@gcmdev/faxios 0.2.0 → 0.2.2

package/src/lib/adapters/fetch.ts

@@ -0,0 +1,871 @@
+import FaxiosError from "../core/FaxiosError.js";
+import FaxiosHeaders from "../core/FaxiosHeaders.js";
+import prepareRequest from "../core/prepareRequest.js";
+import { settle } from "../core/settle.js";
+import { VERSION } from "../env/data.js";
+import composeSignals from "../helpers/composeSignals.js";
+import estimateDataURLDecodedBytes from "../helpers/estimateDataURLDecodedBytes.js";
+import {
+  asyncDecorator,
+  progressEventDecorator,
+  progressEventReducer
+} from "../helpers/progressEventReducer.js";
+import { toByteStringHeaderObject } from "../helpers/sanitizeHeaderValue.js";
+import { trackStream } from "../helpers/trackStream.js";
+import platform from "../platform.js";
+import type {
+  FaxiosRequestHeaders,
+  InternalFaxiosRequestConfig
+} from "../types.js";
+import utils from "../utils.js";
+import { checkDeclaredContentLength, checkMaterializedSize, cleanFormDataContentType, encodeBodyIfNeeded, handleFetchCaughtError } from "./fetch-helpers.js";
+import type { ComposedSignal, PendingBodyErrorRef } from "./fetch-helpers.js";
+
+// btoa is a global in Node 16+ and browsers; accessed via globalThis for no-DOM lib compat
+const _btoa: (data: string) => string = (
+  globalThis as unknown as Record<string, unknown>
+)["btoa"] as (data: string) => string;
+type AnyConstructor = new (...args: Array<unknown>) => unknown;
+type FetchFn = (input: unknown, init?: unknown) => Promise<AnyResponse>;
+type AnyResponse = {
+  [key: string]: unknown;
+  arrayBuffer: () => Promise<ArrayBuffer>;
+  body: unknown;
+  headers: {
+    [key: string]: unknown;
+    get: (name: string) => null | string;
+    has: (name: string) => boolean;
+  };
+  status: number;
+  statusText: string;
+};
+type AnyRequest = {
+  [key: string]: unknown;
+  arrayBuffer: () => Promise<ArrayBuffer>;
+  body: null | { cancel: () => Promise<void>; };
+  headers: {
+    get: (name: string) => null | string;
+    has: (name: string) => boolean;
+  };
+};
+type AnyReadableStream = {
+  [key: string]: unknown;
+  cancel: () => Promise<void>;
+};
+type AnyTextEncoder = { encode: (str: string) => Uint8Array; };
+
+const DEFAULT_CHUNK_SIZE = 64 * 1024;
+
+const { isFunction } = utils;
+
+// Web stream bodies this adapter has sent. fetch can read a stream without leaving it locked,
+// and there's no portable "disturbed" check, so a second send is caught here.
+const sentStreamBodies = new WeakSet<object>();
+
+// A stream body can be read once. Middleware that calls next() again after a try read it
+// would send an empty body (Node stream) or get an uncoded TypeError from fetch (web stream).
+const rejectUsedStreamBody = (data: unknown, config: InternalFaxiosRequestConfig): void => {
+  const body = data as { bodyUsed?: unknown; destroyed?: unknown; locked?: unknown; readableDidRead?: unknown; readableEnded?: unknown; };
+  const isWebStream = utils.isReadableStream!(data);
+  if (
+    (isWebStream && (body.locked === true || sentStreamBodies.has(body))) ||
+    ((utils.isRequest!(data) || utils.isResponse!(data)) && body.bodyUsed === true) ||
+    (utils.isStream(data) && (body.readableDidRead === true || body.readableEnded === true || body.destroyed === true))
+  ) {
+    throw new FaxiosError(
+      "Request body stream was already used and can't be sent again; pass a new body for each try",
+      FaxiosError.ERR_BAD_REQUEST,
+      config
+    );
+  }
+  if (isWebStream) sentStreamBodies.add(body);
+};
+
+// Server runtimes default User-Agent to their own (e.g. "node"), so name faxios there.
+// Browsers send their own User-Agent; setting one makes every cross-origin request
+// need a CORS preflight that most APIs don't allow.
+const setsUserAgent = !platform.hasStandardBrowserEnv && !platform.hasStandardBrowserWebWorkerEnv;
+const applyDefaultUserAgent = (headers: FaxiosRequestHeaders): void => {
+  if (setsUserAgent) headers.set("User-Agent", "faxios/" + VERSION, false);
+};
+
+/**
+ * Encode a UTF-8 string to a Latin-1 byte string for use with btoa().
+ * This is a modern replacement for the deprecated unescape(encodeURIComponent(str)) pattern.
+ *
+ * @param {string} str The string to encode
+ *
+ * @returns {string} UTF-8 bytes as a Latin-1 string
+ */
+const encodeUTF8 = (str: string): string =>
+  encodeURIComponent(str).replace(
+    /%([0-9A-F]{2})/gi,
+    (_: string, hex: string) => String.fromCharCode(parseInt(hex, 16))
+  );
+
+// Node's WHATWG URL parser returns `username` and `password` percent-encoded.
+// Decode before composing the `auth` option so credentials such as
+// `my%40email.com:pass` are sent as `my@email.com:pass`. Falls back to the
+// original value for malformed input so a bad encoding never throws.
+const decodeURIComponentSafe = (value: unknown): unknown => {
+  if (!utils.isString(value)) {
+    return value;
+  }
+
+  try {
+    return decodeURIComponent(value as string);
+  }
+  catch {
+    return value;
+  }
+};
+
+const test = (
+  fn: (...args: Array<unknown>) => unknown,
+  ...args: Array<unknown>
+): boolean => {
+  try {
+    return !!fn(...args);
+  }
+  catch {
+    return false;
+  }
+};
+
+const maybeWithAuthCredentials = (url: string): boolean => {
+  const protocolIndex = url.indexOf("://");
+  const urlToCheck = protocolIndex !== -1 ? url.slice(protocolIndex + 3) : url;
+  // Only `@` indicates credentials in the authority; `:` alone is a port separator.
+  return urlToCheck.includes("@");
+};
+
+// RequestInit members faxios sets itself; the same keys in `fetchOptions` are ignored.
+const FAXIOS_INIT_KEYS: Record<string, true> = {
+  body: true,
+  credentials: true,
+  duplex: true,
+  headers: true,
+  method: true,
+  signal: true,
+};
+
+// Spec defaults written as own init members when the caller sets none. undici converts the init
+// into a plain dictionary and reads absent members from it, so an absent member still picks up a
+// polluted Object.prototype value; an own default leaves nothing to inherit.
+const REQUEST_INIT_DEFAULTS: Record<string, unknown> = {
+  cache: "default",
+  integrity: "",
+  keepalive: false,
+  mode: "cors",
+  redirect: "follow",
+  referrer: "about:client",
+  referrerPolicy: "",
+};
+
+// Where undici (Node's fetch) keeps its global dispatcher.
+const UNDICI_GLOBAL_DISPATCHER = Symbol.for("undici.globalDispatcher.1");
+
+type FetchEnv = {
+  fetch?: unknown;
+  Request?: unknown;
+  Response?: unknown;
+};
+
+// eslint-disable-next-line sonarjs/function-return-type
+const factory = (env: FetchEnv) => {
+  // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
+  const globalObject: Record<string, unknown> = utils.global ?? globalThis;
+  const ReadableStream = globalObject["ReadableStream"] as
+    | (AnyConstructor & { prototype: AnyReadableStream; })
+    | undefined;
+  const TextEncoder = globalObject["TextEncoder"] as
+    | (new () => AnyTextEncoder)
+    | undefined;
+
+  // `undefined` falls back to the global constructor; `null` disables it.
+  const envFetch = env.fetch as FetchFn | undefined;
+  const Request = (env.Request === undefined ? globalObject["Request"] : env.Request) as AnyConstructor | undefined;
+  const Response = (env.Response === undefined ? globalObject["Response"] : env.Response) as AnyConstructor | undefined;
+  const _globalFetch = (globalThis as unknown as Record<string, unknown>)[
+    "fetch"
+  ];
+  const isFetchSupported = envFetch
+    ? isFunction(envFetch)
+    : isFunction(_globalFetch);
+  const isRequestSupported = isFunction(Request);
+  const isResponseSupported = isFunction(Response);
+
+  if (!isFetchSupported) {
+    return false;
+  }
+
+  // Only members this runtime's Request exposes, so an engine that rejects members it doesn't
+  // implement (Cloudflare Workers) is never sent one.
+  const requestInitDefaults = Object.entries(REQUEST_INIT_DEFAULTS).filter(([ key ]) =>
+    isRequestSupported && utils.hasOwnInPrototypeChain((Request as AnyConstructor).prototype, key));
+
+  // Null prototype: WebIDL reads every RequestInit member with Get, which walks the prototype
+  // chain, so a plain object literal would let a polluted Object.prototype.redirect, .integrity,
+  // .mode or undici .dispatcher apply to every request. Every own enumerable key of fetchOptions
+  // is copied, so runtime extensions (Next.js `next`, Workers `cf`, Bun `tls`) still pass through;
+  // inherited keys never do. The caller sets signal, method, headers, body, duplex, credentials.
+  const initFromFetchOptions = (fetchOptions: unknown): Record<string, unknown> => {
+    const init: Record<string, unknown> = Object.create(null);
+    for (const [ key, value ] of requestInitDefaults) init[key] = value;
+    // Node's global fetch reads `dispatcher` the same way; pin it to undici's own global one.
+    if (!envFetch && utils.hasOwnProp(globalThis, UNDICI_GLOBAL_DISPATCHER)) {
+      init["dispatcher"] = (globalThis as Record<PropertyKey, unknown>)[UNDICI_GLOBAL_DISPATCHER];
+    }
+    if (utils.isObject(fetchOptions)) {
+      for (const key of Object.keys(fetchOptions)) {
+        if (!utils.hasOwnProp(FAXIOS_INIT_KEYS, key)) init[key] = (fetchOptions as Record<string, unknown>)[key];
+      }
+    }
+    return init;
+  };
+
+  const isReadableStreamSupported = isFunction(ReadableStream);
+
+  const encodeText: (str: string) => Promise<Uint8Array> | Uint8Array =
+    typeof TextEncoder === "function"
+      ? (
+        (encoder: AnyTextEncoder) => (str: string) =>
+          encoder.encode(str)
+      )(new TextEncoder())
+      : async (str: string) =>
+        new Uint8Array(
+          await (
+            new (Request as AnyConstructor)(str) as AnyRequest
+          ).arrayBuffer()
+        );
+
+  // A Node stream body reaches fetch twice: once in `new Request(url, init)` and again in
+  // `fetch(request, init)`. undici (Node 26.11+) starts reading an async iterable in both,
+  // so the first chunk goes to the discarded copy. One web stream is read only once.
+  // Web stream bodies must yield bytes, so string chunks (e.g. `Readable.from(["a"])`) are encoded.
+  const from = (ReadableStream as undefined | { from?: (source: unknown) => unknown; })?.from;
+  const streamFrom = typeof from === "function" ? from.bind(ReadableStream) : undefined;
+  async function* toByteChunks(source: AsyncIterable<unknown>) {
+    for await (const chunk of source) yield typeof chunk === "string" ? await encodeText(chunk) : chunk;
+  }
+  const toWebStream = (body: unknown): unknown =>
+    (streamFrom && utils.isStream(body) && !utils.isFormData(body)
+      ? streamFrom(toByteChunks(body as AsyncIterable<unknown>))
+      : body);
+
+  const supportsRequestStream =
+    isRequestSupported &&
+    isReadableStreamSupported &&
+    test(() => {
+      let duplexAccessed = false;
+
+      const request = new (Request as AnyConstructor)(platform.origin, {
+        body: new (ReadableStream as AnyConstructor)(),
+        method: "POST",
+        get duplex() {
+          duplexAccessed = true;
+          return "half";
+        },
+      }) as AnyRequest;
+
+      const hasContentType = request.headers.has("Content-Type");
+
+      if (request.body != null) {
+        request.body.cancel().catch(() => {});
+      }
+
+      // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
+      return duplexAccessed && !hasContentType;
+    });
+
+  const supportsResponseStream =
+    isResponseSupported &&
+    isReadableStreamSupported &&
+    test(() =>
+      utils.isReadableStream!(
+        (new (Response as AnyConstructor)("") as AnyResponse).body
+      )
+    );
+
+  const resolvers: Record<
+    string,
+    ((res: AnyResponse, config?: unknown) => unknown) | false
+  > = {
+    stream: supportsResponseStream && ((res: AnyResponse) => res.body),
+  };
+
+  // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
+  isFetchSupported &&
+    (() => {
+      [ "text", "arrayBuffer", "blob", "formData", "stream" ].forEach(type => {
+        !resolvers[type] &&
+          (resolvers[type] = (res: AnyResponse, config?: unknown) => {
+            const method = (res as Record<string, unknown>)[type];
+
+            if (method) {
+              return (method as (this: AnyResponse) => unknown).call(res);
+            }
+
+            throw new FaxiosError(
+              `Response type '${type}' is not supported`,
+              FaxiosError.ERR_NOT_SUPPORT,
+              config as InternalFaxiosRequestConfig
+            );
+          });
+      });
+    })();
+
+  const getBodyLength = async (body: unknown): Promise<number | undefined> => {
+    if (body == null) {
+      return 0;
+    }
+
+    if (utils.isBlob(body)) {
+      return (body as { size: number; }).size;
+    }
+
+    if (utils.isSpecCompliantForm(body)) {
+      const _request = new (Request as AnyConstructor)(platform.origin, {
+        method: "POST",
+        body,
+      }) as AnyRequest;
+      return (await _request.arrayBuffer()).byteLength;
+    }
+
+    if (utils.isArrayBufferView(body) || utils.isArrayBuffer(body)) {
+      return (body as ArrayBuffer | ArrayBufferView).byteLength;
+    }
+
+    if (utils.isURLSearchParams(body)) {
+      body = body + "";
+    }
+
+    if (utils.isString(body)) {
+      return (await encodeText(body as string)).byteLength;
+    }
+    return undefined;
+  };
+
+  const resolveBodyLength = async (
+    headers: FaxiosRequestHeaders,
+    body: unknown
+  ): Promise<number | undefined> => {
+    const length = utils.toFiniteNumber(headers.getContentLength());
+
+    return length == null ? getBodyLength(body) : length;
+  };
+
+  const normalizeCredentials = (wc: boolean | string): string => {
+    if (utils.isString(wc)) return wc as string;
+    return wc ? "include" : "omit";
+  };
+
+  // HTTP basic authentication: extract auth from config or URL, set Authorization header,
+  // strip credentials from URL. Returns the (possibly updated) URL.
+  const applyAuthToRequest = (
+    url: string,
+    headers: FaxiosRequestHeaders,
+    own: (key: string) => unknown
+  ): string => {
+    let auth: undefined | { password: unknown; username: unknown; };
+    const configAuth = own("auth");
+    if (configAuth) {
+      auth = {
+        username: utils.getSafeProp(configAuth, "username") || "",
+        password: utils.getSafeProp(configAuth, "password") || "",
+      };
+    }
+    if (maybeWithAuthCredentials(url)) {
+      const parsedURL = new URL(url, platform.origin);
+      if (!auth && (parsedURL.username || parsedURL.password)) {
+        auth = {
+          username: decodeURIComponentSafe(parsedURL.username),
+          password: decodeURIComponentSafe(parsedURL.password),
+        };
+      }
+      if (parsedURL.username || parsedURL.password) {
+        parsedURL.username = "";
+        parsedURL.password = "";
+        url = parsedURL.href;
+      }
+    }
+    if (auth) {
+      headers.delete("authorization");
+      headers.set(
+        "Authorization",
+        "Basic " +
+          _btoa(
+            encodeUTF8(
+              String(auth.username || "") + ":" + String(auth.password || "")
+            )
+          )
+      );
+    }
+    return url;
+  };
+
+  // Pre-flight size checks: data: URL content-length and known-size body maxBodyLength.
+  // Returns requestContentLength if computed, else undefined.
+  const checkPreflightLimits = async (
+    url: string,
+    data: unknown,
+    method: string,
+    hasMaxContentLength: boolean,
+    maxContentLength: number,
+    hasMaxBodyLength: boolean,
+    maxBodyLength: number,
+    config: InternalFaxiosRequestConfig,
+    request: unknown
+  ): Promise<number | undefined> => {
+    // Enforce maxContentLength for data: URLs up-front so we never materialize
+    // an oversized payload. The HTTP adapter applies the same check.
+    if (
+      hasMaxContentLength &&
+      typeof url === "string" &&
+      url.startsWith("data:")
+    ) {
+      const estimated = estimateDataURLDecodedBytes(url);
+      if (estimated > maxContentLength) {
+        throw new FaxiosError(
+          "maxContentLength size of " + maxContentLength + " exceeded",
+          FaxiosError.ERR_BAD_RESPONSE,
+          config,
+          request
+        );
+      }
+    }
+    // Enforce maxBodyLength against known-size bodies before dispatch using
+    // the body's actual size — never a caller-declared Content-Length.
+    if (hasMaxBodyLength && method !== "get" && method !== "head") {
+      const outboundLength = await getBodyLength(data);
+      if (typeof outboundLength === "number" && isFinite(outboundLength)) {
+        if (outboundLength > maxBodyLength) {
+          throw new FaxiosError(
+            "Request body larger than maxBodyLength limit",
+            FaxiosError.ERR_BAD_REQUEST,
+            config,
+            request
+          );
+        }
+        return outboundLength;
+      }
+    }
+    return undefined;
+  };
+
+  // Wrap a Request body with upload progress tracking and optional maxBodyLength enforcement.
+  const applyUploadProgress = (
+    _request: AnyRequest,
+    data: unknown,
+    headers: FaxiosRequestHeaders,
+    requestContentLength: number | undefined,
+    onUploadProgress: unknown,
+    _trackStream: (stream: unknown, onProgress?: (bytes: number) => void, flush?: () => void) => unknown
+  ): unknown => {
+    let contentTypeHeader: null | string;
+    if (
+      utils.isFormData(data) &&
+      (contentTypeHeader = _request.headers.get("content-type"))
+    ) {
+      headers.setContentType(contentTypeHeader);
+    }
+    if (_request.body) {
+      const [ onProgress, flush ] = onUploadProgress
+        ? progressEventDecorator(
+          requestContentLength,
+          progressEventReducer(
+            asyncDecorator(
+              onUploadProgress as (...args: Array<unknown>) => unknown
+            ),
+            false
+          )
+        )
+        : [];
+      return _trackStream(_request.body, onProgress, flush);
+    }
+    return data;
+  };
+
+  // Set up request body streaming with upload progress and/or maxBodyLength enforcement.
+  const buildUploadStream = async (
+    data: unknown,
+    url: string,
+    method: string,
+    headers: FaxiosRequestHeaders,
+    onUploadProgress: unknown,
+    mustEnforceStreamBody: boolean,
+    requestContentLength: number | undefined,
+    hasMaxBodyLength: boolean,
+    maxBodyLength: number,
+    config: InternalFaxiosRequestConfig,
+    request: unknown,
+    pendingBodyErrorRef: PendingBodyErrorRef
+  ): Promise<{ data: unknown; requestContentLength: number | undefined; }> => {
+    const _makeBodyLengthError = () =>
+      new FaxiosError(
+        "Request body larger than maxBodyLength limit",
+        FaxiosError.ERR_BAD_REQUEST,
+        config,
+        request
+      );
+
+    const _trackStream = (
+      stream: unknown,
+      onProgress?: (bytes: number) => void,
+      flush?: () => void
+    ) =>
+      trackStream(
+        stream,
+        DEFAULT_CHUNK_SIZE,
+        (loadedBytes: number) => {
+          if (hasMaxBodyLength && loadedBytes > maxBodyLength) {
+            pendingBodyErrorRef.value = _makeBodyLengthError();
+            throw pendingBodyErrorRef.value;
+          }
+          onProgress && onProgress(loadedBytes);
+        },
+        flush
+      );
+
+    if (
+      supportsRequestStream &&
+      method !== "get" &&
+      method !== "head" &&
+      (onUploadProgress || mustEnforceStreamBody)
+    ) {
+      requestContentLength =
+        requestContentLength == null
+          ? await resolveBodyLength(headers, data)
+          : requestContentLength;
+
+      // A declared length of 0 is only trusted to skip the wrap when we are
+      // not enforcing a stream limit (which must not rely on that header).
+      if (requestContentLength !== 0 || mustEnforceStreamBody) {
+        const _request = new (Request as AnyConstructor)(url, {
+          method: "POST",
+          body: data,
+          duplex: "half",
+        }) as AnyRequest;
+        data = applyUploadProgress(_request, data, headers, requestContentLength, onUploadProgress, _trackStream);
+      }
+    }
+    else if (
+      mustEnforceStreamBody &&
+      !isRequestSupported &&
+      isReadableStreamSupported &&
+      method !== "get" &&
+      method !== "head"
+    ) {
+      data = _trackStream(data);
+    }
+    else if (
+      mustEnforceStreamBody &&
+      isRequestSupported &&
+      !supportsRequestStream &&
+      method !== "get" &&
+      method !== "head"
+    ) {
+      throw new FaxiosError(
+        "Stream request bodies are not supported by the current fetch implementation",
+        FaxiosError.ERR_NOT_SUPPORT,
+        config,
+        request
+      );
+    }
+
+    return { data, requestContentLength };
+  };
+
+  // Wrap the response body stream with download progress tracking and maxContentLength enforcement.
+  const buildDownloadStream = (
+    response: AnyResponse,
+    responseHeaders: FaxiosHeaders,
+    onDownloadProgress: unknown,
+    hasMaxContentLength: boolean,
+    maxContentLength: number,
+    isStreamResponse: boolean,
+    unsubscribe: (() => void) | false | undefined,
+    config: InternalFaxiosRequestConfig,
+    request: unknown
+  ): AnyResponse => {
+    const needsWrapping = onDownloadProgress || hasMaxContentLength || (isStreamResponse && unsubscribe);
+    if (!supportsResponseStream || !response.body || !needsWrapping) {
+      return response;
+    }
+
+    const options: Record<string, unknown> = {};
+    [ "status", "statusText", "headers" ].forEach(prop => {
+      options[prop] = response[prop];
+    });
+
+    const responseContentLength = utils.toFiniteNumber(
+      (responseHeaders.getContentLength as () => unknown)()
+    );
+
+    const [ onProgress, flush ] = onDownloadProgress
+      ? progressEventDecorator(
+        responseContentLength,
+        progressEventReducer(
+          asyncDecorator(
+            onDownloadProgress as (...args: Array<unknown>) => unknown
+          ),
+          true
+        )
+      )
+      : [];
+
+    let bytesRead = 0;
+    const onChunkProgress = (loadedBytes: number): void => {
+      if (hasMaxContentLength) {
+        bytesRead = loadedBytes;
+        if (bytesRead > maxContentLength) {
+          throw new FaxiosError(
+            "maxContentLength size of " + maxContentLength + " exceeded",
+            FaxiosError.ERR_BAD_RESPONSE,
+            config,
+            request
+          );
+        }
+      }
+      onProgress && onProgress(loadedBytes);
+    };
+
+    return new (Response as AnyConstructor)(
+      trackStream(
+        response.body,
+        DEFAULT_CHUNK_SIZE,
+        onChunkProgress,
+        () => {
+          flush && flush();
+          unsubscribe && unsubscribe();
+        }
+      ),
+      options
+    ) as AnyResponse;
+  };
+
+  const unsubscribeOnComplete = (isStreamResponse: boolean, unsubscribe: (() => void) | undefined) => {
+    if (!isStreamResponse) unsubscribe?.();
+  };
+
+  return async (config: InternalFaxiosRequestConfig) => {
+    const _resolved = prepareRequest(config) as InternalFaxiosRequestConfig & {
+      fetchOptions?: Record<string, unknown>;
+      withCredentials?: boolean | string;
+    };
+    let {
+      url,
+      method,
+      data,
+      signal,
+      timeout,
+      timeoutErrorMessage,
+      onDownloadProgress,
+      onUploadProgress,
+      responseType,
+      fetchOptions,
+      maxContentLength,
+      maxBodyLength,
+    } = _resolved;
+    let headers = _resolved.headers;
+    let withCredentials: boolean | string =
+      _resolved.withCredentials ?? "same-origin";
+
+    const hasMaxContentLength =
+      utils.isNumber(maxContentLength) && maxContentLength! > -1;
+    const hasMaxBodyLength =
+      utils.isNumber(maxBodyLength) && maxBodyLength! > -1;
+    const own = (key: string): unknown =>
+      utils.hasOwnProp(config, key)
+        ? (config as unknown as Record<string, unknown>)[key]
+        : undefined;
+
+    const _fetch: FetchFn = (envFetch || (globalThis as unknown as Record<string, unknown>)["fetch"]) as FetchFn;
+
+    if (timeout != null && !Number.isFinite(Number(timeout))) {
+      throw new FaxiosError(
+        "error trying to parse `config.timeout` to int",
+        FaxiosError.ERR_BAD_OPTION_VALUE,
+        config
+      );
+    }
+
+    responseType = (
+      responseType ? (responseType + "").toLowerCase() : "text"
+    ) as typeof responseType;
+
+    const composedSignal = composeSignals(
+      [ signal ],
+      timeout,
+      timeoutErrorMessage
+    ) as ComposedSignal | undefined;
+
+    const unsubscribe = composedSignal?.unsubscribe?.bind(composedSignal);
+
+    let request: null | Request = null;
+    const pendingBodyErrorRef: PendingBodyErrorRef = { value: null };
+
+    try {
+      rejectUsedStreamBody(data, config);
+
+      url = applyAuthToRequest(url!, headers, own);
+
+      const preflightContentLength = await checkPreflightLimits(
+        url,
+        data,
+        method!,
+        hasMaxContentLength,
+        maxContentLength!,
+        hasMaxBodyLength,
+        maxBodyLength!,
+        config,
+        request
+      );
+
+      // A streamed body under maxBodyLength must be counted as fetch consumes
+      // it; its size is never trusted from a caller-declared Content-Length.
+      const isStreamLike = utils.isReadableStream!(data) || utils.isStream(data);
+      const mustEnforceStreamBody = hasMaxBodyLength && isStreamLike;
+
+      ({ data } = await buildUploadStream(
+        data,
+        url,
+        method!,
+        headers,
+        onUploadProgress,
+        mustEnforceStreamBody,
+        preflightContentLength,
+        hasMaxBodyLength,
+        maxBodyLength!,
+        config,
+        request,
+        pendingBodyErrorRef
+      ));
+
+      withCredentials = normalizeCredentials(withCredentials);
+
+      // Cloudflare Workers throws when credentials are defined
+      // see https://github.com/cloudflare/workerd/issues/902
+      const isCredentialsSupported =
+        isRequestSupported &&
+        Request != null &&
+        "credentials" in (Request.prototype as object);
+
+      cleanFormDataContentType(data, headers);
+
+      applyDefaultUserAgent(headers);
+
+      const serializedHeaders = toByteStringHeaderObject(headers.normalize(false));
+
+      // Browsers auto-add "text/plain;charset=UTF-8" for string bodies when no Content-Type is set.
+      // Encoding as Uint8Array prevents the browser from injecting a content-type.
+      // Case-insensitive check: toByteStringHeaderObject may normalize to lowercase.
+      data = toWebStream(await encodeBodyIfNeeded(data, serializedHeaders, encodeText));
+
+      const resolvedOptions = initFromFetchOptions(fetchOptions);
+      resolvedOptions["signal"] = composedSignal;
+      resolvedOptions["method"] = (method as string).toUpperCase();
+      resolvedOptions["headers"] = serializedHeaders;
+      resolvedOptions["body"] = data;
+      resolvedOptions["duplex"] = "half";
+      resolvedOptions["credentials"] = isCredentialsSupported ? withCredentials : undefined;
+
+      request = isRequestSupported
+        ? new (Request as AnyConstructor)(url, resolvedOptions) as Request
+        : null;
+
+      // Pass resolvedOptions as the fetch init even when a Request object is supplied, so the
+      // same null-prototype members apply to both calls.
+      let response = await (isRequestSupported
+        ? _fetch(request, resolvedOptions)
+        : _fetch(url, resolvedOptions));
+
+      const responseHeaders = FaxiosHeaders.from(response.headers);
+
+      checkDeclaredContentLength(responseHeaders, hasMaxContentLength, maxContentLength!, config, request);
+
+      const isStreamResponse =
+        supportsResponseStream &&
+        (responseType === "stream" || responseType === "response");
+
+      response = buildDownloadStream(
+        response,
+        responseHeaders,
+        onDownloadProgress,
+        hasMaxContentLength,
+        maxContentLength!,
+        isStreamResponse,
+        unsubscribe,
+        config,
+        request
+      );
+
+      responseType = responseType || "text";
+
+      const resolverKey = utils.findKey(resolvers, responseType) || "text";
+      const resolver = resolvers[resolverKey];
+      const responseData = await (resolver && resolver(response, config));
+
+      checkMaterializedSize(
+        responseData,
+        hasMaxContentLength,
+        maxContentLength!,
+        isStreamResponse,
+        supportsResponseStream,
+        config,
+        request
+      );
+
+      unsubscribeOnComplete(isStreamResponse, unsubscribe);
+
+      return await new Promise((resolve, reject) => {
+        settle(resolve, reject, {
+          data: responseData,
+          headers: FaxiosHeaders.from(response.headers),
+          status: response.status,
+          statusText: response.statusText,
+          config,
+          request,
+        });
+      });
+    }
+    catch (err) {
+      unsubscribe && unsubscribe();
+      throw handleFetchCaughtError(err, composedSignal, pendingBodyErrorRef, config, request);
+    }
+  };
+};
+
+const seedCache = new Map<unknown, unknown>();
+
+export const getFetch = (config?: { env?: Record<string, unknown>; }) => {
+  // Own reads only: a polluted Object.prototype.fetch must never become the transport.
+  const env = config && utils.hasOwnProp(config, "env") ? config.env : undefined;
+  const own = (key: keyof FetchEnv): unknown => (env && utils.hasOwnProp(env, key) ? env[key] : undefined);
+  const fetch = own("fetch");
+  const Request = own("Request");
+  const Response = own("Response");
+  const seeds: Array<unknown> = [ Request, Response, fetch ];
+
+  const len = seeds.length;
+  let i = len;
+  let seed: unknown;
+  let target: unknown;
+  let map: Map<unknown, unknown> = seedCache;
+
+  while (i--) {
+    seed = seeds[i];
+    target = map.get(seed);
+
+    if (target === undefined) {
+      target = i ? new Map<unknown, unknown>() : factory({ fetch, Request, Response });
+      map.set(seed, target);
+    }
+
+    map = target as Map<unknown, unknown>;
+  }
+
+  return target;
+};
+
+getFetch();