@celestia-island/hikari 0.55.180 → 0.55.182

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celestia-island/hikari",
-  "version": "0.55.180",
+  "version": "0.55.182",
   "private": false,
   "type": "module",
   "description": "Hikari Vue 3 component library — production-grade UI components based on shittim-chest design system",
@@ -58,6 +58,7 @@
     "vue": "^*"
   },
   "dependencies": {
+    "@celestia-island/tairitsu-transport": "^0.1",
     "@xterm/addon-fit": "^0.*",
     "@xterm/addon-image": "^0.10.0-beta.301",
     "@xterm/xterm": "^6.1.0-beta.304",

package/src/components/HkDraggableList.scss

@@ -89,6 +89,23 @@
   display: flex;
   align-items: center;
   gap: var(--space-8, 0.5rem);
+
+  /* A vertical list's row content owns the lane's width: when the host
+     renders ONE root element per row (the card shapes — wowsp's install
+     and account cards), stretch it across the lane so every row fills
+     the list instead of hugging its own text (wowsp report 2026-10-18:
+     the settings card lists shrank to content width after adopting this
+     component — the retired SortableList rows were plain blocks that
+     filled). min-width: 0 keeps ellipsis chains inside the card working.
+     Fragment rows — several sibling elements sharing the lane (chest's
+     tab/subview manager rows) — keep host-owned layout: the selector
+     deliberately does not match them. The drag ghost reuses the row
+     markup, so a single-root ghost fills its frame exactly like its
+     live row. */
+  > :only-child {
+    flex: 1;
+    min-width: 0;
+  }
 }
 
 .hk-draggable-list-ghost {

package/src/components/HkDraggableList.styles.test.ts

@@ -62,3 +62,22 @@ describe("HkDraggableList handle-lane sheet", () => {
     expect(body).toContain("display: none");
   });
 });
+
+describe("HkDraggableList content-lane fill sheet", () => {
+  const css = listCss();
+
+  it("stretches a single-root row across the lane", () => {
+    const body = ruleBody(css, ".hk-draggable-list-content > :only-child");
+    expect(body, "the :only-child fill rule must exist").not.toBeNull();
+    expect(body).toContain("flex: 1");
+    expect(body).toContain("min-width: 0");
+  });
+
+  // The fill must stay keyed on :only-child: fragment rows (several
+  // siblings sharing the lane) are host-owned layout and must not match.
+  it("never stretches fragment rows — the rule keys on :only-child alone", () => {
+    const fillRules = css.match(/\.hk-draggable-list-content\s*>\s*[^{]+\{/g) ?? [];
+    expect(fillRules.length).toBe(1);
+    expect(fillRules[0]).toContain(":only-child");
+  });
+});

package/src/components/HkDraggableList.test.tsx

@@ -223,6 +223,54 @@ describe("HkDraggableList list semantics", () => {
   });
 });
 
+describe("HkDraggableList content-lane shape", () => {
+  /** The lane hands the slot content through verbatim, and the sheet
+   *  stretches a lane's ONLY element child across the row (the
+   *  `:only-child` fill — sheet twin:
+   *  HkDraggableList.styles.test.ts). That selector's semantics hinge on
+   *  this shape: a single-root slot must land as exactly one element
+   *  child, and a fragment slot as several siblings (which the fill
+   *  deliberately does not match). */
+
+  function mountWithSlot(slot: () => unknown): HTMLElement {
+    const container = document.createElement("div");
+    document.body.appendChild(container);
+    const app = createApp({
+      render: () =>
+        h(
+          HDraggableList,
+          { items: [{ key: "a" }] },
+          { item: () => slot() },
+        ),
+    });
+    app.mount(container);
+    mounts.push({ app, container });
+    return container.querySelector(".hk-draggable-list") as HTMLElement;
+  }
+
+  function laneOf(root: HTMLElement): HTMLElement {
+    return root.querySelector(".hk-draggable-list-content") as HTMLElement;
+  }
+
+  it("lands a single-root slot as the lane's only element child", () => {
+    const root = mountWithSlot(() => h("div", { class: "row-card" }, "body"));
+    const children = Array.from(laneOf(root).children);
+    expect(children).toHaveLength(1);
+    expect(children[0]!.classList.contains("row-card")).toBe(true);
+  });
+
+  it("lands a fragment slot as several lane siblings the fill ignores", () => {
+    const root = mountWithSlot(() => [
+      h("span", { class: "row-lead" }, "lead"),
+      h("span", { class: "row-tail" }, "tail"),
+    ]);
+    const children = Array.from(laneOf(root).children);
+    expect(children).toHaveLength(2);
+    expect(children[0]!.classList.contains("row-lead")).toBe(true);
+    expect(children[1]!.classList.contains("row-tail")).toBe(true);
+  });
+});
+
 describe("HkDraggableList press ergonomics (clickable rows)", () => {
   /** Two guards make a clickable row safe inside the list (ported from
    *  wowsp's SortableList twin, which ran them in production):

package/src/utils/connectivity.ts

@@ -6,6 +6,8 @@
  * fails the origin is unreachable, otherwise the host responded but the
  * CORS policy rejected the credentialed request.
  */
+import { bindHostFetch } from "@celestia-island/tairitsu-transport/contract";
+
 export type OriginProbe =
   | { ok: true }
   | { ok: false; reason: "unreachable" | "cors-blocked" };
@@ -16,8 +18,9 @@ export async function probeOrigin(
 ): Promise<OriginProbe> {
   // Bare `?? fetch` detaches Window's fetch receiver — the default path
   // throws "Illegal invocation" in a browser (2026-10-17 chest live
-  // report family). bind(globalThis) re-attaches it, re-resolved per call.
-  const fetchFn = opts?.fetchFn ?? fetch.bind(globalThis);
+  // report family). The shared bindHostFetch() from tairitsu-transport is
+  // the one sanctioned acquisition, re-resolved per call.
+  const fetchFn = opts?.fetchFn ?? bindHostFetch();
   try {
     // A successful credentialed fetch means reachable + CORS-whitelisted,
     // regardless of the HTTP status code (4xx/5xx still prove the origin).
@@ -45,7 +48,7 @@ export async function probeOriginWithBody(
   opts?: { fetchFn?: typeof fetch },
 ): Promise<{ ok: boolean; body?: string }> {
   // Same receiver rule as probeOrigin: never capture Window's fetch bare.
-  const fetchFn = opts?.fetchFn ?? fetch.bind(globalThis);
+  const fetchFn = opts?.fetchFn ?? bindHostFetch();
   try {
     const resp = await fetchFn(url, { credentials: "include", mode: "cors" });
     return { ok: true, body: await resp.text().catch(() => undefined) };

package/src/utils/healthProbe.ts

@@ -9,6 +9,8 @@
  * Pure function, no app config — callers bring the URL.
  */
 
+import { bindHostFetch } from "@celestia-island/tairitsu-transport/contract";
+
 /** Minimal subset shared by all `/api/health` consumers. */
 export interface HealthProbeBody {
   status: string;
@@ -43,8 +45,9 @@ export async function probeHealthEndpoint(
   // Bare `?? fetch` captures Window's fetch detached — every default
   // call throws "Illegal invocation" in a browser (2026-10-17 chest live
   // report; the probe then silently reported every panel unreachable).
-  // bind(globalThis) re-attaches the receiver and re-resolves per call.
-  const fetchFn = opts.fetchFn ?? fetch.bind(globalThis);
+  // The shared bindHostFetch() from tairitsu-transport re-attaches the
+  // receiver and re-resolves per call.
+  const fetchFn = opts.fetchFn ?? bindHostFetch();
   const started = performance.now();
   try {
     const resp = await fetchFn(url, {

package/src/utils/powNonce.ts

@@ -1,3 +1,4 @@
+import { bindHostFetch } from "@celestia-island/tairitsu-transport/contract";
 import { solvePow, type PowChallenge } from "./pow";
 
 export type ChallengeDescriptor =
@@ -31,9 +32,10 @@ export async function fetchChallenge(
   baseUrl: string,
   // Bare `= fetch` captures Window's fetch detached — the default throws
   // "Illegal invocation" in a browser (2026-10-17 chest live report
-  // family). bind(globalThis) re-attaches the receiver, re-resolved per
-  // call so vi.stubGlobal stubs stay visible.
-  fetchFn: typeof fetch = fetch.bind(globalThis),
+  // family). The shared bindHostFetch() from tairitsu-transport
+  // re-attaches the receiver, re-resolved per call so vi.stubGlobal
+  // stubs stay visible.
+  fetchFn: typeof fetch = bindHostFetch(),
 ): Promise<ChallengeDescriptor | undefined> {
   let resp: Response;
   try {
@@ -64,7 +66,7 @@ export async function negotiateNonce(
 ): Promise<string | undefined> {
   try {
     // Same receiver rule as fetchChallenge's default: never bare `?? fetch`.
-    const fetchFn = opts?.fetchFn ?? fetch.bind(globalThis);
+    const fetchFn = opts?.fetchFn ?? bindHostFetch();
     let body: Record<string, unknown> | undefined;
     if (opts?.captchaToken) {
       body = { type: "captcha", token: opts.captchaToken };