@mavogel/awscdk-rootmail 0.1.2 → 0.1.4

package/node_modules/nodemailer/dist/cjs/shared/objects.js

@@ -0,0 +1,43 @@
+"use strict";
+// Safe copying of objects whose keys come from the caller.
+//
+// This lives in its own leaf module, like ./url.ts, so that every layer can reach it.
+// src/shared/index.ts imports src/fetch, so src/fetch can not import src/shared back,
+// and src/mime-funcs is a leaf that would otherwise pull in dns/net/os/fs for a string
+// comparison. src/shared/index.ts re-exports both functions for the callers that already
+// depend on it.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.copyOwnKeys = exports.isProtoKey = void 0;
+/**
+ * Detects a key that can not be copied onto a plain object with `target[key] = value`.
+ *
+ * "__proto__" is the only one: assigning it runs the inherited setter and replaces the
+ * prototype of the target instead of adding a property to it, so a caller can smuggle
+ * values past validation that only inspects own keys. JSON.parse produces such a key
+ * where an object literal can not. "constructor" and "prototype" have no such setter and
+ * become ordinary own properties, so dropping them would only discard legitimate values.
+ *
+ * @param key Key to check
+ * @returns true if the key must not be copied
+ */
+const isProtoKey = (key) => key === '__proto__';
+exports.isProtoKey = isProtoKey;
+/**
+ * Copies own enumerable keys from a source object to a target object. Every copy that
+ * walks the keys of user supplied data goes through here, see isProtoKey.
+ *
+ * @param target Object to copy the keys to
+ * @param source Object to copy the keys from
+ * @param [skip] Optional predicate, return true to leave a key out
+ * @returns The target object
+ */
+const copyOwnKeys = (target, source, skip) => {
+    Object.keys(source || {}).forEach(key => {
+        if ((0, exports.isProtoKey)(key) || (skip && skip(key))) {
+            return;
+        }
+        target[key] = source[key];
+    });
+    return target;
+};
+exports.copyOwnKeys = copyOwnKeys;

package/node_modules/nodemailer/dist/cjs/shared/url.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Parsed URL in the shape of the legacy `url.parse()` result
+ */
+export interface ParsedUrl {
+    protocol: string | null;
+    host: string | null;
+    hostname: string | null;
+    port: string | null;
+    pathname: string | null;
+    search: string | null;
+    path: string | null;
+    href: string;
+    auth: string | null;
+    /** Decoded user name, null when the URL carries no credentials */
+    username: string | null;
+    /** Decoded password, null when the URL carries none */
+    password: string | null;
+    query: string | null | Record<string, string | string[]>;
+}
+export declare const parse: (input?: string | null, parseQueryString?: boolean) => ParsedUrl;
+export declare const resolve: (from: string, to: string) => string;

package/node_modules/nodemailer/dist/cjs/shared/url.js

@@ -0,0 +1,255 @@
+"use strict";
+// URL parsing wrapper around the WHATWG `URL` class. It only falls back to the
+// legacy, deprecation-warning-emitting `url.parse()` / `url.resolve()` for input
+// the WHATWG parser rejects.
+//
+// The WHATWG `URL` exposes a different shape than the legacy parser, so results
+// are normalized back into the legacy field names the rest of the codebase reads
+// (`protocol`, `hostname`, `port`, `pathname`, `path`, `search`, `auth`, `query`,
+// `href`). This keeps every existing call site unchanged.
+//
+// Known, accepted divergences from the legacy parser:
+//  - non-special schemes (smtp:/smtps:/direct:) are not host-lowercased by
+//    WHATWG; cosmetic only, SMTP/DNS hosts are case-insensitive. (IDNA mapping
+//    and IPv6 brackets are normalized back by normalizeHostname below.)
+//  - a literal unescaped ':' inside a password is percent-encoded by WHATWG;
+//    such passwords should be percent-encoded by the caller anyway.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolve = exports.parse = void 0;
+const node_net_1 = __importDefault(require("node:net"));
+const node_url_1 = __importDefault(require("node:url"));
+const punycode = __importStar(require("../punycode/index.js"));
+// Matches a "scheme:" not followed by "//" (and with something after it), used
+// to re-insert the authority separator the legacy parser did not require.
+const SLASHLESS_AUTHORITY = /^([a-zA-Z][a-zA-Z0-9+.-]*:)(?!\/\/)([\s\S]+)$/;
+// Leading and trailing C0 controls and spaces, which the WHATWG parser strips before it
+// looks at the input. Stripped up front so that the slash-less form is recognized in a
+// value read from a file with a trailing newline as well.
+const SURROUNDING_WHITESPACE = /^[\x00-\x20]+|[\x00-\x20]+$/g;
+// Leading characters legacy url.parse() skips before it reads the scheme
+const LEGACY_TRIM = /^[\x00-\x20\u00a0\ufeff]+/;
+// The authority of a "scheme://authority/..." or a scheme-relative "//authority/..."
+// string: the scheme, if any (anything the legacy parser takes for one, it is less strict
+// than WHATWG about the first character), and what the legacy parser has to report as the
+// host once the userinfo is removed, see legacyParse. The legacy parser treats a backslash
+// as a slash.
+const AUTHORITY = /^([a-zA-Z0-9+.-]+:)?[\\/]{2}([^\\/?#]*)/;
+// The WHATWG forbidden domain code points, except '%' which an opaque host may carry: the
+// C0 control characters, space, DEL and the URL delimiters. CONTROL_CHARS is the C0 and DEL
+// subset, checked on its own in legacyParse where the host string still carries the port
+// and IPv6 brackets.
+const FORBIDDEN_HOST_CHARS = /[\x00-\x20#/:<>?@[\\\]^|\x7f]/;
+const CONTROL_CHARS = /[\x00-\x1f\x7f]/;
+// The error the WHATWG parser throws, for a host that only fails the checks in this module
+function invalidUrl(input) {
+    const err = new TypeError('Invalid URL');
+    err.code = 'ERR_INVALID_URL';
+    err.input = input;
+    return err;
+}
+// Legacy url.parse() for input the WHATWG parser refused. The legacy parser does not
+// reject a host it can not represent: a NUL byte, a percent-encoded byte, a space or a
+// '<' inside the host ends the host early and the rest becomes the path, so
+// 'localhost%00.example.com' silently turns into a request to 'localhost'. When the
+// input has an authority that the legacy parser reads as the host (always for
+// "scheme://", for "//host" only when slashesDenoteHost is set, as url.resolve() does
+// for its target), the legacy result is accepted only if that host is the whole written
+// authority, lowercased and IDNA mapped the way the legacy parser does it, and carries
+// no control character. A legacy result with a host (an empty one included, 'http:///x'
+// is a request to localhost) that no such authority accounts for is refused as well.
+// Otherwise the WHATWG error is reported. Relative input has no authority to check and
+// keeps the legacy behavior.
+function legacyParse(input, parseQueryString, whatwgError, slashesDenoteHost) {
+    const parsed = node_url_1.default.parse(input, parseQueryString, slashesDenoteHost);
+    const authority = AUTHORITY.exec(input.replace(LEGACY_TRIM, ''));
+    if (authority && (authority[1] || parsed.hostname !== null)) {
+        const written = authority[2].slice(authority[2].lastIndexOf('@') + 1);
+        if (!written || CONTROL_CHARS.test(written) || (parsed.host || '').toLowerCase() !== punycode.toASCII(written.toLowerCase())) {
+            throw whatwgError;
+        }
+        // the legacy parser takes any bracketed value for an IPv6 literal
+        if (written.charAt(0) === '[' && !node_net_1.default.isIPv6(written.slice(1, written.indexOf(']')))) {
+            throw whatwgError;
+        }
+    }
+    else if (parsed.hostname !== null) {
+        throw whatwgError;
+    }
+    // the legacy parser only offers the joined form, split it on the first colon
+    const legacyAuth = parsed.auth === null || parsed.auth === undefined ? null : parsed.auth.split(':');
+    const result = parsed;
+    result.username = legacyAuth ? legacyAuth.shift() : null;
+    result.password = legacyAuth && legacyAuth.length ? legacyAuth.join(':') : null;
+    return result;
+}
+// decodeURIComponent that never throws. Legacy url.parse() decodes the auth
+// component but tolerates malformed percent sequences, so mirror that.
+function safeDecode(str) {
+    try {
+        return decodeURIComponent(str);
+    }
+    catch (_err) {
+        return str;
+    }
+}
+// Derives the legacy-shaped bare hostname from a WHATWG URL. WHATWG keeps IPv6
+// literals bracketed ('[::1]') and, for non-special schemes (smtp:/smtps:/socks:),
+// percent-encodes a non-ASCII host instead of IDNA-mapping it. Both forms are
+// un-resolvable when handed to net/dns/http.request, which is what every call
+// site does, so map them back to what legacy url.parse() returned: the bare
+// address and the IDNA mapped (lowercased, punycode) form. Idempotent on plain
+// ASCII and already-punycode hosts, so special-scheme hosts (already IDNA-mapped
+// by WHATWG) pass through.
+function normalizeHostname(raw, href) {
+    const hostname = raw || '';
+    if (!hostname) {
+        // Host-less URL (e.g. 'direct:'): legacy returned '' here, not null;
+        // consumers do `hostname.length` / `'.' + hostname`, so keep it a string.
+        return '';
+    }
+    if (hostname.charAt(0) === '[' && hostname.charAt(hostname.length - 1) === ']') {
+        return hostname.slice(1, -1);
+    }
+    const decoded = safeDecode(hostname);
+    // domainToASCII applies the WHATWG host rules (IDNA mapping included) and returns an
+    // empty string for a host it refuses, the forbidden characters among them
+    const mapped = FORBIDDEN_HOST_CHARS.test(decoded) ? '' : node_url_1.default.domainToASCII(decoded);
+    if (!mapped) {
+        throw invalidUrl(href);
+    }
+    return mapped;
+}
+const parse = (input, parseQueryString) => {
+    input = (input || '').replace(SURROUNDING_WHITESPACE, '');
+    // Legacy url.parse() parses a "user:pass@host:port" authority that follows
+    // the scheme even without the "//" separator, for schemes outside its
+    // built-in slashed-protocol list (smtp:/smtps:/socks:/...). The WHATWG
+    // parser instead treats a scheme not followed by "//" as an opaque path.
+    // Re-insert the "//" so slash-less connection/proxy URLs keep resolving to
+    // an authority, as they did before. This assumes a slash-authority scheme,
+    // which every consumer here uses (http/https/smtp/smtps/socks/direct); an
+    // opaque scheme like mailto:/data:/tel: would be mis-split, but none reach
+    // this module.
+    const slashless = SLASHLESS_AUTHORITY.exec(input);
+    const normalized = slashless ? slashless[1] + '//' + slashless[2] : input;
+    let u;
+    try {
+        u = new URL(normalized);
+    }
+    catch (err) {
+        // WHATWG rejects some input the legacy parser tolerated (empty/relative
+        // strings, scheme-relative '//host/path', out-of-range ports, ...). Fall
+        // back to the legacy parser so behavior, including the downstream errors
+        // callers rely on, is preserved. This is the only path that can still
+        // emit a deprecation warning; it fires for anything WHATWG cannot
+        // represent, including legitimate relative URLs, not just malformed input.
+        return legacyParse(normalized, parseQueryString, err);
+    }
+    const hostname = normalizeHostname(u.hostname, u.href);
+    const port = u.port || null;
+    const pathname = u.pathname || null;
+    const search = u.search || null;
+    // Legacy `.auth` is the decoded "user[:pass]" string; WHATWG keeps the
+    // username/password percent-encoded, so decode to stay byte-compatible with
+    // existing consumers (parseConnectionUrl, Basic/Proxy-Authorization headers).
+    let auth = null;
+    let username = null;
+    let password = null;
+    if (u.username || u.password) {
+        // Gate on password too: legacy url.parse('smtps://:pass@host').auth was
+        // ':pass'. Dropping it would silently connect unauthenticated.
+        username = safeDecode(u.username);
+        password = u.password ? safeDecode(u.password) : null;
+        // the joined form is ambiguous once the user name contains a colon, so
+        // consumers that need the parts read username and password instead
+        auth = username + (password !== null ? ':' + password : '');
+    }
+    let query;
+    if (parseQueryString) {
+        // Mirror querystring.parse(): null-prototype object, repeated keys become an array.
+        const parsed = Object.create(null);
+        u.searchParams.forEach((value, key) => {
+            if (Object.prototype.hasOwnProperty.call(parsed, key)) {
+                const existing = parsed[key];
+                if (Array.isArray(existing)) {
+                    existing.push(value);
+                }
+                else {
+                    parsed[key] = [existing, value];
+                }
+            }
+            else {
+                parsed[key] = value;
+            }
+        });
+        query = parsed;
+    }
+    else {
+        query = search ? search.slice(1) : null;
+    }
+    return {
+        protocol: u.protocol || null,
+        host: u.host || null,
+        hostname,
+        port,
+        pathname,
+        search,
+        path: (pathname || '') + (search || '') || null,
+        href: u.href,
+        auth,
+        username,
+        password,
+        query
+    };
+};
+exports.parse = parse;
+const resolve = (from, to) => {
+    try {
+        return new URL(to, from).href;
+    }
+    catch (err) {
+        // Malformed target, fall back to the legacy resolver, but only when the legacy
+        // parser reads the same host out of both inputs that was written. The target
+        // decides the host when it is absolute or scheme-relative, the base otherwise
+        legacyParse(from, false, err, true);
+        legacyParse(to, false, err, true);
+        return node_url_1.default.resolve(from, to);
+    }
+};
+exports.resolve = resolve;

package/node_modules/nodemailer/dist/cjs/smtp-connection/data-stream.d.ts

@@ -0,0 +1,22 @@
+import { Transform, type TransformCallback, type TransformOptions } from 'node:stream';
+/**
+ * Escapes dots in the beginning of lines. Ends the stream with <CR><LF>.<CR><LF>
+ * Also makes sure that only <CR><LF> sequences are used for linebreaks
+ *
+ * @param options Stream options
+ */
+export default class DataStream extends Transform {
+    options: TransformOptions;
+    inByteCount: number;
+    outByteCount: number;
+    lastByte: number | false;
+    constructor(options?: TransformOptions);
+    /**
+     * Escapes dots
+     */
+    _transform(chunk: Buffer | string, encoding: BufferEncoding, done: TransformCallback): void;
+    /**
+     * Finalizes the stream with a dot on a single line
+     */
+    _flush(done: TransformCallback): void;
+}

package/node_modules/nodemailer/dist/cjs/smtp-connection/data-stream.js

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_stream_1 = require("node:stream");
+/**
+ * Escapes dots in the beginning of lines. Ends the stream with <CR><LF>.<CR><LF>
+ * Also makes sure that only <CR><LF> sequences are used for linebreaks
+ *
+ * @param options Stream options
+ */
+class DataStream extends node_stream_1.Transform {
+    constructor(options) {
+        super(options);
+        this.options = options || {};
+        this.inByteCount = 0;
+        this.outByteCount = 0;
+        this.lastByte = false;
+    }
+    /**
+     * Escapes dots
+     */
+    _transform(chunk, encoding, done) {
+        const chunks = [];
+        let chunklen = 0;
+        let i, len, lastPos = 0;
+        let buf;
+        if (!chunk || !chunk.length) {
+            return done();
+        }
+        if (typeof chunk === 'string') {
+            chunk = Buffer.from(chunk);
+        }
+        this.inByteCount += chunk.length;
+        for (i = 0, len = chunk.length; i < len; i++) {
+            if (chunk[i] === 0x2e) {
+                // .
+                if ((i && chunk[i - 1] === 0x0a) || (!i && (!this.lastByte || this.lastByte === 0x0a))) {
+                    buf = chunk.slice(lastPos, i + 1);
+                    chunks.push(buf);
+                    chunks.push(Buffer.from('.'));
+                    chunklen += buf.length + 1;
+                    lastPos = i + 1;
+                }
+            }
+            else if (chunk[i] === 0x0a) {
+                // \n
+                if ((i && chunk[i - 1] !== 0x0d) || (!i && this.lastByte !== 0x0d)) {
+                    if (i > lastPos) {
+                        buf = chunk.slice(lastPos, i);
+                        chunks.push(buf);
+                        chunklen += buf.length + 2;
+                    }
+                    else {
+                        chunklen += 2;
+                    }
+                    chunks.push(Buffer.from('\r\n'));
+                    lastPos = i + 1;
+                }
+            }
+        }
+        if (chunklen) {
+            // add last piece
+            if (lastPos < chunk.length) {
+                buf = chunk.slice(lastPos);
+                chunks.push(buf);
+                chunklen += buf.length;
+            }
+            this.outByteCount += chunklen;
+            this.push(Buffer.concat(chunks, chunklen));
+        }
+        else {
+            this.outByteCount += chunk.length;
+            this.push(chunk);
+        }
+        this.lastByte = chunk[chunk.length - 1];
+        done();
+    }
+    /**
+     * Finalizes the stream with a dot on a single line
+     */
+    _flush(done) {
+        let buf;
+        if (this.lastByte === 0x0a) {
+            buf = Buffer.from('.\r\n');
+        }
+        else if (this.lastByte === 0x0d) {
+            buf = Buffer.from('\n.\r\n');
+        }
+        else {
+            buf = Buffer.from('\r\n.\r\n');
+        }
+        this.outByteCount += buf.length;
+        this.push(buf);
+        done();
+    }
+}
+exports.default = DataStream;
+module.exports = exports.default;
+Object.defineProperty(module.exports, 'default', { value: exports.default, enumerable: false, writable: true, configurable: true });

package/node_modules/nodemailer/dist/cjs/smtp-connection/http-proxy-client.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Minimal HTTP/S proxy client
+ */
+import net from 'node:net';
+import type { NodemailerError } from '../errors.js';
+/**
+ * TLS options for connecting to an HTTPS proxy
+ */
+export interface HttpProxyClientOptions {
+    /** Set to false to accept a proxy certificate that fails validation (e.g. self-signed) */
+    rejectUnauthorized?: boolean;
+}
+/**
+ * Receives the proxied socket once the CONNECT handshake has succeeded, or the error that prevented it
+ */
+export type HttpProxyClientCallback = (err: NodemailerError | null, socket?: net.Socket) => void;
+/**
+ * Establishes proxied connection to destinationPort
+ *
+ * httpProxyClient("http://localhost:3128/", 80, "google.com", function(err, socket){
+ *     socket.write("GET / HTTP/1.0\r\n\r\n");
+ * });
+ *
+ * @param proxyUrl proxy configuration, etg "http://proxy.host:3128/"
+ * @param destinationPort Port to open in destination host
+ * @param destinationHost Destination hostname
+ * @param [tlsOptions] Optional TLS options for an HTTPS proxy (e.g. { rejectUnauthorized: false })
+ * @param callback Callback to run with the rocket object once connection is established
+ */
+declare function httpProxyClient(proxyUrl: string, destinationPort: number | string, destinationHost: string, callback: HttpProxyClientCallback): void;
+declare function httpProxyClient(proxyUrl: string, destinationPort: number | string, destinationHost: string, tlsOptions: HttpProxyClientOptions | undefined, callback: HttpProxyClientCallback): void;
+/**
+ * Socket timeout in milliseconds while the CONNECT handshake is in progress, defaults to 30 seconds.
+ * Settable on the function itself, the same way the CommonJS module exposed it.
+ */
+declare namespace httpProxyClient {
+    let timeout: number | undefined;
+}
+export default httpProxyClient;

package/node_modules/nodemailer/dist/cjs/smtp-connection/http-proxy-client.js

@@ -0,0 +1,177 @@
+"use strict";
+/**
+ * Minimal HTTP/S proxy client
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_net_1 = __importDefault(require("node:net"));
+const node_tls_1 = __importDefault(require("node:tls"));
+const urllib = __importStar(require("../shared/url.js"));
+const errors = __importStar(require("../errors.js"));
+// Cap the CONNECT response we buffer before the header terminator, so a proxy that
+// never sends \r\n\r\n cannot grow memory unboundedly before the socket times out.
+const MAX_RESPONSE_HEADER_BYTES = 64 * 1024;
+function httpProxyClient(proxyUrl, destinationPort, destinationHost, tlsOptions, callback) {
+    if (typeof tlsOptions === 'function') {
+        callback = tlsOptions;
+        tlsOptions = {};
+    }
+    tlsOptions = tlsOptions || {};
+    // Reject CRLF in the destination before it reaches the CONNECT request line
+    // and Host header. A tainted host/port could otherwise inject additional
+    // request headers into the proxy connection (HTTP request splitting).
+    destinationPort = Number(destinationPort) || 0;
+    if (!destinationPort || /[\r\n]/.test(destinationHost)) {
+        const err = new Error('Invalid proxy destination');
+        err.code = errors.EPROXY;
+        setImmediate(() => callback(err));
+        return;
+    }
+    const proxy = urllib.parse(proxyUrl);
+    const connectOptions = {
+        host: proxy.hostname,
+        port: Number(proxy.port) ? Number(proxy.port) : proxy.protocol === 'https:' ? 443 : 80
+    };
+    let connect;
+    if (proxy.protocol === 'https:') {
+        // Validate the proxy's TLS certificate by default. A caller that uses a
+        // self-signed proxy (e.g. integration tests) opts out explicitly with
+        // tls.rejectUnauthorized === false.
+        connectOptions.rejectUnauthorized = tlsOptions.rejectUnauthorized !== false;
+        connect = node_tls_1.default.connect.bind(node_tls_1.default);
+    }
+    else {
+        connect = node_net_1.default.connect.bind(node_net_1.default);
+    }
+    let socket;
+    // Error harness for initial connection. Once connection is established, the responsibility
+    // to handle errors is passed to whoever uses this socket
+    let finished = false;
+    const tempSocketErr = (err) => {
+        if (finished) {
+            return;
+        }
+        finished = true;
+        try {
+            socket.destroy();
+        }
+        catch (_E) {
+            // ignore
+        }
+        callback(err);
+    };
+    const timeoutErr = () => {
+        const err = new Error('Proxy socket timed out');
+        err.code = 'ETIMEDOUT';
+        tempSocketErr(err);
+    };
+    socket = connect(connectOptions, () => {
+        if (finished) {
+            return;
+        }
+        const reqHeaders = {
+            Host: destinationHost + ':' + destinationPort,
+            Connection: 'close'
+        };
+        if (proxy.auth) {
+            reqHeaders['Proxy-Authorization'] = 'Basic ' + Buffer.from(proxy.auth).toString('base64');
+        }
+        socket.write(
+        // HTTP method
+        'CONNECT ' +
+            destinationHost +
+            ':' +
+            destinationPort +
+            ' HTTP/1.1\r\n' +
+            // HTTP request headers
+            Object.keys(reqHeaders)
+                .map(key => key + ': ' + reqHeaders[key])
+                .join('\r\n') +
+            // End request
+            '\r\n\r\n');
+        let headers = '';
+        const onSocketData = (chunk) => {
+            let match;
+            let remainder;
+            if (finished) {
+                return;
+            }
+            headers += chunk.toString('binary');
+            if ((match = headers.match(/\r\n\r\n/))) {
+                socket.removeListener('data', onSocketData);
+                remainder = headers.substr(match.index + match[0].length);
+                headers = headers.substr(0, match.index);
+                if (remainder) {
+                    socket.unshift(Buffer.from(remainder, 'binary'));
+                }
+                // proxy connection is now established
+                finished = true;
+                // check response code
+                match = headers.match(/^HTTP\/\d+\.\d+ (\d+)/i);
+                if (!match || (match[1] || '').charAt(0) !== '2') {
+                    try {
+                        socket.destroy();
+                    }
+                    catch (_E) {
+                        // ignore
+                    }
+                    const err = new Error('Invalid response from proxy' + ((match && ': ' + match[1]) || ''));
+                    err.code = errors.EPROXY;
+                    return callback(err);
+                }
+                socket.removeListener('error', tempSocketErr);
+                socket.removeListener('timeout', timeoutErr);
+                socket.setTimeout(0);
+                return callback(null, socket);
+            }
+            if (headers.length > MAX_RESPONSE_HEADER_BYTES) {
+                socket.removeListener('data', onSocketData);
+                const err = new Error('Proxy response headers too large');
+                err.code = errors.EPROXY;
+                return tempSocketErr(err);
+            }
+        };
+        socket.on('data', onSocketData);
+    });
+    socket.setTimeout(httpProxyClient.timeout || 30 * 1000);
+    socket.on('timeout', timeoutErr);
+    socket.once('error', tempSocketErr);
+}
+exports.default = httpProxyClient;
+module.exports = exports.default;
+Object.defineProperty(module.exports, 'default', { value: exports.default, enumerable: false, writable: true, configurable: true });