@gjsify/fetch 0.52.0 → 0.54.0

package/lib/esm/index.js

@@ -1 +1 @@
-import"./_virtual/_rolldown/runtime.js";import{Blob as e,File as t}from"./utils/blob-from.js";import{FetchError as n}from"./errors/fetch-error.js";import{isDomainOrSubdomain as r,isSameProtocol as i}from"./utils/is.js";import{clone as a}from"./body.js";import{AbortError as o}from"./errors/abort-error.js";import s from"./headers.js";import{parseDataUri as c}from"./utils/data-uri.js";import{resolveRootRelativeUrl as l}from"./utils/root-relative-system.js";import{isRedirect as u}from"./utils/is-redirect.js";import{Response as d}from"./response.js";import{loadSoup as f}from"./utils/soup-lazy.js";import{parseReferrerPolicyFromHeader as p}from"./utils/referrer.js";import{Request as m,getSoupRequestOptions as h}from"./request.js";import{XMLHttpRequest as g,XMLHttpRequestUpload as _}from"./xhr.js";import{URL as v}from"@gjsify/url";import y from"node:stream";import{FormData as b}from"@gjsify/formdata";import x from"@girs/glib-2.0";const S=new Set([`data:`,`http:`,`https:`,`file:`]);function rewriteFetchInput(e){if(typeof e!=`string`)return e;let t=l(e);return t!==e&&globalThis.__GJSIFY_DEBUG_FETCH===!0&&console.log(`[fetch] rewrite ${e} → ${t}`),t}async function fetch(t,l={}){t=rewriteFetchInput(t);let g=new m(t,l),{parsedURL:_,options:b}=h(g);if(!S.has(_.protocol))throw TypeError(`@gjsify/fetch cannot load ${t}. URL scheme "${_.protocol.replace(/:$/,``)}" is not supported.`);if(_.protocol===`data:`){let{buffer:e,typeFull:t}=c(g.url);return new d(Buffer.from(e),{headers:{"Content-Type":t}})}if(_.protocol===`file:`){let e=globalThis.__GJSIFY_DEBUG_FETCH===!0;e&&console.log(`[fetch] file:// ${g.url}`);try{let t=x.filename_from_uri(g.url)[0];e&&console.log(`[fetch] file:// path=${t}`);let[r,i]=x.file_get_contents(t);if(e&&console.log(`[fetch] file:// ok=${r} bytes=${i?.byteLength??`?`}`),!r)throw new n(`Failed to read file: ${t}`,`system`);let a=i,o=new Uint8Array(a.byteLength);o.set(a);let s=new d(o);return e&&console.log(`[fetch] file:// response created`),s}catch(t){let r=t instanceof Error?t:Error(String(t));throw e&&console.warn(`[fetch] file:// FAIL: ${r.message}`),new n(`request to ${g.url} failed, reason: ${r.message}`,`system`,r)}}let{signal:C}=g;if(C&&C.aborted)throw new o(`The operation was aborted.`);let w,T;try{let e=await g._send(b);w=e.readable,T=e.cancellable}catch(e){if(C&&C.aborted)throw new o(`The operation was aborted.`);let t=e instanceof Error?e:Error(String(e));throw new n(`request to ${g.url} failed, reason: ${t.message}`,`system`,t)}let abortHandler=()=>{T.cancel()};C&&C.addEventListener(`abort`,abortHandler,{once:!0});let finalize=()=>{C&&C.removeEventListener(`abort`,abortHandler)};T.connect(()=>{w.destroy(new o(`The operation was aborted.`))}),w.on(`error`,e=>{finalize()});let E=g._message,D=await f(),O=s._newFromSoupMessage(D,E),k=E.status_code,A=E.get_reason_phrase();if(u(k)){let e=O.get(`Location`),t=null;try{t=e===null?null:new v(e,g.url)}catch{if(g.redirect!==`manual`)throw finalize(),new n(`uri requested responds with an invalid redirect URL: ${e}`,`invalid-redirect`)}switch(g.redirect){case`error`:throw finalize(),new n(`uri requested responds with a redirect, redirect mode is set to error: ${g.url}`,`no-redirect`);case`manual`:break;case`follow`:{if(t===null)break;if(g.counter>=g.follow)throw finalize(),new n(`maximum redirect reached at: ${g.url}`,`max-redirect`);let e={headers:new s(g.headers),follow:g.follow,counter:g.counter+1,agent:g.agent,compress:g.compress,method:g.method,body:a(g),signal:g.signal,size:g.size,referrer:g.referrer,referrerPolicy:g.referrerPolicy};if(!r(g.url,t)||!i(g.url,t))for(let t of[`authorization`,`www-authenticate`,`cookie`,`cookie2`])e.headers.delete(t);if(k!==303&&g.body&&l.body instanceof y.Readable)throw finalize(),new n(`Cannot follow redirect with body being a readable stream`,`unsupported-redirect`);(k===303||(k===301||k===302)&&g.method===`POST`)&&(e.method=`GET`,e.body=void 0,e.headers.delete(`content-length`));let o=p(O);return o&&(e.referrerPolicy=o),finalize(),fetch(new m(t,e))}default:throw TypeError(`Redirect option '${g.redirect}' is not a valid value of RequestRedirect`)}}let j={url:g.url,status:k,statusText:A,headers:O,size:g.size,counter:g.counter,highWaterMark:g.highWaterMark},M=O.get(`Content-Encoding`);if(!g.compress||g.method===`HEAD`||M===null||k===204||k===304)return finalize(),new d(w,j);if(typeof DecompressionStream<`u`){let t=null;if(M===`gzip`||M===`x-gzip`?t=`gzip`:(M===`deflate`||M===`x-deflate`)&&(t=`deflate`),t){let n=new e([await new d(w,j).arrayBuffer()]).stream().pipeThrough(new DecompressionStream(t));return finalize(),new d(n,j)}}return finalize(),new d(w,j)}export{o as AbortError,e as Blob,n as FetchError,t as File,b as FormData,s as Headers,m as Request,d as Response,g as XMLHttpRequest,_ as XMLHttpRequestUpload,fetch as default,u as isRedirect,l as resolveRootRelativeUrl};
+import"./_virtual/_rolldown/runtime.js";import{Blob as e,File as t}from"./utils/blob-from.js";import{FetchError as n}from"./errors/fetch-error.js";import{isDomainOrSubdomain as r,isSameProtocol as i}from"./utils/is.js";import{clone as a}from"./body.js";import{AbortError as o}from"./errors/abort-error.js";import s from"./headers.js";import{parseDataUri as c}from"./utils/data-uri.js";import{resolveRootRelativeUrl as l}from"./utils/root-relative-system.js";import{isRedirect as u}from"./utils/is-redirect.js";import{Response as d}from"./response.js";import{loadSoup as f}from"./utils/soup-lazy.js";import{parseReferrerPolicyFromHeader as p}from"./utils/referrer.js";import{Request as m,getSoupRequestOptions as h}from"./request.js";import{XMLHttpRequest as g,XMLHttpRequestUpload as _}from"./xhr.js";import{URL as v}from"@gjsify/url";import y from"node:stream";import{FormData as b}from"@gjsify/formdata";import x from"@girs/glib-2.0";const S=new Set([`data:`,`http:`,`https:`,`file:`]);function rewriteFetchInput(e){if(typeof e!=`string`)return e;let t=l(e);return t!==e&&globalThis.__GJSIFY_DEBUG_FETCH===!0&&console.log(`[fetch] rewrite ${e} → ${t}`),t}async function fetch(t,l={}){t=rewriteFetchInput(t);let g=new m(t,l),{parsedURL:_,options:b}=h(g);if(!S.has(_.protocol))throw TypeError(`@gjsify/fetch cannot load ${t}. URL scheme "${_.protocol.replace(/:$/,``)}" is not supported.`);if(_.protocol===`data:`){let{buffer:e,typeFull:t}=c(g.url);return new d(Buffer.from(e),{headers:{"Content-Type":t}})}if(_.protocol===`file:`){let e=globalThis.__GJSIFY_DEBUG_FETCH===!0;e&&console.log(`[fetch] file:// ${g.url}`);try{let t=x.filename_from_uri(g.url)[0];e&&console.log(`[fetch] file:// path=${t}`);let[r,i]=x.file_get_contents(t);if(e&&console.log(`[fetch] file:// ok=${r} bytes=${i?.byteLength??`?`}`),!r)throw new n(`Failed to read file: ${t}`,`system`);let a=i,o=new Uint8Array(a.byteLength);o.set(a);let s=new d(o);return e&&console.log(`[fetch] file:// response created`),s}catch(t){let r=t instanceof Error?t:Error(String(t));throw e&&console.warn(`[fetch] file:// FAIL: ${r.message}`),new n(`request to ${g.url} failed, reason: ${r.message}`,`system`,r)}}let{signal:C}=g;if(C&&C.aborted)throw new o(`The operation was aborted.`);let w,T;try{let e=await g._send(b);w=e.readable,T=e.cancellable}catch(e){if(C&&C.aborted)throw new o(`The operation was aborted.`);let t=e instanceof Error?e:Error(String(e));throw new n(`request to ${g.url} failed, reason: ${t.message}`,`system`,t)}let abortHandler=()=>{T.cancel()};C&&C.addEventListener(`abort`,abortHandler,{once:!0});let finalize=()=>{C&&C.removeEventListener(`abort`,abortHandler)};T.connect(()=>{w.destroy(new o(`The operation was aborted.`))}),w.on(`error`,e=>{finalize()});let E=g._message,D=await f(),O=s._newFromSoupMessage(D,E),k=E.status_code,A=E.get_reason_phrase();if(u(k)){let e=O.get(`Location`),t=null;try{t=e===null?null:new v(e,g.url)}catch{if(g.redirect!==`manual`)throw w.destroy(),finalize(),new n(`uri requested responds with an invalid redirect URL: ${e}`,`invalid-redirect`)}switch(g.redirect){case`error`:throw w.destroy(),finalize(),new n(`uri requested responds with a redirect, redirect mode is set to error: ${g.url}`,`no-redirect`);case`manual`:break;case`follow`:{if(t===null)break;if(g.counter>=g.follow)throw w.destroy(),finalize(),new n(`maximum redirect reached at: ${g.url}`,`max-redirect`);let e={headers:new s(g.headers),follow:g.follow,counter:g.counter+1,agent:g.agent,compress:g.compress,method:g.method,body:a(g),signal:g.signal,size:g.size,referrer:g.referrer,referrerPolicy:g.referrerPolicy};if(!r(g.url,t)||!i(g.url,t))for(let t of[`authorization`,`www-authenticate`,`cookie`,`cookie2`])e.headers.delete(t);if(k!==303&&g.body&&l.body instanceof y.Readable)throw w.destroy(),finalize(),new n(`Cannot follow redirect with body being a readable stream`,`unsupported-redirect`);(k===303||(k===301||k===302)&&g.method===`POST`)&&(e.method=`GET`,e.body=void 0,e.headers.delete(`content-length`));let o=p(O);return o&&(e.referrerPolicy=o),await new Promise(e=>{w.once(`close`,()=>e()),w.resume()}),finalize(),fetch(new m(t,e))}default:throw w.destroy(),finalize(),TypeError(`Redirect option '${g.redirect}' is not a valid value of RequestRedirect`)}}let j={url:g.url,status:k,statusText:A,headers:O,size:g.size,counter:g.counter,highWaterMark:g.highWaterMark},M=O.get(`Content-Encoding`);if(!g.compress||g.method===`HEAD`||M===null||k===204||k===304)return finalize(),new d(w,j);if(typeof DecompressionStream<`u`){let t=null;if(M===`gzip`||M===`x-gzip`?t=`gzip`:(M===`deflate`||M===`x-deflate`)&&(t=`deflate`),t){let n=new e([await new d(w,j).arrayBuffer()]).stream().pipeThrough(new DecompressionStream(t));return finalize(),new d(n,j)}}return finalize(),new d(w,j)}export{o as AbortError,e as Blob,n as FetchError,t as File,b as FormData,s as Headers,m as Request,d as Response,g as XMLHttpRequest,_ as XMLHttpRequestUpload,fetch as default,u as isRedirect,l as resolveRootRelativeUrl};

package/lib/esm/utils/soup-helpers.js

@@ -1 +1 @@
-import"../_virtual/_rolldown/runtime.js";import{Readable as e}from"node:stream";import t from"@girs/glib-2.0";import{inputStreamAsyncIterator as n}from"@gjsify/utils";async function soupSendAsync(e,n,r=t.PRIORITY_DEFAULT,i=null){return new Promise((t,a)=>{e.send_async(n,r,i,(n,r)=>{try{t(e.send_finish(r))}catch(e){a(e)}})})}function inputStreamToReadable(t,r={}){return e.from(n(t),r)}export{inputStreamToReadable,soupSendAsync};
+import"../_virtual/_rolldown/runtime.js";import{Readable as e}from"node:stream";import t from"@girs/glib-2.0";import n from"@girs/gio-2.0";import{inputStreamAsyncIterator as r}from"@gjsify/utils";async function soupSendAsync(e,r,i=t.PRIORITY_DEFAULT,a=null){return new Promise((t,o)=>{let s=!1,onCancel=()=>{s||(s=!0,o(new n.IOErrorEnum({code:n.IOErrorEnum.CANCELLED,message:`Operation was cancelled`})))},c=a?a.connect(onCancel):0;s||e.send_async(r,i,a,(n,r)=>{c&&a.disconnect(c);let i;try{i=e.send_finish(r)}catch(e){s||(s=!0,o(e));return}if(s){closeInputStream(i);return}s=!0,t(i)})})}function closeInputStream(e){return new Promise(n=>{e.close_async(t.PRIORITY_DEFAULT,null,(t,r)=>{try{e.close_finish(r)}catch{}n()})})}function inputStreamToReadable(i,a={}){let o=new n.Cancellable,s=null,close=()=>s||(i.has_pending()?Promise.resolve():(s=closeInputStream(i),s));async function*chunks(){try{yield*r(i,4096,t.PRIORITY_DEFAULT,o)}finally{await close()}}let c=e.from(chunks(),a);return c.once(`close`,()=>{i.has_pending()?o.cancel():close()}),c}export{inputStreamToReadable,soupSendAsync};

package/lib/index.js

@@ -155,6 +155,11 @@ export default async function fetch(url, init = {}) {
     const statusMessage = message.get_reason_phrase();
     // HTTP fetch step 5 — handle redirects
     if (isRedirect(statusCode)) {
+        // A redirect response never reaches the caller, so nothing else will
+        // consume or close its body — and an unclosed Soup body stream pins its
+        // connection until GC (see inputStreamToReadable). Drain it when
+        // following, so the connection is back in the pool before the next hop
+        // (usually to the same host) asks for one; destroy it on every error exit.
         const location = headers.get('Location');
         let locationURL = null;
         try {
@@ -162,12 +167,14 @@ export default async function fetch(url, init = {}) {
         }
         catch {
             if (request.redirect !== 'manual') {
+                readable.destroy();
                 finalize();
                 throw new FetchError(`uri requested responds with an invalid redirect URL: ${location}`, 'invalid-redirect');
             }
         }
         switch (request.redirect) {
             case 'error':
+                readable.destroy();
                 finalize();
                 throw new FetchError(`uri requested responds with a redirect, redirect mode is set to error: ${request.url}`, 'no-redirect');
             case 'manual':
@@ -178,6 +185,7 @@ export default async function fetch(url, init = {}) {
                     break;
                 }
                 if (request.counter >= request.follow) {
+                    readable.destroy();
                     finalize();
                     throw new FetchError(`maximum redirect reached at: ${request.url}`, 'max-redirect');
                 }
@@ -202,6 +210,7 @@ export default async function fetch(url, init = {}) {
                 }
                 // Cannot follow redirect with body being a readable stream
                 if (statusCode !== 303 && request.body && init.body instanceof Stream.Readable) {
+                    readable.destroy();
                     finalize();
                     throw new FetchError('Cannot follow redirect with body being a readable stream', 'unsupported-redirect');
                 }
@@ -216,10 +225,17 @@ export default async function fetch(url, init = {}) {
                 if (responseReferrerPolicy) {
                     requestOptions.referrerPolicy = responseReferrerPolicy;
                 }
+                // 'close', not 'end': it also fires when an abort destroys the body mid-drain.
+                await new Promise((resolve) => {
+                    readable.once('close', () => resolve());
+                    readable.resume();
+                });
                 finalize();
                 return fetch(new Request(locationURL, requestOptions));
             }
             default:
+                readable.destroy();
+                finalize();
                 throw new TypeError(`Redirect option '${request.redirect}' is not a valid value of RequestRedirect`);
         }
     }

package/lib/soup-session.gjs.spec.js

@@ -138,6 +138,178 @@ export default async () => {
                 expect(stderr.includes('libsoup-CRITICAL')).toBe(false);
             });
         });
+        // Regression: libsoup 3 hands a connection back to the pool only when the
+        // response body stream is CLOSED — reading it to EOF merely marks the body
+        // done. @gjsify/fetch read bodies to EOF and never closed the stream, so
+        // every fetch pinned its connection IN_USE until SpiderMonkey happened to
+        // finalize the stream. Keep-alive reuse never happened, and once the
+        // shared session's `max-conns` (64) were pinned against servers that had
+        // since gone away, the next fetch queued forever. socket.io's polling
+        // transport hit that wall ~30 tests into its integration suite on macOS,
+        // where GC ran too rarely to rescue it.
+        await describe('@gjsify/fetch — body streams release their pooled connection', async () => {
+            const startServer = () => {
+                const ports = [];
+                const server = new Soup.Server({});
+                server.add_handler(null, (_s, msg) => {
+                    ports.push(msg.get_remote_address().get_port());
+                    msg.set_status(200, null);
+                    msg.set_response('text/plain', Soup.MemoryUse.COPY, new TextEncoder().encode('ok'));
+                });
+                server.listen_local(0, Soup.ServerListenOptions.IPV4_ONLY);
+                return { server, ports, base: server.get_uris()[0].to_string() };
+            };
+            await it('reuses the keep-alive connection once a body has been read', async () => {
+                const { server, ports, base } = startServer();
+                // fetch defaults to `Connection: close` (node-fetch heritage), so
+                // opt into keep-alive to observe the connection going back to the pool.
+                const init = { headers: { Connection: 'keep-alive' } };
+                try {
+                    await (await fetchFn(base, init)).text();
+                    await (await fetchFn(base, init)).arrayBuffer();
+                    await (await fetchFn(base, init)).text();
+                    expect(ports.length).toBe(3);
+                    // One client port = one connection, handed back and reused.
+                    expect(new Set(ports).size).toBe(1);
+                }
+                finally {
+                    server.disconnect();
+                }
+            });
+            await it('does not exhaust the pool against servers that have gone away', async () => {
+                // More servers than the shared session's default max-conns (64):
+                // each leaves one idle keep-alive connection behind. Idle ones are
+                // reclaimable; pinned ones made fetch #65 wait forever.
+                let completed = 0;
+                for (let i = 0; i < 70; i++) {
+                    const { server, base } = startServer();
+                    const ctrl = new AbortController();
+                    const timer = setTimeout(() => ctrl.abort(), 2000);
+                    try {
+                        await (await fetchFn(base, { signal: ctrl.signal })).text();
+                        completed++;
+                    }
+                    catch {
+                        break;
+                    }
+                    finally {
+                        clearTimeout(timer);
+                        server.disconnect();
+                    }
+                }
+                expect(completed).toBe(70);
+            });
+            await it('drains a followed redirect so the next hop reuses its connection', async () => {
+                const ports = [];
+                const server = new Soup.Server({});
+                server.add_handler(null, (_s, msg) => {
+                    ports.push(msg.get_remote_address().get_port());
+                    if (msg.get_uri().get_path() === '/moved') {
+                        msg.set_redirect(307, '/target');
+                        // A non-empty body: libsoup completes an empty one without a stream close.
+                        msg.set_response('text/plain', Soup.MemoryUse.COPY, new TextEncoder().encode('moved'));
+                    }
+                    else {
+                        msg.set_status(200, null);
+                        msg.set_response('text/plain', Soup.MemoryUse.COPY, new TextEncoder().encode('ok'));
+                    }
+                });
+                server.listen_local(0, Soup.ServerListenOptions.IPV4_ONLY);
+                const base = server.get_uris()[0].to_string();
+                try {
+                    // libsoup follows safe-method redirects itself; a 307 on PUT is
+                    // left to fetch's own redirect step, the path under test.
+                    const res = await fetchFn(`${base}moved`, { method: 'PUT', headers: { Connection: 'keep-alive' } });
+                    expect(await res.text()).toBe('ok');
+                    expect(ports.length).toBe(2);
+                    // Nobody reads a redirect's body; left open it pinned its connection.
+                    expect(new Set(ports).size).toBe(1);
+                }
+                finally {
+                    server.disconnect();
+                }
+            });
+            // A body read parked on a server that has gone quiet (long-poll, SSE)
+            // kept the stream open past body.cancel(): close() cannot run while
+            // a read is pending, so the connection stayed pinned. Cancel one
+            // such body per per-host slot (DEFAULT_MAX_CONNS_PER_HOST = 16);
+            // pinned, they leave no slot for the request after them.
+            await it('releases the connection when a body is cancelled mid-stream', async () => {
+                const server = new Soup.Server({});
+                server.add_handler(null, (_s, msg) => {
+                    msg.set_status(200, null);
+                    if (msg.get_uri().get_path() === '/stream') {
+                        msg.get_response_headers().set_encoding(Soup.Encoding.CHUNKED);
+                        // No complete(): the response stays open with nothing more to read.
+                        msg.get_response_body().append(new TextEncoder().encode('first'));
+                    }
+                    else {
+                        msg.set_response('text/plain', Soup.MemoryUse.COPY, new TextEncoder().encode('ok'));
+                    }
+                });
+                server.listen_local(0, Soup.ServerListenOptions.IPV4_ONLY);
+                const base = server.get_uris()[0].to_string();
+                try {
+                    for (let i = 0; i < 16; i++) {
+                        const res = await fetchFn(`${base}stream`);
+                        const reader = res.body.getReader();
+                        const first = await reader.read();
+                        expect(new TextDecoder().decode(first.value)).toBe('first');
+                        await reader.cancel();
+                    }
+                    const ctrl = new AbortController();
+                    const timer = setTimeout(() => ctrl.abort(), 2000);
+                    try {
+                        expect(await (await fetchFn(base, { signal: ctrl.signal })).text()).toBe('ok');
+                    }
+                    finally {
+                        clearTimeout(timer);
+                    }
+                }
+                finally {
+                    server.disconnect();
+                }
+            });
+            // libsoup does not watch the cancellable of a message still queued
+            // for a connection slot, so an abort there used to hang until some
+            // other request freed a slot.
+            await it('rejects an aborted fetch that is still queued for a connection', async () => {
+                const paused = [];
+                const server = new Soup.Server({});
+                server.add_handler(null, (_s, msg) => {
+                    msg.pause();
+                    paused.push(msg);
+                });
+                server.listen_local(0, Soup.ServerListenOptions.IPV4_ONLY);
+                const base = server.get_uris()[0].to_string();
+                // Fill every per-host slot (DEFAULT_MAX_CONNS_PER_HOST) with a hung request.
+                const holders = Array.from({ length: 16 }, () => new AbortController());
+                const held = holders.map((c) => fetchFn(base, { signal: c.signal }).catch(() => undefined));
+                try {
+                    const deadline = Date.now() + 2000;
+                    while (paused.length < holders.length && Date.now() < deadline) {
+                        await new Promise((r) => setTimeout(r, 20));
+                    }
+                    expect(paused.length).toBe(holders.length);
+                    const ctrl = new AbortController();
+                    const queued = fetchFn(base, { signal: ctrl.signal }).then(() => 'resolved', (err) => err.name);
+                    setTimeout(() => ctrl.abort(), 50);
+                    const outcome = await Promise.race([
+                        queued,
+                        new Promise((r) => setTimeout(() => r('still queued'), 2000)),
+                    ]);
+                    expect(outcome).toBe('AbortError');
+                }
+                finally {
+                    for (const c of holders)
+                        c.abort();
+                    await Promise.all(held);
+                    for (const msg of paused)
+                        msg.unpause();
+                    server.disconnect();
+                }
+            });
+        });
         // Regression: @gjsify/fetch re-parsed the already-encoded request URL
         // with `GLib.UriFlags.NONE`, which DECODES a second time — collapsing an
         // escaped `%2F` inside a path segment back to a literal `/`. That sent

package/lib/tls-abort.gjs.spec.js

@@ -12,10 +12,11 @@
 // GJS-only (`.gjs.spec.ts`): the body runs under `on('Gjs', …)`, a no-op on Node. Soup/GLib/Gio are
 // read from the GJS bootstrap `imports` (same idiom as soup-session.gjs.spec.ts) so the Node bundle
 // never resolves `gi://*`. Request/fetch are read from `globalThis` (installed by
-// `@gjsify/fetch/register`, pulled in by test.mts). `@gjsify/abort-controller` is pure-TS
-// cross-runtime, so its static import is safe on both legs.
+// `@gjsify/fetch/register`, pulled in by test.mts), and so is AbortController/AbortSignal
+// (`@gjsify/abort-controller/register`): a workspace import here would be compiled by this
+// package's `build:types`, which a cold `@gjsify/cli --with-dependencies` sweep may run before
+// abort-controller's (held by scripts/check-build-infra-order.mjs, incident #1775).
 import { describe, it, expect, on } from '@gjsify/unit';
-import { AbortController, AbortSignal } from '@gjsify/abort-controller';
 // A REAL self-signed cert+key (RSA-2048, CN=localhost, SAN DNS:localhost + IP:127.0.0.1, 100y) so a
 // live TLS handshake against the local Soup.Server actually completes. Embedded inline to stay
 // hermetic (no fixtures) — same approach as packages/node/tls TEST_CERT_AND_KEY. Regenerate with:

package/lib/utils/soup-helpers.d.ts

@@ -1,12 +1,28 @@
-import type Gio from '@girs/gio-2.0';
+import Gio from '@girs/gio-2.0';
 import type Soup from '@girs/soup-3.0';
 import { Readable } from 'node:stream';
 import type { ReadableOptions } from 'node:stream';
 /**
  * Promise wrapper around `Soup.Session.send_async` / `send_finish`.
+ *
+ * Rejects as soon as `cancellable` fires instead of waiting for libsoup's
+ * callback: a message still QUEUED for a connection slot (the session is at
+ * `max-conns` / `max-conns-per-host`) sits in libsoup's STARTING state, which
+ * never looks at its cancellable — the cancellation only lands once some other
+ * request frees a slot, so an aborted fetch would hang until then. The message
+ * stays queued inside libsoup and fails with CANCELLED when it is dequeued; a
+ * stream that wins the race anyway is closed so it cannot pin its connection.
  */
 export declare function soupSendAsync(session: Soup.Session, msg: Soup.Message, ioPriority?: number, cancellable?: Gio.Cancellable | null): Promise<Gio.InputStream>;
 /**
- * Converts a `Gio.InputStream` to a Node.js `Readable` stream.
+ * Converts a `Gio.InputStream` to a Node.js `Readable` stream, closing the
+ * input stream once the body is consumed or the Readable is destroyed.
+ *
+ * The close is load-bearing for Soup response bodies: libsoup 3 returns the
+ * connection to the session's pool only when the body stream is CLOSED —
+ * reading to EOF merely marks the body done. Left open, each response pins its
+ * connection IN_USE until the stream happens to be GC-finalized; keep-alive
+ * reuse never happens, and once `max-conns` are pinned the next request queues
+ * forever (socket.io's polling transport stalled on exactly that).
  */
 export declare function inputStreamToReadable(inputStream: Gio.InputStream, options?: ReadableOptions): Readable;

package/lib/utils/soup-helpers.js

@@ -1,25 +1,122 @@
+import Gio from '@girs/gio-2.0';
 import GLib from '@girs/glib-2.0';
 import { Readable } from 'node:stream';
 import { inputStreamAsyncIterator } from '@gjsify/utils';
 /**
  * Promise wrapper around `Soup.Session.send_async` / `send_finish`.
+ *
+ * Rejects as soon as `cancellable` fires instead of waiting for libsoup's
+ * callback: a message still QUEUED for a connection slot (the session is at
+ * `max-conns` / `max-conns-per-host`) sits in libsoup's STARTING state, which
+ * never looks at its cancellable — the cancellation only lands once some other
+ * request frees a slot, so an aborted fetch would hang until then. The message
+ * stays queued inside libsoup and fails with CANCELLED when it is dequeued; a
+ * stream that wins the race anyway is closed so it cannot pin its connection.
  */
 export async function soupSendAsync(session, msg, ioPriority = GLib.PRIORITY_DEFAULT, cancellable = null) {
     return new Promise((resolve, reject) => {
+        let settled = false;
+        const onCancel = () => {
+            if (settled)
+                return;
+            settled = true;
+            reject(new Gio.IOErrorEnum({ code: Gio.IOErrorEnum.CANCELLED, message: 'Operation was cancelled' }));
+        };
+        // g_cancellable_connect runs the handler at once when already cancelled.
+        const handlerId = cancellable ? cancellable.connect(onCancel) : 0;
+        if (settled)
+            return;
         session.send_async(msg, ioPriority, cancellable, (_self, asyncRes) => {
+            // Not from inside the cancel handler, so disconnecting cannot deadlock.
+            if (handlerId)
+                cancellable.disconnect(handlerId);
+            let inputStream;
             try {
-                const inputStream = session.send_finish(asyncRes);
-                resolve(inputStream);
+                inputStream = session.send_finish(asyncRes);
             }
             catch (error) {
-                reject(error);
+                if (!settled) {
+                    settled = true;
+                    reject(error);
+                }
+                return;
             }
+            if (settled) {
+                void closeInputStream(inputStream);
+                return;
+            }
+            settled = true;
+            resolve(inputStream);
+        });
+    });
+}
+/**
+ * Close a `Gio.InputStream` without blocking the main loop. Resolves once the
+ * close has finished; never rejects — a close failure leaves nothing for the
+ * caller to recover, and the stream is unusable either way.
+ */
+function closeInputStream(inputStream) {
+    return new Promise((resolve) => {
+        inputStream.close_async(GLib.PRIORITY_DEFAULT, null, (_self, res) => {
+            try {
+                inputStream.close_finish(res);
+            }
+            catch {
+                /* already closed, or the connection died — nothing to release */
+            }
+            resolve();
         });
     });
 }
 /**
- * Converts a `Gio.InputStream` to a Node.js `Readable` stream.
+ * Converts a `Gio.InputStream` to a Node.js `Readable` stream, closing the
+ * input stream once the body is consumed or the Readable is destroyed.
+ *
+ * The close is load-bearing for Soup response bodies: libsoup 3 returns the
+ * connection to the session's pool only when the body stream is CLOSED —
+ * reading to EOF merely marks the body done. Left open, each response pins its
+ * connection IN_USE until the stream happens to be GC-finalized; keep-alive
+ * reuse never happens, and once `max-conns` are pinned the next request queues
+ * forever (socket.io's polling transport stalled on exactly that).
  */
 export function inputStreamToReadable(inputStream, options = {}) {
-    return Readable.from(inputStreamAsyncIterator(inputStream), options);
+    // Owned here, not by the caller: it only ever cancels an in-flight body
+    // read of a Readable that has already been destroyed.
+    const readCancellable = new Gio.Cancellable();
+    let closing = null;
+    const close = () => {
+        if (closing)
+            return closing;
+        // A read still in flight owns the stream (close would fail with
+        // G_IO_ERROR_PENDING); the generator's `finally` closes it once that
+        // read settles.
+        if (inputStream.has_pending())
+            return Promise.resolve();
+        closing = closeInputStream(inputStream);
+        return closing;
+    };
+    async function* chunks() {
+        try {
+            yield* inputStreamAsyncIterator(inputStream, 4096, GLib.PRIORITY_DEFAULT, readCancellable);
+        }
+        finally {
+            // Awaited, so 'end' (and with it text()/arrayBuffer()) is only
+            // observed after the connection is back in the pool — a follow-up
+            // request to the same host can then reuse it.
+            await close();
+        }
+    }
+    const readable = Readable.from(chunks(), options);
+    readable.once('close', () => {
+        // A destroyed Readable (abort, body.cancel(), consumer gave up) may
+        // never resume the generator, so its `finally` would not run — close
+        // from here. A read still waiting on an idle server (long-poll, SSE)
+        // would hold the stream forever: cancel it, and the generator's
+        // `finally` closes the stream once the cancelled read settles.
+        if (inputStream.has_pending())
+            readCancellable.cancel();
+        else
+            void close();
+    });
+    return readable;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gjsify/fetch",
-    "version": "0.52.0",
+    "version": "0.54.0",
     "description": "Web and Node.js fetch module for Gjs",
     "module": "lib/esm/index.js",
     "types": "lib/index.d.ts",
@@ -51,8 +51,9 @@
         "fetch"
     ],
     "devDependencies": {
-        "@gjsify/cli": "^0.52.0",
-        "@gjsify/unit": "^0.52.0",
+        "@gjsify/abort-controller": "^0.54.0",
+        "@gjsify/cli": "^0.54.0",
+        "@gjsify/unit": "^0.54.0",
         "@types/node": "^25.9.2",
         "typescript": "^6.0.3"
     },
@@ -61,11 +62,11 @@
         "@girs/gjs": "5.4.0",
         "@girs/glib-2.0": "5.4.0",
         "@girs/soup-3.0": "5.4.0",
-        "@gjsify/dom-events": "^0.52.0",
-        "@gjsify/formdata": "^0.52.0",
-        "@gjsify/http": "^0.52.0",
-        "@gjsify/url": "^0.52.0",
-        "@gjsify/utils": "^0.52.0"
+        "@gjsify/dom-events": "^0.54.0",
+        "@gjsify/formdata": "^0.54.0",
+        "@gjsify/http": "^0.54.0",
+        "@gjsify/url": "^0.54.0",
+        "@gjsify/utils": "^0.54.0"
     },
     "gjsify": {
         "runtimes": {