[ejsmith]

Summary

Replaces the Deno toolchain with Vite+ 1.4 (vp), following the layout of Vite+'s own library template and vp migrate output.

Before	After
deno fmt / deno lint / deno check	vp check: Oxfmt, Oxlint (type-aware), and TypeScript 7 type-checking in one pass
deno test + @std/assert	vp test: Vitest 5 with expect
deno pack + a CI step that patched package.json	vp pack: tsdown, generated exports, publint and attw checks
deno.json	package.json, vite.config.ts, tsconfig.json, pnpm workspace (includes docs/)

Layout

• mod.ts → src/index.ts, src/mocks/mod.ts → src/mocks/index.ts, src/tests/ → tests/
• The docs site joins the pnpm workspace. One install and one lockfile replace the separate npm ci --force. VitePress 2 builds on Vite+'s bundled Vite 8.

Tests

• A TypeScript-AST codemod converted all 200 tests (same count as before). Assertions use idiomatic matchers: toBe, toEqual, toBeInstanceOf, toContain, comparison matchers, and rejects.*.
• Truthiness checks on nullable values use Vitest's assert, so later lines keep TypeScript's type narrowing.
• The one real Node/Deno difference: in Node, a Request follows its init.signal only through a weak reference. The "abort during body read" test's fake fetch didn't keep the Request reachable, so garbage collection could drop it before the abort fired. The test then hung, flakily. The test now keeps the Request alive and has a comment explaining why. Verified with forced GC.
• Integration tests no longer depend on Deno's net permission check; they always run, as they effectively did in CI.

Package output

• Still ESM-only, with the same . and ./mocks subpaths. Output is bundled into dist/ with platform: "neutral" (it targets browsers, Deno and Bun as well as Node), plus sideEffects: false.
• Keeps a top-level types field like 1.3.4, so TypeScript projects using "moduleResolution": "node" still resolve the root import. attw's esm-only profile doesn't check that mode, so this was verified with a full attw run against the 1.3.4 tarball.
• Public API is unchanged. All 59 + 4 exports match the published 1.3.4. The typings are better: deno pack had collapsed the default export and middleware to any.
• Smoke-tested the packed tarball in Node, in TypeScript (nodenext and bundler resolution), and in Deno 2.9 via npm:.

CI and publishing

• setup-vp (pinned to v1.22.0) replaces setup-deno in the CI, docs and Copilot workflows.
• The build job runs check → tests with coverage → MinVer version stamp → vp pack → vp pm pack, then uploads the tarball as an artifact.
• The publish job is the only job with id-token/packages: write. It publishes that exact tarball to npm with --provenance and to GitHub Packages. Trigger conditions, tags, the recovery-branch flow and workflow_dispatch versioning are unchanged.
• The workflow file is still ci.yml, so npm trusted publishing should keep matching.
• The publish job doesn't check out the repo, because npm refuses to run inside it: devEngines pins pnpm.
• The publish job sets the npm dist-tag once: latest for stable release versions and next for everything else, on both npm and GitHub Packages. Before, npm 11 would reject a prerelease tag like v1.4.0-beta.1, because the npmjs step passed no --tag.
• JSR publishing is removed.

CI hardening

• No shell injection: the version, ref, and dist-tag reach scripts through env:, and versions that aren't valid semver are rejected. Before, a release/npm/* branch name or a workflow_dispatch input could inject shell commands.
• Real-API tests don't gate releases: tests are split into unit and integration Vitest projects. unit has 192 tests, runs fully offline (verified with fetch disabled), and gates publishing. integration (tests/integration/) calls dummyjson.com in its own job, so an outage there can't block a release.
• CI for pull requests: CI runs on pull_request, including PRs from forks, and builds the docs site so docs or TypeDoc breaks show up before merge. Pushes now trigger CI only on main, release/npm/** and v* tags. Feature branches get CI through their PR.
• Least privilege: the workflow token defaults to contents: read, and checkout doesn't persist credentials. The docs deploy workflow gets the same treatment, plus a Pages concurrency guard.

Other

• Removed obsolete @ts-ignore: New in Deno 1.44 and deno-lint-ignore comments. Fixed the lint findings: a useless spread, a <string> cast that erasableSyntaxOnly rejects, and two redundant unknown | … unions. Added targeted suppressions for the intentional thenable class and the spread of headers that are known to be a plain object.
• VS Code: Vite+ extension pack and Oxc formatter settings. The Deno launch.json/tasks.json are removed; the Vitest extension covers debugging.
• Pre-commit hook: vp staged runs vp check --fix. It's installed by prepare: vp config on vp install.
• Dependabot now updates GitHub Actions and npm packages (root, docs, docs/typedoc) weekly, with a 3-day cooldown. vite-plus and @vitest/* are grouped, and @vitest/coverage-v8 lives in the pnpm catalog next to vite-plus, so it stays on the Vitest version Vite+ bundles.
• Docs: contributing guide, install tabs for npm/pnpm/Deno/Bun, a "Coming from JSR?" tip, and the correct CI badge.

API reference on the docs site

This replaces the JSR API docs.

• Generation: TypeDoc, typedoc-plugin-markdown, and typedoc-vitepress-theme turn the JSDoc in src/ into Markdown pages under docs/api/ on every docs build. The output is gitignored.
• Site integration: an API item in the nav and an API sidebar. Every page links to its source on GitHub. Pages are grouped by import path: @foundatiofx/fetchclient and @foundatiofx/fetchclient/mocks.
• Separate workspace package: TypeDoc only supports TypeScript up to 6.0, so it lives in docs/typedoc with TypeScript 6. Installing TypeScript 6 in docs made pnpm create a second Vite+ core instance, which broke type-checking of the VitePress config. Overrides and packageExtensions can't redirect a peer dependency, so a separate package is the way around it.
• Sidebar loading: the VitePress config reads the generated sidebar JSON at runtime, so vp check doesn't depend on the docs having been built.
• New type exports (additive): GetRequestOptions, GroupRateLimiterOptions, CacheEntry, Counter, IObjectEvent, Link, Links. These appear in public signatures but couldn't be imported before.
• Other source fixes: inlined the internal Fetch alias, and fixed two stale @param tags.

Verification

• vp check: clean, no warnings
• vp test --coverage: 13 files, 200 tests passing
• vp pack: publint and attw report no issues
• vp run docs:build: succeeds, including the generated API reference (TypeDoc: 0 errors, 0 warnings)
• actionlint: clean
• Replayed the CI build job in a fresh clone (frozen install → check → test → version stamp → pack), then ran npm publish --dry-run with npm 11 on the resulting tarball

Follow-ups (manual)

• Deprecate @foundatiofx/fetchclient on jsr.io, pointing users to npm:@foundatiofx/fetchclient.
• Confirm the npm trusted-publisher settings don't reference a GitHub environment or a job name. The publishing job is now publish; it was npm.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-05T16:50:32.734585Z	54af82e	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.