fetch library

Downloads and archives: the "download and add" half of installing a package, shared by just and its plugins.

HttpFetcher: HTTPS only (every redirect too), polite retries, limits, every failure a FetchException, and CachedText that still reads offline.
DownloadCache and checkPinned: downloads pinned by size and SHA-256, kept per user.
GitHubRepo: where a repository's release files are, without the rate-limited GitHub API.
ZipArchive reads a zip, refusing anything a tool should never unpack (paths outside the folder, links, ZIP64, bombs); ZipWriter writes one the same way every time. SafePaths holds the path rules both follow.
CancelToken stops any of it.

Classes

CachedText: Text fetched through an on-disk copy: fresh when the server answered, the cached copy when it said "unchanged" — or, offline, when it could not be reached at all or sent something unreadable.
CancelToken: A request to stop a download or an install, checked between steps.
DownloadCache: The per-user cache shared by every project on this machine: archives stored under their SHA-256, so a version downloaded once installs anywhere without the network, and thumbnails.
FetchResponse: What a server answered.
GitHubRepo: A GitHub repository, as https://github.com/<owner>/<repo> names it.
HttpFetcher: Fetches files over HTTPS.
SafePaths: Checks paths from untrusted archives so they can only ever land inside the folder they are extracted to, on every desktop platform.
ZipArchive: A ZIP archive read fully into memory and checked before any file in it is unpacked.
ZipEntry: One file or folder in a ZipArchive.
ZipLimits: How much an archive may hold before ZipArchive.read refuses it.
ZipWriter: Builds a ZIP archive whose bytes depend only on its files' paths and contents.

checkPinned(Uint8List bytes, {required int size, required String sha256, required String what}) → void: Checks that bytes, downloaded as what, are the size bytes whose SHA-256 is sha256. Throws DownloadException when they are not: changed after they were pinned, or broken on the way.
isFetchAllowed(Uri uri) → bool: Whether uri may be fetched: https:, or plain http: to this machine only.

ByteProgress = void Function(int received, int? total): Reports bytes received so far, out of total when known.

CancelledException: Work stopped because a CancelToken was cancelled.
DownloadException: A download whose bytes are not what was pinned.
FetchException: Something that could not be fetched: the server refused, the network failed, or the download broke a limit.
UnsafePathException: A path in an archive or a package that is not safe to write.
ZipFormatException: A ZIP archive that is damaged, uses something this reader refuses, or breaks one of its ZipLimits.