refactor: use Proxy for ESM-safe Response wrapping

Replace static property wrapper with Proxy-based delegation to fix
critical issues identified in automated reviews:

- Fix stale bodyUsed property (P1 bug)
- Ensure all Response properties remain live/dynamic
- Automatically include all Response methods (including stream())
- Maintain correct 'this' binding for delegated methods
- Preserve prototype chain and type checking

The Proxy approach provides true delegation while preventing Response
mutation, ensuring compatibility with both CommonJS and ESM environments.

Addresses feedback on PR #1430

Author: omarmciver

templates/base/http-clients/fetch-http-client.ejs

@@ -196,29 +196,44 @@ export class HttpClient<SecurityDataType = unknown> {
             body: typeof body === "undefined" || body === null ? null : payloadFormatter(body),
         }
         ).then(async (response) => {
-            // Create a wrapper object that doesn't mutate the Response
+            // Create a Proxy that wraps the Response without mutating it
             // This ensures compatibility with ESM environments where Response is read-only
-            const r = {
-                data: (null as unknown) as T,
-                error: (null as unknown) as E,
-                // Delegate Response properties
-                ok: response.ok,
-                status: response.status,
-                statusText: response.statusText,
-                headers: response.headers,
-                url: response.url,
-                redirected: response.redirected,
-                type: response.type,
-                body: response.body,
-                bodyUsed: response.bodyUsed,
-                // Delegate Response methods
-                arrayBuffer: () => response.arrayBuffer(),
-                blob: () => response.blob(),
-                clone: () => response.clone(),
-                formData: () => response.formData(),
-                json: () => response.json(),
-                text: () => response.text(),
-            } as HttpResponse<T, E>;
+            // while maintaining all Response properties and methods as live/dynamic values
+            const r = new Proxy(response, {
+                get(target, prop) {
+                    // Custom properties for our API wrapper
+                    if (prop === 'data') {
+                        return target._data !== undefined ? target._data : (null as unknown) as T;
+                    }
+                    if (prop === 'error') {
+                        return target._error !== undefined ? target._error : (null as unknown) as E;
+                    }
+
+                    // Delegate everything else to the actual Response object
+                    const value = target[prop];
+
+                    // Bind methods to the original response to maintain correct 'this' context
+                    if (typeof value === 'function') {
+                        return value.bind(target);
+                    }
+
+                    return value;
+                },
+                set(target, prop, value) {
+                    // Allow setting data and error properties
+                    if (prop === 'data') {
+                        target._data = value;
+                        return true;
+                    }
+                    if (prop === 'error') {
+                        target._error = value;
+                        return true;
+                    }
+
+                    // Prevent mutation of Response properties (ESM safety)
+                    return false;
+                }
+            }) as HttpResponse<T, E>;
 
             const responseToParse = responseFormat ? response.clone() : response;
             const data = !responseFormat ? r : await responseToParse[responseFormat]()