@johnhenry/andbox 0.1.3 → 0.3.0

package/src/index.d.ts

@@ -251,27 +251,185 @@ export interface SandboxFetchReply {
   redirected?: boolean;
 }
 
+/**
+ * `network.allowedHosts` as a function: asked on the host, with a fresh `URL`,
+ * before every request the sandbox makes and before every redirect hop andbox
+ * follows. Only `true` (or a promise of `true`) allows; anything else refuses,
+ * and a thrown error is the message the sandbox's `fetch` rejects with.
+ */
+export type SandboxHostPolicy = (url: URL) => boolean | Promise<boolean>;
+
 /** `createSandbox({ network })`: a host-backed global `fetch` inside the sandbox. */
 export interface SandboxNetworkOptions {
   /**
-   * Called on the host for every request the sandbox's `fetch` makes, through
-   * the gated `fetch` capability (`policy.capabilities.fetch` applies). The
-   * URL is always absolute http(s). Return a `Response` or a plain reply.
-   * Called without a `this`, so the platform `fetch` itself can be passed.
-   * Required unless `allowedHosts` is given.
+   * Required (0.2.0, andbox#43): which hosts the sandbox may reach. Checked on
+   * the host before `fetch` is called, so leaving it out is an error rather
+   * than "every host".
+   *
+   * - `string[]`: hostnames, matched exactly against the request URL's
+   *   hostname (case-insensitive, IDN and IPv4 normalised like `URL`, any
+   *   port, http or https). No subdomain matching: `'example.com'` does not
+   *   allow `'api.example.com'`. IPv6 in brackets (`'[::1]'`). Entries with a
+   *   scheme, port, path or `*` throw. Must not be empty. Any redirect is
+   *   refused (the request is made with `redirect: 'manual'`).
+   * - `(url: URL) => boolean | Promise<boolean>`: a policy asked for every
+   *   request, so the allowlist can change while the sandbox runs. andbox
+   *   follows redirects itself (`redirect: 'manual'` underneath) and asks it
+   *   again for each hop; where the platform hides the target (a browser's
+   *   opaque redirect) the request fails.
+   * - `'*'`: any http(s) host. Your `fetch` is the whole policy, and the
+   *   sandbox's redirect mode is passed to it unchanged.
+   */
+  allowedHosts: readonly string[] | '*' | SandboxHostPolicy;
+  /**
+   * Called on the host for every request the sandbox's `fetch` makes that
+   * `allowedHosts` allows, through the gated `fetch` capability
+   * (`policy.capabilities.fetch` applies). The URL is always absolute
+   * http(s). Return a `Response` or a plain reply. Called without a `this`,
+   * so the platform `fetch` itself can be passed. Default: the platform's
+   * global `fetch` (on a server, that has the server's network position).
    */
   fetch?: (url: string, init: SandboxFetchInit) =>
     Response | SandboxFetchReply | Promise<Response | SandboxFetchReply>;
-  /**
-   * Put `createNetworkFetch(allowedHosts, fetch)` in front: other hosts and
-   * any redirect are refused. Without `fetch` it wraps the host's global
-   * `fetch`. Must not be empty.
-   */
-  allowedHosts?: string[];
   /** `init.credentials` for every request. Default `'omit'`. */
   credentials?: RequestCredentials;
 }
 
+// ── bridges (createSandbox({ bridges }), andbox#46) ──
+
+/** Per-sandbox limits of one bridge. 0 = unlimited. */
+export interface BridgeLimits {
+  /** Live handles at a time. Default 32 (chromeAI: 8). */
+  maxHandles?: number;
+  /** Open streams at a time. Default 8 (chromeAI: 4). */
+  maxStreams?: number;
+  /** Approximate size of one result or stream chunk (strings as UTF-8, binary by byteLength). Default 0. */
+  maxResultBytes?: number;
+  /** Wall-clock time for one call; for a stream method, until the stream ends. Default 0. */
+  timeoutMs?: number;
+}
+
+/** Defaults for {@link BridgeLimits}. */
+export declare const DEFAULT_BRIDGE_LIMITS: Readonly<Required<BridgeLimits>>;
+
+/** An opaque reference to a host object, from `ctx.handle()`. Return it (or put it in a result). */
+export interface BridgeHandleRef<T = unknown> {
+  readonly type: string;
+  readonly target: T;
+}
+
+/** What every bridge method receives as its first argument. */
+export interface BridgeContext<State = any, Target = any> {
+  /** The bridge's name (its global in the sandbox). */
+  bridge: string;
+  /** `'chat.create'` for an api method, `'Session.ask'` for a handle method. */
+  method: string;
+  /**
+   * Aborts when the sandbox's AbortSignal for this call fires, the call times
+   * out (`limits.timeoutMs`), its handle is destroyed, the stream is
+   * cancelled, or the sandbox's Worker/frame is terminated. Pass it on.
+   */
+  signal: AbortSignal;
+  /** Per-sandbox state from `createState()` (lives as long as the sandbox, across restarts). */
+  state: State;
+  /** Handle methods: the host object the sandbox's handle refers to. */
+  target: Target;
+  /** Wrap a host object so the sandbox gets a handle to it (type: a key of `handles`). */
+  handle<T>(type: string, target: T): BridgeHandleRef<T>;
+}
+
+/**
+ * A bridge method. Arguments arrive by structured clone, with sandbox
+ * functions replaced by async proxies (reverse calls into the sandbox),
+ * AbortSignals by `ctx.signal`, and handles by their host objects.
+ */
+export type BridgeMethodFn<State = any, Target = any> = (ctx: BridgeContext<State, Target>, ...args: any[]) => unknown;
+
+/** The activation a method needs: `true`/`'transient'` (a gesture in the last few seconds) or `'sticky'` (any gesture since load). */
+export type BridgeActivation = boolean | 'transient' | 'sticky';
+
+export interface BridgeMethodSpec<State = any, Target = any> {
+  call: BridgeMethodFn<State, Target>;
+  /** Returns a ReadableStream / (async) iterable; the sandbox gets a ReadableStream at once. */
+  stream?: boolean;
+  /** Returns a handle: `limits.maxHandles` is checked before the method runs. */
+  handle?: boolean;
+  /** Needs page user activation; a function decides per call (e.g. only when a download is needed). */
+  requiresUserActivation?: BridgeActivation | ((ctx: BridgeContext<State, Target>, ...args: any[]) => BridgeActivation | Promise<BridgeActivation>);
+}
+
+export type BridgeMethod<State = any, Target = any> = BridgeMethodFn<State, Target> | BridgeMethodSpec<State, Target>;
+
+/** A tree of namespaces and methods: `{ chat: { create, list } }` becomes `svc.chat.create()`. */
+export interface BridgeApi<State = any> {
+  [name: string]: BridgeMethod<State> | BridgeApi<State>;
+}
+
+/** A host object type the sandbox holds handles to. */
+export interface BridgeHandleType<State = any, Target = any> {
+  /** Methods callable on the sandbox's handle; `ctx.target` is the host object. */
+  methods?: Record<string, BridgeMethod<State, Target>>;
+  /** Properties copied to the sandbox (primitives and arrays of primitives) with the handle and after every call. */
+  props?: string[];
+  /** Release the host object: on handle.destroy(), and for every live handle when the sandbox is disposed, restarted or killed. */
+  destroy?: (target: Target) => void | Promise<void>;
+}
+
+/** What `onRequest` sees for every bridge method call (not for destroy/cancel/abort). */
+export interface BridgeRequest {
+  bridge: string;
+  /** `'chat.create'` or `'Session.ask'`; the gate name is `${bridge}.${method}`. */
+  method: string;
+  /** Decoded arguments (sandbox functions are proxies; signals are the call's signal). */
+  args: unknown[];
+  handle: { id: string; type: string } | null;
+  /** The activation the method needs for this call, or false. */
+  requiresUserActivation: false | 'transient' | 'sticky';
+  /** The page's `navigator.userActivation` now; null where the platform has none (Node). */
+  userActivation: { isActive: boolean; hasBeenActive: boolean } | null;
+  /** Aborts when the call does (the sandbox gave up, timed out or was terminated): close your consent UI. */
+  signal: AbortSignal;
+}
+
+export interface BridgeDefinition<State = any> {
+  /** Methods and namespaces of the sandbox global. */
+  api?: BridgeApi<State>;
+  /** Host object types, by name. A handle type cannot share a name with an api member. */
+  handles?: Record<string, BridgeHandleType<State>>;
+  limits?: BridgeLimits;
+  /**
+   * Consent hook, asked on the host before every method call. Only `true`
+   * (or a promise of it) allows; anything else, or a throw, rejects the call
+   * in the sandbox with `NotAllowedError`. It may wait for the user.
+   */
+  onRequest?: (request: BridgeRequest) => boolean | Promise<boolean>;
+  /** Per-sandbox state (`ctx.state`), created once per sandbox. */
+  createState?: () => State;
+  /** Extra fields for `sandbox.stats().bridges[name]`. */
+  stats?: (state: State) => Record<string, unknown>;
+  /**
+   * Sandbox-side adapter: a self-contained function (stringified; no outside
+   * references) called in the sandbox with the generated global and
+   * `clientOptions`; returns the global to install.
+   */
+  client?: ((api: any, options: any) => any) | string;
+  /** JSON passed to `client` in the sandbox. */
+  clientOptions?: unknown;
+  /** Extra sandbox globals aliasing paths of the api: `{ LanguageModel: 'languageModel' }`. */
+  globals?: Record<string, string>;
+}
+
+/** Check a bridge definition (throws a TypeError) and return it unchanged. */
+export declare function defineBridge<State = any>(definition: BridgeDefinition<State>): BridgeDefinition<State>;
+
+/** `sandbox.stats().bridges[name]`. */
+export interface BridgeStats {
+  handles: number;
+  streams: number;
+  pendingCalls: number;
+  [extra: string]: unknown;
+}
+
 // ── stdio ──
 
 /** An async iterable stdio stream with push/end controls. */
@@ -302,9 +460,11 @@ export declare function createStdio(): StdioStream;
  * @param options.networkFetch  Install the host-backed global `fetch` shim
  *   (what `createSandbox({ network })` uses). It calls the host's `fetch`
  *   capability. Default false: `fetch` is removed like the other network globals.
+ * @param options.bridges  Include the bridge client (`createSandbox({ bridges })`);
+ *   the globals are built from the manifests sent with `configure`. Default false.
  * @returns The complete Worker script source code as a string.
  */
-export declare function makeWorkerSource(options?: { networkFetch?: boolean }): string;
+export declare function makeWorkerSource(options?: { networkFetch?: boolean; bridges?: boolean }): string;
 
 // ── service-worker-source ──
 
@@ -475,12 +635,24 @@ export interface SandboxOptions {
    * `worker`, `node-worker` and `iframe` modes (throws in `wasm`): install a
    * global `fetch` in the sandbox that sends each request to `network.fetch`
    * on the host, through the gated `fetch` capability (andbox#39). http(s)
-   * only; `credentials` is the host's choice. Other network globals stay
+   * only, and only to the hosts `network.allowedHosts` allows (required,
+   * andbox#43); `credentials` is the host's choice. Other network globals stay
    * locked in worker modes; the platform `import()` operator is not affected.
    * Unset (default): worker modes have no `fetch`. Conflicts with a
    * capability named `fetch`.
    */
   network?: SandboxNetworkOptions;
+  /**
+   * `worker`, `node-worker` and `iframe` modes (throws in the others): one
+   * sandbox global per entry that proxies a host API (andbox#46). Host
+   * objects never cross: the sandbox holds opaque handles, gets structured
+   * clones, pulls streams chunk by chunk, and its functions run in the
+   * sandbox when the host calls them. Every method call goes through the
+   * capability gate as `${bridge}.${method}` (so `policy` limits it) and
+   * through the bridge's `onRequest`; every handle is destroyed when the
+   * sandbox is disposed, restarted or killed. See `@johnhenry/andbox/bridges/chrome-ai`.
+   */
+  bridges?: Record<string, BridgeDefinition>;
 }
 
 /** Options for the built-in Node worker_threads mode (`nodeWorker`). */
@@ -533,6 +705,8 @@ export interface SandboxStats {
   pendingEvaluations: number;
   virtualModules: string[];
   gate: GateStatsResult;
+  /** With `bridges`: live handles/streams/calls per bridge, plus the bridge's own `stats()`. */
+  bridges?: Record<string, BridgeStats>;
   /** `mode: 'wasm'` only: interrupt polls used by the most recent evaluate(). */
   fuelUsed?: number;
   /** `mode: 'wasm'` only: peak sampled JS heap bytes seen so far. */

package/src/index.mjs

@@ -10,6 +10,7 @@ export { createVirtualModuleRegistry } from './virtual-module-registry.mjs';
 export { gateCapabilities } from './capability-gate.mjs';
 export { createStdio } from './stdio.mjs';
 export { createNetworkFetch } from './network-policy.mjs';
+export { defineBridge, DEFAULT_BRIDGE_LIMITS } from './bridge-host.mjs';
 export { makeDeferred, makeAbortError, makeTimeoutError } from './deferred.mjs';
 export { DEFAULT_TIMEOUT_MS, DEFAULT_LIMITS, DEFAULT_CAPABILITY_LIMITS } from './constants.mjs';
 export { makeWorkerSource } from './worker-source.mjs';

package/src/network-policy.mjs

@@ -107,47 +107,232 @@ async function toWireResponse(res, requestURL) {
   };
 }
 
+// ── allowedHosts: required, three forms (andbox#43) ──
+
+/** The explicit opt-in for "any http(s) host; my `fetch` is the whole policy". */
+const ANY_HOST = '*';
+
+const MAX_REDIRECTS = 20;
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+/** Request headers that describe the body; dropped when a redirect turns the request into a GET. */
+const BODY_HEADERS = ['content-encoding', 'content-language', 'content-location', 'content-type'];
+
+const ALLOWED_HOSTS_EXAMPLE =
+  "  network: { allowedHosts: ['api.example.com'] }                     // only these hosts\n" +
+  '  network: { fetch, allowedHosts: (url) => policy.allows(url.host) } // decided per request\n' +
+  "  network: { fetch, allowedHosts: '*' }                              // any host: your fetch is the whole policy";
+
+const ENTRY_HINT =
+  "entries are hostnames without a scheme, port, path or wildcard, e.g. 'api.example.com', '127.0.0.1', '[::1]'";
+
 /**
- * Validate `createSandbox({ network })` and build the host-side `fetch`
- * capability behind the sandbox's global `fetch` shim.
- *
- * Everything that arrives from the sandbox is treated as untrusted input
- * (evaluated code can also call `host.call('fetch', url, init)` directly):
- * the URL must be http(s), only method/headers/body/redirect are taken from
- * the request, and `credentials` and `signal` are always set by the host.
+ * Normalise one `allowedHosts` array entry to the form `URL#hostname` has
+ * (lowercase, punycode, canonical IPv4, bracketed IPv6), so it can be
+ * compared with a request URL's hostname. Throws on anything that would
+ * silently never match (a port, a scheme, a path, a wildcard).
+ */
+function normalizeHostEntry(entry) {
+  if (typeof entry !== 'string' || entry.length === 0) {
+    throw new TypeError(`network.allowedHosts: ${ENTRY_HINT} (got ${JSON.stringify(entry)})`);
+  }
+  if (entry === ANY_HOST) {
+    throw new TypeError("network.allowedHosts: to allow any host pass the string '*' itself, not inside an array");
+  }
+  const bare = entry.startsWith('[') ? entry.replace(/^\[[^\]]*\]/, '') : entry;
+  if (/[/?#@\s*\\]/.test(entry) || bare.includes(':')) {
+    throw new TypeError(`network.allowedHosts: ${ENTRY_HINT} (got '${entry}')`);
+  }
+  let hostname;
+  try {
+    hostname = new URL(`http://${entry}/`).hostname;
+  } catch {
+    throw new TypeError(`network.allowedHosts: '${entry}' is not a valid hostname; ${ENTRY_HINT}`);
+  }
+  return hostname;
+}
+
+/**
+ * Validate `createSandbox({ network })` without building anything, so
+ * `createSandbox()` can refuse a bad option before it starts a Worker.
  *
- * @param {{ fetch?: Function, allowedHosts?: string[], credentials?: RequestCredentials }} network
- * @returns {(this: { signal?: AbortSignal }, url: unknown, init?: unknown) => Promise<object>}
+ * @returns {{ hostFetch?: Function, allowedHosts: string[] | '*' | ((url: URL) => unknown), credentials: RequestCredentials }}
  */
-export function createFetchCapability(network) {
+export function validateNetworkOptions(network) {
   if (network === null || typeof network !== 'object' || Array.isArray(network)) {
-    throw new TypeError('network must be an object: { fetch?, allowedHosts?, credentials? }');
+    throw new TypeError('network must be an object: { allowedHosts, fetch?, credentials? }');
   }
   for (const key of Object.keys(network)) {
     if (!NETWORK_KEYS.has(key)) {
-      throw new TypeError(`network.${key} is not a known option (expected fetch, allowedHosts, credentials)`);
+      throw new TypeError(`network.${key} is not a known option (expected allowedHosts, fetch, credentials)`);
     }
   }
   const { fetch: hostFetch, allowedHosts, credentials = 'omit' } = network;
   if (hostFetch !== undefined && typeof hostFetch !== 'function') {
     throw new TypeError('network.fetch must be a function (url, init) => Response');
   }
-  if (allowedHosts !== undefined) {
-    if (!Array.isArray(allowedHosts) || !allowedHosts.every((h) => typeof h === 'string' && h.length > 0)) {
-      throw new TypeError('network.allowedHosts must be an array of hostname strings');
-    }
+  if (allowedHosts === undefined) {
+    throw new TypeError(
+      'network.allowedHosts is required: the sandbox gets no network unless you say which hosts it may reach. ' +
+      `For example:\n${ALLOWED_HOSTS_EXAMPLE}`
+    );
+  }
+  let hosts;
+  if (allowedHosts === ANY_HOST || typeof allowedHosts === 'function') {
+    hosts = allowedHosts;
+  } else if (Array.isArray(allowedHosts)) {
     if (allowedHosts.length === 0) {
-      throw new TypeError('network.allowedHosts must list at least one host; to give the sandbox no network, omit `network`');
+      throw new TypeError(
+        'network.allowedHosts must list at least one host; to give the sandbox no network, omit `network`. ' +
+        `For example:\n${ALLOWED_HOSTS_EXAMPLE}`
+      );
     }
-  }
-  if (hostFetch === undefined && allowedHosts === undefined) {
-    throw new TypeError('network needs `fetch` (a host function) and/or `allowedHosts`');
+    hosts = [...new Set(allowedHosts.map(normalizeHostEntry))];
+  } else {
+    throw new TypeError(
+      "network.allowedHosts must be an array of hostnames, a function (url: URL) => boolean, or '*' " +
+      `(got ${typeof allowedHosts === 'string' ? `'${allowedHosts}'` : typeof allowedHosts}). For example:\n${ALLOWED_HOSTS_EXAMPLE}`
+    );
   }
   if (!CREDENTIALS.includes(credentials)) {
     throw new TypeError(`network.credentials must be one of ${CREDENTIALS.map((c) => `'${c}'`).join(', ')}`);
   }
+  return { hostFetch, allowedHosts: hosts, credentials };
+}
 
-  const send = allowedHosts ? createNetworkFetch(allowedHosts, hostFetch) : hostFetch;
+/** The host's fetch, or the platform's, called without a `this`. */
+function resolveFetch(hostFetch) {
+  if (hostFetch) return (url, init) => hostFetch(url, init);
+  return (url, init) => {
+    const platformFetch = globalThis.fetch;
+    if (typeof platformFetch !== 'function') throw new Error('fetch is not available');
+    return platformFetch.call(globalThis, url, init);
+  };
+}
+
+async function askPolicy(policy, href) {
+  // A fresh URL each time: the policy cannot change the URL andbox requests.
+  const verdict = await policy(new URL(href));
+  if (verdict !== true) {
+    throw new Error(`Network access denied: ${new URL(href).host} is not allowed by network.allowedHosts`);
+  }
+}
+
+function responseHeaders(res) {
+  if (res?.headers && typeof res.headers.get === 'function') return res.headers;
+  try {
+    return new Headers(res?.headers ?? undefined);
+  } catch {
+    return new Headers();
+  }
+}
+
+function discardBody(res) {
+  try {
+    res?.body?.cancel?.().catch(() => {});
+  } catch {
+    // nothing to release
+  }
+}
+
+/**
+ * `allowedHosts` as a function: ask it about every URL andbox is about to
+ * request, the first one and every redirect hop. Redirects are followed by
+ * andbox itself (`redirect: 'manual'` underneath), re-asking the function for
+ * each `Location`, with the Fetch standard's method/body rewriting and
+ * `Authorization` dropped on a cross-origin hop. Where the platform hides the
+ * target (a browser's `opaqueredirect`), the request fails closed.
+ */
+function createPolicyFetch(policy, hostFetch) {
+  const send = resolveFetch(hostFetch);
+  return async function policyFetch(url, init) {
+    const { body: firstBody, headers: firstHeaders, method: firstMethod, ...rest } = init;
+    const mode = init.redirect ?? 'follow';
+    let href = url;
+    let method = firstMethod;
+    let headers = new Headers(firstHeaders);
+    let body = firstBody;
+    for (let hop = 0; ; hop++) {
+      await askPolicy(policy, href);
+      const res = await send(href, {
+        ...rest,
+        method,
+        headers,
+        ...(body !== undefined ? { body } : {}),
+        redirect: 'manual',
+      });
+      if (mode === 'manual') return res;
+      if (res?.type === 'opaqueredirect') {
+        throw new Error(
+          `Network access denied: ${new URL(href).host} answered with a redirect whose target this platform's fetch hides, ` +
+          "so network.allowedHosts cannot check it; pass a network.fetch that returns the redirect response, or use allowedHosts: '*'"
+        );
+      }
+      const location = REDIRECT_STATUSES.has(res?.status) ? responseHeaders(res).get('location') : null;
+      if (location === null) {
+        if (hop === 0) return res;
+        return { status: res.status, statusText: res.statusText, headers: responseHeaders(res), body: await readBody(res), url: href, redirected: true };
+      }
+      discardBody(res);
+      if (mode === 'error') throw new Error(`fetch: ${new URL(href).host} redirected and the request's redirect mode is 'error'`);
+      if (hop + 1 > MAX_REDIRECTS) throw new Error(`fetch: more than ${MAX_REDIRECTS} redirects`);
+      let next;
+      try {
+        next = new URL(location, href);
+      } catch {
+        throw new Error(`fetch: ${new URL(href).host} redirected to an invalid URL`);
+      }
+      if (next.protocol !== 'http:' && next.protocol !== 'https:') {
+        throw new Error(`Network access denied: ${new URL(href).host} redirected to a ${next.protocol} URL`);
+      }
+      const status = res.status;
+      if ((status === 303 && method !== 'GET' && method !== 'HEAD') || ((status === 301 || status === 302) && method === 'POST')) {
+        method = 'GET';
+        body = undefined;
+        headers = new Headers(headers);
+        for (const name of BODY_HEADERS) headers.delete(name);
+      }
+      if (next.origin !== new URL(href).origin) {
+        headers = new Headers(headers);
+        headers.delete('authorization');
+      }
+      href = next.href;
+    }
+  };
+}
+
+async function readBody(res) {
+  if (res == null) return null;
+  if (typeof res.arrayBuffer === 'function') return res.arrayBuffer();
+  return res.body ?? null;
+}
+
+/**
+ * The host-side sender for a validated `network`: the policy in front of the
+ * host's (or the platform's) fetch.
+ */
+function createNetworkSender({ hostFetch, allowedHosts }) {
+  if (allowedHosts === ANY_HOST) return resolveFetch(hostFetch);
+  if (typeof allowedHosts === 'function') return createPolicyFetch(allowedHosts, hostFetch);
+  return createNetworkFetch(allowedHosts, hostFetch);
+}
+
+/**
+ * Validate `createSandbox({ network })` and build the host-side `fetch`
+ * capability behind the sandbox's global `fetch` shim.
+ *
+ * Everything that arrives from the sandbox is treated as untrusted input
+ * (evaluated code can also call `host.call('fetch', url, init)` directly):
+ * the URL must be http(s) and pass `allowedHosts` before the host's `fetch`
+ * is called, only method/headers/body/redirect are taken from the request,
+ * and `credentials` and `signal` are always set by the host.
+ *
+ * @param {{ allowedHosts: string[] | '*' | ((url: URL) => boolean | Promise<boolean>), fetch?: Function, credentials?: RequestCredentials }} network
+ * @returns {(this: { signal?: AbortSignal }, url: unknown, init?: unknown) => Promise<object>}
+ */
+export function createFetchCapability(network) {
+  const options = validateNetworkOptions(network);
+  const { credentials } = options;
+  const send = createNetworkSender(options);
 
   return async function fetchCapability(url, init) {
     if (typeof url !== 'string') throw new TypeError('fetch: the URL must be a string');