Response body cap in bytes (checked against Content-Length up front AND while streaming, since the header is optional/spoofable).
OptionalprivateOptional caller-specific explanation when private destinations fail.
Wall-clock budget for the whole fetch — every redirect hop plus the body read share one AbortSignal.timeout.
Permit private/loopback/link-local destinations (LAN hosts).