accessio 1.4.0 → 1.6.0

package/cjs/helpers/rateLimiter.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/helpers/rateLimiter.ts"],"sourcesContent":["import type { RateLimiter, AccessioRequestConfig, AccessioResponse } from '../types';\n\ninterface QueueItem {\n  resolve: () => void;\n  reject: (reason: Error) => void;\n}\n\nexport function createRateLimiter(\n  maxConcurrent: number = Infinity,\n  maxQueueSize: number = Infinity,\n): RateLimiter {\n  if (maxConcurrent !== Infinity && (!Number.isInteger(maxConcurrent) || maxConcurrent < 1)) {\n    throw new RangeError(\n      `[Accessio] maxConcurrent must be a positive integer or Infinity, got: ${maxConcurrent}`,\n    );\n  }\n  if (maxQueueSize !== Infinity && (!Number.isInteger(maxQueueSize) || maxQueueSize < 1)) {\n    throw new RangeError(\n      `[Accessio] maxQueueSize must be a positive integer or Infinity, got: ${maxQueueSize}`,\n    );\n  }\n  let active = 0;\n  let destroyed = false;\n  const queue: QueueItem[] = [];\n\n  function acquire(): Promise<void> {\n    if (destroyed) {\n      return Promise.reject(new Error('[Accessio] Rate limiter has been destroyed'));\n    }\n\n    if (active < maxConcurrent) {\n      active++;\n      return Promise.resolve();\n    }\n\n    if (queue.length >= maxQueueSize) {\n      return Promise.reject(\n        new Error(`[Accessio] Rate limiter queue size exceeded maxQueueSize (${maxQueueSize})`),\n      );\n    }\n\n    return new Promise((resolve, reject) => {\n      queue.push({ resolve, reject });\n    });\n  }\n\n  function release(): void {\n    if (destroyed) return;\n    if (active <= 0) return;\n\n    const next = queue.shift();\n    if (next) {\n      next.resolve();\n      return;\n    }\n    active--;\n  }\n\n  function destroy(): void {\n    destroyed = true;\n    const reason = new Error('[Accessio] Rate limiter destroyed — pending request cancelled');\n    while (queue.length > 0) {\n      queue.shift()!.reject(reason);\n    }\n  }\n\n  return {\n    acquire,\n    release,\n    destroy,\n    get pending() {\n      return queue.length;\n    },\n    get active() {\n      return active;\n    },\n    get destroyed() {\n      return destroyed;\n    },\n  };\n}\n\nexport async function rateLimitedRequest<T = unknown>(\n  dispatchFn: (config: AccessioRequestConfig) => Promise<AccessioResponse<T>>,\n  limiter: RateLimiter,\n  config: AccessioRequestConfig,\n): Promise<AccessioResponse<T>> {\n  await limiter.acquire();\n  try {\n    return await dispatchFn(config);\n  } finally {\n    limiter.release();\n  }\n}\n\nexport default createRateLimiter;\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOO,SAAS,kBACd,gBAAwB,UACxB,eAAuB,UACV;AACb,MAAI,kBAAkB,aAAa,CAAC,OAAO,UAAU,aAAa,KAAK,gBAAgB,IAAI;AACzF,UAAM,IAAI;AAAA,MACR,yEAAyE,aAAa;AAAA,IACxF;AAAA,EACF;AACA,MAAI,iBAAiB,aAAa,CAAC,OAAO,UAAU,YAAY,KAAK,eAAe,IAAI;AACtF,UAAM,IAAI;AAAA,MACR,wEAAwE,YAAY;AAAA,IACtF;AAAA,EACF;AACA,MAAI,SAAS;AACb,MAAI,YAAY;AAChB,QAAM,QAAqB,CAAC;AAE5B,WAAS,UAAyB;AAChC,QAAI,WAAW;AACb,aAAO,QAAQ,OAAO,IAAI,MAAM,4CAA4C,CAAC;AAAA,IAC/E;AAEA,QAAI,SAAS,eAAe;AAC1B;AACA,aAAO,QAAQ,QAAQ;AAAA,IACzB;AAEA,QAAI,MAAM,UAAU,cAAc;AAChC,aAAO,QAAQ;AAAA,QACb,IAAI,MAAM,6DAA6D,YAAY,GAAG;AAAA,MACxF;AAAA,IACF;AAEA,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,YAAM,KAAK,EAAE,SAAS,OAAO,CAAC;AAAA,IAChC,CAAC;AAAA,EACH;AAEA,WAAS,UAAgB;AACvB,QAAI,UAAW;AACf,QAAI,UAAU,EAAG;AAEjB,UAAM,OAAO,MAAM,MAAM;AACzB,QAAI,MAAM;AACR,WAAK,QAAQ;AACb;AAAA,IACF;AACA;AAAA,EACF;AAEA,WAAS,UAAgB;AACvB,gBAAY;AACZ,UAAM,SAAS,IAAI,MAAM,oEAA+D;AACxF,WAAO,MAAM,SAAS,GAAG;AACvB,YAAM,MAAM,EAAG,OAAO,MAAM;AAAA,IAC9B;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,IAAI,UAAU;AACZ,aAAO,MAAM;AAAA,IACf;AAAA,IACA,IAAI,SAAS;AACX,aAAO;AAAA,IACT;AAAA,IACA,IAAI,YAAY;AACd,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,eAAsB,mBACpB,YACA,SACA,QAC8B;AAC9B,QAAM,QAAQ,QAAQ;AACtB,MAAI;AACF,WAAO,MAAM,WAAW,MAAM;AAAA,EAChC,UAAE;AACA,YAAQ,QAAQ;AAAA,EAClB;AACF;AAEA,IAAO,sBAAQ;","names":[]}
+{"version":3,"sources":["../../src/helpers/rateLimiter.ts"],"sourcesContent":["import type { RateLimiter, AccessioRequestConfig, AccessioResponse } from '../types';\n\ninterface QueueItem {\n  resolve: () => void;\n  reject: (reason: Error) => void;\n}\n\nexport function createRateLimiter(\n  maxConcurrent: number = Infinity,\n  maxQueueSize: number = Infinity,\n): RateLimiter {\n  if (maxConcurrent !== Infinity && (!Number.isInteger(maxConcurrent) || maxConcurrent < 1)) {\n    throw new RangeError(\n      `[Accessio] maxConcurrent must be a positive integer or Infinity, got: ${maxConcurrent}`,\n    );\n  }\n  if (maxQueueSize !== Infinity && (!Number.isInteger(maxQueueSize) || maxQueueSize < 1)) {\n    throw new RangeError(\n      `[Accessio] maxQueueSize must be a positive integer or Infinity, got: ${maxQueueSize}`,\n    );\n  }\n  let active = 0;\n  let destroyed = false;\n  const queue: QueueItem[] = [];\n\n  function acquire(signal?: AbortSignal): Promise<void> {\n    if (destroyed) {\n      return Promise.reject(new Error('[Accessio] Rate limiter has been destroyed'));\n    }\n\n    if (signal?.aborted) {\n      return Promise.reject(signal.reason || new Error('Request aborted'));\n    }\n\n    if (active < maxConcurrent) {\n      active++;\n      return Promise.resolve();\n    }\n\n    if (queue.length >= maxQueueSize) {\n      return Promise.reject(\n        new Error(`[Accessio] Rate limiter queue size exceeded maxQueueSize (${maxQueueSize})`),\n      );\n    }\n\n    return new Promise((resolve, reject) => {\n      let onAbort: (() => void) | undefined;\n\n      const item = {\n        resolve: () => {\n          if (signal && onAbort) {\n            signal.removeEventListener('abort', onAbort);\n          }\n          resolve();\n        },\n        reject: (err: Error) => {\n          if (signal && onAbort) {\n            signal.removeEventListener('abort', onAbort);\n          }\n          reject(err);\n        },\n      };\n\n      queue.push(item);\n\n      if (signal) {\n        onAbort = () => {\n          const index = queue.indexOf(item);\n          if (index !== -1) {\n            queue.splice(index, 1);\n          }\n          reject(signal.reason || new Error('Request aborted'));\n        };\n        signal.addEventListener('abort', onAbort, { once: true });\n      }\n    });\n  }\n\n  function release(): void {\n    if (destroyed) return;\n    if (active <= 0) return;\n\n    const next = queue.shift();\n    if (next) {\n      next.resolve();\n      return;\n    }\n    active--;\n  }\n\n  function destroy(): void {\n    destroyed = true;\n    const reason = new Error('[Accessio] Rate limiter destroyed — pending request cancelled');\n    while (queue.length > 0) {\n      queue.shift()!.reject(reason);\n    }\n  }\n\n  return {\n    acquire,\n    release,\n    destroy,\n    get pending() {\n      return queue.length;\n    },\n    get active() {\n      return active;\n    },\n    get destroyed() {\n      return destroyed;\n    },\n  };\n}\n\nexport async function rateLimitedRequest<T = unknown>(\n  dispatchFn: (config: AccessioRequestConfig) => Promise<AccessioResponse<T>>,\n  limiter: RateLimiter,\n  config: AccessioRequestConfig,\n): Promise<AccessioResponse<T>> {\n  await limiter.acquire(config.signal);\n  try {\n    return await dispatchFn(config);\n  } finally {\n    limiter.release();\n  }\n}\n\nexport default createRateLimiter;\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAOO,SAAS,kBACd,gBAAwB,UACxB,eAAuB,UACV;AACb,MAAI,kBAAkB,aAAa,CAAC,OAAO,UAAU,aAAa,KAAK,gBAAgB,IAAI;AACzF,UAAM,IAAI;AAAA,MACR,yEAAyE,aAAa;AAAA,IACxF;AAAA,EACF;AACA,MAAI,iBAAiB,aAAa,CAAC,OAAO,UAAU,YAAY,KAAK,eAAe,IAAI;AACtF,UAAM,IAAI;AAAA,MACR,wEAAwE,YAAY;AAAA,IACtF;AAAA,EACF;AACA,MAAI,SAAS;AACb,MAAI,YAAY;AAChB,QAAM,QAAqB,CAAC;AAE5B,WAAS,QAAQ,QAAqC;AACpD,QAAI,WAAW;AACb,aAAO,QAAQ,OAAO,IAAI,MAAM,4CAA4C,CAAC;AAAA,IAC/E;AAEA,QAAI,QAAQ,SAAS;AACnB,aAAO,QAAQ,OAAO,OAAO,UAAU,IAAI,MAAM,iBAAiB,CAAC;AAAA,IACrE;AAEA,QAAI,SAAS,eAAe;AAC1B;AACA,aAAO,QAAQ,QAAQ;AAAA,IACzB;AAEA,QAAI,MAAM,UAAU,cAAc;AAChC,aAAO,QAAQ;AAAA,QACb,IAAI,MAAM,6DAA6D,YAAY,GAAG;AAAA,MACxF;AAAA,IACF;AAEA,WAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAI;AAEJ,YAAM,OAAO;AAAA,QACX,SAAS,MAAM;AACb,cAAI,UAAU,SAAS;AACrB,mBAAO,oBAAoB,SAAS,OAAO;AAAA,UAC7C;AACA,kBAAQ;AAAA,QACV;AAAA,QACA,QAAQ,CAAC,QAAe;AACtB,cAAI,UAAU,SAAS;AACrB,mBAAO,oBAAoB,SAAS,OAAO;AAAA,UAC7C;AACA,iBAAO,GAAG;AAAA,QACZ;AAAA,MACF;AAEA,YAAM,KAAK,IAAI;AAEf,UAAI,QAAQ;AACV,kBAAU,MAAM;AACd,gBAAM,QAAQ,MAAM,QAAQ,IAAI;AAChC,cAAI,UAAU,IAAI;AAChB,kBAAM,OAAO,OAAO,CAAC;AAAA,UACvB;AACA,iBAAO,OAAO,UAAU,IAAI,MAAM,iBAAiB,CAAC;AAAA,QACtD;AACA,eAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAAA,MAC1D;AAAA,IACF,CAAC;AAAA,EACH;AAEA,WAAS,UAAgB;AACvB,QAAI,UAAW;AACf,QAAI,UAAU,EAAG;AAEjB,UAAM,OAAO,MAAM,MAAM;AACzB,QAAI,MAAM;AACR,WAAK,QAAQ;AACb;AAAA,IACF;AACA;AAAA,EACF;AAEA,WAAS,UAAgB;AACvB,gBAAY;AACZ,UAAM,SAAS,IAAI,MAAM,oEAA+D;AACxF,WAAO,MAAM,SAAS,GAAG;AACvB,YAAM,MAAM,EAAG,OAAO,MAAM;AAAA,IAC9B;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,IAAI,UAAU;AACZ,aAAO,MAAM;AAAA,IACf;AAAA,IACA,IAAI,SAAS;AACX,aAAO;AAAA,IACT;AAAA,IACA,IAAI,YAAY;AACd,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,eAAsB,mBACpB,YACA,SACA,QAC8B;AAC9B,QAAM,QAAQ,QAAQ,OAAO,MAAM;AACnC,MAAI;AACF,WAAO,MAAM,WAAW,MAAM;AAAA,EAChC,UAAE;AACA,YAAQ,QAAQ;AAAA,EAClB;AACF;AAEA,IAAO,sBAAQ;","names":[]}

package/cjs/helpers/toFormData.cjs

@@ -29,7 +29,7 @@ function toFormData(obj, form, namespace) {
   }
   if (obj instanceof Date) {
     fd.append(namespace || "", obj.toISOString());
-  } else if (typeof obj === "object" && !(obj instanceof File) && !(obj instanceof Blob)) {
+  } else if (typeof obj === "object" && !(typeof File !== "undefined" && obj instanceof File) && !(typeof Blob !== "undefined" && obj instanceof Blob)) {
     Object.keys(obj).forEach((key) => {
       if (Array.isArray(obj)) {
         formKey = namespace ? `${namespace}[${key}]` : key;

package/cjs/helpers/toFormData.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/helpers/toFormData.ts"],"sourcesContent":["export function toFormData(obj: any, form?: FormData, namespace?: string): FormData {\n  const fd = form || new FormData();\n  let formKey: string;\n\n  if (obj === null || obj === undefined) {\n    return fd;\n  }\n\n  if (obj instanceof Date) {\n    fd.append(namespace || '', obj.toISOString());\n  } else if (typeof obj === 'object' && !(obj instanceof File) && !(obj instanceof Blob)) {\n    Object.keys(obj).forEach((key) => {\n      if (Array.isArray(obj)) {\n        formKey = namespace ? `${namespace}[${key}]` : key;\n      } else {\n        formKey = namespace ? `${namespace}.${key}` : key;\n      }\n      toFormData(obj[key], fd, formKey);\n    });\n  } else {\n    fd.append(namespace || '', obj);\n  }\n\n  return fd;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAO,SAAS,WAAW,KAAU,MAAiB,WAA8B;AAClF,QAAM,KAAK,QAAQ,IAAI,SAAS;AAChC,MAAI;AAEJ,MAAI,QAAQ,QAAQ,QAAQ,QAAW;AACrC,WAAO;AAAA,EACT;AAEA,MAAI,eAAe,MAAM;AACvB,OAAG,OAAO,aAAa,IAAI,IAAI,YAAY,CAAC;AAAA,EAC9C,WAAW,OAAO,QAAQ,YAAY,EAAE,eAAe,SAAS,EAAE,eAAe,OAAO;AACtF,WAAO,KAAK,GAAG,EAAE,QAAQ,CAAC,QAAQ;AAChC,UAAI,MAAM,QAAQ,GAAG,GAAG;AACtB,kBAAU,YAAY,GAAG,SAAS,IAAI,GAAG,MAAM;AAAA,MACjD,OAAO;AACL,kBAAU,YAAY,GAAG,SAAS,IAAI,GAAG,KAAK;AAAA,MAChD;AACA,iBAAW,IAAI,GAAG,GAAG,IAAI,OAAO;AAAA,IAClC,CAAC;AAAA,EACH,OAAO;AACL,OAAG,OAAO,aAAa,IAAI,GAAG;AAAA,EAChC;AAEA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../src/helpers/toFormData.ts"],"sourcesContent":["export function toFormData(obj: any, form?: FormData, namespace?: string): FormData {\n  const fd = form || new FormData();\n  let formKey: string;\n\n  if (obj === null || obj === undefined) {\n    return fd;\n  }\n\n  if (obj instanceof Date) {\n    fd.append(namespace || '', obj.toISOString());\n  } else if (\n    typeof obj === 'object' &&\n    !(typeof File !== 'undefined' && obj instanceof File) &&\n    !(typeof Blob !== 'undefined' && obj instanceof Blob)\n  ) {\n    Object.keys(obj).forEach((key) => {\n      if (Array.isArray(obj)) {\n        formKey = namespace ? `${namespace}[${key}]` : key;\n      } else {\n        formKey = namespace ? `${namespace}.${key}` : key;\n      }\n      toFormData(obj[key], fd, formKey);\n    });\n  } else {\n    fd.append(namespace || '', obj);\n  }\n\n  return fd;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAO,SAAS,WAAW,KAAU,MAAiB,WAA8B;AAClF,QAAM,KAAK,QAAQ,IAAI,SAAS;AAChC,MAAI;AAEJ,MAAI,QAAQ,QAAQ,QAAQ,QAAW;AACrC,WAAO;AAAA,EACT;AAEA,MAAI,eAAe,MAAM;AACvB,OAAG,OAAO,aAAa,IAAI,IAAI,YAAY,CAAC;AAAA,EAC9C,WACE,OAAO,QAAQ,YACf,EAAE,OAAO,SAAS,eAAe,eAAe,SAChD,EAAE,OAAO,SAAS,eAAe,eAAe,OAChD;AACA,WAAO,KAAK,GAAG,EAAE,QAAQ,CAAC,QAAQ;AAChC,UAAI,MAAM,QAAQ,GAAG,GAAG;AACtB,kBAAU,YAAY,GAAG,SAAS,IAAI,GAAG,MAAM;AAAA,MACjD,OAAO;AACL,kBAAU,YAAY,GAAG,SAAS,IAAI,GAAG,KAAK;AAAA,MAChD;AACA,iBAAW,IAAI,GAAG,GAAG,IAAI,OAAO;AAAA,IAClC,CAAC;AAAA,EACH,OAAO;AACL,OAAG,OAAO,aAAa,IAAI,GAAG;AAAA,EAChC;AAEA,SAAO;AACT;","names":[]}

package/index.d.ts

@@ -150,6 +150,13 @@ export interface AccessioRequestConfig {
   /** TTL in ms for cached responses (when supported by the provider) */
   cacheTTL?: number;
 
+  /** Custom function to serialize request properties into a deterministic cache key */
+  cacheKeySerializer?: (
+    config: AccessioRequestConfig,
+    fullURL: string,
+    headers: Record<string, HeaderValue>,
+  ) => string;
+
   // ── Response handling ──────────────────────────────
 
   /** Maximum allowed response Content-Length in bytes */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "accessio",
-  "version": "1.4.0",
+  "version": "1.6.0",
   "description": "Fast, flexible HTTP client — simple, modular, and dependency-free",
   "type": "module",
   "main": "./cjs/index.cjs",
@@ -96,7 +96,8 @@
     "node": ">=18.0.0"
   },
   "devDependencies": {
-    "@vitest/coverage-v8": "^3.1.0",
+    "@types/node": "^25.9.2",
+    "@vitest/coverage-v8": "^4.1.8",
     "eslint": "^9.0.0",
     "eslint-config-prettier": "^10.1.8",
     "jsdom": "^29.0.2",
@@ -104,6 +105,6 @@
     "tsup": "^8.0.0",
     "typescript": "^5.0.0",
     "typescript-eslint": "^8.59.3",
-    "vitest": "^3.1.0"
+    "vitest": "^4.1.8"
   }
-}
+}

package/src/accessio.ts

@@ -261,19 +261,13 @@ export class Accessio {
     if (!response.data) return;
 
     const reader = response.data.getReader();
-    const decoder = new TextDecoder();
-    let buffer = '';
+    try {
+      const decoder = new TextDecoder();
+      let buffer = '';
 
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done) break;
-
-      buffer += decoder.decode(value, { stream: true });
-      const lines = buffer.split('\n');
-      buffer = lines.pop() || '';
-
-      for (const line of lines) {
-        if (line.trim().startsWith('data:')) {
+      const processLine = function* (line: string) {
+        const trimmed = line.trim();
+        if (trimmed.startsWith('data:')) {
           const dataStr = line.replace(/^data:\s*/, '');
           if (dataStr === '[DONE]') return;
           try {
@@ -281,14 +275,39 @@ export class Accessio {
           } catch (e) {
             yield dataStr as any;
           }
-        } else if (line.trim().startsWith('{') || line.trim().startsWith('[')) {
+        } else if (trimmed.startsWith('{') || trimmed.startsWith('[')) {
           try {
             yield JSON.parse(line);
           } catch (e) {
             // ignore partial json
           }
         }
+      };
+
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) break;
+
+        buffer += decoder.decode(value, { stream: true });
+        const lines = buffer.split('\n');
+        buffer = lines.pop() || '';
+
+        for (const line of lines) {
+          yield* processLine(line);
+        }
       }
+
+      buffer += decoder.decode(new Uint8Array(), { stream: false });
+      if (buffer.trim()) {
+        yield* processLine(buffer);
+      }
+    } finally {
+      try {
+        await reader.cancel();
+      } catch {
+        // ignore errors on cancel
+      }
+      reader.releaseLock();
     }
   }
 
@@ -302,14 +321,24 @@ export class Accessio {
     while (nextUrl) {
       const response: AccessioResponse<any> = await this.get(nextUrl, currentConfig);
 
-      const items = Array.isArray(response.data) ? response.data : response.data.data;
+      const data = response.data;
+      const items = Array.isArray(data)
+        ? data
+        : data && typeof data === 'object'
+          ? (data as any).data
+          : null;
+
       if (Array.isArray(items)) {
         for (const item of items) {
           yield item;
         }
       }
 
-      nextUrl = response.data.next || response.data.links?.next || null;
+      nextUrl =
+        data && typeof data === 'object'
+          ? (data as any).next || (data as any).links?.next || null
+          : null;
+
       if (nextUrl) {
         currentConfig = mergeConfig(currentConfig, { url: nextUrl, params: {} });
       }

package/src/core/accessioError.ts

@@ -42,11 +42,42 @@ export function redactBody(value: unknown, seen?: WeakSet<object>): unknown {
   return out;
 }
 
+function redactParams(params: unknown): unknown {
+  if (!params || typeof params !== 'object') return params;
+  const out: Record<string, unknown> = {};
+  for (const key of Object.keys(params as Record<string, unknown>)) {
+    const value = (params as Record<string, unknown>)[key];
+    if (SENSITIVE_BODY_KEY.test(key)) {
+      out[key] = '[REDACTED]';
+    } else if (value && typeof value === 'object' && !Array.isArray(value)) {
+      out[key] = redactParams(value);
+    } else {
+      out[key] = value;
+    }
+  }
+  return out;
+}
+
+function redactURL(url: string | undefined): string | undefined {
+  if (!url) return url;
+  // Match inline credentials: http://user:pass@host
+  return url.replace(/^([a-z][a-z\d+\-.]*:\/\/)([^/]+)@/i, (match, protocol, userInfo) => {
+    const parts = userInfo.split(':');
+    if (parts.length > 1) {
+      return `${protocol}${parts[0]}:[REDACTED]@`;
+    }
+    return `${protocol}[REDACTED]@`;
+  });
+}
+
 export function redactConfig(config: AccessioRequestConfig | null): AccessioRequestConfig | null {
   if (!config) return config;
   const clone = { ...config } as AccessioRequestConfig & { auth?: unknown };
   if ('auth' in clone) delete clone.auth;
   if (clone.headers) clone.headers = redactHeaders(clone.headers) as typeof clone.headers;
+  if (clone.params) clone.params = redactParams(clone.params) as typeof clone.params;
+  if (clone.url) clone.url = redactURL(clone.url);
+  if (clone._builtUrl) clone._builtUrl = redactURL(clone._builtUrl);
   return clone;
 }
 
@@ -86,8 +117,8 @@ export class AccessioError extends Error {
     this.response = response ?? null;
     this.isAccessioError = true;
 
-    if (Error.captureStackTrace) {
-      Error.captureStackTrace(this, AccessioError);
+    if ((Error as any).captureStackTrace) {
+      (Error as any).captureStackTrace(this, AccessioError);
     }
   }
 

package/src/core/buildURL.ts

@@ -82,19 +82,22 @@ export default function buildURL(
       if (key === '__proto__' || key === 'prototype' || key === 'constructor') continue;
       unusedParams[key] = (params as Record<string, unknown>)[key];
     }
-    fullURL = fullURL.replace(/(?::([a-zA-Z0-9_]+))|(?:{([a-zA-Z0-9_]+)})/g, (match, p1, p2) => {
-      const key = p1 || p2;
-      if (
-        key &&
-        Object.prototype.hasOwnProperty.call(unusedParams, key) &&
-        unusedParams[key] !== undefined
-      ) {
-        const val = unusedParams[key];
-        delete unusedParams[key];
-        return encodeURIComponent(String(val));
-      }
-      return match;
-    });
+    fullURL = fullURL.replace(
+      /(?::([a-zA-Z_][a-zA-Z0-9_]*))|(?:{([a-zA-Z_][a-zA-Z0-9_]*)})/g,
+      (match, p1, p2) => {
+        const key = p1 || p2;
+        if (
+          key &&
+          Object.prototype.hasOwnProperty.call(unusedParams, key) &&
+          unusedParams[key] !== undefined
+        ) {
+          const val = unusedParams[key];
+          delete unusedParams[key];
+          return encodeURIComponent(String(val));
+        }
+        return match;
+      },
+    );
     finalParams = unusedParams;
   }
 

package/src/core/fetchAdapter.ts

@@ -154,6 +154,9 @@ function wrapDownloadProgress(fetchResponse: Response, config: AccessioRequestCo
         controller.error(e);
       }
     },
+    cancel(reason) {
+      reader.cancel(reason).catch(() => {});
+    },
   });
 
   return new Response(stream, {

package/src/core/mergeConfig.ts

@@ -37,7 +37,7 @@ function deepMerge(...sources: any[]): Record<string, any> {
 }
 
 const requestOnlyKeys = new Set<string>(['url', 'data', 'signal']);
-const deepMergeKeys = new Set<string>(['headers']);
+const deepMergeKeys = new Set<string>(['headers', 'params', 'hooks']);
 
 export default function mergeConfig(
   config1: AccessioRequestConfig = {},

package/src/core/request.ts

@@ -12,28 +12,35 @@ import type { AccessioRequestConfig, AccessioResponse, TransformFunction } from
 type HeadersConfig = Record<string, Record<string, string | string[]>>;
 type FlatHeaders = Record<string, string | string[]>;
 
-function lookupHeader(headers: FlatHeaders, name: string): string {
-  const target = name.toLowerCase();
-  for (const k of Object.keys(headers)) {
-    if (k.toLowerCase() === target) {
-      const v = headers[k];
-      return Array.isArray(v) ? v.join(',') : (v ?? '');
-    }
-  }
-  return '';
-}
-
 function buildCacheKey(
   config: AccessioRequestConfig,
   fullURL: string,
   flatHeaders: FlatHeaders,
 ): string {
+  if (typeof config.cacheKeySerializer === 'function') {
+    return config.cacheKeySerializer(config, fullURL, flatHeaders);
+  }
   const method = (config.method || 'GET').toUpperCase();
-  const auth = lookupHeader(flatHeaders, 'authorization');
-  const accept = lookupHeader(flatHeaders, 'accept');
   const withCreds = config.withCredentials ? '1' : '0';
   const respType = config.responseType || 'json';
-  return `${method}:${fullURL}|a=${auth}|x=${accept}|c=${withCreds}|t=${respType}`;
+
+  // Sort and serialize headers dynamically to prevent collisions,
+  // excluding environment-specific transient headers.
+  const serializedHeaders = Object.keys(flatHeaders)
+    .sort()
+    .filter(
+      (k) =>
+        !['user-agent', 'connection', 'host', 'content-length', 'accept-encoding'].includes(
+          k.toLowerCase(),
+        ),
+    )
+    .map((k) => {
+      const val = flatHeaders[k];
+      return `${k.toLowerCase()}=${Array.isArray(val) ? val.join(',') : val}`;
+    })
+    .join('&');
+
+  return `${method}:${fullURL}|h:${serializedHeaders}|c=${withCreds}|t=${respType}`;
 }
 
 function buildTransformArray(
@@ -126,8 +133,39 @@ export default async function dispatchRequest(
   if (isGet && config.dedupe) {
     const inflight = activeRequests.get(cacheKey);
     if (inflight) {
-      const shared = await inflight;
-      return finalizeResponse(shared, config);
+      try {
+        const shared = await inflight;
+        const response = finalizeResponse(shared, config);
+        const settled = await new Promise<AccessioResponse>((resolve, reject) => {
+          settle(
+            resolve as (value: AccessioResponse) => void,
+            reject as (reason: AccessioError) => void,
+            response,
+            config,
+          );
+        });
+
+        if (config.hooks?.onRequestResponse) {
+          await config.hooks.onRequestResponse(settled);
+        }
+
+        return settled;
+      } catch (error) {
+        let finalError = error;
+        if (error instanceof AccessioError) {
+          finalError = AccessioError.from(
+            error,
+            error.code || 'ERR_DEDUPE',
+            config,
+            error.request,
+            error.response,
+          );
+        }
+        if (config.hooks?.onRequestError && finalError instanceof AccessioError) {
+          await config.hooks.onRequestError(finalError);
+        }
+        throw finalError;
+      }
     }
   }
 

package/src/core/retry.ts

@@ -10,6 +10,7 @@ import type {
 function isUnretriableBody(data: unknown): boolean {
   if (data == null) return false;
   if (typeof ReadableStream !== 'undefined' && data instanceof ReadableStream) return true;
+  if (data && typeof (data as any).pipe === 'function') return true;
   return false;
 }
 
@@ -33,10 +34,11 @@ function defaultRetryCondition(error: any): boolean {
   return false;
 }
 
-function calculateDelay(attempt: number, baseDelay: number): number {
+function calculateDelay(attempt: number, baseDelay: number, maxDelay: number = 30000): number {
   const exponentialDelay = baseDelay * Math.pow(2, attempt);
   const jitter = exponentialDelay * 0.25 * (Math.random() * 2 - 1);
-  return Math.round(exponentialDelay + jitter);
+  const calculated = Math.round(exponentialDelay + jitter);
+  return Math.min(calculated, maxDelay);
 }
 
 function sleep(ms: number, options?: { signal?: AbortSignal }): Promise<void> {
@@ -89,8 +91,9 @@ async function retryRequest(
     } catch (error) {
       lastError = error;
 
-      const isLastAttempt = attempt >= actualMaxRetries;
-      const shouldRetry = !isLastAttempt && retryCondition(error as AccessioError);
+      const is429 = (error as any).response?.status === 429;
+      const attemptLimit = is429 && config.retryOn429 ? Math.max(maxRetries, 3) : maxRetries;
+      const shouldRetry = attempt < attemptLimit && retryCondition(error as AccessioError);
 
       if (!shouldRetry) {
         throw error;
@@ -107,7 +110,7 @@ async function retryRequest(
         );
       }
 
-      let delay = calculateDelay(attempt, retryDelay);
+      let delay = calculateDelay(attempt, retryDelay, config.maxRetryDelay ?? 30000);
 
       if (config.retryOn429 && (error as any).response?.status === 429) {
         const headers = (error as any).response?.headers;

package/src/helpers/flattenHeaders.ts

@@ -76,10 +76,13 @@ export function removeContentType(headers: Record<string, string | string[]>): v
 export function buildFetchHeaders(headers: Record<string, string | string[]>): Headers {
   const fetchHeaders = new Headers();
   for (const [key, value] of Object.entries(headers)) {
+    if (value === undefined || value === null) continue;
     assertSafeHeader(key, value);
     if (Array.isArray(value)) {
       for (const v of value) {
-        fetchHeaders.append(key, v);
+        if (v !== undefined && v !== null) {
+          fetchHeaders.append(key, v);
+        }
       }
     } else {
       fetchHeaders.set(key, value);

package/src/helpers/memoryCache.ts

@@ -2,6 +2,11 @@ import type { CacheProvider } from '../types';
 
 class MemoryCache implements CacheProvider {
   private cache = new Map<string, { value: any; expiry: number | null }>();
+  private maxItems: number;
+
+  constructor(maxItems: number = 1000) {
+    this.maxItems = maxItems;
+  }
 
   get(key: string) {
     const item = this.cache.get(key);
@@ -14,7 +19,24 @@ class MemoryCache implements CacheProvider {
   }
 
   set(key: string, value: any, ttl?: number) {
-    const expiry = ttl ? Date.now() + ttl : null;
+    const now = Date.now();
+
+    // Proactively evict all expired items first
+    for (const [k, item] of this.cache.entries()) {
+      if (item.expiry && now > item.expiry) {
+        this.cache.delete(k);
+      }
+    }
+
+    // Evict oldest item if we are still at limit
+    if (this.cache.size >= this.maxItems) {
+      const oldest = this.cache.keys().next().value;
+      if (oldest !== undefined) {
+        this.cache.delete(oldest);
+      }
+    }
+
+    const expiry = ttl ? now + ttl : null;
     this.cache.set(key, { value, expiry });
   }
 
@@ -28,3 +50,4 @@ class MemoryCache implements CacheProvider {
 }
 
 export const defaultMemoryCache = new MemoryCache();
+export { MemoryCache };

package/src/helpers/rateLimiter.ts

@@ -23,11 +23,15 @@ export function createRateLimiter(
   let destroyed = false;
   const queue: QueueItem[] = [];
 
-  function acquire(): Promise<void> {
+  function acquire(signal?: AbortSignal): Promise<void> {
     if (destroyed) {
       return Promise.reject(new Error('[Accessio] Rate limiter has been destroyed'));
     }
 
+    if (signal?.aborted) {
+      return Promise.reject(signal.reason || new Error('Request aborted'));
+    }
+
     if (active < maxConcurrent) {
       active++;
       return Promise.resolve();
@@ -40,7 +44,35 @@ export function createRateLimiter(
     }
 
     return new Promise((resolve, reject) => {
-      queue.push({ resolve, reject });
+      let onAbort: (() => void) | undefined;
+
+      const item = {
+        resolve: () => {
+          if (signal && onAbort) {
+            signal.removeEventListener('abort', onAbort);
+          }
+          resolve();
+        },
+        reject: (err: Error) => {
+          if (signal && onAbort) {
+            signal.removeEventListener('abort', onAbort);
+          }
+          reject(err);
+        },
+      };
+
+      queue.push(item);
+
+      if (signal) {
+        onAbort = () => {
+          const index = queue.indexOf(item);
+          if (index !== -1) {
+            queue.splice(index, 1);
+          }
+          reject(signal.reason || new Error('Request aborted'));
+        };
+        signal.addEventListener('abort', onAbort, { once: true });
+      }
     });
   }
 
@@ -85,7 +117,7 @@ export async function rateLimitedRequest<T = unknown>(
   limiter: RateLimiter,
   config: AccessioRequestConfig,
 ): Promise<AccessioResponse<T>> {
-  await limiter.acquire();
+  await limiter.acquire(config.signal);
   try {
     return await dispatchFn(config);
   } finally {

package/src/helpers/toFormData.ts

@@ -8,7 +8,11 @@ export function toFormData(obj: any, form?: FormData, namespace?: string): FormD
 
   if (obj instanceof Date) {
     fd.append(namespace || '', obj.toISOString());
-  } else if (typeof obj === 'object' && !(obj instanceof File) && !(obj instanceof Blob)) {
+  } else if (
+    typeof obj === 'object' &&
+    !(typeof File !== 'undefined' && obj instanceof File) &&
+    !(typeof Blob !== 'undefined' && obj instanceof Blob)
+  ) {
     Object.keys(obj).forEach((key) => {
       if (Array.isArray(obj)) {
         formKey = namespace ? `${namespace}[${key}]` : key;

package/src/types.ts

@@ -91,11 +91,17 @@ export interface AccessioRequestConfig {
   dedupe?: boolean;
   cache?: boolean | CacheProvider;
   cacheTTL?: number;
+  cacheKeySerializer?: (
+    config: AccessioRequestConfig,
+    fullURL: string,
+    headers: Record<string, string | string[]>,
+  ) => string;
   onDownloadProgress?: (progressEvent: { loaded: number; total: number }) => void;
   hooks?: AccessioHooks;
   schema?: SchemaValidator;
   fetch?: typeof fetch;
   retryOn429?: boolean;
+  maxRetryDelay?: number;
 }
 
 export interface AccessioResponse<T = unknown> {
@@ -120,7 +126,7 @@ export interface AccessioError extends Error {
 }
 
 export interface RateLimiter {
-  acquire: () => Promise<void>;
+  acquire: (signal?: AbortSignal) => Promise<void>;
   release: () => void;
   destroy: () => void;
   pending: number;