@gjsify/fetch 0.4.28 → 0.4.30

package/lib/body.d.ts

@@ -1,5 +1,6 @@
 import { Blob } from './utils/blob-from.js';
-import { Readable, Writable } from 'node:stream';
+import type { Writable } from 'node:stream';
+import { Readable } from 'node:stream';
 import { Buffer } from 'node:buffer';
 import { FormData } from '@gjsify/formdata';
 import { FetchBaseError } from './errors/base.js';

package/lib/body.js

@@ -20,15 +20,7 @@ const pipeline = (source, dest) => new Promise((resolve, reject) => {
 });
 const INTERNALS = Symbol('Body internals');
 function isAnyArrayBuffer(val) {
-    return val instanceof ArrayBuffer ||
-        (typeof SharedArrayBuffer !== 'undefined' && val instanceof SharedArrayBuffer);
-}
-function isBoxedPrimitive(val) {
-    return (val instanceof String ||
-        val instanceof Number ||
-        val instanceof Boolean ||
-        (typeof Symbol !== 'undefined' && val instanceof Symbol) ||
-        (typeof BigInt !== 'undefined' && val instanceof BigInt));
+    return val instanceof ArrayBuffer || (typeof SharedArrayBuffer !== 'undefined' && val instanceof SharedArrayBuffer);
 }
 /**
  * Body mixin
@@ -133,7 +125,9 @@ export default class Body {
                         try {
                             controller.enqueue(chunk instanceof Uint8Array ? chunk : new Uint8Array(chunk));
                         }
-                        catch { /* consumer cancelled — drop */ }
+                        catch {
+                            /* consumer cancelled — drop */
+                        }
                     });
                     stream.on('end', () => {
                         if (closed)
@@ -145,7 +139,9 @@ export default class Body {
                         try {
                             controller.close();
                         }
-                        catch { /* already closed/cancelled */ }
+                        catch {
+                            /* already closed/cancelled */
+                        }
                     });
                     stream.on('error', (err) => {
                         if (closed)
@@ -154,13 +150,15 @@ export default class Body {
                         try {
                             controller.error(err);
                         }
-                        catch { /* already closed/cancelled */ }
+                        catch {
+                            /* already closed/cancelled */
+                        }
                     });
                 },
                 cancel() {
                     closed = true;
                     stream.destroy();
-                }
+                },
             });
         }
         return null;
@@ -206,10 +204,12 @@ export default class Body {
      * Return raw response as Blob
      */
     async blob() {
-        const ct = (this.headers?.get('content-type')) || (this[INTERNALS].body && this[INTERNALS].body.type) || '';
+        const ct = this.headers?.get('content-type') ||
+            (this[INTERNALS].body && this[INTERNALS].body.type) ||
+            '';
         const buf = await this.arrayBuffer();
         return new Blob([buf], {
-            type: ct
+            type: ct,
         });
     }
     /**
@@ -271,11 +271,13 @@ async function consumeBody(data) {
     }
     catch (error) {
         const err = error instanceof Error ? error : new Error(String(error));
-        const error_ = error instanceof FetchBaseError ? error : new FetchError(`Invalid response body while trying to fetch ${data.url}: ${err.message}`, 'system', err);
+        const error_ = error instanceof FetchBaseError
+            ? error
+            : new FetchError(`Invalid response body while trying to fetch ${data.url}: ${err.message}`, 'system', err);
         throw error_;
     }
     try {
-        if (accum.every(c => typeof c === 'string')) {
+        if (accum.every((c) => typeof c === 'string')) {
             return Buffer.from(accum.join(''));
         }
         return Buffer.concat(accum, accumBytes);
@@ -295,7 +297,7 @@ export const clone = (instance, highWaterMark) => {
     if (instance.bodyUsed) {
         throw new Error('cannot clone body after it is used');
     }
-    if ((body instanceof Stream) && (typeof body.getBoundary !== 'function')) {
+    if (body instanceof Stream && typeof body.getBoundary !== 'function') {
         p1 = new PassThrough({ highWaterMark });
         p2 = new PassThrough({ highWaterMark });
         body.pipe(p1);
@@ -385,7 +387,7 @@ function readableStreamToReadable(webStream) {
         },
         destroy(_err, callback) {
             reader.cancel().then(() => callback(null), callback);
-        }
+        },
     });
 }
 /**

package/lib/esm/request.js

@@ -1 +1 @@
-import"./_virtual/_rolldown/runtime.js";import{isAbortSignal as e}from"./utils/is.js";import t,{clone as n,extractContentType as r,getTotalBytes as i}from"./body.js";import a from"./headers.js";import{inputStreamToReadable as o,soupSendAsync as s}from"./utils/soup-helpers.js";import{DEFAULT_REFERRER_POLICY as c,determineRequestsReferrer as l,validateReferrerPolicy as u}from"./utils/referrer.js";import{URL as d}from"@gjsify/url";import f from"@girs/soup-3.0";import p from"@girs/glib-2.0";import m from"@girs/gio-2.0";const h=Symbol(`Request internals`),isRequest=e=>typeof e==`object`&&typeof e.url==`string`;var g=class Request extends t{cache;credentials;destination;get headers(){return this[h].headers}integrity;keepalive;get method(){return this[h].method}mode;get redirect(){return this[h].redirect}get referrer(){if(this[h].referrer===`no-referrer`)return``;if(this[h].referrer===`client`)return`about:client`;if(this[h].referrer)return this[h].referrer.toString()}get referrerPolicy(){return this[h].referrerPolicy}set referrerPolicy(e){this[h].referrerPolicy=u(e)}get signal(){return this[h].signal}get url(){return this[h].parsedURL.toString()}get _uri(){return p.Uri.parse(this.url,p.UriFlags.NONE)}get _session(){return this[h].session}get _message(){return this[h].message}get _inputStream(){return this[h].inputStream}get[Symbol.toStringTag](){return`Request`}[h];follow;compress=!1;counter=0;agent=``;highWaterMark=16384;insecureHTTPParser=!1;constructor(t,i){let o=t,s=i||{},c,l={};if(isRequest(t)?(c=new d(o.url),l=o):c=new d(t),c.username!==``||c.password!==``)throw TypeError(`${c} is an url with embedded credentials.`);let u=s.method||l.method||`GET`;if(/^(delete|get|head|options|post|put)$/i.test(u)&&(u=u.toUpperCase()),(i?.body!=null||isRequest(t)&&o.body!==null)&&(u===`GET`||u===`HEAD`))throw TypeError(`Request with GET/HEAD method cannot have body`);let m=i?.body?i.body:isRequest(t)&&o.body!==null?n(t):null;super(m,{size:s.size||0});let g=new a(i?.headers||o.headers||{});if(m!==null&&!g.has(`Content-Type`)){let e=r(m,this);e&&g.set(`Content-Type`,e)}let _=isRequest(t)?o.signal:null;if(i&&`signal`in i&&(_=i.signal),_!=null&&!e(_))throw TypeError(`Expected signal to be an instanceof AbortSignal or EventTarget`);let v=i?.referrer==null?o.referrer:i.referrer;if(v===``)v=`no-referrer`;else if(v){let e=new d(v);v=/^about:(\/\/)?client$/.test(e.toString())?`client`:e}else v=void 0;let y=c.protocol,b=null,x=null;(y===`http:`||y===`https:`)&&(b=new f.Session,x=new f.Message({method:u,uri:p.Uri.parse(c.toString(),p.UriFlags.NONE)})),this[h]={method:u,redirect:i?.redirect||o.redirect||`follow`,headers:g,parsedURL:c,signal:_,referrer:v,referrerPolicy:``,session:b,message:x},this.follow=s.follow===void 0?o.follow===void 0?20:o.follow:s.follow,this.compress=s.compress===void 0?o.compress===void 0?!0:o.compress:s.compress,this.counter=s.counter||o.counter||0,this.agent=s.agent||o.agent,this.highWaterMark=s.highWaterMark||o.highWaterMark||16384,this.insecureHTTPParser=s.insecureHTTPParser||o.insecureHTTPParser||!1,this.referrerPolicy=i?.referrerPolicy||o.referrerPolicy||``}async _send(e){let{session:t,message:n}=this[h];if(!t||!n)throw Error(`Cannot send request: no Soup session (non-HTTP URL?)`);try{t.remove_feature_by_type(f.ContentDecoder.$gtype)}catch{}e.headers._appendToSoupMessage(n);let r=this._rawBodyBuffer;if(r!==null&&r.byteLength>0){let t=e.headers.get(`content-type`)||null;n.set_request_body_from_bytes(t,new p.Bytes(r))}let i=new m.Cancellable;return this[h].inputStream=await s(t,n,p.PRIORITY_DEFAULT,i),this[h].readable=o(this[h].inputStream),{inputStream:this[h].inputStream,readable:this[h].readable,cancellable:i}}clone(){return new Request(this)}async arrayBuffer(){return super.arrayBuffer()}async blob(){return super.blob()}async formData(){return super.formData()}async json(){return super.json()}async text(){return super.text()}};Object.defineProperties(g.prototype,{method:{enumerable:!0},url:{enumerable:!0},headers:{enumerable:!0},redirect:{enumerable:!0},clone:{enumerable:!0},signal:{enumerable:!0},referrer:{enumerable:!0},referrerPolicy:{enumerable:!0}});const getSoupRequestOptions=e=>{let{parsedURL:t}=e[h],n=new a(e[h].headers);n.has(`Accept`)||n.set(`Accept`,`*/*`);let r=null;if(e.body===null&&/^(post|put)$/i.test(e.method)&&(r=`0`),e.body!==null){let t=i(e);typeof t==`number`&&!Number.isNaN(t)&&(r=String(t))}r&&n.set(`Content-Length`,r),e.referrerPolicy===``&&(e.referrerPolicy=c),e.referrer&&e.referrer!==`no-referrer`?e[h].referrer=l(e):e[h].referrer=`no-referrer`,e[h].referrer instanceof d&&n.set(`Referer`,e.referrer),n.has(`User-Agent`)||n.set(`User-Agent`,`gjsify-fetch`),e.compress&&!n.has(`Accept-Encoding`)&&n.set(`Accept-Encoding`,`gzip, deflate`);let{agent:o}=e;return typeof o==`function`&&(o=o(t)),!n.has(`Connection`)&&!o&&n.set(`Connection`,`close`),{parsedURL:t,options:{headers:n}}};export{g as Request,g as default,getSoupRequestOptions};
+import"./_virtual/_rolldown/runtime.js";import{isAbortSignal as e}from"./utils/is.js";import t,{clone as n,extractContentType as r,getTotalBytes as i}from"./body.js";import a from"./headers.js";import{inputStreamToReadable as o,soupSendAsync as s}from"./utils/soup-helpers.js";import{DEFAULT_REFERRER_POLICY as c,determineRequestsReferrer as l,validateReferrerPolicy as u}from"./utils/referrer.js";import{URL as d}from"@gjsify/url";import f from"@girs/soup-3.0";import p from"@girs/glib-2.0";import m from"@girs/gio-2.0";const h=Symbol(`Request internals`);let g=null;function getSharedSession(){if(g===null){g=new f.Session;try{g.remove_feature_by_type(f.ContentDecoder.$gtype)}catch{}}return g}const isRequest=e=>typeof e==`object`&&typeof e.url==`string`;var _=class Request extends t{cache;credentials;destination;get headers(){return this[h].headers}integrity;keepalive;get method(){return this[h].method}mode;get redirect(){return this[h].redirect}get referrer(){if(this[h].referrer===`no-referrer`)return``;if(this[h].referrer===`client`)return`about:client`;if(this[h].referrer)return this[h].referrer.toString()}get referrerPolicy(){return this[h].referrerPolicy}set referrerPolicy(e){this[h].referrerPolicy=u(e)}get signal(){return this[h].signal}get url(){return this[h].parsedURL.toString()}get _uri(){return p.Uri.parse(this.url,p.UriFlags.NONE)}get _session(){return this[h].session}get _message(){return this[h].message}get _inputStream(){return this[h].inputStream}get[Symbol.toStringTag](){return`Request`}[h];follow;compress=!1;counter=0;agent=``;highWaterMark=16384;insecureHTTPParser=!1;constructor(t,i){let o=t,s=i||{},c,l={};if(isRequest(t)?(c=new d(o.url),l=o):c=new d(t),c.username!==``||c.password!==``)throw TypeError(`${c} is an url with embedded credentials.`);let u=s.method||l.method||`GET`;if(/^(delete|get|head|options|post|put)$/i.test(u)&&(u=u.toUpperCase()),(i?.body!=null||isRequest(t)&&o.body!==null)&&(u===`GET`||u===`HEAD`))throw TypeError(`Request with GET/HEAD method cannot have body`);let m=i?.body?i.body:isRequest(t)&&o.body!==null?n(t):null;super(m,{size:s.size||0});let g=new a(i?.headers||o.headers||{});if(m!==null&&!g.has(`Content-Type`)){let e=r(m,this);e&&g.set(`Content-Type`,e)}let _=isRequest(t)?o.signal:null;if(i&&`signal`in i&&(_=i.signal),_!=null&&!e(_))throw TypeError(`Expected signal to be an instanceof AbortSignal or EventTarget`);let v=i?.referrer==null?o.referrer:i.referrer;if(v===``)v=`no-referrer`;else if(v){let e=new d(v);v=/^about:(\/\/)?client$/.test(e.toString())?`client`:e}else v=void 0;let y=c.protocol,b=null,x=null;(y===`http:`||y===`https:`)&&(b=getSharedSession(),x=new f.Message({method:u,uri:p.Uri.parse(c.toString(),p.UriFlags.NONE)})),this[h]={method:u,redirect:i?.redirect||o.redirect||`follow`,headers:g,parsedURL:c,signal:_,referrer:v,referrerPolicy:``,session:b,message:x},this.follow=s.follow===void 0?o.follow===void 0?20:o.follow:s.follow,this.compress=s.compress===void 0?o.compress===void 0?!0:o.compress:s.compress,this.counter=s.counter||o.counter||0,this.agent=s.agent||o.agent,this.highWaterMark=s.highWaterMark||o.highWaterMark||16384,this.insecureHTTPParser=s.insecureHTTPParser||o.insecureHTTPParser||!1,this.referrerPolicy=i?.referrerPolicy||o.referrerPolicy||``}async _send(e){let{session:t,message:n}=this[h];if(!t||!n)throw Error(`Cannot send request: no Soup session (non-HTTP URL?)`);e.headers._appendToSoupMessage(n);let r=this._rawBodyBuffer;if(r!==null&&r.byteLength>0){let t=e.headers.get(`content-type`)||null;n.set_request_body_from_bytes(t,new p.Bytes(r))}let i=new m.Cancellable;return this[h].inputStream=await s(t,n,p.PRIORITY_DEFAULT,i),this[h].readable=o(this[h].inputStream),{inputStream:this[h].inputStream,readable:this[h].readable,cancellable:i}}clone(){return new Request(this)}async arrayBuffer(){return super.arrayBuffer()}async blob(){return super.blob()}async formData(){return super.formData()}async json(){return super.json()}async text(){return super.text()}};Object.defineProperties(_.prototype,{method:{enumerable:!0},url:{enumerable:!0},headers:{enumerable:!0},redirect:{enumerable:!0},clone:{enumerable:!0},signal:{enumerable:!0},referrer:{enumerable:!0},referrerPolicy:{enumerable:!0}});const getSoupRequestOptions=e=>{let{parsedURL:t}=e[h],n=new a(e[h].headers);n.has(`Accept`)||n.set(`Accept`,`*/*`);let r=null;if(e.body===null&&/^(post|put)$/i.test(e.method)&&(r=`0`),e.body!==null){let t=i(e);typeof t==`number`&&!Number.isNaN(t)&&(r=String(t))}r&&n.set(`Content-Length`,r),e.referrerPolicy===``&&(e.referrerPolicy=c),e.referrer&&e.referrer!==`no-referrer`?e[h].referrer=l(e):e[h].referrer=`no-referrer`,e[h].referrer instanceof d&&n.set(`Referer`,e.referrer),n.has(`User-Agent`)||n.set(`User-Agent`,`gjsify-fetch`),e.compress&&!n.has(`Accept-Encoding`)&&n.set(`Accept-Encoding`,`gzip, deflate`);let{agent:o}=e;return typeof o==`function`&&(o=o(t)),!n.has(`Connection`)&&!o&&n.set(`Connection`,`close`),{parsedURL:t,options:{headers:n}}};export{_ as Request,_ as default,getSoupRequestOptions};

package/lib/esm/utils/referrer.js

@@ -1 +1 @@
-import"../_virtual/_rolldown/runtime.js";import{URL as e}from"@gjsify/url";import{isIP as t}from"node:net";function stripURLForUseAsAReferrer(t,n=!1){if(t==null||t===`no-referrer`)return`no-referrer`;let r=new e(t);return/^(about|blob|data):$/.test(r.protocol)?`no-referrer`:(r.username=``,r.password=``,r.hash=``,n&&(r.pathname=``,r.search=``),r)}const n=new Set([``,`no-referrer`,`no-referrer-when-downgrade`,`same-origin`,`origin`,`strict-origin`,`origin-when-cross-origin`,`strict-origin-when-cross-origin`,`unsafe-url`]),r=`strict-origin-when-cross-origin`;function validateReferrerPolicy(e){if(!n.has(e))throw TypeError(`Invalid referrerPolicy: ${e}`);return e}function isOriginPotentiallyTrustworthy(e){if(/^(http|ws)s:$/.test(e.protocol))return!0;let n=e.host.replace(/(^\[)|(]$)/g,``),r=t(n);return r===4&&/^127\./.test(n)||r===6&&/^(((0+:){7})|(::(0+:){0,6}))0*1$/.test(n)?!0:e.host===`localhost`||e.host.endsWith(`.localhost`)?!1:e.protocol===`file:`}function isUrlPotentiallyTrustworthy(t){return/^about:(blank|srcdoc)$/.test(t.toString())||(typeof t==`string`&&(t=new e(t)),t.protocol===`data:`)||/^(blob|filesystem):$/.test(t.protocol)?!0:isOriginPotentiallyTrustworthy(t)}function determineRequestsReferrer(t,n={}){let{referrerURLCallback:r,referrerOriginCallback:i}=n;if(t.referrer===`no-referrer`||t.referrerPolicy===``)return null;let a=t.referrerPolicy;if(t.referrer===`about:client`)return`no-referrer`;let o=new e(t.referrer),s=stripURLForUseAsAReferrer(o),c=stripURLForUseAsAReferrer(o,!0);s.toString().length>4096&&(s=c),r&&(s=r(s)),i&&(c=i(c));let l=new e(t.url);switch(a){case`no-referrer`:return`no-referrer`;case`origin`:return c;case`unsafe-url`:return s;case`strict-origin`:return isUrlPotentiallyTrustworthy(s)&&!isUrlPotentiallyTrustworthy(l)?`no-referrer`:c.toString();case`strict-origin-when-cross-origin`:return s.origin===l.origin?s:isUrlPotentiallyTrustworthy(s)&&!isUrlPotentiallyTrustworthy(l)?`no-referrer`:c;case`same-origin`:return s.origin===l.origin?s:`no-referrer`;case`origin-when-cross-origin`:return s.origin===l.origin?s:c;case`no-referrer-when-downgrade`:return isUrlPotentiallyTrustworthy(s)&&!isUrlPotentiallyTrustworthy(l)?`no-referrer`:s;default:throw TypeError(`Invalid referrerPolicy: ${a}`)}}function parseReferrerPolicyFromHeader(e){let t=(e.get(`referrer-policy`)||``).split(/[,\s]+/),r=``;for(let e of t)e&&n.has(e)&&(r=e);return r}export{r as DEFAULT_REFERRER_POLICY,n as ReferrerPolicy,determineRequestsReferrer,isOriginPotentiallyTrustworthy,isUrlPotentiallyTrustworthy,parseReferrerPolicyFromHeader,stripURLForUseAsAReferrer,validateReferrerPolicy};
+import"../_virtual/_rolldown/runtime.js";import{URL as e}from"@gjsify/url";import{isIP as t}from"node:net";function stripURLForUseAsAReferrer(t,n=!1){if(t==null||t===`no-referrer`)return`no-referrer`;let r=new e(t);return/^(about|blob|data):$/.test(r.protocol)?`no-referrer`:(r.username=``,r.password=``,r.hash=``,n&&(r.pathname=``,r.search=``),r)}const n=new Set([``,`no-referrer`,`no-referrer-when-downgrade`,`same-origin`,`origin`,`strict-origin`,`origin-when-cross-origin`,`strict-origin-when-cross-origin`,`unsafe-url`]),r=`strict-origin-when-cross-origin`;function validateReferrerPolicy(e){if(!n.has(e))throw TypeError(`Invalid referrerPolicy: ${e}`);return e}function isOriginPotentiallyTrustworthy(e){if(/^(http|ws)s:$/.test(e.protocol))return!0;let n=e.host.replace(/(^\[)|(]$)/g,``),r=t(n);return r===4&&n.startsWith(`127.`)||r===6&&/^(((0+:){7})|(::(0+:){0,6}))0*1$/.test(n)?!0:e.host===`localhost`||e.host.endsWith(`.localhost`)?!1:e.protocol===`file:`}function isUrlPotentiallyTrustworthy(t){return/^about:(blank|srcdoc)$/.test(t.toString())||(typeof t==`string`&&(t=new e(t)),t.protocol===`data:`)||/^(blob|filesystem):$/.test(t.protocol)?!0:isOriginPotentiallyTrustworthy(t)}function determineRequestsReferrer(t,n={}){let{referrerURLCallback:r,referrerOriginCallback:i}=n;if(t.referrer===`no-referrer`||t.referrerPolicy===``)return null;let a=t.referrerPolicy;if(t.referrer===`about:client`)return`no-referrer`;let o=new e(t.referrer),s=stripURLForUseAsAReferrer(o),c=stripURLForUseAsAReferrer(o,!0);s.toString().length>4096&&(s=c),r&&(s=r(s)),i&&(c=i(c));let l=new e(t.url);switch(a){case`no-referrer`:return`no-referrer`;case`origin`:return c;case`unsafe-url`:return s;case`strict-origin`:return isUrlPotentiallyTrustworthy(s)&&!isUrlPotentiallyTrustworthy(l)?`no-referrer`:c.toString();case`strict-origin-when-cross-origin`:return s.origin===l.origin?s:isUrlPotentiallyTrustworthy(s)&&!isUrlPotentiallyTrustworthy(l)?`no-referrer`:c;case`same-origin`:return s.origin===l.origin?s:`no-referrer`;case`origin-when-cross-origin`:return s.origin===l.origin?s:c;case`no-referrer-when-downgrade`:return isUrlPotentiallyTrustworthy(s)&&!isUrlPotentiallyTrustworthy(l)?`no-referrer`:s;default:throw TypeError(`Invalid referrerPolicy: ${a}`)}}function parseReferrerPolicyFromHeader(e){let t=(e.get(`referrer-policy`)||``).split(/[,\s]+/),r=``;for(let e of t)e&&n.has(e)&&(r=e);return r}export{r as DEFAULT_REFERRER_POLICY,n as ReferrerPolicy,determineRequestsReferrer,isOriginPotentiallyTrustworthy,isUrlPotentiallyTrustworthy,parseReferrerPolicyFromHeader,stripURLForUseAsAReferrer,validateReferrerPolicy};

package/lib/headers.js

@@ -54,8 +54,8 @@ export default class Headers {
             }
         }
         else {
-            throw new TypeError('Failed to construct \'Headers\': The provided value is not of type ' +
-                '\'(sequence<sequence<ByteString>> or record<ByteString, ByteString>)\'');
+            throw new TypeError("Failed to construct 'Headers': The provided value is not of type " +
+                "'(sequence<sequence<ByteString>> or record<ByteString, ByteString>)'");
         }
     }
     append(name, value) {

package/lib/index.js

@@ -15,7 +15,7 @@ import { isRedirect } from './utils/is-redirect.js';
 import { FormData } from '@gjsify/formdata';
 import { isDomainOrSubdomain, isSameProtocol } from './utils/is.js';
 import { parseReferrerPolicyFromHeader } from './utils/referrer.js';
-import { Blob, File, } from './utils/blob-from.js';
+import { Blob, File } from './utils/blob-from.js';
 import { URL } from '@gjsify/url';
 export { FormData, Headers, Request, Response, FetchError, AbortError, isRedirect };
 export { Blob, File };
@@ -30,9 +30,7 @@ function rewriteRootRelativeUrl(input) {
     const DEBUG = _g.__GJSIFY_DEBUG_FETCH === true;
     try {
         // GJS-only: derive program dir from System.programInvocationName.
-        const programPath = _g.imports?.system?.programPath
-            ?? _g.imports?.system?.programInvocationName
-            ?? '';
+        const programPath = _g.imports?.system?.programPath ?? _g.imports?.system?.programInvocationName ?? '';
         if (!programPath)
             return input;
         const dir = GLib.path_get_dirname(programPath);
@@ -136,7 +134,7 @@ export default async function fetch(url, init = {}) {
         readable.destroy(new AbortError('The operation was aborted.'));
     });
     // Handle stream errors
-    readable.on('error', (error) => {
+    readable.on('error', (_error) => {
         finalize();
         // Error is consumed by the body when read
     });
@@ -183,7 +181,7 @@ export default async function fetch(url, init = {}) {
                     signal: request.signal,
                     size: request.size,
                     referrer: request.referrer,
-                    referrerPolicy: request.referrerPolicy
+                    referrerPolicy: request.referrerPolicy,
                 };
                 // Don't forward sensitive headers to different domains/protocols
                 if (!isDomainOrSubdomain(request.url, locationURL) || !isSameProtocol(request.url, locationURL)) {
@@ -222,7 +220,7 @@ export default async function fetch(url, init = {}) {
         headers,
         size: request.size,
         counter: request.counter,
-        highWaterMark: request.highWaterMark
+        highWaterMark: request.highWaterMark,
     };
     // Handle content encoding (decompression)
     const codings = headers.get('Content-Encoding');
@@ -232,7 +230,11 @@ export default async function fetch(url, init = {}) {
     // 3. no Content-Encoding header
     // 4. no content response (204)
     // 5. content not modified response (304)
-    if (!request.compress || request.method === 'HEAD' || codings === null || statusCode === 204 || statusCode === 304) {
+    if (!request.compress ||
+        request.method === 'HEAD' ||
+        codings === null ||
+        statusCode === 204 ||
+        statusCode === 304) {
         finalize();
         return new Response(readable, responseOptions);
     }

package/lib/index.spec.js

@@ -7,7 +7,7 @@ import { describe, it, expect, on } from '@gjsify/unit';
 export default async () => {
     await describe('fetch', async () => {
         await it('fetch should be a function', async () => {
-            expect(typeof fetch).toBe("function");
+            expect(typeof fetch).toBe('function');
         });
     });
     await describe('Headers', async () => {
@@ -37,7 +37,10 @@ export default async () => {
             expect(h.has('x-remove')).toBe(false);
         });
         await it('should construct from array pairs', async () => {
-            const h = new Headers([['a', '1'], ['b', '2']]);
+            const h = new Headers([
+                ['a', '1'],
+                ['b', '2'],
+            ]);
             expect(h.get('a')).toBe('1');
             expect(h.get('b')).toBe('2');
         });
@@ -71,15 +74,17 @@ export default async () => {
     });
     await describe('Headers forEach', async () => {
         await it('should iterate all headers with forEach', async () => {
-            const h = new Headers({ 'a': '1', 'b': '2' });
+            const h = new Headers({ a: '1', b: '2' });
             const collected = [];
-            h.forEach((value, key) => { collected.push(`${key}:${value}`); });
+            h.forEach((value, key) => {
+                collected.push(`${key}:${value}`);
+            });
             expect(collected.length).toBe(2);
             expect(collected[0]).toBe('a:1');
             expect(collected[1]).toBe('b:2');
         });
         await it('should return correct values() iterator', async () => {
-            const h = new Headers({ 'x': 'hello', 'y': 'world' });
+            const h = new Headers({ x: 'hello', y: 'world' });
             const values = [...h.values()];
             expect(values.length).toBe(2);
         });
@@ -93,7 +98,7 @@ export default async () => {
             expect(entries[1][0]).toBe('x-custom');
         });
         await it('should support spread operator', async () => {
-            const h = new Headers({ 'a': '1' });
+            const h = new Headers({ a: '1' });
             const arr = [...h];
             expect(arr.length).toBe(1);
             expect(arr[0][0]).toBe('a');
@@ -108,7 +113,7 @@ export default async () => {
             expect(() => h.append('invalid header', 'value')).toThrow();
         });
         await it('should support entries() for destructuring', async () => {
-            const h = new Headers({ 'host': 'example.com', 'accept': '*/*' });
+            const h = new Headers({ host: 'example.com', accept: '*/*' });
             const obj = {};
             for (const [k, v] of h.entries())
                 obj[k] = v;
@@ -128,7 +133,7 @@ export default async () => {
         });
         await it('should set custom headers', async () => {
             const r = new Request('https://example.com', {
-                headers: { 'X-Custom': 'test' }
+                headers: { 'X-Custom': 'test' },
             });
             expect(r.headers.get('x-custom')).toBe('test');
         });
@@ -178,7 +183,7 @@ export default async () => {
         });
         await it('should parse json body', async () => {
             const r = new Response('{"key": "value"}');
-            const json = await r.json();
+            const json = (await r.json());
             expect(json.key).toBe('value');
         });
         await it('should parse arrayBuffer body', async () => {
@@ -207,7 +212,7 @@ export default async () => {
             expect(r.status).toBe(200);
             const ct = r.headers.get('content-type') || '';
             expect(ct.includes('application/json')).toBe(true);
-            const data = await r.json();
+            const data = (await r.json());
             expect(data.message).toBe('ok');
         });
         await it('should clone a response', async () => {
@@ -265,22 +270,30 @@ export default async () => {
                 xhr.send();
             });
             await it('responseType="arraybuffer" yields ArrayBuffer', async () => {
-                const xhr = await runXhr((x) => { x.responseType = 'arraybuffer'; });
+                const xhr = await runXhr((x) => {
+                    x.responseType = 'arraybuffer';
+                });
                 expect(xhr.response instanceof ArrayBuffer).toBe(true);
                 expect(xhr.response.byteLength).toBe(5);
             });
             await it('responseType="text" yields decoded string', async () => {
-                const xhr = await runXhr((x) => { x.responseType = 'text'; });
+                const xhr = await runXhr((x) => {
+                    x.responseType = 'text';
+                });
                 expect(xhr.response).toBe('hello');
                 expect(xhr.responseText).toBe('hello');
             });
             await it('default responseType "" yields text', async () => {
-                const xhr = await runXhr(() => { });
+                const xhr = await runXhr(() => {
+                    /* responseType left at "" */
+                });
                 expect(xhr.response).toBe('hello');
                 expect(xhr.responseText).toBe('hello');
             });
             await it('responseType="blob" attaches _tmpPath for URL.createObjectURL', async () => {
-                const xhr = await runXhr((x) => { x.responseType = 'blob'; });
+                const xhr = await runXhr((x) => {
+                    x.responseType = 'blob';
+                });
                 const blob = xhr.response;
                 expect(blob instanceof Blob).toBe(true);
                 expect(typeof blob._tmpPath).toBe('string');

package/lib/request.d.ts

@@ -2,8 +2,8 @@ import GLib from '@girs/glib-2.0';
 import Soup from '@girs/soup-3.0';
 import Gio from '@girs/gio-2.0';
 import { URL } from '@gjsify/url';
-import { Blob } from './utils/blob-from.js';
-import { Readable } from 'node:stream';
+import type { Blob } from './utils/blob-from.js';
+import type { Readable } from 'node:stream';
 import Headers from './headers.js';
 import Body from './body.js';
 import type { FormData } from '@gjsify/formdata';

package/lib/request.js

@@ -12,12 +12,61 @@ import Body, { clone, extractContentType, getTotalBytes } from './body.js';
 import { isAbortSignal } from './utils/is.js';
 import { validateReferrerPolicy, determineRequestsReferrer, DEFAULT_REFERRER_POLICY } from './utils/referrer.js';
 const INTERNALS = Symbol('Request internals');
+/**
+ * Process-wide shared `Soup.Session`.
+ *
+ * Why a singleton and not a fresh `new Soup.Session()` per request:
+ *
+ * libsoup's connection manager keeps each open connection registered on a
+ * per-host list (`SoupHost.conns`). That list is only emptied when the
+ * connection's `disconnected` signal is processed on the main loop. When a
+ * `Soup.Session` is *finalized* its connection manager is torn down
+ * (`soup_connection_manager_free` → `soup_host_free`), which asserts the host
+ * has no live connections — `g_warn_if_fail (host->conns == NULL)`. If a
+ * session is dropped while a connection is still registered (the disconnect
+ * hasn't been pumped yet), libsoup prints:
+ *
+ *     (gjs:…): libsoup-CRITICAL **: runtime check failed: (host->conns == NULL)
+ *
+ * Under GJS this is a SpiderMonkey-GC race: a per-request session (the old
+ * behavior — one `new Soup.Session()` per `Request`) becomes garbage as soon as
+ * the `Response` body is read, and a GC sweep can finalize it on the very same
+ * turn the connection is still being cleaned up. The same class of GLib/Soup
+ * BoxedInstance GC race is mitigated elsewhere in gjsify (e.g. `@gjsify/timers`
+ * uses `GLib.timeout_add` instead of holding `GLib.Source` boxed instances).
+ *
+ * Holding one long-lived session at module scope keeps it permanently reachable
+ * (never GC-finalized for the lifetime of the program), so the teardown path
+ * that fires the assertion is never reached mid-flight. It also lets libsoup
+ * pool and reuse keep-alive connections across requests — a real win for
+ * heavy fetch users like `@gjsify/npm-registry` during `gjsify install`.
+ *
+ * Lazily created so merely importing `@gjsify/fetch` (e.g. for `Headers`/
+ * `Request`/`Response` types on Node, or in a browser bundle) does not
+ * instantiate a Soup object.
+ */
+let sharedSession = null;
+function getSharedSession() {
+    if (sharedSession === null) {
+        sharedSession = new Soup.Session();
+        // Soup auto-adds a ContentDecoder to new sessions, but it decodes the
+        // body without removing the Content-Encoding header, causing
+        // double-decompression when index.ts also runs DecompressionStream.
+        // Remove it once here so our JS-level decompression handles everything.
+        try {
+            sharedSession.remove_feature_by_type(Soup.ContentDecoder.$gtype);
+        }
+        catch {
+            /* not present */
+        }
+    }
+    return sharedSession;
+}
 /**
  * Check if `obj` is an instance of Request.
  */
 const isRequest = (obj) => {
-    return (typeof obj === 'object' &&
-        typeof obj.url === 'string');
+    return typeof obj === 'object' && typeof obj.url === 'string';
 };
 /** This Fetch API interface represents a resource request. */
 export class Request extends Body {
@@ -124,9 +173,13 @@ export class Request extends Body {
             (method === 'GET' || method === 'HEAD')) {
             throw new TypeError('Request with GET/HEAD method cannot have body');
         }
-        const inputBody = init?.body ? init.body : (isRequest(input) && inputRL.body !== null ? clone(input) : null);
+        const inputBody = init?.body
+            ? init.body
+            : isRequest(input) && inputRL.body !== null
+                ? clone(input)
+                : null;
         super(inputBody, {
-            size: initRL.size || 0
+            size: initRL.size || 0,
         });
         const headers = new Headers((init?.headers || inputRL.headers || {}));
         if (inputBody !== null && !headers.has('Content-Type')) {
@@ -135,9 +188,7 @@ export class Request extends Body {
                 headers.set('Content-Type', contentType);
             }
         }
-        let signal = isRequest(input) ?
-            inputRL.signal :
-            null;
+        let signal = isRequest(input) ? inputRL.signal : null;
         if (init && 'signal' in init) {
             signal = init.signal;
         }
@@ -164,7 +215,11 @@ export class Request extends Body {
         let session = null;
         let message = null;
         if (scheme === 'http:' || scheme === 'https:') {
-            session = new Soup.Session();
+            // Reuse the process-wide shared session (see getSharedSession docs):
+            // a per-request session that gets GC-finalized while a connection is
+            // still registered on its host triggers libsoup's
+            // `host->conns == NULL` CRITICAL.
+            session = getSharedSession();
             message = new Soup.Message({
                 method,
                 uri: GLib.Uri.parse(parsedURL.toString(), GLib.UriFlags.NONE),
@@ -182,8 +237,14 @@ export class Request extends Body {
             message,
         };
         // Node-fetch-only options
-        this.follow = initRL.follow === undefined ? (inputRL.follow === undefined ? 20 : inputRL.follow) : initRL.follow;
-        this.compress = initRL.compress === undefined ? (inputRL.compress === undefined ? true : inputRL.compress) : initRL.compress;
+        this.follow =
+            initRL.follow === undefined ? (inputRL.follow === undefined ? 20 : inputRL.follow) : initRL.follow;
+        this.compress =
+            initRL.compress === undefined
+                ? inputRL.compress === undefined
+                    ? true
+                    : inputRL.compress
+                : initRL.compress;
         this.counter = initRL.counter || inputRL.counter || 0;
         this.agent = initRL.agent || inputRL.agent;
         this.highWaterMark = initRL.highWaterMark || inputRL.highWaterMark || 16384;
@@ -200,14 +261,9 @@ export class Request extends Body {
         if (!session || !message) {
             throw new Error('Cannot send request: no Soup session (non-HTTP URL?)');
         }
-        // Soup auto-adds ContentDecoder to new sessions, but it decodes the body
-        // without removing the Content-Encoding header, causing double-decompression
-        // if we also run DecompressionStream below. Remove it so our JS-level
-        // decompression in index.ts handles everything correctly.
-        try {
-            session.remove_feature_by_type(Soup.ContentDecoder.$gtype);
-        }
-        catch { /* not present */ }
+        // ContentDecoder is removed once on the shared session in
+        // getSharedSession() (so the Content-Encoding header survives for our
+        // JS-level DecompressionStream in index.ts). Nothing per-request here.
         options.headers._appendToSoupMessage(message);
         // Attach the request body to the Soup message (needed for POST/PUT/PATCH).
         // Use _rawBodyBuffer to read the body without consuming the stream (the
@@ -224,7 +280,7 @@ export class Request extends Body {
         return {
             inputStream: this[INTERNALS].inputStream,
             readable: this[INTERNALS].readable,
-            cancellable
+            cancellable,
         };
     }
     /**
@@ -257,7 +313,7 @@ Object.defineProperties(Request.prototype, {
     clone: { enumerable: true },
     signal: { enumerable: true },
     referrer: { enumerable: true },
-    referrerPolicy: { enumerable: true }
+    referrerPolicy: { enumerable: true },
 });
 export default Request;
 /**
@@ -322,6 +378,6 @@ export const getSoupRequestOptions = (request) => {
     };
     return {
         parsedURL,
-        options
+        options,
     };
 };

package/lib/response.d.ts

@@ -1,7 +1,7 @@
 import Gio from '@girs/gio-2.0';
 import Headers from './headers.js';
 import Body from './body.js';
-import { Blob } from './utils/blob-from.js';
+import type { Blob } from './utils/blob-from.js';
 import type { Readable } from 'node:stream';
 declare const INTERNALS: unique symbol;
 interface ResponseOptions {

package/lib/response.js

@@ -38,7 +38,7 @@ export class Response extends Body {
             statusText: options.statusText || '',
             headers,
             counter: options.counter,
-            highWaterMark: options.highWaterMark
+            highWaterMark: options.highWaterMark,
         };
     }
     get type() {
@@ -83,7 +83,7 @@ export class Response extends Body {
             ok: this.ok,
             redirected: this.redirected,
             size: this.size,
-            highWaterMark: this.highWaterMark
+            highWaterMark: this.highWaterMark,
         });
     }
     /**
@@ -97,9 +97,9 @@ export class Response extends Body {
         }
         return new Response(null, {
             headers: {
-                location: new URL(url).toString()
+                location: new URL(url).toString(),
             },
-            status
+            status,
         });
     }
     static error() {
@@ -153,6 +153,6 @@ Object.defineProperties(Response.prototype, {
     redirected: { enumerable: true },
     statusText: { enumerable: true },
     headers: { enumerable: true },
-    clone: { enumerable: true }
+    clone: { enumerable: true },
 });
 export default Response;

package/lib/soup-session.gjs.spec.d.ts

@@ -0,0 +1,2 @@
+declare const _default: () => Promise<void>;
+export default _default;

package/lib/soup-session.gjs.spec.js

@@ -0,0 +1,118 @@
+// Soup.Session lifecycle for GJS for @gjsify/fetch — original regression test.
+//
+// Regression: @gjsify/fetch used to create a fresh `new Soup.Session()` inside
+// every Request constructor. Once the Response body was read, that per-request
+// session became unreachable and SpiderMonkey could finalize it on the next GC
+// sweep while a libsoup connection was still registered on its host. libsoup's
+// connection-manager teardown then asserted `host->conns == NULL` and printed:
+//
+//   (gjs:…): libsoup-CRITICAL **: runtime check failed: (host->conns == NULL)
+//
+// on stderr during heavy fetch use (notably @gjsify/npm-registry's packument/
+// tarball fetches inside `gjsify install`). The fix holds ONE process-wide
+// `Soup.Session` at module scope so it is never GC-finalized mid-flight.
+//
+// This file is GJS-only (`.gjs.spec.ts`). The suite body runs under
+// `on('Gjs', …)`, so it is a no-op on Node. To keep the Node bundle free of
+// `gi://*` / `system` imports (the same `test.mts` aggregator drives
+// `test:node`), all GJS runtime objects are read from `globalThis.imports`
+// (the GJS bootstrap) rather than statically imported — type-only imports give
+// us the real shapes at compile time and are stripped at runtime.
+import { describe, it, expect, on } from '@gjsify/unit';
+export default async () => {
+    await on('Gjs', async () => {
+        // Read GJS runtime objects lazily (no static gi:// import → Node bundle
+        // stays clean). `imports` is the GJS bootstrap global.
+        const gjs = globalThis.imports;
+        const Soup = gjs.gi.Soup;
+        const GLib = gjs.gi.GLib;
+        const Gio = gjs.gi.Gio;
+        const System = gjs.system;
+        // Request + fetch are installed as globals by `@gjsify/fetch/register`,
+        // pulled into the test bundle by test.mts.
+        const RequestCtor = globalThis.Request;
+        const fetchFn = globalThis.fetch;
+        await describe('@gjsify/fetch — Soup.Session lifecycle (host->conns regression)', async () => {
+            await it('reuses one shared Soup.Session across HTTP requests (no per-request session)', () => {
+                // Two distinct HTTP Requests must share the very same Soup.Session
+                // instance. A per-request session is what triggered the GC race;
+                // a shared singleton can never be finalized while in use.
+                const a = new RequestCtor('http://example.com/a');
+                const b = new RequestCtor('https://example.org/b');
+                expect(a._session).toBeTruthy();
+                expect(b._session).toBeTruthy();
+                expect(a._session === b._session).toBe(true);
+                expect(a._session instanceof Soup.Session).toBe(true);
+            });
+            await it('non-HTTP requests do not allocate a Soup.Session', () => {
+                const dataReq = new RequestCtor('data:text/plain,hi');
+                expect(dataReq._session).toBeNull();
+            });
+            await it('many fetches + GC against a local server emit no host->conns / libsoup-CRITICAL warning', async () => {
+                // Exercise the live fetch path in-process first (the exact
+                // lifecycle: fetch → read body → drop refs → GC).
+                const server = new Soup.Server({});
+                server.add_handler(null, (_srv, msg) => {
+                    msg.set_status(200, null);
+                    msg.set_response('application/json', Soup.MemoryUse.COPY, new TextEncoder().encode('{"ok":true}'));
+                });
+                server.listen_local(0, Soup.ServerListenOptions.IPV4_ONLY);
+                const base = server.get_uris()[0].to_string();
+                for (let i = 0; i < 12; i++) {
+                    const res = await fetchFn(base);
+                    await res.json();
+                    System.gc();
+                }
+                System.gc();
+                System.gc();
+                // Stronger assertion: run the same loop in a child gjs process and
+                // capture its stderr, so we can assert the libsoup warning is
+                // absent (GJS cannot redirect its own fd 2). The worker imports
+                // this package's built bundle by absolute path. If the bundle is
+                // not built (running specs from src only), skip the subprocess —
+                // the shared-session invariant above is the load-bearing check.
+                const pkgRoot = GLib.path_get_dirname(GLib.path_get_dirname(GLib.filename_from_uri(import.meta.url)[0]));
+                const fetchEntry = `${pkgRoot}/lib/esm/index.js`;
+                if (!GLib.file_test(fetchEntry, GLib.FileTest.EXISTS)) {
+                    expect(true).toBe(true);
+                    return;
+                }
+                const worker = `
+                    imports.gi.versions.Soup = '3.0';
+                    const { Soup, GLib } = imports.gi;
+                    const System = imports.system;
+                    const { default: fetch } = await import(${JSON.stringify('file://' + fetchEntry)});
+                    const server = new Soup.Server({});
+                    server.add_handler(null, (_s, msg) => {
+                        msg.set_status(200, null);
+                        msg.set_response('application/json', Soup.MemoryUse.COPY,
+                            new TextEncoder().encode('{"ok":true}'));
+                    });
+                    server.listen_local(0, Soup.ServerListenOptions.IPV4_ONLY);
+                    const base = server.get_uris()[0].to_string();
+                    for (let i = 0; i < 20; i++) {
+                        const res = await fetch(base);
+                        await res.json();
+                        System.gc();
+                    }
+                    System.gc(); System.gc();
+                `;
+                const proc = Gio.Subprocess.new(['gjs', '-m', '-c', worker], Gio.SubprocessFlags.STDERR_PIPE | Gio.SubprocessFlags.STDOUT_SILENCE);
+                const stderrBytes = await new Promise((resolve, reject) => {
+                    proc.communicate_async(null, null, (p, r) => {
+                        try {
+                            const [, , stderr] = p.communicate_finish(r);
+                            resolve(stderr ? stderr.toArray() : new Uint8Array());
+                        }
+                        catch (e) {
+                            reject(e instanceof Error ? e : new Error(String(e)));
+                        }
+                    });
+                });
+                const stderr = new TextDecoder().decode(stderrBytes);
+                expect(stderr.includes('host->conns')).toBe(false);
+                expect(stderr.includes('libsoup-CRITICAL')).toBe(false);
+            });
+        });
+    });
+};

package/lib/types/system-error.js

@@ -1,2 +1 @@
-;
 export {};

package/lib/utils/blob-from.d.ts

@@ -1,2 +1,2 @@
 import { Blob, File } from 'node:buffer';
-export { Blob, File, };
+export { Blob, File };

package/lib/utils/blob-from.js

@@ -1,4 +1,4 @@
 // Re-export Blob/File from buffer (which provides the polyfill on GJS)
 // Reference: Node.js buffer.Blob (available since v18)
 import { Blob, File } from 'node:buffer';
-export { Blob, File, };
+export { Blob, File };

package/lib/utils/is-redirect.js

@@ -5,6 +5,6 @@ const redirectStatus = new Set([301, 302, 303, 307, 308]);
  * @param {number} code - Status code
  * @return {boolean}
  */
-export const isRedirect = code => {
+export const isRedirect = (code) => {
     return redirectStatus.has(code);
 };

package/lib/utils/is.d.ts

@@ -1,4 +1,4 @@
-import { Blob } from './blob-from.js';
+import type { Blob } from './blob-from.js';
 /**
  * Check if `obj` is a URLSearchParams object
  * ref: https://github.com/node-fetch/node-fetch/issues/296#issuecomment-307598143

package/lib/utils/is.js

@@ -11,7 +11,7 @@ const NAME = Symbol.toStringTag;
  * @param {*} object - Object to check for
  * @return {boolean}
  */
-export const isURLSearchParameters = object => {
+export const isURLSearchParameters = (object) => {
     return (typeof object === 'object' &&
         typeof object.append === 'function' &&
         typeof object.delete === 'function' &&
@@ -44,8 +44,7 @@ export const isAbortSignal = (object) => {
     if (typeof object !== 'object' || object === null)
         return false;
     const obj = object;
-    return (obj[NAME] === 'AbortSignal' ||
-        obj[NAME] === 'EventTarget');
+    return obj[NAME] === 'AbortSignal' || obj[NAME] === 'EventTarget';
 };
 /**
  * isDomainOrSubdomain reports whether sub is a subdomain (or exact match) of

package/lib/utils/multipart-parser.js

@@ -29,7 +29,7 @@ var S;
 let f = 1;
 const F = {
     PART_BOUNDARY: f,
-    LAST_BOUNDARY: f *= 2
+    LAST_BOUNDARY: (f *= 2),
 };
 const LF = 10;
 const CR = 13;
@@ -38,7 +38,7 @@ const HYPHEN = 45;
 const COLON = 58;
 const A = 97;
 const Z = 122;
-const lower = c => c | 0x20;
+const lower = (c) => c | 0x20;
 const noop = (..._args) => { };
 class MultipartParser {
     index = 0;

package/lib/utils/referrer.d.ts

@@ -1,5 +1,5 @@
 import { URL } from '@gjsify/url';
-import Request from '../request.js';
+import type Request from '../request.js';
 /**
  * @external URL
  * @see {@link https://developer.mozilla.org/en-US/docs/Web/API/URL URL}
@@ -13,7 +13,7 @@ import Request from '../request.js';
  * @param url
  * @param originOnly
  */
-export declare function stripURLForUseAsAReferrer(url: null | URL | "no-referrer", originOnly?: boolean): URL | "no-referrer";
+export declare function stripURLForUseAsAReferrer(url: null | URL | 'no-referrer', originOnly?: boolean): URL | "no-referrer";
 /**
  * @see {@link https://w3c.github.io/webappsec-referrer-policy/#enumdef-referrerpolicy enum ReferrerPolicy}
  */

package/lib/utils/referrer.js

@@ -15,7 +15,8 @@ import { isIP } from 'node:net';
  */
 export function stripURLForUseAsAReferrer(url, originOnly = false) {
     // 1. If url is null, return no referrer.
-    if (url == null || url === "no-referrer") { // eslint-disable-line no-eq-null, eqeqeq
+    if (url == null || url === 'no-referrer') {
+        // eslint-disable-line no-eq-null, eqeqeq
         return 'no-referrer';
     }
     const u = new URL(url);
@@ -55,7 +56,7 @@ export const ReferrerPolicy = new Set([
     'strict-origin',
     'origin-when-cross-origin',
     'strict-origin-when-cross-origin',
-    'unsafe-url'
+    'unsafe-url',
 ]);
 /**
  * @see {@link https://w3c.github.io/webappsec-referrer-policy/#default-referrer-policy default referrer policy}
@@ -89,7 +90,7 @@ export function isOriginPotentiallyTrustworthy(url) {
     // 4. If origin's host component matches one of the CIDR notations 127.0.0.0/8 or ::1/128 [RFC4632], return "Potentially Trustworthy".
     const hostIp = url.host.replace(/(^\[)|(]$)/g, '');
     const hostIPVersion = isIP(hostIp);
-    if (hostIPVersion === 4 && /^127\./.test(hostIp)) {
+    if (hostIPVersion === 4 && hostIp.startsWith('127.')) {
         return true;
     }
     if (hostIPVersion === 6 && /^(((0+:){7})|(::(0+:){0,6}))0*1$/.test(hostIp)) {

package/lib/utils/soup-helpers.d.ts

@@ -1,5 +1,5 @@
-import Gio from '@girs/gio-2.0';
-import Soup from '@girs/soup-3.0';
+import type Gio from '@girs/gio-2.0';
+import type Soup from '@girs/soup-3.0';
 import { Readable } from 'node:stream';
 import type { ReadableOptions } from 'node:stream';
 /**

package/lib/xhr.js

@@ -43,10 +43,7 @@ function guessBlobExt(url) {
     }
 }
 function writeBlobToTempFile(bytes, url) {
-    const tmpPath = GLib.build_filenamev([
-        GLib.get_tmp_dir(),
-        `gjsify-blob-${_blobCounter++}${guessBlobExt(url)}`,
-    ]);
+    const tmpPath = GLib.build_filenamev([GLib.get_tmp_dir(), `gjsify-blob-${_blobCounter++}${guessBlobExt(url)}`]);
     GLib.file_set_contents(tmpPath, bytes);
     return tmpPath;
 }
@@ -119,7 +116,9 @@ export class XMLHttpRequest extends EventTarget {
         if (this._aborted)
             return;
         const headersInit = {};
-        this._headers.forEach((v, k) => { headersInit[k] = v; });
+        this._headers.forEach((v, k) => {
+            headersInit[k] = v;
+        });
         const fetchOptions = {
             method: this._method,
             headers: headersInit,
@@ -198,7 +197,7 @@ export class XMLHttpRequest extends EventTarget {
                     const text = await res.text();
                     // Strip UTF-8 BOM (U+FEFF) — browsers do this automatically; required
                     // for JSON.parse to succeed on BOM-prefixed JSON responses.
-                    const stripped = text.charCodeAt(0) === 0xFEFF ? text.slice(1) : text;
+                    const stripped = text.charCodeAt(0) === 0xfeff ? text.slice(1) : text;
                     this.responseText = stripped;
                     this.response = stripped;
                     break;
@@ -248,7 +247,9 @@ export class XMLHttpRequest extends EventTarget {
         if (this.onloadend)
             this.onloadend(new ProgressEvent('loadend'));
     }
-    overrideMimeType(_mime) { }
+    overrideMimeType(_mime) {
+        /* no-op */
+    }
     _onTimeout() {
         if (this._aborted)
             return;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gjsify/fetch",
-    "version": "0.4.28",
+    "version": "0.4.30",
     "description": "Web and Node.js fetch module for Gjs",
     "module": "lib/esm/index.js",
     "types": "lib/index.d.ts",
@@ -48,8 +48,8 @@
         "fetch"
     ],
     "devDependencies": {
-        "@gjsify/cli": "^0.4.28",
-        "@gjsify/unit": "^0.4.28",
+        "@gjsify/cli": "^0.4.30",
+        "@gjsify/unit": "^0.4.30",
         "@types/node": "^25.9.1",
         "typescript": "^6.0.3"
     },
@@ -58,9 +58,9 @@
         "@girs/gjs": "4.0.1",
         "@girs/glib-2.0": "2.88.0-4.0.1",
         "@girs/soup-3.0": "3.6.6-4.0.1",
-        "@gjsify/formdata": "^0.4.28",
-        "@gjsify/http": "^0.4.28",
-        "@gjsify/url": "^0.4.28",
-        "@gjsify/utils": "^0.4.28"
+        "@gjsify/formdata": "^0.4.30",
+        "@gjsify/http": "^0.4.30",
+        "@gjsify/url": "^0.4.30",
+        "@gjsify/utils": "^0.4.30"
     }
 }