fumo:http

HTTP requires the http capability and a manifest host allowlist:

{
  "capabilities": ["http"],
  "http": { "hosts": ["api.example.com"] }
}

import { http } from "fumo:http";

const response = await http.get("https://api.example.com/state", {
    timeoutMs: 5000,
    maximumBytes: 262144,
    accept: "application/json"
});

console.log(response.status, response.json);

request, get, and post return Promises. Supported methods are GET, POST, PUT, PATCH, and DELETE. Responses contain ok, status, body, contentType, and parsed json when applicable.

Safe mode enforces HTTPS. Hosts must match an exact declaration or a declared *.domain suffix. URLs with embedded credentials are rejected. Scripts cannot set authorization or cookie headers and WinHTTP does not reuse loader credentials or cookies.

Limits:

• 256 KiB request body
• 250 to 15,000 ms timeout
• up to 4 MiB response
• four concurrent and 1,024 lifetime requests per runtime

All pending requests are cancelled and joined when the script unloads.