Module fetch 

A WHATWG-ish fetch + Headers + Response, so npm packages that expect fetch work. It is a thin surface over the SAME ferridriver::http_client core the Playwright-style request binding uses — one HTTP stack, one place the net policy applies. The ergonomic request API stays; this just adds the standard entry point.

Web-standard names: Headers, Request, Response are the WHATWG classes (the Playwright page-network Request/Response are no longer globals — they were never globals in Playwright either, only return values). Headers is spec (lowercase + RFC7230 validate, value normalize, , combine, separate set-cookie + getSetCookie, sorted real iterators, forEach). Response / Request are constructible with the spec accessors (status/ok/redirected/type/bodyUsed/headers/…), single-use bodies (text/json/arrayBuffer), clone(), and static Response.json/error/redirect. fetch(url, { signal }) is wired to AbortController/AbortSignal (see super::abort): an already-aborted signal rejects before I/O and an in-flight abort drops the request future. Response.body is a ReadableStream that pulls chunks live off the socket (the body is NOT buffered; text()/json()/arrayBuffer() drain it on demand) — see super::streams. Blob and FormData (see super::blob / super::form_data) are accepted as bodies — a Blob sends its bytes + type, a FormData is serialized as multipart/form-data. Still a subset: clone() of a not-yet-read streamed Response throws (no stream tee); a signal on a Request instance is not yet forwarded (pass it via init.signal); init.redirect maps onto the per-request redirect cap (manual/error -> don’t follow; a spec-exact opaque-redirect / rejection is not distinguishable through reqwest’s per-request policy).

Net policy: fetch is a facade over the SAME core a net-restricted tool’s request wraps, so the allow.net allow-list must bind here too — otherwise a tool restricted to host X could reach anywhere via the global fetch. The per-tool allow-list lives in NetPolicyUd (VM userdata); plugins::dispatch_tool brackets each handler poll so the policy in effect is whichever tool’s continuation is running, and fetch snapshots it synchronously at call time (before any I/O).

Structs

FetchRequestJs

WHATWG Request (spec subset). Constructible (new Request(input, init?) where input is a URL string or another Request), with url/method/headers/redirect/credentials/bodyUsed accessors and text/json/arrayBuffer/clone. signal is accepted and stored but not yet wired (AbortController follow-up); fetch reads url/method/headers/body/redirect off a Request argument.

FetchResponseJs

WHATWG Response (spec subset). Constructible (new Response(body?, init?)), with status/ok/statusText/url/redirected/type/ bodyUsed/headers accessors, text/json/arrayBuffer body readers (single-use: a second read throws, per spec), clone() (throws once the body is used), and static Response.json, Response.error, Response.redirect. This is the global Response (the Playwright page-network Response is no longer a global — it is only ever a return value, matching Playwright itself).

HeadersJs

WHATWG Headers (spec subset, no external deps): names are lowercased and RFC7230-validated, values are HTTP-whitespace normalized and validated, append combines same-name values with , (; for cookie) while set-cookie is kept as separate entries, getSetCookie() returns them all, and iteration is sorted by name. keys/values/entries/[Symbol.iterator] return real iterator objects.

Functions

install

Install globalThis.fetch, bound to cx (the session’s HTTP context — same one the request binding wraps). Net policy that applies to request applies here because it is the same core.