kinetex 1.0.0 → 1.1.0

package/dist/browser/kinetex.js

@@ -1,4 +1,4 @@
-/* kinetex v1.0.0 | MIT | https://github.com/kinetexjs/kinetex */
+/* kinetex v1.1.0 | MIT | https://github.com/kinetexjs/kinetex */
 "use strict";
 var kinetex = (() => {
   var __create = Object.create;
@@ -51,160 +51,6 @@ var kinetex = (() => {
   var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
   var __privateMethod = (obj, member, method) => (__accessCheck(obj, member, "access private method"), method);
 
-  // dist/esm/types.js
-  function toRequestId(id) {
-    return id;
-  }
-  function validateErrorCode(code) {
-    if (typeof code === "string") {
-      for (const valid of VALID_ERROR_CODES) {
-        if (valid === code)
-          return valid;
-      }
-    }
-    return void 0;
-  }
-  var VALID_ERROR_CODES, KinetexError, SizeLimitError, HTTPStatusError, AbortError, NetworkError, ValidationError, AuthError, ProxyError, RedirectError, TimeoutError;
-  var init_types = __esm({
-    "dist/esm/types.js"() {
-      "use strict";
-      VALID_ERROR_CODES = [
-        "ENETWORK",
-        "ETIMEOUT",
-        "EABORT",
-        "EHTTPSTATUS",
-        "ESIZELIMIT",
-        "EPARSE",
-        "EVALIDATION",
-        "EAUTH",
-        "EPROXY",
-        "EREDIRECT",
-        "EUNKNOWN"
-      ];
-      KinetexError = class extends Error {
-        /**
-         * @param message - Human-readable error description.
-         * @param code - Machine-readable error code.
-         * @param options - Additional context (request, response, cause).
-         */
-        constructor(message, code, options) {
-          super(message);
-          /** Machine-readable error code. */
-          __publicField(this, "code");
-          /** Original request, if available. */
-          __publicField(this, "request");
-          /** Response, if available (for HTTP-level errors). */
-          __publicField(this, "response");
-          /** Underlying cause. */
-          __publicField(this, "cause");
-          this.name = "KinetexError";
-          this.code = code;
-          if (options?.request !== void 0)
-            this.request = options.request;
-          if (options?.response !== void 0)
-            this.response = options.response;
-          if (options?.cause !== void 0)
-            this.cause = options.cause;
-        }
-        /** True if the error is a network/transport failure (not proxy-related). */
-        get isNetwork() {
-          return this.code === "ENETWORK";
-        }
-        /** True if the error is a proxy-related failure. */
-        get isProxy() {
-          return this.code === "EPROXY";
-        }
-        /** True if the error is a timeout. */
-        get isTimeout() {
-          return this.code === "ETIMEOUT";
-        }
-        /** True if the request was aborted by the caller. */
-        get isAbort() {
-          return this.code === "EABORT";
-        }
-        /** True if the server returned a 4xx or 5xx status. */
-        get isHTTPError() {
-          return this.code === "EHTTPSTATUS";
-        }
-        /** HTTP status code shorthand (null for non-HTTP errors). */
-        get status() {
-          return this.response?.status ?? null;
-        }
-      };
-      SizeLimitError = class extends KinetexError {
-        constructor(bytesRead, limit, request) {
-          super(`Response size limit exceeded: ${bytesRead} bytes read, limit is ${limit} bytes`, "ESIZELIMIT", request !== void 0 ? { request } : {});
-          __publicField(this, "bytesRead");
-          __publicField(this, "limit");
-          this.bytesRead = bytesRead;
-          this.limit = limit;
-          this.name = "SizeLimitError";
-        }
-      };
-      HTTPStatusError = class extends KinetexError {
-        constructor(response, request) {
-          super(`HTTP ${response.status} ${response.statusText} \u2014 ${response.url}`, "EHTTPSTATUS", {
-            request,
-            response
-          });
-          this.name = "HTTPStatusError";
-        }
-        /** True if the status is a 4xx client error. */
-        get isClientError() {
-          return (this.status ?? 0) >= 400 && (this.status ?? 0) < 500;
-        }
-        /** True if the status is a 5xx server error. */
-        get isServerError() {
-          return (this.status ?? 0) >= 500;
-        }
-      };
-      AbortError = class extends KinetexError {
-        constructor(request) {
-          super("Request was aborted", "EABORT", request !== void 0 ? { request } : {});
-          this.name = "AbortError";
-        }
-      };
-      NetworkError = class extends KinetexError {
-        constructor(message, request) {
-          super(message, "ENETWORK", request !== void 0 ? { request } : {});
-          this.name = "NetworkError";
-        }
-      };
-      ValidationError = class extends KinetexError {
-        constructor(message, request) {
-          super(message, "EVALIDATION", request !== void 0 ? { request } : {});
-          this.name = "ValidationError";
-        }
-      };
-      AuthError = class extends KinetexError {
-        constructor(message, request) {
-          super(message, "EAUTH", request !== void 0 ? { request } : {});
-          this.name = "AuthError";
-        }
-      };
-      ProxyError = class extends KinetexError {
-        constructor(message, request) {
-          super(message, "EPROXY", request !== void 0 ? { request } : {});
-          this.name = "ProxyError";
-        }
-      };
-      RedirectError = class extends KinetexError {
-        constructor(message, request) {
-          super(message, "EREDIRECT", request !== void 0 ? { request } : {});
-          this.name = "RedirectError";
-        }
-      };
-      TimeoutError = class extends KinetexError {
-        constructor(timeoutMs, request) {
-          super(`Request timed out after ${timeoutMs}ms`, "ETIMEOUT", request !== void 0 ? { request } : {});
-          __publicField(this, "timeoutMs");
-          this.timeoutMs = timeoutMs;
-          this.name = "TimeoutError";
-        }
-      };
-    }
-  });
-
   // dist/esm/utils.js
   function getProcess() {
     if (_process)
@@ -346,6 +192,25 @@ var kinetex = (() => {
     const result = safeJSONParse(text);
     return result.success ? result.value : text;
   }
+  function sanitizeParsedJSON(value) {
+    if (value === null || typeof value !== "object")
+      return value;
+    if (Array.isArray(value)) {
+      for (let i = 0; i < value.length; i++) {
+        value[i] = sanitizeParsedJSON(value[i]);
+      }
+      return value;
+    }
+    const obj = value;
+    for (const key of Object.keys(obj)) {
+      if (key === "__proto__" || key === "constructor" || key === "prototype") {
+        delete obj[key];
+        continue;
+      }
+      sanitizeParsedJSON(obj[key]);
+    }
+    return value;
+  }
   function parseUntrustedJSON(text) {
     return safeJSONParse(text, {
       maxDepth: 16,
@@ -401,6 +266,123 @@ var kinetex = (() => {
     }
     return true;
   }
+  function isBlockedIPv4(n) {
+    return IPV4_BLOCKED_RANGES.some(([lo, hi]) => n >= lo && n <= hi);
+  }
+  function parseIPv4Component(p) {
+    if (p === "")
+      return null;
+    if (/^0[xX][0-9a-fA-F]+$/.test(p))
+      return parseInt(p, 16);
+    if (/^0[0-7]+$/.test(p))
+      return parseInt(p, 8);
+    if (/^\d+$/.test(p))
+      return parseInt(p, 10);
+    return null;
+  }
+  function parseIPv4Host(host) {
+    if (host.includes(":") || !/^[0-9a-fA-FxX.]+$/.test(host))
+      return null;
+    const parts = host.split(".");
+    if (parts.length > 4)
+      return null;
+    if (parts.length === 1) {
+      const v = parseIPv4Component(parts[0]);
+      if (v === null || v > 4294967295)
+        return null;
+      return v >>> 0;
+    }
+    const nums = [];
+    for (const p of parts) {
+      const v = parseIPv4Component(p);
+      const isLast = p === parts[parts.length - 1];
+      if (v === null || v > (isLast && nums.length === 3 ? 255 : 255))
+        return null;
+      nums.push(v);
+    }
+    while (nums.length < 4)
+      nums.push(0);
+    return (nums[0] << 24 | nums[1] << 16 | nums[2] << 8 | nums[3]) >>> 0;
+  }
+  function parseIPv6Host(host) {
+    if (!host.includes(":"))
+      return null;
+    const bare = host.split("%")[0];
+    const halves = bare.split("::");
+    if (halves.length > 2)
+      return null;
+    const expandGroups = (part) => {
+      if (part === "")
+        return [];
+      const groups = part.split(":");
+      const out = [];
+      for (let i = 0; i < groups.length; i++) {
+        const g2 = groups[i];
+        if (g2 === "")
+          return null;
+        if (g2.includes(".")) {
+          if (i !== groups.length - 1)
+            return null;
+          const n = parseIPv4Host(g2);
+          if (n === null)
+            return null;
+          out.push(n >>> 24 & 255, n >>> 16 & 255, n >>> 8 & 255, n & 255);
+        } else {
+          if (!/^[0-9a-fA-F]{1,4}$/.test(g2))
+            return null;
+          const v = parseInt(g2, 16);
+          out.push(v >>> 8 & 255, v & 255);
+        }
+      }
+      return out;
+    };
+    let bytes;
+    if (halves.length === 2) {
+      const left = expandGroups(halves[0]);
+      const right = expandGroups(halves[1]);
+      if (!left || !right)
+        return null;
+      const fill = 16 - left.length - right.length;
+      if (fill < 0)
+        return null;
+      bytes = [...left, ...new Array(fill).fill(0), ...right];
+    } else {
+      const all = expandGroups(bare);
+      if (!all || all.length !== 16)
+        return null;
+      bytes = all;
+    }
+    return bytes.length === 16 ? new Uint8Array(bytes) : null;
+  }
+  function isBlockedIPv6(b) {
+    const read32 = (i) => (b[i] << 24 | b[i + 1] << 16 | b[i + 2] << 8 | b[i + 3]) >>> 0;
+    if (b.every((x) => x === 0))
+      return true;
+    if (b.slice(0, 15).every((x) => x === 0) && b[15] === 1)
+      return true;
+    const first = b[0];
+    if ((first & 254) === 252)
+      return true;
+    if (first === 254 && (b[1] & 192) === 128)
+      return true;
+    if (first === 255)
+      return true;
+    if (b[0] === 32 && b[1] === 1 && b[2] === 13 && b[3] === 184)
+      return true;
+    if (b.slice(0, 10).every((x) => x === 0) && b[10] === 255 && b[11] === 255) {
+      return isBlockedIPv4(read32(12));
+    }
+    if (b.slice(0, 12).every((x) => x === 0)) {
+      return isBlockedIPv4(read32(12));
+    }
+    if (b[0] === 0 && b[1] === 100 && b[2] === 255 && b[3] === 155 && b.slice(4, 12).every((x) => x === 0)) {
+      return isBlockedIPv4(read32(12));
+    }
+    if (b[0] === 32 && b[1] === 2) {
+      return isBlockedIPv4(read32(2));
+    }
+    return false;
+  }
   function isSafeURL(url, allowedSchemes = ["http", "https"]) {
     try {
       const parsed = typeof url === "string" ? new URL(url) : url;
@@ -412,14 +394,20 @@ var kinetex = (() => {
         return false;
       }
       let host = parsed.hostname.toLowerCase();
-      if (host.startsWith("[") && host.endsWith("]"))
+      const isV6Literal = host.startsWith("[") && host.endsWith("]");
+      if (isV6Literal)
         host = host.slice(1, -1);
-      if (host === "0:0:0:0:0:0:0:1")
-        host = "::1";
-      if (host === "localhost" || host === "0.0.0.0")
-        return false;
-      if (PRIVATE_IP_RANGES.some((r) => r.test(host)))
+      if (host === "localhost" || host.endsWith(".localhost") || host === "0.0.0.0")
         return false;
+      if (isV6Literal || host.includes(":")) {
+        const v6 = parseIPv6Host(host);
+        if (v6 === null || isBlockedIPv6(v6))
+          return false;
+      } else {
+        const v4 = parseIPv4Host(host);
+        if (v4 !== null && isBlockedIPv4(v4))
+          return false;
+      }
       if (parsed.hostname.includes("..") || parsed.pathname.includes("..")) {
         return false;
       }
@@ -463,6 +451,8 @@ var kinetex = (() => {
     }
     const cloned = {};
     for (const key in value) {
+      if (key === "__proto__" || key === "constructor" || key === "prototype")
+        continue;
       if (Object.prototype.hasOwnProperty.call(value, key)) {
         cloned[key] = deepClone(value[key]);
       }
@@ -619,17 +609,14 @@ var kinetex = (() => {
     return false;
   }
   function randomBytes(byteCount) {
+    if (!Number.isInteger(byteCount) || byteCount < 0 || byteCount > 65536) {
+      throw new Error(`randomBytes: invalid byteCount ${byteCount}`);
+    }
     const arr = new Uint8Array(byteCount);
     if (typeof crypto !== "undefined" && typeof crypto.getRandomValues === "function") {
       crypto.getRandomValues(arr);
     } else {
-      const uuid = typeof crypto !== "undefined" && typeof crypto.randomUUID === "function" ? crypto.randomUUID().replace(/-/g, "") : "";
-      if (uuid.length >= byteCount * 2) {
-        return uuid.slice(0, byteCount * 2);
-      }
-      for (let i = 0; i < arr.length; i++) {
-        arr[i] = Math.floor(Math.random() * 256);
-      }
+      throw new Error("randomBytes: no CSPRNG available in this runtime \u2014 crypto.getRandomValues is required");
     }
     return Array.from(arr).map((b) => b.toString(16).padStart(2, "0")).join("");
   }
@@ -681,7 +668,7 @@ var kinetex = (() => {
     });
     return result;
   }
-  var _process, _Buffer, DEFAULT_LIMITS, HEADER_NAME_PATTERN, FORBIDDEN_SCHEMES, PRIVATE_IP_RANGES, cachedRuntime;
+  var _process, _Buffer, DEFAULT_LIMITS, HEADER_NAME_PATTERN, FORBIDDEN_SCHEMES, IPV4_BLOCKED_RANGES, cachedRuntime;
   var init_utils = __esm({
     "dist/esm/utils.js"() {
       "use strict";
@@ -717,53 +704,194 @@ var kinetex = (() => {
         "webcal",
         "urn"
       ]);
-      PRIVATE_IP_RANGES = [
-        /^127\./,
-        // loopback
-        /^10\./,
-        // RFC 1918
-        /^192\.168\./,
-        // RFC 1918
-        /^172\.(1[6-9]|2\d|3[01])\./,
-        // RFC 1918
-        /^169\.254\./,
-        // link-local (AWS IMDS, etc.)
-        /^0\./,
-        // this-network
-        /^::1$/i,
-        // IPv6 loopback
-        /^fc00:/i,
-        // IPv6 ULA (fc00::/7 - includes fc00: and fd00:)
-        /^fd00:/i,
-        // IPv6 ULA (fd00::/8 - unique local)
-        /^fe80:/i,
-        // IPv6 link-local (fe80::/10)
-        /^2001:db8:/i,
-        // IPv6 documentation range
-        /^::0?ffff:/i,
-        // IPv4-mapped IPv6 (::ffff:...)
-        /^0:0:0:0:0:ffff:/i,
-        // IPv4-mapped compressed form
-        // FIX 4: IPv4-mapped IPv6 SSRF bypass — e.g. http://[::ffff:127.0.0.1]
-        /^::ffff:127\./i,
-        // IPv4-mapped loopback
-        /^::ffff:10\./i,
-        // IPv4-mapped RFC 1918
-        /^::ffff:192\.168\./i,
-        // IPv4-mapped RFC 1918
-        /^::ffff:172\.(1[6-9]|2\d|3[01])\./i,
-        // IPv4-mapped RFC 1918
-        /^::ffff:169\.254\./i,
-        // IPv4-mapped link-local
-        /^0:0:0:0:0:ffff:7f/i,
-        // compressed form of ::ffff:127.x
-        /^::$/i
-        // IPv4-compatible :: (any ::/96)
+      IPV4_BLOCKED_RANGES = [
+        [0, 16777215],
+        // 0.0.0.0/8 — this-network
+        [167772160, 184549375],
+        // 10.0.0.0/8 — RFC 1918 private
+        [1681915904, 1686110207],
+        // 100.64.0.0/10 — CGNAT (RFC 6598)
+        [2130706432, 2147483647],
+        // 127.0.0.0/8 — loopback
+        [2851995648, 2852061183],
+        // 169.254.0.0/16 — link-local (AWS IMDS etc.)
+        [2886729728, 2887778303],
+        // 172.16.0.0/12 — RFC 1918 private
+        [3221225472, 3221225727],
+        // 192.0.0.0/24 — IETF protocol assignments
+        [3221225984, 3221226239],
+        // 192.0.2.0/24 — TEST-NET-1
+        [3232235520, 3232301055],
+        // 192.168.0.0/16 — RFC 1918 private
+        [3323068416, 3323199487],
+        // 198.18.0.0/15 — benchmarking
+        [3325256704, 3325256959],
+        // 198.51.100.0/24 — TEST-NET-2
+        [3405803776, 3405804031],
+        // 203.0.113.0/24 — TEST-NET-3
+        [3758096384, 4026531839],
+        // 224.0.0.0/4 — multicast
+        [4026531840, 4294967295]
+        // 240.0.0.0/4 — reserved (incl. 255.255.255.255)
       ];
       cachedRuntime = null;
     }
   });
 
+  // dist/esm/types.js
+  function toRequestId(id) {
+    return id;
+  }
+  function validateErrorCode(code) {
+    if (typeof code === "string") {
+      for (const valid of VALID_ERROR_CODES) {
+        if (valid === code)
+          return valid;
+      }
+    }
+    return void 0;
+  }
+  var VALID_ERROR_CODES, KinetexError, SizeLimitError, HTTPStatusError, AbortError, NetworkError, ValidationError, AuthError, ProxyError, RedirectError, TimeoutError;
+  var init_types = __esm({
+    "dist/esm/types.js"() {
+      "use strict";
+      VALID_ERROR_CODES = [
+        "ENETWORK",
+        "ETIMEOUT",
+        "EABORT",
+        "EHTTPSTATUS",
+        "ESIZELIMIT",
+        "EPARSE",
+        "EVALIDATION",
+        "EAUTH",
+        "EPROXY",
+        "EREDIRECT",
+        "EUNKNOWN"
+      ];
+      KinetexError = class extends Error {
+        /**
+         * @param message - Human-readable error description.
+         * @param code - Machine-readable error code.
+         * @param options - Additional context (request, response, cause).
+         */
+        constructor(message, code, options) {
+          super(message);
+          /** Machine-readable error code. */
+          __publicField(this, "code");
+          /** Original request, if available. */
+          __publicField(this, "request");
+          /** Response, if available (for HTTP-level errors). */
+          __publicField(this, "response");
+          /** Underlying cause. */
+          __publicField(this, "cause");
+          this.name = "KinetexError";
+          this.code = code;
+          if (options?.request !== void 0)
+            this.request = options.request;
+          if (options?.response !== void 0)
+            this.response = options.response;
+          if (options?.cause !== void 0)
+            this.cause = options.cause;
+        }
+        /** True if the error is a network/transport failure (not proxy-related). */
+        get isNetwork() {
+          return this.code === "ENETWORK";
+        }
+        /** True if the error is a proxy-related failure. */
+        get isProxy() {
+          return this.code === "EPROXY";
+        }
+        /** True if the error is a timeout. */
+        get isTimeout() {
+          return this.code === "ETIMEOUT";
+        }
+        /** True if the request was aborted by the caller. */
+        get isAbort() {
+          return this.code === "EABORT";
+        }
+        /** True if the server returned a 4xx or 5xx status. */
+        get isHTTPError() {
+          return this.code === "EHTTPSTATUS";
+        }
+        /** HTTP status code shorthand (null for non-HTTP errors). */
+        get status() {
+          return this.response?.status ?? null;
+        }
+      };
+      SizeLimitError = class extends KinetexError {
+        constructor(bytesRead, limit, request) {
+          super(`Response size limit exceeded: ${bytesRead} bytes read, limit is ${limit} bytes`, "ESIZELIMIT", request !== void 0 ? { request } : {});
+          __publicField(this, "bytesRead");
+          __publicField(this, "limit");
+          this.bytesRead = bytesRead;
+          this.limit = limit;
+          this.name = "SizeLimitError";
+        }
+      };
+      HTTPStatusError = class extends KinetexError {
+        constructor(response, request) {
+          super(`HTTP ${response.status} ${response.statusText} \u2014 ${response.url}`, "EHTTPSTATUS", {
+            request,
+            response
+          });
+          this.name = "HTTPStatusError";
+        }
+        /** True if the status is a 4xx client error. */
+        get isClientError() {
+          return (this.status ?? 0) >= 400 && (this.status ?? 0) < 500;
+        }
+        /** True if the status is a 5xx server error. */
+        get isServerError() {
+          return (this.status ?? 0) >= 500;
+        }
+      };
+      AbortError = class extends KinetexError {
+        constructor(request) {
+          super("Request was aborted", "EABORT", request !== void 0 ? { request } : {});
+          this.name = "AbortError";
+        }
+      };
+      NetworkError = class extends KinetexError {
+        constructor(message, request) {
+          super(message, "ENETWORK", request !== void 0 ? { request } : {});
+          this.name = "NetworkError";
+        }
+      };
+      ValidationError = class extends KinetexError {
+        constructor(message, request) {
+          super(message, "EVALIDATION", request !== void 0 ? { request } : {});
+          this.name = "ValidationError";
+        }
+      };
+      AuthError = class extends KinetexError {
+        constructor(message, request) {
+          super(message, "EAUTH", request !== void 0 ? { request } : {});
+          this.name = "AuthError";
+        }
+      };
+      ProxyError = class extends KinetexError {
+        constructor(message, request) {
+          super(message, "EPROXY", request !== void 0 ? { request } : {});
+          this.name = "ProxyError";
+        }
+      };
+      RedirectError = class extends KinetexError {
+        constructor(message, request) {
+          super(message, "EREDIRECT", request !== void 0 ? { request } : {});
+          this.name = "RedirectError";
+        }
+      };
+      TimeoutError = class extends KinetexError {
+        constructor(timeoutMs, request) {
+          super(`Request timed out after ${timeoutMs}ms`, "ETIMEOUT", request !== void 0 ? { request } : {});
+          __publicField(this, "timeoutMs");
+          this.timeoutMs = timeoutMs;
+          this.name = "TimeoutError";
+        }
+      };
+    }
+  });
+
   // dist/esm/cache.js
   var cache_exports = {};
   __export(cache_exports, {
@@ -3706,7 +3834,7 @@ var kinetex = (() => {
     const charset = options.charset ?? parseContentType2(ct ?? "")?.charset ?? null;
     const text = decodeBody(bytes, charset, url);
     try {
-      return JSON.parse(text);
+      return sanitizeParsedJSON(JSON.parse(text));
     } catch (err) {
       throw new ResponseDecodeError(`JSON parse failed: ${err}`, "json", url);
     }
@@ -3761,7 +3889,7 @@ var kinetex = (() => {
           const trimmed = buffer.trim();
           if (trimmed) {
             try {
-              yield JSON.parse(trimmed);
+              yield sanitizeParsedJSON(JSON.parse(trimmed));
             } catch (err) {
               options.onParseError?.(err, trimmed);
             }
@@ -3776,7 +3904,7 @@ var kinetex = (() => {
           if (!trimmed || trimmed.startsWith("#"))
             continue;
           try {
-            yield JSON.parse(trimmed);
+            yield sanitizeParsedJSON(JSON.parse(trimmed));
           } catch (err) {
             options.onParseError?.(err, trimmed);
           }
@@ -3809,7 +3937,7 @@ var kinetex = (() => {
           const remaining = flushBuffer();
           if (remaining) {
             try {
-              const obj = JSON.parse(remaining);
+              const obj = sanitizeParsedJSON(JSON.parse(remaining));
               options.onObject?.(obj);
               yield obj;
             } catch (err) {
@@ -3830,7 +3958,7 @@ var kinetex = (() => {
             if (depth === 0 && startIdx !== -1) {
               const objStr = buffer.slice(startIdx, i + 1);
               try {
-                const obj = JSON.parse(objStr);
+                const obj = sanitizeParsedJSON(JSON.parse(objStr));
                 options.onObject?.(obj);
                 yield obj;
               } catch (err) {
@@ -4374,7 +4502,7 @@ var kinetex = (() => {
     }
   }
   function createTransport(fetchFn, preferHTTP2 = true, sessionOptions, transportOptions) {
-    if (IS_NODE && preferHTTP2) {
+    if (IS_NODE && preferHTTP2 && !fetchFn) {
       return new NodeHTTP2Transport({
         ...sessionOptions?.sessionTTLMs !== void 0 ? { sessionTTLMs: sessionOptions.sessionTTLMs } : {},
         ...sessionOptions?.pingIntervalMs !== void 0 ? { pingIntervalMs: sessionOptions.pingIntervalMs } : {},
@@ -4399,8 +4527,11 @@ var kinetex = (() => {
     }, timeoutMs);
     const signal = mergeSignals(request.signal, controller.signal) ?? null;
     const req = { ...request, signal };
+    const timeoutPromise = new Promise((_, reject) => {
+      controller.signal.addEventListener("abort", () => reject(new TimeoutError(timeoutMs, request)), { once: true });
+    });
     try {
-      const result = await transport.send(req);
+      const result = await Promise.race([transport.send(req), timeoutPromise]);
       clearTimeout(timer);
       if (controller.signal.aborted) {
         throw new TimeoutError(timeoutMs, request);
@@ -4408,7 +4539,7 @@ var kinetex = (() => {
       return result;
     } catch (err) {
       clearTimeout(timer);
-      if (controller.signal.aborted) {
+      if (controller.signal.aborted && !(err instanceof TimeoutError)) {
         throw new TimeoutError(timeoutMs, request);
       }
       throw err;
@@ -4969,12 +5100,15 @@ var kinetex = (() => {
                   }
                 }
                 if (hasForbidden) {
+                  if (this._strict) {
+                    throw new KinetexError(`Strict mode: header "${hName}" contains forbidden control characters`, "EVALIDATION", { request: currentReq });
+                  }
                   if (this._onDroppedHeader) {
                     this._onDroppedHeader(hName, hStr);
-                    delete h2ReqHeaders[hName];
-                  } else {
-                    throw new KinetexError(`Strict mode: header "${hName}" contains forbidden control characters`, "EVALIDATION", { request: currentReq });
+                  } else if (typeof console !== "undefined") {
+                    console.warn(`[kinetex] Invalid header dropped (HTTP/2): "${hName}" \u2014 value contains illegal control characters. Pass strictHeaders: true to throw instead.`);
                   }
+                  delete h2ReqHeaders[hName];
                 }
               }
             }
@@ -7325,6 +7459,10 @@ var kinetex = (() => {
                   continue;
                 if (!sameSiteAllows(cookie.sameSite, context))
                   continue;
+                if (cookie.name.startsWith("__Secure-") && !(cookie.secure && isSecure))
+                  continue;
+                if (cookie.name.startsWith("__Host-") && !(cookie.secure && isSecure && cookie.path === "/" && cookie.hostOnly))
+                  continue;
                 result.push(cookie);
               }
             }
@@ -7797,9 +7935,11 @@ var kinetex = (() => {
     const [head, ...rest] = path;
     if (head === void 0)
       return;
+    if (head === "__proto__" || head === "constructor" || head === "prototype")
+      return;
     const o = obj;
     if (rest.length === 0) {
-      if (head in o)
+      if (Object.prototype.hasOwnProperty.call(o, head))
         o[head] = "***";
       return;
     }
@@ -7882,6 +8022,7 @@ var kinetex = (() => {
   var init_logging = __esm({
     "dist/esm/logging.js"() {
       "use strict";
+      init_utils();
       getNodeEnv = () => {
         try {
           return globalThis.process?.env?.["NODE_ENV"];
@@ -8241,7 +8382,7 @@ var kinetex = (() => {
           const size = str.length;
           if (ct.includes("application/json") && this.bodyFields.length > 0) {
             try {
-              const parsed = JSON.parse(str);
+              const parsed = sanitizeParsedJSON(JSON.parse(str));
               for (const path of this.bodyFields)
                 redactObjectPath(parsed, path.split("."));
               str = JSON.stringify(parsed);
@@ -8512,7 +8653,7 @@ var kinetex = (() => {
       if (!evt.data && evt.data !== "")
         continue;
       try {
-        const data = JSON.parse(evt.data, options.reviver);
+        const data = sanitizeParsedJSON(JSON.parse(evt.data, options.reviver));
         yield { event: evt.event, data, id: evt.id };
       } catch (err) {
         options.onError?.(err, evt);
@@ -8552,6 +8693,7 @@ var kinetex = (() => {
   var init_sse = __esm({
     "dist/esm/sse.js"() {
       "use strict";
+      init_utils();
       SSEParser = class {
         constructor() {
           __publicField(this, "lines", []);
@@ -8991,7 +9133,7 @@ var kinetex = (() => {
         onJSON(eventType, handler) {
           return this.on(eventType, async (data, evt) => {
             try {
-              const parsed = JSON.parse(data);
+              const parsed = sanitizeParsedJSON(JSON.parse(data));
               await handler(parsed, evt);
             } catch {
             }
@@ -9315,11 +9457,18 @@ var kinetex = (() => {
     let current = obj;
     for (let i = 0; i < parts.length - 1; i++) {
       const key = parts[i];
+      if (key === "__proto__" || key === "constructor" || key === "prototype") {
+        throw new ValidationError(`Invalid upload path: "${path}" \u2014 reserved key "${key}"`);
+      }
       if (!current[key] || typeof current[key] !== "object")
         current[key] = {};
       current = current[key];
     }
-    current[parts[parts.length - 1]] = value;
+    const leaf = parts[parts.length - 1];
+    if (leaf === "__proto__" || leaf === "constructor" || leaf === "prototype") {
+      throw new ValidationError(`Invalid upload path: "${path}" \u2014 reserved key "${leaf}"`);
+    }
+    current[leaf] = value;
   }
   async function parseGraphQLResponse(response, req) {
     const ct = response.headers.get("content-type") ?? "";
@@ -9330,7 +9479,7 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
     }
     let json;
     try {
-      json = await response.json();
+      json = sanitizeParsedJSON(await response.json());
     } catch (err) {
       throw new GraphQLClientError("Failed to parse GraphQL response as JSON", "EPARSE", void 0, req, void 0, err);
     }
@@ -9477,6 +9626,7 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
     "dist/esm/graphql.js"() {
       "use strict";
       init_types();
+      init_utils();
       GraphQLClientError = class extends Error {
         /**
          * @param message       - Human-readable error description
@@ -9798,7 +9948,7 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
           } catch (err) {
             throw new GraphQLClientError(err instanceof Error ? err.message : "Batch network error", "ENETWORK", void 0, requests[0], void 0, err);
           }
-          const rawResults = await response.json();
+          const rawResults = sanitizeParsedJSON(await response.json());
           if (!Array.isArray(rawResults)) {
             throw new GraphQLClientError("Batch response must be an array of GraphQL responses", "EINVALIDRESPONSE", void 0, requests[0], rawResults);
           }
@@ -9886,7 +10036,7 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
               continue;
             let gqlRes;
             try {
-              gqlRes = JSON.parse(event.data);
+              gqlRes = sanitizeParsedJSON(JSON.parse(event.data));
             } catch {
               continue;
             }
@@ -10413,7 +10563,7 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
   }
   function deserializePaginationState(serialized) {
     try {
-      return JSON.parse(atob(serialized));
+      return sanitizeParsedJSON(JSON.parse(atob(serialized)));
     } catch {
       throw new Error("Invalid pagination state string");
     }
@@ -10460,6 +10610,7 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
   var init_pagination = __esm({
     "dist/esm/pagination.js"() {
       "use strict";
+      init_utils();
     }
   });
 
@@ -10768,6 +10919,7 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
     retryLink: () => retryLink,
     safeJSONParse: () => safeJSONParse,
     safeParseURL: () => safeParseURL,
+    sanitizeParsedJSON: () => sanitizeParsedJSON,
     sanitizeURL: () => sanitizeURL,
     securityHeaders: () => securityHeaders,
     sendWithTimeout: () => sendWithTimeout,
@@ -11782,6 +11934,7 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
   }
 
   // dist/esm/ws.js
+  init_utils();
   var WSError = class extends Error {
     /**
      * @param message - Human-readable error description
@@ -12452,7 +12605,7 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
             data = evt.data;
             bytes = new TextEncoder().encode(data).byteLength;
             try {
-              json = JSON.parse(data);
+              json = sanitizeParsedJSON(JSON.parse(data));
             } catch {
             }
           } else if (evt.data instanceof ArrayBuffer) {
@@ -14868,6 +15021,34 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
   function randomHex(len) {
     return randomBytes(len / 2);
   }
+  var HAR_REDACT_HEADERS = /* @__PURE__ */ new Set([
+    "authorization",
+    "proxy-authorization",
+    "cookie",
+    "set-cookie",
+    "x-api-key",
+    "x-auth-token",
+    "x-access-token",
+    "x-refresh-token",
+    "x-csrf-token",
+    "x-session-id",
+    "x-session-token",
+    "x-secret",
+    "x-secret-key",
+    "x-private-key",
+    "api-key",
+    "apikey",
+    "bearer",
+    "token",
+    "authentication",
+    "credentials",
+    "password",
+    "passwd",
+    "secret"
+  ]);
+  function redactHARHeader(name, value) {
+    return HAR_REDACT_HEADERS.has(name.toLowerCase()) ? { name, value: "***REDACTED***" } : { name, value };
+  }
   var HARRecorder = class {
     /**
      * @param maxEntries - Maximum number of entries before eviction (default 10000).
@@ -14919,7 +15100,7 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
           method: req.method,
           url: req.url,
           httpVersion: res.httpVersion,
-          headers: Object.entries(req.headers).map(([name, value]) => ({ name, value })),
+          headers: Object.entries(req.headers).map(([name, value]) => redactHARHeader(name, value)),
           queryString: (() => {
             try {
               return Array.from(new URL(req.url).searchParams.entries()).map(([name, value]) => ({
@@ -14946,7 +15127,7 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
           status: res.status,
           statusText: res.statusText,
           httpVersion: res.httpVersion,
-          headers: Object.entries(res.headers).map(([name, value]) => ({ name, value })),
+          headers: Object.entries(res.headers).map(([name, value]) => redactHARHeader(name, value)),
           content: {
             size: res.rawBody?.byteLength ?? 0,
             mimeType: res.headers["content-type"] ?? "application/octet-stream",
@@ -14994,7 +15175,11 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
     switch (auth.type) {
       case "bearer": {
         const token = typeof auth.token === "function" ? await auth.token() : auth.token;
-        headers["authorization"] = `Bearer ${token}`;
+        const headerValue = `Bearer ${token}`;
+        if (!isValidHeaderValue(headerValue)) {
+          throw new KinetexError("Invalid bearer token \u2014 contains forbidden characters (CRLF/CTL)", "EVALIDATION");
+        }
+        headers["authorization"] = headerValue;
         break;
       }
       case "basic": {
@@ -15015,7 +15200,13 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
       }
       case "apikey": {
         const key = typeof auth.key === "function" ? await auth.key() : auth.key;
-        headers[auth.header.toLowerCase()] = key;
+        if (!isValidHeaderName(auth.header)) {
+          throw new KinetexError(`Invalid apikey auth header name: "${auth.header}"`, "EVALIDATION");
+        }
+        if (!isValidHeaderValue(String(key))) {
+          throw new KinetexError(`Invalid apikey value for "${auth.header}" \u2014 contains forbidden characters`, "EVALIDATION");
+        }
+        headers[auth.header.toLowerCase()] = String(key);
         break;
       }
       case "digest": {
@@ -15034,6 +15225,37 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
     }
     return { ...req, headers };
   }
+  var CROSS_ORIGIN_STRIP_HEADERS = /* @__PURE__ */ new Set([
+    "authorization",
+    "cookie",
+    "proxy-authorization",
+    "x-api-key",
+    "x-auth-token",
+    "x-access-token",
+    "x-refresh-token",
+    "x-csrf-token",
+    "x-session-id",
+    "x-session-token",
+    "x-secret",
+    "x-secret-key",
+    "x-private-key",
+    "api-key",
+    "apikey",
+    "www-authenticate"
+  ]);
+  function redactUserInfo(url) {
+    try {
+      const u = new URL(url);
+      if (u.username || u.password) {
+        u.username = "";
+        u.password = "";
+        return u.toString();
+      }
+      return url;
+    } catch {
+      return url.replace(/\/\/[^/@]*@/, "//");
+    }
+  }
   function buildURL(base, url, params) {
     const MAX_QUERY_PARAM_COUNT = 100;
     const MAX_URL_LENGTH = 8192;
@@ -15054,7 +15276,7 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
     }
     if (!params || Object.keys(params).length === 0) {
       if (!isSafeURL(full)) {
-        throw new KinetexError(`URL "${full}" failed safety check \u2014 blocked private/loopback address or forbidden scheme`, "EVALIDATION");
+        throw new KinetexError(`URL "${redactUserInfo(full)}" failed safety check \u2014 blocked private/loopback address or forbidden scheme`, "EVALIDATION");
       }
       return full;
     }
@@ -15088,7 +15310,7 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
         throw new KinetexError(`URL length ${result.length} bytes exceeds limit of ${MAX_URL_LENGTH} bytes`, "EVALIDATION");
       }
       if (!isSafeURL(result)) {
-        throw new KinetexError(`URL "${result}" failed safety check \u2014 blocked private/loopback address or forbidden scheme`, "EVALIDATION");
+        throw new KinetexError(`URL "${redactUserInfo(result)}" failed safety check \u2014 blocked private/loopback address or forbidden scheme`, "EVALIDATION");
       }
       return result;
     } catch (err) {
@@ -15126,6 +15348,9 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
       if (result.length > MAX_URL_LENGTH) {
         throw new KinetexError(`URL length ${result.length} bytes exceeds limit of ${MAX_URL_LENGTH} bytes`, "EVALIDATION");
       }
+      if (!isSafeURL(result)) {
+        throw new KinetexError(`URL "${redactUserInfo(result)}" failed safety check \u2014 blocked private/loopback address or forbidden scheme`, "EVALIDATION");
+      }
       return result;
     }
   }
@@ -15873,6 +16098,10 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
         throw new KinetexError(`Invalid HTTP method '${method}'. Valid methods: ${VALID_METHODS.join(", ")}`, "EVALIDATION");
       }
       const fullUrl = buildURL(options.baseURL ?? this.cfg.baseURL, url, mergeParams(this.cfg.params, options.params));
+      const proxy = options.proxy ?? this.cfg.proxy;
+      if (proxy) {
+        throw new KinetexError("proxy is configured but kinetex's built-in transports cannot route through it: HTTP(S) proxies require a custom fetch with a proxy agent (e.g. undici ProxyAgent passed via the `fetch` option), and SOCKS5 requires createSocks5Tunnel() from kinetex/socks5. Set up one of those instead of relying on `proxy` silently doing nothing.", "EVALIDATION");
+      }
       if (this.cfg.httpsOnly) {
         try {
           const parsedUrl = new URL(fullUrl);
@@ -15896,9 +16125,25 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
           bodySize2 = options.body.byteLength;
         } else if (options.body instanceof Blob) {
           bodySize2 = options.body.size;
+        } else if (ArrayBuffer.isView(options.body)) {
+          bodySize2 = options.body.byteLength;
+        } else if (options.body instanceof URLSearchParams) {
+          bodySize2 = new TextEncoder().encode(options.body.toString()).byteLength;
         } else if (options.body instanceof FormData) {
+          const boundaryOverhead = 76;
+          for (const [name, value] of options.body) {
+            bodySize2 += new TextEncoder().encode(name).byteLength + boundaryOverhead;
+            if (typeof value === "string") {
+              bodySize2 += new TextEncoder().encode(value).byteLength;
+            } else {
+              bodySize2 += value.size;
+            }
+          }
+          bodySize2 += boundaryOverhead;
+        } else if (options.body instanceof ReadableStream) {
+          throw new KinetexError(`maxRequestSize cannot be enforced for ReadableStream bodies \u2014 pass maxRequestSize: 0 to opt out, or buffer the body first`, "EVALIDATION");
         } else if (options.body && typeof options.body === "object") {
-          bodySize2 = JSON.stringify(options.body).length;
+          bodySize2 = new TextEncoder().encode(JSON.stringify(options.body)).byteLength;
         }
         if (bodySize2 > maxRequestSize) {
           throw new KinetexError(`Request body size ${bodySize2} bytes exceeds limit of ${maxRequestSize} bytes`, "EVALIDATION");
@@ -16078,10 +16323,26 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
     async _sendFollowingRedirects(req, timeout, jar, appliedAuth) {
       const MAX_REDIRECTS = 20;
       let currentReq = { ...req, redirect: "manual" };
+      const origin0 = (() => {
+        try {
+          return new URL(req.url).origin;
+        } catch {
+          return null;
+        }
+      })();
       const visited = /* @__PURE__ */ new Set();
       for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
         if (hop > 0 && appliedAuth) {
-          currentReq = await applyAuth(currentReq, appliedAuth);
+          const sameOrigin = (() => {
+            try {
+              return new URL(currentReq.url).origin === origin0;
+            } catch {
+              return false;
+            }
+          })();
+          if (sameOrigin) {
+            currentReq = await applyAuth(currentReq, appliedAuth);
+          }
         }
         if (hop > 0 && this.cfg.hooks?.onBeforeRequest) {
           for (const fn of this.cfg.hooks.onBeforeRequest) {
@@ -16153,6 +16414,14 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
           } else {
             delete nextHeaders["cookie"];
           }
+          try {
+            if (new URL(nextUrl).origin !== new URL(currentReq.url).origin) {
+              for (const h of CROSS_ORIGIN_STRIP_HEADERS) {
+                delete nextHeaders[h];
+              }
+            }
+          } catch {
+          }
           currentReq = {
             ...currentReq,
             url: nextUrl,