[ptz0n]

What

Replaces the axios runtime dependency with the platform's native fetch. verisure now has zero runtime dependencies.

Why

Node 18+ has had a built-in fetch for a while now, and this module's HTTP needs are simple enough (JSON bodies, Basic auth, reading Set-Cookie) that a full HTTP client dependency isn't earning its keep. This also happened while working on the homebridge-verisure TypeScript rewrite, which bumps its own minimum Node version, so it's a natural time to do this here too.

Changes

• index.js: fetch instead of axios. Manual Basic-auth header construction, JSON body/content-type handling, and reading multiple Set-Cookie headers via Response.headers.getSetCookie() (Node 18.14+/undici).
• errors.js: errors now carry an isRateLimited flag when the response is an HTTP 429, or a GraphQL error body containing a marker Verisure is known to use for rate/quota limits (e.g. AUT_00021) - even when wrapped in an otherwise-200 GraphQL response. Lets callers (like homebridge-verisure) back off instead of retrying into an already-rate-limited account.
• Network-level failures (DNS, timeout, connection reset) now surface their original message instead of a generic "fetch failed" (fetch wraps these in a generic TypeError with the real cause nested under .cause).
• The constructor takes an optional 4th argument, { dispatcher }, purely for test injection (an undici MockAgent) - production callers never need it.
• Test suite rewritten from nock to undici's MockAgent, injected explicitly via the new constructor option rather than the ambient global-dispatcher trick (which doesn't reliably cross Jest's per-file VM realm boundary).
• Bump minimum Node.js to 18 (engines field), bump dev tooling (eslint 8, eslint-config-airbnb-base 15, jest 29), update CI matrix to Node 18/20/22, drop two unused pre-GraphQL test fixtures.

Breaking

• Minimum Node.js version is now 18 (was 10).
• Errors thrown for non-2xx responses are now a custom HttpError rather than an axios error object, though the same error.response.status / error.response.data shape is preserved for compatibility with existing callers.

Full test suite passes locally (npm test: eslint + jest, 100% statement coverage on the changed files).

[ptz0n]

Manually verified against a real Verisure account (login, MFA, cookie output, and getInstallations() over fetch) via homebridge-verisure's bin/verisure CLI, linked locally against this branch. Works.

[ptz0n]

Same story as over on homebridge-verisure: sorry for the long silence, I haven't forgotten about this project. Time to bring it back to life properly — starting with cleaning up this transport layer while I'm at it.