@projectpac/use-http

A use provider for the most ordinary sensitive operation there is: call an endpoint with a credential the human stored, without the credential passing through the code that wanted the call.

A data function's real need looks like this -- fetch a feed with a stored token -- and it is the smallest complete demonstration of what the seam is for: the protocol writes the destination, data management resolves the named source, and the provider is the only thing that ever holds the bytes.

Three things it will not do:

• Send a credential anywhere unlisted. allowedHosts has no "any": a credential is only as contained as the set of places it can go.
• Echo what went in. The receipt is the status and the response body. Not the credential, not the request headers.
• Read more than it was given. The response is bounded, and the request has a deadline.