusted for anything, and
+ * `maxEntrySize` alone bounds the in-memory result.
+ */
+function planEntryInflation(entry, validateEntrySizes, maxEntrySize) {
+    if (validateEntrySizes && entry.uncompressedSize > maxEntrySize) {
+        throw new FileTooLargeError(entry.path, `declares uncompressed size of ${entry.uncompressedSize} bytes, ` +
+            `which exceeds the maximum allowed size of ${maxEntrySize} bytes. ` +
+            "Use the streaming API for large entries.");
+    }
+    const bound = validateEntrySizes ? entry.uncompressedSize : maxEntrySize;
+    return { entry, validateEntrySizes, bound };
+}
+/**
+ * Translate an inflater limit hit into the error that names the entry.
+ */
+function translateOutputLimit(err, plan) {
+    if (!(err instanceof ArchiveLimitError)) {
+        return err;
+    }
+    const { entry, bound } = plan;
+    return plan.validateEntrySizes
+        ? new EntrySizeMismatchError(entry.path, entry.uncompressedSize, undefined, "too-many-bytes", {
+            cause: err
+        })
+        : new FileTooLargeError(entry.path, `inflates beyond ${bound} bytes`, { cause: err });
+}
 /**
  * Process compressed (and possibly encrypted) entry data to get the final content.
  *
@@ -40,19 +74,14 @@ const DEFAULT_MAX_ENTRY_SIZE = 512 * 1024 * 1024;
  * @param password - Optional password for decryption
  * @param checkCrc32 - Whether to validate CRC32 checksum (default: false)
  * @param validateEntrySizes - Whether to validate decompressed size matches declared size (default: true)
+ * @param maxEntrySize - Largest entry that may be inflated into memory (default: 512 MiB)
  * @returns Decompressed entry content
  */
-export async function processEntryData(entry, compressedData, password, checkCrc32 = false, validateEntrySizes = true) {
+export async function processEntryData(entry, compressedData, password, checkCrc32 = false, validateEntrySizes = true, maxEntrySize = DEFAULT_MAX_ENTRY_SIZE) {
     let result;
-    // Pre-decompression size check: reject entries whose *declared* uncompressed size
-    // exceeds the limit. This catches archives that honestly declare very large entries
-    // but does NOT protect against ZIP bombs that lie about their size (for that, use
-    // the streaming path processEntryDataStream which validates actual output bytes).
-    if (validateEntrySizes && entry.uncompressedSize > DEFAULT_MAX_ENTRY_SIZE) {
-        throw new FileTooLargeError(entry.path, `declares uncompressed size of ${entry.uncompressedSize} bytes, ` +
-            `which exceeds the maximum allowed size of ${DEFAULT_MAX_ENTRY_SIZE} bytes. ` +
-            "Use the streaming API for large entries.");
-    }
+    // Rejects an over-large declared size up front, and bounds the inflater so an
+    // entry that lies about its size stops as soon as it overruns.
+    const plan = planEntryInflation(entry, validateEntrySizes, maxEntrySize);
     // Handle encrypted entries
     if (entry.isEncrypted) {
         if (!password) {
@@ -65,7 +94,7 @@ export async function processEntryData(entry, compressedData, password, checkCrc
                 throw new DecryptionError(entry.path);
             }
             // Decompress if needed (use original compression method)
-            result = await decompressData(decrypted, entry.originalCompressionMethod ?? COMPRESSION_STORE, entry.path);
+            result = await decompressData(decrypted, entry.originalCompressionMethod ?? COMPRESSION_STORE, plan);
         }
         else if (entry.encryptionMethod === "zipcrypto") {
             // ZipCrypto decryption
@@ -73,7 +102,7 @@ export async function processEntryData(entry, compressedData, password, checkCrc
             if (!decrypted) {
                 throw new DecryptionError(entry.path);
             }
-            result = await decompressData(decrypted, entry.compressionMethod, entry.path);
+            result = await decompressData(decrypted, entry.compressionMethod, plan);
         }
         else {
             throw new DecryptionError(entry.path, "Unsupported encryption method");
@@ -81,7 +110,7 @@ export async function processEntryData(entry, compressedData, password, checkCrc
     }
     else {
         // Non-encrypted entry
-        result = await decompressData(compressedData, entry.compressionMethod, entry.path);
+        result = await decompressData(compressedData, entry.compressionMethod, plan);
     }
     // Validate entry size (ZIP bomb protection)
     if (validateEntrySizes && result.length !== entry.uncompressedSize) {
@@ -111,17 +140,14 @@ export async function processEntryData(entry, compressedData, password, checkCrc
  * @param compressedData - Raw compressed (and possibly encrypted) data from the ZIP
  * @param password - Optional password for decryption
  * @param validateEntrySizes - Whether to validate decompressed size matches declared size (default: true)
+ * @param maxEntrySize - Largest entry that may be inflated into memory (default: 512 MiB)
  * @returns Decompressed entry content
  * @throws Error if the entry uses AES encryption
  */
-export function processEntryDataSync(entry, compressedData, password, validateEntrySizes = true) {
+export function processEntryDataSync(entry, compressedData, password, validateEntrySizes = true, maxEntrySize = DEFAULT_MAX_ENTRY_SIZE) {
     let result;
-    // Pre-decompression size check (same as async version)
-    if (validateEntrySizes && entry.uncompressedSize > DEFAULT_MAX_ENTRY_SIZE) {
-        throw new FileTooLargeError(entry.path, `declares uncompressed size of ${entry.uncompressedSize} bytes, ` +
-            `which exceeds the maximum allowed size of ${DEFAULT_MAX_ENTRY_SIZE} bytes. ` +
-            "Use the streaming API for large entries.");
-    }
+    // Same up-front check and inflater bound as the async version.
+    const plan = planEntryInflation(entry, validateEntrySizes, maxEntrySize);
     // Handle encrypted entries
     if (entry.isEncrypted) {
         if (!password) {
@@ -137,7 +163,7 @@ export function processEntryDataSync(entry, compressedData, password, validateEn
             if (!decrypted) {
                 throw new DecryptionError(entry.path);
             }
-            result = decompressDataSync(decrypted, entry.compressionMethod, entry.path);
+            result = decompressDataSync(decrypted, entry.compressionMethod, plan);
             // Always verify CRC32 for ZipCrypto because header verification only checks 1 byte
             // (1/256 false positive rate with wrong password per ZIP spec)
             const actualCrc = crc32(result);
@@ -151,7 +177,7 @@ export function processEntryDataSync(entry, compressedData, password, validateEn
     }
     else {
         // Non-encrypted entry
-        result = decompressDataSync(compressedData, entry.compressionMethod, entry.path);
+        result = decompressDataSync(compressedData, entry.compressionMethod, plan);
     }
     // Validate entry size (ZIP bomb protection)
     if (validateEntrySizes && result.length !== entry.uncompressedSize) {
@@ -161,14 +187,20 @@ export function processEntryDataSync(entry, compressedData, password, validateEn
     return result;
 }
 /**
- * Decompress data based on compression method (async).
+ * Decompress an entry's data based on compression method (async), under the
+ * entry's output bound.
  */
-async function decompressData(data, compressionMethod, path) {
+async function decompressData(data, compressionMethod, plan) {
     if (compressionMethod === COMPRESSION_STORE) {
         return data;
     }
     if (compressionMethod === COMPRESSION_DEFLATE) {
-        return decompress(data);
+        try {
+            return await decompress(data, { maxOutputLength: plan.bound });
+        }
+        catch (err) {
+            throw translateOutputLimit(err, plan);
+        }
     }
     throw new UnsupportedCompressionError(compressionMethod);
 }
@@ -429,7 +461,7 @@ function applyValidationStreams(entry, source, options) {
  * requires the full ciphertext; this function falls back to buffering for AES.
  */
 export function processEntryDataStream(entry, compressedData, options = {}) {
-    const { password, checkCrc32 = false, validateEntrySizes = true, signal } = options;
+    const { password, checkCrc32 = false, validateEntrySizes = true, maxEntrySize = DEFAULT_MAX_ENTRY_SIZE, signal } = options;
     async function* run() {
         throwIfAborted(signal);
         if (entry.type === "directory") {
@@ -441,11 +473,13 @@ export function processEntryDataStream(entry, compressedData, options = {}) {
                 throw new PasswordRequiredError(entry.path);
             }
             if (entry.encryptionMethod === "aes" && entry.aesKeyStrength) {
+                // Reject an over-large declared size before buffering the ciphertext.
+                const plan = planEntryInflation(entry, validateEntrySizes, maxEntrySize);
                 // AES requires full ciphertext to verify HMAC.
                 const encrypted = await collect(compressedData);
                 const decrypted = await aesDecrypt(encrypted, password, entry.aesKeyStrength);
                 const method = entry.originalCompressionMethod ?? COMPRESSION_STORE;
-                const out = await decompressData(decrypted, method, entry.path);
+                const out = await decompressData(decrypted, method, plan);
                 // Validate size for AES entries (already fully buffered)
                 if (validateEntrySizes && out.length !== entry.uncompressedSize) {
                     const reason = out.length > entry.uncompressedSize ? "too-many-bytes" : "too-few-bytes";
@@ -483,7 +517,7 @@ export function processEntryDataStream(entry, compressedData, options = {}) {
             // Fallback for other encryption methods.
             const encrypted = await collect(compressedData);
             // processEntryData already handles size validation internally
-            const out = await processEntryData(entry, encrypted, password, checkCrc32, validateEntrySizes);
+            const out = await processEntryData(entry, encrypted, password, checkCrc32, validateEntrySizes, maxEntrySize);
             if (out.length) {
                 yield out;
             }
@@ -513,14 +547,20 @@ export function processEntryDataStream(entry, compressedData, options = {}) {
     return run();
 }
 /**
- * Decompress data based on compression method (sync).
+ * Decompress an entry's data based on compression method (sync), under the
+ * entry's output bound.
  */
-function decompressDataSync(data, compressionMethod, path) {
+function decompressDataSync(data, compressionMethod, plan) {
     if (compressionMethod === COMPRESSION_STORE) {
         return data;
     }
     if (compressionMethod === COMPRESSION_DEFLATE) {
-        return decompressSync(data);
+        try {
+            return decompressSync(data, { maxOutputLength: plan.bound });
+        }
+        catch (err) {
+            throw translateOutputLimit(err, plan);
+        }
     }
     throw new UnsupportedCompressionError(compressionMethod);
 }

package/dist/esm/modules/archive/unzip/zip-parser.js

@@ -4,9 +4,10 @@
  * No dependency on Node.js stream module
  */
 import { EMPTY_UINT8ARRAY } from "../core/bytes.js";
-import { FileTooLargeError } from "../core/errors.js";
+import { ArchiveLimitError, FileTooLargeError } from "../core/errors.js";
 import { processEntryData, processEntryDataSync, readEntryCompressedData } from "./zip-extract-core.js";
 import { parseZipArchiveFromBuffer } from "../zip-spec/zip-parser-core.js";
+import { assertLimitOption } from "../../../utils/limits.js";
 const MAX_SAFE_INTEGER_BIGINT = BigInt(Number.MAX_SAFE_INTEGER);
 function assertEntryExtractableInMemory(entry) {
     // This parser extracts into memory. If ZIP64 values exceed JS safe integers,
@@ -29,7 +30,8 @@ function assertEntryExtractableInMemory(entry) {
 function parseZipArchive(data, options = {}) {
     return parseZipArchiveFromBuffer(data, {
         decodeStrings: options.decodeStrings,
-        encoding: options.encoding
+        encoding: options.encoding,
+        maxEntries: options.maxEntries
     });
 }
 /**
@@ -41,7 +43,7 @@ async function extractEntryData(data, entry, options = {}) {
     }
     assertEntryExtractableInMemory(entry);
     const compressedData = readEntryCompressedData(data, entry);
-    return processEntryData(entry, compressedData, options.password);
+    return processEntryData(entry, compressedData, options.password, false, true, options.maxEntrySize);
 }
 /**
  * Extract file data synchronously (only supports ZipCrypto, not AES)
@@ -52,19 +54,39 @@ function extractEntryDataSync(data, entry, options = {}) {
     }
     assertEntryExtractableInMemory(entry);
     const compressedData = readEntryCompressedData(data, entry);
-    return processEntryDataSync(entry, compressedData, options.password);
+    return processEntryDataSync(entry, compressedData, options.password, true, options.maxEntrySize);
 }
 /**
  * High-level ZIP parser class
  */
 export class ZipParser {
     constructor(data, options = {}) {
+        assertLimitOption("maxEntrySize", options.maxEntrySize);
+        assertLimitOption("maxTotalUncompressedSize", options.maxTotalUncompressedSize);
         this.data = data instanceof ArrayBuffer ? new Uint8Array(data) : data;
         const result = parseZipArchive(this.data, options);
         this.entries = result.entries;
         this.archiveComment = result.comment;
         this.entryMap = new Map(this.entries.map(e => [e.path, e]));
         this.password = options.password;
+        this.maxEntrySize = options.maxEntrySize;
+        this.maxTotalUncompressedSize = options.maxTotalUncompressedSize ?? Infinity;
+    }
+    /**
+     * Reject a bulk extraction whose declared sizes exceed the total limit.
+     * Each entry is inflated under a bound of its declared size, so the declared
+     * sum is an upper bound on what extraction can actually produce.
+     */
+    assertTotalWithinLimit() {
+        let total = 0;
+        for (const entry of this.entries) {
+            if (entry.type !== "directory") {
+                total += entry.uncompressedSize;
+            }
+        }
+        if (total > this.maxTotalUncompressedSize) {
+            throw new ArchiveLimitError("maxTotalUncompressedSize", this.maxTotalUncompressedSize);
+        }
     }
     /**
      * Set the password for encrypted entries.
@@ -179,7 +201,10 @@ export class ZipParser {
         if (!entry) {
             return null;
         }
-        return extractEntryData(this.data, entry, { password: password ?? this.password });
+        return extractEntryData(this.data, entry, {
+            password: password ?? this.password,
+            maxEntrySize: this.maxEntrySize
+        });
     }
     /**
      * Extract a single file (sync)
@@ -195,7 +220,10 @@ export class ZipParser {
         if (!entry) {
             return null;
         }
-        return extractEntryDataSync(this.data, entry, { password: password ?? this.password });
+        return extractEntryDataSync(this.data, entry, {
+            password: password ?? this.password,
+            maxEntrySize: this.maxEntrySize
+        });
     }
     /**
      * Extract all files (async)
@@ -204,8 +232,12 @@ export class ZipParser {
     async extractAll(password) {
         const result = new Map();
         const pw = password ?? this.password;
+        this.assertTotalWithinLimit();
         for (const entry of this.entries) {
-            const data = await extractEntryData(this.data, entry, { password: pw });
+            const data = await extractEntryData(this.data, entry, {
+                password: pw,
+                maxEntrySize: this.maxEntrySize
+            });
             result.set(entry.path, data);
         }
         return result;
@@ -222,8 +254,12 @@ export class ZipParser {
     extractAllSync(password) {
         const result = {};
         const pw = password ?? this.password;
+        this.assertTotalWithinLimit();
         for (const entry of this.entries) {
-            result[entry.path] = extractEntryDataSync(this.data, entry, { password: pw });
+            result[entry.path] = extractEntryDataSync(this.data, entry, {
+                password: pw,
+                maxEntrySize: this.maxEntrySize
+            });
         }
         return result;
     }
@@ -234,11 +270,21 @@ export class ZipParser {
      */
     async forEach(callback, password) {
         const pw = password ?? this.password;
+        let produced = 0;
         for (const entry of this.entries) {
             let dataPromise = null;
             const getData = () => {
                 if (!dataPromise) {
-                    dataPromise = extractEntryData(this.data, entry, { password: pw });
+                    dataPromise = extractEntryData(this.data, entry, {
+                        password: pw,
+                        maxEntrySize: this.maxEntrySize
+                    }).then(bytes => {
+                        produced += bytes.length;
+                        if (produced > this.maxTotalUncompressedSize) {
+                            throw new ArchiveLimitError("maxTotalUncompressedSize", this.maxTotalUncompressedSize);
+                        }
+                        return bytes;
+                    });
                 }
                 return dataPromise;
             };

package/dist/esm/modules/archive/zip-spec/zip-parser-core.js

@@ -4,12 +4,12 @@
  * This module contains pure functions for parsing EOCD, ZIP64 EOCD, and Central Directory.
  * Used by both `ZipParser` (in-memory) and `RemoteZipReader` (random-access).
  */
-import { ArchiveError, EocdNotFoundError } from "../core/errors.js";
+import { ArchiveError, ArchiveLimitError, EocdNotFoundError } from "../core/errors.js";
 import { decodeZipPath, decodeZipComment, resolveZipStringCodec } from "../core/text.js";
 import { BinaryReader } from "./binary.js";
 import { resolveZipLastModifiedDateFromUnixSeconds } from "./timestamps.js";
 import { parseZipExtraFields } from "./zip-extra-fields.js";
-import { CENTRAL_DIR_HEADER_SIG, COMPRESSION_AES, UINT16_MAX, UINT32_MAX, ZIP64_END_OF_CENTRAL_DIR_LOCATOR_SIG, ZIP64_END_OF_CENTRAL_DIR_SIG, ZIP_OS_MSDOS, getUnixModeFromExternalAttributes, isSymlinkMode, isDirectoryMode } from "./zip-records.js";
+import { CENTRAL_DIR_HEADER_SIG, COMPRESSION_AES, ZIP_CENTRAL_DIR_HEADER_FIXED_SIZE, UINT16_MAX, UINT32_MAX, ZIP64_END_OF_CENTRAL_DIR_LOCATOR_SIG, ZIP64_END_OF_CENTRAL_DIR_SIG, ZIP_OS_MSDOS, getUnixModeFromExternalAttributes, isSymlinkMode, isDirectoryMode } from "./zip-records.js";
 import { uint8ArrayToString as decodeUtf8 } from "../../../utils/binary.js";
 // -----------------------------------------------------------------------------
 // Constants
@@ -323,6 +323,18 @@ export function parseCentralDirectoryAt(data, offset, totalEntries, options = {}
     if (totalEntries === 0) {
         return [];
     }
+    // Every record is at least 46 bytes, so a count the buffer cannot hold is a
+    // lie — reject it before sizing an array from it.
+    if (totalEntries * ZIP_CENTRAL_DIR_HEADER_FIXED_SIZE > data.length - offset) {
+        throw new ArchiveError(`Central Directory declares ${totalEntries} entries, more than its ${data.length - offset} bytes can hold`);
+    }
+    // The 46-byte check only proves the count is *possible*; a genuine central
+    // directory of many tiny entries still costs one JS object (plus path
+    // strings and extra-field maps) per record, so the count needs its own bound.
+    const maxEntries = options.maxEntries ?? Infinity;
+    if (totalEntries > maxEntries) {
+        throw new ArchiveLimitError("maxEntries", maxEntries);
+    }
     const entries = new Array(totalEntries);
     const reader = new BinaryReader(data, offset);
     for (let i = 0; i < totalEntries; i++) {

package/dist/esm/modules/csv/parse/scanner/scanner.js

@@ -1051,6 +1051,9 @@ export function createScanner(config) {
         },
         getBuffer() {
             return state.buffer.slice(state.position);
+        },
+        pendingLength() {
+            return state.buffer.length - state.position;
         }
     };
 }

package/dist/esm/modules/csv/parse/sync.js

@@ -5,6 +5,7 @@
  * Provides parseCsv function and low-level parsing generators.
  */
 import { getUtf8ByteLength } from "../constants.js";
+import { CsvError } from "../errors.js";
 import { resolveParseConfig, toScannerConfig } from "./config.js";
 import { filterValidHeaders } from "./helpers.js";
 import { splitLinesWithEndings } from "./lines.js";
@@ -95,7 +96,7 @@ export function* parseFastMode(input, config, state, errors) {
         if (config.maxRowBytes !== undefined) {
             const lineBytes = getUtf8ByteLength(line);
             if (lineBytes > config.maxRowBytes) {
-                throw new Error(`Row exceeds the maximum size of ${config.maxRowBytes} bytes`);
+                throw new CsvError(`Row exceeds the maximum size of ${config.maxRowBytes} bytes`);
             }
         }
         if (config.infoOption) {
@@ -203,7 +204,7 @@ export function* parseWithScanner(input, config, state, errors) {
             const rawRow = input.slice(scanResult.rawStart, rawEndPos);
             const rowBytes = getUtf8ByteLength(rawRow);
             if (rowBytes > config.maxRowBytes) {
-                throw new Error(`Row exceeds the maximum size of ${config.maxRowBytes} bytes`);
+                throw new CsvError(`Row exceeds the maximum size of ${config.maxRowBytes} bytes`);
             }
         }
         // Skip comment lines

package/dist/esm/modules/csv/stream/parser.js

@@ -5,6 +5,7 @@
  * Works identically in both Node.js and Browser environments.
  */
 import { DEFAULT_LINEBREAK_REGEX, getUtf8ByteLength } from "../constants.js";
+import { CsvError } from "../errors.js";
 import { createParseConfig, toScannerConfig } from "../parse/config.js";
 import { createDelimiterDetector } from "../parse/delimiter-detector.js";
 import { convertRowToObject, filterValidHeaders } from "../parse/helpers.js";
@@ -444,6 +445,36 @@ export class CsvParserStream extends Transform {
             callback();
         }
     }
+    /**
+     * Fail early when the unfinished row already exceeds `maxRowBytes`.
+     *
+     * The completed-row check alone cannot bound memory: an unclosed quote (or a line that never
+     * ends) is never completed, so it would be buffered forever. Every UTF-16 code unit encodes
+     * to at least one UTF-8 byte, so a pending length above the limit proves the row is too
+     * large without measuring it — reading `.length` does not flatten the appended rope. Two
+     * code units of slack cover a line ending that has only partly arrived.
+     */
+    pendingRowLimitError(pendingLength) {
+        const limit = this.parseConfig.maxRowBytes;
+        if (limit === undefined || pendingLength <= limit + 2) {
+            return null;
+        }
+        return new CsvError(`Row exceeds the maximum size of ${limit} bytes`);
+    }
+    /**
+     * Emit the rows this chunk completed, then fail if the unfinished row left behind is
+     * already over the limit. The completed rows go out first: they are valid, and the
+     * error belongs to the row after them. `callback` is called exactly once.
+     */
+    finishChunk(rows, pendingLength, callback) {
+        const limitError = this.pendingRowLimitError(pendingLength);
+        if (!limitError) {
+            this.processPendingRows(rows, callback);
+            return;
+        }
+        // A consumer that aborted from its chunk callback asked for no more rows, not an error.
+        this.processPendingRows(rows, err => callback(err ?? (this.chunkAborted ? null : limitError)));
+    }
     /**
      * Reset info state for next row (used when skipping rows or after processing)
      */
@@ -497,7 +528,7 @@ export class CsvParserStream extends Transform {
         }
         // Scanner internally tracks unconsumed data - no need to reset
         // It will continue from where it left off on the next feed()
-        this.processPendingRows(pendingRows, callback);
+        this.finishChunk(pendingRows, this.scanner.pendingLength(), callback);
     }
     /**
      * Run the hook and BOM strip on the first text, exactly as `Csv.parse` does.
@@ -712,12 +743,17 @@ export class CsvParserStream extends Transform {
         // Nothing has arrived that could end a line, so the buffer is left alone entirely —
         // touching it would flatten the rope built by appending. See fastModeLineEndPending.
         if (!this.fastModeLineEndPending) {
-            callback();
+            callback(this.pendingRowLimitError(this.buffer.length));
             return;
         }
         const completeEnd = this.getFastModeCompleteDataEnd(this.buffer);
         // If no complete line, wait for more data
         if (completeEnd === -1) {
+            const limitError = this.pendingRowLimitError(this.buffer.length);
+            if (limitError) {
+                callback(limitError);
+                return;
+            }
             // The buffer stays, so record that it holds no line ending and spare the next
             // chunk from searching it again. Backing off by one character short of the
             // longest line ending keeps a line ending that straddles the mark reachable —
@@ -768,7 +804,7 @@ export class CsvParserStream extends Transform {
                 return;
             }
         }
-        this.processPendingRows(pendingRows, callback);
+        this.finishChunk(pendingRows, this.buffer.length, callback);
     }
     buildRow(rawRow, info) {
         const { dynamicTyping, castDate, groupColumnsByName = false } = this.options;
@@ -879,7 +915,7 @@ export class CsvParserStream extends Transform {
         if (raw !== undefined && this.parseConfig.maxRowBytes !== undefined) {
             const rawBytes = getUtf8ByteLength(raw);
             if (rawBytes > this.parseConfig.maxRowBytes) {
-                callback(new Error(`Row exceeds the maximum size of ${this.parseConfig.maxRowBytes} bytes`));
+                callback(new CsvError(`Row exceeds the maximum size of ${this.parseConfig.maxRowBytes} bytes`));
                 return "error";
             }
         }