lifecycleion 0.0.19 → 0.0.21

package/dist/lib/http-client-node/index.d.cts

@@ -1,4 +1,5 @@
-import { H as HTTPAdapter, A as AdapterType, a as AdapterRequest, b as AdapterResponse } from '../../types-CWw885iO.cjs';
+import { H as HTTPAdapter, A as AdapterType, a as AdapterRequest, b as AdapterResponse } from '../../types-BFvpJPMt.cjs';
+export { c as AdapterProgressEvent, d as HTTPMethod, S as StreamResponseCancel, e as StreamResponseContext, f as StreamResponseFactory, g as StreamResponseInfo, W as WritableLike } from '../../types-BFvpJPMt.cjs';
 import '../../types-BW0vnSzd.cjs';
 
 interface NodeAdapterConfig {
@@ -48,6 +49,36 @@ interface NodeAdapterConfig {
      * routes by Host, also set defaultHeaders: { host: 'billing.internal' }.
      */
     servername?: string;
+    /**
+     * Certificate revocation list(s), used to reject a server certificate whose
+     * serial has been revoked even though its chain and hostname still check out.
+     * A revoked certificate fails the handshake with `CERT_REVOKED`.
+     *
+     * Accepts whatever your CA tooling produced. A PEM string holding SEVERAL
+     * concatenated CRLs — the format Apache's `SSLCARevocationFile`, nginx's
+     * `ssl_crl` and HAProxy's `crl-file` all expect, and what `openssl ca
+     * -gencrl` output is usually assembled into — is split into the array Node
+     * requires. A single CRL, a DER `Buffer`, or an array you built yourself is
+     * passed through untouched.
+     *
+     * The split exists because Node reads only the FIRST CRL of a concatenated
+     * string and silently ignores the rest, unlike `ca`, which reads every
+     * certificate in a bundle. See docs/http-client.md.
+     *
+     * Two things to know before using this:
+     *
+     * - **Every certificate in the chain needs a covering CRL.** Node enables
+     *   `X509_V_FLAG_CRL_CHECK_ALL`, so supplying a CRL for one root while
+     *   connecting through another fails with `UNABLE_TO_GET_CRL` even when
+     *   nothing was revoked. Cover every root you talk to, or scope the client.
+     * - **CRLs expire.** Past `nextUpdate` the handshake fails with
+     *   `CRL_HAS_EXPIRED`, including for certificates that were never revoked.
+     *   Re-pass a fresh CRL before then; the refresh cadence is yours to own.
+     *
+     * Both failures are fail-closed, so a stale CRL never silently stops
+     * enforcing — but both can take out healthy connections.
+     */
+    crl?: string | Buffer | Array<string | Buffer>;
     /**
      * Set to false to accept self-signed certificates in dev/test environments.
      * Defaults to true (Node.js default — rejects invalid certs).
@@ -61,4 +92,4 @@ declare class NodeAdapter implements HTTPAdapter {
     send(request: AdapterRequest): Promise<AdapterResponse>;
 }
 
-export { NodeAdapter, type NodeAdapterConfig };
+export { AdapterRequest, AdapterResponse, AdapterType, HTTPAdapter, NodeAdapter, type NodeAdapterConfig };

package/dist/lib/http-client-node/index.d.ts

@@ -1,4 +1,5 @@
-import { H as HTTPAdapter, A as AdapterType, a as AdapterRequest, b as AdapterResponse } from '../../types-Mso0dYOS.js';
+import { H as HTTPAdapter, A as AdapterType, a as AdapterRequest, b as AdapterResponse } from '../../types-BONtIhQ5.js';
+export { c as AdapterProgressEvent, d as HTTPMethod, S as StreamResponseCancel, e as StreamResponseContext, f as StreamResponseFactory, g as StreamResponseInfo, W as WritableLike } from '../../types-BONtIhQ5.js';
 import '../../types-BW0vnSzd.js';
 
 interface NodeAdapterConfig {
@@ -48,6 +49,36 @@ interface NodeAdapterConfig {
      * routes by Host, also set defaultHeaders: { host: 'billing.internal' }.
      */
     servername?: string;
+    /**
+     * Certificate revocation list(s), used to reject a server certificate whose
+     * serial has been revoked even though its chain and hostname still check out.
+     * A revoked certificate fails the handshake with `CERT_REVOKED`.
+     *
+     * Accepts whatever your CA tooling produced. A PEM string holding SEVERAL
+     * concatenated CRLs — the format Apache's `SSLCARevocationFile`, nginx's
+     * `ssl_crl` and HAProxy's `crl-file` all expect, and what `openssl ca
+     * -gencrl` output is usually assembled into — is split into the array Node
+     * requires. A single CRL, a DER `Buffer`, or an array you built yourself is
+     * passed through untouched.
+     *
+     * The split exists because Node reads only the FIRST CRL of a concatenated
+     * string and silently ignores the rest, unlike `ca`, which reads every
+     * certificate in a bundle. See docs/http-client.md.
+     *
+     * Two things to know before using this:
+     *
+     * - **Every certificate in the chain needs a covering CRL.** Node enables
+     *   `X509_V_FLAG_CRL_CHECK_ALL`, so supplying a CRL for one root while
+     *   connecting through another fails with `UNABLE_TO_GET_CRL` even when
+     *   nothing was revoked. Cover every root you talk to, or scope the client.
+     * - **CRLs expire.** Past `nextUpdate` the handshake fails with
+     *   `CRL_HAS_EXPIRED`, including for certificates that were never revoked.
+     *   Re-pass a fresh CRL before then; the refresh cadence is yours to own.
+     *
+     * Both failures are fail-closed, so a stale CRL never silently stops
+     * enforcing — but both can take out healthy connections.
+     */
+    crl?: string | Buffer | Array<string | Buffer>;
     /**
      * Set to false to accept self-signed certificates in dev/test environments.
      * Defaults to true (Node.js default — rejects invalid certs).
@@ -61,4 +92,4 @@ declare class NodeAdapter implements HTTPAdapter {
     send(request: AdapterRequest): Promise<AdapterResponse>;
 }
 
-export { NodeAdapter, type NodeAdapterConfig };
+export { AdapterRequest, AdapterResponse, AdapterType, HTTPAdapter, NodeAdapter, type NodeAdapterConfig };

package/dist/lib/http-client-node/index.js

@@ -325,19 +325,63 @@ var CERT_ERROR_CODES = /* @__PURE__ */ new Set([
   "ERR_SSL_TLSV13_ALERT_CERTIFICATE_REQUIRED",
   "ERR_SSL_PEER_DID_NOT_RETURN_A_CERTIFICATE",
   "SELF_SIGNED_CERT_IN_CHAIN",
-  "UNABLE_TO_GET_ISSUER_CERT_LOCALLY"
+  "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
+  "CERT_REVOKED"
 ]);
+var CRL_CODE_PATTERN = /(?:^|_)CRLS?(?:_|$)/;
+var TRANSPORT_ERROR_CODES = /* @__PURE__ */ new Set([
+  "ENOTFOUND",
+  "EAI_AGAIN",
+  "ECONNREFUSED",
+  "ECONNRESET",
+  "ECONNABORTED",
+  "ETIMEDOUT",
+  "EPIPE",
+  "EHOSTUNREACH",
+  "EHOSTDOWN",
+  "ENETUNREACH",
+  "ENETDOWN",
+  "EADDRNOTAVAIL"
+]);
+var UNDICI_TRANSPORT_ERROR_PREFIX = "UND_ERR_";
 function isTLSCertificateError(error) {
-  const code = error.code ?? "";
+  if (isTLSCertificateErrorSelf(error)) {
+    return true;
+  }
+  const cause = readMember(error, "cause");
+  return isErrorValue(cause) ? isTLSCertificateErrorSelf(cause) : false;
+}
+function isErrorValue(value) {
+  try {
+    return value instanceof Error;
+  } catch {
+    return false;
+  }
+}
+function isTLSCertificateErrorSelf(error) {
+  const rawCode = readMember(error, "code");
+  const code = typeof rawCode === "string" ? rawCode : "";
   if (CERT_ERROR_CODES.has(code)) {
     return true;
   }
+  if (CRL_CODE_PATTERN.test(code)) {
+    return true;
+  }
   if ((code.startsWith("ERR_TLS_") || code.startsWith("ERR_SSL_")) && code.includes("CERT")) {
     return true;
   }
-  return /certificate|self signed|unable to verify|altname/i.test(
-    error.message
-  );
+  if (TRANSPORT_ERROR_CODES.has(code) || code.startsWith(UNDICI_TRANSPORT_ERROR_PREFIX)) {
+    return false;
+  }
+  const message = readMember(error, "message");
+  return typeof message === "string" ? /certificate|self signed|unable to verify|altname/i.test(message) : false;
+}
+function readMember(error, key) {
+  try {
+    return error[key];
+  } catch {
+    return void 0;
+  }
 }
 
 // src/lib/http-client/adapters/node-adapter-utils.ts
@@ -368,20 +412,6 @@ function materializeNodeRequestHeaders(headers) {
 
 // src/lib/http-client/utils.ts
 import qs from "qs";
-
-// src/lib/domain-utils/domain-utils.ts
-import { getDomain, getSubdomain, getPublicSuffix } from "tldts";
-
-// src/lib/domain-utils/helpers.ts
-import { toASCII } from "tr46";
-var INTERNAL_PSEUDO_TLDS = Object.freeze(
-  /* @__PURE__ */ new Set(["localhost", "local", "test", "internal"])
-);
-
-// src/lib/domain-utils/domain-utils.ts
-import { getDomain as getDomain2, getSubdomain as getSubdomain2 } from "tldts";
-
-// src/lib/http-client/utils.ts
 function resolveAbsoluteURL(url, baseURL) {
   if (!url) {
     return url;
@@ -471,6 +501,9 @@ var NodeAdapter = class {
         }
         httpsOptions.rejectUnauthorized = true;
       }
+      if (this._config.crl !== void 0) {
+        httpsOptions.crl = normalizeCRL(this._config.crl);
+      }
       if (this._config.rejectUnauthorized === false) {
         httpsOptions.rejectUnauthorized = false;
       }
@@ -479,7 +512,6 @@ var NodeAdapter = class {
       let activeResponseStream;
       let activeBufferedResponse;
       let isStreamFactoryPending = false;
-      let uploadedBodyBytes = 0;
       let didFireUpload100 = false;
       const reportUploadProgress = (event) => {
         if (didFireUpload100) {
@@ -488,7 +520,6 @@ var NodeAdapter = class {
         if (event.progress === 1) {
           didFireUpload100 = true;
         }
-        uploadedBodyBytes = Math.max(uploadedBodyBytes, event.loaded);
         request.onUploadProgress?.(event);
       };
       reportUploadProgress({ loaded: 0, total: 0, progress: 0 });
@@ -538,7 +569,7 @@ var NodeAdapter = class {
               return;
             }
             if (writable === null || isStreamResponseCancel(writable)) {
-              const cancelReason = writable !== null ? writable.reason : void 0;
+              const cancelReason = writable !== null ? readObjectMember(writable, "reason") : void 0;
               streamAbort.abort();
               req.destroy();
               const abortErr = new Error(
@@ -710,7 +741,7 @@ var NodeAdapter = class {
             );
           });
         })().catch((error) => {
-          reject(error instanceof Error ? error : new Error(String(error)));
+          reject(normalizeError(error));
         });
       });
       req.on("error", (error) => {
@@ -737,7 +768,7 @@ var NodeAdapter = class {
           );
           return;
         }
-        const isRetryableTransportError = uploadedBodyBytes === 0;
+        const wasDefinitelyNotSent = isPreConnectionError(error);
         resolveAdapterResponse(
           resolve,
           req,
@@ -746,7 +777,7 @@ var NodeAdapter = class {
           {
             status: 0,
             isTransportError: true,
-            isRetryable: isRetryableTransportError,
+            ...wasDefinitelyNotSent ? { wasDefinitelyNotSent: true } : {},
             headers: {},
             body: null,
             errorCause: error
@@ -837,12 +868,14 @@ var NodeAdapter = class {
             request.requestURL,
             request.headers,
             {
+              // No isRetryable veto: that would stop retrying an idempotent
+              // PUT or DELETE. Delivery is unproven rather than disproven, so
+              // nothing is claimed and the client's method rule decides.
               status: 0,
               isTransportError: true,
-              isRetryable: false,
               headers: {},
               body: null,
-              errorCause: error instanceof Error ? error : new Error(String(error))
+              errorCause: normalizeError(error)
             }
           );
         });
@@ -859,12 +892,14 @@ var NodeAdapter = class {
             request.requestURL,
             request.headers,
             {
+              // No isRetryable veto: that would stop retrying an idempotent
+              // PUT or DELETE. Delivery is unproven rather than disproven, so
+              // nothing is claimed and the client's method rule decides.
               status: 0,
               isTransportError: true,
-              isRetryable: false,
               headers: {},
               body: null,
-              errorCause: error instanceof Error ? error : new Error(String(error))
+              errorCause: normalizeError(error)
             }
           );
         });
@@ -934,7 +969,7 @@ async function streamResponseBody(res, writable, totalBytes, onProgress) {
       } catch (error) {
         settle({
           code: "stream_write_error",
-          cause: error instanceof Error ? error : new Error(String(error))
+          cause: normalizeError(error)
         });
         return;
       }
@@ -965,7 +1000,7 @@ async function streamResponseBody(res, writable, totalBytes, onProgress) {
       } catch (error) {
         settle({
           code: "stream_write_error",
-          cause: error instanceof Error ? error : new Error(String(error))
+          cause: normalizeError(error)
         });
       }
     };
@@ -994,6 +1029,36 @@ async function streamResponseBody(res, writable, totalBytes, onProgress) {
     res.on("close", onResponseClose);
   });
 }
+var PEM_CRL_HEADER = "-----BEGIN X509 CRL-----";
+var PEM_CRL_BLOCK = /-----BEGIN X509 CRL-----[\s\S]*?-----END X509 CRL-----/g;
+var RESIDUE_OUTSIDE_PEM_BLOCKS = /\S/;
+function normalizeCRL(crl) {
+  if (Array.isArray(crl)) {
+    return crl.flatMap((entry) => normalizeCRLEntry(entry));
+  }
+  return normalizeCRLEntry(crl);
+}
+function normalizeCRLEntry(entry) {
+  if (typeof entry === "string") {
+    return splitCRLString(entry);
+  }
+  const text = entry.toString("latin1");
+  if (!text.includes(PEM_CRL_HEADER)) {
+    return entry;
+  }
+  const split = splitCRLString(text);
+  return Array.isArray(split) ? split : entry;
+}
+function splitCRLString(crl) {
+  const blocks = crl.match(PEM_CRL_BLOCK) ?? [];
+  const residue = crl.replace(PEM_CRL_BLOCK, "");
+  if (RESIDUE_OUTSIDE_PEM_BLOCKS.test(residue)) {
+    throw new Error(
+      "NodeAdapter: the `crl` value contains content outside any complete -----BEGIN/END X509 CRL----- block. Only PEM CRL blocks separated by whitespace are accepted, because a truncated CRL and a line of commentary are indistinguishable \u2014 accepting the second would mean silently dropping the first and enforcing an incomplete revocation set. Common causes: a partial download, a clipped or mistyped delimiter, or decoded text from `openssl ... -text`, which must be stripped before the bundle is passed here."
+    );
+  }
+  return blocks.length > 1 ? blocks : crl;
+}
 function normalizeResponseHeaders(headers) {
   const result = {};
   for (const [key, value] of Object.entries(headers)) {
@@ -1041,6 +1106,16 @@ function removeWritableListener(writable, event, listener) {
   const removable = writable;
   removable.off?.(event, listener);
 }
+var PRE_CONNECTION_ERROR_CODES = /* @__PURE__ */ new Set([
+  "ECONNREFUSED",
+  "ENOTFOUND",
+  "EAI_AGAIN",
+  "EADDRNOTAVAIL"
+]);
+function isPreConnectionError(error) {
+  const code = readObjectMember(error, "code");
+  return typeof code === "string" && PRE_CONNECTION_ERROR_CODES.has(code);
+}
 function makeResponseStreamError(message, cause) {
   const error = new Error(message);
   if (cause) {
@@ -1049,7 +1124,7 @@ function makeResponseStreamError(message, cause) {
   return error;
 }
 function markStreamFactoryError(error, req, fallbackHeaders) {
-  const normalized = error instanceof Error ? error : new Error(String(error));
+  const normalized = normalizeError(error);
   const tagged = normalized;
   tagged[NON_RETRYABLE_HTTP_CLIENT_CALLBACK_ERROR_FLAG] = true;
   Object.assign(normalized, { [STREAM_FACTORY_ERROR_FLAG]: true });
@@ -1073,7 +1148,34 @@ function markResponseStreamAbortError(error, req, fallbackHeaders, status, heade
   return error;
 }
 function isStreamResponseCancel(value) {
-  return value !== null && typeof value === "object" && value.cancel === true;
+  return readObjectMember(value, "cancel") === true;
+}
+function readObjectMember(source, key) {
+  if (source === null || typeof source !== "object" && typeof source !== "function") {
+    return void 0;
+  }
+  try {
+    return source[key];
+  } catch {
+    return void 0;
+  }
+}
+function isErrorValue2(value) {
+  try {
+    return value instanceof Error;
+  } catch {
+    return false;
+  }
+}
+function normalizeError(value) {
+  if (isErrorValue2(value)) {
+    return value;
+  }
+  try {
+    return new Error(String(value));
+  } catch {
+    return new Error("Unknown error");
+  }
 }
 export {
   NodeAdapter