Bound outbound HTTP responses and wait time

Cargo.toml

@@ -57,7 +57,8 @@ regex = "1.13.0"
 log = "0.4.33"
 rustyline = "18.0.1"
 tokio = { version = "1.52.3", features = ["full"] }
-reqwest = { version = "0.13.4", features = ["json"] }
+reqwest = { version = "0.13.4", features = ["json", "stream"] }
+encoding_rs = "0.8.35"
 # sqlx 0.9 split the old `runtime-tokio-rustls` feature into a separate runtime
 # and TLS backend; `tls-rustls` aliases the ring-backed rustls stack we used before.
 sqlx = { version = "0.9.0", features = ["runtime-tokio", "tls-rustls", "sqlite", "mysql", "postgres", "chrono"] }

Docs/04-advanced-features/interoperability.md

@@ -92,6 +92,15 @@ Non-2xx statuses are not errors — check `resp.ok` or `resp.status`
 yourself. Network failures (DNS, connection refused) still raise errors you
 can `try`/`catch`.
 
+Outbound responses are streamed and decoded into a bounded buffer. The
+`web_server_max_response_size` setting (64 MiB by default) limits the response
+body for `read content` and `read response`, both as received and after text
+decoding. The limit includes chunked responses with no declared length. Outside
+a `main loop`, the connection and body read share the script's remaining
+`timeout_seconds`; inside a lifetime-exempt `main loop`, each request gets a
+fresh timeout of that duration. Cooperative cancellation also interrupts a
+request that is waiting on the remote peer.
+
 **Note:** inside an `open url` statement the words `method`, `headers`, and
 `body` introduce clauses, so use different variable names there (e.g.
 `request_headers`, `payload`).

Docs/reference/configuration-reference.md

@@ -211,7 +211,7 @@ All keys currently loaded from config files, with defaults.
 | `web_server_tls_cert_file` | path | *(none)* | Default PEM cert for bare `listen … secured` |
 | `web_server_tls_key_file` | path | *(none)* | Default PEM key for bare `listen … secured` |
 | `web_server_max_body_size` | integer ≥ 1 | `1048576` (1 MiB) | Max HTTP request body size (bytes); enforced while streaming (chunked-safe) |
-| `web_server_max_response_size` | integer ≥ 1 | `67108864` (64 MiB) | Max HTTP response body size (bytes) |
+| `web_server_max_response_size` | integer ≥ 1 | `67108864` (64 MiB) | Max handler or outbound HTTP response body size (bytes) |
 | `web_server_request_queue_bound` | integer ≥ 1 | `256` | Max queued HTTP requests before shedding with 503 |
 | `web_server_response_timeout_seconds` | integer ≥ 0 | `300` | Seconds to await a handler before shedding with 504; `0` disables |
 | `web_socket_queue_bound` | integer ≥ 1 | `1024` | Max queued frames/events per WebSocket channel before shedding |
@@ -248,7 +248,11 @@ budget.
 
 #### `timeout_seconds`
 
-Maximum execution time for a WFL script in seconds. The script terminates if it exceeds this limit.
+Maximum execution time for a WFL script in seconds. Outside a `main loop`, an
+outbound `open url` request (connection, headers, and response body) consumes
+the run's remaining time. A `main loop` remains exempt from the lifetime limit,
+but each outbound request inside it gets this duration as a fresh finite timeout
+so a stalled remote peer cannot wedge the server indefinitely.
 
 - **Type:** Integer (minimum: 1)
 - **Default:** `60`
@@ -524,7 +528,12 @@ Because request handlers run one at a time (see [Web Servers → Limitations](..
 
 #### `web_server_max_response_size`
 
-Maximum HTTP response body a handler may `respond with`, in bytes. A larger response is refused (the handler gets a runtime error) rather than streaming an unbounded payload to the client.
+Maximum HTTP response body size, in bytes, for both directions: content a
+handler may `respond with`, and content an outbound `open url` statement may
+read. A larger handler response is refused; a larger outbound response is
+stopped when either its received bytes or decoded UTF-8 text reaches this
+limit. This applies even when the remote server uses chunked transfer encoding
+or omits `Content-Length`.
 
 - **Type:** Integer (bytes, at least 1)
 - **Default:** `67108864` (64 MiB)

src/config.rs

@@ -53,9 +53,10 @@ pub struct WflConfig {
     /// server sheds new requests with a 503 instead of growing memory without
     /// bound. Default 256; must be at least 1.
     pub web_server_request_queue_bound: usize,
-    /// Maximum HTTP response body size in bytes. A handler that tries to send a
-    /// larger body is refused with a 500 rather than streaming an unbounded
-    /// payload. Feeds `ExecutionBudget`. Default 64 MiB.
+    /// Maximum HTTP response body size in bytes, for both handler responses and
+    /// bodies read by outbound `open url` statements. A larger body is refused
+    /// rather than buffered/streamed without bound. Feeds `ExecutionBudget`.
+    /// Default 64 MiB.
     pub web_server_max_response_size: usize,
     /// Maximum seconds the transport waits for a handler to answer an accepted
     /// HTTP request before shedding it with 504 and releasing its in-flight

src/exec/budget.rs

@@ -100,7 +100,8 @@ pub struct BudgetLimits {
     /// Maximum accepted HTTP request body size in bytes. Mapped from `.wflcfg`
     /// `web_server_max_body_size`.
     pub max_request_body_bytes: usize,
-    /// Maximum HTTP response body size in bytes. Mapped from `.wflcfg`
+    /// Maximum HTTP response body size in bytes, for both handler responses and
+    /// bodies read by outbound `open url` statements. Mapped from `.wflcfg`
     /// `web_server_max_response_size`.
     pub max_response_bytes: usize,
     /// Maximum accepted-but-unhandled HTTP requests held in the transport