@api-client/core 0.18.12 → 0.18.13

package/build/src/runtime/http-engine/connections/DigestAuthHandler.js

@@ -0,0 +1,184 @@
+import crypto from 'node:crypto';
+/**
+ * Handles HTTP Digest authentication according to RFC 2617
+ */
+export class DigestAuthHandler {
+    logger;
+    username;
+    password;
+    nc = 1;
+    cnonce;
+    constructor(username, password, logger) {
+        this.username = username;
+        this.password = password;
+        this.logger = logger;
+        this.cnonce = this.generateCnonce();
+    }
+    /**
+     * Parse a WWW-Authenticate or Proxy-Authenticate header
+     */
+    parseChallenge(authenticateHeader) {
+        const challenge = { realm: '', nonce: '' };
+        // Extract the method (Digest)
+        const methodMatch = authenticateHeader.match(/^(\w+)/);
+        if (!methodMatch || methodMatch[1].toLowerCase() !== 'digest') {
+            throw new Error('Not a Digest authentication challenge');
+        }
+        // Parse key-value pairs (both quoted and unquoted)
+        const paramRegex = /(\w+)=(?:"([^"]*)"|([^,\s]+))/g;
+        let match;
+        while ((match = paramRegex.exec(authenticateHeader)) !== null) {
+            const [, key, quotedValue, unquotedValue] = match;
+            const value = quotedValue !== undefined ? quotedValue : unquotedValue;
+            switch (key.toLowerCase()) {
+                case 'realm':
+                    challenge.realm = value;
+                    break;
+                case 'nonce':
+                    challenge.nonce = value;
+                    break;
+                case 'qop':
+                    challenge.qop = value;
+                    break;
+                case 'algorithm':
+                    challenge.algorithm = value;
+                    break;
+                case 'opaque':
+                    challenge.opaque = value;
+                    break;
+                case 'stale':
+                    challenge.stale = value;
+                    break;
+                case 'domain':
+                    challenge.domain = value;
+                    break;
+            }
+        }
+        // Validate required fields
+        if (!challenge.realm || !challenge.nonce) {
+            throw new Error('Invalid Digest challenge: missing realm or nonce');
+        }
+        this.logger.debug('Parsed Digest challenge:', challenge);
+        return challenge;
+    }
+    /**
+     * Generate a Digest authentication response
+     */
+    generateResponse(challenge, method, uri) {
+        const algorithm = challenge.algorithm?.toLowerCase() || 'md5';
+        const qop = challenge.qop?.toLowerCase();
+        // Generate HA1 = MD5(username:realm:password)
+        const ha1 = this.calculateHA1(challenge.realm, algorithm);
+        // Generate HA2 = MD5(method:uri)
+        const ha2 = this.calculateHA2(method, uri, algorithm);
+        let response;
+        if (qop) {
+            // With quality of protection
+            const nc = this.formatNC(this.nc);
+            const cnonce = this.cnonce;
+            if (qop === 'auth') {
+                // response = MD5(HA1:nonce:nc:cnonce:qop:HA2)
+                const responseInput = `${ha1}:${challenge.nonce}:${nc}:${cnonce}:${qop}:${ha2}`;
+                response = crypto.createHash(algorithm).update(responseInput).digest('hex');
+            }
+            else {
+                throw new Error(`Unsupported qop value: ${qop}`);
+            }
+        }
+        else {
+            // Without quality of protection
+            // response = MD5(HA1:nonce:HA2)
+            const responseInput = `${ha1}:${challenge.nonce}:${ha2}`;
+            response = crypto.createHash(algorithm).update(responseInput).digest('hex');
+        }
+        // Build the response header
+        const responseParams = {
+            username: this.username,
+            realm: challenge.realm,
+            nonce: challenge.nonce,
+            uri,
+            response,
+        };
+        if (challenge.algorithm) {
+            responseParams.algorithm = challenge.algorithm;
+        }
+        if (challenge.opaque) {
+            responseParams.opaque = challenge.opaque;
+        }
+        if (qop) {
+            responseParams.qop = qop;
+            responseParams.nc = this.formatNC(this.nc);
+            responseParams.cnonce = this.cnonce;
+        }
+        const responseHeader = this.buildResponseHeader(responseParams);
+        this.logger.debug('Generated Digest response:', responseHeader);
+        // Increment nonce count for next request
+        this.nc++;
+        return responseHeader;
+    }
+    /**
+     * Calculate HA1 = MD5(username:realm:password)
+     */
+    calculateHA1(realm, algorithm) {
+        const input = `${this.username}:${realm}:${this.password}`;
+        return crypto.createHash(algorithm).update(input).digest('hex');
+    }
+    /**
+     * Calculate HA2 = MD5(method:uri)
+     */
+    calculateHA2(method, uri, algorithm) {
+        const input = `${method}:${uri}`;
+        return crypto.createHash(algorithm).update(input).digest('hex');
+    }
+    /**
+     * Generate a client nonce
+     */
+    generateCnonce() {
+        return crypto.randomBytes(16).toString('hex');
+    }
+    /**
+     * Format nonce count as 8-digit hex string
+     */
+    formatNC(nc) {
+        return nc.toString(16).padStart(8, '0');
+    }
+    /**
+     * Build the Authorization header string
+     */
+    buildResponseHeader(params) {
+        const parts = ['Digest'];
+        // Add required parameters
+        parts.push(`username="${params.username}"`);
+        parts.push(`realm="${params.realm}"`);
+        parts.push(`nonce="${params.nonce}"`);
+        parts.push(`uri="${params.uri}"`);
+        parts.push(`response="${params.response}"`);
+        // Add optional parameters
+        if (params.algorithm) {
+            parts.push(`algorithm="${params.algorithm}"`);
+        }
+        if (params.opaque) {
+            parts.push(`opaque="${params.opaque}"`);
+        }
+        if (params.qop) {
+            parts.push(`qop="${params.qop}"`);
+            parts.push(`nc="${params.nc}"`);
+            parts.push(`cnonce="${params.cnonce}"`);
+        }
+        return parts.join(', ');
+    }
+    /**
+     * Reset the nonce count (useful for new sessions)
+     */
+    reset() {
+        this.nc = 1;
+        this.cnonce = this.generateCnonce();
+    }
+    /**
+     * Check if a challenge is stale
+     */
+    isStale(challenge) {
+        return challenge.stale === 'true';
+    }
+}
+//# sourceMappingURL=DigestAuthHandler.js.map

package/build/src/runtime/http-engine/connections/DigestAuthHandler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DigestAuthHandler.js","sourceRoot":"","sources":["../../../../../src/runtime/http-engine/connections/DigestAuthHandler.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAA;AA0BhC;;GAEG;AACH,MAAM,OAAO,iBAAiB;IACpB,MAAM,CAAiB;IACvB,QAAQ,CAAQ;IAChB,QAAQ,CAAQ;IAChB,EAAE,GAAG,CAAC,CAAA;IACN,MAAM,CAAQ;IAEtB,YAAY,QAAgB,EAAE,QAAgB,EAAE,MAAuB;QACrE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAA;IACrC,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,kBAA0B;QACvC,MAAM,SAAS,GAAoB,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;QAE3D,8BAA8B;QAC9B,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QACtD,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QAC1D,CAAC;QAED,mDAAmD;QACnD,MAAM,UAAU,GAAG,gCAAgC,CAAA;QACnD,IAAI,KAAK,CAAA;QACT,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9D,MAAM,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,aAAa,CAAC,GAAG,KAAK,CAAA;YACjD,MAAM,KAAK,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAA;YAErE,QAAQ,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC1B,KAAK,OAAO;oBACV,SAAS,CAAC,KAAK,GAAG,KAAK,CAAA;oBACvB,MAAK;gBACP,KAAK,OAAO;oBACV,SAAS,CAAC,KAAK,GAAG,KAAK,CAAA;oBACvB,MAAK;gBACP,KAAK,KAAK;oBACR,SAAS,CAAC,GAAG,GAAG,KAAK,CAAA;oBACrB,MAAK;gBACP,KAAK,WAAW;oBACd,SAAS,CAAC,SAAS,GAAG,KAAK,CAAA;oBAC3B,MAAK;gBACP,KAAK,QAAQ;oBACX,SAAS,CAAC,MAAM,GAAG,KAAK,CAAA;oBACxB,MAAK;gBACP,KAAK,OAAO;oBACV,SAAS,CAAC,KAAK,GAAG,KAAK,CAAA;oBACvB,MAAK;gBACP,KAAK,QAAQ;oBACX,SAAS,CAAC,MAAM,GAAG,KAAK,CAAA;oBACxB,MAAK;YACT,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;QACrE,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE,SAAS,CAAC,CAAA;QACxD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,SAA0B,EAAE,MAAc,EAAE,GAAW;QACtE,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,KAAK,CAAA;QAC7D,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,CAAA;QAExC,8CAA8C;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;QAEzD,iCAAiC;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,CAAA;QAErD,IAAI,QAAgB,CAAA;QAEpB,IAAI,GAAG,EAAE,CAAC;YACR,6BAA6B;YAC7B,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;YAE1B,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBACnB,8CAA8C;gBAC9C,MAAM,aAAa,GAAG,GAAG,GAAG,IAAI,SAAS,CAAC,KAAK,IAAI,EAAE,IAAI,MAAM,IAAI,GAAG,IAAI,GAAG,EAAE,CAAA;gBAC/E,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAC7E,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAA;YAClD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,gCAAgC;YAChC,gCAAgC;YAChC,MAAM,aAAa,GAAG,GAAG,GAAG,IAAI,SAAS,CAAC,KAAK,IAAI,GAAG,EAAE,CAAA;YACxD,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC7E,CAAC;QAED,4BAA4B;QAC5B,MAAM,cAAc,GAAmB;YACrC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,GAAG;YACH,QAAQ;SACT,CAAA;QAED,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;YACxB,cAAc,CAAC,SAAS,GAAG,SAAS,CAAC,SAAS,CAAA;QAChD,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACrB,cAAc,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAA;QAC1C,CAAC;QAED,IAAI,GAAG,EAAE,CAAC;YACR,cAAc,CAAC,GAAG,GAAG,GAAG,CAAA;YACxB,cAAc,CAAC,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAC1C,cAAc,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QACrC,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAA;QAC/D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,cAAc,CAAC,CAAA;QAE/D,yCAAyC;QACzC,IAAI,CAAC,EAAE,EAAE,CAAA;QAET,OAAO,cAAc,CAAA;IACvB,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,KAAa,EAAE,SAAiB;QACnD,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAA;QAC1D,OAAO,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACjE,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,MAAc,EAAE,GAAW,EAAE,SAAiB;QACjE,MAAM,KAAK,GAAG,GAAG,MAAM,IAAI,GAAG,EAAE,CAAA;QAChC,OAAO,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACjE,CAAC;IAED;;OAEG;IACK,cAAc;QACpB,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC/C,CAAC;IAED;;OAEG;IACK,QAAQ,CAAC,EAAU;QACzB,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACzC,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,MAAsB;QAChD,MAAM,KAAK,GAAa,CAAC,QAAQ,CAAC,CAAA;QAElC,0BAA0B;QAC1B,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAA;QAC3C,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,GAAG,CAAC,CAAA;QACrC,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,GAAG,CAAC,CAAA;QACrC,KAAK,CAAC,IAAI,CAAC,QAAQ,MAAM,CAAC,GAAG,GAAG,CAAC,CAAA;QACjC,KAAK,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAA;QAE3C,0BAA0B;QAC1B,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC,cAAc,MAAM,CAAC,SAAS,GAAG,CAAC,CAAA;QAC/C,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,MAAM,GAAG,CAAC,CAAA;QACzC,CAAC;QAED,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,QAAQ,MAAM,CAAC,GAAG,GAAG,CAAC,CAAA;YACjC,KAAK,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;YAC/B,KAAK,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,MAAM,GAAG,CAAC,CAAA;QACzC,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,EAAE,GAAG,CAAC,CAAA;QACX,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAA;IACrC,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,SAA0B;QAChC,OAAO,SAAS,CAAC,KAAK,KAAK,MAAM,CAAA;IACnC,CAAC;CACF","sourcesContent":["import crypto from 'node:crypto'\nimport { type Logger, type ILogObj } from '../../../lib/logging/index.js'\n\nexport interface DigestChallenge {\n  realm: string\n  nonce: string\n  qop?: string\n  algorithm?: string\n  opaque?: string\n  stale?: string\n  domain?: string\n}\n\nexport interface DigestResponse {\n  username: string\n  realm: string\n  nonce: string\n  uri: string\n  response: string\n  qop?: string\n  nc?: string\n  cnonce?: string\n  algorithm?: string\n  opaque?: string\n}\n\n/**\n * Handles HTTP Digest authentication according to RFC 2617\n */\nexport class DigestAuthHandler {\n  private logger: Logger<ILogObj>\n  private username: string\n  private password: string\n  private nc = 1\n  private cnonce: string\n\n  constructor(username: string, password: string, logger: Logger<ILogObj>) {\n    this.username = username\n    this.password = password\n    this.logger = logger\n    this.cnonce = this.generateCnonce()\n  }\n\n  /**\n   * Parse a WWW-Authenticate or Proxy-Authenticate header\n   */\n  parseChallenge(authenticateHeader: string): DigestChallenge {\n    const challenge: DigestChallenge = { realm: '', nonce: '' }\n\n    // Extract the method (Digest)\n    const methodMatch = authenticateHeader.match(/^(\\w+)/)\n    if (!methodMatch || methodMatch[1].toLowerCase() !== 'digest') {\n      throw new Error('Not a Digest authentication challenge')\n    }\n\n    // Parse key-value pairs (both quoted and unquoted)\n    const paramRegex = /(\\w+)=(?:\"([^\"]*)\"|([^,\\s]+))/g\n    let match\n    while ((match = paramRegex.exec(authenticateHeader)) !== null) {\n      const [, key, quotedValue, unquotedValue] = match\n      const value = quotedValue !== undefined ? quotedValue : unquotedValue\n\n      switch (key.toLowerCase()) {\n        case 'realm':\n          challenge.realm = value\n          break\n        case 'nonce':\n          challenge.nonce = value\n          break\n        case 'qop':\n          challenge.qop = value\n          break\n        case 'algorithm':\n          challenge.algorithm = value\n          break\n        case 'opaque':\n          challenge.opaque = value\n          break\n        case 'stale':\n          challenge.stale = value\n          break\n        case 'domain':\n          challenge.domain = value\n          break\n      }\n    }\n\n    // Validate required fields\n    if (!challenge.realm || !challenge.nonce) {\n      throw new Error('Invalid Digest challenge: missing realm or nonce')\n    }\n\n    this.logger.debug('Parsed Digest challenge:', challenge)\n    return challenge\n  }\n\n  /**\n   * Generate a Digest authentication response\n   */\n  generateResponse(challenge: DigestChallenge, method: string, uri: string): string {\n    const algorithm = challenge.algorithm?.toLowerCase() || 'md5'\n    const qop = challenge.qop?.toLowerCase()\n\n    // Generate HA1 = MD5(username:realm:password)\n    const ha1 = this.calculateHA1(challenge.realm, algorithm)\n\n    // Generate HA2 = MD5(method:uri)\n    const ha2 = this.calculateHA2(method, uri, algorithm)\n\n    let response: string\n\n    if (qop) {\n      // With quality of protection\n      const nc = this.formatNC(this.nc)\n      const cnonce = this.cnonce\n\n      if (qop === 'auth') {\n        // response = MD5(HA1:nonce:nc:cnonce:qop:HA2)\n        const responseInput = `${ha1}:${challenge.nonce}:${nc}:${cnonce}:${qop}:${ha2}`\n        response = crypto.createHash(algorithm).update(responseInput).digest('hex')\n      } else {\n        throw new Error(`Unsupported qop value: ${qop}`)\n      }\n    } else {\n      // Without quality of protection\n      // response = MD5(HA1:nonce:HA2)\n      const responseInput = `${ha1}:${challenge.nonce}:${ha2}`\n      response = crypto.createHash(algorithm).update(responseInput).digest('hex')\n    }\n\n    // Build the response header\n    const responseParams: DigestResponse = {\n      username: this.username,\n      realm: challenge.realm,\n      nonce: challenge.nonce,\n      uri,\n      response,\n    }\n\n    if (challenge.algorithm) {\n      responseParams.algorithm = challenge.algorithm\n    }\n\n    if (challenge.opaque) {\n      responseParams.opaque = challenge.opaque\n    }\n\n    if (qop) {\n      responseParams.qop = qop\n      responseParams.nc = this.formatNC(this.nc)\n      responseParams.cnonce = this.cnonce\n    }\n\n    const responseHeader = this.buildResponseHeader(responseParams)\n    this.logger.debug('Generated Digest response:', responseHeader)\n\n    // Increment nonce count for next request\n    this.nc++\n\n    return responseHeader\n  }\n\n  /**\n   * Calculate HA1 = MD5(username:realm:password)\n   */\n  private calculateHA1(realm: string, algorithm: string): string {\n    const input = `${this.username}:${realm}:${this.password}`\n    return crypto.createHash(algorithm).update(input).digest('hex')\n  }\n\n  /**\n   * Calculate HA2 = MD5(method:uri)\n   */\n  private calculateHA2(method: string, uri: string, algorithm: string): string {\n    const input = `${method}:${uri}`\n    return crypto.createHash(algorithm).update(input).digest('hex')\n  }\n\n  /**\n   * Generate a client nonce\n   */\n  private generateCnonce(): string {\n    return crypto.randomBytes(16).toString('hex')\n  }\n\n  /**\n   * Format nonce count as 8-digit hex string\n   */\n  private formatNC(nc: number): string {\n    return nc.toString(16).padStart(8, '0')\n  }\n\n  /**\n   * Build the Authorization header string\n   */\n  private buildResponseHeader(params: DigestResponse): string {\n    const parts: string[] = ['Digest']\n\n    // Add required parameters\n    parts.push(`username=\"${params.username}\"`)\n    parts.push(`realm=\"${params.realm}\"`)\n    parts.push(`nonce=\"${params.nonce}\"`)\n    parts.push(`uri=\"${params.uri}\"`)\n    parts.push(`response=\"${params.response}\"`)\n\n    // Add optional parameters\n    if (params.algorithm) {\n      parts.push(`algorithm=\"${params.algorithm}\"`)\n    }\n\n    if (params.opaque) {\n      parts.push(`opaque=\"${params.opaque}\"`)\n    }\n\n    if (params.qop) {\n      parts.push(`qop=\"${params.qop}\"`)\n      parts.push(`nc=\"${params.nc}\"`)\n      parts.push(`cnonce=\"${params.cnonce}\"`)\n    }\n\n    return parts.join(', ')\n  }\n\n  /**\n   * Reset the nonce count (useful for new sessions)\n   */\n  reset(): void {\n    this.nc = 1\n    this.cnonce = this.generateCnonce()\n  }\n\n  /**\n   * Check if a challenge is stale\n   */\n  isStale(challenge: DigestChallenge): boolean {\n    return challenge.stale === 'true'\n  }\n}\n"]}

package/build/src/runtime/http-engine/connections/DirectConnection.d.ts

@@ -0,0 +1,22 @@
+import net from 'net';
+import { ConnectionOptions } from './ConnectionManager.js';
+/**
+ * Handles direct HTTP and HTTPS connections
+ */
+export declare class DirectConnection {
+    private options;
+    constructor(options: ConnectionOptions);
+    /**
+     * Establish a connection to the target host
+     */
+    connect(): Promise<net.Socket>;
+    /**
+     * Create a TCP connection for HTTP
+     */
+    private createTcpConnection;
+    /**
+     * Create a TLS connection for HTTPS
+     */
+    private createTlsConnection;
+}
+//# sourceMappingURL=DirectConnection.d.ts.map

package/build/src/runtime/http-engine/connections/DirectConnection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DirectConnection.d.ts","sourceRoot":"","sources":["../../../../../src/runtime/http-engine/connections/DirectConnection.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,KAAK,CAAA;AAErB,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAM1D;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,OAAO,CAAmB;gBAEtB,OAAO,EAAE,iBAAiB;IAItC;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;IAmBpC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA8B3B;;OAEG;IACH,OAAO,CAAC,mBAAmB;CAyD5B"}

package/build/src/runtime/http-engine/connections/DirectConnection.js

@@ -0,0 +1,105 @@
+import net from 'net';
+import tls from 'tls';
+import { addClientCertificate, checkServerIdentity } from '../certificates/index.js';
+/**
+ * Handles direct HTTP and HTTPS connections
+ */
+export class DirectConnection {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    /**
+     * Establish a connection to the target host
+     */
+    async connect() {
+        const { host, port, timeout, validateCertificates, certificates, logger, stats } = this.options;
+        let socket;
+        // Check if this is an HTTPS connection based on port or protocol
+        const isHttps = port === 443 || port === 8443 || this.options.protocol === 'https:';
+        if (isHttps) {
+            socket = await this.createTlsConnection(host, port, validateCertificates, certificates, logger, stats);
+        }
+        else {
+            socket = await this.createTcpConnection(host, port, logger, stats);
+        }
+        if (timeout && timeout > 0) {
+            socket.setTimeout(timeout);
+        }
+        return socket;
+    }
+    /**
+     * Create a TCP connection for HTTP
+     */
+    createTcpConnection(host, port, logger, stats) {
+        logger.debug(`Opening HTTP connection to ${host} on port ${port}`);
+        return new Promise((resolve, reject) => {
+            stats.connectionTime = Date.now();
+            const isIp = net.isIP(host);
+            if (isIp) {
+                stats.lookupTime = Date.now();
+            }
+            const client = net.createConnection(port, host, () => {
+                stats.connectedTime = Date.now();
+                logger.debug('HTTP connection established.');
+                resolve(client);
+            });
+            client.pause();
+            if (!isIp) {
+                client.once('lookup', () => {
+                    stats.lookupTime = Date.now();
+                });
+            }
+            client.once('error', (err) => reject(err));
+        });
+    }
+    /**
+     * Create a TLS connection for HTTPS
+     */
+    createTlsConnection(host, port, validateCertificates, certificates, logger, stats) {
+        logger.debug('Opening an SSL connection...');
+        const options = {};
+        const isIp = net.isIP(host);
+        if (!isIp) {
+            options.servername = host;
+        }
+        if (validateCertificates) {
+            options.checkServerIdentity = (hostname, cert) => checkServerIdentity(hostname, cert);
+        }
+        else {
+            options.rejectUnauthorized = false;
+            options.checkServerIdentity = () => {
+                return undefined;
+            };
+        }
+        // Add client certificates if provided
+        if (Array.isArray(certificates)) {
+            certificates.forEach((cert) => addClientCertificate(cert, options));
+        }
+        return new Promise((resolve, reject) => {
+            const time = Date.now();
+            stats.connectionTime = time;
+            if (isIp) {
+                stats.lookupTime = time;
+            }
+            const client = tls.connect(port, host, options, () => {
+                logger.debug('SSL connection established.');
+                const connectTime = Date.now();
+                stats.connectedTime = connectTime;
+                stats.secureStartTime = connectTime;
+                resolve(client);
+            });
+            client.pause();
+            client.once('error', (e) => reject(e));
+            if (!isIp) {
+                client.once('lookup', () => {
+                    stats.lookupTime = Date.now();
+                });
+            }
+            client.once('secureConnect', () => {
+                stats.secureConnectedTime = Date.now();
+            });
+        });
+    }
+}
+//# sourceMappingURL=DirectConnection.js.map

package/build/src/runtime/http-engine/connections/DirectConnection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DirectConnection.js","sourceRoot":"","sources":["../../../../../src/runtime/http-engine/connections/DirectConnection.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,KAAK,CAAA;AACrB,OAAO,GAAG,MAAM,KAAK,CAAA;AAGrB,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAIpF;;GAEG;AACH,MAAM,OAAO,gBAAgB;IACnB,OAAO,CAAmB;IAElC,YAAY,OAA0B;QACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,CAAA;QAE/F,IAAI,MAAkB,CAAA;QACtB,iEAAiE;QACjE,MAAM,OAAO,GAAG,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAA;QACnF,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;QACxG,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;QACpE,CAAC;QAED,IAAI,OAAO,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;QAC5B,CAAC;QAED,OAAO,MAAM,CAAA;IACf,CAAC;IAED;;OAEG;IACK,mBAAmB,CACzB,IAAY,EACZ,IAAY,EACZ,MAAuB,EACvB,KAAmB;QAEnB,MAAM,CAAC,KAAK,CAAC,8BAA8B,IAAI,YAAY,IAAI,EAAE,CAAC,CAAA;QAClE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YACjC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC3B,IAAI,IAAI,EAAE,CAAC;gBACT,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YAC/B,CAAC;YAED,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;gBACnD,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;gBAChC,MAAM,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAA;gBAC5C,OAAO,CAAC,MAAM,CAAC,CAAA;YACjB,CAAC,CAAC,CAAA;YAEF,MAAM,CAAC,KAAK,EAAE,CAAA;YACd,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE;oBACzB,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;gBAC/B,CAAC,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;QACnD,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;OAEG;IACK,mBAAmB,CACzB,IAAY,EACZ,IAAY,EACZ,oBAAyC,EACzC,YAA2C,EAC3C,MAAuB,EACvB,KAAmB;QAEnB,MAAM,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAA;QAC5C,MAAM,OAAO,GAA0B,EAAE,CAAA;QACzC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAE3B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,UAAU,GAAG,IAAI,CAAA;QAC3B,CAAC;QAED,IAAI,oBAAoB,EAAE,CAAC;YACzB,OAAO,CAAC,mBAAmB,GAAG,CAAC,QAAgB,EAAE,IAAyB,EAAE,EAAE,CAAC,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QACpH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,kBAAkB,GAAG,KAAK,CAAA;YAClC,OAAO,CAAC,mBAAmB,GAAG,GAAsB,EAAE;gBACpD,OAAO,SAAS,CAAA;YAClB,CAAC,CAAA;QACH,CAAC;QAED,sCAAsC;QACtC,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAChC,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;QACrE,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YACvB,KAAK,CAAC,cAAc,GAAG,IAAI,CAAA;YAC3B,IAAI,IAAI,EAAE,CAAC;gBACT,KAAK,CAAC,UAAU,GAAG,IAAI,CAAA;YACzB,CAAC;YAED,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE;gBACnD,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAA;gBAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;gBAC9B,KAAK,CAAC,aAAa,GAAG,WAAW,CAAA;gBACjC,KAAK,CAAC,eAAe,GAAG,WAAW,CAAA;gBACnC,OAAO,CAAC,MAAM,CAAC,CAAA;YACjB,CAAC,CAAC,CAAA;YAEF,MAAM,CAAC,KAAK,EAAE,CAAA;YACd,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;YAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE;oBACzB,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;gBAC/B,CAAC,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE;gBAChC,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YACxC,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;CACF","sourcesContent":["import net from 'net'\nimport tls from 'tls'\nimport { ConnectionOptions } from './ConnectionManager.js'\nimport type { HttpCertificate } from '../../../models/ClientCertificate.js'\nimport { addClientCertificate, checkServerIdentity } from '../certificates/index.js'\nimport { type Logger, type ILogObj } from '../../../lib/logging/index.js'\nimport type { RequestStats } from '../CoreEngine.js'\n\n/**\n * Handles direct HTTP and HTTPS connections\n */\nexport class DirectConnection {\n  private options: ConnectionOptions\n\n  constructor(options: ConnectionOptions) {\n    this.options = options\n  }\n\n  /**\n   * Establish a connection to the target host\n   */\n  async connect(): Promise<net.Socket> {\n    const { host, port, timeout, validateCertificates, certificates, logger, stats } = this.options\n\n    let socket: net.Socket\n    // Check if this is an HTTPS connection based on port or protocol\n    const isHttps = port === 443 || port === 8443 || this.options.protocol === 'https:'\n    if (isHttps) {\n      socket = await this.createTlsConnection(host, port, validateCertificates, certificates, logger, stats)\n    } else {\n      socket = await this.createTcpConnection(host, port, logger, stats)\n    }\n\n    if (timeout && timeout > 0) {\n      socket.setTimeout(timeout)\n    }\n\n    return socket\n  }\n\n  /**\n   * Create a TCP connection for HTTP\n   */\n  private createTcpConnection(\n    host: string,\n    port: number,\n    logger: Logger<ILogObj>,\n    stats: RequestStats\n  ): Promise<net.Socket> {\n    logger.debug(`Opening HTTP connection to ${host} on port ${port}`)\n    return new Promise((resolve, reject) => {\n      stats.connectionTime = Date.now()\n      const isIp = net.isIP(host)\n      if (isIp) {\n        stats.lookupTime = Date.now()\n      }\n\n      const client = net.createConnection(port, host, () => {\n        stats.connectedTime = Date.now()\n        logger.debug('HTTP connection established.')\n        resolve(client)\n      })\n\n      client.pause()\n      if (!isIp) {\n        client.once('lookup', () => {\n          stats.lookupTime = Date.now()\n        })\n      }\n      client.once('error', (err: Error) => reject(err))\n    })\n  }\n\n  /**\n   * Create a TLS connection for HTTPS\n   */\n  private createTlsConnection(\n    host: string,\n    port: number,\n    validateCertificates: boolean | undefined,\n    certificates: HttpCertificate[] | undefined,\n    logger: Logger<ILogObj>,\n    stats: RequestStats\n  ): Promise<tls.TLSSocket> {\n    logger.debug('Opening an SSL connection...')\n    const options: tls.ConnectionOptions = {}\n    const isIp = net.isIP(host)\n\n    if (!isIp) {\n      options.servername = host\n    }\n\n    if (validateCertificates) {\n      options.checkServerIdentity = (hostname: string, cert: tls.PeerCertificate) => checkServerIdentity(hostname, cert)\n    } else {\n      options.rejectUnauthorized = false\n      options.checkServerIdentity = (): Error | undefined => {\n        return undefined\n      }\n    }\n\n    // Add client certificates if provided\n    if (Array.isArray(certificates)) {\n      certificates.forEach((cert) => addClientCertificate(cert, options))\n    }\n\n    return new Promise((resolve, reject) => {\n      const time = Date.now()\n      stats.connectionTime = time\n      if (isIp) {\n        stats.lookupTime = time\n      }\n\n      const client = tls.connect(port, host, options, () => {\n        logger.debug('SSL connection established.')\n        const connectTime = Date.now()\n        stats.connectedTime = connectTime\n        stats.secureStartTime = connectTime\n        resolve(client)\n      })\n\n      client.pause()\n      client.once('error', (e: Error) => reject(e))\n      if (!isIp) {\n        client.once('lookup', () => {\n          stats.lookupTime = Date.now()\n        })\n      }\n      client.once('secureConnect', () => {\n        stats.secureConnectedTime = Date.now()\n      })\n    })\n  }\n}\n"]}

package/build/src/runtime/http-engine/connections/ProxyAuthHandler.d.ts

@@ -0,0 +1,60 @@
+import { type Logger, type ILogObj } from '../../../lib/logging/index.js';
+export interface ProxyAuthOptions {
+    proxyUsername?: string;
+    proxyPassword?: string;
+    /**
+     * The type of proxy authentication to use.
+     */
+    proxyAuthorization?: 'Basic';
+    logger: Logger<ILogObj>;
+}
+export interface ProxyAuthChallenge {
+    method: string;
+    realm?: string;
+    nonce?: string;
+    qop?: string;
+    algorithm?: string;
+}
+/**
+ * Handles proxy authentication challenges and responses
+ */
+export declare class ProxyAuthHandler {
+    private options;
+    private authState;
+    private challenge?;
+    private digestHandler?;
+    constructor(options: ProxyAuthOptions);
+    /**
+     * Check if we have proxy credentials configured
+     */
+    hasCredentials(): boolean;
+    /**
+     * Generate the initial proxy authorization header
+     */
+    generateAuthHeader(): string | undefined;
+    /**
+     * Handle a proxy authentication challenge
+     */
+    handleChallenge(authenticateHeader: string): string | undefined;
+    /**
+     * Parse the WWW-Authenticate or Proxy-Authenticate header
+     */
+    private parseChallenge;
+    /**
+     * Generate a Digest authentication response
+     */
+    private generateDigestResponse;
+    /**
+     * Check if authentication was successful
+     */
+    isAuthenticated(): boolean;
+    /**
+     * Mark authentication as successful
+     */
+    markAuthenticated(): void;
+    /**
+     * Reset authentication state
+     */
+    reset(): void;
+}
+//# sourceMappingURL=ProxyAuthHandler.d.ts.map

package/build/src/runtime/http-engine/connections/ProxyAuthHandler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProxyAuthHandler.d.ts","sourceRoot":"","sources":["../../../../../src/runtime/http-engine/connections/ProxyAuthHandler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,OAAO,EAAE,MAAM,+BAA+B,CAAA;AAGzE,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;OAEG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,OAAO,CAAkB;IACjC,OAAO,CAAC,SAAS,CAAkD;IACnE,OAAO,CAAC,SAAS,CAAC,CAAoB;IACtC,OAAO,CAAC,aAAa,CAAC,CAAmB;gBAE7B,OAAO,EAAE,gBAAgB;IAOrC;;OAEG;IACH,cAAc,IAAI,OAAO;IAKzB;;OAEG;IACH,kBAAkB,IAAI,MAAM,GAAG,SAAS;IAyBxC;;OAEG;IACH,eAAe,CAAC,kBAAkB,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAgB/D;;OAEG;IACH,OAAO,CAAC,cAAc;IAiCtB;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAsB9B;;OAEG;IACH,eAAe,IAAI,OAAO;IAI1B;;OAEG;IACH,iBAAiB,IAAI,IAAI;IAIzB;;OAEG;IACH,KAAK,IAAI,IAAI;CAOd"}

package/build/src/runtime/http-engine/connections/ProxyAuthHandler.js

@@ -0,0 +1,138 @@
+import { SerializableError } from '../../../models/SerializableError.js';
+import { DigestAuthHandler } from './DigestAuthHandler.js';
+/**
+ * Handles proxy authentication challenges and responses
+ */
+export class ProxyAuthHandler {
+    options;
+    authState = 'none';
+    challenge;
+    digestHandler;
+    constructor(options) {
+        this.options = options;
+        if (options.proxyUsername && options.proxyPassword) {
+            this.digestHandler = new DigestAuthHandler(options.proxyUsername, options.proxyPassword, options.logger);
+        }
+    }
+    /**
+     * Check if we have proxy credentials configured
+     */
+    hasCredentials() {
+        const { proxyUsername, proxyPassword, proxyAuthorization } = this.options;
+        return !!(proxyUsername && proxyPassword) || !!proxyAuthorization;
+    }
+    /**
+     * Generate the initial proxy authorization header
+     */
+    generateAuthHeader() {
+        const { proxyUsername, proxyPassword, proxyAuthorization } = this.options;
+        if (!proxyUsername || !proxyPassword) {
+            return undefined;
+        }
+        if (!proxyAuthorization || proxyAuthorization === 'Basic') {
+            // Basic authentication
+            const token = Buffer.from(`${proxyUsername}:${proxyPassword}`).toString('base64');
+            return `Basic ${token}`;
+        }
+        if (proxyAuthorization === 'Digest') {
+            // For Digest auth, we need a challenge first
+            if (this.authState === 'none') {
+                // Initial request without auth header
+                return undefined;
+            }
+            return this.generateDigestResponse();
+        }
+        throw new SerializableError(`Unsupported proxy authorization type: ${proxyAuthorization}`);
+    }
+    /**
+     * Handle a proxy authentication challenge
+     */
+    handleChallenge(authenticateHeader) {
+        this.authState = 'challenged';
+        this.challenge = this.parseChallenge(authenticateHeader);
+        this.options.logger.debug('Received proxy authentication challenge:', this.challenge);
+        if (this.challenge?.method === 'Basic') {
+            // For Basic auth, we can respond immediately
+            return this.generateAuthHeader();
+        }
+        else if (this.challenge?.method === 'Digest') {
+            // For Digest auth, we need to generate a proper response
+            return this.generateDigestResponse();
+        }
+        throw new SerializableError(`Unsupported proxy authentication method: ${this.challenge?.method}`);
+    }
+    /**
+     * Parse the WWW-Authenticate or Proxy-Authenticate header
+     */
+    parseChallenge(authenticateHeader) {
+        const challenge = { method: '' };
+        // Extract the method (Basic, Digest, etc.)
+        const methodMatch = authenticateHeader.match(/^(\w+)/);
+        if (methodMatch) {
+            challenge.method = methodMatch[1];
+        }
+        // Parse key-value pairs
+        const paramRegex = /(\w+)="([^"]*)"/g;
+        let match;
+        while ((match = paramRegex.exec(authenticateHeader)) !== null) {
+            const [, key, value] = match;
+            switch (key.toLowerCase()) {
+                case 'realm':
+                    challenge.realm = value;
+                    break;
+                case 'nonce':
+                    challenge.nonce = value;
+                    break;
+                case 'qop':
+                    challenge.qop = value;
+                    break;
+                case 'algorithm':
+                    challenge.algorithm = value;
+                    break;
+            }
+        }
+        return challenge;
+    }
+    /**
+     * Generate a Digest authentication response
+     */
+    generateDigestResponse() {
+        if (!this.digestHandler || !this.challenge) {
+            return undefined;
+        }
+        try {
+            // Parse the full Digest challenge
+            const digestChallenge = this.digestHandler.parseChallenge(`Digest realm="${this.challenge.realm}", nonce="${this.challenge.nonce}"${this.challenge.qop ? `, qop="${this.challenge.qop}"` : ''}${this.challenge.algorithm ? `, algorithm="${this.challenge.algorithm}"` : ''}`);
+            // Generate the response for CONNECT method
+            const response = this.digestHandler.generateResponse(digestChallenge, 'CONNECT', '/');
+            return response;
+        }
+        catch (error) {
+            this.options.logger.error('Failed to generate Digest response:', error);
+            throw new SerializableError(`Digest authentication failed: ${error.message}`, 127);
+        }
+    }
+    /**
+     * Check if authentication was successful
+     */
+    isAuthenticated() {
+        return this.authState === 'authenticated';
+    }
+    /**
+     * Mark authentication as successful
+     */
+    markAuthenticated() {
+        this.authState = 'authenticated';
+    }
+    /**
+     * Reset authentication state
+     */
+    reset() {
+        this.authState = 'none';
+        this.challenge = undefined;
+        if (this.digestHandler) {
+            this.digestHandler.reset();
+        }
+    }
+}
+//# sourceMappingURL=ProxyAuthHandler.js.map

package/build/src/runtime/http-engine/connections/ProxyAuthHandler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProxyAuthHandler.js","sourceRoot":"","sources":["../../../../../src/runtime/http-engine/connections/ProxyAuthHandler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAA;AAExE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAoB1D;;GAEG;AACH,MAAM,OAAO,gBAAgB;IACnB,OAAO,CAAkB;IACzB,SAAS,GAA4C,MAAM,CAAA;IAC3D,SAAS,CAAqB;IAC9B,aAAa,CAAoB;IAEzC,YAAY,OAAyB;QACnC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YACnD,IAAI,CAAC,aAAa,GAAG,IAAI,iBAAiB,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;QAC1G,CAAC;IACH,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC,OAAO,CAAA;QACzE,OAAO,CAAC,CAAC,CAAC,aAAa,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,kBAAkB,CAAA;IACnE,CAAC;IAED;;OAEG;IACH,kBAAkB;QAChB,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC,OAAO,CAAA;QAEzE,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,EAAE,CAAC;YACrC,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,IAAI,CAAC,kBAAkB,IAAI,kBAAkB,KAAK,OAAO,EAAE,CAAC;YAC1D,uBAAuB;YACvB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,IAAI,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YACjF,OAAO,SAAS,KAAK,EAAE,CAAA;QACzB,CAAC;QAED,IAAI,kBAAkB,KAAK,QAAQ,EAAE,CAAC;YACpC,6CAA6C;YAC7C,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;gBAC9B,sCAAsC;gBACtC,OAAO,SAAS,CAAA;YAClB,CAAC;YACD,OAAO,IAAI,CAAC,sBAAsB,EAAE,CAAA;QACtC,CAAC;QAED,MAAM,IAAI,iBAAiB,CAAC,yCAAyC,kBAAkB,EAAE,CAAC,CAAA;IAC5F,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,kBAA0B;QACxC,IAAI,CAAC,SAAS,GAAG,YAAY,CAAA;QAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAA;QACxD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;QAErF,IAAI,IAAI,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,EAAE,CAAC;YACvC,6CAA6C;YAC7C,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAA;QAClC,CAAC;aAAM,IAAI,IAAI,CAAC,SAAS,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/C,yDAAyD;YACzD,OAAO,IAAI,CAAC,sBAAsB,EAAE,CAAA;QACtC,CAAC;QAED,MAAM,IAAI,iBAAiB,CAAC,4CAA4C,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;IACnG,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,kBAA0B;QAC/C,MAAM,SAAS,GAAuB,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;QAEpD,2CAA2C;QAC3C,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QACtD,IAAI,WAAW,EAAE,CAAC;YAChB,SAAS,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;QACnC,CAAC;QAED,wBAAwB;QACxB,MAAM,UAAU,GAAG,kBAAkB,CAAA;QACrC,IAAI,KAAK,CAAA;QACT,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9D,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,KAAK,CAAA;YAC5B,QAAQ,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC1B,KAAK,OAAO;oBACV,SAAS,CAAC,KAAK,GAAG,KAAK,CAAA;oBACvB,MAAK;gBACP,KAAK,OAAO;oBACV,SAAS,CAAC,KAAK,GAAG,KAAK,CAAA;oBACvB,MAAK;gBACP,KAAK,KAAK;oBACR,SAAS,CAAC,GAAG,GAAG,KAAK,CAAA;oBACrB,MAAK;gBACP,KAAK,WAAW;oBACd,SAAS,CAAC,SAAS,GAAG,KAAK,CAAA;oBAC3B,MAAK;YACT,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAA;IAClB,CAAC;IAED;;OAEG;IACK,sBAAsB;QAC5B,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAC3C,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,IAAI,CAAC;YACH,kCAAkC;YAClC,MAAM,eAAe,GAAG,IAAI,CAAC,aAAa,CAAC,cAAc,CACvD,iBAAiB,IAAI,CAAC,SAAS,CAAC,KAAK,aAAa,IAAI,CAAC,SAAS,CAAC,KAAK,IACpE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EACzD,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACjF,CAAA;YAED,2CAA2C;YAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,eAAe,EAAE,SAAS,EAAE,GAAG,CAAC,CAAA;YACrF,OAAO,QAAQ,CAAA;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAA;YACvE,MAAM,IAAI,iBAAiB,CAAC,iCAAkC,KAAe,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAA;QAC/F,CAAC;IACH,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,IAAI,CAAC,SAAS,KAAK,eAAe,CAAA;IAC3C,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,IAAI,CAAC,SAAS,GAAG,eAAe,CAAA;IAClC,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,SAAS,GAAG,MAAM,CAAA;QACvB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;QAC1B,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAA;QAC5B,CAAC;IACH,CAAC;CACF","sourcesContent":["import { SerializableError } from '../../../models/SerializableError.js'\nimport { type Logger, type ILogObj } from '../../../lib/logging/index.js'\nimport { DigestAuthHandler } from './DigestAuthHandler.js'\n\nexport interface ProxyAuthOptions {\n  proxyUsername?: string\n  proxyPassword?: string\n  /**\n   * The type of proxy authentication to use.\n   */\n  proxyAuthorization?: 'Basic'\n  logger: Logger<ILogObj>\n}\n\nexport interface ProxyAuthChallenge {\n  method: string\n  realm?: string\n  nonce?: string\n  qop?: string\n  algorithm?: string\n}\n\n/**\n * Handles proxy authentication challenges and responses\n */\nexport class ProxyAuthHandler {\n  private options: ProxyAuthOptions\n  private authState: 'none' | 'challenged' | 'authenticated' = 'none'\n  private challenge?: ProxyAuthChallenge\n  private digestHandler?: DigestAuthHandler\n\n  constructor(options: ProxyAuthOptions) {\n    this.options = options\n    if (options.proxyUsername && options.proxyPassword) {\n      this.digestHandler = new DigestAuthHandler(options.proxyUsername, options.proxyPassword, options.logger)\n    }\n  }\n\n  /**\n   * Check if we have proxy credentials configured\n   */\n  hasCredentials(): boolean {\n    const { proxyUsername, proxyPassword, proxyAuthorization } = this.options\n    return !!(proxyUsername && proxyPassword) || !!proxyAuthorization\n  }\n\n  /**\n   * Generate the initial proxy authorization header\n   */\n  generateAuthHeader(): string | undefined {\n    const { proxyUsername, proxyPassword, proxyAuthorization } = this.options\n\n    if (!proxyUsername || !proxyPassword) {\n      return undefined\n    }\n\n    if (!proxyAuthorization || proxyAuthorization === 'Basic') {\n      // Basic authentication\n      const token = Buffer.from(`${proxyUsername}:${proxyPassword}`).toString('base64')\n      return `Basic ${token}`\n    }\n\n    if (proxyAuthorization === 'Digest') {\n      // For Digest auth, we need a challenge first\n      if (this.authState === 'none') {\n        // Initial request without auth header\n        return undefined\n      }\n      return this.generateDigestResponse()\n    }\n\n    throw new SerializableError(`Unsupported proxy authorization type: ${proxyAuthorization}`)\n  }\n\n  /**\n   * Handle a proxy authentication challenge\n   */\n  handleChallenge(authenticateHeader: string): string | undefined {\n    this.authState = 'challenged'\n    this.challenge = this.parseChallenge(authenticateHeader)\n    this.options.logger.debug('Received proxy authentication challenge:', this.challenge)\n\n    if (this.challenge?.method === 'Basic') {\n      // For Basic auth, we can respond immediately\n      return this.generateAuthHeader()\n    } else if (this.challenge?.method === 'Digest') {\n      // For Digest auth, we need to generate a proper response\n      return this.generateDigestResponse()\n    }\n\n    throw new SerializableError(`Unsupported proxy authentication method: ${this.challenge?.method}`)\n  }\n\n  /**\n   * Parse the WWW-Authenticate or Proxy-Authenticate header\n   */\n  private parseChallenge(authenticateHeader: string): ProxyAuthChallenge {\n    const challenge: ProxyAuthChallenge = { method: '' }\n\n    // Extract the method (Basic, Digest, etc.)\n    const methodMatch = authenticateHeader.match(/^(\\w+)/)\n    if (methodMatch) {\n      challenge.method = methodMatch[1]\n    }\n\n    // Parse key-value pairs\n    const paramRegex = /(\\w+)=\"([^\"]*)\"/g\n    let match\n    while ((match = paramRegex.exec(authenticateHeader)) !== null) {\n      const [, key, value] = match\n      switch (key.toLowerCase()) {\n        case 'realm':\n          challenge.realm = value\n          break\n        case 'nonce':\n          challenge.nonce = value\n          break\n        case 'qop':\n          challenge.qop = value\n          break\n        case 'algorithm':\n          challenge.algorithm = value\n          break\n      }\n    }\n\n    return challenge\n  }\n\n  /**\n   * Generate a Digest authentication response\n   */\n  private generateDigestResponse(): string | undefined {\n    if (!this.digestHandler || !this.challenge) {\n      return undefined\n    }\n\n    try {\n      // Parse the full Digest challenge\n      const digestChallenge = this.digestHandler.parseChallenge(\n        `Digest realm=\"${this.challenge.realm}\", nonce=\"${this.challenge.nonce}\"${\n          this.challenge.qop ? `, qop=\"${this.challenge.qop}\"` : ''\n        }${this.challenge.algorithm ? `, algorithm=\"${this.challenge.algorithm}\"` : ''}`\n      )\n\n      // Generate the response for CONNECT method\n      const response = this.digestHandler.generateResponse(digestChallenge, 'CONNECT', '/')\n      return response\n    } catch (error) {\n      this.options.logger.error('Failed to generate Digest response:', error)\n      throw new SerializableError(`Digest authentication failed: ${(error as Error).message}`, 127)\n    }\n  }\n\n  /**\n   * Check if authentication was successful\n   */\n  isAuthenticated(): boolean {\n    return this.authState === 'authenticated'\n  }\n\n  /**\n   * Mark authentication as successful\n   */\n  markAuthenticated(): void {\n    this.authState = 'authenticated'\n  }\n\n  /**\n   * Reset authentication state\n   */\n  reset(): void {\n    this.authState = 'none'\n    this.challenge = undefined\n    if (this.digestHandler) {\n      this.digestHandler.reset()\n    }\n  }\n}\n"]}

package/build/src/runtime/http-engine/connections/ProxyConnection.d.ts

@@ -0,0 +1,14 @@
+import net from 'net';
+import { ProxyConnectionOptions } from './ConnectionManager.js';
+/**
+ * Handles HTTP requests through a proxy server
+ */
+export declare class ProxyConnection {
+    private options;
+    constructor(options: ProxyConnectionOptions);
+    /**
+     * Establish a connection to the proxy server
+     */
+    connect(): Promise<net.Socket>;
+}
+//# sourceMappingURL=ProxyConnection.d.ts.map

package/build/src/runtime/http-engine/connections/ProxyConnection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProxyConnection.d.ts","sourceRoot":"","sources":["../../../../../src/runtime/http-engine/connections/ProxyConnection.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,KAAK,CAAA;AAErB,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAI/D;;GAEG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,OAAO,CAAwB;gBAE3B,OAAO,EAAE,sBAAsB;IAI3C;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;CAmCrC"}

package/build/src/runtime/http-engine/connections/ProxyConnection.js

@@ -0,0 +1,47 @@
+import { URL } from 'url';
+import { DirectConnection } from './DirectConnection.js';
+import { SerializableError } from '../../../models/SerializableError.js';
+/**
+ * Handles HTTP requests through a proxy server
+ */
+export class ProxyConnection {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    /**
+     * Establish a connection to the proxy server
+     */
+    async connect() {
+        const { proxy, proxyIsSsl, logger } = this.options;
+        logger.debug('Proxying an HTTP request...');
+        if (!proxy) {
+            throw new Error('No proxy configuration found.');
+        }
+        let proxyUrl = proxy;
+        if (proxyIsSsl && !proxyUrl.startsWith('https:')) {
+            proxyUrl = `https://${proxyUrl}`;
+        }
+        else if (!proxyIsSsl && !proxyUrl.startsWith('http:')) {
+            proxyUrl = `http://${proxyUrl}`;
+        }
+        const proxyUri = new URL(proxyUrl);
+        const port = Number(proxyUri.port || (proxyIsSsl ? 443 : 80));
+        const host = proxyUri.hostname;
+        // Create a direct connection to the proxy
+        const directConnection = new DirectConnection({
+            ...this.options,
+            host,
+            port,
+            protocol: proxyIsSsl ? 'https:' : 'http:',
+        });
+        try {
+            return await directConnection.connect();
+        }
+        catch (error) {
+            const err = error;
+            throw new SerializableError(`Failed to connect to proxy: ${err.message}`, err.code ? Number(err.code) : 112);
+        }
+    }
+}
+//# sourceMappingURL=ProxyConnection.js.map