@celestia-island/hikari 0.55.179 → 0.55.181

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celestia-island/hikari",
-  "version": "0.55.179",
+  "version": "0.55.181",
   "private": false,
   "type": "module",
   "description": "Hikari Vue 3 component library — production-grade UI components based on shittim-chest design system",
@@ -58,6 +58,7 @@
     "vue": "^*"
   },
   "dependencies": {
+    "@celestia-island/tairitsu-transport": "^0.1",
     "@xterm/addon-fit": "^0.*",
     "@xterm/addon-image": "^0.10.0-beta.301",
     "@xterm/xterm": "^6.1.0-beta.304",

package/src/utils/connectivity.ts

@@ -6,6 +6,8 @@
  * fails the origin is unreachable, otherwise the host responded but the
  * CORS policy rejected the credentialed request.
  */
+import { bindHostFetch } from "@celestia-island/tairitsu-transport/contract";
+
 export type OriginProbe =
   | { ok: true }
   | { ok: false; reason: "unreachable" | "cors-blocked" };
@@ -14,7 +16,11 @@ export async function probeOrigin(
   url: string,
   opts?: { fetchFn?: typeof fetch },
 ): Promise<OriginProbe> {
-  const fetchFn = opts?.fetchFn ?? fetch;
+  // Bare `?? fetch` detaches Window's fetch receiver — the default path
+  // throws "Illegal invocation" in a browser (2026-10-17 chest live
+  // report family). The shared bindHostFetch() from tairitsu-transport is
+  // the one sanctioned acquisition, re-resolved per call.
+  const fetchFn = opts?.fetchFn ?? bindHostFetch();
   try {
     // A successful credentialed fetch means reachable + CORS-whitelisted,
     // regardless of the HTTP status code (4xx/5xx still prove the origin).
@@ -41,7 +47,8 @@ export async function probeOriginWithBody(
   url: string,
   opts?: { fetchFn?: typeof fetch },
 ): Promise<{ ok: boolean; body?: string }> {
-  const fetchFn = opts?.fetchFn ?? fetch;
+  // Same receiver rule as probeOrigin: never capture Window's fetch bare.
+  const fetchFn = opts?.fetchFn ?? bindHostFetch();
   try {
     const resp = await fetchFn(url, { credentials: "include", mode: "cors" });
     return { ok: true, body: await resp.text().catch(() => undefined) };

package/src/utils/fetchReceiver.test.ts

@@ -0,0 +1,94 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { probeOrigin, probeOriginWithBody } from "./connectivity";
+import { probeHealthEndpoint } from "./healthProbe";
+import { fetchChallenge, negotiateNonce } from "./powNonce";
+
+/**
+ * The browser's `fetch` is a Window method: capturing it as a bare value
+ * (`opts?.fetchFn ?? fetch`) detaches the receiver, and every default call
+ * throws "Failed to execute 'fetch' on 'Window': Illegal invocation"
+ * (2026-10-17 chest live report: branding silently fell back and health
+ * probes reported every panel unreachable — the TypeError was swallowed
+ * into `{ok:false}` results). Node's fetch does not check its receiver,
+ * so these tests stub the browser's exact contract — `this !== globalThis`
+ * rejects with the same TypeError — making a detached capture red here.
+ */
+function stubWindowFetch(): void {
+  vi.stubGlobal(
+    "fetch",
+    vi.fn(function (this: unknown, input: RequestInfo | URL): Promise<Response> {
+      if (this !== globalThis) {
+        return Promise.reject(
+          new TypeError("Failed to execute 'fetch' on 'Window': Illegal invocation"),
+        );
+      }
+      const url = String(input);
+      if (url.endsWith("/health")) {
+        return Promise.resolve(new Response(JSON.stringify({}), { status: 200 }));
+      }
+      if (url.endsWith("/auth/nonce")) {
+        return Promise.resolve(
+          new Response(JSON.stringify({ nonce: "nonce-1" }), { status: 200 }),
+        );
+      }
+      // probeOrigin / probeOriginWithBody / health probe targets.
+      return Promise.resolve(new Response("pong", { status: 200 }));
+    }),
+  );
+}
+
+describe("connectivity / healthProbe / powNonce — default fetches keep the Window receiver", () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  it("probeOrigin's default fetchFn probes instead of throwing illegal invocation", async () => {
+    stubWindowFetch();
+
+    await expect(probeOrigin("https://panel.example/health")).resolves.toEqual({ ok: true });
+  });
+
+  it("probeOriginWithBody's default fetchFn captures the body", async () => {
+    stubWindowFetch();
+
+    // Non-/health URL: the stub's default branch answers the body "pong".
+    await expect(probeOriginWithBody("https://panel.example/ping")).resolves.toEqual({
+      ok: true,
+      body: "pong",
+    });
+  });
+
+  it("probeHealthEndpoint's default fetchFn reads a healthy body", async () => {
+    stubWindowFetch();
+
+    const result = await probeHealthEndpoint("https://panel.example/health");
+    expect(result.ok).toBe(true);
+    expect(result.body).toEqual({});
+  });
+
+  it("powNonce defaults complete the challenge/nonce exchange", async () => {
+    stubWindowFetch();
+
+    // `undefined` (fetch failed) would mean the default threw — the exact
+    // silent regression that dropped the X-Nonce on chest's live login.
+    await expect(fetchChallenge("/api")).resolves.toBe(null);
+    await expect(negotiateNonce("/api")).resolves.toBe("nonce-1");
+  });
+
+  it("an explicit fetchFn still wins over every default", async () => {
+    const guard = vi.fn(() => Promise.reject(new Error("global fetch must not be called")));
+    vi.stubGlobal("fetch", guard);
+    const explicit = vi.fn(async () => new Response("{}", { status: 200 }));
+
+    await probeOrigin("https://panel.example/", { fetchFn: explicit });
+    await probeOriginWithBody("https://panel.example/", { fetchFn: explicit });
+    await probeHealthEndpoint("https://panel.example/", { fetchFn: explicit });
+    await fetchChallenge("/api", explicit);
+    await negotiateNonce("/api", { fetchFn: explicit });
+
+    // negotiateNonce rides the explicit fn twice (challenge + exchange).
+    expect(explicit).toHaveBeenCalledTimes(6);
+    expect(guard).not.toHaveBeenCalled();
+  });
+});

package/src/utils/healthProbe.ts

@@ -9,6 +9,8 @@
  * Pure function, no app config — callers bring the URL.
  */
 
+import { bindHostFetch } from "@celestia-island/tairitsu-transport/contract";
+
 /** Minimal subset shared by all `/api/health` consumers. */
 export interface HealthProbeBody {
   status: string;
@@ -40,7 +42,12 @@ export async function probeHealthEndpoint(
   url: string,
   opts: { timeoutMs?: number; fetchFn?: typeof fetch } = {},
 ): Promise<HealthProbeResult> {
-  const fetchFn = opts.fetchFn ?? fetch;
+  // Bare `?? fetch` captures Window's fetch detached — every default
+  // call throws "Illegal invocation" in a browser (2026-10-17 chest live
+  // report; the probe then silently reported every panel unreachable).
+  // The shared bindHostFetch() from tairitsu-transport re-attaches the
+  // receiver and re-resolves per call.
+  const fetchFn = opts.fetchFn ?? bindHostFetch();
   const started = performance.now();
   try {
     const resp = await fetchFn(url, {

package/src/utils/powNonce.ts

@@ -1,3 +1,4 @@
+import { bindHostFetch } from "@celestia-island/tairitsu-transport/contract";
 import { solvePow, type PowChallenge } from "./pow";
 
 export type ChallengeDescriptor =
@@ -29,7 +30,12 @@ function normalizeBase(baseUrl: string): string {
  */
 export async function fetchChallenge(
   baseUrl: string,
-  fetchFn: typeof fetch = fetch,
+  // Bare `= fetch` captures Window's fetch detached — the default throws
+  // "Illegal invocation" in a browser (2026-10-17 chest live report
+  // family). The shared bindHostFetch() from tairitsu-transport
+  // re-attaches the receiver, re-resolved per call so vi.stubGlobal
+  // stubs stay visible.
+  fetchFn: typeof fetch = bindHostFetch(),
 ): Promise<ChallengeDescriptor | undefined> {
   let resp: Response;
   try {
@@ -59,7 +65,8 @@ export async function negotiateNonce(
   },
 ): Promise<string | undefined> {
   try {
-    const fetchFn = opts?.fetchFn ?? fetch;
+    // Same receiver rule as fetchChallenge's default: never bare `?? fetch`.
+    const fetchFn = opts?.fetchFn ?? bindHostFetch();
     let body: Record<string, unknown> | undefined;
     if (opts?.captchaToken) {
       body = { type: "captcha", token: opts.captchaToken };