fix(fetch): prefer native fetch to avoid node-fetch premature close

[orius123]

Related Issues

Related: nodejs/node#63989

Description

Problem

On Node 22.23.0 and 24.17.0 (the June 2026 security release, CVE-2026-48931 http.Agent fix), cross-fetch -> node-fetch@2.7.0 throws a false FetchError: ... Premature close [ERR_STREAM_PREMATURE_CLOSE] on keep-alive responses. Every SDK request runs through cross-fetch, so this breaks validateSession, key fetches, and management calls for any app on those runtimes (commonly hit via unpinned node:22 / node:24 base images). Node's built-in fetch (undici) is unaffected.

Fix

lib/fetch-polyfill.ts prefers the global fetch (undici, Node 18+) and falls back to cross-fetch only on older runtimes.

Behavior

• Before: keep-alive responses throw ERR_STREAM_PREMATURE_CLOSE on Node 22.23.0 / 24.17.0.
• After: requests use native fetch on Node 18+, no premature-close error. No API or config change.

Tests

• Existing suite: 22 suites / 356 tests pass.
• Verified against a keep-alive + chunked /v2/keys mock on Node 22.23.0 and 24.17.0: SDK getKey succeeds on the native path and fails on the forced cross-fetch path. Both pass on Node 24.16.0 (unaffected release).

Must

• Tests
• Documentation (if applicable)

[shuni-bot-dev]

🐕 Starting automated code review...

Analyzing changes...

[shuni-bot-dev]

🐕 Suggested Reviewers

The reviewers are selected based on recent contributions to the affected file, ensuring they are familiar with the latest changes and context. This selection covers different contributors to provide a broader review perspective with expertise directly related to the fetch polyfill.

Reviewer	Reason
nirgur	Recent contributor to lib/fetch-polyfill.ts, likely familiar with the fetch implementation and related bug fixes.
nmacianx	Contributed to the same file, indicating recent activity and expertise in the fetch polyfill.
mattolson	Contributed to the same file, bringing recent context and understanding of the code changes.
asafshen	Recent contributor to lib/fetch-polyfill.ts, capable of reviewing the latest modifications and their impact.

_{Suggested by Shuni based on git history and PR context. Names are not @-mentioned to avoid notifying anyone — request a review from whoever fits best.}