@nifrajs/proxy 2.14.1 → 3.2.0

package/dist/index.js

@@ -10,10 +10,22 @@
  * by a `Connection` header, and `Proxy-*` headers are dropped from the forwarded request and from
  * the relayed response (the Connection-nominated leak is the @fastify/http-proxy CVE-2026-33805 /
  * Hono proxy CVE-2026-71849 class). Forwarding metadata (`Forwarded`, `X-Forwarded-*`) is stripped
- * unless `forwardClientIp: true`, in which case the caller chain is appended truthfully. Upstream
+ * unless explicitly configured. `forwardClientIp: true` emits caller IP/protocol, while
+ * `forwardedHost` emits only its fixed authority and never the inbound Host. An inbound IP chain is
+ * preserved only with the explicit `trustForwardedFor: true` declaration. Upstream
  * redirects are never followed (`redirect: "manual"`) - following one would let the upstream steer
  * the proxy anywhere. TLS verification is always on; there is no knob to disable it.
  */
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+const NODE_NATIVE_MOUNT = Symbol.for("@nifrajs/core/node-native-mount");
+const NODE_NATIVE_TRANSPORT = Symbol.for("@nifrajs/proxy/node-native-transport");
 /** RFC 9110 hop-by-hop headers: they describe one connection, never end-to-end semantics. */
 const HOP_BY_HOP = new Set([
     "connection",
@@ -26,7 +38,7 @@ const HOP_BY_HOP = new Set([
     "transfer-encoding",
     "upgrade",
 ]);
-/** Forwarding metadata is an explicit opt-in (`forwardClientIp`), never a passthrough. */
+/** Forwarding metadata is an explicit opt-in (`forwardClientIp` / `forwardedHost`), never passthrough. */
 const FORWARDING = new Set([
     "forwarded",
     "x-forwarded-for",
@@ -34,9 +46,14 @@ const FORWARDING = new Set([
     "x-forwarded-proto",
 ]);
 const EMPTY = new Set();
-/** Header names nominated hop-by-hop by a `Connection` header (lowercased). */
-function connectionNominated(headers) {
-    const raw = headers.get("connection");
+/**
+ * Header names nominated hop-by-hop by a `Connection` header value (lowercased).
+ *
+ * Takes the raw value, not a header container, so the Web lane (`Headers`) and the Node-native lane
+ * (a header record) resolve `connection` their own way and share this one parse - the hop-by-hop
+ * decision is security-critical and must not exist in two copies that can drift.
+ */
+function parseConnectionNominated(raw) {
     if (raw === null)
         return EMPTY;
     const out = new Set();
@@ -50,56 +67,407 @@ function connectionNominated(headers) {
 function dropHeader(name, nominated) {
     return HOP_BY_HOP.has(name) || nominated.has(name) || name.startsWith("proxy-");
 }
+/**
+ * A request header dropped before the hop: it names the proxy (`host`, which the transport derives
+ * from the target), is hop-by-hop / Connection-nominated / `proxy-*`, or is forwarding metadata that
+ * only explicit proxy options may reintroduce. The single predicate both lanes filter through.
+ */
+function isDroppedRequestHeader(name, nominated) {
+    return name === "host" || dropHeader(name, nominated) || FORWARDING.has(name);
+}
+/**
+ * A response header kept on relay. Drops hop-by-hop / Connection-nominated, and - only when the
+ * transport decoded the body, so the stored `Content-Encoding` and length describe bytes the client
+ * will never see - drops those two as well. The undici lanes pass bytes through untouched
+ * (`bodyEncoded` true) and keep them; the `fetch` lane decoded and drops them.
+ */
+function isKeptResponseHeader(name, nominated, bodyEncoded) {
+    if (dropHeader(name, nominated))
+        return false;
+    if (!bodyEncoded && (name === "content-encoding" || name === "content-length"))
+        return false;
+    return true;
+}
+/**
+ * The caller-IP `x-forwarded-*` overrides to SET when `forwardClientIp` is on. Shared so the trust
+ * decision - the one place that may preserve inbound `x-forwarded-for` - cannot diverge between lanes.
+ * Host is intentionally absent: only the fixed `forwardedHost` option may emit it.
+ */
+function forwardedClientHeaders(priorXff, requestUrl, clientIp, trustInbound) {
+    return [
+        ["x-forwarded-for", trustInbound && priorXff !== null ? `${priorXff}, ${clientIp}` : clientIp],
+        ["x-forwarded-proto", new URL(requestUrl).protocol.slice(0, -1)],
+    ];
+}
 const flatError = (status, error) => new Response(JSON.stringify({ ok: false, error }), {
     status,
     headers: { "content-type": "application/json" },
 });
 function upstreamRequestHeaders(req, clientIp, options) {
-    const nominated = connectionNominated(req.headers);
+    const nominated = parseConnectionNominated(req.headers.get("connection"));
     const out = new Headers();
     for (const [name, value] of req.headers) {
-        // `host` names the proxy, not the upstream - fetch derives the right one from the target URL.
-        if (name === "host" || dropHeader(name, nominated))
-            continue;
-        if (FORWARDING.has(name))
+        if (isDroppedRequestHeader(name, nominated))
             continue;
         out.append(name, value);
     }
     if (options.forwardClientIp === true && clientIp !== undefined) {
-        const prior = req.headers.get("x-forwarded-for");
-        const chain = prior !== null ? `${prior}, ${clientIp}` : clientIp;
-        if (chain !== undefined)
-            out.set("x-forwarded-for", chain);
-        out.set("x-forwarded-proto", new URL(req.url).protocol.slice(0, -1));
-        const host = req.headers.get("host");
-        if (host !== null)
-            out.set("x-forwarded-host", host);
+        for (const [name, value] of forwardedClientHeaders(req.headers.get("x-forwarded-for"), req.url, clientIp, options.trustForwardedFor === true)) {
+            out.set(name, value);
+        }
     }
+    if (options.forwardedHost !== undefined)
+        out.set("x-forwarded-host", options.forwardedHost);
     if (options.headers !== undefined) {
         for (const [name, value] of Object.entries(options.headers))
             out.set(name, value);
     }
     return out;
 }
-function relayedResponseHeaders(upstream) {
-    const nominated = connectionNominated(upstream.headers);
+function relayedResponseHeaders(upstreamHeaders, bodyEncoded) {
+    const nominated = parseConnectionNominated(upstreamHeaders.get("connection"));
     const out = new Headers();
-    for (const [name, value] of upstream.headers) {
-        if (dropHeader(name, nominated))
-            continue;
-        // fetch() already decoded the body per Content-Encoding, so the stored encoding and length no
-        // longer describe the bytes being relayed. (Re-compression is the compression() middleware's job.)
-        if (name === "content-encoding" || name === "content-length")
-            continue;
-        // Re-added below via getSetCookie() so multiple cookies survive on every runtime.
+    for (const [name, value] of upstreamHeaders) {
+        // Re-added below via getSetCookie() so multiple cookies survive on every runtime - a `Headers`
+        // iteration would hand back one comma-joined value that no longer parses as separate cookies.
         if (name === "set-cookie")
             continue;
+        if (!isKeptResponseHeader(name, nominated, bodyEncoded))
+            continue;
         out.append(name, value);
     }
-    for (const cookie of upstream.headers.getSetCookie())
+    for (const cookie of upstreamHeaders.getSetCookie())
         out.append("set-cookie", cookie);
     return out;
 }
+/**
+ * Bound the gap *between* response body chunks. `timeoutMs` only covers up to the response headers -
+ * the sole window a 504 is still sendable - and `fetch` has no body-side deadline of its own, so an
+ * upstream that answers and then stops sending would otherwise pin the caller's connection and this
+ * proxy's socket open indefinitely. The timer is armed per read and cleared the moment bytes land,
+ * so a healthy stream pays one setTimeout/clearTimeout pair per chunk and nothing else. On expiry
+ * the upstream read is cancelled and the relayed stream errors, which is the only signal left once
+ * the status line has already been sent.
+ */
+function idleBoundedBody(body, ms) {
+    const reader = body.getReader();
+    let timer;
+    const disarm = () => {
+        if (timer !== undefined) {
+            clearTimeout(timer);
+            timer = undefined;
+        }
+    };
+    return new ReadableStream({
+        async pull(controller) {
+            // Rejects only while the read below is still outstanding: `disarm()` runs before this pull
+            // settles either way, so the timer can never fire against an already-answered read and leave
+            // an unobserved rejection behind.
+            const stalled = new Promise((_, reject) => {
+                timer = setTimeout(() => {
+                    reject(new Error(`[nifra/proxy] upstream response body stalled for ${ms}ms`));
+                }, ms);
+            });
+            try {
+                const result = await Promise.race([reader.read(), stalled]);
+                if (result.done) {
+                    controller.close();
+                    return;
+                }
+                controller.enqueue(result.value);
+            }
+            catch (error) {
+                // Tear the upstream down as well - erroring only the relayed stream would leave the
+                // upstream socket reading into nothing.
+                void reader.cancel(error).catch(() => { });
+                throw error;
+            }
+            finally {
+                disarm();
+            }
+        },
+        cancel(reason) {
+            disarm();
+            return reader.cancel(reason);
+        },
+    });
+}
+/**
+ * The Node-stream claim seam, by value rather than by import: `node-stream.ts` pulls `node:stream`,
+ * and this file has to stay loadable on every runtime. Only the key and the shape below are the
+ * contract - see that module for what claiming means and why it is one-shot.
+ */
+const NODE_STREAM_CLAIM = Symbol.for("nifra.node.stream-claim");
+/**
+ * Run `onSettled` once the relayed body is finished with - closed, errored, or cancelled.
+ *
+ * A body that arrives claimable (the undici transport hands the upstream's Node stream through a Web
+ * view that `@nifrajs/node` can trade back in) keeps its claim: the wrapper forwards it, and when the
+ * claim is taken the callback moves to the Node stream's `close` instead. Replacing the stream
+ * outright would strip the claim and put every proxied byte back through a Web round trip.
+ *
+ * `highWaterMark: 0` for the same reason it is zero in `claimableWebStream`: a default strategy pulls
+ * speculatively at construction, which would read the source before anyone asked and make the claim
+ * unavailable in every case.
+ */
+function settleTracked(body, onSettled) {
+    let settled = false;
+    const settle = () => {
+        if (settled)
+            return;
+        settled = true;
+        onSettled();
+    };
+    const reader = body.getReader();
+    const tracked = new ReadableStream({
+        async pull(controller) {
+            try {
+                const result = await reader.read();
+                if (result.done) {
+                    controller.close();
+                    settle();
+                    return;
+                }
+                controller.enqueue(result.value);
+            }
+            catch (error) {
+                settle();
+                throw error;
+            }
+        },
+        cancel(reason) {
+            settle();
+            return reader.cancel(reason);
+        },
+    }, { highWaterMark: 0 });
+    const holder = body[NODE_STREAM_CLAIM];
+    if (holder !== undefined && typeof holder.claim === "function") {
+        const forwarded = {
+            claim() {
+                const claimed = holder.claim();
+                if (claimed === null)
+                    return null;
+                // The wrapper is bypassed from here on, so the Node stream's own end is the settle point.
+                claimed.once("close", settle);
+                return claimed;
+            },
+        };
+        Object.defineProperty(tracked, NODE_STREAM_CLAIM, { value: forwarded, enumerable: false });
+    }
+    return tracked;
+}
+/**
+ * Create the portable `fetch`-backed {@link ProxyTransport} - the default off Node, and the fallback
+ * everywhere the undici transport cannot be used. `redirect: "manual"` is not a preference: following
+ * an upstream redirect would let the upstream choose the proxy's next destination, so it is pinned
+ * here and a 3xx is relayed to the caller untouched.
+ *
+ * Pass it explicitly only to tune {@link FetchTransportOptions.bodyTimeoutMs} or to pin the choice
+ * on Node; leaving `transport` unset picks the right one per runtime.
+ */
+export function fetchTransport(options = {}) {
+    const bodyTimeout = options.bodyTimeoutMs ?? 30_000;
+    if (!Number.isFinite(bodyTimeout) || bodyTimeout < 0) {
+        throw new Error("[nifra/proxy] bodyTimeoutMs must be a non-negative number");
+    }
+    return async (target, request) => {
+        const init = {
+            method: request.method,
+            headers: request.headers,
+            redirect: "manual",
+            signal: request.signal,
+        };
+        if (request.body !== null) {
+            init.body = request.body;
+            init.duplex = "half";
+        }
+        const response = await fetch(target, init);
+        const body = response.body;
+        return {
+            status: response.status,
+            statusText: response.statusText,
+            headers: response.headers,
+            body: body === null || bodyTimeout === 0 ? body : idleBoundedBody(body, bodyTimeout),
+            // fetch decoded any Content-Encoding, so the relayed body is identity.
+            bodyEncoded: false,
+        };
+    };
+}
+/** The portable transport with its defaults - built once, not per request. */
+const defaultFetchTransport = fetchTransport();
+/**
+ * Pick the transport when the caller named none. On Node, `undici`'s dispatcher is ~2.5x `fetch` on
+ * GET and ~2.2x on POST for this workload, so it is the default there when installed - resolved
+ * lazily through a dynamic `import` so the base package keeps no static dependency on `undici` and
+ * stays loadable on runtimes that do not ship it. Everywhere else `fetch` is both the portable
+ * choice and the fast one: under Bun the `undici` specifier is a shim `undiciTransport` refuses, and
+ * Bun/Deno/edge `fetch` already measures level with a raw client. A Node install without the
+ * optional `undici` peer falls back to `fetch` rather than failing.
+ */
+async function selectDefaultTransport() {
+    const runtime = globalThis;
+    const onNode = runtime.Bun === undefined &&
+        runtime.Deno === undefined &&
+        typeof process !== "undefined" &&
+        process.versions?.node !== undefined;
+    if (!onNode)
+        return defaultFetchTransport;
+    try {
+        // The specifier is a variable, not a literal, on purpose: a bundler targeting an edge runtime
+        // must NOT follow this into `undici` (which pulls `node:*` builtins), and this branch only ever
+        // executes on Node. `import()` of a non-literal is left as a genuine runtime import, so `undici`
+        // enters the graph only for a Node consumer that actually reaches here. The `.js` names the
+        // emitted file directly (tsc does not resolve a variable specifier); the cast restores its type.
+        const undiciModule = "./undici.js";
+        const mod = (await import(__rewriteRelativeImportExtension(undiciModule)));
+        return mod.undiciTransport();
+    }
+    catch {
+        // `undici` is an optional peer - absent, we simply keep the portable transport.
+        return defaultFetchTransport;
+    }
+}
+function nativeTransportOf(value) {
+    if (typeof value !== "function")
+        return undefined;
+    const candidate = value[NODE_NATIVE_TRANSPORT];
+    return typeof candidate === "function" ? candidate : undefined;
+}
+/** Load the optional client directly for a bundled Node consumer. A variable specifier keeps
+ * `undici` out of edge bundles; unlike a relative dynamic import, Node-targeted single-file bundlers
+ * leave this as the real package lookup rather than emitting a sibling `undici.js` that does not
+ * exist next to the one-file application bundle. */
+async function defaultNativeTransport() {
+    try {
+        const packageName = "undici";
+        const mod = (await import(__rewriteRelativeImportExtension(packageName)));
+        if (typeof mod.request !== "function")
+            return undefined;
+        const request = mod.request;
+        return async (target, input) => {
+            const upstream = await request(target, {
+                method: input.method,
+                headers: Array.from(input.headers),
+                body: input.body,
+                signal: input.signal,
+                headersTimeout: input.headersTimeout,
+                bodyTimeout: 30_000,
+            });
+            return {
+                status: upstream.statusCode,
+                headers: upstream.headers,
+                body: upstream.body,
+                dump: () => upstream.body.dump(),
+            };
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+function nativeHeaderValue(headers, name) {
+    const value = headers[name];
+    if (value === undefined)
+        return null;
+    return typeof value === "string" ? value : Array.from(value).join(", ");
+}
+function nativeHeaderValues(value) {
+    if (value === undefined)
+        return [];
+    return typeof value === "string" ? [value] : value;
+}
+function nativeRequestHeaders(request, clientIp, options) {
+    const nominated = parseConnectionNominated(nativeHeaderValue(request.headers, "connection"));
+    const entries = [];
+    for (const [name, raw] of Object.entries(request.headers)) {
+        if (raw === undefined)
+            continue;
+        if (isDroppedRequestHeader(name, nominated))
+            continue;
+        for (const value of nativeHeaderValues(raw))
+            entries.push(name, value);
+    }
+    const replace = (name, value) => {
+        for (let i = entries.length - 2; i >= 0; i -= 2) {
+            if (entries[i] === name)
+                entries.splice(i, 2);
+        }
+        entries.push(name, value);
+    };
+    if (options.forwardClientIp === true && clientIp !== undefined) {
+        for (const [name, value] of forwardedClientHeaders(nativeHeaderValue(request.headers, "x-forwarded-for"), request.url, clientIp, options.trustForwardedFor === true)) {
+            replace(name, value);
+        }
+    }
+    if (options.forwardedHost !== undefined)
+        replace("x-forwarded-host", options.forwardedHost);
+    if (options.headers !== undefined) {
+        for (const [name, value] of Object.entries(options.headers))
+            replace(name.toLowerCase(), value);
+    }
+    return entries;
+}
+function nativeResponseHeaders(headers) {
+    const nominated = parseConnectionNominated(nativeHeaderValue(headers, "connection"));
+    const out = [];
+    for (const [name, value] of Object.entries(headers)) {
+        // The native lane is always the undici passthrough transport, which does not decode the body,
+        // so the stored content-encoding/length still describe the relayed bytes: `bodyEncoded` true.
+        if (value === undefined || !isKeptResponseHeader(name, nominated, true))
+            continue;
+        out.push([name, value]);
+    }
+    return out;
+}
+function nativeResponseOpen(response) {
+    return (response.destroyed !== true && response.writableEnded !== true && response.writable !== false);
+}
+function nativeFlatError(response, statusCode, error) {
+    if (!nativeResponseOpen(response))
+        return;
+    const body = JSON.stringify({ ok: false, error });
+    response.setHeader("content-type", "application/json");
+    response.setHeader("content-length", String(new TextEncoder().encode(body).byteLength));
+    response.writeHead(statusCode);
+    response.end(body);
+}
+function pipeNativeBody(body, response, cleanup) {
+    return new Promise((resolve) => {
+        let settled = false;
+        const done = () => {
+            if (settled)
+                return;
+            settled = true;
+            response.removeListener("close", onClose);
+            response.removeListener("finish", onFinish);
+            body.removeListener("error", onError);
+            cleanup();
+            if (body.destroyed !== true)
+                body.destroy();
+            resolve();
+        };
+        const onClose = () => done();
+        const onFinish = () => done();
+        const onError = () => {
+            if (!settled && nativeResponseOpen(response))
+                response.destroy();
+            done();
+        };
+        body.on("error", onError);
+        response.once("close", onClose);
+        response.once("finish", onFinish);
+        if (!nativeResponseOpen(response)) {
+            done();
+            return;
+        }
+        try {
+            body.pipe(response);
+        }
+        catch {
+            onError();
+        }
+    });
+}
 /**
  * Create a proxy handler bound to one upstream origin.
  *
@@ -129,6 +497,28 @@ export function createProxy(options) {
     if (stripPrefix !== undefined && (!stripPrefix.startsWith("/") || stripPrefix.endsWith("/"))) {
         throw new Error('[nifra/proxy] stripPrefix must start with "/" and not end with one');
     }
+    if (options.trustForwardedFor === true && options.forwardClientIp !== true) {
+        throw new Error("[nifra/proxy] trustForwardedFor requires forwardClientIp: true");
+    }
+    if (options.forwardedHost !== undefined) {
+        let parsed;
+        try {
+            parsed = new URL(`http://${options.forwardedHost}`);
+        }
+        catch {
+            throw new TypeError("[nifra/proxy] forwardedHost must be a bare host authority");
+        }
+        if (options.forwardedHost === "" ||
+            parsed.host === "" ||
+            parsed.username !== "" ||
+            parsed.password !== "" ||
+            parsed.pathname !== "/" ||
+            parsed.search !== "" ||
+            parsed.hash !== "" ||
+            /[\r\n\s]/.test(options.forwardedHost)) {
+            throw new TypeError("[nifra/proxy] forwardedHost must be a bare host authority");
+        }
+    }
     const timeoutMs = options.timeoutMs ?? 30_000;
     if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
         throw new Error("[nifra/proxy] timeoutMs must be a positive number");
@@ -142,7 +532,40 @@ export function createProxy(options) {
             throw new TypeError(`[nifra/proxy] static header is not allowed: ${name}`);
         }
     }
-    return async (input) => {
+    // An explicit transport is used as given. Otherwise the default is resolved lazily on the first
+    // request and memoised: the dynamic `import` of the undici transport cannot run in this synchronous
+    // constructor, and doing it per request would re-pay the resolution every time.
+    const explicitTransport = options.transport;
+    let resolvedTransport = explicitTransport;
+    let resolving;
+    const getTransport = () => {
+        if (resolvedTransport !== undefined)
+            return resolvedTransport;
+        resolving ??= selectDefaultTransport().then((t) => {
+            resolvedTransport = t;
+            return t;
+        });
+        return resolving;
+    };
+    // The native lane is available only for the built-in undici transport. A custom transport keeps
+    // the documented Web contract and therefore falls back to the existing path rather than silently
+    // bypassing its implementation. The default is resolved lazily for the same optional-peer and
+    // edge-bundle reasons as `selectDefaultTransport` above.
+    const explicitNativeTransport = nativeTransportOf(explicitTransport);
+    let nativeTransport = explicitNativeTransport;
+    let nativeResolving;
+    const getNativeTransport = () => {
+        if (nativeTransport !== undefined)
+            return nativeTransport;
+        if (explicitTransport !== undefined)
+            return undefined;
+        nativeResolving ??= defaultNativeTransport().then((candidate) => {
+            nativeTransport = candidate;
+            return candidate;
+        });
+        return nativeResolving;
+    };
+    const proxy = async (input) => {
         const req = input instanceof Request ? input : input.req;
         const clientIp = input instanceof Request ? undefined : input.clientIp;
         const callerSignal = input instanceof Request ? input.signal : (input.signal ?? input.req.signal);
@@ -157,35 +580,166 @@ export function createProxy(options) {
         const target = new URL(base);
         target.pathname = path;
         target.search = incoming.search;
-        const timeout = AbortSignal.timeout(timeoutMs);
-        const signal = callerSignal !== undefined ? AbortSignal.any([timeout, callerSignal]) : timeout;
-        const body = req.method === "GET" || req.method === "HEAD" ? undefined : req.body;
-        const init = {
-            method: req.method,
-            headers: upstreamRequestHeaders(req, clientIp, options),
-            redirect: "manual",
-            signal,
-        };
-        if (body !== null && body !== undefined) {
-            init.body = body;
-            init.duplex = "half";
+        // One AbortController instead of `AbortSignal.timeout` + `AbortSignal.any`: that pair costs
+        // ~12x more per request on Node, and its timer is only reclaimed once GC gets to the signal.
+        // Here the timer is cancelled the moment the upstream answers, so a burst of in-flight requests
+        // cannot leave a deadline-long backlog of live timers in the wheel. The caller listener
+        // deliberately outlives the timer - a client that disconnects mid-body must still tear the
+        // upstream stream down - so it is dropped when the exchange ends instead.
+        const controller = new AbortController();
+        let timedOut = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            controller.abort();
+        }, timeoutMs);
+        const abortUpstream = () => controller.abort();
+        // Removing the listener only matters for a signal that outlives this request: `req.signal`
+        // belongs to the request and is collected with it, while a caller-supplied `signal` may be
+        // shared by every request a process proxies, where one retained listener per exchange
+        // accumulates without bound. Only that case pays for the bookkeeping below.
+        const sharedSignal = callerSignal !== req.signal;
+        let releaseCaller = () => { };
+        if (callerSignal.aborted) {
+            clearTimeout(timer);
+            controller.abort();
+        }
+        else {
+            callerSignal.addEventListener("abort", abortUpstream, { once: true });
+            if (sharedSignal) {
+                releaseCaller = () => {
+                    callerSignal.removeEventListener("abort", abortUpstream);
+                };
+            }
         }
+        const transport = resolvedTransport ?? (await getTransport());
         let upstream;
         try {
-            upstream = await fetch(target, init);
+            upstream = await transport(target, {
+                method: req.method,
+                headers: upstreamRequestHeaders(req, clientIp, options),
+                body: req.method === "GET" || req.method === "HEAD" ? null : req.body,
+                signal: controller.signal,
+            });
         }
         catch (error) {
-            if (timeout.aborted)
+            clearTimeout(timer);
+            releaseCaller();
+            if (timedOut)
                 return flatError(504, "gateway_timeout");
-            if (callerSignal?.aborted === true)
+            if (callerSignal.aborted)
                 throw error;
             return flatError(502, "bad_gateway");
         }
-        return new Response(upstream.body, {
+        clearTimeout(timer);
+        const relayed = upstream.body;
+        if (relayed === null)
+            releaseCaller();
+        return new Response(relayed !== null && sharedSignal ? settleTracked(relayed, releaseCaller) : relayed, {
             status: upstream.status,
             statusText: upstream.statusText,
-            headers: relayedResponseHeaders(upstream),
+            headers: relayedResponseHeaders(upstream.headers, upstream.bodyEncoded === true),
         });
     };
+    const nativeMount = async (input, response, platform) => {
+        const transport = await getNativeTransport();
+        if (transport === undefined)
+            return false;
+        const raw = input.raw;
+        const controller = new AbortController();
+        let timedOut = false;
+        let cleaned = false;
+        const onAbort = () => controller.abort();
+        const cleanup = () => {
+            if (cleaned)
+                return;
+            cleaned = true;
+            raw.removeListener("aborted", onAbort);
+            response.removeListener("close", onAbort);
+        };
+        raw.once("aborted", onAbort);
+        response.once("close", onAbort);
+        if (raw.destroyed === true || raw.aborted === true || response.destroyed === true) {
+            cleanup();
+            return;
+        }
+        const timer = setTimeout(() => {
+            timedOut = true;
+            controller.abort();
+        }, timeoutMs);
+        const incoming = new URL(input.url);
+        let path = incoming.pathname;
+        if (stripPrefix !== undefined && (path === stripPrefix || path.startsWith(`${stripPrefix}/`))) {
+            const rest = path.slice(stripPrefix.length);
+            path = rest === "" || !rest.startsWith("/") ? `/${rest}` : rest;
+        }
+        // As in the Web path, mutate only a clone of the fixed origin. The Node adapter's URL is used
+        // for path/query and never as a URL base, so a request path cannot redirect the dialed host.
+        const target = new URL(base);
+        target.pathname = path;
+        target.search = incoming.search;
+        try {
+            const upstream = await transport(target, {
+                method: input.method,
+                headers: nativeRequestHeaders(input, platform?.clientIp, options),
+                body: input.method === "GET" || input.method === "HEAD" ? null : input.raw,
+                signal: controller.signal,
+                headersTimeout: timeoutMs,
+            });
+            clearTimeout(timer);
+            if (controller.signal.aborted) {
+                cleanup();
+                return;
+            }
+            for (const [name, value] of nativeResponseHeaders(upstream.headers)) {
+                response.setHeader(name, value);
+            }
+            const noBody = input.method === "HEAD" ||
+                upstream.status === 101 ||
+                upstream.status === 204 ||
+                upstream.status === 205 ||
+                upstream.status === 304;
+            if (noBody) {
+                await upstream.dump();
+                if (!nativeResponseOpen(response)) {
+                    cleanup();
+                    return;
+                }
+                response.writeHead(upstream.status);
+                response.end();
+                cleanup();
+                return;
+            }
+            if (!nativeResponseOpen(response)) {
+                cleanup();
+                return;
+            }
+            response.writeHead(upstream.status);
+            await pipeNativeBody(upstream.body, response, cleanup);
+            return;
+        }
+        catch {
+            clearTimeout(timer);
+            cleanup();
+            if (controller.signal.aborted && !timedOut)
+                return;
+            if (timedOut)
+                nativeFlatError(response, 504, "gateway_timeout");
+            else
+                nativeFlatError(response, 502, "bad_gateway");
+            return;
+        }
+    };
+    const runtime = globalThis;
+    const nodeRuntime = runtime.Bun === undefined &&
+        runtime.Deno === undefined &&
+        typeof process !== "undefined" &&
+        process.versions?.node !== undefined;
+    // A caller-supplied transport without the native marker must not pay a promise-based probe on
+    // every Node request. The default is advertised on Node and can still fall back once if the
+    // optional peer is absent; all other runtimes keep the exact portable mount shape.
+    if (explicitNativeTransport !== undefined || (explicitTransport === undefined && nodeRuntime)) {
+        Object.defineProperty(proxy, NODE_NATIVE_MOUNT, { value: nativeMount });
+    }
+    return proxy;
 }
 //# sourceMappingURL=index.js.map