kinetex 1.2.0 → 1.3.0

package/dist/browser/kinetex.js

@@ -1,4 +1,4 @@
-/* kinetex v1.2.0 | MIT | https://github.com/kinetexjs/kinetex */
+/* kinetex v1.3.0 | MIT | https://github.com/kinetexjs/kinetex */
 "use strict";
 var kinetex = (() => {
   var __create = Object.create;
@@ -902,6 +902,7 @@ var kinetex = (() => {
   // dist/esm/cache.js
   var cache_exports = {};
   __export(cache_exports, {
+    CREDENTIAL_HEADERS: () => CREDENTIAL_HEADERS,
     CloudflareKVAdapter: () => CloudflareKVAdapter,
     HTTPCache: () => HTTPCache,
     MemoryStorageAdapter: () => MemoryStorageAdapter,
@@ -993,18 +994,16 @@ var kinetex = (() => {
     return parts.join(";");
   }
   function normalizeCacheKeyPart(part) {
-    const controlRanges = [
-      String.fromCharCode(0) + "-" + String.fromCharCode(31),
-      String.fromCharCode(127) + "-" + String.fromCharCode(159)
-    ].join("");
-    const controlRegex = new RegExp(`[${controlRanges}]`, "g");
-    return part.replaceAll(controlRegex, "").replaceAll(/\s+/g, " ").trim();
+    return part.replaceAll(CONTROL_CHARS, "").replaceAll(/\s+/g, " ").trim();
   }
   async function getAuthFingerprint(headers) {
-    const authHeaders = ["authorization", "cookie", "x-api-key", "x-auth-token"];
+    const lowered = /* @__PURE__ */ new Map();
+    for (const [name, value] of Object.entries(headers)) {
+      lowered.set(name.toLowerCase(), value);
+    }
     const parts = [];
-    for (const header of authHeaders) {
-      const value = headers[header.toLowerCase()];
+    for (const header of CREDENTIAL_HEADERS) {
+      const value = lowered.get(header);
       if (value)
         parts.push(`${header}=${value}`);
     }
@@ -1118,7 +1117,7 @@ var kinetex = (() => {
   function createTwoTierCache(l2, config) {
     return new HTTPCache({ ...config, storage: new TwoTierStorageAdapter(l2) });
   }
-  var MemoryStorageAdapter, WebStorageAdapter, CloudflareKVAdapter, TwoTierStorageAdapter, LRUNode, LRUTracker, HTTPCache;
+  var MemoryStorageAdapter, WebStorageAdapter, CloudflareKVAdapter, TwoTierStorageAdapter, CONTROL_CHARS, CREDENTIAL_HEADERS, LRUNode, LRUTracker, HTTPCache;
   var init_cache = __esm({
     "dist/esm/cache.js"() {
       "use strict";
@@ -1286,6 +1285,24 @@ var kinetex = (() => {
           await Promise.all([this.l1.clear(), this.l2.clear()]);
         }
       };
+      CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f]/g;
+      CREDENTIAL_HEADERS = [
+        "authorization",
+        "proxy-authorization",
+        "cookie",
+        "x-api-key",
+        "apikey",
+        "api-key",
+        "x-auth-token",
+        "x-access-token",
+        "x-refresh-token",
+        "x-session-id",
+        "x-session-token",
+        "x-secret",
+        "x-secret-key",
+        "x-private-key",
+        "x-csrf-token"
+      ];
       LRUNode = class {
         constructor(key, prev = null, next = null) {
           __publicField(this, "key");
@@ -1400,6 +1417,8 @@ var kinetex = (() => {
             // 7 days
             honorCacheControl: config.honorCacheControl ?? true,
             cacheMethods: config.cacheMethods ?? ["GET", "HEAD"],
+            // 304 is intentionally absent: the client revalidates rather than
+            // storing a 304, so listing it only implied a guarantee that never held.
             cacheStatuses: config.cacheStatuses ?? [
               200,
               203,
@@ -1407,7 +1426,6 @@ var kinetex = (() => {
               206,
               300,
               301,
-              304,
               404,
               405,
               410,
@@ -1774,6 +1792,9 @@ var kinetex = (() => {
             for (const tag of entry.tags) {
               this.tagIndex.get(tag)?.delete(key);
             }
+          } else {
+            for (const set of this.tagIndex.values())
+              set.delete(key);
           }
         }
         async _ensureCapacity(newEntrySize) {
@@ -1966,6 +1987,23 @@ var kinetex = (() => {
     }
     return out;
   }
+  function splitCacheControlDirectives(value) {
+    const parts = [];
+    let current = "";
+    let inQuotes = false;
+    for (const ch of value) {
+      if (ch === '"')
+        inQuotes = !inQuotes;
+      if (ch === "," && !inQuotes) {
+        parts.push(current);
+        current = "";
+        continue;
+      }
+      current += ch;
+    }
+    parts.push(current);
+    return parts;
+  }
   function parseCacheControl2(value) {
     const d = {
       noCache: false,
@@ -1986,7 +2024,7 @@ var kinetex = (() => {
       staleWhileRevalidate: null,
       unknown: /* @__PURE__ */ new Map()
     };
-    for (const part of value.split(",")) {
+    for (const part of splitCacheControlDirectives(value)) {
       const t = part.trim();
       const eq = t.indexOf("=");
       const k = (eq === -1 ? t : t.slice(0, eq)).trim().toLowerCase();
@@ -2310,11 +2348,30 @@ var kinetex = (() => {
       proto: xproto ?? null
     };
   }
-  function getClientIP(headers) {
+  function getClientIP(headers, options = {}) {
+    const trustedHops = Math.max(0, Math.trunc(options.trustedHops ?? 0));
     const fwd = normalizeForwardedHeaders(headers);
-    if (fwd.for.length > 0)
-      return fwd.for[0];
-    return headers.get(HeaderName.XRealIP);
+    if (fwd.for.length > 0) {
+      const list = fwd.for;
+      const index = trustedHops === 0 ? 0 : list.length - trustedHops;
+      const value = list[index] ?? list[0];
+      return stripIPPortAndBrackets(value);
+    }
+    return stripIPPortAndBrackets(headers.get(HeaderName.XRealIP) ?? "") || null;
+  }
+  function stripIPPortAndBrackets(value) {
+    let v = value.trim();
+    if (v.startsWith('"') && v.endsWith('"') && v.length >= 2)
+      v = v.slice(1, -1);
+    if (v.startsWith("[")) {
+      const end = v.indexOf("]");
+      if (end !== -1)
+        return v.slice(1, end);
+    }
+    const m = /^(.*):\d+$/.exec(v);
+    if (m && (m[1] ?? "").includes("."))
+      return m[1];
+    return v;
   }
   function parseRetryAfter(value) {
     const t = value.trim();
@@ -4456,6 +4513,7 @@ var kinetex = (() => {
   // dist/esm/core.js
   var core_exports = {};
   __export(core_exports, {
+    DEFAULT_ACCEPT_ENCODING: () => DEFAULT_ACCEPT_ENCODING,
     FetchTransport: () => FetchTransport,
     HAS_NATIVE_FETCH: () => HAS_NATIVE_FETCH,
     HTTP_STATUS_TEXTS: () => HTTP_STATUS_TEXTS,
@@ -4509,6 +4567,11 @@ var kinetex = (() => {
     }
   }
   function createTransport(fetchFn, preferHTTP2 = true, sessionOptions, transportOptions) {
+    if (IS_NODE && preferHTTP2 && fetchFn) {
+      if (!isProductionEnvironment()) {
+        console.warn('[kinetex] httpVersion: "HTTP/2" is ignored when a custom `fetch` is configured \u2014 NodeHTTP2Transport cannot use a custom fetch, so the request goes through FetchTransport (HTTP/1.1 semantics). Drop the `fetch` option to use HTTP/2.');
+      }
+    }
     if (IS_NODE && preferHTTP2 && !fetchFn) {
       return new NodeHTTP2Transport({
         ...sessionOptions?.sessionTTLMs !== void 0 ? { sessionTTLMs: sessionOptions.sessionTTLMs } : {},
@@ -4750,7 +4813,8 @@ var kinetex = (() => {
     } else if (typeof body === "string") {
       stream.end(body);
     } else {
-      stream.end();
+      const bytes = await serializeRawBody(body);
+      stream.end(bytes);
     }
   }
   async function pipeBodyToNodeReq(req, body) {
@@ -4769,8 +4833,18 @@ var kinetex = (() => {
     } else if (typeof body === "string") {
       req.end(body);
     } else {
-      req.end();
+      const bytes = await serializeRawBody(body);
+      req.end(bytes);
+    }
+  }
+  async function serializeRawBody(body) {
+    if (typeof URLSearchParams !== "undefined" && body instanceof URLSearchParams) {
+      return new TextEncoder().encode(body.toString());
+    }
+    if (typeof Blob !== "undefined" && body instanceof Blob) {
+      return new Uint8Array(await body.arrayBuffer());
     }
+    return new Uint8Array(0);
   }
   async function decompressBodyStream(body, headers) {
     if (!body)
@@ -4795,7 +4869,7 @@ var kinetex = (() => {
     const { applyDecompression: applyDecompression2 } = await Promise.resolve().then(() => (init_response(), response_exports));
     return applyDecompression2(body, headers);
   }
-  var g, RUNTIME, _runtimeOverride, IS_NODE, HAS_NATIVE_FETCH, FetchTransport, NodeHTTP2Transport, nodeReadableToWebStream, HTTP_STATUS_TEXTS;
+  var g, RUNTIME, _runtimeOverride, IS_NODE, HAS_NATIVE_FETCH, DEFAULT_ACCEPT_ENCODING, FetchTransport, NodeHTTP2Transport, nodeReadableToWebStream, HTTP_STATUS_TEXTS;
   var init_core = __esm({
     "dist/esm/core.js"() {
       "use strict";
@@ -4808,6 +4882,7 @@ var kinetex = (() => {
       _runtimeOverride = null;
       IS_NODE = RUNTIME === "node";
       HAS_NATIVE_FETCH = RUNTIME !== "node" || typeof globalThis.fetch === "function";
+      DEFAULT_ACCEPT_ENCODING = "gzip, deflate, br";
       FetchTransport = class {
         /**
          * @param fetchFnOrOptions - Custom fetch function or options object
@@ -4855,7 +4930,7 @@ var kinetex = (() => {
             sanitizedHeaders[name] = value;
           }
           const ae = sanitizedHeaders["accept-encoding"];
-          if (ae && ae.toLowerCase().includes("gzip") && ae.toLowerCase().includes("deflate") && ae.toLowerCase().includes("br")) {
+          if (ae && ae.toLowerCase().replace(/\s+/g, " ") === DEFAULT_ACCEPT_ENCODING) {
             delete sanitizedHeaders["accept-encoding"];
           }
           const init = {
@@ -5659,8 +5734,7 @@ var kinetex = (() => {
       return false;
     if (isIPAddress(cd))
       return false;
-    const psl = getPublicSuffix(rh);
-    if (psl === rh)
+    if (isPublicSuffix(cd))
       return false;
     return true;
   }
@@ -7369,7 +7443,7 @@ var kinetex = (() => {
           let cookieDomain;
           let hostOnly;
           if (parsed.domain !== null && parsed.domain !== "") {
-            const cd = parsed.domain;
+            const cd = parsed.domain.toLowerCase();
             const matcher = this.domainMatcherFn ?? domainMatch;
             if (!matcher(reqHost, cd))
               return false;
@@ -7439,9 +7513,6 @@ var kinetex = (() => {
          * @returns Array of matching Cookie objects (direct references into storage)
          */
         getCookies(options) {
-          if (Math.random() < 0.01) {
-            this.clearExpired();
-          }
           const url = safeParseUrl(options.url);
           if (!url)
             return [];
@@ -7878,11 +7949,13 @@ var kinetex = (() => {
           if (this.domainMatcherFn) {
             return this.domainMatcherFn(reqHost, cookieDomain);
           }
-          if (reqHost === cookieDomain)
+          const host = reqHost.toLowerCase();
+          const domain = cookieDomain.toLowerCase();
+          if (host === domain)
             return true;
-          if (isIPAddress(reqHost))
+          if (isIPAddress(host))
             return false;
-          return reqHost.endsWith("." + cookieDomain);
+          return host.endsWith("." + domain);
         }
       };
     }
@@ -8584,7 +8657,7 @@ var kinetex = (() => {
          * ```ts
          * const logger = createProductionLogger();
          * const child = logger.child({ requestId: "req-123", userId: "user-456" });
-         * child.logRequest(...); // Logs will include both requestId and userId
+         * child.logRequest("req-123", "GET", "/users", {}, null, 1); // Logs include both requestId and userId
          * ```
          */
         child(context) {
@@ -8697,8 +8770,23 @@ var kinetex = (() => {
       events.push(final);
     return events;
   }
-  function sleep3(ms) {
-    return new Promise((r) => setTimeout(r, ms));
+  function sleep3(ms, signal) {
+    return new Promise((r) => {
+      if (signal?.aborted) {
+        r();
+        return;
+      }
+      const onAbort = () => {
+        clearTimeout(timer);
+        signal?.removeEventListener("abort", onAbort);
+        r();
+      };
+      const timer = setTimeout(() => {
+        signal?.removeEventListener("abort", onAbort);
+        r();
+      }, ms);
+      signal?.addEventListener("abort", onAbort, { once: true });
+    });
   }
   var SSEParser, SSETransformStream, SSEClient, SSERouter, SSEServerResponse, SSEError, SSEMaxReconnectsError;
   var init_sse = __esm({
@@ -9075,8 +9163,8 @@ var kinetex = (() => {
               }
               if (!cfg.reconnect)
                 throw err;
-              if (cfg.maxReconnects > 0 && reconnectAttempt >= cfg.maxReconnects) {
-                throw new SSEMaxReconnectsError(reconnectAttempt, cfg.url);
+              if (cfg.maxReconnects > 0 && this.health.totalReconnects >= cfg.maxReconnects) {
+                throw new SSEMaxReconnectsError(this.health.totalReconnects, cfg.url);
               }
               reconnectAttempt++;
               this.health.totalReconnects++;
@@ -9089,25 +9177,31 @@ var kinetex = (() => {
                 clearTimeout(heartbeatTimer);
                 heartbeatTimer = null;
               }
-              await sleep3(delay2);
+              await sleep3(delay2, cfg.signal);
+              if (cfg.signal?.aborted)
+                break;
               parser.reset();
               continue;
             }
             this.health.connected = false;
             if (!cfg.reconnect)
               break;
-            if (cfg.maxReconnects > 0 && reconnectAttempt >= cfg.maxReconnects) {
-              throw new SSEMaxReconnectsError(reconnectAttempt, cfg.url);
+            if (cfg.maxReconnects > 0 && this.health.totalReconnects >= cfg.maxReconnects) {
+              throw new SSEMaxReconnectsError(this.health.totalReconnects, cfg.url);
             }
             reconnectAttempt++;
             this.health.totalReconnects++;
-            const delay = Math.min(reconnectDelay, cfg.maxReconnectDelayMs);
+            this.health.reconnectAttempt = reconnectAttempt;
+            const delay = Math.min(reconnectDelay + reconnectDelay * cfg.reconnectJitter * Math.random(), cfg.maxReconnectDelayMs);
+            reconnectDelay = Math.min(reconnectDelay * 2, cfg.maxReconnectDelayMs);
             cfg.onReconnect(reconnectAttempt, delay);
             if (heartbeatTimer) {
               clearTimeout(heartbeatTimer);
               heartbeatTimer = null;
             }
-            await sleep3(delay);
+            await sleep3(delay, cfg.signal);
+            if (cfg.signal?.aborted)
+              break;
           }
           this.health.connected = false;
         }
@@ -10593,12 +10687,16 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
         r();
         return;
       }
-      const timer = setTimeout(r, ms);
-      if (signal)
-        signal.addEventListener("abort", () => {
-          clearTimeout(timer);
-          r();
-        }, { once: true });
+      const onAbort = () => {
+        clearTimeout(timer);
+        signal?.removeEventListener("abort", onAbort);
+        r();
+      };
+      const timer = setTimeout(() => {
+        signal?.removeEventListener("abort", onAbort);
+        r();
+      }, ms);
+      signal?.addEventListener("abort", onAbort, { once: true });
     });
   }
   function toPaginationIterator(source) {
@@ -11098,38 +11196,58 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
         }
       });
     }
+    let reader = null;
+    let onUploadAbort = null;
+    const detach = () => {
+      if (onUploadAbort) {
+        options.signal?.removeEventListener("abort", onUploadAbort);
+        onUploadAbort = null;
+      }
+    };
     const stream = new ReadableStream({
-      async start(controller) {
-        const reader = source.getReader();
+      start(controller) {
         if (options.signal?.aborted) {
-          reader.cancel("aborted").catch(() => {
-          });
           controller.error(new DOMException("Upload aborted", "AbortError"));
           return;
         }
-        const onUploadAbort = () => {
-          reader.cancel("aborted").catch(() => {
+        reader = source.getReader();
+        onUploadAbort = () => {
+          const r = reader;
+          reader = null;
+          void r?.cancel("aborted").catch(() => {
           });
+          tracker.complete();
           controller.error(new DOMException("Upload aborted", "AbortError"));
         };
         options.signal?.addEventListener("abort", onUploadAbort, { once: true });
+      },
+      async pull(controller) {
+        if (!reader)
+          return;
         try {
-          while (true) {
-            const { done, value } = await reader.read();
-            if (done) {
-              tracker.complete();
-              controller.close();
-              break;
-            }
-            tracker.update(value.byteLength);
-            controller.enqueue(value);
+          const { done, value } = await reader.read();
+          if (done) {
+            detach();
+            reader.releaseLock();
+            reader = null;
+            tracker.complete();
+            controller.close();
+            return;
           }
+          tracker.update(value.byteLength);
+          controller.enqueue(value);
         } catch (err) {
+          detach();
           tracker.complete();
           controller.error(err);
-        } finally {
-          options.signal?.removeEventListener("abort", onUploadAbort);
         }
+      },
+      cancel(reason) {
+        detach();
+        const r = reader;
+        reader = null;
+        void r?.cancel(reason).catch(() => {
+        });
       }
     });
     return { stream, tracker };
@@ -11146,40 +11264,64 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
       return { response, tracker };
     }
     const body = response.body;
+    let reader = null;
+    let aborted = false;
+    let onAbort = null;
+    const detach = () => {
+      if (onAbort) {
+        options.signal?.removeEventListener("abort", onAbort);
+        onAbort = null;
+      }
+    };
     const trackedStream = new ReadableStream({
-      async start(controller) {
-        const reader = body.getReader();
-        let aborted = false;
-        const onAbort = () => {
+      start(controller) {
+        if (options.signal?.aborted) {
+          aborted = true;
+          controller.error(new DOMException("Download aborted", "AbortError"));
+          return;
+        }
+        reader = body.getReader();
+        onAbort = () => {
           if (aborted)
             return;
           aborted = true;
-          reader.cancel("aborted").catch(() => {
+          const r = reader;
+          reader = null;
+          void r?.cancel("aborted").catch(() => {
           });
           controller.error(new DOMException("Download aborted", "AbortError"));
         };
         options.signal?.addEventListener("abort", onAbort, { once: true });
+      },
+      async pull(controller) {
+        if (!reader)
+          return;
         try {
-          while (true) {
-            const { done, value } = await reader.read();
-            if (done) {
-              tracker.complete();
-              controller.close();
-              break;
-            }
-            tracker.update(value.byteLength);
-            controller.enqueue(value);
+          const { done, value } = await reader.read();
+          if (done) {
+            detach();
+            reader.releaseLock();
+            reader = null;
+            tracker.complete();
+            controller.close();
+            return;
           }
+          tracker.update(value.byteLength);
+          controller.enqueue(value);
         } catch (err) {
+          detach();
           if (!aborted) {
             tracker.complete();
           }
           controller.error(err);
-        } finally {
-          if (!aborted) {
-            options.signal?.removeEventListener("abort", onAbort);
-          }
         }
+      },
+      cancel(reason) {
+        detach();
+        const r = reader;
+        reader = null;
+        void r?.cancel(reason).catch(() => {
+        });
       }
     });
     const trackedResponse = new Response(trackedStream, {
@@ -11187,6 +11329,16 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
       statusText: response.statusText,
       headers: response.headers
     });
+    for (const prop of ["url", "redirected", "type"]) {
+      try {
+        Object.defineProperty(trackedResponse, prop, {
+          value: response[prop],
+          enumerable: true,
+          configurable: true
+        });
+      } catch {
+      }
+    }
     return { response: trackedResponse, tracker };
   }
   async function* streamWithProgress(stream, total, options = {}) {
@@ -11367,11 +11519,19 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
           downloadTracker.update(e.loaded - downloadTracker.bytesLoaded);
         });
       }
-      options.signal?.addEventListener("abort", () => {
+      const onAbort = () => {
         xhr.abort();
         reject(new DOMException("Request aborted", "AbortError"));
-      }, { once: true });
+      };
+      const detach = () => options.signal?.removeEventListener("abort", onAbort);
+      options.signal?.addEventListener("abort", onAbort, { once: true });
+      if (options.signal?.aborted) {
+        detach();
+        onAbort();
+        return;
+      }
       xhr.addEventListener("load", () => {
+        detach();
         downloadTracker.complete();
         const rawHeaders = xhr.getAllResponseHeaders();
         const headers = {};
@@ -11389,11 +11549,17 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
         });
       });
       xhr.addEventListener("error", () => {
+        detach();
         reject(new TypeError("Network request failed"));
       });
       xhr.addEventListener("timeout", () => {
+        detach();
         reject(new TypeError("Request timed out"));
       });
+      xhr.addEventListener("abort", () => {
+        detach();
+        reject(new DOMException("Request aborted", "AbortError"));
+      });
       xhr.send(options.body ?? null);
     });
   }
@@ -11545,6 +11711,11 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
         if (effectiveWindowMs <= 0) {
           this.inflight.delete(key);
         } else {
+          const stale = this.timeouts.get(key);
+          if (stale !== void 0) {
+            clearTimeout(stale);
+            this.timeouts.delete(key);
+          }
           const timeoutId = setTimeout(() => {
             this.inflight.delete(key);
             this.timeouts.delete(key);
@@ -11586,13 +11757,6 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
     get keys() {
       return [...this.inflight.keys()];
     }
-    /**
-     * Get comprehensive deduplication statistics.
-     * NOTE: inFlightCount and trackedKeys reflect snapshot time; entries may
-     * resolve asynchronously between sampling and return (non-blocking, acceptable).
-     *
-     * @returns Snapshot of hits, misses, hit rate, and tracked entries
-     */
     /**
      * Get comprehensive deduplication statistics.
      *
@@ -11735,9 +11899,16 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
     }
     /** Snapshot of all counters — suitable for logging or dashboards. */
     get snapshot() {
+      let failureCount = this._consecutiveFails;
+      if (this.windowSize > 0) {
+        failureCount = 0;
+        for (const ok of this._window)
+          if (!ok)
+            failureCount++;
+      }
       return {
         state: this._state,
-        failureCount: this.windowSize > 0 ? this._window.filter((v) => !v).length : this._consecutiveFails,
+        failureCount,
         successCount: this._consecutiveSucc,
         lastFailureAt: this._lastFailureAt,
         lastSuccessAt: this._lastSuccessAt,
@@ -11763,6 +11934,7 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
         this.cfg.onRejected?.(snap);
         return Promise.reject(new CircuitOpenError(this.key, snap));
       }
+      let heldProbe = false;
       if (this._state === "HALF_OPEN") {
         if (this._inFlightProbes >= this.halfOpenConcurrency) {
           this._totalRejected++;
@@ -11771,15 +11943,16 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
           return Promise.reject(new CircuitOpenError(this.key, snap));
         }
         this._inFlightProbes++;
+        heldProbe = true;
       }
       this._totalRequests++;
-      return fn().then((result) => {
-        if (this._state === "HALF_OPEN")
+      return Promise.resolve().then(fn).then((result) => {
+        if (heldProbe)
           this._inFlightProbes = Math.max(0, this._inFlightProbes - 1);
         this._recordSuccess();
         return result;
       }, (err) => {
-        if (this._state === "HALF_OPEN")
+        if (heldProbe)
           this._inFlightProbes = Math.max(0, this._inFlightProbes - 1);
         if (this._isCountableFailure(err)) {
           this._recordFailure();
@@ -12742,6 +12915,10 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
       return this._maxReconnects === 0 || this._reconnAttempt < this._maxReconnects;
     }
     _scheduleRecon() {
+      if (this._reconnTimer) {
+        clearTimeout(this._reconnTimer);
+        this._reconnTimer = null;
+      }
       this._state = "RECONNECTING";
       this._reconnAttempt++;
       const exp = this._reconnectBaseMs * Math.pow(2, this._reconnAttempt - 1);
@@ -12749,13 +12926,11 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
       const delay = Math.floor(capped * (1 + this._reconnectJitter * Math.random()));
       this._cbReconnect?.(this._reconnAttempt, delay);
       this._reconnTimer = setTimeout(() => {
+        this._reconnTimer = null;
         if (!this._aborted)
           this._doConnect(true).catch(() => {
           });
       }, delay);
-      if (typeof this._reconnTimer === "object" && this._reconnTimer !== null && "unref" in this._reconnTimer) {
-        this._reconnTimer.unref();
-      }
     }
     _tx(data) {
       const ws = this._ws;
@@ -12923,12 +13098,17 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
   init_cache();
 
   // dist/esm/interceptors.js
+  init_cache();
   var _idSeq = 0;
   function nextId() {
     return `interceptor_${++_idSeq}`;
   }
-  function sortByPriority(arr) {
-    return [...arr].sort((a, b) => a.priority - b.priority);
+  function insertByPriority(arr, entry) {
+    const at = arr.findIndex((x) => x.priority > entry.priority);
+    if (at === -1)
+      arr.push(entry);
+    else
+      arr.splice(at, 0, entry);
   }
   var InterceptorManager = class {
     constructor() {
@@ -12946,7 +13126,7 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
      */
     useRequest(fn, opts = {}) {
       const id = opts.id ?? nextId();
-      this.requestInterceptors.push({
+      insertByPriority(this.requestInterceptors, {
         id,
         priority: opts.priority ?? 0,
         once: opts.once ?? false,
@@ -12964,7 +13144,7 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
      */
     useResponse(fn, opts = {}) {
       const id = opts.id ?? nextId();
-      this.responseInterceptors.push({
+      insertByPriority(this.responseInterceptors, {
         id,
         priority: opts.priority ?? 0,
         once: opts.once ?? false,
@@ -12982,7 +13162,7 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
      */
     useError(fn, opts = {}) {
       const id = opts.id ?? nextId();
-      this.errorInterceptors.push({
+      insertByPriority(this.errorInterceptors, {
         id,
         priority: opts.priority ?? 0,
         once: opts.once ?? false,
@@ -13059,7 +13239,7 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
     async _run(ctx, dispatcher) {
       ctx.attempt++;
       const toEject = /* @__PURE__ */ new Set();
-      for (const interceptor of sortByPriority(this.requestInterceptors)) {
+      for (const interceptor of this.requestInterceptors) {
         if (ctx.aborted)
           break;
         if (interceptor.condition && !interceptor.condition(ctx))
@@ -13099,7 +13279,7 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
     }
     async _runResponsePhase(ctx, dispatcher) {
       const toEject = /* @__PURE__ */ new Set();
-      for (const interceptor of sortByPriority(this.responseInterceptors)) {
+      for (const interceptor of this.responseInterceptors) {
         if (ctx.aborted)
           break;
         if (interceptor.condition && !interceptor.condition(ctx))
@@ -13137,7 +13317,7 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
     }
     async _runErrorPhase(ctx, dispatcher) {
       const toEject = /* @__PURE__ */ new Set();
-      for (const interceptor of sortByPriority(this.errorInterceptors)) {
+      for (const interceptor of this.errorInterceptors) {
         if (interceptor.condition && !interceptor.condition(ctx))
           continue;
         let result;
@@ -13549,13 +13729,15 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
   var CACHE_STALE_KEY = /* @__PURE__ */ Symbol("cacheStale");
   function createDedupeInterceptor() {
     const inflight = /* @__PURE__ */ new Map();
-    function key(req) {
-      return `${req.method.toUpperCase()}:${req.url}`;
+    async function key(req) {
+      const authFp = await getAuthFingerprint(req.headers ?? {});
+      return `${req.method.toUpperCase()}:${req.url}${authFp ? ":" + authFp : ""}`;
     }
-    const requestInterceptor = (ctx) => {
+    const requestInterceptor = async (ctx) => {
       if (ctx.request.method.toUpperCase() !== "GET" && ctx.request.method.toUpperCase() !== "HEAD")
         return;
-      const k = key(ctx.request);
+      const k = await key(ctx.request);
+      ctx.store.set(DEDUPE_KEY, k);
       const slot = inflight.get(k);
       if (!slot) {
         inflight.set(k, {
@@ -13564,38 +13746,59 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
         });
         return;
       }
-      ctx.store.set(DEDUPE_QUEUED_KEY, k);
       return new Promise((resolve, reject) => {
-        slot.waiters.push({
+        const signal = ctx.request.signal;
+        const waiter = {
           resolve: (res) => resolve(res),
-          reject: (err) => reject(err)
+          reject: (err) => reject(err),
           // Properly reject instead of throwing
-        });
+          cleanup: () => signal?.removeEventListener("abort", onQueuedAbort)
+        };
+        const onQueuedAbort = () => {
+          const at = slot.waiters.indexOf(waiter);
+          if (at !== -1)
+            slot.waiters.splice(at, 1);
+          reject(new Error("Request aborted while queued for deduplication"));
+        };
+        if (signal?.aborted) {
+          onQueuedAbort();
+          return;
+        }
+        signal?.addEventListener("abort", onQueuedAbort, { once: true });
+        slot.waiters.push(waiter);
       });
     };
     const responseInterceptor = (ctx) => {
       if (!ctx.response)
         return;
-      const k = key(ctx.request);
+      const k = ctx.store.get(DEDUPE_KEY);
+      if (!k)
+        return;
       const slot = inflight.get(k);
       if (!slot)
         return;
       inflight.delete(k);
-      for (const w of slot.waiters)
+      for (const w of slot.waiters.splice(0)) {
+        w.cleanup();
         w.resolve(ctx.response);
+      }
     };
     const errorInterceptor = (ctx) => {
-      const k = key(ctx.request);
+      const k = ctx.store.get(DEDUPE_KEY);
+      if (!k)
+        return;
       const slot = inflight.get(k);
       if (!slot)
         return;
       inflight.delete(k);
-      for (const w of slot.waiters)
+      for (const w of slot.waiters.splice(0)) {
+        w.cleanup();
         w.reject(ctx.error);
+      }
     };
     return { requestInterceptor, responseInterceptor, errorInterceptor };
   }
-  var DEDUPE_QUEUED_KEY = /* @__PURE__ */ Symbol("dedupeQueued");
+  var DEDUPE_KEY = /* @__PURE__ */ Symbol("dedupeKey");
   var RATE_LIMIT_DEFAULTS = {
     limit: 60,
     windowMs: 6e4,
@@ -13961,7 +14164,7 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
       const role = roles[0]?.trim();
       if (!role)
         throw new NetworkError("No IAM role found in IMDS response");
-      const credsRes = await fetchWithTimeout(`${endpoint}/latest/meta-data/iam/security-credentials/${role}`, { headers: { "x-aws-ec2-metadata-token": token } }, timeout);
+      const credsRes = await fetchWithTimeout(`${endpoint}/latest/meta-data/iam/security-credentials/${encodeURIComponent(role)}`, { headers: { "x-aws-ec2-metadata-token": token } }, timeout);
       if (!credsRes.ok)
         throw new NetworkError(`IMDS credentials fetch failed: ${credsRes.status}`);
       const data = await credsRes.json();
@@ -14962,9 +15165,24 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
     const response = await computeDigestResponse(challenge, username, password, method, uri, cnonce, nc);
     return formatDigestAuth(challenge, username, response, uri, cnonce, nc);
   }
+  function createDigestAuthorizer() {
+    const counters = /* @__PURE__ */ new Map();
+    return async (wwwAuth, username, password, method, uri) => {
+      const challenge = parseDigestChallenge(wwwAuth);
+      const cnonce = randomBytes(5);
+      const scope = `${challenge.realm}\0${challenge.nonce}`;
+      const next = (counters.get(scope) ?? 0) + 1;
+      counters.set(scope, next);
+      const nc = next.toString(16).padStart(8, "0");
+      const response = await computeDigestResponse(challenge, username, password, method, uri, cnonce, nc);
+      return formatDigestAuth(challenge, username, response, uri, cnonce, nc);
+    };
+  }
 
   // dist/esm/client.js
   init_core();
+  init_core();
+  var DEFAULT_MAX_REDIRECTS = 20;
   var DEFAULT_RETRY = {
     maxRetries: 3,
     baseDelayMs: 300,
@@ -15083,6 +15301,59 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
     "passwd",
     "secret"
   ]);
+  var INTERCEPTOR_RESEND_DEPTH = "__interceptorResendDepth";
+  var MAX_INTERCEPTOR_RESENDS = 5;
+  var HAR_REDACT_PARAMS = /* @__PURE__ */ new Set([
+    "api_key",
+    "apikey",
+    "access_token",
+    "refresh_token",
+    "id_token",
+    "token",
+    "auth",
+    "authorization",
+    "key",
+    "secret",
+    "password",
+    "passwd",
+    "signature",
+    "sig",
+    "x-amz-signature",
+    "x-amz-credential",
+    "x-amz-security-token",
+    "x-goog-signature",
+    "sas",
+    "session",
+    "sessionid",
+    "jwt",
+    "code"
+  ]);
+  var HAR_MAX_BODY_CHARS = 8192;
+  function isHARBodySafeToRecord(contentType) {
+    if (!contentType)
+      return false;
+    const ct = contentType.toLowerCase();
+    return ct.includes("json") || ct.includes("xml") || ct.includes("text/plain") || ct.includes("application/javascript");
+  }
+  function redactHARUrl(url) {
+    try {
+      const u = new URL(url);
+      let changed = false;
+      for (const key of [...u.searchParams.keys()]) {
+        if (HAR_REDACT_PARAMS.has(key.toLowerCase())) {
+          u.searchParams.set(key, "***REDACTED***");
+          changed = true;
+        }
+      }
+      if (u.hash && (u.hash.includes("token") || u.hash.includes("sig") || u.hash.length > 1)) {
+        u.hash = "#***REDACTED***";
+        changed = true;
+      }
+      return changed ? u.toString() : url;
+    } catch {
+      return url.replace(/([?&])(api_key|apikey|access_token|refresh_token|token|secret|password|signature|sig)=([^&#]*)/gi, "$1$2=***REDACTED***");
+    }
+  }
   function redactHARHeader(name, value) {
     return HAR_REDACT_HEADERS.has(name.toLowerCase()) ? { name, value: "***REDACTED***" } : { name, value };
   }
@@ -15118,9 +15389,9 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
       let receiveMs = 0;
       try {
         if (typeof performance !== "undefined" && typeof performance.getEntriesByType === "function") {
-          const entries = performance.getEntriesByType("resource");
-          const entry2 = entries.filter((e) => e.name === res.url).pop();
-          if (entry2 && entry2.requestStart > 0) {
+          const entries = typeof performance.getEntriesByName === "function" ? performance.getEntriesByName(res.url) : performance.getEntriesByType("resource").filter((e) => e.name === res.url);
+          const entry2 = entries[entries.length - 1];
+          if (entry2 && entry2.requestStart > 0 && Date.now() - entry2.startTime < 6e4) {
             sendMs = Math.max(0, entry2.responseStart - entry2.requestStart);
             receiveMs = Math.max(0, entry2.responseEnd - entry2.responseStart);
             waitMs = Math.max(0, total - sendMs - receiveMs);
@@ -15135,12 +15406,16 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
         time: total,
         request: {
           method: req.method,
-          url: req.url,
+          // Redacted: HAR logs are routinely exported and shared, and a query
+          // string is just as leaky as a header (?api_key=, ?access_token=,
+          // ?signature=). Previously only headers were redacted, so the full URL
+          // and every query value landed in the log verbatim.
+          url: redactHARUrl(req.url),
           httpVersion: res.httpVersion,
           headers: Object.entries(req.headers).map(([name, value]) => redactHARHeader(name, value)),
           queryString: (() => {
             try {
-              return Array.from(new URL(req.url).searchParams.entries()).map(([name, value]) => ({
+              return Array.from(new URL(redactHARUrl(req.url)).searchParams.entries()).map(([name, value]) => ({
                 name,
                 value
               }));
@@ -15168,9 +15443,12 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
           content: {
             size: res.rawBody?.byteLength ?? 0,
             mimeType: res.headers["content-type"] ?? "application/octet-stream",
-            ...typeof res.data === "string" ? { text: res.data } : {}
+            // Body text is only kept for non-HTML payloads and is truncated:
+            // response bodies routinely carry tokens and PII.
+            ...typeof res.data === "string" && isHARBodySafeToRecord(res.headers["content-type"]) ? { text: res.data.slice(0, HAR_MAX_BODY_CHARS) } : {}
           },
-          redirectURL: res.headers["location"] ?? "",
+          // The Location header can itself carry a signed URL — redact it too.
+          redirectURL: res.headers["location"] ? redactHARUrl(res.headers["location"]) : "",
           bodySize: res.rawBody?.byteLength ?? 0
         },
         timings: {
@@ -15262,22 +15540,25 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
     }
     return { ...req, headers };
   }
+  var FETCH_SPEC_STRIPPED_ON_REDIRECT = /* @__PURE__ */ new Set(["authorization", "cookie", "proxy-authorization"]);
+  function hasForwardedCredentials(headers, auth) {
+    if (auth && auth.type === "apikey")
+      return true;
+    if (!headers)
+      return false;
+    for (const name of Object.keys(headers)) {
+      const lower = name.toLowerCase();
+      if (CROSS_ORIGIN_STRIP_HEADERS.has(lower) && !FETCH_SPEC_STRIPPED_ON_REDIRECT.has(lower)) {
+        return true;
+      }
+    }
+    return false;
+  }
   var CROSS_ORIGIN_STRIP_HEADERS = /* @__PURE__ */ new Set([
-    "authorization",
-    "cookie",
-    "proxy-authorization",
-    "x-api-key",
-    "x-auth-token",
-    "x-access-token",
-    "x-refresh-token",
-    "x-csrf-token",
-    "x-session-id",
-    "x-session-token",
-    "x-secret",
-    "x-secret-key",
-    "x-private-key",
-    "api-key",
-    "apikey",
+    ...CREDENTIAL_HEADERS,
+    // Response-only per RFC 9110, so it can never legitimately appear on an
+    // outgoing request — kept in the strip list as defence in depth for callers
+    // that copy a full header bag (including response headers) onto a request.
     "www-authenticate"
   ]);
   function redactUserInfo(url) {
@@ -15557,6 +15838,7 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
       }
       if (config.auth?.type === "digest") {
         const digestConfig = config.auth;
+        const digestAuthorizer = createDigestAuthorizer();
         this.interceptors.addResponse(async (ctx) => {
           if (!ctx.response)
             return;
@@ -15568,8 +15850,9 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
           if (ctx.request.meta.__digestRetried)
             return;
           const method = ctx.request.method;
-          const uri = new URL(ctx.request.url).pathname + new URL(ctx.request.url).search;
-          const authHeader = await createDigestAuthorization(wwwAuth, digestConfig.username, digestConfig.password, method, uri);
+          const parsedUrl = new URL(ctx.request.url);
+          const uri = parsedUrl.pathname + parsedUrl.search;
+          const authHeader = await digestAuthorizer(wwwAuth, digestConfig.username, digestConfig.password, method, uri);
           return {
             ...ctx.request,
             headers: { ...ctx.request.headers, authorization: authHeader },
@@ -15665,22 +15948,24 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
       const errEject = this.useError(async (ctx) => {
         if (!ctx.error)
           return;
+        const hookReq = {
+          url: ctx.request.url,
+          method: ctx.request.method,
+          headers: ctx.request.headers,
+          body: ctx.request.body,
+          signal: ctx.request.signal,
+          meta: ctx.request.meta
+        };
+        const errResponse = toHookResponse(ctx.error.response, hookReq);
         const hookErr = {
           error: ctx.error,
-          request: {
-            url: ctx.request.url,
-            method: ctx.request.method,
-            headers: ctx.request.headers,
-            body: ctx.request.body,
-            signal: ctx.request.signal,
-            meta: ctx.request.meta
-          },
-          response: null,
+          request: hookReq,
+          response: errResponse,
           attempt: ctx.attempt
         };
         const hookCtx = {
           request: hookErr.request,
-          response: null,
+          response: errResponse,
           error: ctx.error,
           startedAt: ctx.startedAt,
           attempt: ctx.attempt,
@@ -16180,7 +16465,11 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
         } else if (options.body instanceof ReadableStream) {
           throw new KinetexError(`maxRequestSize cannot be enforced for ReadableStream bodies \u2014 pass maxRequestSize: 0 to opt out, or buffer the body first`, "EVALIDATION");
         } else if (options.body && typeof options.body === "object") {
-          bodySize2 = new TextEncoder().encode(JSON.stringify(options.body)).byteLength;
+          try {
+            bodySize2 = new TextEncoder().encode(JSON.stringify(options.body)).byteLength;
+          } catch (err) {
+            throw new KinetexError(`Cannot measure request body size: ${err instanceof Error ? err.message : String(err)}`, "EVALIDATION");
+          }
         }
         if (bodySize2 > maxRequestSize) {
           throw new KinetexError(`Request body size ${bodySize2} bytes exceeds limit of ${maxRequestSize} bytes`, "EVALIDATION");
@@ -16188,10 +16477,22 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
       }
       let req = {
         url: fullUrl,
-        method,
+        // Use the normalized method, not the caller's casing: `send(url, "patch")`
+        // passed validation above but used to put the literal string "patch" on
+        // the wire. fetch() only normalizes delete/get/head/options/post/put, so a
+        // lowercase PATCH/CONNECT went out verbatim and servers answered 405.
+        method: normalizedMethod,
         headers: mergeHeaders(this.cfg.headers, options.headers),
+        // A plain object/array is accepted by the public API (RequestBody) and is
+        // JSON-encoded in the block immediately below, so the request object only
+        // ever holds a real BodyInit by the time this function returns.
         body: options.body ?? null,
         signal: options.signal ?? null,
+        // Resolved once here so the manual redirect follower sees the same
+        // effective values the caller asked for. Spread (not `??`) because the
+        // project uses exactOptionalPropertyTypes.
+        ...options.followRedirects !== void 0 || this.cfg.followRedirects !== void 0 ? { followRedirects: options.followRedirects ?? this.cfg.followRedirects } : {},
+        ...options.maxRedirects !== void 0 || this.cfg.maxRedirects !== void 0 ? { maxRedirects: options.maxRedirects ?? this.cfg.maxRedirects } : {},
         meta: { ...options.meta },
         httpVersion: options.httpVersion ?? this.cfg.httpVersion ?? "HTTP/2"
       };
@@ -16202,6 +16503,12 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
           body: JSON.stringify(req.body)
         };
       }
+      if (req.body !== null && typeof URLSearchParams !== "undefined" && req.body instanceof URLSearchParams && !req.headers["content-type"]) {
+        req = {
+          ...req,
+          headers: { ...req.headers, "content-type": "application/x-www-form-urlencoded" }
+        };
+      }
       const auth = options.auth !== false ? options.auth ?? this.cfg.auth : void 0;
       if (auth)
         req = await applyAuth(req, auth);
@@ -16214,31 +16521,44 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
           req = { ...req, headers: { ...req.headers, cookie: cookieHeader } };
       }
       let _otelSpan = null;
-      if (this._otelTracer) {
-        _otelSpan = this._otelTracer.startSpan(`HTTP ${req.method}`, {
-          kind: 3
-          /* CLIENT */
-        });
-        const { traceparent, traceId, spanId } = buildTraceparent(_otelSpan);
-        _otelSpan.setAttribute("http.request.method", req.method);
-        _otelSpan.setAttribute("url.full", req.url);
-        try {
-          _otelSpan.setAttribute("server.address", new URL(req.url).hostname);
-        } catch {
+      try {
+        if (this._otelTracer) {
+          _otelSpan = this._otelTracer.startSpan(`HTTP ${req.method}`, {
+            kind: 3
+            /* CLIENT */
+          });
+          const { traceparent, traceId, spanId } = buildTraceparent(_otelSpan);
+          _otelSpan.setAttribute("http.request.method", req.method);
+          _otelSpan.setAttribute("url.full", req.url);
+          try {
+            _otelSpan.setAttribute("server.address", new URL(req.url).hostname);
+          } catch {
+          }
+          req = {
+            ...req,
+            headers: { ...req.headers, traceparent },
+            meta: { ...req.meta, traceId, spanId }
+          };
+        } else if (req.meta["traceId"] && !req.headers["traceparent"]) {
+          const traceId = String(req.meta["traceId"]);
+          const spanId = randomHex(16);
+          req = {
+            ...req,
+            headers: { ...req.headers, traceparent: `00-${traceId}-${spanId}-01` },
+            meta: { ...req.meta, spanId }
+          };
         }
-        req = {
-          ...req,
-          headers: { ...req.headers, traceparent },
-          meta: { ...req.meta, traceId, spanId }
-        };
-      } else if (req.meta["traceId"] && !req.headers["traceparent"]) {
-        const traceId = String(req.meta["traceId"]);
-        const spanId = randomHex(16);
-        req = {
-          ...req,
-          headers: { ...req.headers, traceparent: `00-${traceId}-${spanId}-01` },
-          meta: { ...req.meta, spanId }
-        };
+      } catch (tracingErr) {
+        if (_otelSpan) {
+          _otelSpan.setStatus({
+            code: 2,
+            message: tracingErr instanceof Error ? tracingErr.message : String(tracingErr)
+          });
+          if (tracingErr instanceof Error)
+            _otelSpan.recordException(tracingErr);
+          _otelSpan.end();
+        }
+        throw tracingErr;
       }
       let _cbOrigin;
       if (this._circuitBreakerKeyFn) {
@@ -16255,8 +16575,11 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
         }
       }
       const _execFactory = () => this._executeWithRetry(req, retryCfg, timeoutMs, options, startMs, wallClockMs);
-      const authFp = await getAuthFingerprint(req.headers ?? {});
-      const _dedupKey = `${req.method}:${req.url}${authFp ? ":" + authFp : ""}`;
+      let _dedupKey = "";
+      if (this._dedup) {
+        const authFp = await getAuthFingerprint(req.headers ?? {});
+        _dedupKey = `${req.method}:${req.url}${authFp ? ":" + authFp : ""}`;
+      }
       const _dedupedFactory = this._dedup ? () => this._dedup.execute(req.method, _dedupKey, _execFactory).then((r) => r) : _execFactory;
       const _guardedFactory = this._circuitBreakers ? () => this._circuitBreakers.execute(_cbOrigin, _dedupedFactory).then((r) => r) : _dedupedFactory;
       try {
@@ -16294,7 +16617,10 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
       while (true) {
         attempt++;
         if (req.signal?.aborted) {
-          throw createAbortError();
+          throw createAbortError(req);
+        }
+        if (attempt > 1 && isNonReplayableBody(req.body)) {
+          throw new KinetexError("Cannot retry a request whose body is a stream or Blob \u2014 the body was consumed by the first attempt. Buffer it first, or disable retry for this request.", "EVALIDATION", { request: req });
         }
         try {
           const res = await this._executeOnce(req, timeout, options, startMs, attempt, wallClockMs, retryCfg);
@@ -16320,6 +16646,15 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
           }
           return res;
         } catch (err) {
+          if (globalThis.__KINETEX_DEBUG_RETRY) {
+            console.log("DBG catch", {
+              attempt,
+              maxRetries: retryCfg === false ? "FALSE" : retryCfg?.maxRetries,
+              methods: retryCfg === false ? "FALSE" : retryCfg?.methods,
+              code: err?.code,
+              method: req.method
+            });
+          }
           if (retryCfg && attempt <= retryCfg.maxRetries) {
             const retryCtx = {
               request: req,
@@ -16354,11 +16689,22 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
     // intermediate redirect responses. When a cookie jar is active we must follow
     // redirects ourselves one hop at a time so we can capture cookies at each step.
     /**
-     * Follow redirects manually, one hop at a time, to capture Set-Cookie headers.
-     * fetch() auto-follows redirects but silently drops Set-Cookie from intermediary hops.
+     * Follow redirects manually, one hop at a time.
+     *
+     * Two independent reasons this path exists:
+     *  1. fetch() auto-follows redirects but silently drops Set-Cookie from
+     *     intermediary hops, so an active cookie jar must see every hop itself.
+     *  2. Per the Fetch spec, a cross-origin redirect only drops
+     *     `authorization` / `cookie` / `proxy-authorization`. Custom credential
+     *     headers (apikey, X-Company-Key, ...) are forwarded verbatim, so any
+     *     request carrying one must also be followed manually.
+     *
+     * @param jar - Optional cookie jar. When omitted, no cookie header is
+     *              rebuilt and intermediate Set-Cookie headers are ignored.
      */
     async _sendFollowingRedirects(req, timeout, jar, appliedAuth) {
-      const MAX_REDIRECTS = 20;
+      const maxRedirects = Math.max(0, req.maxRedirects ?? DEFAULT_MAX_REDIRECTS);
+      const followRedirects = req.followRedirects !== false && maxRedirects > 0;
       let currentReq = { ...req, redirect: "manual" };
       const origin0 = (() => {
         try {
@@ -16368,7 +16714,7 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
         }
       })();
       const visited = /* @__PURE__ */ new Set();
-      for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+      for (let hop = 0; hop <= maxRedirects; hop++) {
         if (hop > 0 && appliedAuth) {
           const sameOrigin = (() => {
             try {
@@ -16411,11 +16757,13 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
             });
           }
           visited.add(raw.url);
-          jar.processResponseHeaders(raw.headers, {
+          jar?.processResponseHeaders(raw.headers, {
             url: raw.url
           });
-          if (hop === MAX_REDIRECTS) {
-            throw new KinetexError(`Too many redirects (exceeded ${MAX_REDIRECTS})`, "ENETWORK", {
+          if (!followRedirects)
+            return { ...raw, redirected: true };
+          if (hop === maxRedirects) {
+            throw new KinetexError(`Too many redirects (exceeded ${maxRedirects})`, "ENETWORK", {
               request: req
             });
           }
@@ -16434,6 +16782,12 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
             if (protocol !== "http:" && protocol !== "https:") {
               throw new KinetexError(`Unsafe redirect to ${protocol} detected \u2014 only HTTP(S) allowed`, "ENETWORK", { request: req });
             }
+            if (!isSafeURL(nextUrl)) {
+              throw new KinetexError(`Unsafe redirect target blocked: ${redactUserInfo(location)}`, "EVALIDATION", { request: req });
+            }
+            if (this.cfg.httpsOnly && protocol !== "https:") {
+              throw new KinetexError(`HTTPS-only mode enabled but redirect target uses ${protocol}`, "EVALIDATION", { request: req });
+            }
           } catch (err) {
             if (err instanceof KinetexError)
               throw err;
@@ -16444,21 +16798,30 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
           }
           const nextMethod = raw.status === 301 || raw.status === 302 || raw.status === 303 ? "GET" : currentReq.method;
           const nextBody = nextMethod === "GET" || nextMethod === "HEAD" ? null : currentReq.body;
-          const cookieHeader = jar.getCookieHeader({ url: nextUrl, http: true });
           const nextHeaders = { ...currentReq.headers };
-          if (cookieHeader) {
-            nextHeaders["cookie"] = cookieHeader;
-          } else {
-            delete nextHeaders["cookie"];
-          }
+          let crossOrigin = false;
           try {
-            if (new URL(nextUrl).origin !== new URL(currentReq.url).origin) {
-              for (const h of CROSS_ORIGIN_STRIP_HEADERS) {
-                delete nextHeaders[h];
-              }
-            }
+            crossOrigin = new URL(nextUrl).origin !== new URL(currentReq.url).origin;
           } catch {
           }
+          if (crossOrigin) {
+            for (const h of CROSS_ORIGIN_STRIP_HEADERS) {
+              delete nextHeaders[h];
+            }
+            if (appliedAuth && appliedAuth.type === "apikey") {
+              delete nextHeaders[appliedAuth.header.toLowerCase()];
+            }
+          }
+          if (jar) {
+            const cookieHeader = jar.getCookieHeader({ url: nextUrl, http: true });
+            if (cookieHeader) {
+              nextHeaders["cookie"] = cookieHeader;
+            } else {
+              delete nextHeaders["cookie"];
+            }
+          } else if (crossOrigin) {
+            delete nextHeaders["cookie"];
+          }
           currentReq = {
             ...currentReq,
             url: nextUrl,
@@ -16469,7 +16832,7 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
           };
           continue;
         }
-        return raw;
+        return hop > 0 ? { ...raw, redirected: true } : raw;
       }
       throw new KinetexError("Redirect loop", "ENETWORK", { request: req });
     }
@@ -16556,7 +16919,10 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
                     }
                   }
                 } finally {
-                  (await this.getCache())?.clearSWRInFlight(cacheReq);
+                  try {
+                    (await this.getCache())?.clearSWRInFlight(cacheReq);
+                  } catch {
+                  }
                 }
               })();
             }
@@ -16634,15 +17000,17 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
           ...req,
           headers: {
             ...req.headers,
-            "accept-encoding": "gzip, deflate, br"
+            "accept-encoding": DEFAULT_ACCEPT_ENCODING
           }
         };
       }
       const dispatchJar = await this.getCookieJar();
+      const effectiveAuth = options.auth !== false ? options.auth ?? this.cfg.auth : void 0;
+      const needsManualRedirects = dispatchJar !== null || hasForwardedCredentials(req.headers, effectiveAuth);
       this._trace(_traceId, "transport_send", "start", startMs, attempt);
       let raw;
       try {
-        raw = dispatchJar ? await this._sendFollowingRedirects(req, timeout, dispatchJar, options.auth !== false ? options.auth ?? this.cfg.auth : void 0) : await sendWithTimeout(this.transport, req, timeout);
+        raw = needsManualRedirects ? await this._sendFollowingRedirects(req, timeout, dispatchJar ?? void 0, effectiveAuth) : await sendWithTimeout(this.transport, req, timeout);
       } catch (err) {
         if (_uploadStreamForCleanup) {
           try {
@@ -16686,9 +17054,10 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
           },
           ...req.signal !== null ? { signal: req.signal } : {}
         });
+        const source = bodyStream;
         bodyStream = new ReadableStream({
           async start(controller) {
-            const reader = bodyStream.getReader();
+            const reader = source.getReader();
             try {
               while (true) {
                 const { done, value } = await reader.read();
@@ -16706,8 +17075,9 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
               reader.releaseLock();
             }
           },
-          cancel() {
-            bodyStream?.cancel();
+          cancel(reason) {
+            void source.cancel(reason).catch(() => {
+            });
           }
         });
       }
@@ -16728,7 +17098,9 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
         status: raw.status,
         statusText: raw.statusText,
         headers: raw.headers,
-        data: this.cfg.transformResponse ? this.cfg.transformResponse(data, {}) : data,
+        // transformResponse is applied below, once `res` exists, so it receives
+        // the real response object instead of the `{}` placeholder it used to get.
+        data,
         rawBody,
         url: raw.url,
         cached: false,
@@ -16738,6 +17110,9 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
         request: req,
         attempt
       };
+      if (this.cfg.transformResponse) {
+        res.data = this.cfg.transformResponse(res.data, res);
+      }
       if (options.cache !== false && this.cfg.cache) {
         const cache = await this.getCache();
         if (cache && raw.status !== 304) {
@@ -16806,6 +17181,10 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
         if ("status" in result && "headers" in result) {
           current = result;
         } else if ("url" in result && "method" in result && !("status" in result)) {
+          const resendDepth = Number(_req.meta[INTERCEPTOR_RESEND_DEPTH] ?? 0);
+          if (resendDepth >= MAX_INTERCEPTOR_RESENDS) {
+            throw new KinetexError(`Response interceptor re-send limit reached (${MAX_INTERCEPTOR_RESENDS}) \u2014 refusing to loop`, "EVALIDATION", { request: _req });
+          }
           if (retryCfg && attempt <= retryCfg.maxRetries) {
             const retryCtx = {
               request: _req,
@@ -16822,7 +17201,13 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
             }, Promise.resolve());
             await sleep6(delay, _req.signal);
           }
-          return this._executeOnce(result, timeout, options, startMs, attempt + 1, void 0, retryCfg);
+          return this._executeOnce({
+            ...result,
+            meta: {
+              ...result.meta,
+              [INTERCEPTOR_RESEND_DEPTH]: resendDepth + 1
+            }
+          }, timeout, options, startMs, attempt + 1, void 0, retryCfg);
         }
       }
       return current;
@@ -17100,7 +17485,10 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
      * Call this when the client is no longer needed to prevent memory leaks.
      * @returns A promise that resolves when cleanup is complete.
      */
-    async destroy() {
+    // Not `async`: nothing here awaits, so the returned promise is resolved
+    // explicitly instead. The signature stays Promise<void> — callers and the
+    // docs `await client.destroy()`.
+    destroy() {
       for (const ws of this._wsClients) {
         try {
           ws.close(1e3, "Client destroyed");
@@ -17108,12 +17496,6 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
         }
       }
       this._wsClients.clear();
-      if (this._cache) {
-        try {
-          await this._cache.clear();
-        } catch {
-        }
-      }
       if (IS_NODE && this.transport && "destroy" in this.transport) {
         this.transport.destroy();
       }
@@ -17123,6 +17505,7 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
       this._circuitBreakers?.clear?.();
       this._otelTracer = null;
       this.interceptors.clear();
+      return Promise.resolve();
     }
   };
   var FluentRequest = class {
@@ -17351,13 +17734,19 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
       }).catch((err) => onError?.(err instanceof KinetexError ? err : new KinetexError(String(err), "EUNKNOWN")));
     }
   };
-  function createAbortError() {
-    if (typeof DOMException !== "undefined") {
-      return new DOMException("Aborted", "AbortError");
-    }
-    const err = new Error("Aborted");
-    err.name = "AbortError";
-    return err;
+  function toHookResponse(res, request) {
+    if (!res)
+      return null;
+    return {
+      status: res.status,
+      statusText: res.statusText,
+      headers: res.headers,
+      body: res.rawBody ?? null,
+      request
+    };
+  }
+  function createAbortError(request) {
+    return new AbortError(request);
   }
   function mergeParams(a, b) {
     if (!a && !b)
@@ -17381,6 +17770,11 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
       signal?.addEventListener("abort", onAbort, { once: true });
     });
   }
+  function isNonReplayableBody(body) {
+    if (body instanceof ReadableStream)
+      return true;
+    return typeof Blob !== "undefined" && body instanceof Blob;
+  }
   function perfNow4() {
     return typeof performance !== "undefined" ? performance.now() : Date.now();
   }
@@ -17399,7 +17793,13 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
     constructor(client, options = {}) {
       /** The parent Kinetex instance used to send requests. */
       __publicField(this, "_client");
-      /** Maximum number of requests to flush at once. */
+      /**
+       * Maximum number of requests taken out of the queue per flush.
+       * NOTE: this is a batching size, NOT a concurrency limit — every request in a
+       * batch is dispatched immediately and in parallel, and `flush()` drains the
+       * whole queue the same way. Use `maxBatch` to bound how much is dispatched per
+       * tick, and a semaphore or rate limiter to bound actual parallelism.
+       */
       __publicField(this, "_maxBatch");
       /** Milliseconds to wait before flushing an incomplete batch. */
       __publicField(this, "_flushMs");
@@ -17408,8 +17808,16 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
       /** Timer handle for deferred flush. */
       __publicField(this, "_timer", null);
       this._client = client;
-      this._maxBatch = options.maxBatch ?? 100;
-      this._flushMs = options.flushMs ?? 0;
+      const maxBatch = options.maxBatch ?? 100;
+      if (!Number.isInteger(maxBatch) || maxBatch < 1) {
+        throw new RangeError(`BatchQueue maxBatch must be a positive integer (got ${maxBatch})`);
+      }
+      this._maxBatch = maxBatch;
+      const flushMs = options.flushMs ?? 0;
+      if (!Number.isFinite(flushMs) || flushMs < 0) {
+        throw new RangeError(`BatchQueue flushMs must be a non-negative finite number (got ${flushMs})`);
+      }
+      this._flushMs = flushMs;
     }
     /**
      * Enqueue a request. Returns a promise that resolves when the batch
@@ -17462,7 +17870,8 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
      * Loops until the queue is empty so items beyond maxBatch are not orphaned.
      */
     flush() {
-      while (this._queue.length > 0)
+      let guard = this._queue.length + 1;
+      while (this._queue.length > 0 && guard-- > 0)
         this._flushNow();
     }
     /** How many requests are currently queued (not yet sent). */
@@ -18457,28 +18866,27 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
   }
   var denoTcpConnector = async (host, port, timeoutMs) => {
     const denoGlobal = globalThis;
-    let conn;
-    if (timeoutMs && timeoutMs > 0) {
-      conn = await Promise.race([
-        denoGlobal.Deno.connect({ hostname: host, port, transport: "tcp" }),
-        new Promise((_, rej) => setTimeout(() => rej(new Socks5Error("TCP connect to proxy timed out", "SOCKS5_TIMEOUT", true)), timeoutMs))
-      ]);
-    } else {
-      conn = await denoGlobal.Deno.connect({ hostname: host, port, transport: "tcp" });
-    }
-    const wrappedRead = async (buf) => {
-      if (timeoutMs && timeoutMs > 0) {
-        return Promise.race([
-          conn.read(buf).catch(() => null),
-          new Promise((_, rej) => setTimeout(() => rej(new Socks5Error("TCP read timed out", "SOCKS5_TIMEOUT", true)), timeoutMs))
-        ]);
-      }
+    const withTimeout2 = async (work, message) => {
+      if (!timeoutMs || timeoutMs <= 0)
+        return work;
+      let timer;
       try {
-        return await conn.read(buf);
-      } catch {
-        return null;
+        return await Promise.race([
+          work,
+          new Promise((_, rej) => {
+            timer = setTimeout(() => rej(new Socks5Error(message, "SOCKS5_TIMEOUT", true)), timeoutMs);
+          })
+        ]);
+      } finally {
+        if (timer !== void 0)
+          clearTimeout(timer);
       }
     };
+    const conn = await withTimeout2(denoGlobal.Deno.connect({ hostname: host, port, transport: "tcp" }), "TCP connect to proxy timed out");
+    const wrappedRead = (buf) => {
+      const read = conn.read(buf).catch(() => null);
+      return withTimeout2(read, "TCP read timed out");
+    };
     return {
       read: wrappedRead,
       write: (data) => conn.write(data),
@@ -18531,7 +18939,9 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
           buffer = next;
           flushBuffer();
         });
+        let ended = false;
         socket.on("end", () => {
+          ended = true;
           if (pendingRead) {
             pendingRead(null);
             pendingRead = null;
@@ -18539,6 +18949,9 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
             pendingBuf = null;
           }
         });
+        socket.on("close", () => {
+          ended = true;
+        });
         socket.once("error", (err) => {
           clearTimeout(timer);
           lastError = err;
@@ -18557,6 +18970,10 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
                 rej(lastError);
                 return;
               }
+              if (ended && buffer.length === 0) {
+                res(null);
+                return;
+              }
               if (buffer.length > 0) {
                 const n = Math.min(buffer.length, buf.length);
                 buf.set(buffer.subarray(0, n));