kinetex 1.3.0 → 1.5.0

package/dist/esm/utils.js

@@ -1,9 +1,7 @@
 /**
  * Cross-runtime utilities for type safety, validation, and security.
  */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 let _process;
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 let _Buffer;
 // Check globalThis.process for Node.js runtime detection (no dynamic import needed)
 function getProcess() {
@@ -47,7 +45,17 @@ const DEFAULT_LIMITS = {
  * @returns Parse result with success/failure information
  */
 export function safeJSONParse(text, options = {}) {
-    const limits = { ...DEFAULT_LIMITS, ...options };
+    // `{ ...DEFAULT_LIMITS, ...options }` copies an *explicitly present*
+    // `undefined` straight over a real limit, and every comparison this file
+    // makes is `<=` / `>` against a number — so `{ maxDepth: undefined }` did not
+    // mean "use the default", it meant "there is no depth limit", silently. That
+    // is the shape config plumbing produces (`{ maxDepth: env.MAX_DEPTH }`), and
+    // the `Required<>` on `limits` says the opposite. Only defined values merge.
+    const limits = { ...DEFAULT_LIMITS };
+    for (const [key, value] of Object.entries(options)) {
+        if (value !== undefined)
+            limits[key] = value;
+    }
     // Check string length first
     if (text.length > limits.maxStringLength) {
         return {
@@ -241,6 +249,44 @@ export function parseUntrustedJSON(text) {
 // ============================================================================
 // §2  TYPE GUARDS
 // ============================================================================
+/**
+ * Exact brand test for a platform type.
+ *
+ * `instanceof` is authoritative in the current realm and — unlike a
+ * constructor-name check — survives subclasses, so `new File()` is still a
+ * `Blob`. It fails across realms (an `iframe`'s `Headers` is a different
+ * constructor), so the platform's own `Symbol.toStringTag` is consulted as a
+ * fallback: that is the tag the runtime sets on the real object, and the one
+ * thing a `Map` or a `Set` does not carry.
+ *
+ * The previous guards duck-typed on a *single* method name, which made the
+ * most common built-ins in the language pass for types they are not:
+ * `Map` and `Set` both have `has`, `FormData` has `forEach`, so
+ * `isURLSearchParams(new Map())`, `isURLSearchParams(new Set())` and
+ * `isHeaders(new FormData())` were all `true`. Meanwhile `isBlob` compared
+ * `constructor.name === "Blob"` and rejected every `File`, which is a `Blob`.
+ */
+function hasBrand(value, ctor, tag, required) {
+    if (value === null || typeof value !== "object")
+        return false;
+    if (typeof ctor === "function") {
+        try {
+            if (value instanceof ctor)
+                return true;
+        }
+        catch {
+            // A Proxy with a hostile getPrototypeOf — fall through to the brand.
+        }
+    }
+    // Cross-realm: the runtime's own brand, plus the methods that make the
+    // value usable as the type. The brand alone is one getter away from
+    // anything, and a guard whose whole job is to route a value to the right
+    // code path is not one that should hand it out on a say-so.
+    if (Object.prototype.toString.call(value) !== `[object ${tag}]`)
+        return false;
+    const obj = value;
+    return required.every((m) => typeof obj[m] === "function");
+}
 /**
  * Type guard for Uint8Array.
  *
@@ -266,10 +312,7 @@ export function isArrayBuffer(value) {
  * @returns True if the value is a ReadableStream.
  */
 export function isReadableStream(value) {
-    return (value !== null &&
-        typeof value === "object" &&
-        "getReader" in value &&
-        typeof value.getReader === "function");
+    return hasBrand(value, globalThis.ReadableStream, "ReadableStream", ["getReader", "cancel"]);
 }
 /**
  * Type guard for Headers.
@@ -278,10 +321,7 @@ export function isReadableStream(value) {
  * @returns True if the value is a Headers instance.
  */
 export function isHeaders(value) {
-    return (value !== null &&
-        typeof value === "object" &&
-        "forEach" in value &&
-        typeof value.forEach === "function");
+    return hasBrand(value, globalThis.Headers, "Headers", ["get", "set", "append", "forEach"]);
 }
 /**
  * Type guard for AbortSignal.
@@ -290,10 +330,10 @@ export function isHeaders(value) {
  * @returns True if the value is an AbortSignal.
  */
 export function isAbortSignal(value) {
-    return (value !== null &&
-        typeof value === "object" &&
-        "aborted" in value &&
-        typeof value.aborted === "boolean");
+    return hasBrand(value, globalThis.AbortSignal, "AbortSignal", [
+        "addEventListener",
+        "removeEventListener",
+    ]);
 }
 /**
  * Type guard for plain objects (\[object Object\]).
@@ -302,9 +342,17 @@ export function isAbortSignal(value) {
  * @returns True if the value is a plain Object.
  */
 export function isPlainObject(value) {
-    return (value !== null &&
-        typeof value === "object" &&
-        Object.prototype.toString.call(value) === "[object Object]");
+    if (value === null || typeof value !== "object")
+        return false;
+    // `Object.prototype.toString.call(x) === "[object Object]"` is the classic
+    // wrong way to write this: it is true for *every* object whose class does
+    // not override Symbol.toStringTag, so `new (class { constructor() { this.a = 1 } })()`
+    // passed — which is the opposite of what "plain" means, and the reason the
+    // guard cannot be trusted for the copy/merge decisions its name invites.
+    // What makes an object plain is its prototype: Object.prototype, or none at
+    // all (a null-prototype object is a dictionary, and still plain).
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
 }
 /**
  * Type guard for FormData.
@@ -313,9 +361,7 @@ export function isPlainObject(value) {
  * @returns True if the value is a FormData instance.
  */
 export function isFormData(value) {
-    return (value !== null &&
-        typeof value === "object" &&
-        value.constructor?.name === "FormData");
+    return hasBrand(value, globalThis.FormData, "FormData", ["append", "get", "getAll", "set"]);
 }
 /**
  * Type guard for Blob.
@@ -324,7 +370,10 @@ export function isFormData(value) {
  * @returns True if the value is a Blob instance.
  */
 export function isBlob(value) {
-    return (value !== null && typeof value === "object" && value.constructor?.name === "Blob");
+    // File extends Blob, and its own brand is "[object File]", so this is
+    // `instanceof`-first on purpose: a constructor-name check rejected every
+    // File, which is the single most common Blob-shaped value in a browser.
+    return hasBrand(value, globalThis.Blob, "Blob", ["arrayBuffer", "slice", "text", "stream"]);
 }
 /**
  * Type guard for URLSearchParams.
@@ -333,10 +382,12 @@ export function isBlob(value) {
  * @returns True if the value is a URLSearchParams instance.
  */
 export function isURLSearchParams(value) {
-    return (value !== null &&
-        typeof value === "object" &&
-        "has" in value &&
-        typeof value.has === "function");
+    return hasBrand(value, globalThis.URLSearchParams, "URLSearchParams", [
+        "append",
+        "get",
+        "getAll",
+        "sort",
+    ]);
 }
 // ============================================================================
 // §3  VALIDATION UTILITIES
@@ -366,13 +417,21 @@ export function isValidHeaderValue(value) {
         return false;
     if (value.length > 8192)
         return false; // Reasonable length limit
-    // Header values can contain any ASCII except CTLs and CRLF (header injection)
-    // Per RFC 7230, HT (0x09) is allowed in header values
+    // RFC 9110 §5.5: field-value is VCHAR / SP / HTAB / obs-text, where obs-text
+    // is %x80-FF. So a value may hold the Latin-1 range and nothing above it —
+    // there is no upper bound in the loop, which accepted an emoji and then let
+    // the very next `new Headers({ "X-A": "\u{1F600}" })` throw
+    // "Cannot convert argument to a ByteString because the character at index 0
+    // has a value of 55357". This guard is what a caller checks first, so a
+    // "valid" verdict that the runtime then refuses is worse than no verdict.
     for (let i = 0; i < value.length; i++) {
         const code = value.charCodeAt(i);
-        // No control characters (0-31 except 9=HT), 127
-        // No CRLF (13 = \r, 10 = \n) - prevents header injection
-        if ((code < 32 && code !== 9) || code === 127 || code === 13 || code === 10)
+        // No control characters (0-31 except 9=HT) and no DEL — CR and LF are
+        // inside that range, so this is also the header-injection guard.
+        if ((code < 32 && code !== 9) || code === 127)
+            return false;
+        // Above obs-text: a code point no ByteString header value can carry.
+        if (code > 0xff)
             return false;
     }
     return true;
@@ -581,9 +640,7 @@ function isBlockedIPv6(b) {
     if (b[0] === 0x20 && b[1] === 0x01 && b[2] === 0x0d && b[3] === 0xb8)
         return true;
     // ::ffff:0:0/96 — IPv4-mapped → apply the IPv4 checks to the tail
-    if (b.slice(0, 10).every((x) => x === 0) &&
-        b[10] === 0xff &&
-        b[11] === 0xff) {
+    if (b.slice(0, 10).every((x) => x === 0) && b[10] === 0xff && b[11] === 0xff) {
         return isBlockedIPv4(read32(12));
     }
     // ::/96 — deprecated IPv4-compatible → apply the IPv4 checks to the tail
@@ -611,7 +668,7 @@ function isBlockedIPv6(b) {
  * @param allowedSchemes - Allowed URL schemes
  * @returns True if URL is safe
  */
-export function isSafeURL(url, allowedSchemes = ["http", "https"]) {
+export function isSafeURL(url, allowedSchemes = ["http", "https"], options = {}) {
     try {
         const parsed = typeof url === "string" ? new URL(url) : url;
         const scheme = parsed.protocol.replace(/:$/, "").toLowerCase();
@@ -623,25 +680,31 @@ export function isSafeURL(url, allowedSchemes = ["http", "https"]) {
         if (FORBIDDEN_SCHEMES.has(scheme)) {
             return false;
         }
-        let host = parsed.hostname.toLowerCase();
-        const isV6Literal = host.startsWith("[") && host.endsWith("]");
-        if (isV6Literal)
-            host = host.slice(1, -1);
-        // Block loopback hostnames (including *.localhost subdomains)
-        if (host === "localhost" || host.endsWith(".localhost") || host === "0.0.0.0")
-            return false;
-        // Block private/reserved IPs (SSRF prevention) — numeric comparison over
-        // expanded bytes so every IPv6 spelling and numeric IPv4 form is covered.
-        if (isV6Literal || host.includes(":")) {
-            const v6 = parseIPv6Host(host);
-            // Unparseable IPv6 literal → reject defensively
-            if (v6 === null || isBlockedIPv6(v6))
-                return false;
-        }
-        else {
-            const v4 = parseIPv4Host(host);
-            if (v4 !== null && isBlockedIPv4(v4))
+        // `allowPrivateNetwork` relaxes *only* the address checks below. Scheme,
+        // path traversal, hostname length, URL length and port validation are not
+        // about where the socket lands, so they still apply — otherwise opting in to
+        // a loopback fixture would also silently opt in to `file:` and `../`.
+        if (!options.allowPrivateNetwork) {
+            let host = parsed.hostname.toLowerCase();
+            const isV6Literal = host.startsWith("[") && host.endsWith("]");
+            if (isV6Literal)
+                host = host.slice(1, -1);
+            // Block loopback hostnames (including *.localhost subdomains)
+            if (host === "localhost" || host.endsWith(".localhost") || host === "0.0.0.0")
                 return false;
+            // Block private/reserved IPs (SSRF prevention) — numeric comparison over
+            // expanded bytes so every IPv6 spelling and numeric IPv4 form is covered.
+            if (isV6Literal || host.includes(":")) {
+                const v6 = parseIPv6Host(host);
+                // Unparseable IPv6 literal → reject defensively
+                if (v6 === null || isBlockedIPv6(v6))
+                    return false;
+            }
+            else {
+                const v4 = parseIPv4Host(host);
+                if (v4 !== null && isBlockedIPv4(v4))
+                    return false;
+            }
         }
         // Check for suspicious patterns (path traversal)
         if (parsed.hostname.includes("..") || parsed.pathname.includes("..")) {
@@ -666,6 +729,35 @@ export function isSafeURL(url, allowedSchemes = ["http", "https"]) {
         return false;
     }
 }
+/**
+ * True when a literal IPv4/IPv6 address falls in a blocked range.
+ *
+ * The same decision `isSafeURL` makes about a hostname, applied to an address
+ * that has already been resolved. Kept separate from `isSafeURL` because the two
+ * answer different questions: `isSafeURL` reads what the caller wrote, this
+ * reads what the resolver returned. Both are needed — see
+ * `createPinnedLookup` in `core.ts`, which is the only thing that stops a
+ * hostname that resolves to a private address from being dialled.
+ *
+ * IPv4 literals are accepted in every form a resolver can return (dotted-quad
+ * and numeric); anything unparseable is treated as blocked, so an address this
+ * cannot understand fails closed rather than open.
+ */
+export function isBlockedAddress(address) {
+    const host = address.trim().toLowerCase();
+    if (host.startsWith("[") && host.endsWith("]"))
+        return true;
+    if (host === "" || host === "localhost" || host.endsWith(".localhost"))
+        return true;
+    if (host.includes(":")) {
+        const v6 = parseIPv6Host(host);
+        return v6 === null || isBlockedIPv6(v6);
+    }
+    // A resolver returns dotted-quad, but `parseIPv4Host` also accepts the
+    // numeric spellings, and a non-IP string must not be read as "safe".
+    const v4 = parseIPv4Host(host);
+    return v4 === null || isBlockedIPv4(v4);
+}
 /**
  * Check if a URL is absolute (has a scheme).
  *
@@ -712,7 +804,24 @@ export function deepClone(value) {
         value.forEach((v) => cloned.add(deepClone(v)));
         return cloned;
     }
-    const cloned = {};
+    // A class instance is rebuilt on *its own* prototype. The walk below
+    // produced a bare `{}` for every object that was not a plain one, so
+    // `deepClone(new (class { m() { return 1 } })())` came back as an `Object`
+    // with `m` gone — the clone was no longer the thing it was cloned from, and
+    // the failure was silent until something called a method. `new (proto)()` is
+    // not generally callable, so the instance is created with its prototype
+    // attached and its own properties copied across.
+    //
+    // A *host* object — RegExp, URL, a typed array, an Error — is not: those
+    // carry internal slots that `Object.create` cannot produce, and
+    // `Object.create(RegExp.prototype)` satisfies `instanceof` while throwing
+    // "called on non-RegExp object" the moment a getter is touched. The brand is
+    // the discriminator, and it is exact: a class instance reports the plain
+    // `[object Object]`, because the brand comes from the runtime, not the
+    // constructor. Those keep the dictionary form they always had.
+    const proto = Object.getPrototypeOf(value);
+    const isClassInstance = Object.prototype.toString.call(value) === "[object Object]";
+    const cloned = proto === Object.prototype || proto === null || !isClassInstance ? {} : Object.create(proto);
     for (const key in value) {
         // Prototype-pollution guard: never copy __proto__ / constructor / prototype
         if (key === "__proto__" || key === "constructor" || key === "prototype")
@@ -742,7 +851,27 @@ export function isPromise(value) {
  */
 export function createStructuredError(message, context) {
     const error = new Error(message);
-    Object.assign(error, context);
+    // `Object.assign` writes through [[Set]], so a context carrying an *own*
+    // `__proto__` key — which is exactly what `JSON.parse('{"__proto\u003a…}')`
+    // produces, and what a caller forwarding a remote error payload hands over —
+    // did not add a field. It reached the inherited `__proto__` setter and
+    // replaced the error's prototype, so the attacker-supplied object sat in the
+    // prototype chain of every error the client then went on to format, log or
+    // inspect. The one key that has to be expressible is written as a data
+    // property, which is what was meant.
+    for (const key of Object.keys(context)) {
+        const value = context[key];
+        if (key === "__proto__") {
+            Object.defineProperty(error, key, {
+                value,
+                writable: true,
+                enumerable: true,
+                configurable: true,
+            });
+            continue;
+        }
+        error[key] = value;
+    }
     return error;
 }
 /**
@@ -758,11 +887,40 @@ export function formatError(error) {
                 context[key] = value;
             }
         }
-        const contextStr = Object.keys(context).length > 0 ? ` | ${JSON.stringify(context)}` : "";
+        const contextStr = Object.keys(context).length > 0 ? ` | ${safeStringify(context)}` : "";
         return `${error.name}: ${error.message}${contextStr}`;
     }
     return String(error);
 }
+/**
+ * `JSON.stringify` for a log line, on a value that is very likely to be
+ * hostile.
+ *
+ * The context attached by {@link createStructuredError} is whatever the failing
+ * call had in hand — a `request`, a `response`, a `cause` — and all three
+ * routinely point back at each other. `JSON.stringify` answers that with a
+ * thrown `TypeError: Converting circular structure to JSON`, and a BigInt with
+ * another, so the function whose entire job is to turn an error into a string
+ * threw instead, taking the `catch` that was logging it down with it.
+ */
+export function safeStringify(value, circularMarker = "[Circular]") {
+    const seen = new Set();
+    try {
+        return (JSON.stringify(value, (_key, v) => {
+            if (typeof v === "bigint")
+                return v.toString();
+            if (typeof v === "object" && v !== null) {
+                if (seen.has(v))
+                    return circularMarker;
+                seen.add(v);
+            }
+            return v;
+        }) ?? String(value));
+    }
+    catch {
+        return String(value);
+    }
+}
 // ============================================================================
 // §5  TIME UTILITIES
 // ============================================================================
@@ -823,12 +981,12 @@ export function perfNow() {
  */
 export function sleep(ms, signal) {
     if (signal?.aborted) {
-        return Promise.reject(_abortError());
+        return Promise.reject(abortError());
     }
     return new Promise((resolve, reject) => {
         const onAbort = () => {
             clearTimeout(timer);
-            reject(_abortError());
+            reject(abortError());
         };
         const timer = setTimeout(() => {
             signal?.removeEventListener("abort", onAbort); // cleanup on normal completion
@@ -865,10 +1023,16 @@ export function concatUint8Arrays(chunks) {
  * @returns Uint8Array or null if unsupported type
  */
 export function toUint8Array(data) {
+    // Both branches copy. The Uint8Array branch sliced but the ArrayBuffer
+    // branch wrapped, so the same call handed back a copy for one input type and
+    // a live view for the other: writing to the result of
+    // `toUint8Array(buffer)` wrote through to the caller's buffer, and two calls
+    // given the same buffer shared it. A function whose output is "the bytes" has
+    // to be the same kind of thing whichever type it was handed.
     if (data instanceof Uint8Array)
         return data.slice();
     if (data instanceof ArrayBuffer)
-        return new Uint8Array(data);
+        return new Uint8Array(data.slice(0));
     const b = getBuffer();
     if (b && b.isBuffer(data)) {
         return new Uint8Array(data);
@@ -888,6 +1052,50 @@ export function toUint8Array(data) {
  * @param bytes The buffer to encode.
  * @returns Base64-encoded string.
  */
+/**
+ * SHA-256 of a string or byte array, as lowercase hex.
+ *
+ * The `ArrayBuffer` slice is not optional. `crypto.subtle.digest` takes an
+ * `ArrayBuffer`, and a `Uint8Array`'s `.buffer` is the whole backing store —
+ * pass it directly and a view that starts partway into a larger buffer gets
+ * hashed from offset zero, hashing the wrong bytes. Three copies of this
+ * function existed and one of them made exactly that mistake.
+ */
+/**
+ * Copy `headers`, replacing the value of any name in `sensitive` with `mask`.
+ *
+ * The comparison is case-insensitive because HTTP header names are, and the
+ * caller's set is folded once here rather than at each call site — which is
+ * what `noUncheckedIndexedAccess` makes expensive elsewhere, where every
+ * consumer ends up writing `headers["x"] ?? headers["X"]` to find a header that
+ * was only ever stored under one spelling.
+ *
+ * `mask` is a parameter rather than a constant because four call sites already
+ * disagreed on it: the logger and the lifecycle hooks wrote `"***"`, the
+ * logging interceptor wrote `"**REDACTED**"`, and the HAR recorder wrote
+ * `"***REDACTED***"`. Those strings are observable in log output, so unifying
+ * them is a behaviour change and is deliberately not made here — but they are
+ * now in one function, so a future decision to converge is a one-line edit.
+ */
+/** True when `name` is one of `sensitive`, compared case-insensitively. */
+export function isSensitiveHeader(name, sensitive) {
+    return sensitive.has(name.toLowerCase());
+}
+export function redactHeaders(headers, sensitive, mask) {
+    const out = {};
+    for (const [k, v] of Object.entries(headers)) {
+        out[k] = isSensitiveHeader(k, sensitive) ? mask : v;
+    }
+    return out;
+}
+export async function sha256Hex(data) {
+    const raw = typeof data === "string" ? new TextEncoder().encode(data) : data;
+    const buf = raw.buffer.slice(raw.byteOffset, raw.byteOffset + raw.byteLength);
+    const hash = await crypto.subtle.digest("SHA-256", buf);
+    return Array.from(new Uint8Array(hash))
+        .map((b) => b.toString(16).padStart(2, "0"))
+        .join("");
+}
 export function uint8ArrayToBase64(bytes) {
     // Process in 3-byte (24-bit) aligned chunks to avoid padding issues mid-stream.
     // 3 × 2¹³ = 24 576 bytes per chunk — keeps individual strings small.
@@ -929,25 +1137,44 @@ export function mergeSignals(...signals) {
     }
     if (validSignals.length === 1)
         return validSignals[0];
-    // Check if any signal is already aborted
-    if (validSignals.some((s) => s.aborted)) {
+    // Check if any signal is already aborted.
+    //
+    // `controller.abort()` with no argument installs the platform's generic
+    // `AbortError: This operation was aborted`, which threw away *why* the call
+    // was aborted. The two-live-signal branch below preserves the reason, and so
+    // does the `AbortSignal.any` path this function prefers on every current
+    // runtime — so the one case a caller is most likely to hit (a signal that
+    // already fired, e.g. `AbortSignal.timeout()`) was the only one that lost
+    // it. `interceptors.ts` re-aborts with `existing.reason` when merging, and
+    // anything reading the merged signal's reason saw a bare AbortError where it
+    // should have seen the caller's TimeoutError or their own Error.
+    const preAborted = validSignals.find((s) => s.aborted);
+    if (preAborted) {
         const controller = new AbortController();
-        controller.abort();
+        controller.abort(preAborted.reason);
         return controller.signal;
     }
+    // The platform primitive, where it exists. The hand-rolled version below
+    // attached an `abort` listener to every input and only ever removed it when
+    // one of those inputs fired — so merging a long-lived caller signal (a
+    // request-scoped controller is the usual one) accumulated one listener per
+    // merge, forever, and tripped Node's MaxListenersExceededWarning at 11.
+    // The "9.11" self-cleanup that was supposed to release them could not run:
+    // the merged controller is never handed out, so nothing but the inputs can
+    // ever abort it. `AbortSignal.any` holds its inputs weakly and adds nothing
+    // observable to them. Node 20.3+, Deno, Bun and current browsers have it;
+    // the manual path remains for Node 18 and older.
+    const nativeAny = AbortSignal.any;
+    if (typeof nativeAny === "function") {
+        return nativeAny.call(AbortSignal, validSignals);
+    }
     const controller = new AbortController();
     // abort: fire the controller and clean up ALL listeners immediately.
     const abort = () => {
         for (const s of validSignals)
             s.removeEventListener("abort", abort);
-        controller.abort(_abortError());
+        controller.abort(abortError());
     };
-    // 9.11: when the merged signal itself aborts (e.g. from another path), also clean up.
-    // This prevents listener accumulation when callers abort the controller externally.
-    controller.signal.addEventListener("abort", () => {
-        for (const s of validSignals)
-            s.removeEventListener("abort", abort);
-    }, { once: true });
     for (const s of validSignals)
         s.addEventListener("abort", abort, { once: true });
     return controller.signal;
@@ -1001,11 +1228,20 @@ export function randomBytes(byteCount) {
         .join("");
 }
 // Cross-runtime error creation: DOMException may not exist in all runtimes.
-function _abortError() {
+/**
+ * A platform-shaped abort rejection: a `DOMException` named `AbortError` where
+ * one exists, and a plain `Error` carrying the same name where it does not.
+ *
+ * `message` is a parameter because two callers need different text for the same
+ * event, and they had each written this function. It is deliberately not
+ * `AbortError` from `types.ts`: that is a `KinetexError` with code `EABORT`, a
+ * different and equally deliberate contract used by the request pipeline.
+ */
+export function abortError(message = "Aborted") {
     if (typeof DOMException !== "undefined") {
-        return new DOMException("Aborted", "AbortError");
+        return new DOMException(message, "AbortError");
     }
-    const err = new Error("Aborted");
+    const err = new Error(message);
     err.name = "AbortError";
     return err;
 }
@@ -1088,7 +1324,33 @@ export function hasNativeFetch() {
 export function normalizeHeaders(headers) {
     const result = {};
     headers.forEach((value, key) => {
-        result[key.toLowerCase()] = value;
+        const name = key.toLowerCase();
+        // `__proto__` is a legal header name — it is made of token characters — and
+        // `result[name] = value` is a [[Set]], so a response carrying it went
+        // through the inherited setter, which ignores a primitive. The header did
+        // not overwrite anything; it simply disappeared, and the caller reading the
+        // normalized record never learned the response had sent it.
+        if (name === "__proto__") {
+            Object.defineProperty(result, name, {
+                value,
+                writable: true,
+                enumerable: true,
+                configurable: true,
+            });
+            return;
+        }
+        // `Set-Cookie` is the one header the Fetch spec does NOT combine: it
+        // yields each cookie as a separate `forEach` entry, while every other
+        // repeated header arrives already joined with ", ". Assigning therefore
+        // overwrote: a response setting two cookies normalized to the last one
+        // only, and the first vanished with no error anywhere. `Headers.get()`
+        // reports them combined as "a=1, b=2", so accumulate to match it — the
+        // cookie jar splits this form back apart with `splitSetCookieHeaders`.
+        if (name === "set-cookie" && Object.hasOwn(result, name)) {
+            result[name] = `${result[name]}, ${value}`;
+            return;
+        }
+        result[name] = value;
     });
     return result;
 }