@gcmdev/faxios 0.2.1 → 0.2.2

package/src/lib/core/FaxiosHeaders.ts

@@ -9,16 +9,16 @@ import utils from "../utils.js";
 const $internals = Symbol("internals");
 
 type HeaderMatcher =
-  | string
+  | ((this: FaxiosHeaders, value: string, name: string) => boolean)
   | RegExp
-  | ((this: FaxiosHeaders, value: string, name: string) => boolean);
+  | string;
 
 type HeaderInput =
-  | Record<string, unknown>
   | FaxiosHeaders
+  | null
+  | Record<string, unknown>
   | string
-  | undefined
-  | null;
+  | undefined;
 
 /** Matches a `FaxiosHeaders` instance by its type-only brand. */
 export type FaxiosHeadersInstance = Pick<FaxiosHeaders, typeof faxiosHeadersBrand>;
@@ -31,7 +31,7 @@ function normalizeHeader(header: string): string {
 // eslint-disable-next-line sonarjs/function-return-type
 function normalizeValue(
   value: FaxiosHeaderValue | undefined
-): string | Array<string> | false | null | undefined {
+): Array<string> | false | null | string | undefined {
   if (value == null) {
     return value;
   }
@@ -64,9 +64,9 @@ function matchHeaderValue(
   value: unknown,
   header: string,
   filter:
-    | string
-    | RegExp
     | ((this: FaxiosHeaders, value: string, name: string) => boolean)
+    | RegExp
+    | string
     | undefined,
   isHeaderNameFilter?: boolean
 ): boolean | undefined {
@@ -176,7 +176,7 @@ class FaxiosHeaders {
   declare hasAuthorization: (matcher?: HeaderMatcher) => boolean;
 
   constructor(
-    headers?: Record<string, unknown> | FaxiosHeaders | string | null
+    headers?: FaxiosHeaders | null | Record<string, unknown> | string
   ) {
     headers && this.set(headers);
   }
@@ -244,17 +244,17 @@ class FaxiosHeaders {
 
   get(header: string): FaxiosHeaderValue | undefined;
   get(header: string, parser: true): Record<string, string> | undefined;
-  get(header: string, parser: RegExp): RegExpExecArray | null | undefined;
+  get(header: string, parser: RegExp): null | RegExpExecArray | undefined;
   get<R>(header: string, parser: (this: FaxiosHeaders, value: FaxiosHeaderValue, header: string) => R): R | undefined;
   get(
     header: string,
     parser?:
-      | RegExp
       | ((
         this: FaxiosHeaders,
         value: FaxiosHeaderValue,
         header: string
       ) => unknown)
+      | RegExp
       | true
   ): unknown {
     header = normalizeHeader(header);
@@ -317,7 +317,7 @@ class FaxiosHeaders {
     return false;
   }
 
-  delete(header: string | Array<string>, matcher?: HeaderMatcher): boolean {
+  delete(header: Array<string> | string, matcher?: HeaderMatcher): boolean {
     const self = this;
     let deleted = false;
 
@@ -450,15 +450,15 @@ class FaxiosHeaders {
   }
 
   static from(
-    thing?: Record<string, unknown> | FaxiosHeaders | string | null
+    thing?: FaxiosHeaders | null | Record<string, unknown> | string
   ): FaxiosHeaders {
     return thing instanceof this ? thing : new this(thing);
   }
 
   static concat(
-    first: Record<string, unknown> | FaxiosHeaders | string | undefined | null,
+    first: FaxiosHeaders | null | Record<string, unknown> | string | undefined,
     ...targets: Array<
-      Record<string, unknown> | FaxiosHeaders | string | undefined | null
+      FaxiosHeaders | null | Record<string, unknown> | string | undefined
     >
   ): FaxiosHeaders {
     const computed = new this(first);
@@ -468,7 +468,7 @@ class FaxiosHeaders {
     return computed;
   }
 
-  static accessor(header: string | Array<string>): typeof FaxiosHeaders {
+  static accessor(header: Array<string> | string): typeof FaxiosHeaders {
     const self = this as unknown as Record<
       symbol,
       { accessors: Record<string, boolean>; }

package/src/lib/core/define.ts

@@ -1,19 +1,19 @@
 // @ts-self-types="./define.d.ts" — required for Deno: maps built .js to adjacent .d.ts in dist/
 
+import type { FaxiosRequestConfig, FaxiosResponse, Method, StringLiteralsOrString } from "../types.js";
 import type { StandardSchemaV1 } from "../types/standard-schema.js";
-import type { FaxiosRequestConfig, FaxiosResponse, StringLiteralsOrString, Method } from "../types.js";
 import mergeConfig from "./mergeConfig.js";
 
 type StrippedFields =
-  | "url"
+  | "data"
   | "method"
-  | "pathParams"
   | "params"
-  | "data"
-  | "pathParamsSchema"
   | "paramsSchema"
+  | "pathParams"
+  | "pathParamsSchema"
   | "requestSchema"
-  | "responseSchema";
+  | "responseSchema"
+  | "url";
 
 /** Request config accepted by a defined endpoint call: everything except `url`, `method`, `pathParams`, `params`, `data` and the schemas. */
 export type BasePerCallConfig = Omit<FaxiosRequestConfig, StrippedFields>;
@@ -47,12 +47,12 @@ export type DefineConfig<
   D extends StandardSchemaV1 | undefined = undefined,
   R extends StandardSchemaV1 | undefined = undefined
 > = BasePerCallConfig & {
+  paramsSchema?: P;
   /**
    * Standard Schema that validates `pathParams` on every call; its output fills the `{key}`
    * placeholders. Makes `pathParams` required per call. A failure rejects with `ERR_BAD_PATH_PARAMS_SCHEMA`.
    */
   pathParamsSchema?: PP;
-  paramsSchema?: P;
   requestSchema?: D;
   responseSchema?: R;
 };

package/src/lib/core/dispatchRequest.ts

@@ -7,7 +7,7 @@ import FaxiosError from "../core/FaxiosError.js";
 import FaxiosHeaders from "../core/FaxiosHeaders.js";
 import { validateSchema } from "../core/validateSchema.js";
 import { substitutePathParams } from "../helpers/substitutePathParams.js";
-import type { InternalFaxiosRequestConfig, FaxiosResponse } from "../types.js";
+import type { FaxiosResponse, InternalFaxiosRequestConfig } from "../types.js";
 import utils from "../utils.js";
 import transformData from "./transformData.js";
 
@@ -151,7 +151,7 @@ export default async function dispatchRequest(this: unknown, config: InternalFax
         if (!isCancel(reason)) {
           throwIfCancellationRequested(config);
 
-          const r = reason as { response?: { data?: unknown; headers?: unknown; status?: number; [k: string]: unknown; }; } | null;
+          const r = reason as null | { response?: { [k: string]: unknown; data?: unknown; headers?: unknown; status?: number; }; };
           if (r?.response) {
             (config as unknown as Record<string, unknown>)["response"] = r.response;
             try {

package/src/lib/core/mergeConfig.ts

@@ -1,6 +1,6 @@
 "use strict";
 
-import type { FaxiosRequestConfig, FaxiosDefaults } from "../types.js";
+import type { FaxiosDefaults, FaxiosRequestConfig } from "../types.js";
 import utils from "../utils.js";
 import FaxiosHeaders from "./FaxiosHeaders.js";
 
@@ -15,7 +15,7 @@ const headersToObject = (thing: unknown) => (thing instanceof FaxiosHeaders ? {
  *
  * @returns {Object} New object resulting from merging config2 to config1
  */
-export default function mergeConfig(config1: FaxiosRequestConfig | FaxiosDefaults | Record<string, unknown>, config2?: FaxiosRequestConfig | FaxiosDefaults | Record<string, unknown>): FaxiosRequestConfig & Record<string, unknown> {
+export default function mergeConfig(config1: FaxiosDefaults | FaxiosRequestConfig | Record<string, unknown>, config2?: FaxiosDefaults | FaxiosRequestConfig | Record<string, unknown>): FaxiosRequestConfig & Record<string, unknown> {
    
   config2 = config2 || {};
 
@@ -79,6 +79,40 @@ export default function mergeConfig(config1: FaxiosRequestConfig | FaxiosDefault
     return undefined;
   }
 
+  // Shallow own-key copy into a null-prototype object, later sources winning. Every own key is
+  // kept, including `constructor`, `prototype` and `__proto__`: `params` are caller data that
+  // reach the query string, and defineProperty stores them as plain data slots.
+  function ownCopy(...sources: Array<unknown>): Record<string, unknown> {
+    const out: Record<string, unknown> = Object.create(null);
+    for (const source of sources) {
+      if (!utils.isPlainObject(source)) continue;
+      const record = source as Record<string, unknown>;
+      for (const key of Object.keys(record)) {
+        Object.defineProperty(out, key, Object.assign(Object.create(null) as PropertyDescriptor, {
+          value: record[key],
+          enumerable: true,
+          writable: true,
+          configurable: true,
+        }));
+      }
+    }
+    return out;
+  }
+
+  // `params`: a plain object is copied with every own key; anything else (URLSearchParams,
+  // a custom serializer's input) passes through as given.
+  function mergeParams(a: unknown, b: unknown): unknown {
+    const source = utils.isUndefined(b) ? a : b;
+    if (!utils.isPlainObject(source)) return source;
+    return utils.isUndefined(b) ? ownCopy(a) : ownCopy(a, b);
+  }
+
+  // `env`: shallow, null-prototype, so `fetch`, `Request` and `Response` can only be own values.
+  function mergeEnv(a: unknown, b: unknown): unknown {
+    if (utils.isUndefined(a) && utils.isUndefined(b)) return undefined;
+    return ownCopy(a, b);
+  }
+
   function getMergedTransitionalOption(prop: string): unknown {
     const c2 = config2 as Record<string, unknown>;
     const c1 = config1 as Record<string, unknown>;
@@ -117,7 +151,11 @@ export default function mergeConfig(config1: FaxiosRequestConfig | FaxiosDefault
   const mergeMap = {
     url: valueFromConfig2,
     method: valueFromConfig2,
-    data: valueFromConfig2,
+    // The body is passed by reference: faxios never mutates it, and copying would drop keys such
+    // as `constructor` and cost a deep clone per request.
+    data: (_a: unknown, b: unknown) => b,
+    params: mergeParams,
+    env: mergeEnv,
     baseURL: defaultToConfig2,
     transformRequest: defaultToConfig2,
     transformResponse: defaultToConfig2,
@@ -150,7 +188,7 @@ export default function mergeConfig(config1: FaxiosRequestConfig | FaxiosDefault
 
   utils.forEach(Object.keys({ ...config1, ...config2 }), function computeConfigValue(_value: unknown, _prop: unknown) {
     const key = _value as string;
-    if (key === "__proto__" || key === "constructor" || key === "prototype") return;
+    if (utils.isDangerousKey(key)) return;
     const mergeFn = (utils.hasOwnProp(mergeMap, key) ? (mergeMap as Record<string, typeof mergeDeepProperties>)[key] : mergeDeepProperties)!;
     const a = utils.hasOwnProp(config1, key) ? c1[key] : undefined;
     const b = utils.hasOwnProp(config2, key) ? c2[key] : undefined;

package/src/lib/core/prepareRequest.ts

@@ -96,7 +96,7 @@ function prepareRequest(config: FaxiosRequestConfig): FaxiosRequestConfig {
   const url = own("url");
 
   const headers: FaxiosHeaders = FaxiosHeaders.from(
-    own("headers") as Record<string, unknown> | null | undefined
+    own("headers") as null | Record<string, unknown> | undefined
   );
   newConfig.headers = headers;
 

package/src/lib/core/route.ts

@@ -1,5 +1,6 @@
 // @ts-self-types="./route.d.ts" — required for Deno: maps built .js to adjacent .d.ts in dist/
 
+import cloneConfig from "../helpers/cloneConfig.js";
 import type { StandardSchemaV1 } from "../types/standard-schema.js";
 import type { BasePerCallConfig, DefineConfig, DefinedEndpoint, FaxiosLike } from "./define.js";
 import { createDefinedEndpoint } from "./define.js";
@@ -28,7 +29,7 @@ export type RouteMethodConfig<
 
 /** The object `route()` returns: one endpoint factory per HTTP method (no `query`). */
 export type RouteBuilder<PP extends StandardSchemaV1<unknown, Record<string, unknown>> | undefined, TOpts = unknown> = {
-  [M in "get" | "post" | "put" | "patch" | "delete" | "head" | "options"]: <
+  [M in "delete" | "get" | "head" | "options" | "patch" | "post" | "put"]: <
     P extends StandardSchemaV1 | undefined = undefined,
     D extends StandardSchemaV1 | undefined = undefined,
     R extends StandardSchemaV1 | undefined = undefined
@@ -43,11 +44,7 @@ export function createRouteBuilder<PP extends StandardSchemaV1<unknown, Record<s
   url: string,
   routeConfig?: RouteConfig<PP>
 ): RouteBuilder<PP> {
-  const raw = Object.assign(Object.create(null), routeConfig ?? {});
-  delete raw.__proto__;
-  delete raw.constructor;
-  delete raw.prototype;
-  const { pathParamsSchema, ...routeDefaults } = raw;
+  const { pathParamsSchema, ...routeDefaults } = cloneConfig(routeConfig ?? {});
 
   const builder = {} as RouteBuilder<PP>;
   for (const method of methods) {

package/src/lib/core/transformData.ts

@@ -2,12 +2,12 @@
 
 import FaxiosHeaders from "../core/FaxiosHeaders.js";
 import defaults from "../defaults/index.js";
-import type { InternalFaxiosRequestConfig, FaxiosRequestHeaders, FaxiosRequestTransformer, FaxiosResponseTransformer } from "../types.js";
+import type { FaxiosRequestHeaders, FaxiosRequestTransformer, FaxiosResponseTransformer, InternalFaxiosRequestConfig } from "../types.js";
 import utils from "../utils.js";
 
 type TransformFn = FaxiosRequestTransformer | FaxiosResponseTransformer;
 
-export default function transformData(this: unknown, fns: TransformFn | Array<TransformFn> | undefined, response?: { data?: unknown; headers?: unknown; status?: number; } | null): unknown {
+export default function transformData(this: unknown, fns: Array<TransformFn> | TransformFn | undefined, response?: null | { data?: unknown; headers?: unknown; status?: number; }): unknown {
   const config = (this || defaults) as InternalFaxiosRequestConfig;
   const context = response || config;
   const headers = FaxiosHeaders.from(context.headers as Record<string, unknown> | undefined);

package/src/lib/core/validateSchema.ts

@@ -1,13 +1,13 @@
 import isCancel from "../cancel/isCancel.js";
+import type { FaxiosResponse, InternalFaxiosRequestConfig } from "../types.js";
 import type { StandardSchemaV1 } from "../types/standard-schema.js";
-import type { InternalFaxiosRequestConfig, FaxiosResponse } from "../types.js";
 import FaxiosError from "./FaxiosError.js";
 
 type SchemaErrorCode =
-  | typeof FaxiosError.ERR_BAD_RESPONSE_SCHEMA
-  | typeof FaxiosError.ERR_BAD_REQUEST_SCHEMA
   | typeof FaxiosError.ERR_BAD_PARAMS_SCHEMA
-  | typeof FaxiosError.ERR_BAD_PATH_PARAMS_SCHEMA;
+  | typeof FaxiosError.ERR_BAD_PATH_PARAMS_SCHEMA
+  | typeof FaxiosError.ERR_BAD_REQUEST_SCHEMA
+  | typeof FaxiosError.ERR_BAD_RESPONSE_SCHEMA;
 
 export async function validateSchema<S extends StandardSchemaV1>(
   schema: S,

package/src/lib/defaults/index.ts

@@ -96,7 +96,7 @@ const defaults: FaxiosDefaults = {
       headers: FaxiosRequestHeaders
     ) {
       const contentType =
-        (headers.getContentType() as string | null | undefined) || "";
+        (headers.getContentType() as null | string | undefined) || "";
       const hasJSONContentType = contentType.indexOf("application/json") > -1;
       const isObjectPayload = utils.isObject(data);
 

package/src/lib/env/data.ts

@@ -1 +1 @@
-export const VERSION = "0.2.1";
+export const VERSION = "0.2.2";

package/src/lib/faxios.ts

@@ -15,8 +15,8 @@ import formDataToJSON from "./helpers/formDataToJSON.js";
 import HttpStatusCode from "./helpers/HttpStatusCode.js";
 import isFaxiosError from "./helpers/isFaxiosError.js";
 import toFormData from "./helpers/toFormData.js";
+import type { CreateFaxiosDefaults, FaxiosDefaults, FaxiosHeaderValue, FaxiosMiddleware, FaxiosPluginArgument, FaxiosRequestConfig, FaxiosResponse, HeadersDefaults, Method, SchemaConfig, StringLiteralsOrString } from "./types.js";
 import type { StandardSchemaV1 } from "./types/standard-schema.js";
-import type { Method, StringLiteralsOrString, CreateFaxiosDefaults, FaxiosDefaults, FaxiosHeaderValue, FaxiosMiddleware, FaxiosPluginArgument, FaxiosRequestConfig, HeadersDefaults, FaxiosResponse, SchemaConfig } from "./types.js";
 import utils from "./utils.js";
 
 /**
@@ -91,11 +91,11 @@ type ProvidedCapabilities<TProv> = [TProv] extends [null | undefined] ? {} : TPr
 // use() reads capability names with Object.keys() and skips the keys that could pollute a prototype,
 // so the registry only holds string names. A symbol, number or dangerous key would be typed on
 // ctx.capabilities without matching a registered name, and nothing could satisfy a requirement for one.
-type UnsupportedCapabilityKeys<TCaps> = Extract<keyof TCaps, symbol | number | "__proto__" | "constructor" | "prototype">;
+type UnsupportedCapabilityKeys<TCaps> = Extract<keyof TCaps, "__proto__" | "constructor" | "prototype" | number | symbol>;
 
-type RejectUnsupportedCapabilityKeys<TReq, TProv> = [UnsupportedCapabilityKeys<TReq> | UnsupportedCapabilityKeys<TProv>] extends [never]
+type RejectUnsupportedCapabilityKeys<TReq, TProv> = [UnsupportedCapabilityKeys<TProv> | UnsupportedCapabilityKeys<TReq>] extends [never]
   ? unknown
-  : { "faxios: capability names must be strings other than __proto__, constructor and prototype": UnsupportedCapabilityKeys<TReq> | UnsupportedCapabilityKeys<TProv>; };
+  : { "faxios: capability names must be strings other than __proto__, constructor and prototype": UnsupportedCapabilityKeys<TProv> | UnsupportedCapabilityKeys<TReq>; };
 
 // Nothing sets a plugin option for the caller, so a required one would be typed as present in the
 // plugin's middleware while every request that omits it leaves it undefined.
@@ -130,23 +130,6 @@ type CheckPlugin<THave, TReq, TProv, TOpt> = RequireCapabilities<THave, TReq>
 // without narrowing first.
 // eslint-disable-next-line @typescript-eslint/no-empty-object-type -- see above
 export type FaxiosInstance<TOpts = {}, TCaps = {}> = {
-  /**
-   * Register middleware or a plugin and return this instance, typed with the plugin's request
-   * options and capabilities added. A plugin whose required capabilities aren't installed yet, or
-   * that provides a capability another installed plugin already provides, is a type error.
-   */
-  use: <TReq = unknown, TProv = unknown, TOpt = unknown>(
-    middleware: FaxiosMiddleware<TOpts, TCaps> | (FaxiosPluginArgument<TReq, TProv, TOpt> & CheckPlugin<TCaps, TReq, TProv, TOpt>)
-  ) => FaxiosInstance<TOpts & TOpt, TCaps & ProvidedCapabilities<TProv>>;
-  /**
-   * Remove middleware or a plugin registered with use(), by reference. In-flight requests are
-   * unaffected. The instance type is not narrowed: request options and capabilities the ejected
-   * plugin added stay in its type.
-   */
-  // A method, so its parameter is checked bivariantly: middleware typed for this instance's
-  // options and capabilities is accepted.
-  // eslint-disable-next-line @typescript-eslint/method-signature-style -- see above
-  eject<TReq = unknown, TProv = unknown, TOpt = unknown>(middleware: FaxiosMiddleware<TOpt> | FaxiosPluginArgument<TReq, TProv, TOpt>): void;
   /**
    * Define a typed endpoint for `method` and `url` (with optional `{key}` placeholders). `config`
    * holds request defaults and the `pathParamsSchema`, `paramsSchema`, `requestSchema` and
@@ -165,6 +148,15 @@ export type FaxiosInstance<TOpts = {}, TCaps = {}> = {
     url: string,
     config?: DefineConfig<PP, P, D, R> & TOpts
   ) => DefinedEndpoint<PP, P, D, R, TOpts>;
+  /**
+   * Remove middleware or a plugin registered with use(), by reference. In-flight requests are
+   * unaffected. The instance type is not narrowed: request options and capabilities the ejected
+   * plugin added stay in its type.
+   */
+  // A method, so its parameter is checked bivariantly: middleware typed for this instance's
+  // options and capabilities is accepted.
+  // eslint-disable-next-line @typescript-eslint/method-signature-style -- see above
+  eject<TReq = unknown, TProv = unknown, TOpt = unknown>(middleware: FaxiosMiddleware<TOpt> | FaxiosPluginArgument<TReq, TProv, TOpt>): void;
   /**
    * Group endpoints that share `url` and `config`. Returns one endpoint factory per method (`get`,
    * `post`, `put`, `patch`, `delete`, `head`, `options`; no `query`), each taking `paramsSchema`,
@@ -176,22 +168,38 @@ export type FaxiosInstance<TOpts = {}, TCaps = {}> = {
     url: string,
     config?: RouteConfig<PP> & TOpts
   ) => RouteBuilder<PP, TOpts>;
+  /**
+   * Register middleware or a plugin and return this instance, typed with the plugin's request
+   * options and capabilities added. A plugin whose required capabilities aren't installed yet, or
+   * that provides a capability another installed plugin already provides, is a type error.
+   */
+  use: <TReq = unknown, TProv = unknown, TOpt = unknown>(
+    middleware: FaxiosMiddleware<TOpts, TCaps> | (FaxiosPluginArgument<TReq, TProv, TOpt> & CheckPlugin<TCaps, TReq, TProv, TOpt>)
+  ) => FaxiosInstance<TOpts & TOpt, TCaps & ProvidedCapabilities<TProv>>;
   <O, D = unknown>(config: SchemaConfig<O, D> & TOpts): Promise<FaxiosResponse<O, D>>;
   <O, D = unknown>(url: string, config: SchemaConfig<O, D> & TOpts): Promise<FaxiosResponse<O, D>>;
   <T = unknown, R = FaxiosResponse<T>, D = unknown>(config: FaxiosRequestConfig<D> & TOpts): Promise<R>;
   <T = unknown, R = FaxiosResponse<T>, D = unknown>(url: string, config?: FaxiosRequestConfig<D> & TOpts): Promise<R>;
-  request: {
-    <O, D = unknown>(config: SchemaConfig<O, D> & TOpts): Promise<FaxiosResponse<O, D>>;
-    <T = unknown, R = FaxiosResponse<T>, D = unknown>(config: FaxiosRequestConfig<D> & TOpts): Promise<R>;
-  };
-  get: {
+  create: (instanceConfig?: CreateFaxiosDefaults) => FaxiosInstance;
+  // `common` plus one header group per method; a key set directly on
+  // `headers` applies to every method.
+  defaults: Omit<FaxiosDefaults, "headers"> & {
+    headers: HeadersDefaults & { [key: string]: FaxiosHeaderValue | undefined; };
+  } & Partial<TOpts>;
+  delete: {
     <O, D = unknown>(url: string, config: SchemaConfig<O, D> & TOpts): Promise<FaxiosResponse<O, D>>;
     <T = unknown, R = FaxiosResponse<T>, D = unknown>(url: string, config?: FaxiosRequestConfig<D> & TOpts): Promise<R>;
   };
-  delete: {
+  get: {
     <O, D = unknown>(url: string, config: SchemaConfig<O, D> & TOpts): Promise<FaxiosResponse<O, D>>;
     <T = unknown, R = FaxiosResponse<T>, D = unknown>(url: string, config?: FaxiosRequestConfig<D> & TOpts): Promise<R>;
   };
+  /**
+   * Build the URL for `config` without sending a request. Applies `baseURL`, `params` and
+   * `paramsSerializer`, but does not substitute `pathParams` or run schemas, so `{key}`
+   * placeholders come back as written.
+   */
+  getUri: (config?: FaxiosRequestConfig & TOpts) => string;
   head: {
     <O, D = unknown>(url: string, config: SchemaConfig<O, D> & TOpts): Promise<FaxiosResponse<O, D>>;
     <T = unknown, R = FaxiosResponse<T>, D = unknown>(url: string, config?: FaxiosRequestConfig<D> & TOpts): Promise<R>;
@@ -200,23 +208,23 @@ export type FaxiosInstance<TOpts = {}, TCaps = {}> = {
     <O, D = unknown>(url: string, config: SchemaConfig<O, D> & TOpts): Promise<FaxiosResponse<O, D>>;
     <T = unknown, R = FaxiosResponse<T>, D = unknown>(url: string, config?: FaxiosRequestConfig<D> & TOpts): Promise<R>;
   };
-  post: {
+  patch: {
     <O, D = unknown>(url: string, data: D | undefined, config: SchemaConfig<O, D> & TOpts): Promise<FaxiosResponse<O, D>>;
     <T = unknown, R = FaxiosResponse<T>, D = unknown>(url: string, data?: D, config?: FaxiosRequestConfig<D> & TOpts): Promise<R>;
   };
-  put: {
+  patchForm: {
     <O, D = unknown>(url: string, data: D | undefined, config: SchemaConfig<O, D> & TOpts): Promise<FaxiosResponse<O, D>>;
     <T = unknown, R = FaxiosResponse<T>, D = unknown>(url: string, data?: D, config?: FaxiosRequestConfig<D> & TOpts): Promise<R>;
   };
-  patch: {
+  post: {
     <O, D = unknown>(url: string, data: D | undefined, config: SchemaConfig<O, D> & TOpts): Promise<FaxiosResponse<O, D>>;
     <T = unknown, R = FaxiosResponse<T>, D = unknown>(url: string, data?: D, config?: FaxiosRequestConfig<D> & TOpts): Promise<R>;
   };
-  query: {
+  postForm: {
     <O, D = unknown>(url: string, data: D | undefined, config: SchemaConfig<O, D> & TOpts): Promise<FaxiosResponse<O, D>>;
     <T = unknown, R = FaxiosResponse<T>, D = unknown>(url: string, data?: D, config?: FaxiosRequestConfig<D> & TOpts): Promise<R>;
   };
-  postForm: {
+  put: {
     <O, D = unknown>(url: string, data: D | undefined, config: SchemaConfig<O, D> & TOpts): Promise<FaxiosResponse<O, D>>;
     <T = unknown, R = FaxiosResponse<T>, D = unknown>(url: string, data?: D, config?: FaxiosRequestConfig<D> & TOpts): Promise<R>;
   };
@@ -224,41 +232,33 @@ export type FaxiosInstance<TOpts = {}, TCaps = {}> = {
     <O, D = unknown>(url: string, data: D | undefined, config: SchemaConfig<O, D> & TOpts): Promise<FaxiosResponse<O, D>>;
     <T = unknown, R = FaxiosResponse<T>, D = unknown>(url: string, data?: D, config?: FaxiosRequestConfig<D> & TOpts): Promise<R>;
   };
-  patchForm: {
+  query: {
     <O, D = unknown>(url: string, data: D | undefined, config: SchemaConfig<O, D> & TOpts): Promise<FaxiosResponse<O, D>>;
     <T = unknown, R = FaxiosResponse<T>, D = unknown>(url: string, data?: D, config?: FaxiosRequestConfig<D> & TOpts): Promise<R>;
   };
-  // `common` plus one header group per method; a key set directly on
-  // `headers` applies to every method.
-  defaults: Omit<FaxiosDefaults, "headers"> & {
-    headers: HeadersDefaults & { [key: string]: FaxiosHeaderValue | undefined; };
-  } & Partial<TOpts>;
-  /**
-   * Build the URL for `config` without sending a request. Applies `baseURL`, `params` and
-   * `paramsSerializer`, but does not substitute `pathParams` or run schemas, so `{key}`
-   * placeholders come back as written.
-   */
-  getUri: (config?: FaxiosRequestConfig & TOpts) => string;
-  create: (instanceConfig?: CreateFaxiosDefaults) => FaxiosInstance;
+  request: {
+    <O, D = unknown>(config: SchemaConfig<O, D> & TOpts): Promise<FaxiosResponse<O, D>>;
+    <T = unknown, R = FaxiosResponse<T>, D = unknown>(config: FaxiosRequestConfig<D> & TOpts): Promise<R>;
+  };
 };
 
 /** The default export: an instance plus the static helpers only it carries. */
 export type FaxiosStatic = FaxiosInstance & {
-  Faxios: typeof Faxios;
+  all: (promises: Array<Promise<unknown>>) => Promise<Array<unknown>>;
+  Cancel: typeof CanceledError;
   CanceledError: typeof CanceledError;
-  isCancel: typeof isCancel;
-  VERSION: typeof VERSION;
-  toFormData: typeof toFormData;
+  default: FaxiosStatic;
+  Faxios: typeof Faxios;
   FaxiosError: typeof FaxiosError;
-  Cancel: typeof CanceledError;
-  all: (promises: Array<Promise<unknown>>) => Promise<Array<unknown>>;
-  spread: (fn: (...args: Array<unknown>) => unknown) => (arr: Array<unknown>) => unknown;
-  isFaxiosError: typeof isFaxiosError;
-  mergeConfig: typeof mergeConfig;
   FaxiosHeaders: typeof FaxiosHeaders;
   formToJSON: (thing: unknown) => unknown;
   HttpStatusCode: typeof HttpStatusCode;
-  default: FaxiosStatic;
+  isCancel: typeof isCancel;
+  isFaxiosError: typeof isFaxiosError;
+  mergeConfig: typeof mergeConfig;
+  spread: (fn: (...args: Array<unknown>) => unknown) => (arr: Array<unknown>) => unknown;
+  toFormData: typeof toFormData;
+  VERSION: typeof VERSION;
 };
 
 // Create the default instance to be exported; the statics are attached below.

package/src/lib/helpers/HttpStatusCode.ts

@@ -71,7 +71,7 @@ const HttpStatusCode = {
 };
 
 Object.entries(HttpStatusCode).forEach(([ key, value ]) => {
-  (HttpStatusCode as Record<string | number, string | number>)[value] = key;
+  (HttpStatusCode as Record<number | string, number | string>)[value] = key;
 });
 
 export default HttpStatusCode;

package/src/lib/helpers/cloneConfig.ts

@@ -1,6 +1,5 @@
 import type { FaxiosRequestConfig } from "../types.js";
-
-export const DANGEROUS_KEYS = new Set([ "__proto__", "constructor", "prototype" ]);
+import utils from "../utils.js";
 
 // ponytail: null-proto shallow clone; replaces mergeConfig({}, config) which ran the full
 // two-config merge machinery just to get a defensive copy. Security invariants preserved:
@@ -15,7 +14,7 @@ export default function cloneConfig<T extends FaxiosRequestConfig>(src: T): T &
     enumerable: false,
   }));
   for (const key of Object.keys(src)) {
-    if (!DANGEROUS_KEYS.has(key)) {
+    if (!utils.isDangerousKey(key)) {
       (dst as Record<string, unknown>)[key] = (src as Record<string, unknown>)[key];
     }
   }

package/src/lib/helpers/composeSignals.ts

@@ -5,11 +5,11 @@ import utils from "../utils.js";
 type AbortHandler = (this: AbortSignal & { reason?: unknown; }, reason: unknown) => void;
 type EventListenerFn = (event: unknown) => void;
 type SignalLike = {
-  unsubscribe?: (() => void) | ((handler: AbortHandler) => void);
-  addEventListener: (type: string, listener: EventListenerFn) => void;
-  removeEventListener: (type: string, listener: EventListenerFn) => void;
   aborted: boolean;
+  addEventListener: (type: string, listener: EventListenerFn) => void;
   reason?: unknown;
+  removeEventListener: (type: string, listener: EventListenerFn) => void;
+  unsubscribe?: (() => void) | ((handler: AbortHandler) => void);
 };
 export type ExtendedAbortSignal = AbortSignal & { unsubscribe?: (() => void) | ((handler: AbortHandler) => void); };
 
@@ -35,7 +35,7 @@ const composeSignals = (signals: Array<unknown> | null | undefined, timeout?: nu
     }
   };
 
-  let timer: ReturnType<typeof setTimeout> | null =
+  let timer: null | ReturnType<typeof setTimeout> =
     timeout
       ? setTimeout(() => {
         timer = null;

package/src/lib/helpers/cookies.ts

@@ -2,9 +2,9 @@ import platform from "../platform.js";
 import utils from "../utils.js";
 
 type CookieManager = {
-  write: (name: string, value: string, expires?: number, path?: string, domain?: string, secure?: boolean, sameSite?: string) => void;
-  read: (name: string) => string | null;
+  read: (name: string) => null | string;
   remove: (name: string) => void;
+  write: (name: string, value: string, expires?: number, path?: string, domain?: string, secure?: boolean, sameSite?: string) => void;
 };
 
 const _globalThis = globalThis as { document?: { cookie?: string; }; };
@@ -36,7 +36,7 @@ export default platform.hasStandardBrowserEnv
       _globalThis.document.cookie = cookie.join("; ");
     },
 
-    read(name: string): string | null {
+    read(name: string): null | string {
       if (!_globalThis.document) return null;
       // Match name=value by splitting on the semicolon separator instead of building a
       // RegExp from `name` — interpolating an unescaped string into a RegExp would let

package/src/lib/helpers/formDataToJSON.ts

@@ -29,7 +29,7 @@ function parsePropPath(name: string): Array<string> {
   // foo x y z
   const path: Array<string> = [];
   const pattern = /\w+|\[(\w*)]/g;
-  let match: RegExpExecArray | null;
+  let match: null | RegExpExecArray;
 
   while ((match = pattern.exec(name)) !== null) {
     throwIfDepthExceeded(path.length);
@@ -66,13 +66,13 @@ function arrayToObject(arr: Array<unknown>): Record<string, unknown> {
  *
  * @returns {Object<string, any> | null} The converted object.
  */
-function formDataToJSON(formData: unknown): Record<string, unknown> | null {
+function formDataToJSON(formData: unknown): null | Record<string, unknown> {
   function buildPath(path: Array<string>, value: unknown, target: Record<string, unknown>, index: number): boolean {
     throwIfDepthExceeded(index);
 
-    let name: string | number = path[index++]!;
+    let name: number | string = path[index++]!;
 
-    if (name === "__proto__") return true;
+    if (utils.isDangerousKey(name)) return true;
 
     const isNumericKey = Number.isFinite(+name);
     const isLast = index >= path.length;

package/src/lib/helpers/parseHeaders.ts

@@ -38,8 +38,8 @@ const ignoreDuplicateOf = utils.toObjectSet([
  *
  * @returns {Object} Headers parsed into an object
  */
-export default (rawHeaders: string): Record<string, string | Array<string>> => {
-  const parsed: Record<string, string | Array<string>> = {};
+export default (rawHeaders: string): Record<string, Array<string> | string> => {
+  const parsed: Record<string, Array<string> | string> = {};
   let key: string;
   let val: string;
   let i: number;