@fgv/ts-extras 5.1.0-5 → 5.1.0-50

package/lib/packlets/safer-fetch/retry.d.ts

@@ -0,0 +1,162 @@
+import { type Result } from '@fgv/ts-utils';
+import type { FetchFailureReason } from './failureReason';
+import type { SaferFetchMethod } from './model';
+/**
+ * Opt-in retry policy.
+ *
+ * @remarks
+ * **Retry is off by default and has to be asked for.** A primitive that silently retries
+ * changes the semantics of every call site and amplifies load against a service that is already
+ * struggling.
+ *
+ * Two rules are load-bearing rather than incidental, and are worth reading before enabling this:
+ *
+ * **Every attempt re-runs the address guard from hop 0 — a full re-walk, never a resume and
+ * never a cached verdict.** Reusing an earlier attempt's verdict would make retry its own
+ * DNS-rebinding vector: an attacker needs the guard to pass once and a connect to land on a
+ * private address, so `N` connects against **one** check multiplies their odds by the retry
+ * count — and a retry delay is precisely when a short-TTL rebind lands. A resume is
+ * independently wrong because the redirect chain is not stable across attempts: attempt 2's
+ * server may answer with a different `Location`, so revalidating only the current hop would
+ * validate a chain the request no longer follows. The consequence is that retries cost more
+ * than a naive implementation would suggest — each carries full re-resolution — and that cost
+ * is deliberate.
+ *
+ * **The overall deadline is the ceiling.** Retries consume `timeoutMs` and never reset it, so
+ * `{ timeoutMs: 30_000, retry: { attempts: 3 } }` is a thirty-second call, not a two-minute
+ * one. When the remaining budget is shorter than the computed delay, the call fails with the
+ * attempt's own failure rather than sleeping past its deadline.
+ * @public
+ */
+export interface IRetryPolicy {
+    /**
+     * Additional attempts after the first, **not** a total. `attempts: 2` means up to three
+     * requests. Must be a non-negative integer; `0` disables retry.
+     */
+    readonly attempts: number;
+    /**
+     * First backoff delay, in milliseconds, doubled per attempt before jitter. Default
+     * {@link SaferFetch.DEFAULT_RETRY_BASE_DELAY_MS}.
+     */
+    readonly baseDelayMs?: number;
+    /**
+     * Ceiling on any single delay, in milliseconds. Default
+     * {@link SaferFetch.DEFAULT_RETRY_MAX_DELAY_MS}. Also clamps a server-supplied
+     * `Retry-After`, which is the security-relevant half of its job.
+     */
+    readonly maxDelayMs?: number;
+    /**
+     * Retries `POST` / `PUT` / `PATCH` / `DELETE` as well as `GET` / `HEAD`. Default `false`.
+     *
+     * @remarks
+     * Off by default because a timeout does not tell you whether the server processed the
+     * request: a retried `POST` after a timeout can double-charge. Turn it on for endpoints you
+     * know are idempotent — an idempotency key, a `PUT` of a whole resource — and not otherwise.
+     */
+    readonly retryNonIdempotent?: boolean;
+    /**
+     * Honors a `Retry-After` header on `429` and `503`. Default `true`.
+     *
+     * @remarks
+     * Always clamped to `maxDelayMs`, whatever this is set to. The header is chosen by the
+     * server, which in this threat model may be the adversary.
+     */
+    readonly respectRetryAfter?: boolean;
+}
+/**
+ * A {@link SaferFetch.IRetryPolicy} with every default applied, so no downstream code path
+ * branches on a field's absence.
+ * @internal
+ */
+export interface IResolvedRetryPolicy {
+    readonly attempts: number;
+    readonly baseDelayMs: number;
+    readonly maxDelayMs: number;
+    readonly retryNonIdempotent: boolean;
+    readonly respectRetryAfter: boolean;
+}
+/** No retry. The resolved shape of an absent `retry` option. @internal */
+export declare const NO_RETRY: IResolvedRetryPolicy;
+/**
+ * Applies the retry defaults, rejecting a policy that cannot mean anything.
+ *
+ * @remarks
+ * Validated for the same reason `redirectPolicy` and `sensitiveHeaders` are: a JavaScript
+ * caller can pass anything, and a `NaN` delay silently becomes a `setTimeout(NaN)` that fires
+ * immediately — turning a backoff into a tight retry loop against a struggling service.
+ * @internal
+ */
+export declare function resolveRetryPolicy(retry?: IRetryPolicy): Result<IResolvedRetryPolicy>;
+/**
+ * Decides whether a failure is one a later attempt could plausibly answer differently.
+ *
+ * @remarks
+ * The `switch` is exhaustive over the taxonomy on purpose: a new failure kind should have to be
+ * classified deliberately rather than inherit "retryable" or "not" from a default branch.
+ *
+ * `'blocked-by-guard'` can never succeed on a retry — the guard's answer is about the
+ * destination, not about the moment. `'too-large'` is the sharper case: retrying it
+ * re-downloads up to the cap every time, which turns a defense into an amplifier aimed at the
+ * caller's own bandwidth.
+ * @internal
+ */
+export declare function isRetryableFailure(reason: FetchFailureReason | undefined): boolean;
+/**
+ * Whether this method may be retried under the supplied policy.
+ * @internal
+ */
+export declare function isRetryableMethod(method: SaferFetchMethod, policy: IResolvedRetryPolicy): boolean;
+/**
+ * Whether a `Retry-After` header on this failure is one to honor.
+ *
+ * @remarks
+ * Only on `429` and `503`, and only when the policy asks for it. A `500` carrying a
+ * `Retry-After` does not get to dictate the caller's schedule.
+ * @internal
+ */
+export declare function honorsRetryAfter(reason: FetchFailureReason | undefined, policy: IResolvedRetryPolicy): boolean;
+/**
+ * Parses a `Retry-After` header value into milliseconds.
+ *
+ * @remarks
+ * Both RFC 9110 forms: delta-seconds, and an HTTP-date which is converted to a delay relative
+ * to `nowMs`. An unparseable value, a negative delta, or a date already in the past yields
+ * `undefined` — "the server said nothing usable", which falls back to ordinary backoff rather
+ * than to zero delay. Returning `0` for a past date would let a stale clock produce a hot loop.
+ *
+ * The value is **not** clamped here. Clamping belongs with the rest of the delay arithmetic in
+ * {@link computeRetryDelayMs}, so there is exactly one place the ceiling is applied.
+ * @internal
+ */
+export declare function parseRetryAfterMs(value: string | undefined, nowMs: number): number | undefined;
+/** Inputs to {@link computeRetryDelayMs}. @internal */
+export interface IRetryDelayParams {
+    /** 0-based index of the retry about to be scheduled: `0` is the first retry. */
+    readonly attempt: number;
+    readonly policy: IResolvedRetryPolicy;
+    /** A honored, parsed `Retry-After`, in milliseconds, when the server sent a usable one. */
+    readonly retryAfterMs?: number;
+    /** Injected for determinism in tests; the call path passes `Math.random`. */
+    readonly random: () => number;
+}
+/**
+ * Computes how long to wait before the next attempt.
+ *
+ * @remarks
+ * **Exponential backoff with full jitter**: the delay is uniform on `[0, cap)` where `cap` is
+ * `baseDelayMs * 2^attempt` bounded by `maxDelayMs`. Full jitter rather than a fixed backoff
+ * because every caller that failed against the same struggling host would otherwise retry in
+ * the same instant, which is the thundering herd the backoff was supposed to prevent.
+ *
+ * **A honored `Retry-After` replaces the computed backoff and is clamped to `maxDelayMs`.** The
+ * clamp is not a rounding detail: `Retry-After` is chosen by the server, which in this threat
+ * model may be the adversary, so an unclamped `Retry-After: 86400` is a day-long sleep the
+ * caller never agreed to. Jitter is not applied to it — the server named an instant, and
+ * scattering around it is the caller's herd problem, not the server's instruction.
+ *
+ * `2 ** attempt` overflows to `Infinity` for a large enough `attempt`; `Math.min` with a finite
+ * ceiling absorbs that, which is why the cap is computed in this order.
+ * @internal
+ */
+export declare function computeRetryDelayMs(params: IRetryDelayParams): number;
+//# sourceMappingURL=retry.d.ts.map

package/lib/packlets/safer-fetch/retry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry.d.ts","sourceRoot":"","sources":["../../../src/packlets/safer-fetch/retry.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAiB,KAAK,MAAM,EAAE,MAAM,eAAe,CAAC;AAS3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAE7B;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAEtC;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;CACrC;AAED,0EAA0E;AAC1E,eAAO,MAAM,QAAQ,EAAE,oBAMtB,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,CAAC,EAAE,YAAY,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAkCrF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,GAAG,SAAS,GAAG,OAAO,CAyBlF;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAEjG;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,kBAAkB,GAAG,SAAS,EACtC,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAIT;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAgB9F;AAED,uDAAuD;AACvD,MAAM,WAAW,iBAAiB;IAChC,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,2FAA2F;IAC3F,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,MAAM,MAAM,CAAC;CAC/B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAQrE"}

package/lib/packlets/safer-fetch/retry.js

@@ -0,0 +1,197 @@
+"use strict";
+// Copyright (c) 2026 Erik Fortune
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all
+// copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NO_RETRY = void 0;
+exports.resolveRetryPolicy = resolveRetryPolicy;
+exports.isRetryableFailure = isRetryableFailure;
+exports.isRetryableMethod = isRetryableMethod;
+exports.honorsRetryAfter = honorsRetryAfter;
+exports.parseRetryAfterMs = parseRetryAfterMs;
+exports.computeRetryDelayMs = computeRetryDelayMs;
+const ts_utils_1 = require("@fgv/ts-utils");
+const defaults_1 = require("./defaults");
+/** No retry. The resolved shape of an absent `retry` option. @internal */
+exports.NO_RETRY = {
+    attempts: 0,
+    baseDelayMs: defaults_1.DEFAULT_RETRY_BASE_DELAY_MS,
+    maxDelayMs: defaults_1.DEFAULT_RETRY_MAX_DELAY_MS,
+    retryNonIdempotent: false,
+    respectRetryAfter: true
+};
+/**
+ * Applies the retry defaults, rejecting a policy that cannot mean anything.
+ *
+ * @remarks
+ * Validated for the same reason `redirectPolicy` and `sensitiveHeaders` are: a JavaScript
+ * caller can pass anything, and a `NaN` delay silently becomes a `setTimeout(NaN)` that fires
+ * immediately — turning a backoff into a tight retry loop against a struggling service.
+ * @internal
+ */
+function resolveRetryPolicy(retry) {
+    var _a, _b, _c;
+    // `?? undefined` rather than `!== undefined`, matching every other option: a `null` from a
+    // JavaScript caller means "absent", never "installed".
+    const policy = retry !== null && retry !== void 0 ? retry : undefined;
+    if (policy === undefined) {
+        return (0, ts_utils_1.succeed)(exports.NO_RETRY);
+    }
+    const attempts = policy.attempts;
+    if (!Number.isInteger(attempts) || attempts < 0) {
+        return (0, ts_utils_1.fail)(`retry.attempts must be a non-negative integer; got ${attempts}.`);
+    }
+    const baseDelayMs = (_a = policy.baseDelayMs) !== null && _a !== void 0 ? _a : defaults_1.DEFAULT_RETRY_BASE_DELAY_MS;
+    const maxDelayMs = (_b = policy.maxDelayMs) !== null && _b !== void 0 ? _b : defaults_1.DEFAULT_RETRY_MAX_DELAY_MS;
+    const delays = [
+        ['retry.baseDelayMs', baseDelayMs],
+        ['retry.maxDelayMs', maxDelayMs]
+    ];
+    for (const [name, value] of delays) {
+        if (!Number.isFinite(value) || value < 0) {
+            return (0, ts_utils_1.fail)(`${name} must be a non-negative finite number; got ${value}.`);
+        }
+    }
+    return (0, ts_utils_1.succeed)({
+        attempts,
+        baseDelayMs,
+        maxDelayMs,
+        retryNonIdempotent: policy.retryNonIdempotent === true,
+        // Defaults to honoring the header, so `?? true` rather than the `=== true` the other two
+        // flags use.
+        respectRetryAfter: (_c = policy.respectRetryAfter) !== null && _c !== void 0 ? _c : true
+    });
+}
+/**
+ * Decides whether a failure is one a later attempt could plausibly answer differently.
+ *
+ * @remarks
+ * The `switch` is exhaustive over the taxonomy on purpose: a new failure kind should have to be
+ * classified deliberately rather than inherit "retryable" or "not" from a default branch.
+ *
+ * `'blocked-by-guard'` can never succeed on a retry — the guard's answer is about the
+ * destination, not about the moment. `'too-large'` is the sharper case: retrying it
+ * re-downloads up to the cap every time, which turns a defense into an amplifier aimed at the
+ * caller's own bandwidth.
+ * @internal
+ */
+function isRetryableFailure(reason) {
+    // A failure with no detail is one this primitive could not classify, and an unclassifiable
+    // failure is not one to retry — the whole basis for retrying is knowing what went wrong.
+    if (reason === undefined) {
+        return false;
+    }
+    switch (reason.kind) {
+        case 'network':
+        case 'timeout':
+            return true;
+        case 'http-status':
+            return defaults_1.RETRYABLE_HTTP_STATUSES.includes(reason.status);
+        case 'invalid-url':
+        case 'blocked-by-guard':
+        case 'redirect-rejected':
+        case 'redirect-opaque':
+        case 'too-many-redirects':
+        case 'aborted':
+        case 'too-large':
+        case 'unsupported-content-type':
+        case 'decode':
+        case 'parse':
+        case 'unknown':
+            return false;
+    }
+}
+/**
+ * Whether this method may be retried under the supplied policy.
+ * @internal
+ */
+function isRetryableMethod(method, policy) {
+    return policy.retryNonIdempotent || defaults_1.IDEMPOTENT_METHODS.includes(method);
+}
+/**
+ * Whether a `Retry-After` header on this failure is one to honor.
+ *
+ * @remarks
+ * Only on `429` and `503`, and only when the policy asks for it. A `500` carrying a
+ * `Retry-After` does not get to dictate the caller's schedule.
+ * @internal
+ */
+function honorsRetryAfter(reason, policy) {
+    return (policy.respectRetryAfter && (reason === null || reason === void 0 ? void 0 : reason.kind) === 'http-status' && defaults_1.RETRY_AFTER_STATUSES.includes(reason.status));
+}
+/**
+ * Parses a `Retry-After` header value into milliseconds.
+ *
+ * @remarks
+ * Both RFC 9110 forms: delta-seconds, and an HTTP-date which is converted to a delay relative
+ * to `nowMs`. An unparseable value, a negative delta, or a date already in the past yields
+ * `undefined` — "the server said nothing usable", which falls back to ordinary backoff rather
+ * than to zero delay. Returning `0` for a past date would let a stale clock produce a hot loop.
+ *
+ * The value is **not** clamped here. Clamping belongs with the rest of the delay arithmetic in
+ * {@link computeRetryDelayMs}, so there is exactly one place the ceiling is applied.
+ * @internal
+ */
+function parseRetryAfterMs(value, nowMs) {
+    const text = (value !== null && value !== void 0 ? value : '').trim();
+    if (text.length === 0) {
+        return undefined;
+    }
+    // Digits only: a delta-seconds value. Tested before `Date.parse`, which accepts bare numbers
+    // as years in some engines and would read `Retry-After: 120` as the year 120.
+    if (/^\d+$/.test(text)) {
+        return Number(text) * 1000;
+    }
+    const at = Date.parse(text);
+    if (Number.isNaN(at)) {
+        return undefined;
+    }
+    const delay = at - nowMs;
+    return delay > 0 ? delay : undefined;
+}
+/**
+ * Computes how long to wait before the next attempt.
+ *
+ * @remarks
+ * **Exponential backoff with full jitter**: the delay is uniform on `[0, cap)` where `cap` is
+ * `baseDelayMs * 2^attempt` bounded by `maxDelayMs`. Full jitter rather than a fixed backoff
+ * because every caller that failed against the same struggling host would otherwise retry in
+ * the same instant, which is the thundering herd the backoff was supposed to prevent.
+ *
+ * **A honored `Retry-After` replaces the computed backoff and is clamped to `maxDelayMs`.** The
+ * clamp is not a rounding detail: `Retry-After` is chosen by the server, which in this threat
+ * model may be the adversary, so an unclamped `Retry-After: 86400` is a day-long sleep the
+ * caller never agreed to. Jitter is not applied to it — the server named an instant, and
+ * scattering around it is the caller's herd problem, not the server's instruction.
+ *
+ * `2 ** attempt` overflows to `Infinity` for a large enough `attempt`; `Math.min` with a finite
+ * ceiling absorbs that, which is why the cap is computed in this order.
+ * @internal
+ */
+function computeRetryDelayMs(params) {
+    var _a;
+    const { attempt, policy, random } = params;
+    const retryAfterMs = (_a = params.retryAfterMs) !== null && _a !== void 0 ? _a : undefined;
+    if (retryAfterMs !== undefined) {
+        return Math.min(retryAfterMs, policy.maxDelayMs);
+    }
+    const cap = Math.min(policy.baseDelayMs * 2 ** attempt, policy.maxDelayMs);
+    return random() * cap;
+}
+//# sourceMappingURL=retry.js.map

package/lib/packlets/safer-fetch/retry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry.js","sourceRoot":"","sources":["../../../src/packlets/safer-fetch/retry.ts"],"names":[],"mappings":";AAAA,kCAAkC;AAClC,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AACxE,2DAA2D;AAC3D,EAAE;AACF,iFAAiF;AACjF,kDAAkD;AAClD,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,yEAAyE;AACzE,gFAAgF;AAChF,gFAAgF;AAChF,YAAY;;;AAgHZ,gDAkCC;AAeD,gDAyBC;AAMD,8CAEC;AAUD,4CAOC;AAeD,8CAgBC;AAgCD,kDAQC;AAxRD,4CAA2D;AAE3D,yCAMoB;AAoFpB,0EAA0E;AAC7D,QAAA,QAAQ,GAAyB;IAC5C,QAAQ,EAAE,CAAC;IACX,WAAW,EAAE,sCAA2B;IACxC,UAAU,EAAE,qCAA0B;IACtC,kBAAkB,EAAE,KAAK;IACzB,iBAAiB,EAAE,IAAI;CACxB,CAAC;AAEF;;;;;;;;GAQG;AACH,SAAgB,kBAAkB,CAAC,KAAoB;;IACrD,2FAA2F;IAC3F,uDAAuD;IACvD,MAAM,MAAM,GAAG,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,SAAS,CAAC;IAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,IAAA,kBAAO,EAAC,gBAAQ,CAAC,CAAC;IAC3B,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QAChD,OAAO,IAAA,eAAI,EAAC,sDAAsD,QAAQ,GAAG,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,WAAW,GAAG,MAAA,MAAM,CAAC,WAAW,mCAAI,sCAA2B,CAAC;IACtE,MAAM,UAAU,GAAG,MAAA,MAAM,CAAC,UAAU,mCAAI,qCAA0B,CAAC;IACnE,MAAM,MAAM,GAA6C;QACvD,CAAC,mBAAmB,EAAE,WAAW,CAAC;QAClC,CAAC,kBAAkB,EAAE,UAAU,CAAC;KACjC,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACzC,OAAO,IAAA,eAAI,EAAC,GAAG,IAAI,8CAA8C,KAAK,GAAG,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,OAAO,IAAA,kBAAO,EAAC;QACb,QAAQ;QACR,WAAW;QACX,UAAU;QACV,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,KAAK,IAAI;QACtD,yFAAyF;QACzF,aAAa;QACb,iBAAiB,EAAE,MAAA,MAAM,CAAC,iBAAiB,mCAAI,IAAI;KACpD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,kBAAkB,CAAC,MAAsC;IACvE,2FAA2F;IAC3F,yFAAyF;IACzF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,SAAS,CAAC;QACf,KAAK,SAAS;YACZ,OAAO,IAAI,CAAC;QACd,KAAK,aAAa;YAChB,OAAO,kCAAuB,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzD,KAAK,aAAa,CAAC;QACnB,KAAK,kBAAkB,CAAC;QACxB,KAAK,mBAAmB,CAAC;QACzB,KAAK,iBAAiB,CAAC;QACvB,KAAK,oBAAoB,CAAC;QAC1B,KAAK,SAAS,CAAC;QACf,KAAK,WAAW,CAAC;QACjB,KAAK,0BAA0B,CAAC;QAChC,KAAK,QAAQ,CAAC;QACd,KAAK,OAAO,CAAC;QACb,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,MAAwB,EAAE,MAA4B;IACtF,OAAO,MAAM,CAAC,kBAAkB,IAAI,6BAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,gBAAgB,CAC9B,MAAsC,EACtC,MAA4B;IAE5B,OAAO,CACL,MAAM,CAAC,iBAAiB,IAAI,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,IAAI,MAAK,aAAa,IAAI,+BAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAC3G,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,iBAAiB,CAAC,KAAyB,EAAE,KAAa;IACxE,MAAM,IAAI,GAAG,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,6FAA6F;IAC7F,8EAA8E;IAC9E,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,EAAE,GAAG,KAAK,CAAC;IACzB,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvC,CAAC;AAaD;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,mBAAmB,CAAC,MAAyB;;IAC3D,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC3C,MAAM,YAAY,GAAG,MAAA,MAAM,CAAC,YAAY,mCAAI,SAAS,CAAC;IACtD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,GAAG,CAAC,IAAI,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAC3E,OAAO,MAAM,EAAE,GAAG,GAAG,CAAC;AACxB,CAAC","sourcesContent":["// Copyright (c) 2026 Erik Fortune\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal\n// in the Software without restriction, including without limitation the rights\n// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\n// copies of the Software, and to permit persons to whom the Software is\n// furnished to do so, subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in all\n// copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\n// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\n// SOFTWARE.\n\nimport { fail, succeed, type Result } from '@fgv/ts-utils';\n\nimport {\n  DEFAULT_RETRY_BASE_DELAY_MS,\n  DEFAULT_RETRY_MAX_DELAY_MS,\n  IDEMPOTENT_METHODS,\n  RETRY_AFTER_STATUSES,\n  RETRYABLE_HTTP_STATUSES\n} from './defaults';\nimport type { FetchFailureReason } from './failureReason';\nimport type { SaferFetchMethod } from './model';\n\n/**\n * Opt-in retry policy.\n *\n * @remarks\n * **Retry is off by default and has to be asked for.** A primitive that silently retries\n * changes the semantics of every call site and amplifies load against a service that is already\n * struggling.\n *\n * Two rules are load-bearing rather than incidental, and are worth reading before enabling this:\n *\n * **Every attempt re-runs the address guard from hop 0 — a full re-walk, never a resume and\n * never a cached verdict.** Reusing an earlier attempt's verdict would make retry its own\n * DNS-rebinding vector: an attacker needs the guard to pass once and a connect to land on a\n * private address, so `N` connects against **one** check multiplies their odds by the retry\n * count — and a retry delay is precisely when a short-TTL rebind lands. A resume is\n * independently wrong because the redirect chain is not stable across attempts: attempt 2's\n * server may answer with a different `Location`, so revalidating only the current hop would\n * validate a chain the request no longer follows. The consequence is that retries cost more\n * than a naive implementation would suggest — each carries full re-resolution — and that cost\n * is deliberate.\n *\n * **The overall deadline is the ceiling.** Retries consume `timeoutMs` and never reset it, so\n * `{ timeoutMs: 30_000, retry: { attempts: 3 } }` is a thirty-second call, not a two-minute\n * one. When the remaining budget is shorter than the computed delay, the call fails with the\n * attempt's own failure rather than sleeping past its deadline.\n * @public\n */\nexport interface IRetryPolicy {\n  /**\n   * Additional attempts after the first, **not** a total. `attempts: 2` means up to three\n   * requests. Must be a non-negative integer; `0` disables retry.\n   */\n  readonly attempts: number;\n\n  /**\n   * First backoff delay, in milliseconds, doubled per attempt before jitter. Default\n   * {@link SaferFetch.DEFAULT_RETRY_BASE_DELAY_MS}.\n   */\n  readonly baseDelayMs?: number;\n\n  /**\n   * Ceiling on any single delay, in milliseconds. Default\n   * {@link SaferFetch.DEFAULT_RETRY_MAX_DELAY_MS}. Also clamps a server-supplied\n   * `Retry-After`, which is the security-relevant half of its job.\n   */\n  readonly maxDelayMs?: number;\n\n  /**\n   * Retries `POST` / `PUT` / `PATCH` / `DELETE` as well as `GET` / `HEAD`. Default `false`.\n   *\n   * @remarks\n   * Off by default because a timeout does not tell you whether the server processed the\n   * request: a retried `POST` after a timeout can double-charge. Turn it on for endpoints you\n   * know are idempotent — an idempotency key, a `PUT` of a whole resource — and not otherwise.\n   */\n  readonly retryNonIdempotent?: boolean;\n\n  /**\n   * Honors a `Retry-After` header on `429` and `503`. Default `true`.\n   *\n   * @remarks\n   * Always clamped to `maxDelayMs`, whatever this is set to. The header is chosen by the\n   * server, which in this threat model may be the adversary.\n   */\n  readonly respectRetryAfter?: boolean;\n}\n\n/**\n * A {@link SaferFetch.IRetryPolicy} with every default applied, so no downstream code path\n * branches on a field's absence.\n * @internal\n */\nexport interface IResolvedRetryPolicy {\n  readonly attempts: number;\n  readonly baseDelayMs: number;\n  readonly maxDelayMs: number;\n  readonly retryNonIdempotent: boolean;\n  readonly respectRetryAfter: boolean;\n}\n\n/** No retry. The resolved shape of an absent `retry` option. @internal */\nexport const NO_RETRY: IResolvedRetryPolicy = {\n  attempts: 0,\n  baseDelayMs: DEFAULT_RETRY_BASE_DELAY_MS,\n  maxDelayMs: DEFAULT_RETRY_MAX_DELAY_MS,\n  retryNonIdempotent: false,\n  respectRetryAfter: true\n};\n\n/**\n * Applies the retry defaults, rejecting a policy that cannot mean anything.\n *\n * @remarks\n * Validated for the same reason `redirectPolicy` and `sensitiveHeaders` are: a JavaScript\n * caller can pass anything, and a `NaN` delay silently becomes a `setTimeout(NaN)` that fires\n * immediately — turning a backoff into a tight retry loop against a struggling service.\n * @internal\n */\nexport function resolveRetryPolicy(retry?: IRetryPolicy): Result<IResolvedRetryPolicy> {\n  // `?? undefined` rather than `!== undefined`, matching every other option: a `null` from a\n  // JavaScript caller means \"absent\", never \"installed\".\n  const policy = retry ?? undefined;\n  if (policy === undefined) {\n    return succeed(NO_RETRY);\n  }\n\n  const attempts = policy.attempts;\n  if (!Number.isInteger(attempts) || attempts < 0) {\n    return fail(`retry.attempts must be a non-negative integer; got ${attempts}.`);\n  }\n\n  const baseDelayMs = policy.baseDelayMs ?? DEFAULT_RETRY_BASE_DELAY_MS;\n  const maxDelayMs = policy.maxDelayMs ?? DEFAULT_RETRY_MAX_DELAY_MS;\n  const delays: ReadonlyArray<readonly [string, number]> = [\n    ['retry.baseDelayMs', baseDelayMs],\n    ['retry.maxDelayMs', maxDelayMs]\n  ];\n  for (const [name, value] of delays) {\n    if (!Number.isFinite(value) || value < 0) {\n      return fail(`${name} must be a non-negative finite number; got ${value}.`);\n    }\n  }\n\n  return succeed({\n    attempts,\n    baseDelayMs,\n    maxDelayMs,\n    retryNonIdempotent: policy.retryNonIdempotent === true,\n    // Defaults to honoring the header, so `?? true` rather than the `=== true` the other two\n    // flags use.\n    respectRetryAfter: policy.respectRetryAfter ?? true\n  });\n}\n\n/**\n * Decides whether a failure is one a later attempt could plausibly answer differently.\n *\n * @remarks\n * The `switch` is exhaustive over the taxonomy on purpose: a new failure kind should have to be\n * classified deliberately rather than inherit \"retryable\" or \"not\" from a default branch.\n *\n * `'blocked-by-guard'` can never succeed on a retry — the guard's answer is about the\n * destination, not about the moment. `'too-large'` is the sharper case: retrying it\n * re-downloads up to the cap every time, which turns a defense into an amplifier aimed at the\n * caller's own bandwidth.\n * @internal\n */\nexport function isRetryableFailure(reason: FetchFailureReason | undefined): boolean {\n  // A failure with no detail is one this primitive could not classify, and an unclassifiable\n  // failure is not one to retry — the whole basis for retrying is knowing what went wrong.\n  if (reason === undefined) {\n    return false;\n  }\n  switch (reason.kind) {\n    case 'network':\n    case 'timeout':\n      return true;\n    case 'http-status':\n      return RETRYABLE_HTTP_STATUSES.includes(reason.status);\n    case 'invalid-url':\n    case 'blocked-by-guard':\n    case 'redirect-rejected':\n    case 'redirect-opaque':\n    case 'too-many-redirects':\n    case 'aborted':\n    case 'too-large':\n    case 'unsupported-content-type':\n    case 'decode':\n    case 'parse':\n    case 'unknown':\n      return false;\n  }\n}\n\n/**\n * Whether this method may be retried under the supplied policy.\n * @internal\n */\nexport function isRetryableMethod(method: SaferFetchMethod, policy: IResolvedRetryPolicy): boolean {\n  return policy.retryNonIdempotent || IDEMPOTENT_METHODS.includes(method);\n}\n\n/**\n * Whether a `Retry-After` header on this failure is one to honor.\n *\n * @remarks\n * Only on `429` and `503`, and only when the policy asks for it. A `500` carrying a\n * `Retry-After` does not get to dictate the caller's schedule.\n * @internal\n */\nexport function honorsRetryAfter(\n  reason: FetchFailureReason | undefined,\n  policy: IResolvedRetryPolicy\n): boolean {\n  return (\n    policy.respectRetryAfter && reason?.kind === 'http-status' && RETRY_AFTER_STATUSES.includes(reason.status)\n  );\n}\n\n/**\n * Parses a `Retry-After` header value into milliseconds.\n *\n * @remarks\n * Both RFC 9110 forms: delta-seconds, and an HTTP-date which is converted to a delay relative\n * to `nowMs`. An unparseable value, a negative delta, or a date already in the past yields\n * `undefined` — \"the server said nothing usable\", which falls back to ordinary backoff rather\n * than to zero delay. Returning `0` for a past date would let a stale clock produce a hot loop.\n *\n * The value is **not** clamped here. Clamping belongs with the rest of the delay arithmetic in\n * {@link computeRetryDelayMs}, so there is exactly one place the ceiling is applied.\n * @internal\n */\nexport function parseRetryAfterMs(value: string | undefined, nowMs: number): number | undefined {\n  const text = (value ?? '').trim();\n  if (text.length === 0) {\n    return undefined;\n  }\n  // Digits only: a delta-seconds value. Tested before `Date.parse`, which accepts bare numbers\n  // as years in some engines and would read `Retry-After: 120` as the year 120.\n  if (/^\\d+$/.test(text)) {\n    return Number(text) * 1000;\n  }\n  const at = Date.parse(text);\n  if (Number.isNaN(at)) {\n    return undefined;\n  }\n  const delay = at - nowMs;\n  return delay > 0 ? delay : undefined;\n}\n\n/** Inputs to {@link computeRetryDelayMs}. @internal */\nexport interface IRetryDelayParams {\n  /** 0-based index of the retry about to be scheduled: `0` is the first retry. */\n  readonly attempt: number;\n  readonly policy: IResolvedRetryPolicy;\n  /** A honored, parsed `Retry-After`, in milliseconds, when the server sent a usable one. */\n  readonly retryAfterMs?: number;\n  /** Injected for determinism in tests; the call path passes `Math.random`. */\n  readonly random: () => number;\n}\n\n/**\n * Computes how long to wait before the next attempt.\n *\n * @remarks\n * **Exponential backoff with full jitter**: the delay is uniform on `[0, cap)` where `cap` is\n * `baseDelayMs * 2^attempt` bounded by `maxDelayMs`. Full jitter rather than a fixed backoff\n * because every caller that failed against the same struggling host would otherwise retry in\n * the same instant, which is the thundering herd the backoff was supposed to prevent.\n *\n * **A honored `Retry-After` replaces the computed backoff and is clamped to `maxDelayMs`.** The\n * clamp is not a rounding detail: `Retry-After` is chosen by the server, which in this threat\n * model may be the adversary, so an unclamped `Retry-After: 86400` is a day-long sleep the\n * caller never agreed to. Jitter is not applied to it — the server named an instant, and\n * scattering around it is the caller's herd problem, not the server's instruction.\n *\n * `2 ** attempt` overflows to `Infinity` for a large enough `attempt`; `Math.min` with a finite\n * ceiling absorbs that, which is why the cap is computed in this order.\n * @internal\n */\nexport function computeRetryDelayMs(params: IRetryDelayParams): number {\n  const { attempt, policy, random } = params;\n  const retryAfterMs = params.retryAfterMs ?? undefined;\n  if (retryAfterMs !== undefined) {\n    return Math.min(retryAfterMs, policy.maxDelayMs);\n  }\n  const cap = Math.min(policy.baseDelayMs * 2 ** attempt, policy.maxDelayMs);\n  return random() * cap;\n}\n"]}

package/lib/packlets/safer-fetch/saferFetch.d.ts

@@ -0,0 +1,108 @@
+import { type Converter, type DetailedResult, type Validator } from '@fgv/ts-utils';
+import { type JsonValue } from '@fgv/ts-json-base';
+import type { FetchFailureReason } from './failureReason';
+import type { ISaferFetchOptions, ISaferFetchResponse } from './model';
+/**
+ * Fetches a URL and returns the raw response bytes, subject to the scheme check, the address
+ * guard, the request and response guards, the deadlines, and the response size cap.
+ *
+ * @remarks
+ * **What this does not protect against.** It is not a sandbox: a caller who wants to reach
+ * `127.0.0.1` can call `globalThis.fetch` directly, so this guards untrusted *data*, never
+ * untrusted *code in the same process*. It does no certificate pinning and adds nothing
+ * against a network-position attacker — TLS is that control. It does not resist DNS rebinding:
+ * an address guard validates a resolved address and the transport then re-resolves, so a
+ * hostile resolver can answer the two lookups differently. And it inspects nothing in the
+ * response body. If your deployment has an egress proxy or firewall, that control is strictly
+ * stronger than this one; this is defense in depth for deployments that do not.
+ *
+ * **The failure detail is an internal-network scanning oracle.** Log it; do not echo it, or
+ * any string derived from it, to an untrusted caller. The detail is structured precisely so
+ * that mapping it to a coarse public code is trivial.
+ *
+ * **Redirects are rejected unless you ask for them.** `redirectPolicy: 'validate-each-hop'`
+ * follows them, runs the address guard on every hop before any connection, and drops credential
+ * headers the first time the chain leaves an origin — and never restores them, so an
+ * `A` → `B` → `A` chain does not hand the token back to `A`.
+ *
+ * @param url - The URL to fetch. Only `http:` and `https:` are ever requested; every other
+ * scheme fails as `'invalid-url'`.
+ * @param options - Call options. `addressGuard` is required and has no default — use
+ * `blockPrivateNetworks()` on Node, or `allowAnyAddress()` to name the absence of the
+ * guarantee at the call site. `maxResponseBytes` defaults to 5 MiB and is meant to be tuned
+ * per call: real documents clear that, and raising it for the calls that need it is the
+ * intended use, not a workaround.
+ * @public
+ */
+export declare function saferFetchBytes(url: string | URL, options: ISaferFetchOptions): Promise<DetailedResult<ISaferFetchResponse<Uint8Array>, FetchFailureReason>>;
+/**
+ * Fetches a URL and decodes the response body as text.
+ *
+ * @remarks
+ * The charset comes from the `Content-Type` parameter and defaults to UTF-8. Decoding is
+ * strict: an unknown charset, or a byte sequence that is not valid in the declared one, fails
+ * as `'decode'` rather than silently producing mojibake that some caller downstream treats as
+ * data.
+ *
+ * See {@link SaferFetch.saferFetchBytes} for what this primitive does **not** protect against,
+ * and for the warning about echoing failure detail to untrusted callers.
+ *
+ * @param url - The URL to fetch.
+ * @param options - Call options. `addressGuard` is required. `maxResponseBytes` defaults to
+ * 5 MiB and is meant to be tuned per call.
+ * @public
+ */
+export declare function saferFetchText(url: string | URL, options: ISaferFetchOptions): Promise<DetailedResult<ISaferFetchResponse<string>, FetchFailureReason>>;
+/**
+ * Options for the validating form of {@link SaferFetch.saferFetchJson}.
+ *
+ * @remarks
+ * `converter` is **required** here, and `T` is inferred from it. There is deliberately no way
+ * to assert a `T` without supplying the converter that evidences it at runtime: a caller-named
+ * type with nothing checking it is a claim the primitive cannot keep. Omit the whole options
+ * type and the value comes back as `JsonValue`, which is what the wire actually guarantees.
+ * @public
+ */
+export interface ISaferFetchJsonOptions<T> extends ISaferFetchOptions {
+    /** Applied to the parsed JSON, taking the caller from wire to validated `T` in one step. */
+    readonly converter: Converter<T> | Validator<T>;
+}
+/**
+ * Fetches a URL and parses the response body as JSON, yielding the raw `JsonValue` for the
+ * caller to validate.
+ *
+ * @remarks
+ * **This does not gate on `Content-Type` by itself.** A server returning an HTML error page
+ * with a `200` will be decoded and parsed, and fail as `'parse'` — twenty frames from where it
+ * actually went wrong. Pass `responseHeadersGuard: allowContentTypes(['application/json'])`
+ * to reject on the header instead: it costs a header comparison rather than a body transfer,
+ * and the failure names the type. Content-type gating is a guard rather than an option so that
+ * there is exactly one mechanism for it.
+ *
+ * See {@link SaferFetch.saferFetchBytes} for what this primitive does **not** protect against,
+ * and for the warning about echoing failure detail to untrusted callers.
+ *
+ * @param url - The URL to fetch.
+ * @param options - Call options. `addressGuard` is required. `maxResponseBytes` defaults to
+ * 5 MiB and is meant to be tuned per call.
+ * @public
+ */
+export declare function saferFetchJson(url: string | URL, options: ISaferFetchOptions): Promise<DetailedResult<ISaferFetchResponse<JsonValue>, FetchFailureReason>>;
+/**
+ * Fetches a URL, parses the response body as JSON, and runs it through the supplied converter
+ * or validator so the caller reaches a validated `T` in one step.
+ *
+ * @remarks
+ * `T` is inferred from `converter` and is never caller-asserted, so the returned type is
+ * evidenced at runtime rather than claimed.
+ *
+ * See {@link SaferFetch.saferFetchBytes} for what this primitive does **not** protect against,
+ * and for the warning about echoing failure detail to untrusted callers.
+ *
+ * @param url - The URL to fetch.
+ * @param options - Call options plus the required `converter`. `addressGuard` is required.
+ * `maxResponseBytes` defaults to 5 MiB and is meant to be tuned per call.
+ * @public
+ */
+export declare function saferFetchJson<T>(url: string | URL, options: ISaferFetchJsonOptions<T>): Promise<DetailedResult<ISaferFetchResponse<T>, FetchFailureReason>>;
+//# sourceMappingURL=saferFetch.d.ts.map

package/lib/packlets/safer-fetch/saferFetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"saferFetch.d.ts","sourceRoot":"","sources":["../../../src/packlets/safer-fetch/saferFetch.ts"],"names":[],"mappings":"AAoBA,OAAO,EAOL,KAAK,SAAS,EAEd,KAAK,cAAc,EAEnB,KAAK,SAAS,EACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAoC,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAYrF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAW1D,OAAO,KAAK,EAIV,kBAAkB,EAElB,mBAAmB,EAIpB,MAAM,SAAS,CAAC;AAk+BjB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,GAAG,GAAG,EACjB,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAE9E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,GAAG,GAAG,EACjB,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAM1E;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,sBAAsB,CAAC,CAAC,CAAE,SAAQ,kBAAkB;IACnE,4FAA4F;IAC5F,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;CACjD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,GAAG,GAAG,EACjB,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAC/E;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,cAAc,CAAC,CAAC,EACpC,GAAG,EAAE,MAAM,GAAG,GAAG,EACjB,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC,GACjC,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC"}