@wmind/site-core 0.1.1 → 0.1.2

package/README.md

@@ -4,8 +4,9 @@ The product-independent core of the site SDK: an HTTP transport, request-driven
 cache model, an atomic-swap snapshot, webhooks and status. Product modules (`@wmind/site-entitycms`,
 `@wmind/site-legal`) build on it; a site normally installs a module, not this package alone.
 
-- **Status:** MIT, final name, public on npm. Version `0.1.1`: the two known limits of `0.1.0`
-  fixed, one option added (`storeTimeoutMs`), nothing removed or changed in shape.
+- **Status:** MIT, final name, public on npm. Version `0.1.2`: a bug fix (the transport's timeout
+  survives a garbage collection on Node); `0.1.1` fixed the two known limits of `0.1.0` and added
+  one option (`storeTimeoutMs`). Nothing removed or changed in shape.
 - **Runs on:** Node 22, browsers and edge runtimes (Cloudflare Workers, Vercel, Netlify). Web
   platform APIs only (`fetch`, `Request`, `Response`, `crypto.subtle`, `AbortController`); zero
   runtime dependencies.
@@ -51,6 +52,12 @@ cache model, an atomic-swap snapshot, webhooks and status. Product modules (`@wm
 
 ## Known limits
 
+- **Fixed in 0.1.2.** On Node 22, `fetch(request)` holds the Request's abort signal weakly: when a
+  garbage collection ran before an attempt's timer fired, the abort never reached the socket, and a
+  call to an API that never answers hung forever, past `timeoutMs` and the deadline (a flight that
+  never settles, a request that waits for it). The transport now keeps each Request referenced
+  until its fetch settles, so `timeoutMs` and `deadlineMs` hold. A `fetch` you pass gets the same
+  Request and needs nothing more.
 - **Fixed in 0.1.1.** A loader slower than `refreshMaxMs` no longer restarts forever without
   landing (rule 1), and a store call that never settles no longer blocks its key: every
   `CacheStore` call (`get`, `set`, `delete`) is bounded by `storeTimeoutMs` (5 s), after which it

package/dist/http.js

@@ -5,6 +5,10 @@
  */
 import { errorFromResponse, parseRetryAfter, siteSdkError } from './errors.js';
 import { sleep, timeoutSignal } from './internal/timers.js';
+/** Reads `value` so it stays reachable until the caller's promise settles (0.1.2). */
+function keepAlive(value) {
+    void value;
+}
 export const DEFAULT_TIMEOUT_MS = 10_000;
 export const DEFAULT_DEADLINE_MS = 30_000;
 export const DEFAULT_MAX_RETRIES = 6;
@@ -152,13 +156,17 @@ export function createHttp(options) {
             }));
             try {
                 let res;
+                const outgoing = new Request(url, {
+                    method,
+                    headers,
+                    ...(bodyText !== undefined ? { body: bodyText } : {}),
+                    signal,
+                });
                 try {
-                    res = await fetchImpl(new Request(url, {
-                        method,
-                        headers,
-                        ...(bodyText !== undefined ? { body: bodyText } : {}),
-                        signal,
-                    }));
+                    // 0.1.2: the Request stays referenced until its fetch settles. Node's fetch holds the
+                    // Request's signal weakly: once the Request is collected, the timeout's abort never
+                    // reaches the socket, and a call to an API that never answers hangs forever.
+                    res = await Promise.resolve(fetchImpl(outgoing)).finally(() => keepAlive(outgoing));
                 }
                 catch (error) {
                     throw failure(error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wmind/site-core",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Site SDK core: HTTP transport, request-driven refresh, snapshot store, webhooks, status",
   "license": "MIT",
   "repository": {