arthron 1.0.1 → 1.2.0

package/dist/index.cjs

@@ -1,164 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-//#region src/request/url.ts
-const ABSOLUTE_URL = /^[a-z][a-z0-9+.-]*:\/\//i;
-const HTTP_URL = /^https?:\/\//i;
-function isAbsoluteUrl(path) {
-	return ABSOLUTE_URL.test(path);
-}
-/**
-* Origin + pathname only — the query and userinfo tend to carry secrets.
-* For anything printed: log lines, error messages, `ArthronError.toJSON`.
-*/
-function redactUrl(url) {
-	try {
-		const parsed = new URL(url);
-		return `${parsed.origin}${parsed.pathname}`;
-	} catch {
-		return url.split(/[?#]/)[0] ?? url;
-	}
-}
-/**
-* `undefined` when `url` has no origin of its own. A relative baseURL takes
-* the page's origin in a browser and has none elsewhere.
-*/
-function originOf(url) {
-	const page = globalThis.location?.href;
-	try {
-		return new URL(url, page).origin;
-	} catch {
-		return;
-	}
-}
-/** `path` is absolute and points away from `baseURL`'s origin. */
-function leavesBase(baseURL, path) {
-	if (baseURL === void 0 || !isAbsoluteUrl(path)) return false;
-	const base = originOf(baseURL);
-	return base === void 0 || originOf(path) !== base;
-}
-function toQueryString(params) {
-	if (!params) return "";
-	if (Object.prototype.toString.call(params) === "[object URLSearchParams]") return params.toString();
-	const search = new URLSearchParams();
-	for (const [key, value] of Object.entries(params)) for (const item of Array.isArray(value) ? value : [value]) {
-		if (item === null || item === void 0) continue;
-		if (typeof item === "object" || typeof item === "function") throw new TypeError(`arthron: params.${key} is not a string, number or boolean — pass one of those or an array of them (dates: date.toISOString())`);
-		search.append(key, String(item));
-	}
-	return search.toString();
-}
-/**
-* Fill `{name}` placeholders with encoded values, so each one stays inside
-* its segment: "/", "?" and "#" are encoded, and the values WHATWG URL would
-* turn into a different path — "", "." and ".." — are refused. A placeholder
-* without a value, or a value without a placeholder, is a mistake too.
-*/
-function fillPath(template, values) {
-	const used = /* @__PURE__ */ new Set();
-	const filled = template.replace(/\{([^{}/]+)\}/g, (_, name) => {
-		if (!Object.hasOwn(values, name)) throw new TypeError(`arthron: path "${template}" has {${name}} but no value for it — pass path: { ${name}: … }`);
-		used.add(name);
-		const value = String(values[name]);
-		if (value === "" || value === "." || value === "..") throw new TypeError(`arthron: path value ${name}=${JSON.stringify(value)} would change the path, not fill a segment — pass a real id`);
-		return encodeURIComponent(value);
-	});
-	const unused = Object.keys(values).find((name) => !used.has(name));
-	if (unused !== void 0) throw new TypeError(`arthron: path "${template}" has no {${unused}} — add the placeholder or drop the value`);
-	return filled;
-}
-/**
-* Join `baseURL` and `path` by plain string concatenation so a path prefix in
-* the base (`/v1`) survives a leading slash in the path. WHATWG `new URL()`
-* would drop it. An absolute path replaces the base only when it stays on the
-* base's origin, or when `allowAbsoluteUrls` says other origins are fine — a
-* path built from user input or an API response must not carry the client's
-* credentials somewhere else.
-*/
-function resolveUrl(baseURL, path, params, allowAbsoluteUrls = false) {
-	let url;
-	if (isAbsoluteUrl(path)) {
-		if (!HTTP_URL.test(path)) {
-			const scheme = path.slice(0, path.indexOf(":") + 1);
-			throw new TypeError(`arthron: only http(s) URLs can be requested, got a "${scheme}" URL — use an http:// or https:// URL`);
-		}
-		if (!allowAbsoluteUrls && leavesBase(baseURL, path)) throw new TypeError(`arthron: ${originOf(path)} is outside baseURL ${(baseURL && originOf(baseURL)) ?? baseURL} — pass a path relative to baseURL, or set arthron({ allowAbsoluteUrls: true }) to allow other origins (config headers are not sent to them)`);
-		url = path;
-	} else {
-		if (baseURL === void 0) throw new TypeError(`arthron: relative path "${redactUrl(path)}" needs a baseURL — pass baseURL in arthron({ baseURL }) or use an absolute URL`);
-		url = `${baseURL.replace(/\/+$/, "")}/${path.replace(/^\/+/, "")}`;
-	}
-	const query = toQueryString(params);
-	if (!query) return url;
-	const hash = url.indexOf("#");
-	const [base, fragment] = hash === -1 ? [url, ""] : [url.slice(0, hash), url.slice(hash)];
-	return `${base}${base.includes("?") ? "&" : "?"}${query}${fragment}`;
-}
-//#endregion
-//#region src/error/arthron-error.ts
-/**
-* Marks an ArthronError across copies of this package. The ESM and CJS
-* builds can both end up loaded (a CJS dependency creates the client, ESM
-* app code catches), each with its own class — `Symbol.for` is shared.
-*/
-const BRAND = Symbol.for("arthron.ArthronError");
-/**
-* The only error arthron itself produces. Two sources: a response with
-* `ok === false`, or fetch rejecting outright (network failure, `status` 0).
-* Everything else — cancellation, interceptor bugs — is rethrown untouched.
-*/
-var ArthronError = class ArthronError extends Error {
-	name = "ArthronError";
-	/** HTTP status of the failed response; `0` when fetch itself failed (network). */
-	status;
-	statusText;
-	/** Parsed body: JSON if it parses, else the text, else `undefined`. */
-	data;
-	/**
-	* The server's own explanation, picked out of `data` (by default
-	* `message` → `error` → `error.message` → `detail`; see the `errorDetail`
-	* config). `undefined` when the body had none. Untrusted server text: show
-	* it to users as text, never as HTML. `message`, by contrast, is written by
-	* arthron — method, URL without query, status — and is meant for logs.
-	*/
-	detail;
-	/** The underlying error for network failures. */
-	cause;
-	constructor(init) {
-		super(init.message);
-		this.status = init.status;
-		this.statusText = init.statusText;
-		this.data = init.data;
-		this.detail = init.detail;
-		this.cause = init.cause;
-		Object.defineProperties(this, {
-			headers: { value: init.headers },
-			request: { value: init.request },
-			response: { value: init.response },
-			[BRAND]: { value: true }
-		});
-	}
-	/** `instanceof ArthronError` holds for an error from any copy of the package. */
-	static [Symbol.hasInstance](value) {
-		return this === ArthronError ? isArthronError(value) : Function.prototype[Symbol.hasInstance].call(this, value);
-	}
-	/** What serializers see: no headers, no body, no query or userinfo. */
-	toJSON() {
-		return {
-			name: this.name,
-			message: this.message,
-			detail: this.detail,
-			status: this.status,
-			statusText: this.statusText,
-			method: this.request.init.method ?? "GET",
-			url: redactUrl(this.request.url),
-			data: this.data
-		};
-	}
-};
-/** `true` for errors arthron produced: a `!ok` response or a network failure. Cancellations and plugin bugs are not ArthronErrors. */
-function isArthronError(error) {
-	return typeof error === "object" && error !== null && error[BRAND] === true;
-}
-//#endregion
+const require_plugins = require("./plugins-Cigqz2SS.cjs");
 //#region src/request/headers.ts
 const isPlainRecord = (headers) => !Array.isArray(headers) && Object.prototype.toString.call(headers) !== "[object Headers]";
 /**
@@ -198,17 +39,19 @@ function cloneBody(body) {
 * again (retry) must not see the previous attempt's changes, so every attempt
 * starts from a fresh copy of the headers and of a FormData/URLSearchParams body.
 */
-function cloneContext({ url, init, meta }) {
+function cloneContext({ url, init, meta, fetch }) {
 	const copy = {
 		...init,
 		headers: toHeaderRecord(init.headers)
 	};
 	if (init.body) copy.body = cloneBody(init.body);
-	return {
+	const out = {
 		url,
 		init: copy,
 		meta: { ...meta }
 	};
+	if (fetch) out.fetch = fetch;
+	return out;
 }
 /**
 * Put headers back into a plain lowercase record. A plugin written in JS (or
@@ -216,7 +59,7 @@ function cloneContext({ url, init, meta }) {
 * `{ ...ctx.init.headers }` would otherwise drop every header.
 */
 function normalize(ctx, previous) {
-	return {
+	const out = {
 		...ctx,
 		init: {
 			...ctx.init,
@@ -224,6 +67,18 @@ function normalize(ctx, previous) {
 		},
 		meta: ctx.meta ?? previous.meta
 	};
+	const fetch = ctx.fetch ?? previous.fetch;
+	if (fetch) out.fetch = fetch;
+	return out;
+}
+/**
+* A plugin written in JS (or with a cast) that forgets to return would hand
+* `undefined` on — and an error interceptor's would be what the caller
+* catches. Name the plugin slot instead.
+*/
+function returned(value, who, what, cause, verb = "returned") {
+	if (value != null) return value;
+	throw new TypeError(`arthron: ${who} ${verb} ${value} — return ${what}`, cause === void 0 ? void 0 : { cause });
 }
 /**
 * Owns the order of one request.
@@ -247,267 +102,35 @@ async function runPipeline(plugins, ctx, send) {
 	}
 	const attempt = async (input) => {
 		let current = cloneContext(input);
+		for (const interceptor of request) current = normalize(returned(await interceptor(current), "a request interceptor", "the context (ctx or a changed copy)"), current);
+		let res;
 		try {
-			for (const interceptor of request) current = normalize(await interceptor(current), current);
-			let res = await send(current);
-			for (const interceptor of response) res = await interceptor(res, current);
-			return res;
+			res = await send(current);
 		} catch (thrown) {
-			if (!isArthronError(thrown)) throw thrown;
+			if (!require_plugins.isArthronError(thrown)) throw thrown;
 			let err = thrown;
-			for (const interceptor of error) err = await interceptor(err, current);
+			for (const interceptor of error) err = returned(await interceptor(err, current), "an error interceptor", "the error (err or a changed one)", thrown);
 			throw err;
 		}
+		for (const interceptor of response) res = returned(await interceptor(res, current), "a response interceptor", "the Response (res or a new one)");
+		return res;
 	};
-	const dispatch = (index, input) => {
+	const dispatch = async (index, input) => {
 		const middleware = middlewares[index];
 		if (!middleware) return attempt(input);
-		return middleware(input, (next) => dispatch(index + 1, {
-			...next,
-			meta: next.meta ?? input.meta
-		}));
+		return returned(await middleware(input, (next) => {
+			const ctx = {
+				...next,
+				meta: next.meta ?? input.meta
+			};
+			const fetch = next.fetch ?? input.fetch;
+			if (fetch) ctx.fetch = fetch;
+			return dispatch(index + 1, ctx);
+		}), "a middleware", "the Response, usually `return next(ctx)`", void 0, "resolved with");
 	};
 	return dispatch(0, ctx);
 }
 //#endregion
-//#region src/request/body.ts
-const RAW_TAGS = /* @__PURE__ */ new Set([
-	"FormData",
-	"Blob",
-	"File",
-	"ArrayBuffer",
-	"URLSearchParams",
-	"ReadableStream"
-]);
-/**
-* `Symbol.toStringTag`, not `instanceof`: a body from another realm or a
-* polyfill (formdata-node, fetch-blob) must not be JSON-encoded into `{}`.
-*/
-const tagOf = (value) => Object.prototype.toString.call(value).slice(8, -1);
-function isReadableStream(value) {
-	return tagOf(value) === "ReadableStream";
-}
-/**
-* Whether `RequestCtor` can send a ReadableStream body. Node and Chromium
-* read `duplex` and leave the stream alone; Firefox ignores `duplex` and
-* would send the text "[object ReadableStream]"; older Safari refuses it.
-* The check from
-* https://developer.chrome.com/docs/capabilities/web-apis/fetch-streaming-requests
-*/
-function canStreamRequestBody(RequestCtor) {
-	let duplexRead = false;
-	try {
-		const request = new RequestCtor("https://stream.test", {
-			method: "POST",
-			body: new ReadableStream(),
-			get duplex() {
-				duplexRead = true;
-				return "half";
-			}
-		});
-		return duplexRead && !request.headers.has("content-type");
-	} catch {
-		return false;
-	}
-}
-let runtimeStreams;
-/** `canStreamRequestBody` for the global `Request`, checked once. */
-function runtimeStreamsRequestBody() {
-	runtimeStreams ??= typeof Request !== "function" || canStreamRequestBody(Request);
-	return runtimeStreams;
-}
-/**
-* What JSON.stringify would turn into `{}`, `undefined` or internal state
-* instead of the data — with the fix, so it reads as an error message.
-*/
-function mangledByJson(body) {
-	if (typeof body === "function" || typeof body === "symbol") return `a ${typeof body}, which JSON cannot carry — send its data instead`;
-	if (typeof body !== "object" || body === null || Array.isArray(body)) return;
-	if (Symbol.asyncIterator in body) return "an async iterable (a Node stream?) — pass a ReadableStream (Readable.toWeb(stream)) or collect it first";
-	if (Symbol.iterator in body) return "an iterable such as a Map, Set or generator — convert it to an array or plain object first";
-}
-/** Bodies fetch already knows how to send. Content-Type is left to the caller / runtime. */
-function isRawBody(body) {
-	if (typeof body === "string") return true;
-	if (ArrayBuffer.isView(body)) return true;
-	return RAW_TAGS.has(tagOf(body));
-}
-/**
-* Turn a caller-supplied body into something fetch accepts. Raw bodies pass
-* through untouched; anything else is JSON with `content-type` set — unless
-* the caller already set one (headers arrive lowercased, so a plain lookup is
-* enough).
-*/
-function serializeBody(body, headers) {
-	if (body === void 0) return {
-		body: void 0,
-		headers
-	};
-	if (tagOf(body) === "FormData") {
-		const { "content-type": _dropped, ...rest } = headers;
-		return {
-			body,
-			headers: rest
-		};
-	}
-	if (isRawBody(body)) return {
-		body,
-		headers
-	};
-	const mangled = mangledByJson(body);
-	if (mangled) throw new TypeError(`arthron: the body is ${mangled}`);
-	const type = headers["content-type"];
-	if (type !== void 0 && !/\bjson\b/i.test(type)) throw new TypeError(`arthron: a ${typeof body} body is sent as JSON, but content-type is "${type}" — pass a string, URLSearchParams or FormData for that content type, or drop the header`);
-	const withType = "content-type" in headers ? headers : {
-		...headers,
-		"content-type": "application/json"
-	};
-	return {
-		body: JSON.stringify(body),
-		headers: withType
-	};
-}
-//#endregion
-//#region src/response/rebuild-response.ts
-/**
-* A new Response with `body` but everything else taken from `original`. The
-* constructor resets `url`, `redirected` and `type`, so those are copied over
-* as own properties — callers that resolve relative links or detect
-* redirects keep working.
-*/
-function rebuildResponse(original, body) {
-	return withFetchedFields(new Response(body, {
-		status: original.status,
-		statusText: original.statusText,
-		headers: original.headers
-	}), original);
-}
-/** Copy the fields the constructor resets — onto `clone()`s as well. */
-function withFetchedFields(target, from) {
-	const clone = target.clone.bind(target);
-	return Object.defineProperties(target, {
-		url: { value: from.url },
-		redirected: { value: from.redirected },
-		type: { value: from.type },
-		clone: { value: () => withFetchedFields(clone(), from) }
-	});
-}
-//#endregion
-//#region src/error/create-error.ts
-/**
-* Cancellation is not an HTTP failure. Matched by name so it works across
-* realms — or by the request's own `signal`, since `abort(reason)` rejects
-* with whatever reason the caller chose.
-*/
-function isCancellation(error, signal) {
-	if (signal?.aborted) return true;
-	const name = error?.name;
-	return name === "AbortError" || name === "TimeoutError";
-}
-/**
-* What a cancelled call rejects with: its signal's reason. WebKit's fetch
-* rejects, and errors a half-read body, with a generic AbortError instead,
-* dropping a TimeoutError or the caller's own reason.
-*/
-function cancellationError(error, signal) {
-	return signal?.aborted ? signal.reason : error;
-}
-const isRecord = (value) => typeof value === "object" && value !== null;
-/** `message` → `error` (string) → `error.message` → `detail`. */
-function defaultErrorDetail(data) {
-	if (!isRecord(data)) return void 0;
-	if (typeof data.message === "string") return data.message;
-	if (typeof data.error === "string") return data.error;
-	if (isRecord(data.error) && typeof data.error.message === "string") return data.error.message;
-	if (typeof data.detail === "string") return data.detail;
-}
-/** How much of an error body arthron reads. Error bodies are for diagnosis; a hostile or broken server must not be able to fill memory with one. */
-const MAX_ERROR_BODY_BYTES = 65536;
-/** Up to `limit` bytes of the body; the rest is cancelled unread. `undefined` when there is no body or reading it failed. */
-async function readCapped(response, limit) {
-	if (!response.body) return void 0;
-	let reader;
-	const chunks = [];
-	let size = 0;
-	try {
-		reader = response.body.getReader();
-		while (size <= limit) {
-			const { value, done } = await reader.read();
-			if (done) break;
-			chunks.push(value);
-			size += value.byteLength;
-		}
-	} catch {
-		return;
-	} finally {
-		await reader?.cancel().catch(() => {});
-		reader?.releaseLock();
-	}
-	const bytes = new Uint8Array(size);
-	let offset = 0;
-	for (const chunk of chunks) {
-		bytes.set(chunk, offset);
-		offset += chunk.byteLength;
-	}
-	return size > limit ? {
-		bytes: bytes.subarray(0, limit),
-		truncated: true
-	} : {
-		bytes,
-		truncated: false
-	};
-}
-/** JSON if the whole body parses, else the text (cut at the limit), else `undefined` when empty. */
-function parseBody(read) {
-	const text = new TextDecoder().decode(read.bytes);
-	if (text === "") return void 0;
-	if (read.truncated) return text;
-	try {
-		return JSON.parse(text);
-	} catch {
-		return text;
-	}
-}
-/** The request as error messages name it: method and URL, no query or userinfo. */
-function describeRequest(request) {
-	return `${request.init.method ?? "GET"} ${redactUrl(request.url)}`;
-}
-async function responseError(response, request, resolve = defaultErrorDetail) {
-	const read = await readCapped(response, MAX_ERROR_BODY_BYTES);
-	const data = read && parseBody(read);
-	if (read) response = rebuildResponse(response, read.bytes);
-	const status = response.statusText ? `${response.status} ${response.statusText}` : String(response.status);
-	return new ArthronError({
-		message: `${describeRequest(request)} failed with ${status}`,
-		detail: resolve(data, response) || void 0,
-		status: response.status,
-		statusText: response.statusText,
-		headers: response.headers,
-		data,
-		request,
-		response
-	});
-}
-/**
-* Browsers that stream a request body (Chromium, current WebKit) do it only
-* over HTTP/2, and fail one sent to an HTTP/1.1 server with the same bare
-* "Failed to fetch" / "Load failed" as a dead server, so name the likely cause.
-*/
-const STREAM_BODY_HINT = " — in a browser, a ReadableStream body streams only over HTTP/2; send a Blob or ArrayBuffer to an HTTP/1.1 server";
-function networkError(cause, request) {
-	const reason = cause instanceof Error && cause.message ? cause.message : "network error";
-	const hint = isReadableStream(request.init.body) ? STREAM_BODY_HINT : "";
-	return new ArthronError({
-		message: `${describeRequest(request)} failed: ${reason}${hint}`,
-		status: 0,
-		statusText: "",
-		headers: new Headers(),
-		data: void 0,
-		request,
-		cause
-	});
-}
-//#endregion
 //#region src/response/schema-validation.ts
 const pathOf = (issue) => (issue.path ?? []).map((part) => String(typeof part === "object" && part !== null ? part.key : part)).join(".");
 /**
@@ -542,6 +165,10 @@ const DEFAULT_LIMIT = 8388608;
 */
 async function* lines(response, maxLineLength) {
 	if (!response.body) return;
+	const checked = (line) => {
+		if (line.length <= maxLineLength) return line;
+		throw new RangeError(`arthron: a stream line is longer than ${maxLineLength} characters — pass a larger maxLineLength to .sse() / .ndjson() if that is expected`);
+	};
 	const reader = response.body.getReader();
 	const decoder = new TextDecoder();
 	const breaks = /\r\n|\r|\n/g;
@@ -559,12 +186,11 @@ async function* lines(response, maxLineLength) {
 			let start = 0;
 			breaks.lastIndex = 0;
 			for (let m = breaks.exec(text); m; m = breaks.exec(text)) {
-				yield pending + text.slice(start, m.index);
+				yield checked(pending + text.slice(start, m.index));
 				pending = "";
 				start = breaks.lastIndex;
 			}
-			pending += text.slice(start);
-			if (pending.length > maxLineLength) throw new RangeError(`arthron: a stream line is longer than ${maxLineLength} characters — pass a larger maxLineLength to .sse() / .ndjson() if that is expected`);
+			pending = checked(pending + text.slice(start));
 			if (done) break;
 		}
 		if (pending) yield pending;
@@ -647,7 +273,7 @@ function iterate(promise, parse, signal) {
 		try {
 			yield* parse(await promise);
 		} catch (error) {
-			throw cancellationError(error, signal);
+			throw require_plugins.cancellationError(error, signal);
 		}
 	} };
 }
@@ -657,7 +283,7 @@ function iterate(promise, parse, signal) {
 */
 function toArthronPromise(promise, signal) {
 	const read = (body) => promise.then(body).catch((error) => {
-		throw cancellationError(error, signal);
+		throw require_plugins.cancellationError(error, signal);
 	});
 	return Object.assign(promise, {
 		json: ((schema) => read(async (res) => {
@@ -737,9 +363,8 @@ function assertSendable(url, method) {
 	try {
 		new Request(url, { method });
 	} catch (cause) {
-		const shown = redactUrl(url);
-		const reason = (cause instanceof Error ? cause.message : String(cause)).split(url).join(shown);
-		throw new TypeError(`arthron: cannot send ${method} ${shown} (${reason}) — use an absolute URL or a baseURL with a scheme (https://…), and a valid HTTP method`, { cause });
+		const reason = require_plugins.redactUrlIn(cause instanceof Error ? cause.message : String(cause), url);
+		throw new TypeError(`arthron: cannot send ${method} ${require_plugins.redactUrl(url)} (${reason}) — use an absolute URL or a baseURL with a scheme (https://…), and a valid HTTP method`, { cause });
 	}
 }
 /**
@@ -749,8 +374,8 @@ function assertSendable(url, method) {
 * assertSendable.
 */
 function assertStreamable(url, method, body) {
-	if (!isReadableStream(body) || runtimeStreamsRequestBody()) return;
-	throw new TypeError(`arthron: cannot send ${method} ${redactUrl(url)} with a ReadableStream body — this browser cannot stream a request body and would send it garbled or not at all; pass a Blob or ArrayBuffer instead`);
+	if (!require_plugins.isReadableStream(body) || require_plugins.runtimeStreamsRequestBody()) return;
+	throw new TypeError(`arthron: cannot send ${method} ${require_plugins.redactUrl(url)} with a ReadableStream body — this browser cannot stream a request body and would send it garbled or not at all; pass a Blob or ArrayBuffer instead`);
 }
 /**
 * Non-ok responses the caller asked for are not failures: an opaque one
@@ -762,7 +387,7 @@ function failedByDefault(res, init) {
 }
 /** The one place a failure becomes an ArthronError. Cancellation passes through. */
 async function send(resolved, ctx, throwOn) {
-	const fetchImpl = resolved.fetch ?? globalThis.fetch;
+	const fetchImpl = ctx.fetch ?? resolved.fetch ?? globalThis.fetch;
 	if (resolved.fetch === void 0) {
 		const method = ctx.init.method ?? "GET";
 		assertSendable(ctx.url, method);
@@ -773,12 +398,12 @@ async function send(resolved, ctx, throwOn) {
 	try {
 		res = await fetchImpl(ctx.url, ctx.init);
 	} catch (thrown) {
-		if (isCancellation(thrown, signal)) throw cancellationError(thrown, signal);
-		throw networkError(thrown, ctx);
+		if (require_plugins.isCancellation(thrown, signal)) throw require_plugins.cancellationError(thrown, signal);
+		throw require_plugins.networkError(thrown, ctx);
 	}
 	if (res.ok) return res;
 	if (!(throwOn ? throwOn(res) : failedByDefault(res, ctx.init))) return res;
-	const error = await responseError(res, ctx, resolved.errorDetail);
+	const error = await require_plugins.responseError(res, ctx, resolved.errorDetail);
 	if (signal?.aborted) throw signal.reason;
 	throw error;
 }
@@ -808,9 +433,10 @@ function arthron(config = {}) {
 			const upper = method.toUpperCase();
 			const verb = STANDARD_METHODS.has(upper) ? upper : method;
 			if (rawBody !== void 0 && BODYLESS_METHODS.has(upper)) throw new TypeError(`arthron: ${upper} requests cannot carry a body — send it as params (query) or switch to POST`);
-			if (pathValues) path = fillPath(path, pathValues);
-			const url = resolveUrl(resolved.baseURL, path, params, resolved.allowAbsoluteUrls);
-			const { body, headers } = serializeBody(rawBody, mergeHeaders(leavesBase(resolved.baseURL, path) ? void 0 : resolved.headers, callHeaders));
+			if (pathValues) path = require_plugins.fillPath(path, pathValues);
+			const url = require_plugins.resolveUrl(resolved.baseURL, path, params, resolved.allowAbsoluteUrls);
+			const defaults = require_plugins.leavesBase(resolved.baseURL, path) ? void 0 : resolved.headers;
+			const { body, headers } = require_plugins.serializeBody(rawBody, mergeHeaders(defaults, callHeaders));
 			const requestInit = {
 				...initDefaults,
 				...init,
@@ -818,11 +444,12 @@ function arthron(config = {}) {
 				headers
 			};
 			if (body !== void 0) requestInit.body = body;
-			if (isReadableStream(body)) Object.assign(requestInit, { duplex: "half" });
+			if (require_plugins.isReadableStream(body)) Object.assign(requestInit, { duplex: "half" });
 			return toArthronPromise(runPipeline(resolved.use, {
 				url,
 				init: requestInit,
-				meta: { ...meta }
+				meta: { ...meta },
+				fetch: resolved.fetch ?? globalThis.fetch
 			}, (ctx) => send(resolved, ctx, throwOn)), init.signal);
 		} catch (thrown) {
 			return toArthronPromise(Promise.reject(thrown));
@@ -870,278 +497,21 @@ const defineInterceptor = {
 /** Identity helper: type-checks a plugin object literal without an annotation. */
 const definePlugin = (plugin) => plugin;
 //#endregion
-//#region src/plugins/logging/logging.ts
-function consoleSink(logger) {
-	return (e) => {
-		if (e.phase === "start") logger.log(`[arthron] → ${e.method} ${e.path}`);
-		else if (e.phase === "success") logger.log(`[arthron] ← ${e.method} ${e.path} ${e.status} ${e.ms}ms`);
-		else logger.error(`[arthron] ✕ ${e.method} ${e.path} ${e.status ?? "-"} ${e.ms}ms`);
-	};
-}
-/**
-* One event when a request starts, one when it settles, with status and
-* elapsed time. Wraps the whole call, so retries are included in the time.
-* Default output is a console line per event; pass `onEvent` to get the
-* structured event instead. Cancellations are not reported.
-*/
-function logging(options = {}) {
-	const { enabled = true, logger = console, onEvent, now = () => performance.now() } = options;
-	const emit = onEvent ?? consoleSink(logger);
-	return {
-		name: "logging",
-		middleware: async (ctx, next) => {
-			if (!enabled) return next(ctx);
-			const method = ctx.init.method ?? "GET";
-			const path = redactUrl(ctx.url);
-			const started = now();
-			const ms = () => Math.round(now() - started);
-			emit({
-				phase: "start",
-				method,
-				path
-			});
-			let res;
-			try {
-				res = await next(ctx);
-			} catch (error) {
-				if (!isCancellation(error, ctx.init.signal)) {
-					const status = isArthronError(error) ? error.status : void 0;
-					emit({
-						phase: "error",
-						method,
-						path,
-						status,
-						ms: ms(),
-						error
-					});
-				}
-				throw error;
-			}
-			emit({
-				phase: "success",
-				method,
-				path,
-				status: res.status,
-				ms: ms()
-			});
-			return res;
-		}
-	};
-}
-//#endregion
-//#region src/plugins/retry/retry.ts
-const DEFAULT_RETRY_ON = [
-	408,
-	429,
-	500,
-	502,
-	503,
-	504
-];
-const DEFAULT_METHODS = [
-	"GET",
-	"HEAD",
-	"OPTIONS",
-	"QUERY",
-	"PUT",
-	"DELETE"
-];
-const DEFAULT_MAX_RETRY_AFTER = 6e4;
-/** setTimeout fires at once past this, so every wait is capped to it. */
-const MAX_TIMER_MS$1 = 2 ** 31 - 1;
-function defaultSleep(ms, signal) {
-	return new Promise((resolve, reject) => {
-		if (signal?.aborted) return reject(signal.reason);
-		const onAbort = () => {
-			clearTimeout(timer);
-			reject(signal?.reason);
-		};
-		const timer = setTimeout(() => {
-			signal?.removeEventListener("abort", onAbort);
-			resolve();
-		}, ms);
-		signal?.addEventListener("abort", onAbort, { once: true });
-	});
-}
-/** `Retry-After` as ms — seconds or an HTTP-date. `undefined` when absent or unparsable. */
-function retryAfterMs(error) {
-	const value = error.headers.get("retry-after")?.trim();
-	if (!value) return void 0;
-	const seconds = Number(value);
-	if (!Number.isNaN(seconds)) return Math.max(0, seconds * 1e3);
-	const at = Date.parse(value);
-	if (Number.isNaN(at)) return void 0;
-	return Math.max(0, at - Date.now());
-}
-/** The rule without `shouldRetry`: a network error or a `retryOn` status, on a method in `methods`. */
-function byDefault(thrown, method, settings) {
-	if (!settings.allowed.has(method) || !isArthronError(thrown)) return false;
-	return thrown.status === 0 || settings.retryOn.includes(thrown.status);
-}
-/** Defaults filled in and `retries` checked — `attempt >= NaN` is never true, so an unset env var would retry forever. */
-function settle(options, where) {
-	const { retries = 2, retryOn = DEFAULT_RETRY_ON, methods = DEFAULT_METHODS, delay = (retry) => Math.random() * 300 * 2 ** retry, maxRetryAfter = DEFAULT_MAX_RETRY_AFTER, shouldRetry, onRetry } = options;
-	if (!Number.isInteger(retries) || retries < 0) throw new TypeError(`arthron: ${where} retries: ${retries} needs a whole number ≥ 0 — e.g. retries: 2`);
-	return {
-		retries,
-		retryOn,
-		allowed: new Set(methods.map((m) => m.toUpperCase())),
-		delay,
-		maxRetryAfter,
-		shouldRetry,
-		onRetry
-	};
-}
-/**
-* Retry on network errors and the configured statuses by calling `next`
-* again — the whole attempt (request interceptors included) is re-run.
-* Only `ArthronError` is considered; cancellation and plugin bugs pass through.
-* A call can turn it off or override its options with `meta.retry`.
-*/
-function retry(options = {}) {
-	const { sleep = defaultSleep, ...rest } = options;
-	const base = settle(rest, "retry()");
-	return {
-		name: "retry",
-		middleware: async (ctx, next) => {
-			const override = ctx.meta?.retry;
-			if (override === false) return next(ctx);
-			const settings = override ? settle({
-				...rest,
-				...override
-			}, "meta.retry") : base;
-			const method = (ctx.init.method ?? "GET").toUpperCase();
-			const resendable = !isReadableStream(ctx.init.body);
-			for (let attempt = 0;; attempt += 1) try {
-				return await next(ctx);
-			} catch (thrown) {
-				if (!resendable || attempt >= settings.retries) throw thrown;
-				if (ctx.init.signal?.aborted) throw thrown;
-				const verdict = settings.shouldRetry?.(thrown, attempt, ctx);
-				if (verdict === false) throw thrown;
-				if (verdict === void 0 && !byDefault(thrown, method, settings)) throw thrown;
-				const retryAfter = isArthronError(thrown) ? retryAfterMs(thrown) : void 0;
-				if (retryAfter !== void 0 && retryAfter > settings.maxRetryAfter) throw thrown;
-				const wait = Math.min(retryAfter ?? settings.delay(attempt, thrown), MAX_TIMER_MS$1);
-				settings.onRetry?.(thrown, attempt, wait);
-				await sleep(wait, ctx.init.signal);
-			}
-		}
-	};
-}
-//#endregion
-//#region src/plugins/timeout/timeout.ts
-const MAX_TIMER_MS = 2 ** 31 - 1;
-/**
-* Wrap `body` so the deadline keeps running until it is fully read, and so an
-* abort while reading surfaces as a stream error instead of a silent stall.
-*/
-function guardBody(body, signal, finish, onChunk) {
-	const reader = body.getReader();
-	return new ReadableStream({
-		start(controller) {
-			signal.addEventListener("abort", () => {
-				controller.error(signal.reason);
-				reader.cancel(signal.reason).catch(() => {});
-			}, { once: true });
-		},
-		async pull(controller) {
-			const { value, done } = await reader.read();
-			if (done) {
-				finish();
-				controller.close();
-				return;
-			}
-			onChunk();
-			controller.enqueue(value);
-		},
-		cancel(reason) {
-			finish();
-			return reader.cancel(reason);
-		}
-	});
-}
-/** setTimeout fires at once for NaN, negatives and anything past 2^31-1. */
-function checkDeadline(ms, where) {
-	if (ms === Number.POSITIVE_INFINITY || ms >= 0 && ms <= MAX_TIMER_MS) return;
-	throw new TypeError(`arthron: ${where} needs 0–${MAX_TIMER_MS} ms — pass Infinity for no deadline`);
-}
-/** A timer that aborts `controller` with a TimeoutError and never keeps Node alive on its own. */
-function deadlineTimer(controller, ms, message) {
-	const timer = setTimeout(() => controller.abort(new DOMException(message, "TimeoutError")), ms);
-	timer.unref?.();
-	return timer;
-}
-/**
-* Abort the request when it takes longer than `ms` — counted from the start
-* of the attempt until the body has been fully read, so a server that sends
-* headers and then stalls still trips it. With `idle`, also abort once no
-* data has arrived for that long. Rejects with a `TimeoutError` (a
-* `DOMException`, like `AbortSignal.timeout()` would give); it is not an
-* `ArthronError`, so error interceptors and `retry` leave it alone.
-*
-* A call can change the total deadline with `meta.timeout`.
-*
-* Deadlines are timers on an AbortController — not `AbortSignal.timeout`,
-* since the idle one restarts — joined to the caller's signal with
-* `AbortSignal.any`.
-*/
-function timeout(ms, options = {}) {
-	checkDeadline(ms, `timeout(${ms})`);
-	const { idle } = options;
-	if (idle !== void 0) checkDeadline(idle, `timeout(…, { idle: ${idle} })`);
-	return {
-		name: "timeout",
-		middleware: async (ctx, next) => {
-			const deadline = ctx.meta?.timeout ?? ms;
-			if (deadline !== ms) checkDeadline(deadline, `meta.timeout: ${deadline}`);
-			const idleMs = idle === Number.POSITIVE_INFINITY ? void 0 : idle;
-			if (deadline === Number.POSITIVE_INFINITY && idleMs === void 0) return next(ctx);
-			const controller = new AbortController();
-			const outer = ctx.init.signal;
-			const signal = outer ? AbortSignal.any([outer, controller.signal]) : controller.signal;
-			const total = deadline === Number.POSITIVE_INFINITY ? void 0 : deadlineTimer(controller, deadline, `arthron: request timed out after ${deadline}ms`);
-			let quiet;
-			const stillAlive = () => {
-				if (idleMs === void 0) return;
-				clearTimeout(quiet);
-				quiet = deadlineTimer(controller, idleMs, `arthron: no data for ${idleMs}ms`);
-			};
-			const finish = () => {
-				clearTimeout(total);
-				clearTimeout(quiet);
-			};
-			stillAlive();
-			let res;
-			try {
-				res = await next({
-					...ctx,
-					init: {
-						...ctx.init,
-						signal
-					}
-				});
-			} catch (thrown) {
-				finish();
-				throw thrown;
-			}
-			if (!res.body) {
-				finish();
-				return res;
-			}
-			stillAlive();
-			return rebuildResponse(res, guardBody(res.body, signal, finish, stillAlive));
-		}
-	};
-}
+//#region src/index.ts
+/** @deprecated Import from "arthron/plugins"; this export goes in the next major. */
+const logging = require_plugins.logging;
+/** @deprecated Import from "arthron/plugins"; this export goes in the next major. */
+const retry = require_plugins.retry;
+/** @deprecated Import from "arthron/plugins"; this export goes in the next major. */
+const timeout = require_plugins.timeout;
 //#endregion
-exports.ArthronError = ArthronError;
+exports.ArthronError = require_plugins.ArthronError;
 exports.SchemaError = SchemaError;
 exports.arthron = arthron;
 exports.defineInterceptor = defineInterceptor;
 exports.defineMiddleware = defineMiddleware;
 exports.definePlugin = definePlugin;
-exports.isArthronError = isArthronError;
+exports.isArthronError = require_plugins.isArthronError;
 exports.logging = logging;
 exports.retry = retry;
 exports.timeout = timeout;