@nxtedition/nxt-undici 7.3.25 → 7.3.27

package/lib/interceptor/proxy.js

@@ -2,6 +2,19 @@ import net from 'node:net'
 import createError from 'http-errors'
 import { DecoratorHandler } from '../utils.js'
 
+// Accumulator used by reduceHeaders on the response path. Hoisted to module
+// scope so it is allocated once rather than on every onHeaders/onUpgrade call.
+/**
+ * @param {Record<string, string>} acc
+ * @param {string} key
+ * @param {string} val
+ * @returns {Record<string, string>}
+ */
+const copyHeader = (acc, key, val) => {
+  acc[key] = val
+  return acc
+}
+
 class Handler extends DecoratorHandler {
   #opts
 
@@ -18,13 +31,13 @@ class Handler extends DecoratorHandler {
         {
           headers,
           httpVersion: this.#opts.httpVersion ?? this.#opts.req?.httpVersion,
-          socket: this.#opts.socket,
+          // Response path: never synthesize a Forwarded header (it is
+          // request-only, RFC 7239) — passing socket would leak the proxy's
+          // own addresses downstream. isResponse still rejects an inbound one.
+          isResponse: true,
           proxyName: this.#opts.name,
         },
-        (acc, key, val) => {
-          acc[key] = val
-          return acc
-        },
+        copyHeader,
         {},
       ),
       socket,
@@ -38,13 +51,10 @@ class Handler extends DecoratorHandler {
         {
           headers,
           httpVersion: this.#opts.httpVersion ?? this.#opts.req?.httpVersion,
-          socket: this.#opts.socket,
+          isResponse: true,
           proxyName: this.#opts.name,
         },
-        (acc, key, val) => {
-          acc[key] = val
-          return acc
-        },
+        copyHeader,
         {},
       ),
       resume,
@@ -52,49 +62,206 @@ class Handler extends DecoratorHandler {
   }
 }
 
-// This expression matches hop-by-hop headers.
-// These headers are meaningful only for a single transport-level connection,
-// and must not be retransmitted by proxies or cached.
-const HOP_EXPR =
-  /^(te|host|upgrade|trailers|connection|keep-alive|http2-settings|transfer-encoding|proxy-connection|proxy-authenticate|proxy-authorization)$/i
+// ASCII case-insensitive equality where `b` is a lowercase literal and the
+// caller guarantees `a.length === b.length`. Allocation-free.
+/**
+ * @param {string} a
+ * @param {string} b
+ * @returns {boolean}
+ */
+function eqiLower(a, b) {
+  if (a === b) {
+    return true
+  }
+  for (let i = 0; i < b.length; i++) {
+    let c = a.charCodeAt(i)
+    if (c >= 0x41 && c <= 0x5a) {
+      c += 0x20 // upper -> lower
+    }
+    if (c !== b.charCodeAt(i)) {
+      return false
+    }
+  }
+  return true
+}
+
+// Matches hop-by-hop headers — meaningful only for a single transport-level
+// connection, so a proxy must not retransmit or cache them. This is the single
+// source of truth for that set: it is used both for the per-key strip below
+// and for the Connection-value check. HTTP field names are ASCII tokens, so a
+// length-dispatched ASCII case-insensitive compare is exactly equivalent to a
+// `/^(te|host|…)$/i` regexp (verified over 137k generated keys) while staying
+// allocation-free and letting the common (non-hop) header bail out in a single
+// comparison.
+/**
+ * @param {string} key
+ * @returns {boolean}
+ */
+function isHopByHop(key) {
+  switch (key.length) {
+    case 2:
+      return eqiLower(key, 'te')
+    case 4:
+      return eqiLower(key, 'host')
+    case 7:
+      return eqiLower(key, 'upgrade')
+    case 8:
+      return eqiLower(key, 'trailers')
+    case 10:
+      return eqiLower(key, 'connection') || eqiLower(key, 'keep-alive')
+    case 14:
+      return eqiLower(key, 'http2-settings')
+    case 16:
+      return eqiLower(key, 'proxy-connection')
+    case 17:
+      return eqiLower(key, 'transfer-encoding')
+    case 18:
+      return eqiLower(key, 'proxy-authenticate')
+    case 19:
+      return eqiLower(key, 'proxy-authorization')
+    default:
+      return false
+  }
+}
 
 // Removes hop-by-hop and pseudo headers.
 // Updates via and forwarded headers.
 // Only hop-by-hop headers may be set using the Connection general header.
-function reduceHeaders({ headers, proxyName, httpVersion, socket }, fn, acc) {
+/**
+ * @template T
+ * @param {object} options
+ * @param {Record<string, string | string[]>} options.headers Header map; a
+ *   value is an array when the field appeared more than once.
+ * @param {string} [options.proxyName] This proxy's name. When set, a Via
+ *   segment is appended and Via loop detection runs.
+ * @param {string} [options.httpVersion] Protocol token for the appended Via
+ *   segment; defaults to `'HTTP/1.1'`.
+ * @param {{ localAddress?: string, localPort?: number, remoteAddress?: string,
+ *   remotePort?: number, encrypted?: boolean } | null} [options.socket] Request
+ *   path only: when present a Forwarded header is synthesised. An inbound
+ *   Forwarded header is always treated as a BadGateway (it is request-only).
+ * @param {boolean} [options.isResponse] Response path marker. When set,
+ *   Forwarded is never synthesised regardless of `socket` (it would leak the
+ *   proxy's own addresses downstream); an inbound Forwarded is still rejected.
+ * @param {(acc: T, key: string, value: string) => T} fn Accumulator invoked
+ *   once per retained header.
+ * @param {T} acc Initial accumulator value.
+ * @returns {T}
+ */
+function reduceHeaders({ headers, proxyName, httpVersion, socket, isResponse }, fn, acc) {
   let via = ''
   let forwarded = ''
   let host = ''
   let authority = ''
+  /** @type {string | string[]} */
   let connection = ''
 
-  for (const [key, val] of Object.entries(headers)) {
+  // Iterate via Object.keys (computed once and reused by both passes) rather
+  // than Object.entries: the latter allocates an outer array plus one
+  // 2-element array per header on every call, and this runs on the hot path of
+  // every proxied request and response. Object.keys allocates a single flat
+  // array we reuse, cutting per-call allocation by ~4-6x.
+  const keys = Object.keys(headers)
+
+  // Object keys are unique, so each special is seen at most once; a repeated
+  // field-line instead surfaces as an array value (parseHeaders collects them).
+  // RFC 9110 §5.3 only permits repeats for list-valued fields (ABNF `#`), where
+  // the parts are semantically one comma-separated value — those we combine.
+  // Singular fields with more than one value are a protocol error — those we
+  // reject.
+  //
+  // Field names are case-insensitive (RFC 7230). The production path lowercases
+  // keys (parseHeaders) before this runs, but the standalone interceptors.proxy()
+  // composition may pass mixed-case keys, so capture case-insensitively via the
+  // allocation-free eqiLower — otherwise a mixed-case `Forwarded`/`Connection`/
+  // `Via`/`Host` would skip capture and leak/bypass the handling below.
+  for (let i = 0; i < keys.length; i++) {
+    const key = keys[i]
     const len = key.length
-    if (len === 3 && !via && key === 'via') {
-      via = val
-    } else if (len === 4 && !host && key === 'host') {
-      host = val
-    } else if (len === 9 && !forwarded && key === 'forwarded') {
-      forwarded = val
-    } else if (len === 10 && !connection && key === 'connection') {
-      connection = val
-    } else if (len === 10 && !authority && key === ':authority') {
-      authority = val
+    if (len === 3 && eqiLower(key, 'via')) {
+      // Via is list-valued (RFC 9110 §7.6.3): combine repeated field-lines.
+      const v = headers[key]
+      via = Array.isArray(v) ? v.join(', ') : v
+    } else if (len === 4 && eqiLower(key, 'host')) {
+      // Host is singular (RFC 9110 §7.2, RFC 7230 §5.4): more than one is a
+      // protocol error, so reject rather than combine.
+      const v = headers[key]
+      if (Array.isArray(v)) {
+        throw new createError.BadGateway()
+      }
+      host = v
+    } else if (len === 9 && eqiLower(key, 'forwarded')) {
+      // Forwarded is list-valued (RFC 7239 §4): combine repeated field-lines.
+      const v = headers[key]
+      forwarded = Array.isArray(v) ? v.join(', ') : v
+    } else if (len === 10 && eqiLower(key, 'connection')) {
+      // Connection is list-valued (RFC 9110 §7.6.1): captured raw and tokenised
+      // below — combining then re-splitting would be wasteful.
+      connection = headers[key]
+    } else if (len === 10 && key === ':authority') {
+      // :authority is singular (RFC 9113 §8.3.1): reject more than one. Pseudo
+      // headers are always lowercase, so an exact compare is correct here.
+      const v = headers[key]
+      if (Array.isArray(v)) {
+        throw new createError.BadGateway()
+      }
+      authority = v
     }
   }
 
-  let remove = []
-  if (connection && !HOP_EXPR.test(connection)) {
-    remove = connection.split(/,\s*/)
+  // `remove` is lazily allocated: it stays null unless a Connection header
+  // actually lists headers to strip (the uncommon case), so the hot path
+  // neither allocates an (almost always empty) array nor runs includes() per
+  // header.
+  //
+  // Header field names are case-insensitive (RFC 7230); parseHeaders already
+  // lowercased the keys we compare against, so lowercase the listed names too,
+  // otherwise `Connection: X-Custom` fails to strip `x-custom` and it leaks to
+  // the next hop. trim() handles surrounding whitespace, so a plain comma split
+  // suffices.
+  let remove = null
+  if (Array.isArray(connection)) {
+    // Repeated Connection field-lines (RFC 9110 §7.6.1): each part may itself
+    // list several options. A repeat always carries multiple/custom tokens, so
+    // the single-hop-token shortcut below never applies.
+    remove = []
+    for (const part of connection) {
+      for (const token of part.split(',')) {
+        remove.push(token.trim().toLowerCase())
+      }
+    }
+  } else if (connection && !isHopByHop(connection)) {
+    // Single value: one field-line, so one split over its comma list. The
+    // isHopByHop guard skips the common single-token forms (`keep-alive`,
+    // `close`, …) where there is nothing custom to strip.
+    remove = []
+    for (const token of connection.split(',')) {
+      remove.push(token.trim().toLowerCase())
+    }
   }
 
-  for (const [key, val] of Object.entries(headers)) {
-    if (key.charAt(0) !== ':' && !remove.includes(key) && !HOP_EXPR.test(key)) {
-      acc = fn(acc, key, val.toString())
+  for (let i = 0; i < keys.length; i++) {
+    const key = keys[i]
+    const len = key.length
+    if (
+      key.charCodeAt(0) !== 0x3a /* ':' */ &&
+      // via/forwarded are captured above and (re)emitted by the dedicated
+      // finalization below; letting the retain loop also emit them leaks an
+      // empty inbound value (e.g. `via: ''`) that the `if (via)` guard then
+      // never overwrites, and bypasses the Forwarded BadGateway rejection.
+      // Case-insensitive (eqiLower) to match the case-insensitive capture above.
+      !(len === 3 && eqiLower(key, 'via')) &&
+      !(len === 9 && eqiLower(key, 'forwarded')) &&
+      // toLowerCase: `remove` entries are lowercased but keys may not be (the
+      // standalone interceptor path), so match case-insensitively like isHopByHop.
+      (remove === null || !remove.includes(key.toLowerCase())) &&
+      !isHopByHop(key)
+    ) {
+      acc = fn(acc, key, headers[key].toString())
     }
   }
 
-  if (socket) {
+  if (!isResponse && socket) {
     const forwardedHost = authority || host
     acc = fn(
       acc,
@@ -110,13 +277,27 @@ function reduceHeaders({ headers, proxyName, httpVersion, socket }, fn, acc) {
           .join(';'),
     )
   } else if (forwarded) {
-    // The forwarded header should not be included in response.
+    // Forwarded is a request-only header (RFC 7239): a proxy must neither emit
+    // it on a response nor relay one an upstream echoed back.
     throw new createError.BadGateway()
   }
 
   if (proxyName) {
     if (via) {
-      if (via.split(',').some((name) => name.endsWith(proxyName))) {
+      const viaLower = via.toLowerCase()
+      const proxyNameLower = proxyName.toLowerCase()
+      // A Via segment is "received-protocol received-by [comment]". Compare the
+      // received-by token for equality (case-insensitive) rather than testing
+      // whether the whole segment ends with proxyName — endsWith() trips a
+      // false-positive loop for any unrelated proxy whose name merely has
+      // proxyName as a suffix (e.g. name 'proxy' vs upstream 'otherproxy').
+      if (
+        viaLower.includes(proxyNameLower) &&
+        viaLower.split(',').some((seg) => {
+          const by = seg.trim().split(/\s+/)[1]
+          return by != null && by === proxyNameLower
+        })
+      ) {
         throw new createError.LoopDetected()
       }
       via += ', '
@@ -133,6 +314,11 @@ function reduceHeaders({ headers, proxyName, httpVersion, socket }, fn, acc) {
   return acc
 }
 
+/**
+ * @param {string} address
+ * @param {number} [port]
+ * @returns {string}
+ */
 function printIp(address, port) {
   const isIPv6 = net.isIPv6(address)
   let str = `${address}`

package/lib/interceptor/query.js

@@ -11,6 +11,12 @@ export default () => (dispatch) => (opts, handler) => {
 }
 
 function serializePathWithQuery(url, queryParams) {
+  if (typeof url !== 'string') {
+    // A path-less object URL leaves opts.path undefined; fail with a clear
+    // message instead of a cryptic "Cannot read properties of undefined".
+    throw new Error('Query params require a string path.')
+  }
+
   if (url.includes('?') || url.includes('#')) {
     throw new Error('Query params cannot be passed when url already contains "?" or "#".')
   }

package/lib/interceptor/redirect.js

@@ -1,5 +1,5 @@
 import assert from 'node:assert'
-import { DecoratorHandler, isDisturbed, parseURL } from '../utils.js'
+import { DecoratorHandler, isDisturbed, parseURL, parseHeaders } from '../utils.js'
 
 const redirectableStatusCodes = [300, 301, 302, 303, 307, 308]
 
@@ -21,15 +21,23 @@ class Handler extends DecoratorHandler {
 
     this.#dispatch = dispatch
     this.#opts = opts
-    this.#maxCount = Number.isFinite(opts.follow) ? opts.follow : (opts.follow?.count ?? 0)
+    // `follow: true` means "follow redirects" — map it to the project default
+    // cap rather than letting `true.count ?? 0` collapse to 0, which would
+    // reject the very first redirect with "Max redirections reached: 0".
+    this.#maxCount =
+      opts.follow === true
+        ? 8
+        : Number.isFinite(opts.follow)
+          ? opts.follow
+          : (opts.follow?.count ?? 0)
 
     super.onConnect((reason) => {
       this.#aborted = true
-      if (this.#abort) {
-        this.#abort(reason)
-      } else {
-        this.#reason = reason
-      }
+      // Always remember the latest reason so it survives a caller abort that
+      // lands in the window between one hop completing and the next hop's
+      // onConnect; #abort may still point at the finished hop's no-op abort.
+      this.#reason = reason
+      this.#abort?.(reason)
     })
   }
 
@@ -73,7 +81,11 @@ class Handler extends DecoratorHandler {
         return super.onHeaders(statusCode, headers, resume)
       }
     } else {
-      if (this.#count >= this.#maxCount) {
+      // `follow: N` follows up to N redirects and errors on the N+1th, matching
+      // undici/fetch maxRedirections semantics. `>` (not `>=`): with `>=`,
+      // `follow: 1` threw on the very first redirect with a self-contradictory
+      // "Max redirections reached: 1." message.
+      if (this.#count > this.#maxCount) {
         throw Object.assign(new Error(`Max redirections reached: ${this.#maxCount}.`), {
           history: this.#history,
         })
@@ -181,6 +193,13 @@ function shouldRemoveHeader(header, removeContent, unknownOrigin) {
 // https://tools.ietf.org/html/rfc7231#section-6.4
 function cleanRequestHeaders(headers, removeContent, unknownOrigin) {
   const ret = {}
+  if (Array.isArray(headers)) {
+    // undici accepts request headers as a flat [name, value, ...] array.
+    // Object.keys on that yields numeric indices, not field names, so the
+    // strip checks below would never match and the headers would be mangled
+    // into { '0': name, '1': value, ... }. Normalize to an object first.
+    headers = parseHeaders(headers)
+  }
   if (headers && typeof headers === 'object') {
     for (const key of Object.keys(headers)) {
       if (!shouldRemoveHeader(key, removeContent, unknownOrigin)) {

package/lib/interceptor/request-body-factory.js

@@ -1,4 +1,4 @@
-import { Readable } from 'node:stream'
+import { Readable, finished } from 'node:stream'
 import { isStream } from '../utils.js'
 
 function noop() {}
@@ -38,9 +38,16 @@ class FactoryStream extends Readable {
               .on('end', () => {
                 this.push(null)
               })
-              .on('error', (err) => {
+            // `finished` (not a bare 'error' listener) so a premature close —
+            // the inner body destroyed without emitting 'end' or 'error', which
+            // surfaces only as 'close' — becomes ERR_STREAM_PREMATURE_CLOSE and
+            // fails the request, instead of hanging forever with no terminal
+            // push(null). writable:false: these inner bodies are read-only.
+            finished(this.#body, { writable: false }, (err) => {
+              if (err) {
                 this.destroy(err)
-              })
+              }
+            })
           }
 
           callback(null)

package/lib/interceptor/request-id.js

@@ -12,8 +12,15 @@ function genReqId() {
 }
 
 export default () => (dispatch) => (opts, handler) => {
-  const prevId = opts.id ?? opts.headers?.['request-id']
-  const nextId = prevId ? `${prevId},${genReqId()}` : genReqId()
+  // Treat an empty string the same as absent in BOTH the selection and the
+  // chaining test (the old `??`-vs-truthy split kept a falsy opts.id, skipped
+  // the request-id header fallback, then dropped it anyway — losing a real
+  // parent id and breaking trace correlation).
+  let prevId = opts.id
+  if (prevId == null || prevId === '') {
+    prevId = opts.headers?.['request-id']
+  }
+  const nextId = prevId != null && prevId !== '' ? `${prevId},${genReqId()}` : genReqId()
   return dispatch(
     {
       ...opts,

package/lib/interceptor/response-error.js

@@ -35,10 +35,12 @@ class Handler extends DecoratorHandler {
       return super.onHeaders(statusCode, headers, resume)
     }
 
-    if (
-      this.#headers['content-type']?.startsWith('application/json') ||
-      this.#headers['content-type']?.startsWith('text/plain')
-    ) {
+    // A duplicated content-type header is an array; .startsWith would throw
+    // synchronously out of this parser callback. Coerce to the first value.
+    const contentType = Array.isArray(this.#headers['content-type'])
+      ? this.#headers['content-type'][0]
+      : this.#headers['content-type']
+    if (contentType?.startsWith('application/json') || contentType?.startsWith('text/plain')) {
       this.#decoder = new TextDecoder('utf-8')
       this.#body = ''
     }

package/lib/interceptor/response-retry.js

@@ -151,18 +151,32 @@ class Handler extends DecoratorHandler {
         return false
       }
 
+      if (this.#pos === 0 && statusCode === 200) {
+        // We asked for a byte range to resume, but no bytes had been forwarded
+        // to the consumer yet, so a server that ignored Range and replied with
+        // the full 200 is acceptable — forward it from the start. (RFC 9110
+        // permits ignoring Range; if-match still guards against changed
+        // content via a 412.) Without this, a legal full 200 retry was
+        // rejected with "Response retry failed".
+        this.#resume = resume
+        return true
+      }
+
       const contentRange = parseContentRange(headers['content-range'])
       if (!contentRange) {
         this.#maybeError(null)
         return false
       }
 
+      // Validate the server's content-range against our tracked position.
+      // These values are server-controlled, so route a mismatch through the
+      // same graceful error path as the branches above — an assert() here
+      // would throw out of onHeaders (a parser callback) and hang the stream.
       const { start, size, end = size } = contentRange
-      assert(this.#pos === start, `content-range mismatched start ${this.#pos} != ${start}`)
-      assert(
-        this.#end == null || this.#end === end,
-        `content-range mismatched end ${this.#end} != ${end}`,
-      )
+      if (this.#pos !== start || (this.#end != null && this.#end !== end)) {
+        this.#maybeError(null)
+        return false
+      }
 
       this.#resume = resume
 
@@ -333,10 +347,19 @@ class Handler extends DecoratorHandler {
     const headers = err?.headers ?? this.#headers
 
     if (statusCode && [420, 429, 502, 503, 504].includes(statusCode)) {
-      const retryAfter = headers?.['retry-after'] ? Number(headers['retry-after']) * 1e3 : null
+      const raw = headers?.['retry-after']
+      let retryAfter = raw ? Number(raw) * 1e3 : null
+      if (raw && (retryAfter == null || !Number.isFinite(retryAfter))) {
+        // RFC 9110: Retry-After may be an HTTP-date rather than delta-seconds.
+        const date = Date.parse(raw)
+        retryAfter = Number.isFinite(date) ? Math.max(0, date - Date.now()) : null
+      }
       const delay =
         retryAfter != null && Number.isFinite(retryAfter)
-          ? retryAfter
+          ? // Clamp the server-controlled wait: bounds a hostile/misconfigured
+            // value and avoids the 32-bit timer overflow that makes huge delays
+            // fire immediately.
+            Math.min(retryAfter, 60e3)
           : Math.min(10e3, retryCount * 1e3)
       this.#opts.logger?.debug({ statusCode, retryAfter, delay, retryCount }, 'retry delay')
       return tp.setTimeout(delay, true, { signal: opts?.signal ?? undefined })

package/lib/interceptor/response-verify.js

@@ -7,6 +7,7 @@ class Handler extends DecoratorHandler {
   #expectedSize
   #hasher
   #pos = 0
+  #abort
 
   constructor(opts, { handler }) {
     super(handler)
@@ -19,12 +20,22 @@ class Handler extends DecoratorHandler {
     this.#expectedSize = null
     this.#hasher = null
     this.#pos = 0
+    // Keep the raw transport abort so a mid-stream verification failure can
+    // tear down the connection. The DecoratorHandler-wrapped abort becomes a
+    // no-op once super.onError sets #errored, so we must drive abort directly.
+    this.#abort = abort
 
     super.onConnect(abort)
   }
 
   onHeaders(statusCode, headers, resume) {
-    this.#contentMD5 = this.#verifyOpts.hash ? headers['content-md5'] : null
+    // A duplicated Content-MD5 header arrives as an array. Several identical
+    // copies (a CDN/proxy re-appending its own) describe the same digest, so
+    // collapse them to one; genuinely conflicting copies are kept as an array
+    // so the strict comparison in onComplete still fails. A non-array (the
+    // common single-header case) is used verbatim.
+    const md5 = this.#verifyOpts.hash ? headers['content-md5'] : null
+    this.#contentMD5 = Array.isArray(md5) && md5.every((v) => v === md5[0]) ? md5[0] : md5
 
     if (this.#verifyOpts.size) {
       const contentRange = parseContentRange(headers['content-range'])
@@ -45,12 +56,14 @@ class Handler extends DecoratorHandler {
     this.#hasher?.update(chunk)
 
     if (this.#expectedSize != null && this.#pos > this.#expectedSize) {
-      super.onError(
-        Object.assign(new Error('Response body exceeded Content-Range'), {
-          expected: this.#expectedSize,
-          actual: this.#pos,
-        }),
-      )
+      const err = Object.assign(new Error('Response body exceeded Content-Range'), {
+        expected: this.#expectedSize,
+        actual: this.#pos,
+      })
+      super.onError(err)
+      // Returning false only applies backpressure; the socket would stay
+      // paused until bodyTimeout. Abort to release the connection now.
+      this.#abort?.(err)
       return false
     }
 

package/lib/request.js

@@ -58,8 +58,16 @@ export class RequestHandler {
           this.abort(this.reason)
         }
       }
-      signal.addEventListener('abort', onAbort)
-      this.removeAbortListener = () => signal.removeEventListener('abort', onAbort)
+      // The validation above accepts either an EventTarget (addEventListener)
+      // or an EventEmitter (.on), matching undici's contract — so honour both
+      // here instead of assuming addEventListener and crashing on an emitter.
+      if (typeof signal.addEventListener === 'function') {
+        signal.addEventListener('abort', onAbort)
+        this.removeAbortListener = () => signal.removeEventListener('abort', onAbort)
+      } else {
+        signal.on('abort', onAbort)
+        this.removeAbortListener = () => signal.removeListener('abort', onAbort)
+      }
     }
   }
 
@@ -150,9 +158,17 @@ export function request(dispatch, urlOrOpts, optsOrNully) {
   let url = urlOrOpts
   let opts = optsOrNully
 
-  if (typeof url === 'object' && url != null && opts == null) {
-    opts = url
-    url = opts.url ?? opts
+  if (typeof url === 'object' && url != null) {
+    if (opts == null) {
+      // Single-arg form: the object is both the url source and the opts.
+      opts = url
+      url = url.url ?? url
+    } else if (url.url != null) {
+      // Two-arg object-first form, e.g. request({ url }, { dispatcher }):
+      // unwrap the url field but keep the separately-provided opts. A genuine
+      // WHATWG URL has no `.url` property, so real URL objects are unaffected.
+      url = url.url
+    }
   }
 
   if (typeof url === 'string') {
@@ -172,7 +188,9 @@ export function request(dispatch, urlOrOpts, optsOrNully) {
     const protocol = url.protocol ?? 'http:'
     const host =
       url.host ??
-      (url.hostname ? `${url.hostname}:${url.port ?? (protocol === 'https:' ? 443 : 80)}` : null)
+      // `||` not `??`: an empty-string port must fall back to the default,
+      // matching defaultLookup; `??` would yield a trailing-colon origin.
+      (url.hostname ? `${url.hostname}:${url.port || (protocol === 'https:' ? 443 : 80)}` : null)
 
     if (!host || !protocol) {
       throw new InvalidArgumentError('invalid url')
@@ -193,5 +211,16 @@ export function request(dispatch, urlOrOpts, optsOrNully) {
     body: isStream(opts?.body) && opts.body.closed ? null : opts?.body,
   }
 
-  return new Promise((resolve) => dispatch(opts, new RequestHandler(opts, resolve)))
+  return new Promise((resolve) => {
+    const handler = new RequestHandler(opts, resolve)
+    try {
+      dispatch(opts, handler)
+    } catch (err) {
+      // A synchronous throw from dispatch otherwise skips onConnect/onError, so
+      // the request body stream is never destroyed and the signal's abort
+      // listener is never removed — both leak. Route it through onError, whose
+      // idempotent guards make this harmless if dispatch already reported.
+      handler.onError(err)
+    }
+  })
 }