@celestia-island/hikari 0.55.180 → 0.55.181

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celestia-island/hikari",
-  "version": "0.55.180",
+  "version": "0.55.181",
   "private": false,
   "type": "module",
   "description": "Hikari Vue 3 component library — production-grade UI components based on shittim-chest design system",
@@ -58,6 +58,7 @@
     "vue": "^*"
   },
   "dependencies": {
+    "@celestia-island/tairitsu-transport": "^0.1",
     "@xterm/addon-fit": "^0.*",
     "@xterm/addon-image": "^0.10.0-beta.301",
     "@xterm/xterm": "^6.1.0-beta.304",

package/src/utils/connectivity.ts

@@ -6,6 +6,8 @@
  * fails the origin is unreachable, otherwise the host responded but the
  * CORS policy rejected the credentialed request.
  */
+import { bindHostFetch } from "@celestia-island/tairitsu-transport/contract";
+
 export type OriginProbe =
   | { ok: true }
   | { ok: false; reason: "unreachable" | "cors-blocked" };
@@ -16,8 +18,9 @@ export async function probeOrigin(
 ): Promise<OriginProbe> {
   // Bare `?? fetch` detaches Window's fetch receiver — the default path
   // throws "Illegal invocation" in a browser (2026-10-17 chest live
-  // report family). bind(globalThis) re-attaches it, re-resolved per call.
-  const fetchFn = opts?.fetchFn ?? fetch.bind(globalThis);
+  // report family). The shared bindHostFetch() from tairitsu-transport is
+  // the one sanctioned acquisition, re-resolved per call.
+  const fetchFn = opts?.fetchFn ?? bindHostFetch();
   try {
     // A successful credentialed fetch means reachable + CORS-whitelisted,
     // regardless of the HTTP status code (4xx/5xx still prove the origin).
@@ -45,7 +48,7 @@ export async function probeOriginWithBody(
   opts?: { fetchFn?: typeof fetch },
 ): Promise<{ ok: boolean; body?: string }> {
   // Same receiver rule as probeOrigin: never capture Window's fetch bare.
-  const fetchFn = opts?.fetchFn ?? fetch.bind(globalThis);
+  const fetchFn = opts?.fetchFn ?? bindHostFetch();
   try {
     const resp = await fetchFn(url, { credentials: "include", mode: "cors" });
     return { ok: true, body: await resp.text().catch(() => undefined) };

package/src/utils/healthProbe.ts

@@ -9,6 +9,8 @@
  * Pure function, no app config — callers bring the URL.
  */
 
+import { bindHostFetch } from "@celestia-island/tairitsu-transport/contract";
+
 /** Minimal subset shared by all `/api/health` consumers. */
 export interface HealthProbeBody {
   status: string;
@@ -43,8 +45,9 @@ export async function probeHealthEndpoint(
   // Bare `?? fetch` captures Window's fetch detached — every default
   // call throws "Illegal invocation" in a browser (2026-10-17 chest live
   // report; the probe then silently reported every panel unreachable).
-  // bind(globalThis) re-attaches the receiver and re-resolves per call.
-  const fetchFn = opts.fetchFn ?? fetch.bind(globalThis);
+  // The shared bindHostFetch() from tairitsu-transport re-attaches the
+  // receiver and re-resolves per call.
+  const fetchFn = opts.fetchFn ?? bindHostFetch();
   const started = performance.now();
   try {
     const resp = await fetchFn(url, {

package/src/utils/powNonce.ts

@@ -1,3 +1,4 @@
+import { bindHostFetch } from "@celestia-island/tairitsu-transport/contract";
 import { solvePow, type PowChallenge } from "./pow";
 
 export type ChallengeDescriptor =
@@ -31,9 +32,10 @@ export async function fetchChallenge(
   baseUrl: string,
   // Bare `= fetch` captures Window's fetch detached — the default throws
   // "Illegal invocation" in a browser (2026-10-17 chest live report
-  // family). bind(globalThis) re-attaches the receiver, re-resolved per
-  // call so vi.stubGlobal stubs stay visible.
-  fetchFn: typeof fetch = fetch.bind(globalThis),
+  // family). The shared bindHostFetch() from tairitsu-transport
+  // re-attaches the receiver, re-resolved per call so vi.stubGlobal
+  // stubs stay visible.
+  fetchFn: typeof fetch = bindHostFetch(),
 ): Promise<ChallengeDescriptor | undefined> {
   let resp: Response;
   try {
@@ -64,7 +66,7 @@ export async function negotiateNonce(
 ): Promise<string | undefined> {
   try {
     // Same receiver rule as fetchChallenge's default: never bare `?? fetch`.
-    const fetchFn = opts?.fetchFn ?? fetch.bind(globalThis);
+    const fetchFn = opts?.fetchFn ?? bindHostFetch();
     let body: Record<string, unknown> | undefined;
     if (opts?.captchaToken) {
       body = { type: "captcha", token: opts.captchaToken };