accessio 1.5.0 → 1.6.0

package/README.md

@@ -2,298 +2,256 @@
 
 **Fast, flexible HTTP client — simple, modular, and dependency-free.**
 
-`Accessio` is a lightweight, modern HTTP client built on top of the native `fetch` API. It provides a familiar, Promise-based interface with advanced features like interceptors, automatic retries, rate limiting, and structured debug logging, all while maintaining **zero external dependencies**.
+Accessio is a lightweight, modern HTTP client built on top of the native fetch API. It provides a familiar, Promise-based interface with advanced features like interceptors, automatic retries, rate limiting, and structured debug logging, all while maintaining zero external dependencies.
 
 ---
 
-## ✨ Features
-
-- 🚀 **Promise-based** — works seamlessly with `async`/`await`
-- 🌐 **Isomorphic** — runs in both browser and Node.js (≥ 18)
-- 🪶 **Zero dependencies** — ultra-lightweight, built on native `fetch`
-- 🔄 **Interceptors** — transform requests and responses globally or per instance
-- ⚙️ **Configurable instances** — create multiple API clients with custom defaults
-- 🛡️ **Robust Error handling** — structured `AccessioError` with status, config, and response
-- 📦 **Dual format** — full support for both ESM and CommonJS
-- 📐 **TypeScript first** — written in TS with comprehensive type definitions
-- ⏱️ **Timeout & Cancellation** — built-in support via `AbortController` and `signal`
-- 🔧 **Transform pipelines** — flexible request/response data transformation
-- ♻️ **Automatic Retries** — smart retry logic with exponential backoff and jitter
-- 🚥 **Rate Limiter** — built-in concurrency control for high-throughput applications
-- 🐞 **Debug Mode** — structured, beautiful console logging for easy development
-- ⏱️ **Duration Tracking** — every response includes precise timing metadata
-- 🧬 **GraphQL Support** — built-in `gql` method for easy querying
-- 📡 **SSE Streaming** — async iterators for Server-Sent Events via `stream`
-- 📚 **Auto-Pagination** — seamlessly iterate through paginated APIs via `autoPaginate`
-- 🛡️ **Schema Validation** — validate responses automatically using Zod or custom schemas
-- 🗂️ **Caching & Deduplication** — prevent redundant requests and cache responses
-- 🪝 **Lifecycle Hooks** — simple hooks for request/response/error events
+## ⚡ Key Features
+
+- **Zero Runtime Dependencies**: Keep your bundle size minimal and avoid supply chain vulnerabilities.
+- **Axios-Compatible API**: Direct drop-in replacement with `.get()`, `.post()`, `.request()`, and custom instances via `.create()`.
+- **🛡️ Built-in Security & Auto-Redaction**: Prevents accidental leakage of secrets in error logs. Automatically redacts:
+  - `Authorization`, `Cookie`, and `Set-Cookie` headers.
+  - Sensitive request/response parameters (e.g., `api_key`, `token`, `password`, `secret`).
+  - Inline credentials inside URLs.
+- **⏳ Concurrency Rate Limiter**: Built-in queue-based rate limiter to throttle concurrent requests, complete with immediate queue ejection on `AbortSignal` cancellation.
+- **🔁 Jittered Exponential Backoff Retry**: Automatic retries for network failures or `5xx` status codes. Fully respects the HTTP 429 `Retry-After` header and supports customizable retry conditions and callbacks.
+- **🌊 SSE & Newline JSON Streaming**: Native asynchronous generator-based parsing for Server-Sent Events (SSE) and newline-delimited JSON streams.
+- **📂 Auto-Pagination**: Seamlessly yields paginated items from APIs using page links (e.g., `next` or `links.next`).
+- **🧪 Type-safe Schema Validation**: Validate API response payloads at runtime using Zod, ArkType, or any validation library with a `.parse()` or `.parseAsync()` method.
+- **📦 Request Deduplication**: Automatically coalesces concurrent duplicate GET requests to avoid redundant network traffic.
+- **💾 Memory Caching**: In-memory caching out-of-the-box with custom TTL, or easily swap in a custom storage provider (e.g., Redis, LocalStorage).
+- **🔗 Synchronous & Asynchronous Interceptors**: Hook into the request/response pipeline to dynamically inject headers, handle global errors, or log metrics.
+- **⚓ Lifecycle Hooks**: Granular callbacks (`onBeforeRequest`, `onRequestResponse`, `onRequestError`) for custom instrumentation.
+- **FormData Serialization**: Automatically converts flat or nested JS objects to `FormData` for multipart submissions.
 
 ---
 
 ## 📦 Installation
 
 ```bash
-# Using npm
 npm install accessio
-
-# Using yarn
-yarn add accessio
-
-# Using pnpm
-pnpm add accessio
 ```
 
 ---
 
 ## 🚀 Quick Start
 
+### Basic Requests
+
 ```typescript
 import accessio from 'accessio';
 
 // Simple GET request
-const { data } = await accessio.get('https://api.example.com/users');
+const response = await accessio.get('https://api.example.com/users/123');
+console.log(response.data); // Automatically parsed JSON response
 
-// POST request with JSON body
-const response = await accessio.post('https://api.example.com/users', {
-  name: 'John Doe',
+// POST request with body
+const postResponse = await accessio.post('https://api.example.com/users', {
+  name: 'Jane Doe',
   role: 'Developer',
 });
-
-console.log(`User created in ${response.duration}ms`);
 ```
 
----
-
-## 📖 API Reference
-
-### Request Methods
-
-| Method                                     | Description                              |
-| :----------------------------------------- | :--------------------------------------- |
-| `accessio(config)`                         | Generic request using config object      |
-| `accessio.get(url, config?)`               | GET request                              |
-| `accessio.post(url, data?, config?)`       | POST request                             |
-| `accessio.put(url, data?, config?)`        | PUT request                              |
-| `accessio.patch(url, data?, config?)`      | PATCH request                            |
-| `accessio.delete(url, config?)`            | DELETE request                           |
-| `accessio.head(url, config?)`              | HEAD request                             |
-| `accessio.options(url, config?)`           | OPTIONS request                          |
-| `accessio.postForm(url, data?, config?)`   | POST request with `multipart/form-data`  |
-| `accessio.putForm(url, data?, config?)`    | PUT request with `multipart/form-data`   |
-| `accessio.patchForm(url, data?, config?)`  | PATCH request with `multipart/form-data` |
-| `accessio.stream(url, config?)`            | Server-Sent Events (SSE) streaming       |
-| `accessio.autoPaginate(url, config?)`      | Async iterator for paginated endpoints   |
-| `accessio.gql(url, query, vars?, config?)` | GraphQL query/mutation wrapper           |
-
-### Configuration Options
+### Custom Instances
 
 ```typescript
-{
-  baseURL: 'https://api.example.com', // Base URL for all requests
-  url: '/users',                     // Relative or absolute URL
-  method: 'get',                     // HTTP method (default: get)
-  headers: { 'X-Custom': 'val' },    // Custom headers
-  params: { id: 123 },               // URL query parameters
-  data: { name: 'John' },            // Request body (JSON/FormData/etc)
-  timeout: 5000,                     // Timeout in ms (default: 0)
-  responseType: 'json',              // Expected response: 'json', 'text', 'blob', 'stream'
-  auth: { username: '', password: '' }, // Basic auth credentials
-  retry: 3,                          // Max retry attempts
-  retryDelay: 1000,                  // Base delay for exponential backoff
-  debug: true,                       // Enable structured logging
-  rateLimiter: limiter,              // Concurrency limiter instance
-  validateStatus: (s) => s < 400,    // Resolve/reject predicate
-  signal: abortController.signal,    // Custom AbortSignal
-  dedupe: true,                      // Prevent duplicate in-flight requests
-  cache: true,                       // Cache responses (boolean or CacheProvider)
-  cacheTTL: 60000,                   // Cache time-to-live in ms
-  schema: z.object({...}),           // Schema validator (e.g., Zod)
-  fetch: customFetch,                // Custom fetch implementation
-  retryOn429: true,                  // Automatically retry on rate limits
-  hooks: {                           // Lifecycle hooks
-    onBeforeRequest: (config) => {},
-    onRequestResponse: (response) => {},
-    onRequestError: (error) => {}
-  }
-}
+import accessio from 'accessio';
+
+// Create a configured instance
+const api = accessio.create({
+  baseURL: 'https://api.example.com/v1',
+  headers: {
+    'X-Client-Name': 'AccessioClient',
+  },
+  timeout: 5000, // 5-second timeout
+});
+
+// Use instance methods
+const { data } = await api.get('/users');
 ```
 
 ---
 
-## ♻️ Advanced Usage
+## 🛠️ Advanced Features
 
-### Interceptors
+### 🛡️ Auto-Redaction (Zero-leak Logs)
 
-Interceptors allow you to transform requests or responses before they are handled by `then` or `catch`.
+Accessio is built with security first. If a request fails, sensitive credentials in request/response properties are redacted automatically before being attached to the `AccessioError`.
 
 ```typescript
-// Add a request interceptor
-accessio.interceptors.request.use((config) => {
-  config.headers['Authorization'] = `Bearer ${storage.getToken()}`;
-  return config;
-});
-
-// Add a response interceptor
-accessio.interceptors.response.use(
-  (response) => response,
-  (error) => {
-    if (error.response?.status === 401) logout();
-    return Promise.reject(error);
-  },
-);
+try {
+  await accessio.get('https://admin:secret_password@api.example.com/users', {
+    params: { api_key: 'super_secret_token_123' },
+    headers: { Authorization: 'Bearer token_xyz' },
+  });
+} catch (error) {
+  if (accessio.isAccessioError(error)) {
+    console.error(error.toJSON());
+    /*
+      Outputs:
+      {
+        "name": "AccessioError",
+        "message": "Request failed with status code 401",
+        "code": "ERR_BAD_REQUEST",
+        "status": 401,
+        "config": {
+          "url": "https://admin:[REDACTED]@api.example.com/users",
+          "params": {
+            "api_key": "[REDACTED]"
+          },
+          "headers": {
+            "authorization": "[REDACTED]"
+          }
+        }
+      }
+    */
+  }
+}
 ```
 
-### Error Handling
-
-`Accessio` provides a structured error object with specific codes to help you handle failures gracefully.
+### 🔁 Automatic Retries & Backoff
 
-| Code               | Description                   |
-| :----------------- | :---------------------------- |
-| `ERR_BAD_REQUEST`  | 4xx status code               |
-| `ERR_BAD_RESPONSE` | 5xx status code               |
-| `ERR_NETWORK`      | Network connectivity issues   |
-| `ETIMEDOUT`        | Request exceeded timeout      |
-| `ERR_CANCELED`     | Request was manually aborted  |
-| `ERR_INVALID_URL`  | The provided URL is malformed |
-| `ERR_BAD_OPTION`   | Invalid configuration option  |
-
-### Automatic Retries
-
-`Accessio` includes a powerful retry mechanism that handles network errors and 5xx responses automatically.
+Automatically retry failed requests using exponential backoff with randomized jitter to prevent thundering herds.
 
 ```typescript
 const response = await accessio.get('/flaky-endpoint', {
-  retry: 5,
-  retryDelay: 1000, // Delays: 1s, 2s, 4s, 8s, 16s (+/- random jitter)
-  onRetry: (attempt, error) => console.log(`Retry #${attempt}...`),
+  retry: 3, // Max retry attempts
+  retryDelay: 1000, // Initial delay in ms (doubles each attempt)
+  maxRetryDelay: 10000, // Maximum delay cap
+  retryOn429: true, // Respect Retry-After header for HTTP 429 responses
+  onRetry: (attempt, error, config) => {
+    console.warn(`Retry attempt #${attempt} due to: ${error.message}`);
+  },
 });
 ```
 
-### Rate Limiting
+### ⏳ Concurrency Rate Limiting
 
-Limit concurrent requests globally or per-instance to prevent overloading APIs.
+Throttle outbound requests using a queue-based rate limiter. This is especially useful for third-party APIs with tight request limits.
 
 ```typescript
-import { createRateLimiter } from 'accessio';
+import accessio, { createRateLimiter } from 'accessio';
+
+// Allow a maximum of 2 requests in parallel
+const rateLimiter = createRateLimiter(2);
 
-const limiter = createRateLimiter(5); // Max 5 concurrent requests
-const api = accessio.create({ rateLimiter: limiter });
+const api = accessio.create({ rateLimiter });
 
-// Requests will wait in queue if limit is reached
-const results = await Promise.all([
-  api.get('/req-1'),
-  api.get('/req-2'),
-  // ...
-]);
+// These will run with a max concurrency of 2, queueing the rest
+const requests = [1, 2, 3, 4, 5].map((id) => api.get(`/users/${id}`));
+const responses = await Promise.all(requests);
 ```
 
-### Debug Mode
+### 🌊 SSE & Newline JSON Streaming
 
-Get beautiful, structured logs in your console by enabling `debug: true`.
+Accessio leverages asynchronous generators to handle incoming response streams dynamically (works with Server-Sent Events or line-by-line JSON streams).
 
 ```typescript
-// 🐦‍⬛ [accessio] → GET https://api.example.com/users
-//    Params: {"page":1}
-//    Timeout: 5000ms
-// 🐦‍⬛ [accessio] ← ✅ 200 OK (142ms)
-//    Size: ~3.2 KB
+// Iterating through an AI completion SSE stream
+for await (const chunk of api.stream('/ai/complete')) {
+  console.log(chunk); // Parsed JSON chunk, e.g., { text: "hello" }
+}
 ```
 
-### Caching & Deduplication
+### 📂 Auto-Pagination
 
-Prevent duplicate requests and cache responses to improve performance.
+Avoid boilerplate code for pagination. Accessio can auto-follow `next` and `links.next` properties automatically:
 
 ```typescript
-const api = accessio.create({
-  dedupe: true, // Prevents identical requests while one is pending
-  cache: true, // Caches responses in memory
-  cacheTTL: 5 * 60 * 1000, // Cache for 5 minutes
-});
+// Automatically fetches subsequent pages until next link is null
+for await (const item of api.autoPaginate('/users?page=1')) {
+  console.log(item.name); // Yields individual items from each page's items array
+}
 ```
 
-### Schema Validation
+### 🧪 Runtime Schema Validation
 
-Automatically parse and validate responses using libraries like Zod.
+Validate your API payloads at runtime using your favorite validation library (e.g., Zod, ArkType, Superstruct).
 
 ```typescript
 import { z } from 'zod';
 
-const userSchema = z.object({ id: z.number(), name: z.string() });
-
-const response = await accessio.get('/user/1', { schema: userSchema });
-// response.data is strictly typed and validated against userSchema
-```
-
-### Server-Sent Events (SSE)
+const UserSchema = z.object({
+  id: z.string(),
+  name: z.string(),
+  email: z.string().email(),
+});
 
-Easily consume SSE streams using async iterators.
+const response = await api.get('/users/123', {
+  schema: UserSchema, // Throws AccessioError (ERR_BAD_RESPONSE) if validation fails
+});
 
-```typescript
-for await (const chunk of accessio.stream('/stream')) {
-  console.log(chunk); // Parsed JSON or string data from SSE
-}
+const user = response.data; // Fully typed as { id: string; name: string; email: string }
 ```
 
-### Auto-Pagination
+### 📦 Request Deduplication & Caching
 
-Iterate through paginated endpoints effortlessly.
+Optimize application performance by preventing duplicate queries and utilizing caching.
 
 ```typescript
-for await (const user of accessio.autoPaginate('/users')) {
-  console.log(user); // Automatically fetches the next page when needed
-}
+const api = accessio.create({
+  dedupe: true, // Merge concurrent requests targeting the same endpoint
+  cache: true, // Enable in-memory cache
+  cacheTTL: 60000, // Cache responses for 60 seconds
+});
+
+// Executes exactly 1 network call, resolves both promises
+const [res1, res2] = await Promise.all([api.get('/heavy-report'), api.get('/heavy-report')]);
 ```
 
-### GraphQL
+### 🔗 Interceptors & Hooks
 
-Send GraphQL queries and mutations with ease.
+Modify requests and responses at runtime, or listen to client lifecycles:
 
 ```typescript
-const query = `
-  query GetUser($id: ID!) {
-    user(id: $id) { name, email }
-  }
-`;
-
-const response = await accessio.gql('/graphql', query, { id: '1' });
-```
+const api = accessio.create();
 
-### Lifecycle Hooks
-
-Use hooks for simple global or request-specific event handling.
+// Add Request Interceptor
+api.interceptors.request.use((config) => {
+  config.headers = config.headers || {};
+  config.headers['X-Request-Timestamp'] = Date.now().toString();
+  return config;
+});
 
-```typescript
-accessio.create({
-  hooks: {
-    onBeforeRequest: (config) => console.log('Starting request...'),
-    onRequestResponse: (response) => console.log('Request succeeded!'),
-    onRequestError: (error) => console.error('Request failed!'),
+// Add Response Interceptor
+api.interceptors.response.use(
+  (response) => {
+    // Modify output data
+    return response;
   },
-});
+  (error) => {
+    // Handle global errors (e.g. token refresh)
+    return Promise.reject(error);
+  },
+);
 ```
 
 ---
 
-## 🛠️ Developer Guide
-
-### Local Setup
-
-```bash
-git clone https://github.com/salvatorecorvaglia/accessio.git
-cd accessio
-npm install
-```
-
-### Available Scripts
-
-- `npm run build`: Generate CommonJS bundles
-- `npm run test`: Run the full test suite with Vitest
-- `npm run test:coverage`: Run tests with coverage report
-- `npm run test:browser`: Run tests in browser environment
-- `npm run lint`: Check for code style issues
-- `npm run format`: Automatically format the codebase with Prettier
-- `npm run typecheck`: Validate TypeScript types
+## ⚙️ Configuration Options
+
+Here is the complete list of config parameters available in `AccessioRequestConfig`:
+
+| Option             | Type                                                      | Default               | Description                                                                    |
+| :----------------- | :-------------------------------------------------------- | :-------------------- | :----------------------------------------------------------------------------- |
+| `baseURL`          | `string`                                                  | `undefined`           | Prepended to relative URLs.                                                    |
+| `method`           | `string`                                                  | `'get'`               | HTTP request method (e.g., `'get'`, `'post'`).                                 |
+| `headers`          | `Record`                                                  | `{}`                  | Key-value mapping of custom headers.                                           |
+| `params`           | `Record`                                                  | `undefined`           | Query parameters appended to the URL.                                          |
+| `data`             | `any`                                                     | `undefined`           | The payload to send in the request body.                                       |
+| `timeout`          | `number`                                                  | `0` (disabled)        | Request timeout in milliseconds.                                               |
+| `responseType`     | `'json' \| 'text' \| 'blob' \| 'arraybuffer' \| 'stream'` | `'json'`              | Expected format of the response data.                                          |
+| `retry`            | `number`                                                  | `0`                   | Number of times to retry failed requests.                                      |
+| `retryDelay`       | `number`                                                  | `1000`                | Initial delay for exponential backoff (ms).                                    |
+| `retryOn429`       | `boolean`                                                 | `false`               | Automatically retry on 429 using the `Retry-After` header.                     |
+| `rateLimiter`      | `RateLimiter`                                             | `undefined`           | A rate limiter instance to enqueue requests.                                   |
+| `dedupe`           | `boolean`                                                 | `false`               | Coalesce concurrent duplicate GET requests.                                    |
+| `cache`            | `boolean \| CacheProvider`                                | `false`               | Enable caching using memory or custom provider.                                |
+| `cacheTTL`         | `number`                                                  | `undefined`           | TTL for cached responses in ms.                                                |
+| `schema`           | `SchemaValidator`                                         | `undefined`           | Zod/schema parser to validate response body.                                   |
+| `hooks`            | `AccessioHooks`                                           | `undefined`           | Lifecycle callbacks: `onBeforeRequest`, `onRequestResponse`, `onRequestError`. |
+| `allowedProtocols` | `string[] \| null`                                        | `['http:', 'https:']` | Protocols allowed for requesting. Set to `null` to disable check.              |
 
 ---
 

package/cjs/core/accessioError.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/accessioError.ts"],"sourcesContent":["import ErrorCodes from '../constants/errorCodes';\nimport type { AccessioRequestConfig, AccessioResponse } from '../types';\n\nfunction redactHeaders(headers: unknown): unknown {\n  if (!headers || typeof headers !== 'object') return headers;\n  const out: Record<string, unknown> = {};\n  for (const key of Object.keys(headers as Record<string, unknown>)) {\n    const value = (headers as Record<string, unknown>)[key];\n    if (/^authorization$/i.test(key) || /^cookie$/i.test(key) || /^set-cookie$/i.test(key)) {\n      out[key] = '[REDACTED]';\n    } else if (value && typeof value === 'object' && !Array.isArray(value)) {\n      out[key] = redactHeaders(value);\n    } else {\n      out[key] = value;\n    }\n  }\n  return out;\n}\n\nconst SENSITIVE_BODY_KEY =\n  /^(password|passwd|pwd|token|access_token|refresh_token|id_token|authorization|api[_-]?key|secret|client[_-]?secret|cookie|set[_-]?cookie|private[_-]?key|session)$/i;\n\nexport function redactBody(value: unknown, seen?: WeakSet<object>): unknown {\n  if (value === null || typeof value !== 'object') return value;\n  const visited = seen ?? new WeakSet<object>();\n  if (visited.has(value as object)) return '[Circular]';\n  visited.add(value as object);\n\n  if (Array.isArray(value)) {\n    return value.map((item) => redactBody(item, visited));\n  }\n\n  const out: Record<string, unknown> = {};\n  for (const key of Object.keys(value as Record<string, unknown>)) {\n    const v = (value as Record<string, unknown>)[key];\n    if (SENSITIVE_BODY_KEY.test(key)) {\n      out[key] = '[REDACTED]';\n    } else {\n      out[key] = redactBody(v, visited);\n    }\n  }\n  return out;\n}\n\nfunction redactParams(params: unknown): unknown {\n  if (!params || typeof params !== 'object') return params;\n  const out: Record<string, unknown> = {};\n  for (const key of Object.keys(params as Record<string, unknown>)) {\n    const value = (params as Record<string, unknown>)[key];\n    if (SENSITIVE_BODY_KEY.test(key)) {\n      out[key] = '[REDACTED]';\n    } else if (value && typeof value === 'object' && !Array.isArray(value)) {\n      out[key] = redactParams(value);\n    } else {\n      out[key] = value;\n    }\n  }\n  return out;\n}\n\nfunction redactURL(url: string | undefined): string | undefined {\n  if (!url) return url;\n  // Match inline credentials: http://user:pass@host\n  return url.replace(/^([a-z][a-z\\d+\\-.]*:\\/\\/)([^/]+)@/i, (match, protocol, userInfo) => {\n    const parts = userInfo.split(':');\n    if (parts.length > 1) {\n      return `${protocol}${parts[0]}:[REDACTED]@`;\n    }\n    return `${protocol}[REDACTED]@`;\n  });\n}\n\nexport function redactConfig(config: AccessioRequestConfig | null): AccessioRequestConfig | null {\n  if (!config) return config;\n  const clone = { ...config } as AccessioRequestConfig & { auth?: unknown };\n  if ('auth' in clone) delete clone.auth;\n  if (clone.headers) clone.headers = redactHeaders(clone.headers) as typeof clone.headers;\n  if (clone.params) clone.params = redactParams(clone.params) as typeof clone.params;\n  if (clone.url) clone.url = redactURL(clone.url);\n  if (clone._builtUrl) clone._builtUrl = redactURL(clone._builtUrl);\n  return clone;\n}\n\nexport class AccessioError extends Error {\n  static ERR_BAD_OPTION_VALUE: string = ErrorCodes.ERR_BAD_OPTION_VALUE;\n  static ERR_BAD_OPTION: string = ErrorCodes.ERR_BAD_OPTION;\n  static ECONNABORTED: string = ErrorCodes.ECONNABORTED;\n  static ETIMEDOUT: string = ErrorCodes.ETIMEDOUT;\n  static ERR_NETWORK: string = ErrorCodes.ERR_NETWORK;\n  static ERR_FR_TOO_MANY_REDIRECTS: string = ErrorCodes.ERR_FR_TOO_MANY_REDIRECTS;\n  static ERR_BAD_RESPONSE: string = ErrorCodes.ERR_BAD_RESPONSE;\n  static ERR_BAD_REQUEST: string = ErrorCodes.ERR_BAD_REQUEST;\n  static ERR_CANCELED: string = ErrorCodes.ERR_CANCELED;\n  static ERR_NOT_SUPPORT: string = ErrorCodes.ERR_NOT_SUPPORT;\n  static ERR_INVALID_URL: string = ErrorCodes.ERR_INVALID_URL;\n\n  readonly code: string | null;\n  readonly config: AccessioRequestConfig | null;\n  readonly request: unknown;\n  readonly response: AccessioResponse | null;\n  readonly isAccessioError: true;\n  cause?: Error;\n  override name = 'AccessioError' as const;\n\n  constructor(\n    message: string,\n    code: string | null,\n    config: AccessioRequestConfig | null,\n    request: unknown,\n    response: AccessioResponse | null,\n  ) {\n    super(message);\n    this.name = 'AccessioError';\n    this.code = code ?? null;\n    this.config = redactConfig(config ?? null);\n    this.request = request ?? null;\n    this.response = response ?? null;\n    this.isAccessioError = true;\n\n    if (Error.captureStackTrace) {\n      Error.captureStackTrace(this, AccessioError);\n    }\n  }\n\n  toJSON(): Record<string, unknown> {\n    return {\n      name: this.name,\n      message: this.message,\n      code: this.code,\n      status: this.response ? this.response.status : null,\n      config: this.config,\n    };\n  }\n\n  static from(\n    error: Error,\n    code: string,\n    config: AccessioRequestConfig | null,\n    request: unknown,\n    response: AccessioResponse | null,\n  ): AccessioError {\n    const accessioError = new AccessioError(error.message, code, config, request, response);\n    accessioError.cause = error;\n    accessioError.stack = error.stack;\n    return accessioError;\n  }\n}\n\nexport default AccessioError;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,wBAAuB;AAGvB,SAAS,cAAc,SAA2B;AAChD,MAAI,CAAC,WAAW,OAAO,YAAY,SAAU,QAAO;AACpD,QAAM,MAA+B,CAAC;AACtC,aAAW,OAAO,OAAO,KAAK,OAAkC,GAAG;AACjE,UAAM,QAAS,QAAoC,GAAG;AACtD,QAAI,mBAAmB,KAAK,GAAG,KAAK,YAAY,KAAK,GAAG,KAAK,gBAAgB,KAAK,GAAG,GAAG;AACtF,UAAI,GAAG,IAAI;AAAA,IACb,WAAW,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,GAAG;AACtE,UAAI,GAAG,IAAI,cAAc,KAAK;AAAA,IAChC,OAAO;AACL,UAAI,GAAG,IAAI;AAAA,IACb;AAAA,EACF;AACA,SAAO;AACT;AAEA,MAAM,qBACJ;AAEK,SAAS,WAAW,OAAgB,MAAiC;AAC1E,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AACxD,QAAM,UAAU,QAAQ,oBAAI,QAAgB;AAC5C,MAAI,QAAQ,IAAI,KAAe,EAAG,QAAO;AACzC,UAAQ,IAAI,KAAe;AAE3B,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,IAAI,CAAC,SAAS,WAAW,MAAM,OAAO,CAAC;AAAA,EACtD;AAEA,QAAM,MAA+B,CAAC;AACtC,aAAW,OAAO,OAAO,KAAK,KAAgC,GAAG;AAC/D,UAAM,IAAK,MAAkC,GAAG;AAChD,QAAI,mBAAmB,KAAK,GAAG,GAAG;AAChC,UAAI,GAAG,IAAI;AAAA,IACb,OAAO;AACL,UAAI,GAAG,IAAI,WAAW,GAAG,OAAO;AAAA,IAClC;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aAAa,QAA0B;AAC9C,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,QAAM,MAA+B,CAAC;AACtC,aAAW,OAAO,OAAO,KAAK,MAAiC,GAAG;AAChE,UAAM,QAAS,OAAmC,GAAG;AACrD,QAAI,mBAAmB,KAAK,GAAG,GAAG;AAChC,UAAI,GAAG,IAAI;AAAA,IACb,WAAW,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,GAAG;AACtE,UAAI,GAAG,IAAI,aAAa,KAAK;AAAA,IAC/B,OAAO;AACL,UAAI,GAAG,IAAI;AAAA,IACb;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,UAAU,KAA6C;AAC9D,MAAI,CAAC,IAAK,QAAO;AAEjB,SAAO,IAAI,QAAQ,sCAAsC,CAAC,OAAO,UAAU,aAAa;AACtF,UAAM,QAAQ,SAAS,MAAM,GAAG;AAChC,QAAI,MAAM,SAAS,GAAG;AACpB,aAAO,GAAG,QAAQ,GAAG,MAAM,CAAC,CAAC;AAAA,IAC/B;AACA,WAAO,GAAG,QAAQ;AAAA,EACpB,CAAC;AACH;AAEO,SAAS,aAAa,QAAoE;AAC/F,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,EAAE,GAAG,OAAO;AAC1B,MAAI,UAAU,MAAO,QAAO,MAAM;AAClC,MAAI,MAAM,QAAS,OAAM,UAAU,cAAc,MAAM,OAAO;AAC9D,MAAI,MAAM,OAAQ,OAAM,SAAS,aAAa,MAAM,MAAM;AAC1D,MAAI,MAAM,IAAK,OAAM,MAAM,UAAU,MAAM,GAAG;AAC9C,MAAI,MAAM,UAAW,OAAM,YAAY,UAAU,MAAM,SAAS;AAChE,SAAO;AACT;AAEO,MAAM,sBAAsB,MAAM;AAAA,EACvC,OAAO,uBAA+B,kBAAAA,QAAW;AAAA,EACjD,OAAO,iBAAyB,kBAAAA,QAAW;AAAA,EAC3C,OAAO,eAAuB,kBAAAA,QAAW;AAAA,EACzC,OAAO,YAAoB,kBAAAA,QAAW;AAAA,EACtC,OAAO,cAAsB,kBAAAA,QAAW;AAAA,EACxC,OAAO,4BAAoC,kBAAAA,QAAW;AAAA,EACtD,OAAO,mBAA2B,kBAAAA,QAAW;AAAA,EAC7C,OAAO,kBAA0B,kBAAAA,QAAW;AAAA,EAC5C,OAAO,eAAuB,kBAAAA,QAAW;AAAA,EACzC,OAAO,kBAA0B,kBAAAA,QAAW;AAAA,EAC5C,OAAO,kBAA0B,kBAAAA,QAAW;AAAA,EAEnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT;AAAA,EACS,OAAO;AAAA,EAEhB,YACE,SACA,MACA,QACA,SACA,UACA;AACA,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO,QAAQ;AACpB,SAAK,SAAS,aAAa,UAAU,IAAI;AACzC,SAAK,UAAU,WAAW;AAC1B,SAAK,WAAW,YAAY;AAC5B,SAAK,kBAAkB;AAEvB,QAAI,MAAM,mBAAmB;AAC3B,YAAM,kBAAkB,MAAM,aAAa;AAAA,IAC7C;AAAA,EACF;AAAA,EAEA,SAAkC;AAChC,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,SAAS,KAAK;AAAA,MACd,MAAM,KAAK;AAAA,MACX,QAAQ,KAAK,WAAW,KAAK,SAAS,SAAS;AAAA,MAC/C,QAAQ,KAAK;AAAA,IACf;AAAA,EACF;AAAA,EAEA,OAAO,KACL,OACA,MACA,QACA,SACA,UACe;AACf,UAAM,gBAAgB,IAAI,cAAc,MAAM,SAAS,MAAM,QAAQ,SAAS,QAAQ;AACtF,kBAAc,QAAQ;AACtB,kBAAc,QAAQ,MAAM;AAC5B,WAAO;AAAA,EACT;AACF;AAEA,IAAO,wBAAQ;","names":["ErrorCodes"]}
+{"version":3,"sources":["../../src/core/accessioError.ts"],"sourcesContent":["import ErrorCodes from '../constants/errorCodes';\nimport type { AccessioRequestConfig, AccessioResponse } from '../types';\n\nfunction redactHeaders(headers: unknown): unknown {\n  if (!headers || typeof headers !== 'object') return headers;\n  const out: Record<string, unknown> = {};\n  for (const key of Object.keys(headers as Record<string, unknown>)) {\n    const value = (headers as Record<string, unknown>)[key];\n    if (/^authorization$/i.test(key) || /^cookie$/i.test(key) || /^set-cookie$/i.test(key)) {\n      out[key] = '[REDACTED]';\n    } else if (value && typeof value === 'object' && !Array.isArray(value)) {\n      out[key] = redactHeaders(value);\n    } else {\n      out[key] = value;\n    }\n  }\n  return out;\n}\n\nconst SENSITIVE_BODY_KEY =\n  /^(password|passwd|pwd|token|access_token|refresh_token|id_token|authorization|api[_-]?key|secret|client[_-]?secret|cookie|set[_-]?cookie|private[_-]?key|session)$/i;\n\nexport function redactBody(value: unknown, seen?: WeakSet<object>): unknown {\n  if (value === null || typeof value !== 'object') return value;\n  const visited = seen ?? new WeakSet<object>();\n  if (visited.has(value as object)) return '[Circular]';\n  visited.add(value as object);\n\n  if (Array.isArray(value)) {\n    return value.map((item) => redactBody(item, visited));\n  }\n\n  const out: Record<string, unknown> = {};\n  for (const key of Object.keys(value as Record<string, unknown>)) {\n    const v = (value as Record<string, unknown>)[key];\n    if (SENSITIVE_BODY_KEY.test(key)) {\n      out[key] = '[REDACTED]';\n    } else {\n      out[key] = redactBody(v, visited);\n    }\n  }\n  return out;\n}\n\nfunction redactParams(params: unknown): unknown {\n  if (!params || typeof params !== 'object') return params;\n  const out: Record<string, unknown> = {};\n  for (const key of Object.keys(params as Record<string, unknown>)) {\n    const value = (params as Record<string, unknown>)[key];\n    if (SENSITIVE_BODY_KEY.test(key)) {\n      out[key] = '[REDACTED]';\n    } else if (value && typeof value === 'object' && !Array.isArray(value)) {\n      out[key] = redactParams(value);\n    } else {\n      out[key] = value;\n    }\n  }\n  return out;\n}\n\nfunction redactURL(url: string | undefined): string | undefined {\n  if (!url) return url;\n  // Match inline credentials: http://user:pass@host\n  return url.replace(/^([a-z][a-z\\d+\\-.]*:\\/\\/)([^/]+)@/i, (match, protocol, userInfo) => {\n    const parts = userInfo.split(':');\n    if (parts.length > 1) {\n      return `${protocol}${parts[0]}:[REDACTED]@`;\n    }\n    return `${protocol}[REDACTED]@`;\n  });\n}\n\nexport function redactConfig(config: AccessioRequestConfig | null): AccessioRequestConfig | null {\n  if (!config) return config;\n  const clone = { ...config } as AccessioRequestConfig & { auth?: unknown };\n  if ('auth' in clone) delete clone.auth;\n  if (clone.headers) clone.headers = redactHeaders(clone.headers) as typeof clone.headers;\n  if (clone.params) clone.params = redactParams(clone.params) as typeof clone.params;\n  if (clone.url) clone.url = redactURL(clone.url);\n  if (clone._builtUrl) clone._builtUrl = redactURL(clone._builtUrl);\n  return clone;\n}\n\nexport class AccessioError extends Error {\n  static ERR_BAD_OPTION_VALUE: string = ErrorCodes.ERR_BAD_OPTION_VALUE;\n  static ERR_BAD_OPTION: string = ErrorCodes.ERR_BAD_OPTION;\n  static ECONNABORTED: string = ErrorCodes.ECONNABORTED;\n  static ETIMEDOUT: string = ErrorCodes.ETIMEDOUT;\n  static ERR_NETWORK: string = ErrorCodes.ERR_NETWORK;\n  static ERR_FR_TOO_MANY_REDIRECTS: string = ErrorCodes.ERR_FR_TOO_MANY_REDIRECTS;\n  static ERR_BAD_RESPONSE: string = ErrorCodes.ERR_BAD_RESPONSE;\n  static ERR_BAD_REQUEST: string = ErrorCodes.ERR_BAD_REQUEST;\n  static ERR_CANCELED: string = ErrorCodes.ERR_CANCELED;\n  static ERR_NOT_SUPPORT: string = ErrorCodes.ERR_NOT_SUPPORT;\n  static ERR_INVALID_URL: string = ErrorCodes.ERR_INVALID_URL;\n\n  readonly code: string | null;\n  readonly config: AccessioRequestConfig | null;\n  readonly request: unknown;\n  readonly response: AccessioResponse | null;\n  readonly isAccessioError: true;\n  cause?: Error;\n  override name = 'AccessioError' as const;\n\n  constructor(\n    message: string,\n    code: string | null,\n    config: AccessioRequestConfig | null,\n    request: unknown,\n    response: AccessioResponse | null,\n  ) {\n    super(message);\n    this.name = 'AccessioError';\n    this.code = code ?? null;\n    this.config = redactConfig(config ?? null);\n    this.request = request ?? null;\n    this.response = response ?? null;\n    this.isAccessioError = true;\n\n    if ((Error as any).captureStackTrace) {\n      (Error as any).captureStackTrace(this, AccessioError);\n    }\n  }\n\n  toJSON(): Record<string, unknown> {\n    return {\n      name: this.name,\n      message: this.message,\n      code: this.code,\n      status: this.response ? this.response.status : null,\n      config: this.config,\n    };\n  }\n\n  static from(\n    error: Error,\n    code: string,\n    config: AccessioRequestConfig | null,\n    request: unknown,\n    response: AccessioResponse | null,\n  ): AccessioError {\n    const accessioError = new AccessioError(error.message, code, config, request, response);\n    accessioError.cause = error;\n    accessioError.stack = error.stack;\n    return accessioError;\n  }\n}\n\nexport default AccessioError;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,wBAAuB;AAGvB,SAAS,cAAc,SAA2B;AAChD,MAAI,CAAC,WAAW,OAAO,YAAY,SAAU,QAAO;AACpD,QAAM,MAA+B,CAAC;AACtC,aAAW,OAAO,OAAO,KAAK,OAAkC,GAAG;AACjE,UAAM,QAAS,QAAoC,GAAG;AACtD,QAAI,mBAAmB,KAAK,GAAG,KAAK,YAAY,KAAK,GAAG,KAAK,gBAAgB,KAAK,GAAG,GAAG;AACtF,UAAI,GAAG,IAAI;AAAA,IACb,WAAW,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,GAAG;AACtE,UAAI,GAAG,IAAI,cAAc,KAAK;AAAA,IAChC,OAAO;AACL,UAAI,GAAG,IAAI;AAAA,IACb;AAAA,EACF;AACA,SAAO;AACT;AAEA,MAAM,qBACJ;AAEK,SAAS,WAAW,OAAgB,MAAiC;AAC1E,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AACxD,QAAM,UAAU,QAAQ,oBAAI,QAAgB;AAC5C,MAAI,QAAQ,IAAI,KAAe,EAAG,QAAO;AACzC,UAAQ,IAAI,KAAe;AAE3B,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,IAAI,CAAC,SAAS,WAAW,MAAM,OAAO,CAAC;AAAA,EACtD;AAEA,QAAM,MAA+B,CAAC;AACtC,aAAW,OAAO,OAAO,KAAK,KAAgC,GAAG;AAC/D,UAAM,IAAK,MAAkC,GAAG;AAChD,QAAI,mBAAmB,KAAK,GAAG,GAAG;AAChC,UAAI,GAAG,IAAI;AAAA,IACb,OAAO;AACL,UAAI,GAAG,IAAI,WAAW,GAAG,OAAO;AAAA,IAClC;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aAAa,QAA0B;AAC9C,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,QAAM,MAA+B,CAAC;AACtC,aAAW,OAAO,OAAO,KAAK,MAAiC,GAAG;AAChE,UAAM,QAAS,OAAmC,GAAG;AACrD,QAAI,mBAAmB,KAAK,GAAG,GAAG;AAChC,UAAI,GAAG,IAAI;AAAA,IACb,WAAW,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,GAAG;AACtE,UAAI,GAAG,IAAI,aAAa,KAAK;AAAA,IAC/B,OAAO;AACL,UAAI,GAAG,IAAI;AAAA,IACb;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,UAAU,KAA6C;AAC9D,MAAI,CAAC,IAAK,QAAO;AAEjB,SAAO,IAAI,QAAQ,sCAAsC,CAAC,OAAO,UAAU,aAAa;AACtF,UAAM,QAAQ,SAAS,MAAM,GAAG;AAChC,QAAI,MAAM,SAAS,GAAG;AACpB,aAAO,GAAG,QAAQ,GAAG,MAAM,CAAC,CAAC;AAAA,IAC/B;AACA,WAAO,GAAG,QAAQ;AAAA,EACpB,CAAC;AACH;AAEO,SAAS,aAAa,QAAoE;AAC/F,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,EAAE,GAAG,OAAO;AAC1B,MAAI,UAAU,MAAO,QAAO,MAAM;AAClC,MAAI,MAAM,QAAS,OAAM,UAAU,cAAc,MAAM,OAAO;AAC9D,MAAI,MAAM,OAAQ,OAAM,SAAS,aAAa,MAAM,MAAM;AAC1D,MAAI,MAAM,IAAK,OAAM,MAAM,UAAU,MAAM,GAAG;AAC9C,MAAI,MAAM,UAAW,OAAM,YAAY,UAAU,MAAM,SAAS;AAChE,SAAO;AACT;AAEO,MAAM,sBAAsB,MAAM;AAAA,EACvC,OAAO,uBAA+B,kBAAAA,QAAW;AAAA,EACjD,OAAO,iBAAyB,kBAAAA,QAAW;AAAA,EAC3C,OAAO,eAAuB,kBAAAA,QAAW;AAAA,EACzC,OAAO,YAAoB,kBAAAA,QAAW;AAAA,EACtC,OAAO,cAAsB,kBAAAA,QAAW;AAAA,EACxC,OAAO,4BAAoC,kBAAAA,QAAW;AAAA,EACtD,OAAO,mBAA2B,kBAAAA,QAAW;AAAA,EAC7C,OAAO,kBAA0B,kBAAAA,QAAW;AAAA,EAC5C,OAAO,eAAuB,kBAAAA,QAAW;AAAA,EACzC,OAAO,kBAA0B,kBAAAA,QAAW;AAAA,EAC5C,OAAO,kBAA0B,kBAAAA,QAAW;AAAA,EAEnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT;AAAA,EACS,OAAO;AAAA,EAEhB,YACE,SACA,MACA,QACA,SACA,UACA;AACA,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO,QAAQ;AACpB,SAAK,SAAS,aAAa,UAAU,IAAI;AACzC,SAAK,UAAU,WAAW;AAC1B,SAAK,WAAW,YAAY;AAC5B,SAAK,kBAAkB;AAEvB,QAAK,MAAc,mBAAmB;AACpC,MAAC,MAAc,kBAAkB,MAAM,aAAa;AAAA,IACtD;AAAA,EACF;AAAA,EAEA,SAAkC;AAChC,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,SAAS,KAAK;AAAA,MACd,MAAM,KAAK;AAAA,MACX,QAAQ,KAAK,WAAW,KAAK,SAAS,SAAS;AAAA,MAC/C,QAAQ,KAAK;AAAA,IACf;AAAA,EACF;AAAA,EAEA,OAAO,KACL,OACA,MACA,QACA,SACA,UACe;AACf,UAAM,gBAAgB,IAAI,cAAc,MAAM,SAAS,MAAM,QAAQ,SAAS,QAAQ;AACtF,kBAAc,QAAQ;AACtB,kBAAc,QAAQ,MAAM;AAC5B,WAAO;AAAA,EACT;AACF;AAEA,IAAO,wBAAQ;","names":["ErrorCodes"]}

package/cjs/core/buildURL.cjs

@@ -84,15 +84,18 @@ function buildURL(url, baseURL, params, paramsSerializer) {
       if (key === "__proto__" || key === "prototype" || key === "constructor") continue;
       unusedParams[key] = params[key];
     }
-    fullURL = fullURL.replace(/(?::([a-zA-Z0-9_]+))|(?:{([a-zA-Z0-9_]+)})/g, (match, p1, p2) => {
-      const key = p1 || p2;
-      if (key && Object.prototype.hasOwnProperty.call(unusedParams, key) && unusedParams[key] !== void 0) {
-        const val = unusedParams[key];
-        delete unusedParams[key];
-        return encodeURIComponent(String(val));
+    fullURL = fullURL.replace(
+      /(?::([a-zA-Z_][a-zA-Z0-9_]*))|(?:{([a-zA-Z_][a-zA-Z0-9_]*)})/g,
+      (match, p1, p2) => {
+        const key = p1 || p2;
+        if (key && Object.prototype.hasOwnProperty.call(unusedParams, key) && unusedParams[key] !== void 0) {
+          const val = unusedParams[key];
+          delete unusedParams[key];
+          return encodeURIComponent(String(val));
+        }
+        return match;
       }
-      return match;
-    });
+    );
     finalParams = unusedParams;
   }
   const serialized = serializeParams(finalParams, paramsSerializer);

package/cjs/core/buildURL.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/buildURL.ts"],"sourcesContent":["import type { ParamsSerializer } from '../types';\n\nfunction serializeParams(\n  params: Record<string, unknown>,\n  paramsSerializer?: ParamsSerializer,\n): string {\n  if (!params) return '';\n\n  if (typeof paramsSerializer === 'function') {\n    return paramsSerializer(params);\n  }\n\n  if (typeof URLSearchParams !== 'undefined' && params instanceof URLSearchParams) {\n    return params.toString();\n  }\n\n  const parts: string[] = [];\n\n  function encode(prefix: string, value: unknown): void {\n    if (value === null || value === undefined) {\n      return;\n    }\n\n    if (Array.isArray(value)) {\n      value.forEach((item, index) => {\n        if (typeof item === 'object' && item !== null) {\n          encode(`${prefix}[${index}]`, item);\n        } else {\n          encode(prefix, item);\n        }\n      });\n    } else if (typeof value === 'object' && !(value instanceof Date)) {\n      Object.keys(value as Record<string, unknown>).forEach((key) => {\n        encode(`${prefix}[${key}]`, (value as Record<string, unknown>)[key]);\n      });\n    } else {\n      const encodedValue = value instanceof Date ? value.toISOString() : value;\n      parts.push(`${encodeURIComponent(prefix)}=${encodeURIComponent(encodedValue as string)}`);\n    }\n  }\n\n  Object.keys(params).forEach((key) => {\n    encode(key, params[key]);\n  });\n\n  return parts.join('&');\n}\n\nfunction combineURLs(baseURL: string, relativeURL: string): string {\n  if (!baseURL) return relativeURL || '';\n  if (!relativeURL) return baseURL;\n\n  let base = baseURL;\n  while (base.endsWith('/')) {\n    base = base.slice(0, -1);\n  }\n\n  let relative = relativeURL;\n  while (relative.startsWith('/')) {\n    relative = relative.slice(1);\n  }\n\n  return `${base}/${relative}`;\n}\n\nfunction isAbsoluteURL(url: string): boolean {\n  return /^([a-z][a-z\\d+\\-.]*:)/i.test(url);\n}\n\nexport default function buildURL(\n  url: string,\n  baseURL?: string,\n  params?: Record<string, unknown>,\n  paramsSerializer?: ParamsSerializer,\n): string {\n  let fullURL = baseURL && !isAbsoluteURL(url) ? combineURLs(baseURL, url) : url || '';\n\n  let finalParams = params;\n  if (params && typeof params === 'object' && !(params instanceof URLSearchParams)) {\n    const unusedParams: Record<string, unknown> = {};\n    for (const key of Object.keys(params)) {\n      if (key === '__proto__' || key === 'prototype' || key === 'constructor') continue;\n      unusedParams[key] = (params as Record<string, unknown>)[key];\n    }\n    fullURL = fullURL.replace(/(?::([a-zA-Z0-9_]+))|(?:{([a-zA-Z0-9_]+)})/g, (match, p1, p2) => {\n      const key = p1 || p2;\n      if (\n        key &&\n        Object.prototype.hasOwnProperty.call(unusedParams, key) &&\n        unusedParams[key] !== undefined\n      ) {\n        const val = unusedParams[key];\n        delete unusedParams[key];\n        return encodeURIComponent(String(val));\n      }\n      return match;\n    });\n    finalParams = unusedParams;\n  }\n\n  const serialized = serializeParams(finalParams as Record<string, unknown>, paramsSerializer);\n  if (serialized) {\n    const hashIndex = fullURL.indexOf('#');\n    let fragment = '';\n    if (hashIndex !== -1) {\n      fragment = fullURL.slice(hashIndex);\n      fullURL = fullURL.slice(0, hashIndex);\n    }\n    fullURL += (fullURL.indexOf('?') === -1 ? '?' : '&') + serialized + fragment;\n  }\n\n  return fullURL;\n}\n\nexport { serializeParams, combineURLs, isAbsoluteURL };\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,SAAS,gBACP,QACA,kBACQ;AACR,MAAI,CAAC,OAAQ,QAAO;AAEpB,MAAI,OAAO,qBAAqB,YAAY;AAC1C,WAAO,iBAAiB,MAAM;AAAA,EAChC;AAEA,MAAI,OAAO,oBAAoB,eAAe,kBAAkB,iBAAiB;AAC/E,WAAO,OAAO,SAAS;AAAA,EACzB;AAEA,QAAM,QAAkB,CAAC;AAEzB,WAAS,OAAO,QAAgB,OAAsB;AACpD,QAAI,UAAU,QAAQ,UAAU,QAAW;AACzC;AAAA,IACF;AAEA,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,YAAM,QAAQ,CAAC,MAAM,UAAU;AAC7B,YAAI,OAAO,SAAS,YAAY,SAAS,MAAM;AAC7C,iBAAO,GAAG,MAAM,IAAI,KAAK,KAAK,IAAI;AAAA,QACpC,OAAO;AACL,iBAAO,QAAQ,IAAI;AAAA,QACrB;AAAA,MACF,CAAC;AAAA,IACH,WAAW,OAAO,UAAU,YAAY,EAAE,iBAAiB,OAAO;AAChE,aAAO,KAAK,KAAgC,EAAE,QAAQ,CAAC,QAAQ;AAC7D,eAAO,GAAG,MAAM,IAAI,GAAG,KAAM,MAAkC,GAAG,CAAC;AAAA,MACrE,CAAC;AAAA,IACH,OAAO;AACL,YAAM,eAAe,iBAAiB,OAAO,MAAM,YAAY,IAAI;AACnE,YAAM,KAAK,GAAG,mBAAmB,MAAM,CAAC,IAAI,mBAAmB,YAAsB,CAAC,EAAE;AAAA,IAC1F;AAAA,EACF;AAEA,SAAO,KAAK,MAAM,EAAE,QAAQ,CAAC,QAAQ;AACnC,WAAO,KAAK,OAAO,GAAG,CAAC;AAAA,EACzB,CAAC;AAED,SAAO,MAAM,KAAK,GAAG;AACvB;AAEA,SAAS,YAAY,SAAiB,aAA6B;AACjE,MAAI,CAAC,QAAS,QAAO,eAAe;AACpC,MAAI,CAAC,YAAa,QAAO;AAEzB,MAAI,OAAO;AACX,SAAO,KAAK,SAAS,GAAG,GAAG;AACzB,WAAO,KAAK,MAAM,GAAG,EAAE;AAAA,EACzB;AAEA,MAAI,WAAW;AACf,SAAO,SAAS,WAAW,GAAG,GAAG;AAC/B,eAAW,SAAS,MAAM,CAAC;AAAA,EAC7B;AAEA,SAAO,GAAG,IAAI,IAAI,QAAQ;AAC5B;AAEA,SAAS,cAAc,KAAsB;AAC3C,SAAO,yBAAyB,KAAK,GAAG;AAC1C;AAEe,SAAR,SACL,KACA,SACA,QACA,kBACQ;AACR,MAAI,UAAU,WAAW,CAAC,cAAc,GAAG,IAAI,YAAY,SAAS,GAAG,IAAI,OAAO;AAElF,MAAI,cAAc;AAClB,MAAI,UAAU,OAAO,WAAW,YAAY,EAAE,kBAAkB,kBAAkB;AAChF,UAAM,eAAwC,CAAC;AAC/C,eAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,UAAI,QAAQ,eAAe,QAAQ,eAAe,QAAQ,cAAe;AACzE,mBAAa,GAAG,IAAK,OAAmC,GAAG;AAAA,IAC7D;AACA,cAAU,QAAQ,QAAQ,+CAA+C,CAAC,OAAO,IAAI,OAAO;AAC1F,YAAM,MAAM,MAAM;AAClB,UACE,OACA,OAAO,UAAU,eAAe,KAAK,cAAc,GAAG,KACtD,aAAa,GAAG,MAAM,QACtB;AACA,cAAM,MAAM,aAAa,GAAG;AAC5B,eAAO,aAAa,GAAG;AACvB,eAAO,mBAAmB,OAAO,GAAG,CAAC;AAAA,MACvC;AACA,aAAO;AAAA,IACT,CAAC;AACD,kBAAc;AAAA,EAChB;AAEA,QAAM,aAAa,gBAAgB,aAAwC,gBAAgB;AAC3F,MAAI,YAAY;AACd,UAAM,YAAY,QAAQ,QAAQ,GAAG;AACrC,QAAI,WAAW;AACf,QAAI,cAAc,IAAI;AACpB,iBAAW,QAAQ,MAAM,SAAS;AAClC,gBAAU,QAAQ,MAAM,GAAG,SAAS;AAAA,IACtC;AACA,gBAAY,QAAQ,QAAQ,GAAG,MAAM,KAAK,MAAM,OAAO,aAAa;AAAA,EACtE;AAEA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../src/core/buildURL.ts"],"sourcesContent":["import type { ParamsSerializer } from '../types';\n\nfunction serializeParams(\n  params: Record<string, unknown>,\n  paramsSerializer?: ParamsSerializer,\n): string {\n  if (!params) return '';\n\n  if (typeof paramsSerializer === 'function') {\n    return paramsSerializer(params);\n  }\n\n  if (typeof URLSearchParams !== 'undefined' && params instanceof URLSearchParams) {\n    return params.toString();\n  }\n\n  const parts: string[] = [];\n\n  function encode(prefix: string, value: unknown): void {\n    if (value === null || value === undefined) {\n      return;\n    }\n\n    if (Array.isArray(value)) {\n      value.forEach((item, index) => {\n        if (typeof item === 'object' && item !== null) {\n          encode(`${prefix}[${index}]`, item);\n        } else {\n          encode(prefix, item);\n        }\n      });\n    } else if (typeof value === 'object' && !(value instanceof Date)) {\n      Object.keys(value as Record<string, unknown>).forEach((key) => {\n        encode(`${prefix}[${key}]`, (value as Record<string, unknown>)[key]);\n      });\n    } else {\n      const encodedValue = value instanceof Date ? value.toISOString() : value;\n      parts.push(`${encodeURIComponent(prefix)}=${encodeURIComponent(encodedValue as string)}`);\n    }\n  }\n\n  Object.keys(params).forEach((key) => {\n    encode(key, params[key]);\n  });\n\n  return parts.join('&');\n}\n\nfunction combineURLs(baseURL: string, relativeURL: string): string {\n  if (!baseURL) return relativeURL || '';\n  if (!relativeURL) return baseURL;\n\n  let base = baseURL;\n  while (base.endsWith('/')) {\n    base = base.slice(0, -1);\n  }\n\n  let relative = relativeURL;\n  while (relative.startsWith('/')) {\n    relative = relative.slice(1);\n  }\n\n  return `${base}/${relative}`;\n}\n\nfunction isAbsoluteURL(url: string): boolean {\n  return /^([a-z][a-z\\d+\\-.]*:)/i.test(url);\n}\n\nexport default function buildURL(\n  url: string,\n  baseURL?: string,\n  params?: Record<string, unknown>,\n  paramsSerializer?: ParamsSerializer,\n): string {\n  let fullURL = baseURL && !isAbsoluteURL(url) ? combineURLs(baseURL, url) : url || '';\n\n  let finalParams = params;\n  if (params && typeof params === 'object' && !(params instanceof URLSearchParams)) {\n    const unusedParams: Record<string, unknown> = {};\n    for (const key of Object.keys(params)) {\n      if (key === '__proto__' || key === 'prototype' || key === 'constructor') continue;\n      unusedParams[key] = (params as Record<string, unknown>)[key];\n    }\n    fullURL = fullURL.replace(\n      /(?::([a-zA-Z_][a-zA-Z0-9_]*))|(?:{([a-zA-Z_][a-zA-Z0-9_]*)})/g,\n      (match, p1, p2) => {\n        const key = p1 || p2;\n        if (\n          key &&\n          Object.prototype.hasOwnProperty.call(unusedParams, key) &&\n          unusedParams[key] !== undefined\n        ) {\n          const val = unusedParams[key];\n          delete unusedParams[key];\n          return encodeURIComponent(String(val));\n        }\n        return match;\n      },\n    );\n    finalParams = unusedParams;\n  }\n\n  const serialized = serializeParams(finalParams as Record<string, unknown>, paramsSerializer);\n  if (serialized) {\n    const hashIndex = fullURL.indexOf('#');\n    let fragment = '';\n    if (hashIndex !== -1) {\n      fragment = fullURL.slice(hashIndex);\n      fullURL = fullURL.slice(0, hashIndex);\n    }\n    fullURL += (fullURL.indexOf('?') === -1 ? '?' : '&') + serialized + fragment;\n  }\n\n  return fullURL;\n}\n\nexport { serializeParams, combineURLs, isAbsoluteURL };\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,SAAS,gBACP,QACA,kBACQ;AACR,MAAI,CAAC,OAAQ,QAAO;AAEpB,MAAI,OAAO,qBAAqB,YAAY;AAC1C,WAAO,iBAAiB,MAAM;AAAA,EAChC;AAEA,MAAI,OAAO,oBAAoB,eAAe,kBAAkB,iBAAiB;AAC/E,WAAO,OAAO,SAAS;AAAA,EACzB;AAEA,QAAM,QAAkB,CAAC;AAEzB,WAAS,OAAO,QAAgB,OAAsB;AACpD,QAAI,UAAU,QAAQ,UAAU,QAAW;AACzC;AAAA,IACF;AAEA,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,YAAM,QAAQ,CAAC,MAAM,UAAU;AAC7B,YAAI,OAAO,SAAS,YAAY,SAAS,MAAM;AAC7C,iBAAO,GAAG,MAAM,IAAI,KAAK,KAAK,IAAI;AAAA,QACpC,OAAO;AACL,iBAAO,QAAQ,IAAI;AAAA,QACrB;AAAA,MACF,CAAC;AAAA,IACH,WAAW,OAAO,UAAU,YAAY,EAAE,iBAAiB,OAAO;AAChE,aAAO,KAAK,KAAgC,EAAE,QAAQ,CAAC,QAAQ;AAC7D,eAAO,GAAG,MAAM,IAAI,GAAG,KAAM,MAAkC,GAAG,CAAC;AAAA,MACrE,CAAC;AAAA,IACH,OAAO;AACL,YAAM,eAAe,iBAAiB,OAAO,MAAM,YAAY,IAAI;AACnE,YAAM,KAAK,GAAG,mBAAmB,MAAM,CAAC,IAAI,mBAAmB,YAAsB,CAAC,EAAE;AAAA,IAC1F;AAAA,EACF;AAEA,SAAO,KAAK,MAAM,EAAE,QAAQ,CAAC,QAAQ;AACnC,WAAO,KAAK,OAAO,GAAG,CAAC;AAAA,EACzB,CAAC;AAED,SAAO,MAAM,KAAK,GAAG;AACvB;AAEA,SAAS,YAAY,SAAiB,aAA6B;AACjE,MAAI,CAAC,QAAS,QAAO,eAAe;AACpC,MAAI,CAAC,YAAa,QAAO;AAEzB,MAAI,OAAO;AACX,SAAO,KAAK,SAAS,GAAG,GAAG;AACzB,WAAO,KAAK,MAAM,GAAG,EAAE;AAAA,EACzB;AAEA,MAAI,WAAW;AACf,SAAO,SAAS,WAAW,GAAG,GAAG;AAC/B,eAAW,SAAS,MAAM,CAAC;AAAA,EAC7B;AAEA,SAAO,GAAG,IAAI,IAAI,QAAQ;AAC5B;AAEA,SAAS,cAAc,KAAsB;AAC3C,SAAO,yBAAyB,KAAK,GAAG;AAC1C;AAEe,SAAR,SACL,KACA,SACA,QACA,kBACQ;AACR,MAAI,UAAU,WAAW,CAAC,cAAc,GAAG,IAAI,YAAY,SAAS,GAAG,IAAI,OAAO;AAElF,MAAI,cAAc;AAClB,MAAI,UAAU,OAAO,WAAW,YAAY,EAAE,kBAAkB,kBAAkB;AAChF,UAAM,eAAwC,CAAC;AAC/C,eAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,UAAI,QAAQ,eAAe,QAAQ,eAAe,QAAQ,cAAe;AACzE,mBAAa,GAAG,IAAK,OAAmC,GAAG;AAAA,IAC7D;AACA,cAAU,QAAQ;AAAA,MAChB;AAAA,MACA,CAAC,OAAO,IAAI,OAAO;AACjB,cAAM,MAAM,MAAM;AAClB,YACE,OACA,OAAO,UAAU,eAAe,KAAK,cAAc,GAAG,KACtD,aAAa,GAAG,MAAM,QACtB;AACA,gBAAM,MAAM,aAAa,GAAG;AAC5B,iBAAO,aAAa,GAAG;AACvB,iBAAO,mBAAmB,OAAO,GAAG,CAAC;AAAA,QACvC;AACA,eAAO;AAAA,MACT;AAAA,IACF;AACA,kBAAc;AAAA,EAChB;AAEA,QAAM,aAAa,gBAAgB,aAAwC,gBAAgB;AAC3F,MAAI,YAAY;AACd,UAAM,YAAY,QAAQ,QAAQ,GAAG;AACrC,QAAI,WAAW;AACf,QAAI,cAAc,IAAI;AACpB,iBAAW,QAAQ,MAAM,SAAS;AAClC,gBAAU,QAAQ,MAAM,GAAG,SAAS;AAAA,IACtC;AACA,gBAAY,QAAQ,QAAQ,GAAG,MAAM,KAAK,MAAM,OAAO,aAAa;AAAA,EACtE;AAEA,SAAO;AACT;","names":[]}

package/cjs/core/mergeConfig.cjs

@@ -45,7 +45,7 @@ function deepMerge(...sources) {
   return result;
 }
 const requestOnlyKeys = /* @__PURE__ */ new Set(["url", "data", "signal"]);
-const deepMergeKeys = /* @__PURE__ */ new Set(["headers"]);
+const deepMergeKeys = /* @__PURE__ */ new Set(["headers", "params", "hooks"]);
 function mergeConfig(config1 = {}, config2 = {}) {
   const merged = /* @__PURE__ */ Object.create(null);
   const allKeys = /* @__PURE__ */ new Set([...Object.keys(config1), ...Object.keys(config2)]);

package/cjs/core/mergeConfig.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/mergeConfig.ts"],"sourcesContent":["import type { AccessioRequestConfig } from '../types';\n\nfunction deepMerge(...sources: any[]): Record<string, any> {\n  const result: Record<string, any> = Object.create(null);\n\n  for (const source of sources) {\n    if (!source || typeof source !== 'object') continue;\n\n    for (const key of Object.keys(source)) {\n      if (key === '__proto__' || key === 'constructor' || key === 'prototype') continue;\n\n      const value = source[key];\n\n      if (value && typeof value === 'object' && !Array.isArray(value)) {\n        if (\n          value instanceof Date ||\n          value instanceof RegExp ||\n          value instanceof Map ||\n          value instanceof Set ||\n          value instanceof Error ||\n          (typeof ArrayBuffer !== 'undefined' && value instanceof ArrayBuffer) ||\n          (typeof Blob !== 'undefined' && value instanceof Blob)\n        ) {\n          result[key] = value;\n        } else if (result[key] && typeof result[key] === 'object' && !Array.isArray(result[key])) {\n          result[key] = deepMerge(result[key], value);\n        } else {\n          result[key] = deepMerge(value);\n        }\n      } else if (value !== undefined) {\n        result[key] = value;\n      }\n    }\n  }\n\n  return result;\n}\n\nconst requestOnlyKeys = new Set<string>(['url', 'data', 'signal']);\nconst deepMergeKeys = new Set<string>(['headers']);\n\nexport default function mergeConfig(\n  config1: AccessioRequestConfig = {},\n  config2: AccessioRequestConfig = {},\n): AccessioRequestConfig {\n  const merged: any = Object.create(null);\n\n  const allKeys = new Set<string>([...Object.keys(config1), ...Object.keys(config2)]);\n\n  for (const key of allKeys) {\n    const val1 = config1[key as keyof AccessioRequestConfig];\n    const val2 = config2[key as keyof AccessioRequestConfig];\n\n    if (requestOnlyKeys.has(key)) {\n      if (val2 !== undefined) {\n        merged[key] = val2;\n      }\n    } else if (deepMergeKeys.has(key)) {\n      merged[key] = deepMerge(val1 || {}, val2 || {});\n    } else {\n      merged[key] = val2 !== undefined ? val2 : val1;\n    }\n  }\n\n  return merged;\n}\n\nexport { deepMerge };\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,SAAS,aAAa,SAAqC;AACzD,QAAM,SAA8B,uBAAO,OAAO,IAAI;AAEtD,aAAW,UAAU,SAAS;AAC5B,QAAI,CAAC,UAAU,OAAO,WAAW,SAAU;AAE3C,eAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,UAAI,QAAQ,eAAe,QAAQ,iBAAiB,QAAQ,YAAa;AAEzE,YAAM,QAAQ,OAAO,GAAG;AAExB,UAAI,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,GAAG;AAC/D,YACE,iBAAiB,QACjB,iBAAiB,UACjB,iBAAiB,OACjB,iBAAiB,OACjB,iBAAiB,SAChB,OAAO,gBAAgB,eAAe,iBAAiB,eACvD,OAAO,SAAS,eAAe,iBAAiB,MACjD;AACA,iBAAO,GAAG,IAAI;AAAA,QAChB,WAAW,OAAO,GAAG,KAAK,OAAO,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,QAAQ,OAAO,GAAG,CAAC,GAAG;AACxF,iBAAO,GAAG,IAAI,UAAU,OAAO,GAAG,GAAG,KAAK;AAAA,QAC5C,OAAO;AACL,iBAAO,GAAG,IAAI,UAAU,KAAK;AAAA,QAC/B;AAAA,MACF,WAAW,UAAU,QAAW;AAC9B,eAAO,GAAG,IAAI;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAEA,MAAM,kBAAkB,oBAAI,IAAY,CAAC,OAAO,QAAQ,QAAQ,CAAC;AACjE,MAAM,gBAAgB,oBAAI,IAAY,CAAC,SAAS,CAAC;AAElC,SAAR,YACL,UAAiC,CAAC,GAClC,UAAiC,CAAC,GACX;AACvB,QAAM,SAAc,uBAAO,OAAO,IAAI;AAEtC,QAAM,UAAU,oBAAI,IAAY,CAAC,GAAG,OAAO,KAAK,OAAO,GAAG,GAAG,OAAO,KAAK,OAAO,CAAC,CAAC;AAElF,aAAW,OAAO,SAAS;AACzB,UAAM,OAAO,QAAQ,GAAkC;AACvD,UAAM,OAAO,QAAQ,GAAkC;AAEvD,QAAI,gBAAgB,IAAI,GAAG,GAAG;AAC5B,UAAI,SAAS,QAAW;AACtB,eAAO,GAAG,IAAI;AAAA,MAChB;AAAA,IACF,WAAW,cAAc,IAAI,GAAG,GAAG;AACjC,aAAO,GAAG,IAAI,UAAU,QAAQ,CAAC,GAAG,QAAQ,CAAC,CAAC;AAAA,IAChD,OAAO;AACL,aAAO,GAAG,IAAI,SAAS,SAAY,OAAO;AAAA,IAC5C;AAAA,EACF;AAEA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../src/core/mergeConfig.ts"],"sourcesContent":["import type { AccessioRequestConfig } from '../types';\n\nfunction deepMerge(...sources: any[]): Record<string, any> {\n  const result: Record<string, any> = Object.create(null);\n\n  for (const source of sources) {\n    if (!source || typeof source !== 'object') continue;\n\n    for (const key of Object.keys(source)) {\n      if (key === '__proto__' || key === 'constructor' || key === 'prototype') continue;\n\n      const value = source[key];\n\n      if (value && typeof value === 'object' && !Array.isArray(value)) {\n        if (\n          value instanceof Date ||\n          value instanceof RegExp ||\n          value instanceof Map ||\n          value instanceof Set ||\n          value instanceof Error ||\n          (typeof ArrayBuffer !== 'undefined' && value instanceof ArrayBuffer) ||\n          (typeof Blob !== 'undefined' && value instanceof Blob)\n        ) {\n          result[key] = value;\n        } else if (result[key] && typeof result[key] === 'object' && !Array.isArray(result[key])) {\n          result[key] = deepMerge(result[key], value);\n        } else {\n          result[key] = deepMerge(value);\n        }\n      } else if (value !== undefined) {\n        result[key] = value;\n      }\n    }\n  }\n\n  return result;\n}\n\nconst requestOnlyKeys = new Set<string>(['url', 'data', 'signal']);\nconst deepMergeKeys = new Set<string>(['headers', 'params', 'hooks']);\n\nexport default function mergeConfig(\n  config1: AccessioRequestConfig = {},\n  config2: AccessioRequestConfig = {},\n): AccessioRequestConfig {\n  const merged: any = Object.create(null);\n\n  const allKeys = new Set<string>([...Object.keys(config1), ...Object.keys(config2)]);\n\n  for (const key of allKeys) {\n    const val1 = config1[key as keyof AccessioRequestConfig];\n    const val2 = config2[key as keyof AccessioRequestConfig];\n\n    if (requestOnlyKeys.has(key)) {\n      if (val2 !== undefined) {\n        merged[key] = val2;\n      }\n    } else if (deepMergeKeys.has(key)) {\n      merged[key] = deepMerge(val1 || {}, val2 || {});\n    } else {\n      merged[key] = val2 !== undefined ? val2 : val1;\n    }\n  }\n\n  return merged;\n}\n\nexport { deepMerge };\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,SAAS,aAAa,SAAqC;AACzD,QAAM,SAA8B,uBAAO,OAAO,IAAI;AAEtD,aAAW,UAAU,SAAS;AAC5B,QAAI,CAAC,UAAU,OAAO,WAAW,SAAU;AAE3C,eAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,UAAI,QAAQ,eAAe,QAAQ,iBAAiB,QAAQ,YAAa;AAEzE,YAAM,QAAQ,OAAO,GAAG;AAExB,UAAI,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,GAAG;AAC/D,YACE,iBAAiB,QACjB,iBAAiB,UACjB,iBAAiB,OACjB,iBAAiB,OACjB,iBAAiB,SAChB,OAAO,gBAAgB,eAAe,iBAAiB,eACvD,OAAO,SAAS,eAAe,iBAAiB,MACjD;AACA,iBAAO,GAAG,IAAI;AAAA,QAChB,WAAW,OAAO,GAAG,KAAK,OAAO,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,QAAQ,OAAO,GAAG,CAAC,GAAG;AACxF,iBAAO,GAAG,IAAI,UAAU,OAAO,GAAG,GAAG,KAAK;AAAA,QAC5C,OAAO;AACL,iBAAO,GAAG,IAAI,UAAU,KAAK;AAAA,QAC/B;AAAA,MACF,WAAW,UAAU,QAAW;AAC9B,eAAO,GAAG,IAAI;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAEA,MAAM,kBAAkB,oBAAI,IAAY,CAAC,OAAO,QAAQ,QAAQ,CAAC;AACjE,MAAM,gBAAgB,oBAAI,IAAY,CAAC,WAAW,UAAU,OAAO,CAAC;AAErD,SAAR,YACL,UAAiC,CAAC,GAClC,UAAiC,CAAC,GACX;AACvB,QAAM,SAAc,uBAAO,OAAO,IAAI;AAEtC,QAAM,UAAU,oBAAI,IAAY,CAAC,GAAG,OAAO,KAAK,OAAO,GAAG,GAAG,OAAO,KAAK,OAAO,CAAC,CAAC;AAElF,aAAW,OAAO,SAAS;AACzB,UAAM,OAAO,QAAQ,GAAkC;AACvD,UAAM,OAAO,QAAQ,GAAkC;AAEvD,QAAI,gBAAgB,IAAI,GAAG,GAAG;AAC5B,UAAI,SAAS,QAAW;AACtB,eAAO,GAAG,IAAI;AAAA,MAChB;AAAA,IACF,WAAW,cAAc,IAAI,GAAG,GAAG;AACjC,aAAO,GAAG,IAAI,UAAU,QAAQ,CAAC,GAAG,QAAQ,CAAC,CAAC;AAAA,IAChD,OAAO;AACL,aAAO,GAAG,IAAI,SAAS,SAAY,OAAO;AAAA,IAC5C;AAAA,EACF;AAEA,SAAO;AACT;","names":[]}

package/cjs/core/request.cjs

@@ -41,23 +41,22 @@ var import_flattenHeaders = require("../helpers/flattenHeaders");
 var import_auth = require("../helpers/auth");
 var import_fetchAdapter = __toESM(require("./fetchAdapter"), 1);
 var import_memoryCache = require("../helpers/memoryCache");
-function lookupHeader(headers, name) {
-  const target = name.toLowerCase();
-  for (const k of Object.keys(headers)) {
-    if (k.toLowerCase() === target) {
-      const v = headers[k];
-      return Array.isArray(v) ? v.join(",") : v ?? "";
-    }
-  }
-  return "";
-}
 function buildCacheKey(config, fullURL, flatHeaders) {
+  if (typeof config.cacheKeySerializer === "function") {
+    return config.cacheKeySerializer(config, fullURL, flatHeaders);
+  }
   const method = (config.method || "GET").toUpperCase();
-  const auth = lookupHeader(flatHeaders, "authorization");
-  const accept = lookupHeader(flatHeaders, "accept");
   const withCreds = config.withCredentials ? "1" : "0";
   const respType = config.responseType || "json";
-  return `${method}:${fullURL}|a=${auth}|x=${accept}|c=${withCreds}|t=${respType}`;
+  const serializedHeaders = Object.keys(flatHeaders).sort().filter(
+    (k) => !["user-agent", "connection", "host", "content-length", "accept-encoding"].includes(
+      k.toLowerCase()
+    )
+  ).map((k) => {
+    const val = flatHeaders[k];
+    return `${k.toLowerCase()}=${Array.isArray(val) ? val.join(",") : val}`;
+  }).join("&");
+  return `${method}:${fullURL}|h:${serializedHeaders}|c=${withCreds}|t=${respType}`;
 }
 function buildTransformArray(transform) {
   if (!transform) return [];
@@ -127,8 +126,37 @@ async function dispatchRequest(config) {
   if (isGet && config.dedupe) {
     const inflight = activeRequests.get(cacheKey);
     if (inflight) {
-      const shared = await inflight;
-      return finalizeResponse(shared, config);
+      try {
+        const shared = await inflight;
+        const response = finalizeResponse(shared, config);
+        const settled = await new Promise((resolve, reject) => {
+          (0, import_settle.default)(
+            resolve,
+            reject,
+            response,
+            config
+          );
+        });
+        if (config.hooks?.onRequestResponse) {
+          await config.hooks.onRequestResponse(settled);
+        }
+        return settled;
+      } catch (error) {
+        let finalError = error;
+        if (error instanceof import_accessioError.default) {
+          finalError = import_accessioError.default.from(
+            error,
+            error.code || "ERR_DEDUPE",
+            config,
+            error.request,
+            error.response
+          );
+        }
+        if (config.hooks?.onRequestError && finalError instanceof import_accessioError.default) {
+          await config.hooks.onRequestError(finalError);
+        }
+        throw finalError;
+      }
     }
   }
   const performRequest = async () => {

package/cjs/core/request.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/request.ts"],"sourcesContent":["import buildURL from './buildURL';\nimport AccessioError, { redactConfig } from './accessioError';\nimport { ERR_BAD_OPTION } from '../constants/errorCodes';\nimport transformData from '../helpers/transformData';\nimport settle from '../helpers/settle';\nimport { flattenHeaders, removeContentType, buildFetchHeaders } from '../helpers/flattenHeaders';\nimport { setBasicAuth } from '../helpers/auth';\nimport fetchAdapter from './fetchAdapter';\nimport { defaultMemoryCache } from '../helpers/memoryCache';\nimport type { AccessioRequestConfig, AccessioResponse, TransformFunction } from '../types';\n\ntype HeadersConfig = Record<string, Record<string, string | string[]>>;\ntype FlatHeaders = Record<string, string | string[]>;\n\nfunction lookupHeader(headers: FlatHeaders, name: string): string {\n  const target = name.toLowerCase();\n  for (const k of Object.keys(headers)) {\n    if (k.toLowerCase() === target) {\n      const v = headers[k];\n      return Array.isArray(v) ? v.join(',') : (v ?? '');\n    }\n  }\n  return '';\n}\n\nfunction buildCacheKey(\n  config: AccessioRequestConfig,\n  fullURL: string,\n  flatHeaders: FlatHeaders,\n): string {\n  const method = (config.method || 'GET').toUpperCase();\n  const auth = lookupHeader(flatHeaders, 'authorization');\n  const accept = lookupHeader(flatHeaders, 'accept');\n  const withCreds = config.withCredentials ? '1' : '0';\n  const respType = config.responseType || 'json';\n  return `${method}:${fullURL}|a=${auth}|x=${accept}|c=${withCreds}|t=${respType}`;\n}\n\nfunction buildTransformArray(\n  transform: TransformFunction | TransformFunction[] | undefined,\n): TransformFunction[] {\n  if (!transform) return [];\n  if (Array.isArray(transform)) return transform;\n  return [transform];\n}\n\nconst DEFAULT_ALLOWED_PROTOCOLS = ['http:', 'https:'];\n\nfunction assertAllowedProtocol(fullURL: string, config: AccessioRequestConfig): void {\n  if (config.allowedProtocols === null) return;\n  const allowed = config.allowedProtocols ?? DEFAULT_ALLOWED_PROTOCOLS;\n\n  let scheme: string | null = null;\n  const match = /^([a-z][a-z\\d+\\-.]*):/i.exec(fullURL);\n  if (match) scheme = `${match[1].toLowerCase()}:`;\n  if (!scheme) return;\n\n  if (!allowed.includes(scheme)) {\n    throw new AccessioError(\n      `URL protocol \"${scheme}\" is not allowed. Allowed: ${allowed.join(', ')}. ` +\n        'Set config.allowedProtocols to extend, or null to disable the check.',\n      ERR_BAD_OPTION,\n      config,\n      null,\n      null,\n    );\n  }\n}\n\nconst activeRequests = new Map<string, Promise<AccessioResponse>>();\nconst MAX_ACTIVE_REQUESTS = 1024;\n\nexport function __activeRequestsSize(): number {\n  return activeRequests.size;\n}\n\nfunction trackActiveRequest(key: string, promise: Promise<AccessioResponse>): void {\n  activeRequests.set(key, promise);\n  // Evict the oldest entry if we've grown past the cap. Map preserves insertion order.\n  while (activeRequests.size > MAX_ACTIVE_REQUESTS) {\n    const oldest = activeRequests.keys().next().value;\n    if (oldest === undefined || oldest === key) break;\n    activeRequests.delete(oldest);\n  }\n}\n\nexport default async function dispatchRequest(\n  config: AccessioRequestConfig,\n): Promise<AccessioResponse> {\n  const fullURL =\n    config._builtUrl ||\n    buildURL(\n      config.url ?? '',\n      config.baseURL,\n      config.params as Record<string, unknown> | undefined,\n      config.paramsSerializer,\n    );\n\n  assertAllowedProtocol(fullURL, config);\n\n  if (config.hooks?.onBeforeRequest) {\n    await config.hooks.onBeforeRequest(config);\n  }\n\n  const flatHeaders = flattenHeaders(config.headers as HeadersConfig | undefined, config.method);\n  setBasicAuth(config, flatHeaders);\n\n  const isGet = (config.method || 'GET').toUpperCase() === 'GET';\n  const cacheKey = isGet ? buildCacheKey(config, fullURL, flatHeaders) : '';\n\n  if (isGet && config.cache) {\n    const cacheProvider = typeof config.cache === 'object' ? config.cache : defaultMemoryCache;\n    const cached = await cacheProvider.get(cacheKey);\n    if (cached) {\n      const cachedView: AccessioResponse = {\n        ...cached,\n        config: redactConfig(config) as typeof cached.config,\n      };\n      if (config.hooks?.onRequestResponse) {\n        await config.hooks.onRequestResponse(cachedView);\n      }\n      return cachedView;\n    }\n  }\n\n  if (isGet && config.dedupe) {\n    const inflight = activeRequests.get(cacheKey);\n    if (inflight) {\n      const shared = await inflight;\n      return finalizeResponse(shared, config);\n    }\n  }\n\n  const performRequest = async (): Promise<AccessioResponse> => {\n    const requestTransforms = buildTransformArray(config.transformRequest);\n    const requestData = await transformData(requestTransforms, config.data, flatHeaders, config);\n\n    if (\n      requestData === null ||\n      requestData === undefined ||\n      (typeof FormData !== 'undefined' && requestData instanceof FormData)\n    ) {\n      removeContentType(flatHeaders);\n    }\n\n    const fetchOptions: RequestInit = {\n      method: (config.method || 'GET').toUpperCase(),\n      headers: buildFetchHeaders(flatHeaders),\n    };\n\n    const methodsWithBody = ['POST', 'PUT', 'PATCH', 'DELETE'];\n    if (\n      methodsWithBody.includes(fetchOptions.method!) &&\n      requestData !== undefined &&\n      requestData !== null\n    ) {\n      fetchOptions.body = requestData as BodyInit;\n    }\n\n    if (config.withCredentials) {\n      fetchOptions.credentials = 'include';\n    }\n\n    if (config.dispatcher) {\n      (fetchOptions as any).dispatcher = config.dispatcher;\n    }\n    if (config.agent) {\n      (fetchOptions as any).agent = config.agent;\n    }\n\n    const requestStartTime = Date.now();\n    const response = await fetchAdapter(config, fullURL, fetchOptions, requestStartTime);\n\n    const responseTransforms = buildTransformArray(config.transformResponse);\n    response.data = await transformData(\n      responseTransforms,\n      response.data,\n      response.headers,\n      config,\n      'response',\n    );\n\n    return response;\n  };\n\n  const promise = performRequest();\n\n  if (isGet && config.dedupe) {\n    trackActiveRequest(cacheKey, promise);\n    const cleanup = () => {\n      if (activeRequests.get(cacheKey) === promise) {\n        activeRequests.delete(cacheKey);\n      }\n    };\n    promise.then(cleanup, cleanup);\n  }\n\n  try {\n    const shared = await promise;\n    const response = finalizeResponse(shared, config);\n\n    if (isGet && config.cache) {\n      const cacheProvider = typeof config.cache === 'object' ? config.cache : defaultMemoryCache;\n      await cacheProvider.set(cacheKey, shared, config.cacheTTL);\n    }\n\n    const settled = await new Promise<AccessioResponse>((resolve, reject) => {\n      settle(\n        resolve as (value: AccessioResponse) => void,\n        reject as (reason: AccessioError) => void,\n        response,\n        config,\n      );\n    });\n\n    if (config.hooks?.onRequestResponse) {\n      await config.hooks.onRequestResponse(settled);\n    }\n\n    return settled;\n  } catch (error) {\n    if (config.hooks?.onRequestError && error instanceof AccessioError) {\n      await config.hooks.onRequestError(error);\n    }\n    throw error;\n  }\n}\n\nfunction finalizeResponse(\n  shared: AccessioResponse,\n  config: AccessioRequestConfig,\n): AccessioResponse {\n  return {\n    ...shared,\n    config: redactConfig(config) as typeof shared.config,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,sBAAqB;AACrB,2BAA4C;AAC5C,wBAA+B;AAC/B,2BAA0B;AAC1B,oBAAmB;AACnB,4BAAqE;AACrE,kBAA6B;AAC7B,0BAAyB;AACzB,yBAAmC;AAMnC,SAAS,aAAa,SAAsB,MAAsB;AAChE,QAAM,SAAS,KAAK,YAAY;AAChC,aAAW,KAAK,OAAO,KAAK,OAAO,GAAG;AACpC,QAAI,EAAE,YAAY,MAAM,QAAQ;AAC9B,YAAM,IAAI,QAAQ,CAAC;AACnB,aAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,IAAK,KAAK;AAAA,IAChD;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,cACP,QACA,SACA,aACQ;AACR,QAAM,UAAU,OAAO,UAAU,OAAO,YAAY;AACpD,QAAM,OAAO,aAAa,aAAa,eAAe;AACtD,QAAM,SAAS,aAAa,aAAa,QAAQ;AACjD,QAAM,YAAY,OAAO,kBAAkB,MAAM;AACjD,QAAM,WAAW,OAAO,gBAAgB;AACxC,SAAO,GAAG,MAAM,IAAI,OAAO,MAAM,IAAI,MAAM,MAAM,MAAM,SAAS,MAAM,QAAQ;AAChF;AAEA,SAAS,oBACP,WACqB;AACrB,MAAI,CAAC,UAAW,QAAO,CAAC;AACxB,MAAI,MAAM,QAAQ,SAAS,EAAG,QAAO;AACrC,SAAO,CAAC,SAAS;AACnB;AAEA,MAAM,4BAA4B,CAAC,SAAS,QAAQ;AAEpD,SAAS,sBAAsB,SAAiB,QAAqC;AACnF,MAAI,OAAO,qBAAqB,KAAM;AACtC,QAAM,UAAU,OAAO,oBAAoB;AAE3C,MAAI,SAAwB;AAC5B,QAAM,QAAQ,yBAAyB,KAAK,OAAO;AACnD,MAAI,MAAO,UAAS,GAAG,MAAM,CAAC,EAAE,YAAY,CAAC;AAC7C,MAAI,CAAC,OAAQ;AAEb,MAAI,CAAC,QAAQ,SAAS,MAAM,GAAG;AAC7B,UAAM,IAAI,qBAAAA;AAAA,MACR,iBAAiB,MAAM,8BAA8B,QAAQ,KAAK,IAAI,CAAC;AAAA,MAEvE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,MAAM,iBAAiB,oBAAI,IAAuC;AAClE,MAAM,sBAAsB;AAErB,SAAS,uBAA+B;AAC7C,SAAO,eAAe;AACxB;AAEA,SAAS,mBAAmB,KAAa,SAA0C;AACjF,iBAAe,IAAI,KAAK,OAAO;AAE/B,SAAO,eAAe,OAAO,qBAAqB;AAChD,UAAM,SAAS,eAAe,KAAK,EAAE,KAAK,EAAE;AAC5C,QAAI,WAAW,UAAa,WAAW,IAAK;AAC5C,mBAAe,OAAO,MAAM;AAAA,EAC9B;AACF;AAEA,eAAO,gBACL,QAC2B;AAC3B,QAAM,UACJ,OAAO,iBACP,gBAAAC;AAAA,IACE,OAAO,OAAO;AAAA,IACd,OAAO;AAAA,IACP,OAAO;AAAA,IACP,OAAO;AAAA,EACT;AAEF,wBAAsB,SAAS,MAAM;AAErC,MAAI,OAAO,OAAO,iBAAiB;AACjC,UAAM,OAAO,MAAM,gBAAgB,MAAM;AAAA,EAC3C;AAEA,QAAM,kBAAc,sCAAe,OAAO,SAAsC,OAAO,MAAM;AAC7F,gCAAa,QAAQ,WAAW;AAEhC,QAAM,SAAS,OAAO,UAAU,OAAO,YAAY,MAAM;AACzD,QAAM,WAAW,QAAQ,cAAc,QAAQ,SAAS,WAAW,IAAI;AAEvE,MAAI,SAAS,OAAO,OAAO;AACzB,UAAM,gBAAgB,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ;AACxE,UAAM,SAAS,MAAM,cAAc,IAAI,QAAQ;AAC/C,QAAI,QAAQ;AACV,YAAM,aAA+B;AAAA,QACnC,GAAG;AAAA,QACH,YAAQ,mCAAa,MAAM;AAAA,MAC7B;AACA,UAAI,OAAO,OAAO,mBAAmB;AACnC,cAAM,OAAO,MAAM,kBAAkB,UAAU;AAAA,MACjD;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,SAAS,OAAO,QAAQ;AAC1B,UAAM,WAAW,eAAe,IAAI,QAAQ;AAC5C,QAAI,UAAU;AACZ,YAAM,SAAS,MAAM;AACrB,aAAO,iBAAiB,QAAQ,MAAM;AAAA,IACxC;AAAA,EACF;AAEA,QAAM,iBAAiB,YAAuC;AAC5D,UAAM,oBAAoB,oBAAoB,OAAO,gBAAgB;AACrE,UAAM,cAAc,UAAM,qBAAAC,SAAc,mBAAmB,OAAO,MAAM,aAAa,MAAM;AAE3F,QACE,gBAAgB,QAChB,gBAAgB,UACf,OAAO,aAAa,eAAe,uBAAuB,UAC3D;AACA,mDAAkB,WAAW;AAAA,IAC/B;AAEA,UAAM,eAA4B;AAAA,MAChC,SAAS,OAAO,UAAU,OAAO,YAAY;AAAA,MAC7C,aAAS,yCAAkB,WAAW;AAAA,IACxC;AAEA,UAAM,kBAAkB,CAAC,QAAQ,OAAO,SAAS,QAAQ;AACzD,QACE,gBAAgB,SAAS,aAAa,MAAO,KAC7C,gBAAgB,UAChB,gBAAgB,MAChB;AACA,mBAAa,OAAO;AAAA,IACtB;AAEA,QAAI,OAAO,iBAAiB;AAC1B,mBAAa,cAAc;AAAA,IAC7B;AAEA,QAAI,OAAO,YAAY;AACrB,MAAC,aAAqB,aAAa,OAAO;AAAA,IAC5C;AACA,QAAI,OAAO,OAAO;AAChB,MAAC,aAAqB,QAAQ,OAAO;AAAA,IACvC;AAEA,UAAM,mBAAmB,KAAK,IAAI;AAClC,UAAM,WAAW,UAAM,oBAAAC,SAAa,QAAQ,SAAS,cAAc,gBAAgB;AAEnF,UAAM,qBAAqB,oBAAoB,OAAO,iBAAiB;AACvE,aAAS,OAAO,UAAM,qBAAAD;AAAA,MACpB;AAAA,MACA,SAAS;AAAA,MACT,SAAS;AAAA,MACT;AAAA,MACA;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,eAAe;AAE/B,MAAI,SAAS,OAAO,QAAQ;AAC1B,uBAAmB,UAAU,OAAO;AACpC,UAAM,UAAU,MAAM;AACpB,UAAI,eAAe,IAAI,QAAQ,MAAM,SAAS;AAC5C,uBAAe,OAAO,QAAQ;AAAA,MAChC;AAAA,IACF;AACA,YAAQ,KAAK,SAAS,OAAO;AAAA,EAC/B;AAEA,MAAI;AACF,UAAM,SAAS,MAAM;AACrB,UAAM,WAAW,iBAAiB,QAAQ,MAAM;AAEhD,QAAI,SAAS,OAAO,OAAO;AACzB,YAAM,gBAAgB,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ;AACxE,YAAM,cAAc,IAAI,UAAU,QAAQ,OAAO,QAAQ;AAAA,IAC3D;AAEA,UAAM,UAAU,MAAM,IAAI,QAA0B,CAAC,SAAS,WAAW;AACvE,wBAAAE;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,CAAC;AAED,QAAI,OAAO,OAAO,mBAAmB;AACnC,YAAM,OAAO,MAAM,kBAAkB,OAAO;AAAA,IAC9C;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,OAAO,OAAO,kBAAkB,iBAAiB,qBAAAJ,SAAe;AAClE,YAAM,OAAO,MAAM,eAAe,KAAK;AAAA,IACzC;AACA,UAAM;AAAA,EACR;AACF;AAEA,SAAS,iBACP,QACA,QACkB;AAClB,SAAO;AAAA,IACL,GAAG;AAAA,IACH,YAAQ,mCAAa,MAAM;AAAA,EAC7B;AACF;","names":["AccessioError","buildURL","transformData","fetchAdapter","settle"]}
+{"version":3,"sources":["../../src/core/request.ts"],"sourcesContent":["import buildURL from './buildURL';\nimport AccessioError, { redactConfig } from './accessioError';\nimport { ERR_BAD_OPTION } from '../constants/errorCodes';\nimport transformData from '../helpers/transformData';\nimport settle from '../helpers/settle';\nimport { flattenHeaders, removeContentType, buildFetchHeaders } from '../helpers/flattenHeaders';\nimport { setBasicAuth } from '../helpers/auth';\nimport fetchAdapter from './fetchAdapter';\nimport { defaultMemoryCache } from '../helpers/memoryCache';\nimport type { AccessioRequestConfig, AccessioResponse, TransformFunction } from '../types';\n\ntype HeadersConfig = Record<string, Record<string, string | string[]>>;\ntype FlatHeaders = Record<string, string | string[]>;\n\nfunction buildCacheKey(\n  config: AccessioRequestConfig,\n  fullURL: string,\n  flatHeaders: FlatHeaders,\n): string {\n  if (typeof config.cacheKeySerializer === 'function') {\n    return config.cacheKeySerializer(config, fullURL, flatHeaders);\n  }\n  const method = (config.method || 'GET').toUpperCase();\n  const withCreds = config.withCredentials ? '1' : '0';\n  const respType = config.responseType || 'json';\n\n  // Sort and serialize headers dynamically to prevent collisions,\n  // excluding environment-specific transient headers.\n  const serializedHeaders = Object.keys(flatHeaders)\n    .sort()\n    .filter(\n      (k) =>\n        !['user-agent', 'connection', 'host', 'content-length', 'accept-encoding'].includes(\n          k.toLowerCase(),\n        ),\n    )\n    .map((k) => {\n      const val = flatHeaders[k];\n      return `${k.toLowerCase()}=${Array.isArray(val) ? val.join(',') : val}`;\n    })\n    .join('&');\n\n  return `${method}:${fullURL}|h:${serializedHeaders}|c=${withCreds}|t=${respType}`;\n}\n\nfunction buildTransformArray(\n  transform: TransformFunction | TransformFunction[] | undefined,\n): TransformFunction[] {\n  if (!transform) return [];\n  if (Array.isArray(transform)) return transform;\n  return [transform];\n}\n\nconst DEFAULT_ALLOWED_PROTOCOLS = ['http:', 'https:'];\n\nfunction assertAllowedProtocol(fullURL: string, config: AccessioRequestConfig): void {\n  if (config.allowedProtocols === null) return;\n  const allowed = config.allowedProtocols ?? DEFAULT_ALLOWED_PROTOCOLS;\n\n  let scheme: string | null = null;\n  const match = /^([a-z][a-z\\d+\\-.]*):/i.exec(fullURL);\n  if (match) scheme = `${match[1].toLowerCase()}:`;\n  if (!scheme) return;\n\n  if (!allowed.includes(scheme)) {\n    throw new AccessioError(\n      `URL protocol \"${scheme}\" is not allowed. Allowed: ${allowed.join(', ')}. ` +\n        'Set config.allowedProtocols to extend, or null to disable the check.',\n      ERR_BAD_OPTION,\n      config,\n      null,\n      null,\n    );\n  }\n}\n\nconst activeRequests = new Map<string, Promise<AccessioResponse>>();\nconst MAX_ACTIVE_REQUESTS = 1024;\n\nexport function __activeRequestsSize(): number {\n  return activeRequests.size;\n}\n\nfunction trackActiveRequest(key: string, promise: Promise<AccessioResponse>): void {\n  activeRequests.set(key, promise);\n  // Evict the oldest entry if we've grown past the cap. Map preserves insertion order.\n  while (activeRequests.size > MAX_ACTIVE_REQUESTS) {\n    const oldest = activeRequests.keys().next().value;\n    if (oldest === undefined || oldest === key) break;\n    activeRequests.delete(oldest);\n  }\n}\n\nexport default async function dispatchRequest(\n  config: AccessioRequestConfig,\n): Promise<AccessioResponse> {\n  const fullURL =\n    config._builtUrl ||\n    buildURL(\n      config.url ?? '',\n      config.baseURL,\n      config.params as Record<string, unknown> | undefined,\n      config.paramsSerializer,\n    );\n\n  assertAllowedProtocol(fullURL, config);\n\n  if (config.hooks?.onBeforeRequest) {\n    await config.hooks.onBeforeRequest(config);\n  }\n\n  const flatHeaders = flattenHeaders(config.headers as HeadersConfig | undefined, config.method);\n  setBasicAuth(config, flatHeaders);\n\n  const isGet = (config.method || 'GET').toUpperCase() === 'GET';\n  const cacheKey = isGet ? buildCacheKey(config, fullURL, flatHeaders) : '';\n\n  if (isGet && config.cache) {\n    const cacheProvider = typeof config.cache === 'object' ? config.cache : defaultMemoryCache;\n    const cached = await cacheProvider.get(cacheKey);\n    if (cached) {\n      const cachedView: AccessioResponse = {\n        ...cached,\n        config: redactConfig(config) as typeof cached.config,\n      };\n      if (config.hooks?.onRequestResponse) {\n        await config.hooks.onRequestResponse(cachedView);\n      }\n      return cachedView;\n    }\n  }\n\n  if (isGet && config.dedupe) {\n    const inflight = activeRequests.get(cacheKey);\n    if (inflight) {\n      try {\n        const shared = await inflight;\n        const response = finalizeResponse(shared, config);\n        const settled = await new Promise<AccessioResponse>((resolve, reject) => {\n          settle(\n            resolve as (value: AccessioResponse) => void,\n            reject as (reason: AccessioError) => void,\n            response,\n            config,\n          );\n        });\n\n        if (config.hooks?.onRequestResponse) {\n          await config.hooks.onRequestResponse(settled);\n        }\n\n        return settled;\n      } catch (error) {\n        let finalError = error;\n        if (error instanceof AccessioError) {\n          finalError = AccessioError.from(\n            error,\n            error.code || 'ERR_DEDUPE',\n            config,\n            error.request,\n            error.response,\n          );\n        }\n        if (config.hooks?.onRequestError && finalError instanceof AccessioError) {\n          await config.hooks.onRequestError(finalError);\n        }\n        throw finalError;\n      }\n    }\n  }\n\n  const performRequest = async (): Promise<AccessioResponse> => {\n    const requestTransforms = buildTransformArray(config.transformRequest);\n    const requestData = await transformData(requestTransforms, config.data, flatHeaders, config);\n\n    if (\n      requestData === null ||\n      requestData === undefined ||\n      (typeof FormData !== 'undefined' && requestData instanceof FormData)\n    ) {\n      removeContentType(flatHeaders);\n    }\n\n    const fetchOptions: RequestInit = {\n      method: (config.method || 'GET').toUpperCase(),\n      headers: buildFetchHeaders(flatHeaders),\n    };\n\n    const methodsWithBody = ['POST', 'PUT', 'PATCH', 'DELETE'];\n    if (\n      methodsWithBody.includes(fetchOptions.method!) &&\n      requestData !== undefined &&\n      requestData !== null\n    ) {\n      fetchOptions.body = requestData as BodyInit;\n    }\n\n    if (config.withCredentials) {\n      fetchOptions.credentials = 'include';\n    }\n\n    if (config.dispatcher) {\n      (fetchOptions as any).dispatcher = config.dispatcher;\n    }\n    if (config.agent) {\n      (fetchOptions as any).agent = config.agent;\n    }\n\n    const requestStartTime = Date.now();\n    const response = await fetchAdapter(config, fullURL, fetchOptions, requestStartTime);\n\n    const responseTransforms = buildTransformArray(config.transformResponse);\n    response.data = await transformData(\n      responseTransforms,\n      response.data,\n      response.headers,\n      config,\n      'response',\n    );\n\n    return response;\n  };\n\n  const promise = performRequest();\n\n  if (isGet && config.dedupe) {\n    trackActiveRequest(cacheKey, promise);\n    const cleanup = () => {\n      if (activeRequests.get(cacheKey) === promise) {\n        activeRequests.delete(cacheKey);\n      }\n    };\n    promise.then(cleanup, cleanup);\n  }\n\n  try {\n    const shared = await promise;\n    const response = finalizeResponse(shared, config);\n\n    if (isGet && config.cache) {\n      const cacheProvider = typeof config.cache === 'object' ? config.cache : defaultMemoryCache;\n      await cacheProvider.set(cacheKey, shared, config.cacheTTL);\n    }\n\n    const settled = await new Promise<AccessioResponse>((resolve, reject) => {\n      settle(\n        resolve as (value: AccessioResponse) => void,\n        reject as (reason: AccessioError) => void,\n        response,\n        config,\n      );\n    });\n\n    if (config.hooks?.onRequestResponse) {\n      await config.hooks.onRequestResponse(settled);\n    }\n\n    return settled;\n  } catch (error) {\n    if (config.hooks?.onRequestError && error instanceof AccessioError) {\n      await config.hooks.onRequestError(error);\n    }\n    throw error;\n  }\n}\n\nfunction finalizeResponse(\n  shared: AccessioResponse,\n  config: AccessioRequestConfig,\n): AccessioResponse {\n  return {\n    ...shared,\n    config: redactConfig(config) as typeof shared.config,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,sBAAqB;AACrB,2BAA4C;AAC5C,wBAA+B;AAC/B,2BAA0B;AAC1B,oBAAmB;AACnB,4BAAqE;AACrE,kBAA6B;AAC7B,0BAAyB;AACzB,yBAAmC;AAMnC,SAAS,cACP,QACA,SACA,aACQ;AACR,MAAI,OAAO,OAAO,uBAAuB,YAAY;AACnD,WAAO,OAAO,mBAAmB,QAAQ,SAAS,WAAW;AAAA,EAC/D;AACA,QAAM,UAAU,OAAO,UAAU,OAAO,YAAY;AACpD,QAAM,YAAY,OAAO,kBAAkB,MAAM;AACjD,QAAM,WAAW,OAAO,gBAAgB;AAIxC,QAAM,oBAAoB,OAAO,KAAK,WAAW,EAC9C,KAAK,EACL;AAAA,IACC,CAAC,MACC,CAAC,CAAC,cAAc,cAAc,QAAQ,kBAAkB,iBAAiB,EAAE;AAAA,MACzE,EAAE,YAAY;AAAA,IAChB;AAAA,EACJ,EACC,IAAI,CAAC,MAAM;AACV,UAAM,MAAM,YAAY,CAAC;AACzB,WAAO,GAAG,EAAE,YAAY,CAAC,IAAI,MAAM,QAAQ,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,GAAG;AAAA,EACvE,CAAC,EACA,KAAK,GAAG;AAEX,SAAO,GAAG,MAAM,IAAI,OAAO,MAAM,iBAAiB,MAAM,SAAS,MAAM,QAAQ;AACjF;AAEA,SAAS,oBACP,WACqB;AACrB,MAAI,CAAC,UAAW,QAAO,CAAC;AACxB,MAAI,MAAM,QAAQ,SAAS,EAAG,QAAO;AACrC,SAAO,CAAC,SAAS;AACnB;AAEA,MAAM,4BAA4B,CAAC,SAAS,QAAQ;AAEpD,SAAS,sBAAsB,SAAiB,QAAqC;AACnF,MAAI,OAAO,qBAAqB,KAAM;AACtC,QAAM,UAAU,OAAO,oBAAoB;AAE3C,MAAI,SAAwB;AAC5B,QAAM,QAAQ,yBAAyB,KAAK,OAAO;AACnD,MAAI,MAAO,UAAS,GAAG,MAAM,CAAC,EAAE,YAAY,CAAC;AAC7C,MAAI,CAAC,OAAQ;AAEb,MAAI,CAAC,QAAQ,SAAS,MAAM,GAAG;AAC7B,UAAM,IAAI,qBAAAA;AAAA,MACR,iBAAiB,MAAM,8BAA8B,QAAQ,KAAK,IAAI,CAAC;AAAA,MAEvE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,MAAM,iBAAiB,oBAAI,IAAuC;AAClE,MAAM,sBAAsB;AAErB,SAAS,uBAA+B;AAC7C,SAAO,eAAe;AACxB;AAEA,SAAS,mBAAmB,KAAa,SAA0C;AACjF,iBAAe,IAAI,KAAK,OAAO;AAE/B,SAAO,eAAe,OAAO,qBAAqB;AAChD,UAAM,SAAS,eAAe,KAAK,EAAE,KAAK,EAAE;AAC5C,QAAI,WAAW,UAAa,WAAW,IAAK;AAC5C,mBAAe,OAAO,MAAM;AAAA,EAC9B;AACF;AAEA,eAAO,gBACL,QAC2B;AAC3B,QAAM,UACJ,OAAO,iBACP,gBAAAC;AAAA,IACE,OAAO,OAAO;AAAA,IACd,OAAO;AAAA,IACP,OAAO;AAAA,IACP,OAAO;AAAA,EACT;AAEF,wBAAsB,SAAS,MAAM;AAErC,MAAI,OAAO,OAAO,iBAAiB;AACjC,UAAM,OAAO,MAAM,gBAAgB,MAAM;AAAA,EAC3C;AAEA,QAAM,kBAAc,sCAAe,OAAO,SAAsC,OAAO,MAAM;AAC7F,gCAAa,QAAQ,WAAW;AAEhC,QAAM,SAAS,OAAO,UAAU,OAAO,YAAY,MAAM;AACzD,QAAM,WAAW,QAAQ,cAAc,QAAQ,SAAS,WAAW,IAAI;AAEvE,MAAI,SAAS,OAAO,OAAO;AACzB,UAAM,gBAAgB,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ;AACxE,UAAM,SAAS,MAAM,cAAc,IAAI,QAAQ;AAC/C,QAAI,QAAQ;AACV,YAAM,aAA+B;AAAA,QACnC,GAAG;AAAA,QACH,YAAQ,mCAAa,MAAM;AAAA,MAC7B;AACA,UAAI,OAAO,OAAO,mBAAmB;AACnC,cAAM,OAAO,MAAM,kBAAkB,UAAU;AAAA,MACjD;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAEA,MAAI,SAAS,OAAO,QAAQ;AAC1B,UAAM,WAAW,eAAe,IAAI,QAAQ;AAC5C,QAAI,UAAU;AACZ,UAAI;AACF,cAAM,SAAS,MAAM;AACrB,cAAM,WAAW,iBAAiB,QAAQ,MAAM;AAChD,cAAM,UAAU,MAAM,IAAI,QAA0B,CAAC,SAAS,WAAW;AACvE,4BAAAC;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF,CAAC;AAED,YAAI,OAAO,OAAO,mBAAmB;AACnC,gBAAM,OAAO,MAAM,kBAAkB,OAAO;AAAA,QAC9C;AAEA,eAAO;AAAA,MACT,SAAS,OAAO;AACd,YAAI,aAAa;AACjB,YAAI,iBAAiB,qBAAAF,SAAe;AAClC,uBAAa,qBAAAA,QAAc;AAAA,YACzB;AAAA,YACA,MAAM,QAAQ;AAAA,YACd;AAAA,YACA,MAAM;AAAA,YACN,MAAM;AAAA,UACR;AAAA,QACF;AACA,YAAI,OAAO,OAAO,kBAAkB,sBAAsB,qBAAAA,SAAe;AACvE,gBAAM,OAAO,MAAM,eAAe,UAAU;AAAA,QAC9C;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,iBAAiB,YAAuC;AAC5D,UAAM,oBAAoB,oBAAoB,OAAO,gBAAgB;AACrE,UAAM,cAAc,UAAM,qBAAAG,SAAc,mBAAmB,OAAO,MAAM,aAAa,MAAM;AAE3F,QACE,gBAAgB,QAChB,gBAAgB,UACf,OAAO,aAAa,eAAe,uBAAuB,UAC3D;AACA,mDAAkB,WAAW;AAAA,IAC/B;AAEA,UAAM,eAA4B;AAAA,MAChC,SAAS,OAAO,UAAU,OAAO,YAAY;AAAA,MAC7C,aAAS,yCAAkB,WAAW;AAAA,IACxC;AAEA,UAAM,kBAAkB,CAAC,QAAQ,OAAO,SAAS,QAAQ;AACzD,QACE,gBAAgB,SAAS,aAAa,MAAO,KAC7C,gBAAgB,UAChB,gBAAgB,MAChB;AACA,mBAAa,OAAO;AAAA,IACtB;AAEA,QAAI,OAAO,iBAAiB;AAC1B,mBAAa,cAAc;AAAA,IAC7B;AAEA,QAAI,OAAO,YAAY;AACrB,MAAC,aAAqB,aAAa,OAAO;AAAA,IAC5C;AACA,QAAI,OAAO,OAAO;AAChB,MAAC,aAAqB,QAAQ,OAAO;AAAA,IACvC;AAEA,UAAM,mBAAmB,KAAK,IAAI;AAClC,UAAM,WAAW,UAAM,oBAAAC,SAAa,QAAQ,SAAS,cAAc,gBAAgB;AAEnF,UAAM,qBAAqB,oBAAoB,OAAO,iBAAiB;AACvE,aAAS,OAAO,UAAM,qBAAAD;AAAA,MACpB;AAAA,MACA,SAAS;AAAA,MACT,SAAS;AAAA,MACT;AAAA,MACA;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,eAAe;AAE/B,MAAI,SAAS,OAAO,QAAQ;AAC1B,uBAAmB,UAAU,OAAO;AACpC,UAAM,UAAU,MAAM;AACpB,UAAI,eAAe,IAAI,QAAQ,MAAM,SAAS;AAC5C,uBAAe,OAAO,QAAQ;AAAA,MAChC;AAAA,IACF;AACA,YAAQ,KAAK,SAAS,OAAO;AAAA,EAC/B;AAEA,MAAI;AACF,UAAM,SAAS,MAAM;AACrB,UAAM,WAAW,iBAAiB,QAAQ,MAAM;AAEhD,QAAI,SAAS,OAAO,OAAO;AACzB,YAAM,gBAAgB,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ;AACxE,YAAM,cAAc,IAAI,UAAU,QAAQ,OAAO,QAAQ;AAAA,IAC3D;AAEA,UAAM,UAAU,MAAM,IAAI,QAA0B,CAAC,SAAS,WAAW;AACvE,wBAAAD;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,CAAC;AAED,QAAI,OAAO,OAAO,mBAAmB;AACnC,YAAM,OAAO,MAAM,kBAAkB,OAAO;AAAA,IAC9C;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,OAAO,OAAO,kBAAkB,iBAAiB,qBAAAF,SAAe;AAClE,YAAM,OAAO,MAAM,eAAe,KAAK;AAAA,IACzC;AACA,UAAM;AAAA,EACR;AACF;AAEA,SAAS,iBACP,QACA,QACkB;AAClB,SAAO;AAAA,IACL,GAAG;AAAA,IACH,YAAQ,mCAAa,MAAM;AAAA,EAC7B;AACF;","names":["AccessioError","buildURL","settle","transformData","fetchAdapter"]}

package/cjs/helpers/memoryCache.cjs

@@ -18,11 +18,16 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 var memoryCache_exports = {};
 __export(memoryCache_exports, {
+  MemoryCache: () => MemoryCache,
   defaultMemoryCache: () => defaultMemoryCache
 });
 module.exports = __toCommonJS(memoryCache_exports);
 class MemoryCache {
   cache = /* @__PURE__ */ new Map();
+  maxItems;
+  constructor(maxItems = 1e3) {
+    this.maxItems = maxItems;
+  }
   get(key) {
     const item = this.cache.get(key);
     if (!item) return null;
@@ -33,7 +38,19 @@ class MemoryCache {
     return item.value;
   }
   set(key, value, ttl) {
-    const expiry = ttl ? Date.now() + ttl : null;
+    const now = Date.now();
+    for (const [k, item] of this.cache.entries()) {
+      if (item.expiry && now > item.expiry) {
+        this.cache.delete(k);
+      }
+    }
+    if (this.cache.size >= this.maxItems) {
+      const oldest = this.cache.keys().next().value;
+      if (oldest !== void 0) {
+        this.cache.delete(oldest);
+      }
+    }
+    const expiry = ttl ? now + ttl : null;
     this.cache.set(key, { value, expiry });
   }
   delete(key) {
@@ -46,6 +63,7 @@ class MemoryCache {
 const defaultMemoryCache = new MemoryCache();
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  MemoryCache,
   defaultMemoryCache
 });
 //# sourceMappingURL=memoryCache.cjs.map

package/cjs/helpers/memoryCache.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/helpers/memoryCache.ts"],"sourcesContent":["import type { CacheProvider } from '../types';\n\nclass MemoryCache implements CacheProvider {\n  private cache = new Map<string, { value: any; expiry: number | null }>();\n\n  get(key: string) {\n    const item = this.cache.get(key);\n    if (!item) return null;\n    if (item.expiry && Date.now() > item.expiry) {\n      this.cache.delete(key);\n      return null;\n    }\n    return item.value;\n  }\n\n  set(key: string, value: any, ttl?: number) {\n    const expiry = ttl ? Date.now() + ttl : null;\n    this.cache.set(key, { value, expiry });\n  }\n\n  delete(key: string) {\n    this.cache.delete(key);\n  }\n\n  clear() {\n    this.cache.clear();\n  }\n}\n\nexport const defaultMemoryCache = new MemoryCache();\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,MAAM,YAAqC;AAAA,EACjC,QAAQ,oBAAI,IAAmD;AAAA,EAEvE,IAAI,KAAa;AACf,UAAM,OAAO,KAAK,MAAM,IAAI,GAAG;AAC/B,QAAI,CAAC,KAAM,QAAO;AAClB,QAAI,KAAK,UAAU,KAAK,IAAI,IAAI,KAAK,QAAQ;AAC3C,WAAK,MAAM,OAAO,GAAG;AACrB,aAAO;AAAA,IACT;AACA,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,IAAI,KAAa,OAAY,KAAc;AACzC,UAAM,SAAS,MAAM,KAAK,IAAI,IAAI,MAAM;AACxC,SAAK,MAAM,IAAI,KAAK,EAAE,OAAO,OAAO,CAAC;AAAA,EACvC;AAAA,EAEA,OAAO,KAAa;AAClB,SAAK,MAAM,OAAO,GAAG;AAAA,EACvB;AAAA,EAEA,QAAQ;AACN,SAAK,MAAM,MAAM;AAAA,EACnB;AACF;AAEO,MAAM,qBAAqB,IAAI,YAAY;","names":[]}
+{"version":3,"sources":["../../src/helpers/memoryCache.ts"],"sourcesContent":["import type { CacheProvider } from '../types';\n\nclass MemoryCache implements CacheProvider {\n  private cache = new Map<string, { value: any; expiry: number | null }>();\n  private maxItems: number;\n\n  constructor(maxItems: number = 1000) {\n    this.maxItems = maxItems;\n  }\n\n  get(key: string) {\n    const item = this.cache.get(key);\n    if (!item) return null;\n    if (item.expiry && Date.now() > item.expiry) {\n      this.cache.delete(key);\n      return null;\n    }\n    return item.value;\n  }\n\n  set(key: string, value: any, ttl?: number) {\n    const now = Date.now();\n\n    // Proactively evict all expired items first\n    for (const [k, item] of this.cache.entries()) {\n      if (item.expiry && now > item.expiry) {\n        this.cache.delete(k);\n      }\n    }\n\n    // Evict oldest item if we are still at limit\n    if (this.cache.size >= this.maxItems) {\n      const oldest = this.cache.keys().next().value;\n      if (oldest !== undefined) {\n        this.cache.delete(oldest);\n      }\n    }\n\n    const expiry = ttl ? now + ttl : null;\n    this.cache.set(key, { value, expiry });\n  }\n\n  delete(key: string) {\n    this.cache.delete(key);\n  }\n\n  clear() {\n    this.cache.clear();\n  }\n}\n\nexport const defaultMemoryCache = new MemoryCache();\nexport { MemoryCache };\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,MAAM,YAAqC;AAAA,EACjC,QAAQ,oBAAI,IAAmD;AAAA,EAC/D;AAAA,EAER,YAAY,WAAmB,KAAM;AACnC,SAAK,WAAW;AAAA,EAClB;AAAA,EAEA,IAAI,KAAa;AACf,UAAM,OAAO,KAAK,MAAM,IAAI,GAAG;AAC/B,QAAI,CAAC,KAAM,QAAO;AAClB,QAAI,KAAK,UAAU,KAAK,IAAI,IAAI,KAAK,QAAQ;AAC3C,WAAK,MAAM,OAAO,GAAG;AACrB,aAAO;AAAA,IACT;AACA,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,IAAI,KAAa,OAAY,KAAc;AACzC,UAAM,MAAM,KAAK,IAAI;AAGrB,eAAW,CAAC,GAAG,IAAI,KAAK,KAAK,MAAM,QAAQ,GAAG;AAC5C,UAAI,KAAK,UAAU,MAAM,KAAK,QAAQ;AACpC,aAAK,MAAM,OAAO,CAAC;AAAA,MACrB;AAAA,IACF;AAGA,QAAI,KAAK,MAAM,QAAQ,KAAK,UAAU;AACpC,YAAM,SAAS,KAAK,MAAM,KAAK,EAAE,KAAK,EAAE;AACxC,UAAI,WAAW,QAAW;AACxB,aAAK,MAAM,OAAO,MAAM;AAAA,MAC1B;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,MAAM,MAAM;AACjC,SAAK,MAAM,IAAI,KAAK,EAAE,OAAO,OAAO,CAAC;AAAA,EACvC;AAAA,EAEA,OAAO,KAAa;AAClB,SAAK,MAAM,OAAO,GAAG;AAAA,EACvB;AAAA,EAEA,QAAQ;AACN,SAAK,MAAM,MAAM;AAAA,EACnB;AACF;AAEO,MAAM,qBAAqB,IAAI,YAAY;","names":[]}

package/index.d.ts

@@ -150,6 +150,13 @@ export interface AccessioRequestConfig {
   /** TTL in ms for cached responses (when supported by the provider) */
   cacheTTL?: number;
 
+  /** Custom function to serialize request properties into a deterministic cache key */
+  cacheKeySerializer?: (
+    config: AccessioRequestConfig,
+    fullURL: string,
+    headers: Record<string, HeaderValue>,
+  ) => string;
+
   // ── Response handling ──────────────────────────────
 
   /** Maximum allowed response Content-Length in bytes */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "accessio",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "description": "Fast, flexible HTTP client — simple, modular, and dependency-free",
   "type": "module",
   "main": "./cjs/index.cjs",
@@ -96,7 +96,8 @@
     "node": ">=18.0.0"
   },
   "devDependencies": {
-    "@vitest/coverage-v8": "^3.1.0",
+    "@types/node": "^25.9.2",
+    "@vitest/coverage-v8": "^4.1.8",
     "eslint": "^9.0.0",
     "eslint-config-prettier": "^10.1.8",
     "jsdom": "^29.0.2",
@@ -104,6 +105,6 @@
     "tsup": "^8.0.0",
     "typescript": "^5.0.0",
     "typescript-eslint": "^8.59.3",
-    "vitest": "^3.1.0"
+    "vitest": "^4.1.8"
   }
 }

package/src/core/accessioError.ts

@@ -117,8 +117,8 @@ export class AccessioError extends Error {
     this.response = response ?? null;
     this.isAccessioError = true;
 
-    if (Error.captureStackTrace) {
-      Error.captureStackTrace(this, AccessioError);
+    if ((Error as any).captureStackTrace) {
+      (Error as any).captureStackTrace(this, AccessioError);
     }
   }
 

package/src/core/buildURL.ts

@@ -82,19 +82,22 @@ export default function buildURL(
       if (key === '__proto__' || key === 'prototype' || key === 'constructor') continue;
       unusedParams[key] = (params as Record<string, unknown>)[key];
     }
-    fullURL = fullURL.replace(/(?::([a-zA-Z0-9_]+))|(?:{([a-zA-Z0-9_]+)})/g, (match, p1, p2) => {
-      const key = p1 || p2;
-      if (
-        key &&
-        Object.prototype.hasOwnProperty.call(unusedParams, key) &&
-        unusedParams[key] !== undefined
-      ) {
-        const val = unusedParams[key];
-        delete unusedParams[key];
-        return encodeURIComponent(String(val));
-      }
-      return match;
-    });
+    fullURL = fullURL.replace(
+      /(?::([a-zA-Z_][a-zA-Z0-9_]*))|(?:{([a-zA-Z_][a-zA-Z0-9_]*)})/g,
+      (match, p1, p2) => {
+        const key = p1 || p2;
+        if (
+          key &&
+          Object.prototype.hasOwnProperty.call(unusedParams, key) &&
+          unusedParams[key] !== undefined
+        ) {
+          const val = unusedParams[key];
+          delete unusedParams[key];
+          return encodeURIComponent(String(val));
+        }
+        return match;
+      },
+    );
     finalParams = unusedParams;
   }
 

package/src/core/mergeConfig.ts

@@ -37,7 +37,7 @@ function deepMerge(...sources: any[]): Record<string, any> {
 }
 
 const requestOnlyKeys = new Set<string>(['url', 'data', 'signal']);
-const deepMergeKeys = new Set<string>(['headers']);
+const deepMergeKeys = new Set<string>(['headers', 'params', 'hooks']);
 
 export default function mergeConfig(
   config1: AccessioRequestConfig = {},

package/src/core/request.ts

@@ -12,28 +12,35 @@ import type { AccessioRequestConfig, AccessioResponse, TransformFunction } from
 type HeadersConfig = Record<string, Record<string, string | string[]>>;
 type FlatHeaders = Record<string, string | string[]>;
 
-function lookupHeader(headers: FlatHeaders, name: string): string {
-  const target = name.toLowerCase();
-  for (const k of Object.keys(headers)) {
-    if (k.toLowerCase() === target) {
-      const v = headers[k];
-      return Array.isArray(v) ? v.join(',') : (v ?? '');
-    }
-  }
-  return '';
-}
-
 function buildCacheKey(
   config: AccessioRequestConfig,
   fullURL: string,
   flatHeaders: FlatHeaders,
 ): string {
+  if (typeof config.cacheKeySerializer === 'function') {
+    return config.cacheKeySerializer(config, fullURL, flatHeaders);
+  }
   const method = (config.method || 'GET').toUpperCase();
-  const auth = lookupHeader(flatHeaders, 'authorization');
-  const accept = lookupHeader(flatHeaders, 'accept');
   const withCreds = config.withCredentials ? '1' : '0';
   const respType = config.responseType || 'json';
-  return `${method}:${fullURL}|a=${auth}|x=${accept}|c=${withCreds}|t=${respType}`;
+
+  // Sort and serialize headers dynamically to prevent collisions,
+  // excluding environment-specific transient headers.
+  const serializedHeaders = Object.keys(flatHeaders)
+    .sort()
+    .filter(
+      (k) =>
+        !['user-agent', 'connection', 'host', 'content-length', 'accept-encoding'].includes(
+          k.toLowerCase(),
+        ),
+    )
+    .map((k) => {
+      const val = flatHeaders[k];
+      return `${k.toLowerCase()}=${Array.isArray(val) ? val.join(',') : val}`;
+    })
+    .join('&');
+
+  return `${method}:${fullURL}|h:${serializedHeaders}|c=${withCreds}|t=${respType}`;
 }
 
 function buildTransformArray(
@@ -126,8 +133,39 @@ export default async function dispatchRequest(
   if (isGet && config.dedupe) {
     const inflight = activeRequests.get(cacheKey);
     if (inflight) {
-      const shared = await inflight;
-      return finalizeResponse(shared, config);
+      try {
+        const shared = await inflight;
+        const response = finalizeResponse(shared, config);
+        const settled = await new Promise<AccessioResponse>((resolve, reject) => {
+          settle(
+            resolve as (value: AccessioResponse) => void,
+            reject as (reason: AccessioError) => void,
+            response,
+            config,
+          );
+        });
+
+        if (config.hooks?.onRequestResponse) {
+          await config.hooks.onRequestResponse(settled);
+        }
+
+        return settled;
+      } catch (error) {
+        let finalError = error;
+        if (error instanceof AccessioError) {
+          finalError = AccessioError.from(
+            error,
+            error.code || 'ERR_DEDUPE',
+            config,
+            error.request,
+            error.response,
+          );
+        }
+        if (config.hooks?.onRequestError && finalError instanceof AccessioError) {
+          await config.hooks.onRequestError(finalError);
+        }
+        throw finalError;
+      }
     }
   }
 

package/src/helpers/memoryCache.ts

@@ -2,6 +2,11 @@ import type { CacheProvider } from '../types';
 
 class MemoryCache implements CacheProvider {
   private cache = new Map<string, { value: any; expiry: number | null }>();
+  private maxItems: number;
+
+  constructor(maxItems: number = 1000) {
+    this.maxItems = maxItems;
+  }
 
   get(key: string) {
     const item = this.cache.get(key);
@@ -14,7 +19,24 @@ class MemoryCache implements CacheProvider {
   }
 
   set(key: string, value: any, ttl?: number) {
-    const expiry = ttl ? Date.now() + ttl : null;
+    const now = Date.now();
+
+    // Proactively evict all expired items first
+    for (const [k, item] of this.cache.entries()) {
+      if (item.expiry && now > item.expiry) {
+        this.cache.delete(k);
+      }
+    }
+
+    // Evict oldest item if we are still at limit
+    if (this.cache.size >= this.maxItems) {
+      const oldest = this.cache.keys().next().value;
+      if (oldest !== undefined) {
+        this.cache.delete(oldest);
+      }
+    }
+
+    const expiry = ttl ? now + ttl : null;
     this.cache.set(key, { value, expiry });
   }
 
@@ -28,3 +50,4 @@ class MemoryCache implements CacheProvider {
 }
 
 export const defaultMemoryCache = new MemoryCache();
+export { MemoryCache };

package/src/types.ts

@@ -91,6 +91,11 @@ export interface AccessioRequestConfig {
   dedupe?: boolean;
   cache?: boolean | CacheProvider;
   cacheTTL?: number;
+  cacheKeySerializer?: (
+    config: AccessioRequestConfig,
+    fullURL: string,
+    headers: Record<string, string | string[]>,
+  ) => string;
   onDownloadProgress?: (progressEvent: { loaded: number; total: number }) => void;
   hooks?: AccessioHooks;
   schema?: SchemaValidator;