node-vault-client 3.0.2 → 3.1.0

package/README.md

@@ -505,6 +505,7 @@ Client constructor function.
 | options.api.url | <code>String</code> |  | the url of the vault server |
 | [options.api.apiVersion] | <code>String</code> | `v1` |  |
 | [options.api.requestOptions] | <code>Object</code> |  | extra options merged into every HTTP request (see [Custom transport](#custom-transport-proxy--self-signed-tls)) |
+| [options.api.timeout] | <code>number</code> | `120000` | milliseconds a request may take, response headers, body and redirects included, before it rejects with `RequestTimeoutError`; `0` turns the limit off, `null` gives the default (see [Request timeouts](#request-timeouts)) |
 | [options.api.namespace] | <code>String</code> |  | Optional. Vault namespace, sent as the `X-Vault-Namespace` header on **every** request — login, token lookup/renewal, and all secret operations — for every auth type. This is the canonical location; `auth.config.namespace` is still honored for backward compatibility. |
 | [options.api.kv.autoDetect] | <code>boolean</code> | `false` | auto-detect the KV version of each mount on first use (see [KV v2 & generic backends](#kv-v2--generic-backends)) |
 | [options.api.engines] | <code>Object</code> | `{}` | static mount-to-version map, e.g. `{ secret: 2, legacy: 1 }` (see [KV v2 & generic backends](#kv-v2--generic-backends)) |
@@ -559,8 +560,35 @@ bundle undici 7.x, so pin `undici@^7`.
 
 ##### Request timeouts
 
-There is no default timeout. A Vault that accepts the connection and never answers will leave
-`read()` (and every other call) pending indefinitely. Set one through the dispatcher:
+Every request to Vault, including logins, `lookup-self` and background `renew-self`, has to
+finish within `api.timeout` milliseconds: **120 000 (2 minutes) by default**. The limit covers the
+whole request: response headers, the body and any redirects. A request that runs out of time
+rejects with `RequestTimeoutError` (its `timeout` property holds the limit, `cause` the
+`fetch()` rejection). With `api.kv.autoDetect`, a mount detection that times out fails the call
+with the usual detection `VaultError`, with `RequestTimeoutError` on its `cause`. A renewal that
+times out is handled like any other failed renewal.
+
+`api.timeout` is in milliseconds; `null` or leaving it out gives the default, and a value under
+1000 logs a warning in case it was meant as seconds. Anything but an integer from 0 to 2147483647
+raises `InvalidArgumentsError` when the client is created.
+
+The default sits above Vault's own default `max_request_duration` (90 s), so it does not cut
+short a request that a Vault with default settings would still answer. Set it lower to fail
+fast, or higher if your Vault allows longer requests:
+
+```javascript
+const vaultClient = VaultClient.boot('main', {
+    api: { url: 'https://vault.example.com:8200/', timeout: 10000 },
+    auth: { type: 'token', config: { token: '...' } },
+});
+```
+
+`timeout: 0` turns the limit off, as it was before `api.timeout` existed. What remains then
+are the timeouts of the dispatcher `fetch()` uses: Node's default one gives up after 300 s
+without response headers (`TypeError: fetch failed`, `cause.code` `UND_ERR_HEADERS_TIMEOUT`) or
+300 s without body data (`UND_ERR_BODY_TIMEOUT`). Those limits apply per phase, so a body that
+keeps trickling in is never cut off. Any timeouts set on a custom dispatcher still apply
+alongside `api.timeout`, and whichever fires first rejects the request:
 
 ```javascript
 const { Agent } = require('undici');
@@ -574,12 +602,11 @@ const vaultClient = VaultClient.boot('main', {
 });
 ```
 
-A failed request rejects with `TypeError: fetch failed`, with `cause.code` set to
-`UND_ERR_HEADERS_TIMEOUT` or `UND_ERR_BODY_TIMEOUT`.
-
-Do **not** put `signal: AbortSignal.timeout(ms)` in `requestOptions`. It is created once and
-shared by every request the client makes, so it works for the first call and then aborts all
-later ones with `TimeoutError`. Pass a fresh signal per call, or use the dispatcher above.
+A `signal` in `requestOptions` still aborts every request in flight when it fires (with the
+signal's own reason, not `RequestTimeoutError`), so an `AbortController` can cancel requests
+on shutdown. `fetch()` then receives the client's own per-request signal, which follows it. Do **not** use `signal: AbortSignal.timeout(ms)` there: it is created once and
+shared by every request the client makes, so it works for the first calls and then aborts all
+later ones. Use `api.timeout` instead.
 
 ##### Redirects and the Vault token
 
@@ -816,6 +843,14 @@ the ones it was booted with, the client logs a warning rather than letting the d
 silently. Use [`VaultClient.get(name)`](#VaultClient.get) to fetch an existing instance, or
 [`VaultClient.clear(name)`](#VaultClient.clear) before booting to replace one.
 
+Options are compared as hashes, so no credential is kept for the comparison. Plain objects and
+arrays compare by content, in any key order. Functions and other objects compare by identity, and
+a `Buffer`, `Date`, `URL` or `RegExp` by value. So a logger class instance, an undici `dispatcher`,
+or a logger object built from new functions counts as different even when it would behave the
+same; a plain object that reuses the same functions does not. The warning names the top-level
+options that differ (for example `logger`) and is logged once per instance for each set of them.
+Boot each name once and fetch it with `get()` elsewhere.
+
 **Kind**: static method of [<code>VaultClient</code>](#VaultClient)  
 **Returns**: <code>VaultClient</code>  
 
@@ -1061,10 +1096,11 @@ try {
 |---|---|---|
 | `VaultError` | `Error` | Base class for every error below. Raised directly when mount detection fails (e.g. permission denied) and no `api.engines` override was provided. |
 | `VaultHttpError` | `VaultError` | Vault answered with a non-2xx status. Carries the status as `statusCode` and the parsed body as `error`. `message` (`"<status> - <raw body text>"`) and `error` hold the full response body, which can include secret material (e.g. a partially failed transit batch), so log `statusCode` and `error.errors` rather than the error object itself. |
-| `InvalidArgumentsError` | `VaultError` | Bad arguments or configuration: `boot()` called without options, an unknown instance name passed to `get()`, an unsupported `auth.type`, invalid renewal options, an invalid node-config substitution map, or a KV method path that fails [path validation](#path-validation). |
+| `InvalidArgumentsError` | `VaultError` | Bad arguments or configuration: `boot()` called without options, an unknown instance name passed to `get()`, an unsupported `auth.type`, invalid renewal options or `api.timeout`, an invalid node-config substitution map, or a KV method path that fails [path validation](#path-validation). |
 | `InvalidAWSCredentialsError` | `InvalidArgumentsError` | `auth.config.credentials` was supplied but is not a usable `accessKeyId` / `secretAccessKey` pair. |
 | `AuthTokenExpiredError` | `VaultError` | The Vault token expired and the backend cannot obtain a new one. `token` auth can never re-authenticate and reaches this error at max TTL even with renewal enabled; other backends can also reach it when re-authentication is disabled or their credential can no longer be replayed. |
 | `UnsupportedOperationError` | `VaultError` | A v2-only method (`deleteVersions`, `undeleteVersions`, `destroyVersions`, `readMetadata`, `deleteMetadata`) was called against a mount that did not resolve as KV v2. |
+| `RequestTimeoutError` | `VaultError` | A request to Vault did not finish within `api.timeout` milliseconds (see [Request timeouts](#request-timeouts)). Carries the limit as `timeout` and the `fetch()` rejection (a `TimeoutError` DOMException) as `cause`. |
 
 ## Contributing
 

package/index.d.ts

@@ -39,6 +39,8 @@ declare namespace VaultClient {
         apiVersion?: string;
         namespace?: string;
         requestOptions?: Record<string, any>;
+        /** Milliseconds a request may take before it rejects with RequestTimeoutError; `0` turns it off. Default 120000. */
+        timeout?: number | null;
         kv?: { autoDetect?: boolean };
         engines?: Record<string, 1 | 2>;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "node-vault-client",
-  "version": "3.0.2",
+  "version": "3.1.0",
   "description": "A Vault Client implemented in pure javascript for HashiCorp Vault. It supports variety of Auth Backends and performs lease renewal for issued auth token.",
   "repository": {
     "url": "git+https://github.com/namecheap/node-vault-client.git"
@@ -21,6 +21,7 @@
     "test:e2e": "mocha --exit \"test/e2e/e2e.test.mjs\"",
     "test:e2e:kv2": "mocha --exit \"test/e2e/e2e.kv2.test.mjs\"",
     "test:e2e:jwt": "mocha --exit \"test/e2e/e2e.jwt.test.mjs\"",
+    "test:e2e:generic": "mocha --exit \"test/e2e/e2e.generic.test.mjs\"",
     "test:example": "node examples/jwt-auth/vault-jwt-demo.mjs",
     "coverage": "c8 npm run test:unit",
     "lint": "eslint src/ test/ examples/",
@@ -54,10 +55,11 @@
   },
   "overrides": {
     "serialize-javascript": "^7.1.4",
-    "glob": "^13.0.0",
+    "glob": "^14.0.3",
     "diff": "^8.0.3",
     "brace-expansion": "^5.0.12",
-    "js-yaml": "^4.3.2"
+    "js-yaml": "^4.3.2",
+    "minimatch": "^11.0.4"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",

package/src/VaultApiClient.js

@@ -1,8 +1,86 @@
 'use strict';
 
+const { defaultMaxListeners, getMaxListeners, setMaxListeners } = require('events');
 const errors = require('./errors');
 const { trimTrailingSlashes } = require('./slashes');
 
+// Above Vault's own default max_request_duration (90 s), so no request a default-configured
+// Vault would still answer is cut short, and below the 300 s headers/body timeouts of the
+// dispatcher Node's fetch() uses by default.
+const DEFAULT_TIMEOUT_MS = 120000;
+// setTimeout() fires after 1 ms for a delay that does not fit in a signed 32-bit integer.
+const MAX_TIMEOUT_MS = 2147483647;
+// The listener limit fetch() gives a signal it is passed (see deadline()).
+const FETCH_MAX_LISTENERS = 1500;
+
+function validateTimeout(timeout) {
+    // null reads as "not set", as it does in a config file.
+    if (timeout === undefined || timeout === null) {
+        return DEFAULT_TIMEOUT_MS;
+    }
+    if (!Number.isInteger(timeout) || timeout < 0 || timeout > MAX_TIMEOUT_MS) {
+        throw new errors.InvalidArgumentsError(
+            `"api.timeout" should be an integer number of milliseconds from 0 to ${MAX_TIMEOUT_MS}, ` +
+            `got ${String(timeout)}`
+        );
+    }
+    return timeout;
+}
+
+/**
+ * What fetch() accepts as a signal: Node 20 and 22 take any object with a boolean `aborted`
+ * and an `addEventListener` (an abort-controller polyfill, a signal from another realm).
+ */
+function isSignalLike(value) {
+    return value !== null && typeof value === 'object'
+        && typeof value.aborted === 'boolean' && typeof value.addEventListener === 'function';
+}
+
+/**
+ * A per-request deadline. A plain timer, cleared once the request settles, rather than
+ * AbortSignal.timeout(), whose timer cannot be cancelled and so outlives every fast request.
+ * A `requestOptions.signal` still aborts the request: it is followed through a listener that
+ * is removed at the same point, since that signal lives as long as the client.
+ *
+ * @param {number} ms
+ * @param {AbortSignal} [signal] - `requestOptions.signal`
+ * @returns {{signal: AbortSignal, isTimeout: function(*): boolean, clear: function(): void}}
+ */
+function deadline(ms, signal) {
+    const controller = new AbortController();
+    const reason = new DOMException('The operation was aborted due to timeout', 'TimeoutError');
+    const timer = setTimeout(() => controller.abort(reason), ms);
+    const follow = () => controller.abort(signal.reason);
+    if (signal) {
+        if (signal.aborted) {
+            follow();
+        } else {
+            // fetch() raised a signal's listener limit to 1500 when it was still at the default;
+            // it now gets the client's own signal, so do the same here, or more than ten
+            // requests in flight on one signal print MaxListenersExceededWarning (Node 20).
+            try {
+                if (getMaxListeners(signal) === defaultMaxListeners) {
+                    setMaxListeners(FETCH_MAX_LISTENERS, signal);
+                }
+            } catch {
+                // not an EventTarget (a polyfill): it has no listener limit to raise
+            }
+            signal.addEventListener('abort', follow, { once: true });
+        }
+    }
+
+    return {
+        signal: controller.signal,
+        isTimeout: (err) => err === reason,
+        clear: () => {
+            clearTimeout(timer);
+            if (signal && typeof signal.removeEventListener === 'function') {
+                signal.removeEventListener('abort', follow);
+            }
+        },
+    };
+}
+
 /**
  * Joins URL segments with single slashes while preserving the leading
  * protocol (e.g. "https://"). Replaces the former `url-join` dependency.
@@ -35,6 +113,9 @@ class VaultApiClient {
      *      (`method`, `body`) always take precedence; `headers` are merged with the
      *      per-request headers winning. Stored by reference (not deep-cloned) so live
      *      objects such as a Dispatcher keep their prototype and remain usable.
+     * @param {number} [config.timeout=120000] - milliseconds a request may take, response
+     *      headers, body and redirects included, before it rejects with
+     *      {@link RequestTimeoutError}. `0` turns the limit off; `null` gives the default.
      * @param {Object} logger
      * @param {String} [namespace] - Vault namespace. When set, `X-Vault-Namespace` is added to
      *      every request (login, token lookup/renewal, and secret operations) so namespacing is
@@ -55,6 +136,12 @@ class VaultApiClient {
             this.__config.requestOptions = requestOptions;
         }
 
+        this.__timeout = validateTimeout(this.__config.timeout);
+        // 3.0.x ignored an api.timeout key, so a config may still carry one written in seconds.
+        if (this.__timeout > 0 && this.__timeout < 1000) {
+            logger.warn('"api.timeout" is %d ms; it is in milliseconds, not seconds', this.__timeout);
+        }
+
         this.__namespace = namespace !== undefined ? namespace : this.__config.namespace;
         this._logger = logger;
     }
@@ -102,7 +189,28 @@ class VaultApiClient {
             uri
         );
 
-        return fetch(uri, options).then((response) => {
+        // A requestOptions.signal that fetch() would reject is passed on untouched, without the
+        // deadline, so fetch() rejects it as it always has. The deadline is armed last, and
+        // cleared if fetch() throws synchronously, so no timer outlives a failed call.
+        const userSignal = requestOptions.signal;
+        const limit = this.__timeout > 0 && (userSignal === undefined || userSignal === null
+            || isSignalLike(userSignal))
+            ? deadline(this.__timeout, userSignal || undefined)
+            : null;
+        let pending;
+        if (limit === null) {
+            pending = fetch(uri, options);
+        } else {
+            options.signal = limit.signal;
+            try {
+                pending = fetch(uri, options);
+            } catch (err) {
+                limit.clear();
+                throw err;
+            }
+        }
+
+        const request = pending.then((response) => {
             return response.text().then((text) => {
                 let body;
                 if (text) {
@@ -127,6 +235,18 @@ class VaultApiClient {
                 return body;
             });
         });
+        if (limit === null) {
+            return request;
+        }
+
+        return request
+            .catch((err) => {
+                if (limit.isTimeout(err)) {
+                    throw new errors.RequestTimeoutError(this.__timeout, { cause: err });
+                }
+                throw err;
+            })
+            .finally(limit.clear);
     }
 }
 

package/src/VaultClient.js

@@ -18,51 +18,105 @@ const { trimTrailingSlashes } = require('./slashes');
 const noop = () => {};
 const vaultInstances = {};
 
-// Only credential providers compare by identity: a different provider means the client would
-// authenticate differently. Other functions (logger methods, an IAM `credentials` provider
-// chain) are often re-created per call with the same behaviour, so they all fingerprint alike.
-const IDENTITY_COMPARED_KEYS = new Set(['jwtProvider', 'distributedClaimAccessTokenProvider']);
+// Functions, and objects that are not plain data (an undici dispatcher, a logger class
+// instance), compare by identity. Their own enumerable keys say nothing about what they do:
+// structurally, any two dispatchers look alike, and so do two loggers built from different
+// functions, so a boot() that passed a different one was ignored without a warning (#224).
+// A Buffer, Date, URL or RegExp compares by value, so an equal one re-created per call still
+// matches. No user code (getters, toJSON, Proxy traps) decides the comparison.
+//
+// Per-process ids, in a WeakMap so that fingerprinting never keeps an option (or the closure
+// state it captures) alive.
+const identityIds = new WeakMap();
+let nextIdentityId = 0;
+
+function identityId(value) {
+    if (!identityIds.has(value)) {
+        identityIds.set(value, ++nextIdentityId);
+    }
+    return identityIds.get(value);
+}
 
-// Per-process ids for those providers. A WeakMap so that fingerprinting never keeps a
-// provider (or the closure state it captures) alive.
-const functionIds = new WeakMap();
-let nextFunctionId = 0;
+/**
+ * How an object takes part in the fingerprint: 'array' and 'plain' by content, 'value' by
+ * {@link valueOf}, anything else by identity. Plain includes a null prototype and an
+ * Object.prototype from another realm (vm, a test runner's structuredClone). A Proxy whose
+ * traps throw compares by identity rather than making boot() throw.
+ */
+function kindOf(value) {
+    try {
+        if (Array.isArray(value)) {
+            return 'array';
+        }
+        if (Buffer.isBuffer(value) || value instanceof Date || value instanceof URL || value instanceof RegExp) {
+            return 'value';
+        }
+        const proto = Object.getPrototypeOf(value);
+        return proto === null || Object.getPrototypeOf(proto) === null ? 'plain' : 'identity';
+    } catch {
+        return 'identity';
+    }
+}
 
-function functionId(fn) {
-    if (!functionIds.has(fn)) {
-        functionIds.set(fn, ++nextFunctionId);
+function valueOf(value) {
+    if (Buffer.isBuffer(value)) {
+        return `buffer:${value.toString('base64')}`;
     }
-    return functionIds.get(fn);
+    if (value instanceof Date) {
+        return `date:${value.getTime()}`;
+    }
+    return `${value instanceof URL ? 'url' : 'regexp'}:${JSON.stringify(String(value))}`;
 }
 
 /**
- * Order-insensitive canonical form of the boot options, hashed so that no credential is
- * retained just to compare two boot() calls. `jwtProvider` and
- * `distributedClaimAccessTokenProvider` compare by identity; every other function is `fn`.
+ * Order-insensitive canonical form of a boot option, hashed so that no credential is retained
+ * just to compare two boot() calls. Plain objects and arrays compare by content, functions and
+ * other objects by identity, and a Buffer, Date, URL or RegExp by value.
  */
-function fingerprintOptions(value, seen, key) {
+function fingerprintOptions(value, seen) {
     if (typeof value === 'function') {
-        return IDENTITY_COMPARED_KEYS.has(key) ? `fn#${functionId(value)}` : 'fn';
+        return `fn#${identityId(value)}`;
+    }
+    if (typeof value === 'bigint') {
+        return `${value}n`;
     }
     if (value === null || typeof value !== 'object') {
         return JSON.stringify(value) || String(value);
     }
+    const kind = kindOf(value);
+    if (kind === 'value') {
+        return valueOf(value);
+    }
+    if (kind === 'identity') {
+        return `obj#${identityId(value)}`;
+    }
     seen = seen || new Set();
     if (seen.has(value)) {
         return 'circular';
     }
     seen.add(value);
-    if (Array.isArray(value)) {
+    if (kind === 'array') {
         return `[${value.map((item) => fingerprintOptions(item, seen)).join(',')}]`;
     }
     const body = Object.keys(value).sort()
-        .map((key) => `${JSON.stringify(key)}:${fingerprintOptions(value[key], seen, key)}`)
+        .map((key) => `${JSON.stringify(key)}:${fingerprintOptions(value[key], seen)}`)
         .join(',');
     return `{${body}}`;
 }
 
-function optionsDigest(options) {
-    return crypto.createHash('sha256').update(fingerprintOptions(options)).digest('hex');
+/** One digest per top-level option, so a mismatch can name the options that differ. */
+function optionsDigests(options) {
+    const digests = new Map();
+    for (const key of Object.keys(options)) {
+        digests.set(key, crypto.createHash('sha256').update(fingerprintOptions(options[key])).digest('hex'));
+    }
+    return digests;
+}
+
+/** The top-level options whose digests differ, sorted; empty when the options match. */
+function differingOptions(before, after) {
+    const keys = new Set([...before.keys(), ...after.keys()]);
+    return [...keys].filter((key) => before.get(key) !== after.get(key)).sort();
 }
 
 // fetch() parses the joined URL per the WHATWG URL Standard: '?' starts the query, '#' the
@@ -145,6 +199,9 @@ class VaultClient {
      * @param {Object} [options.api.requestOptions] - extra options merged into every HTTP
      *      request (e.g. an undici `dispatcher` for a proxy/SOCKS agent or custom TLS/CA trust).
      *      See {@link VaultApiClient#constructor}.
+     * @param {number} [options.api.timeout=120000] - milliseconds a request may take, response
+     *      headers, body and redirects included, before it rejects with RequestTimeoutError.
+     *      `0` turns the limit off.
      * @param {Object} [options.api.kv] - KV engine options
      * @param {boolean} [options.api.kv.autoDetect=false] - When true, auto-detect KV version per mount
      * @param {Object} [options.api.engines] - Mount-to-version overrides, e.g. { secret: 2, legacy: 1 }
@@ -227,8 +284,15 @@ class VaultClient {
      * `options` are used only when the instance is first created. A later call for a name
      * that already exists returns the existing instance and ignores the options it was
      * given; when those options differ from the ones the instance was booted with, that is
-     * logged as a warning rather than passing silently. Use {@link VaultClient.get} to
-     * fetch an existing instance, or {@link VaultClient.clear} to replace one.
+     * logged as a warning, naming the top-level options that differ, rather than passing
+     * silently. The warning is logged once per instance for each set of differing options.
+     * Use {@link VaultClient.get} to fetch an existing instance, or {@link VaultClient.clear}
+     * to replace one.
+     *
+     * Options are compared as hashes, so no credential is kept for the comparison. Plain
+     * objects and arrays compare by content, in any key order. Functions and other objects (a
+     * logger class instance, an undici dispatcher) compare by identity, and a Buffer, Date,
+     * URL or RegExp by value.
      *
      * @param {String} name - Vault instance name
      * @param {Object} options - options for {@link VaultClient#constructor}. Required on
@@ -243,14 +307,22 @@ class VaultClient {
         let instance = vaultInstances[name];
         if (instance === undefined) {
             vaultInstances[name] = instance = new VaultClient(options);
-            instance.__bootDigest = optionsDigest(options);
-        } else if (instance.__bootDigest !== optionsDigest(options)) {
+            instance.__bootDigests = optionsDigests(options);
+            instance.__bootWarned = new Set();
+            return instance;
+        }
+
+        // Once per instance for each set of differing options: code that re-creates its logger
+        // for every boot() call would otherwise log this on every call.
+        const differing = differingOptions(instance.__bootDigests, optionsDigests(options)).join(', ');
+        if (differing !== '' && !instance.__bootWarned.has(differing)) {
+            instance.__bootWarned.add(differing);
             instance.__log.warn(
                 'VaultClient.boot("%s") was called with different options than the existing ' +
                 'instance was booted with; the existing instance is returned and these options ' +
                 'are ignored. Use VaultClient.get("%s") to fetch it, or VaultClient.clear("%s") ' +
-                'first to replace it.',
-                name, name, name
+                'first to replace it. Differing options: %s.',
+                name, name, name, differing
             );
         }
         return instance;

package/src/errors.d.ts

@@ -16,3 +16,8 @@ export declare class VaultHttpError extends VaultError {
     statusCode: number;
     error: unknown;
 }
+
+export declare class RequestTimeoutError extends VaultError {
+    constructor(timeout: number, options?: { cause?: unknown });
+    timeout: number;
+}

package/src/errors.js

@@ -41,6 +41,23 @@ class VaultHttpError extends VaultError {
     }
 }
 
+/**
+ * A request to Vault did not complete within `api.timeout` milliseconds: response headers,
+ * body and any redirects included. The `fetch()` rejection (a `TimeoutError` DOMException)
+ * is on `cause`.
+ */
+class RequestTimeoutError extends VaultError {
+    /**
+     * @param {number} timeout - the `api.timeout` that elapsed, in milliseconds. Exposed as
+     *   `error.timeout`.
+     * @param {{cause?: *}} [options]
+     */
+    constructor(timeout, options) {
+        super(`Vault request timed out after ${timeout} ms (api.timeout)`, options);
+        this.timeout = timeout;
+    }
+}
+
 module.exports = {
     VaultError,
     InvalidArgumentsError,
@@ -48,4 +65,5 @@ module.exports = {
     AuthTokenExpiredError,
     UnsupportedOperationError,
     VaultHttpError,
+    RequestTimeoutError,
 };