arthron 1.2.0 → 2.1.0

package/dist/plugins-CHCMxtAE.mjs

@@ -1,1166 +0,0 @@
-//#region src/request/url.ts
-const ABSOLUTE_URL = /^[a-z][a-z0-9+.-]*:\/\//i;
-const HTTP_URL = /^https?:\/\//i;
-function isAbsoluteUrl(path) {
-	return ABSOLUTE_URL.test(path);
-}
-/**
-* Origin + pathname only — the query and userinfo tend to carry secrets.
-* For anything printed: log lines, error messages, `ArthronError.toJSON`.
-*/
-function redactUrl(url) {
-	try {
-		const parsed = new URL(url);
-		return `${parsed.origin}${parsed.pathname}`;
-	} catch {
-		return url.split(/[?#]/)[0] ?? url;
-	}
-}
-/**
-* `text` with `url` redacted wherever it appears, as given or as the URL
-* parser normalizes it — for a runtime's own message that repeats the URL.
-*/
-function redactUrlIn(text, url) {
-	const shown = redactUrl(url);
-	let href;
-	try {
-		href = new URL(url).href;
-	} catch {}
-	let out = text.split(url).join(shown);
-	if (href && href !== url) out = out.split(href).join(shown);
-	return out;
-}
-/**
-* `undefined` when `url` has no origin of its own. A relative baseURL takes
-* the page's origin in a browser and has none elsewhere.
-*/
-function originOf$1(url) {
-	const page = globalThis.location?.href;
-	try {
-		return new URL(url, page).origin;
-	} catch {
-		return;
-	}
-}
-/** `path` is absolute and points away from `baseURL`'s origin. */
-function leavesBase(baseURL, path) {
-	if (baseURL === void 0 || !isAbsoluteUrl(path)) return false;
-	const base = originOf$1(baseURL);
-	return base === void 0 || originOf$1(path) !== base;
-}
-function toQueryString(params) {
-	if (!params) return "";
-	if (Object.prototype.toString.call(params) === "[object URLSearchParams]") return params.toString();
-	const search = new URLSearchParams();
-	for (const [key, value] of Object.entries(params)) for (const item of Array.isArray(value) ? value : [value]) {
-		if (item === null || item === void 0) continue;
-		if (typeof item === "object" || typeof item === "function") throw new TypeError(`arthron: params.${key} is not a string, number or boolean — pass one of those or an array of them (dates: date.toISOString())`);
-		search.append(key, String(item));
-	}
-	return search.toString();
-}
-/**
-* Fill `{name}` placeholders with encoded values, so each one stays inside
-* its segment: "/", "?" and "#" are encoded, and the values WHATWG URL would
-* turn into a different path — "", "." and ".." — are refused. A placeholder
-* without a value, or a value without a placeholder, is a mistake too.
-*/
-function fillPath(template, values) {
-	const used = /* @__PURE__ */ new Set();
-	const filled = template.replace(/\{([^{}/]+)\}/g, (_, name) => {
-		if (!Object.hasOwn(values, name)) throw new TypeError(`arthron: path "${template}" has {${name}} but no value for it — pass path: { ${name}: … }`);
-		used.add(name);
-		const value = String(values[name]);
-		if (value === "" || value === "." || value === "..") throw new TypeError(`arthron: path value ${name}=${JSON.stringify(value)} would change the path, not fill a segment — pass a real id`);
-		return encodeURIComponent(value);
-	});
-	const unused = Object.keys(values).find((name) => !used.has(name));
-	if (unused !== void 0) throw new TypeError(`arthron: path "${template}" has no {${unused}} — add the placeholder or drop the value`);
-	return filled;
-}
-/**
-* Join `baseURL` and `path` by plain string concatenation so a path prefix in
-* the base (`/v1`) survives a leading slash in the path. WHATWG `new URL()`
-* would drop it. An absolute path replaces the base only when it stays on the
-* base's origin, or when `allowAbsoluteUrls` says other origins are fine — a
-* path built from user input or an API response must not carry the client's
-* credentials somewhere else.
-*/
-function resolveUrl(baseURL, path, params, allowAbsoluteUrls = false) {
-	let url;
-	if (isAbsoluteUrl(path)) {
-		if (!HTTP_URL.test(path)) {
-			const scheme = path.slice(0, path.indexOf(":") + 1);
-			throw new TypeError(`arthron: only http(s) URLs can be requested, got a "${scheme}" URL — use an http:// or https:// URL`);
-		}
-		if (!allowAbsoluteUrls && leavesBase(baseURL, path)) throw new TypeError(`arthron: ${originOf$1(path)} is outside baseURL ${(baseURL && originOf$1(baseURL)) ?? baseURL} — pass a path relative to baseURL, or set arthron({ allowAbsoluteUrls: true }) to allow other origins (config headers are not sent to them)`);
-		url = path;
-	} else {
-		if (baseURL === void 0) throw new TypeError(`arthron: relative path "${redactUrl(path)}" needs a baseURL — pass baseURL in arthron({ baseURL }) or use an absolute URL`);
-		url = `${baseURL.replace(/\/+$/, "")}/${path.replace(/^\/+/, "")}`;
-	}
-	const query = toQueryString(params);
-	if (!query) return url;
-	const hash = url.indexOf("#");
-	const [base, fragment] = hash === -1 ? [url, ""] : [url.slice(0, hash), url.slice(hash)];
-	return `${base}${base.includes("?") ? "&" : "?"}${query}${fragment}`;
-}
-//#endregion
-//#region src/error/arthron-error.ts
-/**
-* Marks an ArthronError across copies of this package. The ESM and CJS
-* builds can both end up loaded (a CJS dependency creates the client, ESM
-* app code catches), each with its own class — `Symbol.for` is shared.
-*/
-const BRAND = Symbol.for("arthron.ArthronError");
-/**
-* The only error arthron itself produces. Two sources: a response with
-* `ok === false`, or fetch rejecting outright (network failure, `status` 0).
-* Everything else — cancellation, interceptor bugs — is rethrown untouched.
-*/
-var ArthronError = class ArthronError extends Error {
-	name = "ArthronError";
-	/** HTTP status of the failed response; `0` when fetch itself failed (network). */
-	status;
-	statusText;
-	/** Parsed body: JSON if it parses, else the text, else `undefined`. */
-	data;
-	/**
-	* The server's own explanation, picked out of `data` (by default
-	* `message` → `error` → `error.message` → `detail`; see the `errorDetail`
-	* config). `undefined` when the body had none. Untrusted server text: show
-	* it to users as text, never as HTML. `message`, by contrast, is written by
-	* arthron — method, URL without query, status — and is meant for logs.
-	*/
-	detail;
-	/** The underlying error for network failures. */
-	cause;
-	constructor(init) {
-		super(init.message);
-		this.status = init.status;
-		this.statusText = init.statusText;
-		this.data = init.data;
-		this.detail = init.detail;
-		this.cause = init.cause;
-		Object.defineProperties(this, {
-			headers: { value: init.headers },
-			request: { value: init.request },
-			response: { value: init.response },
-			[BRAND]: { value: true }
-		});
-	}
-	/** `instanceof ArthronError` holds for an error from any copy of the package. */
-	static [Symbol.hasInstance](value) {
-		return this === ArthronError ? isArthronError(value) : Function.prototype[Symbol.hasInstance].call(this, value);
-	}
-	/** What serializers see: no headers, no body, no query or userinfo. */
-	toJSON() {
-		return {
-			name: this.name,
-			message: this.message,
-			detail: this.detail,
-			status: this.status,
-			statusText: this.statusText,
-			method: this.request.init.method ?? "GET",
-			url: redactUrl(this.request.url),
-			data: this.data
-		};
-	}
-};
-/** `true` for errors arthron produced: a `!ok` response or a network failure. Cancellations and plugin bugs are not ArthronErrors. */
-function isArthronError(error) {
-	return typeof error === "object" && error !== null && error[BRAND] === true;
-}
-//#endregion
-//#region src/request/body.ts
-const RAW_TAGS = /* @__PURE__ */ new Set([
-	"FormData",
-	"Blob",
-	"File",
-	"ArrayBuffer",
-	"URLSearchParams",
-	"ReadableStream"
-]);
-/**
-* `Symbol.toStringTag`, not `instanceof`: a body from another realm or a
-* polyfill (formdata-node, fetch-blob) must not be JSON-encoded into `{}`.
-*/
-const tagOf = (value) => Object.prototype.toString.call(value).slice(8, -1);
-function isReadableStream(value) {
-	return tagOf(value) === "ReadableStream";
-}
-/**
-* Whether `RequestCtor` can send a ReadableStream body. Node and Chromium
-* read `duplex` and leave the stream alone; Firefox ignores `duplex` and
-* would send the text "[object ReadableStream]"; older Safari refuses it.
-* The check from
-* https://developer.chrome.com/docs/capabilities/web-apis/fetch-streaming-requests
-*/
-function canStreamRequestBody(RequestCtor) {
-	let duplexRead = false;
-	try {
-		const request = new RequestCtor("https://stream.test", {
-			method: "POST",
-			body: new ReadableStream(),
-			get duplex() {
-				duplexRead = true;
-				return "half";
-			}
-		});
-		return duplexRead && !request.headers.has("content-type");
-	} catch {
-		return false;
-	}
-}
-let runtimeStreams;
-/** `canStreamRequestBody` for the global `Request`, checked once. */
-function runtimeStreamsRequestBody() {
-	runtimeStreams ??= typeof Request !== "function" || canStreamRequestBody(Request);
-	return runtimeStreams;
-}
-/**
-* What JSON.stringify would turn into `{}`, `undefined` or internal state
-* instead of the data — with the fix, so it reads as an error message.
-*/
-function mangledByJson(body) {
-	if (typeof body === "function" || typeof body === "symbol") return `a ${typeof body}, which JSON cannot carry — send its data instead`;
-	if (typeof body !== "object" || body === null || Array.isArray(body)) return;
-	if (Symbol.asyncIterator in body) return "an async iterable (a Node stream?) — pass a ReadableStream (Readable.toWeb(stream)) or collect it first";
-	if (Symbol.iterator in body) return "an iterable such as a Map, Set or generator — convert it to an array or plain object first";
-}
-/** Bodies fetch already knows how to send. Content-Type is left to the caller / runtime. */
-function isRawBody(body) {
-	if (typeof body === "string") return true;
-	if (ArrayBuffer.isView(body)) return true;
-	return RAW_TAGS.has(tagOf(body));
-}
-/**
-* Turn a caller-supplied body into something fetch accepts. Raw bodies pass
-* through untouched; anything else is JSON with `content-type` set — unless
-* the caller already set one (headers arrive lowercased, so a plain lookup is
-* enough).
-*/
-function serializeBody(body, headers) {
-	if (body === void 0) return {
-		body: void 0,
-		headers
-	};
-	if (tagOf(body) === "FormData") {
-		const { "content-type": _dropped, ...rest } = headers;
-		return {
-			body,
-			headers: rest
-		};
-	}
-	if (isRawBody(body)) return {
-		body,
-		headers
-	};
-	const mangled = mangledByJson(body);
-	if (mangled) throw new TypeError(`arthron: the body is ${mangled}`);
-	const type = headers["content-type"];
-	if (type !== void 0 && !/\bjson\b/i.test(type)) throw new TypeError(`arthron: a ${typeof body} body is sent as JSON, but content-type is "${type}" — pass a string, URLSearchParams or FormData for that content type, or drop the header`);
-	const withType = "content-type" in headers ? headers : {
-		...headers,
-		"content-type": "application/json"
-	};
-	return {
-		body: JSON.stringify(body),
-		headers: withType
-	};
-}
-//#endregion
-//#region src/plugins/bearer-auth/bearer-auth.ts
-/** The origin of an absolute http(s) URL; `undefined` for anything else. */
-function originOf(url) {
-	try {
-		const { protocol, origin } = new URL(url);
-		return protocol === "http:" || protocol === "https:" ? origin : void 0;
-	} catch {
-		return;
-	}
-}
-function allowedOrigins(origin) {
-	const urls = typeof origin === "string" ? [origin] : origin;
-	if (urls.length === 0) throw new TypeError("arthron: bearerAuth({ origin }) needs at least one URL — e.g. origin: \"https://api.example.com\"");
-	return new Set(urls.map((url) => {
-		const found = originOf(url);
-		if (found) return found;
-		throw new TypeError(`arthron: bearerAuth({ origin }) needs an http(s) URL, got ${JSON.stringify(url)} — e.g. origin: "https://api.example.com"`);
-	}));
-}
-/**
-* Bearer-token auth. A request interceptor sets `authorization: Bearer
-* <token>` on every attempt to `origin`; with `refresh`, a middleware turns a
-* 401 into one refresh and one more try. Concurrent 401s share the refresh
-* (with refresh-token rotation, parallel refreshes revoke each other), and a
-* call whose token was replaced meanwhile just retries. A call opts out with
-* `meta: { bearerAuth: false }`.
-*/
-function bearerAuth(options) {
-	const { token, refresh } = options;
-	const allowed = allowedOrigins(options.origin);
-	const ours = (url) => allowed.has(originOf(url) ?? "");
-	const bearer = async () => {
-		const value = await token();
-		return value ? `Bearer ${value}` : void 0;
-	};
-	let refreshing;
-	return {
-		name: "bearerAuth",
-		request: async (ctx) => {
-			if (ctx.meta?.bearerAuth === false || !ours(ctx.url)) return ctx;
-			const value = await bearer();
-			if (!value) return ctx;
-			return {
-				...ctx,
-				init: {
-					...ctx.init,
-					headers: {
-						...ctx.init.headers,
-						authorization: value
-					}
-				}
-			};
-		},
-		middleware: async (ctx, next) => {
-			if (!refresh || ctx.meta?.bearerAuth === false) return next(ctx);
-			if (isReadableStream(ctx.init.body)) return next(ctx);
-			try {
-				return await next(ctx);
-			} catch (error) {
-				if (!isArthronError(error) || error.status !== 401) throw error;
-				if (!ours(error.request.url)) throw error;
-				if (error.request.init.headers.authorization === await bearer()) {
-					refreshing ??= refresh().finally(() => {
-						refreshing = void 0;
-					});
-					await refreshing;
-				}
-				return next(ctx);
-			}
-		}
-	};
-}
-//#endregion
-//#region src/response/rebuild-response.ts
-/**
-* A new Response with `body` but everything else taken from `original`. The
-* constructor resets `url`, `redirected` and `type`, so those are copied over
-* as own properties — callers that resolve relative links or detect
-* redirects keep working.
-*/
-function rebuildResponse(original, body) {
-	const rebuilt = new Response(body, {
-		status: original.status,
-		statusText: original.statusText,
-		headers: original.headers
-	});
-	const { url, redirected, type } = original;
-	return withFields(rebuilt, {
-		url,
-		redirected,
-		type
-	});
-}
-/** Set those fields on `target` — and on its `clone()`s as well. */
-function withFields(target, fields) {
-	const clone = target.clone.bind(target);
-	return Object.defineProperties(target, {
-		url: { value: fields.url },
-		redirected: { value: fields.redirected },
-		type: { value: fields.type },
-		clone: { value: () => withFields(clone(), fields) }
-	});
-}
-//#endregion
-//#region src/error/create-error.ts
-/**
-* Cancellation is not an HTTP failure. Matched by name so it works across
-* realms — or by the request's own `signal`, since `abort(reason)` rejects
-* with whatever reason the caller chose.
-*/
-function isCancellation(error, signal) {
-	if (signal?.aborted) return true;
-	const name = error?.name;
-	return name === "AbortError" || name === "TimeoutError";
-}
-/**
-* What a cancelled call rejects with: its signal's reason. WebKit's fetch
-* rejects, and errors a half-read body, with a generic AbortError instead,
-* dropping a TimeoutError or the caller's own reason.
-*/
-function cancellationError(error, signal) {
-	return signal?.aborted ? signal.reason : error;
-}
-const isRecord = (value) => typeof value === "object" && value !== null;
-/** `message` → `error` (string) → `error.message` → `detail`. */
-function defaultErrorDetail(data) {
-	if (!isRecord(data)) return void 0;
-	if (typeof data.message === "string") return data.message;
-	if (typeof data.error === "string") return data.error;
-	if (isRecord(data.error) && typeof data.error.message === "string") return data.error.message;
-	if (typeof data.detail === "string") return data.detail;
-}
-/** How much of an error body arthron reads. Error bodies are for diagnosis; a hostile or broken server must not be able to fill memory with one. */
-const MAX_ERROR_BODY_BYTES = 65536;
-/** Up to `limit` bytes of the body; the rest is cancelled unread. `undefined` when there is no body or reading it failed. */
-async function readCapped(response, limit) {
-	if (!response.body) return void 0;
-	let reader;
-	const chunks = [];
-	let size = 0;
-	try {
-		reader = response.body.getReader();
-		while (size <= limit) {
-			const { value, done } = await reader.read();
-			if (done) break;
-			chunks.push(value);
-			size += value.byteLength;
-		}
-	} catch {
-		return;
-	} finally {
-		await reader?.cancel().catch(() => {});
-		reader?.releaseLock();
-	}
-	const bytes = new Uint8Array(size);
-	let offset = 0;
-	for (const chunk of chunks) {
-		bytes.set(chunk, offset);
-		offset += chunk.byteLength;
-	}
-	return size > limit ? {
-		bytes: bytes.subarray(0, limit),
-		truncated: true
-	} : {
-		bytes,
-		truncated: false
-	};
-}
-/** JSON if the whole body parses, else the text (cut at the limit), else `undefined` when empty. */
-function parseBody(read) {
-	const text = new TextDecoder().decode(read.bytes);
-	if (text === "") return void 0;
-	if (read.truncated) return text;
-	try {
-		return JSON.parse(text);
-	} catch {
-		return text;
-	}
-}
-/** The request as error messages name it: method and URL, no query or userinfo. */
-function describeRequest(request) {
-	return `${request.init.method ?? "GET"} ${redactUrl(request.url)}`;
-}
-async function responseError(response, request, resolve = defaultErrorDetail) {
-	const read = await readCapped(response, MAX_ERROR_BODY_BYTES);
-	const data = read && parseBody(read);
-	if (read) response = rebuildResponse(response, read.bytes);
-	const status = response.statusText ? `${response.status} ${response.statusText}` : String(response.status);
-	return new ArthronError({
-		message: `${describeRequest(request)} failed with ${status}`,
-		detail: resolve(data, response) || void 0,
-		status: response.status,
-		statusText: response.statusText,
-		headers: response.headers,
-		data,
-		request,
-		response
-	});
-}
-/**
-* Browsers that stream a request body (Chromium, current WebKit) do it only
-* over HTTP/2, and fail one sent to an HTTP/1.1 server with the same bare
-* "Failed to fetch" / "Load failed" as a dead server, so name the likely cause.
-*/
-const STREAM_BODY_HINT = " — in a browser, a ReadableStream body streams only over HTTP/2; send a Blob or ArrayBuffer to an HTTP/1.1 server";
-function networkError(cause, request) {
-	const reason = cause instanceof Error && cause.message ? redactUrlIn(cause.message, request.url) : "network error";
-	const hint = isReadableStream(request.init.body) ? STREAM_BODY_HINT : "";
-	return new ArthronError({
-		message: `${describeRequest(request)} failed: ${reason}${hint}`,
-		status: 0,
-		statusText: "",
-		headers: new Headers(),
-		data: void 0,
-		request,
-		cause
-	});
-}
-//#endregion
-//#region src/plugins/logging/logging.ts
-function consoleSink(logger) {
-	return (e) => {
-		if (e.phase === "start") logger.log(`[arthron] → ${e.method} ${e.path}`);
-		else if (e.phase === "success") logger.log(`[arthron] ← ${e.method} ${e.path} ${e.status} ${e.ms}ms`);
-		else logger.error(`[arthron] ✕ ${e.method} ${e.path} ${e.status ?? "-"} ${e.ms}ms`);
-	};
-}
-/**
-* One event when a request starts, one when it settles, with status and
-* elapsed time. Wraps the whole call, so retries are included in the time.
-* Default output is a console line per event; pass `onEvent` to get the
-* structured event instead. Cancellations are not reported.
-*/
-function logging(options = {}) {
-	const { enabled = true, logger = console, onEvent, now = () => performance.now() } = options;
-	const emit = onEvent ?? consoleSink(logger);
-	return {
-		name: "logging",
-		middleware: async (ctx, next) => {
-			if (!enabled) return next(ctx);
-			const method = ctx.init.method ?? "GET";
-			const path = redactUrl(ctx.url);
-			const started = now();
-			const ms = () => Math.round(now() - started);
-			emit({
-				phase: "start",
-				method,
-				path
-			});
-			let res;
-			try {
-				res = await next(ctx);
-			} catch (error) {
-				if (!isCancellation(error, ctx.init.signal)) {
-					const status = isArthronError(error) ? error.status : void 0;
-					emit({
-						phase: "error",
-						method,
-						path,
-						status,
-						ms: ms(),
-						error
-					});
-				}
-				throw error;
-			}
-			emit({
-				phase: "success",
-				method,
-				path,
-				status: res.status,
-				ms: ms()
-			});
-			return res;
-		}
-	};
-}
-//#endregion
-//#region src/plugins/retry/retry.ts
-const DEFAULT_RETRY_ON = [
-	408,
-	429,
-	500,
-	502,
-	503,
-	504
-];
-const DEFAULT_METHODS = [
-	"GET",
-	"HEAD",
-	"OPTIONS",
-	"QUERY",
-	"PUT",
-	"DELETE"
-];
-const DEFAULT_MAX_RETRY_AFTER = 6e4;
-/** setTimeout fires at once past this, so every wait is capped to it. */
-const MAX_TIMER_MS$1 = 2 ** 31 - 1;
-function defaultSleep(ms, signal) {
-	return new Promise((resolve, reject) => {
-		if (signal?.aborted) return reject(signal.reason);
-		const onAbort = () => {
-			clearTimeout(timer);
-			reject(signal?.reason);
-		};
-		const timer = setTimeout(() => {
-			signal?.removeEventListener("abort", onAbort);
-			resolve();
-		}, ms);
-		signal?.addEventListener("abort", onAbort, { once: true });
-	});
-}
-/** `Retry-After` as ms — seconds or an HTTP-date. `undefined` when absent or unparsable. */
-function retryAfterMs(error) {
-	const value = error.headers.get("retry-after")?.trim();
-	if (!value) return void 0;
-	const seconds = Number(value);
-	if (!Number.isNaN(seconds)) return Math.max(0, seconds * 1e3);
-	const at = Date.parse(value);
-	if (Number.isNaN(at)) return void 0;
-	return Math.max(0, at - Date.now());
-}
-/** The rule without `shouldRetry`: a network error or a `retryOn` status, on a method in `methods`. */
-function byDefault(thrown, method, settings) {
-	if (!settings.allowed.has(method) || !isArthronError(thrown)) return false;
-	return thrown.status === 0 || settings.retryOn.includes(thrown.status);
-}
-/** Defaults filled in and `retries` checked — `attempt >= NaN` is never true, so an unset env var would retry forever. */
-function settle$1(options, where) {
-	const { retries = 2, retryOn = DEFAULT_RETRY_ON, methods = DEFAULT_METHODS, delay = (retry) => Math.random() * 300 * 2 ** retry, maxRetryAfter = DEFAULT_MAX_RETRY_AFTER, shouldRetry, onRetry } = options;
-	if (!Number.isInteger(retries) || retries < 0) throw new TypeError(`arthron: ${where} retries: ${retries} needs a whole number ≥ 0 — e.g. retries: 2`);
-	return {
-		retries,
-		retryOn,
-		allowed: new Set(methods.map((m) => m.toUpperCase())),
-		delay,
-		maxRetryAfter,
-		shouldRetry,
-		onRetry
-	};
-}
-/**
-* Retry on network errors and the configured statuses by calling `next`
-* again — the whole attempt (request interceptors included) is re-run.
-* Only `ArthronError` is considered; cancellation and plugin bugs pass through.
-* A call can turn it off or override its options with `meta.retry`.
-*/
-function retry(options = {}) {
-	const { sleep = defaultSleep, ...rest } = options;
-	const base = settle$1(rest, "retry()");
-	return {
-		name: "retry",
-		middleware: async (ctx, next) => {
-			const override = ctx.meta?.retry;
-			if (override === false) return next(ctx);
-			const settings = override ? settle$1({
-				...rest,
-				...override
-			}, "meta.retry") : base;
-			const method = (ctx.init.method ?? "GET").toUpperCase();
-			const resendable = !isReadableStream(ctx.init.body);
-			for (let attempt = 0;; attempt += 1) try {
-				return await next(ctx);
-			} catch (thrown) {
-				if (!resendable || attempt >= settings.retries) throw thrown;
-				if (ctx.init.signal?.aborted) throw thrown;
-				const verdict = settings.shouldRetry?.(thrown, attempt, ctx);
-				if (verdict === false) throw thrown;
-				if (verdict === void 0 && !byDefault(thrown, method, settings)) throw thrown;
-				const retryAfter = isArthronError(thrown) ? retryAfterMs(thrown) : void 0;
-				if (retryAfter !== void 0 && retryAfter > settings.maxRetryAfter) throw thrown;
-				const wait = Math.min(retryAfter ?? settings.delay(attempt, thrown), MAX_TIMER_MS$1);
-				settings.onRetry?.(thrown, attempt, wait);
-				await sleep(wait, ctx.init.signal);
-			}
-		}
-	};
-}
-//#endregion
-//#region src/plugins/timeout/timeout.ts
-const MAX_TIMER_MS = 2 ** 31 - 1;
-/**
-* Wrap `body` so the deadline keeps running until it is fully read, and so an
-* abort while reading surfaces as a stream error instead of a silent stall.
-*/
-function guardBody(body, signal, finish, onChunk) {
-	const reader = body.getReader();
-	return new ReadableStream({
-		start(controller) {
-			signal.addEventListener("abort", () => {
-				controller.error(signal.reason);
-				reader.cancel(signal.reason).catch(() => {});
-			}, { once: true });
-		},
-		async pull(controller) {
-			const { value, done } = await reader.read();
-			if (done) {
-				finish();
-				controller.close();
-				return;
-			}
-			onChunk();
-			controller.enqueue(value);
-		},
-		cancel(reason) {
-			finish();
-			return reader.cancel(reason);
-		}
-	});
-}
-/** setTimeout fires at once for NaN, negatives and anything past 2^31-1. */
-function checkDeadline(ms, where) {
-	if (ms === Number.POSITIVE_INFINITY || ms >= 0 && ms <= MAX_TIMER_MS) return;
-	throw new TypeError(`arthron: ${where} needs 0–${MAX_TIMER_MS} ms — pass Infinity for no deadline`);
-}
-/** A timer that aborts `controller` with a TimeoutError and never keeps Node alive on its own. */
-function deadlineTimer(controller, ms, message) {
-	const timer = setTimeout(() => controller.abort(new DOMException(message, "TimeoutError")), ms);
-	timer.unref?.();
-	return timer;
-}
-/** `timeout(ms)`, `timeout({ total, idle })` or the deprecated `timeout(ms, { idle })`, checked. */
-function settle(first, second) {
-	if (typeof first === "number") {
-		checkDeadline(first, `timeout(${first})`);
-		const { idle } = second;
-		if (idle !== void 0) checkDeadline(idle, `timeout(…, { idle: ${idle} })`);
-		return {
-			ms: first,
-			idle
-		};
-	}
-	const { total, idle } = first;
-	if (total === void 0 && idle === void 0) throw new TypeError("arthron: timeout({}) needs total or idle — e.g. timeout({ total: 10_000 }) or timeout({ idle: 30_000 })");
-	if (total !== void 0) checkDeadline(total, `timeout({ total: ${total} })`);
-	if (idle !== void 0) checkDeadline(idle, `timeout({ idle: ${idle} })`);
-	return {
-		ms: total ?? Number.POSITIVE_INFINITY,
-		idle
-	};
-}
-function timeout(first, second = {}) {
-	const { ms, idle } = settle(first, second);
-	return {
-		name: "timeout",
-		middleware: async (ctx, next) => {
-			const deadline = ctx.meta?.timeout ?? ms;
-			if (deadline !== ms) checkDeadline(deadline, `meta.timeout: ${deadline}`);
-			const idleMs = idle === Number.POSITIVE_INFINITY ? void 0 : idle;
-			if (deadline === Number.POSITIVE_INFINITY && idleMs === void 0) return next(ctx);
-			const controller = new AbortController();
-			const outer = ctx.init.signal;
-			const signal = outer ? AbortSignal.any([outer, controller.signal]) : controller.signal;
-			const total = deadline === Number.POSITIVE_INFINITY ? void 0 : deadlineTimer(controller, deadline, `arthron: request timed out after ${deadline}ms`);
-			let quiet;
-			const stillAlive = () => {
-				if (idleMs === void 0) return;
-				clearTimeout(quiet);
-				quiet = deadlineTimer(controller, idleMs, `arthron: no data for ${idleMs}ms`);
-			};
-			const finish = () => {
-				clearTimeout(total);
-				clearTimeout(quiet);
-			};
-			stillAlive();
-			let res;
-			try {
-				res = await next({
-					...ctx,
-					init: {
-						...ctx.init,
-						signal
-					}
-				});
-			} catch (thrown) {
-				finish();
-				throw thrown;
-			}
-			if (!res.body) {
-				finish();
-				return res;
-			}
-			stillAlive();
-			return rebuildResponse(res, guardBody(res.body, signal, finish, stillAlive));
-		}
-	};
-}
-//#endregion
-//#region src/plugins/upload-progress/form-data.ts
-const encoder = new TextEncoder();
-/** Names and filenames inside the quoted Content-Disposition parameters. */
-const escapeName = (name) => name.replace(/\n/g, "%0A").replace(/\r/g, "%0D").replace(/"/g, "%22");
-/** String values go out with CRLF line breaks, as the runtime's encoder sends them. */
-const normalizeBreaks = (value) => value.replace(/\r\n|\r|\n/g, "\r\n");
-function boundary() {
-	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
-	return `----arthron${Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("")}`;
-}
-/**
-* A FormData body as multipart/form-data, with its length known before
-* anything is read: the parts' headers and string values are encoded up
-* front, files are only counted by size and streamed while the body is
-* sent — a large file is not held in memory to learn the length.
-*/
-function encodeFormData(form) {
-	const b = boundary();
-	const parts = [];
-	for (const [name, value] of form) {
-		let head = `--${b}\r\nContent-Disposition: form-data; name="${escapeName(name)}"`;
-		if (typeof value === "string") {
-			parts.push(encoder.encode(`${head}\r\n\r\n`));
-			parts.push(encoder.encode(normalizeBreaks(value)));
-		} else {
-			head += `; filename="${escapeName(value.name)}"\r\nContent-Type: ${value.type || "application/octet-stream"}`;
-			parts.push(encoder.encode(`${head}\r\n\r\n`));
-			parts.push(value);
-		}
-		parts.push(encoder.encode("\r\n"));
-	}
-	parts.push(encoder.encode(`--${b}--\r\n`));
-	const total = parts.reduce((sum, part) => sum + (part instanceof Uint8Array ? part.byteLength : part.size), 0);
-	let index = 0;
-	let reader;
-	return {
-		stream: new ReadableStream({
-			async pull(controller) {
-				for (;;) {
-					if (reader) {
-						const { value, done } = await reader.read();
-						if (!done) return controller.enqueue(value);
-						reader = void 0;
-					}
-					const part = parts[index++];
-					if (part === void 0) return controller.close();
-					if (part instanceof Uint8Array) return controller.enqueue(part);
-					reader = part.stream().getReader();
-				}
-			},
-			cancel: (reason) => reader?.cancel(reason)
-		}, { highWaterMark: 0 }),
-		total,
-		type: `multipart/form-data; boundary=${b}`
-	};
-}
-//#endregion
-//#region src/plugins/upload-progress/progress-event.ts
-/** An empty body is complete at once, not `0 / 0`. */
-function progressEvent(loaded, total) {
-	return {
-		loaded,
-		total,
-		progress: total === void 0 ? void 0 : total === 0 ? 1 : loaded / total
-	};
-}
-//#endregion
-//#region src/plugins/upload-progress/request-parts.ts
-/**
-* What a transport needs from fetch's arguments, in any shape a plugin
-* wrapping it may pass: arthron sends a URL string and a lowercase header
-* record, a wrapper may pass a Request, a URL or Headers.
-*/
-const urlOf = (input) => input instanceof Request ? input.url : String(input);
-/** A Request's headers, then init's on top, as one lowercase record. */
-function headersOf(input, init) {
-	const merged = new Headers(input instanceof Request ? input.headers : void 0);
-	for (const [name, value] of new Headers(init.headers)) merged.set(name, value);
-	return Object.fromEntries(merged);
-}
-//#endregion
-//#region src/plugins/upload-progress/counting-fetch.ts
-/**
-* The most one progress step covers. Chunks are cut to it whatever their
-* source: Node hands an in-memory Blob over as a single chunk, which would
-* jump from 0 to 100%.
-*/
-const SLICE = 65536;
-const fromBytes = (bytes, type) => ({
-	stream: new ReadableStream({ start(controller) {
-		controller.enqueue(bytes);
-		controller.close();
-	} }),
-	total: bytes.byteLength,
-	type: type ?? void 0
-});
-/** The body as bytes to count, or `undefined` for none (or one fetch should get as is). */
-async function sourceOf(body, headers) {
-	if (body === void 0 || body === null) return void 0;
-	if (typeof body === "string") return fromBytes(new TextEncoder().encode(body), "text/plain;charset=UTF-8");
-	if (ArrayBuffer.isView(body)) return fromBytes(new Uint8Array(body.buffer, body.byteOffset, body.byteLength));
-	switch (tagOf(body)) {
-		case "Blob":
-		case "File": {
-			const blob = body;
-			return {
-				stream: blob.stream(),
-				total: blob.size,
-				type: blob.type || void 0
-			};
-		}
-		case "ArrayBuffer": return fromBytes(new Uint8Array(body));
-		case "URLSearchParams": return fromBytes(new TextEncoder().encode(String(body)), "application/x-www-form-urlencoded;charset=UTF-8");
-		case "FormData": {
-			const { stream, total, type } = encodeFormData(body);
-			return {
-				stream,
-				total,
-				type
-			};
-		}
-		case "ReadableStream": {
-			const length = Number(headers["content-length"]);
-			return {
-				stream: body,
-				total: Number.isSafeInteger(length) && length >= 0 ? length : void 0,
-				type: void 0
-			};
-		}
-		default: return;
-	}
-}
-/**
-* `base` with the request body counted as it is read. The body is swapped
-* here, inside the call, so the context the plugins see keeps the caller's
-* own. A callback that throws fails the call with its own error, not the
-* "fetch failed" the body error would become.
-*/
-function countingFetch(base, onProgress) {
-	return (async (input, init = {}) => {
-		const headers = headersOf(input, init);
-		const source = await sourceOf(init.body, headers);
-		if (!source) return base(input, init);
-		const { total, type } = source;
-		if (total !== void 0 && !("content-length" in headers)) headers["content-length"] = String(total);
-		if (type && !("content-type" in headers)) headers["content-type"] = type;
-		const signal = init.signal;
-		const reader = source.stream.getReader();
-		let loaded = 0;
-		let rest;
-		let reported = false;
-		let answered = false;
-		let failure;
-		const report = () => {
-			if (answered) return;
-			reported = true;
-			try {
-				onProgress(progressEvent(loaded, total));
-			} catch (error) {
-				failure = { error };
-				throw error;
-			}
-		};
-		const body = new ReadableStream({
-			async pull(controller) {
-				const stopped = async () => {
-					if (!signal?.aborted) return false;
-					await reader.cancel(signal.reason).catch(() => {});
-					controller.error(signal.reason);
-					return true;
-				};
-				if (await stopped()) return;
-				let chunk = rest;
-				if (!chunk?.byteLength) {
-					const { value, done } = await reader.read();
-					if (done) {
-						if (!reported) report();
-						return controller.close();
-					}
-					chunk = value;
-					if (await stopped()) return;
-				}
-				rest = chunk.subarray(SLICE);
-				const piece = chunk.subarray(0, SLICE);
-				loaded += piece.byteLength;
-				report();
-				controller.enqueue(piece);
-			},
-			cancel: (reason) => reader.cancel(reason)
-		}, { highWaterMark: 0 });
-		try {
-			const res = await base(input, {
-				...init,
-				body,
-				headers,
-				duplex: "half"
-			});
-			answered = true;
-			return res;
-		} catch (error) {
-			throw failure ? failure.error : error;
-		}
-	});
-}
-//#endregion
-//#region src/plugins/upload-progress/xhr-fetch.ts
-const NULL_BODY_STATUSES = /* @__PURE__ */ new Set([
-	101,
-	204,
-	205,
-	304
-]);
-/** `getAllResponseHeaders()` as `Headers`; lines without a name are skipped. */
-function parseResponseHeaders(raw) {
-	const headers = new Headers();
-	for (const line of raw.split(/\r?\n/)) {
-		const colon = line.indexOf(":");
-		if (colon <= 0) continue;
-		const name = line.slice(0, colon).trim();
-		if (name) headers.append(name, line.slice(colon + 1).trim());
-	}
-	return headers;
-}
-/**
-* What fetch would report for this response. XHR gives only the final URL;
-* the request URL is normalized (case, default port, no fragment) before
-* comparing, so writing it differently is not a redirect.
-*/
-function responseFields(requestUrl, responseURL, pageHref) {
-	const requested = new URL(requestUrl, pageHref);
-	requested.hash = "";
-	const final = new URL(responseURL || requested.href, pageHref);
-	const sameOrigin = pageHref !== void 0 && final.origin === new URL(pageHref).origin;
-	return {
-		url: final.href,
-		redirected: final.href !== requested.href,
-		type: sameOrigin ? "basic" : "cors"
-	};
-}
-/**
-* A fetch over XMLHttpRequest, for the one thing fetch cannot do in a
-* browser: report upload progress. It honours what an arthron attempt
-* carries — method, headers, body, `credentials: "include"`, `signal` — and
-* fails the way fetch does, so `send` makes the same ArthronErrors: a
-* network failure rejects with a TypeError, an abort with the signal's
-* reason. The response arrives whole; XHR does not stream it.
-*/
-function xhrFetch(onProgress) {
-	return ((input, init = {}) => new Promise((resolve, reject) => {
-		const url = urlOf(input);
-		const { signal } = init;
-		if (signal?.aborted) return reject(signal.reason);
-		const xhr = new XMLHttpRequest();
-		let settled = false;
-		const settle = (done) => {
-			if (settled) return;
-			settled = true;
-			signal?.removeEventListener("abort", onAbort);
-			done();
-		};
-		const fail = (error) => {
-			settle(() => reject(error));
-			xhr.abort();
-		};
-		const onAbort = () => fail(signal?.reason);
-		signal?.addEventListener("abort", onAbort, { once: true });
-		let reported;
-		const report = (loaded, total) => {
-			if (settled || reported?.loaded === loaded && reported.total === total) return;
-			reported = progressEvent(loaded, total);
-			try {
-				onProgress(reported);
-			} catch (error) {
-				fail(error);
-			}
-		};
-		const fromEvent = (e) => report(e.loaded, e.lengthComputable ? e.total : void 0);
-		xhr.upload.onprogress = fromEvent;
-		xhr.upload.onload = fromEvent;
-		xhr.onload = () => {
-			if (!reported) report(0, 0);
-			if (xhr.status === 0) return settle(() => reject(/* @__PURE__ */ new TypeError("Network request failed")));
-			const headers = parseResponseHeaders(xhr.getAllResponseHeaders());
-			const body = NULL_BODY_STATUSES.has(xhr.status) ? null : xhr.response;
-			const res = new Response(body, {
-				status: xhr.status,
-				statusText: xhr.statusText,
-				headers
-			});
-			const page = globalThis.location?.href;
-			settle(() => resolve(withFields(res, responseFields(url, xhr.responseURL, page))));
-		};
-		xhr.onerror = xhr.ontimeout = () => settle(() => reject(/* @__PURE__ */ new TypeError("Network request failed")));
-		xhr.open(init.method ?? "GET", url);
-		xhr.responseType = "arraybuffer";
-		if (init.credentials === "include") xhr.withCredentials = true;
-		for (const [name, value] of Object.entries(headersOf(input, init))) xhr.setRequestHeader(name, value);
-		xhr.send(init.body ?? null);
-	}));
-}
-//#endregion
-//#region src/plugins/upload-progress/upload-progress.ts
-/**
-* How a progress call can be sent here. Node first — jsdom on Node has an
-* XMLHttpRequest too, but Node's fetch is the real transport there. Bun,
-* Deno, Electron and Cloudflare Workers also expose `process.versions.node`;
-* only Node was shown to keep content-length on a counted body, and an
-* Electron renderer has XHR.
-*/
-function transportFor(runtime) {
-	const { versions, hasXhr, userAgent, deno } = runtime;
-	if (Boolean(versions?.node) && !versions?.bun && !versions?.electron && !deno && userAgent !== "Cloudflare-Workers") return "count";
-	return hasXhr ? "xhr" : void 0;
-}
-function currentRuntime() {
-	const g = globalThis;
-	const runtime = {
-		hasXhr: typeof XMLHttpRequest === "function",
-		deno: "Deno" in globalThis
-	};
-	if (g.process?.versions) runtime.versions = g.process.versions;
-	if (g.navigator?.userAgent) runtime.userAgent = g.navigator.userAgent;
-	return runtime;
-}
-/**
-* What an XHR cannot honour and whose loss would change the call: it always
-* follows redirects, has no no-cors mode, and always sends cookies to its own
-* origin. `undefined` when the call can go over XHR.
-*/
-function xhrRefusal(init, url, pageHref) {
-	if (init.redirect === "manual" || init.redirect === "error") return `redirect: "${init.redirect}" — XMLHttpRequest always follows redirects`;
-	if (init.mode === "no-cors") return "mode: \"no-cors\" — XMLHttpRequest has no no-cors mode";
-	if (init.credentials === "omit" && pageHref) {
-		const page = new URL(pageHref).origin;
-		if (new URL(url, pageHref).origin === page) return "credentials: \"omit\" on this origin — XMLHttpRequest always sends cookies to its own origin";
-	}
-}
-/**
-* The attempt with its own signal, joined to the call's. A callback that
-* throws aborts the attempt with its error: send passes an abort reason on
-* untouched, so it stays a plugin exception — not a network ArthronError
-* that error interceptors would see and retry would repeat.
-*/
-function withOwnSignal(ctx, onProgress) {
-	const own = new AbortController();
-	const outer = ctx.init.signal;
-	const signal = outer ? AbortSignal.any([outer, own.signal]) : own.signal;
-	const report = (event) => {
-		if (own.signal.aborted) return;
-		try {
-			onProgress(event);
-		} catch (error) {
-			own.abort(error);
-		}
-	};
-	return {
-		ctx: {
-			...ctx,
-			init: {
-				...ctx.init,
-				signal
-			}
-		},
-		report
-	};
-}
-/**
-* Does nothing by itself — only a call that passes `meta.onUploadProgress`
-* reports upload progress. On such a call it changes how that one attempt
-* is sent: over XMLHttpRequest in a browser, with a counted body in Node.
-* Every other call, on this client too, goes out exactly as before.
-*
-* Progress needs the runtime's own fetch: with an injected `fetch`, another
-* plugin's transport, or a runtime that is neither (Deno, Bun, Cloudflare
-* Workers, a service worker), the call is sent as usual without progress.
-* Put it last in `use`: the call's signal carries a throwing callback's
-* error, and an interceptor after it that replaces the signal would cut it.
-*/
-function uploadProgress() {
-	return {
-		name: "uploadProgress",
-		request: (ctx) => {
-			const onProgress = ctx.meta?.onUploadProgress;
-			const { body } = ctx.init;
-			if (!onProgress || body === void 0 || body === null) return ctx;
-			if (ctx.fetch !== globalThis.fetch) return ctx;
-			const transport = transportFor(currentRuntime());
-			if (!transport) return ctx;
-			if (transport === "xhr") {
-				const page = globalThis.location?.href;
-				const refusal = xhrRefusal(ctx.init, ctx.url, page);
-				if (refusal) throw new TypeError(`arthron: onUploadProgress cannot be combined with ${refusal}; drop one of them`);
-				if (isReadableStream(body)) return ctx;
-			}
-			const { ctx: next, report } = withOwnSignal(ctx, onProgress);
-			return {
-				...next,
-				fetch: transport === "xhr" ? xhrFetch(report) : countingFetch(ctx.fetch, report)
-			};
-		}
-	};
-}
-//#endregion
-export { redactUrl as _, cancellationError as a, responseError as c, runtimeStreamsRequestBody as d, serializeBody as f, leavesBase as g, fillPath as h, logging as i, bearerAuth as l, isArthronError as m, timeout as n, isCancellation as o, ArthronError as p, retry as r, networkError as s, uploadProgress as t, isReadableStream as u, redactUrlIn as v, resolveUrl as y };
-
-//# sourceMappingURL=plugins-CHCMxtAE.mjs.map