kinetex 1.4.0 → 1.5.0

package/dist/browser/kinetex.js

@@ -1,4 +1,4 @@
-/* kinetex v1.4.0 | MIT | https://github.com/kinetexjs/kinetex */
+/* kinetex v1.5.0 | MIT | https://github.com/kinetexjs/kinetex */
 "use strict";
 var kinetex = (() => {
   var __create = Object.create;
@@ -422,7 +422,7 @@ var kinetex = (() => {
     }
     return false;
   }
-  function isSafeURL(url, allowedSchemes = ["http", "https"]) {
+  function isSafeURL(url, allowedSchemes = ["http", "https"], options = {}) {
     try {
       const parsed = typeof url === "string" ? new URL(url) : url;
       const scheme = parsed.protocol.replace(/:$/, "").toLowerCase();
@@ -432,20 +432,22 @@ var kinetex = (() => {
       if (FORBIDDEN_SCHEMES.has(scheme)) {
         return false;
       }
-      let host = parsed.hostname.toLowerCase();
-      const isV6Literal = host.startsWith("[") && host.endsWith("]");
-      if (isV6Literal)
-        host = host.slice(1, -1);
-      if (host === "localhost" || host.endsWith(".localhost") || host === "0.0.0.0")
-        return false;
-      if (isV6Literal || host.includes(":")) {
-        const v6 = parseIPv6Host(host);
-        if (v6 === null || isBlockedIPv6(v6))
-          return false;
-      } else {
-        const v4 = parseIPv4Host(host);
-        if (v4 !== null && isBlockedIPv4(v4))
+      if (!options.allowPrivateNetwork) {
+        let host = parsed.hostname.toLowerCase();
+        const isV6Literal = host.startsWith("[") && host.endsWith("]");
+        if (isV6Literal)
+          host = host.slice(1, -1);
+        if (host === "localhost" || host.endsWith(".localhost") || host === "0.0.0.0")
           return false;
+        if (isV6Literal || host.includes(":")) {
+          const v6 = parseIPv6Host(host);
+          if (v6 === null || isBlockedIPv6(v6))
+            return false;
+        } else {
+          const v4 = parseIPv4Host(host);
+          if (v4 !== null && isBlockedIPv4(v4))
+            return false;
+        }
       }
       if (parsed.hostname.includes("..") || parsed.pathname.includes("..")) {
         return false;
@@ -465,6 +467,19 @@ var kinetex = (() => {
       return false;
     }
   }
+  function isBlockedAddress(address) {
+    const host = address.trim().toLowerCase();
+    if (host.startsWith("[") && host.endsWith("]"))
+      return true;
+    if (host === "" || host === "localhost" || host.endsWith(".localhost"))
+      return true;
+    if (host.includes(":")) {
+      const v6 = parseIPv6Host(host);
+      return v6 === null || isBlockedIPv6(v6);
+    }
+    const v4 = parseIPv4Host(host);
+    return v4 === null || isBlockedIPv4(v4);
+  }
   function deepClone(value) {
     if (value === null || typeof value !== "object") {
       return value;
@@ -530,7 +545,7 @@ var kinetex = (() => {
     }
     return String(error);
   }
-  function safeStringify(value) {
+  function safeStringify(value, circularMarker = "[Circular]") {
     const seen = /* @__PURE__ */ new Set();
     try {
       return JSON.stringify(value, (_key, v) => {
@@ -538,7 +553,7 @@ var kinetex = (() => {
           return v.toString();
         if (typeof v === "object" && v !== null) {
           if (seen.has(v))
-            return "[Circular]";
+            return circularMarker;
           seen.add(v);
         }
         return v;
@@ -564,7 +579,7 @@ var kinetex = (() => {
       return null;
     }
   }
-  function perfNow2() {
+  function perfNow() {
     const p = getProcess();
     if (p?.hrtime) {
       const [sec, ns] = p.hrtime();
@@ -578,12 +593,12 @@ var kinetex = (() => {
   }
   function sleep(ms, signal) {
     if (signal?.aborted) {
-      return Promise.reject(_abortError());
+      return Promise.reject(abortError());
     }
     return new Promise((resolve, reject) => {
       const onAbort = () => {
         clearTimeout(timer);
-        reject(_abortError());
+        reject(abortError());
       };
       const timer = setTimeout(() => {
         signal?.removeEventListener("abort", onAbort);
@@ -620,6 +635,22 @@ var kinetex = (() => {
     }
     return null;
   }
+  function isSensitiveHeader(name, sensitive) {
+    return sensitive.has(name.toLowerCase());
+  }
+  function redactHeaders(headers, sensitive, mask) {
+    const out = {};
+    for (const [k, v] of Object.entries(headers)) {
+      out[k] = isSensitiveHeader(k, sensitive) ? mask : v;
+    }
+    return out;
+  }
+  async function sha256Hex(data) {
+    const raw = typeof data === "string" ? new TextEncoder().encode(data) : data;
+    const buf = raw.buffer.slice(raw.byteOffset, raw.byteOffset + raw.byteLength);
+    const hash = await crypto.subtle.digest("SHA-256", buf);
+    return Array.from(new Uint8Array(hash)).map((b) => b.toString(16).padStart(2, "0")).join("");
+  }
   function uint8ArrayToBase64(bytes) {
     const CHUNK = 24576;
     if (bytes.byteLength <= CHUNK) {
@@ -661,7 +692,7 @@ var kinetex = (() => {
     const abort = () => {
       for (const s of validSignals)
         s.removeEventListener("abort", abort);
-      controller.abort(_abortError());
+      controller.abort(abortError());
     };
     for (const s of validSignals)
       s.addEventListener("abort", abort, { once: true });
@@ -691,11 +722,11 @@ var kinetex = (() => {
     }
     return Array.from(arr).map((b) => b.toString(16).padStart(2, "0")).join("");
   }
-  function _abortError() {
+  function abortError(message = "Aborted") {
     if (typeof DOMException !== "undefined") {
-      return new DOMException("Aborted", "AbortError");
+      return new DOMException(message, "AbortError");
     }
-    const err = new Error("Aborted");
+    const err = new Error(message);
     err.name = "AbortError";
     return err;
   }
@@ -1124,6 +1155,9 @@ var kinetex = (() => {
     if (honor && d.noStore) {
       return { ttlMs: 0, swrMs: 0, staleOnError: 0, shouldCache: false };
     }
+    if (honor && d.private) {
+      return { ttlMs: 0, swrMs: 0, staleOnError: 0, shouldCache: false };
+    }
     const maxAgeSecs = d.sMaxAge ?? d.maxAge;
     let ttlMs;
     if (maxAgeSecs !== null) {
@@ -2300,7 +2334,7 @@ var kinetex = (() => {
             continue;
           const k = t.slice(0, eq).trim().toLowerCase();
           let v = t.slice(eq + 1).trim();
-          if (v.startsWith('"') && v.endsWith('"'))
+          if (v.length >= 2 && v.startsWith('"') && v.endsWith('"'))
             v = v.slice(1, -1);
           params.set(k, v);
         }
@@ -3895,522 +3929,217 @@ var kinetex = (() => {
     }
   });
 
-  // dist/esm/proxy.js
-  var proxy_exports = {};
-  __export(proxy_exports, {
-    connectThroughProxy: () => connectThroughProxy
+  // dist/esm/response.js
+  var response_exports = {};
+  __export(response_exports, {
+    ContentTypeError: () => ContentTypeError,
+    HTTPResponseError: () => HTTPResponseError,
+    ResponseCache: () => ResponseCache,
+    ResponseDecodeError: () => ResponseDecodeError,
+    ResponseSizeLimitError: () => ResponseSizeLimitError,
+    applyDecompression: () => applyDecompression,
+    assertOk: () => assertOk,
+    assertOkJSON: () => assertOkJSON,
+    createLimitedReader: () => createLimitedReader,
+    decodeBody: () => decodeBody,
+    decompressStream: () => decompressStream,
+    diffResponses: () => diffResponses,
+    extractServerTiming: () => extractServerTiming,
+    isBinary: () => isBinary,
+    isJSON: () => isJSON,
+    isText: () => isText,
+    limitAction: () => limitAction,
+    normalizeHeaders: () => normalizeHeaders2,
+    normalizeResponse: () => normalizeResponse,
+    parseContentType: () => parseContentType2,
+    parseMultipartResponse: () => parseMultipartResponse,
+    readBlob: () => readBlob,
+    readBodyWithLimit: () => readBodyWithLimit,
+    readBytes: () => readBytes,
+    readFormData: () => readFormData,
+    readJSON: () => readJSON,
+    readJSONStream: () => readJSONStream,
+    readNDJSON: () => readNDJSON,
+    readStream: () => readStream,
+    readText: () => readText
   });
-  function isSocksProxy(url) {
-    return /^socks5h?:/i.test(url);
+  function normalizeHeaders2(headers) {
+    return normalizeHeaders(headers);
   }
-  function proxyAuthHeader(proxy) {
-    if (proxy.username === void 0)
-      return void 0;
-    const raw = `${proxy.username}:${proxy.password ?? ""}`;
-    const bytes = new TextEncoder().encode(raw);
-    let binary = "";
-    for (const b of bytes)
-      binary += String.fromCharCode(b);
-    const b64 = typeof globalThis.btoa === "function" ? globalThis.btoa(binary) : (
-      // Node without btoa (or a non-Latin1 username) — encode explicitly.
-      Buffer.from(bytes).toString("base64")
-    );
-    return `Basic ${b64}`;
+  function normalizeResponse(response) {
+    return {
+      status: response.status,
+      statusText: response.statusText,
+      headers: normalizeHeaders2(response.headers),
+      url: response.url,
+      redirected: response.redirected,
+      ok: response.ok,
+      bodyUsed: response.bodyUsed
+    };
   }
-  function parseConnectStatus(head) {
-    const statusLine = head.split("\r\n", 1)[0] ?? "";
-    const match = /^HTTP\/1\.[01] (\d{3})(?: (.*))?$/.exec(statusLine);
-    if (!match)
+  function parseContentType2(value) {
+    if (!value)
       return null;
-    return { status: Number(match[1]), reason: match[2] ?? "" };
+    if (value.length > MAX_HEADER_LENGTH)
+      return null;
+    const parsed = parseContentType(value);
+    if (!parsed)
+      return null;
+    return {
+      mediaType: parsed.mediaType,
+      type: parsed.type,
+      subtype: parsed.subtype,
+      charset: parsed.charset,
+      boundary: parsed.boundary
+    };
   }
-  async function connectThroughProxy(proxy, target, options = {}) {
-    const errMeta = options.request !== void 0 ? { request: options.request } : {};
-    if (isSocksProxy(proxy.url)) {
-      throw new KinetexError(`proxy url "${proxy.url}" is a SOCKS proxy, which needs a different mechanism. Use createSocks5Tunnel() from kinetex/socks5 and supply your own fetch over the tunnel.`, "EVALIDATION", errMeta);
-    }
-    let proxyUrl;
-    try {
-      proxyUrl = new URL(proxy.url);
-    } catch (err) {
-      throw new KinetexError(`proxy url "${proxy.url}" is not a valid URL`, "EVALIDATION", {
-        ...errMeta,
-        cause: err
+  function isJSON(contentType) {
+    if (!contentType)
+      return false;
+    const info = parseContentType2(contentType);
+    if (!info)
+      return false;
+    return info.mediaType === "application/json" || info.subtype.endsWith("+json");
+  }
+  function isText(contentType) {
+    if (!contentType)
+      return false;
+    const info = parseContentType2(contentType);
+    return info?.type === "text";
+  }
+  function isBinary(contentType) {
+    return !isText(contentType) && !isJSON(contentType);
+  }
+  function readWithAbort(reader, signal) {
+    if (!signal)
+      return reader.read();
+    if (signal.aborted)
+      return Promise.resolve({ done: true, value: void 0 });
+    return new Promise((resolve, reject) => {
+      const onAbort = () => {
+        void reader.cancel("aborted").catch(() => {
+        });
+        resolve({ done: true, value: void 0 });
+      };
+      signal.addEventListener("abort", onAbort, { once: true });
+      reader.read().then(resolve, reject).finally(() => {
+        signal.removeEventListener("abort", onAbort);
       });
+    });
+  }
+  function normaliseOnExceed(mode) {
+    return mode === "truncate" || mode === "abort" ? mode : "throw";
+  }
+  function limitAction(chunk, bytesRead, limit, onExceed, makeError) {
+    const newTotal = bytesRead + chunk.byteLength;
+    if (newTotal <= limit.maxBytes)
+      return { kind: "keep" };
+    limit.onExceedCallback?.(newTotal, limit.maxBytes);
+    if (onExceed === "throw")
+      throw makeError(newTotal, limit.maxBytes);
+    if (onExceed === "truncate") {
+      const remaining = limit.maxBytes - bytesRead;
+      return { kind: "truncate", chunk: chunk.slice(0, remaining) };
     }
-    if (proxyUrl.protocol !== "http:" && proxyUrl.protocol !== "https:") {
-      throw new KinetexError(`proxy url scheme "${proxyUrl.protocol}" is not supported; use http:, https:, socks5: or socks5h:`, "EVALIDATION", errMeta);
-    }
-    const net = await import("node:net");
-    const tls = await import("node:tls");
-    const proxyPort = proxyUrl.port ? Number(proxyUrl.port) : proxyUrl.protocol === "https:" ? 443 : 80;
-    const targetPort = target.port ? Number(target.port) : target.protocol === "https:" ? 443 : 80;
-    const authority = `${target.hostname}:${targetPort}`;
-    const timeoutMs = options.connectTimeoutMs ?? DEFAULT_CONNECT_TIMEOUT_MS;
-    const baseSocket = proxyUrl.protocol === "https:" ? await openTlsSocket(tls, {
-      host: proxyUrl.hostname,
-      port: proxyPort,
-      servername: proxyUrl.hostname,
-      ...options.ca !== void 0 ? { ca: options.ca } : {}
-    }, timeoutMs, options.signal, errMeta, `proxy ${proxyUrl.host}`) : await openTcpSocket(net, { host: proxyUrl.hostname, port: proxyPort }, timeoutMs, options.signal, errMeta, `proxy ${proxyUrl.host}`);
-    const auth = proxyAuthHeader(proxy);
-    const connectLines = [
-      `CONNECT ${authority} HTTP/1.1`,
-      `Host: ${authority}`,
-      // RFC 9110 §9.3.6: proxies that support persistent tunnels are expected to
-      // treat a tunnel as still-open even without this, but sending it is what
-      // every real client does and some proxies misbehave without it.
-      "Proxy-Connection: Keep-Alive",
-      ...auth !== void 0 ? [`Proxy-Authorization: ${auth}`] : [],
-      "",
-      ""
-    ];
-    baseSocket.write(connectLines.join("\r\n"));
-    let head = "";
-    const headResult = await new Promise((resolve) => {
-      const drain = () => {
-        for (; ; ) {
-          const chunk = baseSocket.read();
-          if (chunk === null)
-            return;
-          head += chunk.toString("latin1");
+    return { kind: "stop" };
+  }
+  async function readBodyWithLimit(stream, url, limit, signal) {
+    const onExceed = normaliseOnExceed(limit.onExceed);
+    const reader = stream.getReader();
+    const chunks = [];
+    let bytesRead = 0;
+    try {
+      while (true) {
+        if (signal?.aborted) {
+          await reader.cancel("aborted");
+          throw new DOMException("Response reading aborted", "AbortError");
         }
-      };
-      const onReadable = () => {
-        drain();
-        const end = head.indexOf("\r\n\r\n");
-        if (end === -1) {
-          if (head.length > MAX_HEAD_BYTES) {
-            cleanup();
-            resolve({
-              ok: false,
-              err: new KinetexError("Proxy sent an oversized CONNECT response", "EPROXY", errMeta)
-            });
+        const { done, value } = await readWithAbort(reader, signal);
+        if (done) {
+          if (signal?.aborted) {
+            throw new DOMException("Response reading aborted", "AbortError");
           }
-          return;
+          break;
         }
-        cleanup();
-        const parsed = parseConnectStatus(head.slice(0, end));
-        if (!parsed) {
-          resolve({
-            ok: false,
-            err: new KinetexError(`Proxy returned a malformed CONNECT response: ${JSON.stringify(head.slice(0, end).split("\r\n", 1)[0] ?? "")}`, "EPROXY", errMeta)
-          });
-          return;
+        let action;
+        try {
+          action = limitAction(value, bytesRead, limit, onExceed, (n, max) => new ResponseSizeLimitError(n, max, url));
+        } catch (err) {
+          await reader.cancel("size limit exceeded");
+          throw err;
         }
-        if (parsed.status >= 200 && parsed.status < 300) {
-          const tail = head.slice(end + 4);
-          if (tail.length > 0)
-            baseSocket.unshift(Buffer.from(tail, "latin1"));
-          resolve({ ok: true });
-          return;
+        if (action.kind === "stop") {
+          await reader.cancel("size limit exceeded");
+          break;
         }
-        if (parsed.status === 407) {
-          resolve({
-            ok: false,
-            err: new KinetexError("Proxy requires authentication (407). Set `username`/`password` on the proxy config, or embed them in the proxy URL.", "EPROXY", errMeta)
-          });
-          return;
+        if (action.kind === "truncate") {
+          chunks.push(action.chunk);
+          bytesRead += action.chunk.byteLength;
+          break;
         }
-        resolve({
-          ok: false,
-          err: new KinetexError(`Proxy refused CONNECT to ${authority}: ${parsed.status} ${parsed.reason}`.trim(), "EPROXY", errMeta)
+        chunks.push(value);
+        bytesRead += value.byteLength;
+      }
+    } finally {
+      if (signal?.aborted) {
+        await reader.cancel("aborted").catch(() => {
         });
-      };
-      const onError = (e) => {
-        cleanup();
-        resolve({
-          ok: false,
-          err: new KinetexError(`Proxy connection failed: ${e.message}`, "ENETWORK", {
-            ...errMeta,
-            cause: e
-          })
-        });
-      };
-      const onClosedEarly = () => {
-        cleanup();
-        resolve({
-          ok: false,
-          err: new KinetexError(`Proxy closed the connection before answering CONNECT for ${authority}`, "EPROXY", errMeta)
-        });
-      };
-      const onTimeout = () => {
-        cleanup();
-        baseSocket.destroy();
-        resolve({
-          ok: false,
-          err: new KinetexError(`Proxy did not respond to CONNECT for ${authority} within ${timeoutMs}ms`, "ETIMEOUT", errMeta)
-        });
-      };
-      const onAbort = () => {
-        cleanup();
-        baseSocket.destroy();
-        resolve({
-          ok: false,
-          err: new KinetexError("Proxy connection aborted", "EABORT", errMeta)
-        });
-      };
-      const timer = setTimeout(onTimeout, timeoutMs);
-      if (typeof timer.unref === "function") {
-        timer.unref();
-      }
-      function cleanup() {
-        clearTimeout(timer);
-        baseSocket.off("readable", onReadable);
-        baseSocket.off("error", onError);
-        baseSocket.off("end", onClosedEarly);
-        baseSocket.off("close", onClosedEarly);
-        baseSocket.off("timeout", onTimeout);
-        options.signal?.removeEventListener("abort", onAbort);
       }
-      baseSocket.on("readable", onReadable);
-      baseSocket.once("error", onError);
-      baseSocket.once("end", onClosedEarly);
-      baseSocket.once("close", onClosedEarly);
-      baseSocket.setTimeout(timeoutMs, onTimeout);
-      options.signal?.addEventListener("abort", onAbort, { once: true });
-      drain();
-    });
-    if (!headResult.ok) {
-      baseSocket.destroy();
-      throw headResult.err;
+      reader.releaseLock();
     }
-    if (target.protocol !== "https:") {
-      baseSocket.setTimeout(0);
-      return baseSocket;
+    return concatUint8Arrays2(chunks);
+  }
+  function resolveCharset(charset) {
+    if (!charset)
+      return "utf-8";
+    const key = charset.toLowerCase().trim();
+    if (Object.prototype.hasOwnProperty.call(CHARSET_ALIASES, key)) {
+      return CHARSET_ALIASES[key];
     }
-    return await new Promise((resolve, reject) => {
-      const onTunnelTimeout = () => {
-        done();
-        baseSocket.destroy();
-        reject(new KinetexError(`TLS handshake through proxy to ${target.hostname} did not complete within ${timeoutMs}ms`, "ETIMEOUT", errMeta));
-      };
-      const onTunnelAbort = () => {
-        done();
-        baseSocket.destroy();
-        reject(new KinetexError("Proxy connection aborted", "EABORT", errMeta));
-      };
-      const tunnelTimer = setTimeout(onTunnelTimeout, timeoutMs);
-      if (typeof tunnelTimer.unref === "function") {
-        tunnelTimer.unref();
-      }
-      options.signal?.addEventListener("abort", onTunnelAbort, { once: true });
-      function done() {
-        clearTimeout(tunnelTimer);
-        options.signal?.removeEventListener("abort", onTunnelAbort);
-      }
-      const secure = tls.connect(
-        {
-          socket: baseSocket,
-          servername: options.servername ?? target.hostname,
-          ...options.ca !== void 0 ? { ca: options.ca } : {}
-        },
-        // `rejectUnauthorized` is left at its default (true), so a peer that
-        // fails verification emits `error` rather than reaching this callback.
-        // Verification therefore cannot be bypassed here, and the callback
-        // only ever runs for a verified handshake.
-        () => {
-          done();
-          baseSocket.setTimeout(0);
-          resolve(secure);
-        }
-      );
-      secure.once("error", (e) => {
-        done();
-        baseSocket.destroy();
-        reject(new KinetexError(`TLS handshake through proxy failed for ${target.hostname}: ${e.message}`, "ENETWORK", { ...errMeta, cause: e }));
-      });
-    });
+    return "utf-8";
   }
-  async function openTcpSocket(net, opts, timeoutMs, signal, errMeta, what) {
-    return await new Promise((resolve, reject) => {
-      const socket = net.connect({ host: opts.host, port: opts.port });
-      const onError = (e) => {
-        cleanup();
-        reject(new KinetexError(`Cannot reach ${what}: ${e.message}`, "ENETWORK", {
-          ...errMeta,
-          cause: e
-        }));
-      };
-      const timer = setTimeout(() => {
-        cleanup();
-        socket.destroy();
-        reject(new KinetexError(`Connecting to ${what} timed out`, "ETIMEOUT", errMeta));
-      }, timeoutMs);
-      if (typeof timer.unref === "function") {
-        timer.unref();
-      }
-      const onAbort = () => {
-        cleanup();
-        socket.destroy();
-        reject(new KinetexError("Proxy connection aborted", "EABORT", errMeta));
-      };
-      function cleanup() {
-        clearTimeout(timer);
-        socket.off("error", onError);
-        signal?.removeEventListener("abort", onAbort);
-      }
-      socket.once("error", onError);
-      socket.once("connect", () => {
-        cleanup();
-        resolve(socket);
-      });
-      if (signal?.aborted)
-        onAbort();
-      else
-        signal?.addEventListener("abort", onAbort, { once: true });
-    });
+  function detectBOM(bytes) {
+    if (bytes[0] === 239 && bytes[1] === 187 && bytes[2] === 191)
+      return "utf-8";
+    if (bytes[0] === 255 && bytes[1] === 254)
+      return "utf-16le";
+    if (bytes[0] === 254 && bytes[1] === 255)
+      return "utf-16be";
+    return null;
   }
-  async function openTlsSocket(tls, opts, timeoutMs, signal, errMeta, what) {
-    return await new Promise((resolve, reject) => {
-      const socket = tls.connect({
-        host: opts.host,
-        port: opts.port,
-        servername: opts.servername,
-        ...opts.ca !== void 0 ? { ca: opts.ca } : {}
-      }, () => {
-        cleanup();
-        resolve(socket);
-      });
-      const onError = (e) => {
-        cleanup();
-        reject(new KinetexError(`Cannot reach ${what}: ${e.message}`, "ENETWORK", {
-          ...errMeta,
-          cause: e
-        }));
-      };
-      const timer = setTimeout(() => {
-        cleanup();
-        socket.destroy();
-        reject(new KinetexError(`Connecting to ${what} timed out`, "ETIMEOUT", errMeta));
-      }, timeoutMs);
-      if (typeof timer.unref === "function") {
-        timer.unref();
+  function decodeBody(bytes, charset, url) {
+    const detected = detectBOM(bytes);
+    const resolved = detected ?? resolveCharset(charset);
+    const data = detected ? bytes.slice(detected === "utf-8" ? 3 : 2) : bytes;
+    try {
+      return new TextDecoder(resolved, { fatal: true }).decode(data);
+    } catch {
+      try {
+        return new TextDecoder(resolved, { fatal: false }).decode(data);
+      } catch (err2) {
+        throw new ResponseDecodeError(String(err2), resolved, url ?? "<unknown url>");
       }
-      const onAbort = () => {
-        cleanup();
-        socket.destroy();
-        reject(new KinetexError("Proxy connection aborted", "EABORT", errMeta));
-      };
-      function cleanup() {
-        clearTimeout(timer);
-        socket.off("error", onError);
-        signal?.removeEventListener("abort", onAbort);
+    }
+  }
+  function createSizeLimitedDecompression(stream, encoding, maxDecompressedSize = 1e8) {
+    const decompressed = decompressStream(stream, encoding);
+    let bytesRead = 0;
+    const sizeLimitTransform = new TransformStream({
+      transform(chunk, controller) {
+        bytesRead += chunk.byteLength;
+        if (bytesRead > maxDecompressedSize) {
+          controller.error(new ResponseSizeLimitError(bytesRead, maxDecompressedSize, "decompression"));
+          return;
+        }
+        controller.enqueue(chunk);
       }
-      socket.once("error", onError);
-      if (signal?.aborted)
-        onAbort();
-      else
-        signal?.addEventListener("abort", onAbort, { once: true });
     });
+    return decompressed.pipeThrough(sizeLimitTransform);
   }
-  var DEFAULT_CONNECT_TIMEOUT_MS, MAX_HEAD_BYTES;
-  var init_proxy = __esm({
-    "dist/esm/proxy.js"() {
-      "use strict";
-      init_types();
-      DEFAULT_CONNECT_TIMEOUT_MS = 3e4;
-      MAX_HEAD_BYTES = 64 * 1024;
-    }
-  });
-
-  // dist/esm/response.js
-  var response_exports = {};
-  __export(response_exports, {
-    ContentTypeError: () => ContentTypeError,
-    HTTPResponseError: () => HTTPResponseError,
-    ResponseCache: () => ResponseCache,
-    ResponseDecodeError: () => ResponseDecodeError,
-    ResponseSizeLimitError: () => ResponseSizeLimitError,
-    applyDecompression: () => applyDecompression,
-    assertOk: () => assertOk,
-    assertOkJSON: () => assertOkJSON,
-    createLimitedReader: () => createLimitedReader,
-    decodeBody: () => decodeBody,
-    decompressStream: () => decompressStream,
-    diffResponses: () => diffResponses,
-    extractServerTiming: () => extractServerTiming,
-    isBinary: () => isBinary,
-    isJSON: () => isJSON,
-    isText: () => isText,
-    normalizeHeaders: () => normalizeHeaders2,
-    normalizeResponse: () => normalizeResponse,
-    parseContentType: () => parseContentType2,
-    parseMultipartResponse: () => parseMultipartResponse,
-    readBlob: () => readBlob,
-    readBodyWithLimit: () => readBodyWithLimit,
-    readBytes: () => readBytes,
-    readFormData: () => readFormData,
-    readJSON: () => readJSON,
-    readJSONStream: () => readJSONStream,
-    readNDJSON: () => readNDJSON,
-    readStream: () => readStream,
-    readText: () => readText
-  });
-  function normalizeHeaders2(headers) {
-    return normalizeHeaders(headers);
-  }
-  function normalizeResponse(response) {
-    return {
-      status: response.status,
-      statusText: response.statusText,
-      headers: normalizeHeaders2(response.headers),
-      url: response.url,
-      redirected: response.redirected,
-      ok: response.ok,
-      bodyUsed: response.bodyUsed
-    };
-  }
-  function parseContentType2(value) {
-    if (!value)
-      return null;
-    if (value.length > MAX_HEADER_LENGTH)
-      return null;
-    const parsed = parseContentType(value);
-    if (!parsed)
-      return null;
-    return {
-      mediaType: parsed.mediaType,
-      type: parsed.type,
-      subtype: parsed.subtype,
-      charset: parsed.charset,
-      boundary: parsed.boundary
-    };
-  }
-  function isJSON(contentType) {
-    if (!contentType)
-      return false;
-    const info = parseContentType2(contentType);
-    if (!info)
-      return false;
-    return info.mediaType === "application/json" || info.subtype.endsWith("+json");
-  }
-  function isText(contentType) {
-    if (!contentType)
-      return false;
-    const info = parseContentType2(contentType);
-    return info?.type === "text";
-  }
-  function isBinary(contentType) {
-    return !isText(contentType) && !isJSON(contentType);
-  }
-  function readWithAbort(reader, signal) {
-    if (!signal)
-      return reader.read();
-    if (signal.aborted)
-      return Promise.resolve({ done: true, value: void 0 });
-    return new Promise((resolve, reject) => {
-      const onAbort = () => {
-        void reader.cancel("aborted").catch(() => {
-        });
-        resolve({ done: true, value: void 0 });
-      };
-      signal.addEventListener("abort", onAbort, { once: true });
-      reader.read().then(resolve, reject).finally(() => {
-        signal.removeEventListener("abort", onAbort);
-      });
-    });
-  }
-  function normaliseOnExceed(mode) {
-    return mode === "truncate" || mode === "abort" ? mode : "throw";
-  }
-  async function readBodyWithLimit(stream, url, limit, signal) {
-    const onExceed = normaliseOnExceed(limit.onExceed);
-    const reader = stream.getReader();
-    const chunks = [];
-    let bytesRead = 0;
-    try {
-      while (true) {
-        if (signal?.aborted) {
-          await reader.cancel("aborted");
-          throw new DOMException("Response reading aborted", "AbortError");
-        }
-        const { done, value } = await readWithAbort(reader, signal);
-        if (done) {
-          if (signal?.aborted) {
-            throw new DOMException("Response reading aborted", "AbortError");
-          }
-          break;
-        }
-        const newTotal = bytesRead + value.byteLength;
-        if (newTotal > limit.maxBytes) {
-          limit.onExceedCallback?.(newTotal, limit.maxBytes);
-          if (onExceed === "throw") {
-            await reader.cancel("size limit exceeded");
-            throw new ResponseSizeLimitError(newTotal, limit.maxBytes, url);
-          }
-          if (onExceed === "abort") {
-            await reader.cancel("size limit exceeded");
-            break;
-          }
-          if (onExceed === "truncate") {
-            const remaining = limit.maxBytes - bytesRead;
-            if (remaining > 0) {
-              chunks.push(value.slice(0, remaining));
-              bytesRead += remaining;
-            }
-            break;
-          }
-        }
-        chunks.push(value);
-        bytesRead += value.byteLength;
-      }
-    } finally {
-      reader.releaseLock();
-    }
-    return concatUint8Arrays2(chunks);
-  }
-  function resolveCharset(charset) {
-    if (!charset)
-      return "utf-8";
-    const key = charset.toLowerCase().trim();
-    if (Object.prototype.hasOwnProperty.call(CHARSET_ALIASES, key)) {
-      return CHARSET_ALIASES[key];
-    }
-    return "utf-8";
-  }
-  function detectBOM(bytes) {
-    if (bytes[0] === 239 && bytes[1] === 187 && bytes[2] === 191)
-      return "utf-8";
-    if (bytes[0] === 255 && bytes[1] === 254)
-      return "utf-16le";
-    if (bytes[0] === 254 && bytes[1] === 255)
-      return "utf-16be";
-    return null;
-  }
-  function decodeBody(bytes, charset, url) {
-    const detected = detectBOM(bytes);
-    const resolved = detected ?? resolveCharset(charset);
-    const data = detected ? bytes.slice(detected === "utf-8" ? 3 : 2) : bytes;
-    try {
-      return new TextDecoder(resolved, { fatal: true }).decode(data);
-    } catch {
-      try {
-        return new TextDecoder(resolved, { fatal: false }).decode(data);
-      } catch (err2) {
-        throw new ResponseDecodeError(String(err2), resolved, url);
-      }
-    }
-  }
-  function createSizeLimitedDecompression(stream, encoding, maxDecompressedSize = 1e8) {
-    const decompressed = decompressStream(stream, encoding);
-    let bytesRead = 0;
-    const sizeLimitTransform = new TransformStream({
-      transform(chunk, controller) {
-        bytesRead += chunk.byteLength;
-        if (bytesRead > maxDecompressedSize) {
-          controller.error(new ResponseSizeLimitError(bytesRead, maxDecompressedSize, "decompression"));
-          return;
-        }
-        controller.enqueue(chunk);
-      }
-    });
-    return decompressed.pipeThrough(sizeLimitTransform);
-  }
-  function decompressStream(stream, encoding) {
-    const normalized = encoding.trim().toLowerCase();
-    if (normalized === "br") {
-      return brotliDecompressStream(stream);
+  function decompressStream(stream, encoding) {
+    const normalized = encoding.trim().toLowerCase();
+    if (normalized === "br") {
+      return brotliDecompressStream(stream);
     }
     if (normalized === "zstd") {
       return zstdDecompressStream(stream);
@@ -4419,12 +4148,65 @@ var kinetex = (() => {
       return stream;
     try {
       const format = normalized;
-      const ds = new DecompressionStream(format);
-      return stream.pipeThrough(ds);
+      const decoder = new DecompressionStream(format);
+      return decodeUnlessEmpty(stream, decoder);
     } catch {
       return stream;
     }
   }
+  function decodeUnlessEmpty(source, decoder) {
+    const reader = source.getReader();
+    return new ReadableStream({
+      async start(controller) {
+        let first = null;
+        for (; ; ) {
+          const next = await reader.read().catch(() => ({ done: true, value: void 0 }));
+          if (next.done || next.value.byteLength > 0) {
+            first = next;
+            break;
+          }
+        }
+        if (first.done) {
+          controller.close();
+          return;
+        }
+        const rehydrated = new ReadableStream({
+          start(c) {
+            c.enqueue(first.value);
+          },
+          async pull(c) {
+            const next = await reader.read();
+            if (next.done)
+              c.close();
+            else
+              c.enqueue(next.value);
+          },
+          cancel(reason) {
+            void reader.cancel(reason).catch(() => void 0);
+          }
+        });
+        const out = rehydrated.pipeThrough(decoder);
+        const pump = out.getReader();
+        void (async () => {
+          try {
+            for (; ; ) {
+              const chunk = await pump.read();
+              if (chunk.done) {
+                controller.close();
+                return;
+              }
+              controller.enqueue(chunk.value);
+            }
+          } catch (err) {
+            controller.error(err);
+          }
+        })();
+      },
+      cancel(reason) {
+        void reader.cancel(reason).catch(() => void 0);
+      }
+    });
+  }
   function brotliDecompressStream(stream) {
     if (!isNodeRuntime())
       return stream;
@@ -4441,6 +4223,7 @@ var kinetex = (() => {
     let settled = false;
     let reader = null;
     let cancelRequested = false;
+    let sawBytes = false;
     return new ReadableStream({
       async start(controller) {
         const zlib = await import("node:zlib");
@@ -4474,9 +4257,19 @@ var kinetex = (() => {
           while (true) {
             const { done, value } = await reader.read();
             if (done) {
+              if (!sawBytes) {
+                if (!settled) {
+                  settled = true;
+                  controller.close();
+                }
+                br.destroy();
+                break;
+              }
               br.end();
               break;
             }
+            if (value.byteLength > 0)
+              sawBytes = true;
             br.write(value);
           }
         } catch (e) {
@@ -4874,9 +4667,9 @@ var kinetex = (() => {
       };
     }).filter((m) => m.name);
   }
-  async function readBodyBytes(response, url, options) {
+  function readBodyBytes(response, url, options) {
     if (!response.body)
-      return new Uint8Array(0);
+      return Promise.resolve(new Uint8Array(0));
     const headers = normalizeHeaders2(response.headers);
     let stream = response.body;
     if (options.decompress !== false) {
@@ -4888,30 +4681,7 @@ var kinetex = (() => {
     if (options.sizeLimit) {
       return readBodyWithLimit(stream, url, options.sizeLimit, options.signal);
     }
-    const reader = stream.getReader();
-    const chunks = [];
-    try {
-      while (true) {
-        if (options.signal?.aborted) {
-          throw new DOMException("Response reading aborted", "AbortError");
-        }
-        const { done, value } = await readWithAbort(reader, options.signal);
-        if (done) {
-          if (options.signal?.aborted) {
-            throw new DOMException("Response reading aborted", "AbortError");
-          }
-          break;
-        }
-        chunks.push(value);
-      }
-    } finally {
-      if (options.signal?.aborted) {
-        await reader.cancel("aborted").catch(() => {
-        });
-      }
-      reader.releaseLock();
-    }
-    return concatUint8Arrays2(chunks);
+    return readBodyWithLimit(stream, url, { maxBytes: Infinity }, options.signal);
   }
   function applySizeLimit(stream, url, limit, signal) {
     const onExceed = normaliseOnExceed(limit.onExceed);
@@ -4937,27 +4707,20 @@ var kinetex = (() => {
               controller.close();
               break;
             }
-            const newTotal = bytesRead + value.byteLength;
-            if (newTotal > limit.maxBytes) {
-              limit.onExceedCallback?.(newTotal, limit.maxBytes);
-              if (onExceed === "throw") {
-                await reader.cancel("size limit");
-                controller.error(new ResponseSizeLimitError(newTotal, limit.maxBytes, url));
-                return;
-              }
-              if (onExceed === "abort") {
-                await reader.cancel("size limit");
-                controller.close();
-                return;
-              }
-              if (onExceed === "truncate") {
-                const remaining = limit.maxBytes - bytesRead;
-                if (remaining > 0)
-                  controller.enqueue(value.slice(0, remaining));
-                controller.close();
-                await reader.cancel("size limit");
-                return;
-              }
+            let action;
+            try {
+              action = limitAction(value, bytesRead, limit, onExceed, (n, max) => new ResponseSizeLimitError(n, max, url));
+            } catch (err) {
+              await reader.cancel("size limit exceeded");
+              controller.error(err);
+              return;
+            }
+            if (action.kind !== "keep") {
+              if (action.kind === "truncate")
+                controller.enqueue(action.chunk);
+              controller.close();
+              await reader.cancel("size limit exceeded");
+              return;
             }
             bytesRead += value.byteLength;
             controller.enqueue(value);
@@ -5195,6 +4958,330 @@ var kinetex = (() => {
     }
   });
 
+  // dist/esm/proxy.js
+  var proxy_exports = {};
+  __export(proxy_exports, {
+    connectThroughProxy: () => connectThroughProxy
+  });
+  function isIpLiteral(host) {
+    const h = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+    return h.includes(":") || /^\d+(\.\d+)*$/.test(h);
+  }
+  function isSocksProxy(url) {
+    return /^socks5h?:/i.test(url);
+  }
+  function proxyAuthHeader(proxy) {
+    if (proxy.username === void 0)
+      return void 0;
+    const raw = `${proxy.username}:${proxy.password ?? ""}`;
+    const bytes = new TextEncoder().encode(raw);
+    let binary = "";
+    for (const b of bytes)
+      binary += String.fromCharCode(b);
+    const b64 = typeof globalThis.btoa === "function" ? globalThis.btoa(binary) : (
+      // Node without btoa (or a non-Latin1 username) — encode explicitly.
+      Buffer.from(bytes).toString("base64")
+    );
+    return `Basic ${b64}`;
+  }
+  function parseConnectStatus(head) {
+    const statusLine = head.split("\r\n", 1)[0] ?? "";
+    const match = /^HTTP\/1\.[01] (\d{3})(?: (.*))?$/.exec(statusLine);
+    if (!match)
+      return null;
+    return { status: Number(match[1]), reason: match[2] ?? "" };
+  }
+  async function connectThroughProxy(proxy, target, options = {}) {
+    const errMeta = options.request !== void 0 ? { request: options.request } : {};
+    if (isSocksProxy(proxy.url)) {
+      throw new KinetexError(`proxy url "${proxy.url}" is a SOCKS proxy, which needs a different mechanism. Use createSocks5Tunnel() from kinetex/socks5 and supply your own fetch over the tunnel.`, "EVALIDATION", errMeta);
+    }
+    let proxyUrl;
+    try {
+      proxyUrl = new URL(proxy.url);
+    } catch (err) {
+      throw new KinetexError(`proxy url "${proxy.url}" is not a valid URL`, "EVALIDATION", {
+        ...errMeta,
+        cause: err
+      });
+    }
+    if (proxyUrl.protocol !== "http:" && proxyUrl.protocol !== "https:") {
+      throw new KinetexError(`proxy url scheme "${proxyUrl.protocol}" is not supported; use http:, https:, socks5: or socks5h:`, "EVALIDATION", errMeta);
+    }
+    const net = await import("node:net");
+    const tls = await import("node:tls");
+    const proxyPort = proxyUrl.port ? Number(proxyUrl.port) : proxyUrl.protocol === "https:" ? 443 : 80;
+    const targetPort = target.port ? Number(target.port) : target.protocol === "https:" ? 443 : 80;
+    const authority = `${target.hostname}:${targetPort}`;
+    const timeoutMs = options.connectTimeoutMs ?? DEFAULT_CONNECT_TIMEOUT_MS;
+    const baseSocket = proxyUrl.protocol === "https:" ? await openTlsSocket(tls, {
+      host: proxyUrl.hostname,
+      port: proxyPort,
+      servername: proxyUrl.hostname,
+      ...options.ca !== void 0 ? { ca: options.ca } : {}
+    }, timeoutMs, options.signal, errMeta, `proxy ${proxyUrl.host}`) : await openTcpSocket(net, { host: proxyUrl.hostname, port: proxyPort }, timeoutMs, options.signal, errMeta, `proxy ${proxyUrl.host}`);
+    const auth = proxyAuthHeader(proxy);
+    const connectLines = [
+      `CONNECT ${authority} HTTP/1.1`,
+      `Host: ${authority}`,
+      // RFC 9110 §9.3.6: proxies that support persistent tunnels are expected to
+      // treat a tunnel as still-open even without this, but sending it is what
+      // every real client does and some proxies misbehave without it.
+      "Proxy-Connection: Keep-Alive",
+      ...auth !== void 0 ? [`Proxy-Authorization: ${auth}`] : [],
+      "",
+      ""
+    ];
+    baseSocket.write(connectLines.join("\r\n"));
+    let head = "";
+    const headResult = await new Promise((resolve) => {
+      const drain = () => {
+        for (; ; ) {
+          const chunk = baseSocket.read();
+          if (chunk === null)
+            return;
+          head += chunk.toString("latin1");
+        }
+      };
+      const onReadable = () => {
+        drain();
+        const end = head.indexOf("\r\n\r\n");
+        if (end === -1) {
+          if (head.length > MAX_HEAD_BYTES) {
+            cleanup();
+            resolve({
+              ok: false,
+              err: new KinetexError("Proxy sent an oversized CONNECT response", "EPROXY", errMeta)
+            });
+          }
+          return;
+        }
+        cleanup();
+        const parsed = parseConnectStatus(head.slice(0, end));
+        if (!parsed) {
+          resolve({
+            ok: false,
+            err: new KinetexError(`Proxy returned a malformed CONNECT response: ${JSON.stringify(head.slice(0, end).split("\r\n", 1)[0] ?? "")}`, "EPROXY", errMeta)
+          });
+          return;
+        }
+        if (parsed.status >= 200 && parsed.status < 300) {
+          const tail = head.slice(end + 4);
+          if (tail.length > 0)
+            baseSocket.unshift(Buffer.from(tail, "latin1"));
+          resolve({ ok: true });
+          return;
+        }
+        if (parsed.status === 407) {
+          resolve({
+            ok: false,
+            err: new KinetexError("Proxy requires authentication (407). Set `username`/`password` on the proxy config, or embed them in the proxy URL.", "EPROXY", errMeta)
+          });
+          return;
+        }
+        resolve({
+          ok: false,
+          err: new KinetexError(`Proxy refused CONNECT to ${authority}: ${parsed.status} ${parsed.reason}`.trim(), "EPROXY", errMeta)
+        });
+      };
+      const onError = (e) => {
+        cleanup();
+        resolve({
+          ok: false,
+          err: new KinetexError(`Proxy connection failed: ${e.message}`, "ENETWORK", {
+            ...errMeta,
+            cause: e
+          })
+        });
+      };
+      const onClosedEarly = () => {
+        cleanup();
+        resolve({
+          ok: false,
+          err: new KinetexError(`Proxy closed the connection before answering CONNECT for ${authority}`, "EPROXY", errMeta)
+        });
+      };
+      const onTimeout = () => {
+        cleanup();
+        baseSocket.destroy();
+        resolve({
+          ok: false,
+          err: new KinetexError(`Proxy did not respond to CONNECT for ${authority} within ${timeoutMs}ms`, "ETIMEOUT", errMeta)
+        });
+      };
+      const onAbort = () => {
+        cleanup();
+        baseSocket.destroy();
+        resolve({
+          ok: false,
+          err: new KinetexError("Proxy connection aborted", "EABORT", errMeta)
+        });
+      };
+      const timer = setTimeout(onTimeout, timeoutMs);
+      if (typeof timer.unref === "function") {
+        timer.unref();
+      }
+      function cleanup() {
+        clearTimeout(timer);
+        baseSocket.off("readable", onReadable);
+        baseSocket.off("error", onError);
+        baseSocket.off("end", onClosedEarly);
+        baseSocket.off("close", onClosedEarly);
+        baseSocket.off("timeout", onTimeout);
+        options.signal?.removeEventListener("abort", onAbort);
+      }
+      baseSocket.on("readable", onReadable);
+      baseSocket.once("error", onError);
+      baseSocket.once("end", onClosedEarly);
+      baseSocket.once("close", onClosedEarly);
+      baseSocket.setTimeout(timeoutMs, onTimeout);
+      options.signal?.addEventListener("abort", onAbort, { once: true });
+      drain();
+    });
+    if (!headResult.ok) {
+      baseSocket.destroy();
+      throw headResult.err;
+    }
+    if (target.protocol !== "https:") {
+      baseSocket.setTimeout(0);
+      return baseSocket;
+    }
+    return await new Promise((resolve, reject) => {
+      const onTunnelTimeout = () => {
+        done();
+        baseSocket.destroy();
+        reject(new KinetexError(`TLS handshake through proxy to ${target.hostname} did not complete within ${timeoutMs}ms`, "ETIMEOUT", errMeta));
+      };
+      const onTunnelAbort = () => {
+        done();
+        baseSocket.destroy();
+        reject(new KinetexError("Proxy connection aborted", "EABORT", errMeta));
+      };
+      const tunnelTimer = setTimeout(onTunnelTimeout, timeoutMs);
+      if (typeof tunnelTimer.unref === "function") {
+        tunnelTimer.unref();
+      }
+      options.signal?.addEventListener("abort", onTunnelAbort, { once: true });
+      function done() {
+        clearTimeout(tunnelTimer);
+        options.signal?.removeEventListener("abort", onTunnelAbort);
+      }
+      const sni = options.servername ?? target.hostname;
+      const secure = tls.connect(
+        {
+          socket: baseSocket,
+          ...sni !== void 0 && !isIpLiteral(sni) ? { servername: sni } : {},
+          ...options.ca !== void 0 ? { ca: options.ca } : {}
+        },
+        // `rejectUnauthorized` is left at its default (true), so a peer that
+        // fails verification emits `error` rather than reaching this callback.
+        // Verification therefore cannot be bypassed here, and the callback
+        // only ever runs for a verified handshake.
+        () => {
+          done();
+          baseSocket.setTimeout(0);
+          resolve(secure);
+        }
+      );
+      secure.once("error", (e) => {
+        done();
+        baseSocket.destroy();
+        reject(new KinetexError(`TLS handshake through proxy failed for ${target.hostname}: ${e.message}`, "ENETWORK", { ...errMeta, cause: e }));
+      });
+    });
+  }
+  async function openTcpSocket(net, opts, timeoutMs, signal, errMeta, what) {
+    return await new Promise((resolve, reject) => {
+      const socket = net.connect({ host: opts.host, port: opts.port });
+      const onError = (e) => {
+        cleanup();
+        reject(new KinetexError(`Cannot reach ${what}: ${e.message}`, "ENETWORK", {
+          ...errMeta,
+          cause: e
+        }));
+      };
+      const timer = setTimeout(() => {
+        cleanup();
+        socket.destroy();
+        reject(new KinetexError(`Connecting to ${what} timed out`, "ETIMEOUT", errMeta));
+      }, timeoutMs);
+      if (typeof timer.unref === "function") {
+        timer.unref();
+      }
+      const onAbort = () => {
+        cleanup();
+        socket.destroy();
+        reject(new KinetexError("Proxy connection aborted", "EABORT", errMeta));
+      };
+      function cleanup() {
+        clearTimeout(timer);
+        socket.off("error", onError);
+        signal?.removeEventListener("abort", onAbort);
+      }
+      socket.once("error", onError);
+      socket.once("connect", () => {
+        cleanup();
+        resolve(socket);
+      });
+      if (signal?.aborted)
+        onAbort();
+      else
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
+  }
+  async function openTlsSocket(tls, opts, timeoutMs, signal, errMeta, what) {
+    return await new Promise((resolve, reject) => {
+      const socket = tls.connect({
+        host: opts.host,
+        port: opts.port,
+        ...isIpLiteral(opts.servername) ? {} : { servername: opts.servername },
+        ...opts.ca !== void 0 ? { ca: opts.ca } : {}
+      }, () => {
+        cleanup();
+        resolve(socket);
+      });
+      const onError = (e) => {
+        cleanup();
+        reject(new KinetexError(`Cannot reach ${what}: ${e.message}`, "ENETWORK", {
+          ...errMeta,
+          cause: e
+        }));
+      };
+      const timer = setTimeout(() => {
+        cleanup();
+        socket.destroy();
+        reject(new KinetexError(`Connecting to ${what} timed out`, "ETIMEOUT", errMeta));
+      }, timeoutMs);
+      if (typeof timer.unref === "function") {
+        timer.unref();
+      }
+      const onAbort = () => {
+        cleanup();
+        socket.destroy();
+        reject(new KinetexError("Proxy connection aborted", "EABORT", errMeta));
+      };
+      function cleanup() {
+        clearTimeout(timer);
+        socket.off("error", onError);
+        signal?.removeEventListener("abort", onAbort);
+      }
+      socket.once("error", onError);
+      if (signal?.aborted)
+        onAbort();
+      else
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
+  }
+  var DEFAULT_CONNECT_TIMEOUT_MS, MAX_HEAD_BYTES;
+  var init_proxy = __esm({
+    "dist/esm/proxy.js"() {
+      "use strict";
+      init_types();
+      DEFAULT_CONNECT_TIMEOUT_MS = 3e4;
+      MAX_HEAD_BYTES = 64 * 1024;
+    }
+  });
+
   // dist/esm/core.js
   var core_exports = {};
   __export(core_exports, {
@@ -5205,10 +5292,13 @@ var kinetex = (() => {
     IS_NODE: () => IS_NODE,
     NodeHTTP2Transport: () => NodeHTTP2Transport,
     RUNTIME: () => RUNTIME,
+    blockedHostError: () => blockedHostError,
+    createPinnedLookup: () => createPinnedLookup,
     createTransport: () => createTransport,
     decompressBodyStream: () => decompressBodyStream,
     detectRuntime: () => detectRuntime,
     encodeMultipart: () => encodeMultipart,
+    filterSafeAddresses: () => filterSafeAddresses,
     getEffectiveRuntime: () => getEffectiveRuntime,
     normalizeHeaders: () => normalizeHeaders3,
     parseBody: () => parseBody,
@@ -5274,6 +5364,7 @@ var kinetex = (() => {
         ...sessionOptions?.connectTimeoutMs !== void 0 ? { connectTimeoutMs: sessionOptions.connectTimeoutMs } : {},
         ...sessionOptions?.requestTimeoutMs !== void 0 ? { requestTimeoutMs: sessionOptions.requestTimeoutMs } : {},
         ...transportOptions?.strict !== void 0 ? { strict: transportOptions.strict } : {},
+        ...transportOptions?.allowPrivateNetwork !== void 0 ? { allowPrivateNetwork: transportOptions.allowPrivateNetwork } : {},
         ...transportOptions?.onDroppedHeader !== void 0 ? { onDroppedHeader: transportOptions.onDroppedHeader } : {},
         ...transportOptions?.ca !== void 0 ? { ca: transportOptions.ca } : {},
         ...transportOptions?.proxy !== void 0 ? { proxy: transportOptions.proxy } : {}
@@ -5283,7 +5374,11 @@ var kinetex = (() => {
       fetchFn: fetchFn ?? globalThis.fetch,
       ...transportOptions?.strict !== void 0 ? { strict: transportOptions.strict } : {},
       ...transportOptions?.onDroppedHeader !== void 0 ? { onDroppedHeader: transportOptions.onDroppedHeader } : {},
-      ...transportOptions?.dispatcher !== void 0 ? { dispatcher: transportOptions.dispatcher } : {}
+      ...transportOptions?.dispatcher !== void 0 ? { dispatcher: transportOptions.dispatcher } : {},
+      // Reaches the pre-flight DNS screen in FetchTransport. It was accepted by
+      // createTransport and then dropped, so every fetch-based runtime silently
+      // had the screen off.
+      ...transportOptions?.allowPrivateNetwork !== void 0 ? { allowPrivateNetwork: transportOptions.allowPrivateNetwork } : {}
     });
   }
   async function sendWithTimeout(transport, request, timeoutMs) {
@@ -5348,10 +5443,11 @@ var kinetex = (() => {
         if (done)
           break;
         if (maxBytes > 0) {
-          const newTotal = total + value.byteLength;
-          if (newTotal > maxBytes) {
+          try {
+            limitAction(value, total, { maxBytes }, "throw", (n, max) => new SizeLimitError(n, max));
+          } catch (err) {
             await reader.cancel("size limit exceeded");
-            throw new SizeLimitError(newTotal, maxBytes);
+            throw err;
           }
         }
         chunks.push(value);
@@ -5410,6 +5506,41 @@ var kinetex = (() => {
     }
     return raw;
   }
+  function filterSafeAddresses(addresses) {
+    return addresses.filter((a) => a.family !== 0 && !isBlockedAddress(a.address));
+  }
+  function blockedHostError(url, addresses) {
+    return new KinetexError(`URL "${url}" resolved only to blocked addresses (${addresses.map((a) => a.address).join(", ") || "none"})`, "EBLOCKEDHOST");
+  }
+  function createPinnedLookup() {
+    return (hostname, options, callback) => {
+      const fail = (err) => {
+        callback(err);
+      };
+      const wantsAll = options.all === true;
+      const resolved = { ...options, all: true };
+      (0, import_node_dns.lookup)(hostname, resolved, (err, addresses) => {
+        if (err) {
+          fail(err);
+          return;
+        }
+        const safe = filterSafeAddresses(addresses ?? []);
+        if (safe.length === 0) {
+          const blocked = (addresses ?? []).map((a) => a.address).join(", ") || "no addresses";
+          const e = new Error(`Refusing to connect to ${hostname}: it resolves only to a blocked address (${blocked})`);
+          e.code = "EBLOCKEDHOST";
+          fail(e);
+          return;
+        }
+        if (wantsAll) {
+          callback(null, safe);
+          return;
+        }
+        const first = safe[0];
+        callback(null, first.address, first.family);
+      });
+    };
+  }
   function normalizeHeaders3(headers) {
     return normalizeHeaders(headers);
   }
@@ -5615,14 +5746,17 @@ Content-Type: ${value.type || "application/octet-stream"}\r
     const { applyDecompression: applyDecompression2 } = await Promise.resolve().then(() => (init_response(), response_exports));
     return applyDecompression2(body, headers);
   }
-  var g, RUNTIME, _runtimeOverride, KNOWN_RUNTIMES, IS_NODE, HAS_NATIVE_FETCH, DEFAULT_ACCEPT_ENCODING, FetchTransport, NodeHTTP2Transport, nodeReadableToWebStream, HTTP_STATUS_TEXTS;
+  var import_node_dns, import_node_net, g, RUNTIME, _runtimeOverride, KNOWN_RUNTIMES, IS_NODE, HAS_NATIVE_FETCH, DEFAULT_ACCEPT_ENCODING, FetchTransport, NodeHTTP2Transport, PINNED_LOOKUP, nodeReadableToWebStream, HTTP_STATUS_TEXTS;
   var init_core = __esm({
     "dist/esm/core.js"() {
       "use strict";
       init_types();
       init_utils();
       init_headers();
+      import_node_dns = __require("node:dns");
+      import_node_net = __require("node:net");
       init_utils();
+      init_response();
       g = globalThis;
       RUNTIME = detectRuntime();
       _runtimeOverride = null;
@@ -5647,17 +5781,72 @@ Content-Type: ${value.type || "application/octet-stream"}\r
           __publicField(this, "strict");
           __publicField(this, "onDroppedHeader");
           __publicField(this, "dispatcher");
+          /** Per-request timeout; omitted means no timeout. */
+          __publicField(this, "requestTimeoutMs");
+          /**
+           * Permit connections to hosts resolving into private/loopback space.
+           * Default: false.
+           */
+          __publicField(this, "_allowPrivateNetwork");
           if (typeof fetchFnOrOptions === "function") {
             this.fetchFn = fetchFnOrOptions;
             this.strict = false;
             this.onDroppedHeader = void 0;
             this.dispatcher = void 0;
+            this.requestTimeoutMs = void 0;
+            this._allowPrivateNetwork = false;
           } else {
             this.fetchFn = fetchFnOrOptions.fetchFn ?? globalThis.fetch;
             this.strict = fetchFnOrOptions.strict ?? false;
             this.onDroppedHeader = fetchFnOrOptions.onDroppedHeader;
             this.dispatcher = fetchFnOrOptions.dispatcher;
+            this.requestTimeoutMs = fetchFnOrOptions.requestTimeoutMs;
+            this._allowPrivateNetwork = fetchFnOrOptions.allowPrivateNetwork ?? false;
+          }
+        }
+        /**
+         * Refuse a host that resolves into blocked address space.
+         *
+         * The Node transports close DNS rebinding properly: they resolve once and
+         * pin the checked address to the socket (`createPinnedLookup`). `fetch` has no
+         * resolver hook — undici owns the connection and exposes no way to install
+         * one — so the only place to intervene is before the call.
+         *
+         * That closes the case that matters in practice: a name resolving to loopback
+         * or the cloud metadata address is refused outright, which is the vector
+         * behind the classic SSRF-through-DNS attacks. What it cannot close is a
+         * resolver that answers public on this lookup and private on the connect a
+         * moment later. Closing *that* needs a resolver hook `fetch` does not offer,
+         * and claiming otherwise would be worse than saying so.
+         *
+         * The host has already passed the lexical screen by this point, so this is a
+         * second line of defence rather than the first.
+         */
+        async assertReachableHost(url) {
+          if (this._allowPrivateNetwork)
+            return;
+          if (this.fetchFn !== globalThis.fetch)
+            return;
+          let parsed;
+          try {
+            parsed = new URL(url);
+          } catch {
+            return;
+          }
+          if (!parsed.hostname || (0, import_node_net.isIP)(parsed.hostname))
+            return;
+          let addresses;
+          try {
+            addresses = await new Promise((resolve, reject) => {
+              (0, import_node_dns.lookup)(parsed.hostname, { all: true }, (err, res) => err ? reject(err) : resolve(res));
+            });
+          } catch {
+            return;
           }
+          const safe = filterSafeAddresses(addresses);
+          if (safe.length > 0)
+            return;
+          throw blockedHostError(url, addresses);
         }
         /**
          * Send a request via the native fetch() API.
@@ -5670,6 +5859,7 @@ Content-Type: ${value.type || "application/octet-stream"}\r
          * @returns Raw response from the server
          */
         async send(req) {
+          await this.assertReachableHost(req.url);
           const sanitizedHeaders = {};
           for (const [name, value] of Object.entries(req.headers ?? {})) {
             if (typeof name !== "string" || typeof value !== "string")
@@ -5716,15 +5906,41 @@ Content-Type: ${value.type || "application/octet-stream"}\r
           if (this.dispatcher !== void 0) {
             init.dispatcher = this.dispatcher;
           }
+          const timeoutMs = this.requestTimeoutMs;
+          const timeoutCtl = timeoutMs === void 0 ? void 0 : new AbortController();
+          let timedOut = false;
+          const onCallerAbort = () => timeoutCtl?.abort();
+          if (timeoutCtl && req.signal) {
+            if (req.signal.aborted)
+              timeoutCtl.abort();
+            else
+              req.signal.addEventListener("abort", onCallerAbort, { once: true });
+          }
+          const timer = timeoutCtl && timeoutMs !== void 0 ? setTimeout(() => {
+            timedOut = true;
+            timeoutCtl.abort();
+          }, timeoutMs) : void 0;
+          const initWithSignal = timeoutCtl && !init.signal ? { ...init, signal: timeoutCtl.signal } : init;
           let response;
           try {
-            response = await this.fetchFn(req.url, init);
+            response = await this.fetchFn(req.url, initWithSignal);
           } catch (err) {
+            if (timer !== void 0)
+              clearTimeout(timer);
+            if (timeoutCtl && req.signal)
+              req.signal.removeEventListener("abort", onCallerAbort);
+            if (timedOut) {
+              throw new KinetexError(`HTTP/1.1 request to ${req.url} timed out after ${timeoutMs}ms`, "ETIMEOUT", { request: req, cause: err });
+            }
             if (isAbortError(err)) {
               throw new KinetexError("Request was aborted", "EABORT", { request: req, cause: err });
             }
             throw new KinetexError(err instanceof Error ? err.message : "Network request failed", "ENETWORK", { request: req, cause: err });
           }
+          if (timer !== void 0)
+            clearTimeout(timer);
+          if (timeoutCtl && req.signal)
+            req.signal.removeEventListener("abort", onCallerAbort);
           const headers = normalizeHeaders3(response.headers);
           const httpVersion = detectHTTPVersion(response, headers);
           let alreadyDecompressed = true;
@@ -5787,6 +6003,8 @@ Content-Type: ${value.type || "application/octet-stream"}\r
            * sockets, which is a lot to hold open for a legacy fallback), and gives
            * callers a way to opt out.
            */
+          /** Whether to permit connections into private/loopback address space. */
+          __publicField(this, "_allowPrivateNetwork");
           __publicField(this, "_http1KeepAlive");
           __publicField(this, "_http1MaxSockets");
           __publicField(this, "_http1Agent", null);
@@ -5795,6 +6013,7 @@ Content-Type: ${value.type || "application/octet-stream"}\r
           this.sessionTTLMs = options.sessionTTLMs ?? 5 * 6e4;
           this.pingIntervalMs = options.pingIntervalMs ?? 3e4;
           this.maxSessions = options.maxSessions ?? 100;
+          this._allowPrivateNetwork = options.allowPrivateNetwork ?? false;
           this._http1KeepAlive = options.http1KeepAlive ?? true;
           this._http1MaxSockets = options.http1MaxSockets ?? 16;
           this._proxy = options.proxy;
@@ -5856,6 +6075,9 @@ Content-Type: ${value.type || "application/octet-stream"}\r
           const session = await new Promise((resolve, reject) => {
             const s = http2.connect(origin, {
               rejectUnauthorized: true,
+              // Resolve-and-check, so a hostname that points at a private address is
+              // refused before anything is dialled. See `createPinnedLookup`.
+              ...this._allowPrivateNetwork ? {} : { lookup: PINNED_LOOKUP },
               ...this._ca !== void 0 ? { ca: this._ca } : {},
               // Already connected (and already TLS-wrapped for an https origin),
               // so node:http2 must use it as-is rather than negotiating again.
@@ -6154,7 +6376,11 @@ Content-Type: ${value.type || "application/octet-stream"}\r
             if (!this._http1Fallback) {
               const opts = {
                 fetchFn: globalThis.fetch,
-                strict: this._strict
+                strict: this._strict,
+                // The h2 path enforces `_requestTimeoutMs` itself; without passing it
+                // down, `new NodeHTTP2Transport({ requestTimeoutMs: 500 })` hung for
+                // the full response time on any non-https URL or HTTP/1.1 request.
+                requestTimeoutMs: this._requestTimeoutMs
               };
               if (this._onDroppedHeader !== void 0)
                 opts.onDroppedHeader = this._onDroppedHeader;
@@ -6191,7 +6417,9 @@ Content-Type: ${value.type || "application/octet-stream"}\r
             // `ca` was accepted by the transport but never reached this path, so a
             // private or self-signed peer could not be reached without disabling
             // verification process-wide.
-            ...this._ca !== void 0 ? { ca: this._ca } : {}
+            ...this._ca !== void 0 ? { ca: this._ca } : {},
+            // Same reason as the HTTP/2 path above.
+            ...this._allowPrivateNetwork ? {} : { lookup: PINNED_LOOKUP }
           };
           return new Promise((resolve, reject) => {
             const httpReq = https.request(options, (httpRes) => {
@@ -6306,6 +6534,7 @@ Content-Type: ${value.type || "application/octet-stream"}\r
           this._http1Agent = null;
         }
       };
+      PINNED_LOOKUP = createPinnedLookup();
       nodeReadableToWebStream = nodeDuplexToReadable;
       HTTP_STATUS_TEXTS = {
         100: "Continue",
@@ -6534,7 +6763,7 @@ Content-Type: ${value.type || "application/octet-stream"}\r
       const basic = delim >= 0 ? input.slice(0, delim) : "";
       for (let j = 0; j < basic.length; j++) {
         const cp = basic.charCodeAt(j);
-        if (cp > 122 || cp > 90 && cp < 97 || cp > 57 && cp < 65 || cp < 48)
+        if (cp >= 128 || cp < 32 || cp === 127)
           return input;
         output.push(cp);
       }
@@ -6590,6 +6819,9 @@ Content-Type: ${value.type || "application/octet-stream"}\r
     }
   }
   function decodeIDNLabel(label) {
+    if (label.includes(".")) {
+      return label.split(".").map((part) => decodeIDNLabel(part)).join(".");
+    }
     if (!label.toLowerCase().startsWith("xn--")) {
       return label;
     }
@@ -9083,21 +9315,6 @@ Content-Type: ${value.type || "application/octet-stream"}\r
     }
     return { name: "Error", message: String(err) };
   }
-  function safeStringify2(value) {
-    try {
-      const seen = /* @__PURE__ */ new WeakSet();
-      return JSON.stringify(value, (_k, v) => {
-        if (v !== null && typeof v === "object") {
-          if (seen.has(v))
-            return "[circular]";
-          seen.add(v);
-        }
-        return v;
-      }) ?? String(value);
-    } catch {
-      return String(value);
-    }
-  }
   function truncateToBytes(str, maxBytes) {
     const enc = new TextEncoder();
     const total = enc.encode(str).byteLength;
@@ -9114,9 +9331,6 @@ Content-Type: ${value.type || "application/octet-stream"}\r
     }
     return { text: str.slice(0, end), removed: total - used };
   }
-  function perfNow3() {
-    return typeof performance !== "undefined" ? performance.now() : Date.now();
-  }
   function createLogger(config) {
     return new HTTPLogger(config);
   }
@@ -9148,7 +9362,7 @@ Content-Type: ${value.type || "application/octet-stream"}\r
       }
     });
   }
-  var getNodeEnv, LogLevel, DEFAULT_REDACT_HEADERS, DEFAULT_REDACT_PARAMS, DEFAULT_ALLOWED_BODY_TYPES, ConsoleTransport, hasStdout, JSONTransport, BatchingTransport, RemoteTransport, MultiTransport, _logIdSeq, Redactor, _HTTPLogger, HTTPLogger;
+  var getNodeEnv, LogLevel, DEFAULT_REDACT_HEADERS, DEFAULT_REDACT_PARAMS, DEFAULT_ALLOWED_BODY_TYPES, ConsoleTransport, hasStdout, JSONTransport, BatchingTransport, RemoteTransport, MultiTransport, _logIdSeq, Redactor, _HTTPLogger, HTTPLogger, CIRCULAR_MARKER, safeStringify2;
   var init_logging = __esm({
     "dist/esm/logging.js"() {
       "use strict";
@@ -9468,11 +9682,7 @@ Content-Type: ${value.type || "application/octet-stream"}\r
         }
         /** Redact sensitive header values, replacing them with "***". */
         redactHeaders(headers) {
-          const out = {};
-          for (const [k, v] of Object.entries(headers)) {
-            out[k] = this.headerSet.has(k.toLowerCase()) ? "***" : v;
-          }
-          return out;
+          return redactHeaders(headers, this.headerSet, "***");
         }
         /**
          * Redact sensitive query parameters from a URL.
@@ -9519,7 +9729,7 @@ Content-Type: ${value.type || "application/octet-stream"}\r
             }
             if (!this.paramSet.has(decoded.toLowerCase()))
               return pair;
-            return eq === -1 ? `${name}=***` : `${name}=***`;
+            return `${name}=***`;
           });
           return `${base}?${params.join("&")}${fragment}`;
         }
@@ -9597,7 +9807,7 @@ Content-Type: ${value.type || "application/octet-stream"}\r
         }
         /** Evict oldest or stale (abandoned) active IDs to prevent unbounded memory growth. */
         _cleanupActiveIds() {
-          const now2 = perfNow3();
+          const now2 = perfNow();
           if (this.activeIds.size > _HTTPLogger.MAX_ACTIVE_IDS) {
             const entries = Array.from(this.activeIds.entries());
             const toRemove = entries.slice(0, entries.length - Math.floor(_HTTPLogger.MAX_ACTIVE_IDS * 0.8));
@@ -9628,7 +9838,7 @@ Content-Type: ${value.type || "application/octet-stream"}\r
           if (this.activeIds.size > 500) {
             this._cleanupActiveIds();
           }
-          this.activeIds.set(requestId, { startMs: perfNow3(), method, url });
+          this.activeIds.set(requestId, { startMs: perfNow(), method, url });
           const ct = headers["content-type"] ?? headers["Content-Type"] ?? null;
           const redacted = this.redactor.redactBody(body, ct, false);
           const entry = {
@@ -9661,7 +9871,7 @@ Content-Type: ${value.type || "application/octet-stream"}\r
          */
         logResponse(requestId, status, statusText, headers, body, attempt, cached, meta = {}) {
           const active = this.activeIds.get(requestId);
-          const dur = active ? perfNow3() - active.startMs : 0;
+          const dur = active ? perfNow() - active.startMs : 0;
           const method = active?.method ?? "GET";
           const url = active?.url ?? "";
           this.activeIds.delete(requestId);
@@ -9701,7 +9911,7 @@ Content-Type: ${value.type || "application/octet-stream"}\r
          */
         logError(requestId, error, status, attempt, meta = {}) {
           const active = this.activeIds.get(requestId);
-          const dur = active ? perfNow3() - active.startMs : 0;
+          const dur = active ? perfNow() - active.startMs : 0;
           const method = active?.method ?? "GET";
           const url = active?.url ?? "";
           this.activeIds.delete(requestId);
@@ -9801,6 +10011,8 @@ Content-Type: ${value.type || "application/octet-stream"}\r
       /** Time after which an abandoned active ID is evicted */
       __publicField(_HTTPLogger, "IDLE_TIMEOUT_MS", 6e4);
       HTTPLogger = _HTTPLogger;
+      CIRCULAR_MARKER = "[circular]";
+      safeStringify2 = (value) => safeStringify(value, CIRCULAR_MARKER);
     }
   });
 
@@ -10588,9 +10800,6 @@ Content-Type: ${value.type || "application/octet-stream"}\r
     const message = graphQLErrors.map((e) => e.message).join("; ");
     return new GraphQLClientError(message, "EGRAPHQL", graphQLErrors, req, res);
   }
-  function sleep3(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-  }
   function buildLinkChain(links, terminal) {
     return links.reduceRight((next, link) => (op) => link(op, next), terminal);
   }
@@ -10607,12 +10816,6 @@ Content-Type: ${value.type || "application/octet-stream"}\r
     const m = trimmed.match(/^\s*(?:query|mutation|subscription)\s+([A-Za-z_][A-Za-z0-9_]*)/im);
     return m ? m[1] : null;
   }
-  async function sha256Hex3(str) {
-    const encoded = new TextEncoder().encode(str);
-    const buf = encoded.buffer.slice(encoded.byteOffset, encoded.byteOffset + encoded.byteLength);
-    const hash = await crypto.subtle.digest("SHA-256", buf);
-    return Array.from(new Uint8Array(hash)).map((b) => b.toString(16).padStart(2, "0")).join("");
-  }
   async function buildHeaders(config, extra = {}) {
     const base = {
       "content-type": "application/json",
@@ -10784,7 +10987,7 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
     let fetchBody = null;
     const fetchHeaders = { ...headers };
     if (apqMode === "omitQuery" || apqMode === "full") {
-      const hash = getAPQHashFn ? await getAPQHashFn(req.query) : await sha256Hex3(req.query);
+      const hash = getAPQHashFn ? await getAPQHashFn(req.query) : await sha256Hex(req.query);
       const extensions = {
         ...req.extensions,
         persistedQuery: { version: 1, sha256Hash: hash }
@@ -10901,7 +11104,7 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
       let lastErr;
       for (let attempt = 0; attempt <= max; attempt++) {
         if (attempt > 0)
-          await sleep3(delay * Math.pow(2, attempt - 1));
+          await sleep(delay * Math.pow(2, attempt - 1));
         try {
           return await next(op);
         } catch (err) {
@@ -10926,6 +11129,8 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
       "use strict";
       init_types();
       init_utils();
+      init_utils();
+      init_utils();
       GraphQLClientError = class extends Error {
         /**
          * @param message       - Human-readable error description
@@ -11056,7 +11261,7 @@ ${text}`, "ENETWORK", void 0, req, void 0, new Error(`HTTP ${response.status}`))
             _GraphQLClient.apqHashToQuery.delete(cached.hash);
           }
           _GraphQLClient._apqMisses++;
-          const hash = await sha256Hex3(query);
+          const hash = await sha256Hex(query);
           const now2 = Date.now();
           const existingEntry = _GraphQLClient.apqHashToQuery.get(hash);
           if (existingEntry && existingEntry.query !== query) {
@@ -11424,7 +11629,7 @@ ${text}`, "ENETWORK", void 0, requests[0], void 0, new Error(`HTTP ${response.st
           let lastErr;
           for (let attempt = 0; attempt <= this.config.retries; attempt++) {
             if (attempt > 0)
-              await sleep3(this.config.retryDelayMs * Math.pow(2, attempt - 1));
+              await sleep(this.config.retryDelayMs * Math.pow(2, attempt - 1));
             try {
               return await this._executeRaw(req, signal);
             } catch (err) {
@@ -11586,7 +11791,7 @@ ${text}`, "ENETWORK", void 0, requests[0], void 0, new Error(`HTTP ${response.st
       if (config.maxPages && pageNum >= config.maxPages)
         break;
       if (pageNum > 0 && config.delayMs && config.delayMs > 0) {
-        await sleep4(config.delayMs, config.signal);
+        await sleep2(config.delayMs, config.signal);
       }
       let response;
       try {
@@ -11967,7 +12172,7 @@ ${text}`, "ENETWORK", void 0, requests[0], void 0, new Error(`HTTP ${response.st
     }
     return state;
   }
-  function sleep4(ms, signal) {
+  function sleep2(ms, signal) {
     return new Promise((r) => {
       if (signal?.aborted) {
         r();
@@ -12333,7 +12538,7 @@ ${text}`, "ENETWORK", void 0, requests[0], void 0, new Error(`HTTP ${response.st
     pathSegments: () => pathSegments,
     percentDecode: () => percentDecode,
     percentEncode: () => percentEncode,
-    perfNow: () => perfNow2,
+    perfNow: () => perfNow,
     pickQuery: () => pickQuery,
     presignRequest: () => presignRequest,
     readBlob: () => readBlob,
@@ -12396,6 +12601,7 @@ ${text}`, "ENETWORK", void 0, requests[0], void 0, new Error(`HTTP ${response.st
   });
 
   // dist/esm/progress.js
+  init_utils();
   var ProgressTracker = class {
     constructor(total, options = {}) {
       __publicField(this, "loaded", 0);
@@ -12986,11 +13192,43 @@ ${text}`, "ENETWORK", void 0, requests[0], void 0, new Error(`HTTP ${response.st
       }
     };
   }
-  function perfNow() {
-    return typeof performance !== "undefined" ? performance.now() : Date.now();
-  }
 
   // dist/esm/dedup.js
+  var NON_IDENTITY_HEADERS = [
+    "traceparent",
+    "tracestate",
+    "baggage",
+    "x-request-id",
+    "x-correlation-id",
+    "x-trace-id"
+  ];
+  async function identityFingerprint(headers) {
+    if (headers === void 0)
+      return "";
+    const lowered = /* @__PURE__ */ new Map();
+    for (const [name, value] of Object.entries(headers)) {
+      lowered.set(name.toLowerCase(), value);
+    }
+    const parts = [];
+    for (const name of NON_IDENTITY_HEADERS)
+      lowered.delete(name);
+    for (const name of [...lowered.keys()].sort()) {
+      parts.push(`${name}=${lowered.get(name)}`);
+    }
+    if (parts.length === 0)
+      return "";
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(parts.join("|")));
+    return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, "0")).join("");
+  }
+  function dedupKeyFrom(method, url, fingerprint) {
+    return fingerprint ? `${method}:${url}:${fingerprint}` : `${method}:${url}`;
+  }
+  function defaultDedupKey(method, url, headers) {
+    if (headers === void 0)
+      return `${method}::${url}`;
+    const identity = Object.entries(headers).filter(([name]) => !NON_IDENTITY_HEADERS.includes(name.toLowerCase())).map(([name, value]) => `${name.toLowerCase()}=${value}`).sort();
+    return identity.length === 0 ? `${method}::${url}` : `${method}::${url}::${identity.join("&")}`;
+  }
   var DedupMap = class {
     /**
      * @param options - Deduplication configuration
@@ -12998,6 +13236,9 @@ ${text}`, "ENETWORK", void 0, requests[0], void 0, new Error(`HTTP ${response.st
     constructor(options = {}) {
       __publicField(this, "inflight", /* @__PURE__ */ new Map());
       __publicField(this, "timeouts", /* @__PURE__ */ new Map());
+      /** Window timers, overridable for tests. See {@link DedupOptions.timers}. */
+      __publicField(this, "_setTimeout");
+      __publicField(this, "_clearTimeout");
       __publicField(this, "windowMs");
       __publicField(this, "methods");
       __publicField(this, "keyFn");
@@ -13007,8 +13248,10 @@ ${text}`, "ENETWORK", void 0, requests[0], void 0, new Error(`HTTP ${response.st
       __publicField(this, "_misses", 0);
       this.windowMs = options.windowMs ?? 0;
       this.methods = new Set((options.methods ?? ["GET", "HEAD"]).map((m) => m.toUpperCase()));
-      this.keyFn = options.keyFn ?? ((m, url) => `${m}::${url}`);
+      this.keyFn = options.keyFn ?? defaultDedupKey;
       this._globalSignal = options.signal ?? null;
+      this._setTimeout = options.timers?.setTimeout ?? ((fn, ms) => setTimeout(fn, ms));
+      this._clearTimeout = options.timers?.clearTimeout ?? ((h) => clearTimeout(h));
     }
     /**
      * Execute `factory` for the given method/url, or return the in-flight
@@ -13032,9 +13275,12 @@ ${text}`, "ENETWORK", void 0, requests[0], void 0, new Error(`HTTP ${response.st
      * entry and creating a new one. The first caller becomes the "leader" and all
      * subsequent callers within the same tick share the same promise.
      *
-     * Note: The default `keyFn` does NOT include headers in the deduplication key.
-     * Two requests with different auth tokens to the same URL will NOT be deduplicated
-     * unless you provide a custom `keyFn` that includes headers.
+     * Note: the default key includes the request headers, so two requests to the
+     * same URL carrying different `Authorization` or `Cookie` are separate
+     * requests and are never coalesced. A key of method + URL alone was the
+     * default once, and it handed one caller's response to another: 50 callers
+     * aside, even two callers for different tenants shared a single response.
+     * See {@link defaultDedupKey}.
      */
     execute(method, url, factory, headers, windowMs, signal) {
       const effectiveWindowMs = windowMs ?? this.windowMs;
@@ -13077,7 +13323,7 @@ ${text}`, "ENETWORK", void 0, requests[0], void 0, new Error(`HTTP ${response.st
           this.inflight.delete(key);
           const existingTimeout = this.timeouts.get(key);
           if (existingTimeout !== void 0) {
-            clearTimeout(existingTimeout);
+            this._clearTimeout(existingTimeout);
             this.timeouts.delete(key);
           }
         } : null;
@@ -13102,10 +13348,10 @@ ${text}`, "ENETWORK", void 0, requests[0], void 0, new Error(`HTTP ${response.st
         } else {
           const stale = this.timeouts.get(key);
           if (stale !== void 0) {
-            clearTimeout(stale);
+            this._clearTimeout(stale);
             this.timeouts.delete(key);
           }
-          const timeoutId = setTimeout(() => {
+          const timeoutId = this._setTimeout(() => {
             this.inflight.delete(key);
             this.timeouts.delete(key);
           }, effectiveWindowMs);
@@ -13119,7 +13365,7 @@ ${text}`, "ENETWORK", void 0, requests[0], void 0, new Error(`HTTP ${response.st
           this.inflight.delete(key);
         const existingTimeout = this.timeouts.get(key);
         if (existingTimeout !== void 0) {
-          clearTimeout(existingTimeout);
+          this._clearTimeout(existingTimeout);
           this.timeouts.delete(key);
         }
         throw err;
@@ -13176,7 +13422,7 @@ ${text}`, "ENETWORK", void 0, requests[0], void 0, new Error(`HTTP ${response.st
     clear() {
       this.inflight.clear();
       for (const timeoutId of this.timeouts.values()) {
-        clearTimeout(timeoutId);
+        this._clearTimeout(timeoutId);
       }
       this.timeouts.clear();
     }
@@ -13190,7 +13436,7 @@ ${text}`, "ENETWORK", void 0, requests[0], void 0, new Error(`HTTP ${response.st
     invalidate(key) {
       const timeoutId = this.timeouts.get(key);
       if (timeoutId) {
-        clearTimeout(timeoutId);
+        this._clearTimeout(timeoutId);
         this.timeouts.delete(key);
       }
       return this.inflight.delete(key);
@@ -13467,7 +13713,7 @@ ${text}`, "ENETWORK", void 0, requests[0], void 0, new Error(`HTTP ${response.st
       const code = err.code;
       if (this.failureFilter.networkErrors && code === "ENETWORK")
         return true;
-      if (this.failureFilter.timeouts && code === "ETIMEOUT")
+      if (this.failureFilter.timeouts && (code === "ETIMEOUT" || code === "ETIMEDOUT"))
         return true;
       if (this.failureFilter.serverErrors) {
         const status = err.status;
@@ -13547,6 +13793,18 @@ ${text}`, "ENETWORK", void 0, requests[0], void 0, new Error(`HTTP ${response.st
 
   // dist/esm/ws.js
   init_utils();
+  function validateHandshakeHeaders(headers) {
+    if (!headers)
+      return;
+    for (const [name, value] of Object.entries(headers)) {
+      if (!isValidHeaderName(name)) {
+        throw new WSError(`Invalid WebSocket handshake header name: ${JSON.stringify(name)}`);
+      }
+      if (!isValidHeaderValue(value)) {
+        throw new WSError(`Invalid value for WebSocket handshake header ${JSON.stringify(name)}: must be a string of printable characters with no control characters`);
+      }
+    }
+  }
   var WSError = class extends Error {
     /**
      * @param message - Human-readable error description
@@ -13679,6 +13937,7 @@ ${text}`, "ENETWORK", void 0, requests[0], void 0, new Error(`HTTP ${response.st
       this._url = cfg.url;
       this._protocols = cfg.protocols;
       this._headers = cfg.headers;
+      validateHandshakeHeaders(cfg.headers);
       this._maxReconnects = cfg.maxReconnects ?? 10;
       this._reconnectBaseMs = cfg.reconnectBaseMs ?? 1e3;
       this._reconnectMaxMs = cfg.reconnectMaxMs ?? 3e4;
@@ -14396,7 +14655,13 @@ ${text}`, "ENETWORK", void 0, requests[0], void 0, new Error(`HTTP ${response.st
     }
     /** Buffer an outgoing message and track bytes for backpressure. */
     _bufferMessage(data, byteLen) {
-      if (this._bufferMessages && !this._aborted) {
+      if (!this._bufferMessages) {
+        if (!this._aborted) {
+          this._cbError?.(new WSError(`WebSocket message dropped: the socket is not open and bufferMessages is disabled (${byteLen} bytes). Reconnect, or enable bufferMessages to queue sends made while reconnecting.`));
+        }
+        return;
+      }
+      if (!this._aborted) {
         const evicted = this._buffer.length >= this._maxBufferSize ? this._buffer.shift() : void 0;
         if (evicted !== void 0) {
           this._bufferedBytes -= typeof evicted === "string" ? new TextEncoder().encode(evicted).byteLength : evicted.byteLength;
@@ -14516,6 +14781,7 @@ ${text}`, "ENETWORK", void 0, requests[0], void 0, new Error(`HTTP ${response.st
 
   // dist/esm/interceptors.js
   init_cache();
+  init_utils();
   init_types();
   init_headers();
   var _idSeq = 0;
@@ -14824,7 +15090,7 @@ ${text}`, "ENETWORK", void 0, requests[0], void 0, new Error(`HTTP ${response.st
         return;
       const delay = computeDelay(ctx.attempt, retryAfterMs(ctx));
       cfg.onRetry?.(ctx, delay);
-      await sleep2(delay);
+      await sleep(delay);
       return { ...ctx.request };
     };
     const errorInterceptor = async (ctx) => {
@@ -14832,7 +15098,7 @@ ${text}`, "ENETWORK", void 0, requests[0], void 0, new Error(`HTTP ${response.st
         return;
       const delay = computeDelay(ctx.attempt, null);
       cfg.onRetry?.(ctx, delay);
-      await sleep2(delay);
+      await sleep(delay);
       ctx.error = null;
       throw new RetrySignal(ctx.request);
     };
@@ -14997,13 +15263,7 @@ ${text}`, "ENETWORK", void 0, requests[0], void 0, new Error(`HTTP ${response.st
   function createLoggingInterceptor(config = {}) {
     const cfg = { ...LOG_DEFAULTS, ...config };
     const redactSet = new Set(cfg.redactHeaders.map((h) => h.toLowerCase()));
-    function redactHeaders(headers) {
-      const out = {};
-      for (const [k, v] of Object.entries(headers)) {
-        out[k] = redactSet.has(k.toLowerCase()) ? "**REDACTED**" : v;
-      }
-      return out;
-    }
+    const redactHeaders2 = (headers) => redactHeaders(headers, redactSet, "**REDACTED**");
     function makeEntry(type, ctx) {
       const requestId = ctx.store.get(REQUEST_ID_KEY) ?? "unknown";
       return {
@@ -15016,7 +15276,7 @@ ${text}`, "ENETWORK", void 0, requests[0], void 0, new Error(`HTTP ${response.st
         durationMs: type !== "request" ? now() - ctx.startedAt : null,
         attempt: ctx.attempt,
         error: ctx.error instanceof Error ? ctx.error.message : null,
-        headers: redactHeaders(ctx.request.headers ?? {})
+        headers: redactHeaders2(ctx.request.headers ?? {})
       };
     }
     const requestInterceptor = (ctx) => {
@@ -15552,12 +15812,7 @@ ${text}`, "ENETWORK", void 0, requests[0], void 0, new Error(`HTTP ${response.st
     };
     return { requestInterceptor, responseInterceptor, errorInterceptor, snapshot, reset };
   }
-  function now() {
-    return typeof performance !== "undefined" && typeof performance.now === "function" ? performance.now() : Date.now();
-  }
-  function sleep2(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-  }
+  var now = perfNow;
   function computeBodySize(body) {
     if (!body)
       return 0;
@@ -15624,6 +15879,10 @@ ${text}`, "ENETWORK", void 0, requests[0], void 0, new Error(`HTTP ${response.st
 
   // dist/esm/aws-sigv4.js
   init_types();
+  init_utils();
+  function toHex(bytes) {
+    return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+  }
   function staticCredentials(creds) {
     return () => Promise.resolve(creds);
   }
@@ -15793,16 +16052,6 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
     const sig = await crypto.subtle.sign("HMAC", cryptoKey, enc.encode(data));
     return new Uint8Array(sig);
   }
-  async function sha256Hex(data) {
-    const enc = new TextEncoder();
-    const raw = typeof data === "string" ? enc.encode(data) : data;
-    const buf = raw.buffer.slice(raw.byteOffset, raw.byteOffset + raw.byteLength);
-    const hashBuf = await crypto.subtle.digest("SHA-256", buf);
-    return toHex(new Uint8Array(hashBuf));
-  }
-  function toHex(bytes) {
-    return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
-  }
   var DEFAULT_UNSIGNED_HEADERS = /* @__PURE__ */ new Set([
     "user-agent",
     "x-forwarded-for",
@@ -16294,6 +16543,7 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
 
   // dist/esm/digest.js
   init_utils();
+  init_utils();
   function md5(input) {
     const bytes = [];
     for (let i = 0; i < input.length; i++) {
@@ -16458,11 +16708,11 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
     for (let offset = 0; offset < bytes.length; offset += 64) {
       const M = [];
       for (let i = 0; i < 16; i++) {
-        const b02 = bytes[offset + i * 4];
-        const b1 = bytes[offset + i * 4 + 1];
-        const b2 = bytes[offset + i * 4 + 2];
-        const b3 = bytes[offset + i * 4 + 3];
-        M[i] = (b02 | b1 << 8 | b2 << 16 | b3 << 24) >>> 0;
+        const w0 = bytes[offset + i * 4];
+        const w1 = bytes[offset + i * 4 + 1];
+        const w2 = bytes[offset + i * 4 + 2];
+        const w3 = bytes[offset + i * 4 + 3];
+        M[i] = (w0 | w1 << 8 | w2 << 16 | w3 << 24) >>> 0;
       }
       let A = a0, B = b0, C = c0, D = d0;
       for (let i = 0; i < 64; i++) {
@@ -16503,7 +16753,7 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
   function hexToBytes(hex) {
     const out = new Uint8Array(hex.length / 2);
     for (let i = 0; i < out.length; i++) {
-      out[i] = parseInt(hex.substr(i * 2, 2), 16);
+      out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
     }
     return out;
   }
@@ -16557,12 +16807,6 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
       throw new Error("Digest challenge missing 'nonce'");
     return challenge;
   }
-  async function sha256Hex2(data) {
-    const enc = new TextEncoder();
-    const buf = await crypto.subtle.digest("SHA-256", enc.encode(data));
-    const bytes = new Uint8Array(buf);
-    return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
-  }
   function sha512256Hex(data) {
     const K = [
       0x428a2f98d728ae22n,
@@ -16747,7 +16991,7 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
         return md5(s);
       if (algo === "SHA-512-256")
         return sha512256Hex(s);
-      return await sha256Hex2(s);
+      return await sha256Hex(s);
     }
     const user = challenge.userhash ? uint8ArrayToBase64(hexToBytes(await hash(`${username}:${realm}`))) : username;
     let ha1 = await hash(`${user}:${realm}:${password}`);
@@ -16778,7 +17022,7 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
       throw new Error(`Unsupported digest algorithm: ${challenge.algorithm}`);
     }
     const { algo } = resolved;
-    const digest = algo === "MD5" ? md5(`${username}:${challenge.realm}`) : algo === "SHA-512-256" ? sha512256Hex(`${username}:${challenge.realm}`) : await sha256Hex2(`${username}:${challenge.realm}`);
+    const digest = algo === "MD5" ? md5(`${username}:${challenge.realm}`) : algo === "SHA-512-256" ? sha512256Hex(`${username}:${challenge.realm}`) : await sha256Hex(`${username}:${challenge.realm}`);
     return uint8ArrayToBase64(hexToBytes(digest));
   }
   function resolveHashAlgo(algorithm) {
@@ -16836,12 +17080,26 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
   }
   function createDigestAuthorizer() {
     const counters = /* @__PURE__ */ new Map();
+    const MAX_TRACKED_NONCES = 64;
+    const rememberNonce = (scope, value) => {
+      if (!counters.has(scope)) {
+        counters.set(scope, value);
+        if (counters.size > MAX_TRACKED_NONCES) {
+          const oldest = counters.keys().next();
+          if (!oldest.done)
+            counters.delete(oldest.value);
+        }
+        return;
+      }
+      counters.delete(scope);
+      counters.set(scope, value);
+    };
     return async (wwwAuth, username, password, method, uri) => {
       const challenge = parseDigestChallenge(wwwAuth);
       const cnonce = randomBytes(5);
       const scope = `${challenge.realm}\0${challenge.nonce}`;
       const next = (counters.get(scope) ?? 0) + 1;
-      counters.set(scope, next);
+      rememberNonce(scope, next);
       const nc = next.toString(16).padStart(8, "0");
       const response = await computeDigestResponse(challenge, username, password, method, uri, cnonce, nc);
       const usernameStar = await computeUsernameStar(challenge, username);
@@ -16947,6 +17205,7 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
   function randomHex(len) {
     return randomBytes(len / 2);
   }
+  var DEFAULT_MAX_RESPONSE_SIZE = 100 * 1024 * 1024;
   var HAR_REDACT_HEADERS = /* @__PURE__ */ new Set([
     "authorization",
     "proxy-authorization",
@@ -17000,6 +17259,63 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
     "jwt",
     "code"
   ]);
+  function scrubKnownSecrets(text, req) {
+    const secrets = [];
+    const add = (v) => {
+      if (typeof v === "string" && v.length >= 8)
+        secrets.push(v);
+    };
+    for (const [name, value] of Object.entries(req.headers ?? {})) {
+      if (isSensitiveHeader(name, HAR_REDACT_HEADERS) && typeof value === "string") {
+        add(value);
+        const sp = value.indexOf(" ");
+        if (sp !== -1)
+          add(value.slice(sp + 1));
+      }
+    }
+    let query;
+    try {
+      query = new URL(req.url).searchParams;
+    } catch {
+      query = new URLSearchParams();
+    }
+    for (const [key, value] of query.entries()) {
+      if (HAR_REDACT_PARAMS.has(key.toLowerCase()) && typeof value === "string" && value.length >= 8) {
+        secrets.push(value);
+      }
+    }
+    let out = text;
+    for (const secret of secrets)
+      out = out.split(secret).join(HAR_REDACT_MASK);
+    return out;
+  }
+  function redactHARBody(text, mimeType) {
+    if (!/json/i.test(mimeType))
+      return text;
+    let parsed;
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      return text;
+    }
+    const walk = (node) => {
+      if (Array.isArray(node))
+        return node.map(walk);
+      if (node !== null && typeof node === "object") {
+        const out = {};
+        for (const [key, value] of Object.entries(node)) {
+          out[key] = HAR_REDACT_PARAMS.has(key.toLowerCase()) ? HAR_REDACT_MASK : walk(value);
+        }
+        return out;
+      }
+      return node;
+    };
+    try {
+      return JSON.stringify(walk(parsed));
+    } catch {
+      return text;
+    }
+  }
   var HAR_MAX_BODY_CHARS = 8192;
   function isHARBodySafeToRecord(contentType) {
     if (!contentType)
@@ -17026,8 +17342,12 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
       return url.replace(/([?&])(api_key|apikey|access_token|refresh_token|token|secret|password|signature|sig)=([^&#]*)/gi, "$1$2=***REDACTED***");
     }
   }
+  var HAR_REDACT_MASK = "***REDACTED***";
   function redactHARHeader(name, value) {
-    return HAR_REDACT_HEADERS.has(name.toLowerCase()) ? { name, value: "***REDACTED***" } : { name, value };
+    return {
+      name,
+      value: isSensitiveHeader(name, HAR_REDACT_HEADERS) ? HAR_REDACT_MASK : value
+    };
   }
   function harPostData(req) {
     if (!req.body)
@@ -17045,7 +17365,8 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
     } else {
       return {};
     }
-    return { postData: { mimeType, text: text.slice(0, HAR_MAX_BODY_CHARS) } };
+    const redacted = scrubKnownSecrets(redactHARBody(text, mimeType), req);
+    return { postData: { mimeType, text: redacted.slice(0, HAR_MAX_BODY_CHARS) } };
   }
   var HARRecorder = class {
     /**
@@ -17146,7 +17467,12 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
             mimeType: res.headers["content-type"] ?? "application/octet-stream",
             // Body text is only kept for non-HTML payloads and is truncated:
             // response bodies routinely carry tokens and PII.
-            ...typeof res.data === "string" && isHARBodySafeToRecord(res.headers["content-type"]) ? { text: res.data.slice(0, HAR_MAX_BODY_CHARS) } : {}
+            ...typeof res.data === "string" && isHARBodySafeToRecord(res.headers["content-type"]) ? {
+              // Same reason as the request side: a `text/plain` body has no
+              // field names to redact by, and a server that echoes the token
+              // back would otherwise put it in the export verbatim.
+              text: scrubKnownSecrets(res.data, req).slice(0, HAR_MAX_BODY_CHARS)
+            } : {}
           },
           // The Location header can itself carry a signed URL — redact it too.
           redirectURL: res.headers["location"] ? redactHARUrl(res.headers["location"]) : "",
@@ -17261,8 +17587,32 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
       return url.replace(/\/\/[^/@]*@/, "//");
     }
   }
-  function buildURL(base, url, params, allowedSchemes = ["http", "https"]) {
+  function buildURL(base, url, params, allowedSchemes = ["http", "https"], allowPrivateNetwork = false) {
     const MAX_QUERY_PARAM_COUNT = 100;
+    const forEachQueryParam = (params2, emit) => {
+      let paramCount = 0;
+      const count = () => {
+        paramCount++;
+        if (paramCount > MAX_QUERY_PARAM_COUNT) {
+          throw new KinetexError(`Query parameter count ${paramCount} exceeds limit of ${MAX_QUERY_PARAM_COUNT}`, "EVALIDATION");
+        }
+      };
+      for (const [key, value] of Object.entries(params2)) {
+        if (value === null || value === void 0)
+          continue;
+        if (Array.isArray(value)) {
+          for (const v of value) {
+            if (v === null || v === void 0)
+              continue;
+            count();
+            emit(key, String(v), true);
+          }
+        } else {
+          count();
+          emit(key, String(value), false);
+        }
+      }
+    };
     const MAX_URL_LENGTH = 8192;
     let full;
     if (/^https?:\/\//i.test(url)) {
@@ -17280,44 +17630,27 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
       }
     }
     if (!params || Object.keys(params).length === 0) {
-      if (!isSafeURL(full, allowedSchemes)) {
+      if (!isSafeURL(full, allowedSchemes, { allowPrivateNetwork })) {
         throw new KinetexError(`URL "${redactUserInfo(full)}" failed safety check \u2014 blocked private/loopback address or forbidden scheme`, "EVALIDATION");
       }
       return full;
     }
     try {
       const u = new URL(full);
-      if (!isSafeURL(u, allowedSchemes)) {
+      if (!isSafeURL(u, allowedSchemes, { allowPrivateNetwork })) {
         throw new KinetexError(`URL "${redactUserInfo(full)}" failed safety check \u2014 blocked private/loopback address or forbidden scheme`, "EVALIDATION");
       }
-      let paramCount = 0;
-      for (const [key, value] of Object.entries(params)) {
-        if (value === null || value === void 0)
-          continue;
-        const strValue = String(value);
-        if (Array.isArray(value)) {
-          for (const v of value) {
-            if (v !== null && v !== void 0) {
-              paramCount++;
-              if (paramCount > MAX_QUERY_PARAM_COUNT) {
-                throw new KinetexError(`Query parameter count ${paramCount} exceeds limit of ${MAX_QUERY_PARAM_COUNT}`, "EVALIDATION");
-              }
-              u.searchParams.append(key, String(v));
-            }
-          }
-        } else {
-          paramCount++;
-          if (paramCount > MAX_QUERY_PARAM_COUNT) {
-            throw new KinetexError(`Query parameter count ${paramCount} exceeds limit of ${MAX_QUERY_PARAM_COUNT}`, "EVALIDATION");
-          }
-          u.searchParams.set(key, strValue);
-        }
-      }
+      forEachQueryParam(params, (key, value, fromArray) => {
+        if (fromArray)
+          u.searchParams.append(key, value);
+        else
+          u.searchParams.set(key, value);
+      });
       const result = u.toString();
       if (result.length > MAX_URL_LENGTH) {
         throw new KinetexError(`URL length ${result.length} bytes exceeds limit of ${MAX_URL_LENGTH} bytes`, "EVALIDATION");
       }
-      if (!isSafeURL(result)) {
+      if (!isSafeURL(result, allowedSchemes, { allowPrivateNetwork })) {
         throw new KinetexError(`URL "${redactUserInfo(result)}" failed safety check \u2014 blocked private/loopback address or forbidden scheme`, "EVALIDATION");
       }
       return result;
@@ -17330,33 +17663,14 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
         full += "?";
       }
       const paramParts = [];
-      let paramCount = 0;
-      for (const [key, value] of Object.entries(params ?? {})) {
-        if (value === null || value === void 0)
-          continue;
-        if (Array.isArray(value)) {
-          for (const v of value) {
-            if (v !== null && v !== void 0) {
-              paramCount++;
-              if (paramCount > MAX_QUERY_PARAM_COUNT) {
-                throw new KinetexError(`Query parameter count ${paramCount} exceeds limit of ${MAX_QUERY_PARAM_COUNT}`, "EVALIDATION");
-              }
-              paramParts.push(`${encodeURIComponent(key)}=${encodeURIComponent(String(v))}`);
-            }
-          }
-        } else {
-          paramCount++;
-          if (paramCount > MAX_QUERY_PARAM_COUNT) {
-            throw new KinetexError(`Query parameter count ${paramCount} exceeds limit of ${MAX_QUERY_PARAM_COUNT}`, "EVALIDATION");
-          }
-          paramParts.push(`${encodeURIComponent(key)}=${encodeURIComponent(String(value))}`);
-        }
-      }
+      forEachQueryParam(params ?? {}, (key, value) => {
+        paramParts.push(`${encodeURIComponent(key)}=${encodeURIComponent(value)}`);
+      });
       const result = full + paramParts.join("&");
       if (result.length > MAX_URL_LENGTH) {
         throw new KinetexError(`URL length ${result.length} bytes exceeds limit of ${MAX_URL_LENGTH} bytes`, "EVALIDATION");
       }
-      if (!isSafeURL(result)) {
+      if (!isSafeURL(result, allowedSchemes, { allowPrivateNetwork })) {
         throw new KinetexError(`URL "${redactUserInfo(result)}" failed safety check \u2014 blocked private/loopback address or forbidden scheme`, "EVALIDATION");
       }
       return result;
@@ -17386,11 +17700,26 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
     }
     return out;
   }
+  function loggableBody(body) {
+    if (body === null || body === void 0)
+      return null;
+    if (typeof body === "string")
+      return body;
+    if (body instanceof Uint8Array)
+      return body;
+    try {
+      return JSON.stringify(body);
+    } catch {
+      return null;
+    }
+  }
   function shouldRetry(cfg, ctx) {
     if (ctx.attempt > cfg.maxRetries)
       return false;
-    if (!cfg.methods.includes(ctx.request.method))
+    const hasIdempotencyKey = Object.keys(ctx.request.headers ?? {}).some((name) => name.toLowerCase() === "idempotency-key" && ctx.request.headers[name] !== "");
+    if (!hasIdempotencyKey && !cfg.methods.includes(ctx.request.method)) {
       return false;
+    }
     if (cfg.shouldRetry)
       return cfg.shouldRetry(ctx);
     if (ctx.error) {
@@ -17417,6 +17746,10 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
           return false;
         case "EREDIRECT":
           return false;
+        // A blocked host is a permanent refusal, not a transport hiccup; retrying
+        // resolves the same name to the same blocked address.
+        case "EBLOCKEDHOST":
+          return false;
         case "EUNKNOWN":
           return false;
         default: {
@@ -17542,7 +17875,9 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
         {
           ...config.strictHeaders ? { strict: true } : {},
           ...config.dispatcher !== void 0 ? { dispatcher: config.dispatcher } : {},
-          ...config.proxy !== void 0 ? { proxy: config.proxy } : {}
+          ...config.proxy !== void 0 ? { proxy: config.proxy } : {},
+          ...config.allowPrivateNetwork !== void 0 ? { allowPrivateNetwork: config.allowPrivateNetwork } : {},
+          ...config.ca !== void 0 ? { ca: config.ca } : {}
         }
       );
       if (config.interceptors) {
@@ -17639,7 +17974,7 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
           status: ctx.response.status,
           statusText: ctx.response.statusText,
           headers: ctx.response.headers,
-          body: ctx.response.rawBody ?? null,
+          body: ctx.response.body ?? null,
           request: {
             url: ctx.request.url,
             method: ctx.request.method,
@@ -18011,12 +18346,7 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
      * ```
      */
     async ws(url, options = {}) {
-      const fullURL = buildURL(this.cfg.baseURL, url, this.cfg.params, [
-        "http",
-        "https",
-        "ws",
-        "wss"
-      ]);
+      const fullURL = buildURL(this.cfg.baseURL, url, this.cfg.params, ["http", "https", "ws", "wss"], this.cfg.allowPrivateNetwork);
       const headers = mergeHeaders(this.cfg.headers, options.headers);
       const authHeaders = {};
       const auth = this.cfg.auth;
@@ -18044,7 +18374,11 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
       }
       const jar = await this.getCookieJar();
       if (jar) {
-        const cookieHeader = jar.getCookieHeader({ url: fullURL, http: false });
+        const cookieHeader = jar.getCookieHeader({
+          url: fullURL,
+          http: false,
+          sameSiteContext: "strict"
+        });
         if (cookieHeader)
           headers["cookie"] = cookieHeader;
       }
@@ -18052,7 +18386,7 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
         const wsUrl = new URL(fullURL);
         if (this.cfg.baseURL) {
           const baseUrl = new URL(this.cfg.baseURL);
-          const wsIsSecure = wsUrl.protocol === "wss:";
+          const wsIsSecure = wsUrl.protocol === "wss:" || wsUrl.protocol === "https:";
           const httpIsSecure = baseUrl.protocol === "https:" || baseUrl.protocol === "wss:";
           if (wsIsSecure !== httpIsSecure || wsUrl.host !== baseUrl.host) {
             throw new KinetexError(`WebSocket origin ${wsUrl.origin} does not match baseURL origin ${baseUrl.origin}`, "EVALIDATION");
@@ -18100,6 +18434,7 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
       this._wsClients.add(client);
       await client.connect().catch((err) => {
         this._wsClients.delete(client);
+        client.destroy();
         throw err;
       });
       return client;
@@ -18118,10 +18453,14 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
      * @returns A promise resolving to the parsed response.
      */
     async send(url, method, options = {}) {
-      const startMs = perfNow4();
+      const startMs = perfNow();
       const wallClockMs = Date.now();
       const timeoutMs = options.timeout !== void 0 ? options.timeout : this.cfg.timeout ?? 3e4;
-      const retryCfg = options.retry === false ? false : { ...this.retryConfig, ...options.retry ?? {} };
+      const retryCfg = options.retry === false ? false : {
+        ...this.retryConfig,
+        ...options.retry ?? {},
+        ...options.retry?.totalTimeoutMs !== void 0 ? {} : { totalTimeoutMs: options.totalTimeoutMs ?? this.cfg.totalTimeoutMs ?? timeoutMs }
+      };
       const VALID_METHODS = [
         "GET",
         "POST",
@@ -18137,7 +18476,7 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
       if (!VALID_METHODS.includes(normalizedMethod)) {
         throw new KinetexError(`Invalid HTTP method '${method}'. Valid methods: ${VALID_METHODS.join(", ")}`, "EVALIDATION");
       }
-      const fullUrl = buildURL(options.baseURL ?? this.cfg.baseURL, url, mergeParams(this.cfg.params, options.params));
+      const fullUrl = buildURL(options.baseURL ?? this.cfg.baseURL, url, mergeParams(this.cfg.params, options.params), void 0, this.cfg.allowPrivateNetwork === true);
       const perRequestProxy = options.proxy;
       if (perRequestProxy) {
         throw new KinetexError("A per-request `proxy` is not supported because the transport pools one connection per origin \u2014 set `proxy` on the client instead, or use a custom `fetch` with a proxy agent for per-request routing. SOCKS5 requires createSocks5Tunnel() from kinetex/socks5.", "EVALIDATION");
@@ -18238,11 +18577,16 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
         req = await this.cfg.transformRequest(req);
       const jar = await this.getCookieJar();
       if (jar) {
-        const cookieHeader = jar.getCookieHeader({ url: req.url, http: true });
+        const cookieHeader = jar.getCookieHeader({
+          url: req.url,
+          http: true,
+          sameSiteContext: "strict"
+        });
         if (cookieHeader)
           req = { ...req, headers: { ...req.headers, cookie: cookieHeader } };
       }
       let _otelSpan = null;
+      let _dedupKey = "";
       try {
         if (this._otelTracer) {
           _otelSpan = this._otelTracer.startSpan(`HTTP ${req.method}`, {
@@ -18270,6 +18614,10 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
             meta: { ...req.meta, spanId }
           };
         }
+        if (this._dedup) {
+          const identity = await identityFingerprint(req.headers);
+          _dedupKey = dedupKeyFrom(req.method, req.url, identity);
+        }
       } catch (tracingErr) {
         if (_otelSpan) {
           _otelSpan.setStatus({
@@ -18297,11 +18645,6 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
         }
       }
       const _execFactory = () => this._executeWithRetry(req, retryCfg, timeoutMs, options, startMs, wallClockMs);
-      let _dedupKey = "";
-      if (this._dedup) {
-        const authFp = await getAuthFingerprint(req.headers ?? {});
-        _dedupKey = `${req.method}:${req.url}${authFp ? ":" + authFp : ""}`;
-      }
       const _dedupedFactory = this._dedup ? () => this._dedup.execute(req.method, _dedupKey, _execFactory).then((r) => r) : _execFactory;
       const _guardedFactory = this._circuitBreakers ? () => this._circuitBreakers.execute(_cbOrigin, _dedupedFactory).then((r) => r) : _dedupedFactory;
       try {
@@ -18416,12 +18759,16 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
             const doRetry = retryCfg.shouldRetry ? await retryCfg.shouldRetry(retryCtx) : shouldRetry(retryCfg, retryCtx);
             if (doRetry) {
               const delay = computeRetryDelay(retryCfg, attempt, getRetryAfterMs(res.headers));
+              if (retryCfg.totalTimeoutMs !== void 0 && retryCfg.totalTimeoutMs > 0) {
+                if (perfNow() - startMs + delay >= retryCfg.totalTimeoutMs)
+                  return res;
+              }
               await retryCfg.onRetry?.(retryCtx, delay);
               await this.cfg.hooks?.onRetry?.reduce(async (p, fn) => {
                 await p;
                 await fn(retryCtx);
               }, Promise.resolve());
-              await sleep5(delay, req.signal);
+              await sleep3(delay, req.signal);
               continue;
             }
           }
@@ -18459,12 +18806,17 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
             const doRetry = clockSkewCorrected ? true : retryCfg.shouldRetry ? await retryCfg.shouldRetry(retryCtx) : shouldRetry(retryCfg, retryCtx);
             if (doRetry) {
               const delay = computeRetryDelay(retryCfg, attempt, errResponse ? getRetryAfterMs(errResponse.headers) : null);
+              if (retryCfg.totalTimeoutMs !== void 0 && retryCfg.totalTimeoutMs > 0) {
+                if (perfNow() - startMs + delay >= retryCfg.totalTimeoutMs) {
+                  throw err;
+                }
+              }
               await retryCfg.onRetry?.(retryCtx, delay);
               await this.cfg.hooks?.onRetry?.reduce(async (p, fn) => {
                 await p;
                 await fn(retryCtx);
               }, Promise.resolve());
-              await sleep5(delay, req.signal);
+              await sleep3(delay, req.signal);
               continue;
             }
           }
@@ -18530,7 +18882,7 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
               request: currentReq,
               response: null,
               error: null,
-              startedAt: perfNow4(),
+              startedAt: perfNow(),
               attempt: 1,
               meta: currentReq.meta
             });
@@ -18575,7 +18927,9 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
             if (protocol !== "http:" && protocol !== "https:") {
               throw new KinetexError(`Unsafe redirect to ${protocol} detected \u2014 only HTTP(S) allowed`, "ENETWORK", { request: req });
             }
-            if (!isSafeURL(nextUrl)) {
+            if (!isSafeURL(nextUrl, void 0, {
+              allowPrivateNetwork: this.cfg.allowPrivateNetwork === true
+            })) {
               throw new KinetexError(`Unsafe redirect target blocked: ${redactUserInfo(location)}`, "EVALIDATION", { request: req });
             }
             if (this.cfg.httpsOnly && protocol !== "https:") {
@@ -18591,6 +18945,9 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
           }
           const nextMethod = raw.status === 301 || raw.status === 302 || raw.status === 303 ? "GET" : currentReq.method;
           const nextBody = nextMethod === "GET" || nextMethod === "HEAD" ? null : currentReq.body;
+          if (nextBody !== null && isNonReplayableBody(nextBody)) {
+            throw new KinetexError("Cannot follow this redirect: a 307/308 preserves the method and body, and this request's body is a stream or Blob that the first attempt already consumed. Buffer it first, or disable redirects for this request.", "EVALIDATION", { request: currentReq });
+          }
           const nextHeaders = { ...currentReq.headers };
           let crossOrigin = false;
           try {
@@ -18606,7 +18963,11 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
             }
           }
           if (jar) {
-            const cookieHeader = jar.getCookieHeader({ url: nextUrl, http: true });
+            const cookieHeader = jar.getCookieHeader({
+              url: nextUrl,
+              http: true,
+              sameSiteContext: "strict"
+            });
             if (cookieHeader) {
               nextHeaders["cookie"] = cookieHeader;
             } else {
@@ -18659,6 +19020,10 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
         }
       }
       this._trace(_traceId, "lifecycle_before", "end", startMs, attempt);
+      const _logger = await this.getLogger();
+      if (_logger) {
+        _logger.logRequest(_traceId, req.method, req.url, req.headers, loggableBody(req.body), attempt);
+      }
       const forceRefresh = options.cache !== false && options.cache?.forceRefresh === true;
       if (options.cache !== false && this.cfg.cache) {
         const cache = await this.getCache();
@@ -18879,7 +19244,7 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
           }
         });
       }
-      const maxSize = options.maxResponseSize ?? this.cfg.maxResponseSize ?? 0;
+      const maxSize = options.maxResponseSize ?? this.cfg.maxResponseSize ?? DEFAULT_MAX_RESPONSE_SIZE;
       const rawBody = await readRawBody(bodyStream, maxSize, raw.url, req.signal);
       const jar = await this.getCookieJar();
       if (jar) {
@@ -18891,7 +19256,7 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
       this._trace(_traceId, "response_parse", "start", startMs, attempt);
       const data = await parseBody(rawBody, ct, options.parseResponse, options.parseFailure, raw.headers, raw.url);
       this._trace(_traceId, "response_parse", "end", startMs, attempt);
-      const durationMs = perfNow4() - startMs;
+      const durationMs = perfNow() - startMs;
       const res = {
         status: raw.status,
         statusText: raw.statusText,
@@ -18900,6 +19265,9 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
         // the real response object instead of the `{}` placeholder it used to get.
         data,
         rawBody,
+        // The same bytes in the shape an interceptor sees, so one response
+        // object satisfies both the public and the pipeline views.
+        body: rawBody,
         url: raw.url,
         cached: false,
         redirected: raw.redirected,
@@ -18917,9 +19285,9 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
           await cache.set({ url: req.url, method: req.method, headers: req.headers }, { status: raw.status, statusText: raw.statusText, headers: raw.headers, body: rawBody }, { tags: options.tags ?? [] });
         }
       }
-      const logger = await this.getLogger();
+      const logger = _logger ?? await this.getLogger();
       if (logger) {
-        const requestId = ctx.store.get("requestId") ?? req.meta["requestId"] ?? "unknown";
+        const requestId = ctx.store.get("requestId") ?? req.meta["requestId"] ?? _traceId;
         logger.logResponse(requestId, res.status, res.statusText, res.headers, rawBody, attempt, false);
       }
       this.harRecorder?.record(req, res, wallClockMs ?? Date.now() - res.durationMs);
@@ -18997,7 +19365,7 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
               await p;
               await fn2(retryCtx);
             }, Promise.resolve());
-            await sleep5(delay, _req.signal);
+            await sleep3(delay, _req.signal);
           }
           return this._executeOnce({
             ...result,
@@ -19051,7 +19419,7 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
       const bodyData = raw.body;
       const rawBody = bodyData instanceof Uint8Array ? bodyData : typeof bodyData === "string" ? new TextEncoder().encode(bodyData) : null;
       const data = rawBody ? await parseBody(rawBody, raw.headers["content-type"] ?? null, options.parseResponse, options.parseFailure, raw.headers, "url" in raw ? raw.url : req.url) : null;
-      const durationMs = perfNow4() - startMs;
+      const durationMs = perfNow() - startMs;
       const responseURL = "url" in raw ? raw.url : req.url;
       const wasRedirected = "redirected" in raw ? raw.redirected : false;
       const responseHTTPVersion = "httpVersion" in raw ? raw.httpVersion : "HTTP/1.1";
@@ -19059,6 +19427,8 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
         status: raw.status,
         statusText: raw.statusText,
         headers: raw.headers,
+        // Present so the object satisfies both response views at once.
+        body: rawBody,
         data,
         rawBody,
         url: responseURL,
@@ -19175,7 +19545,7 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
     async sse(url, options = {}) {
       const { SSEClient: SSEClient2 } = await Promise.resolve().then(() => (init_sse(), sse_exports));
       const headers = mergeHeaders(this.cfg.headers, options.headers);
-      const fullURL = buildURL(this.cfg.baseURL, url, this.cfg.params);
+      const fullURL = buildURL(this.cfg.baseURL, url, this.cfg.params, void 0, this.cfg.allowPrivateNetwork);
       const pipeFetch = async (input, init) => {
         const reqUrl = typeof input === "string" ? input : input.url;
         const fi = init;
@@ -19214,7 +19584,7 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
     async graphql(url, options = {}) {
       const { GraphQLClient: GraphQLClient2 } = await Promise.resolve().then(() => (init_graphql(), graphql_exports));
       const headers = mergeHeaders(this.cfg.headers, options.headers);
-      const fullURL = buildURL(this.cfg.baseURL, url, this.cfg.params);
+      const fullURL = buildURL(this.cfg.baseURL, url, this.cfg.params, void 0, this.cfg.allowPrivateNetwork);
       const pipeFetch = async (input, init) => {
         const reqUrl = typeof input === "string" ? input : input.url;
         const fi = init;
@@ -19252,7 +19622,7 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
      */
     async paginate(url, options) {
       const { createPagePaginator: createPagePaginator2 } = await Promise.resolve().then(() => (init_pagination(), pagination_exports));
-      const fullURL = buildURL(this.cfg.baseURL, url, this.cfg.params);
+      const fullURL = buildURL(this.cfg.baseURL, url, this.cfg.params, void 0, this.cfg.allowPrivateNetwork);
       const pipeFetch = async (input, init) => {
         const reqUrl = typeof input === "string" ? input : input.url;
         const fi = init;
@@ -19579,7 +19949,7 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
       return void 0;
     return { ...a, ...b };
   }
-  function sleep5(ms, signal) {
+  function sleep3(ms, signal) {
     return new Promise((resolve, reject) => {
       if (signal?.aborted) {
         reject(createAbortError());
@@ -19601,9 +19971,6 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
       return true;
     return typeof Blob !== "undefined" && body instanceof Blob;
   }
-  function perfNow4() {
-    return typeof performance !== "undefined" ? performance.now() : Date.now();
-  }
   function createMethodCircuitBreakerKey(req) {
     try {
       return `${req.method}:${new URL(req.url).origin}`;
@@ -19739,6 +20106,7 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
   init_headers();
 
   // dist/esm/lifecycle.js
+  init_utils();
   var HookEmitter = class {
     constructor() {
       __publicField(this, "listeners", /* @__PURE__ */ new Map());
@@ -20286,12 +20654,7 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
   function createLoggingHooks(options = {}) {
     const log = options.logger ?? ((msg, data) => console.log(msg, JSON.stringify(data)));
     const redact = new Set((options.redactHeaders ?? ["authorization", "cookie", "set-cookie", "proxy-authorization"]).map((h) => h.toLowerCase()));
-    function safeHeaders(h) {
-      const out = {};
-      for (const [k, v] of Object.entries(h))
-        out[k] = redact.has(k.toLowerCase()) ? "***" : v;
-      return out;
-    }
+    const safeHeaders = (h) => redactHeaders(h, redact, "***");
     return {
       beforeRequest: (req) => {
         log("\u2192 request", {
@@ -20320,11 +20683,11 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
     const TIMING_KEY = "__kinetex_timing__";
     return {
       beforeRequest: (_req, ctx) => {
-        ctx.meta[TIMING_KEY] = perfNow5();
+        ctx.meta[TIMING_KEY] = perfNow();
       },
       afterResponse: (_res, ctx) => {
         const start = ctx.meta[TIMING_KEY];
-        const elapsed = start !== void 0 ? perfNow5() - start : null;
+        const elapsed = start !== void 0 ? perfNow() - start : null;
         if (elapsed !== null) {
           ctx.meta.durationMs = elapsed;
         }
@@ -20347,7 +20710,7 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
       beforeRequest: (req, ctx) => {
         if (req.signal?.aborted) {
           ctx.meta.aborted = true;
-          throw createAbortError2("Request aborted before sending");
+          throw abortError("Request aborted before sending");
         }
       },
       onCancel: (evt) => {
@@ -20355,23 +20718,12 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
       }
     };
   }
-  function createAbortError2(message) {
-    if (typeof DOMException !== "undefined") {
-      return new DOMException(message, "AbortError");
-    }
-    const err = new Error(message);
-    err.name = "AbortError";
-    return err;
-  }
-  function perfNow5() {
-    return typeof performance !== "undefined" ? performance.now() : Date.now();
-  }
   function createHookContext(request, overrides = {}) {
     return {
       request,
       response: null,
       error: null,
-      startedAt: perfNow5(),
+      startedAt: perfNow(),
       attempt: 1,
       meta: {},
       ...overrides
@@ -20656,12 +21008,12 @@ ${errors.map((e) => `  - ${e.message}`).join("\n")}`);
         const retriable = err instanceof Socks5Error && err.retriable;
         if (!retriable || attempt === maxRetries)
           break;
-        await sleep6(delayMs * Math.pow(2, attempt));
+        await sleep4(delayMs * Math.pow(2, attempt));
       }
     }
     throw lastError;
   }
-  function sleep6(ms) {
+  function sleep4(ms) {
     return new Promise((r) => setTimeout(r, ms));
   }
   var TRANSIENT_DIAL_CODES = /* @__PURE__ */ new Set([