@yanglaofish/fishtools 0.5.2 → 0.5.3

package/node_modules/undici/lib/web/fetch/index.js

@@ -7,13 +7,13 @@ const {
   makeAppropriateNetworkError,
   filterResponse,
   makeResponse,
-  fromInnerResponse,
-  getResponseState
+  fromInnerResponse
 } = require('./response')
 const { HeadersList } = require('./headers')
-const { Request, cloneRequest, getRequestDispatcher, getRequestState, removeRequestAbortListener } = require('./request')
+const { Request, cloneRequest } = require('./request')
 const zlib = require('node:zlib')
 const {
+  bytesMatch,
   makePolicyContainer,
   clonePolicyContainer,
   requestBadPort,
@@ -29,12 +29,15 @@ const {
   crossOriginResourcePolicyCheck,
   determineRequestsReferrer,
   coarsenedSharedCurrentTime,
+  createDeferredPromise,
+  isBlobLike,
   sameOrigin,
   isCancelled,
   isAborted,
   isErrorLike,
   fullyReadBody,
   readableStreamClose,
+  isomorphicEncode,
   urlIsLocal,
   urlIsHttpHttpsScheme,
   urlHasHttpsScheme,
@@ -42,11 +45,9 @@ const {
   simpleRangeHeaderValue,
   buildContentRange,
   createInflate,
-  extractMimeType,
-  hasAuthenticationEntry,
-  includesCredentials,
-  isTraversableNavigable
+  extractMimeType
 } = require('./util')
+const { kState, kDispatcher } = require('./symbols')
 const assert = require('node:assert')
 const { safelyExtractBody, extractBody } = require('./body')
 const {
@@ -57,16 +58,12 @@ const {
   subresourceSet
 } = require('./constants')
 const EE = require('node:events')
-const { Readable, pipeline, finished, isErrored, isReadable } = require('node:stream')
-const { addAbortListener, bufferToLowerCasedHeaderName } = require('../../core/util')
-const { SocketError } = require('../../core/errors')
+const { Readable, pipeline, finished } = require('node:stream')
+const { addAbortListener, isErrored, isReadable, bufferToLowerCasedHeaderName } = require('../../core/util')
 const { dataURLProcessor, serializeAMimeType, minimizeSupportedMimeType } = require('./data-url')
 const { getGlobalDispatcher } = require('../../global')
-const { webidl } = require('../webidl')
+const { webidl } = require('./webidl')
 const { STATUS_CODES } = require('node:http')
-const { bytesMatch } = require('../subresource-integrity/subresource-integrity')
-const { isomorphicEncode } = require('../infra')
-
 const GET_OR_HEAD = ['GET', 'HEAD']
 
 const defaultUserAgent = typeof __UNDICI_IS_NODE__ !== 'undefined' || typeof esbuildDetection !== 'undefined'
@@ -76,35 +73,6 @@ const defaultUserAgent = typeof __UNDICI_IS_NODE__ !== 'undefined' || typeof esb
 /** @type {import('buffer').resolveObjectURL} */
 let resolveObjectURL
 
-function appendHeadersListFromResponseHeaders (headersList, headers, rawHeaders) {
-  if (Array.isArray(rawHeaders)) {
-    for (let i = 0; i < rawHeaders.length; i += 2) {
-      const nameStr = bufferToLowerCasedHeaderName(rawHeaders[i])
-      const value = rawHeaders[i + 1]
-
-      if (Array.isArray(value) && !Buffer.isBuffer(value)) {
-        for (const val of value) {
-          headersList.append(nameStr, val.toString('latin1'), true)
-        }
-      } else {
-        headersList.append(nameStr, value.toString('latin1'), true)
-      }
-    }
-
-    return
-  }
-
-  for (const [name, value] of Object.entries(headers ?? {})) {
-    if (Array.isArray(value)) {
-      for (const entry of value) {
-        headersList.append(name, `${entry}`, true)
-      }
-    } else {
-      headersList.append(name, `${value}`, true)
-    }
-  }
-}
-
 class Fetch extends EE {
   constructor (dispatcher) {
     super()
@@ -161,7 +129,7 @@ function fetch (input, init = undefined) {
   webidl.argumentLengthCheck(arguments, 1, 'globalThis.fetch')
 
   // 1. Let p be a new promise.
-  let p = Promise.withResolvers()
+  let p = createDeferredPromise()
 
   // 2. Let requestObject be the result of invoking the initial value of
   // Request as constructor with input and init as arguments. If this throws
@@ -176,13 +144,13 @@ function fetch (input, init = undefined) {
   }
 
   // 3. Let request be requestObject’s request.
-  const request = getRequestState(requestObject)
+  const request = requestObject[kState]
 
   // 4. If requestObject’s signal’s aborted flag is set, then:
   if (requestObject.signal.aborted) {
     // 1. Abort the fetch() call with p, request, null, and
     //    requestObject’s signal’s abort reason.
-    abortFetch(p, request, null, requestObject.signal.reason, null)
+    abortFetch(p, request, null, requestObject.signal.reason)
 
     // 2. Return p.
     return p.promise
@@ -209,7 +177,7 @@ function fetch (input, init = undefined) {
   let controller = null
 
   // 11. Add the following abort steps to requestObject’s signal:
-  const removeAbortListener = addAbortListener(
+  addAbortListener(
     requestObject.signal,
     () => {
       // 1. Set locallyAborted to true.
@@ -225,19 +193,10 @@ function fetch (input, init = undefined) {
 
       // 4. Abort the fetch() call with p, request, responseObject,
       //    and requestObject’s signal’s abort reason.
-      abortFetch(p, request, realResponse, requestObject.signal.reason, controller.controller)
+      abortFetch(p, request, realResponse, requestObject.signal.reason)
     }
   )
 
-  // Remove the `abort` listeners registered above and in the Request
-  // constructor once the fetch has settled. Without this, reusing a single
-  // signal across many requests leaks listeners and Node.js emits a
-  // MaxListenersExceededWarning. See https://github.com/nodejs/undici/issues/5285
-  const cleanupAbortListeners = () => {
-    removeAbortListener()
-    removeRequestAbortListener(requestObject)
-  }
-
   // 12. Let handleFetchDone given response response be to finalize and
   // report timing with response, globalObject, and "fetch".
   // see function handleFetchDone
@@ -261,8 +220,7 @@ function fetch (input, init = undefined) {
       // 2. Abort the fetch() call with p, request, responseObject, and
       //    deserializedError.
 
-      abortFetch(p, request, responseObject, controller.serializedAbortReason, controller.controller)
-      cleanupAbortListeners()
+      abortFetch(p, request, responseObject, controller.serializedAbortReason)
       return
     }
 
@@ -270,7 +228,6 @@ function fetch (input, init = undefined) {
     // and terminate these substeps.
     if (response.type === 'error') {
       p.reject(new TypeError('fetch failed', { cause: response.error }))
-      cleanupAbortListeners()
       return
     }
 
@@ -285,15 +242,9 @@ function fetch (input, init = undefined) {
 
   controller = fetching({
     request,
-    processResponseEndOfBody: (response) => {
-      handleFetchDone(response)
-      cleanupAbortListeners()
-    },
+    processResponseEndOfBody: handleFetchDone,
     processResponse,
-    dispatcher: getRequestDispatcher(requestObject), // undici
-    // Keep requestObject alive to prevent its AbortController from being GC'd
-    // See https://github.com/nodejs/undici/issues/4627
-    requestObject
+    dispatcher: requestObject[kDispatcher] // undici
   })
 
   // 14. Return p.
@@ -359,9 +310,7 @@ function finalizeAndReportTiming (response, initiatorType = 'other') {
     originalURL.href,
     initiatorType,
     globalThis,
-    cacheState,
-    '', // bodyType
-    response.status
+    cacheState
   )
 }
 
@@ -369,7 +318,7 @@ function finalizeAndReportTiming (response, initiatorType = 'other') {
 const markResourceTiming = performance.markResourceTiming
 
 // https://fetch.spec.whatwg.org/#abort-fetch
-function abortFetch (p, request, responseObject, error, controller /* undici-specific */) {
+function abortFetch (p, request, responseObject, error) {
   // 1. Reject promise with error.
   if (p) {
     // We might have already resolved the promise at this stage
@@ -378,7 +327,7 @@ function abortFetch (p, request, responseObject, error, controller /* undici-spe
 
   // 2. If request’s body is not null and is readable, then cancel request’s
   // body with error.
-  if (request.body?.stream != null && isReadable(request.body.stream)) {
+  if (request.body != null && isReadable(request.body?.stream)) {
     request.body.stream.cancel(error).catch((err) => {
       if (err.code === 'ERR_INVALID_STATE') {
         // Node bug?
@@ -394,12 +343,18 @@ function abortFetch (p, request, responseObject, error, controller /* undici-spe
   }
 
   // 4. Let response be responseObject’s response.
-  const response = getResponseState(responseObject)
+  const response = responseObject[kState]
 
   // 5. If response’s body is not null and is readable, then error response’s
   // body with error.
-  if (response.body?.stream != null && isReadable(response.body.stream)) {
-    controller.error(error)
+  if (response.body != null && isReadable(response.body?.stream)) {
+    response.body.stream.cancel(error).catch((err) => {
+      if (err.code === 'ERR_INVALID_STATE') {
+        // Node bug?
+        return
+      }
+      throw err
+    })
   }
 }
 
@@ -412,8 +367,7 @@ function fetching ({
   processResponseEndOfBody,
   processResponseConsumeBody,
   useParallelQueue = false,
-  dispatcher = getGlobalDispatcher(), // undici
-  requestObject = null // Keep alive to prevent AbortController GC, see #4627
+  dispatcher = getGlobalDispatcher() // undici
 }) {
   // Ensure that the dispatcher is set accordingly
   assert(dispatcher)
@@ -467,9 +421,7 @@ function fetching ({
     processResponseConsumeBody,
     processResponseEndOfBody,
     taskDestination,
-    crossOriginIsolatedCapability,
-    // Keep requestObject alive to prevent its AbortController from being GC'd
-    requestObject
+    crossOriginIsolatedCapability
   }
 
   // 7. If request’s body is a byte sequence, then set request’s body to
@@ -554,71 +506,75 @@ function fetching ({
   }
 
   // 16. Run main fetch given fetchParams.
-  mainFetch(fetchParams, false)
+  mainFetch(fetchParams)
+    .catch(err => {
+      fetchParams.controller.terminate(err)
+    })
 
   // 17. Return fetchParam's controller
   return fetchParams.controller
 }
 
 // https://fetch.spec.whatwg.org/#concept-main-fetch
-async function mainFetch (fetchParams, recursive) {
-  try {
-    // 1. Let request be fetchParams’s request.
-    const request = fetchParams.request
+async function mainFetch (fetchParams, recursive = false) {
+  // 1. Let request be fetchParams’s request.
+  const request = fetchParams.request
 
-    // 2. Let response be null.
-    let response = null
+  // 2. Let response be null.
+  let response = null
 
-    // 3. If request’s local-URLs-only flag is set and request’s current URL is
-    // not local, then set response to a network error.
-    if (request.localURLsOnly && !urlIsLocal(requestCurrentURL(request))) {
-      response = makeNetworkError('local URLs only')
-    }
+  // 3. If request’s local-URLs-only flag is set and request’s current URL is
+  // not local, then set response to a network error.
+  if (request.localURLsOnly && !urlIsLocal(requestCurrentURL(request))) {
+    response = makeNetworkError('local URLs only')
+  }
 
-    // 4. Run report Content Security Policy violations for request.
-    // TODO
+  // 4. Run report Content Security Policy violations for request.
+  // TODO
 
-    // 5. Upgrade request to a potentially trustworthy URL, if appropriate.
-    tryUpgradeRequestToAPotentiallyTrustworthyURL(request)
+  // 5. Upgrade request to a potentially trustworthy URL, if appropriate.
+  tryUpgradeRequestToAPotentiallyTrustworthyURL(request)
 
-    // 6. If should request be blocked due to a bad port, should fetching request
-    // be blocked as mixed content, or should request be blocked by Content
-    // Security Policy returns blocked, then set response to a network error.
-    if (requestBadPort(request) === 'blocked') {
-      response = makeNetworkError('bad port')
-    }
-    // TODO: should fetching request be blocked as mixed content?
-    // TODO: should request be blocked by Content Security Policy?
+  // 6. If should request be blocked due to a bad port, should fetching request
+  // be blocked as mixed content, or should request be blocked by Content
+  // Security Policy returns blocked, then set response to a network error.
+  if (requestBadPort(request) === 'blocked') {
+    response = makeNetworkError('bad port')
+  }
+  // TODO: should fetching request be blocked as mixed content?
+  // TODO: should request be blocked by Content Security Policy?
 
-    // 7. If request’s referrer policy is the empty string, then set request’s
-    // referrer policy to request’s policy container’s referrer policy.
-    if (request.referrerPolicy === '') {
-      request.referrerPolicy = request.policyContainer.referrerPolicy
-    }
+  // 7. If request’s referrer policy is the empty string, then set request’s
+  // referrer policy to request’s policy container’s referrer policy.
+  if (request.referrerPolicy === '') {
+    request.referrerPolicy = request.policyContainer.referrerPolicy
+  }
 
-    // 8. If request’s referrer is not "no-referrer", then set request’s
-    // referrer to the result of invoking determine request’s referrer.
-    if (request.referrer !== 'no-referrer') {
-      request.referrer = determineRequestsReferrer(request)
-    }
+  // 8. If request’s referrer is not "no-referrer", then set request’s
+  // referrer to the result of invoking determine request’s referrer.
+  if (request.referrer !== 'no-referrer') {
+    request.referrer = determineRequestsReferrer(request)
+  }
 
-    // 9. Set request’s current URL’s scheme to "https" if all of the following
-    // conditions are true:
-    // - request’s current URL’s scheme is "http"
-    // - request’s current URL’s host is a domain
-    // - Matching request’s current URL’s host per Known HSTS Host Domain Name
-    //   Matching results in either a superdomain match with an asserted
-    //   includeSubDomains directive or a congruent match (with or without an
-    //   asserted includeSubDomains directive). [HSTS]
-    // TODO
+  // 9. Set request’s current URL’s scheme to "https" if all of the following
+  // conditions are true:
+  // - request’s current URL’s scheme is "http"
+  // - request’s current URL’s host is a domain
+  // - Matching request’s current URL’s host per Known HSTS Host Domain Name
+  //   Matching results in either a superdomain match with an asserted
+  //   includeSubDomains directive or a congruent match (with or without an
+  //   asserted includeSubDomains directive). [HSTS]
+  // TODO
 
-    // 10. If recursive is false, then run the remaining steps in parallel.
-    // TODO
+  // 10. If recursive is false, then run the remaining steps in parallel.
+  // TODO
 
-    // 11. If response is null, then set response to the result of running
-    // the steps corresponding to the first matching statement:
-    if (response === null) {
+  // 11. If response is null, then set response to the result of running
+  // the steps corresponding to the first matching statement:
+  if (response === null) {
+    response = await (async () => {
       const currentURL = requestCurrentURL(request)
+
       if (
         // - request’s current URL’s origin is same origin with request’s origin,
         //   and request’s response tainting is "basic"
@@ -632,188 +588,192 @@ async function mainFetch (fetchParams, recursive) {
         request.responseTainting = 'basic'
 
         // 2. Return the result of running scheme fetch given fetchParams.
-        response = await schemeFetch(fetchParams)
+        return await schemeFetch(fetchParams)
+      }
 
       // request’s mode is "same-origin"
-      } else if (request.mode === 'same-origin') {
+      if (request.mode === 'same-origin') {
         // 1. Return a network error.
-        response = makeNetworkError('request mode cannot be "same-origin"')
+        return makeNetworkError('request mode cannot be "same-origin"')
+      }
 
       // request’s mode is "no-cors"
-      } else if (request.mode === 'no-cors') {
+      if (request.mode === 'no-cors') {
         // 1. If request’s redirect mode is not "follow", then return a network
         // error.
         if (request.redirect !== 'follow') {
-          response = makeNetworkError(
+          return makeNetworkError(
             'redirect mode cannot be "follow" for "no-cors" request'
           )
-        } else {
-          // 2. Set request’s response tainting to "opaque".
-          request.responseTainting = 'opaque'
-
-          // 3. Return the result of running scheme fetch given fetchParams.
-          response = await schemeFetch(fetchParams)
         }
+
+        // 2. Set request’s response tainting to "opaque".
+        request.responseTainting = 'opaque'
+
+        // 3. Return the result of running scheme fetch given fetchParams.
+        return await schemeFetch(fetchParams)
+      }
+
       // request’s current URL’s scheme is not an HTTP(S) scheme
-      } else if (!urlIsHttpHttpsScheme(requestCurrentURL(request))) {
+      if (!urlIsHttpHttpsScheme(requestCurrentURL(request))) {
         // Return a network error.
-        response = makeNetworkError('URL scheme must be a HTTP(S) scheme')
-
-        // - request’s use-CORS-preflight flag is set
-        // - request’s unsafe-request flag is set and either request’s method is
-        //   not a CORS-safelisted method or CORS-unsafe request-header names with
-        //   request’s header list is not empty
-        //    1. Set request’s response tainting to "cors".
-        //    2. Let corsWithPreflightResponse be the result of running HTTP fetch
-        //    given fetchParams and true.
-        //    3. If corsWithPreflightResponse is a network error, then clear cache
-        //    entries using request.
-        //    4. Return corsWithPreflightResponse.
-        // TODO
+        return makeNetworkError('URL scheme must be a HTTP(S) scheme')
+      }
+
+      // - request’s use-CORS-preflight flag is set
+      // - request’s unsafe-request flag is set and either request’s method is
+      //   not a CORS-safelisted method or CORS-unsafe request-header names with
+      //   request’s header list is not empty
+      //    1. Set request’s response tainting to "cors".
+      //    2. Let corsWithPreflightResponse be the result of running HTTP fetch
+      //    given fetchParams and true.
+      //    3. If corsWithPreflightResponse is a network error, then clear cache
+      //    entries using request.
+      //    4. Return corsWithPreflightResponse.
+      // TODO
 
       // Otherwise
-      } else {
-        //    1. Set request’s response tainting to "cors".
-        request.responseTainting = 'cors'
+      //    1. Set request’s response tainting to "cors".
+      request.responseTainting = 'cors'
 
-        //    2. Return the result of running HTTP fetch given fetchParams.
-        response = await httpFetch(fetchParams)
-      }
+      //    2. Return the result of running HTTP fetch given fetchParams.
+      return await httpFetch(fetchParams)
+    })()
+  }
+
+  // 12. If recursive is true, then return response.
+  if (recursive) {
+    return response
+  }
+
+  // 13. If response is not a network error and response is not a filtered
+  // response, then:
+  if (response.status !== 0 && !response.internalResponse) {
+    // If request’s response tainting is "cors", then:
+    if (request.responseTainting === 'cors') {
+      // 1. Let headerNames be the result of extracting header list values
+      // given `Access-Control-Expose-Headers` and response’s header list.
+      // TODO
+      // 2. If request’s credentials mode is not "include" and headerNames
+      // contains `*`, then set response’s CORS-exposed header-name list to
+      // all unique header names in response’s header list.
+      // TODO
+      // 3. Otherwise, if headerNames is not null or failure, then set
+      // response’s CORS-exposed header-name list to headerNames.
+      // TODO
     }
 
-    // 12. If recursive is true, then return response.
-    if (recursive) {
-      return response
+    // Set response to the following filtered response with response as its
+    // internal response, depending on request’s response tainting:
+    if (request.responseTainting === 'basic') {
+      response = filterResponse(response, 'basic')
+    } else if (request.responseTainting === 'cors') {
+      response = filterResponse(response, 'cors')
+    } else if (request.responseTainting === 'opaque') {
+      response = filterResponse(response, 'opaque')
+    } else {
+      assert(false)
     }
+  }
 
-    // 13. If response is not a network error and response is not a filtered
-    // response, then:
-    if (response.status !== 0 && !response.internalResponse) {
-      // If request’s response tainting is "cors", then:
-      if (request.responseTainting === 'cors') {
-        // 1. Let headerNames be the result of extracting header list values
-        // given `Access-Control-Expose-Headers` and response’s header list.
-        // TODO
-        // 2. If request’s credentials mode is not "include" and headerNames
-        // contains `*`, then set response’s CORS-exposed header-name list to
-        // all unique header names in response’s header list.
-        // TODO
-        // 3. Otherwise, if headerNames is not null or failure, then set
-        // response’s CORS-exposed header-name list to headerNames.
-        // TODO
-      }
+  // 14. Let internalResponse be response, if response is a network error,
+  // and response’s internal response otherwise.
+  let internalResponse =
+    response.status === 0 ? response : response.internalResponse
 
-      // Set response to the following filtered response with response as its
-      // internal response, depending on request’s response tainting:
-      if (request.responseTainting === 'basic') {
-        response = filterResponse(response, 'basic')
-      } else if (request.responseTainting === 'cors') {
-        response = filterResponse(response, 'cors')
-      } else if (request.responseTainting === 'opaque') {
-        response = filterResponse(response, 'opaque')
-      } else {
-        assert(false)
-      }
-    }
+  // 15. If internalResponse’s URL list is empty, then set it to a clone of
+  // request’s URL list.
+  if (internalResponse.urlList.length === 0) {
+    internalResponse.urlList.push(...request.urlList)
+  }
 
-    // 14. Let internalResponse be response, if response is a network error,
-    // and response’s internal response otherwise.
-    let internalResponse =
-      response.status === 0 ? response : response.internalResponse
+  // 16. If request’s timing allow failed flag is unset, then set
+  // internalResponse’s timing allow passed flag.
+  if (!request.timingAllowFailed) {
+    response.timingAllowPassed = true
+  }
 
-    // 15. If internalResponse’s URL list is empty, then set it to a clone of
-    // request’s URL list.
-    if (internalResponse.urlList.length === 0) {
-      internalResponse.urlList.push(...request.urlList)
-    }
+  // 17. If response is not a network error and any of the following returns
+  // blocked
+  // - should internalResponse to request be blocked as mixed content
+  // - should internalResponse to request be blocked by Content Security Policy
+  // - should internalResponse to request be blocked due to its MIME type
+  // - should internalResponse to request be blocked due to nosniff
+  // TODO
 
-    // 16. If request’s timing allow failed flag is unset, then set
-    // internalResponse’s timing allow passed flag.
-    if (!request.timingAllowFailed) {
-      response.timingAllowPassed = true
-    }
+  // 18. If response’s type is "opaque", internalResponse’s status is 206,
+  // internalResponse’s range-requested flag is set, and request’s header
+  // list does not contain `Range`, then set response and internalResponse
+  // to a network error.
+  if (
+    response.type === 'opaque' &&
+    internalResponse.status === 206 &&
+    internalResponse.rangeRequested &&
+    !request.headers.contains('range', true)
+  ) {
+    response = internalResponse = makeNetworkError()
+  }
 
-    // 17. If response is not a network error and any of the following returns
-    // blocked
-    // - should internalResponse to request be blocked as mixed content
-    // - should internalResponse to request be blocked by Content Security Policy
-    // - should internalResponse to request be blocked due to its MIME type
-    // - should internalResponse to request be blocked due to nosniff
-    // TODO
+  // 19. If response is not a network error and either request’s method is
+  // `HEAD` or `CONNECT`, or internalResponse’s status is a null body status,
+  // set internalResponse’s body to null and disregard any enqueuing toward
+  // it (if any).
+  if (
+    response.status !== 0 &&
+    (request.method === 'HEAD' ||
+      request.method === 'CONNECT' ||
+      nullBodyStatus.includes(internalResponse.status))
+  ) {
+    internalResponse.body = null
+    fetchParams.controller.dump = true
+  }
 
-    // 18. If response’s type is "opaque", internalResponse’s status is 206,
-    // internalResponse’s range-requested flag is set, and request’s header
-    // list does not contain `Range`, then set response and internalResponse
-    // to a network error.
-    if (
-      response.type === 'opaque' &&
-      internalResponse.status === 206 &&
-      internalResponse.rangeRequested &&
-      !request.headers.contains('range', true)
-    ) {
-      response = internalResponse = makeNetworkError()
-    }
+  // 20. If request’s integrity metadata is not the empty string, then:
+  if (request.integrity) {
+    // 1. Let processBodyError be this step: run fetch finale given fetchParams
+    // and a network error.
+    const processBodyError = (reason) =>
+      fetchFinale(fetchParams, makeNetworkError(reason))
 
-    // 19. If response is not a network error and either request’s method is
-    // `HEAD` or `CONNECT`, or internalResponse’s status is a null body status,
-    // set internalResponse’s body to null and disregard any enqueuing toward
-    // it (if any).
-    if (
-      response.status !== 0 &&
-      (request.method === 'HEAD' ||
-        request.method === 'CONNECT' ||
-        nullBodyStatus.includes(internalResponse.status))
-    ) {
-      internalResponse.body = null
-      fetchParams.controller.dump = true
+    // 2. If request’s response tainting is "opaque", or response’s body is null,
+    // then run processBodyError and abort these steps.
+    if (request.responseTainting === 'opaque' || response.body == null) {
+      processBodyError(response.error)
+      return
     }
 
-    // 20. If request’s integrity metadata is not the empty string, then:
-    if (request.integrity) {
-      // 1. Let processBodyError be this step: run fetch finale given fetchParams
-      // and a network error.
-      const processBodyError = (reason) =>
-        fetchFinale(fetchParams, makeNetworkError(reason))
-
-      // 2. If request’s response tainting is "opaque", or response’s body is null,
-      // then run processBodyError and abort these steps.
-      if (request.responseTainting === 'opaque' || response.body == null) {
-        processBodyError(response.error)
+    // 3. Let processBody given bytes be these steps:
+    const processBody = (bytes) => {
+      // 1. If bytes do not match request’s integrity metadata,
+      // then run processBodyError and abort these steps. [SRI]
+      if (!bytesMatch(bytes, request.integrity)) {
+        processBodyError('integrity mismatch')
         return
       }
 
-      // 3. Let processBody given bytes be these steps:
-      const processBody = (bytes) => {
-        // 1. If bytes do not match request’s integrity metadata,
-        // then run processBodyError and abort these steps. [SRI]
-        if (!bytesMatch(bytes, request.integrity)) {
-          processBodyError('integrity mismatch')
-          return
-        }
-
-        // 2. Set response’s body to bytes as a body.
-        response.body = safelyExtractBody(bytes)[0]
-
-        // 3. Run fetch finale given fetchParams and response.
-        fetchFinale(fetchParams, response)
-      }
+      // 2. Set response’s body to bytes as a body.
+      response.body = safelyExtractBody(bytes)[0]
 
-      // 4. Fully read response’s body given processBody and processBodyError.
-      fullyReadBody(response.body, processBody, processBodyError)
-    } else {
-      // 21. Otherwise, run fetch finale given fetchParams and response.
+      // 3. Run fetch finale given fetchParams and response.
       fetchFinale(fetchParams, response)
     }
-  } catch (err) {
-    fetchParams.controller.terminate(err)
+
+    // 4. Fully read response’s body given processBody and processBodyError.
+    await fullyReadBody(response.body, processBody, processBodyError)
+  } else {
+    // 21. Otherwise, run fetch finale given fetchParams and response.
+    fetchFinale(fetchParams, response)
   }
 }
 
 // https://fetch.spec.whatwg.org/#concept-scheme-fetch
 // given a fetch params fetchParams
 function schemeFetch (fetchParams) {
+  // Note: since the connection is destroyed on redirect, which sets fetchParams to a
+  // cancelled state, we do not want this condition to trigger *unless* there have been
+  // no redirects. See https://github.com/nodejs/undici/issues/1776
   // 1. If fetchParams is canceled, then return the appropriate network error for fetchParams.
-  if (isCancelled(fetchParams)) {
+  if (isCancelled(fetchParams) && fetchParams.request.redirectCount === 0) {
     return Promise.resolve(makeAppropriateNetworkError(fetchParams))
   }
 
@@ -850,7 +810,7 @@ function schemeFetch (fetchParams) {
 
       // 2. If request’s method is not `GET`, blobURLEntry is null, or blobURLEntry’s
       //    object is not a Blob object, then return a network error.
-      if (request.method !== 'GET' || !webidl.is.Blob(blob)) {
+      if (request.method !== 'GET' || !isBlobLike(blob)) {
         return Promise.resolve(makeNetworkError('invalid method'))
       }
 
@@ -928,7 +888,7 @@ function schemeFetch (fetchParams) {
 
         // 8. Let slicedBlob be the result of invoking slice blob given blob, rangeStart,
         //    rangeEnd + 1, and type.
-        const slicedBlob = blob.slice(rangeStart, rangeEnd + 1, type)
+        const slicedBlob = blob.slice(rangeStart, rangeEnd, type)
 
         // 9. Let slicedBodyWithType be the result of safely extracting slicedBlob.
         // Note: same reason as mentioned above as to why we use extractBody
@@ -1027,21 +987,21 @@ function fetchFinale (fetchParams, response) {
   //    `Server-Timing` from response’s internal response’s header list.
   // TODO
 
-  // 3. If fetchParams’s request’s destination is "document", then set fetchParams’s controller’s
-  //    full timing info to fetchParams’s timing info.
-  if (fetchParams.request.destination === 'document') {
-    fetchParams.controller.fullTimingInfo = timingInfo
-  }
-
-  // 4. Let processResponseEndOfBody be the following steps:
+  // 3. Let processResponseEndOfBody be the following steps:
   const processResponseEndOfBody = () => {
     // 1. Let unsafeEndTime be the unsafe shared current time.
     const unsafeEndTime = Date.now() // ?
 
-    // 2. Set fetchParams’s controller’s report timing steps to the following steps given a global object global:
+    // 2. If fetchParams’s request’s destination is "document", then set fetchParams’s controller’s
+    //    full timing info to fetchParams’s timing info.
+    if (fetchParams.request.destination === 'document') {
+      fetchParams.controller.fullTimingInfo = timingInfo
+    }
+
+    // 3. Set fetchParams’s controller’s report timing steps to the following steps given a global object global:
     fetchParams.controller.reportTimingSteps = () => {
       // 1. If fetchParams’s request’s URL’s scheme is not an HTTP(S) scheme, then return.
-      if (!urlIsHttpHttpsScheme(fetchParams.request.url)) {
+      if (fetchParams.request.url.protocol !== 'https:') {
         return
       }
 
@@ -1066,7 +1026,7 @@ function fetchFinale (fetchParams, response) {
       let responseStatus = 0
 
       // 7. If fetchParams’s request’s mode is not "navigate" or response’s has-cross-origin-redirects is false:
-      if (fetchParams.request.mode !== 'navigate' || !response.hasCrossOriginRedirects) {
+      if (fetchParams.request.mode !== 'navigator' || !response.hasCrossOriginRedirects) {
         // 1. Set responseStatus to response’s status.
         responseStatus = response.status
 
@@ -1083,11 +1043,12 @@ function fetchFinale (fetchParams, response) {
       //    fetchParams’s request’s URL, fetchParams’s request’s initiator type, global, cacheState, bodyInfo,
       //    and responseStatus.
       if (fetchParams.request.initiatorType != null) {
+        // TODO: update markresourcetiming
         markResourceTiming(timingInfo, fetchParams.request.url.href, fetchParams.request.initiatorType, globalThis, cacheState, bodyInfo, responseStatus)
       }
     }
 
-    // 3. Let processResponseEndOfBodyTask be the following steps:
+    // 4. Let processResponseEndOfBodyTask be the following steps:
     const processResponseEndOfBodyTask = () => {
       // 1. Set fetchParams’s request’s done flag.
       fetchParams.request.done = true
@@ -1106,11 +1067,11 @@ function fetchFinale (fetchParams, response) {
       }
     }
 
-    // 4. Queue a fetch task to run processResponseEndOfBodyTask with fetchParams’s task destination
+    // 5. Queue a fetch task to run processResponseEndOfBodyTask with fetchParams’s task destination
     queueMicrotask(() => processResponseEndOfBodyTask())
   }
 
-  // 5. If fetchParams’s process response is non-null, then queue a fetch task to run fetchParams’s
+  // 4. If fetchParams’s process response is non-null, then queue a fetch task to run fetchParams’s
   //    process response given response, with fetchParams’s task destination.
   if (fetchParams.processResponse != null) {
     queueMicrotask(() => {
@@ -1119,14 +1080,11 @@ function fetchFinale (fetchParams, response) {
     })
   }
 
-  // 6. Let internalResponse be response, if response is a network error; otherwise response’s internal response.
+  // 5. Let internalResponse be response, if response is a network error; otherwise response’s internal response.
   const internalResponse = response.type === 'error' ? response : (response.internalResponse ?? response)
 
-  // 7. If response is a network error, then run the WebDriver BiDi fetch error steps with request.
-  //    Otherwise, run the WebDriver BiDi response completed steps with request and response.
-
-  // 8. If internalResponse’s body is null, then run processResponseEndOfBody.
-  // 9. Otherwise:
+  // 6. If internalResponse’s body is null, then run processResponseEndOfBody.
+  // 7. Otherwise:
   if (internalResponse.body == null) {
     processResponseEndOfBody()
   } else {
@@ -1144,27 +1102,6 @@ function fetchFinale (fetchParams, response) {
       processResponseEndOfBody()
     })
   }
-
-  // 10. If fetchParams’s process response consume body is non-null, then:
-  if (fetchParams.processResponseConsumeBody != null) {
-    // 1. Let processBody given nullOrBytes be this step: run fetchParams’s
-    //    process response consume body given response and nullOrBytes.
-    const processBody = (nullOrBytes) => fetchParams.processResponseConsumeBody(response, nullOrBytes)
-
-    // 2. Let processBodyError be this step: run fetchParams’s process
-    //    response consume body given response and failure.
-    const processBodyError = () => fetchParams.processResponseConsumeBody(response, 'failure')
-
-    // 3. If internalResponse’s body is null, then queue a fetch task to run
-    //    processBody given null, with fetchParams’s task destination.
-    if (internalResponse.body == null) {
-      queueMicrotask(() => processBody(null))
-    } else {
-      // 4. Otherwise, fully read internalResponse’s body given processBody,
-      //    processBodyError, and fetchParams’s task destination.
-      fullyReadBody(internalResponse.body, processBody, processBodyError)
-    }
-  }
 }
 
 // https://fetch.spec.whatwg.org/#http-fetch
@@ -1240,7 +1177,7 @@ async function httpFetch (fetchParams) {
     // encouraged to, transmit an RST_STREAM frame.
     // See, https://github.com/whatwg/fetch/issues/1288
     if (request.redirect !== 'manual') {
-      fetchParams.controller.connection.destroy()
+      fetchParams.controller.connection.destroy(undefined, false)
     }
 
     // 2. Switch on request’s redirect mode:
@@ -1381,8 +1318,8 @@ function httpRedirectFetch (fetchParams, response) {
     request.headersList.delete('host', true)
   }
 
-  // 14. If request's body is non-null, then set request's body to the first return
-  // value of safely extracting request's body's source.
+  // 14. If request’s body is non-null, then set request’s body to the first return
+  // value of safely extracting request’s body’s source.
   if (request.body != null) {
     assert(request.body.source != null)
     request.body = safelyExtractBody(request.body.source)[0]
@@ -1453,16 +1390,7 @@ async function httpNetworkOrCacheFetch (
     // Otherwise:
 
     // 1. Set httpRequest to a clone of request.
-    // Implementations are encouraged to avoid teeing request’s body’s stream
-    // when request’s body’s source is null as only a single body is needed in
-    // that case. E.g., when request’s body’s source is null, redirects and
-    // authentication will end up failing the fetch.
-    if (request.body?.source != null) {
-      httpRequest = cloneRequest(request)
-    } else {
-      httpRequest = cloneRequest({ ...request, body: null })
-      httpRequest.body = request.body
-    }
+    httpRequest = cloneRequest(request)
 
     // 2. Set httpFetchParams to a copy of fetchParams.
     httpFetchParams = { ...fetchParams }
@@ -1502,10 +1430,7 @@ async function httpNetworkOrCacheFetch (
   //    8. If contentLengthHeaderValue is non-null, then append
   //    `Content-Length`/contentLengthHeaderValue to httpRequest’s header
   //    list.
-  if (
-    contentLengthHeaderValue != null &&
-    !httpRequest.headersList.contains('content-length', true)
-  ) {
+  if (contentLengthHeaderValue != null) {
     httpRequest.headersList.append('content-length', contentLengthHeaderValue, true)
   }
 
@@ -1521,7 +1446,7 @@ async function httpNetworkOrCacheFetch (
   //    11. If httpRequest’s referrer is a URL, then append
   //    `Referer`/httpRequest’s referrer, serialized and isomorphic encoded,
   //     to httpRequest’s header list.
-  if (webidl.is.URL(httpRequest.referrer)) {
+  if (httpRequest.referrer instanceof URL) {
     httpRequest.headersList.append('referer', isomorphicEncode(httpRequest.referrer.href), true)
   }
 
@@ -1535,7 +1460,7 @@ async function httpNetworkOrCacheFetch (
   //    user agents should append `User-Agent`/default `User-Agent` value to
   //    httpRequest’s header list.
   if (!httpRequest.headersList.contains('user-agent', true)) {
-    httpRequest.headersList.append('user-agent', defaultUserAgent, true)
+    httpRequest.headersList.append('user-agent', defaultUserAgent)
   }
 
   //    15. If httpRequest’s cache mode is "default" and httpRequest’s header
@@ -1591,7 +1516,7 @@ async function httpNetworkOrCacheFetch (
   //    TODO: https://github.com/whatwg/fetch/issues/1285#issuecomment-896560129
   if (!httpRequest.headersList.contains('accept-encoding', true)) {
     if (urlHasHttpsScheme(requestCurrentURL(httpRequest))) {
-      httpRequest.headersList.append('accept-encoding', 'br, gzip, deflate, zstd', true)
+      httpRequest.headersList.append('accept-encoding', 'br, gzip, deflate', true)
     } else {
       httpRequest.headersList.append('accept-encoding', 'gzip, deflate', true)
     }
@@ -1599,39 +1524,13 @@ async function httpNetworkOrCacheFetch (
 
   httpRequest.headersList.delete('host', true)
 
-  //    21. If includeCredentials is true, then:
+  //    20. If includeCredentials is true, then:
   if (includeCredentials) {
     // 1. If the user agent is not configured to block cookies for httpRequest
     // (see section 7 of [COOKIES]), then:
     // TODO: credentials
-
     // 2. If httpRequest’s header list does not contain `Authorization`, then:
-    if (!httpRequest.headersList.contains('authorization', true)) {
-      // 1. Let authorizationValue be null.
-      let authorizationValue = null
-
-      // 2. If there’s an authentication entry for httpRequest and either
-      //    httpRequest’s use-URL-credentials flag is unset or httpRequest’s
-      //    current URL does not include credentials, then set
-      //    authorizationValue to authentication entry.
-      if (hasAuthenticationEntry(httpRequest) && (
-        httpRequest.useURLCredentials === undefined || !includesCredentials(requestCurrentURL(httpRequest))
-      )) {
-        // TODO
-      } else if (includesCredentials(requestCurrentURL(httpRequest)) && isAuthenticationFetch) {
-        // 3. Otherwise, if httpRequest’s current URL does include credentials
-        //    and isAuthenticationFetch is true, set authorizationValue to
-        //    httpRequest’s current URL, converted to an `Authorization` value
-        const { username, password } = requestCurrentURL(httpRequest)
-        authorizationValue = `Basic ${Buffer.from(`${username}:${password}`).toString('base64')}`
-      }
-
-      // 4. If authorizationValue is non-null, then append (`Authorization`,
-      //    authorizationValue) to httpRequest’s header list.
-      if (authorizationValue !== null) {
-        httpRequest.headersList.append('Authorization', authorizationValue, false)
-      }
-    }
+    // TODO: credentials
   }
 
   //    21. If there’s a proxy-authentication entry, use it as appropriate.
@@ -1713,66 +1612,10 @@ async function httpNetworkOrCacheFetch (
   // 13. Set response’s request-includes-credentials to includeCredentials.
   response.requestIncludesCredentials = includeCredentials
 
-  // 14. If response’s status is 401, httpRequest’s response tainting is not "cors",
-  //     includeCredentials is true, and request’s traversable for user prompts is
-  //     a traversable navigable:
-  //
-  //     In Node.js there is no traversable navigable to prompt the user, but we
-  //     still need to handle URL-embedded credentials so authentication retries
-  //     for WebSocket handshakes continue to work.
-  if (response.status === 401 && httpRequest.responseTainting !== 'cors' && includeCredentials && (
-    request.useURLCredentials !== undefined ||
-    isTraversableNavigable(request.traversableForUserPrompts)
-  )) {
-    // 2. If request’s body is non-null, then:
-    if (request.body != null) {
-      // 1. If request’s body’s source is null, then return a network error.
-      if (request.body.source == null) {
-        // Note: In Node.js, this code path should not be reached because
-        // isTraversableNavigable() returns false for non-navigable contexts.
-        // However, we handle it gracefully by returning the response instead of
-        // a network error, as we won't actually retry the request.
-        // This aligns with the Fetch spec discussion in whatwg/fetch#1132,
-        // which allows implementations flexibility when credentials can't be obtained.
-        return response
-      }
-
-      // 2. Set request’s body to the body of the result of safely extracting
-      //    request’s body’s source.
-      request.body = safelyExtractBody(request.body.source)[0]
-    }
-
-    // 3. If request’s use-URL-credentials flag is unset or isAuthenticationFetch is
-    //    true, then:
-    if (request.useURLCredentials === undefined || isAuthenticationFetch) {
-      // 1. If fetchParams is canceled, then return the appropriate network error
-      //    for fetchParams.
-      if (isCancelled(fetchParams)) {
-        return makeAppropriateNetworkError(fetchParams)
-      }
-
-      // 2. Let username and password be the result of prompting the end user for a
-      //    username and password, respectively, in request’s traversable for user prompts.
-      // TODO
-
-      // 3. Set the username given request’s current URL and username.
-      // requestCurrentURL(request).username = TODO
-
-      // 4. Set the password given request’s current URL and password.
-      // requestCurrentURL(request).password = TODO
-
-      // In browsers, the user will be prompted to enter a username/password before the request
-      // is re-sent. To prevent an infinite 401 loop, return the response for now.
-      // https://github.com/nodejs/undici/pull/4756
-      return response
-    }
-
-    // 4. Set response to the result of running HTTP-network-or-cache fetch given
-    //    fetchParams and true.
-    fetchParams.controller.connection.destroy()
-
-    response = await httpNetworkOrCacheFetch(fetchParams, true)
-  }
+  // 14. If response’s status is 401, httpRequest’s response tainting is not
+  // "cors", includeCredentials is true, and request’s window is an environment
+  // settings object, then:
+  // TODO
 
   // 15. If response’s status is 407, then:
   if (response.status === 407) {
@@ -1849,10 +1692,12 @@ async function httpNetworkFetch (
   fetchParams.controller.connection = {
     abort: null,
     destroyed: false,
-    destroy (err) {
+    destroy (err, abort = true) {
       if (!this.destroyed) {
         this.destroyed = true
-        this.abort?.(err ?? new DOMException('The operation was aborted.', 'AbortError'))
+        if (abort) {
+          this.abort?.(err ?? new DOMException('The operation was aborted.', 'AbortError'))
+        }
       }
     }
   }
@@ -2043,8 +1888,8 @@ async function httpNetworkFetch (
 
   // 11. Let pullAlgorithm be an action that resumes the ongoing fetch
   // if it is suspended.
-  const pullAlgorithm = () => {
-    return fetchParams.controller.resume()
+  const pullAlgorithm = async () => {
+    await fetchParams.controller.resume()
   }
 
   // 12. Let cancelAlgorithm be an algorithm that aborts fetchParams’s
@@ -2070,11 +1915,15 @@ async function httpNetworkFetch (
   //     cancelAlgorithm set to cancelAlgorithm.
   const stream = new ReadableStream(
     {
-      start (controller) {
+      async start (controller) {
         fetchParams.controller.controller = controller
       },
-      pull: pullAlgorithm,
-      cancel: cancelAlgorithm,
+      async pull (controller) {
+        await pullAlgorithm(controller)
+      },
+      async cancel (reason) {
+        await cancelAlgorithm(reason)
+      },
       type: 'bytes'
     }
   )
@@ -2101,10 +1950,8 @@ async function httpNetworkFetch (
   // 19. Run these steps in parallel:
 
   //    1. Run these steps, but abort when fetchParams is canceled:
-  if (!fetchParams.controller.resume) {
-    fetchParams.controller.on('terminated', onAborted)
-  }
-
+  fetchParams.controller.onAborted = onAborted
+  fetchParams.controller.on('terminated', onAborted)
   fetchParams.controller.resume = async () => {
     // 1. While true
     while (true) {
@@ -2212,236 +2059,208 @@ async function httpNetworkFetch (
 
   function dispatch ({ body }) {
     const url = requestCurrentURL(request)
-    /** @type {import('../../..').Agent} */
+    /** @type {import('../..').Agent} */
     const agent = fetchParams.controller.dispatcher
 
-    const path = url.pathname + url.search
-    const hasTrailingQuestionMark = url.search.length === 0 && url.href[url.href.length - url.hash.length - 1] === '?'
-
-    return dispatchWithProtocolPreference(body)
-
-    function dispatchWithProtocolPreference (body, allowH2) {
-      return new Promise((resolve, reject) => agent.dispatch(
-        {
-          path: hasTrailingQuestionMark ? `${path}?` : path,
-          origin: url.origin,
-          method: request.method,
-          body: agent.isMockActive ? request.body && (request.body.source || request.body.stream) : body,
-          // Preserve the serialized fetch body for MockAgent net-connect fallthroughs.
-          __mockAgentBodyForDispatch: body,
-          headers: request.headersList.entries,
-          maxRedirections: 0,
-          upgrade: request.mode === 'websocket' ? 'websocket' : undefined,
-          ...(allowH2 === false ? { allowH2 } : null)
+    return new Promise((resolve, reject) => agent.dispatch(
+      {
+        path: url.pathname + url.search,
+        origin: url.origin,
+        method: request.method,
+        body: agent.isMockActive ? request.body && (request.body.source || request.body.stream) : body,
+        headers: request.headersList.entries,
+        maxRedirections: 0,
+        upgrade: request.mode === 'websocket' ? 'websocket' : undefined
+      },
+      {
+        body: null,
+        abort: null,
+
+        onConnect (abort) {
+          // TODO (fix): Do we need connection here?
+          const { connection } = fetchParams.controller
+
+          // Set timingInfo’s final connection timing info to the result of calling clamp and coarsen
+          // connection timing info with connection’s timing info, timingInfo’s post-redirect start
+          // time, and fetchParams’s cross-origin isolated capability.
+          // TODO: implement connection timing
+          timingInfo.finalConnectionTimingInfo = clampAndCoarsenConnectionTimingInfo(undefined, timingInfo.postRedirectStartTime, fetchParams.crossOriginIsolatedCapability)
+
+          if (connection.destroyed) {
+            abort(new DOMException('The operation was aborted.', 'AbortError'))
+          } else {
+            fetchParams.controller.on('terminated', abort)
+            this.abort = connection.abort = abort
+          }
+
+          // Set timingInfo’s final network-request start time to the coarsened shared current time given
+          // fetchParams’s cross-origin isolated capability.
+          timingInfo.finalNetworkRequestStartTime = coarsenedSharedCurrentTime(fetchParams.crossOriginIsolatedCapability)
         },
-        {
-          body: null,
-          abort: null,
-
-          onRequestStart (controller) {
-            // TODO (fix): Do we need connection here?
-            const { connection } = fetchParams.controller
-
-            // Set timingInfo’s final connection timing info to the result of calling clamp and coarsen
-            // connection timing info with connection’s timing info, timingInfo’s post-redirect start
-            // time, and fetchParams’s cross-origin isolated capability.
-            // TODO: implement connection timing
-            timingInfo.finalConnectionTimingInfo = clampAndCoarsenConnectionTimingInfo(undefined, timingInfo.postRedirectStartTime, fetchParams.crossOriginIsolatedCapability)
-
-            const abort = (reason) => controller.abort(reason)
-
-            if (connection.destroyed) {
-              abort(new DOMException('The operation was aborted.', 'AbortError'))
-            } else {
-              fetchParams.controller.on('terminated', abort)
-              this.abort = connection.abort = abort
-            }
 
-            // Set timingInfo’s final network-request start time to the coarsened shared current time given
-            // fetchParams’s cross-origin isolated capability.
-            timingInfo.finalNetworkRequestStartTime = coarsenedSharedCurrentTime(fetchParams.crossOriginIsolatedCapability)
-          },
-
-          onResponseStarted () {
-            // Set timingInfo’s final network-response start time to the coarsened shared current
-            // time given fetchParams’s cross-origin isolated capability, immediately after the
-            // user agent’s HTTP parser receives the first byte of the response (e.g., frame header
-            // bytes for HTTP/2 or response status line for HTTP/1.x).
-            timingInfo.finalNetworkResponseStartTime = coarsenedSharedCurrentTime(fetchParams.crossOriginIsolatedCapability)
-          },
-
-          onResponseStart (controller, status, headers, statusText) {
-            if (status < 200) {
-              return
-            }
+        onResponseStarted () {
+          // Set timingInfo’s final network-response start time to the coarsened shared current
+          // time given fetchParams’s cross-origin isolated capability, immediately after the
+          // user agent’s HTTP parser receives the first byte of the response (e.g., frame header
+          // bytes for HTTP/2 or response status line for HTTP/1.x).
+          timingInfo.finalNetworkResponseStartTime = coarsenedSharedCurrentTime(fetchParams.crossOriginIsolatedCapability)
+        },
 
-            const rawHeaders = controller?.rawHeaders ?? []
-            const headersList = new HeadersList()
-            appendHeadersListFromResponseHeaders(headersList, headers, rawHeaders)
-            const location = headersList.get('location', true)
+        onHeaders (status, rawHeaders, resume, statusText) {
+          if (status < 200) {
+            return
+          }
 
-            this.body = new Readable({ read: () => controller.resume() })
+          let location = ''
 
-            const willFollow = location && request.redirect === 'follow' &&
-              redirectStatusSet.has(status)
+          const headersList = new HeadersList()
 
-            const decoders = []
+          for (let i = 0; i < rawHeaders.length; i += 2) {
+            headersList.append(bufferToLowerCasedHeaderName(rawHeaders[i]), rawHeaders[i + 1].toString('latin1'), true)
+          }
+          location = headersList.get('location', true)
 
-            // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Encoding
-            if (request.method !== 'HEAD' && request.method !== 'CONNECT' && !nullBodyStatus.includes(status) && !willFollow) {
-              // https://www.rfc-editor.org/rfc/rfc7231#section-3.1.2.1
-              const contentEncoding = headersList.get('content-encoding', true)
-              // "All content-coding values are case-insensitive..."
-              /** @type {string[]} */
-              const codings = contentEncoding ? contentEncoding.toLowerCase().split(',') : []
+          this.body = new Readable({ read: resume })
 
-              // Limit the number of content-encodings to prevent resource exhaustion.
-              // CVE fix similar to urllib3 (GHSA-gm62-xv2j-4w53) and curl (CVE-2022-32206).
-              const maxContentEncodings = 5
-              if (codings.length > maxContentEncodings) {
-                reject(new Error(`too many content-encodings in response: ${codings.length}, maximum allowed is ${maxContentEncodings}`))
-                return
-              }
+          const decoders = []
 
-              for (let i = codings.length - 1; i >= 0; --i) {
-                const coding = codings[i].trim()
-                // https://www.rfc-editor.org/rfc/rfc9112.html#section-7.2
-                if (coding === 'x-gzip' || coding === 'gzip') {
-                  decoders.push(zlib.createGunzip({
-                    // Be less strict when decoding compressed responses, since sometimes
-                    // servers send slightly invalid responses that are still accepted
-                    // by common browsers.
-                    // Always using Z_SYNC_FLUSH is what cURL does.
-                    flush: zlib.constants.Z_SYNC_FLUSH,
-                    finishFlush: zlib.constants.Z_SYNC_FLUSH
-                  }))
-                } else if (coding === 'deflate') {
-                  decoders.push(createInflate({
-                    flush: zlib.constants.Z_SYNC_FLUSH,
-                    finishFlush: zlib.constants.Z_SYNC_FLUSH
-                  }))
-                } else if (coding === 'br') {
-                  decoders.push(zlib.createBrotliDecompress({
-                    flush: zlib.constants.BROTLI_OPERATION_FLUSH,
-                    finishFlush: zlib.constants.BROTLI_OPERATION_FLUSH
-                  }))
-                } else if (coding === 'zstd') {
-                  decoders.push(zlib.createZstdDecompress({
-                    flush: zlib.constants.ZSTD_e_continue,
-                    finishFlush: zlib.constants.ZSTD_e_end
-                  }))
-                } else {
-                  decoders.length = 0
-                  break
-                }
-              }
+          const willFollow = location && request.redirect === 'follow' &&
+            redirectStatusSet.has(status)
+
+          // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Encoding
+          if (request.method !== 'HEAD' && request.method !== 'CONNECT' && !nullBodyStatus.includes(status) && !willFollow) {
+            // https://www.rfc-editor.org/rfc/rfc7231#section-3.1.2.1
+            const contentEncoding = headersList.get('content-encoding', true)
+            // "All content-coding values are case-insensitive..."
+            /** @type {string[]} */
+            const codings = contentEncoding ? contentEncoding.toLowerCase().split(',') : []
+
+            // Limit the number of content-encodings to prevent resource exhaustion.
+            // CVE fix similar to urllib3 (GHSA-gm62-xv2j-4w53) and curl (CVE-2022-32206).
+            const maxContentEncodings = 5
+            if (codings.length > maxContentEncodings) {
+              reject(new Error(`too many content-encodings in response: ${codings.length}, maximum allowed is ${maxContentEncodings}`))
+              return true
             }
 
-            const onError = (err) => this.onResponseError(controller, err)
-
-            resolve({
-              status,
-              statusText,
-              headersList,
-              body: decoders.length
-                ? pipeline(this.body, ...decoders, (err) => {
-                  if (err) {
-                    this.onResponseError(controller, err)
-                  }
-                }).on('error', onError)
-                : this.body.on('error', onError)
-            })
-          },
-
-          onResponseData (controller, chunk) {
-            if (fetchParams.controller.dump) {
-              return
+            for (let i = codings.length - 1; i >= 0; --i) {
+              const coding = codings[i].trim()
+              // https://www.rfc-editor.org/rfc/rfc9112.html#section-7.2
+              if (coding === 'x-gzip' || coding === 'gzip') {
+                decoders.push(zlib.createGunzip({
+                  // Be less strict when decoding compressed responses, since sometimes
+                  // servers send slightly invalid responses that are still accepted
+                  // by common browsers.
+                  // Always using Z_SYNC_FLUSH is what cURL does.
+                  flush: zlib.constants.Z_SYNC_FLUSH,
+                  finishFlush: zlib.constants.Z_SYNC_FLUSH
+                }))
+              } else if (coding === 'deflate') {
+                decoders.push(createInflate({
+                  flush: zlib.constants.Z_SYNC_FLUSH,
+                  finishFlush: zlib.constants.Z_SYNC_FLUSH
+                }))
+              } else if (coding === 'br') {
+                decoders.push(zlib.createBrotliDecompress({
+                  flush: zlib.constants.BROTLI_OPERATION_FLUSH,
+                  finishFlush: zlib.constants.BROTLI_OPERATION_FLUSH
+                }))
+              } else {
+                decoders.length = 0
+                break
+              }
             }
+          }
 
-            // 1. If one or more bytes have been transmitted from response’s
-            // message body, then:
+          const onError = this.onError.bind(this)
 
-            //  1. Let bytes be the transmitted bytes.
-            const bytes = chunk
+          resolve({
+            status,
+            statusText,
+            headersList,
+            body: decoders.length
+              ? pipeline(this.body, ...decoders, (err) => {
+                if (err) {
+                  this.onError(err)
+                }
+              }).on('error', onError)
+              : this.body.on('error', onError)
+          })
 
-            //  2. Let codings be the result of extracting header list values
-            //  given `Content-Encoding` and response’s header list.
-            //  See pullAlgorithm.
+          return true
+        },
 
-            //  3. Increase timingInfo’s encoded body size by bytes’s length.
-            timingInfo.encodedBodySize += bytes.byteLength
+        onData (chunk) {
+          if (fetchParams.controller.dump) {
+            return
+          }
 
-            //  4. See pullAlgorithm...
+          // 1. If one or more bytes have been transmitted from response’s
+          // message body, then:
 
-            if (this.body.push(bytes) === false) {
-              controller.pause()
-            }
-          },
+          //  1. Let bytes be the transmitted bytes.
+          const bytes = chunk
 
-          onResponseEnd () {
-            if (this.abort) {
-              fetchParams.controller.off('terminated', this.abort)
-            }
+          //  2. Let codings be the result of extracting header list values
+          //  given `Content-Encoding` and response’s header list.
+          //  See pullAlgorithm.
 
-            fetchParams.controller.ended = true
+          //  3. Increase timingInfo’s encoded body size by bytes’s length.
+          timingInfo.encodedBodySize += bytes.byteLength
 
-            this.body?.push(null)
-          },
+          //  4. See pullAlgorithm...
 
-          onResponseError (controller, error) {
-            if (this.abort) {
-              fetchParams.controller.off('terminated', this.abort)
-            }
+          return this.body.push(bytes)
+        },
 
-            if (
-              request.mode === 'websocket' &&
-              allowH2 !== false &&
-              error?.code === 'UND_ERR_INFO' &&
-              error?.message === 'HTTP/2: Extended CONNECT protocol not supported by server'
-            ) {
-              // The origin negotiated H2, but RFC 8441 websocket support is unavailable.
-              // Retry the opening handshake on a fresh HTTP/1.1-only connection instead.
-              resolve(dispatchWithProtocolPreference(body, false))
-              return
-            }
+        onComplete () {
+          if (this.abort) {
+            fetchParams.controller.off('terminated', this.abort)
+          }
 
-            this.body?.destroy(error)
+          if (fetchParams.controller.onAborted) {
+            fetchParams.controller.off('terminated', fetchParams.controller.onAborted)
+          }
 
-            if (!controller?.aborted) {
-              fetchParams.controller.terminate(error)
-            }
+          fetchParams.controller.ended = true
 
-            reject(error)
-          },
-
-          onRequestUpgrade (controller, status, headers, socket) {
-            // We need to support 200 for websocket over h2 as per RFC-8441
-            // Absence of session means H1
-            if ((socket.session != null && status !== 200) || (socket.session == null && status !== 101)) {
-              if (socket.session != null) {
-                // The server refused the extended CONNECT, and nothing further
-                // will settle this request. Fail the opening handshake here.
-                controller.abort(new SocketError('bad upgrade', null))
-              }
-              return false
-            }
+          this.body.push(null)
+        },
 
-            const rawHeaders = controller?.rawHeaders ?? []
-            const headersList = new HeadersList()
-            appendHeadersListFromResponseHeaders(headersList, headers, rawHeaders)
+        onError (error) {
+          if (this.abort) {
+            fetchParams.controller.off('terminated', this.abort)
+          }
 
-            resolve({
-              status,
-              statusText: STATUS_CODES[status],
-              headersList,
-              socket
-            })
+          this.body?.destroy(error)
 
-            return true
+          fetchParams.controller.terminate(error)
+
+          reject(error)
+        },
+
+        onUpgrade (status, rawHeaders, socket) {
+          if (status !== 101) {
+            return
+          }
+
+          const headersList = new HeadersList()
+
+          for (let i = 0; i < rawHeaders.length; i += 2) {
+            headersList.append(bufferToLowerCasedHeaderName(rawHeaders[i]), rawHeaders[i + 1].toString('latin1'), true)
           }
+
+          resolve({
+            status,
+            statusText: STATUS_CODES[status],
+            headersList,
+            socket
+          })
+
+          return true
         }
-      ))
-    }
+      }
+    ))
   }
 }