kinetex 1.4.0 → 1.5.0

package/dist/cjs/aws-sigv4.js

@@ -22,6 +22,13 @@
  */
 // Node.js globals accessed via globalThis for cross-runtime compatibility
 import { TimeoutError, NetworkError } from "./types.js";
+import { sha256Hex } from "./utils.js";
+/** Convert a Uint8Array to a lowercase hex string. */
+function toHex(bytes) {
+    return Array.from(bytes)
+        .map((b) => b.toString(16).padStart(2, "0"))
+        .join("");
+}
 /**
  * Static credential provider — wraps a fixed set of credentials.
  */
@@ -277,20 +284,6 @@ async function hmacSHA256(key, data) {
 /**
  * SHA-256 hash of a string or bytes. Returns lowercase hex.
  */
-async function sha256Hex(data) {
-    const enc = new TextEncoder();
-    const raw = typeof data === "string" ? enc.encode(data) : data;
-    // Cast to ArrayBuffer for WebCrypto digest overload
-    const buf = raw.buffer.slice(raw.byteOffset, raw.byteOffset + raw.byteLength);
-    const hashBuf = await crypto.subtle.digest("SHA-256", buf);
-    return toHex(new Uint8Array(hashBuf));
-}
-/** Convert a Uint8Array to a lowercase hex string. */
-function toHex(bytes) {
-    return Array.from(bytes)
-        .map((b) => b.toString(16).padStart(2, "0"))
-        .join("");
-}
 // ============================================================================
 // #5  CANONICAL REQUEST
 // ============================================================================

package/dist/cjs/cache.js

@@ -438,6 +438,15 @@ function computeTTL(response, defaultTtl, honor) {
     if (honor && d.noStore) {
         return { ttlMs: 0, swrMs: 0, staleOnError: 0, shouldCache: false };
     }
+    // `private` marks a response as belonging to a single user. A browser's cache
+    // *is* per-user, so storing it there is correct — but this cache is a Map in
+    // the calling process, shared by every request that process makes. Honouring
+    // the directive is the difference between one user's `private` response and
+    // another user's. `d.private` was parsed and then never read, so a response
+    // that explicitly asked not to be shared was stored and replayed anyway.
+    if (honor && d.private) {
+        return { ttlMs: 0, swrMs: 0, staleOnError: 0, shouldCache: false };
+    }
     // s-maxage takes priority (for shared/proxy caches)
     const maxAgeSecs = d.sMaxAge ?? d.maxAge;
     let ttlMs;

package/dist/cjs/circuit-breaker.js

@@ -327,7 +327,14 @@ export class CircuitBreaker {
         const code = err.code;
         if (this.failureFilter.networkErrors && code === "ENETWORK")
             return true;
-        if (this.failureFilter.timeouts && code === "ETIMEOUT")
+        // `ETIMEDOUT` as well as `ETIMEOUT`. The timeout interceptor raises its own
+        // `TimeoutError` (src/interceptors.ts), which carries `ETIMEDOUT`, so a
+        // request that timed out at the interceptor was never counted toward the
+        // threshold no matter what `failureFilter.timeouts` was set to. Both codes
+        // are kept because `ETIMEDOUT` is also a node:net errno (see
+        // `TRANSIENT_DIAL_CODES` in socks5.ts), so accepting it is right
+        // independently of the interceptor.
+        if (this.failureFilter.timeouts && (code === "ETIMEOUT" || code === "ETIMEDOUT"))
             return true;
         if (this.failureFilter.serverErrors) {
             const status = err.status;