@gcmdev/faxios 0.1.0 → 0.2.1

package/src/lib/core/dispatchRequest.ts

@@ -0,0 +1,171 @@
+"use strict";
+
+import { getFetch } from "../adapters/fetch.js";
+import CanceledError from "../cancel/CanceledError.js";
+import isCancel from "../cancel/isCancel.js";
+import FaxiosError from "../core/FaxiosError.js";
+import FaxiosHeaders from "../core/FaxiosHeaders.js";
+import { validateSchema } from "../core/validateSchema.js";
+import { substitutePathParams } from "../helpers/substitutePathParams.js";
+import type { InternalFaxiosRequestConfig, FaxiosResponse } from "../types.js";
+import utils from "../utils.js";
+import transformData from "./transformData.js";
+
+function throwIfCancellationRequested(config: InternalFaxiosRequestConfig): void {
+  if (config.signal && config.signal.aborted) {
+    throw new CanceledError(undefined, config);
+  }
+}
+
+async function validateAndSubstitutePathParams(config: InternalFaxiosRequestConfig): Promise<void> {
+  if (config.pathParamsSchema) {
+    const validated = await validateSchema(
+      config.pathParamsSchema, config.pathParams,
+      FaxiosError.ERR_BAD_PATH_PARAMS_SCHEMA, config
+    );
+    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- runtime guard: schema can return { value: null }
+    if (validated == null) {
+      throw new FaxiosError(
+        "pathParamsSchema returned null/undefined",
+        FaxiosError.ERR_BAD_PATH_PARAMS_SCHEMA, config
+      );
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition, sonarjs/different-types-comparison -- runtime guard: schema may transform to non-Record
+    if (typeof validated !== "object" || validated === null || Array.isArray(validated)) {
+      throw new FaxiosError(
+        "pathParamsSchema must return a plain object",
+        FaxiosError.ERR_BAD_PATH_PARAMS_SCHEMA, config
+      );
+    }
+    config.pathParams = validated;
+  }
+  const params = config.pathParams ?? {};
+  try {
+    config.url = substitutePathParams(config.url ?? "", params);
+  }
+  catch (err) {
+    throw FaxiosError.from(
+      err instanceof Error ? err : new Error(String(err)),
+      FaxiosError.ERR_BAD_OPTION_VALUE, config
+    );
+  }
+}
+
+// Intentional mutation: config is the internal merged copy (post-mergeConfig), not the user's original.
+// Validation order (pathParams → params → data) is a fail-fast guarantee — do not reorder.
+// DO NOT make this function async. Returning undefined (not a Promise) on the fast path is a
+// microtask-ordering contract: dispatchRequest must reach the adapter in the same microtask so
+// that a synchronous controller.abort() after request creation is processed by the adapter's
+// signal listener, not before it registers. An async function always returns a Promise, inserting
+// a microtask boundary that breaks abort timing in fetch adapter tests and real-world usage.
+function validatePreFlight(config: InternalFaxiosRequestConfig): Promise<void> | undefined {
+  if (config.pathParamsSchema && config.pathParams === undefined) {
+    throw new FaxiosError(
+      "pathParams is required when pathParamsSchema is configured",
+      FaxiosError.ERR_BAD_OPTION_VALUE, config
+    );
+  }
+
+  const hasSchemas = config.pathParamsSchema || config.paramsSchema || config.requestSchema;
+  if (!hasSchemas && config.pathParams === undefined) return undefined;
+
+  // pathParams present but no schemas — substitute synchronously, no microtask boundary needed.
+  if (!hasSchemas) {
+    const params = config.pathParams ?? {};
+    try { config.url = substitutePathParams(config.url ?? "", params); }
+    catch (err) { throw FaxiosError.from(err instanceof Error ? err : new Error(String(err)), FaxiosError.ERR_BAD_OPTION_VALUE, config); }
+    return undefined;
+  }
+
+  return (async () => {
+    if (config.pathParams !== undefined) {
+      await validateAndSubstitutePathParams(config);
+    }
+
+    if (config.paramsSchema) {
+      throwIfCancellationRequested(config);
+      config.params = await validateSchema(config.paramsSchema, config.params, FaxiosError.ERR_BAD_PARAMS_SCHEMA, config) as typeof config.params;
+    }
+
+    if (config.requestSchema) {
+      throwIfCancellationRequested(config);
+      config.data = await validateSchema(config.requestSchema, config.data, FaxiosError.ERR_BAD_REQUEST_SCHEMA, config);
+    }
+  })();
+}
+
+export default async function dispatchRequest(this: unknown, config: InternalFaxiosRequestConfig): Promise<FaxiosResponse> {
+  throwIfCancellationRequested(config);
+
+  const preFlight = validatePreFlight(config);
+  if (preFlight) await preFlight;
+
+  config.headers = FaxiosHeaders.from(config.headers) as unknown as typeof config.headers;
+
+  config.data = transformData.call(config, config.transformRequest);
+
+  if (config.data != null && !utils.isFormData(config.data) && [ "post", "put", "patch" ].indexOf(config.method as string) !== -1) {
+    (config.headers as unknown as { setContentType: (v: string, r: boolean) => void; }).setContentType("application/x-www-form-urlencoded", false);
+  }
+
+  // Last cancellation check: nothing between here and the adapter call may await. An abort that
+  // lands during pre-flight validation must not reach the adapter, which only listens for future
+  // abort events.
+  throwIfCancellationRequested(config);
+
+  const _adapter = getFetch(config);
+  if (!_adapter) {
+    throw new FaxiosError(
+      "Fetch API is not supported in this environment",
+      FaxiosError.ERR_NOT_SUPPORT,
+      config
+    );
+  }
+  const adapter = _adapter as (config: InternalFaxiosRequestConfig) => Promise<FaxiosResponse>;
+
+  /* eslint-disable promise/always-return */
+  return (adapter(config))
+    .then(
+
+      function onAdapterResolution(response: FaxiosResponse) {
+        throwIfCancellationRequested(config);
+
+        (config as unknown as Record<string, unknown>)["response"] = response;
+
+        try {
+          response.data = transformData.call(config, config.transformResponse, response);
+          response.headers = FaxiosHeaders.from(response.headers);
+        }
+        finally {
+          delete (config as unknown as Record<string, unknown>)["response"];
+        }
+
+        if (config.responseSchema) {
+          return validateSchema(config.responseSchema, response.data, FaxiosError.ERR_BAD_RESPONSE_SCHEMA, config, response)
+            .then(data => { response.data = data; throwIfCancellationRequested(config); return response; });
+        }
+
+        return response;
+      },
+      function onAdapterRejection(reason: unknown) {
+        if (!isCancel(reason)) {
+          throwIfCancellationRequested(config);
+
+          const r = reason as { response?: { data?: unknown; headers?: unknown; status?: number; [k: string]: unknown; }; } | null;
+          if (r?.response) {
+            (config as unknown as Record<string, unknown>)["response"] = r.response;
+            try {
+              r.response.data = transformData.call(config, config.transformResponse, r.response);
+            }
+            finally {
+              delete (config as unknown as Record<string, unknown>)["response"];
+            }
+            r.response.headers = FaxiosHeaders.from(r.response.headers as Record<string, unknown>);
+          }
+        }
+
+        throw reason;
+      }
+    );
+  /* eslint-enable promise/always-return */
+}

package/src/lib/core/mergeConfig.ts

@@ -0,0 +1,175 @@
+"use strict";
+
+import type { FaxiosRequestConfig, FaxiosDefaults } from "../types.js";
+import utils from "../utils.js";
+import FaxiosHeaders from "./FaxiosHeaders.js";
+
+const headersToObject = (thing: unknown) => (thing instanceof FaxiosHeaders ? { ...thing } : thing);
+
+/**
+ * Config-specific merge-function which creates a new config-object
+ * by merging two configuration objects together.
+ *
+ * @param {Object} config1
+ * @param {Object} config2
+ *
+ * @returns {Object} New object resulting from merging config2 to config1
+ */
+export default function mergeConfig(config1: FaxiosRequestConfig | FaxiosDefaults | Record<string, unknown>, config2?: FaxiosRequestConfig | FaxiosDefaults | Record<string, unknown>): FaxiosRequestConfig & Record<string, unknown> {
+   
+  config2 = config2 || {};
+
+  // Use a null-prototype object so that downstream reads such as `config.auth`
+  // or `config.baseURL` cannot inherit polluted values from Object.prototype.
+  // `hasOwnProperty` is restored as a non-enumerable own slot to preserve
+  // ergonomics for user code that relies on it.
+  const config = Object.create(null);
+  Object.defineProperty(config, "hasOwnProperty",
+    // Null-proto descriptor so a polluted Object.prototype.get cannot turn
+    // this data descriptor into an accessor descriptor on the way in.
+    Object.assign(Object.create(null) as PropertyDescriptor, {
+      value: Object.prototype.hasOwnProperty,
+      enumerable: false,
+      writable: true,
+      configurable: true,
+    })
+  );
+
+  function getMergedValue(target: unknown, source: unknown, _prop?: unknown, caseless?: unknown): unknown {
+    if (utils.isPlainObject(target) && utils.isPlainObject(source)) {
+      return utils.merge.call({ caseless }, target, source);
+    }
+    else if (utils.isPlainObject(source)) {
+      return utils.merge({}, source);
+    }
+    else if (utils.isArray(source)) {
+      return source.slice();
+    }
+    return source;
+  }
+
+  function mergeDeepProperties(a: unknown, b: unknown, prop?: unknown, caseless?: unknown): unknown {
+    if (!utils.isUndefined(b)) {
+      return getMergedValue(a, b, prop, caseless);
+    }
+    else if (!utils.isUndefined(a)) {
+      return getMergedValue(undefined, a, prop, caseless);
+    }
+    return undefined;
+  }
+
+  function valueFromConfig2(_a: unknown, b: unknown): unknown {
+    if (!utils.isUndefined(b)) {
+      return getMergedValue(undefined, b);
+    }
+    return undefined;
+  }
+
+  function defaultToConfig2(a: unknown, b: unknown, prop?: unknown): unknown {
+    if (!utils.isUndefined(b)) {
+      return getMergedValue(undefined, b);
+    }
+    // ponytail: explicit undefined in config2 (e.g. xsrfCookieName: undefined) must win over config1's default
+    else if (utils.hasOwnProp(config2, prop as string)) {
+      return undefined;
+    }
+    else if (!utils.isUndefined(a)) {
+      return getMergedValue(undefined, a);
+    }
+    return undefined;
+  }
+
+  function getMergedTransitionalOption(prop: string): unknown {
+    const c2 = config2 as Record<string, unknown>;
+    const c1 = config1 as Record<string, unknown>;
+    const transitional2 = utils.hasOwnProp(config2, "transitional") ? c2["transitional"] : undefined;
+
+    if (!utils.isUndefined(transitional2)) {
+      if (utils.isPlainObject(transitional2)) {
+        if (utils.hasOwnProp(transitional2, prop)) {
+          return (transitional2 as Record<string, unknown>)[prop];
+        }
+      }
+      else {
+        return undefined;
+      }
+    }
+
+    const transitional1 = utils.hasOwnProp(config1, "transitional") ? c1["transitional"] : undefined;
+
+    if (utils.isPlainObject(transitional1) && utils.hasOwnProp(transitional1, prop)) {
+      return (transitional1 as Record<string, unknown>)[prop];
+    }
+
+    return undefined;
+  }
+   
+  function mergeDirectKeys(a: unknown, b: unknown, prop?: unknown): unknown {
+    if (utils.hasOwnProp(config2, prop as string)) {
+      return getMergedValue(a, b);
+    }
+    else if (utils.hasOwnProp(config1, prop as string)) {
+      return getMergedValue(undefined, a);
+    }
+    return undefined;
+  }
+
+  const mergeMap = {
+    url: valueFromConfig2,
+    method: valueFromConfig2,
+    data: valueFromConfig2,
+    baseURL: defaultToConfig2,
+    transformRequest: defaultToConfig2,
+    transformResponse: defaultToConfig2,
+    paramsSerializer: defaultToConfig2,
+    timeout: defaultToConfig2,
+    timeoutMessage: defaultToConfig2,
+    withCredentials: defaultToConfig2,
+    withXSRFToken: defaultToConfig2,
+    responseType: defaultToConfig2,
+    xsrfCookieName: defaultToConfig2,
+    xsrfHeaderName: defaultToConfig2,
+    onUploadProgress: defaultToConfig2,
+    onDownloadProgress: defaultToConfig2,
+    maxContentLength: defaultToConfig2,
+    maxBodyLength: defaultToConfig2,
+    responseEncoding: defaultToConfig2,
+    responseSchema: defaultToConfig2,
+    requestSchema: defaultToConfig2,
+    paramsSchema: defaultToConfig2,
+    pathParams: defaultToConfig2,
+    pathParamsSchema: defaultToConfig2,
+    validateStatus: mergeDirectKeys,
+    headers: (a: unknown, b: unknown, prop?: unknown) =>
+      mergeDeepProperties(headersToObject(a), headersToObject(b), prop, true),
+  };
+
+  const c1 = config1 as Record<string, unknown>;
+  const c2 = config2 as Record<string, unknown>;
+  const out = config as Record<string, unknown>;
+
+  utils.forEach(Object.keys({ ...config1, ...config2 }), function computeConfigValue(_value: unknown, _prop: unknown) {
+    const key = _value as string;
+    if (key === "__proto__" || key === "constructor" || key === "prototype") return;
+    const mergeFn = (utils.hasOwnProp(mergeMap, key) ? (mergeMap as Record<string, typeof mergeDeepProperties>)[key] : mergeDeepProperties)!;
+    const a = utils.hasOwnProp(config1, key) ? c1[key] : undefined;
+    const b = utils.hasOwnProp(config2, key) ? c2[key] : undefined;
+    const configValue = mergeFn(a, b, key);
+    (utils.isUndefined(configValue) && mergeFn !== mergeDirectKeys) || (out[key] = configValue);
+  });
+
+  if (
+    utils.hasOwnProp(config2, "validateStatus") &&
+    utils.isUndefined((config2).validateStatus) &&
+    getMergedTransitionalOption("validateStatusUndefinedResolves") === false
+  ) {
+    if (utils.hasOwnProp(config1, "validateStatus")) {
+      out["validateStatus"] = getMergedValue(undefined, (config1).validateStatus);
+    }
+    else {
+      delete out["validateStatus"];
+    }
+  }
+
+  return config;
+}

package/src/lib/core/prepareRequest.ts

@@ -0,0 +1,155 @@
+import buildFullPath from "../core/buildFullPath.js";
+import FaxiosHeaders from "../core/FaxiosHeaders.js";
+import buildURL from "../helpers/buildURL.js";
+import cloneConfig from "../helpers/cloneConfig.js";
+import cookies from "../helpers/cookies.js";
+import isURLSameOrigin from "../helpers/isURLSameOrigin.js";
+import platform from "../platform.js";
+import type { FaxiosRequestConfig } from "../types.js";
+import utils from "../utils.js";
+
+const FORM_DATA_CONTENT_HEADERS = [ "content-type", "content-length" ];
+
+function setFormDataHeaders(
+  headers: FaxiosHeaders,
+  formHeaders: Record<string, unknown>,
+  policy: unknown
+): void {
+  if (policy !== "content-only") {
+    headers.set(formHeaders);
+    return;
+  }
+  /* eslint-disable big-o/no-array-lookup-in-loop -- 2-element constant array */
+  Object.entries(formHeaders).forEach(([ key, val ]) => {
+    if (FORM_DATA_CONTENT_HEADERS.includes(key.toLowerCase())) {
+      headers.set(key, val);
+    }
+  });
+  /* eslint-enable big-o/no-array-lookup-in-loop */
+}
+
+/**
+ * Encode a UTF-8 string to a Latin-1 byte string for use with btoa().
+ * This is a modern replacement for the deprecated unescape(encodeURIComponent(str)) pattern.
+ *
+ * @param {string} str The string to encode
+ *
+ * @returns {string} UTF-8 bytes as a Latin-1 string
+ */
+const encodeUTF8 = (str: string): string =>
+  encodeURIComponent(str).replace(
+    /%([0-9A-F]{2})/gi,
+    (_: string, hex: string) => String.fromCharCode(parseInt(hex, 16))
+  );
+
+function applyXSRFToken(
+  headers: FaxiosHeaders,
+  withXSRFToken: ((cfg: unknown) => unknown) | boolean | null | undefined,
+  xsrfHeaderName: string | undefined,
+  xsrfCookieName: string | undefined,
+  config: FaxiosRequestConfig
+): void {
+  if (utils.isFunction(withXSRFToken)) {
+    withXSRFToken = (withXSRFToken as (cfg: unknown) => unknown)(
+      config
+    ) as boolean | null | undefined;
+  }
+
+  // Strict boolean check — prevents proto-pollution gadgets (e.g. Object.prototype.withXSRFToken = 1)
+  // and misconfigurations (e.g. "false") from short-circuiting the same-origin check and leaking
+  // the XSRF token cross-origin.
+  const shouldSendXSRF =
+    withXSRFToken === true ||
+    (withXSRFToken == null && isURLSameOrigin(config.url ?? ""));
+
+  if (shouldSendXSRF) {
+    const xsrfValue =
+      xsrfHeaderName && xsrfCookieName && cookies.read(xsrfCookieName);
+
+    if (xsrfValue) {
+      headers.set(xsrfHeaderName, xsrfValue);
+    }
+  }
+}
+
+function prepareRequest(config: FaxiosRequestConfig): FaxiosRequestConfig {
+  const newConfig = cloneConfig(config);
+
+  // Read only own properties to prevent prototype pollution gadgets
+  // (e.g. Object.prototype.baseURL = 'https://evil.com').
+  const own = (key: string) =>
+    utils.hasOwnProp(newConfig, key)
+      ? (newConfig as Record<string, unknown>)[key]
+      : undefined;
+
+  const data = own("data");
+  let withXSRFToken = own("withXSRFToken") as
+    | ((cfg: unknown) => unknown)
+    | boolean
+    | null
+    | undefined;
+  const xsrfHeaderName = own("xsrfHeaderName") as string | undefined;
+  const xsrfCookieName = own("xsrfCookieName") as string | undefined;
+  const auth = own("auth");
+  const baseURL = own("baseURL");
+  const allowAbsoluteUrls = own("allowAbsoluteUrls");
+  const url = own("url");
+
+  const headers: FaxiosHeaders = FaxiosHeaders.from(
+    own("headers") as Record<string, unknown> | null | undefined
+  );
+  newConfig.headers = headers;
+
+  newConfig.url = buildURL(
+    buildFullPath(baseURL, url, allowAbsoluteUrls, newConfig),
+    own("params"),
+    own("paramsSerializer")
+  );
+
+  // HTTP basic authentication
+  if (auth) {
+    const username = String(utils.getSafeProp(auth, "username") || "");
+    const password = String(utils.getSafeProp(auth, "password") || "");
+
+    headers.set(
+      "Authorization",
+      "Basic " +
+        (
+          (globalThis as Record<string, unknown>)["btoa"] as (
+            s: string
+          ) => string
+        )(username + ":" + (password ? encodeUTF8(password) : ""))
+    );
+  }
+
+  if (utils.isFormData(data)) {
+    if (
+      platform.hasStandardBrowserEnv ||
+      platform.hasStandardBrowserWebWorkerEnv ||
+      utils.isReactNative(data)
+    ) {
+      (headers.setContentType as (v: unknown) => unknown)(undefined); // browser/web worker/RN handles it
+    }
+    else if (
+      utils.isFunction((data as Record<string, unknown>)["getHeaders"])
+    ) {
+      // Node.js FormData (like form-data package)
+      setFormDataHeaders(
+        headers,
+        (data as { getHeaders: () => Record<string, unknown>; }).getHeaders(),
+        own("formDataHeaderPolicy")
+      );
+    }
+  }
+
+  // Add xsrf header
+  // This is only done if running in a standard browser environment.
+  // Specifically not if we're in a web worker, or react-native.
+  if (platform.hasStandardBrowserEnv) {
+    applyXSRFToken(headers, withXSRFToken, xsrfHeaderName, xsrfCookieName, newConfig);
+  }
+
+  return newConfig;
+}
+
+export default prepareRequest;

package/src/lib/core/route.ts

@@ -0,0 +1,68 @@
+// @ts-self-types="./route.d.ts" — required for Deno: maps built .js to adjacent .d.ts in dist/
+
+import type { StandardSchemaV1 } from "../types/standard-schema.js";
+import type { BasePerCallConfig, DefineConfig, DefinedEndpoint, FaxiosLike } from "./define.js";
+import { createDefinedEndpoint } from "./define.js";
+
+/** Config for `route()`: request defaults shared by every method, plus an optional `pathParamsSchema`. */
+export type RouteConfig<PP extends StandardSchemaV1<unknown, Record<string, unknown>> | undefined = undefined> =
+  BasePerCallConfig & {
+    /**
+     * Standard Schema that validates `pathParams` on every call of every method's endpoint; its
+     * output fills the `{key}` placeholders. Makes `pathParams` required per call, and a method's
+     * config can't replace it. A failure rejects with `ERR_BAD_PATH_PARAMS_SCHEMA`.
+     */
+    pathParamsSchema?: PP;
+  };
+
+/** Config for one method of a route; merged over the route config. */
+export type RouteMethodConfig<
+  P extends StandardSchemaV1 | undefined = undefined,
+  D extends StandardSchemaV1 | undefined = undefined,
+  R extends StandardSchemaV1 | undefined = undefined
+> = BasePerCallConfig & {
+  paramsSchema?: P;
+  requestSchema?: D;
+  responseSchema?: R;
+};
+
+/** The object `route()` returns: one endpoint factory per HTTP method (no `query`). */
+export type RouteBuilder<PP extends StandardSchemaV1<unknown, Record<string, unknown>> | undefined, TOpts = unknown> = {
+  [M in "get" | "post" | "put" | "patch" | "delete" | "head" | "options"]: <
+    P extends StandardSchemaV1 | undefined = undefined,
+    D extends StandardSchemaV1 | undefined = undefined,
+    R extends StandardSchemaV1 | undefined = undefined
+  >(config?: RouteMethodConfig<P, D, R> & TOpts) => DefinedEndpoint<PP, P, D, R, TOpts>;
+};
+
+// ponytail: `query` excluded — non-standard HTTP method alias, not useful in route definitions
+const methods = [ "get", "post", "put", "patch", "delete", "head", "options" ] as const satisfies ReadonlyArray<keyof RouteBuilder<undefined>>;
+
+export function createRouteBuilder<PP extends StandardSchemaV1<unknown, Record<string, unknown>> | undefined>(
+  instance: FaxiosLike,
+  url: string,
+  routeConfig?: RouteConfig<PP>
+): RouteBuilder<PP> {
+  const raw = Object.assign(Object.create(null), routeConfig ?? {});
+  delete raw.__proto__;
+  delete raw.constructor;
+  delete raw.prototype;
+  const { pathParamsSchema, ...routeDefaults } = raw;
+
+  const builder = {} as RouteBuilder<PP>;
+  for (const method of methods) {
+    (builder as Record<string, unknown>)[method] = <
+      P extends StandardSchemaV1 | undefined,
+      D extends StandardSchemaV1 | undefined,
+      R extends StandardSchemaV1 | undefined
+    >(methodConfig?: RouteMethodConfig<P, D, R>) => {
+      const defineConf = {
+        ...routeDefaults,
+        ...(methodConfig ?? {}),
+        ...(pathParamsSchema !== undefined ? { pathParamsSchema } : {}),
+      } as DefineConfig<PP, P, D, R>;
+      return createDefinedEndpoint<PP, P, D, R>(instance, method, url, defineConf);
+    };
+  }
+  return builder;
+}

package/src/lib/core/settle.ts

@@ -0,0 +1,20 @@
+"use strict";
+
+import type { FaxiosResponse } from "../types.js";
+import FaxiosError from "./FaxiosError.js";
+
+export function settle(resolve: (value: FaxiosResponse) => void, reject: (reason: unknown) => void, response: FaxiosResponse): void {
+  const validateStatus = response.config.validateStatus;
+  if (!response.status || !validateStatus || validateStatus(response.status)) {
+    resolve(response);
+  }
+  else {
+    reject(new FaxiosError(
+      "Request failed with status code " + response.status,
+      response.status >= 400 && response.status < 500 ? FaxiosError.ERR_BAD_REQUEST : FaxiosError.ERR_BAD_RESPONSE,
+      response.config,
+      response.request,
+      response
+    ));
+  }
+}

package/src/lib/core/transformData.ts

@@ -0,0 +1,23 @@
+"use strict";
+
+import FaxiosHeaders from "../core/FaxiosHeaders.js";
+import defaults from "../defaults/index.js";
+import type { InternalFaxiosRequestConfig, FaxiosRequestHeaders, FaxiosRequestTransformer, FaxiosResponseTransformer } from "../types.js";
+import utils from "../utils.js";
+
+type TransformFn = FaxiosRequestTransformer | FaxiosResponseTransformer;
+
+export default function transformData(this: unknown, fns: TransformFn | Array<TransformFn> | undefined, response?: { data?: unknown; headers?: unknown; status?: number; } | null): unknown {
+  const config = (this || defaults) as InternalFaxiosRequestConfig;
+  const context = response || config;
+  const headers = FaxiosHeaders.from(context.headers as Record<string, unknown> | undefined);
+  let data: unknown = (context as { data?: unknown; }).data;
+
+  utils.forEach(fns, function transform(fn: unknown) {
+    data = (fn as TransformFn).call(config, data, headers as unknown as FaxiosRequestHeaders, response?.status);
+  });
+
+  headers.normalize(false);
+
+  return data;
+}

package/src/lib/core/validateSchema.ts

@@ -0,0 +1,53 @@
+import isCancel from "../cancel/isCancel.js";
+import type { StandardSchemaV1 } from "../types/standard-schema.js";
+import type { InternalFaxiosRequestConfig, FaxiosResponse } from "../types.js";
+import FaxiosError from "./FaxiosError.js";
+
+type SchemaErrorCode =
+  | typeof FaxiosError.ERR_BAD_RESPONSE_SCHEMA
+  | typeof FaxiosError.ERR_BAD_REQUEST_SCHEMA
+  | typeof FaxiosError.ERR_BAD_PARAMS_SCHEMA
+  | typeof FaxiosError.ERR_BAD_PATH_PARAMS_SCHEMA;
+
+export async function validateSchema<S extends StandardSchemaV1>(
+  schema: S,
+  value: unknown,
+  errorCode: SchemaErrorCode,
+  config: InternalFaxiosRequestConfig,
+  response?: FaxiosResponse
+): Promise<StandardSchemaV1.InferOutput<S>> {
+  let result: StandardSchemaV1.Result<unknown> | undefined;
+  try {
+    const raw = schema["~standard"].validate(value);
+    result = raw instanceof Promise ? await raw : raw;
+  }
+  catch (err) {
+    if (isCancel(err)) throw err;
+    const cause = err instanceof Error ? err : new Error(String(err), { cause: err });
+    const wrapped = FaxiosError.from(
+      cause, errorCode, config, undefined, response
+    );
+    wrapped.issues = [{ message: wrapped.message }];
+    throw wrapped;
+  }
+  // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
+  if (!result) {
+    const error = new FaxiosError(
+      `schema['~standard'].validate() returned a non-Result value`,
+      errorCode, config, undefined, response
+    );
+    error.issues = [];
+    throw error;
+  }
+  if (result.issues !== undefined) {
+    const error = new FaxiosError(
+      "Schema validation failed",
+      errorCode, config, undefined, response
+    );
+    // Strip to spec-only fields — runtime libs may attach sensitive data
+    error.issues = result.issues.map(({ message, path }) => path ? { message, path } : { message });
+    throw error;
+  }
+  // Standard Schema spec guarantees Result.value aligns with InferOutput
+  return result.value;
+}