kinetex 1.1.0 → 1.3.0

package/dist/cjs/interceptors.js

@@ -27,6 +27,7 @@
  *  - Metrics interceptor   (timing, status buckets, error rates)
  *  - No dependencies, no runtime globals beyond Promise/Map/Set
  */
+import { getAuthFingerprint } from "./cache.js";
 // ============================================================================
 // §3  INTERCEPTOR MANAGER
 // ============================================================================
@@ -34,8 +35,18 @@ let _idSeq = 0;
 function nextId() {
     return `interceptor_${++_idSeq}`;
 }
-function sortByPriority(arr) {
-    return [...arr].sort((a, b) => a.priority - b.priority);
+/**
+ * Insert keeping ascending priority order. Sorting at registration (once)
+ * instead of on every request avoids copying the whole array three times per
+ * request, and Array#sort is stable so equal priorities keep registration
+ * order — the same result the old per-request sort produced.
+ */
+function insertByPriority(arr, entry) {
+    const at = arr.findIndex((x) => x.priority > entry.priority);
+    if (at === -1)
+        arr.push(entry);
+    else
+        arr.splice(at, 0, entry);
 }
 /**
  * Manages registration, ejection, and pipeline execution of interceptors.
@@ -57,7 +68,7 @@ export class InterceptorManager {
      */
     useRequest(fn, opts = {}) {
         const id = opts.id ?? nextId();
-        this.requestInterceptors.push({
+        insertByPriority(this.requestInterceptors, {
             id,
             priority: opts.priority ?? 0,
             once: opts.once ?? false,
@@ -75,7 +86,7 @@ export class InterceptorManager {
      */
     useResponse(fn, opts = {}) {
         const id = opts.id ?? nextId();
-        this.responseInterceptors.push({
+        insertByPriority(this.responseInterceptors, {
             id,
             priority: opts.priority ?? 0,
             once: opts.once ?? false,
@@ -93,7 +104,7 @@ export class InterceptorManager {
      */
     useError(fn, opts = {}) {
         const id = opts.id ?? nextId();
-        this.errorInterceptors.push({
+        insertByPriority(this.errorInterceptors, {
             id,
             priority: opts.priority ?? 0,
             once: opts.once ?? false,
@@ -178,7 +189,7 @@ export class InterceptorManager {
         // Collect IDs to eject after iteration (avoids modifying array during for-of)
         const toEject = new Set();
         // ── Request phase ──────────────────────────────────────────────────────
-        for (const interceptor of sortByPriority(this.requestInterceptors)) {
+        for (const interceptor of this.requestInterceptors) {
             if (ctx.aborted)
                 break;
             if (interceptor.condition && !interceptor.condition(ctx))
@@ -225,7 +236,7 @@ export class InterceptorManager {
     async _runResponsePhase(ctx, dispatcher) {
         // Collect IDs to eject after iteration
         const toEject = new Set();
-        for (const interceptor of sortByPriority(this.responseInterceptors)) {
+        for (const interceptor of this.responseInterceptors) {
             if (ctx.aborted)
                 break;
             if (interceptor.condition && !interceptor.condition(ctx))
@@ -268,7 +279,7 @@ export class InterceptorManager {
     async _runErrorPhase(ctx, dispatcher) {
         // Collect IDs to eject after iteration
         const toEject = new Set();
-        for (const interceptor of sortByPriority(this.errorInterceptors)) {
+        for (const interceptor of this.errorInterceptors) {
             if (interceptor.condition && !interceptor.condition(ctx))
                 continue;
             let result;
@@ -513,33 +524,43 @@ export function createTimeoutInterceptor(config = {}) {
             ctx.aborted = true;
             controller.abort(new TimeoutError(cfg.message, ms));
         }, ms);
-        // Merge with any existing signal
+        // Merge with any existing signal. The listener is removed in the
+        // response/error cleanup below so a shared external signal does not
+        // accumulate one closure per request (leak fix).
         const existing = ctx.request.signal;
         if (existing) {
-            existing.addEventListener("abort", () => {
+            const onExistingAbort = () => {
                 clearTimeout(timer);
                 controller.abort(existing.reason);
-            }, { once: true });
+            };
+            existing.addEventListener("abort", onExistingAbort, { once: true });
+            ctx.store.set(TIMEOUT_SIGNAL_KEY, { existing, onExistingAbort });
         }
         ctx.request = { ...ctx.request, signal: controller.signal };
         // Store cleanup ref in context
         ctx.store.set(TIMEOUT_TIMER_KEY, timer);
     };
-    // Response interceptor cleans up the timer after request completes
-    const responseInterceptor = (ctx) => {
+    /** Shared cleanup for the response and error phases. */
+    const cleanupTimeout = (ctx) => {
         const timer = ctx.store.get(TIMEOUT_TIMER_KEY);
         if (timer) {
             clearTimeout(timer);
             ctx.store.delete(TIMEOUT_TIMER_KEY);
         }
+        const merged = ctx.store.get(TIMEOUT_SIGNAL_KEY);
+        if (merged) {
+            merged.existing.removeEventListener("abort", merged.onExistingAbort);
+            ctx.store.delete(TIMEOUT_SIGNAL_KEY);
+        }
+    };
+    // Response interceptor cleans up the timer and merged-signal listener after
+    // the request completes
+    const responseInterceptor = (ctx) => {
+        cleanupTimeout(ctx);
     };
-    // Error interceptor also cleans up the timer
+    // Error interceptor also cleans up the timer and merged-signal listener
     const errorInterceptor = (ctx) => {
-        const timer = ctx.store.get(TIMEOUT_TIMER_KEY);
-        if (timer) {
-            clearTimeout(timer);
-            ctx.store.delete(TIMEOUT_TIMER_KEY);
-        }
+        cleanupTimeout(ctx);
     };
     return {
         id: "timeout",
@@ -549,6 +570,7 @@ export function createTimeoutInterceptor(config = {}) {
     };
 }
 const TIMEOUT_TIMER_KEY = Symbol("timeoutTimer");
+const TIMEOUT_SIGNAL_KEY = Symbol("timeoutSignal");
 /** Error thrown when a request exceeds the configured timeout. */
 export class TimeoutError extends Error {
     timeoutMs;
@@ -747,13 +769,22 @@ const CACHE_STALE_KEY = Symbol("cacheStale");
  */
 export function createDedupeInterceptor() {
     const inflight = new Map();
-    function key(req) {
-        return `${req.method.toUpperCase()}:${req.url}`;
+    /**
+     * Dedupe key. SECURITY: the auth fingerprint is part of the key. Without it,
+     * two callers with different Authorization / Cookie / API-key headers for the
+     * same URL were coalesced and one user received the other user's response.
+     */
+    async function key(req) {
+        const authFp = await getAuthFingerprint((req.headers ?? {}));
+        return `${req.method.toUpperCase()}:${req.url}${authFp ? ":" + authFp : ""}`;
     }
-    const requestInterceptor = (ctx) => {
+    const requestInterceptor = async (ctx) => {
         if (ctx.request.method.toUpperCase() !== "GET" && ctx.request.method.toUpperCase() !== "HEAD")
             return;
-        const k = key(ctx.request);
+        const k = await key(ctx.request);
+        // Stash the key on the context so the response/error phases can find this
+        // request' slot without re-deriving it.
+        ctx.store.set(DEDUPE_KEY, k);
         const slot = inflight.get(k);
         if (!slot) {
             // First request for this key — create in-flight entry
@@ -763,39 +794,61 @@ export function createDedupeInterceptor() {
             });
             return;
         }
-        // A request is already in flight — queue up
-        ctx.store.set(DEDUPE_QUEUED_KEY, k);
-        // Return a Promise that resolves to InterceptorResponse (which is a valid RequestInterceptorResult)
+        // A request is already in flight — queue up. A queued caller must never be
+        // left hanging if its own signal aborts while it waits for the leader.
         return new Promise((resolve, reject) => {
-            slot.waiters.push({
+            const signal = ctx.request.signal;
+            const waiter = {
                 resolve: (res) => resolve(res),
                 reject: (err) => reject(err), // Properly reject instead of throwing
-            });
+                cleanup: () => signal?.removeEventListener("abort", onQueuedAbort),
+            };
+            const onQueuedAbort = () => {
+                const at = slot.waiters.indexOf(waiter);
+                if (at !== -1)
+                    slot.waiters.splice(at, 1);
+                reject(new Error("Request aborted while queued for deduplication"));
+            };
+            if (signal?.aborted) {
+                onQueuedAbort();
+                return;
+            }
+            signal?.addEventListener("abort", onQueuedAbort, { once: true });
+            slot.waiters.push(waiter);
         });
     };
     const responseInterceptor = (ctx) => {
         if (!ctx.response)
             return;
-        const k = key(ctx.request);
+        const k = ctx.store.get(DEDUPE_KEY);
+        if (!k)
+            return;
         const slot = inflight.get(k);
         if (!slot)
             return;
         inflight.delete(k);
-        for (const w of slot.waiters)
+        for (const w of slot.waiters.splice(0)) {
+            w.cleanup();
             w.resolve(ctx.response);
+        }
     };
     const errorInterceptor = (ctx) => {
-        const k = key(ctx.request);
+        const k = ctx.store.get(DEDUPE_KEY);
+        if (!k)
+            return;
         const slot = inflight.get(k);
         if (!slot)
             return;
         inflight.delete(k);
-        for (const w of slot.waiters)
+        for (const w of slot.waiters.splice(0)) {
+            w.cleanup();
             w.reject(ctx.error);
+        }
     };
     return { requestInterceptor, responseInterceptor, errorInterceptor };
 }
-const DEDUPE_QUEUED_KEY = Symbol("dedupeQueued");
+/** ctx.store key holding this request's dedupe key. */
+const DEDUPE_KEY = Symbol("dedupeKey");
 const RATE_LIMIT_DEFAULTS = {
     limit: 60,
     windowMs: 60_000,

package/dist/cjs/logging.js

@@ -723,7 +723,7 @@ export class HTTPLogger {
      * ```ts
      * const logger = createProductionLogger();
      * const child = logger.child({ requestId: "req-123", userId: "user-456" });
-     * child.logRequest(...); // Logs will include both requestId and userId
+     * child.logRequest("req-123", "GET", "/users", {}, null, 1); // Logs include both requestId and userId
      * ```
      */
     child(context) {

package/dist/cjs/pagination.js

@@ -478,12 +478,20 @@ function sleep(ms, signal) {
             r();
             return;
         }
-        const timer = setTimeout(r, ms);
-        if (signal)
-            signal.addEventListener("abort", () => {
-                clearTimeout(timer);
-                r();
-            }, { once: true });
+        // The listener is removed on the timer path too. With `{ once: true }` it
+        // only self-removes when it FIRES, so a long-lived signal shared by many
+        // paginated requests accumulated one dead listener per completed sleep
+        // (MaxListeners warning + retained closures).
+        const onAbort = () => {
+            clearTimeout(timer);
+            signal?.removeEventListener("abort", onAbort);
+            r();
+        };
+        const timer = setTimeout(() => {
+            signal?.removeEventListener("abort", onAbort);
+            r();
+        }, ms);
+        signal?.addEventListener("abort", onAbort, { once: true });
     });
 }
 /**

package/dist/cjs/progress.js

@@ -178,36 +178,66 @@ export function withUploadProgress(body, total, options = {}) {
             },
         });
     }
+    // PULL-BASED, not start()-based. The old implementation drained the whole
+    // source inside start(), enqueueing every chunk before the transport read a
+    // single byte — a large upload was fully buffered in memory and the
+    // ReadableStream highWaterMark bought nothing. pull() reads one chunk per
+    // demand, so backpressure reaches the source.
+    let reader = null;
+    let onUploadAbort = null;
+    const detach = () => {
+        if (onUploadAbort) {
+            options.signal?.removeEventListener("abort", onUploadAbort);
+            onUploadAbort = null;
+        }
+    };
     const stream = new ReadableStream({
-        async start(controller) {
-            const reader = source.getReader();
+        start(controller) {
             // Handle already-aborted signal immediately
             if (options.signal?.aborted) {
-                reader.cancel("aborted").catch(() => { });
                 controller.error(new DOMException("Upload aborted", "AbortError"));
                 return;
             }
-            options.signal?.addEventListener("abort", () => {
-                reader.cancel("aborted").catch(() => { });
+            reader = source.getReader();
+            onUploadAbort = () => {
+                const r = reader;
+                reader = null;
+                void r?.cancel("aborted").catch(() => { });
+                tracker.complete();
                 controller.error(new DOMException("Upload aborted", "AbortError"));
-            }, { once: true });
+            };
+            // Removed in detach() on close/cancel/error so repeated uploads sharing
+            // one signal do not accumulate listeners (leak fix).
+            options.signal?.addEventListener("abort", onUploadAbort, { once: true });
+        },
+        async pull(controller) {
+            if (!reader)
+                return;
             try {
-                while (true) {
-                    const { done, value } = await reader.read();
-                    if (done) {
-                        tracker.complete();
-                        controller.close();
-                        break;
-                    }
-                    tracker.update(value.byteLength);
-                    controller.enqueue(value);
+                const { done, value } = await reader.read();
+                if (done) {
+                    detach();
+                    reader.releaseLock();
+                    reader = null;
+                    tracker.complete();
+                    controller.close();
+                    return;
                 }
+                tracker.update(value.byteLength);
+                controller.enqueue(value);
             }
             catch (err) {
+                detach();
                 tracker.complete();
                 controller.error(err);
             }
         },
+        cancel(reason) {
+            detach();
+            const r = reader;
+            reader = null;
+            void r?.cancel(reason).catch(() => { });
+        },
     });
     return { stream, tracker };
 }
@@ -240,44 +270,67 @@ export function withDownloadProgress(response, options = {}) {
         return { response, tracker };
     }
     const body = response.body;
+    // PULL-BASED for the same reason as withUploadProgress: the start()-based
+    // version buffered the entire download in memory before the consumer read it.
+    let reader = null;
+    let aborted = false;
+    let onAbort = null;
+    const detach = () => {
+        if (onAbort) {
+            options.signal?.removeEventListener("abort", onAbort);
+            onAbort = null;
+        }
+    };
     const trackedStream = new ReadableStream({
-        async start(controller) {
-            const reader = body.getReader();
-            let aborted = false;
-            const onAbort = () => {
+        start(controller) {
+            if (options.signal?.aborted) {
+                aborted = true;
+                controller.error(new DOMException("Download aborted", "AbortError"));
+                return;
+            }
+            reader = body.getReader();
+            onAbort = () => {
                 if (aborted)
                     return;
                 aborted = true;
+                const r = reader;
+                reader = null;
                 // Ensure tracker knows we're aborting (don't wait for complete)
-                reader.cancel("aborted").catch(() => { });
+                void r?.cancel("aborted").catch(() => { });
                 controller.error(new DOMException("Download aborted", "AbortError"));
             };
             options.signal?.addEventListener("abort", onAbort, { once: true });
+        },
+        async pull(controller) {
+            if (!reader)
+                return;
             try {
-                while (true) {
-                    const { done, value } = await reader.read();
-                    if (done) {
-                        tracker.complete();
-                        controller.close();
-                        break;
-                    }
-                    tracker.update(value.byteLength);
-                    controller.enqueue(value);
+                const { done, value } = await reader.read();
+                if (done) {
+                    detach();
+                    reader.releaseLock();
+                    reader = null;
+                    tracker.complete();
+                    controller.close();
+                    return;
                 }
+                tracker.update(value.byteLength);
+                controller.enqueue(value);
             }
             catch (err) {
+                detach();
                 // Ensure tracker is marked as complete even on error
                 if (!aborted) {
                     tracker.complete();
                 }
                 controller.error(err);
             }
-            finally {
-                // Remove abort listener if not already triggered
-                if (!aborted) {
-                    options.signal?.removeEventListener("abort", onAbort);
-                }
-            }
+        },
+        cancel(reason) {
+            detach();
+            const r = reader;
+            reader = null;
+            void r?.cancel(reason).catch(() => { });
         },
     });
     const trackedResponse = new Response(trackedStream, {
@@ -285,6 +338,21 @@ export function withDownloadProgress(response, options = {}) {
         statusText: response.statusText,
         headers: response.headers,
     });
+    // A reconstructed Response reports url === "" and redirected === false, which
+    // silently broke anything downstream that reads them. `url` and `redirected`
+    // are prototype getters, so shadow them with own properties on the instance.
+    for (const prop of ["url", "redirected", "type"]) {
+        try {
+            Object.defineProperty(trackedResponse, prop, {
+                value: response[prop],
+                enumerable: true,
+                configurable: true,
+            });
+        }
+        catch {
+            /* non-configurable in this runtime — leave the default in place */
+        }
+    }
     return { response: trackedResponse, tracker };
 }
 // ============================================================================
@@ -342,11 +410,11 @@ export async function collectStream(stream, total, options = {}) {
         reader.cancel("aborted").catch(() => { });
         throw new DOMException("Stream aborted", "AbortError");
     }
-    // Register abort handler
+    // Register abort handler (removed in the finally below — leak fix)
+    const abortHandler = () => {
+        reader.cancel("aborted").catch(() => { });
+    };
     if (options.signal) {
-        const abortHandler = () => {
-            reader.cancel("aborted").catch(() => { });
-        };
         options.signal.addEventListener("abort", abortHandler, { once: true });
     }
     try {
@@ -360,6 +428,7 @@ export async function collectStream(stream, total, options = {}) {
     }
     finally {
         reader.releaseLock();
+        options.signal?.removeEventListener("abort", abortHandler);
     }
     tracker.complete();
     // Concatenate chunks
@@ -546,12 +615,23 @@ export function xhrFetch(url, options) {
                 downloadTracker.update(e.loaded - downloadTracker.bytesLoaded);
             });
         }
-        // Abort signal
-        options.signal?.addEventListener("abort", () => {
+        // Abort signal. The listener is detached on settle: with `{ once: true }`
+        // it only self-removes when it actually fires, so a caller reusing one
+        // signal across many xhrFetch calls accumulated listeners — and each one
+        // kept the whole XHR + promise closures alive after the request finished.
+        const onAbort = () => {
             xhr.abort();
             reject(new DOMException("Request aborted", "AbortError"));
-        }, { once: true });
+        };
+        const detach = () => options.signal?.removeEventListener("abort", onAbort);
+        options.signal?.addEventListener("abort", onAbort, { once: true });
+        if (options.signal?.aborted) {
+            detach();
+            onAbort();
+            return;
+        }
         xhr.addEventListener("load", () => {
+            detach();
             downloadTracker.complete();
             // Parse response headers
             const rawHeaders = xhr.getAllResponseHeaders();
@@ -570,11 +650,18 @@ export function xhrFetch(url, options) {
             });
         });
         xhr.addEventListener("error", () => {
+            detach();
             reject(new TypeError("Network request failed"));
         });
         xhr.addEventListener("timeout", () => {
+            detach();
             reject(new TypeError("Request timed out"));
         });
+        xhr.addEventListener("abort", () => {
+            // Covers aborts initiated from inside the XHR (not via the signal).
+            detach();
+            reject(new DOMException("Request aborted", "AbortError"));
+        });
         xhr.send(options.body ?? null);
     });
 }

package/dist/cjs/socks5.js

@@ -501,31 +501,34 @@ export const denoTcpConnector = async (host, port, timeoutMs) => {
     // Type assertion for Deno global which has the connect method
     // Must use type assertion as Deno namespace is not in standard TypeScript types
     const denoGlobal = globalThis;
-    let conn;
-    if (timeoutMs && timeoutMs > 0) {
-        // Wrap connect in a timeout race
-        conn = await Promise.race([
-            denoGlobal.Deno.connect({ hostname: host, port, transport: "tcp" }),
-            new Promise((_, rej) => setTimeout(() => rej(new Socks5Error("TCP connect to proxy timed out", "SOCKS5_TIMEOUT", true)), timeoutMs)),
-        ]);
-    }
-    else {
-        conn = await denoGlobal.Deno.connect({ hostname: host, port, transport: "tcp" });
-    }
-    const wrappedRead = async (buf) => {
-        if (timeoutMs && timeoutMs > 0) {
-            return Promise.race([
-                conn.read(buf).catch(() => null),
-                new Promise((_, rej) => setTimeout(() => rej(new Socks5Error("TCP read timed out", "SOCKS5_TIMEOUT", true)), timeoutMs)),
-            ]);
-        }
+    // NOTE: every timeout below is created and cleared explicitly. The previous
+    // Promise.race timers were never cleared, so each read left a pending timer
+    // (holding a closure, and keeping the Deno event loop alive) for the full
+    // timeout window — one per chunk on a streaming tunnel.
+    const withTimeout = async (work, message) => {
+        if (!timeoutMs || timeoutMs <= 0)
+            return work;
+        let timer;
         try {
-            return await conn.read(buf);
+            return await Promise.race([
+                work,
+                new Promise((_, rej) => {
+                    timer = setTimeout(() => rej(new Socks5Error(message, "SOCKS5_TIMEOUT", true)), timeoutMs);
+                }),
+            ]);
         }
-        catch {
-            return null;
+        finally {
+            if (timer !== undefined)
+                clearTimeout(timer);
         }
     };
+    const conn = await withTimeout(denoGlobal.Deno.connect({ hostname: host, port, transport: "tcp" }), "TCP connect to proxy timed out");
+    // Not `async`: it returns withTimeout()'s promise directly, so there is no
+    // await to make the function async.
+    const wrappedRead = (buf) => {
+        const read = conn.read(buf).catch(() => null);
+        return withTimeout(read, "TCP read timed out");
+    };
     return {
         read: wrappedRead,
         write: (data) => conn.write(data),
@@ -590,7 +593,12 @@ export const nodeTcpConnector = (host, port, timeoutMs) => {
                 buffer = next;
                 flushBuffer();
             });
+            // Latch EOF. Without this, a read issued AFTER `end` parked forever:
+            // the socket will never emit data again, nothing rejects, and the caller
+            // hangs with no error. Callers now get an immediate null (clean EOF).
+            let ended = false;
             socket.on("end", () => {
+                ended = true;
                 if (pendingRead) {
                     pendingRead(null);
                     pendingRead = null;
@@ -598,6 +606,9 @@ export const nodeTcpConnector = (host, port, timeoutMs) => {
                     pendingBuf = null;
                 }
             });
+            socket.on("close", () => {
+                ended = true;
+            });
             socket.once("error", (err) => {
                 clearTimeout(timer);
                 lastError = err;
@@ -616,6 +627,10 @@ export const nodeTcpConnector = (host, port, timeoutMs) => {
                             rej(lastError);
                             return;
                         }
+                        if (ended && buffer.length === 0) {
+                            res(null);
+                            return;
+                        }
                         if (buffer.length > 0) {
                             const n = Math.min(buffer.length, buf.length);
                             buf.set(buffer.subarray(0, n));