@revenexx/integrations-node-sdk 1.8.0 → 1.8.1

package/dist/index.cjs

@@ -496,6 +496,43 @@ var CROSS_ORIGIN_SAFE_HEADERS = /* @__PURE__ */ new Set([
 function headerCrossesOrigin(name) {
   return CROSS_ORIGIN_SAFE_HEADERS.has(name.trim().toLowerCase());
 }
+var UNSENDABLE_IN_HEADER_VALUE = /[\0-\x08\x0a-\x1f\x7f\u0100-\uffff]/;
+var HEADER_NAME_TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+function isHttpWhitespace(code) {
+  return code === 9 || code === 10 || code === 13 || code === 32;
+}
+function trimHttpWhitespace(value) {
+  let start = 0;
+  let end = value.length;
+  while (start < end && isHttpWhitespace(value.charCodeAt(start))) start++;
+  while (end > start && isHttpWhitespace(value.charCodeAt(end - 1))) end--;
+  return value.slice(start, end);
+}
+function invalidHeader(detail) {
+  return new NodeError("INVALID_HEADER", detail, { status: 0 });
+}
+function sendableHeaders(headers) {
+  if (typeof headers !== "object" || headers === null) {
+    throw invalidHeader("Headers must be an object or a list of pairs");
+  }
+  if (!(Symbol.iterator in headers) && Object.getOwnPropertySymbols(headers).length > 0) {
+    throw invalidHeader("A header name must be a string, not a symbol");
+  }
+  const entries = Symbol.iterator in headers ? Array.from(headers) : Object.entries(headers);
+  return entries.map((entry, i) => {
+    const pair = typeof entry === "object" && entry !== null && Symbol.iterator in entry ? Array.from(entry) : [];
+    if (pair.length !== 2) throw invalidHeader(`Header entry ${i} is not a name/value pair`);
+    const name = String(pair[0]);
+    const value = String(pair[1]);
+    if (!HEADER_NAME_TOKEN.test(name)) {
+      throw invalidHeader(`Header name ${JSON.stringify(name)} cannot be sent`);
+    }
+    if (UNSENDABLE_IN_HEADER_VALUE.test(trimHttpWhitespace(value))) {
+      throw invalidHeader(`Header ${JSON.stringify(name)} has a character in its value that cannot be sent`);
+    }
+    return [name, value];
+  });
+}
 var DEFAULT_RETRY_ATTEMPTS = 0;
 var MAX_RETRY_ATTEMPTS = 5;
 var DEFAULT_RETRY_DELAY_MS = 1e3;
@@ -568,7 +605,7 @@ async function guardedFetch(url, fetchOptions, ctxSignal, effectiveMs) {
       throw new NodeError("BLOCKED_ADDRESS", "Blocked https\u2192http downgrade on redirect", { status: 0 });
     }
     await guardUrl(nextUrl, ctxSignal, effectiveMs);
-    const headers = new Headers(currentInit.headers ?? void 0);
+    const headers = new Headers(currentInit.headers);
     let method = (currentInit.method ?? "GET").toUpperCase();
     let body = currentInit.body;
     if (redirectStatus === 303 || (redirectStatus === 301 || redirectStatus === 302) && method === "POST") {
@@ -593,6 +630,8 @@ async function safeFetch(url, options = {}) {
   const safeAttempts = Number.isFinite(rawAttempts) ? Math.min(Math.max(0, rawAttempts), MAX_RETRY_ATTEMPTS) : DEFAULT_RETRY_ATTEMPTS;
   const maxAttempts = safeAttempts + 1;
   const retryDelayMs = retry?.delayMs ?? DEFAULT_RETRY_DELAY_MS;
+  if (ctxSignal?.aborted) throw ctxSignal.reason;
+  if (fetchOptions.headers !== void 0) fetchOptions.headers = sendableHeaders(fetchOptions.headers);
   let lastError;
   for (let attempt = 1; attempt <= maxAttempts; attempt++) {
     if (ctxSignal?.aborted) throw ctxSignal.reason;

package/dist/index.js

@@ -404,6 +404,43 @@ var CROSS_ORIGIN_SAFE_HEADERS = /* @__PURE__ */ new Set([
 function headerCrossesOrigin(name) {
   return CROSS_ORIGIN_SAFE_HEADERS.has(name.trim().toLowerCase());
 }
+var UNSENDABLE_IN_HEADER_VALUE = /[\0-\x08\x0a-\x1f\x7f\u0100-\uffff]/;
+var HEADER_NAME_TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+function isHttpWhitespace(code) {
+  return code === 9 || code === 10 || code === 13 || code === 32;
+}
+function trimHttpWhitespace(value) {
+  let start = 0;
+  let end = value.length;
+  while (start < end && isHttpWhitespace(value.charCodeAt(start))) start++;
+  while (end > start && isHttpWhitespace(value.charCodeAt(end - 1))) end--;
+  return value.slice(start, end);
+}
+function invalidHeader(detail) {
+  return new NodeError("INVALID_HEADER", detail, { status: 0 });
+}
+function sendableHeaders(headers) {
+  if (typeof headers !== "object" || headers === null) {
+    throw invalidHeader("Headers must be an object or a list of pairs");
+  }
+  if (!(Symbol.iterator in headers) && Object.getOwnPropertySymbols(headers).length > 0) {
+    throw invalidHeader("A header name must be a string, not a symbol");
+  }
+  const entries = Symbol.iterator in headers ? Array.from(headers) : Object.entries(headers);
+  return entries.map((entry, i) => {
+    const pair = typeof entry === "object" && entry !== null && Symbol.iterator in entry ? Array.from(entry) : [];
+    if (pair.length !== 2) throw invalidHeader(`Header entry ${i} is not a name/value pair`);
+    const name = String(pair[0]);
+    const value = String(pair[1]);
+    if (!HEADER_NAME_TOKEN.test(name)) {
+      throw invalidHeader(`Header name ${JSON.stringify(name)} cannot be sent`);
+    }
+    if (UNSENDABLE_IN_HEADER_VALUE.test(trimHttpWhitespace(value))) {
+      throw invalidHeader(`Header ${JSON.stringify(name)} has a character in its value that cannot be sent`);
+    }
+    return [name, value];
+  });
+}
 var DEFAULT_RETRY_ATTEMPTS = 0;
 var MAX_RETRY_ATTEMPTS = 5;
 var DEFAULT_RETRY_DELAY_MS = 1e3;
@@ -476,7 +513,7 @@ async function guardedFetch(url, fetchOptions, ctxSignal, effectiveMs) {
       throw new NodeError("BLOCKED_ADDRESS", "Blocked https\u2192http downgrade on redirect", { status: 0 });
     }
     await guardUrl(nextUrl, ctxSignal, effectiveMs);
-    const headers = new Headers(currentInit.headers ?? void 0);
+    const headers = new Headers(currentInit.headers);
     let method = (currentInit.method ?? "GET").toUpperCase();
     let body = currentInit.body;
     if (redirectStatus === 303 || (redirectStatus === 301 || redirectStatus === 302) && method === "POST") {
@@ -501,6 +538,8 @@ async function safeFetch(url, options = {}) {
   const safeAttempts = Number.isFinite(rawAttempts) ? Math.min(Math.max(0, rawAttempts), MAX_RETRY_ATTEMPTS) : DEFAULT_RETRY_ATTEMPTS;
   const maxAttempts = safeAttempts + 1;
   const retryDelayMs = retry?.delayMs ?? DEFAULT_RETRY_DELAY_MS;
+  if (ctxSignal?.aborted) throw ctxSignal.reason;
+  if (fetchOptions.headers !== void 0) fetchOptions.headers = sendableHeaders(fetchOptions.headers);
   let lastError;
   for (let attempt = 1; attempt <= maxAttempts; attempt++) {
     if (ctxSignal?.aborted) throw ctxSignal.reason;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@revenexx/integrations-node-sdk",
-  "version": "1.8.0",
+  "version": "1.8.1",
   "description": "TypeScript interfaces and utilities for Revenexx integration nodes",
   "license": "MIT",
   "author": "revenexx GmbH",