ci: fix puppeteer proxy test

2026-03-30 17:18:57 +00:00 · 2026-03-30 09:56:05 +02:00
64 changed files with 636 additions and 1454 deletions
--- a/.github/workflows/e2e-test.yml
+++ b/.github/workflows/e2e-test.yml
@@ -107,8 +107,11 @@ jobs:
          export PROXY_USERNAME=username PROXY_PASSWORD=password
          ./proxy/proxy & echo $! > PROXY.id
          ./lightpanda serve & echo $! > LPD.pid
-          URL=https://demo-browser.lightpanda.io/campfire-commerce/ node puppeteer/proxy_auth.js
          BASE_URL=https://demo-browser.lightpanda.io/ node playwright/proxy_auth.js
+          kill `cat LPD.pid`
+
+          ./lightpanda serve --http-proxy 'http://127.0.0.1:3000' & echo $! > LPD.pid
+          URL=https://demo-browser.lightpanda.io/campfire-commerce/ node puppeteer/proxy_auth.js
          kill `cat LPD.pid` `cat PROXY.id`

  # e2e tests w/ web-bot-auth configuration on.
--- a/README.md
+++ b/README.md
@@ -36,8 +36,8 @@ Lightpanda is the open-source browser made for headless usage:

 Fast web automation for AI agents, LLM training, scraping and testing:

- Ultra-low memory footprint (16x less than Chrome)
- Exceptionally fast execution (9x faster than Chrome)
+- Ultra-low memory footprint (9x less than Chrome)
+- Exceptionally fast execution (11x faster than Chrome)
 - Instant startup

 [^1]: **Playwright support disclaimer:**
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,11 +0,0 @@
-# Reporting security issues
-
-## Supported Versions
-
-Security fixes are applied to the latest `main` branch.
-
-## Reporting a Vulnerability
-
-Please **DO NOT** file a public issue, instead send your report privately to security@lightpanda.io.
-
-Security reports are greatly appreciated and we will publicly thank you for it, although we keep your name confidential if you request it.
--- a/src/App.zig
+++ b/src/App.zig
@@ -55,7 +55,7 @@ pub fn init(allocator: Allocator, config: *const Config) !*App {
        .arena_pool = undefined,
    };

-    app.network = try Network.init(allocator, app, config);
+    app.network = try Network.init(allocator, config);
    errdefer app.network.deinit();

    app.platform = try Platform.init();
--- a/src/Config.zig
+++ b/src/Config.zig
@@ -157,13 +157,6 @@ pub fn userAgentSuffix(self: *const Config) ?[]const u8 {
    };
 }

-pub fn cacheDir(self: *const Config) ?[]const u8 {
-    return switch (self.mode) {
-        inline .serve, .fetch, .mcp => |opts| opts.common.cache_dir,
-        else => null,
-    };
-}
-
 pub fn cdpTimeout(self: *const Config) usize {
    return switch (self.mode) {
        .serve => |opts| if (opts.timeout > 604_800) 604_800_000 else @as(usize, opts.timeout) * 1000,
@@ -273,7 +266,6 @@ pub const Common = struct {
    log_format: ?log.Format = null,
    log_filter_scopes: ?[]log.Scope = null,
    user_agent_suffix: ?[]const u8 = null,
-    cache_dir: ?[]const u8 = null,

    web_bot_auth_key_file: ?[]const u8 = null,
    web_bot_auth_keyid: ?[]const u8 = null,
@@ -1008,14 +1000,5 @@ fn parseCommonArg(
        return true;
    }

-    if (std.mem.eql(u8, "--cache_dir", opt)) {
-        const str = args.next() orelse {
-            log.fatal(.app, "missing argument value", .{ .arg = "--cache_dir" });
-            return error.InvalidArgument;
-        };
-        common.cache_dir = try allocator.dupe(u8, str);
-        return true;
-    }
-
    return false;
 }
--- a/src/browser/EventManager.zig
+++ b/src/browser/EventManager.zig
@@ -205,7 +205,7 @@ pub fn dispatch(self: *EventManager, target: *EventTarget, event: *Event) Dispat

 pub fn dispatchOpts(self: *EventManager, target: *EventTarget, event: *Event, comptime opts: DispatchOpts) DispatchError!void {
    event.acquireRef();
-    defer _ = event.releaseRef(self.page._session);
+    defer event.deinit(false, self.page._session);

    if (comptime IS_DEBUG) {
        log.debug(.event, "eventManager.dispatch", .{ .type = event._type_string.str(), .bubbles = event._bubbles });
@@ -240,7 +240,7 @@ pub fn dispatchDirect(self: *EventManager, target: *EventTarget, event: *Event,
    defer window._current_event = prev_event;

    event.acquireRef();
-    defer _ = event.releaseRef(page._session);
+    defer event.deinit(false, page._session);

    if (comptime IS_DEBUG) {
        log.debug(.event, "dispatchDirect", .{ .type = event._type_string, .context = opts.context });
--- a/src/browser/Factory.zig
+++ b/src/browser/Factory.zig
@@ -239,7 +239,7 @@ fn eventInit(arena: Allocator, typ: String, value: anytype) !Event {
    const time_stamp = (raw_timestamp / 2) * 2;

    return .{
-        ._rc = .{},
+        ._rc = 0,
        ._arena = arena,
        ._type = unionInit(Event.Type, value),
        ._type_string = typ,
@@ -255,7 +255,6 @@ pub fn blob(_: *const Factory, arena: Allocator, child: anytype) !*@TypeOf(child

    const blob_ptr = chain.get(0);
    blob_ptr.* = .{
-        ._rc = .{},
        ._arena = arena,
        ._type = unionInit(Blob.Type, chain.get(1)),
        ._slice = "",
@@ -272,7 +271,7 @@ pub fn abstractRange(_: *const Factory, arena: Allocator, child: anytype, page:
    const doc = page.document.asNode();
    const abstract_range = chain.get(0);
    abstract_range.* = AbstractRange{
-        ._rc = .{},
+        ._rc = 0,
        ._arena = arena,
        ._page_id = page.id,
        ._type = unionInit(AbstractRange.Type, chain.get(1)),
--- a/src/browser/HttpClient.zig
+++ b/src/browser/HttpClient.zig
@@ -32,9 +32,6 @@ const CookieJar = @import("webapi/storage/Cookie.zig").Jar;
 const http = @import("../network/http.zig");
 const Runtime = @import("../network/Runtime.zig");
 const Robots = @import("../network/Robots.zig");
-const Cache = @import("../network/cache/Cache.zig");
-const CacheMetadata = Cache.CachedMetadata;
-const CachedResponse = Cache.CachedResponse;

 const IS_DEBUG = builtin.mode == .Debug;

@@ -314,69 +311,7 @@ pub fn request(self: *Client, req: Request) !void {
    return self.fetchRobotsThenProcessRequest(robots_url, req);
 }

-fn serveFromCache(req: Request, cached: *const CachedResponse) !void {
-    const response = Response.fromCached(req.ctx, cached);
-
-    if (req.start_callback) |cb| {
-        try cb(response);
-    }
-
-    const proceed = try req.header_callback(response);
-    if (!proceed) {
-        switch (cached.data) {
-            .buffer => |_| {},
-            .file => |file| file.close(),
-        }
-        req.error_callback(req.ctx, error.Abort);
-        return;
-    }
-
-    switch (cached.data) {
-        .buffer => |data| {
-            if (data.len > 0) {
-                try req.data_callback(response, data);
-            }
-        },
-        .file => |file| {
-            defer file.close();
-            var buf: [1024]u8 = undefined;
-            var file_reader = file.reader(&buf);
-
-            const reader = &file_reader.interface;
-            var read_buf: [1024]u8 = undefined;
-
-            while (true) {
-                const curr = try reader.readSliceShort(&read_buf);
-                if (curr == 0) break;
-                try req.data_callback(response, read_buf[0..curr]);
-            }
-        },
-    }
-
-    try req.done_callback(req.ctx);
-}
-
 fn processRequest(self: *Client, req: Request) !void {
-    if (self.network.cache) |*cache| {
-        if (req.method == .GET) {
-            const arena = try self.network.app.arena_pool.acquire(.{ .debug = "HttpClient.processRequest.cache" });
-            defer self.network.app.arena_pool.release(arena);
-
-            if (cache.get(arena, .{ .url = req.url, .timestamp = std.time.timestamp() })) |cached| {
-                log.debug(.browser, "http.cache.get", .{
-                    .url = req.url,
-                    .found = true,
-                    .metadata = cached.metadata,
-                });
-
-                defer req.headers.deinit();
-                return serveFromCache(req, &cached);
-            } else {
-                log.debug(.browser, "http.cache.get", .{ .url = req.url, .found = false });
-            }
-        }
-    }
-
    const transfer = try self.makeTransfer(req);

    transfer.req.notification.dispatch(.http_request_start, &.{ .transfer = transfer });
@@ -464,10 +399,8 @@ fn fetchRobotsThenProcessRequest(self: *Client, robots_url: [:0]const u8, req: R
    try entry.value_ptr.append(self.allocator, req);
 }

-fn robotsHeaderCallback(response: Response) !bool {
-    const ctx: *RobotsRequestContext = @ptrCast(@alignCast(response.ctx));
-    // Robots callbacks only happen on real live requests.
-    const transfer = response.inner.transfer;
+fn robotsHeaderCallback(transfer: *Transfer) !bool {
+    const ctx: *RobotsRequestContext = @ptrCast(@alignCast(transfer.ctx));

    if (transfer.response_header) |hdr| {
        log.debug(.browser, "robots status", .{ .status = hdr.status, .robots_url = ctx.robots_url });
@@ -481,8 +414,8 @@ fn robotsHeaderCallback(response: Response) !bool {
    return true;
 }

-fn robotsDataCallback(response: Response, data: []const u8) !void {
-    const ctx: *RobotsRequestContext = @ptrCast(@alignCast(response.ctx));
+fn robotsDataCallback(transfer: *Transfer, data: []const u8) !void {
+    const ctx: *RobotsRequestContext = @ptrCast(@alignCast(transfer.ctx));
    try ctx.buffer.appendSlice(ctx.client.allocator, data);
 }

@@ -701,43 +634,13 @@ fn makeTransfer(self: *Client, req: Request) !*Transfer {
        .id = id,
        .url = req.url,
        .req = req,
+        .ctx = req.ctx,
        .client = self,
        .max_response_size = self.network.config.httpMaxResponseSize(),
    };
    return transfer;
 }

-fn requestFailed(transfer: *Transfer, err: anyerror, comptime execute_callback: bool) void {
-    if (transfer._notified_fail) {
-        // we can force a failed request within a callback, which will eventually
-        // result in this being called again in the more general loop. We do this
-        // because we can raise a more specific error inside a callback in some cases
-        return;
-    }
-
-    transfer._notified_fail = true;
-
-    transfer.req.notification.dispatch(.http_request_fail, &.{
-        .transfer = transfer,
-        .err = err,
-    });
-
-    if (execute_callback) {
-        transfer.req.error_callback(transfer.req.ctx, err);
-    } else if (transfer.req.shutdown_callback) |cb| {
-        cb(transfer.req.ctx);
-    }
-}
-
-// Same restriction as changeProxy. Should be ok since this is only called on
-// BrowserContext deinit.
-pub fn restoreOriginalProxy(self: *Client) !void {
-    try self.ensureNoActiveConnection();
-
-    self.http_proxy = self.network.config.httpProxy();
-    self.use_proxy = self.http_proxy != null;
-}
-
 fn makeRequest(self: *Client, conn: *http.Connection, transfer: *Transfer) anyerror!void {
    {
        // Reset per-response state for retries (auth challenge, queue).
@@ -771,7 +674,7 @@ fn makeRequest(self: *Client, conn: *http.Connection, transfer: *Transfer) anyer
    self.active += 1;

    if (transfer.req.start_callback) |cb| {
-        cb(Response.fromTransfer(transfer)) catch |err| {
+        cb(transfer) catch |err| {
            transfer.deinit();
            return err;
        };
@@ -839,10 +742,7 @@ fn processOneMessage(self: *Client, msg: http.Handles.MultiMessage, transfer: *T
    // TODO give a way to configure the number of auth retries.
    if (transfer._auth_challenge != null and transfer._tries < 10) {
        var wait_for_interception = false;
-        transfer.req.notification.dispatch(
-            .http_request_auth_required,
-            &.{ .transfer = transfer, .wait_for_interception = &wait_for_interception },
-        );
+        transfer.req.notification.dispatch(.http_request_auth_required, &.{ .transfer = transfer, .wait_for_interception = &wait_for_interception });
        if (wait_for_interception) {
            self.intercepted += 1;
            if (comptime IS_DEBUG) {
@@ -941,11 +841,10 @@ fn processOneMessage(self: *Client, msg: http.Handles.MultiMessage, transfer: *T
        }
    }

-    const body = transfer._stream_buffer.items;
-
    // Replay buffered body through user's data_callback.
    if (transfer._stream_buffer.items.len > 0) {
-        try transfer.req.data_callback(Response.fromTransfer(transfer), body);
+        const body = transfer._stream_buffer.items;
+        try transfer.req.data_callback(transfer, body);

        transfer.req.notification.dispatch(.http_response_data, &.{
            .data = body,
@@ -958,42 +857,11 @@ fn processOneMessage(self: *Client, msg: http.Handles.MultiMessage, transfer: *T
        }
    }

-    const allocator = transfer.arena.allocator();
-    var header_list: std.ArrayList(http.Header) = .empty;
-
-    var it = transfer.responseHeaderIterator();
-    while (it.next()) |hdr| {
-        header_list.append(
-            allocator,
-            .{
-                .name = try allocator.dupe(u8, hdr.name),
-                .value = try allocator.dupe(u8, hdr.value),
-            },
-        ) catch |err| {
-            log.warn(.http, "cache header collect failed", .{ .err = err });
-            break;
-        };
-    }
-
    // release conn ASAP so that it's available; some done_callbacks
    // will load more resources.
    transfer.releaseConn();

-    try transfer.req.done_callback(transfer.req.ctx);
-
-    if (transfer._pending_cache_metadata) |metadata| {
-        const cache = &self.network.cache.?;
-
-        // TODO: Support Vary Keying
-        const cache_key = transfer.req.url;
-
-        log.debug(.browser, "http cache", .{ .key = cache_key, .metadata = metadata });
-        cache.put(metadata, body) catch |err| {
-            log.warn(.http, "cache put failed", .{ .err = err });
-        };
-        log.debug(.browser, "http.cache.put", .{ .url = transfer.req.url });
-    }
-
+    try transfer.req.done_callback(transfer.ctx);
    transfer.req.notification.dispatch(.http_request_done, &.{
        .transfer = transfer,
    });
@@ -1071,9 +939,9 @@ pub const Request = struct {
    // arbitrary data that can be associated with this request
    ctx: *anyopaque = undefined,

-    start_callback: ?*const fn (response: Response) anyerror!void = null,
-    header_callback: *const fn (response: Response) anyerror!bool,
-    data_callback: *const fn (response: Response, data: []const u8) anyerror!void,
+    start_callback: ?*const fn (transfer: *Transfer) anyerror!void = null,
+    header_callback: *const fn (transfer: *Transfer) anyerror!bool,
+    data_callback: *const fn (transfer: *Transfer, data: []const u8) anyerror!void,
    done_callback: *const fn (ctx: *anyopaque) anyerror!void,
    error_callback: *const fn (ctx: *anyopaque, err: anyerror) void,
    shutdown_callback: ?*const fn (ctx: *anyopaque) void = null,
@@ -1099,84 +967,16 @@ pub const Request = struct {
    };
 };

-pub const Response = struct {
-    ctx: *anyopaque,
-    inner: union(enum) {
-        transfer: *Transfer,
-        cached: *const CachedResponse,
-    },
-
-    pub fn fromTransfer(transfer: *Transfer) Response {
-        return .{ .ctx = transfer.req.ctx, .inner = .{ .transfer = transfer } };
-    }
-
-    pub fn fromCached(ctx: *anyopaque, resp: *const CachedResponse) Response {
-        return .{ .ctx = ctx, .inner = .{ .cached = resp } };
-    }
-
-    pub fn status(self: Response) ?u16 {
-        return switch (self.inner) {
-            .transfer => |t| if (t.response_header) |rh| rh.status else null,
-            .cached => |c| c.metadata.status,
-        };
-    }
-
-    pub fn contentType(self: Response) ?[]const u8 {
-        return switch (self.inner) {
-            .transfer => |t| if (t.response_header) |*rh| rh.contentType() else null,
-            .cached => |c| c.metadata.content_type,
-        };
-    }
-
-    pub fn contentLength(self: Response) ?u32 {
-        return switch (self.inner) {
-            .transfer => |t| t.getContentLength(),
-            .cached => |c| switch (c.data) {
-                .buffer => |buf| @intCast(buf.len),
-                .file => |f| @intCast(f.getEndPos() catch 0),
-            },
-        };
-    }
-
-    pub fn redirectCount(self: Response) ?u32 {
-        return switch (self.inner) {
-            .transfer => |t| if (t.response_header) |rh| rh.redirect_count else null,
-            .cached => 0,
-        };
-    }
-
-    pub fn url(self: Response) [:0]const u8 {
-        return switch (self.inner) {
-            .transfer => |t| t.url,
-            .cached => |c| c.metadata.url,
-        };
-    }
-
-    pub fn headerIterator(self: Response) HeaderIterator {
-        return switch (self.inner) {
-            .transfer => |t| t.responseHeaderIterator(),
-            .cached => |c| HeaderIterator{ .list = .{ .list = c.metadata.headers } },
-        };
-    }
-
-    pub fn abort(self: Response, err: anyerror) void {
-        switch (self.inner) {
-            .transfer => |t| t.abort(err),
-            .cached => {},
-        }
-    }
-};
-
 pub const Transfer = struct {
    arena: ArenaAllocator,
    id: u32 = 0,
    req: Request,
    url: [:0]const u8,
+    ctx: *anyopaque, // copied from req.ctx to make it easier for callback handlers
    client: *Client,
    // total bytes received in the response, including the response status line,
    // the headers, and the [encoded] body.
    bytes_received: usize = 0,
-    _pending_cache_metadata: ?CacheMetadata = null,

    aborted: bool = false,

@@ -1265,7 +1065,7 @@ pub const Transfer = struct {
    // as abort (doesn't send a notification, doesn't invoke an error callback)
    fn kill(self: *Transfer) void {
        if (self.req.shutdown_callback) |cb| {
-            cb(self.req.ctx);
+            cb(self.ctx);
        }

        if (self._performing or self.client.performing) {
@@ -1301,7 +1101,7 @@ pub const Transfer = struct {
        });

        if (execute_callback) {
-            self.req.error_callback(self.req.ctx, err);
+            self.req.error_callback(self.ctx, err);
        } else if (self.req.shutdown_callback) |cb| {
            cb(self.ctx);
        }
@@ -1542,45 +1342,11 @@ pub const Transfer = struct {
            }
        }

-        const proceed = transfer.req.header_callback(Response.fromTransfer(transfer)) catch |err| {
+        const proceed = transfer.req.header_callback(transfer) catch |err| {
            log.err(.http, "header_callback", .{ .err = err, .req = transfer });
            return err;
        };

-        if (transfer.client.network.cache != null and transfer.req.method == .GET) {
-            const rh = &transfer.response_header.?;
-            const allocator = transfer.arena.allocator();
-
-            const maybe_cm = try Cache.tryCache(
-                allocator,
-                std.time.timestamp(),
-                transfer.url,
-                rh.status,
-                rh.contentType(),
-                if (conn.getResponseHeader("cache-control", 0)) |h| h.value else null,
-                if (conn.getResponseHeader("vary", 0)) |h| h.value else null,
-                if (conn.getResponseHeader("etag", 0)) |h| h.value else null,
-                if (conn.getResponseHeader("last-modified", 0)) |h| h.value else null,
-                if (conn.getResponseHeader("age", 0)) |h| h.value else null,
-                conn.getResponseHeader("set-cookie", 0) != null,
-                conn.getResponseHeader("authorization", 0) != null,
-            );
-
-            if (maybe_cm) |cm| {
-                var header_list: std.ArrayList(http.Header) = .empty;
-                var it = transfer.responseHeaderIterator();
-                while (it.next()) |hdr| {
-                    try header_list.append(allocator, .{
-                        .name = try allocator.dupe(u8, hdr.name),
-                        .value = try allocator.dupe(u8, hdr.value),
-                    });
-                }
-
-                transfer._pending_cache_metadata = cm;
-                transfer._pending_cache_metadata.?.headers = header_list.items;
-            }
-        }
-
        transfer.req.notification.dispatch(.http_response_header_done, &.{
            .transfer = transfer,
        });
@@ -1683,7 +1449,7 @@ pub const Transfer = struct {
    fn _fulfill(transfer: *Transfer, status: u16, headers: []const http.Header, body: ?[]const u8) !void {
        const req = &transfer.req;
        if (req.start_callback) |cb| {
-            try cb(Response.fromTransfer(transfer));
+            try cb(transfer);
        }

        transfer.response_header = .{
@@ -1702,13 +1468,13 @@ pub const Transfer = struct {
        }

        lp.assert(transfer._header_done_called == false, "Transfer.fulfill header_done_called", .{});
-        if (try req.header_callback(Response.fromTransfer(transfer)) == false) {
+        if (try req.header_callback(transfer) == false) {
            transfer.abort(error.Abort);
            return;
        }

        if (body) |b| {
-            try req.data_callback(Response.fromTransfer(transfer), b);
+            try req.data_callback(transfer, b);
        }

        try req.done_callback(req.ctx);
@@ -1745,10 +1511,10 @@ pub const Transfer = struct {
 };

 const Noop = struct {
-    fn headerCallback(_: Response) !bool {
+    fn headerCallback(_: *Transfer) !bool {
        return true;
    }
-    fn dataCallback(_: Response, _: []const u8) !void {}
+    fn dataCallback(_: *Transfer, _: []const u8) !void {}
    fn doneCallback(_: *anyopaque) !void {}
    fn errorCallback(_: *anyopaque, _: anyerror) void {}
 };
--- a/src/browser/Mime.zig
+++ b/src/browser/Mime.zig
@@ -27,9 +27,6 @@ charset: [41]u8 = default_charset,
 charset_len: usize = default_charset_len,
 is_default_charset: bool = true,

-type_buf: [127]u8 = @splat(0),
-sub_type_buf: [127]u8 = @splat(0),
-
 /// String "UTF-8" continued by null characters.
 const default_charset = .{ 'U', 'T', 'F', '-', '8' } ++ .{0} ** 36;
 const default_charset_len = 5;
@@ -64,10 +61,7 @@ pub const ContentType = union(ContentTypeEnum) {
    image_webp: void,
    application_json: void,
    unknown: void,
-    other: struct {
-        type: []const u8,
-        sub_type: []const u8,
-    },
+    other: struct { type: []const u8, sub_type: []const u8 },
 };

 pub fn contentTypeString(mime: *const Mime) []const u8 {
@@ -118,18 +112,17 @@ fn parseCharset(value: []const u8) error{ CharsetTooBig, Invalid }![]const u8 {
    return value;
 }

-pub fn parse(input: []const u8) !Mime {
+pub fn parse(input: []u8) !Mime {
    if (input.len > 255) {
        return error.TooBig;
    }

-    var buf: [255]u8 = undefined;
-    const normalized = std.ascii.lowerString(&buf, std.mem.trim(u8, input, &std.ascii.whitespace));
+    // Zig's trim API is broken. The return type is always `[]const u8`,
+    // even if the input type is `[]u8`. @constCast is safe here.
+    var normalized = @constCast(std.mem.trim(u8, input, &std.ascii.whitespace));
    _ = std.ascii.lowerString(normalized, normalized);

-    var mime = Mime{ .content_type = undefined };
-
-    const content_type, const type_len = try parseContentType(normalized, &mime.type_buf, &mime.sub_type_buf);
+    const content_type, const type_len = try parseContentType(normalized);
    if (type_len >= normalized.len) {
        return .{ .content_type = content_type };
    }
@@ -170,12 +163,13 @@ pub fn parse(input: []const u8) !Mime {
        }
    }

-    mime.params = params;
-    mime.charset = charset;
-    mime.charset_len = charset_len;
-    mime.content_type = content_type;
-    mime.is_default_charset = !has_explicit_charset;
-    return mime;
+    return .{
+        .params = params,
+        .charset = charset,
+        .charset_len = charset_len,
+        .content_type = content_type,
+        .is_default_charset = !has_explicit_charset,
+    };
 }

 /// Prescan the first 1024 bytes of an HTML document for a charset declaration.
@@ -401,7 +395,7 @@ pub fn isText(mime: *const Mime) bool {
 }

 // we expect value to be lowercase
-fn parseContentType(value: []const u8, type_buf: []u8, sub_type_buf: []u8) !struct { ContentType, usize } {
+fn parseContentType(value: []const u8) !struct { ContentType, usize } {
    const end = std.mem.indexOfScalarPos(u8, value, 0, ';') orelse value.len;
    const type_name = trimRight(value[0..end]);
    const attribute_start = end + 1;
@@ -450,18 +444,10 @@ fn parseContentType(value: []const u8, type_buf: []u8, sub_type_buf: []u8) !stru
        return error.Invalid;
    }

-    @memcpy(type_buf[0..main_type.len], main_type);
-    @memcpy(sub_type_buf[0..sub_type.len], sub_type);
-
-    return .{
-        .{
-            .other = .{
-                .type = type_buf[0..main_type.len],
-                .sub_type = sub_type_buf[0..sub_type.len],
-            },
-        },
-        attribute_start,
-    };
+    return .{ .{ .other = .{
+        .type = main_type,
+        .sub_type = sub_type,
+    } }, attribute_start };
 }

 const VALID_CODEPOINTS = blk: {
@@ -475,13 +461,6 @@ const VALID_CODEPOINTS = blk: {
    break :blk v;
 };

-pub fn typeString(self: *const Mime) []const u8 {
-    return switch (self.content_type) {
-        .other => |o| o.type[0..o.type_len],
-        else => "",
-    };
-}
-
 fn validType(value: []const u8) bool {
    for (value) |b| {
        if (VALID_CODEPOINTS[b] == false) {
--- a/src/browser/Page.zig
+++ b/src/browser/Page.zig
@@ -854,10 +854,12 @@ fn notifyParentLoadComplete(self: *Page) void {
    parent.iframeCompletedLoading(self.iframe.?);
 }

-fn pageHeaderDoneCallback(response: HttpClient.Response) !bool {
-    var self: *Page = @ptrCast(@alignCast(response.ctx));
+fn pageHeaderDoneCallback(transfer: *HttpClient.Transfer) !bool {
+    var self: *Page = @ptrCast(@alignCast(transfer.ctx));

-    const response_url = response.url();
+    const header = &transfer.response_header.?;
+
+    const response_url = std.mem.span(header.url);
    if (std.mem.eql(u8, response_url, self.url) == false) {
        // would be different than self.url in the case of a redirect
        self.url = try self.arena.dupeZ(u8, response_url);
@@ -871,8 +873,8 @@ fn pageHeaderDoneCallback(response: HttpClient.Response) !bool {
    if (comptime IS_DEBUG) {
        log.debug(.page, "navigate header", .{
            .url = self.url,
-            .status = response.status(),
-            .content_type = response.contentType(),
+            .status = header.status,
+            .content_type = header.contentType(),
            .type = self._type,
        });
    }
@@ -880,14 +882,14 @@ fn pageHeaderDoneCallback(response: HttpClient.Response) !bool {
    return true;
 }

-fn pageDataCallback(response: HttpClient.Response, data: []const u8) !void {
-    var self: *Page = @ptrCast(@alignCast(response.ctx));
+fn pageDataCallback(transfer: *HttpClient.Transfer, data: []const u8) !void {
+    var self: *Page = @ptrCast(@alignCast(transfer.ctx));

    if (self._parse_state == .pre) {
        // we lazily do this, because we might need the first chunk of data
        // to sniff the content type
        var mime: Mime = blk: {
-            if (response.contentType()) |ct| {
+            if (transfer.response_header.?.contentType()) |ct| {
                break :blk try Mime.parse(ct);
            }
            break :blk Mime.sniff(data);
@@ -3390,7 +3392,7 @@ pub fn handleClick(self: *Page, target: *Node) !void {
 pub fn triggerKeyboard(self: *Page, keyboard_event: *KeyboardEvent) !void {
    const event = keyboard_event.asEvent();
    const element = self.window._document._active_element orelse {
-        _ = event.releaseRef(self._session);
+        keyboard_event.deinit(false, self._session);
        return;
    };

@@ -3486,7 +3488,7 @@ pub fn submitForm(self: *Page, submitter_: ?*Element, form_: ?*Element.Html.Form

        // so submit_event is still valid when we check _prevent_default
        submit_event.acquireRef();
-        defer _ = submit_event.releaseRef(self._session);
+        defer submit_event.deinit(false, self._session);

        try self._event_manager.dispatch(form_element.asEventTarget(), submit_event);
        // If the submit event was prevented, don't submit the form
--- a/src/browser/ScriptManager.zig
+++ b/src/browser/ScriptManager.zig
@@ -694,86 +694,82 @@ pub const Script = struct {
        self.manager.page.releaseArena(self.arena);
    }

-    fn startCallback(response: HttpClient.Response) !void {
-        log.debug(.http, "script fetch start", .{ .req = response });
+    fn startCallback(transfer: *HttpClient.Transfer) !void {
+        log.debug(.http, "script fetch start", .{ .req = transfer });
    }

-    fn headerCallback(response: HttpClient.Response) !bool {
-        const self: *Script = @ptrCast(@alignCast(response.ctx));
-
-        self.status = response.status().?;
-        if (response.status() != 200) {
+    fn headerCallback(transfer: *HttpClient.Transfer) !bool {
+        const self: *Script = @ptrCast(@alignCast(transfer.ctx));
+        const header = &transfer.response_header.?;
+        self.status = header.status;
+        if (header.status != 200) {
            log.info(.http, "script header", .{
-                .req = response,
-                .status = response.status(),
-                .content_type = response.contentType(),
+                .req = transfer,
+                .status = header.status,
+                .content_type = header.contentType(),
            });
            return false;
        }

        if (comptime IS_DEBUG) {
            log.debug(.http, "script header", .{
-                .req = response,
-                .status = response.status(),
-                .content_type = response.contentType(),
+                .req = transfer,
+                .status = header.status,
+                .content_type = header.contentType(),
            });
        }

-        switch (response.inner) {
-            .transfer => |transfer| {
-                // temp debug, trying to figure out why the next assert sometimes
-                // fails. Is the buffer just corrupt or is headerCallback really
-                // being called twice?
-                lp.assert(self.header_callback_called == false, "ScriptManager.Header recall", .{
-                    .m = @tagName(std.meta.activeTag(self.mode)),
-                    .a1 = self.debug_transfer_id,
-                    .a2 = self.debug_transfer_tries,
-                    .a3 = self.debug_transfer_aborted,
-                    .a4 = self.debug_transfer_bytes_received,
-                    .a5 = self.debug_transfer_notified_fail,
-                    .a7 = self.debug_transfer_intercept_state,
-                    .a8 = self.debug_transfer_auth_challenge,
-                    .a9 = self.debug_transfer_easy_id,
-                    .b1 = transfer.id,
-                    .b2 = transfer._tries,
-                    .b3 = transfer.aborted,
-                    .b4 = transfer.bytes_received,
-                    .b5 = transfer._notified_fail,
-                    .b7 = @intFromEnum(transfer._intercept_state),
-                    .b8 = transfer._auth_challenge != null,
-                    .b9 = if (transfer._conn) |c| @intFromPtr(c._easy) else 0,
-                });
-                self.header_callback_called = true;
-                self.debug_transfer_id = transfer.id;
-                self.debug_transfer_tries = transfer._tries;
-                self.debug_transfer_aborted = transfer.aborted;
-                self.debug_transfer_bytes_received = transfer.bytes_received;
-                self.debug_transfer_notified_fail = transfer._notified_fail;
-                self.debug_transfer_intercept_state = @intFromEnum(transfer._intercept_state);
-                self.debug_transfer_auth_challenge = transfer._auth_challenge != null;
-                self.debug_transfer_easy_id = if (transfer._conn) |c| @intFromPtr(c._easy) else 0;
-            },
-            else => {},
+        {
+            // temp debug, trying to figure out why the next assert sometimes
+            // fails. Is the buffer just corrupt or is headerCallback really
+            // being called twice?
+            lp.assert(self.header_callback_called == false, "ScriptManager.Header recall", .{
+                .m = @tagName(std.meta.activeTag(self.mode)),
+                .a1 = self.debug_transfer_id,
+                .a2 = self.debug_transfer_tries,
+                .a3 = self.debug_transfer_aborted,
+                .a4 = self.debug_transfer_bytes_received,
+                .a5 = self.debug_transfer_notified_fail,
+                .a7 = self.debug_transfer_intercept_state,
+                .a8 = self.debug_transfer_auth_challenge,
+                .a9 = self.debug_transfer_easy_id,
+                .b1 = transfer.id,
+                .b2 = transfer._tries,
+                .b3 = transfer.aborted,
+                .b4 = transfer.bytes_received,
+                .b5 = transfer._notified_fail,
+                .b7 = @intFromEnum(transfer._intercept_state),
+                .b8 = transfer._auth_challenge != null,
+                .b9 = if (transfer._conn) |c| @intFromPtr(c._easy) else 0,
+            });
+            self.header_callback_called = true;
+            self.debug_transfer_id = transfer.id;
+            self.debug_transfer_tries = transfer._tries;
+            self.debug_transfer_aborted = transfer.aborted;
+            self.debug_transfer_bytes_received = transfer.bytes_received;
+            self.debug_transfer_notified_fail = transfer._notified_fail;
+            self.debug_transfer_intercept_state = @intFromEnum(transfer._intercept_state);
+            self.debug_transfer_auth_challenge = transfer._auth_challenge != null;
+            self.debug_transfer_easy_id = if (transfer._conn) |c| @intFromPtr(c._easy) else 0;
        }

        lp.assert(self.source.remote.capacity == 0, "ScriptManager.Header buffer", .{ .capacity = self.source.remote.capacity });
        var buffer: std.ArrayList(u8) = .empty;
-        if (response.contentLength()) |cl| {
+        if (transfer.getContentLength()) |cl| {
            try buffer.ensureTotalCapacity(self.arena, cl);
        }
        self.source = .{ .remote = buffer };
        return true;
    }

-    fn dataCallback(response: HttpClient.Response, data: []const u8) !void {
-        const self: *Script = @ptrCast(@alignCast(response.ctx));
-        self._dataCallback(response, data) catch |err| {
-            log.err(.http, "SM.dataCallback", .{ .err = err, .transfer = response, .len = data.len });
+    fn dataCallback(transfer: *HttpClient.Transfer, data: []const u8) !void {
+        const self: *Script = @ptrCast(@alignCast(transfer.ctx));
+        self._dataCallback(transfer, data) catch |err| {
+            log.err(.http, "SM.dataCallback", .{ .err = err, .transfer = transfer, .len = data.len });
            return err;
        };
    }
-
-    fn _dataCallback(self: *Script, _: HttpClient.Response, data: []const u8) !void {
+    fn _dataCallback(self: *Script, _: *HttpClient.Transfer, data: []const u8) !void {
        try self.source.remote.appendSlice(self.arena, data);
    }

--- a/src/browser/Session.zig
+++ b/src/browser/Session.zig
@@ -71,18 +71,6 @@ origins: std.StringHashMapUnmanaged(*js.Origin) = .empty,
 // ensuring object identity works across same-origin frames.
 identity: js.Identity = .{},

-// Shared finalizer callbacks across all Identities. Keyed by Zig instance ptr.
-// This ensures objects are only freed when ALL v8 wrappers are gone.
-finalizer_callbacks: std.AutoHashMapUnmanaged(usize, *FinalizerCallback) = .empty,
-
-// Tracked global v8 objects that need to be released on cleanup.
-// Lives at Session level so objects can outlive individual Identities.
-globals: std.ArrayList(v8.Global) = .empty,
-
-// Temporary v8 globals that can be released early. Key is global.data_ptr.
-// Lives at Session level so objects holding Temps can outlive individual Identities.
-temps: std.AutoHashMapUnmanaged(usize, v8.Global) = .empty,
-
 // Shared resources for all pages in this session.
 // These live for the duration of the page tree (root + frames).
 arena_pool: *ArenaPool,
@@ -236,30 +224,6 @@ pub fn releaseOrigin(self: *Session, origin: *js.Origin) void {
 /// Reset page_arena and factory for a clean slate.
 /// Called when root page is removed.
 fn resetPageResources(self: *Session) void {
-    // Force cleanup all remaining finalized objects
-    {
-        var it = self.finalizer_callbacks.valueIterator();
-        while (it.next()) |fc| {
-            fc.*.deinit(self);
-        }
-        self.finalizer_callbacks = .empty;
-    }
-
-    {
-        for (self.globals.items) |*global| {
-            v8.v8__Global__Reset(global);
-        }
-        self.globals = .empty;
-    }
-
-    {
-        var it = self.temps.valueIterator();
-        while (it.next()) |global| {
-            v8.v8__Global__Reset(global);
-        }
-        self.temps = .empty;
-    }
-
    self.identity.deinit();
    self.identity = .{};

@@ -493,25 +457,35 @@ pub fn nextPageId(self: *Session) u32 {
    return id;
 }

-// Every finalizable instance of Zig gets 1 FinalizerCallback registered in the
-// session. This is to ensure that, if v8 doesn't finalize the value, we can
-// release on page reset.
+// A type that has a finalizer can have its finalizer called one of two ways.
+// The first is from V8 via the WeakCallback we give to weakRef. But that isn't
+// guaranteed to fire, so we track this in finalizer_callbacks and call them on
+// page reset.
 pub const FinalizerCallback = struct {
    arena: Allocator,
    session: *Session,
-    resolved_ptr_id: usize,
-    finalizer_ptr_id: usize,
-    _deinit: *const fn (ptr_id: usize, session: *Session) void,
+    ptr: *anyopaque,
+    global: v8.Global,
+    identity: *js.Identity,
+    zig_finalizer: *const fn (ptr: *anyopaque, session: *Session) void,

-    // For every FinalizerCallback we'll have 1+ FinalizerCallback.Identity: one
-    // for every identity that gets the instance. In most cases, that'l be 1.
-    pub const Identity = struct {
-        identity: *js.Identity,
-        fc: *Session.FinalizerCallback,
-    };
+    pub fn deinit(self: *FinalizerCallback) void {
+        self.zig_finalizer(self.ptr, self.session);
+        self.session.releaseArena(self.arena);
+    }
+
+    /// Release this item from the identity tracking maps (called after finalizer runs from V8)
+    pub fn releaseIdentity(self: *FinalizerCallback) void {
+        const session = self.session;
+        const id = @intFromPtr(self.ptr);
+
+        if (self.identity.identity_map.fetchRemove(id)) |kv| {
+            var global = kv.value;
+            v8.v8__Global__Reset(&global);
+        }
+
+        _ = self.identity.finalizer_callbacks.remove(id);

-    fn deinit(self: *FinalizerCallback, session: *Session) void {
-        self._deinit(self.finalizer_ptr_id, session);
        session.releaseArena(self.arena);
    }
 };
--- a/src/browser/js/Context.zig
+++ b/src/browser/js/Context.zig
@@ -21,7 +21,6 @@ const lp = @import("lightpanda");
 const log = @import("../../log.zig");

 const js = @import("js.zig");
-const bridge = @import("bridge.zig");
 const Env = @import("Env.zig");
 const Origin = @import("Origin.zig");
 const Scheduler = @import("Scheduler.zig");
@@ -214,11 +213,48 @@ pub fn setOrigin(self: *Context, key: ?[]const u8) !void {
 }

 pub fn trackGlobal(self: *Context, global: v8.Global) !void {
-    return self.session.globals.append(self.session.page_arena, global);
+    return self.identity.globals.append(self.identity_arena, global);
 }

 pub fn trackTemp(self: *Context, global: v8.Global) !void {
-    return self.session.temps.put(self.session.page_arena, global.data_ptr, global);
+    return self.identity.temps.put(self.identity_arena, global.data_ptr, global);
+}
+
+pub fn weakRef(self: *Context, obj: anytype) void {
+    const resolved = js.Local.resolveValue(obj);
+    const fc = self.identity.finalizer_callbacks.get(@intFromPtr(resolved.ptr)) orelse {
+        if (comptime IS_DEBUG) {
+            // should not be possible
+            std.debug.assert(false);
+        }
+        return;
+    };
+    v8.v8__Global__SetWeakFinalizer(&fc.global, fc, resolved.finalizer_from_v8, v8.kParameter);
+}
+
+pub fn safeWeakRef(self: *Context, obj: anytype) void {
+    const resolved = js.Local.resolveValue(obj);
+    const fc = self.identity.finalizer_callbacks.get(@intFromPtr(resolved.ptr)) orelse {
+        if (comptime IS_DEBUG) {
+            // should not be possible
+            std.debug.assert(false);
+        }
+        return;
+    };
+    v8.v8__Global__ClearWeak(&fc.global);
+    v8.v8__Global__SetWeakFinalizer(&fc.global, fc, resolved.finalizer_from_v8, v8.kParameter);
+}
+
+pub fn strongRef(self: *Context, obj: anytype) void {
+    const resolved = js.Local.resolveValue(obj);
+    const fc = self.identity.finalizer_callbacks.get(@intFromPtr(resolved.ptr)) orelse {
+        if (comptime IS_DEBUG) {
+            // should not be possible
+            std.debug.assert(false);
+        }
+        return;
+    };
+    v8.v8__Global__ClearWeak(&fc.global);
 }

 pub const IdentityResult = struct {
@@ -234,6 +270,35 @@ pub fn addIdentity(self: *Context, ptr: usize) !IdentityResult {
    };
 }

+pub fn releaseTemp(self: *Context, global: v8.Global) void {
+    if (self.identity.temps.fetchRemove(global.data_ptr)) |kv| {
+        var g = kv.value;
+        v8.v8__Global__Reset(&g);
+    }
+}
+
+pub fn createFinalizerCallback(
+    self: *Context,
+    global: v8.Global,
+    ptr: *anyopaque,
+    zig_finalizer: *const fn (ptr: *anyopaque, session: *Session) void,
+) !*Session.FinalizerCallback {
+    const session = self.session;
+    const arena = try session.getArena(.{ .debug = "FinalizerCallback" });
+    errdefer session.releaseArena(arena);
+    const fc = try arena.create(Session.FinalizerCallback);
+    fc.* = .{
+        .arena = arena,
+        .session = session,
+        .ptr = ptr,
+        .global = global,
+        .zig_finalizer = zig_finalizer,
+        // Store identity pointer for cleanup when V8 GCs the object
+        .identity = self.identity,
+    };
+    return fc;
+}
+
 // Any operation on the context have to be made from a local.
 pub fn localScope(self: *Context, ls: *js.Local.Scope) void {
    const isolate = self.isolate;
--- a/src/browser/js/Function.zig
+++ b/src/browser/js/Function.zig
@@ -213,7 +213,7 @@ fn _persist(self: *const Function, comptime is_global: bool) !(if (is_global) Gl
        return .{ .handle = global, .temps = {} };
    }
    try ctx.trackTemp(global);
-    return .{ .handle = global, .temps = &ctx.session.temps };
+    return .{ .handle = global, .temps = &ctx.identity.temps };
 }

 pub fn tempWithThis(self: *const Function, value: anytype) !Temp {
--- a/src/browser/js/Identity.zig
+++ b/src/browser/js/Identity.zig
@@ -38,9 +38,38 @@ const Identity = @This();
 // Maps Zig instance pointers to their v8::Global(Object) wrappers.
 identity_map: std.AutoHashMapUnmanaged(usize, v8.Global) = .empty,

+// Tracked global v8 objects that need to be released on cleanup.
+globals: std.ArrayList(v8.Global) = .empty,
+
+// Temporary v8 globals that can be released early. Key is global.data_ptr.
+temps: std.AutoHashMapUnmanaged(usize, v8.Global) = .empty,
+
+// Finalizer callbacks for weak references. Key is @intFromPtr of the Zig instance.
+finalizer_callbacks: std.AutoHashMapUnmanaged(usize, *Session.FinalizerCallback) = .empty,
+
 pub fn deinit(self: *Identity) void {
-    var it = self.identity_map.valueIterator();
-    while (it.next()) |global| {
+    {
+        var it = self.finalizer_callbacks.valueIterator();
+        while (it.next()) |finalizer| {
+            finalizer.*.deinit();
+        }
+    }
+
+    {
+        var it = self.identity_map.valueIterator();
+        while (it.next()) |global| {
+            v8.v8__Global__Reset(global);
+        }
+    }
+
+    for (self.globals.items) |*global| {
        v8.v8__Global__Reset(global);
    }
+
+    {
+        var it = self.temps.valueIterator();
+        while (it.next()) |global| {
+            v8.v8__Global__Reset(global);
+        }
+    }
 }
--- a/src/browser/js/Local.zig
+++ b/src/browser/js/Local.zig
@@ -17,11 +17,10 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.

 const std = @import("std");
+const Session = @import("../Session.zig");
 const log = @import("../../log.zig");
 const string = @import("../../string.zig");

-const Session = @import("../Session.zig");
-
 const js = @import("js.zig");
 const bridge = @import("bridge.zig");
 const Caller = @import("Caller.zig");
@@ -214,8 +213,7 @@ pub fn mapZigInstanceToJs(self: *const Local, js_obj_handle: ?*const v8.Object,
        .pointer => |ptr| {
            const resolved = resolveValue(value);

-            const resolved_ptr_id = @intFromPtr(resolved.ptr);
-            const gop = try ctx.addIdentity(resolved_ptr_id);
+            const gop = try ctx.addIdentity(@intFromPtr(resolved.ptr));
            if (gop.found_existing) {
                // we've seen this instance before, return the same object
                return (js.Object.Global{ .handle = gop.value_ptr.* }).local(self);
@@ -264,27 +262,31 @@ pub fn mapZigInstanceToJs(self: *const Local, js_obj_handle: ?*const v8.Object,
            // dont' use js_obj.persist(), because we don't want to track this in
            // context.global_objects, we want to track it in context.identity_map.
            v8.v8__Global__New(isolate.handle, js_obj.handle, gop.value_ptr);
-            if (resolved.finalizer) |finalizer| {
-                const finalizer_ptr_id = finalizer.ptr_id;
-                finalizer.acquireRef(finalizer_ptr_id);
-
-                const session = ctx.session;
-                const finalizer_gop = try session.finalizer_callbacks.getOrPut(session.page_arena, finalizer_ptr_id);
-                if (finalizer_gop.found_existing == false) {
-                    // This is the first context (and very likely only one) to
-                    // see this Zig instance. We need to create the FinalizerCallback
-                    // so that we can cleanup on page reset if v8 doesn't finalize.
-                    errdefer _ = session.finalizer_callbacks.remove(finalizer_ptr_id);
-                    finalizer_gop.value_ptr.* = try self.createFinalizerCallback(resolved_ptr_id, finalizer_ptr_id, finalizer.deinit);
+            if (@hasDecl(JsApi.Meta, "finalizer")) {
+                // It would be great if resolved knew the resolved type, but I
+                // can't figure out how to make that work, since it depends on
+                // the [runtime] `value`.
+                // We need the resolved finalizer, which we have in resolved.
+                //
+                // The above if statement would be more clear as:
+                //    if (resolved.finalizer_from_v8) |finalizer| {
+                // But that's a runtime check.
+                // Instead, we check if the base has finalizer. The assumption
+                // here is that if a resolve type has a finalizer, then the base
+                // should have a finalizer too.
+                const fc = try ctx.createFinalizerCallback(gop.value_ptr.*, resolved.ptr, resolved.finalizer_from_zig.?);
+                {
+                    errdefer fc.deinit();
+                    try ctx.identity.finalizer_callbacks.put(ctx.identity_arena, @intFromPtr(resolved.ptr), fc);
                }
-                const fc = finalizer_gop.value_ptr.*;
-                const identity_finalizer = try fc.arena.create(Session.FinalizerCallback.Identity);
-                identity_finalizer.* = .{
-                    .fc = fc,
-                    .identity = ctx.identity,
-                };

-                v8.v8__Global__SetWeakFinalizer(gop.value_ptr, identity_finalizer, finalizer.release, v8.kParameter);
+                conditionallyReference(value);
+                if (@hasDecl(JsApi.Meta, "weak")) {
+                    if (comptime IS_DEBUG) {
+                        std.debug.assert(JsApi.Meta.weak == true);
+                    }
+                    v8.v8__Global__SetWeakFinalizer(gop.value_ptr, fc, resolved.finalizer_from_v8, v8.kParameter);
+                }
            }
            return js_obj;
        },
@@ -1119,19 +1121,12 @@ fn jsUnsignedIntToZig(comptime T: type, max: comptime_int, maybe: u32) !T {
 // This function recursively walks the _type union field (if there is one) to
 // get the most specific class_id possible.
 const Resolved = struct {
+    weak: bool,
    ptr: *anyopaque,
    class_id: u16,
    prototype_chain: []const @import("TaggedOpaque.zig").PrototypeChainEntry,
-    finalizer: ?Finalizer,
-
-    const Finalizer = struct {
-        // Resolved.ptr is the most specific value in a chain (e.g. IFrame, not EventTarget, Node,  ...)
-        // Finalizer.ptr_id is the most specific value in a chain that defines an acquireRef
-        ptr_id: usize,
-        deinit: *const fn (ptr_id: usize, session: *Session) void,
-        acquireRef: *const fn (ptr_id: usize) void,
-        release: *const fn (handle: ?*const v8.WeakCallbackInfo) callconv(.c) void,
-    };
+    finalizer_from_v8: ?*const fn (handle: ?*const v8.WeakCallbackInfo) callconv(.c) void = null,
+    finalizer_from_zig: ?*const fn (ptr: *anyopaque, session: *Session) void = null,
 };
 pub fn resolveValue(value: anytype) Resolved {
    const T = bridge.Struct(@TypeOf(value));
@@ -1158,85 +1153,27 @@ pub fn resolveValue(value: anytype) Resolved {
    unreachable;
 }

-fn resolveT(comptime T: type, value: *T) Resolved {
+fn resolveT(comptime T: type, value: *anyopaque) Resolved {
    const Meta = T.JsApi.Meta;
    return .{
        .ptr = value,
        .class_id = Meta.class_id,
        .prototype_chain = &Meta.prototype_chain,
-        .finalizer = blk: {
-            const FT = (comptime findFinalizerType(T)) orelse break :blk null;
-            const getFinalizerPtr = comptime finalizerPtrGetter(T, FT);
-            const finalizer_ptr = getFinalizerPtr(value);
-
-            const Wrap = struct {
-                fn deinit(ptr_id: usize, session: *Session) void {
-                    FT.deinit(@ptrFromInt(ptr_id), session);
-                }
-
-                fn acquireRef(ptr_id: usize) void {
-                    FT.acquireRef(@ptrFromInt(ptr_id));
-                }
-
-                fn release(handle: ?*const v8.WeakCallbackInfo) callconv(.c) void {
-                    const ptr = v8.v8__WeakCallbackInfo__GetParameter(handle.?).?;
-                    const identity_finalizer: *Session.FinalizerCallback.Identity = @ptrCast(@alignCast(ptr));
-
-                    const fc = identity_finalizer.fc;
-                    if (identity_finalizer.identity.identity_map.fetchRemove(fc.resolved_ptr_id)) |kv| {
-                        var global = kv.value;
-                        v8.v8__Global__Reset(&global);
-                    }
-
-                    FT.releaseRef(@ptrFromInt(fc.finalizer_ptr_id), fc.session);
-                }
-            };
-            break :blk .{
-                .ptr_id = @intFromPtr(finalizer_ptr),
-                .deinit = Wrap.deinit,
-                .acquireRef = Wrap.acquireRef,
-                .release = Wrap.release,
-            };
-        },
+        .weak = if (@hasDecl(Meta, "weak")) Meta.weak else false,
+        .finalizer_from_v8 = if (@hasDecl(Meta, "finalizer")) Meta.finalizer.from_v8 else null,
+        .finalizer_from_zig = if (@hasDecl(Meta, "finalizer")) Meta.finalizer.from_zig else null,
    };
 }

-// Start at the "resolved" type (the most specific) and work our way up the
-// prototype chain looking for the type that defines acquireRef
-fn findFinalizerType(comptime T: type) ?type {
-    const S = bridge.Struct(T);
-    if (@hasDecl(S, "acquireRef")) {
-        return S;
+fn conditionallyReference(value: anytype) void {
+    const T = bridge.Struct(@TypeOf(value));
+    if (@hasDecl(T, "acquireRef")) {
+        value.acquireRef();
+        return;
    }
-    if (@hasField(S, "_proto")) {
-        const ProtoPtr = std.meta.fieldInfo(S, ._proto).type;
-        const ProtoChild = @typeInfo(ProtoPtr).pointer.child;
-        return findFinalizerType(ProtoChild);
+    if (@hasField(T, "_proto")) {
+        conditionallyReference(value._proto);
    }
-    return null;
-}
-
-// Generate a function that follows the _proto pointer chain to get to the finalizer type
-fn finalizerPtrGetter(comptime T: type, comptime FT: type) *const fn (*T) *FT {
-    const S = bridge.Struct(T);
-    if (S == FT) {
-        return struct {
-            fn get(v: *T) *FT {
-                return v;
-            }
-        }.get;
-    }
-    if (@hasField(S, "_proto")) {
-        const ProtoPtr = std.meta.fieldInfo(S, ._proto).type;
-        const ProtoChild = @typeInfo(ProtoPtr).pointer.child;
-        const childGetter = comptime finalizerPtrGetter(ProtoChild, FT);
-        return struct {
-            fn get(v: *T) *FT {
-                return childGetter(v._proto);
-            }
-        }.get;
-    }
-    @compileError("Cannot find path from " ++ @typeName(T) ++ " to " ++ @typeName(FT));
 }

 pub fn stackTrace(self: *const Local) !?[]const u8 {
@@ -1444,34 +1381,6 @@ pub fn debugContextId(self: *const Local) i32 {
    return v8.v8__Context__DebugContextId(self.handle);
 }

-fn createFinalizerCallback(
-    self: *const Local,
-
-    // Key in identity map
-    // The most specific value (KeyboardEvent, not Event)
-    resolved_ptr_id: usize,
-
-    // The most specific value where finalizers are defined
-    // What actually gets acquired / released / deinit
-    finalizer_ptr_id: usize,
-    deinit: *const fn (ptr_id: usize, session: *Session) void,
-) !*Session.FinalizerCallback {
-    const session = self.ctx.session;
-
-    const arena = try session.getArena(.{ .debug = "FinalizerCallback" });
-    errdefer session.releaseArena(arena);
-
-    const fc = try arena.create(Session.FinalizerCallback);
-    fc.* = .{
-        .arena = arena,
-        .session = session,
-        ._deinit = deinit,
-        .resolved_ptr_id = resolved_ptr_id,
-        .finalizer_ptr_id = finalizer_ptr_id,
-    };
-    return fc;
-}
-
 // Encapsulates a Local and a HandleScope. When we're going from V8->Zig
 // we easily get both a Local and a HandleScope via Caller.init.
 // But when we're going from Zig -> V8, things are more complicated.
--- a/src/browser/js/Promise.zig
+++ b/src/browser/js/Promise.zig
@@ -67,7 +67,7 @@ fn _persist(self: *const Promise, comptime is_global: bool) !(if (is_global) Glo
        return .{ .handle = global, .temps = {} };
    }
    try ctx.trackTemp(global);
-    return .{ .handle = global, .temps = &ctx.session.temps };
+    return .{ .handle = global, .temps = &ctx.identity.temps };
 }

 pub const Temp = G(.temp);
--- a/src/browser/js/Value.zig
+++ b/src/browser/js/Value.zig
@@ -303,7 +303,7 @@ fn _persist(self: *const Value, comptime is_global: bool) !(if (is_global) Globa
        return .{ .handle = global, .temps = {} };
    }
    try ctx.trackTemp(global);
-    return .{ .handle = global, .temps = &ctx.session.temps };
+    return .{ .handle = global, .temps = &ctx.identity.temps };
 }

 pub fn toZig(self: Value, comptime T: type) !T {
--- a/src/browser/js/bridge.zig
+++ b/src/browser/js/bridge.zig
@@ -101,19 +101,34 @@ pub fn Builder(comptime T: type) type {
            }
            return entries;
        }
-    };
-}

-fn releaseRef(comptime T: type, ptr_id: usize, session: *Session) void {
-    if (@hasDecl(T, "releaseRef")) {
-        T.releaseRef(@ptrFromInt(ptr_id), session);
-        return;
-    }
-    if (@hasField(T, "_proto")) {
-        releaseRef(Struct(std.meta.fieldInfo(T, ._proto).type), ptr_id, session);
-        return;
-    }
-    @compileError(@typeName(T) ++ " marked with finalizer without an acquireRef in its prototype chain");
+        pub fn finalizer(comptime func: *const fn (self: *T, shutdown: bool, session: *Session) void) Finalizer {
+            return .{
+                .from_zig = struct {
+                    fn wrap(ptr: *anyopaque, session: *Session) void {
+                        func(@ptrCast(@alignCast(ptr)), true, session);
+                    }
+                }.wrap,
+
+                .from_v8 = struct {
+                    fn wrap(handle: ?*const v8.WeakCallbackInfo) callconv(.c) void {
+                        const ptr = v8.v8__WeakCallbackInfo__GetParameter(handle.?).?;
+                        const fc: *Session.FinalizerCallback = @ptrCast(@alignCast(ptr));
+
+                        const value_ptr = fc.ptr;
+                        if (fc.identity.finalizer_callbacks.contains(@intFromPtr(value_ptr))) {
+                            func(@ptrCast(@alignCast(value_ptr)), false, fc.session);
+                            fc.releaseIdentity();
+                        } else {
+                            // A bit weird, but v8 _requires_ that we release it
+                            // If we don't. We'll 100% crash.
+                            v8.v8__Global__Reset(&fc.global);
+                        }
+                    }
+                }.wrap,
+            };
+        }
+    };
 }

 pub const Constructor = struct {
@@ -396,6 +411,17 @@ pub const Property = struct {
    }
 };

+const Finalizer = struct {
+    // The finalizer wrapper when called from Zig. This is only called on
+    // Origin.deinit
+    from_zig: *const fn (ctx: *anyopaque, session: *Session) void,
+
+    // The finalizer wrapper when called from V8. This may never be called
+    // (hence why we fallback to calling in Origin.deinit). If it is called,
+    // it is only ever called after we SetWeak on the Global.
+    from_v8: *const fn (?*const v8.WeakCallbackInfo) callconv(.c) void,
+};
+
 pub fn unknownWindowPropertyCallback(c_name: ?*const v8.Name, handle: ?*const v8.PropertyCallbackInfo) callconv(.c) u8 {
    const v8_isolate = v8.v8__PropertyCallbackInfo__GetIsolate(handle).?;
    var caller: Caller = undefined;
--- a/src/browser/webapi/AbstractRange.zig
+++ b/src/browser/webapi/AbstractRange.zig
@@ -17,8 +17,6 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.

 const std = @import("std");
-const lp = @import("lightpanda");
-
 const js = @import("../js/js.zig");

 const Session = @import("../Session.zig");
@@ -33,7 +31,7 @@ const AbstractRange = @This();

 pub const _prototype_root = true;

-_rc: lp.RC(u8) = .{},
+_rc: u8,
 _type: Type,
 _page_id: u32,
 _arena: Allocator,
@@ -46,18 +44,24 @@ _start_container: *Node,
 _range_link: std.DoublyLinkedList.Node = .{},

 pub fn acquireRef(self: *AbstractRange) void {
-    self._rc.acquire();
+    self._rc += 1;
 }

-pub fn deinit(self: *AbstractRange, session: *Session) void {
-    if (session.findPageById(self._page_id)) |page| {
-        page._live_ranges.remove(&self._range_link);
+pub fn deinit(self: *AbstractRange, shutdown: bool, session: *Session) void {
+    _ = shutdown;
+    const rc = self._rc;
+    if (comptime IS_DEBUG) {
+        std.debug.assert(rc != 0);
    }
-    session.releaseArena(self._arena);
-}

-pub fn releaseRef(self: *AbstractRange, session: *Session) void {
-    self._rc.release(self, session);
+    if (rc == 1) {
+        if (session.findPageById(self._page_id)) |page| {
+            page._live_ranges.remove(&self._range_link);
+        }
+        session.releaseArena(self._arena);
+        return;
+    }
+    self._rc = rc - 1;
 }

 pub const Type = union(enum) {
@@ -334,6 +338,8 @@ pub const JsApi = struct {
        pub const name = "AbstractRange";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(AbstractRange.deinit);
    };

    pub const startContainer = bridge.accessor(AbstractRange.getStartContainer, null, .{});
--- a/src/browser/webapi/Blob.zig
+++ b/src/browser/webapi/Blob.zig
@@ -17,7 +17,7 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.

 const std = @import("std");
-const lp = @import("lightpanda");
+const Writer = std.Io.Writer;

 const js = @import("../js/js.zig");
 const Page = @import("../Page.zig");
@@ -25,7 +25,6 @@ const Session = @import("../Session.zig");

 const Mime = @import("../Mime.zig");

-const Writer = std.Io.Writer;
 const Allocator = std.mem.Allocator;

 /// https://w3c.github.io/FileAPI/#blob-section
@@ -35,7 +34,6 @@ const Blob = @This();
 pub const _prototype_root = true;

 _type: Type,
-_rc: lp.RC(u32),

 _arena: Allocator,

@@ -122,7 +120,6 @@ pub fn initWithMimeValidation(

    const self = try arena.create(Blob);
    self.* = .{
-        ._rc = .{},
        ._arena = arena,
        ._type = .generic,
        ._slice = data,
@@ -131,18 +128,11 @@ pub fn initWithMimeValidation(
    return self;
 }

-pub fn deinit(self: *Blob, session: *Session) void {
+pub fn deinit(self: *Blob, shutdown: bool, session: *Session) void {
+    _ = shutdown;
    session.releaseArena(self._arena);
 }

-pub fn releaseRef(self: *Blob, session: *Session) void {
-    self._rc.release(self, session);
-}
-
-pub fn acquireRef(self: *Blob) void {
-    self._rc.acquire();
-}
-
 const largest_vector = @max(std.simd.suggestVectorLength(u8) orelse 1, 8);
 /// Array of possible vector sizes for the current arch in decrementing order.
 /// We may move this to some file for SIMD helpers in the future.
@@ -335,6 +325,8 @@ pub const JsApi = struct {
        pub const name = "Blob";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(Blob.deinit);
    };

    pub const constructor = bridge.constructor(Blob.init, .{});
--- a/src/browser/webapi/Document.zig
+++ b/src/browser/webapi/Document.zig
@@ -61,7 +61,7 @@ _fonts: ?*FontFaceSet = null,
 _write_insertion_point: ?*Node = null,
 _script_created_parser: ?Parser.Streaming = null,
 _adopted_style_sheets: ?js.Object.Global = null,
-_selection: Selection = .{ ._rc = .init(1) },
+_selection: Selection = .init,

 // https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#throw-on-dynamic-markup-insertion-counter
 // Incremented during custom element reactions when parsing. When > 0,
--- a/src/browser/webapi/Event.zig
+++ b/src/browser/webapi/Event.zig
@@ -17,8 +17,6 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.

 const std = @import("std");
-const lp = @import("lightpanda");
-
 const js = @import("../js/js.zig");

 const Page = @import("../Page.zig");
@@ -57,7 +55,7 @@ _is_trusted: bool = false,
 // - 0: no reference, always a transient state going to either 1 or about to be deinit'd
 // - 1: either zig or v8 have a reference
 // - 2: both zig and v8 have a reference
-_rc: lp.RC(u8) = .{},
+_rc: u8 = 0,

 pub const EventPhase = enum(u8) {
    none = 0,
@@ -141,16 +139,25 @@ pub fn initEvent(
 }

 pub fn acquireRef(self: *Event) void {
-    self._rc.acquire();
+    self._rc += 1;
 }

-/// Force cleanup on Session shutdown.
-pub fn deinit(self: *Event, session: *Session) void {
-    session.releaseArena(self._arena);
-}
+pub fn deinit(self: *Event, shutdown: bool, session: *Session) void {
+    if (shutdown) {
+        session.releaseArena(self._arena);
+        return;
+    }

-pub fn releaseRef(self: *Event, session: *Session) void {
-    self._rc.release(self, session);
+    const rc = self._rc;
+    if (comptime IS_DEBUG) {
+        std.debug.assert(rc != 0);
+    }
+
+    if (rc == 1) {
+        session.releaseArena(self._arena);
+    } else {
+        self._rc = rc - 1;
+    }
 }

 pub fn as(self: *Event, comptime T: type) *T {
@@ -433,6 +440,8 @@ pub const JsApi = struct {

        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(Event.deinit);
        pub const enumerable = false;
    };

--- a/src/browser/webapi/EventTarget.zig
+++ b/src/browser/webapi/EventTarget.zig
@@ -60,7 +60,7 @@ pub fn dispatchEvent(self: *EventTarget, event: *Event, page: *Page) !bool {
    event._is_trusted = false;

    event.acquireRef();
-    defer _ = event.releaseRef(page._session);
+    defer event.deinit(false, page._session);
    try page._event_manager.dispatch(self, event);
    return !event._cancelable or !event._prevent_default;
 }
--- a/src/browser/webapi/File.zig
+++ b/src/browser/webapi/File.zig
@@ -17,7 +17,6 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.

 const std = @import("std");
-const lp = @import("lightpanda");

 const js = @import("../js/js.zig");
 const Page = @import("../Page.zig");
@@ -27,6 +26,7 @@ const Blob = @import("Blob.zig");

 const File = @This();

+/// `File` inherits `Blob`.
 _proto: *Blob,

 // TODO: Implement File API.
@@ -36,6 +36,10 @@ pub fn init(page: *Page) !*File {
    return page._factory.blob(arena, File{ ._proto = undefined });
 }

+pub fn deinit(self: *File, shutdown: bool, session: *Session) void {
+    self._proto.deinit(shutdown, session);
+}
+
 pub const JsApi = struct {
    pub const bridge = js.Bridge(File);

@@ -43,6 +47,8 @@ pub const JsApi = struct {
        pub const name = "File";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(File.deinit);
    };

    pub const constructor = bridge.constructor(File.init, .{});
--- a/src/browser/webapi/FileReader.zig
+++ b/src/browser/webapi/FileReader.zig
@@ -17,8 +17,6 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.

 const std = @import("std");
-const lp = @import("lightpanda");
-
 const js = @import("../js/js.zig");

 const Page = @import("../Page.zig");
@@ -33,7 +31,6 @@ const Allocator = std.mem.Allocator;
 /// https://developer.mozilla.org/en-US/docs/Web/API/FileReader
 const FileReader = @This();

-_rc: lp.RC(u8) = .{},
 _page: *Page,
 _proto: *EventTarget,
 _arena: Allocator,
@@ -73,7 +70,7 @@ pub fn init(page: *Page) !*FileReader {
    });
 }

-pub fn deinit(self: *FileReader, session: *Session) void {
+pub fn deinit(self: *FileReader, _: bool, session: *Session) void {
    if (self._on_abort) |func| func.release();
    if (self._on_error) |func| func.release();
    if (self._on_load) |func| func.release();
@@ -84,14 +81,6 @@ pub fn deinit(self: *FileReader, session: *Session) void {
    session.releaseArena(self._arena);
 }

-pub fn releaseRef(self: *FileReader, session: *Session) void {
-    self._rc.release(self, session);
-}
-
-pub fn acquireRef(self: *FileReader) void {
-    self._rc.acquire();
-}
-
 fn asEventTarget(self: *FileReader) *EventTarget {
    return self._proto;
 }
@@ -320,6 +309,8 @@ pub const JsApi = struct {
        pub const name = "FileReader";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(FileReader.deinit);
    };

    pub const constructor = bridge.constructor(FileReader.init, .{});
--- a/src/browser/webapi/IntersectionObserver.zig
+++ b/src/browser/webapi/IntersectionObserver.zig
@@ -16,8 +16,6 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.
 const std = @import("std");
-const lp = @import("lightpanda");
-
 const js = @import("../js/js.zig");
 const log = @import("../../log.zig");

@@ -41,7 +39,6 @@ pub fn registerTypes() []const type {

 const IntersectionObserver = @This();

-_rc: lp.RC(u8) = .{},
 _arena: Allocator,
 _callback: js.Function.Temp,
 _observing: std.ArrayList(*Element) = .{},
@@ -111,22 +108,15 @@ pub fn init(callback: js.Function.Temp, options: ?ObserverInit, page: *Page) !*I
    return self;
 }

-pub fn deinit(self: *IntersectionObserver, session: *Session) void {
+pub fn deinit(self: *IntersectionObserver, shutdown: bool, session: *Session) void {
    self._callback.release();
-    for (self._pending_entries.items) |entry| {
-        entry.deinitIfUnused(session);
+    if ((comptime IS_DEBUG) and !shutdown) {
+        std.debug.assert(self._observing.items.len == 0);
    }
+
    session.releaseArena(self._arena);
 }

-pub fn releaseRef(self: *IntersectionObserver, session: *Session) void {
-    self._rc.release(self, session);
-}
-
-pub fn acquireRef(self: *IntersectionObserver) void {
-    self._rc.acquire();
-}
-
 pub fn observe(self: *IntersectionObserver, target: *Element, page: *Page) !void {
    // Check if already observing this target
    for (self._observing.items) |elem| {
@@ -137,7 +127,7 @@ pub fn observe(self: *IntersectionObserver, target: *Element, page: *Page) !void

    // Register with page if this is our first observation
    if (self._observing.items.len == 0) {
-        self._rc._refs += 1;
+        page.js.strongRef(self);
        try page.registerIntersectionObserver(self);
    }

@@ -154,19 +144,17 @@ pub fn observe(self: *IntersectionObserver, target: *Element, page: *Page) !void
 }

 pub fn unobserve(self: *IntersectionObserver, target: *Element, page: *Page) void {
-    const original_length = self._observing.items.len;
    for (self._observing.items, 0..) |elem, i| {
        if (elem == target) {
            _ = self._observing.swapRemove(i);
            _ = self._previous_states.remove(target);

-            // Remove any pending entries for this target.
-            // Entries will be cleaned up by V8 GC via the finalizer.
+            // Remove any pending entries for this target
            var j: usize = 0;
            while (j < self._pending_entries.items.len) {
                if (self._pending_entries.items[j]._target == target) {
                    const entry = self._pending_entries.swapRemove(j);
-                    entry.deinitIfUnused(page._session);
+                    entry.deinit(false, page._session);
                } else {
                    j += 1;
                }
@@ -175,26 +163,21 @@ pub fn unobserve(self: *IntersectionObserver, target: *Element, page: *Page) voi
        }
    }

-    if (original_length > 0 and self._observing.items.len == 0) {
-        self._rc._refs -= 1;
+    if (self._observing.items.len == 0) {
+        page.js.safeWeakRef(self);
    }
 }

 pub fn disconnect(self: *IntersectionObserver, page: *Page) void {
-    for (self._pending_entries.items) |entry| {
-        entry.deinitIfUnused(page._session);
-    }
-    self._pending_entries.clearRetainingCapacity();
+    page.unregisterIntersectionObserver(self);
+    self._observing.clearRetainingCapacity();
    self._previous_states.clearRetainingCapacity();

-    const observing_count = self._observing.items.len;
-    self._observing.clearRetainingCapacity();
-
-    page.unregisterIntersectionObserver(self);
-
-    if (observing_count > 0) {
-        _ = self.releaseRef(page._session);
+    for (self._pending_entries.items) |entry| {
+        entry.deinit(false, page._session);
    }
+    self._pending_entries.clearRetainingCapacity();
+    page.js.safeWeakRef(self);
 }

 pub fn takeRecords(self: *IntersectionObserver, page: *Page) ![]*IntersectionObserverEntry {
@@ -285,6 +268,7 @@ fn checkIntersection(self: *IntersectionObserver, target: *Element, page: *Page)
            ._bounding_client_rect = try page._factory.create(data.bounding_client_rect),
            ._intersection_ratio = data.intersection_ratio,
        };
+
        try self._pending_entries.append(self._arena, entry);
    }

@@ -326,7 +310,6 @@ pub fn deliverEntries(self: *IntersectionObserver, page: *Page) !void {
 }

 pub const IntersectionObserverEntry = struct {
-    _rc: lp.RC(u8) = .{},
    _arena: Allocator,
    _time: f64,
    _target: *Element,
@@ -336,25 +319,10 @@ pub const IntersectionObserverEntry = struct {
    _intersection_ratio: f64,
    _is_intersecting: bool,

-    pub fn deinit(self: *IntersectionObserverEntry, session: *Session) void {
+    pub fn deinit(self: *IntersectionObserverEntry, _: bool, session: *Session) void {
        session.releaseArena(self._arena);
    }

-    fn deinitIfUnused(self: *IntersectionObserverEntry, session: *Session) void {
-        if (self._rc._refs == 0) {
-            // hasn't been handed to JS yet.
-            self.deinit(session);
-        }
-    }
-
-    pub fn releaseRef(self: *IntersectionObserverEntry, session: *Session) void {
-        self._rc.release(self, session);
-    }
-
-    pub fn acquireRef(self: *IntersectionObserverEntry) void {
-        self._rc.acquire();
-    }
-
    pub fn getTarget(self: *const IntersectionObserverEntry) *Element {
        return self._target;
    }
@@ -390,6 +358,8 @@ pub const IntersectionObserverEntry = struct {
            pub const name = "IntersectionObserverEntry";
            pub const prototype_chain = bridge.prototypeChain();
            pub var class_id: bridge.ClassId = undefined;
+            pub const weak = true;
+            pub const finalizer = bridge.finalizer(IntersectionObserverEntry.deinit);
        };

        pub const target = bridge.accessor(IntersectionObserverEntry.getTarget, null, .{});
@@ -409,6 +379,8 @@ pub const JsApi = struct {
        pub const name = "IntersectionObserver";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(IntersectionObserver.deinit);
    };

    pub const constructor = bridge.constructor(init, .{});
--- a/src/browser/webapi/MutationObserver.zig
+++ b/src/browser/webapi/MutationObserver.zig
@@ -17,7 +17,6 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.

 const std = @import("std");
-const lp = @import("lightpanda");
 const String = @import("../../string.zig").String;

 const js = @import("../js/js.zig");
@@ -40,7 +39,6 @@ pub fn registerTypes() []const type {

 const MutationObserver = @This();

-_rc: lp.RC(u8) = .{},
 _arena: Allocator,
 _callback: js.Function.Temp,
 _observing: std.ArrayList(Observing) = .{},
@@ -87,20 +85,15 @@ pub fn init(callback: js.Function.Temp, page: *Page) !*MutationObserver {
    return self;
 }

-/// Force cleanup on Session shutdown.
-pub fn deinit(self: *MutationObserver, session: *Session) void {
+pub fn deinit(self: *MutationObserver, shutdown: bool, session: *Session) void {
    self._callback.release();
+    if ((comptime IS_DEBUG) and !shutdown) {
+        std.debug.assert(self._observing.items.len == 0);
+    }
+
    session.releaseArena(self._arena);
 }

-pub fn releaseRef(self: *MutationObserver, session: *Session) void {
-    self._rc.release(self, session);
-}
-
-pub fn acquireRef(self: *MutationObserver) void {
-    self._rc.acquire();
-}
-
 pub fn observe(self: *MutationObserver, target: *Node, options: ObserveOptions, page: *Page) !void {
    const arena = self._arena;

@@ -165,7 +158,7 @@ pub fn observe(self: *MutationObserver, target: *Node, options: ObserveOptions,

    // Register with page if this is our first observation
    if (self._observing.items.len == 0) {
-        self._rc._refs += 1;
+        page.js.strongRef(self);
        try page.registerMutationObserver(self);
    }

@@ -176,17 +169,13 @@ pub fn observe(self: *MutationObserver, target: *Node, options: ObserveOptions,
 }

 pub fn disconnect(self: *MutationObserver, page: *Page) void {
+    page.unregisterMutationObserver(self);
+    self._observing.clearRetainingCapacity();
    for (self._pending_records.items) |record| {
-        _ = record.releaseRef(page._session);
+        record.deinit(false, page._session);
    }
    self._pending_records.clearRetainingCapacity();
-    const observing_count = self._observing.items.len;
-    self._observing.clearRetainingCapacity();
-
-    if (observing_count > 0) {
-        _ = self.releaseRef(page._session);
-    }
-    page.unregisterMutationObserver(self);
+    page.js.safeWeakRef(self);
 }

 pub fn takeRecords(self: *MutationObserver, page: *Page) ![]*MutationRecord {
@@ -359,7 +348,6 @@ pub fn deliverRecords(self: *MutationObserver, page: *Page) !void {
 }

 pub const MutationRecord = struct {
-    _rc: lp.RC(u8) = .{},
    _type: Type,
    _target: *Node,
    _arena: Allocator,
@@ -376,18 +364,10 @@ pub const MutationRecord = struct {
        characterData,
    };

-    pub fn deinit(self: *MutationRecord, session: *Session) void {
+    pub fn deinit(self: *MutationRecord, _: bool, session: *Session) void {
        session.releaseArena(self._arena);
    }

-    pub fn releaseRef(self: *MutationRecord, session: *Session) void {
-        self._rc.release(self, session);
-    }
-
-    pub fn acquireRef(self: *MutationRecord) void {
-        self._rc.acquire();
-    }
-
    pub fn getType(self: *const MutationRecord) []const u8 {
        return switch (self._type) {
            .attributes => "attributes",
@@ -438,6 +418,8 @@ pub const MutationRecord = struct {
            pub const name = "MutationRecord";
            pub const prototype_chain = bridge.prototypeChain();
            pub var class_id: bridge.ClassId = undefined;
+            pub const weak = true;
+            pub const finalizer = bridge.finalizer(MutationRecord.deinit);
        };

        pub const @"type" = bridge.accessor(MutationRecord.getType, null, .{});
@@ -459,6 +441,8 @@ pub const JsApi = struct {
        pub const name = "MutationObserver";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(MutationObserver.deinit);
    };

    pub const constructor = bridge.constructor(MutationObserver.init, .{});
--- a/src/browser/webapi/Permissions.zig
+++ b/src/browser/webapi/Permissions.zig
@@ -17,7 +17,6 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.

 const std = @import("std");
-const lp = @import("lightpanda");
 const js = @import("../js/js.zig");
 const Page = @import("../Page.zig");
 const Session = @import("../Session.zig");
@@ -51,23 +50,14 @@ pub fn query(_: *const Permissions, qd: QueryDescriptor, page: *Page) !js.Promis
 }

 const PermissionStatus = struct {
-    _rc: lp.RC(u8) = .{},
    _arena: Allocator,
    _name: []const u8,
    _state: []const u8,

-    pub fn deinit(self: *PermissionStatus, session: *Session) void {
+    pub fn deinit(self: *PermissionStatus, _: bool, session: *Session) void {
        session.releaseArena(self._arena);
    }

-    pub fn releaseRef(self: *PermissionStatus, session: *Session) void {
-        self._rc.release(self, session);
-    }
-
-    pub fn acquireRef(self: *PermissionStatus) void {
-        self._rc.acquire();
-    }
-
    fn getName(self: *const PermissionStatus) []const u8 {
        return self._name;
    }
@@ -82,6 +72,8 @@ const PermissionStatus = struct {
            pub const name = "PermissionStatus";
            pub const prototype_chain = bridge.prototypeChain();
            pub var class_id: bridge.ClassId = undefined;
+            pub const weak = true;
+            pub const finalizer = bridge.finalizer(PermissionStatus.deinit);
        };
        pub const name = bridge.accessor(getName, null, .{});
        pub const state = bridge.accessor(getState, null, .{});
--- a/src/browser/webapi/Range.zig
+++ b/src/browser/webapi/Range.zig
@@ -38,6 +38,10 @@ pub fn init(page: *Page) !*Range {
    return page._factory.abstractRange(arena, Range{ ._proto = undefined }, page);
 }

+pub fn deinit(self: *Range, shutdown: bool, session: *Session) void {
+    self._proto.deinit(shutdown, session);
+}
+
 pub fn asAbstractRange(self: *Range) *AbstractRange {
    return self._proto;
 }
@@ -693,6 +697,8 @@ pub const JsApi = struct {
        pub const name = "Range";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(Range.deinit);
    };

    // Constants for compareBoundaryPoints
--- a/src/browser/webapi/Selection.zig
+++ b/src/browser/webapi/Selection.zig
@@ -17,7 +17,6 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.

 const std = @import("std");
-const lp = @import("lightpanda");

 const js = @import("../js/js.zig");
 const Page = @import("../Page.zig");
@@ -33,27 +32,18 @@ const Selection = @This();

 pub const SelectionDirection = enum { backward, forward, none };

-_rc: lp.RC(u8) = .{},
 _range: ?*Range = null,
 _direction: SelectionDirection = .none,

 pub const init: Selection = .{};

-pub fn deinit(self: *Selection, session: *Session) void {
+pub fn deinit(self: *Selection, shutdown: bool, session: *Session) void {
    if (self._range) |r| {
-        r.asAbstractRange().releaseRef(session);
+        r.deinit(shutdown, session);
        self._range = null;
    }
 }

-pub fn releaseRef(self: *Selection, session: *Session) void {
-    self._rc.release(self, session);
-}
-
-pub fn acquireRef(self: *Selection) void {
-    self._rc.acquire();
-}
-
 fn dispatchSelectionChangeEvent(page: *Page) !void {
    const event = try Event.init("selectionchange", .{}, page);
    try page._event_manager.dispatch(page.document.asEventTarget(), event);
@@ -703,7 +693,7 @@ pub fn toString(self: *const Selection, page: *Page) ![]const u8 {

 fn setRange(self: *Selection, new_range: ?*Range, page: *Page) void {
    if (self._range) |existing| {
-        _ = existing.asAbstractRange().releaseRef(page._session);
+        existing.deinit(false, page._session);
    }
    if (new_range) |nr| {
        nr.asAbstractRange().acquireRef();
@@ -718,6 +708,7 @@ pub const JsApi = struct {
        pub const name = "Selection";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const finalizer = bridge.finalizer(Selection.deinit);
    };

    pub const anchorNode = bridge.accessor(Selection.getAnchorNode, null, .{});
--- a/src/browser/webapi/URL.zig
+++ b/src/browser/webapi/URL.zig
@@ -256,7 +256,8 @@ pub fn createObjectURL(blob: *Blob, page: *Page) ![]const u8 {
        .{ page.origin orelse "null", uuid_buf },
    );
    try page._blob_urls.put(page.arena, blob_url, blob);
-    blob.acquireRef();
+    // prevent GC from cleaning up the blob while it's in the registry
+    page.js.strongRef(blob);
    return blob_url;
 }

@@ -266,8 +267,9 @@ pub fn revokeObjectURL(url: []const u8, page: *Page) void {
        return;
    }

+    // Remove from registry and release strong ref (no-op if not found)
    if (page._blob_urls.fetchRemove(url)) |entry| {
-        entry.value.releaseRef(page._session);
+        page.js.weakRef(entry.value);
    }
 }

--- a/src/browser/webapi/animation/Animation.zig
+++ b/src/browser/webapi/animation/Animation.zig
@@ -17,7 +17,6 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.

 const std = @import("std");
-const lp = @import("lightpanda");
 const log = @import("../../../log.zig");
 const js = @import("../../js/js.zig");
 const Page = @import("../../Page.zig");
@@ -34,7 +33,6 @@ const PlayState = enum {
    finished,
 };

-_rc: lp.RC(u32) = .{},
 _page: *Page,
 _arena: Allocator,

@@ -64,18 +62,10 @@ pub fn init(page: *Page) !*Animation {
    return self;
 }

-pub fn deinit(self: *Animation, session: *Session) void {
+pub fn deinit(self: *Animation, _: bool, session: *Session) void {
    session.releaseArena(self._arena);
 }

-pub fn releaseRef(self: *Animation, session: *Session) void {
-    self._rc.release(self, session);
-}
-
-pub fn acquireRef(self: *Animation) void {
-    self._rc.acquire();
-}
-
 pub fn play(self: *Animation, page: *Page) !void {
    if (self._playState == .running) {
        return;
@@ -85,7 +75,7 @@ pub fn play(self: *Animation, page: *Page) !void {
    self._playState = .running;

    // Schedule the transition from .running => .finished in 10ms.
-    self.acquireRef();
+    page.js.strongRef(self);
    try page.js.scheduler.add(
        self,
        Animation.update,
@@ -211,7 +201,7 @@ fn update(ctx: *anyopaque) !?u32 {
    }

    // No future change scheduled, set the object weak for garbage collection.
-    self.releaseRef(self._page._session);
+    self._page.js.weakRef(self);
    return null;
 }

@@ -230,6 +220,8 @@ pub const JsApi = struct {
        pub const name = "Animation";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(Animation.deinit);
    };

    pub const play = bridge.function(Animation.play, .{});
--- a/src/browser/webapi/collections/NodeList.zig
+++ b/src/browser/webapi/collections/NodeList.zig
@@ -17,7 +17,6 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.

 const std = @import("std");
-const lp = @import("lightpanda");

 const log = @import("../../../log.zig");
 const js = @import("../../js/js.zig");
@@ -38,9 +37,15 @@ _data: union(enum) {
    radio_node_list: *RadioNodeList,
    name: NodeLive(.name),
 },
-_rc: lp.RC(u32) = .{},
+_rc: usize = 0,
+
+pub fn deinit(self: *NodeList, _: bool, session: *Session) void {
+    const rc = self._rc;
+    if (rc > 1) {
+        self._rc = rc - 1;
+        return;
+    }

-pub fn deinit(self: *NodeList, session: *Session) void {
    switch (self._data) {
        .selector_list => |list| list.deinit(session),
        .child_nodes => |cn| cn.deinit(session),
@@ -48,12 +53,8 @@ pub fn deinit(self: *NodeList, session: *Session) void {
    }
 }

-pub fn releaseRef(self: *NodeList, session: *Session) void {
-    self._rc.release(self, session);
-}
-
 pub fn acquireRef(self: *NodeList) void {
-    self._rc.acquire();
+    self._rc += 1;
 }

 pub fn length(self: *NodeList, page: *Page) !u32 {
@@ -118,12 +119,8 @@ const Iterator = struct {

    const Entry = struct { u32, *Node };

-    pub fn deinit(self: *Iterator, session: *Session) void {
-        self.list.deinit(session);
-    }
-
-    pub fn releaseRef(self: *Iterator, session: *Session) void {
-        self.list.releaseRef(session);
+    pub fn deinit(self: *Iterator, shutdown: bool, session: *Session) void {
+        self.list.deinit(shutdown, session);
    }

    pub fn acquireRef(self: *Iterator) void {
@@ -146,6 +143,8 @@ pub const JsApi = struct {
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
        pub const enumerable = false;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(NodeList.deinit);
    };

    pub const length = bridge.accessor(NodeList.length, null, .{});
--- a/src/browser/webapi/collections/iterator.zig
+++ b/src/browser/webapi/collections/iterator.zig
@@ -17,7 +17,6 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.

 const std = @import("std");
-const lp = @import("lightpanda");
 const js = @import("../../js/js.zig");
 const Page = @import("../../Page.zig");
 const Session = @import("../../Session.zig");
@@ -41,15 +40,9 @@ pub fn Entry(comptime Inner: type, comptime field: ?[]const u8) type {
            return page._factory.create(Self{ .inner = inner });
        }

-        pub fn deinit(self: *Self, session: *Session) void {
-            _ = self;
-            _ = session;
-        }
-
-        pub fn releaseRef(self: *Self, session: *Session) void {
-            // Release the reference to the inner type that we acquired
-            if (@hasDecl(Inner, "releaseRef")) {
-                self.inner.releaseRef(session);
+        pub fn deinit(self: *Self, shutdown: bool, session: *Session) void {
+            if (@hasDecl(Inner, "deinit")) {
+                self.inner.deinit(shutdown, session);
            }
        }

@@ -80,6 +73,8 @@ pub fn Entry(comptime Inner: type, comptime field: ?[]const u8) type {
            pub const Meta = struct {
                pub const prototype_chain = bridge.prototypeChain();
                pub var class_id: bridge.ClassId = undefined;
+                pub const weak = true;
+                pub const finalizer = bridge.finalizer(Self.deinit);
            };

            pub const next = bridge.function(Self.next, .{ .null_as_undefined = true });
--- a/src/browser/webapi/css/FontFace.zig
+++ b/src/browser/webapi/css/FontFace.zig
@@ -17,7 +17,6 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.

 const std = @import("std");
-const lp = @import("lightpanda");
 const js = @import("../../js/js.zig");
 const Page = @import("../../Page.zig");
 const Session = @import("../../Session.zig");
@@ -26,7 +25,6 @@ const Allocator = std.mem.Allocator;

 const FontFace = @This();

-_rc: lp.RC(u8) = .{},
 _arena: Allocator,
 _family: []const u8,

@@ -44,18 +42,10 @@ pub fn init(family: []const u8, source: []const u8, page: *Page) !*FontFace {
    return self;
 }

-pub fn deinit(self: *FontFace, session: *Session) void {
+pub fn deinit(self: *FontFace, _: bool, session: *Session) void {
    session.releaseArena(self._arena);
 }

-pub fn releaseRef(self: *FontFace, session: *Session) void {
-    self._rc.release(self, session);
-}
-
-pub fn acquireRef(self: *FontFace) void {
-    self._rc.acquire();
-}
-
 pub fn getFamily(self: *const FontFace) []const u8 {
    return self._family;
 }
@@ -77,6 +67,8 @@ pub const JsApi = struct {
        pub const name = "FontFace";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(FontFace.deinit);
    };

    pub const constructor = bridge.constructor(FontFace.init, .{});
--- a/src/browser/webapi/css/FontFaceSet.zig
+++ b/src/browser/webapi/css/FontFaceSet.zig
@@ -17,7 +17,6 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.

 const std = @import("std");
-const lp = @import("lightpanda");
 const js = @import("../../js/js.zig");
 const Page = @import("../../Page.zig");
 const Session = @import("../../Session.zig");
@@ -29,7 +28,6 @@ const Allocator = std.mem.Allocator;

 const FontFaceSet = @This();

-_rc: lp.RC(u8) = .{},
 _proto: *EventTarget,
 _arena: Allocator,

@@ -43,18 +41,10 @@ pub fn init(page: *Page) !*FontFaceSet {
    });
 }

-pub fn deinit(self: *FontFaceSet, session: *Session) void {
+pub fn deinit(self: *FontFaceSet, _: bool, session: *Session) void {
    session.releaseArena(self._arena);
 }

-pub fn releaseRef(self: *FontFaceSet, session: *Session) void {
-    self._rc.release(self, session);
-}
-
-pub fn acquireRef(self: *FontFaceSet) void {
-    self._rc.acquire();
-}
-
 pub fn asEventTarget(self: *FontFaceSet) *EventTarget {
    return self._proto;
 }
@@ -105,6 +95,8 @@ pub const JsApi = struct {
        pub const name = "FontFaceSet";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(FontFaceSet.deinit);
    };

    pub const size = bridge.property(0, .{ .template = false, .readonly = true });
--- a/src/browser/webapi/encoding/TextDecoder.zig
+++ b/src/browser/webapi/encoding/TextDecoder.zig
@@ -17,7 +17,6 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.

 const std = @import("std");
-const lp = @import("lightpanda");
 const js = @import("../../js/js.zig");

 const Page = @import("../../Page.zig");
@@ -26,7 +25,6 @@ const Allocator = std.mem.Allocator;

 const TextDecoder = @This();

-_rc: lp.RC(u8) = .{},
 _fatal: bool,
 _arena: Allocator,
 _ignore_bom: bool,
@@ -62,18 +60,10 @@ pub fn init(label_: ?[]const u8, opts_: ?InitOpts, page: *Page) !*TextDecoder {
    return self;
 }

-pub fn deinit(self: *TextDecoder, session: *Session) void {
+pub fn deinit(self: *TextDecoder, _: bool, session: *Session) void {
    session.releaseArena(self._arena);
 }

-pub fn releaseRef(self: *TextDecoder, session: *Session) void {
-    self._rc.release(self, session);
-}
-
-pub fn acquireRef(self: *TextDecoder) void {
-    self._rc.acquire();
-}
-
 pub fn getIgnoreBOM(self: *const TextDecoder) bool {
    return self._ignore_bom;
 }
@@ -119,6 +109,8 @@ pub const JsApi = struct {
        pub const name = "TextDecoder";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(TextDecoder.deinit);
    };

    pub const constructor = bridge.constructor(TextDecoder.init, .{});
--- a/src/browser/webapi/event/CompositionEvent.zig
+++ b/src/browser/webapi/event/CompositionEvent.zig
@@ -53,6 +53,10 @@ pub fn init(typ: []const u8, opts_: ?Options, page: *Page) !*CompositionEvent {
    return event;
 }

+pub fn deinit(self: *CompositionEvent, shutdown: bool, session: *Session) void {
+    self._proto.deinit(shutdown, session);
+}
+
 pub fn asEvent(self: *CompositionEvent) *Event {
    return self._proto;
 }
@@ -68,6 +72,8 @@ pub const JsApi = struct {
        pub const name = "CompositionEvent";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(CompositionEvent.deinit);
    };

    pub const constructor = bridge.constructor(CompositionEvent.init, .{});
--- a/src/browser/webapi/event/CustomEvent.zig
+++ b/src/browser/webapi/event/CustomEvent.zig
@@ -73,19 +73,11 @@ pub fn initCustomEvent(
    self._detail = detail_;
 }

-pub fn deinit(self: *CustomEvent, session: *Session) void {
+pub fn deinit(self: *CustomEvent, shutdown: bool, session: *Session) void {
    if (self._detail) |d| {
        d.release();
    }
-    self._proto.deinit(session);
-}
-
-pub fn acquireRef(self: *CustomEvent) void {
-    self._proto.acquireRef();
-}
-
-pub fn releaseRef(self: *CustomEvent, session: *Session) void {
-    self._proto._rc.release(self, session);
+    self._proto.deinit(shutdown, session);
 }

 pub fn asEvent(self: *CustomEvent) *Event {
@@ -103,6 +95,8 @@ pub const JsApi = struct {
        pub const name = "CustomEvent";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(CustomEvent.deinit);
        pub const enumerable = false;
    };

--- a/src/browser/webapi/event/ErrorEvent.zig
+++ b/src/browser/webapi/event/ErrorEvent.zig
@@ -80,19 +80,11 @@ fn initWithTrusted(arena: Allocator, typ: String, opts_: ?Options, trusted: bool
    return event;
 }

-pub fn deinit(self: *ErrorEvent, session: *Session) void {
+pub fn deinit(self: *ErrorEvent, shutdown: bool, session: *Session) void {
    if (self._error) |e| {
        e.release();
    }
-    self._proto.deinit(session);
-}
-
-pub fn acquireRef(self: *ErrorEvent) void {
-    self._proto.acquireRef();
-}
-
-pub fn releaseRef(self: *ErrorEvent, session: *Session) void {
-    self._proto._rc.release(self, session);
+    self._proto.deinit(shutdown, session);
 }

 pub fn asEvent(self: *ErrorEvent) *Event {
--- a/src/browser/webapi/event/FocusEvent.zig
+++ b/src/browser/webapi/event/FocusEvent.zig
@@ -70,6 +70,10 @@ fn initWithTrusted(arena: Allocator, typ: String, _opts: ?Options, trusted: bool
    return event;
 }

+pub fn deinit(self: *FocusEvent, shutdown: bool, session: *Session) void {
+    self._proto.deinit(shutdown, session);
+}
+
 pub fn asEvent(self: *FocusEvent) *Event {
    return self._proto.asEvent();
 }
@@ -85,6 +89,8 @@ pub const JsApi = struct {
        pub const name = "FocusEvent";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(FocusEvent.deinit);
    };

    pub const constructor = bridge.constructor(FocusEvent.init, .{});
--- a/src/browser/webapi/event/FormDataEvent.zig
+++ b/src/browser/webapi/event/FormDataEvent.zig
@@ -66,6 +66,10 @@ fn initWithTrusted(arena: Allocator, typ: String, maybe_options: ?Options, trust
    return event;
 }

+pub fn deinit(self: *FormDataEvent, shutdown: bool, session: *Session) void {
+    self._proto.deinit(shutdown, session);
+}
+
 pub fn asEvent(self: *FormDataEvent) *Event {
    return self._proto;
 }
@@ -81,6 +85,8 @@ pub const JsApi = struct {
        pub const name = "FormDataEvent";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(FormDataEvent.deinit);
    };

    pub const constructor = bridge.constructor(FormDataEvent.init, .{});
--- a/src/browser/webapi/event/InputEvent.zig
+++ b/src/browser/webapi/event/InputEvent.zig
@@ -83,6 +83,10 @@ fn initWithTrusted(arena: Allocator, typ: String, _opts: ?Options, trusted: bool
    return event;
 }

+pub fn deinit(self: *InputEvent, shutdown: bool, session: *Session) void {
+    self._proto.deinit(shutdown, session);
+}
+
 pub fn asEvent(self: *InputEvent) *Event {
    return self._proto.asEvent();
 }
@@ -106,6 +110,8 @@ pub const JsApi = struct {
        pub const name = "InputEvent";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(InputEvent.deinit);
    };

    pub const constructor = bridge.constructor(InputEvent.init, .{});
--- a/src/browser/webapi/event/KeyboardEvent.zig
+++ b/src/browser/webapi/event/KeyboardEvent.zig
@@ -229,6 +229,10 @@ fn initWithTrusted(arena: Allocator, typ: String, _opts: ?Options, trusted: bool
    return event;
 }

+pub fn deinit(self: *KeyboardEvent, shutdown: bool, session: *Session) void {
+    self._proto.deinit(shutdown, session);
+}
+
 pub fn asEvent(self: *KeyboardEvent) *Event {
    return self._proto.asEvent();
 }
@@ -292,6 +296,8 @@ pub const JsApi = struct {
        pub const name = "KeyboardEvent";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(KeyboardEvent.deinit);
    };

    pub const constructor = bridge.constructor(KeyboardEvent.init, .{});
--- a/src/browser/webapi/event/MessageEvent.zig
+++ b/src/browser/webapi/event/MessageEvent.zig
@@ -73,19 +73,11 @@ fn initWithTrusted(arena: Allocator, typ: String, opts_: ?Options, trusted: bool
    return event;
 }

-pub fn deinit(self: *MessageEvent, session: *Session) void {
+pub fn deinit(self: *MessageEvent, shutdown: bool, session: *Session) void {
    if (self._data) |d| {
        d.release();
    }
-    self._proto.deinit(session);
-}
-
-pub fn acquireRef(self: *MessageEvent) void {
-    self._proto.acquireRef();
-}
-
-pub fn releaseRef(self: *MessageEvent, session: *Session) void {
-    self._proto._rc.release(self, session);
+    self._proto.deinit(shutdown, session);
 }

 pub fn asEvent(self: *MessageEvent) *Event {
@@ -111,6 +103,8 @@ pub const JsApi = struct {
        pub const name = "MessageEvent";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(MessageEvent.deinit);
    };

    pub const constructor = bridge.constructor(MessageEvent.init, .{});
--- a/src/browser/webapi/event/MouseEvent.zig
+++ b/src/browser/webapi/event/MouseEvent.zig
@@ -121,6 +121,10 @@ fn initWithTrusted(arena: Allocator, typ: String, _opts: ?Options, trusted: bool
    return event;
 }

+pub fn deinit(self: *MouseEvent, shutdown: bool, session: *Session) void {
+    self._proto.deinit(shutdown, session);
+}
+
 pub fn asEvent(self: *MouseEvent) *Event {
    return self._proto.asEvent();
 }
@@ -199,6 +203,8 @@ pub const JsApi = struct {
        pub const name = "MouseEvent";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(MouseEvent.deinit);
    };

    pub const constructor = bridge.constructor(MouseEvent.init, .{});
--- a/src/browser/webapi/event/NavigationCurrentEntryChangeEvent.zig
+++ b/src/browser/webapi/event/NavigationCurrentEntryChangeEvent.zig
@@ -83,6 +83,10 @@ fn initWithTrusted(
    return event;
 }

+pub fn deinit(self: *NavigationCurrentEntryChangeEvent, shutdown: bool, session: *Session) void {
+    self._proto.deinit(shutdown, session);
+}
+
 pub fn asEvent(self: *NavigationCurrentEntryChangeEvent) *Event {
    return self._proto;
 }
@@ -102,6 +106,8 @@ pub const JsApi = struct {
        pub const name = "NavigationCurrentEntryChangeEvent";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(NavigationCurrentEntryChangeEvent.deinit);
    };

    pub const constructor = bridge.constructor(NavigationCurrentEntryChangeEvent.init, .{});
--- a/src/browser/webapi/event/PageTransitionEvent.zig
+++ b/src/browser/webapi/event/PageTransitionEvent.zig
@@ -66,6 +66,10 @@ fn initWithTrusted(arena: Allocator, typ: String, _opts: ?Options, trusted: bool
    return event;
 }

+pub fn deinit(self: *PageTransitionEvent, shutdown: bool, session: *Session) void {
+    self._proto.deinit(shutdown, session);
+}
+
 pub fn asEvent(self: *PageTransitionEvent) *Event {
    return self._proto;
 }
@@ -81,6 +85,8 @@ pub const JsApi = struct {
        pub const name = "PageTransitionEvent";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(PageTransitionEvent.deinit);
    };

    pub const constructor = bridge.constructor(PageTransitionEvent.init, .{});
--- a/src/browser/webapi/event/PointerEvent.zig
+++ b/src/browser/webapi/event/PointerEvent.zig
@@ -128,6 +128,10 @@ pub fn init(typ: []const u8, _opts: ?Options, page: *Page) !*PointerEvent {
    return event;
 }

+pub fn deinit(self: *PointerEvent, shutdown: bool, session: *Session) void {
+    self._proto.deinit(shutdown, session);
+}
+
 pub fn asEvent(self: *PointerEvent) *Event {
    return self._proto.asEvent();
 }
@@ -187,6 +191,8 @@ pub const JsApi = struct {
        pub const name = "PointerEvent";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(PointerEvent.deinit);
    };

    pub const constructor = bridge.constructor(PointerEvent.init, .{});
--- a/src/browser/webapi/event/PopStateEvent.zig
+++ b/src/browser/webapi/event/PopStateEvent.zig
@@ -67,6 +67,10 @@ fn initWithTrusted(arena: Allocator, typ: String, _opts: ?Options, trusted: bool
    return event;
 }

+pub fn deinit(self: *PopStateEvent, shutdown: bool, session: *Session) void {
+    self._proto.deinit(shutdown, session);
+}
+
 pub fn asEvent(self: *PopStateEvent) *Event {
    return self._proto;
 }
@@ -88,6 +92,8 @@ pub const JsApi = struct {
        pub const name = "PopStateEvent";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(PopStateEvent.deinit);
    };

    pub const constructor = bridge.constructor(PopStateEvent.init, .{});
--- a/src/browser/webapi/event/ProgressEvent.zig
+++ b/src/browser/webapi/event/ProgressEvent.zig
@@ -68,6 +68,10 @@ fn initWithTrusted(arena: Allocator, typ: String, _opts: ?Options, trusted: bool
    return event;
 }

+pub fn deinit(self: *ProgressEvent, shutdown: bool, session: *Session) void {
+    self._proto.deinit(shutdown, session);
+}
+
 pub fn asEvent(self: *ProgressEvent) *Event {
    return self._proto;
 }
@@ -92,6 +96,8 @@ pub const JsApi = struct {
        pub const name = "ProgressEvent";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(ProgressEvent.deinit);
    };

    pub const constructor = bridge.constructor(ProgressEvent.init, .{});
--- a/src/browser/webapi/event/PromiseRejectionEvent.zig
+++ b/src/browser/webapi/event/PromiseRejectionEvent.zig
@@ -56,22 +56,14 @@ pub fn init(typ: []const u8, opts_: ?Options, page: *Page) !*PromiseRejectionEve
    return event;
 }

-pub fn deinit(self: *PromiseRejectionEvent, session: *Session) void {
+pub fn deinit(self: *PromiseRejectionEvent, shutdown: bool, session: *Session) void {
    if (self._reason) |r| {
        r.release();
    }
    if (self._promise) |p| {
        p.release();
    }
-    self._proto.deinit(session);
-}
-
-pub fn acquireRef(self: *PromiseRejectionEvent) void {
-    self._proto.acquireRef();
-}
-
-pub fn releaseRef(self: *PromiseRejectionEvent, session: *Session) void {
-    self._proto._rc.release(self, session);
+    self._proto.deinit(shutdown, session);
 }

 pub fn asEvent(self: *PromiseRejectionEvent) *Event {
@@ -93,6 +85,8 @@ pub const JsApi = struct {
        pub const name = "PromiseRejectionEvent";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(PromiseRejectionEvent.deinit);
    };

    pub const constructor = bridge.constructor(PromiseRejectionEvent.init, .{});
--- a/src/browser/webapi/event/SubmitEvent.zig
+++ b/src/browser/webapi/event/SubmitEvent.zig
@@ -67,6 +67,10 @@ fn initWithTrusted(arena: Allocator, typ: String, _opts: ?Options, trusted: bool
    return event;
 }

+pub fn deinit(self: *SubmitEvent, shutdown: bool, session: *Session) void {
+    self._proto.deinit(shutdown, session);
+}
+
 pub fn asEvent(self: *SubmitEvent) *Event {
    return self._proto;
 }
@@ -82,6 +86,8 @@ pub const JsApi = struct {
        pub const name = "SubmitEvent";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(SubmitEvent.deinit);
    };

    pub const constructor = bridge.constructor(SubmitEvent.init, .{});
--- a/src/browser/webapi/event/TextEvent.zig
+++ b/src/browser/webapi/event/TextEvent.zig
@@ -59,6 +59,10 @@ pub fn init(typ: []const u8, _opts: ?Options, page: *Page) !*TextEvent {
    return event;
 }

+pub fn deinit(self: *TextEvent, shutdown: bool, session: *Session) void {
+    self._proto.deinit(shutdown, session);
+}
+
 pub fn asEvent(self: *TextEvent) *Event {
    return self._proto.asEvent();
 }
@@ -97,6 +101,8 @@ pub const JsApi = struct {
        pub const name = "TextEvent";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(TextEvent.deinit);
    };

    // No constructor - TextEvent is created via document.createEvent('TextEvent')
--- a/src/browser/webapi/event/UIEvent.zig
+++ b/src/browser/webapi/event/UIEvent.zig
@@ -71,6 +71,10 @@ pub fn init(typ: []const u8, _opts: ?Options, page: *Page) !*UIEvent {
    return event;
 }

+pub fn deinit(self: *UIEvent, shutdown: bool, session: *Session) void {
+    self._proto.deinit(shutdown, session);
+}
+
 pub fn as(self: *UIEvent, comptime T: type) *T {
    return self.is(T).?;
 }
@@ -118,6 +122,8 @@ pub const JsApi = struct {
        pub const name = "UIEvent";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(UIEvent.deinit);
    };

    pub const constructor = bridge.constructor(UIEvent.init, .{});
--- a/src/browser/webapi/event/WheelEvent.zig
+++ b/src/browser/webapi/event/WheelEvent.zig
@@ -87,6 +87,10 @@ pub fn init(typ: []const u8, _opts: ?Options, page: *Page) !*WheelEvent {
    return event;
 }

+pub fn deinit(self: *WheelEvent, shutdown: bool, session: *Session) void {
+    self._proto.deinit(shutdown, session);
+}
+
 pub fn asEvent(self: *WheelEvent) *Event {
    return self._proto.asEvent();
 }
@@ -114,6 +118,8 @@ pub const JsApi = struct {
        pub const name = "WheelEvent";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(WheelEvent.deinit);
    };

    pub const constructor = bridge.constructor(WheelEvent.init, .{});
--- a/src/browser/webapi/net/Fetch.zig
+++ b/src/browser/webapi/net/Fetch.zig
@@ -62,7 +62,7 @@ pub fn init(input: Input, options: ?InitOpts, page: *Page) !js.Promise {
    }

    const response = try Response.init(null, .{ .status = 0 }, page);
-    errdefer response.deinit(page._session);
+    errdefer response.deinit(true, page._session);

    const fetch = try response._arena.create(Fetch);
    fetch.* = .{
@@ -127,16 +127,16 @@ fn handleBlobUrl(url: []const u8, resolver: js.PromiseResolver, page: *Page) !js
    return resolver.promise();
 }

-fn httpStartCallback(response: HttpClient.Response) !void {
-    const self: *Fetch = @ptrCast(@alignCast(response.ctx));
+fn httpStartCallback(transfer: *HttpClient.Transfer) !void {
+    const self: *Fetch = @ptrCast(@alignCast(transfer.ctx));
    if (comptime IS_DEBUG) {
        log.debug(.http, "request start", .{ .url = self._url, .source = "fetch" });
    }
-    self._response._http_response = response;
+    self._response._transfer = transfer;
 }

-fn httpHeaderDoneCallback(response: HttpClient.Response) !bool {
-    const self: *Fetch = @ptrCast(@alignCast(response.ctx));
+fn httpHeaderDoneCallback(transfer: *HttpClient.Transfer) !bool {
+    const self: *Fetch = @ptrCast(@alignCast(transfer.ctx));

    if (self._signal) |signal| {
        if (signal._aborted) {
@@ -145,24 +145,25 @@ fn httpHeaderDoneCallback(response: HttpClient.Response) !bool {
    }

    const arena = self._response._arena;
-    if (response.contentLength()) |cl| {
+    if (transfer.getContentLength()) |cl| {
        try self._buf.ensureTotalCapacity(arena, cl);
    }

    const res = self._response;
+    const header = transfer.response_header.?;

    if (comptime IS_DEBUG) {
        log.debug(.http, "request header", .{
            .source = "fetch",
            .url = self._url,
-            .status = response.status(),
+            .status = header.status,
        });
    }

-    res._status = response.status().?;
-    res._status_text = std.http.Status.phrase(@enumFromInt(response.status().?)) orelse "";
-    res._url = try arena.dupeZ(u8, response.url());
-    res._is_redirected = response.redirectCount().? > 0;
+    res._status = header.status;
+    res._status_text = std.http.Status.phrase(@enumFromInt(header.status)) orelse "";
+    res._url = try arena.dupeZ(u8, std.mem.span(header.url));
+    res._is_redirected = header.redirect_count > 0;

    // Determine response type based on origin comparison
    const page_origin = URL.getOrigin(arena, self._page.url) catch null;
@@ -182,7 +183,7 @@ fn httpHeaderDoneCallback(response: HttpClient.Response) !bool {
        res._type = .basic;
    }

-    var it = response.headerIterator();
+    var it = transfer.responseHeaderIterator();
    while (it.next()) |hdr| {
        try res._headers.append(hdr.name, hdr.value, self._page);
    }
@@ -190,8 +191,8 @@ fn httpHeaderDoneCallback(response: HttpClient.Response) !bool {
    return true;
 }

-fn httpDataCallback(response: HttpClient.Response, data: []const u8) !void {
-    const self: *Fetch = @ptrCast(@alignCast(response.ctx));
+fn httpDataCallback(transfer: *HttpClient.Transfer, data: []const u8) !void {
+    const self: *Fetch = @ptrCast(@alignCast(transfer.ctx));

    // Check if aborted
    if (self._signal) |signal| {
@@ -206,7 +207,7 @@ fn httpDataCallback(response: HttpClient.Response, data: []const u8) !void {
 fn httpDoneCallback(ctx: *anyopaque) !void {
    const self: *Fetch = @ptrCast(@alignCast(ctx));
    var response = self._response;
-    response._http_response = null;
+    response._transfer = null;
    response._body = self._buf.items;

    log.info(.http, "request complete", .{
@@ -225,16 +226,16 @@ fn httpDoneCallback(ctx: *anyopaque) !void {
    return ls.toLocal(self._resolver).resolve("fetch done", js_val);
 }

-fn httpErrorCallback(ctx: *anyopaque, _: anyerror) void {
+fn httpErrorCallback(ctx: *anyopaque, err: anyerror) void {
    const self: *Fetch = @ptrCast(@alignCast(ctx));

    var response = self._response;
-    response._http_response = null;
+    response._transfer = null;
    // the response is only passed on v8 on success, if we're here, it's safe to
    // clear this. (defer since `self is in the response's arena).

    defer if (self._owns_response) {
-        response.deinit(self._page._session);
+        response.deinit(err == error.Abort, self._page._session);
        self._owns_response = false;
    };

@@ -255,8 +256,8 @@ fn httpShutdownCallback(ctx: *anyopaque) void {

    if (self._owns_response) {
        var response = self._response;
-        response._http_response = null;
-        response.deinit(self._page._session);
+        response._transfer = null;
+        response.deinit(true, self._page._session);
        // Do not access `self` after this point: the Fetch struct was
        // allocated from response._arena which has been released.
    }
--- a/src/browser/webapi/net/Response.zig
+++ b/src/browser/webapi/net/Response.zig
@@ -17,7 +17,6 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.

 const std = @import("std");
-const lp = @import("lightpanda");
 const js = @import("../../js/js.zig");
 const HttpClient = @import("../../HttpClient.zig");

@@ -39,7 +38,6 @@ pub const Type = enum {
    opaqueredirect,
 };

-_rc: lp.RC(u8) = .{},
 _status: u16,
 _arena: Allocator,
 _headers: *Headers,
@@ -48,7 +46,7 @@ _type: Type,
 _status_text: []const u8,
 _url: [:0]const u8,
 _is_redirected: bool,
-_http_response: ?HttpClient.Response = null,
+_transfer: ?*HttpClient.Transfer = null,

 const InitOpts = struct {
    status: u16 = 200,
@@ -80,22 +78,18 @@ pub fn init(body_: ?[]const u8, opts_: ?InitOpts, page: *Page) !*Response {
    return self;
 }

-pub fn deinit(self: *Response, session: *Session) void {
-    if (self._http_response) |resp| {
-        resp.abort(error.Abort);
-        self._http_response = null;
+pub fn deinit(self: *Response, shutdown: bool, session: *Session) void {
+    if (self._transfer) |transfer| {
+        if (shutdown) {
+            transfer.terminate();
+        } else {
+            transfer.abort(error.Abort);
+        }
+        self._transfer = null;
    }
    session.releaseArena(self._arena);
 }

-pub fn releaseRef(self: *Response, session: *Session) void {
-    self._rc.release(self, session);
-}
-
-pub fn acquireRef(self: *Response) void {
-    self._rc.acquire();
-}
-
 pub fn getStatus(self: *const Response) u16 {
    return self._status;
 }
@@ -191,7 +185,7 @@ pub fn clone(self: *const Response, page: *Page) !*Response {
        ._type = self._type,
        ._is_redirected = self._is_redirected,
        ._headers = try Headers.init(.{ .obj = self._headers }, page),
-        ._http_response = null,
+        ._transfer = null,
    };
    return cloned;
 }
@@ -203,6 +197,8 @@ pub const JsApi = struct {
        pub const name = "Response";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(Response.deinit);
    };

    pub const constructor = bridge.constructor(Response.init, .{});
--- a/src/browser/webapi/net/XMLHttpRequest.zig
+++ b/src/browser/webapi/net/XMLHttpRequest.zig
@@ -17,7 +17,6 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.

 const std = @import("std");
-const lp = @import("lightpanda");
 const js = @import("../../js/js.zig");

 const log = @import("../../../log.zig");
@@ -39,11 +38,10 @@ const Allocator = std.mem.Allocator;
 const IS_DEBUG = @import("builtin").mode == .Debug;

 const XMLHttpRequest = @This();
-_rc: lp.RC(u8) = .{},
 _page: *Page,
 _proto: *XMLHttpRequestEventTarget,
 _arena: Allocator,
-_http_response: ?HttpClient.Response = null,
+_transfer: ?*HttpClient.Transfer = null,

 _url: [:0]const u8 = "",
 _method: net_http.Method = .GET,
@@ -89,19 +87,22 @@ const ResponseType = enum {
 pub fn init(page: *Page) !*XMLHttpRequest {
    const arena = try page.getArena(.{ .debug = "XMLHttpRequest" });
    errdefer page.releaseArena(arena);
-    const xhr = try page._factory.xhrEventTarget(arena, XMLHttpRequest{
+    return page._factory.xhrEventTarget(arena, XMLHttpRequest{
        ._page = page,
        ._arena = arena,
        ._proto = undefined,
        ._request_headers = try Headers.init(null, page),
    });
-    return xhr;
 }

-pub fn deinit(self: *XMLHttpRequest, session: *Session) void {
-    if (self._http_response) |resp| {
-        resp.abort(error.Abort);
-        self._http_response = null;
+pub fn deinit(self: *XMLHttpRequest, shutdown: bool, session: *Session) void {
+    if (self._transfer) |transfer| {
+        if (shutdown) {
+            transfer.terminate();
+        } else {
+            transfer.abort(error.Abort);
+        }
+        self._transfer = null;
    }

    if (self._on_ready_state_change) |func| {
@@ -136,14 +137,6 @@ pub fn deinit(self: *XMLHttpRequest, session: *Session) void {
    session.releaseArena(self._arena);
 }

-pub fn releaseRef(self: *XMLHttpRequest, session: *Session) void {
-    self._rc.release(self, session);
-}
-
-pub fn acquireRef(self: *XMLHttpRequest) void {
-    self._rc.acquire();
-}
-
 fn asEventTarget(self: *XMLHttpRequest) *EventTarget {
    return self._proto._proto;
 }
@@ -175,9 +168,9 @@ pub fn setWithCredentials(self: *XMLHttpRequest, value: bool) !void {
 // TODO: url should be a union, as it can be multiple things
 pub fn open(self: *XMLHttpRequest, method_: []const u8, url: [:0]const u8) !void {
    // Abort any in-progress request
-    if (self._http_response) |transfer| {
+    if (self._transfer) |transfer| {
        transfer.abort(error.Abort);
-        self._http_response = null;
+        self._transfer = null;
    }

    // Reset internal state
@@ -252,6 +245,8 @@ pub fn send(self: *XMLHttpRequest, body_: ?[]const u8) !void {
        .error_callback = httpErrorCallback,
        .shutdown_callback = httpShutdownCallback,
    });
+
+    page.js.strongRef(self);
 }

 fn handleBlobUrl(self: *XMLHttpRequest, page: *Page) !void {
@@ -387,33 +382,34 @@ pub fn getResponseXML(self: *XMLHttpRequest, page: *Page) !?*Node.Document {
    };
 }

-fn httpStartCallback(response: HttpClient.Response) !void {
-    const self: *XMLHttpRequest = @ptrCast(@alignCast(response.ctx));
+fn httpStartCallback(transfer: *HttpClient.Transfer) !void {
+    const self: *XMLHttpRequest = @ptrCast(@alignCast(transfer.ctx));
    if (comptime IS_DEBUG) {
        log.debug(.http, "request start", .{ .method = self._method, .url = self._url, .source = "xhr" });
    }
-    self._http_response = response;
-    self.acquireRef();
+    self._transfer = transfer;
 }

-fn httpHeaderCallback(response: HttpClient.Response, header: net_http.Header) !void {
-    const self: *XMLHttpRequest = @ptrCast(@alignCast(response.ctx));
+fn httpHeaderCallback(transfer: *HttpClient.Transfer, header: net_http.Header) !void {
+    const self: *XMLHttpRequest = @ptrCast(@alignCast(transfer.ctx));
    const joined = try std.fmt.allocPrint(self._arena, "{s}: {s}", .{ header.name, header.value });
    try self._response_headers.append(self._arena, joined);
 }

-fn httpHeaderDoneCallback(response: HttpClient.Response) !bool {
-    const self: *XMLHttpRequest = @ptrCast(@alignCast(response.ctx));
+fn httpHeaderDoneCallback(transfer: *HttpClient.Transfer) !bool {
+    const self: *XMLHttpRequest = @ptrCast(@alignCast(transfer.ctx));
+
+    const header = &transfer.response_header.?;

    if (comptime IS_DEBUG) {
        log.debug(.http, "request header", .{
            .source = "xhr",
            .url = self._url,
-            .status = response.status(),
+            .status = header.status,
        });
    }

-    if (response.contentType()) |ct| {
+    if (header.contentType()) |ct| {
        self._response_mime = Mime.parse(ct) catch |e| {
            log.info(.http, "invalid content type", .{
                .content_Type = ct,
@@ -424,18 +420,18 @@ fn httpHeaderDoneCallback(response: HttpClient.Response) !bool {
        };
    }

-    var it = response.headerIterator();
+    var it = transfer.responseHeaderIterator();
    while (it.next()) |hdr| {
        const joined = try std.fmt.allocPrint(self._arena, "{s}: {s}", .{ hdr.name, hdr.value });
        try self._response_headers.append(self._arena, joined);
    }

-    self._response_status = response.status().?;
-    if (response.contentLength()) |cl| {
+    self._response_status = header.status;
+    if (transfer.getContentLength()) |cl| {
        self._response_len = cl;
        try self._response_data.ensureTotalCapacity(self._arena, cl);
    }
-    self._response_url = try self._arena.dupeZ(u8, response.url());
+    self._response_url = try self._arena.dupeZ(u8, std.mem.span(header.url));

    const page = self._page;

@@ -450,8 +446,8 @@ fn httpHeaderDoneCallback(response: HttpClient.Response) !bool {
    return true;
 }

-fn httpDataCallback(response: HttpClient.Response, data: []const u8) !void {
-    const self: *XMLHttpRequest = @ptrCast(@alignCast(response.ctx));
+fn httpDataCallback(transfer: *HttpClient.Transfer, data: []const u8) !void {
+    const self: *XMLHttpRequest = @ptrCast(@alignCast(transfer.ctx));
    try self._response_data.appendSlice(self._arena, data);

    const page = self._page;
@@ -474,7 +470,7 @@ fn httpDoneCallback(ctx: *anyopaque) !void {

    // Not that the request is done, the http/client will free the transfer
    // object. It isn't safe to keep it around.
-    self._http_response = null;
+    self._transfer = null;

    const page = self._page;

@@ -490,31 +486,29 @@ fn httpDoneCallback(ctx: *anyopaque) !void {
        .loaded = loaded,
    }, page);

-    self.releaseRef(page._session);
+    page.js.weakRef(self);
 }

 fn httpErrorCallback(ctx: *anyopaque, err: anyerror) void {
    const self: *XMLHttpRequest = @ptrCast(@alignCast(ctx));
    // http client will close it after an error, it isn't safe to keep around
+    self._transfer = null;
    self.handleError(err);
-    if (self._http_response != null) {
-        self._http_response = null;
-        self.releaseRef(self._page._session);
-    }
+    self._page.js.weakRef(self);
 }

 fn httpShutdownCallback(ctx: *anyopaque) void {
    const self: *XMLHttpRequest = @ptrCast(@alignCast(ctx));
-    self._http_response = null;
+    self._transfer = null;
 }

 pub fn abort(self: *XMLHttpRequest) void {
    self.handleError(error.Abort);
-    if (self._http_response) |resp| {
-        resp.abort(error.Abort);
-        self._http_response = null;
-        self.releaseRef(self._page._session);
+    if (self._transfer) |transfer| {
+        transfer.abort(error.Abort);
+        self._transfer = null;
    }
+    self._page.js.weakRef(self);
 }

 fn handleError(self: *XMLHttpRequest, err: anyerror) void {
@@ -588,6 +582,8 @@ pub const JsApi = struct {
        pub const name = "XMLHttpRequest";
        pub const prototype_chain = bridge.prototypeChain();
        pub var class_id: bridge.ClassId = undefined;
+        pub const weak = true;
+        pub const finalizer = bridge.finalizer(XMLHttpRequest.deinit);
    };

    pub const constructor = bridge.constructor(XMLHttpRequest.init, .{});
--- a/src/lightpanda.zig
+++ b/src/lightpanda.zig
@@ -209,37 +209,6 @@ noinline fn assertionFailure(comptime ctx: []const u8, args: anytype) noreturn {
    @import("crash_handler.zig").crash(ctx, args, @returnAddress());
 }

-// Reference counting helper
-pub fn RC(comptime T: type) type {
-    return struct {
-        _refs: T = 0,
-
-        pub fn init(refs: T) @This() {
-            return .{ ._refs = refs };
-        }
-
-        pub fn acquire(self: *@This()) void {
-            self._refs += 1;
-        }
-
-        pub fn release(self: *@This(), value: anytype, session: *Session) void {
-            if (comptime IS_DEBUG) {
-                std.debug.assert(self._refs > 0);
-            }
-
-            const refs = self._refs - 1;
-            self._refs = refs;
-            if (refs > 0) {
-                return;
-            }
-            value.deinit(session);
-            if (session.finalizer_callbacks.fetchRemove(@intFromPtr(value))) |kv| {
-                session.releaseArena(kv.value.arena);
-            }
-        }
-    };
-}
-
 test {
    std.testing.refAllDecls(@This());
 }
--- a/src/network/Runtime.zig
+++ b/src/network/Runtime.zig
@@ -29,9 +29,7 @@ const libcurl = @import("../sys/libcurl.zig");
 const net_http = @import("http.zig");
 const RobotStore = @import("Robots.zig").RobotStore;
 const WebBotAuth = @import("WebBotAuth.zig");
-const Cache = @import("cache/Cache.zig");

-const App = @import("../App.zig");
 const Runtime = @This();

 const Listener = struct {
@@ -47,12 +45,10 @@ const MAX_TICK_CALLBACKS = 16;

 allocator: Allocator,

-app: *App,
 config: *const Config,
 ca_blob: ?net_http.Blob,
 robot_store: RobotStore,
 web_bot_auth: ?WebBotAuth,
-cache: ?Cache,

 connections: []net_http.Connection,
 available: std.DoublyLinkedList = .{},
@@ -204,7 +200,7 @@ fn globalDeinit() void {
    libcurl.curl_global_cleanup();
 }

-pub fn init(allocator: Allocator, app: *App, config: *const Config) !Runtime {
+pub fn init(allocator: Allocator, config: *const Config) !Runtime {
    globalInit(allocator);
    errdefer globalDeinit();

@@ -237,11 +233,6 @@ pub fn init(allocator: Allocator, app: *App, config: *const Config) !Runtime {
    else
        null;

-    const cache = if (config.cacheDir()) |cache_dir_path|
-        Cache{ .kind = .{ .fs = try .init(cache_dir_path) } }
-    else
-        null;
-
    return .{
        .allocator = allocator,
        .config = config,
@@ -253,10 +244,8 @@ pub fn init(allocator: Allocator, app: *App, config: *const Config) !Runtime {
        .available = available,
        .connections = connections,

-        .app = app,
        .robot_store = RobotStore.init(allocator),
        .web_bot_auth = web_bot_auth,
-        .cache = cache,
    };
 }

--- a/src/network/cache/Cache.zig
+++ b/src/network/cache/Cache.zig
@@ -1,173 +0,0 @@
-// Copyright (C) 2023-2026  Lightpanda (Selecy SAS)
-//
-// Francis Bouvier <francis@lightpanda.io>
-// Pierre Tachoire <pierre@lightpanda.io>
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as
-// published by the Free Software Foundation, either version 3 of the
-// License, or (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-const std = @import("std");
-const Http = @import("../http.zig");
-const FsCache = @import("FsCache.zig");
-
-/// A browser-wide cache for resources across the network.
-/// This mostly conforms to RFC9111 with regards to caching behavior.
-pub const Cache = @This();
-
-kind: union(enum) {
-    fs: FsCache,
-},
-
-pub fn get(self: *Cache, arena: std.mem.Allocator, req: CacheRequest) ?CachedResponse {
-    return switch (self.kind) {
-        inline else => |*c| c.get(arena, req),
-    };
-}
-
-pub fn put(self: *Cache, metadata: CachedMetadata, body: []const u8) !void {
-    return switch (self.kind) {
-        inline else => |*c| c.put(metadata, body),
-    };
-}
-
-pub const CacheControl = struct {
-    max_age: u64,
-    must_revalidate: bool = false,
-    immutable: bool = false,
-
-    pub fn parse(value: []const u8) ?CacheControl {
-        var cc: CacheControl = .{ .max_age = undefined };
-
-        var max_age_set = false;
-        var max_s_age_set = false;
-        var is_public = false;
-
-        var iter = std.mem.splitScalar(u8, value, ',');
-        while (iter.next()) |part| {
-            const directive = std.mem.trim(u8, part, &std.ascii.whitespace);
-            if (std.ascii.eqlIgnoreCase(directive, "no-store")) {
-                return null;
-            } else if (std.ascii.eqlIgnoreCase(directive, "no-cache")) {
-                return null;
-            } else if (std.ascii.eqlIgnoreCase(directive, "must-revalidate")) {
-                cc.must_revalidate = true;
-            } else if (std.ascii.eqlIgnoreCase(directive, "immutable")) {
-                cc.immutable = true;
-            } else if (std.ascii.eqlIgnoreCase(directive, "public")) {
-                is_public = true;
-            } else if (std.ascii.startsWithIgnoreCase(directive, "max-age=")) {
-                if (!max_s_age_set) {
-                    if (std.fmt.parseInt(u64, directive[8..], 10) catch null) |max_age| {
-                        cc.max_age = max_age;
-                        max_age_set = true;
-                    }
-                }
-            } else if (std.ascii.startsWithIgnoreCase(directive, "s-maxage=")) {
-                if (std.fmt.parseInt(u64, directive[9..], 10) catch null) |max_age| {
-                    cc.max_age = max_age;
-                    max_age_set = true;
-                    max_s_age_set = true;
-                }
-            }
-        }
-
-        if (!max_age_set) return null;
-        if (!is_public) return null;
-        if (cc.max_age == 0) return null;
-
-        return cc;
-    }
-};
-
-pub const Vary = union(enum) {
-    wildcard: void,
-    value: []const u8,
-
-    pub fn parse(value: []const u8) Vary {
-        if (std.mem.eql(u8, value, "*")) return .wildcard;
-        return .{ .value = value };
-    }
-
-    pub fn toString(self: Vary) []const u8 {
-        return switch (self) {
-            .wildcard => "*",
-            .value => |v| v,
-        };
-    }
-};
-
-pub const CachedMetadata = struct {
-    url: [:0]const u8,
-    content_type: []const u8,
-
-    status: u16,
-    stored_at: i64,
-    age_at_store: u64,
-
-    // for If-None-Match
-    etag: ?[]const u8,
-    // for If-Modified-Since
-    last_modified: ?[]const u8,
-
-    cache_control: CacheControl,
-    vary: ?Vary,
-    headers: []const Http.Header,
-};
-
-pub const CacheRequest = struct {
-    url: []const u8,
-    timestamp: i64,
-};
-
-pub const CachedData = union(enum) {
-    buffer: []const u8,
-    file: std.fs.File,
-};
-
-pub const CachedResponse = struct {
-    metadata: CachedMetadata,
-    data: CachedData,
-};
-
-pub fn tryCache(
-    arena: std.mem.Allocator,
-    timestamp: i64,
-    url: [:0]const u8,
-    status: u16,
-    content_type: ?[]const u8,
-    cache_control: ?[]const u8,
-    vary: ?[]const u8,
-    etag: ?[]const u8,
-    last_modified: ?[]const u8,
-    age: ?[]const u8,
-    has_set_cookie: bool,
-    has_authorization: bool,
-) !?CachedMetadata {
-    if (status != 200) return null;
-    if (has_set_cookie) return null;
-    if (has_authorization) return null;
-    const cc = CacheControl.parse(cache_control orelse return null) orelse return null;
-
-    return .{
-        .url = url,
-        .content_type = if (content_type) |ct| try arena.dupe(u8, ct) else "application/octet-stream",
-        .status = status,
-        .stored_at = timestamp,
-        .age_at_store = if (age) |a| std.fmt.parseInt(u64, a, 10) catch 0 else 0,
-        .cache_control = cc,
-        .vary = if (vary) |v| Vary.parse(v) else null,
-        .etag = if (etag) |e| try arena.dupe(u8, e) else null,
-        .last_modified = if (last_modified) |lm| try arena.dupe(u8, lm) else null,
-        .headers = &.{},
-    };
-}
--- a/src/network/cache/FsCache.zig
+++ b/src/network/cache/FsCache.zig
@@ -1,293 +0,0 @@
-// Copyright (C) 2023-2026  Lightpanda (Selecy SAS)
-//
-// Francis Bouvier <francis@lightpanda.io>
-// Pierre Tachoire <pierre@lightpanda.io>
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU Affero General Public License as
-// published by the Free Software Foundation, either version 3 of the
-// License, or (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU Affero General Public License for more details.
-//
-// You should have received a copy of the GNU Affero General Public License
-// along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-const std = @import("std");
-const Cache = @import("Cache.zig");
-const Http = @import("../http.zig");
-const CacheRequest = Cache.CacheRequest;
-const CachedMetadata = Cache.CachedMetadata;
-const CachedResponse = Cache.CachedResponse;
-
-const CACHE_VERSION: usize = 1;
-const LOCK_STRIPES = 16;
-
-pub const FsCache = @This();
-
-dir: std.fs.Dir,
-locks: [LOCK_STRIPES]std.Thread.Mutex = .{std.Thread.Mutex{}} ** LOCK_STRIPES,
-
-const CacheMetadataFile = struct {
-    version: usize,
-    metadata: CachedMetadata,
-};
-
-fn getLockPtr(self: *FsCache, key: *const [HASHED_KEY_LEN]u8) *std.Thread.Mutex {
-    const lock_idx: usize = @truncate(std.hash.Wyhash.hash(0, key) % LOCK_STRIPES);
-    return &self.locks[lock_idx];
-}
-
-const HASHED_KEY_LEN = 64;
-const HASHED_PATH_LEN = HASHED_KEY_LEN + 5;
-const HASHED_TMP_PATH_LEN = HASHED_PATH_LEN + 4;
-
-fn hashKey(key: []const u8) [HASHED_KEY_LEN]u8 {
-    var digest: [std.crypto.hash.sha2.Sha256.digest_length]u8 = undefined;
-    std.crypto.hash.sha2.Sha256.hash(key, &digest, .{});
-    var hex: [HASHED_KEY_LEN]u8 = undefined;
-    _ = std.fmt.bufPrint(&hex, "{s}", .{std.fmt.bytesToHex(&digest, .lower)}) catch unreachable;
-    return hex;
-}
-
-fn metaPath(hashed_key: *const [HASHED_KEY_LEN]u8) [HASHED_PATH_LEN]u8 {
-    var path: [HASHED_PATH_LEN]u8 = undefined;
-    _ = std.fmt.bufPrint(&path, "{s}.meta", .{hashed_key}) catch unreachable;
-    return path;
-}
-
-fn bodyPath(hashed_key: *const [HASHED_KEY_LEN]u8) [HASHED_PATH_LEN]u8 {
-    var path: [HASHED_PATH_LEN]u8 = undefined;
-    _ = std.fmt.bufPrint(&path, "{s}.body", .{hashed_key}) catch unreachable;
-    return path;
-}
-
-fn metaTmpPath(hashed_key: *const [HASHED_KEY_LEN]u8) [HASHED_TMP_PATH_LEN]u8 {
-    var path: [HASHED_TMP_PATH_LEN]u8 = undefined;
-    _ = std.fmt.bufPrint(&path, "{s}.meta.tmp", .{hashed_key}) catch unreachable;
-    return path;
-}
-
-fn bodyTmpPath(hashed_key: *const [HASHED_KEY_LEN]u8) [HASHED_TMP_PATH_LEN]u8 {
-    var path: [HASHED_TMP_PATH_LEN]u8 = undefined;
-    _ = std.fmt.bufPrint(&path, "{s}.body.tmp", .{hashed_key}) catch unreachable;
-    return path;
-}
-
-pub fn init(path: []const u8) !FsCache {
-    const cwd = std.fs.cwd();
-
-    cwd.makeDir(path) catch |err| switch (err) {
-        error.PathAlreadyExists => {},
-        else => return err,
-    };
-
-    const dir = try cwd.openDir(path, .{ .iterate = true });
-    return .{ .dir = dir };
-}
-
-pub fn deinit(self: *FsCache) void {
-    self.dir.close();
-}
-
-pub fn get(self: *FsCache, arena: std.mem.Allocator, req: CacheRequest) ?Cache.CachedResponse {
-    const hashed_key = hashKey(req.url);
-    const meta_p = metaPath(&hashed_key);
-    const body_p = bodyPath(&hashed_key);
-
-    const lock = self.getLockPtr(&hashed_key);
-    lock.lock();
-    defer lock.unlock();
-
-    const meta_file = self.dir.openFile(&meta_p, .{ .mode = .read_only }) catch return null;
-    defer meta_file.close();
-
-    const contents = meta_file.readToEndAlloc(arena, 1 * 1024 * 1024) catch return null;
-    defer arena.free(contents);
-
-    const cache_file: CacheMetadataFile = std.json.parseFromSliceLeaky(
-        CacheMetadataFile,
-        arena,
-        contents,
-        .{ .allocate = .alloc_always },
-    ) catch {
-        self.dir.deleteFile(&meta_p) catch {};
-        self.dir.deleteFile(&body_p) catch {};
-        return null;
-    };
-
-    const metadata = cache_file.metadata;
-
-    if (cache_file.version != CACHE_VERSION) {
-        self.dir.deleteFile(&meta_p) catch {};
-        self.dir.deleteFile(&body_p) catch {};
-        return null;
-    }
-
-    const now = req.timestamp;
-    const age = (now - metadata.stored_at) + @as(i64, @intCast(metadata.age_at_store));
-    if (age < 0 or @as(u64, @intCast(age)) >= metadata.cache_control.max_age) {
-        self.dir.deleteFile(&meta_p) catch {};
-        self.dir.deleteFile(&body_p) catch {};
-        return null;
-    }
-
-    const body_file = self.dir.openFile(
-        &body_p,
-        .{ .mode = .read_only },
-    ) catch return null;
-
-    return .{
-        .metadata = metadata,
-        .data = .{ .file = body_file },
-    };
-}
-
-pub fn put(self: *FsCache, meta: CachedMetadata, body: []const u8) !void {
-    const hashed_key = hashKey(meta.url);
-    const meta_p = metaPath(&hashed_key);
-    const meta_tmp_p = metaTmpPath(&hashed_key);
-    const body_p = bodyPath(&hashed_key);
-    const body_tmp_p = bodyTmpPath(&hashed_key);
-    var writer_buf: [512]u8 = undefined;
-
-    const lock = self.getLockPtr(&hashed_key);
-    lock.lock();
-    defer lock.unlock();
-
-    {
-        const meta_file = try self.dir.createFile(&meta_tmp_p, .{});
-        errdefer {
-            meta_file.close();
-            self.dir.deleteFile(&meta_tmp_p) catch {};
-        }
-
-        var meta_file_writer = meta_file.writer(&writer_buf);
-        const meta_file_writer_iface = &meta_file_writer.interface;
-        try std.json.Stringify.value(
-            CacheMetadataFile{ .version = CACHE_VERSION, .metadata = meta },
-            .{ .whitespace = .minified },
-            meta_file_writer_iface,
-        );
-        try meta_file_writer_iface.flush();
-        meta_file.close();
-    }
-    errdefer self.dir.deleteFile(&meta_tmp_p) catch {};
-    try self.dir.rename(&meta_tmp_p, &meta_p);
-
-    {
-        const body_file = try self.dir.createFile(&body_tmp_p, .{});
-        errdefer {
-            body_file.close();
-            self.dir.deleteFile(&body_tmp_p) catch {};
-        }
-
-        var body_file_writer = body_file.writer(&writer_buf);
-        const body_file_writer_iface = &body_file_writer.interface;
-        try body_file_writer_iface.writeAll(body);
-        try body_file_writer_iface.flush();
-        body_file.close();
-    }
-    errdefer self.dir.deleteFile(&body_tmp_p) catch {};
-
-    errdefer self.dir.deleteFile(&meta_p) catch {};
-    try self.dir.rename(&body_tmp_p, &body_p);
-}
-
-const testing = std.testing;
-
-test "FsCache: basic put and get" {
-    var tmp = testing.tmpDir(.{});
-    defer tmp.cleanup();
-
-    const path = try tmp.dir.realpathAlloc(testing.allocator, ".");
-    defer testing.allocator.free(path);
-
-    var fs_cache = try FsCache.init(path);
-    defer fs_cache.deinit();
-    var cache = Cache{ .kind = .{ .fs = fs_cache } };
-
-    var arena = std.heap.ArenaAllocator.init(testing.allocator);
-    defer arena.deinit();
-
-    const now = std.time.timestamp();
-    const meta = CachedMetadata{
-        .url = "https://example.com",
-        .content_type = "text/html",
-        .status = 200,
-        .stored_at = now,
-        .age_at_store = 0,
-        .etag = null,
-        .last_modified = null,
-        .cache_control = .{ .max_age = 600 },
-        .vary = null,
-        .headers = &.{},
-    };
-
-    const body = "hello world";
-    try cache.put(meta, body);
-
-    const result = cache.get(arena.allocator(), .{ .url = "https://example.com", .timestamp = now }) orelse return error.CacheMiss;
-    defer result.data.file.close();
-
-    var buf: [64]u8 = undefined;
-    var file_reader = result.data.file.reader(&buf);
-
-    const read_buf = try file_reader.interface.allocRemaining(testing.allocator, .unlimited);
-    defer testing.allocator.free(read_buf);
-
-    try testing.expectEqualStrings(body, read_buf);
-}
-
-test "FsCache: get expiration" {
-    var tmp = testing.tmpDir(.{});
-    defer tmp.cleanup();
-
-    const path = try tmp.dir.realpathAlloc(testing.allocator, ".");
-    defer testing.allocator.free(path);
-
-    var fs_cache = try FsCache.init(path);
-    defer fs_cache.deinit();
-    var cache = Cache{ .kind = .{ .fs = fs_cache } };
-
-    var arena = std.heap.ArenaAllocator.init(testing.allocator);
-    defer arena.deinit();
-
-    const now = 5000;
-    const max_age = 1000;
-
-    const meta = CachedMetadata{
-        .url = "https://example.com",
-        .content_type = "text/html",
-        .status = 200,
-        .stored_at = now,
-        .age_at_store = 900,
-        .etag = null,
-        .last_modified = null,
-        .cache_control = .{ .max_age = max_age },
-        .vary = null,
-        .headers = &.{},
-    };
-
-    const body = "hello world";
-    try cache.put(meta, body);
-
-    const result = cache.get(
-        arena.allocator(),
-        .{ .url = "https://example.com", .timestamp = now + 50 },
-    ) orelse return error.CacheMiss;
-    result.data.file.close();
-
-    try testing.expectEqual(null, cache.get(
-        arena.allocator(),
-        .{ .url = "https://example.com", .timestamp = now + 200 },
-    ));
-
-    try testing.expectEqual(null, cache.get(
-        arena.allocator(),
-        .{ .url = "https://example.com", .timestamp = now },
-    ));
-}