tina4-nodejs 3.13.144 → 3.13.146

package/CLAUDE.md

@@ -13,13 +13,13 @@ Even if the skill text is not currently loaded, these are non-negotiable:
 
 The full discipline lives in `.claude/skills/tina4-maintainer/SKILL.md`; this block is the always-on floor.
 
-# CLAUDE.md - AI Developer Guide for tina4-nodejs (v3.13.144)
+# CLAUDE.md - AI Developer Guide for tina4-nodejs (v3.13.146)
 
 > This file helps AI assistants (Claude, Copilot, Cursor, etc.) understand and work on this codebase effectively.
 
 ## What This Project Is
 
-Tina4 for Node.js/TypeScript v3.13.144 - The Intelligent Native Application 4ramework. A convention-over-configuration structural paradigm. The developer writes TypeScript; Tina4 is invisible infrastructure.
+Tina4 for Node.js/TypeScript v3.13.146 - The Intelligent Native Application 4ramework. A convention-over-configuration structural paradigm. The developer writes TypeScript; Tina4 is invisible infrastructure.
 
 The philosophy: zero ceremony, batteries included, file system as source of truth.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tina4-nodejs",
-  "version": "3.13.144",
+  "version": "3.13.146",
   "type": "module",
   "description": "Tina4 for Node.js/TypeScript - native TypeScript conventions and shared Tina4 contracts",
   "keywords": [

package/packages/cli/dist/bin.js

@@ -43003,6 +43003,13 @@ import { randomBytes as randomBytes11 } from "node:crypto";
 import { promises as fsp, createWriteStream } from "node:fs";
 import { basename as basename7 } from "node:path";
 import { pipeline } from "node:stream/promises";
+function keepCrossOriginHeaders(headers) {
+  const out = {};
+  for (const [key, value] of Object.entries(headers)) {
+    if (KEEP_ON_CROSS_ORIGIN.has(key.toLowerCase())) out[key] = value;
+  }
+  return out;
+}
 function sameOrigin(urlA, urlB) {
   try {
     const a = new URL2(urlA);
@@ -43146,7 +43153,7 @@ async function* parseSseStream(lines) {
   const trailing = emit();
   if (trailing) yield trailing;
 }
-var ApiStreamError, RETRY_STATUSES, DOWNLOAD_CHUNK_SIZE, MAX_REDIRECTS, STRIP_ON_CROSS_ORIGIN, MIME_BY_EXT, Api;
+var ApiStreamError, RETRY_STATUSES, DOWNLOAD_CHUNK_SIZE, MAX_REDIRECTS, STRIP_ON_CROSS_ORIGIN, KEEP_ON_CROSS_ORIGIN, MIME_BY_EXT, Api;
 var init_api = __esm({
   "../core/src/api.ts"() {
     "use strict";
@@ -43164,6 +43171,14 @@ var init_api = __esm({
     DOWNLOAD_CHUNK_SIZE = 64 * 1024;
     MAX_REDIRECTS = 10;
     STRIP_ON_CROSS_ORIGIN = /* @__PURE__ */ new Set(["authorization", "cookie"]);
+    KEEP_ON_CROSS_ORIGIN = /* @__PURE__ */ new Set([
+      "user-agent",
+      "accept",
+      "accept-encoding",
+      "accept-language",
+      "content-type",
+      "content-length"
+    ]);
     MIME_BY_EXT = {
       txt: "text/plain",
       html: "text/html",
@@ -43619,6 +43634,18 @@ var init_api = __esm({
         }
         return `${this.baseUrl}/${path10.replace(/^\/+/, "")}`;
       }
+      /**
+       * The headers configured on the client, as they may go to `targetUrl`.
+       *
+       * They belong to the base origin, like the token: an absolute target on
+       * another origin gets only the cross-origin-safe ones. A client with no
+       * base has no origin to bind them to, and sends them to the URL each call
+       * names.
+       */
+      configuredHeadersFor(targetUrl) {
+        const offOrigin = targetUrl !== void 0 && this.baseUrl !== "" && !sameOrigin(targetUrl, this.baseUrl);
+        return offOrigin ? keepCrossOriginHeaders(this.headers) : this.headers;
+      }
       /**
        * Build the request headers (default User-Agent + auth + cookie jar +
        * extras) and serialize the body to a Buffer. Shared by every verb,
@@ -43633,7 +43660,7 @@ var init_api = __esm({
        * clobber.
        */
       buildRequest(method, contentType, body, extraHeaders, targetUrl) {
-        const headers = { "User-Agent": `Tina4/${TINA4_VERSION}`, ...this.headers };
+        const headers = { "User-Agent": `Tina4/${TINA4_VERSION}`, ...this.configuredHeadersFor(targetUrl) };
         const sameOriginAsBase = targetUrl === void 0 || sameOrigin(targetUrl, this.baseUrl);
         if (this.authHeader && sameOriginAsBase) {
           headers["Authorization"] = this.authHeader;
@@ -43735,9 +43762,9 @@ var init_api = __esm({
        * Location, this drains the intermediate response and re-issues to the new
        * URL: 301/302/303 on a non-GET/HEAD become GET (body dropped, urllib
        * behaviour); 307/308 preserve method + body. When the redirect target is a
-       * DIFFERENT origin, the Authorization and Cookie headers are stripped so a
-       * bearer token / session cookie never leaks to a host you didn't
-       * authenticate to.
+       * DIFFERENT origin, only KEEP_ON_CROSS_ORIGIN headers are carried, so a
+       * bearer token, session cookie or any caller-set credential header never
+       * leaks to a host you didn't authenticate to.
        */
       async performRequest(method, url, headers, data, redirectsLeft) {
         try {
@@ -43781,18 +43808,13 @@ var init_api = __esm({
               const crossOrigin = !sameOrigin(url, nextUrl);
               let nextMethod = method;
               let nextData = data;
-              const nextHeaders = { ...headers };
+              const nextHeaders = crossOrigin ? keepCrossOriginHeaders(headers) : { ...headers };
               if ((status2 === 301 || status2 === 302 || status2 === 303) && method !== "GET" && method !== "HEAD") {
                 nextMethod = "GET";
                 nextData = void 0;
                 deleteHeaderCaseInsensitive(nextHeaders, "content-type");
                 deleteHeaderCaseInsensitive(nextHeaders, "content-length");
               }
-              if (crossOrigin) {
-                for (const name of STRIP_ON_CROSS_ORIGIN) {
-                  deleteHeaderCaseInsensitive(nextHeaders, name);
-                }
-              }
               this.performRequest(nextMethod, nextUrl, nextHeaders, nextData, redirectsLeft - 1).then(resolve29);
               return;
             }

package/packages/core/dist/index.js

@@ -42959,6 +42959,13 @@ import { randomBytes as randomBytes11 } from "node:crypto";
 import { promises as fsp, createWriteStream } from "node:fs";
 import { basename as basename6 } from "node:path";
 import { pipeline } from "node:stream/promises";
+function keepCrossOriginHeaders(headers) {
+  const out = {};
+  for (const [key, value] of Object.entries(headers)) {
+    if (KEEP_ON_CROSS_ORIGIN.has(key.toLowerCase())) out[key] = value;
+  }
+  return out;
+}
 function sameOrigin(urlA, urlB) {
   try {
     const a = new URL2(urlA);
@@ -43102,7 +43109,7 @@ async function* parseSseStream(lines) {
   const trailing = emit();
   if (trailing) yield trailing;
 }
-var ApiStreamError, RETRY_STATUSES, DOWNLOAD_CHUNK_SIZE, MAX_REDIRECTS, STRIP_ON_CROSS_ORIGIN, MIME_BY_EXT, Api;
+var ApiStreamError, RETRY_STATUSES, DOWNLOAD_CHUNK_SIZE, MAX_REDIRECTS, STRIP_ON_CROSS_ORIGIN, KEEP_ON_CROSS_ORIGIN, MIME_BY_EXT, Api;
 var init_api = __esm({
   "src/api.ts"() {
     "use strict";
@@ -43120,6 +43127,14 @@ var init_api = __esm({
     DOWNLOAD_CHUNK_SIZE = 64 * 1024;
     MAX_REDIRECTS = 10;
     STRIP_ON_CROSS_ORIGIN = /* @__PURE__ */ new Set(["authorization", "cookie"]);
+    KEEP_ON_CROSS_ORIGIN = /* @__PURE__ */ new Set([
+      "user-agent",
+      "accept",
+      "accept-encoding",
+      "accept-language",
+      "content-type",
+      "content-length"
+    ]);
     MIME_BY_EXT = {
       txt: "text/plain",
       html: "text/html",
@@ -43575,6 +43590,18 @@ var init_api = __esm({
         }
         return `${this.baseUrl}/${path10.replace(/^\/+/, "")}`;
       }
+      /**
+       * The headers configured on the client, as they may go to `targetUrl`.
+       *
+       * They belong to the base origin, like the token: an absolute target on
+       * another origin gets only the cross-origin-safe ones. A client with no
+       * base has no origin to bind them to, and sends them to the URL each call
+       * names.
+       */
+      configuredHeadersFor(targetUrl) {
+        const offOrigin = targetUrl !== void 0 && this.baseUrl !== "" && !sameOrigin(targetUrl, this.baseUrl);
+        return offOrigin ? keepCrossOriginHeaders(this.headers) : this.headers;
+      }
       /**
        * Build the request headers (default User-Agent + auth + cookie jar +
        * extras) and serialize the body to a Buffer. Shared by every verb,
@@ -43589,7 +43616,7 @@ var init_api = __esm({
        * clobber.
        */
       buildRequest(method, contentType, body, extraHeaders, targetUrl) {
-        const headers = { "User-Agent": `Tina4/${TINA4_VERSION}`, ...this.headers };
+        const headers = { "User-Agent": `Tina4/${TINA4_VERSION}`, ...this.configuredHeadersFor(targetUrl) };
         const sameOriginAsBase = targetUrl === void 0 || sameOrigin(targetUrl, this.baseUrl);
         if (this.authHeader && sameOriginAsBase) {
           headers["Authorization"] = this.authHeader;
@@ -43691,9 +43718,9 @@ var init_api = __esm({
        * Location, this drains the intermediate response and re-issues to the new
        * URL: 301/302/303 on a non-GET/HEAD become GET (body dropped, urllib
        * behaviour); 307/308 preserve method + body. When the redirect target is a
-       * DIFFERENT origin, the Authorization and Cookie headers are stripped so a
-       * bearer token / session cookie never leaks to a host you didn't
-       * authenticate to.
+       * DIFFERENT origin, only KEEP_ON_CROSS_ORIGIN headers are carried, so a
+       * bearer token, session cookie or any caller-set credential header never
+       * leaks to a host you didn't authenticate to.
        */
       async performRequest(method, url, headers, data, redirectsLeft) {
         try {
@@ -43737,18 +43764,13 @@ var init_api = __esm({
               const crossOrigin = !sameOrigin(url, nextUrl);
               let nextMethod = method;
               let nextData = data;
-              const nextHeaders = { ...headers };
+              const nextHeaders = crossOrigin ? keepCrossOriginHeaders(headers) : { ...headers };
               if ((status2 === 301 || status2 === 302 || status2 === 303) && method !== "GET" && method !== "HEAD") {
                 nextMethod = "GET";
                 nextData = void 0;
                 deleteHeaderCaseInsensitive(nextHeaders, "content-type");
                 deleteHeaderCaseInsensitive(nextHeaders, "content-length");
               }
-              if (crossOrigin) {
-                for (const name of STRIP_ON_CROSS_ORIGIN) {
-                  deleteHeaderCaseInsensitive(nextHeaders, name);
-                }
-              }
               this.performRequest(nextMethod, nextUrl, nextHeaders, nextData, redirectsLeft - 1).then(resolve21);
               return;
             }

package/packages/core/src/api.ts

@@ -153,6 +153,26 @@ const MAX_REDIRECTS = 10;
  */
 const STRIP_ON_CROSS_ORIGIN: ReadonlySet<string> = new Set(["authorization", "cookie"]);
 
+/**
+ * The only headers carried onto a different origin. A caller-set header can
+ * hold a credential under any name (X-Api-Key, X-Auth-Token, ...), so a
+ * denylist cannot contain it: the headers configured on the client (and any
+ * per-call header, on a redirect) are bound to the origin they were meant for,
+ * and only these content-negotiation headers cross. Lower-case.
+ */
+const KEEP_ON_CROSS_ORIGIN: ReadonlySet<string> = new Set([
+    "user-agent", "accept", "accept-encoding", "accept-language", "content-type", "content-length",
+]);
+
+/** Only the headers allowed onto a different origin (KEEP_ON_CROSS_ORIGIN). */
+function keepCrossOriginHeaders(headers: Record<string, string>): Record<string, string> {
+    const out: Record<string, string> = {};
+    for (const [key, value] of Object.entries(headers)) {
+        if (KEEP_ON_CROSS_ORIGIN.has(key.toLowerCase())) out[key] = value;
+    }
+    return out;
+}
+
 /**
  * Minimal extension → MIME map for guessing a multipart part's Content-Type.
  * Kept in-repo so the client stays zero-dependency (Node has no stdlib
@@ -909,6 +929,19 @@ export class Api {
         return `${this.baseUrl}/${path.replace(/^\/+/, "")}`;
     }
 
+    /**
+     * The headers configured on the client, as they may go to `targetUrl`.
+     *
+     * They belong to the base origin, like the token: an absolute target on
+     * another origin gets only the cross-origin-safe ones. A client with no
+     * base has no origin to bind them to, and sends them to the URL each call
+     * names.
+     */
+    private configuredHeadersFor(targetUrl?: string): Record<string, string> {
+        const offOrigin = targetUrl !== undefined && this.baseUrl !== "" && !sameOrigin(targetUrl, this.baseUrl);
+        return offOrigin ? keepCrossOriginHeaders(this.headers) : this.headers;
+    }
+
     /**
      * Build the request headers (default User-Agent + auth + cookie jar +
      * extras) and serialize the body to a Buffer. Shared by every verb,
@@ -929,7 +962,7 @@ export class Api {
         extraHeaders?: Record<string, string>,
         targetUrl?: string,
     ): { headers: Record<string, string>; data: Buffer | undefined } {
-        const headers: Record<string, string> = { "User-Agent": `Tina4/${TINA4_VERSION}`, ...this.headers };
+        const headers: Record<string, string> = { "User-Agent": `Tina4/${TINA4_VERSION}`, ...this.configuredHeadersFor(targetUrl) };
         // Attach the configured Authorization / Cookie ONLY when the request
         // target is same-origin as the configured base. A path that is itself
         // an absolute off-origin URL (e.g. get("http://evil/x")) otherwise
@@ -1066,9 +1099,9 @@ export class Api {
      * Location, this drains the intermediate response and re-issues to the new
      * URL: 301/302/303 on a non-GET/HEAD become GET (body dropped, urllib
      * behaviour); 307/308 preserve method + body. When the redirect target is a
-     * DIFFERENT origin, the Authorization and Cookie headers are stripped so a
-     * bearer token / session cookie never leaks to a host you didn't
-     * authenticate to.
+     * DIFFERENT origin, only KEEP_ON_CROSS_ORIGIN headers are carried, so a
+     * bearer token, session cookie or any caller-set credential header never
+     * leaks to a host you didn't authenticate to.
      */
     private async performRequest(
         method: string,
@@ -1128,7 +1161,7 @@ export class Api {
                     const crossOrigin = !sameOrigin(url, nextUrl);
                     let nextMethod = method;
                     let nextData = data;
-                    const nextHeaders: Record<string, string> = { ...headers };
+                    const nextHeaders: Record<string, string> = crossOrigin ? keepCrossOriginHeaders(headers) : { ...headers };
 
                     // 301/302/303 on a body-bearing method → GET, drop the body
                     // (matches urllib's HTTPRedirectHandler); 307/308 preserve.
@@ -1143,12 +1176,6 @@ export class Api {
                         deleteHeaderCaseInsensitive(nextHeaders, "content-length");
                     }
 
-                    if (crossOrigin) {
-                        for (const name of STRIP_ON_CROSS_ORIGIN) {
-                            deleteHeaderCaseInsensitive(nextHeaders, name);
-                        }
-                    }
-
                     this.performRequest(nextMethod, nextUrl, nextHeaders, nextData, redirectsLeft - 1).then(resolve);
                     return;
                 }

package/packages/orm/dist/index.js

@@ -31466,6 +31466,13 @@ import { randomBytes as randomBytes9 } from "node:crypto";
 import { promises as fsp, createWriteStream } from "node:fs";
 import { basename as basename6 } from "node:path";
 import { pipeline } from "node:stream/promises";
+function keepCrossOriginHeaders(headers) {
+  const out = {};
+  for (const [key, value] of Object.entries(headers)) {
+    if (KEEP_ON_CROSS_ORIGIN.has(key.toLowerCase())) out[key] = value;
+  }
+  return out;
+}
 function sameOrigin(urlA, urlB) {
   try {
     const a = new URL2(urlA);
@@ -31609,7 +31616,7 @@ async function* parseSseStream(lines) {
   const trailing = emit();
   if (trailing) yield trailing;
 }
-var ApiStreamError, RETRY_STATUSES, DOWNLOAD_CHUNK_SIZE, MAX_REDIRECTS, STRIP_ON_CROSS_ORIGIN, MIME_BY_EXT, Api;
+var ApiStreamError, RETRY_STATUSES, DOWNLOAD_CHUNK_SIZE, MAX_REDIRECTS, STRIP_ON_CROSS_ORIGIN, KEEP_ON_CROSS_ORIGIN, MIME_BY_EXT, Api;
 var init_api = __esm({
   "../core/src/api.ts"() {
     "use strict";
@@ -31627,6 +31634,14 @@ var init_api = __esm({
     DOWNLOAD_CHUNK_SIZE = 64 * 1024;
     MAX_REDIRECTS = 10;
     STRIP_ON_CROSS_ORIGIN = /* @__PURE__ */ new Set(["authorization", "cookie"]);
+    KEEP_ON_CROSS_ORIGIN = /* @__PURE__ */ new Set([
+      "user-agent",
+      "accept",
+      "accept-encoding",
+      "accept-language",
+      "content-type",
+      "content-length"
+    ]);
     MIME_BY_EXT = {
       txt: "text/plain",
       html: "text/html",
@@ -32082,6 +32097,18 @@ var init_api = __esm({
         }
         return `${this.baseUrl}/${path10.replace(/^\/+/, "")}`;
       }
+      /**
+       * The headers configured on the client, as they may go to `targetUrl`.
+       *
+       * They belong to the base origin, like the token: an absolute target on
+       * another origin gets only the cross-origin-safe ones. A client with no
+       * base has no origin to bind them to, and sends them to the URL each call
+       * names.
+       */
+      configuredHeadersFor(targetUrl) {
+        const offOrigin = targetUrl !== void 0 && this.baseUrl !== "" && !sameOrigin(targetUrl, this.baseUrl);
+        return offOrigin ? keepCrossOriginHeaders(this.headers) : this.headers;
+      }
       /**
        * Build the request headers (default User-Agent + auth + cookie jar +
        * extras) and serialize the body to a Buffer. Shared by every verb,
@@ -32096,7 +32123,7 @@ var init_api = __esm({
        * clobber.
        */
       buildRequest(method, contentType, body, extraHeaders, targetUrl) {
-        const headers = { "User-Agent": `Tina4/${TINA4_VERSION}`, ...this.headers };
+        const headers = { "User-Agent": `Tina4/${TINA4_VERSION}`, ...this.configuredHeadersFor(targetUrl) };
         const sameOriginAsBase = targetUrl === void 0 || sameOrigin(targetUrl, this.baseUrl);
         if (this.authHeader && sameOriginAsBase) {
           headers["Authorization"] = this.authHeader;
@@ -32198,9 +32225,9 @@ var init_api = __esm({
        * Location, this drains the intermediate response and re-issues to the new
        * URL: 301/302/303 on a non-GET/HEAD become GET (body dropped, urllib
        * behaviour); 307/308 preserve method + body. When the redirect target is a
-       * DIFFERENT origin, the Authorization and Cookie headers are stripped so a
-       * bearer token / session cookie never leaks to a host you didn't
-       * authenticate to.
+       * DIFFERENT origin, only KEEP_ON_CROSS_ORIGIN headers are carried, so a
+       * bearer token, session cookie or any caller-set credential header never
+       * leaks to a host you didn't authenticate to.
        */
       async performRequest(method, url, headers, data, redirectsLeft) {
         try {
@@ -32244,18 +32271,13 @@ var init_api = __esm({
               const crossOrigin = !sameOrigin(url, nextUrl);
               let nextMethod = method;
               let nextData = data;
-              const nextHeaders = { ...headers };
+              const nextHeaders = crossOrigin ? keepCrossOriginHeaders(headers) : { ...headers };
               if ((status2 === 301 || status2 === 302 || status2 === 303) && method !== "GET" && method !== "HEAD") {
                 nextMethod = "GET";
                 nextData = void 0;
                 deleteHeaderCaseInsensitive(nextHeaders, "content-type");
                 deleteHeaderCaseInsensitive(nextHeaders, "content-length");
               }
-              if (crossOrigin) {
-                for (const name of STRIP_ON_CROSS_ORIGIN) {
-                  deleteHeaderCaseInsensitive(nextHeaders, name);
-                }
-              }
               this.performRequest(nextMethod, nextUrl, nextHeaders, nextData, redirectsLeft - 1).then(resolve21);
               return;
             }

package/types/core/src/api.d.ts

@@ -318,6 +318,15 @@ export declare class Api {
      */
     private openStreamRequest;
     private buildUrl;
+    /**
+     * The headers configured on the client, as they may go to `targetUrl`.
+     *
+     * They belong to the base origin, like the token: an absolute target on
+     * another origin gets only the cross-origin-safe ones. A client with no
+     * base has no origin to bind them to, and sends them to the URL each call
+     * names.
+     */
+    private configuredHeadersFor;
     /**
      * Build the request headers (default User-Agent + auth + cookie jar +
      * extras) and serialize the body to a Buffer. Shared by every verb,
@@ -357,9 +366,9 @@ export declare class Api {
      * Location, this drains the intermediate response and re-issues to the new
      * URL: 301/302/303 on a non-GET/HEAD become GET (body dropped, urllib
      * behaviour); 307/308 preserve method + body. When the redirect target is a
-     * DIFFERENT origin, the Authorization and Cookie headers are stripped so a
-     * bearer token / session cookie never leaks to a host you didn't
-     * authenticate to.
+     * DIFFERENT origin, only KEEP_ON_CROSS_ORIGIN headers are carried, so a
+     * bearer token, session cookie or any caller-set credential header never
+     * leaks to a host you didn't authenticate to.
      */
     private performRequest;
     /** Buffer a response body, parse JSON if possible, and store cookies. */