frontend/media/eslint.config.js keeps browser host globals out of the package core with no-restricted-globals over BROWSER_HOST - document, window, navigator, location, history, screen, localStorage, sessionStorage and the decode primitives.
It does not list fetch, Blob, File, URL, self or caches, and no script gate scans frontend/media/src at all: tests/scripts/ui_core_boundary.test.mjs reads frontend/ui-core/src only.
So the core of the package whose entire purpose is to be host-neutral could acquire a fetch( and nothing would fire. ui-core has both an ESLint rule and a text scan for this; the newer package has neither.
Direction: extend the globals list, and give frontend/media/src the same text-scan treatment ui-core gets, including the fires-on-violation probe that keeps the scan from passing vacuously.
frontend/media/eslint.config.jskeeps browser host globals out of the package core withno-restricted-globalsoverBROWSER_HOST-document,window,navigator,location,history,screen,localStorage,sessionStorageand the decode primitives.It does not list
fetch,Blob,File,URL,selforcaches, and no script gate scansfrontend/media/srcat all:tests/scripts/ui_core_boundary.test.mjsreadsfrontend/ui-core/srconly.So the core of the package whose entire purpose is to be host-neutral could acquire a
fetch(and nothing would fire.ui-corehas both an ESLint rule and a text scan for this; the newer package has neither.Direction: extend the globals list, and give
frontend/media/srcthe same text-scan treatmentui-coregets, including the fires-on-violation probe that keeps the scan from passing vacuously.