create-request 0.0.1-beta.4 → 0.0.1-beta.6

package/dist/library/BaseRequest.d.ts

@@ -57,10 +57,10 @@ export declare abstract class BaseRequest {
     /**
      * Adds a single query parameter
      * @param key - The parameter name
-     * @param value - The parameter value
+     * @param value - The parameter value, can be a single value or array of values
      * @returns The instance for chaining
      */
-    withQueryParam(key: string, value: string | number | boolean | null | undefined): this;
+    withQueryParam(key: string, value: string | string[] | number | boolean | null | undefined): this;
     /**
      * Sets the mode of the request
      * @param mode - The mode for the request (cors, no-cors, same-origin, navigate)
@@ -86,12 +86,24 @@ export declare abstract class BaseRequest {
      * @returns The instance for chaining
      */
     withBasicAuth(username: string, password: string): this;
+    /**
+     * Cross-environment base64 encoding
+     * Works in both browser and Node.js environments
+     */
+    private encodeBase64;
     /**
      * Sets the bearer token for authentication
      * @param token - The bearer token
      * @returns The instance for chaining
      */
     withBearerToken(token: string): this;
+    /**
+     * Helper function to check for header presence in a case-insensitive way
+     * @param headers Headers object
+     * @param headerName Header name to check
+     * @returns Boolean indicating if the header exists (case-insensitive)
+     */
+    private hasHeader;
     /**
      * Sets cookies for the request
      * @param cookies Object containing cookie name-value pairs or cookie options

package/dist/library/BodyRequest.d.ts

@@ -5,7 +5,6 @@ import type { Body } from "./types";
  */
 export declare abstract class BodyRequest extends BaseRequest {
     protected body?: Body;
-    private bodyProcessed;
     private bodyType?;
     /**
      * Sets the body of the request

package/dist/library/ResponseWrapper.d.ts

@@ -2,55 +2,22 @@
  * Wrapper for HTTP responses with methods to transform the response data
  */
 export declare class ResponseWrapper {
-    readonly ok: boolean;
-    private response;
+    private readonly response;
+    private textCache;
+    private jsonCache;
+    private blobCache;
+    private arrayBufferCache;
+    private bodyUsed;
     constructor(response: Response);
-    /**
-     * Get the raw Response object
-     */
-    get raw(): Response;
-    /**
-     * Get the HTTP status code
-     */
     get status(): number;
-    /**
-     * Get the HTTP status text
-     */
     get statusText(): string;
-    /**
-     * Get response headers
-     */
     get headers(): Headers;
-    /**
-     * Parse response as JSON
-     */
+    get ok(): boolean;
+    get raw(): Response;
     getJson<T = unknown>(): Promise<T>;
-    /**
-     * Get response as text
-     */
     getText(): Promise<string>;
-    /**
-     * Get response as Blob
-     */
     getBlob(): Promise<Blob>;
-    /**
-     * Get response as ArrayBuffer
-     */
     getArrayBuffer(): Promise<ArrayBuffer>;
-    /**
-     * Get response as ReadableStream for true streaming consumption.
-     * This allows you to process data incrementally as it arrives.
-     *
-     * @example
-     * const stream = await request.sendTo('https://example.com/large-file').getBody();
-     * const reader = stream.getReader();
-     *
-     * while (true) {
-     *   const { done, value } = await reader.read();
-     *   if (done) break;
-     *   // Process chunk of data in 'value'
-     * }
-     */
     getBody(): ReadableStream<Uint8Array> | null;
 }
 /**

package/dist/library/index.d.ts

@@ -1,11 +1,11 @@
 import { get, put, head, post, patch, del, options } from "./requestFactories";
 import { Config } from "./utils/Config";
-export { HttpMethod, RequestPriority, CredentialsPolicy, RequestMode, RedirectMode, CacheMode, SameSitePolicy, } from "./enums";
+export { HttpMethod, RequestPriority, CredentialsPolicy, RequestMode, RedirectMode, CacheMode, SameSitePolicy } from "./enums";
 export type { RetryCallback, RequestOptions, CookieOptions, CookiesRecord } from "./types";
 export { RequestError } from "./RequestError";
 export { ResponseWrapper } from "./ResponseWrapper";
 export { CookieUtils } from "./utils/CookieUtils";
-export { GetRequest, PostRequest, PutRequest, DeleteRequest, PatchRequest, HeadRequest, OptionsRequest, } from "./requestMethods";
+export { GetRequest, PostRequest, PutRequest, DeleteRequest, PatchRequest, HeadRequest, OptionsRequest } from "./requestMethods";
 declare const create: {
     readonly get: typeof get;
     readonly post: typeof post;

package/dist/library/index.esm.js

@@ -121,72 +121,114 @@ class RequestError extends Error {
  */
 class ResponseWrapper {
     constructor(response) {
+        this.bodyUsed = false;
         this.response = response;
-        this.ok = response.status >= 200 && response.status < 300; // Standard Fetch API behavior
     }
-    /**
-     * Get the raw Response object
-     */
-    get raw() {
-        return this.response;
-    }
-    /**
-     * Get the HTTP status code
-     */
+    // Wrapper properties
     get status() {
         return this.response.status;
     }
-    /**
-     * Get the HTTP status text
-     */
     get statusText() {
         return this.response.statusText;
     }
-    /**
-     * Get response headers
-     */
     get headers() {
         return this.response.headers;
     }
-    /**
-     * Parse response as JSON
-     */
+    get ok() {
+        return this.response.ok;
+    }
+    get raw() {
+        return this.response;
+    }
+    // Response body methods with caching
     async getJson() {
-        return this.response.json();
+        if (this.jsonCache !== undefined) {
+            return this.jsonCache;
+        }
+        if (this.bodyUsed) {
+            // If we already have text, try to parse it as JSON
+            if (this.textCache !== undefined) {
+                try {
+                    // Fix unsafe assignment by explicitly casting to unknown first
+                    this.jsonCache = JSON.parse(this.textCache);
+                    return this.jsonCache;
+                }
+                catch (e) {
+                    throw new Error("Cannot parse cached text as JSON");
+                }
+            }
+            throw new Error("Response body has already been consumed in a different format");
+        }
+        this.bodyUsed = true;
+        this.jsonCache = (await this.response.json());
+        return this.jsonCache;
     }
-    /**
-     * Get response as text
-     */
     async getText() {
-        return this.response.text();
+        if (this.textCache !== undefined) {
+            return this.textCache;
+        }
+        if (this.bodyUsed) {
+            // If we already have JSON, convert it to text
+            if (this.jsonCache !== undefined) {
+                this.textCache = JSON.stringify(this.jsonCache);
+                return this.textCache;
+            }
+            // If we have blob, convert to text
+            if (this.blobCache !== undefined) {
+                this.textCache = await this.blobCache.text();
+                return this.textCache;
+            }
+            throw new Error("Response body has already been consumed in a format that cannot be converted to text");
+        }
+        this.bodyUsed = true;
+        this.textCache = await this.response.text();
+        return this.textCache;
     }
-    /**
-     * Get response as Blob
-     */
     async getBlob() {
-        return this.response.blob();
+        if (this.blobCache !== undefined) {
+            return this.blobCache;
+        }
+        if (this.bodyUsed) {
+            // If we have text, convert to Blob
+            if (this.textCache !== undefined) {
+                this.blobCache = new Blob([this.textCache], { type: "text/plain" });
+                return this.blobCache;
+            }
+            throw new Error("Response body has already been consumed in a format that cannot be converted to Blob");
+        }
+        this.bodyUsed = true;
+        this.blobCache = await this.response.blob();
+        return this.blobCache;
     }
-    /**
-     * Get response as ArrayBuffer
-     */
     async getArrayBuffer() {
-        return this.response.arrayBuffer();
-    }
-    /**
-     * Get response as ReadableStream for true streaming consumption.
-     * This allows you to process data incrementally as it arrives.
-     *
-     * @example
-     * const stream = await request.sendTo('https://example.com/large-file').getBody();
-     * const reader = stream.getReader();
-     *
-     * while (true) {
-     *   const { done, value } = await reader.read();
-     *   if (done) break;
-     *   // Process chunk of data in 'value'
-     * }
-     */
+        if (this.arrayBufferCache !== undefined) {
+            return this.arrayBufferCache;
+        }
+        if (this.bodyUsed) {
+            // If we have text, convert to ArrayBuffer
+            if (this.textCache !== undefined) {
+                const encoder = new TextEncoder();
+                // Fix ArrayBufferLike by explicitly casting to ArrayBuffer
+                const uint8Array = encoder.encode(this.textCache);
+                this.arrayBufferCache = uint8Array.buffer;
+                return this.arrayBufferCache;
+            }
+            // If we have blob, convert to ArrayBuffer
+            if (this.blobCache !== undefined) {
+                this.arrayBufferCache = await this.blobCache.arrayBuffer();
+                return this.arrayBufferCache;
+            }
+            throw new Error("Response body has already been consumed in a format that cannot be converted to ArrayBuffer");
+        }
+        this.bodyUsed = true;
+        this.arrayBufferCache = await this.response.arrayBuffer();
+        return this.arrayBufferCache;
+    }
     getBody() {
+        if (this.bodyUsed) {
+            throw new Error("Response body has already been consumed");
+        }
+        this.bodyUsed = true;
         return this.response.body;
     }
 }
@@ -292,15 +334,15 @@ class Config {
         return this.enableAntiCsrf;
     }
     /**
-     * Reset configuration to defaults
+     * Reset all configuration options to their defaults
      */
     reset() {
         this.csrfToken = null;
         this.csrfHeaderName = "X-CSRF-Token";
+        this.enableAntiCsrf = true;
         this.xsrfCookieName = "XSRF-TOKEN";
         this.xsrfHeaderName = "X-XSRF-TOKEN";
         this.enableAutoXsrf = true;
-        this.enableAntiCsrf = true;
         return this;
     }
 }
@@ -365,12 +407,34 @@ class CsrfUtils {
     }
     /**
      * Validates if the provided string is a potential CSRF token
-     * Checks if the token meets minimum security requirements (non-empty, not too short)
+     * Checks if the token meets security requirements
      * @param token The token to validate
-     * @returns Whether the token is potentially valid
+     * @returns Whether the token is valid
      */
     static isValidToken(token) {
-        return typeof token === "string" && token.length >= 8;
+        // Basic checks for null/undefined and type
+        if (typeof token !== "string") {
+            return false;
+        }
+        if (token.length < 8)
+            return false;
+        // If token is longer than 10 chars, perform additional security checks
+        if (token.length > 10) {
+            // Check for valid character set (alphanumeric & common token symbols)
+            const validTokenRegex = /^[A-Za-z0-9\-_=+/.]+$/;
+            if (!validTokenRegex.test(token)) {
+                return false;
+            }
+            // For longer tokens, check for sufficient entropy (at least 2 character types)
+            const hasUpperCase = /[A-Z]/.test(token);
+            const hasLowerCase = /[a-z]/.test(token);
+            const hasNumbers = /[0-9]/.test(token);
+            const hasSpecials = /[-_=+/.]/.test(token);
+            const characterTypesCount = [hasUpperCase, hasLowerCase, hasNumbers, hasSpecials].filter(Boolean).length;
+            return characterTypesCount >= 2;
+        }
+        // For shorter tokens (8-10 chars), just return true if we reached here
+        return true;
     }
 }
 
@@ -391,10 +455,14 @@ class BaseRequest {
         return this;
     }
     withTimeout(timeout) {
+        if (!Number.isFinite(timeout) || timeout <= 0)
+            throw new Error("Timeout must be a positive number");
         this.requestOptions.timeout = timeout;
         return this;
     }
     withRetries(retries) {
+        if (!Number.isInteger(retries) || retries < 0)
+            throw new Error("Retry count must be a non-negative integer");
         this.requestOptions.retries = retries;
         return this;
     }
@@ -479,13 +547,16 @@ class BaseRequest {
     /**
      * Adds a single query parameter
      * @param key - The parameter name
-     * @param value - The parameter value
+     * @param value - The parameter value, can be a single value or array of values
      * @returns The instance for chaining
      */
     withQueryParam(key, value) {
-        if (value !== null && value !== undefined) {
+        if (value === null || value === undefined)
+            return this;
+        if (Array.isArray(value))
+            value.forEach(v => this.queryParams.append(key, String(v)));
+        else
             this.queryParams.append(key, String(value));
-        }
         return this;
     }
     /**
@@ -524,9 +595,23 @@ class BaseRequest {
      * @returns The instance for chaining
      */
     withBasicAuth(username, password) {
-        const credentials = btoa(`${username}:${password}`);
+        const credentials = this.encodeBase64(`${username}:${password}`);
         return this.withAuthorization(`Basic ${credentials}`);
     }
+    /**
+     * Cross-environment base64 encoding
+     * Works in both browser and Node.js environments
+     */
+    encodeBase64(str) {
+        // Browser environment
+        if (typeof btoa === "function")
+            return btoa(str);
+        // Node.js environment
+        if (typeof Buffer !== "undefined")
+            return Buffer.from(str).toString("base64");
+        // Fallback (should never happen in modern environments)
+        throw new Error("Base64 encoding is not supported in this environment");
+    }
     /**
      * Sets the bearer token for authentication
      * @param token - The bearer token
@@ -535,6 +620,15 @@ class BaseRequest {
     withBearerToken(token) {
         return this.withAuthorization(`Bearer ${token}`);
     }
+    /**
+     * Helper function to check for header presence in a case-insensitive way
+     * @param headers Headers object
+     * @param headerName Header name to check
+     * @returns Boolean indicating if the header exists (case-insensitive)
+     */
+    hasHeader(headers, headerName) {
+        return Object.keys(headers).some(key => key.toLowerCase() === headerName.toLowerCase());
+    }
     /**
      * Sets cookies for the request
      * @param cookies Object containing cookie name-value pairs or cookie options
@@ -547,19 +641,34 @@ class BaseRequest {
         }
         // Get current headers or initialize empty object
         const currentHeaders = this.requestOptions.headers || {};
-        // Get the existing cookie header in a case-insensitive way
-        let existingCookies = "";
-        const cookieHeaderName = Object.keys(currentHeaders).find(header => header.toLowerCase() === "cookie");
-        if (cookieHeaderName)
-            existingCookies = currentHeaders[cookieHeaderName];
+        // Get all existing cookie headers with different cases
+        const cookieValues = [];
+        const cookieHeaderKeys = [];
+        Object.keys(currentHeaders).forEach(key => {
+            if (key.toLowerCase() === "cookie") {
+                // Don't add empty cookie values
+                if (currentHeaders[key])
+                    cookieValues.push(currentHeaders[key]);
+                cookieHeaderKeys.push(key);
+            }
+        });
+        // Format the new cookies
         const cookieString = CookieUtils.formatRequestCookies(cookies);
-        // Combine with existing cookies if present
-        const newCookieValue = existingCookies ? `${existingCookies}; ${cookieString}` : cookieString;
-        // Set the Cookie header, preserving original case if it exists
-        const headerName = cookieHeaderName || "Cookie";
-        return this.withHeaders({
-            [headerName]: newCookieValue,
+        // Choose which header name to use - preserve existing case if possible
+        const headerName = cookieHeaderKeys.length > 0 ? cookieHeaderKeys[0] : "Cookie";
+        // Combine all existing cookie values with the new ones
+        const combinedCookieValue = [...cookieValues, cookieString].filter(Boolean).join("; ");
+        // Create a new headers object without any cookie headers
+        const newHeaders = { ...currentHeaders };
+        cookieHeaderKeys.forEach(key => {
+            delete newHeaders[key];
         });
+        // Set the new combined cookie header
+        this.requestOptions.headers = {
+            ...newHeaders,
+            [headerName]: combinedCookieValue,
+        };
+        return this;
     }
     /**
      * Set a single cookie
@@ -618,12 +727,13 @@ class BaseRequest {
             // Apply global CSRF token if set
             const globalToken = config.getCsrfToken();
             if (globalToken) {
-                // Check if local token exists
+                // Check if local token exists using case-insensitive comparison
                 const headers = this.requestOptions.headers;
-                const hasLocalToken = Object.keys(headers).some(key => key === "X-CSRF-Token" || key === config.getCsrfHeaderName());
+                const csrfHeaderName = config.getCsrfHeaderName();
+                const hasLocalToken = this.hasHeader(headers, "X-CSRF-Token") || this.hasHeader(headers, csrfHeaderName);
                 if (!hasLocalToken) {
                     this.withHeaders({
-                        [config.getCsrfHeaderName()]: globalToken,
+                        [csrfHeaderName]: globalToken,
                     });
                 }
             }
@@ -632,10 +742,11 @@ class BaseRequest {
                 const xsrfToken = CsrfUtils.getTokenFromCookie(config.getXsrfCookieName());
                 if (xsrfToken && CsrfUtils.isValidToken(xsrfToken)) {
                     const headers = this.requestOptions.headers;
-                    const hasLocalToken = Object.keys(headers).some(key => key === "X-XSRF-TOKEN" || key === config.getXsrfHeaderName());
+                    const xsrfHeaderName = config.getXsrfHeaderName();
+                    const hasLocalToken = this.hasHeader(headers, "X-XSRF-TOKEN") || this.hasHeader(headers, xsrfHeaderName);
                     if (!hasLocalToken) {
                         this.withHeaders({
-                            [config.getXsrfHeaderName()]: xsrfToken,
+                            [xsrfHeaderName]: xsrfToken,
                         });
                     }
                 }
@@ -647,9 +758,7 @@ class BaseRequest {
             method: this.method,
         };
         // Create the base promise
-        const basePromise = !this.requestOptions.retries
-            ? this.executeRequest(url, fetchOptions)
-            : this.executeWithRetries(url, fetchOptions);
+        const basePromise = !this.requestOptions.retries ? this.executeRequest(url, fetchOptions) : this.executeWithRetries(url, fetchOptions);
         const responsePromise = basePromise;
         // Attach convenience methods that begin processing immediately
         responsePromise.getJson = async () => {
@@ -678,12 +787,21 @@ class BaseRequest {
         if (!this.queryParams.toString()) {
             return url;
         }
-        const urlObj = new URL(url);
-        // Merge our query params with any that might be in the URL already
-        this.queryParams.forEach((value, key) => {
-            urlObj.searchParams.append(key, value);
-        });
-        return urlObj.toString();
+        try {
+            // Try to use the URL constructor (works for absolute URLs)
+            const urlObj = new URL(url);
+            // Merge our query params with any that might be in the URL already
+            this.queryParams.forEach((value, key) => {
+                urlObj.searchParams.append(key, value);
+            });
+            return urlObj.toString();
+        }
+        catch (error) {
+            // Handle relative URLs
+            const hasExistingParams = url.includes("?");
+            const separator = hasExistingParams ? "&" : "?";
+            return `${url}${separator}${this.queryParams.toString()}`;
+        }
     }
     /**
      * Executes a request with configured retry logic
@@ -694,38 +812,65 @@ class BaseRequest {
     async executeWithRetries(url, fetchOptions) {
         let attempt = 0;
         const maxRetries = this.requestOptions.retries || 0;
-        // eslint-disable-next-line no-constant-condition
-        while (true) {
+        do {
             try {
                 return await this.executeRequest(url, fetchOptions);
             }
             catch (error) {
-                const requestError = error instanceof RequestError
-                    ? error
-                    : RequestError.networkError(url, fetchOptions.method, error);
-                if (attempt >= maxRetries || requestError.timeoutError) {
+                const requestError = error instanceof RequestError ? error : RequestError.networkError(url, fetchOptions.method, error);
+                // Don't retry on timeout errors or if we've reached the max retries
+                if (attempt >= maxRetries || requestError.timeoutError)
                     throw requestError;
-                }
                 attempt++;
                 if (this.requestOptions.onRetry) {
                     await this.requestOptions.onRetry({ attempt, error: requestError });
                 }
             }
-        }
+        } while (attempt <= maxRetries);
+        // If we somehow get here, we throw an error to avoid undefined behavior
+        throw new RequestError(`Max retries reached (${maxRetries}) but request still failed`, url, fetchOptions.method);
     }
     async executeRequest(url, fetchOptions) {
         // Create a request controller for timeout if needed, or use the provided one
         const controller = this.abortController || new AbortController();
         const { signal } = controller;
         // Use the controller signal for the fetch request, but don't overwrite an existing signal
-        // that might have been set in requestOptions if it exists
         fetchOptions.signal = fetchOptions.signal || signal;
         let timeoutId;
-        // If we have a timeout and we're using our own controller (not provided externally)
-        if (this.requestOptions.timeout && !this.abortController) {
-            timeoutId = setTimeout(() => {
-                controller.abort();
-            }, this.requestOptions.timeout);
+        // Flag to track if abort was caused by our timeout
+        let abortedByTimeout = false;
+        // Handle timeout regardless of whether an external controller is provided
+        if (this.requestOptions.timeout) {
+            if (this.abortController) {
+                // If we have an external controller, create a separate timeout controller
+                // that won't interfere with the external one
+                // Use AbortSignal.timeout if available (modern browsers)
+                if (typeof AbortSignal.timeout === "function") {
+                    const timeoutSignal = AbortSignal.timeout(this.requestOptions.timeout);
+                    // Add event listener to propagate the abort to the main controller
+                    timeoutSignal.addEventListener("abort", () => {
+                        if (!controller.signal.aborted) {
+                            abortedByTimeout = true;
+                            controller.abort();
+                        }
+                    });
+                }
+                else {
+                    // Fallback for browsers without AbortSignal.timeout
+                    timeoutId = setTimeout(() => {
+                        if (!controller.signal.aborted) {
+                            abortedByTimeout = true;
+                            controller.abort();
+                        }
+                    }, this.requestOptions.timeout);
+                }
+            }
+            else {
+                timeoutId = setTimeout(() => {
+                    abortedByTimeout = true;
+                    controller.abort();
+                }, this.requestOptions.timeout);
+            }
         }
         try {
             let response;
@@ -733,11 +878,11 @@ class BaseRequest {
                 response = await fetch(url, fetchOptions);
             }
             catch (error) {
-                // Check if this is an abort error from our timeout
-                if (error instanceof DOMException && error.name === "AbortError" && timeoutId) {
+                // Check if this is an abort error that was specifically caused by our timeout
+                if (error instanceof DOMException && error.name === "AbortError" && abortedByTimeout) {
                     throw RequestError.timeout(url, fetchOptions.method, this.requestOptions.timeout);
                 }
-                // Otherwise it's a network error
+                // Otherwise it's either a user-triggered abort or another network error
                 throw RequestError.networkError(url, fetchOptions.method, error);
             }
             if (!response.ok) {
@@ -758,17 +903,12 @@ class BaseRequest {
  * Base class for requests that can have a body (POST, PUT, PATCH)
  */
 class BodyRequest extends BaseRequest {
-    constructor() {
-        super(...arguments);
-        this.bodyProcessed = false;
-    }
     /**
      * Sets the body of the request
      * @param body - The request body
      */
     withBody(body) {
         this.body = body;
-        this.bodyProcessed = false;
         // Set body type and validate
         if (typeof body === "string") {
             this.bodyType = BodyType.STRING;
@@ -776,11 +916,7 @@ class BodyRequest extends BaseRequest {
         }
         else if (body !== null &&
             typeof body === "object" &&
-            !(body instanceof FormData ||
-                body instanceof Blob ||
-                body instanceof ArrayBuffer ||
-                body instanceof URLSearchParams ||
-                body instanceof ReadableStream)) {
+            !(body instanceof FormData || body instanceof Blob || body instanceof ArrayBuffer || body instanceof URLSearchParams || body instanceof ReadableStream)) {
             this.bodyType = BodyType.JSON;
             this.setContentTypeIfNeeded("application/json");
             // Validate JSON is stringifiable early
@@ -808,15 +944,17 @@ class BodyRequest extends BaseRequest {
      * Overrides the base implementation to add body handling
      */
     sendTo(url) {
-        // Process body only once
-        if (!this.bodyProcessed && this.body !== undefined && !this.requestOptions.body) {
+        if (this.body !== undefined) {
+            // Remove previous body if it exists
+            if (this.requestOptions.body)
+                delete this.requestOptions.body;
+            // Process the body based on its type
             if (this.bodyType === BodyType.JSON) {
                 this.requestOptions.body = JSON.stringify(this.body);
             }
             else {
                 this.requestOptions.body = this.body;
             }
-            this.bodyProcessed = true;
         }
         return super.sendTo(url);
     }

package/dist/library/index.js

@@ -127,72 +127,114 @@
      */
     class ResponseWrapper {
         constructor(response) {
+            this.bodyUsed = false;
             this.response = response;
-            this.ok = response.status >= 200 && response.status < 300; // Standard Fetch API behavior
         }
-        /**
-         * Get the raw Response object
-         */
-        get raw() {
-            return this.response;
-        }
-        /**
-         * Get the HTTP status code
-         */
+        // Wrapper properties
         get status() {
             return this.response.status;
         }
-        /**
-         * Get the HTTP status text
-         */
         get statusText() {
             return this.response.statusText;
         }
-        /**
-         * Get response headers
-         */
         get headers() {
             return this.response.headers;
         }
-        /**
-         * Parse response as JSON
-         */
+        get ok() {
+            return this.response.ok;
+        }
+        get raw() {
+            return this.response;
+        }
+        // Response body methods with caching
         async getJson() {
-            return this.response.json();
+            if (this.jsonCache !== undefined) {
+                return this.jsonCache;
+            }
+            if (this.bodyUsed) {
+                // If we already have text, try to parse it as JSON
+                if (this.textCache !== undefined) {
+                    try {
+                        // Fix unsafe assignment by explicitly casting to unknown first
+                        this.jsonCache = JSON.parse(this.textCache);
+                        return this.jsonCache;
+                    }
+                    catch (e) {
+                        throw new Error("Cannot parse cached text as JSON");
+                    }
+                }
+                throw new Error("Response body has already been consumed in a different format");
+            }
+            this.bodyUsed = true;
+            this.jsonCache = (await this.response.json());
+            return this.jsonCache;
         }
-        /**
-         * Get response as text
-         */
         async getText() {
-            return this.response.text();
+            if (this.textCache !== undefined) {
+                return this.textCache;
+            }
+            if (this.bodyUsed) {
+                // If we already have JSON, convert it to text
+                if (this.jsonCache !== undefined) {
+                    this.textCache = JSON.stringify(this.jsonCache);
+                    return this.textCache;
+                }
+                // If we have blob, convert to text
+                if (this.blobCache !== undefined) {
+                    this.textCache = await this.blobCache.text();
+                    return this.textCache;
+                }
+                throw new Error("Response body has already been consumed in a format that cannot be converted to text");
+            }
+            this.bodyUsed = true;
+            this.textCache = await this.response.text();
+            return this.textCache;
         }
-        /**
-         * Get response as Blob
-         */
         async getBlob() {
-            return this.response.blob();
+            if (this.blobCache !== undefined) {
+                return this.blobCache;
+            }
+            if (this.bodyUsed) {
+                // If we have text, convert to Blob
+                if (this.textCache !== undefined) {
+                    this.blobCache = new Blob([this.textCache], { type: "text/plain" });
+                    return this.blobCache;
+                }
+                throw new Error("Response body has already been consumed in a format that cannot be converted to Blob");
+            }
+            this.bodyUsed = true;
+            this.blobCache = await this.response.blob();
+            return this.blobCache;
         }
-        /**
-         * Get response as ArrayBuffer
-         */
         async getArrayBuffer() {
-            return this.response.arrayBuffer();
-        }
-        /**
-         * Get response as ReadableStream for true streaming consumption.
-         * This allows you to process data incrementally as it arrives.
-         *
-         * @example
-         * const stream = await request.sendTo('https://example.com/large-file').getBody();
-         * const reader = stream.getReader();
-         *
-         * while (true) {
-         *   const { done, value } = await reader.read();
-         *   if (done) break;
-         *   // Process chunk of data in 'value'
-         * }
-         */
+            if (this.arrayBufferCache !== undefined) {
+                return this.arrayBufferCache;
+            }
+            if (this.bodyUsed) {
+                // If we have text, convert to ArrayBuffer
+                if (this.textCache !== undefined) {
+                    const encoder = new TextEncoder();
+                    // Fix ArrayBufferLike by explicitly casting to ArrayBuffer
+                    const uint8Array = encoder.encode(this.textCache);
+                    this.arrayBufferCache = uint8Array.buffer;
+                    return this.arrayBufferCache;
+                }
+                // If we have blob, convert to ArrayBuffer
+                if (this.blobCache !== undefined) {
+                    this.arrayBufferCache = await this.blobCache.arrayBuffer();
+                    return this.arrayBufferCache;
+                }
+                throw new Error("Response body has already been consumed in a format that cannot be converted to ArrayBuffer");
+            }
+            this.bodyUsed = true;
+            this.arrayBufferCache = await this.response.arrayBuffer();
+            return this.arrayBufferCache;
+        }
         getBody() {
+            if (this.bodyUsed) {
+                throw new Error("Response body has already been consumed");
+            }
+            this.bodyUsed = true;
             return this.response.body;
         }
     }
@@ -298,15 +340,15 @@
             return this.enableAntiCsrf;
         }
         /**
-         * Reset configuration to defaults
+         * Reset all configuration options to their defaults
          */
         reset() {
             this.csrfToken = null;
             this.csrfHeaderName = "X-CSRF-Token";
+            this.enableAntiCsrf = true;
             this.xsrfCookieName = "XSRF-TOKEN";
             this.xsrfHeaderName = "X-XSRF-TOKEN";
             this.enableAutoXsrf = true;
-            this.enableAntiCsrf = true;
             return this;
         }
     }
@@ -371,12 +413,34 @@
         }
         /**
          * Validates if the provided string is a potential CSRF token
-         * Checks if the token meets minimum security requirements (non-empty, not too short)
+         * Checks if the token meets security requirements
          * @param token The token to validate
-         * @returns Whether the token is potentially valid
+         * @returns Whether the token is valid
          */
         static isValidToken(token) {
-            return typeof token === "string" && token.length >= 8;
+            // Basic checks for null/undefined and type
+            if (typeof token !== "string") {
+                return false;
+            }
+            if (token.length < 8)
+                return false;
+            // If token is longer than 10 chars, perform additional security checks
+            if (token.length > 10) {
+                // Check for valid character set (alphanumeric & common token symbols)
+                const validTokenRegex = /^[A-Za-z0-9\-_=+/.]+$/;
+                if (!validTokenRegex.test(token)) {
+                    return false;
+                }
+                // For longer tokens, check for sufficient entropy (at least 2 character types)
+                const hasUpperCase = /[A-Z]/.test(token);
+                const hasLowerCase = /[a-z]/.test(token);
+                const hasNumbers = /[0-9]/.test(token);
+                const hasSpecials = /[-_=+/.]/.test(token);
+                const characterTypesCount = [hasUpperCase, hasLowerCase, hasNumbers, hasSpecials].filter(Boolean).length;
+                return characterTypesCount >= 2;
+            }
+            // For shorter tokens (8-10 chars), just return true if we reached here
+            return true;
         }
     }
 
@@ -397,10 +461,14 @@
             return this;
         }
         withTimeout(timeout) {
+            if (!Number.isFinite(timeout) || timeout <= 0)
+                throw new Error("Timeout must be a positive number");
             this.requestOptions.timeout = timeout;
             return this;
         }
         withRetries(retries) {
+            if (!Number.isInteger(retries) || retries < 0)
+                throw new Error("Retry count must be a non-negative integer");
             this.requestOptions.retries = retries;
             return this;
         }
@@ -485,13 +553,16 @@
         /**
          * Adds a single query parameter
          * @param key - The parameter name
-         * @param value - The parameter value
+         * @param value - The parameter value, can be a single value or array of values
          * @returns The instance for chaining
          */
         withQueryParam(key, value) {
-            if (value !== null && value !== undefined) {
+            if (value === null || value === undefined)
+                return this;
+            if (Array.isArray(value))
+                value.forEach(v => this.queryParams.append(key, String(v)));
+            else
                 this.queryParams.append(key, String(value));
-            }
             return this;
         }
         /**
@@ -530,9 +601,23 @@
          * @returns The instance for chaining
          */
         withBasicAuth(username, password) {
-            const credentials = btoa(`${username}:${password}`);
+            const credentials = this.encodeBase64(`${username}:${password}`);
             return this.withAuthorization(`Basic ${credentials}`);
         }
+        /**
+         * Cross-environment base64 encoding
+         * Works in both browser and Node.js environments
+         */
+        encodeBase64(str) {
+            // Browser environment
+            if (typeof btoa === "function")
+                return btoa(str);
+            // Node.js environment
+            if (typeof Buffer !== "undefined")
+                return Buffer.from(str).toString("base64");
+            // Fallback (should never happen in modern environments)
+            throw new Error("Base64 encoding is not supported in this environment");
+        }
         /**
          * Sets the bearer token for authentication
          * @param token - The bearer token
@@ -541,6 +626,15 @@
         withBearerToken(token) {
             return this.withAuthorization(`Bearer ${token}`);
         }
+        /**
+         * Helper function to check for header presence in a case-insensitive way
+         * @param headers Headers object
+         * @param headerName Header name to check
+         * @returns Boolean indicating if the header exists (case-insensitive)
+         */
+        hasHeader(headers, headerName) {
+            return Object.keys(headers).some(key => key.toLowerCase() === headerName.toLowerCase());
+        }
         /**
          * Sets cookies for the request
          * @param cookies Object containing cookie name-value pairs or cookie options
@@ -553,19 +647,34 @@
             }
             // Get current headers or initialize empty object
             const currentHeaders = this.requestOptions.headers || {};
-            // Get the existing cookie header in a case-insensitive way
-            let existingCookies = "";
-            const cookieHeaderName = Object.keys(currentHeaders).find(header => header.toLowerCase() === "cookie");
-            if (cookieHeaderName)
-                existingCookies = currentHeaders[cookieHeaderName];
+            // Get all existing cookie headers with different cases
+            const cookieValues = [];
+            const cookieHeaderKeys = [];
+            Object.keys(currentHeaders).forEach(key => {
+                if (key.toLowerCase() === "cookie") {
+                    // Don't add empty cookie values
+                    if (currentHeaders[key])
+                        cookieValues.push(currentHeaders[key]);
+                    cookieHeaderKeys.push(key);
+                }
+            });
+            // Format the new cookies
             const cookieString = CookieUtils.formatRequestCookies(cookies);
-            // Combine with existing cookies if present
-            const newCookieValue = existingCookies ? `${existingCookies}; ${cookieString}` : cookieString;
-            // Set the Cookie header, preserving original case if it exists
-            const headerName = cookieHeaderName || "Cookie";
-            return this.withHeaders({
-                [headerName]: newCookieValue,
+            // Choose which header name to use - preserve existing case if possible
+            const headerName = cookieHeaderKeys.length > 0 ? cookieHeaderKeys[0] : "Cookie";
+            // Combine all existing cookie values with the new ones
+            const combinedCookieValue = [...cookieValues, cookieString].filter(Boolean).join("; ");
+            // Create a new headers object without any cookie headers
+            const newHeaders = { ...currentHeaders };
+            cookieHeaderKeys.forEach(key => {
+                delete newHeaders[key];
             });
+            // Set the new combined cookie header
+            this.requestOptions.headers = {
+                ...newHeaders,
+                [headerName]: combinedCookieValue,
+            };
+            return this;
         }
         /**
          * Set a single cookie
@@ -624,12 +733,13 @@
                 // Apply global CSRF token if set
                 const globalToken = config.getCsrfToken();
                 if (globalToken) {
-                    // Check if local token exists
+                    // Check if local token exists using case-insensitive comparison
                     const headers = this.requestOptions.headers;
-                    const hasLocalToken = Object.keys(headers).some(key => key === "X-CSRF-Token" || key === config.getCsrfHeaderName());
+                    const csrfHeaderName = config.getCsrfHeaderName();
+                    const hasLocalToken = this.hasHeader(headers, "X-CSRF-Token") || this.hasHeader(headers, csrfHeaderName);
                     if (!hasLocalToken) {
                         this.withHeaders({
-                            [config.getCsrfHeaderName()]: globalToken,
+                            [csrfHeaderName]: globalToken,
                         });
                     }
                 }
@@ -638,10 +748,11 @@
                     const xsrfToken = CsrfUtils.getTokenFromCookie(config.getXsrfCookieName());
                     if (xsrfToken && CsrfUtils.isValidToken(xsrfToken)) {
                         const headers = this.requestOptions.headers;
-                        const hasLocalToken = Object.keys(headers).some(key => key === "X-XSRF-TOKEN" || key === config.getXsrfHeaderName());
+                        const xsrfHeaderName = config.getXsrfHeaderName();
+                        const hasLocalToken = this.hasHeader(headers, "X-XSRF-TOKEN") || this.hasHeader(headers, xsrfHeaderName);
                         if (!hasLocalToken) {
                             this.withHeaders({
-                                [config.getXsrfHeaderName()]: xsrfToken,
+                                [xsrfHeaderName]: xsrfToken,
                             });
                         }
                     }
@@ -653,9 +764,7 @@
                 method: this.method,
             };
             // Create the base promise
-            const basePromise = !this.requestOptions.retries
-                ? this.executeRequest(url, fetchOptions)
-                : this.executeWithRetries(url, fetchOptions);
+            const basePromise = !this.requestOptions.retries ? this.executeRequest(url, fetchOptions) : this.executeWithRetries(url, fetchOptions);
             const responsePromise = basePromise;
             // Attach convenience methods that begin processing immediately
             responsePromise.getJson = async () => {
@@ -684,12 +793,21 @@
             if (!this.queryParams.toString()) {
                 return url;
             }
-            const urlObj = new URL(url);
-            // Merge our query params with any that might be in the URL already
-            this.queryParams.forEach((value, key) => {
-                urlObj.searchParams.append(key, value);
-            });
-            return urlObj.toString();
+            try {
+                // Try to use the URL constructor (works for absolute URLs)
+                const urlObj = new URL(url);
+                // Merge our query params with any that might be in the URL already
+                this.queryParams.forEach((value, key) => {
+                    urlObj.searchParams.append(key, value);
+                });
+                return urlObj.toString();
+            }
+            catch (error) {
+                // Handle relative URLs
+                const hasExistingParams = url.includes("?");
+                const separator = hasExistingParams ? "&" : "?";
+                return `${url}${separator}${this.queryParams.toString()}`;
+            }
         }
         /**
          * Executes a request with configured retry logic
@@ -700,38 +818,65 @@
         async executeWithRetries(url, fetchOptions) {
             let attempt = 0;
             const maxRetries = this.requestOptions.retries || 0;
-            // eslint-disable-next-line no-constant-condition
-            while (true) {
+            do {
                 try {
                     return await this.executeRequest(url, fetchOptions);
                 }
                 catch (error) {
-                    const requestError = error instanceof RequestError
-                        ? error
-                        : RequestError.networkError(url, fetchOptions.method, error);
-                    if (attempt >= maxRetries || requestError.timeoutError) {
+                    const requestError = error instanceof RequestError ? error : RequestError.networkError(url, fetchOptions.method, error);
+                    // Don't retry on timeout errors or if we've reached the max retries
+                    if (attempt >= maxRetries || requestError.timeoutError)
                         throw requestError;
-                    }
                     attempt++;
                     if (this.requestOptions.onRetry) {
                         await this.requestOptions.onRetry({ attempt, error: requestError });
                     }
                 }
-            }
+            } while (attempt <= maxRetries);
+            // If we somehow get here, we throw an error to avoid undefined behavior
+            throw new RequestError(`Max retries reached (${maxRetries}) but request still failed`, url, fetchOptions.method);
         }
         async executeRequest(url, fetchOptions) {
             // Create a request controller for timeout if needed, or use the provided one
             const controller = this.abortController || new AbortController();
             const { signal } = controller;
             // Use the controller signal for the fetch request, but don't overwrite an existing signal
-            // that might have been set in requestOptions if it exists
             fetchOptions.signal = fetchOptions.signal || signal;
             let timeoutId;
-            // If we have a timeout and we're using our own controller (not provided externally)
-            if (this.requestOptions.timeout && !this.abortController) {
-                timeoutId = setTimeout(() => {
-                    controller.abort();
-                }, this.requestOptions.timeout);
+            // Flag to track if abort was caused by our timeout
+            let abortedByTimeout = false;
+            // Handle timeout regardless of whether an external controller is provided
+            if (this.requestOptions.timeout) {
+                if (this.abortController) {
+                    // If we have an external controller, create a separate timeout controller
+                    // that won't interfere with the external one
+                    // Use AbortSignal.timeout if available (modern browsers)
+                    if (typeof AbortSignal.timeout === "function") {
+                        const timeoutSignal = AbortSignal.timeout(this.requestOptions.timeout);
+                        // Add event listener to propagate the abort to the main controller
+                        timeoutSignal.addEventListener("abort", () => {
+                            if (!controller.signal.aborted) {
+                                abortedByTimeout = true;
+                                controller.abort();
+                            }
+                        });
+                    }
+                    else {
+                        // Fallback for browsers without AbortSignal.timeout
+                        timeoutId = setTimeout(() => {
+                            if (!controller.signal.aborted) {
+                                abortedByTimeout = true;
+                                controller.abort();
+                            }
+                        }, this.requestOptions.timeout);
+                    }
+                }
+                else {
+                    timeoutId = setTimeout(() => {
+                        abortedByTimeout = true;
+                        controller.abort();
+                    }, this.requestOptions.timeout);
+                }
             }
             try {
                 let response;
@@ -739,11 +884,11 @@
                     response = await fetch(url, fetchOptions);
                 }
                 catch (error) {
-                    // Check if this is an abort error from our timeout
-                    if (error instanceof DOMException && error.name === "AbortError" && timeoutId) {
+                    // Check if this is an abort error that was specifically caused by our timeout
+                    if (error instanceof DOMException && error.name === "AbortError" && abortedByTimeout) {
                         throw RequestError.timeout(url, fetchOptions.method, this.requestOptions.timeout);
                     }
-                    // Otherwise it's a network error
+                    // Otherwise it's either a user-triggered abort or another network error
                     throw RequestError.networkError(url, fetchOptions.method, error);
                 }
                 if (!response.ok) {
@@ -764,17 +909,12 @@
      * Base class for requests that can have a body (POST, PUT, PATCH)
      */
     class BodyRequest extends BaseRequest {
-        constructor() {
-            super(...arguments);
-            this.bodyProcessed = false;
-        }
         /**
          * Sets the body of the request
          * @param body - The request body
          */
         withBody(body) {
             this.body = body;
-            this.bodyProcessed = false;
             // Set body type and validate
             if (typeof body === "string") {
                 this.bodyType = BodyType.STRING;
@@ -782,11 +922,7 @@
             }
             else if (body !== null &&
                 typeof body === "object" &&
-                !(body instanceof FormData ||
-                    body instanceof Blob ||
-                    body instanceof ArrayBuffer ||
-                    body instanceof URLSearchParams ||
-                    body instanceof ReadableStream)) {
+                !(body instanceof FormData || body instanceof Blob || body instanceof ArrayBuffer || body instanceof URLSearchParams || body instanceof ReadableStream)) {
                 this.bodyType = BodyType.JSON;
                 this.setContentTypeIfNeeded("application/json");
                 // Validate JSON is stringifiable early
@@ -814,15 +950,17 @@
          * Overrides the base implementation to add body handling
          */
         sendTo(url) {
-            // Process body only once
-            if (!this.bodyProcessed && this.body !== undefined && !this.requestOptions.body) {
+            if (this.body !== undefined) {
+                // Remove previous body if it exists
+                if (this.requestOptions.body)
+                    delete this.requestOptions.body;
+                // Process the body based on its type
                 if (this.bodyType === BodyType.JSON) {
                     this.requestOptions.body = JSON.stringify(this.body);
                 }
                 else {
                     this.requestOptions.body = this.body;
                 }
-                this.bodyProcessed = true;
             }
             return super.sendTo(url);
         }

package/dist/library/types.d.ts

@@ -16,7 +16,7 @@ export interface CookieOptions {
     maxAge?: number;
 }
 export type CookiesRecord = Record<string, string | CookieOptions>;
-export { CacheMode, HttpMethod, RequestMode, RedirectMode, SameSitePolicy, RequestPriority, CredentialsPolicy, };
+export { CacheMode, HttpMethod, RequestMode, RedirectMode, SameSitePolicy, RequestPriority, CredentialsPolicy };
 export interface RequestOptions extends Omit<RequestInit, "signal" | "body" | "method" | "credentials" | "mode" | "redirect" | "cache" | "priority"> {
     timeout?: number;
     retries?: number;

package/dist/library/utils/Config.d.ts

@@ -63,7 +63,7 @@ export declare class Config {
      */
     isAntiCsrfEnabled(): boolean;
     /**
-     * Reset configuration to defaults
+     * Reset all configuration options to their defaults
      */
     reset(): Config;
 }

package/dist/library/utils/CsrfUtils.d.ts

@@ -16,9 +16,9 @@ export declare class CsrfUtils {
     static getTokenFromCookie(cookieName?: string): string | null;
     /**
      * Validates if the provided string is a potential CSRF token
-     * Checks if the token meets minimum security requirements (non-empty, not too short)
+     * Checks if the token meets security requirements
      * @param token The token to validate
-     * @returns Whether the token is potentially valid
+     * @returns Whether the token is valid
      */
     static isValidToken(token: string | null | undefined): boolean;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-request",
-  "version": "0.0.1-beta.4",
+  "version": "0.0.1-beta.6",
   "description": "A modern, chainable wrapper for fetch with automatic retries, timeouts, comprehensive error handling, and first-class TypeScript support",
   "main": "dist/library/index.js",
   "module": "dist/library/index.esm.js",
@@ -15,10 +15,10 @@
     "test:coverage": "tsc -p tsconfig.test.json && node --test --experimental-test-coverage dist/tests/test/",
     "pretest": "tsc -p tsconfig.test.json",
     "prepublishOnly": "npm run check && npm run build",
-    "publish:beta": "npm version prerelease --preid=beta && git push origin --tags && npm publish --tag beta",
-    "publish:patch": "npm version patch && git push origin --tags && npm publish",
-    "publish:minor": "npm version minor && git push origin --tags && npm publish",
-    "publish:major": "npm version major && git push origin --tags && npm publish",
+    "publish:beta": "npm run check && npm version prerelease --preid=beta && git push origin --tags && npm publish --tag latest",
+    "disabled:publish:patch": "npm version patch && git push origin --tags && npm publish",
+    "disabled:publish:minor": "npm version minor && git push origin --tags && npm publish",
+    "disabled:publish:major": "npm version major && git push origin --tags && npm publish",
     "lint": "eslint 'src/**/*.ts' 'test/**/*.ts'",
     "lint:fix": "eslint 'src/**/*.ts' 'test/**/*.ts' --fix",
     "format": "prettier --write 'src/**/*.ts' 'test/**/*.ts'",
@@ -36,7 +36,7 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/DanielAmenou/create-request"
+    "url": "https://github.com/DanielAmenou/create-request.git"
   },
   "devDependencies": {
     "@rollup/plugin-commonjs": "^22.0.0",