@j0hanz/superfetch 2.4.3 → 2.4.4

package/dist/fetch.js

@@ -46,129 +46,135 @@ const BLOCKED_IPV6_SUBNETS = [
     { subnet: IPV6_FE80, prefix: 10 },
     { subnet: IPV6_FF00, prefix: 8 },
 ];
-let cachedBlockList;
-function getBlockList() {
-    if (!cachedBlockList) {
-        cachedBlockList = new BlockList();
-        for (const entry of BLOCKED_IPV4_SUBNETS) {
-            cachedBlockList.addSubnet(entry.subnet, entry.prefix, 'ipv4');
-        }
-        for (const entry of BLOCKED_IPV6_SUBNETS) {
-            cachedBlockList.addSubnet(entry.subnet, entry.prefix, 'ipv6');
+class IpBlocker {
+    cachedBlockList;
+    isBlockedIp(candidate) {
+        if (config.security.blockedHosts.has(candidate))
+            return true;
+        const ipType = this.resolveIpType(candidate);
+        if (!ipType)
+            return false;
+        const normalized = candidate.toLowerCase();
+        if (this.isBlockedBySubnetList(normalized, ipType))
+            return true;
+        return (config.security.blockedIpPattern.test(normalized) ||
+            config.security.blockedIpv4MappedPattern.test(normalized));
+    }
+    resolveIpType(ip) {
+        const ipType = isIP(ip);
+        return ipType === 4 || ipType === 6 ? ipType : null;
+    }
+    isBlockedBySubnetList(ip, ipType) {
+        const list = this.getBlockList();
+        return ipType === 4 ? list.check(ip, 'ipv4') : list.check(ip, 'ipv6');
+    }
+    getBlockList() {
+        if (!this.cachedBlockList) {
+            const list = new BlockList();
+            for (const entry of BLOCKED_IPV4_SUBNETS)
+                list.addSubnet(entry.subnet, entry.prefix, 'ipv4');
+            for (const entry of BLOCKED_IPV6_SUBNETS)
+                list.addSubnet(entry.subnet, entry.prefix, 'ipv6');
+            this.cachedBlockList = list;
         }
+        return this.cachedBlockList;
     }
-    return cachedBlockList;
-}
-function matchesBlockedIpPatterns(resolvedIp) {
-    return (config.security.blockedIpPattern.test(resolvedIp) ||
-        config.security.blockedIpv4MappedPattern.test(resolvedIp));
 }
+const ipBlocker = new IpBlocker();
+/** Backwards-compatible export */
 export function isBlockedIp(ip) {
-    if (config.security.blockedHosts.has(ip)) {
-        return true;
-    }
-    const ipType = resolveIpType(ip);
-    if (!ipType)
-        return false;
-    const normalizedIp = ip.toLowerCase();
-    if (isBlockedByList(normalizedIp, ipType))
-        return true;
-    return matchesBlockedIpPatterns(normalizedIp);
-}
-function resolveIpType(ip) {
-    const ipType = isIP(ip);
-    return ipType === 4 || ipType === 6 ? ipType : null;
-}
-function isBlockedByList(ip, ipType) {
-    const blockList = getBlockList();
-    if (ipType === 4) {
-        return blockList.check(ip, 'ipv4');
-    }
-    return blockList.check(ip, 'ipv6');
-}
-export function normalizeUrl(urlString) {
-    const trimmedUrl = requireTrimmedUrl(urlString);
-    assertUrlLength(trimmedUrl);
-    const url = parseUrl(trimmedUrl);
-    assertHttpProtocol(url);
-    assertNoCredentials(url);
-    const hostname = normalizeHostname(url);
-    assertHostnameAllowed(hostname);
-    // Canonicalize hostname to avoid trailing-dot variants and keep url.href consistent.
-    url.hostname = hostname;
-    return { normalizedUrl: url.href, hostname };
-}
-export function validateAndNormalizeUrl(urlString) {
-    return normalizeUrl(urlString).normalizedUrl;
+    return ipBlocker.isBlockedIp(ip);
 }
+/* -------------------------------------------------------------------------------------------------
+ * URL normalization & hostname policy
+ * ------------------------------------------------------------------------------------------------- */
 const VALIDATION_ERROR_CODE = 'VALIDATION_ERROR';
 function createValidationError(message) {
     return createErrorWithCode(message, VALIDATION_ERROR_CODE);
 }
-function requireTrimmedUrl(urlString) {
-    if (!urlString || typeof urlString !== 'string') {
-        throw createValidationError('URL is required');
+const BLOCKED_HOST_SUFFIXES = ['.local', '.internal'];
+class UrlNormalizer {
+    normalize(urlString) {
+        const trimmedUrl = this.requireTrimmedUrl(urlString);
+        this.assertUrlLength(trimmedUrl);
+        const url = this.parseUrl(trimmedUrl);
+        this.assertHttpProtocol(url);
+        this.assertNoCredentials(url);
+        const hostname = this.normalizeHostname(url);
+        this.assertHostnameAllowed(hostname);
+        // Canonicalize hostname to avoid trailing-dot variants and keep url.href consistent.
+        url.hostname = hostname;
+        return { normalizedUrl: url.href, hostname };
+    }
+    validateAndNormalize(urlString) {
+        return this.normalize(urlString).normalizedUrl;
+    }
+    requireTrimmedUrl(urlString) {
+        if (!urlString || typeof urlString !== 'string') {
+            throw createValidationError('URL is required');
+        }
+        const trimmed = urlString.trim();
+        if (!trimmed)
+            throw createValidationError('URL cannot be empty');
+        return trimmed;
     }
-    const trimmedUrl = urlString.trim();
-    if (!trimmedUrl) {
-        throw createValidationError('URL cannot be empty');
+    assertUrlLength(url) {
+        if (url.length <= config.constants.maxUrlLength)
+            return;
+        throw createValidationError(`URL exceeds maximum length of ${config.constants.maxUrlLength} characters`);
     }
-    return trimmedUrl;
-}
-function assertUrlLength(url) {
-    if (url.length <= config.constants.maxUrlLength)
-        return;
-    throw createValidationError(`URL exceeds maximum length of ${config.constants.maxUrlLength} characters`);
-}
-function parseUrl(urlString) {
-    if (!URL.canParse(urlString)) {
-        throw createValidationError('Invalid URL format');
+    parseUrl(urlString) {
+        if (!URL.canParse(urlString))
+            throw createValidationError('Invalid URL format');
+        return new URL(urlString);
     }
-    return new URL(urlString);
-}
-function assertHttpProtocol(url) {
-    if (url.protocol === 'http:' || url.protocol === 'https:')
-        return;
-    throw createValidationError(`Invalid protocol: ${url.protocol}. Only http: and https: are allowed`);
-}
-function assertNoCredentials(url) {
-    if (!url.username && !url.password)
-        return;
-    throw createValidationError('URLs with embedded credentials are not allowed');
-}
-function normalizeHostname(url) {
-    let hostname = url.hostname.toLowerCase();
-    while (hostname.endsWith('.')) {
-        hostname = hostname.slice(0, -1);
+    assertHttpProtocol(url) {
+        if (url.protocol === 'http:' || url.protocol === 'https:')
+            return;
+        throw createValidationError(`Invalid protocol: ${url.protocol}. Only http: and https: are allowed`);
     }
-    if (!hostname) {
-        throw createValidationError('URL must have a valid hostname');
+    assertNoCredentials(url) {
+        if (!url.username && !url.password)
+            return;
+        throw createValidationError('URLs with embedded credentials are not allowed');
+    }
+    normalizeHostname(url) {
+        let hostname = url.hostname.toLowerCase();
+        while (hostname.endsWith('.'))
+            hostname = hostname.slice(0, -1);
+        if (!hostname)
+            throw createValidationError('URL must have a valid hostname');
+        return hostname;
+    }
+    assertHostnameAllowed(hostname) {
+        this.assertNotBlockedHost(hostname);
+        this.assertNotBlockedIp(hostname);
+        this.assertNotBlockedHostnameSuffix(hostname);
+    }
+    assertNotBlockedHost(hostname) {
+        if (!config.security.blockedHosts.has(hostname))
+            return;
+        throw createValidationError(`Blocked host: ${hostname}. Internal hosts are not allowed`);
+    }
+    assertNotBlockedIp(hostname) {
+        if (!ipBlocker.isBlockedIp(hostname))
+            return;
+        throw createValidationError(`Blocked IP range: ${hostname}. Private IPs are not allowed`);
+    }
+    assertNotBlockedHostnameSuffix(hostname) {
+        const blocked = BLOCKED_HOST_SUFFIXES.some((suffix) => hostname.endsWith(suffix));
+        if (!blocked)
+            return;
+        throw createValidationError(`Blocked hostname pattern: ${hostname}. Internal domain suffixes are not allowed`);
     }
-    return hostname;
-}
-const BLOCKED_HOST_SUFFIXES = ['.local', '.internal'];
-function assertHostnameAllowed(hostname) {
-    assertNotBlockedHost(hostname);
-    assertNotBlockedIp(hostname);
-    assertNotBlockedHostnameSuffix(hostname);
-}
-function assertNotBlockedHost(hostname) {
-    if (!config.security.blockedHosts.has(hostname))
-        return;
-    throw createValidationError(`Blocked host: ${hostname}. Internal hosts are not allowed`);
-}
-function assertNotBlockedIp(hostname) {
-    if (!isBlockedIp(hostname))
-        return;
-    throw createValidationError(`Blocked IP range: ${hostname}. Private IPs are not allowed`);
 }
-function assertNotBlockedHostnameSuffix(hostname) {
-    if (!matchesBlockedSuffix(hostname))
-        return;
-    throw createValidationError(`Blocked hostname pattern: ${hostname}. Internal domain suffixes are not allowed`);
+const urlNormalizer = new UrlNormalizer();
+/** Backwards-compatible exports */
+export function normalizeUrl(urlString) {
+    return urlNormalizer.normalize(urlString);
 }
-function matchesBlockedSuffix(hostname) {
-    return BLOCKED_HOST_SUFFIXES.some((suffix) => hostname.endsWith(suffix));
+export function validateAndNormalizeUrl(urlString) {
+    return urlNormalizer.validateAndNormalize(urlString);
 }
 const GITHUB_BLOB_RULE = {
     name: 'github',
@@ -221,61 +227,6 @@ const TRANSFORM_RULES = [
     BITBUCKET_SRC_RULE,
 ];
 const BITBUCKET_RAW_RE = /bitbucket\.org\/[^/]+\/[^/]+\/raw\//;
-function isRawUrl(url) {
-    const lowerUrl = url.toLowerCase();
-    return (lowerUrl.includes('raw.githubusercontent.com') ||
-        lowerUrl.includes('gist.githubusercontent.com') ||
-        lowerUrl.includes('/-/raw/') ||
-        BITBUCKET_RAW_RE.test(lowerUrl));
-}
-function getUrlWithoutParams(url) {
-    const hashIndex = url.indexOf('#');
-    const queryIndex = url.indexOf('?');
-    const endIndex = Math.min(queryIndex === -1 ? url.length : queryIndex, hashIndex === -1 ? url.length : hashIndex);
-    const hash = hashIndex !== -1 ? url.slice(hashIndex) : '';
-    return {
-        base: url.slice(0, endIndex),
-        hash,
-    };
-}
-function resolveUrlToMatch(rule, base, hash) {
-    if (rule.name !== 'github-gist')
-        return base;
-    if (!hash.startsWith('#file-'))
-        return base;
-    return base + hash;
-}
-function applyTransformRules(base, hash) {
-    for (const rule of TRANSFORM_RULES) {
-        const urlToMatch = resolveUrlToMatch(rule, base, hash);
-        const match = rule.pattern.exec(urlToMatch);
-        if (match) {
-            return { url: rule.transform(match), platform: rule.name };
-        }
-    }
-    return null;
-}
-export function transformToRawUrl(url) {
-    if (!url)
-        return { url, transformed: false };
-    if (isRawUrl(url)) {
-        return { url, transformed: false };
-    }
-    const { base, hash } = getUrlWithoutParams(url);
-    const result = applyTransformRules(base, hash);
-    if (!result)
-        return { url, transformed: false };
-    logDebug('URL transformed to raw content URL', {
-        platform: result.platform,
-        original: url.substring(0, 100),
-        transformed: result.url.substring(0, 100),
-    });
-    return {
-        url: result.url,
-        transformed: true,
-        platform: result.platform,
-    };
-}
 const RAW_TEXT_EXTENSIONS = new Set([
     '.md',
     '.markdown',
@@ -290,226 +241,261 @@ const RAW_TEXT_EXTENSIONS = new Set([
     '.adoc',
     '.org',
 ]);
-export function isRawTextContentUrl(url) {
-    if (!url)
-        return false;
-    if (isRawUrl(url))
-        return true;
-    const { base } = getUrlWithoutParams(url);
-    const lowerBase = base.toLowerCase();
-    return hasKnownRawTextExtension(lowerBase);
-}
-function hasKnownRawTextExtension(urlBaseLower) {
-    const lastDot = urlBaseLower.lastIndexOf('.');
-    if (lastDot === -1)
-        return false;
-    const ext = urlBaseLower.slice(lastDot);
-    return RAW_TEXT_EXTENSIONS.has(ext);
-}
-const DNS_LOOKUP_TIMEOUT_MS = 5000;
-const SLOW_REQUEST_THRESHOLD_MS = 5000;
-function normalizeLookupResults(addresses, family) {
-    if (Array.isArray(addresses)) {
-        return addresses;
-    }
-    return [{ address: addresses, family: family ?? 4 }];
-}
-function createNoDnsResultsError(hostname) {
-    return createErrorWithCode(`No DNS results returned for ${hostname}`, 'ENODATA');
-}
-function createEmptySelection(hostname) {
-    return {
-        error: createNoDnsResultsError(hostname),
-        fallback: [],
-        address: [],
-    };
-}
-function selectLookupResult(list, useAll, hostname) {
-    if (list.length === 0)
-        return createEmptySelection(hostname);
-    if (useAll)
-        return { address: list, fallback: list };
-    const first = list.at(0);
-    if (!first)
-        return createEmptySelection(hostname);
-    return {
-        address: first.address,
-        family: first.family,
-        fallback: list,
-    };
-}
-function findLookupError(list, hostname) {
-    for (const addr of list) {
-        const family = typeof addr === 'string' ? 0 : addr.family;
-        if (family !== 4 && family !== 6) {
-            return createErrorWithCode(`Invalid address family returned for ${hostname}`, 'EINVAL');
-        }
-        const ip = typeof addr === 'string' ? addr : addr.address;
-        if (isBlockedIp(ip)) {
-            return createErrorWithCode(`Blocked IP detected for ${hostname}`, 'EBLOCKED');
+class RawUrlTransformer {
+    transformToRawUrl(url) {
+        if (!url)
+            return { url, transformed: false };
+        if (this.isRawUrl(url))
+            return { url, transformed: false };
+        const { base, hash } = this.splitParams(url);
+        const result = this.applyRules(base, hash);
+        if (!result)
+            return { url, transformed: false };
+        logDebug('URL transformed to raw content URL', {
+            platform: result.platform,
+            original: url.substring(0, 100),
+            transformed: result.url.substring(0, 100),
+        });
+        return { url: result.url, transformed: true, platform: result.platform };
+    }
+    isRawTextContentUrl(url) {
+        if (!url)
+            return false;
+        if (this.isRawUrl(url))
+            return true;
+        const { base } = this.splitParams(url);
+        const lowerBase = base.toLowerCase();
+        const lastDot = lowerBase.lastIndexOf('.');
+        if (lastDot === -1)
+            return false;
+        return RAW_TEXT_EXTENSIONS.has(lowerBase.slice(lastDot));
+    }
+    isRawUrl(url) {
+        const lower = url.toLowerCase();
+        return (lower.includes('raw.githubusercontent.com') ||
+            lower.includes('gist.githubusercontent.com') ||
+            lower.includes('/-/raw/') ||
+            BITBUCKET_RAW_RE.test(lower));
+    }
+    splitParams(url) {
+        const hashIndex = url.indexOf('#');
+        const queryIndex = url.indexOf('?');
+        const endIndex = Math.min(queryIndex === -1 ? url.length : queryIndex, hashIndex === -1 ? url.length : hashIndex);
+        const hash = hashIndex !== -1 ? url.slice(hashIndex) : '';
+        return { base: url.slice(0, endIndex), hash };
+    }
+    applyRules(base, hash) {
+        for (const rule of TRANSFORM_RULES) {
+            const urlToMatch = rule.name === 'github-gist' && hash.startsWith('#file-')
+                ? base + hash
+                : base;
+            const match = rule.pattern.exec(urlToMatch);
+            if (match)
+                return { url: rule.transform(match), platform: rule.name };
         }
+        return null;
     }
-    return null;
 }
-function normalizeAndValidateLookupResults(addresses, resolvedFamily, hostname) {
-    const list = normalizeLookupResults(addresses, resolvedFamily);
-    const error = findLookupError(list, hostname);
-    return { list, error };
+const rawUrlTransformer = new RawUrlTransformer();
+/** Backwards-compatible exports */
+export function transformToRawUrl(url) {
+    return rawUrlTransformer.transformToRawUrl(url);
 }
-function respondLookupError(callback, error, addresses) {
-    callback(error, addresses);
+export function isRawTextContentUrl(url) {
+    return rawUrlTransformer.isRawTextContentUrl(url);
 }
-function respondLookupSelection(callback, selection) {
-    if (selection.error) {
-        callback(selection.error, selection.fallback);
-        return;
+const DNS_LOOKUP_TIMEOUT_MS = 5000;
+class SafeDnsLookup {
+    lookup(hostname, options, callback) {
+        const normalizedOptions = this.normalizeOptions(options);
+        const useAll = Boolean(normalizedOptions.all);
+        const resolvedFamily = this.resolveFamily(normalizedOptions.family);
+        const lookupOptions = {
+            family: normalizedOptions.family,
+            hints: normalizedOptions.hints,
+            all: true, // Always request all results; we select based on caller preference.
+            order: this.resolveOrder(normalizedOptions),
+        };
+        const timeout = this.createTimeout(hostname, callback);
+        const safeCallback = (err, address, family) => {
+            if (timeout.isDone())
+                return;
+            timeout.markDone();
+            callback(err, address, family);
+        };
+        (async () => {
+            try {
+                const result = await dns.promises.lookup(hostname, lookupOptions);
+                const addresses = Array.isArray(result) ? result : [result];
+                this.handleLookupResult(null, addresses, hostname, resolvedFamily, useAll, safeCallback);
+            }
+            catch (error) {
+                this.handleLookupResult(error, [], hostname, resolvedFamily, useAll, safeCallback);
+            }
+        })().catch((error) => {
+            if (!timeout.isDone()) {
+                safeCallback(error, []);
+            }
+        });
     }
-    callback(null, selection.address, selection.family);
-}
-function handleLookupResult(error, addresses, hostname, resolvedFamily, useAll, callback) {
-    if (error) {
-        respondLookupError(callback, error, addresses);
-        return;
+    normalizeOptions(options) {
+        return typeof options === 'number' ? { family: options } : options;
+    }
+    resolveFamily(family) {
+        if (family === 'IPv4')
+            return 4;
+        if (family === 'IPv6')
+            return 6;
+        return family;
+    }
+    resolveOrder(options) {
+        if (options.order)
+            return options.order;
+        // legacy `verbatim` option support
+        if (isObject(options)) {
+            const legacy = options.verbatim;
+            if (typeof legacy === 'boolean')
+                return legacy ? 'verbatim' : 'ipv4first';
+        }
+        return 'verbatim';
     }
-    const { list, error: lookupError } = normalizeAndValidateLookupResults(addresses, resolvedFamily, hostname);
-    if (lookupError) {
-        respondLookupError(callback, lookupError, list);
-        return;
+    handleLookupResult(error, addresses, hostname, resolvedFamily, useAll, callback) {
+        if (error) {
+            callback(error, addresses);
+            return;
+        }
+        const list = this.normalizeResults(addresses, resolvedFamily);
+        const validationError = this.validateResults(list, hostname);
+        if (validationError) {
+            callback(validationError, list);
+            return;
+        }
+        const selection = this.selectResult(list, useAll, hostname);
+        if (selection.error) {
+            callback(selection.error, selection.fallback);
+            return;
+        }
+        callback(null, selection.address, selection.family);
     }
-    respondLookupSelection(callback, selectLookupResult(list, useAll, hostname));
-}
-function resolveDns(hostname, options, callback) {
-    const { normalizedOptions, useAll, resolvedFamily } = buildLookupContext(options);
-    const lookupOptions = buildLookupOptions(normalizedOptions);
-    const timeout = createLookupTimeout(hostname, callback);
-    const safeCallback = wrapLookupCallback(callback, timeout);
-    dns.lookup(hostname, lookupOptions, createLookupCallback(hostname, resolvedFamily, useAll, safeCallback));
-}
-function normalizeLookupOptions(options) {
-    return typeof options === 'number' ? { family: options } : options;
-}
-function buildLookupContext(options) {
-    const normalizedOptions = normalizeLookupOptions(options);
-    return {
-        normalizedOptions,
-        useAll: Boolean(normalizedOptions.all),
-        resolvedFamily: resolveFamily(normalizedOptions.family),
-    };
-}
-const DEFAULT_DNS_ORDER = 'verbatim';
-function resolveResultOrder(options) {
-    if (options.order)
-        return options.order;
-    const legacyVerbatim = getLegacyVerbatim(options);
-    if (legacyVerbatim !== undefined) {
-        return legacyVerbatim ? 'verbatim' : 'ipv4first';
+    normalizeResults(addresses, family) {
+        if (Array.isArray(addresses))
+            return addresses;
+        return [{ address: addresses, family: family ?? 4 }];
     }
-    return DEFAULT_DNS_ORDER;
-}
-function getLegacyVerbatim(options) {
-    if (isObject(options)) {
-        const { verbatim } = options;
-        return typeof verbatim === 'boolean' ? verbatim : undefined;
+    validateResults(list, hostname) {
+        if (list.length === 0) {
+            return createErrorWithCode(`No DNS results returned for ${hostname}`, 'ENODATA');
+        }
+        for (const addr of list) {
+            if (addr.family !== 4 && addr.family !== 6) {
+                return createErrorWithCode(`Invalid address family returned for ${hostname}`, 'EINVAL');
+            }
+            if (ipBlocker.isBlockedIp(addr.address)) {
+                return createErrorWithCode(`Blocked IP detected for ${hostname}`, 'EBLOCKED');
+            }
+        }
+        return null;
     }
-    return undefined;
-}
-function buildLookupOptions(normalizedOptions) {
-    return {
-        family: normalizedOptions.family,
-        hints: normalizedOptions.hints,
-        all: true,
-        order: resolveResultOrder(normalizedOptions),
-    };
-}
-function createLookupCallback(hostname, resolvedFamily, useAll, callback) {
-    return (err, addresses) => {
-        handleLookupResult(err, addresses, hostname, resolvedFamily, useAll, callback);
-    };
-}
-function resolveFamily(family) {
-    if (family === 'IPv4')
-        return 4;
-    if (family === 'IPv6')
-        return 6;
-    return family;
-}
-function createLookupTimeout(hostname, callback) {
-    let done = false;
-    const timer = setTimeout(() => {
-        if (done)
-            return;
-        done = true;
-        callback(createErrorWithCode(`DNS lookup timed out for ${hostname}`, 'ETIMEOUT'), []);
-    }, DNS_LOOKUP_TIMEOUT_MS);
-    timer.unref();
-    return {
-        isDone: () => done,
-        markDone: () => {
+    selectResult(list, useAll, hostname) {
+        if (list.length === 0) {
+            return {
+                error: createErrorWithCode(`No DNS results returned for ${hostname}`, 'ENODATA'),
+                fallback: [],
+                address: [],
+            };
+        }
+        if (useAll)
+            return { address: list, fallback: list };
+        const first = list.at(0);
+        if (!first) {
+            return {
+                error: createErrorWithCode(`No DNS results returned for ${hostname}`, 'ENODATA'),
+                fallback: [],
+                address: [],
+            };
+        }
+        return { address: first.address, family: first.family, fallback: list };
+    }
+    createTimeout(hostname, callback) {
+        let done = false;
+        const timer = setTimeout(() => {
+            if (done)
+                return;
             done = true;
-            clearTimeout(timer);
-        },
-    };
-}
-function wrapLookupCallback(callback, timeout) {
-    return (err, address, family) => {
-        if (timeout.isDone())
-            return;
-        timeout.markDone();
-        callback(err, address, family);
-    };
-}
+            callback(createErrorWithCode(`DNS lookup timed out for ${hostname}`, 'ETIMEOUT'), []);
+        }, DNS_LOOKUP_TIMEOUT_MS);
+        timer.unref();
+        return {
+            isDone: () => done,
+            markDone: () => {
+                done = true;
+                clearTimeout(timer);
+            },
+        };
+    }
+}
+const safeDns = new SafeDnsLookup();
+/* -------------------------------------------------------------------------------------------------
+ * Dispatcher / Agent lifecycle
+ * ------------------------------------------------------------------------------------------------- */
 function getAgentOptions() {
     const cpuCount = os.availableParallelism();
     return {
         keepAliveTimeout: 60000,
         connections: Math.max(cpuCount * 2, 25),
         pipelining: 1,
-        connect: { lookup: resolveDns },
+        connect: { lookup: safeDns.lookup.bind(safeDns) },
     };
 }
 export const dispatcher = new Agent(getAgentOptions());
 export function destroyAgents() {
     void dispatcher.close();
 }
+/* -------------------------------------------------------------------------------------------------
+ * Fetch error mapping (request-level)
+ * ------------------------------------------------------------------------------------------------- */
 function parseRetryAfter(header) {
     if (!header)
         return 60;
-    const parsed = parseInt(header, 10);
+    const parsed = Number.parseInt(header, 10);
     return Number.isNaN(parsed) ? 60 : parsed;
 }
-function createCanceledError(url) {
-    return new FetchError('Request was canceled', url, 499, {
-        reason: 'aborted',
-    });
-}
-function createTimeoutError(url, timeoutMs) {
-    return new FetchError(`Request timeout after ${timeoutMs}ms`, url, 504, {
-        timeout: timeoutMs,
-    });
-}
-function createRateLimitError(url, headerValue) {
-    const retryAfter = parseRetryAfter(headerValue);
-    return new FetchError('Too many requests', url, 429, { retryAfter });
-}
-function createHttpError(url, status, statusText) {
-    return new FetchError(`HTTP ${status}: ${statusText}`, url, status);
-}
-function createTooManyRedirectsError(url) {
-    return new FetchError('Too many redirects', url);
-}
-function createMissingRedirectLocationError(url) {
-    return new FetchError('Redirect response missing Location header', url);
-}
-function createSizeLimitError(url, maxBytes) {
-    return new FetchError(`Response exceeds maximum size of ${maxBytes} bytes`, url);
-}
-function createNetworkError(url, message) {
-    const details = message ? { message } : undefined;
-    return new FetchError(`Network error: Could not reach ${url}`, url, undefined, details ?? {});
-}
-function createUnknownError(url, message) {
-    return new FetchError(message, url);
+class FetchErrorFactory {
+    canceled(url) {
+        return new FetchError('Request was canceled', url, 499, {
+            reason: 'aborted',
+        });
+    }
+    timeout(url, timeoutMs) {
+        return new FetchError(`Request timeout after ${timeoutMs}ms`, url, 504, {
+            timeout: timeoutMs,
+        });
+    }
+    rateLimited(url, retryAfterHeader) {
+        return new FetchError('Too many requests', url, 429, {
+            retryAfter: parseRetryAfter(retryAfterHeader),
+        });
+    }
+    http(url, status, statusText) {
+        return new FetchError(`HTTP ${status}: ${statusText}`, url, status);
+    }
+    tooManyRedirects(url) {
+        return new FetchError('Too many redirects', url);
+    }
+    missingRedirectLocation(url) {
+        return new FetchError('Redirect response missing Location header', url);
+    }
+    sizeLimit(url, maxBytes) {
+        return new FetchError(`Response exceeds maximum size of ${maxBytes} bytes`, url);
+    }
+    network(url, message) {
+        return new FetchError(`Network error: Could not reach ${url}`, url, undefined, message ? { message } : {});
+    }
+    unknown(url, message) {
+        return new FetchError(message, url);
+    }
 }
+const fetchErrors = new FetchErrorFactory();
 function isAbortError(error) {
     return (error instanceof Error &&
         (error.name === 'AbortError' || error.name === 'TimeoutError'));
@@ -517,350 +503,322 @@ function isAbortError(error) {
 function isTimeoutError(error) {
     return error instanceof Error && error.name === 'TimeoutError';
 }
-function getRequestUrl(record) {
-    const value = record.requestUrl;
-    return typeof value === 'string' ? value : null;
-}
 function resolveErrorUrl(error, fallback) {
     if (error instanceof FetchError)
         return error.url;
     if (!isObject(error))
         return fallback;
-    const requestUrl = getRequestUrl(error);
-    if (requestUrl)
-        return requestUrl;
-    return fallback;
-}
-function resolveAbortFetchError(error, url, timeoutMs) {
-    if (!isAbortError(error))
-        return null;
-    if (isTimeoutError(error)) {
-        return createTimeoutError(url, timeoutMs);
-    }
-    return createCanceledError(url);
-}
-function resolveUnexpectedFetchError(error, url) {
-    if (error instanceof Error) {
-        return createNetworkError(url, error.message);
-    }
-    return createUnknownError(url, 'Unexpected error');
+    const { requestUrl } = error;
+    return typeof requestUrl === 'string' ? requestUrl : fallback;
 }
 function mapFetchError(error, fallbackUrl, timeoutMs) {
     if (error instanceof FetchError)
         return error;
     const url = resolveErrorUrl(error, fallbackUrl);
-    const abortError = resolveAbortFetchError(error, url, timeoutMs);
-    if (abortError)
-        return abortError;
-    return resolveUnexpectedFetchError(error, url);
-}
-const fetchChannel = diagnosticsChannel.channel('superfetch.fetch');
-function publishFetchEvent(event) {
-    if (!fetchChannel.hasSubscribers)
-        return;
-    try {
-        fetchChannel.publish(event);
-    }
-    catch {
-        // Avoid crashing the publisher if a subscriber throws.
+    if (isAbortError(error)) {
+        return isTimeoutError(error)
+            ? fetchErrors.timeout(url, timeoutMs)
+            : fetchErrors.canceled(url);
     }
+    if (error instanceof Error)
+        return fetchErrors.network(url, error.message);
+    return fetchErrors.unknown(url, 'Unexpected error');
 }
-function buildContextFields(context) {
-    const fields = {};
-    if (context.contextRequestId) {
-        fields.contextRequestId = context.contextRequestId;
-    }
-    if (context.operationId) {
-        fields.operationId = context.operationId;
+const fetchChannel = diagnosticsChannel.channel('superfetch.fetch');
+const SLOW_REQUEST_THRESHOLD_MS = 5000;
+class FetchTelemetry {
+    start(url, method) {
+        const safeUrl = redactUrl(url);
+        const contextRequestId = getRequestId();
+        const operationId = getOperationId();
+        const ctx = {
+            requestId: randomUUID(),
+            startTime: performance.now(),
+            url: safeUrl,
+            method: method.toUpperCase(),
+            ...(contextRequestId ? { contextRequestId } : {}),
+            ...(operationId ? { operationId } : {}),
+        };
+        this.publish({
+            v: 1,
+            type: 'start',
+            requestId: ctx.requestId,
+            method: ctx.method,
+            url: ctx.url,
+            ...(ctx.contextRequestId
+                ? { contextRequestId: ctx.contextRequestId }
+                : {}),
+            ...(ctx.operationId ? { operationId: ctx.operationId } : {}),
+        });
+        logDebug('HTTP Request', {
+            requestId: ctx.requestId,
+            method: ctx.method,
+            url: ctx.url,
+            ...(ctx.contextRequestId
+                ? { contextRequestId: ctx.contextRequestId }
+                : {}),
+            ...(ctx.operationId ? { operationId: ctx.operationId } : {}),
+        });
+        return ctx;
+    }
+    recordResponse(context, response, contentSize) {
+        const duration = performance.now() - context.startTime;
+        const durationLabel = `${Math.round(duration)}ms`;
+        this.publish({
+            v: 1,
+            type: 'end',
+            requestId: context.requestId,
+            status: response.status,
+            duration,
+            ...(context.contextRequestId
+                ? { contextRequestId: context.contextRequestId }
+                : {}),
+            ...(context.operationId ? { operationId: context.operationId } : {}),
+        });
+        const contentType = response.headers.get('content-type') ?? undefined;
+        const contentLengthHeader = response.headers.get('content-length');
+        const size = contentLengthHeader ??
+            (contentSize === undefined ? undefined : String(contentSize));
+        logDebug('HTTP Response', {
+            requestId: context.requestId,
+            status: response.status,
+            url: context.url,
+            duration: durationLabel,
+            ...(context.contextRequestId
+                ? { contextRequestId: context.contextRequestId }
+                : {}),
+            ...(context.operationId ? { operationId: context.operationId } : {}),
+            ...(contentType ? { contentType } : {}),
+            ...(size ? { size } : {}),
+        });
+        if (duration > SLOW_REQUEST_THRESHOLD_MS) {
+            logWarn('Slow HTTP request detected', {
+                requestId: context.requestId,
+                url: context.url,
+                duration: durationLabel,
+                ...(context.contextRequestId
+                    ? { contextRequestId: context.contextRequestId }
+                    : {}),
+                ...(context.operationId ? { operationId: context.operationId } : {}),
+            });
+        }
     }
-    return fields;
-}
-function buildResponseMetadata(response, contentSize) {
-    const contentType = response.headers.get('content-type') ?? undefined;
-    const contentLengthHeader = response.headers.get('content-length');
-    const size = contentLengthHeader ??
-        (contentSize === undefined ? undefined : String(contentSize));
-    const metadata = {};
-    if (contentType)
-        metadata.contentType = contentType;
-    if (size)
-        metadata.size = size;
-    return metadata;
-}
-function logSlowRequest(context, duration, durationLabel, contextFields) {
-    if (duration <= SLOW_REQUEST_THRESHOLD_MS)
-        return;
-    logWarn('Slow HTTP request detected', {
-        requestId: context.requestId,
-        url: context.url,
-        duration: durationLabel,
-        ...contextFields,
-    });
-}
-function resolveSystemErrorCode(error) {
-    return isSystemError(error) ? error.code : undefined;
-}
-function buildFetchErrorEvent(context, err, duration, contextFields, status, code) {
-    const event = {
-        v: 1,
-        type: 'error',
-        requestId: context.requestId,
-        url: context.url,
-        error: err.message,
-        duration,
-        ...contextFields,
-    };
-    if (code !== undefined) {
-        event.code = code;
+    recordError(context, error, status) {
+        const duration = performance.now() - context.startTime;
+        const err = error instanceof Error ? error : new Error(String(error));
+        const code = isSystemError(err) ? err.code : undefined;
+        this.publish({
+            v: 1,
+            type: 'error',
+            requestId: context.requestId,
+            url: context.url,
+            error: err.message,
+            duration,
+            ...(code !== undefined ? { code } : {}),
+            ...(status !== undefined ? { status } : {}),
+            ...(context.contextRequestId
+                ? { contextRequestId: context.contextRequestId }
+                : {}),
+            ...(context.operationId ? { operationId: context.operationId } : {}),
+        });
+        const log = status === 429 ? logWarn : logError;
+        log('HTTP Request Error', {
+            requestId: context.requestId,
+            url: context.url,
+            status,
+            code,
+            error: err.message,
+            ...(context.contextRequestId
+                ? { contextRequestId: context.contextRequestId }
+                : {}),
+            ...(context.operationId ? { operationId: context.operationId } : {}),
+        });
     }
-    if (status !== undefined) {
-        event.status = status;
+    publish(event) {
+        if (!fetchChannel.hasSubscribers)
+            return;
+        try {
+            fetchChannel.publish(event);
+        }
+        catch {
+            // Best-effort; subscriber failures must not crash request path.
+        }
     }
-    return event;
-}
-function createTelemetryContext(url, method) {
-    const safeUrl = redactUrl(url);
-    const contextRequestId = getRequestId();
-    const operationId = getOperationId();
-    return {
-        requestId: randomUUID(),
-        startTime: performance.now(),
-        url: safeUrl,
-        method: method.toUpperCase(),
-        ...(contextRequestId ? { contextRequestId } : {}),
-        ...(operationId ? { operationId } : {}),
-    };
 }
+const telemetry = new FetchTelemetry();
+/** Backwards-compatible exports */
 export function startFetchTelemetry(url, method) {
-    const context = createTelemetryContext(url, method);
-    const contextFields = buildContextFields(context);
-    publishFetchEvent({
-        v: 1,
-        type: 'start',
-        requestId: context.requestId,
-        method: context.method,
-        url: context.url,
-        ...contextFields,
-    });
-    logDebug('HTTP Request', {
-        requestId: context.requestId,
-        method: context.method,
-        url: context.url,
-        ...contextFields,
-    });
-    return context;
+    return telemetry.start(url, method);
 }
 export function recordFetchResponse(context, response, contentSize) {
-    const duration = performance.now() - context.startTime;
-    const durationLabel = `${Math.round(duration)}ms`;
-    const contextFields = buildContextFields(context);
-    const responseMetadata = buildResponseMetadata(response, contentSize);
-    publishFetchEvent({
-        v: 1,
-        type: 'end',
-        requestId: context.requestId,
-        status: response.status,
-        duration,
-        ...contextFields,
-    });
-    logDebug('HTTP Response', {
-        requestId: context.requestId,
-        status: response.status,
-        url: context.url,
-        duration: durationLabel,
-        ...contextFields,
-        ...responseMetadata,
-    });
-    logSlowRequest(context, duration, durationLabel, contextFields);
+    telemetry.recordResponse(context, response, contentSize);
 }
 export function recordFetchError(context, error, status) {
-    const duration = performance.now() - context.startTime;
-    const err = error instanceof Error ? error : new Error(String(error));
-    const contextFields = buildContextFields(context);
-    const code = resolveSystemErrorCode(err);
-    publishFetchEvent(buildFetchErrorEvent(context, err, duration, contextFields, status, code));
-    const log = status === 429 ? logWarn : logError;
-    log('HTTP Request Error', {
-        requestId: context.requestId,
-        url: context.url,
-        status,
-        code,
-        error: err.message,
-        ...contextFields,
-    });
+    telemetry.recordError(context, error, status);
 }
+/* -------------------------------------------------------------------------------------------------
+ * Redirect handling
+ * ------------------------------------------------------------------------------------------------- */
 const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
 function isRedirectStatus(status) {
     return REDIRECT_STATUSES.has(status);
 }
 function cancelResponseBody(response) {
     const cancelPromise = response.body?.cancel();
-    if (cancelPromise) {
+    if (cancelPromise)
         cancelPromise.catch(() => {
-            // Best-effort cancellation; ignore failures.
+            /* ignore */
         });
-    }
 }
-async function performFetchCycle(currentUrl, init, redirectLimit, redirectCount) {
-    const response = await fetch(currentUrl, { ...init, redirect: 'manual' });
-    if (!isRedirectStatus(response.status)) {
-        return { response };
+class RedirectFollower {
+    async fetchWithRedirects(url, init, maxRedirects) {
+        let currentUrl = url;
+        const redirectLimit = Math.max(0, maxRedirects);
+        for (let redirectCount = 0; redirectCount <= redirectLimit; redirectCount += 1) {
+            const { response, nextUrl } = await this.withRedirectErrorContext(currentUrl, async () => this.performFetchCycle(currentUrl, init, redirectLimit, redirectCount));
+            if (!nextUrl)
+                return { response, url: currentUrl };
+            currentUrl = nextUrl;
+        }
+        throw fetchErrors.tooManyRedirects(currentUrl);
+    }
+    async performFetchCycle(currentUrl, init, redirectLimit, redirectCount) {
+        const response = await fetch(currentUrl, { ...init, redirect: 'manual' });
+        if (!isRedirectStatus(response.status))
+            return { response };
+        this.assertRedirectWithinLimit(response, currentUrl, redirectLimit, redirectCount);
+        const location = this.getRedirectLocation(response, currentUrl);
+        cancelResponseBody(response);
+        return {
+            response,
+            nextUrl: this.resolveRedirectTarget(currentUrl, location),
+        };
     }
-    assertRedirectWithinLimit(response, currentUrl, redirectLimit, redirectCount);
-    const location = getRedirectLocation(response, currentUrl);
-    cancelResponseBody(response);
-    return {
-        response,
-        nextUrl: resolveRedirectTarget(currentUrl, location),
-    };
-}
-function assertRedirectWithinLimit(response, currentUrl, redirectLimit, redirectCount) {
-    if (redirectCount < redirectLimit)
-        return;
-    cancelResponseBody(response);
-    throw createTooManyRedirectsError(currentUrl);
-}
-function getRedirectLocation(response, currentUrl) {
-    const location = response.headers.get('location');
-    if (location)
-        return location;
-    cancelResponseBody(response);
-    throw createMissingRedirectLocationError(currentUrl);
-}
-function annotateRedirectError(error, url) {
-    if (!isObject(error))
-        return;
-    error.requestUrl = url;
-}
-function resolveRedirectTarget(baseUrl, location) {
-    if (!URL.canParse(location, baseUrl)) {
-        throw createErrorWithCode('Invalid redirect target', 'EBADREDIRECT');
+    assertRedirectWithinLimit(response, currentUrl, redirectLimit, redirectCount) {
+        if (redirectCount < redirectLimit)
+            return;
+        cancelResponseBody(response);
+        throw fetchErrors.tooManyRedirects(currentUrl);
     }
-    const resolved = new URL(location, baseUrl);
-    if (resolved.username || resolved.password) {
-        throw createErrorWithCode('Redirect target includes credentials', 'EBADREDIRECT');
+    getRedirectLocation(response, currentUrl) {
+        const location = response.headers.get('location');
+        if (location)
+            return location;
+        cancelResponseBody(response);
+        throw fetchErrors.missingRedirectLocation(currentUrl);
+    }
+    resolveRedirectTarget(baseUrl, location) {
+        if (!URL.canParse(location, baseUrl))
+            throw createErrorWithCode('Invalid redirect target', 'EBADREDIRECT');
+        const resolved = new URL(location, baseUrl);
+        if (resolved.username || resolved.password) {
+            throw createErrorWithCode('Redirect target includes credentials', 'EBADREDIRECT');
+        }
+        return validateAndNormalizeUrl(resolved.href);
     }
-    return validateAndNormalizeUrl(resolved.href);
-}
-async function withRedirectErrorContext(url, fn) {
-    try {
-        return await fn();
+    annotateRedirectError(error, url) {
+        if (!isObject(error))
+            return;
+        error.requestUrl = url;
     }
-    catch (error) {
-        annotateRedirectError(error, url);
-        throw error;
+    async withRedirectErrorContext(url, fn) {
+        try {
+            return await fn();
+        }
+        catch (error) {
+            this.annotateRedirectError(error, url);
+            throw error;
+        }
     }
 }
+const redirectFollower = new RedirectFollower();
+/** Backwards-compatible export */
 export async function fetchWithRedirects(url, init, maxRedirects) {
-    let currentUrl = url;
-    const redirectLimit = Math.max(0, maxRedirects);
-    for (let redirectCount = 0; redirectCount <= redirectLimit; redirectCount += 1) {
-        const { response, nextUrl } = await withRedirectErrorContext(currentUrl, () => performFetchCycle(currentUrl, init, redirectLimit, redirectCount));
-        if (!nextUrl) {
-            return { response, url: currentUrl };
-        }
-        currentUrl = nextUrl;
-    }
-    throw createTooManyRedirectsError(currentUrl);
+    return redirectFollower.fetchWithRedirects(url, init, maxRedirects);
 }
+/* -------------------------------------------------------------------------------------------------
+ * Response reading (max size + abort-aware streaming)
+ * ------------------------------------------------------------------------------------------------- */
 function assertContentLengthWithinLimit(response, url, maxBytes) {
-    const contentLengthHeader = response.headers.get('content-length');
-    if (!contentLengthHeader)
+    const header = response.headers.get('content-length');
+    if (!header)
         return;
-    const contentLength = Number.parseInt(contentLengthHeader, 10);
-    if (Number.isNaN(contentLength) || contentLength <= maxBytes) {
+    const contentLength = Number.parseInt(header, 10);
+    if (Number.isNaN(contentLength) || contentLength <= maxBytes)
         return;
-    }
     cancelResponseBody(response);
-    throw createSizeLimitError(url, maxBytes);
-}
-function createReadState() {
-    return {
-        decoder: new TextDecoder(),
-        parts: [],
-        total: 0,
-    };
-}
-function appendChunk(state, chunk, maxBytes, url) {
-    state.total += chunk.byteLength;
-    if (state.total > maxBytes) {
-        throw createSizeLimitError(url, maxBytes);
-    }
-    const decoded = state.decoder.decode(chunk, { stream: true });
-    if (decoded)
-        state.parts.push(decoded);
-}
-function finalizeRead(state) {
-    const decoded = state.decoder.decode();
-    if (decoded)
-        state.parts.push(decoded);
-}
-function createAbortError(url) {
-    return new FetchError('Request was aborted during response read', url, 499, {
-        reason: 'aborted',
-    });
-}
-async function cancelReaderQuietly(reader) {
-    try {
-        await reader.cancel();
-    }
-    catch {
-        // Ignore cancel errors; we're already failing this read.
-    }
-}
-async function throwIfAborted(signal, url, reader) {
-    if (!signal?.aborted)
-        return;
-    await cancelReaderQuietly(reader);
-    throw createAbortError(url);
-}
-async function handleReadFailure(error, signal, url, reader) {
-    const aborted = signal?.aborted ?? false;
-    await cancelReaderQuietly(reader);
-    if (aborted) {
-        throw createAbortError(url);
-    }
-    throw error;
-}
-async function readAllChunks(reader, state, url, maxBytes, signal) {
-    await throwIfAborted(signal, url, reader);
-    let result = await reader.read();
-    while (!result.done) {
-        appendChunk(state, result.value, maxBytes, url);
-        await throwIfAborted(signal, url, reader);
-        result = await reader.read();
-    }
-}
-async function readStreamWithLimit(stream, url, maxBytes, signal) {
-    const state = createReadState();
-    const reader = stream.getReader();
-    try {
-        await readAllChunks(reader, state, url, maxBytes, signal);
-    }
-    catch (error) {
-        await handleReadFailure(error, signal, url, reader);
+    throw fetchErrors.sizeLimit(url, maxBytes);
+}
+class ResponseTextReader {
+    async read(response, url, maxBytes, signal) {
+        assertContentLengthWithinLimit(response, url, maxBytes);
+        if (!response.body) {
+            const text = await response.text();
+            const size = Buffer.byteLength(text);
+            if (size > maxBytes)
+                throw fetchErrors.sizeLimit(url, maxBytes);
+            return { text, size };
+        }
+        return this.readStreamWithLimit(response.body, url, maxBytes, signal);
+    }
+    async readStreamWithLimit(stream, url, maxBytes, signal) {
+        const decoder = new TextDecoder();
+        const parts = [];
+        let total = 0;
+        const reader = stream.getReader();
+        try {
+            await this.throwIfAborted(signal, url, reader);
+            let result = await reader.read();
+            while (!result.done) {
+                total += result.value.byteLength;
+                if (total > maxBytes)
+                    throw fetchErrors.sizeLimit(url, maxBytes);
+                const decoded = decoder.decode(result.value, { stream: true });
+                if (decoded)
+                    parts.push(decoded);
+                await this.throwIfAborted(signal, url, reader);
+                result = await reader.read();
+            }
+        }
+        catch (error) {
+            await this.cancelReaderQuietly(reader);
+            if (signal?.aborted)
+                throw new FetchError('Request was aborted during response read', url, 499, { reason: 'aborted' });
+            throw error;
+        }
+        finally {
+            reader.releaseLock();
+        }
+        const final = decoder.decode();
+        if (final)
+            parts.push(final);
+        return { text: parts.join(''), size: total };
     }
-    finally {
-        reader.releaseLock();
+    async throwIfAborted(signal, url, reader) {
+        if (!signal?.aborted)
+            return;
+        await this.cancelReaderQuietly(reader);
+        throw new FetchError('Request was aborted during response read', url, 499, {
+            reason: 'aborted',
+        });
     }
-    finalizeRead(state);
-    return { text: state.parts.join(''), size: state.total };
-}
-async function readResponseTextFallback(response, url, maxBytes) {
-    const text = await response.text();
-    const size = Buffer.byteLength(text);
-    if (size > maxBytes) {
-        throw createSizeLimitError(url, maxBytes);
+    async cancelReaderQuietly(reader) {
+        try {
+            await reader.cancel();
+        }
+        catch {
+            // ignore
+        }
     }
-    return { text, size };
 }
+const responseReader = new ResponseTextReader();
+/** Backwards-compatible export */
 export async function readResponseText(response, url, maxBytes, signal) {
-    assertContentLengthWithinLimit(response, url, maxBytes);
-    if (!response.body) {
-        return readResponseTextFallback(response, url, maxBytes);
-    }
-    return readStreamWithLimit(response.body, url, maxBytes, signal);
+    return responseReader.read(response, url, maxBytes, signal);
 }
+/* -------------------------------------------------------------------------------------------------
+ * HTTP fetcher (headers, signals, response handling)
+ * ------------------------------------------------------------------------------------------------- */
 const DEFAULT_HEADERS = {
     'User-Agent': config.fetcher.userAgent,
     Accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
@@ -873,63 +831,51 @@ function buildHeaders() {
 }
 function buildRequestSignal(timeoutMs, external) {
     const timeoutSignal = AbortSignal.timeout(timeoutMs);
-    if (!external)
-        return timeoutSignal;
-    return AbortSignal.any([external, timeoutSignal]);
+    return external ? AbortSignal.any([external, timeoutSignal]) : timeoutSignal;
 }
 function buildRequestInit(headers, signal) {
-    return {
-        method: 'GET',
-        headers,
-        signal,
-        dispatcher,
-    };
+    return { method: 'GET', headers, signal, dispatcher };
 }
 function resolveResponseError(response, finalUrl) {
-    return (resolveRateLimitError(response, finalUrl) ??
-        resolveHttpError(response, finalUrl));
-}
-function resolveRateLimitError(response, finalUrl) {
-    return response.status === 429
-        ? createRateLimitError(finalUrl, response.headers.get('retry-after'))
-        : null;
-}
-function resolveHttpError(response, finalUrl) {
+    if (response.status === 429) {
+        return fetchErrors.rateLimited(finalUrl, response.headers.get('retry-after'));
+    }
     return response.ok
         ? null
-        : createHttpError(finalUrl, response.status, response.statusText);
+        : fetchErrors.http(finalUrl, response.status, response.statusText);
 }
-async function handleFetchResponse(response, finalUrl, telemetry, signal) {
+async function handleFetchResponse(response, finalUrl, ctx, signal) {
     const responseError = resolveResponseError(response, finalUrl);
     if (responseError) {
         cancelResponseBody(response);
         throw responseError;
     }
-    const { text, size } = await readResponseText(response, finalUrl, config.fetcher.maxContentLength, signal);
-    recordFetchResponse(telemetry, response, size);
+    const { text, size } = await responseReader.read(response, finalUrl, config.fetcher.maxContentLength, signal);
+    telemetry.recordResponse(ctx, response, size);
     return text;
 }
-async function fetchWithTelemetry(normalizedUrl, requestInit, timeoutMs) {
-    const telemetry = startFetchTelemetry(normalizedUrl, 'GET');
-    try {
-        return await fetchAndHandle(normalizedUrl, requestInit, telemetry);
-    }
-    catch (error) {
-        const mapped = mapFetchError(error, normalizedUrl, timeoutMs);
-        telemetry.url = mapped.url;
-        recordFetchError(telemetry, mapped, mapped.statusCode);
-        throw mapped;
+class HttpFetcher {
+    async fetchNormalizedUrl(normalizedUrl, options) {
+        const timeoutMs = config.fetcher.timeout;
+        const headers = buildHeaders();
+        const signal = buildRequestSignal(timeoutMs, options?.signal);
+        const init = buildRequestInit(headers, signal);
+        const ctx = telemetry.start(normalizedUrl, 'GET');
+        try {
+            const { response, url: finalUrl } = await redirectFollower.fetchWithRedirects(normalizedUrl, init, config.fetcher.maxRedirects);
+            ctx.url = finalUrl;
+            return await handleFetchResponse(response, finalUrl, ctx, init.signal ?? undefined);
+        }
+        catch (error) {
+            const mapped = mapFetchError(error, normalizedUrl, timeoutMs);
+            ctx.url = mapped.url;
+            telemetry.recordError(ctx, mapped, mapped.statusCode);
+            throw mapped;
+        }
     }
 }
-async function fetchAndHandle(normalizedUrl, requestInit, telemetry) {
-    const { response, url: finalUrl } = await fetchWithRedirects(normalizedUrl, requestInit, config.fetcher.maxRedirects);
-    telemetry.url = finalUrl;
-    return handleFetchResponse(response, finalUrl, telemetry, requestInit.signal ?? undefined);
-}
+const httpFetcher = new HttpFetcher();
+/** Backwards-compatible export */
 export async function fetchNormalizedUrl(normalizedUrl, options) {
-    const timeoutMs = config.fetcher.timeout;
-    const headers = buildHeaders();
-    const signal = buildRequestSignal(timeoutMs, options?.signal);
-    const requestInit = buildRequestInit(headers, signal);
-    return fetchWithTelemetry(normalizedUrl, requestInit, timeoutMs);
+    return httpFetcher.fetchNormalizedUrl(normalizedUrl, options);
 }