@stacksjs/rpx 0.11.18 → 0.11.19

package/src/dns.ts

@@ -279,6 +279,57 @@ export function isDnsServerRunning(): boolean {
   return dnsServer !== null
 }
 
+/** True when something is answering A queries for `host` on the rpx dev DNS port. */
+export async function isRpxDevelopmentDnsAnswering(host: string, timeoutMs = 500): Promise<boolean> {
+  const domain = host.trim().toLowerCase().replace(/\.$/, '')
+  if (!domain)
+    return false
+
+  return new Promise((resolve) => {
+    const socket = dgram.createSocket('udp4')
+    const timer = setTimeout(() => {
+      socket.close()
+      resolve(false)
+    }, timeoutMs)
+
+    socket.on('message', (msg) => {
+      clearTimeout(timer)
+      socket.close()
+      try {
+        const header = parseHeader(msg)
+        resolve(header.ancount > 0)
+      }
+      catch {
+        resolve(false)
+      }
+    })
+
+    socket.on('error', () => {
+      clearTimeout(timer)
+      socket.close()
+      resolve(false)
+    })
+
+    const query = buildQuery(domain, 1)
+    socket.send(query, DNS_PORT, '127.0.0.1', (err) => {
+      if (err) {
+        clearTimeout(timer)
+        socket.close()
+        resolve(false)
+      }
+    })
+  })
+}
+
+function buildQuery(name: string, type: number): Buffer {
+  const header = Buffer.alloc(12)
+  header.writeUInt16BE(1, 0)
+  header.writeUInt16BE(0x0100, 2)
+  header.writeUInt16BE(1, 4)
+  const question = Buffer.concat([encodeName(name), Buffer.from([0, type, 0, 1])])
+  return Buffer.concat([header, question])
+}
+
 // ---------------------------------------------------------------------------
 // macOS resolver files
 // ---------------------------------------------------------------------------
@@ -311,9 +362,9 @@ async function flushDnsCache(verbose?: boolean): Promise<void> {
   if (process.platform !== 'darwin')
     return
 
-  const { execSudoSync, getSudoPassword } = await import('./utils')
+  const { execSudoSync, getSudoPassword, isProcessElevated } = await import('./utils')
 
-  if (!getSudoPassword()) {
+  if (!isProcessElevated() && !getSudoPassword()) {
     debugLog('dns', 'Cannot flush DNS cache without SUDO_PASSWORD', verbose)
     return
   }
@@ -353,8 +404,8 @@ async function installResolvers(basenames: string[], verbose?: boolean): Promise
   if (process.platform !== 'darwin')
     return true
 
-  const { getSudoPassword } = await import('./utils')
-  if (!getSudoPassword()) {
+  const { getSudoPassword, isProcessElevated } = await import('./utils')
+  if (!isProcessElevated() && !getSudoPassword()) {
     debugLog('dns', 'SUDO_PASSWORD not set, cannot create resolver files', verbose)
     return false
   }
@@ -375,8 +426,8 @@ async function uninstallResolvers(basenames: string[], verbose?: boolean): Promi
   if (process.platform !== 'darwin')
     return
 
-  const { getSudoPassword } = await import('./utils')
-  if (!getSudoPassword())
+  const { getSudoPassword, isProcessElevated } = await import('./utils')
+  if (!isProcessElevated() && !getSudoPassword())
     return
 
   try {
@@ -415,7 +466,15 @@ export async function setupDevelopmentDns(opts: DevelopmentDnsOptions): Promise<
     return false
 
   const basenames = resolverBasenamesForDomains(domains)
-  const started = await startDnsServer(domains, opts.verbose)
+  let started = await startDnsServer(domains, opts.verbose)
+  if (!started) {
+    const probeHost = domains[0]
+    if (probeHost && await isRpxDevelopmentDnsAnswering(probeHost))
+      started = true
+    else
+      debugLog('dns', 'Dev DNS server not available on 127.0.0.1:15353', opts.verbose)
+  }
+
   if (!started)
     return false
 

package/src/hosts.ts

@@ -4,7 +4,7 @@ import os from 'node:os'
 import path from 'node:path'
 import * as process from 'node:process'
 import { promisify } from 'node:util'
-import { debugLog, getSudoPassword } from './utils'
+import { debugLog, getSudoPassword, isProcessElevated } from './utils'
 
 const execAsync = promisify(exec)
 
@@ -29,6 +29,11 @@ async function execSudo(command: string): Promise<string> {
   if (process.platform === 'win32')
     throw new Error('Administrator privileges required on Windows')
 
+  if (isProcessElevated()) {
+    const { stdout } = await execAsync(command)
+    return stdout
+  }
+
   const sudoPassword = getSudoPassword()
   const escaped = command.replace(/'/g, `'\\''`)
 

package/src/https.ts

@@ -6,7 +6,11 @@ import { homedir } from 'node:os'
 import * as path from 'node:path'
 import { join } from 'node:path'
 import * as process from 'node:process'
-import { addCertToSystemTrustStoreAndSaveCert, createRootCA, generateCertificate as generateCert } from '@stacksjs/tlsx'
+import {
+  addCertToSystemTrustStoreAndSaveCert,
+  createRootCA,
+  generateCertificate as generateCert,
+} from '@stacksjs/tlsx'
 import { log } from './logger'
 import { config } from './config'
 import {
@@ -44,6 +48,45 @@ export {
 
 let cachedSSLConfig: { key: string, cert: string, ca?: string } | null = null
 
+/** Shared dev host cert path used by the rpx daemon and `./buddy dev`. */
+export const SHARED_DEV_HOST_CERT_PATH: string = join(homedir(), '.stacks', 'ssl', 'rpx.localhost.crt')
+
+/**
+ * Bun needs one `tls[]` entry per SNI name even when a single PEM covers every SAN.
+ * Without this, :443 serves the default cert (wrong CN → ERR_CERT_COMMON_NAME_INVALID).
+ */
+export function devSslToSniEntries(
+  hosts: string[],
+  ssl: SSLConfig,
+): Array<{ serverName: string, cert: string, key: string }> {
+  return [...new Set(hosts.filter(Boolean))].map(serverName => ({
+    serverName,
+    cert: ssl.cert,
+    key: ssl.key,
+  }))
+}
+
+/** ProxyOptions for the shared multi-app dev certificate (all registry hosts as SANs). */
+export function buildRegistryTlsProxyOptions(
+  registryHosts: string[],
+  primary: string,
+  verbose?: boolean,
+): ProxyOptions {
+  const sslDir = join(homedir(), '.stacks', 'ssl')
+  const hostnames = [...new Set([primary, ...registryHosts, 'rpx.localhost'])]
+  return {
+    https: {
+      certPath: SHARED_DEV_HOST_CERT_PATH,
+      keyPath: join(sslDir, 'rpx.localhost.key'),
+      caCertPath: join(sslDir, 'rpx.localhost.ca.crt'),
+      commonName: primary,
+    },
+    verbose,
+    regenerateUntrustedCerts: true,
+    proxies: hostnames.map(to => ({ from: 'localhost:1', to, cleanUrls: false })),
+  }
+}
+
 // Canonical filenames for the shared Root CA. The CA is a singleton across all
 // rpx-managed domains so that browsers only need to trust it once. Host certs
 // for individual domains are issued from this CA on demand.
@@ -123,8 +166,8 @@ export function resolveSSLPaths(options: ProxyConfigs, defaultConfig: typeof con
       })
 
       // Filter out undefined values from arrays
-      const altNameIPs = options.https.altNameIPs?.filter((ip: any): ip is string => ip !== undefined) || baseConfig.altNameIPs
-      const altNameURIs = options.https.altNameURIs?.filter((uri: any): uri is string => uri !== undefined) || baseConfig.altNameURIs
+      const altNameIPs = options.https.altNameIPs?.filter((ip: string | undefined): ip is string => ip !== undefined) || baseConfig.altNameIPs
+      const altNameURIs = options.https.altNameURIs?.filter((uri: string | undefined): uri is string => uri !== undefined) || baseConfig.altNameURIs
 
       // Override with provided paths
       return {

package/src/index.ts

@@ -11,9 +11,12 @@ export {
 } from './hosts'
 
 export {
+  SHARED_DEV_HOST_CERT_PATH,
+  buildRegistryTlsProxyOptions,
   checkExistingCertificates,
   cleanupCertificates,
   clearSslConfigCache,
+  devSslToSniEntries,
   forceTrustCertificate,
   generateCertificate,
   getRootCAPaths,

package/src/logger.ts

@@ -1,19 +1,19 @@
 export const log: {
-  info: (...args: any[]) => void
-  success: (...args: any[]) => void
-  warn: (...args: any[]) => void
-  error: (...args: any[]) => void
-  debug: (...args: any[]) => void
-  log: (...args: any[]) => void
-  start: (...args: any[]) => void
-  box: (...args: any[]) => void
+  info: (...args: unknown[]) => void
+  success: (...args: unknown[]) => void
+  warn: (...args: unknown[]) => void
+  error: (...args: unknown[]) => void
+  debug: (...args: unknown[]) => void
+  log: (...args: unknown[]) => void
+  start: (...args: unknown[]) => void
+  box: (...args: unknown[]) => void
 } = {
-  info: (...args: any[]) => console.log('[info]', ...args),
-  success: (...args: any[]) => console.log('[success]', ...args),
-  warn: (...args: any[]) => console.warn('[warn]', ...args),
-  error: (...args: any[]) => console.error('[error]', ...args),
-  debug: (...args: any[]) => console.debug('[debug]', ...args),
-  log: (...args: any[]) => console.log(...args),
-  start: (...args: any[]) => console.log('[start]', ...args),
-  box: (...args: any[]) => console.log('[box]', ...args),
+  info: (...args: unknown[]) => console.log('[info]', ...args),
+  success: (...args: unknown[]) => console.log('[success]', ...args),
+  warn: (...args: unknown[]) => console.warn('[warn]', ...args),
+  error: (...args: unknown[]) => console.error('[error]', ...args),
+  debug: (...args: unknown[]) => console.debug('[debug]', ...args),
+  log: (...args: unknown[]) => console.log(...args),
+  start: (...args: unknown[]) => console.log('[start]', ...args),
+  box: (...args: unknown[]) => console.log('[box]', ...args),
 }

package/src/origin-guard.ts

@@ -21,8 +21,30 @@
  * })
  * Bun.serve({ fetch: req => guard(req) ?? handler(req, server) })
  */
+import { timingSafeEqual } from 'node:crypto'
 import { matchesWildcard } from './host-match'
 
+/**
+ * Compare a request-supplied secret against the expected value in constant time,
+ * so the shared secret can't be recovered byte-by-byte via response timing. The
+ * length check leaks only the secret's length (standard and acceptable); the
+ * byte comparison itself is timing-safe.
+ */
+function secretMatches(provided: string | null, expected: string): boolean {
+  if (provided == null)
+    return false
+  const a = Buffer.from(provided)
+  const b = Buffer.from(expected)
+  if (a.length !== b.length)
+    return false
+  return timingSafeEqual(a, b)
+}
+
+/** Lowercase and strip a single trailing dot so `Host: example.com.` ≡ `example.com`. */
+function normalizeHost(host: string): string {
+  return host.toLowerCase().replace(/\.$/, '')
+}
+
 export interface OriginGuardOptions {
   /** Header the CDN injects on the origin hop (case-insensitive), e.g. `x-origin-verify`. */
   header: string
@@ -51,9 +73,9 @@ const DEFAULT_EXEMPT = ['/.well-known/acme-challenge/']
 function hostnameOf(req: Request): string {
   const hostHeader = req.headers.get('host')
   if (hostHeader)
-    return hostHeader.split(':')[0].toLowerCase()
+    return normalizeHost(hostHeader.split(':')[0])
   try {
-    return new URL(req.url).hostname.toLowerCase()
+    return normalizeHost(new URL(req.url).hostname)
   }
   catch {
     return ''
@@ -65,7 +87,7 @@ export function createOriginGuard(options: OriginGuardOptions): OriginGuard {
   const exact = new Set<string>()
   const wildcards: string[] = []
   for (const h of options.hosts) {
-    const host = h.toLowerCase()
+    const host = normalizeHost(h)
     if (host.startsWith('*.'))
       wildcards.push(host)
     else
@@ -76,7 +98,7 @@ export function createOriginGuard(options: OriginGuardOptions): OriginGuard {
     ?? 'Forbidden: direct origin access is not allowed; requests must arrive via the CDN.\n'
 
   const protects = (hostname: string): boolean => {
-    const h = hostname.toLowerCase()
+    const h = normalizeHost(hostname)
     return exact.has(h) || wildcards.some(w => matchesWildcard(h, w))
   }
 
@@ -95,7 +117,7 @@ export function createOriginGuard(options: OriginGuardOptions): OriginGuard {
     if (exemptPaths.some(p => pathname.startsWith(p)))
       return undefined
 
-    if (req.headers.get(header) === options.value)
+    if (secretMatches(req.headers.get(header), options.value))
       return undefined
 
     return new Response(forbidden, { status: 403, headers: { 'content-type': 'text/plain' } })

package/src/proxy-handler.ts

@@ -16,6 +16,7 @@
 import type { ServerWebSocket } from 'bun'
 import type { ResolvedStaticRoute } from './static-files'
 import type { PathRewrite } from './types'
+import { FALLBACK, POOL_BUSY, proxyViaPool, TIMEOUT } from './proxy-pool'
 import { serveStaticFile } from './static-files'
 import { debugLog, resolvePathRewrite } from './utils'
 
@@ -67,9 +68,10 @@ export type ProxyFetchHandler = (req: Request, server?: ProxyServer) => Promise<
 
 /** Minimal shape of the Bun server needed for WebSocket upgrades. */
 export interface ProxyServer {
-  // Loose `any` so it structurally accepts Bun's `Server<WebSocketData>` for
-  // any data generic (the daemon/start callers parameterize differently).
-  upgrade: (req: Request, options?: { data?: any, headers?: any }) => boolean
+  // `unknown` data + standard HeadersInit so it structurally accepts Bun's
+  // `Server<WebSocketData>` for any data generic (the daemon/start callers
+  // parameterize differently) without resorting to `any`.
+  upgrade: (req: Request, options?: { data?: unknown, headers?: Bun.HeadersInit }) => boolean
 }
 
 /** Data attached to an upgraded client socket so the ws handler can dial upstream. */
@@ -101,8 +103,10 @@ const HOP_BY_HOP = new Set([
 
 function extractHostname(req: Request): string {
   const hostHeader = req.headers.get('host') || ''
-  // Strip port (`stacks.localhost:443` → `stacks.localhost`).
-  return hostHeader.split(':')[0]
+  // Strip port (`stacks.localhost:443` → `stacks.localhost`) without allocating
+  // an array (`split`) on every request.
+  const colon = hostHeader.indexOf(':')
+  return colon === -1 ? hostHeader : hostHeader.slice(0, colon)
 }
 
 /**
@@ -125,25 +129,42 @@ export function stripBasePath(pathname: string, basePath?: string): string {
 
 /**
  * Resolve the upstream target (`host` + `path`) for a request against a route,
- * applying any matching path rewrite.
+ * applying any matching path rewrite. Takes the already-extracted `pathname` so
+ * the hot path never re-parses the request URL.
  */
-function resolveTarget(req: Request, route: ProxyRoute, verbose?: boolean): { targetHost: string, targetPath: string, search: string } {
-  const url = new URL(req.url)
+function resolveTarget(pathname: string, route: ProxyRoute, verbose?: boolean): { targetHost: string, targetPath: string } {
   let targetHost = route.sourceHost ?? ''
   // Proxy backends preserve their mount prefix by default (most apps own their
   // `/api` namespace), opting in to stripping via `stripBasePathPrefix`.
   // Explicit `pathRewrites` still apply on top of this.
   const stripBase = route.stripBasePathPrefix ?? false
-  let targetPath = stripBase ? stripBasePath(url.pathname, route.basePath) : url.pathname
+  let targetPath = stripBase ? stripBasePath(pathname, route.basePath) : pathname
 
   const rewriteMatch = resolvePathRewrite(targetPath, route.pathRewrites)
   if (rewriteMatch) {
     targetHost = rewriteMatch.targetHost
     targetPath = rewriteMatch.targetPath
-    debugLog('request', `Path rewrite: ${url.pathname} → ${targetHost}${targetPath}`, verbose)
+    debugLog('request', `Path rewrite: ${pathname} → ${targetHost}${targetPath}`, verbose)
   }
 
-  return { targetHost, targetPath, search: url.search }
+  return { targetHost, targetPath }
+}
+
+/**
+ * Extract the origin-form path and query from a request URL without the cost of
+ * constructing a `URL`. `req.url` is always absolute-form here
+ * (`http://host/path?q`), so we slice from the first `/` after the authority.
+ * The raw (un-decoded) path is forwarded verbatim, which is what a proxy wants.
+ */
+function splitPathQuery(rawUrl: string): { pathname: string, search: string } {
+  const schemeEnd = rawUrl.indexOf('://')
+  const pathStart = schemeEnd === -1 ? rawUrl.indexOf('/') : rawUrl.indexOf('/', schemeEnd + 3)
+  if (pathStart === -1)
+    return { pathname: '/', search: '' }
+  const q = rawUrl.indexOf('?', pathStart)
+  if (q === -1)
+    return { pathname: rawUrl.slice(pathStart), search: '' }
+  return { pathname: rawUrl.slice(pathStart, q), search: rawUrl.slice(q) }
 }
 
 /**
@@ -154,11 +175,11 @@ function resolveTarget(req: Request, route: ProxyRoute, verbose?: boolean): { ta
  * traffic is handled by the `websocket` handler from {@link createProxyWebSocketHandler}.
  */
 export function createProxyFetchHandler(getRoute: GetRoute, verbose?: boolean): ProxyFetchHandler {
-  return async (req: Request, server?: ProxyServer): Promise<Response | undefined> => {
-    const url = new URL(req.url)
+  const inner = async (req: Request, server?: ProxyServer): Promise<Response | undefined> => {
+    const { pathname, search } = splitPathQuery(req.url)
     const hostname = extractHostname(req)
 
-    const route = getRoute(hostname, url.pathname)
+    const route = getRoute(hostname, pathname)
     if (!route) {
       debugLog('request', `No route found for host: ${hostname}`, verbose)
       return new Response(`No proxy configured for ${hostname}`, { status: 404 })
@@ -169,7 +190,7 @@ export function createProxyFetchHandler(getRoute: GetRoute, verbose?: boolean):
     // own root for `/docs`.
     if (route.static) {
       const strip = route.stripBasePathPrefix ?? true
-      const staticPath = strip ? stripBasePath(url.pathname, route.basePath) : url.pathname
+      const staticPath = strip ? stripBasePath(pathname, route.basePath) : pathname
       return serveStaticFile(staticPath, route.static)
     }
 
@@ -178,7 +199,7 @@ export function createProxyFetchHandler(getRoute: GetRoute, verbose?: boolean):
       if (!server || !route.sourceHost)
         return new Response('WebSocket upgrade not supported here', { status: 400 })
 
-      const { targetHost, targetPath, search } = resolveTarget(req, route, verbose)
+      const { targetHost, targetPath } = resolveTarget(pathname, route, verbose)
       const targetUrl = `ws://${targetHost}${targetPath}${search}`
 
       const forwardHeaders: Record<string, string> = {}
@@ -203,46 +224,93 @@ export function createProxyFetchHandler(getRoute: GetRoute, verbose?: boolean):
     if (!route.sourceHost)
       return new Response(`No upstream configured for ${hostname}`, { status: 502 })
 
-    const { targetHost, targetPath, search } = resolveTarget(req, route, verbose)
-    const targetUrl = `http://${targetHost}${targetPath}${search}`
+    // Strip `.html` and 301 to the clean URL when enabled — before any upstream
+    // work, since the redirect doesn't depend on the origin response.
+    if (route.cleanUrls && pathname.endsWith('.html')) {
+      const cleanPath = pathname.replace(/\.html$/, '')
+      return new Response(null, {
+        status: 301,
+        headers: { Location: cleanPath },
+      })
+    }
+
+    const { targetHost, targetPath } = resolveTarget(pathname, route, verbose)
+    const originOverride = route.changeOrigin ? `http://${route.sourceHost}` : undefined
 
+    // Forward through the pooled raw-socket transport: a reused keepalive pool
+    // per upstream (like nginx's `keepalive`) that stays flat under load, where
+    // fetch()'s connection churn exhausts ephemeral ports and collapses (~15x).
+    // Forwarded headers (host, x-forwarded-*, origin) are serialized inline with
+    // the passthrough headers — no intermediate Headers copy on the hot path. The
+    // pool declines what it doesn't handle (streaming uploads, Expect, upgrades)
+    // via FALLBACK, and bodyless requests can retry through fetch() as a backstop.
+    const hasBody = req.body != null && req.method !== 'GET' && req.method !== 'HEAD'
     try {
-      const headers = new Headers(req.headers)
-      headers.set('host', targetHost)
-      if (route.changeOrigin)
-        headers.set('origin', `http://${route.sourceHost}`)
-      headers.set('x-forwarded-for', '127.0.0.1')
-      headers.set('x-forwarded-proto', 'https')
-      headers.set('x-forwarded-host', hostname)
-
-      const response = await fetch(targetUrl, {
+      return await proxyViaPool({
+        hostPort: targetHost,
         method: req.method,
-        headers,
+        path: `${targetPath}${search}`,
+        reqHeaders: req.headers,
+        forwardedHost: hostname,
+        originOverride,
         body: req.body,
-        redirect: 'manual',
-      })
-
-      // Strip `.html` and 301 to the clean URL when enabled.
-      if (route.cleanUrls && url.pathname.endsWith('.html')) {
-        const cleanPath = url.pathname.replace(/\.html$/, '')
-        return new Response(null, {
-          status: 301,
-          headers: { Location: cleanPath },
-        })
-      }
-
-      const responseHeaders = new Headers(response.headers)
-      return new Response(response.body, {
-        status: response.status,
-        statusText: response.statusText,
-        headers: responseHeaders,
       })
     }
     catch (err) {
+      // Upstream stalled past the configured timeout → 504 (no fetch retry — it
+      // would just stall again).
+      if (err === TIMEOUT) {
+        debugLog('request', `Upstream timeout for ${hostname}`, verbose)
+        return new Response('Gateway Timeout', { status: 504 })
+      }
+      // Pool saturated: every connection to this upstream is busy and the wait
+      // for a free slot timed out. Fail fast and loud (503) instead of parking
+      // the request forever — a parked request with no response is what made the
+      // listener appear "wedged" in production.
+      if (err === POOL_BUSY) {
+        debugLog('request', `Upstream pool saturated for ${hostname}`, verbose)
+        return new Response('Service Unavailable', { status: 503, headers: { 'retry-after': '1' } })
+      }
+      if (err === FALLBACK || !hasBody) {
+        try {
+          const headers = new Headers(req.headers)
+          headers.set('host', targetHost)
+          headers.set('x-forwarded-for', '127.0.0.1')
+          headers.set('x-forwarded-proto', 'https')
+          headers.set('x-forwarded-host', hostname)
+          if (originOverride !== undefined)
+            headers.set('origin', originOverride)
+          return await fetch(`http://${targetHost}${targetPath}${search}`, {
+            method: req.method,
+            headers,
+            body: req.body,
+            redirect: 'manual',
+          })
+        }
+        catch (fetchErr) {
+          debugLog('request', `Proxy error for ${hostname}: ${fetchErr}`, verbose)
+          return new Response(`Proxy Error: ${fetchErr}`, { status: 502 })
+        }
+      }
       debugLog('request', `Proxy error for ${hostname}: ${err}`, verbose)
       return new Response(`Proxy Error: ${err}`, { status: 502 })
     }
   }
+
+  // A reverse proxy must never drop a connection on an unexpected throw: an
+  // async fetch handler that *rejects* makes Bun close the socket with no
+  // response (the client sees an empty reply) and log a stack trace per hit.
+  // Wrap the whole pipeline so a routing bug, a malformed request, or a static
+  // helper that throws always degrades to a 502 instead of a dropped connection.
+  return async (req: Request, server?: ProxyServer): Promise<Response | undefined> => {
+    try {
+      return await inner(req, server)
+    }
+    catch (err) {
+      debugLog('request', `Unhandled proxy handler error: ${err}`, verbose)
+      return new Response('Bad Gateway', { status: 502 })
+    }
+  }
 }
 
 /**
@@ -259,8 +327,11 @@ export function createProxyWebSocketHandler(verbose?: boolean) {
       const { targetUrl, forwardHeaders } = ws.data
       let upstream: WebSocket
       try {
-        // Bun's WebSocket accepts a `headers` option (control-channel auth etc.).
-        upstream = new WebSocket(targetUrl, { headers: forwardHeaders } as any)
+        // Bun's WebSocket accepts a `headers` option (control-channel auth etc.)
+        // that the DOM lib's constructor type doesn't model — describe that
+        // extended constructor precisely instead of falling back to `any`.
+        type BunWebSocketCtor = new (_url: string | URL, _options?: { headers?: Record<string, string> }) => WebSocket
+        upstream = new (WebSocket as unknown as BunWebSocketCtor)(targetUrl, { headers: forwardHeaders })
       }
       catch (err) {
         debugLog('ws', `failed to open upstream ${targetUrl}: ${err}`, verbose)
@@ -274,12 +345,13 @@ export function createProxyWebSocketHandler(verbose?: boolean) {
       upstream.addEventListener('open', () => {
         st.upstreamOpen = true
         for (const frame of st.pending)
-          upstream.send(frame as any)
+          upstream.send(frame)
         st.pending = []
       })
       upstream.addEventListener('message', (ev: MessageEvent) => {
         // Forward both binary (ArrayBuffer) and text frames to the client.
-        ws.send(ev.data as any)
+        // `binaryType` is 'arraybuffer', so `ev.data` is `string | ArrayBuffer`.
+        ws.send(ev.data as string | ArrayBuffer)
       })
       upstream.addEventListener('close', (ev: CloseEvent) => {
         try { ws.close(ev.code || 1000, ev.reason || '') }
@@ -298,7 +370,7 @@ export function createProxyWebSocketHandler(verbose?: boolean) {
         return
       const frame = typeof message === 'string' ? message : new Uint8Array(message)
       if (st.upstreamOpen)
-        st.upstream.send(frame as any)
+        st.upstream.send(frame)
       else
         st.pending.push(frame)
     },