kinetex 1.1.0 → 1.3.0

package/dist/cjs/cookie-parser.js

@@ -1735,10 +1735,13 @@ export function domainMatch(requestHost, cookieDomain) {
     if (isIPAddress(cd))
         return false;
     // RFC 6265 §5.3: cookie domain must not be a public suffix
-    // e.g., "com" or "co.uk" should not be allowed as cookie domain
-    const psl = getPublicSuffix(rh);
-    if (psl === rh)
-        return false; // requestHost is a public suffix
+    // The COOKIE DOMAIN must not be a public suffix: "com" or "co.uk" must
+    // never be accepted as a cookie domain. This check used to test the request
+    // host instead, so it could never fire and a Domain=com cookie was reported
+    // as matching every .com host. (HTTPCookieJar.setCookie guards it separately
+    // with isPublicSuffix(cd); this exported helper must be correct on its own.)
+    if (isPublicSuffix(cd))
+        return false;
     return true;
 }
 // ============================================================================

package/dist/cjs/cookie-store.js

@@ -180,7 +180,11 @@ export class CookieJar {
         let cookieDomain;
         let hostOnly;
         if (parsed.domain !== null && parsed.domain !== "") {
-            const cd = parsed.domain;
+            // Normalize the case: the Domain attribute is case-insensitive, but the
+            // value was stored verbatim while every lookup compares against a
+            // lower-cased request host. `Domain=Example.COM` therefore stored a cookie
+            // that could never be matched again — silently lost for the jar's lifetime.
+            const cd = parsed.domain.toLowerCase();
             // Must domain-match the request host (use custom matcher if provided)
             const matcher = this.domainMatcherFn ?? domainMatch;
             if (!matcher(reqHost, cd))
@@ -269,10 +273,9 @@ export class CookieJar {
      * @returns Array of matching Cookie objects (direct references into storage)
      */
     getCookies(options) {
-        // Lazy cleanup: 1% chance to clear expired cookies on each access
-        if (Math.random() < 0.01) {
-            this.clearExpired();
-        }
+        // Expired cookies are removed by the periodic cleanup timer (and by
+        // clearExpired()); the old 1%-per-access coin flip walked the whole store
+        // at random and made eviction timing non-deterministic.
         const url = safeParseUrl(options.url);
         if (!url)
             return [];
@@ -747,11 +750,16 @@ export class CookieJar {
         // For domain cookies: domain-match (subdomains allowed).
         // We can't know per-domain whether it's host-only without checking cookies,
         // so we do the broader domain-match here and filter host-only per cookie.
-        if (reqHost === cookieDomain)
+        // Lower-case both sides: cookie domains are stored from the (already
+        // normalized) Domain attribute, but a caller can also insert cookies
+        // directly via putCookie() with mixed-case input.
+        const host = reqHost.toLowerCase();
+        const domain = cookieDomain.toLowerCase();
+        if (host === domain)
             return true;
-        if (isIPAddress(reqHost))
+        if (isIPAddress(host))
             return false;
-        return reqHost.endsWith("." + cookieDomain);
+        return host.endsWith("." + domain);
     }
 }
 // ============================================================================

package/dist/cjs/core.js

@@ -103,6 +103,12 @@ function isProductionEnvironment() {
         return false;
     }
 }
+/**
+ * The accept-encoding value client.ts injects when the caller did not set
+ * one. FetchTransport removes exactly this string so fetch() negotiates its
+ * own encodings; any other value is treated as caller intent.
+ */
+export const DEFAULT_ACCEPT_ENCODING = "gzip, deflate, br";
 /**
  * Universal fetch-based transport.
  * Suitable for all runtimes where `fetch` is available.
@@ -160,10 +166,12 @@ export class FetchTransport {
             }
             sanitizedHeaders[name] = value;
         }
-        // Strip default accept-encoding injected by client.ts so fetch()
-        // can add its own. Preserve caller-explicit values (e.g. "identity").
+        // Strip the accept-encoding value INJECTED by client.ts so fetch() can add
+        // its own. The old check removed ANY value containing gzip+deflate+br,
+        // including one the caller set deliberately; matching the exact injected
+        // default keeps caller intent intact.
         const ae = sanitizedHeaders["accept-encoding"];
-        if (ae && ae.toLowerCase().includes("gzip") && ae.toLowerCase().includes("deflate") && ae.toLowerCase().includes("br")) {
+        if (ae && ae.toLowerCase().replace(/\s+/g, " ") === DEFAULT_ACCEPT_ENCODING) {
             delete sanitizedHeaders["accept-encoding"];
         }
         // Build fetch init
@@ -248,6 +256,8 @@ export class NodeHTTP2Transport {
     sessionUsage = new Map();
     _strict;
     _onDroppedHeader;
+    /** Optional CA bundle for origins with self-signed / private-PKI certificates. */
+    _ca;
     /** FIX 11: Configurable connect timeout (replaces hardcoded 30 000 ms) */
     _connectTimeoutMs;
     /** FIX 11: Configurable per-request stream timeout (replaces hardcoded 30 000 ms) */
@@ -263,6 +273,7 @@ export class NodeHTTP2Transport {
         this.maxSessions = options.maxSessions ?? 100;
         this._strict = options.strict ?? false;
         this._onDroppedHeader = options.onDroppedHeader;
+        this._ca = options.ca;
         this._connectTimeoutMs = options.connectTimeoutMs ?? 30_000;
         this._requestTimeoutMs = options.requestTimeoutMs ?? 30_000;
     }
@@ -323,7 +334,10 @@ export class NodeHTTP2Transport {
             }
         }
         const session = await new Promise((resolve, reject) => {
-            const s = http2.connect(origin, { rejectUnauthorized: true });
+            const s = http2.connect(origin, {
+                rejectUnauthorized: true,
+                ...(this._ca !== undefined ? { ca: this._ca } : {}),
+            });
             // FIX 11: use configurable connect timeout instead of hardcoded 30 000 ms
             // FIX 9: unref() the timer so it does not prevent process exit
             const connectTimeout = setTimeout(() => {
@@ -451,35 +465,38 @@ export class NodeHTTP2Transport {
                 ":authority": currentUrl.host,
                 ...currentReq.headers,
             };
-            // Strict-mode header validation (HTTP/2 control-character check)
-            if (this._strict) {
-                for (const [hName, hValue] of Object.entries(h2ReqHeaders)) {
-                    if (hName.startsWith(":"))
-                        continue;
-                    const hStr = Array.isArray(hValue) ? hValue.join(", ") : String(hValue);
-                    let hasForbidden = false;
-                    for (let ci = 0; ci < hStr.length; ci++) {
-                        const code = hStr.charCodeAt(ci);
-                        if ((code >= 0x00 && code <= 0x08) || (code >= 0x0a && code <= 0x1f) || code === 0x7f) {
-                            hasForbidden = true;
-                            break;
-                        }
+            // Header validation (HTTP/2 control-character check). Runs in BOTH modes:
+            // strict throws, non-strict drops with callback/warn — matching the
+            // FetchTransport contract. (Previously the whole loop was gated on
+            // strict mode, so non-strict requests never validated and a header with
+            // forbidden control characters crashed session.request() with a raw
+            // ERR_INVALID_HEADER_VALUE instead of being dropped.)
+            for (const [hName, hValue] of Object.entries(h2ReqHeaders)) {
+                if (hName.startsWith(":"))
+                    continue;
+                const hStr = Array.isArray(hValue) ? hValue.join(", ") : String(hValue);
+                let hasForbidden = false;
+                for (let ci = 0; ci < hStr.length; ci++) {
+                    const code = hStr.charCodeAt(ci);
+                    if ((code >= 0x00 && code <= 0x08) || (code >= 0x0a && code <= 0x1f) || code === 0x7f) {
+                        hasForbidden = true;
+                        break;
                     }
-                    if (hasForbidden) {
-                        if (this._strict) {
-                            throw new KinetexError(`Strict mode: header "${hName}" contains forbidden control characters`, "EVALIDATION", { request: currentReq });
-                        }
-                        // FIX (H3): non-strict mode must match FetchTransport behavior —
-                        // notify the callback (if any) and warn, never drop silently.
-                        if (this._onDroppedHeader) {
-                            this._onDroppedHeader(hName, hStr);
-                        }
-                        else if (typeof console !== "undefined") {
-                            console.warn(`[kinetex] Invalid header dropped (HTTP/2): "${hName}" — value contains illegal control characters. ` +
-                                `Pass strictHeaders: true to throw instead.`);
-                        }
-                        delete h2ReqHeaders[hName];
+                }
+                if (hasForbidden) {
+                    if (this._strict) {
+                        throw new KinetexError(`Strict mode: header "${hName}" contains forbidden control characters`, "EVALIDATION", { request: currentReq });
+                    }
+                    // FIX (H3): non-strict mode must match FetchTransport behavior —
+                    // notify the callback (if any) and warn, never drop silently.
+                    if (this._onDroppedHeader) {
+                        this._onDroppedHeader(hName, hStr);
                     }
+                    else if (typeof console !== "undefined") {
+                        console.warn(`[kinetex] Invalid header dropped (HTTP/2): "${hName}" — value contains illegal control characters. ` +
+                            `Pass strictHeaders: true to throw instead.`);
+                    }
+                    delete h2ReqHeaders[hName];
                 }
             }
             const endStream = !currentReq.body || currentReq.method === "GET" || currentReq.method === "HEAD";
@@ -726,6 +743,13 @@ export function createTransport(fetchFn, preferHTTP2 = true, sessionOptions, tra
     // "Custom fetch implementation" behavior holds on every runtime.
     // Use NodeHTTP2Transport for Node.js when HTTP/2 is preferred and no custom
     // fetch is given. Falls back to FetchTransport otherwise.
+    if (IS_NODE && preferHTTP2 && fetchFn) {
+        if (!isProductionEnvironment()) {
+            console.warn('[kinetex] httpVersion: "HTTP/2" is ignored when a custom `fetch` is configured — ' +
+                "NodeHTTP2Transport cannot use a custom fetch, so the request goes through " +
+                "FetchTransport (HTTP/1.1 semantics). Drop the `fetch` option to use HTTP/2.");
+        }
+    }
     if (IS_NODE && preferHTTP2 && !fetchFn) {
         return new NodeHTTP2Transport({
             ...(sessionOptions?.sessionTTLMs !== undefined
@@ -1102,7 +1126,7 @@ async function writeChunkWithBackpressure(stream, chunk) {
 }
 /**
  * Write a request body to an HTTP/2 stream, respecting backpressure.
- * Handles ReadableStream, Uint8Array, ArrayBuffer, and string body types.
+ * Handles ReadableStream, Uint8Array, ArrayBuffer, string, URLSearchParams and Blob bodies.
  *
  * @param stream - HTTP/2 stream to write to
  * @param body   - Request body
@@ -1127,12 +1151,16 @@ async function attachBodyToH2Stream(stream, body) {
         stream.end(body);
     }
     else {
-        stream.end();
+        // The raw Node transports bypass fetch, so bodies fetch would normally
+        // serialize (URLSearchParams, Blob) must be encoded here. Skipping them
+        // silently sent an empty body to the server.
+        const bytes = await serializeRawBody(body);
+        stream.end(bytes);
     }
 }
 /**
  * Write a request body to a Node.js http.ClientRequest, respecting backpressure.
- * Handles ReadableStream, Uint8Array, ArrayBuffer, and string body types.
+ * Handles ReadableStream, Uint8Array, ArrayBuffer, string, URLSearchParams and Blob bodies.
  *
  * @param req  - Node.js ClientRequest
  * @param body - Request body
@@ -1157,8 +1185,28 @@ async function pipeBodyToNodeReq(req, body) {
         req.end(body);
     }
     else {
-        req.end();
+        // The raw Node transports bypass fetch, so bodies fetch would normally
+        // serialize (URLSearchParams, Blob) must be encoded here. Skipping them
+        // silently sent an empty body to the server.
+        const bytes = await serializeRawBody(body);
+        req.end(bytes);
+    }
+}
+/**
+ * Serialize body types that `fetch` would normally encode for us, so the raw
+ * Node HTTP/1.1 and HTTP/2 transports do not silently send an empty payload.
+ *
+ * @param body - Request body that is not a stream, byte array, or string
+ * @returns The encoded bytes to write (empty for unsupported types)
+ */
+async function serializeRawBody(body) {
+    if (typeof URLSearchParams !== "undefined" && body instanceof URLSearchParams) {
+        return new TextEncoder().encode(body.toString());
+    }
+    if (typeof Blob !== "undefined" && body instanceof Blob) {
+        return new Uint8Array(await body.arrayBuffer());
     }
+    return new Uint8Array(0);
 }
 // ============================================================================
 // §10  DECOMPRESSION

package/dist/cjs/dedup.js

@@ -136,6 +136,15 @@ export class DedupMap {
                 this.inflight.delete(key);
             }
             else {
+                // Clear any previous timer for this key first. Registering a new
+                // window without clearing the old one let the stale timer fire later
+                // and `inflight.delete(key)` — wiping the *new*, still-in-flight entry
+                // out from under callers that were sharing it.
+                const stale = this.timeouts.get(key);
+                if (stale !== undefined) {
+                    clearTimeout(stale);
+                    this.timeouts.delete(key);
+                }
                 const timeoutId = setTimeout(() => {
                     this.inflight.delete(key);
                     this.timeouts.delete(key);
@@ -177,13 +186,6 @@ export class DedupMap {
     get keys() {
         return [...this.inflight.keys()];
     }
-    /**
-     * Get comprehensive deduplication statistics.
-     * NOTE: inFlightCount and trackedKeys reflect snapshot time; entries may
-     * resolve asynchronously between sampling and return (non-blocking, acceptable).
-     *
-     * @returns Snapshot of hits, misses, hit rate, and tracked entries
-     */
     /**
      * Get comprehensive deduplication statistics.
      *

package/dist/cjs/digest.js

@@ -550,3 +550,29 @@ export async function createDigestAuthorization(wwwAuth, username, password, met
     const response = await computeDigestResponse(challenge, username, password, method, uri, cnonce, nc);
     return formatDigestAuth(challenge, username, response, uri, cnonce, nc);
 }
+/**
+ * Stateful Digest-auth authorizer.
+ *
+ * Keeps a per-nonce request counter and increments it on every call, as
+ * RFC 7616 §3.4.1 requires: `nc` is the hex request count for the current
+ * nonce and MUST increase for each request. The stateless
+ * {@link createDigestAuthorization} always sends 00000001, which replay-
+ * protecting servers (nginx, Apache with `AuthDigestNonceLifetime`) reject on
+ * the second request. A new nonce (challenge change) resets the counter to 1.
+ *
+ * Not safe to share across clients that authenticate as different users —
+ * create one per client.
+ */
+export function createDigestAuthorizer() {
+    const counters = new Map();
+    return async (wwwAuth, username, password, method, uri) => {
+        const challenge = parseDigestChallenge(wwwAuth);
+        const cnonce = randomBytes(5);
+        const scope = `${challenge.realm}\u0000${challenge.nonce}`;
+        const next = (counters.get(scope) ?? 0) + 1;
+        counters.set(scope, next);
+        const nc = next.toString(16).padStart(8, "0");
+        const response = await computeDigestResponse(challenge, username, password, method, uri, cnonce, nc);
+        return formatDigestAuth(challenge, username, response, uri, cnonce, nc);
+    };
+}

package/dist/cjs/graphql.js

@@ -383,8 +383,10 @@ async function executeHTTP(req, config, signal, apqMode = "none", getAPQHashFn)
         fetchHeaders["content-type"] = "application/json";
     const controller = new AbortController();
     const timer = config.timeoutMs > 0 ? setTimeout(() => controller.abort(), config.timeoutMs) : null;
-    // Merge external signal
-    signal?.addEventListener("abort", () => controller.abort(), { once: true });
+    // Merge external signal. The listener is removed once the fetch settles so
+    // it does not accumulate on long-lived caller-provided signals (leak fix).
+    const onExternalAbort = () => controller.abort();
+    signal?.addEventListener("abort", onExternalAbort, { once: true });
     let response;
     try {
         response = await config.fetch(fetchUrl, {
@@ -405,6 +407,7 @@ async function executeHTTP(req, config, signal, apqMode = "none", getAPQHashFn)
     finally {
         if (timer)
             clearTimeout(timer);
+        signal?.removeEventListener("abort", onExternalAbort);
     }
     return parseGraphQLResponse(response, req);
 }
@@ -634,7 +637,10 @@ export class GraphQLClient {
         delete headers["content-type"]; // FormData sets it with boundary
         const form = buildMultipartBody(req, uploads);
         const controller = new AbortController();
-        options.signal?.addEventListener("abort", () => controller.abort(), { once: true });
+        // Listener removed when the fetch settles — avoids accumulating on the
+        // caller's signal across many uploads (leak fix).
+        const onExternalAbort = () => controller.abort();
+        options.signal?.addEventListener("abort", onExternalAbort, { once: true });
         this.config.onRequest(req);
         let response;
         try {
@@ -650,6 +656,9 @@ export class GraphQLClient {
             this.config.onError(clientErr, req);
             throw clientErr;
         }
+        finally {
+            options.signal?.removeEventListener("abort", onExternalAbort);
+        }
         const gqlRes = await parseGraphQLResponse(response, req);
         this.config.onResponse(gqlRes, req);
         if (gqlRes.errors?.length) {
@@ -679,7 +688,10 @@ export class GraphQLClient {
     async batch(requests, options = {}) {
         const headers = await buildHeaders(this.config);
         const controller = new AbortController();
-        options.signal?.addEventListener("abort", () => controller.abort(), { once: true });
+        // Listener removed when the fetch settles — avoids accumulating on the
+        // caller's signal across many batches (leak fix).
+        const onExternalAbort = () => controller.abort();
+        options.signal?.addEventListener("abort", onExternalAbort, { once: true });
         let response;
         try {
             response = await this.config.fetch(this.config.url, {
@@ -692,6 +704,9 @@ export class GraphQLClient {
         catch (err) {
             throw new GraphQLClientError(err instanceof Error ? err.message : "Batch network error", "ENETWORK", undefined, requests[0], undefined, err);
         }
+        finally {
+            options.signal?.removeEventListener("abort", onExternalAbort);
+        }
         // FIX (H6): sanitize untrusted batch response JSON before validation.
         const rawResults = sanitizeParsedJSON(await response.json());
         // Validate response is array (B-5 fix)

package/dist/cjs/headers.js

@@ -897,6 +897,31 @@ export function formatContentDisposition(cd) {
  * @param value - Raw `Cache-Control` header value
  * @returns Structured directives object with boolean flags and numeric values
  */
+/**
+ * Split a `Cache-Control` value on commas, ignoring commas inside a quoted
+ * string. RFC 7234 §5.2 allows quoted-string values that contain commas, e.g.
+ * `private="field1, field2"`, so a plain `split(",")` corrupts them.
+ *
+ * @param value - Raw `Cache-Control` header value
+ * @returns Each directive as its own (untrimmed) string
+ */
+function splitCacheControlDirectives(value) {
+    const parts = [];
+    let current = "";
+    let inQuotes = false;
+    for (const ch of value) {
+        if (ch === '"')
+            inQuotes = !inQuotes;
+        if (ch === "," && !inQuotes) {
+            parts.push(current);
+            current = "";
+            continue;
+        }
+        current += ch;
+    }
+    parts.push(current);
+    return parts;
+}
 export function parseCacheControl(value) {
     const d = {
         noCache: false,
@@ -917,7 +942,7 @@ export function parseCacheControl(value) {
         staleWhileRevalidate: null,
         unknown: new Map(),
     };
-    for (const part of value.split(",")) {
+    for (const part of splitCacheControlDirectives(value)) {
         const t = part.trim();
         const eq = t.indexOf("=");
         const k = (eq === -1 ? t : t.slice(0, eq)).trim().toLowerCase();
@@ -1379,17 +1404,48 @@ export function normalizeForwardedHeaders(headers) {
     };
 }
 /**
- * Extract the real client IP from Forwarded, X-Forwarded-For, or X-Real-IP
- * headers (in priority order).
+ * Extract the client IP from Forwarded, X-Forwarded-For, or X-Real-IP.
+ *
+ * ⚠️ SECURITY: the value is derived from client-supplied headers and must NOT be
+ * used for access control, rate limiting or audit trails unless `trustedHops` is
+ * set to the real number of proxies in front of the server. The returned string
+ * is also not validated as an IP address.
  *
  * @param headers - Source headers object
- * @returns First client IP found, or `null` if none present
+ * @param options - Trust configuration
+ * @returns The selected client IP, or `null` if none present
  */
-export function getClientIP(headers) {
+export function getClientIP(headers, options = {}) {
+    const trustedHops = Math.max(0, Math.trunc(options.trustedHops ?? 0));
     const fwd = normalizeForwardedHeaders(headers);
-    if (fwd.for.length > 0)
-        return fwd.for[0];
-    return headers.get(HeaderName.XRealIP);
+    if (fwd.for.length > 0) {
+        const list = fwd.for;
+        // Right-most entry is the closest hop. trustedHops = 1 → the entry the
+        // nearest trusted proxy appended; index = length - trustedHops.
+        const index = trustedHops === 0 ? 0 : list.length - trustedHops;
+        const value = list[index] ?? list[0];
+        return stripIPPortAndBrackets(value);
+    }
+    return stripIPPortAndBrackets(headers.get(HeaderName.XRealIP) ?? "") || null;
+}
+/**
+ * Normalize a Forwarded/XFF entry to a bare host: strip `for="…"` quoting,
+ * `[ipv6]:port`, and a bare `:port` suffix.
+ */
+function stripIPPortAndBrackets(value) {
+    let v = value.trim();
+    if (v.startsWith('"') && v.endsWith('"') && v.length >= 2)
+        v = v.slice(1, -1);
+    if (v.startsWith("[")) {
+        const end = v.indexOf("]");
+        if (end !== -1)
+            return v.slice(1, end);
+    }
+    // Only strip a trailing :digits (never the colons inside an IPv6 literal).
+    const m = /^(.*):\d+$/.exec(v);
+    if (m && (m[1] ?? "").includes("."))
+        return m[1];
+    return v;
 }
 /**
  * Parse a Retry-After header which may be either delta-seconds or an