kinetex 1.3.0 → 1.5.0

package/dist/cjs/logging.js

@@ -27,7 +27,7 @@
  */
 // FIX (H6): logged bodies are untrusted — parsed JSON is stripped of
 // prototype-pollution keys before redaction writes (see sanitizeParsedJSON).
-import { sanitizeParsedJSON } from "./utils.js";
+import { sanitizeParsedJSON, perfNow, redactHeaders, safeStringify as stringifySafely, } from "./utils.js";
 // Cross-runtime: safely detect Node.js process.env
 const getNodeEnv = () => {
     try {
@@ -120,6 +120,17 @@ const DEFAULT_REDACT_PARAMS = [
  * Requests/responses with other content-types will have their body replaced
  * with a short indicator (e.g. "[binary]") instead of being logged verbatim.
  */
+/**
+ * Is this a JSON media type?
+ *
+ * `application/json` and every `+json` structured suffix, case-insensitively
+ * and ignoring parameters, because RFC 9110 makes media types
+ * case-insensitive and `application/JSON; charset=utf-8` is the same type.
+ */
+function isJSONContentType(contentType) {
+    const type = contentType.split(";", 1)[0].trim().toLowerCase();
+    return type === "application/json" || type === "text/json" || type.endsWith("+json");
+}
 const DEFAULT_ALLOWED_BODY_TYPES = [
     "application/json",
     "application/x-www-form-urlencoded",
@@ -137,12 +148,14 @@ export class ConsoleTransport {
     /**
      * @param opts - Console transport options
      */
-    constructor(opts = {
-        pretty: false,
-        onWrite: (output) => console.log(output),
-    }) {
+    constructor(opts = {}) {
+        // `pretty` resolves the same way whether the caller passed nothing, `{}`, or
+        // a full options object. The old default parameter hard-coded `pretty: false`
+        // for the no-argument form only, so `new ConsoleTransport()` emitted JSON
+        // while `new ConsoleTransport({ onWrite })` emitted pretty output outside
+        // production — the opposite of the documented default.
         this.pretty = opts.pretty ?? getNodeEnv() !== "production";
-        this.onWrite = opts.onWrite;
+        this.onWrite = opts.onWrite ?? ((output) => console.log(output));
         // useColors reserved for future ANSI colorization
         void opts.useColors;
     }
@@ -254,6 +267,16 @@ export class BatchingTransport {
     }
     /** Internal flush — sends all buffered entries to inner transport. */
     _flush() {
+        // A size-triggered flush has to disarm the pending timer as well. Leaving
+        // it armed meant `write()`'s `if (!this.timer)` guard stayed false for the
+        // next entry, so nothing scheduled a fresh interval: entries written after
+        // a full batch waited out the remainder of the previous batch's timer, and a
+        // process that hit `maxBatch` and then went quiet held the interval for the
+        // whole `flushMs` with an empty buffer.
+        if (this.timer !== null) {
+            clearTimeout(this.timer);
+            this.timer = null;
+        }
         if (this.buffer.length === 0)
             return;
         const batch = this.buffer.splice(0);
@@ -302,6 +325,12 @@ export class RemoteTransport {
     }
     /** Fire-and-forget flush with error handling. */
     _flush() {
+        // Same disarming as BatchingTransport: a size-triggered flush must not
+        // leave the next entry without a timer of its own.
+        if (this.timer !== null) {
+            clearTimeout(this.timer);
+            this.timer = null;
+        }
         this._flushAsync().catch(this.options.onError ?? ((err) => console.error("[logging] Flush error:", err)));
     }
     /** Async flush implementation — sends batch via HTTP POST. */
@@ -433,13 +462,18 @@ export class Redactor {
     }
     /** Redact sensitive header values, replacing them with "***". */
     redactHeaders(headers) {
-        const out = {};
-        for (const [k, v] of Object.entries(headers)) {
-            out[k] = this.headerSet.has(k.toLowerCase()) ? "***" : v;
-        }
-        return out;
+        return redactHeaders(headers, this.headerSet, "***");
     }
-    /** Redact sensitive query parameters from a URL. */
+    /**
+     * Redact sensitive query parameters from a URL.
+     *
+     * Absolute URLs go through `URL`, which also normalises the result. A URL the
+     * `URL` constructor rejects — every relative form, and relative forms are what
+     * `HTTPLogger.child`'s own example logs — used to be returned untouched, so
+     * `logRequest(id, "GET", "/users?token=abc", ...)` wrote the token in clear
+     * while the absolute spelling of the same request redacted it. Those fall back
+     * to a textual scan of the query string below.
+     */
     redactURL(url) {
         try {
             const u = new URL(url);
@@ -451,9 +485,41 @@ export class Redactor {
             return u.toString();
         }
         catch {
-            return url;
+            return this._redactRelativeQuery(url);
         }
     }
+    /** Redact the query string of a URL the `URL` constructor cannot parse. */
+    _redactRelativeQuery(url) {
+        const q = url.indexOf("?");
+        if (q === -1)
+            return url;
+        const base = url.slice(0, q);
+        const rest = url.slice(q + 1);
+        const hash = rest.indexOf("#");
+        const fragment = hash === -1 ? "" : rest.slice(hash);
+        const query = hash === -1 ? rest : rest.slice(0, hash);
+        const params = query.split("&").map((pair) => {
+            if (pair === "")
+                return pair;
+            const eq = pair.indexOf("=");
+            const name = eq === -1 ? pair : pair.slice(0, eq);
+            let decoded = name;
+            try {
+                decoded = decodeURIComponent(name);
+            }
+            catch {
+                /* keep the raw name if it is not valid percent-encoding */
+            }
+            if (!this.paramSet.has(decoded.toLowerCase()))
+                return pair;
+            // A valueless parameter (`?token`) is redacted to `token=***` rather than
+            // left as the bare name, so the redaction stays visible. The value, when
+            // there is one, is discarded either way — which is why this used to be
+            // written as a ternary whose two arms were the same string.
+            return `${name}=***`;
+        });
+        return `${base}?${params.join("&")}${fragment}`;
+    }
     /**
      * Redact and optionally truncate a request or response body.
      *
@@ -470,6 +536,12 @@ export class Redactor {
         if (!allowed) {
             return { body: `[${ct || "binary"}]`, size: body ? bodySize(body) : null };
         }
+        // The size of the body *as received*, measured before any lossy decoding.
+        // Two invalid UTF-8 bytes decode to two U+FFFD characters that re-encode to
+        // 6 bytes, and reporting 6 for a 2-byte body is a size of nothing the caller
+        // sent. `maxBodyLength` is applied to the re-encoded form below, which is
+        // what actually gets written out.
+        const size = bodySize(body);
         let str;
         if (body instanceof Uint8Array) {
             try {
@@ -482,9 +554,14 @@ export class Redactor {
         else {
             str = body;
         }
-        const size = str.length;
-        // Redact body fields (JSON)
-        if (ct.includes("application/json") && this.bodyFields.length > 0) {
+        // Redact body fields (JSON). The test has to be at least as wide as the
+        // `allowedBodyTypes` gate above: that one uses `startsWith` on a
+        // caller-configured list, so a config of `["application/"]` lets a
+        // `application/vnd.api+json` body through — and this narrower
+        // `includes("application/json")` then logged its `password` field in the
+        // clear. `+json` is the registered suffix form (RFC 6839) and this library
+        // already parses it as JSON elsewhere, so the redactor has to agree.
+        if (isJSONContentType(ct) && this.bodyFields.length > 0) {
             try {
                 // FIX (H6): log bodies are untrusted — sanitize before mutation so a
                 // crafted payload cannot smuggle __proto__ paths into redaction writes.
@@ -501,9 +578,12 @@ export class Redactor {
         for (const pattern of this.patterns) {
             str = str.replace(pattern, "***");
         }
-        // Truncate
-        if (str.length > this.maxBody) {
-            str = str.slice(0, this.maxBody) + `... [truncated ${str.length - this.maxBody} bytes]`;
+        // Truncate by UTF-8 bytes, which is the unit `maxBodyLength` is documented
+        // in, and never split a multi-byte character in half.
+        const afterRedaction = bodySize(str);
+        if (afterRedaction > this.maxBody) {
+            const cut = truncateToBytes(str, this.maxBody);
+            str = `${cut.text}... [truncated ${cut.removed} bytes]`;
         }
         return { body: str, size };
     }
@@ -512,6 +592,15 @@ export class Redactor {
 function redactObjectPath(obj, path) {
     if (!obj || typeof obj !== "object" || path.length === 0)
         return;
+    // A JSON array was skipped outright: `bodyFields: ["password"]` only ever
+    // matched a top-level key, so a bulk payload — `[{"password":"…"}]`, the
+    // shape of most collection endpoints — logged its secrets in clear while
+    // the identical object form was redacted. Apply the path to every element.
+    if (Array.isArray(obj)) {
+        for (const item of obj)
+            redactObjectPath(item, path);
+        return;
+    }
     const [head, ...rest] = path;
     if (head === undefined)
         return;
@@ -642,6 +731,13 @@ export class HTTPLogger {
         const dur = active ? perfNow() - active.startMs : 0;
         const method = active?.method ?? "GET";
         const url = active?.url ?? "";
+        // The active ID is released before the filter runs, not after. A response
+        // dropped by `statuses` / `level` / `excludeURLs` / sampling returned early
+        // and left its entry in `activeIds` forever: the only cleanup is a
+        // size-triggered sweep inside `logRequest`, so a service logging with a
+        // narrow status filter accumulated one dead entry per request until it
+        // reached 10000 and started evicting live ones.
+        this.activeIds.delete(requestId);
         if (!this._shouldLog("INFO", method, url, status))
             return;
         const ct = headers["content-type"] ?? headers["Content-Type"] ?? null;
@@ -665,7 +761,6 @@ export class HTTPLogger {
             cached,
             meta: { ...this.cfg.context, ...meta },
         };
-        this.activeIds.delete(requestId);
         this._write(entry);
     }
     /**
@@ -682,6 +777,8 @@ export class HTTPLogger {
         const dur = active ? perfNow() - active.startMs : 0;
         const method = active?.method ?? "GET";
         const url = active?.url ?? "";
+        // Released before the filter, for the same reason as `logResponse`.
+        this.activeIds.delete(requestId);
         if (!this._shouldLog("ERROR", method, url))
             return;
         const entry = {
@@ -698,7 +795,6 @@ export class HTTPLogger {
             attempt,
             meta: { ...this.cfg.context, ...meta },
         };
-        this.activeIds.delete(requestId);
         this._write(entry);
     }
     // ── §7.2  ID management ────────────────────────────────────────────────────
@@ -838,11 +934,51 @@ function serializeError(err) {
             ...(errStack !== undefined ? { stack: errStack } : {}),
         };
     }
+    // Anything else was `String(err)`, which for a rejected object — the shape a
+    // custom fetch, a GraphQL client or a worker produces — is literally
+    // "[object Object]". The entry recorded no message and no `code`, so the log
+    // said only that something had failed. An error-shaped object keeps its
+    // `name`, `message`, `code` and `stack`; anything else is stringified
+    // structurally.
+    if (err !== null && typeof err === "object") {
+        const o = err;
+        const out = {
+            name: typeof o.name === "string" && o.name !== "" ? o.name : "Error",
+            message: typeof o.message === "string" ? o.message : safeStringify(err),
+        };
+        if (typeof o.code === "string" || typeof o.code === "number")
+            out.code = String(o.code);
+        if (typeof o.stack === "string")
+            out.stack = o.stack;
+        return out;
+    }
     return { name: "Error", message: String(err) };
 }
-/** Cross-runtime high-resolution timer. Falls back to Date.now() when performance.now() is unavailable. */
-function perfNow() {
-    return typeof performance !== "undefined" ? performance.now() : Date.now();
+/** `JSON.stringify` that never throws — falls back for circular values. */
+// The marker is lowercase here and capitalised in the shared helper. Both are
+// asserted by tests and both appear in log output, so this converges on one
+// implementation without converging on one string.
+const CIRCULAR_MARKER = "[circular]";
+const safeStringify = (value) => stringifySafely(value, CIRCULAR_MARKER);
+/**
+ * Truncate a string to at most `maxBytes` UTF-8 bytes, never splitting a
+ * character, and report how many bytes were actually removed.
+ */
+function truncateToBytes(str, maxBytes) {
+    const enc = new TextEncoder();
+    const total = enc.encode(str).byteLength;
+    if (total <= maxBytes)
+        return { text: str, removed: 0 };
+    let used = 0;
+    let end = 0;
+    for (const ch of str) {
+        const width = enc.encode(ch).byteLength;
+        if (used + width > maxBytes)
+            break;
+        used += width;
+        end += ch.length;
+    }
+    return { text: str.slice(0, end), removed: total - used };
 }
 // ============================================================================
 // §10  FACTORY HELPERS

package/dist/cjs/mod.js

@@ -44,13 +44,13 @@ export { parseCookieDate, getPublicSuffix, getRegistrableDomain, isPublicSuffix,
 // core.ts exports
 export { HAS_NATIVE_FETCH, createTransport, parseBody, sendWithTimeout, readRawBody, decompressBodyStream, } from "./core.js";
 // digest.ts exports
-export { parseDigestChallenge, computeDigestResponse, formatDigestAuth, createDigestAuthorization, } from "./digest.js";
+export { parseDigestChallenge, computeDigestResponse, computeUsernameStar, formatDigestAuth, createDigestAuthorization, } from "./digest.js";
 // graphql.ts exports
 export { clearAPQCache, getAPQMetrics, authLink, errorLink, loggingLink, retryLink, } from "./graphql.js";
 // headers.ts exports
 export { HeaderName, formatContentType, parseContentDisposition, formatContentDisposition, parseWWWAuthenticate, formatBearer, formatBasic, parseAccept, parseAcceptEncoding, parseAcceptLanguage, negotiateContentType, parseRange, parseContentRange, formatLinkHeader, parseForwarded, normalizeForwardedHeaders, getClientIP, parseRetryAfter, parseHSTS, formatHSTS, parseCSP, formatCSP, parseServerTiming, formatServerTiming, parseAltSvc, parseContentLanguage, parseWarning, parseParams, fromNodeHeaders, toNodeHeaders, fromWebHeaders, securityHeaders, corsHeaders, RichHeaders, createHeaders, createRequestHeaders, createResponseHeaders, createImmutableHeaders, } from "./headers.js";
 // interceptors.ts exports
-export { createRetryInterceptor, createAuthInterceptor, createTimeoutInterceptor, createLoggingInterceptor, createCacheInterceptor, createDedupeInterceptor, createRateLimitInterceptor, RateLimitError, createHARInterceptor, createMetricsInterceptor, createInterceptorSuite, computeBodySize, } from "./interceptors.js";
+export { createRetryInterceptor, createAuthInterceptor, createTimeoutInterceptor, createLoggingInterceptor, createCacheInterceptor, createDedupeInterceptor, createRateLimitInterceptor, RateLimitError, ConcurrencyLimiter, CONCURRENCY_DEFAULTS, ConcurrencyLimitError, createHARInterceptor, createMetricsInterceptor, createInterceptorSuite, computeBodySize, } from "./interceptors.js";
 // lifecycle.ts exports
 export { RedirectTracker, TooManyRedirectsError, tap, injectHeaders, withBaseURL, throwOnHTTPError, validateResponse, HTTPError, ResponseValidationError, composeBeforeRequest, composeBeforeResponse, composeAround, createLoggingHooks, createTimingHook, createBodyNormalizationHook, createAbortHook, createHookContext, } from "./lifecycle.js";
 // logging.ts exports
@@ -94,5 +94,6 @@ export { InterceptorManager } from "./interceptors.js";
 export { HookRegistry, HookEmitter } from "./lifecycle.js";
 export { CircuitBreaker, CircuitBreakerRegistry, CircuitOpenError, createCircuitBreaker, createCircuitBreakerRegistry, } from "./circuit-breaker.js";
 export { DedupMap, createDedupMap } from "./dedup.js";
+export { generateIdempotencyKey, isValidIdempotencyKey } from "./headers.js";
 // ── Utilities ────────────────────────────────────────────────────────────────
 export { safeJSONParse, tryParseJSON, parseUntrustedJSON, sanitizeParsedJSON, isUint8Array, isArrayBuffer, isReadableStream, isHeaders, isAbortSignal, isPlainObject, isFormData, isBlob, isURLSearchParams, isValidHeaderName, isValidHeaderValue, isSafeURL, sanitizeURL, createStructuredError, formatError, perfNow, sleep, concatUint8Arrays, toUint8Array, uint8ArrayToBase64, deepClone, normalizeHeaders, mergeSignals, isAbortError, getRuntime, isNodeEnvironment, isBrowserEnvironment, hasNativeFetch, } from "./utils.js";