@gcmdev/faxios 0.2.1 → 0.2.2

package/skills/configure-requests/SKILL.md

@@ -86,8 +86,8 @@ const res = await faxios.get("https://api.example.com/users/{id}/posts", {
 // GET https://api.example.com/users/42/posts?page=2&tag=news
 ```
 
-`pathParams` values are `encodeURIComponent`-encoded. A missing or `null` value rejects with
-`ERR_BAD_OPTION_VALUE`.
+`pathParams` values are `encodeURIComponent`-encoded. A missing or `null` value, or `.`/`..`
+(also percent-encoded, such as `%2e%2e`), rejects with `ERR_BAD_OPTION_VALUE`.
 
 Binary downloads need `responseType`, and a type argument because `data` is `unknown`:
 
@@ -273,6 +273,7 @@ plugin's request options (such as `retry: false`). Before writing plugin code, r
   `baseURL` origin when `baseURL` is absolute; otherwise only to relative request URLs. Use
   `origins` to allow more. It leaves an explicit `Authorization` header alone unless
   `overwrite: true`. Install `retry` before it if each attempt should call `getToken` again.
+  A `getToken` result that isn't a non-empty string sends the request without the header.
 - `retry` defaults: 3 attempts, statuses 408/429/500/502/503/504 plus `ERR_NETWORK` and
   `ETIMEDOUT`, exponential backoff from 100 ms with full jitter. A 429/503 `Retry-After` sets the
   wait unless `respectRetryAfter: false`. Turn that off when something else, such as a queue
@@ -304,9 +305,11 @@ const { data } = await testApi.get("https://api.example.com/feed"); // { ok: tru
 await faxios.get("https://api.example.com/feed", { fetchOptions: { cache: "no-store" } });
 ```
 
-- `fetchOptions` is spread into the init object passed to `fetch`. faxios sets `signal`, `method`,
-  `headers`, `body`, `duplex` and `credentials` itself, and those override the same keys in
-  `fetchOptions`.
+- Every own enumerable key of `fetchOptions` is copied into a null-prototype init passed to
+  `fetch`, including runtime extensions (Next.js `next`, Workers `cf`, undici `dispatcher`).
+  Inherited keys are ignored. faxios sets `signal`, `method`, `headers`, `body`, `duplex` and
+  `credentials` itself and ignores those keys in `fetchOptions`.
+- `env.fetch`, `env.Request` and `env.Response` count only as own properties of `env`.
 - Plain-object values inside `fetchOptions` are copied when configs merge; class instances are
   passed by reference.
 - Proxies are runtime configuration, not a faxios option. In Node, the project docs route a

package/skills/configure-requests/references/plugins.md

@@ -85,21 +85,49 @@ Check: `faxios.get("/orders", { trace: "x" })` on an instance without the plugin
 installing it before `authBearer`:
 
 ```ts
-import faxios, { FaxiosError, type FaxiosContext } from "@gcmdev/faxios";
+import faxios, { type FaxiosContext } from "@gcmdev/faxios";
 import { definePlugin } from "@gcmdev/faxios/plugins";
 import { authBearer, type AuthBearerCapability } from "@gcmdev/faxios/plugins/auth-bearer";
 
+function requireSignIn() {
+  return definePlugin({
+    name: "requireSignIn",
+    middleware: async (ctx: FaxiosContext<unknown, AuthBearerCapability>, next) => {
+      if (!(await ctx.capabilities.auth.getToken())) throw new Error("Sign in first");
+      return next(ctx);
+    },
+  });
+}
+
+const api = faxios
+  .create({ baseURL: "https://api.example.com" })
+  .use(authBearer(() => "token"))
+  .use(requireSignIn());
+```
+
+## Refresh a token after a 401
+
+Install the refresh plugin before `authBearer` and never set `Authorization` in it. The retry
+runs `authBearer` again, which calls `getToken` and applies its origin rule, so a third-party 401
+is retried without the token. Share one in-flight refresh so rotating refresh tokens aren't spent twice:
+
+```ts
+import faxios, { FaxiosError } from "@gcmdev/faxios";
+import { definePlugin } from "@gcmdev/faxios/plugins";
+import { authBearer } from "@gcmdev/faxios/plugins/auth-bearer";
+
 function refreshOn401(refresh: () => Promise<void>) {
+  let refreshing: Promise<void> | undefined;
   return definePlugin({
     name: "refreshOn401",
-    middleware: async (ctx: FaxiosContext<unknown, AuthBearerCapability>, next) => {
+    middleware: async (ctx, next) => {
       try {
         return await next(ctx);
       }
       catch (error) {
         if (!(error instanceof FaxiosError) || error.response?.status !== 401) throw error;
-        await refresh();
-        ctx.config.headers.set("Authorization", `Bearer ${await ctx.capabilities.auth.getToken()}`);
+        refreshing ??= refresh().finally(() => { refreshing = undefined; });
+        await refreshing;
         return next(ctx);
       }
     },
@@ -109,10 +137,13 @@ function refreshOn401(refresh: () => Promise<void>) {
 let token = "old";
 const api = faxios
   .create({ baseURL: "https://api.example.com" })
-  .use(authBearer(() => token))
-  .use(refreshOn401(async () => { token = "new"; }));
+  .use(refreshOn401(async () => { token = "new"; }))
+  .use(authBearer(() => token));
 ```
 
+Calling `next` again re-sends the body. A stream body is used up by the first try; sending it
+again rejects with `ERR_BAD_REQUEST`.
+
 ## Rules `.use()` enforces at runtime
 
 - `name` must be a non-empty own string, otherwise `ERR_BAD_OPTION_VALUE`.

package/src/index.ts

@@ -11,7 +11,7 @@ import type { CreateFaxiosDefaults } from "./lib/types.ts";
 export { default as Faxios } from "./lib/core/Faxios.ts";
 export { default as FaxiosError, isSchemaValidationError } from "./lib/core/FaxiosError.ts";
 export type { SchemaValidationError } from "./lib/core/FaxiosError.ts";
-export { default as CanceledError, default as Cancel } from "./lib/cancel/CanceledError.ts";
+export { default as Cancel, default as CanceledError } from "./lib/cancel/CanceledError.ts";
 export { default as isCancel } from "./lib/cancel/isCancel.ts";
 export { default as isFaxiosError } from "./lib/helpers/isFaxiosError.ts";
 export { default as toFormData } from "./lib/helpers/toFormData.ts";
@@ -23,28 +23,28 @@ export { VERSION } from "./lib/env/data.ts";
 export type { FaxiosInstance, FaxiosStatic } from "./lib/faxios.ts";
 export type { StandardSchemaV1 } from "./lib/types/standard-schema.ts";
 export type { BasePerCallConfig, DefineConfig, DefinedEndpoint, FaxiosLike, PerCallConfig } from "./lib/core/define.ts";
-export type { RouteConfig, RouteMethodConfig, RouteBuilder } from "./lib/core/route.ts";
+export type { RouteBuilder, RouteConfig, RouteMethodConfig } from "./lib/core/route.ts";
 
 export type {
+  CreateFaxiosDefaults,
+  FaxiosConfigHeaders,
+  FaxiosContext,
+  FaxiosHeaderValue,
+  FaxiosMiddleware,
+  FaxiosNext,
+  FaxiosPlugin,
+  FaxiosPromise,
   FaxiosRequestConfig,
-  InternalFaxiosRequestConfig,
-  FaxiosResponse,
   FaxiosRequestHeaders,
+  FaxiosResponse,
   FaxiosResponseHeadersLike,
-  FaxiosHeaderValue,
-  Method,
-  ResponseType,
   GenericHTMLFormElement,
+  HeadersDefaults,
+  InternalFaxiosRequestConfig,
+  Method,
   RawFaxiosRequestConfig,
-  FaxiosPromise,
-  CreateFaxiosDefaults,
-  FaxiosConfigHeaders,
   RawFaxiosRequestHeaders,
-  HeadersDefaults,
-  FaxiosContext,
-  FaxiosNext,
-  FaxiosMiddleware,
-  FaxiosPlugin
+  ResponseType
 } from "./lib/types.ts";
 
 // Instance-synthesized members (no 1:1 source module). Types are self-contained

package/src/lib/adapters/fetch-helpers.ts

@@ -3,9 +3,9 @@
 import FaxiosError from "../core/FaxiosError.js";
 import type FaxiosHeaders from "../core/FaxiosHeaders.js";
 import type {
-  InternalFaxiosRequestConfig,
   FaxiosRequestHeaders,
-  FaxiosResponse
+  FaxiosResponse,
+  InternalFaxiosRequestConfig
 } from "../types.js";
 import utils from "../utils.js";
 
@@ -144,7 +144,7 @@ export const cleanFormDataContentType = (
   headers: FaxiosRequestHeaders
 ): void => {
   if (utils.isFormData(data)) {
-    const contentType = headers.getContentType() as string | null | undefined;
+    const contentType = headers.getContentType() as null | string | undefined;
     if (
       contentType &&
       /^multipart\/form-data/i.test(contentType) &&

package/src/lib/adapters/fetch.ts

@@ -6,19 +6,19 @@ import { VERSION } from "../env/data.js";
 import composeSignals from "../helpers/composeSignals.js";
 import estimateDataURLDecodedBytes from "../helpers/estimateDataURLDecodedBytes.js";
 import {
-  progressEventReducer,
+  asyncDecorator,
   progressEventDecorator,
-  asyncDecorator
+  progressEventReducer
 } from "../helpers/progressEventReducer.js";
 import { toByteStringHeaderObject } from "../helpers/sanitizeHeaderValue.js";
 import { trackStream } from "../helpers/trackStream.js";
 import platform from "../platform.js";
 import type {
-  InternalFaxiosRequestConfig,
-  FaxiosRequestHeaders
+  FaxiosRequestHeaders,
+  InternalFaxiosRequestConfig
 } from "../types.js";
 import utils from "../utils.js";
-import { checkDeclaredContentLength, checkMaterializedSize, handleFetchCaughtError, cleanFormDataContentType, encodeBodyIfNeeded } from "./fetch-helpers.js";
+import { checkDeclaredContentLength, checkMaterializedSize, cleanFormDataContentType, encodeBodyIfNeeded, handleFetchCaughtError } from "./fetch-helpers.js";
 import type { ComposedSignal, PendingBodyErrorRef } from "./fetch-helpers.js";
 
 // btoa is a global in Node 16+ and browsers; accessed via globalThis for no-DOM lib compat
@@ -28,29 +28,29 @@ const _btoa: (data: string) => string = (
 type AnyConstructor = new (...args: Array<unknown>) => unknown;
 type FetchFn = (input: unknown, init?: unknown) => Promise<AnyResponse>;
 type AnyResponse = {
+  [key: string]: unknown;
+  arrayBuffer: () => Promise<ArrayBuffer>;
   body: unknown;
   headers: {
-    has: (name: string) => boolean;
-    get: (name: string) => string | null;
     [key: string]: unknown;
+    get: (name: string) => null | string;
+    has: (name: string) => boolean;
   };
   status: number;
   statusText: string;
-  arrayBuffer: () => Promise<ArrayBuffer>;
-  [key: string]: unknown;
 };
 type AnyRequest = {
+  [key: string]: unknown;
+  arrayBuffer: () => Promise<ArrayBuffer>;
+  body: null | { cancel: () => Promise<void>; };
   headers: {
+    get: (name: string) => null | string;
     has: (name: string) => boolean;
-    get: (name: string) => string | null;
   };
-  body: { cancel: () => Promise<void>; } | null;
-  arrayBuffer: () => Promise<ArrayBuffer>;
-  [key: string]: unknown;
 };
 type AnyReadableStream = {
-  cancel: () => Promise<void>;
   [key: string]: unknown;
+  cancel: () => Promise<void>;
 };
 type AnyTextEncoder = { encode: (str: string) => Uint8Array; };
 
@@ -58,6 +58,29 @@ const DEFAULT_CHUNK_SIZE = 64 * 1024;
 
 const { isFunction } = utils;
 
+// Web stream bodies this adapter has sent. fetch can read a stream without leaving it locked,
+// and there's no portable "disturbed" check, so a second send is caught here.
+const sentStreamBodies = new WeakSet<object>();
+
+// A stream body can be read once. Middleware that calls next() again after a try read it
+// would send an empty body (Node stream) or get an uncoded TypeError from fetch (web stream).
+const rejectUsedStreamBody = (data: unknown, config: InternalFaxiosRequestConfig): void => {
+  const body = data as { bodyUsed?: unknown; destroyed?: unknown; locked?: unknown; readableDidRead?: unknown; readableEnded?: unknown; };
+  const isWebStream = utils.isReadableStream!(data);
+  if (
+    (isWebStream && (body.locked === true || sentStreamBodies.has(body))) ||
+    ((utils.isRequest!(data) || utils.isResponse!(data)) && body.bodyUsed === true) ||
+    (utils.isStream(data) && (body.readableDidRead === true || body.readableEnded === true || body.destroyed === true))
+  ) {
+    throw new FaxiosError(
+      "Request body stream was already used and can't be sent again; pass a new body for each try",
+      FaxiosError.ERR_BAD_REQUEST,
+      config
+    );
+  }
+  if (isWebStream) sentStreamBodies.add(body);
+};
+
 // Server runtimes default User-Agent to their own (e.g. "node"), so name faxios there.
 // Browsers send their own User-Agent; setting one makes every cross-origin request
 // need a CORS preflight that most APIs don't allow.
@@ -116,8 +139,40 @@ const maybeWithAuthCredentials = (url: string): boolean => {
   return urlToCheck.includes("@");
 };
 
+// RequestInit members faxios sets itself; the same keys in `fetchOptions` are ignored.
+const FAXIOS_INIT_KEYS: Record<string, true> = {
+  body: true,
+  credentials: true,
+  duplex: true,
+  headers: true,
+  method: true,
+  signal: true,
+};
+
+// Spec defaults written as own init members when the caller sets none. undici converts the init
+// into a plain dictionary and reads absent members from it, so an absent member still picks up a
+// polluted Object.prototype value; an own default leaves nothing to inherit.
+const REQUEST_INIT_DEFAULTS: Record<string, unknown> = {
+  cache: "default",
+  integrity: "",
+  keepalive: false,
+  mode: "cors",
+  redirect: "follow",
+  referrer: "about:client",
+  referrerPolicy: "",
+};
+
+// Where undici (Node's fetch) keeps its global dispatcher.
+const UNDICI_GLOBAL_DISPATCHER = Symbol.for("undici.globalDispatcher.1");
+
+type FetchEnv = {
+  fetch?: unknown;
+  Request?: unknown;
+  Response?: unknown;
+};
+
 // eslint-disable-next-line sonarjs/function-return-type
-const factory = (env: Record<string, unknown>) => {
+const factory = (env: FetchEnv) => {
   // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
   const globalObject: Record<string, unknown> = utils.global ?? globalThis;
   const ReadableStream = globalObject["ReadableStream"] as
@@ -127,26 +182,10 @@ const factory = (env: Record<string, unknown>) => {
     | (new () => AnyTextEncoder)
     | undefined;
 
-  env = utils.merge.call(
-    {
-      skipUndefined: true,
-    },
-    {
-      Request: globalObject["Request"],
-      Response: globalObject["Response"],
-    },
-    env
-  );
-
-  const {
-    fetch: envFetch,
-    Request,
-    Response,
-  } = env as {
-    fetch?: FetchFn;
-    Request?: AnyConstructor;
-    Response?: AnyConstructor;
-  };
+  // `undefined` falls back to the global constructor; `null` disables it.
+  const envFetch = env.fetch as FetchFn | undefined;
+  const Request = (env.Request === undefined ? globalObject["Request"] : env.Request) as AnyConstructor | undefined;
+  const Response = (env.Response === undefined ? globalObject["Response"] : env.Response) as AnyConstructor | undefined;
   const _globalFetch = (globalThis as unknown as Record<string, unknown>)[
     "fetch"
   ];
@@ -160,6 +199,31 @@ const factory = (env: Record<string, unknown>) => {
     return false;
   }
 
+  // Only members this runtime's Request exposes, so an engine that rejects members it doesn't
+  // implement (Cloudflare Workers) is never sent one.
+  const requestInitDefaults = Object.entries(REQUEST_INIT_DEFAULTS).filter(([ key ]) =>
+    isRequestSupported && utils.hasOwnInPrototypeChain((Request as AnyConstructor).prototype, key));
+
+  // Null prototype: WebIDL reads every RequestInit member with Get, which walks the prototype
+  // chain, so a plain object literal would let a polluted Object.prototype.redirect, .integrity,
+  // .mode or undici .dispatcher apply to every request. Every own enumerable key of fetchOptions
+  // is copied, so runtime extensions (Next.js `next`, Workers `cf`, Bun `tls`) still pass through;
+  // inherited keys never do. The caller sets signal, method, headers, body, duplex, credentials.
+  const initFromFetchOptions = (fetchOptions: unknown): Record<string, unknown> => {
+    const init: Record<string, unknown> = Object.create(null);
+    for (const [ key, value ] of requestInitDefaults) init[key] = value;
+    // Node's global fetch reads `dispatcher` the same way; pin it to undici's own global one.
+    if (!envFetch && utils.hasOwnProp(globalThis, UNDICI_GLOBAL_DISPATCHER)) {
+      init["dispatcher"] = (globalThis as Record<PropertyKey, unknown>)[UNDICI_GLOBAL_DISPATCHER];
+    }
+    if (utils.isObject(fetchOptions)) {
+      for (const key of Object.keys(fetchOptions)) {
+        if (!utils.hasOwnProp(FAXIOS_INIT_KEYS, key)) init[key] = (fetchOptions as Record<string, unknown>)[key];
+      }
+    }
+    return init;
+  };
+
   const isReadableStreamSupported = isFunction(ReadableStream);
 
   const encodeText: (str: string) => Promise<Uint8Array> | Uint8Array =
@@ -179,7 +243,7 @@ const factory = (env: Record<string, unknown>) => {
   // `fetch(request, init)`. undici (Node 26.11+) starts reading an async iterable in both,
   // so the first chunk goes to the discarded copy. One web stream is read only once.
   // Web stream bodies must yield bytes, so string chunks (e.g. `Readable.from(["a"])`) are encoded.
-  const from = (ReadableStream as { from?: (source: unknown) => unknown; } | undefined)?.from;
+  const from = (ReadableStream as undefined | { from?: (source: unknown) => unknown; })?.from;
   const streamFrom = typeof from === "function" ? from.bind(ReadableStream) : undefined;
   async function* toByteChunks(source: AsyncIterable<unknown>) {
     for await (const chunk of source) yield typeof chunk === "string" ? await encodeText(chunk) : chunk;
@@ -269,7 +333,7 @@ const factory = (env: Record<string, unknown>) => {
     }
 
     if (utils.isArrayBufferView(body) || utils.isArrayBuffer(body)) {
-      return (body as ArrayBufferView | ArrayBuffer).byteLength;
+      return (body as ArrayBuffer | ArrayBufferView).byteLength;
     }
 
     if (utils.isURLSearchParams(body)) {
@@ -291,7 +355,7 @@ const factory = (env: Record<string, unknown>) => {
     return length == null ? getBodyLength(body) : length;
   };
 
-  const normalizeCredentials = (wc: string | boolean): string => {
+  const normalizeCredentials = (wc: boolean | string): string => {
     if (utils.isString(wc)) return wc as string;
     return wc ? "include" : "omit";
   };
@@ -303,7 +367,7 @@ const factory = (env: Record<string, unknown>) => {
     headers: FaxiosRequestHeaders,
     own: (key: string) => unknown
   ): string => {
-    let auth: { username: unknown; password: unknown; } | undefined;
+    let auth: undefined | { password: unknown; username: unknown; };
     const configAuth = own("auth");
     if (configAuth) {
       auth = {
@@ -398,7 +462,7 @@ const factory = (env: Record<string, unknown>) => {
     onUploadProgress: unknown,
     _trackStream: (stream: unknown, onProgress?: (bytes: number) => void, flush?: () => void) => unknown
   ): unknown => {
-    let contentTypeHeader: string | null;
+    let contentTypeHeader: null | string;
     if (
       utils.isFormData(data) &&
       (contentTypeHeader = _request.headers.get("content-type"))
@@ -587,7 +651,7 @@ const factory = (env: Record<string, unknown>) => {
   return async (config: InternalFaxiosRequestConfig) => {
     const _resolved = prepareRequest(config) as InternalFaxiosRequestConfig & {
       fetchOptions?: Record<string, unknown>;
-      withCredentials?: string | boolean;
+      withCredentials?: boolean | string;
     };
     let {
       url,
@@ -604,7 +668,7 @@ const factory = (env: Record<string, unknown>) => {
       maxBodyLength,
     } = _resolved;
     let headers = _resolved.headers;
-    let withCredentials: string | boolean =
+    let withCredentials: boolean | string =
       _resolved.withCredentials ?? "same-origin";
 
     const hasMaxContentLength =
@@ -638,10 +702,12 @@ const factory = (env: Record<string, unknown>) => {
 
     const unsubscribe = composedSignal?.unsubscribe?.bind(composedSignal);
 
-    let request: Request | null = null;
+    let request: null | Request = null;
     const pendingBodyErrorRef: PendingBodyErrorRef = { value: null };
 
     try {
+      rejectUsedStreamBody(data, config);
+
       url = applyAuthToRequest(url!, headers, own);
 
       const preflightContentLength = await checkPreflightLimits(
@@ -696,25 +762,20 @@ const factory = (env: Record<string, unknown>) => {
       // Case-insensitive check: toByteStringHeaderObject may normalize to lowercase.
       data = toWebStream(await encodeBodyIfNeeded(data, serializedHeaders, encodeText));
 
-      const resolvedOptions = {
-        ...fetchOptions,
-        signal: composedSignal,
-        method: (method as string).toUpperCase(),
-        headers: serializedHeaders,
-        body: data,
-        duplex: "half",
-        credentials: isCredentialsSupported ? withCredentials : undefined,
-      };
+      const resolvedOptions = initFromFetchOptions(fetchOptions);
+      resolvedOptions["signal"] = composedSignal;
+      resolvedOptions["method"] = (method as string).toUpperCase();
+      resolvedOptions["headers"] = serializedHeaders;
+      resolvedOptions["body"] = data;
+      resolvedOptions["duplex"] = "half";
+      resolvedOptions["credentials"] = isCredentialsSupported ? withCredentials : undefined;
 
       request = isRequestSupported
         ? new (Request as AnyConstructor)(url, resolvedOptions) as Request
         : null;
 
-      // Pass resolvedOptions (all own-properties) as the fetch init even when a
-      // Request object is supplied: undici re-reads RequestInit fields (method,
-      // headers, body, credentials) off Object.prototype when init is absent,
-      // so a polluted Object.prototype.method would override the Request's verb.
-      // An explicit own-property init neutralizes every such gadget.
+      // Pass resolvedOptions as the fetch init even when a Request object is supplied, so the
+      // same null-prototype members apply to both calls.
       let response = await (isRequestSupported
         ? _fetch(request, resolvedOptions)
         : _fetch(url, resolvedOptions));
@@ -778,12 +839,12 @@ const factory = (env: Record<string, unknown>) => {
 const seedCache = new Map<unknown, unknown>();
 
 export const getFetch = (config?: { env?: Record<string, unknown>; }) => {
-  const env: Record<string, unknown> = (config && config.env) || {};
-  const { fetch, Request, Response } = env as {
-    fetch?: unknown;
-    Request?: unknown;
-    Response?: unknown;
-  };
+  // Own reads only: a polluted Object.prototype.fetch must never become the transport.
+  const env = config && utils.hasOwnProp(config, "env") ? config.env : undefined;
+  const own = (key: keyof FetchEnv): unknown => (env && utils.hasOwnProp(env, key) ? env[key] : undefined);
+  const fetch = own("fetch");
+  const Request = own("Request");
+  const Response = own("Response");
   const seeds: Array<unknown> = [ Request, Response, fetch ];
 
   const len = seeds.length;
@@ -797,7 +858,7 @@ export const getFetch = (config?: { env?: Record<string, unknown>; }) => {
     target = map.get(seed);
 
     if (target === undefined) {
-      target = i ? new Map<unknown, unknown>() : factory(env);
+      target = i ? new Map<unknown, unknown>() : factory({ fetch, Request, Response });
       map.set(seed, target);
     }
 

package/src/lib/cancel/CanceledError.ts

@@ -13,7 +13,7 @@ class CanceledError extends FaxiosError {
    *
    * @returns {CanceledError} The created error.
    */
-  constructor(message?: string | null, config?: FaxiosRequestConfig, request?: unknown) {
+  constructor(message?: null | string, config?: FaxiosRequestConfig, request?: unknown) {
     super(message == null ? "canceled" : message, FaxiosError.ERR_CANCELED, config as InternalFaxiosRequestConfig, request);
     this.name = "CanceledError";
     (this as unknown as Record<string, unknown>)["__CANCEL__"] = true;

package/src/lib/core/Faxios.ts

@@ -2,10 +2,9 @@
 
 import CanceledError from "../cancel/CanceledError.js";
 import buildURL from "../helpers/buildURL.js";
-import cloneConfig, { DANGEROUS_KEYS } from "../helpers/cloneConfig.js";
+import cloneConfig from "../helpers/cloneConfig.js";
 import validator from "../helpers/validator.js";
 import type { ValidatorFn } from "../helpers/validator.js";
-import type { StandardSchemaV1 } from "../types/standard-schema.js";
 import type {
   FaxiosContext,
   FaxiosMiddleware,
@@ -21,6 +20,7 @@ import type {
   SchemaConfig,
   StringLiteralsOrString
 } from "../types.js";
+import type { StandardSchemaV1 } from "../types/standard-schema.js";
 import utils from "../utils.js";
 import buildFullPath from "./buildFullPath.js";
 import { createDefinedEndpoint } from "./define.js";
@@ -29,21 +29,21 @@ import dispatchRequest from "./dispatchRequest.js";
 import FaxiosError from "./FaxiosError.js";
 import FaxiosHeaders from "./FaxiosHeaders.js";
 import mergeConfig from "./mergeConfig.js";
-import type { RouteConfig, RouteBuilder } from "./route.js";
+import type { RouteBuilder, RouteConfig } from "./route.js";
 import { createRouteBuilder } from "./route.js";
 
 type TransitionalFn = (
-  validator: ValidatorFn | false | undefined,
+  validator: false | undefined | ValidatorFn,
   version?: string,
   message?: string
 ) => ValidatorFn;
 type SpellingFn = (correctSpelling: string) => ValidatorFn;
 const validators = validator.validators as Record<
   string,
-  ValidatorFn | undefined
+  undefined | ValidatorFn
 > & {
-  transitional?: TransitionalFn;
   spelling?: SpellingFn;
+  transitional?: TransitionalFn;
 };
 
 // Every method header group declared on HeadersDefaults. `satisfies` keeps this
@@ -133,7 +133,10 @@ function resolveAllowAbsoluteUrls(
   defaults: FaxiosRequestConfig
 ): void {
   if (config.allowAbsoluteUrls === undefined) {
-    config.allowAbsoluteUrls = defaults.allowAbsoluteUrls ?? !defaults.baseURL;
+    // Own reads only: instance defaults may be a plain object (the default instance's are).
+    const allowAbsoluteUrls = utils.hasOwnProp(defaults, "allowAbsoluteUrls") ? defaults.allowAbsoluteUrls : undefined;
+    const baseURL = utils.hasOwnProp(defaults, "baseURL") ? defaults.baseURL : undefined;
+    config.allowAbsoluteUrls = allowAbsoluteUrls ?? !baseURL;
   }
 }
 
@@ -143,10 +146,10 @@ type AnyContextMiddleware = FaxiosMiddleware<unknown, unknown>;
 type AnyContextNext = FaxiosNext<unknown, unknown>;
 
 type MiddlewareEntry = {
+  provided: Array<string>;
   // The value passed to use(), kept only for eject()'s identity check.
   ref: unknown;
   run: AnyContextMiddleware;
-  provided: Array<string>;
 };
 
 function composeMiddleware(entries: ReadonlyArray<MiddlewareEntry>, dispatch: AnyContextNext): AnyContextNext {
@@ -272,7 +275,7 @@ class Faxios {
 
   #addCapabilities(pluginName: string, provides: unknown): Array<string> {
     const source = provides as Record<string, unknown>;
-    const keys = Object.keys(source).filter(key => !DANGEROUS_KEYS.has(key));
+    const keys = Object.keys(source).filter(key => !utils.isDangerousKey(key));
     for (const key of keys) {
       if (utils.hasOwnProp(this.#capabilities, key)) {
         throw new FaxiosError(`Plugin "${pluginName}" provides capability "${key}", which another plugin already provides`, FaxiosError.ERR_BAD_OPTION);
@@ -295,9 +298,9 @@ class Faxios {
    */
 
   async request<O, D = unknown>(config: SchemaConfig<O, D>): Promise<FaxiosResponse<O, D>>;
-  async request<T = unknown, R = FaxiosResponse<T>, D = unknown>(configOrUrl: string | FaxiosRequestConfig<D>, config?: FaxiosRequestConfig<D>): Promise<R>;
+  async request<T = unknown, R = FaxiosResponse<T>, D = unknown>(configOrUrl: FaxiosRequestConfig<D> | string, config?: FaxiosRequestConfig<D>): Promise<R>;
   async request(
-    configOrUrl: string | FaxiosRequestConfig,
+    configOrUrl: FaxiosRequestConfig | string,
     config?: FaxiosRequestConfig
   ) {
     try {
@@ -313,7 +316,7 @@ class Faxios {
   }
 
   async #request(
-    configOrUrl: string | FaxiosRequestConfig,
+    configOrUrl: FaxiosRequestConfig | string,
     config?: FaxiosRequestConfig
   ): Promise<unknown> {
     /*eslint no-param-reassign:0*/
@@ -361,8 +364,9 @@ class Faxios {
     );
 
     // Set config.method
+    const defaultMethod = utils.hasOwnProp(this.defaults, "method") ? this.defaults.method : undefined;
     config.method = (
-      (config.method || this.defaults.method || "get") as string
+      (config.method || defaultMethod || "get") as string
     ).toLowerCase();
 
     // Flatten headers

package/src/lib/core/FaxiosError.ts

@@ -1,8 +1,8 @@
 // @ts-self-types="./FaxiosError.d.ts" — required for Deno: index.d.ts re-exports SchemaValidationError from here
 "use strict";
 
+import type { FaxiosResponse, InternalFaxiosRequestConfig } from "../types.js";
 import type { StandardSchemaV1 } from "../types/standard-schema.js";
-import type { InternalFaxiosRequestConfig, FaxiosResponse } from "../types.js";
 import utils from "../utils.js";
 import FaxiosHeaders from "./FaxiosHeaders.js";
 
@@ -247,9 +247,9 @@ export type SchemaValidationError =
   }
   | FaxiosError & {
     code:
-      | typeof FaxiosError.ERR_BAD_REQUEST_SCHEMA
       | typeof FaxiosError.ERR_BAD_PARAMS_SCHEMA
-      | typeof FaxiosError.ERR_BAD_PATH_PARAMS_SCHEMA;
+      | typeof FaxiosError.ERR_BAD_PATH_PARAMS_SCHEMA
+      | typeof FaxiosError.ERR_BAD_REQUEST_SCHEMA;
     issues: SchemaIssues;
   };