@fhevm/sdk 1.1.0-alpha.3 → 1.1.0-alpha.5

package/core/actions/base/index.ts

@@ -67,11 +67,11 @@ export {
 } from './verifyZkProofCoprocessorSignatures.js';
 
 export {
-  type FetchSelfKmsSignedcryptedSharesParameters,
-  type FetchDelegatedKmsSignedcryptedSharesParameters,
-  type FetchKmsSignedcryptedSharesReturnType,
-  fetchKmsSignedcryptedShares,
-} from './fetchKmsSignedcryptedShares.js';
+  type FetchSelfKmsSigncryptedSharesParameters,
+  type FetchDelegatedKmsSigncryptedSharesParameters,
+  type FetchKmsSigncryptedSharesReturnType,
+  fetchKmsSigncryptedShares,
+} from './fetchKmsSigncryptedShares.js';
 
 export {
   type VerifyHandlesCoprocessorSignaturesParameters,

package/core/actions/base/readKmsSignersContext.ts

@@ -12,7 +12,8 @@ export type ReadKmsSignersContextReturnType = KmsSignersContext;
 
 export async function readKmsSignersContext(fhevm: Fhevm<FhevmChain>): Promise<ReadKmsSignersContextReturnType> {
   return readKmsSignersContext_(fhevm, {
-    address: fhevm.chain.fhevm.contracts.kmsVerifier.address as ChecksummedAddress,
+    kmsVerifierAddress: fhevm.chain.fhevm.contracts.kmsVerifier.address as ChecksummedAddress,
+    protocolConfigAddress: fhevm.chain.fhevm.contracts.protocolConfig?.address as ChecksummedAddress | undefined,
   });
 }
 

package/core/actions/chain/parseSignedDecryptionPermit.ts

@@ -2,7 +2,7 @@ import type { Fhevm } from '../../types/coreFhevmClient.js';
 import type { FhevmChain } from '../../types/fhevmChain.js';
 import type { SignedDecryptionPermit } from '../../types/signedDecryptionPermit.js';
 import type { TransportKeyPair } from '../../kms/TransportKeyPair-p.js';
-import type { KmsDecryptEip712Like } from '../../types/kms.js';
+import type { Eip712Like } from '../../types/kms.js';
 import { parseSignedDecryptionPermit as parseSignedDecryptionPermit_ } from '../../kms/SignedDecryptionPermit-p.js';
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -10,7 +10,7 @@ import { parseSignedDecryptionPermit as parseSignedDecryptionPermit_ } from '../
 export type ParseSignedDecryptionPermitParameters = {
   /** The serialized permit — a previously parsed permit object. */
   readonly serializedPermit: {
-    readonly eip712: KmsDecryptEip712Like;
+    readonly eip712: Eip712Like;
     readonly signature: string;
     readonly signerAddress: string;
   };

package/core/actions/chain/parseTransportKeyPair.ts

@@ -1,7 +1,8 @@
 import type { Fhevm, OptionalNativeClient } from '../../types/coreFhevmClient.js';
 import type { FhevmRuntime } from '../../types/coreFhevmRuntime.js';
 import type { FhevmChain } from '../../types/fhevmChain.js';
-import { toTransportKeyPair, type TransportKeyPair } from '../../kms/TransportKeyPair-p.js';
+import type { TransportKeyPair } from '../../kms/TransportKeyPair-p.js';
+import { toTransportKeyPair } from '../../kms/TransportKeyPair-p.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 

package/core/actions/decrypt/{decryptKmsSignedcryptedShares.ts → decryptKmsSigncryptedShares.ts}

@@ -4,28 +4,31 @@ import type { WithDecrypt } from '../../types/coreFhevmRuntime.js';
 import type { KmsSigncryptedShares } from '../../types/kms.js';
 import type { TransportKeyPair } from '../../kms/TransportKeyPair-p.js';
 import type { TypedValue } from '../../types/primitives.js';
-import { decryptKmsSignedcryptedShares as decryptKmsSignedcryptedShares_ } from '../../kms/decryptKmsSignedcryptedShares-p.js';
+import { decryptKmsSigncryptedShares as decryptKmsSigncryptedShares_ } from '../../kms/decryptKmsSigncryptedShares-p.js';
 import { clearValueToTypedValue } from '../../handle/ClearValue.js';
+import { asFhevmWithTkmsVersion } from '../../runtime/CoreFhevm-p.js';
 
 ////////////////////////////////////////////////////////////////////////////////
-// decryptKmsSignedcryptedShares (with privateKey)
+// decryptKmsSigncryptedShares (with privateKey)
 ////////////////////////////////////////////////////////////////////////////////
 
-export type DecryptKmsSignedcryptedSharesParameters = {
+export type DecryptKmsSigncryptedSharesParameters = {
   readonly kmsSigncryptedShares: KmsSigncryptedShares;
   readonly transportKeyPair: TransportKeyPair;
 };
 
-export type DecryptKmsSignedcryptedSharesReturnType = readonly TypedValue[];
+export type DecryptKmsSigncryptedSharesReturnType = readonly TypedValue[];
 
 ////////////////////////////////////////////////////////////////////////////////
 
-export async function decryptKmsSignedcryptedShares(
+export async function decryptKmsSigncryptedShares(
   fhevm: Fhevm<FhevmChain, WithDecrypt>,
-  parameters: DecryptKmsSignedcryptedSharesParameters,
-): Promise<DecryptKmsSignedcryptedSharesReturnType> {
-  const clearValues = await decryptKmsSignedcryptedShares_(fhevm, parameters);
+  parameters: DecryptKmsSigncryptedSharesParameters,
+): Promise<DecryptKmsSigncryptedSharesReturnType> {
+  const f = asFhevmWithTkmsVersion(fhevm);
 
-  const originToken = Symbol('decryptKmsSignedcryptedShares');
+  const clearValues = await decryptKmsSigncryptedShares_(f, parameters);
+
+  const originToken = Symbol('decryptKmsSigncryptedShares');
   return clearValues.map((cv) => clearValueToTypedValue(cv, originToken));
 }

package/core/actions/decrypt/decryptValue.ts

@@ -9,6 +9,7 @@ import type { EncryptedValueLike } from '../../types/encryptedTypes.js';
 import { decryptValuesFromPairs as decryptValuesFromPairs_ } from '../../kms/decryptValuesFromPairs.js';
 import { addressToChecksummedAddress, assertIsAddress } from '../../base/address.js';
 import { toFhevmHandle } from '../../handle/FhevmHandle.js';
+import { asFhevmWithTkmsVersion } from '../../runtime/CoreFhevm-p.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -40,7 +41,9 @@ export async function decryptValue(
     },
   ];
 
-  const typedValues = await decryptValuesFromPairs_(fhevm, {
+  const f = asFhevmWithTkmsVersion(fhevm);
+
+  const typedValues = await decryptValuesFromPairs_(f, {
     ...rest,
     pairs: sanitizedPairs,
   } as Parameters<typeof decryptValuesFromPairs_>[1]);

package/core/actions/decrypt/decryptValues.ts

@@ -9,6 +9,7 @@ import type { EncryptedValueLike } from '../../types/encryptedTypes.js';
 import { decryptValuesFromPairs as decryptValuesFromPairs_ } from '../../kms/decryptValuesFromPairs.js';
 import { addressToChecksummedAddress, assertIsAddress } from '../../base/address.js';
 import { toFhevmHandle } from '../../handle/FhevmHandle.js';
+import { asFhevmWithTkmsVersion } from '../../runtime/CoreFhevm-p.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -40,7 +41,9 @@ export async function decryptValues(
     };
   });
 
-  return decryptValuesFromPairs_(fhevm, {
+  const f = asFhevmWithTkmsVersion(fhevm);
+
+  return decryptValuesFromPairs_(f, {
     ...rest,
     pairs: sanitizedPairs,
   } as Parameters<typeof decryptValuesFromPairs_>[1]);

package/core/actions/decrypt/decryptValuesFromPairs.ts

@@ -9,6 +9,7 @@ import type { EncryptedValueLike } from '../../types/encryptedTypes.js';
 import { decryptValuesFromPairs as decryptValuesFromPairs_ } from '../../kms/decryptValuesFromPairs.js';
 import { addressToChecksummedAddress, assertIsAddress } from '../../base/address.js';
 import { toFhevmHandle } from '../../handle/FhevmHandle.js';
+import { asFhevmWithTkmsVersion } from '../../runtime/CoreFhevm-p.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -40,7 +41,9 @@ export async function decryptValuesFromPairs(
     };
   });
 
-  return decryptValuesFromPairs_(fhevm, {
+  const f = asFhevmWithTkmsVersion(fhevm);
+
+  return decryptValuesFromPairs_(f, {
     ...rest,
     pairs: sanitizedPairs,
   } as Parameters<typeof decryptValuesFromPairs_>[1]);

package/core/actions/decrypt/generateTransportKeyPair.ts

@@ -1,19 +1,21 @@
-import type { Fhevm, OptionalNativeClient } from '../../types/coreFhevmClient.js';
+import type { Fhevm } from '../../types/coreFhevmClient.js';
 import type { WithDecrypt } from '../../types/coreFhevmRuntime.js';
 import type { FhevmChain } from '../../types/fhevmChain.js';
 import {
   generateTransportKeyPair as generateTransportKeyPair_,
   type TransportKeyPair,
 } from '../../kms/TransportKeyPair-p.js';
+import { asFhevmWithTkmsVersion } from '../../runtime/CoreFhevm-p.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
 export type GenerateTransportKeyPairReturnType = TransportKeyPair;
 
 export async function generateTransportKeyPair(
-  fhevm: Fhevm<FhevmChain | undefined, WithDecrypt, OptionalNativeClient>,
+  fhevm: Fhevm<FhevmChain, WithDecrypt>,
 ): Promise<GenerateTransportKeyPairReturnType> {
-  return await generateTransportKeyPair_(fhevm);
+  const f = asFhevmWithTkmsVersion(fhevm);
+  return await generateTransportKeyPair_(f);
 }
 
 ////////////////////////////////////////////////////////////////////////////////

package/core/actions/decrypt/index.ts

@@ -17,10 +17,10 @@ export { type DecryptValueParameters, type DecryptValueReturnType, decryptValue
 export { type DecryptValuesParameters, type DecryptValuesReturnType, decryptValues } from './decryptValues.js';
 
 export {
-  type DecryptKmsSignedcryptedSharesParameters,
-  type DecryptKmsSignedcryptedSharesReturnType,
-  decryptKmsSignedcryptedShares,
-} from './decryptKmsSignedcryptedShares.js';
+  type DecryptKmsSigncryptedSharesParameters,
+  type DecryptKmsSigncryptedSharesReturnType,
+  decryptKmsSigncryptedShares,
+} from './decryptKmsSigncryptedShares.js';
 
 export {
   type CanDecryptValuesFromPairsWithUserAddressParameters,

package/core/actions/encrypt/encryptValue.ts

@@ -8,6 +8,7 @@ import { addressToChecksummedAddress, assertIsAddress } from '../../base/address
 import { toArray } from '../../base/object.js';
 import { createTypedValue } from '../../base/typedValue.js';
 import { encrypt as encrypt_ } from '../../coprocessor/encrypt.js';
+import { asFhevmWithTfheVersion } from '../../runtime/CoreFhevm-p.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -37,7 +38,9 @@ export async function encryptValue(
   assertIsAddress(contractAddress, {});
   assertIsAddress(userAddress, {});
 
-  const result = await encrypt_(fhevm, {
+  const f = asFhevmWithTfheVersion(fhevm);
+
+  const result = await encrypt_(f, {
     contractAddress: addressToChecksummedAddress(contractAddress),
     userAddress: addressToChecksummedAddress(userAddress),
     values,

package/core/actions/encrypt/encryptValues.ts

@@ -7,6 +7,7 @@ import type { EncryptedValue } from '../../types/encryptedTypes.js';
 import { addressToChecksummedAddress, assertIsAddress } from '../../base/address.js';
 import { createTypedValue } from '../../base/typedValue.js';
 import { encrypt as encrypt_ } from '../../coprocessor/encrypt.js';
+import { asFhevmWithTfheVersion } from '../../runtime/CoreFhevm-p.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -35,7 +36,9 @@ export async function encryptValues(
   assertIsAddress(contractAddress, {});
   assertIsAddress(userAddress, {});
 
-  const result = await encrypt_(fhevm, {
+  const f = asFhevmWithTfheVersion(fhevm);
+
+  const result = await encrypt_(f, {
     contractAddress: addressToChecksummedAddress(contractAddress),
     userAddress: addressToChecksummedAddress(userAddress),
     values,

package/core/actions/encrypt/generateZkProof.ts

@@ -2,8 +2,10 @@ import type { Fhevm } from '../../types/coreFhevmClient.js';
 import type { WithEncrypt } from '../../types/coreFhevmRuntime.js';
 import type { FhevmChain } from '../../types/fhevmChain.js';
 import type { ZkProof } from '../../types/zkProof-p.js';
+import type { BytesHex } from '../../types/primitives.js';
 import { createTypedValue } from '../../base/typedValue.js';
 import { createZkProofBuilder } from '../../coprocessor/ZkProofBuilder-p.js';
+import { asFhevmWithTfheVersion } from '../../runtime/CoreFhevm-p.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -22,12 +24,18 @@ export async function generateZkProof(
   parameters: GenerateZkProofParameters,
 ): Promise<GenerateZkProofReturnType> {
   const { values, contractAddress, userAddress } = parameters;
+  const hardCodedExtraData = '0x00' as BytesHex;
+
   const builder = createZkProofBuilder();
   for (const value of values) {
     builder.addTypedValue(createTypedValue(value));
   }
-  return builder.build(fhevm, {
+
+  const f = asFhevmWithTfheVersion(fhevm);
+
+  return builder.build(f, {
     contractAddress,
     userAddress,
+    extraData: hardCodedExtraData,
   });
 }

package/core/actions/host/readFhevmExecutorContractData.ts

@@ -10,7 +10,7 @@ import { getAclAddress } from '../../host-contracts/getAclAddress-p.js';
 import { getHandleVersion } from '../../host-contracts/getHandleVersion-p.js';
 import { getHcuLimitAddress } from '../../host-contracts/getHcuLimitAddress-p.js';
 import { assertIsHostContractVersionOf } from '../../host-contracts/HostContractVersion-p.js';
-import { getVersion } from '../../host-contracts/HostContractVersion-p.js';
+import { getHostContractVersion } from '../../host-contracts/HostContractVersion-p.js';
 import { getInputVerifierAddress } from '../../host-contracts/getInputVerifierAddress-p.js';
 
 export type ReadFhevmExecutorContractDataParameters = {
@@ -22,7 +22,7 @@ export async function readFhevmExecutorContractData(
   fhevm: Fhevm,
   parameters: ReadFhevmExecutorContractDataParameters,
 ): Promise<ReadFhevmExecutorContractDataReturnType> {
-  const fhevmExecutorContractAddress = parameters.address;
+  const fhevmExecutorAddress = parameters.address;
 
   ////////////////////////////////////////////////////////////////////////////
   //
@@ -36,11 +36,11 @@ export async function readFhevmExecutorContractData(
   ////////////////////////////////////////////////////////////////////////////
 
   const rpcCalls = [
-    () => getVersion(fhevm, parameters),
-    () => getAclAddress(fhevm, parameters),
-    () => getHcuLimitAddress(fhevm, parameters),
-    () => getInputVerifierAddress(fhevm, parameters),
-    () => getHandleVersion(fhevm, parameters),
+    () => getHostContractVersion(fhevm, parameters),
+    () => getAclAddress(fhevm, { fhevmExecutorAddress }),
+    () => getHcuLimitAddress(fhevm, { fhevmExecutorAddress }),
+    () => getInputVerifierAddress(fhevm, { fhevmExecutorAddress }),
+    () => getHandleVersion(fhevm, { fhevmExecutorAddress }),
   ];
 
   const res = await executeWithBatching<unknown>(rpcCalls, fhevm.options.batchRpcCalls);
@@ -63,7 +63,7 @@ export async function readFhevmExecutorContractData(
 
   const data = createFhevmExecutorContractData(new WeakRef(fhevm.runtime), {
     version: contractVersion,
-    address: fhevmExecutorContractAddress,
+    address: fhevmExecutorAddress,
     aclContractAddress,
     inputVerifierContractAddress,
     hcuLimitContractAddress,

package/core/actions/host/readInputVerifierContractData.ts

@@ -6,7 +6,7 @@ import type { CoprocessorSignersContext } from '../../types/coprocessorSignersCo
 import { eip712Domain, type Eip712DomainReturnType } from '../../host-contracts/eip712Domain-p.js';
 import { assertIsHostContractVersionOf } from '../../host-contracts/HostContractVersion-p.js';
 import { readCoprocessorSignersContext } from '../../host-contracts/readCoprocessorSignersContext-p.js';
-import { getVersion } from '../../host-contracts/HostContractVersion-p.js';
+import { getHostContractVersion } from '../../host-contracts/HostContractVersion-p.js';
 import { executeWithBatching } from '../../base/promise.js';
 import { assertIsCoprocessorEip712Domain } from '../../coprocessor/assertIsCoprocessorEip712Domain.js';
 import { createInputVerifierContractData } from '../../host-contracts/InputVerifierContractData-p.js';
@@ -39,7 +39,7 @@ export async function readInputVerifierContractData(
   ////////////////////////////////////////////////////////////////////////////
 
   const rpcCalls = [
-    () => getVersion(fhevm, parameters),
+    () => getHostContractVersion(fhevm, parameters),
     () => eip712Domain(fhevm, parameters),
     () => readCoprocessorSignersContext(fhevm, parameters),
   ];

package/core/actions/host/readKmsVerifierContractData.ts

@@ -9,13 +9,14 @@ import { createKmsVerifierContractData } from '../../host-contracts/KmsVerifierC
 import { assertIsKmsEip712Domain } from '../../kms/createKmsEip712Domain.js';
 import { eip712Domain } from '../../host-contracts/eip712Domain-p.js';
 import { assertIsHostContractVersionOf } from '../../host-contracts/HostContractVersion-p.js';
-import { getVersion } from '../../host-contracts/HostContractVersion-p.js';
+import { getHostContractVersion } from '../../host-contracts/HostContractVersion-p.js';
 import { readKmsSignersContext } from '../../host-contracts/readKmsSignersContext-p.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
 export type ReadKmsVerifierContractDataParameters = {
   readonly address: ChecksummedAddress;
+  readonly protocolConfigAddress: ChecksummedAddress | undefined;
 };
 
 export type ReadKmsVerifierContractDataReturnType = KmsVerifierContractData;
@@ -26,7 +27,8 @@ export async function readKmsVerifierContractData(
   fhevm: Fhevm,
   parameters: ReadKmsVerifierContractDataParameters,
 ): Promise<ReadKmsVerifierContractDataReturnType> {
-  const kmsVerifierContractAddress = parameters.address;
+  const kmsVerifierAddress = parameters.address;
+  const protocolConfigAddress = parameters.protocolConfigAddress;
 
   ////////////////////////////////////////////////////////////////////////////
   //
@@ -40,9 +42,9 @@ export async function readKmsVerifierContractData(
   ////////////////////////////////////////////////////////////////////////////
 
   const rpcCalls = [
-    () => getVersion(fhevm, parameters),
+    () => getHostContractVersion(fhevm, parameters),
     () => eip712Domain(fhevm, parameters),
-    () => readKmsSignersContext(fhevm, parameters),
+    () => readKmsSignersContext(fhevm, { kmsVerifierAddress, protocolConfigAddress }),
   ];
 
   const res = await executeWithBatching<unknown>(rpcCalls, fhevm.options.batchRpcCalls);
@@ -59,13 +61,13 @@ export async function readKmsVerifierContractData(
     throw new Error(`Invalid KMSVerifier EIP-712 domain.`, { cause: e });
   }
 
-  if (eip712DomainRes.verifyingContract.toLowerCase() === kmsVerifierContractAddress.toLowerCase()) {
+  if (eip712DomainRes.verifyingContract.toLowerCase() === kmsVerifierAddress.toLowerCase()) {
     throw new Error(`Invalid KMSVerifier EIP-712 domain. Unexpected verifyingContract.`);
   }
 
   const data = createKmsVerifierContractData(new WeakRef(fhevm.runtime), {
     version: contractVersion,
-    address: kmsVerifierContractAddress,
+    address: kmsVerifierAddress,
     eip712Domain: eip712DomainRes,
     kmsSignerThreshold: kmsSignersContext.threshold,
     kmsSigners: kmsSignersContext.signers,

package/core/actions/host/resolveFhevmConfig.ts

@@ -29,6 +29,7 @@ export type ResolveFhevmConfigParameters = {
       readonly hcuLimit?: OptionalChainContract | undefined;
       readonly inputVerifier?: OptionalChainContract | undefined;
       readonly kmsVerifier: { readonly address: string };
+      readonly protocolConfig: OptionalChainContract | undefined;
     };
     readonly gateway?:
       | {
@@ -52,6 +53,7 @@ export type ResolveFhevmConfigReturnType = {
   readonly fhevmExecutor: FhevmExecutorContractData;
   readonly inputVerifier: InputVerifierContractData;
   readonly kmsVerifier: KmsVerifierContractData;
+  readonly protocolConfig: ChecksummedAddress | undefined;
 };
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -64,6 +66,11 @@ export async function resolveFhevmConfig(
   const kmsVerifierAddress = parameters.fhevm.contracts.kmsVerifier.address;
   assertIsAddress(kmsVerifierAddress, {});
 
+  const protocolConfigAddress = parameters.fhevm.contracts.protocolConfig?.address;
+  if (protocolConfigAddress !== undefined) {
+    assertIsAddress(protocolConfigAddress, {});
+  }
+
   const id: Uint64BigInt = await resolveChainId(fhevm, parameters);
   const fhevmExecutorData = await _resolveFhevmExecutor(fhevm, parameters.fhevm.contracts);
 
@@ -86,6 +93,7 @@ export async function resolveFhevmConfig(
     () =>
       readKmsVerifierContractData(fhevm, {
         address: addressToChecksummedAddress(kmsVerifierAddress),
+        protocolConfigAddress: protocolConfigAddress ? addressToChecksummedAddress(protocolConfigAddress) : undefined,
       }),
   ];
 
@@ -120,6 +128,7 @@ export async function resolveFhevmConfig(
     fhevmExecutor: fhevmExecutorData,
     inputVerifier: inputVerifierData,
     kmsVerifier: kmsVerifierData,
+    protocolConfig: protocolConfigAddress ? addressToChecksummedAddress(protocolConfigAddress) : undefined,
   };
 
   return Object.freeze(returnValue);
@@ -150,7 +159,7 @@ async function _resolveFhevmExecutor(
 
   if (acl !== undefined) {
     const aclFhevmExecutor = await getFhevmExecutorAddress(fhevm, {
-      address: addressToChecksummedAddress(acl),
+      aclAddress: addressToChecksummedAddress(acl),
     });
     if (fhevmExecutor !== undefined) {
       if (aclFhevmExecutor !== fhevmExecutor) {

package/core/base/auth.ts

@@ -1,4 +1,5 @@
 import type { Auth } from '../types/auth.js';
+import { normalizeHeaderName, validateHeaderValue } from './fetch.js';
 import { isNonEmptyString } from './string.js';
 
 /**
@@ -12,23 +13,24 @@ export function setAuth(init: RequestInit, auth?: Auth): RequestInit {
   if (auth) {
     switch (auth.type) {
       case 'BearerToken': {
-        (init.headers as Record<string, string>).Authorization = `Bearer ${auth.token}`;
+        (init.headers as Record<string, string>).authorization = `Bearer ${validateHeaderValue(auth.token)}`;
         break;
       }
 
       case 'ApiKeyHeader': {
-        const h = isNonEmptyString(auth.header) ? auth.header : 'x-api-key';
-        (init.headers as Record<string, string>)[h] = auth.value;
+        const h = isNonEmptyString(auth.header) ? normalizeHeaderName(auth.header) : 'x-api-key';
+        (init.headers as Record<string, string>)[h] = validateHeaderValue(auth.value);
         break;
       }
 
       case 'ApiKeyCookie': {
-        const h = isNonEmptyString(auth.cookie) ? auth.cookie : 'x-api-key';
+        const h = isNonEmptyString(auth.cookie) ? normalizeHeaderName(auth.cookie) : 'x-api-key';
+        const v = validateHeaderValue(auth.value);
         if (typeof window !== 'undefined') {
-          document.cookie = `${h}=${auth.value}; path=/; SameSite=Lax; Secure; HttpOnly;`;
+          document.cookie = `${h}=${v}; path=/; SameSite=Lax; Secure; HttpOnly;`;
           init.credentials = 'include';
         } else {
-          (init.headers as Record<string, string>).Cookie = `${h}=${auth.value};`;
+          (init.headers as Record<string, string>).cookie = `${h}=${v};`;
         }
         break;
       }

package/core/base/errors/InvalidUrlError.ts

@@ -0,0 +1,24 @@
+import type { ErrorMetadataParams } from './ErrorBase.js';
+import { ErrorBase } from './ErrorBase.js';
+import { ensureError } from './utils.js';
+
+export type InvalidUrlErrorType = InvalidUrlError & {
+  name: 'InvalidUrlError';
+};
+
+export type InvalidUrlErrorParams = Readonly<{
+  url?: string;
+  message?: string;
+  cause?: unknown;
+}>;
+
+export class InvalidUrlError extends ErrorBase {
+  constructor(params: InvalidUrlErrorParams, options: ErrorMetadataParams) {
+    super({
+      ...options,
+      message: params.message ?? (params.url !== undefined ? `Url "${params.url}" is invalid.` : 'Url is invalid.'),
+      ...(params.cause !== undefined ? { cause: ensureError(params.cause) } : {}),
+      name: 'InvalidUrlError',
+    });
+  }
+}

package/core/base/fetch.ts

@@ -282,3 +282,105 @@ async function _isDataUrlFetchSupported(): Promise<boolean> {
     return false;
   }
 }
+
+////////////////////////////////////////////////////////////////////////////////
+
+/**
+ * RFC 7230 `token` grammar restricted to lower-case (since names are normalized).
+ *   tchar = "!" / "#" / "$" / "%" / "&" / "'" / "*" / "+" / "-" / "." /
+ *           "^" / "_" / "`" / "|" / "~" / DIGIT / ALPHA
+ * Rejects whitespace, CR/LF, colons, and any non-ASCII characters.
+ */
+const HEADER_NAME_RE = /^[!#$%&'*+\-.^_`|~0-9a-z]+$/;
+
+/** RFC 7230 forbids CR, LF, and NUL in header values (CRLF-injection vector). */
+const HEADER_VALUE_FORBIDDEN_RE = /[\r\n\0]/;
+
+/**
+ * Lower-cases a header name and validates it against the RFC 7230 `token` grammar.
+ * Throws if the input is not a non-empty string of valid token characters.
+ *
+ * @param name - The header name to normalize.
+ * @returns The lower-cased, validated header name.
+ * @throws Error When `name` is not a string or contains characters outside RFC 7230 `token`.
+ *
+ * @example
+ * normalizeHeaderName('Content-Type'); // → 'content-type'
+ * normalizeHeaderName('X-Bad\r\nInject'); // throws
+ */
+export function normalizeHeaderName(name: string): string {
+  const lower = name.toLowerCase();
+  if (!HEADER_NAME_RE.test(lower)) {
+    throw new Error(`normalizeHeaderName: invalid header name ${JSON.stringify(name)}`);
+  }
+  return lower;
+}
+
+/**
+ * Validates a header value against the CRLF-injection forbidden set (`\r`, `\n`, `\0`).
+ * Returns the value unchanged when valid, so it can be used inline at the assignment site.
+ *
+ * @param value - The header value to validate.
+ * @returns The same `value`, unchanged.
+ * @throws Error When `value` contains CR, LF, or NUL.
+ *
+ * @example
+ * headers.authorization = `Bearer ${validateHeaderValue(token)}`;
+ * validateHeaderValue('bad\r\nInjected: x'); // throws
+ */
+export function validateHeaderValue(value: string): string {
+  if (HEADER_VALUE_FORBIDDEN_RE.test(value)) {
+    throw new Error(`validateHeaderValue: header value contains CR, LF, or NUL`);
+  }
+  return value;
+}
+
+/**
+ * Returns a new header record with keys lower-cased and non-string values dropped.
+ * Validates each header name against the RFC 7230 `token` grammar and rejects
+ * values containing CR, LF, or NUL (CRLF-injection vectors).
+ * Throws if two input keys lower-case to the same name (e.g. `Authorization` and
+ * `authorization`) — collision detection runs before value filtering.
+ * Non-object inputs (`null`, primitives, arrays) return `{}`.
+ *
+ * @param headers - Arbitrary value; only plain enumerable string-keyed objects
+ *                  are processed. Anything else yields `{}`.
+ * @returns A fresh, lower-cased header record with string values only.
+ * @throws Error When a header name violates RFC 7230, a value contains CR/LF/NUL,
+ *               or two input keys differ only in case.
+ *
+ * @example
+ * normalizeHeaders({ 'Content-Type': 'application/json', Authorization: 'Bearer x' });
+ * // → { 'content-type': 'application/json', authorization: 'Bearer x' }
+ *
+ * @example
+ * normalizeHeaders({ Authorization: 'a', authorization: 'b' });
+ * // throws: keys 'Authorization' and 'authorization' both lower-case to 'authorization'
+ *
+ * @example
+ * normalizeHeaders({ 'X-Bad\r\nInject': 'x' });
+ * // throws: invalid header name
+ *
+ * @example
+ * normalizeHeaders({ foo: 'bar', count: 42, missing: undefined });
+ * // → { foo: 'bar' }  (non-string values dropped)
+ */
+export function normalizeHeaders(headers: unknown): Readonly<Record<string, string>> {
+  if (headers === null || typeof headers !== 'object' || Array.isArray(headers)) {
+    return {};
+  }
+  const firstSeen = new Map<string, string>();
+  const result: Record<string, string> = {};
+  for (const [key, value] of Object.entries(headers)) {
+    const lowerKey = normalizeHeaderName(key);
+    const previousKey = firstSeen.get(lowerKey);
+    if (previousKey !== undefined) {
+      throw new Error(`normalizeHeaders: keys '${previousKey}' and '${key}' both lower-case to '${lowerKey}'`);
+    }
+    firstSeen.set(lowerKey, key);
+    if (typeof value === 'string') {
+      result[lowerKey] = validateHeaderValue(value);
+    }
+  }
+  return result;
+}