@mavogel/awscdk-rootmail 0.1.2 → 0.1.4

package/node_modules/nodemailer/dist/esm/shared/objects.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Detects a key that can not be copied onto a plain object with `target[key] = value`.
+ *
+ * "__proto__" is the only one: assigning it runs the inherited setter and replaces the
+ * prototype of the target instead of adding a property to it, so a caller can smuggle
+ * values past validation that only inspects own keys. JSON.parse produces such a key
+ * where an object literal can not. "constructor" and "prototype" have no such setter and
+ * become ordinary own properties, so dropping them would only discard legitimate values.
+ *
+ * @param key Key to check
+ * @returns true if the key must not be copied
+ */
+export declare const isProtoKey: (key: string) => boolean;
+/**
+ * Copies own enumerable keys from a source object to a target object. Every copy that
+ * walks the keys of user supplied data goes through here, see isProtoKey.
+ *
+ * @param target Object to copy the keys to
+ * @param source Object to copy the keys from
+ * @param [skip] Optional predicate, return true to leave a key out
+ * @returns The target object
+ */
+export declare const copyOwnKeys: <T extends object>(target: T, source: object | null | undefined, skip?: (key: string) => boolean) => T;

package/node_modules/nodemailer/dist/esm/shared/objects.js

@@ -0,0 +1,38 @@
+// Safe copying of objects whose keys come from the caller.
+//
+// This lives in its own leaf module, like ./url.ts, so that every layer can reach it.
+// src/shared/index.ts imports src/fetch, so src/fetch can not import src/shared back,
+// and src/mime-funcs is a leaf that would otherwise pull in dns/net/os/fs for a string
+// comparison. src/shared/index.ts re-exports both functions for the callers that already
+// depend on it.
+/**
+ * Detects a key that can not be copied onto a plain object with `target[key] = value`.
+ *
+ * "__proto__" is the only one: assigning it runs the inherited setter and replaces the
+ * prototype of the target instead of adding a property to it, so a caller can smuggle
+ * values past validation that only inspects own keys. JSON.parse produces such a key
+ * where an object literal can not. "constructor" and "prototype" have no such setter and
+ * become ordinary own properties, so dropping them would only discard legitimate values.
+ *
+ * @param key Key to check
+ * @returns true if the key must not be copied
+ */
+export const isProtoKey = (key) => key === '__proto__';
+/**
+ * Copies own enumerable keys from a source object to a target object. Every copy that
+ * walks the keys of user supplied data goes through here, see isProtoKey.
+ *
+ * @param target Object to copy the keys to
+ * @param source Object to copy the keys from
+ * @param [skip] Optional predicate, return true to leave a key out
+ * @returns The target object
+ */
+export const copyOwnKeys = (target, source, skip) => {
+    Object.keys(source || {}).forEach(key => {
+        if (isProtoKey(key) || (skip && skip(key))) {
+            return;
+        }
+        target[key] = source[key];
+    });
+    return target;
+};

package/node_modules/nodemailer/dist/esm/shared/url.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Parsed URL in the shape of the legacy `url.parse()` result
+ */
+export interface ParsedUrl {
+    protocol: string | null;
+    host: string | null;
+    hostname: string | null;
+    port: string | null;
+    pathname: string | null;
+    search: string | null;
+    path: string | null;
+    href: string;
+    auth: string | null;
+    /** Decoded user name, null when the URL carries no credentials */
+    username: string | null;
+    /** Decoded password, null when the URL carries none */
+    password: string | null;
+    query: string | null | Record<string, string | string[]>;
+}
+export declare const parse: (input?: string | null, parseQueryString?: boolean) => ParsedUrl;
+export declare const resolve: (from: string, to: string) => string;

package/node_modules/nodemailer/dist/esm/shared/url.js

@@ -0,0 +1,214 @@
+// URL parsing wrapper around the WHATWG `URL` class. It only falls back to the
+// legacy, deprecation-warning-emitting `url.parse()` / `url.resolve()` for input
+// the WHATWG parser rejects.
+//
+// The WHATWG `URL` exposes a different shape than the legacy parser, so results
+// are normalized back into the legacy field names the rest of the codebase reads
+// (`protocol`, `hostname`, `port`, `pathname`, `path`, `search`, `auth`, `query`,
+// `href`). This keeps every existing call site unchanged.
+//
+// Known, accepted divergences from the legacy parser:
+//  - non-special schemes (smtp:/smtps:/direct:) are not host-lowercased by
+//    WHATWG; cosmetic only, SMTP/DNS hosts are case-insensitive. (IDNA mapping
+//    and IPv6 brackets are normalized back by normalizeHostname below.)
+//  - a literal unescaped ':' inside a password is percent-encoded by WHATWG;
+//    such passwords should be percent-encoded by the caller anyway.
+import net from 'node:net';
+import urllib from 'node:url';
+import * as punycode from '../punycode/index.js';
+// Matches a "scheme:" not followed by "//" (and with something after it), used
+// to re-insert the authority separator the legacy parser did not require.
+const SLASHLESS_AUTHORITY = /^([a-zA-Z][a-zA-Z0-9+.-]*:)(?!\/\/)([\s\S]+)$/;
+// Leading and trailing C0 controls and spaces, which the WHATWG parser strips before it
+// looks at the input. Stripped up front so that the slash-less form is recognized in a
+// value read from a file with a trailing newline as well.
+const SURROUNDING_WHITESPACE = /^[\x00-\x20]+|[\x00-\x20]+$/g;
+// Leading characters legacy url.parse() skips before it reads the scheme
+const LEGACY_TRIM = /^[\x00-\x20\u00a0\ufeff]+/;
+// The authority of a "scheme://authority/..." or a scheme-relative "//authority/..."
+// string: the scheme, if any (anything the legacy parser takes for one, it is less strict
+// than WHATWG about the first character), and what the legacy parser has to report as the
+// host once the userinfo is removed, see legacyParse. The legacy parser treats a backslash
+// as a slash.
+const AUTHORITY = /^([a-zA-Z0-9+.-]+:)?[\\/]{2}([^\\/?#]*)/;
+// The WHATWG forbidden domain code points, except '%' which an opaque host may carry: the
+// C0 control characters, space, DEL and the URL delimiters. CONTROL_CHARS is the C0 and DEL
+// subset, checked on its own in legacyParse where the host string still carries the port
+// and IPv6 brackets.
+const FORBIDDEN_HOST_CHARS = /[\x00-\x20#/:<>?@[\\\]^|\x7f]/;
+const CONTROL_CHARS = /[\x00-\x1f\x7f]/;
+// The error the WHATWG parser throws, for a host that only fails the checks in this module
+function invalidUrl(input) {
+    const err = new TypeError('Invalid URL');
+    err.code = 'ERR_INVALID_URL';
+    err.input = input;
+    return err;
+}
+// Legacy url.parse() for input the WHATWG parser refused. The legacy parser does not
+// reject a host it can not represent: a NUL byte, a percent-encoded byte, a space or a
+// '<' inside the host ends the host early and the rest becomes the path, so
+// 'localhost%00.example.com' silently turns into a request to 'localhost'. When the
+// input has an authority that the legacy parser reads as the host (always for
+// "scheme://", for "//host" only when slashesDenoteHost is set, as url.resolve() does
+// for its target), the legacy result is accepted only if that host is the whole written
+// authority, lowercased and IDNA mapped the way the legacy parser does it, and carries
+// no control character. A legacy result with a host (an empty one included, 'http:///x'
+// is a request to localhost) that no such authority accounts for is refused as well.
+// Otherwise the WHATWG error is reported. Relative input has no authority to check and
+// keeps the legacy behavior.
+function legacyParse(input, parseQueryString, whatwgError, slashesDenoteHost) {
+    const parsed = urllib.parse(input, parseQueryString, slashesDenoteHost);
+    const authority = AUTHORITY.exec(input.replace(LEGACY_TRIM, ''));
+    if (authority && (authority[1] || parsed.hostname !== null)) {
+        const written = authority[2].slice(authority[2].lastIndexOf('@') + 1);
+        if (!written || CONTROL_CHARS.test(written) || (parsed.host || '').toLowerCase() !== punycode.toASCII(written.toLowerCase())) {
+            throw whatwgError;
+        }
+        // the legacy parser takes any bracketed value for an IPv6 literal
+        if (written.charAt(0) === '[' && !net.isIPv6(written.slice(1, written.indexOf(']')))) {
+            throw whatwgError;
+        }
+    }
+    else if (parsed.hostname !== null) {
+        throw whatwgError;
+    }
+    // the legacy parser only offers the joined form, split it on the first colon
+    const legacyAuth = parsed.auth === null || parsed.auth === undefined ? null : parsed.auth.split(':');
+    const result = parsed;
+    result.username = legacyAuth ? legacyAuth.shift() : null;
+    result.password = legacyAuth && legacyAuth.length ? legacyAuth.join(':') : null;
+    return result;
+}
+// decodeURIComponent that never throws. Legacy url.parse() decodes the auth
+// component but tolerates malformed percent sequences, so mirror that.
+function safeDecode(str) {
+    try {
+        return decodeURIComponent(str);
+    }
+    catch (_err) {
+        return str;
+    }
+}
+// Derives the legacy-shaped bare hostname from a WHATWG URL. WHATWG keeps IPv6
+// literals bracketed ('[::1]') and, for non-special schemes (smtp:/smtps:/socks:),
+// percent-encodes a non-ASCII host instead of IDNA-mapping it. Both forms are
+// un-resolvable when handed to net/dns/http.request, which is what every call
+// site does, so map them back to what legacy url.parse() returned: the bare
+// address and the IDNA mapped (lowercased, punycode) form. Idempotent on plain
+// ASCII and already-punycode hosts, so special-scheme hosts (already IDNA-mapped
+// by WHATWG) pass through.
+function normalizeHostname(raw, href) {
+    const hostname = raw || '';
+    if (!hostname) {
+        // Host-less URL (e.g. 'direct:'): legacy returned '' here, not null;
+        // consumers do `hostname.length` / `'.' + hostname`, so keep it a string.
+        return '';
+    }
+    if (hostname.charAt(0) === '[' && hostname.charAt(hostname.length - 1) === ']') {
+        return hostname.slice(1, -1);
+    }
+    const decoded = safeDecode(hostname);
+    // domainToASCII applies the WHATWG host rules (IDNA mapping included) and returns an
+    // empty string for a host it refuses, the forbidden characters among them
+    const mapped = FORBIDDEN_HOST_CHARS.test(decoded) ? '' : urllib.domainToASCII(decoded);
+    if (!mapped) {
+        throw invalidUrl(href);
+    }
+    return mapped;
+}
+export const parse = (input, parseQueryString) => {
+    input = (input || '').replace(SURROUNDING_WHITESPACE, '');
+    // Legacy url.parse() parses a "user:pass@host:port" authority that follows
+    // the scheme even without the "//" separator, for schemes outside its
+    // built-in slashed-protocol list (smtp:/smtps:/socks:/...). The WHATWG
+    // parser instead treats a scheme not followed by "//" as an opaque path.
+    // Re-insert the "//" so slash-less connection/proxy URLs keep resolving to
+    // an authority, as they did before. This assumes a slash-authority scheme,
+    // which every consumer here uses (http/https/smtp/smtps/socks/direct); an
+    // opaque scheme like mailto:/data:/tel: would be mis-split, but none reach
+    // this module.
+    const slashless = SLASHLESS_AUTHORITY.exec(input);
+    const normalized = slashless ? slashless[1] + '//' + slashless[2] : input;
+    let u;
+    try {
+        u = new URL(normalized);
+    }
+    catch (err) {
+        // WHATWG rejects some input the legacy parser tolerated (empty/relative
+        // strings, scheme-relative '//host/path', out-of-range ports, ...). Fall
+        // back to the legacy parser so behavior, including the downstream errors
+        // callers rely on, is preserved. This is the only path that can still
+        // emit a deprecation warning; it fires for anything WHATWG cannot
+        // represent, including legitimate relative URLs, not just malformed input.
+        return legacyParse(normalized, parseQueryString, err);
+    }
+    const hostname = normalizeHostname(u.hostname, u.href);
+    const port = u.port || null;
+    const pathname = u.pathname || null;
+    const search = u.search || null;
+    // Legacy `.auth` is the decoded "user[:pass]" string; WHATWG keeps the
+    // username/password percent-encoded, so decode to stay byte-compatible with
+    // existing consumers (parseConnectionUrl, Basic/Proxy-Authorization headers).
+    let auth = null;
+    let username = null;
+    let password = null;
+    if (u.username || u.password) {
+        // Gate on password too: legacy url.parse('smtps://:pass@host').auth was
+        // ':pass'. Dropping it would silently connect unauthenticated.
+        username = safeDecode(u.username);
+        password = u.password ? safeDecode(u.password) : null;
+        // the joined form is ambiguous once the user name contains a colon, so
+        // consumers that need the parts read username and password instead
+        auth = username + (password !== null ? ':' + password : '');
+    }
+    let query;
+    if (parseQueryString) {
+        // Mirror querystring.parse(): null-prototype object, repeated keys become an array.
+        const parsed = Object.create(null);
+        u.searchParams.forEach((value, key) => {
+            if (Object.prototype.hasOwnProperty.call(parsed, key)) {
+                const existing = parsed[key];
+                if (Array.isArray(existing)) {
+                    existing.push(value);
+                }
+                else {
+                    parsed[key] = [existing, value];
+                }
+            }
+            else {
+                parsed[key] = value;
+            }
+        });
+        query = parsed;
+    }
+    else {
+        query = search ? search.slice(1) : null;
+    }
+    return {
+        protocol: u.protocol || null,
+        host: u.host || null,
+        hostname,
+        port,
+        pathname,
+        search,
+        path: (pathname || '') + (search || '') || null,
+        href: u.href,
+        auth,
+        username,
+        password,
+        query
+    };
+};
+export const resolve = (from, to) => {
+    try {
+        return new URL(to, from).href;
+    }
+    catch (err) {
+        // Malformed target, fall back to the legacy resolver, but only when the legacy
+        // parser reads the same host out of both inputs that was written. The target
+        // decides the host when it is absolute or scheme-relative, the base otherwise
+        legacyParse(from, false, err, true);
+        legacyParse(to, false, err, true);
+        return urllib.resolve(from, to);
+    }
+};

package/node_modules/nodemailer/dist/esm/smtp-connection/data-stream.d.ts

@@ -0,0 +1,22 @@
+import { Transform, type TransformCallback, type TransformOptions } from 'node:stream';
+/**
+ * Escapes dots in the beginning of lines. Ends the stream with <CR><LF>.<CR><LF>
+ * Also makes sure that only <CR><LF> sequences are used for linebreaks
+ *
+ * @param options Stream options
+ */
+export default class DataStream extends Transform {
+    options: TransformOptions;
+    inByteCount: number;
+    outByteCount: number;
+    lastByte: number | false;
+    constructor(options?: TransformOptions);
+    /**
+     * Escapes dots
+     */
+    _transform(chunk: Buffer | string, encoding: BufferEncoding, done: TransformCallback): void;
+    /**
+     * Finalizes the stream with a dot on a single line
+     */
+    _flush(done: TransformCallback): void;
+}

package/node_modules/nodemailer/{lib → dist/esm}/smtp-connection/data-stream.js

@@ -1,44 +1,33 @@
-'use strict';
-
-const { Transform } = require('stream');
-
+import { Transform } from 'node:stream';
 /**
  * Escapes dots in the beginning of lines. Ends the stream with <CR><LF>.<CR><LF>
  * Also makes sure that only <CR><LF> sequences are used for linebreaks
  *
- * @param {Object} options Stream options
+ * @param options Stream options
  */
-class DataStream extends Transform {
+export default class DataStream extends Transform {
     constructor(options) {
         super(options);
         this.options = options || {};
-
         this.inByteCount = 0;
         this.outByteCount = 0;
         this.lastByte = false;
     }
-
     /**
      * Escapes dots
      */
     _transform(chunk, encoding, done) {
         const chunks = [];
         let chunklen = 0;
-        let i,
-            len,
-            lastPos = 0;
+        let i, len, lastPos = 0;
         let buf;
-
         if (!chunk || !chunk.length) {
             return done();
         }
-
         if (typeof chunk === 'string') {
             chunk = Buffer.from(chunk);
         }
-
         this.inByteCount += chunk.length;
-
         for (i = 0, len = chunk.length; i < len; i++) {
             if (chunk[i] === 0x2e) {
                 // .
@@ -49,14 +38,16 @@ class DataStream extends Transform {
                     chunklen += buf.length + 1;
                     lastPos = i + 1;
                 }
-            } else if (chunk[i] === 0x0a) {
+            }
+            else if (chunk[i] === 0x0a) {
                 // \n
                 if ((i && chunk[i - 1] !== 0x0d) || (!i && this.lastByte !== 0x0d)) {
                     if (i > lastPos) {
                         buf = chunk.slice(lastPos, i);
                         chunks.push(buf);
                         chunklen += buf.length + 2;
-                    } else {
+                    }
+                    else {
                         chunklen += 2;
                     }
                     chunks.push(Buffer.from('\r\n'));
@@ -64,7 +55,6 @@ class DataStream extends Transform {
                 }
             }
         }
-
         if (chunklen) {
             // add last piece
             if (lastPos < chunk.length) {
@@ -72,18 +62,16 @@ class DataStream extends Transform {
                 chunks.push(buf);
                 chunklen += buf.length;
             }
-
             this.outByteCount += chunklen;
             this.push(Buffer.concat(chunks, chunklen));
-        } else {
+        }
+        else {
             this.outByteCount += chunk.length;
             this.push(chunk);
         }
-
         this.lastByte = chunk[chunk.length - 1];
         done();
     }
-
     /**
      * Finalizes the stream with a dot on a single line
      */
@@ -91,9 +79,11 @@ class DataStream extends Transform {
         let buf;
         if (this.lastByte === 0x0a) {
             buf = Buffer.from('.\r\n');
-        } else if (this.lastByte === 0x0d) {
+        }
+        else if (this.lastByte === 0x0d) {
             buf = Buffer.from('\n.\r\n');
-        } else {
+        }
+        else {
             buf = Buffer.from('\r\n.\r\n');
         }
         this.outByteCount += buf.length;
@@ -101,5 +91,3 @@ class DataStream extends Transform {
         done();
     }
 }
-
-module.exports = DataStream;

package/node_modules/nodemailer/dist/esm/smtp-connection/http-proxy-client.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Minimal HTTP/S proxy client
+ */
+import net from 'node:net';
+import type { NodemailerError } from '../errors.js';
+/**
+ * TLS options for connecting to an HTTPS proxy
+ */
+export interface HttpProxyClientOptions {
+    /** Set to false to accept a proxy certificate that fails validation (e.g. self-signed) */
+    rejectUnauthorized?: boolean;
+}
+/**
+ * Receives the proxied socket once the CONNECT handshake has succeeded, or the error that prevented it
+ */
+export type HttpProxyClientCallback = (err: NodemailerError | null, socket?: net.Socket) => void;
+/**
+ * Establishes proxied connection to destinationPort
+ *
+ * httpProxyClient("http://localhost:3128/", 80, "google.com", function(err, socket){
+ *     socket.write("GET / HTTP/1.0\r\n\r\n");
+ * });
+ *
+ * @param proxyUrl proxy configuration, etg "http://proxy.host:3128/"
+ * @param destinationPort Port to open in destination host
+ * @param destinationHost Destination hostname
+ * @param [tlsOptions] Optional TLS options for an HTTPS proxy (e.g. { rejectUnauthorized: false })
+ * @param callback Callback to run with the rocket object once connection is established
+ */
+declare function httpProxyClient(proxyUrl: string, destinationPort: number | string, destinationHost: string, callback: HttpProxyClientCallback): void;
+declare function httpProxyClient(proxyUrl: string, destinationPort: number | string, destinationHost: string, tlsOptions: HttpProxyClientOptions | undefined, callback: HttpProxyClientCallback): void;
+/**
+ * Socket timeout in milliseconds while the CONNECT handshake is in progress, defaults to 30 seconds.
+ * Settable on the function itself, the same way the CommonJS module exposed it.
+ */
+declare namespace httpProxyClient {
+    let timeout: number | undefined;
+}
+export default httpProxyClient;

package/node_modules/nodemailer/{lib → dist/esm}/smtp-connection/http-proxy-client.js

@@ -1,38 +1,19 @@
-'use strict';
-
 /**
  * Minimal HTTP/S proxy client
  */
-
-const net = require('net');
-const tls = require('tls');
-const urllib = require('../shared/url');
-const errors = require('../errors');
-
+import net from 'node:net';
+import tls from 'node:tls';
+import * as urllib from '../shared/url.js';
+import * as errors from '../errors.js';
 // Cap the CONNECT response we buffer before the header terminator, so a proxy that
 // never sends \r\n\r\n cannot grow memory unboundedly before the socket times out.
 const MAX_RESPONSE_HEADER_BYTES = 64 * 1024;
-
-/**
- * Establishes proxied connection to destinationPort
- *
- * httpProxyClient("http://localhost:3128/", 80, "google.com", function(err, socket){
- *     socket.write("GET / HTTP/1.0\r\n\r\n");
- * });
- *
- * @param {String} proxyUrl proxy configuration, etg "http://proxy.host:3128/"
- * @param {Number} destinationPort Port to open in destination host
- * @param {String} destinationHost Destination hostname
- * @param {Object} [tlsOptions] Optional TLS options for an HTTPS proxy (e.g. { rejectUnauthorized: false })
- * @param {Function} callback Callback to run with the rocket object once connection is established
- */
 function httpProxyClient(proxyUrl, destinationPort, destinationHost, tlsOptions, callback) {
     if (typeof tlsOptions === 'function') {
         callback = tlsOptions;
         tlsOptions = {};
     }
     tlsOptions = tlsOptions || {};
-
     // Reject CRLF in the destination before it reaches the CONNECT request line
     // and Host header. A tainted host/port could otherwise inject additional
     // request headers into the proxy connection (HTTP request splitting).
@@ -40,16 +21,14 @@ function httpProxyClient(proxyUrl, destinationPort, destinationHost, tlsOptions,
     if (!destinationPort || /[\r\n]/.test(destinationHost)) {
         const err = new Error('Invalid proxy destination');
         err.code = errors.EPROXY;
-        return setImmediate(() => callback(err));
+        setImmediate(() => callback(err));
+        return;
     }
-
     const proxy = urllib.parse(proxyUrl);
-
     const connectOptions = {
         host: proxy.hostname,
         port: Number(proxy.port) ? Number(proxy.port) : proxy.protocol === 'https:' ? 443 : 80
     };
-
     let connect;
     if (proxy.protocol === 'https:') {
         // Validate the proxy's TLS certificate by default. A caller that uses a
@@ -57,39 +36,36 @@ function httpProxyClient(proxyUrl, destinationPort, destinationHost, tlsOptions,
         // tls.rejectUnauthorized === false.
         connectOptions.rejectUnauthorized = tlsOptions.rejectUnauthorized !== false;
         connect = tls.connect.bind(tls);
-    } else {
+    }
+    else {
         connect = net.connect.bind(net);
     }
-
     let socket;
-
     // Error harness for initial connection. Once connection is established, the responsibility
     // to handle errors is passed to whoever uses this socket
     let finished = false;
-    const tempSocketErr = err => {
+    const tempSocketErr = (err) => {
         if (finished) {
             return;
         }
         finished = true;
         try {
             socket.destroy();
-        } catch (_E) {
+        }
+        catch (_E) {
             // ignore
         }
         callback(err);
     };
-
     const timeoutErr = () => {
         const err = new Error('Proxy socket timed out');
         err.code = 'ETIMEDOUT';
         tempSocketErr(err);
     };
-
     socket = connect(connectOptions, () => {
         if (finished) {
             return;
         }
-
         const reqHeaders = {
             Host: destinationHost + ':' + destinationPort,
             Connection: 'close'
@@ -97,64 +73,54 @@ function httpProxyClient(proxyUrl, destinationPort, destinationHost, tlsOptions,
         if (proxy.auth) {
             reqHeaders['Proxy-Authorization'] = 'Basic ' + Buffer.from(proxy.auth).toString('base64');
         }
-
         socket.write(
-            // HTTP method
-            'CONNECT ' +
-                destinationHost +
-                ':' +
-                destinationPort +
-                ' HTTP/1.1\r\n' +
-                // HTTP request headers
-                Object.keys(reqHeaders)
-                    .map(key => key + ': ' + reqHeaders[key])
-                    .join('\r\n') +
-                // End request
-                '\r\n\r\n'
-        );
-
+        // HTTP method
+        'CONNECT ' +
+            destinationHost +
+            ':' +
+            destinationPort +
+            ' HTTP/1.1\r\n' +
+            // HTTP request headers
+            Object.keys(reqHeaders)
+                .map(key => key + ': ' + reqHeaders[key])
+                .join('\r\n') +
+            // End request
+            '\r\n\r\n');
         let headers = '';
-        const onSocketData = chunk => {
+        const onSocketData = (chunk) => {
             let match;
             let remainder;
-
             if (finished) {
                 return;
             }
-
             headers += chunk.toString('binary');
             if ((match = headers.match(/\r\n\r\n/))) {
                 socket.removeListener('data', onSocketData);
-
                 remainder = headers.substr(match.index + match[0].length);
                 headers = headers.substr(0, match.index);
                 if (remainder) {
                     socket.unshift(Buffer.from(remainder, 'binary'));
                 }
-
                 // proxy connection is now established
                 finished = true;
-
                 // check response code
                 match = headers.match(/^HTTP\/\d+\.\d+ (\d+)/i);
                 if (!match || (match[1] || '').charAt(0) !== '2') {
                     try {
                         socket.destroy();
-                    } catch (_E) {
+                    }
+                    catch (_E) {
                         // ignore
                     }
                     const err = new Error('Invalid response from proxy' + ((match && ': ' + match[1]) || ''));
                     err.code = errors.EPROXY;
                     return callback(err);
                 }
-
                 socket.removeListener('error', tempSocketErr);
                 socket.removeListener('timeout', timeoutErr);
                 socket.setTimeout(0);
-
                 return callback(null, socket);
             }
-
             if (headers.length > MAX_RESPONSE_HEADER_BYTES) {
                 socket.removeListener('data', onSocketData);
                 const err = new Error('Proxy response headers too large');
@@ -164,11 +130,8 @@ function httpProxyClient(proxyUrl, destinationPort, destinationHost, tlsOptions,
         };
         socket.on('data', onSocketData);
     });
-
     socket.setTimeout(httpProxyClient.timeout || 30 * 1000);
     socket.on('timeout', timeoutErr);
-
     socket.once('error', tempSocketErr);
 }
-
-module.exports = httpProxyClient;
+export default httpProxyClient;