@mswjs/interceptors 0.41.8 → 0.42.0

package/lib/node/net-DtMnyEeg.js

@@ -0,0 +1,1388 @@
+import { a as createLogger, i as Interceptor, r as toBuffer } from "./buffer-utils-BvPY1Tc-.js";
+import { TypedEvent } from "rettime";
+import { invariant } from "outvariant";
+import http from "node:http";
+import net from "node:net";
+import tls from "node:tls";
+//#region src/utils/patches-registry.ts
+var PatchesRegistry = class {
+	#replacements = /* @__PURE__ */ new Map();
+	applyPatch(owner, key, getNextValue) {
+		const ownerReplacements = this.#replacements.get(owner);
+		invariant(!ownerReplacements?.has(key), `Failed to replace a global value at "${String(key)}": already replaced.`);
+		const match = getDeepPropertyDescriptor(owner, key);
+		if (typeof match === "undefined") {
+			console.warn(`Failed to replace a global value at "${String(key)}": not a global value.`);
+			return () => {};
+		}
+		if (match.descriptor.configurable) Object.defineProperty(owner, key, {
+			value: getNextValue(owner[key]),
+			enumerable: true,
+			configurable: true
+		});
+		else if (match.descriptor.writable) owner[key] = getNextValue(owner[key]);
+		else throw new Error(`Failed to patch a non-configurable non-writable property "${key.toString()}"`);
+		const restorePatch = () => {
+			const currentReplacements = this.#replacements.get(owner);
+			if (!currentReplacements?.has(key)) return;
+			if (match.owner === owner)
+ /**
+			* @note Restoring non-configurable properties works as long as "writable: true"
+			* and none of the other descriptor properties except for "value" have changed.
+			*/
+			Object.defineProperty(match.owner, key, match.descriptor);
+			else
+ /**
+			* @todo Delete the proxy property set by the registry.
+			* If the match's owner isn't the original owner, the property is likely nested in the prototype.
+			* The registry does not meddle with those, they are left intact.
+			*/
+			Reflect.deleteProperty(owner, key);
+			currentReplacements.delete(key);
+			if (currentReplacements.size === 0) this.#replacements.delete(owner);
+		};
+		if (ownerReplacements) ownerReplacements.set(key, restorePatch);
+		else this.#replacements.set(owner, /* @__PURE__ */ new Map([[key, restorePatch]]));
+		return restorePatch;
+	}
+	restoreAllPatches() {
+		const errors = [];
+		for (const [, ownerReplacements] of this.#replacements) for (const [, restorePatch] of ownerReplacements) try {
+			restorePatch();
+		} catch (error) {
+			if (error instanceof Error) errors.push(error);
+			else throw error;
+		}
+		if (errors.length > 0) throw new AggregateError(errors, "FOO!");
+	}
+};
+const patchesRegistry = new PatchesRegistry();
+/**
+* Returns a property descriptor for the given property on the owner.
+* Walks down the prototype chain if the property does not exist on the owner.
+* Handy for getting a global property descriptor where `globalThis` is
+* replaced with a controlled class (e.g. ServiceWorkerGlobalScope).
+*/
+function getDeepPropertyDescriptor(owner, key) {
+	let currentOwner = owner;
+	let descriptor;
+	while (currentOwner) {
+		descriptor = Object.getOwnPropertyDescriptor(currentOwner, key);
+		if (descriptor) return {
+			owner: currentOwner,
+			descriptor
+		};
+		currentOwner = Object.getPrototypeOf(currentOwner);
+	}
+}
+//#endregion
+//#region src/interceptors/net/utils/normalize-net-connect-args.ts
+/**
+* Normalizes the arguments passed to `net.connect()`.
+*/
+function normalizeNetConnectArgs(args) {
+	if (args.length === 0) return [{ path: "" }, null];
+	const callback = typeof args[1] === "function" ? args[1] : args[2] || null;
+	if (typeof args[0] === "string") return [{ path: args[0] }, callback];
+	if (typeof args[0] === "number") return [{
+		port: args[0],
+		path: "",
+		/**
+		* @note The host is optional in the "(port[, host][, callback])"
+		* signatures and defaults to "localhost" in Node.js.
+		*/
+		host: typeof args[1] === "string" ? args[1] : void 0
+	}, callback];
+	if (typeof args[0] === "object") {
+		/**
+		* @note URL arguments receive no special treatment on purpose.
+		* Node.js does not support them and reads a given URL as a plain
+		* options object (e.g. "url.port" is a string, "url.host" includes
+		* the port). The "port" branch below reproduces that reading.
+		*/
+		if ("port" in args[0]) return [{
+			path: "",
+			port: Reflect.get(args[0], "port"),
+			host: Reflect.get(args[0], "host"),
+			auth: Reflect.get(args[0], "auth"),
+			family: Reflect.get(args[0], "family"),
+			hints: Reflect.get(args[0], "hints"),
+			session: Reflect.get(args[0], "session"),
+			localAddress: Reflect.get(args[0], "localAddress"),
+			localPort: Reflect.get(args[0], "localPort"),
+			timeout: Reflect.get(args[0], "timeout"),
+			lookup: Reflect.get(args[0], "lookup"),
+			allowHalfOpen: Reflect.get(args[0], "allowHalfOpen"),
+			noDelay: Reflect.get(args[0], "noDelay"),
+			keepAlive: Reflect.get(args[0], "keepAlive"),
+			keepAliveInitialDelay: Reflect.get(args[0], "keepAliveInitialDelay"),
+			autoSelectFamily: Reflect.get(args[0], "autoSelectFamily"),
+			autoSelectFamilyAttemptTimeout: Reflect.get(args[0], "autoSelectFamilyAttemptTimeout")
+		}, callback];
+		return [{
+			path: args[0].path || "",
+			family: Reflect.get(args[0], "family"),
+			session: Reflect.get(args[0], "session"),
+			auth: Reflect.get(args[0], "auth"),
+			timeout: Reflect.get(args[0], "timeout"),
+			allowHalfOpen: Reflect.get(args[0], "allowHalfOpen")
+		}, callback];
+	}
+	throw new Error(`Invalid arguments passed to net.connect: ${args}`);
+}
+//#endregion
+//#region src/interceptors/net/utils/flush-writes.ts
+/**
+* Write the given pending data to the socket using its public
+* "write()" method. Unlike direct "_writeGeneric()" calls, public
+* writes go through the "Writable" queue that only dispatches the
+* next write once the previous one completes. TLS sockets rely on
+* that serialization: their "TLSWrap" handle supports a single
+* write in flight and crashes the process with a native
+* "Assertion failed: !current_write_" abort when writes overlap
+* (e.g. multiple direct "_writeGeneric()" calls issued on a
+* connecting socket replay back-to-back on "connect").
+*/
+function writePendingData(socket, data, encoding, callback) {
+	if (Array.isArray(data)) {
+		for (let index = 0; index < data.length; index++) {
+			const entry = data[index];
+			/**
+			* @note Per-entry callbacks are intentionally ignored, the same
+			* way "writevGeneric()" only honors the batch-level callback.
+			*/
+			if (index === data.length - 1) socket.write(entry.chunk, entry.encoding, callback);
+			else socket.write(entry.chunk, entry.encoding);
+		}
+		return;
+	}
+	socket.write(data, encoding, callback);
+}
+function unwrapPendingData(data, callback) {
+	if (Array.isArray(data)) for (const entry of data) callback(entry.chunk, entry.encoding, entry.callback);
+	else callback(data);
+}
+//#endregion
+//#region src/interceptors/net/utils/get-tls-connect-options.ts
+/**
+* Returns the original options the given TLS socket was created with.
+* The original `tls.connect()` stores them on the socket instance
+* under an internal symbol before connecting its transport.
+* @see https://github.com/nodejs/node/blob/3178a762d6a2b1a37b74f02266eea0f3d86603f1/lib/_tls_wrap.js#L1690
+*/
+function getTlsConnectOptions(socket) {
+	const kConnectOptions = Object.getOwnPropertySymbols(socket).find((symbol) => {
+		return symbol.description === "connect-options";
+	});
+	if (kConnectOptions == null) return;
+	return Reflect.get(socket, kConnectOptions);
+}
+//#endregion
+//#region src/interceptors/net/utils/address-info.ts
+function getAddressInfoByConnectionOptions(options) {
+	if (options == null) return {};
+	const isIPv6 = options.family === 6 || net.isIPv6(options.host || "");
+	return {
+		address: isIPv6 ? "::1" : "127.0.0.1",
+		/**
+		* @note Coerce the port to a number. Connection options may
+		* describe it as a string (e.g. when created from a URL), while
+		* the address info always reports a numeric port.
+		*/
+		port: Number(options.port) || (options.protocol === "https:" ? 443 : 80),
+		family: isIPv6 ? "IPv6" : "IPv4"
+	};
+}
+/**
+* Get the local address info for the given connection options.
+* This describes the client-side end of the connection: the socket
+* is bound to the loopback interface and an ephemeral port, the same
+* way the operating system binds an outgoing connection.
+*/
+function getLocalAddressInfoByConnectionOptions(options) {
+	if (options == null) return {};
+	const isIPv6 = options.family === 6 || net.isIPv6(options.host || "");
+	return {
+		address: options.localAddress || (isIPv6 ? "::1" : "127.0.0.1"),
+		port: options.localPort || getEphemeralPort(),
+		family: isIPv6 ? "IPv6" : "IPv4"
+	};
+}
+/**
+* Get a random port from the ephemeral range (IANA: 49152-65535),
+* the range the operating system draws from when binding an
+* outgoing connection.
+*/
+function getEphemeralPort() {
+	return 49152 + Math.floor(Math.random() * 16384);
+}
+//#endregion
+//#region src/interceptors/net/socket-controller.ts
+const kListenerWrap = Symbol("kListenerWrap");
+const kRawSocket = Symbol("kRawSocket");
+const kPatched = Symbol("kPatched");
+const logger$1 = createLogger("socket");
+function toServerSocket(socket) {
+	/**
+	* The server-side write buffer. Pushing data to the client honors
+	* the client's read backpressure: once "socket.push()" reports a
+	* full buffer, subsequent server writes queue here and flush when
+	* the client reads again ("_read"). This mirrors how a real server
+	* cannot write faster than the client consumes.
+	*/
+	const pendingWrites = [];
+	let pendingEnd;
+	let isBackpressured = false;
+	let isFlushScheduled = false;
+	const flushPendingWrites = () => {
+		/**
+		* @note The mocked connection is not established yet. Flush once
+		* it is, the same way a real server cannot write to a client
+		* that has not connected.
+		*/
+		if (socket.connecting) {
+			isBackpressured = true;
+			if (!isFlushScheduled) {
+				isFlushScheduled = true;
+				socket.once("ready", () => {
+					isFlushScheduled = false;
+					flushPendingWrites();
+				});
+			}
+			return false;
+		}
+		while (pendingWrites.length > 0) {
+			const nextWrite = pendingWrites.shift();
+			socket._unrefTimer();
+			const canPushMore = socket.push(toBuffer(nextWrite.chunk, nextWrite.encoding), nextWrite.encoding);
+			nextWrite.callback?.();
+			if (!canPushMore) {
+				isBackpressured = true;
+				return false;
+			}
+		}
+		const wasBackpressured = isBackpressured;
+		isBackpressured = false;
+		if (pendingEnd) {
+			const finalEnd = pendingEnd;
+			pendingEnd = void 0;
+			if (finalEnd.chunk != null) socket.push(toBuffer(finalEnd.chunk, finalEnd.encoding), finalEnd.encoding);
+			socket.push(null);
+			finalEnd.callback?.();
+		}
+		if (wasBackpressured) socket.emit("internal:drain");
+		return true;
+	};
+	/**
+	* @note "_read" is the client asking for more data. Flush the
+	* buffered server writes so the delivery resumes as the client
+	* reads, completing the backpressure loop.
+	*/
+	const realRead = socket._read.bind(socket);
+	socket._read = (size) => {
+		realRead(size);
+		if (pendingWrites.length > 0 || pendingEnd != null || isBackpressured) flushPendingWrites();
+	};
+	return new Proxy(socket, { get: (target, property, receiver) => {
+		const getRealValue = () => {
+			return Reflect.get(target, property, receiver);
+		};
+		if (property === "on" || property === "addListener" || property === "once" || property === "prependListener" || property === "prependOnceListener") {
+			const realAddListener = getRealValue();
+			return (event, listener) => {
+				if (event === "data") {
+					const listenerWrap = (chunk, encoding) => {
+						listener(toBuffer(chunk, encoding));
+					};
+					Object.defineProperty(listener, kListenerWrap, {
+						enumerable: false,
+						writable: false,
+						value: listenerWrap
+					});
+					/**
+					* @note Subscribe using the same method (e.g. "once") so its
+					* listener semantics apply to the internal channel too.
+					*/
+					Reflect.apply(realAddListener, target, ["internal:write", listenerWrap]);
+					return target;
+				}
+				/**
+				* @note The "drain" event on the server socket signals the
+				* flush of the server-side write buffer. It is routed through
+				* an internal channel so it does not clash with the "drain"
+				* event of the underlying client socket.
+				*/
+				if (event === "drain") {
+					Reflect.apply(realAddListener, target, ["internal:drain", listener]);
+					return target;
+				}
+				return realAddListener.call(target, event, listener);
+			};
+		}
+		if (property === "off" || property === "removeListener") {
+			const realRemoveListener = getRealValue();
+			return (event, listener) => {
+				if (event === "data") {
+					const listenerWrap = listener[kListenerWrap];
+					if (listenerWrap) return realRemoveListener.call(target, "internal:write", listenerWrap);
+				}
+				if (event === "drain") return realRemoveListener.call(target, "internal:drain", listener);
+				return realRemoveListener.call(target, event, listener);
+			};
+		}
+		if (property === "write") return ((chunk, encoding, callback) => {
+			if (typeof encoding === "function") {
+				callback = encoding;
+				encoding = void 0;
+			}
+			pendingWrites.push({
+				chunk,
+				encoding,
+				callback
+			});
+			/**
+			* @note Do not push more data to a client that is not
+			* reading. The write stays buffered until the client reads
+			* again, and "drain" signals the flush.
+			*/
+			if (isBackpressured) return false;
+			return flushPendingWrites();
+		});
+		if (property === "end") return ((...args) => {
+			const callback = args[args.length - 1];
+			/**
+			* @note The end-of-stream is delivered once the buffered
+			* writes flush so the client never observes the EOF before
+			* the data that preceded it.
+			*/
+			pendingEnd = {
+				chunk: typeof args[0] === "function" ? void 0 : args[0],
+				encoding: typeof args[1] === "string" ? args[1] : void 0,
+				callback: typeof callback === "function" ? callback : void 0
+			};
+			flushPendingWrites();
+			/**
+			* @note Do not end the client socket's writable side.
+			* The server ending the connection only signals EOF to the
+			* client (the client may keep writing on half-open sockets).
+			*/
+			return target;
+		});
+		return getRealValue();
+	} });
+}
+var SocketController = class SocketController {
+	static {
+		this.PENDING = 0;
+	}
+	static {
+		this.CLAIMED = 1;
+	}
+	static {
+		this.PASSTHROUGH = 2;
+	}
+	constructor(socket) {
+		this[kRawSocket] = socket;
+		socket[kPatched] = true;
+		this.readyState = SocketController.PENDING;
+	}
+	/**
+	* Claim this socket. Once claimed, the connection attempt succeeds
+	* regardless of the requested host and the interceptor becomes the
+	* mocked server for this connection.
+	*/
+	claim() {
+		invariant(this.readyState === SocketController.PENDING, "Failed to claim a socket connection: already handled (%s)", this.readyState);
+		this.readyState = SocketController.CLAIMED;
+	}
+	/**
+	* Establish this socket connection as-is.
+	*/
+	passthrough() {
+		invariant(this.readyState === SocketController.PENDING, "Failed to passthrough a socket connection: already handled (%s)", this.readyState);
+		this.readyState = SocketController.PASSTHROUGH;
+	}
+};
+var TcpSocketController = class extends SocketController {
+	#connectionOptions;
+	#realWriteGeneric;
+	#passthroughSocket = null;
+	#bufferedWrites = [];
+	#readsCorked = false;
+	#corkedReads = [];
+	#realHandleSwapped = false;
+	#clientCloseEmitted = false;
+	#clientEndPushed = false;
+	#connectEmulated = false;
+	constructor(socket, createConnection, connectionOptions) {
+		super(socket);
+		this.socket = socket;
+		this.createConnection = createConnection;
+		/**
+		* @note Plain TCP sockets capture the connection options from the
+		* "socket.connect()" proxy below. TLS sockets carry additional
+		* TLS-level options that never pass through "socket.connect()",
+		* so those are provided explicitly (see "TlsSocketController").
+		*/
+		this.#connectionOptions = connectionOptions;
+		this.socket._read = () => {
+			/**
+			* @note Resume the passthrough socket when the consumer asks for
+			* more data. Node.js calls "_read()" once the consumer drains the
+			* read buffer (e.g. after "resume()"). The passthrough socket may
+			* have been paused when the consumer's buffer got full, and this
+			* is the only signal to continue reading.
+			*/
+			this.#passthroughSocket?.resume();
+		};
+		this.#realWriteGeneric = this.socket._writeGeneric;
+		this.#bufferedWrites = [];
+		this.socket._writeGeneric = (...args) => {
+			this.#handleWrite(args);
+		};
+		this.socket.connect = new Proxy(this.socket.connect, { apply: (target, thisArg, args) => {
+			logger$1.verbose("socket.connect() %o", args);
+			this.#connectionOptions = args[0];
+			/**
+			* @note Do not bind the intercepted socket to the requested
+			* local address/port. Binding reserves the port for real, and
+			* the passthrough connection (created with the original options)
+			* would then bind the same port again, resulting in a conflict.
+			* The requested values are still reflected in the address info
+			* of a claimed socket (see "claim()").
+			*/
+			if (args[0] != null && typeof args[0] === "object" && (args[0].localAddress != null || args[0].localPort != null)) args[0] = {
+				...args[0],
+				localAddress: void 0,
+				localPort: void 0
+			};
+			return Reflect.apply(target, thisArg, args);
+		} });
+		/**
+		* @note A single socket can be reused for connections to the same host.
+		* When one connection ends, the Agent frees the socket, then uses it
+		* to write the next request's HTTP message immediately. Use the "free"
+		* event to transition the controller into the pending state so the
+		* next exchange is handled anew.
+		*/
+		socket.on("free", () => {
+			logger$1.verbose("client socket freed!");
+			this.reset();
+		}).on("close", () => {
+			logger$1.verbose("client socket closed!");
+			this.#clientCloseEmitted = true;
+			/**
+			* @note Destroy the passthrough socket, if any. The client
+			* socket is done, and a passthrough connection left open would
+			* linger until the server closes it (or error unhandled if it
+			* is still connecting).
+			*/
+			this.#passthroughSocket?.destroy();
+			this.#passthroughSocket = null;
+			this.#bufferedWrites = [];
+			this.#readsCorked = false;
+			this.#corkedReads = [];
+		});
+		this.serverSocket = toServerSocket(this.socket);
+		this.pendingConnection = Promise.withResolvers();
+		this.#reset();
+	}
+	/**
+	* Reset this controller to the pending state so the next exchange
+	* on this socket can be handled anew. This is meant for kept-alive
+	* sockets that are reused for multiple exchanges by clients that
+	* don't emit the "free" event on the socket (e.g. Undici).
+	*/
+	reset() {
+		/**
+		* @note Only settled (claimed or passed-through) sockets need a reset.
+		* Resetting a pending socket again would discard the writes already
+		* buffered for the next exchange (e.g. the Agent "free" event firing
+		* after the parser has reset this controller at a message boundary).
+		*/
+		if (this.readyState === SocketController.PENDING) return;
+		this.#reset();
+	}
+	#reset() {
+		logger$1.verbose("resetting the socket...");
+		this.readyState = SocketController.PENDING;
+		this.pendingConnection = Promise.withResolvers();
+		this.#bufferedWrites = [];
+		this.#connectEmulated = false;
+		this.socket._pendingData = null;
+		this.socket._pendingEncoding = "";
+		const wrapHandle = (handle) => {
+			this.pendingConnection.promise.then(() => {
+				logger$1.verbose("connection request resolved!", this.readyState);
+				process.nextTick(() => {
+					/**
+					* @note If by this point the socket hasn't been handled,
+					* is still connecting, doesn't have any writes buffered,
+					* and has a "connect" listener, assume it's the "write after connect"
+					* scenario (e.g. undici). In that case, auto-claim the socket to
+					* transition to the connected state appropriately to its handle.
+					*/
+					if (this.readyState === SocketController.PENDING && this.socket.connecting && this.#bufferedWrites.length === 0 && this.socket.listenerCount("connect") > 0) {
+						logger$1.verbose("assume connect->write socket, calling \"connect\" listeners...");
+						this.emulateConnect();
+					}
+				});
+			});
+			/**
+			* Remove the "setTypeOfService" from the handle, if present (Node.js v24+).
+			* Removing it has no effect on the socket but prevents the "setTypeOfService EBADF" error.
+			* @see https://github.com/nodejs/node/blob/69a970f76814d40f55cf162d0cc3632fe8a7e599/lib/net.js#L661
+			* @see https://github.com/nodejs/undici/blob/bf684f7de01616708a33a5d1c092177622394442/lib/dispatcher/client-h1.js#L1136
+			*/
+			if (handle.setTypeOfService) handle.setTypeOfService = void 0;
+			handle.connect = handle.connect6 = (request) => {
+				logger$1.verbose("handle.connect()");
+				this.pendingConnection.resolve([request, handle]);
+			};
+			logger$1.verbose("socket handle wrapped! waiting for connection request...");
+		};
+		if (this.socket._handle) wrapHandle(this.socket._handle);
+		else this.socket.prependOnceListener("connectionAttempt", () => {
+			wrapHandle(this.socket._handle);
+		});
+	}
+	/**
+	* Handle a write performed on the client socket. Installed once as
+	* "_writeGeneric", this is the single write path for every controller
+	* state, dispatching on "readyState".
+	*/
+	#handleWrite(args) {
+		const data = args[1];
+		logger$1.verbose("socket write (state: %d) %o", this.readyState, args);
+		/**
+		* @note Buffer the write BEFORE pushing the data to the server socket.
+		* Handling the pushed data may transition this controller within the
+		* same call stack, and each transition settles the buffered entry:
+		* "passthrough()" flushes it to the real socket, "claim()" drops it,
+		* and a reset at an HTTP message boundary keeps it for the next exchange.
+		*/
+		this.#bufferedWrites.push(args);
+		if (this.readyState === SocketController.PENDING) {
+			/**
+			* @note Reflect the buffered write in "_pendingData" so it counts
+			* toward "bytesWritten", the same way Node.js counts the pending
+			* data of a connecting socket. Flushing the buffered writes resets
+			* "_pendingData" (see `passthrough()`).
+			*/
+			const pendingData = Array.isArray(this.socket._pendingData) ? this.socket._pendingData : [];
+			unwrapPendingData(data, (chunk, chunkEncoding) => {
+				pendingData.push({
+					chunk,
+					encoding: chunkEncoding
+				});
+			});
+			this.socket._pendingData = pendingData;
+			if (this.socket.listenerCount("internal:write") === 0) {
+				logger$1.verbose("no server data listeners, scheduling to the next tick...");
+				process.nextTick(() => {
+					this.#push(data);
+				});
+			} else this.#push(data);
+		} else this.#push(data);
+		/**
+		* Dispatch on the state observed AFTER the push since handling the
+		* pushed data may have transitioned this controller synchronously.
+		*/
+		switch (this.readyState) {
+			case SocketController.PENDING:
+				/**
+				* @note The write either awaits the verdict on this exchange or,
+				* if the push reset this controller at a message boundary, opens
+				* the next exchange (the reset cleared the buffer; re-buffer it).
+				*/
+				if (!this.#bufferedWrites.includes(args)) this.#bufferedWrites.push(args);
+				this.#acknowledgeWrite(args);
+				return;
+			case SocketController.CLAIMED:
+				/**
+				* @note Once claimed, there's nowhere else to write chunks to.
+				* The data was delivered to the server socket; complete the write
+				* so the socket's writable state settles (enabling "finish").
+				*/
+				this.#removeBufferedWrite(args);
+				this.#acknowledgeWrite(args);
+				return;
+			case SocketController.PASSTHROUGH:
+				/**
+				* @note A synchronous "passthrough()" has already flushed this
+				* write (with its callback) to the real socket.
+				*/
+				if (!this.#removeBufferedWrite(args)) return;
+				/**
+				* @note Until the handle swap, the client socket's own handle
+				* cannot carry any data (it never actually connects). Write
+				* directly to the passthrough socket instead. This also prevents
+				* the "connecting" write replay of `Socket.prototype._writeGeneric`
+				* from pushing the same data to the server socket twice.
+				*/
+				if (!this.#realHandleSwapped && this.#passthroughSocket) {
+					writePendingData(this.#passthroughSocket, data, args[2], args[3]);
+					return;
+				}
+				this.#realWriteGeneric.apply(this.socket, args);
+		}
+	}
+	/**
+	* Complete the given write by invoking its callback. The callback is
+	* then removed from the write entry so flushing that entry later
+	* (e.g. on passthrough) does not invoke it twice.
+	*/
+	#acknowledgeWrite(args) {
+		const callback = args[3];
+		if (typeof callback === "function") {
+			callback();
+			args[3] = void 0;
+		}
+	}
+	#removeBufferedWrite(args) {
+		const index = this.#bufferedWrites.indexOf(args);
+		if (index === -1) return false;
+		this.#bufferedWrites.splice(index, 1);
+		return true;
+	}
+	emulateConnect() {
+		this.#connectEmulated = true;
+		/**
+		* @note Reflect the connected state before notifying the listeners,
+		* the same way Node.js does before emitting "connect".
+		*/
+		Reflect.set(this.socket, "connecting", false);
+		/**
+		* @note Invoke the raw listeners so the "once" wrappers get
+		* consumed. This prevents listeners like the connection callback
+		* from being invoked again when "connect" is emitted for real
+		* (e.g. once the claimed connection completes).
+		*/
+		for (const listener of this.socket.rawListeners("connect")) listener.apply(this.socket);
+	}
+	/**
+	* Push the given data to the server socket.
+	* This has no effect on the public-facing socket and is used
+	* only for the interceptors to subscribe to "socket.on('data')"
+	* before the data is actually written anywhere.
+	*/
+	#push = (data) => {
+		if (data == null) return;
+		logger$1.verbose("server push %o", data);
+		unwrapPendingData(data, (chunk, encoding) => {
+			logger$1.verbose("server emitting \"data\" %o", {
+				chunk,
+				encoding
+			});
+			this.socket.emit("internal:write", chunk, encoding);
+		});
+	};
+	#onRealSocketConnect = () => {
+		if (!this.#passthroughSocket) return;
+		/**
+		* @note The consumer may destroy the socket while the passthrough
+		* connection is still being established. The passthrough "connect"
+		* (I/O poll phase) can arrive before the client's "close" callback
+		* (close phase) within the same event loop iteration. A destroyed
+		* socket must not emit "connect"/"ready".
+		*/
+		if (this.socket.destroyed) {
+			this.#passthroughSocket.destroy();
+			return;
+		}
+		const replacedHandle = this.socket._handle;
+		const wasUnrefed = replacedHandle != null && typeof replacedHandle.hasRef === "function" && !replacedHandle.hasRef();
+		this.socket._handle = this.#passthroughSocket._handle;
+		this.#realHandleSwapped = true;
+		/**
+		* @note Preserve the ref state across the handle swap. If the
+		* consumer unrefed the socket while it was connecting, the swapped
+		* handle must not hold the process alive either.
+		*/
+		if (wasUnrefed) this.socket._handle.unref?.();
+		/**
+		* @note Close the replaced handle. Nothing references it past this
+		* point, and left open, it keeps the process alive indefinitely.
+		* For TLS sockets, the replaced handle is a TLSWrap; close its
+		* underlying transport too (closing the wrap alone does not close
+		* the TCP handle it sits on).
+		*/
+		if (replacedHandle != null) {
+			replacedHandle.close();
+			replacedHandle._parent?.close();
+		}
+		Reflect.set(this.socket, "connecting", false);
+		/**
+		* @note Read the remote address info once so it gets cached on the
+		* socket. The passthrough socket controls the swapped handle and may
+		* close it at any point (e.g. once the server ends the connection),
+		* while Node.js keeps serving the cached info for sockets that
+		* have connected. Reading must happen after the socket is no longer
+		* connecting (the info of connecting sockets is never cached).
+		*/
+		this.socket.remoteAddress;
+		this.socket.emit("connect");
+		this.socket.emit("ready");
+	};
+	#onRealSocketConnectionAttemptFailed = (address, port, family, error) => {
+		this.socket.emit("connectionAttemptFailed", address, port, family, error);
+	};
+	#onRealSocketConnectionAttemptTimeout = (address, port, family) => {
+		this.socket.emit("connectionAttemptTimeout", address, port, family);
+	};
+	#onRealSocketData = (data) => {
+		logger$1.verbose("real socket \"data\" event %o", data);
+		/**
+		* @note Receiving data is socket activity. Refresh the idle timer
+		* of the client socket the same way its own reads would
+		* ("socket.setTimeout()" must not fire during an active transfer).
+		* The data arrives on the real socket, which only refreshes the
+		* real socket's timer.
+		*/
+		this.socket._unrefTimer();
+		if (this.#readsCorked) {
+			logger$1.verbose("reads are corked, buffering the data...");
+			this.#corkedReads.push({
+				type: "data",
+				chunk: data
+			});
+			return;
+		}
+		if (!this.socket.push(data)) {
+			logger$1.verbose("client socket forbade more pushes, pausing the passthrough socket...");
+			this.#passthroughSocket?.pause();
+		}
+	};
+	#onRealSocketError = (error) => {
+		logger$1.verbose("real socket \"error\" event %o", error);
+		if (this.socket.destroyed) {
+			logger$1.verbose("real socket errored but client socket already destroyed, skipping...");
+			return;
+		}
+		logger$1.verbose("real socket errored, forwarding %o", error);
+		this.socket.destroy(error);
+		if (this.#realHandleSwapped) process.nextTick(() => this.socket.emit("close", true));
+	};
+	#onRealSocketEnd = () => {
+		this.socket._unrefTimer();
+		if (this.#readsCorked) {
+			this.#corkedReads.push({ type: "end" });
+			return;
+		}
+		this.#clientEndPushed = true;
+		this.socket.push(null);
+	};
+	#onRealSocketClose = (hadError) => {
+		/**
+		* @note The connection is fully closed and the swapped handle
+		* cannot shut down anymore. Report a synchronous shutdown so the
+		* automatic "end()" of a half-closed socket ("allowHalfOpen: false")
+		* finishes without errors once the consumer reads the end-of-stream.
+		*/
+		if (this.#realHandleSwapped && this.socket._handle) this.socket._handle.shutdown = () => 1;
+		if (this.#readsCorked) {
+			this.#corkedReads.push({
+				type: "close",
+				hadError
+			});
+			return;
+		}
+		if (this.#clientCloseEmitted) return;
+		if (this.socket.destroyed && !this.#realHandleSwapped) return;
+		this.#emitClientClose(hadError);
+	};
+	/**
+	* Emit the "close" event on the client socket, honoring the order
+	* of the socket teardown events.
+	* @note The client may be paused with the received data (and the
+	* end-of-stream) still buffered. Node.js never emits "close" before
+	* "end" on a gracefully closed connection: the teardown waits until
+	* the consumer reads the buffered data.
+	*/
+	#emitClientClose(hadError) {
+		if (this.#clientEndPushed && !this.socket.readableEnded && !this.socket.destroyed) {
+			let closeDelivered = false;
+			const deliverClose = (hadErrorOverride) => {
+				if (closeDelivered) return;
+				closeDelivered = true;
+				process.nextTick(() => {
+					if (!this.#clientCloseEmitted) this.socket.emit("close", hadErrorOverride ?? hadError);
+				});
+			};
+			this.socket.once("end", () => {
+				deliverClose();
+			});
+			/**
+			* @note The consumer may also destroy the socket before reading
+			* the buffered data. Node.js still emits "close" for such
+			* sockets, but the destroy machinery of a socket with a swapped
+			* (already closed) handle never completes. Deliver "close" here.
+			*/
+			const realDestroy = this.socket._destroy;
+			this.socket._destroy = (error, callback) => {
+				deliverClose(error != null);
+				return realDestroy.call(this.socket, error, callback);
+			};
+			return;
+		}
+		this.socket.emit("close", hadError);
+	}
+	#onMockSocketDrain = () => {
+		logger$1.verbose("client socket drained!");
+		this.#passthroughSocket?.resume();
+	};
+	/**
+	* Suspend forwarding of the passthrough socket events ("data", "end", "close")
+	* to the client socket. The events are buffered in order until `uncorkReads()`
+	* is called. This allows the consumer to delay the delivery of the original
+	* response to the client (e.g. until its own asynchronous logic settles).
+	*
+	* @note Pausing the client socket is not enough to delay the delivery.
+	* Consumers like Undici read the pushed data from a paused socket
+	* directly via `socket.read()`, which is unaffected by `socket.pause()`.
+	*/
+	corkReads() {
+		this.#readsCorked = true;
+	}
+	/**
+	* Resume forwarding of the passthrough socket events to the client socket,
+	* replaying any events buffered while the reads were corked.
+	*/
+	uncorkReads() {
+		if (!this.#readsCorked) return;
+		this.#readsCorked = false;
+		for (const corkedRead of this.#corkedReads.splice(0)) switch (corkedRead.type) {
+			case "data":
+				if (!this.socket.push(corkedRead.chunk)) {
+					logger$1.verbose("client socket forbade more pushes, pausing the passthrough socket...");
+					this.#passthroughSocket?.pause();
+				}
+				break;
+			case "end":
+				this.#clientEndPushed = true;
+				this.socket.push(null);
+				break;
+			case "close":
+				this.#emitClientClose(corkedRead.hadError);
+				break;
+		}
+	}
+	claim() {
+		super.claim();
+		/**
+		* @note The client may destroy the socket before the connection
+		* is claimed (e.g. abort a request in-flight). There is no
+		* connection to mock then, and the destroyed socket has no handle.
+		*/
+		if (this.socket.destroyed) {
+			logger$1.verbose("socket already destroyed, skipping claim...");
+			return;
+		}
+		/**
+		* @note Skip already connected sockets (e.g. kept-alive sockets
+		* reused for the next exchange). Sockets with an emulated "connect"
+		* only appear connected and must still complete the mock connection.
+		*/
+		if (!this.socket.connecting && !this.#connectEmulated) {
+			logger$1.verbose("socket already connected, skipping claim...");
+			return;
+		}
+		logger$1.verbose("-> claim!");
+		/**
+		* @note Reflect the local end of the claimed socket, the same way
+		* the operating system reports the bound address of an outgoing
+		* connection via "socket.address()"/"localAddress"/"localPort".
+		* Patching the handle also prevents Node.js from handling the
+		* "getsockname" errors of the never-connected raw handle.
+		* @see https://github.com/nodejs/node/blob/13eb80f3b718452213e0fc449702aefbbfe4110f/lib/net.js#L971
+		*/
+		this.socket._handle.getsockname = (addressInfo) => {
+			Object.assign(addressInfo, getLocalAddressInfoByConnectionOptions(this.#connectionOptions));
+			return 0;
+		};
+		/**
+		* @note Reflect the connection target as the peer of the claimed
+		* socket, the same way a connected socket reports the server it
+		* connected to via "remoteAddress"/"remotePort"/"remoteFamily".
+		*/
+		this.socket._handle.getpeername = (addressInfo) => {
+			Object.assign(addressInfo, getAddressInfoByConnectionOptions(this.#connectionOptions));
+			return 0;
+		};
+		this.#bufferedWrites = [];
+		this.socket._pendingData = null;
+		this.socket._pendingEncoding = "";
+		this.pendingConnection.promise.then(([request, handle]) => {
+			logger$1.verbose("connection request resolved, mocking the connection...");
+			/**
+			* @note "afterConnect" asserts that the socket is connecting.
+			* Restore the flag if the connect was emulated earlier (emulation
+			* flips it so its listeners observe a connected socket).
+			* "afterConnect" itself sets it back to false.
+			*/
+			if (this.#connectEmulated) Reflect.set(this.socket, "connecting", true);
+			/**
+			* @see https://github.com/nodejs/node/blob/9cd6630870b776e96c5cf0ac68c31e2f46df3835/lib/net.js#L1142
+			*/
+			request.oncomplete(0, handle, request, true, true);
+		});
+	}
+	passthrough(flushPendingData) {
+		super.passthrough();
+		logger$1.verbose("-> passthrough!");
+		const createRealSocket = () => {
+			const realSocket = this.createConnection();
+			realSocket[kPatched] = true;
+			if (this.socket.timeout != null) realSocket.setTimeout(this.socket.timeout);
+			return realSocket;
+		};
+		const realSocket = this.#passthroughSocket && !this.#passthroughSocket.destroyed ? this.#passthroughSocket : createRealSocket();
+		if (realSocket !== this.#passthroughSocket) this.#passthroughSocket = realSocket;
+		if (this.#bufferedWrites.length === 0) logger$1.verbose("passthrough with empty writes buffer (state: %d)", this.readyState);
+		/**
+		* Flush any writes during the pending phase to the passthrough socket.
+		* @note These are written directly on the passthrough socket to prevent
+		* them from being forwarded as "data" events on the server (already emitted).
+		*/
+		for (let i = 0; i < this.#bufferedWrites.length; i++) {
+			const pendingWrite = this.#bufferedWrites[i];
+			if (i === 0 && typeof flushPendingData === "function") {
+				const data = pendingWrite[1];
+				const encoding = pendingWrite[2];
+				flushPendingData(data, encoding, (nextData) => {
+					pendingWrite[1] = nextData;
+				});
+			}
+			const [, data, encoding, callback] = pendingWrite;
+			writePendingData(realSocket, data, encoding, callback);
+		}
+		this.#bufferedWrites = [];
+		this.socket._pendingData = null;
+		this.socket._pendingEncoding = "";
+		this.socket.address = realSocket.address.bind(realSocket);
+		this.socket.removeListener("drain", this.#onMockSocketDrain);
+		this.socket.on("drain", this.#onMockSocketDrain);
+		realSocket.removeListener("connect", this.#onRealSocketConnect).removeListener("connectionAttemptFailed", this.#onRealSocketConnectionAttemptFailed).removeListener("connectionAttemptTimeout", this.#onRealSocketConnectionAttemptTimeout).removeListener("data", this.#onRealSocketData).removeListener("error", this.#onRealSocketError).removeListener("end", this.#onRealSocketEnd).removeListener("close", this.#onRealSocketClose);
+		realSocket.once("connect", this.#onRealSocketConnect).on("connectionAttemptFailed", this.#onRealSocketConnectionAttemptFailed).on("connectionAttemptTimeout", this.#onRealSocketConnectionAttemptTimeout).on("data", this.#onRealSocketData).on("error", this.#onRealSocketError).on("end", this.#onRealSocketEnd).on("close", this.#onRealSocketClose);
+		return realSocket;
+	}
+};
+var TlsSocketController = class extends TcpSocketController {
+	/**
+	* @note The TLS connection options must be provided explicitly.
+	* They cannot be captured from "socket.connect()" like for plain
+	* TCP sockets because "tls.connect()" fixes them at the TLS socket
+	* construction, before its transport ever connects.
+	*/
+	#tlsConnectionOptions;
+	constructor(socket, createConnection, tlsConnectionOptions) {
+		super(socket, createConnection, tlsConnectionOptions);
+		this.socket = socket;
+		this.createConnection = createConnection;
+		this.#tlsConnectionOptions = tlsConnectionOptions;
+		socket.prependListener("secureConnect", () => {
+			/**
+			* @note Reflect the negotiated ALPN protocol from the handle that
+			* completed the handshake. The socket sets "alpnProtocol" only in
+			* its own "_finishInit", which never runs for passthrough
+			* connections (the handshake completes on the passthrough socket
+			* whose handle this socket inherits).
+			*/
+			socket.alpnProtocol = socket._handle.getALPNNegotiatedProtocol();
+		});
+	}
+	emulateConnect() {
+		super.emulateConnect();
+		for (const listener of this.socket.rawListeners("secureConnect")) listener.apply(this.socket);
+	}
+	claim() {
+		/**
+		* @note The client may destroy the socket before the connection
+		* is claimed. Defer to the parent class, which transitions the
+		* ready state and skips the mock connection of destroyed sockets.
+		*/
+		if (this.socket.destroyed) {
+			super.claim();
+			return;
+		}
+		/**
+		* @note Reflect that the mocked connection is not authorized.
+		* There is no real peer certificate to verify. The identity check
+		* itself is skipped for claimed connections (see the
+		* "isSessionReused" mock below).
+		*/
+		this.socket.prependOnceListener("secureConnect", () => {
+			Reflect.set(this.socket, "authorized", false);
+			Reflect.set(this.socket, "authorizationError", "MOCKED_CONNECTION_NOT_VERIFIED");
+		});
+		const handle = this.socket._handle;
+		handle.start = () => void 0;
+		/**
+		* Mock this to prevent the "Error: Worker exited unexpectedly" error.
+		* This will trigger when "secure" is emitted.
+		* @see https://github.com/nodejs/node/blob/bdc8131fa78089b81b74dbff467365afb6536e6a/lib/internal/tls/wrap.js#L1648
+		*/
+		handle.verifyError = () => void 0;
+		handle.getSession = () => {
+			return Buffer.from("mocked session");
+		};
+		/**
+		* @note Skip the server identity check for this mocked connection.
+		* Node.js runs "options.checkServerIdentity" in "onConnectSecure"
+		* against the peer certificate, and a mocked connection has no
+		* real peer certificate — the caller's (or the default) validation
+		* would fail and destroy the socket. The check is overridden on the
+		* socket's internal connect options since the emulated handshake
+		* still completes through the regular "onConnectSecure" path.
+		* @see https://github.com/nodejs/node/blob/3178a762d6a2b1a37b74f02266eea0f3d86603f1/lib/_tls_wrap.js#L1621
+		*/
+		const realTlsConnectOptions = getTlsConnectOptions(this.socket);
+		if (realTlsConnectOptions) realTlsConnectOptions.checkServerIdentity = () => {};
+		handle.getCipher = () => {
+			return {
+				name: "TLS_AES_256_GCM_SHA384",
+				standardName: "TLS_AES_256_GCM_SHA384",
+				version: "TLSv1.3"
+			};
+		};
+		/**
+		* Mock this to prevent a segfault on Node.js 26+. The native
+		* implementation reads the negotiated group ("SSL_get0_group_name")
+		* of a handshake that never happened. Node.js itself calls this
+		* in "onConnectSecure" to validate the "minDHSize" option.
+		* Reflect the ephemeral key exchange matching the mocked cipher.
+		* @see https://github.com/nodejs/node/blob/3178a762d6a2b1a37b74f02266eea0f3d86603f1/lib/_tls_wrap.js#L1636
+		*/
+		handle.getEphemeralKeyInfo = () => {
+			return {
+				type: "ECDH",
+				name: "X25519",
+				size: 253
+			};
+		};
+		const requestedAlpnProtocols = this.#tlsConnectionOptions?.ALPNProtocols;
+		if (Array.isArray(requestedAlpnProtocols) && requestedAlpnProtocols.length > 0) {
+			const [preferredProtocol] = requestedAlpnProtocols;
+			/**
+			* @note Reflect the client's preferred ALPN protocol as the
+			* negotiated one. The mocked server accepts whatever the
+			* client prefers.
+			*/
+			handle.getALPNNegotiatedProtocol = () => {
+				return typeof preferredProtocol === "string" ? preferredProtocol : false;
+			};
+		}
+		this.socket.once("connect", () => {
+			/**
+			* @note A TLS 1.3 handshake derives five secrets, each reported
+			* via a separate "keylog" event before the handshake completes.
+			* Reflect them with mocked key material matching the mocked
+			* cipher (SHA-384 secrets; the format is "LABEL <client random>
+			* <secret>", each value hex-encoded).
+			*/
+			const mockedClientRandom = "0".repeat(64);
+			const mockedSecret = "0".repeat(96);
+			for (const keylogLabel of [
+				"SERVER_HANDSHAKE_TRAFFIC_SECRET",
+				"EXPORTER_SECRET",
+				"SERVER_TRAFFIC_SECRET_0",
+				"CLIENT_HANDSHAKE_TRAFFIC_SECRET",
+				"CLIENT_TRAFFIC_SECRET_0"
+			]) this.socket.emit("keylog", Buffer.from(`${keylogLabel} ${mockedClientRandom} ${mockedSecret}\n`));
+			handle.onhandshakedone();
+			/**
+			* @note A TLS 1.3 server issues two session tickets by default,
+			* each emitting a separate "session" event on the client.
+			*/
+			handle.onnewsession(1, Buffer.from("mocked session"));
+			handle.onnewsession(2, Buffer.from("mocked session"));
+		});
+		super.claim();
+	}
+	passthrough(flushPendingData) {
+		const realSocket = super.passthrough(flushPendingData);
+		/**
+		* @note Remove the internal "connect" listener added by the TLS socket.
+		* Normally, that listener manages the SSL handshake. But since we're in passthrough,
+		* we delegate that to the real socket. Leaving the listener on the mock socket while
+		* inheriting the real socket's handle will result in the handshake performed twice, which is a no-op.
+		* @see https://github.com/nodejs/node/blob/abddfc921bf2af02a04a6a5d2bca8e2d91d80958/lib/internal/tls/wrap.js#L1105
+		*
+		* This prevents the following error:
+		*  #  node (vitest 4)[8686]: static void node::crypto::TLSWrap::Start(const FunctionCallbackInfo<Value> &) at ../src/crypto/crypto_tls.cc:589
+		#  Assertion failed: !wrap->started_
+		*/
+		for (const connectListener of this.socket.listeners("connect")) if (connectListener === this.socket._start || "listener" in connectListener && connectListener.listener === this.socket._start) this.socket.removeListener("connect", connectListener);
+		realSocket.on("secure", () => {
+			this.socket.emit("secure");
+		}).on("session", (...args) => {
+			this.socket.emit("session", ...args);
+		}).on("keylog", (...args) => {
+			this.socket.emit("keylog", ...args);
+		}).on("OCSPResponse", (...args) => {
+			this.socket.emit("OCSPResponse", ...args);
+		});
+		return realSocket;
+	}
+};
+//#endregion
+//#region src/interceptors/net/utils/normalize-tls-connect-args.ts
+function normalizeTlsConnectArgs(args) {
+	/**
+	* @note Despite incorrect type definitions, "tls.connect()" has all the
+	* options of "net.connect()" and then those specific to TLS connections,
+	* like "session" or "socket".
+	* @see https://github.com/nodejs/node/blob/bdc8131fa78089b81b74dbff467365afb6536e6a/lib/internal/tls/wrap.js#L1615
+	*/
+	const netConnectArgs = normalizeNetConnectArgs(args);
+	const options = netConnectArgs[0];
+	const callback = netConnectArgs[1];
+	if (args[0] !== null && typeof args[0] === "object") Object.assign(options, args[0]);
+	else if (args[1] !== null && typeof args[1] === "object") Object.assign(options, args[1]);
+	else if (args[2] !== null && typeof args[2] === "object") Object.assign(options, args[2]);
+	return callback ? [options, callback] : [options];
+}
+//#endregion
+//#region src/interceptors/net/index.ts
+var SocketConnectionEvent = class extends TypedEvent {
+	constructor(data) {
+		super(...["connection", {}]);
+		this.socket = data.socket;
+		this.connectionOptions = data.connectionOptions;
+		this.controller = data.controller;
+	}
+};
+const logger = createLogger("socket");
+/**
+* A DNS lookup function for intercepted sockets. It always succeeds,
+* resolving any hostname to the loopback address. This ensures the
+* "lookup"/"connectionAttempt" socket events fire even for non-existent
+* hosts, and no real DNS resolution is performed. Passthrough
+* connections are created with the original options and use the real
+* (or the caller's custom) lookup instead.
+*/
+const mockLookup = (hostname, dnsOptions, callback) => {
+	const family = dnsOptions.family === 6 ? 6 : 4;
+	const address = family === 6 ? "::1" : "127.0.0.1";
+	/**
+	* @note Call back asynchronously since DNS lookup is always
+	* asynchronous in Node.js. Calling back synchronously emits
+	* the "lookup"/"connectionAttempt" socket events before the
+	* consumer gets a chance to add listeners for them.
+	*/
+	process.nextTick(() => {
+		/**
+		* @note Honor the Node.js lookup contract: the callback receives
+		* an array of addresses only when the "all" option is set
+		* (e.g. during the family autoselection). Otherwise, it receives
+		* a single address and its family. Node.js rejects an array in
+		* the latter case with "ERR_INVALID_IP_ADDRESS".
+		*/
+		if (dnsOptions.all) {
+			callback(null, [{
+				address,
+				family
+			}]);
+			return;
+		}
+		callback(null, address, family);
+	});
+};
+/**
+* Interceptor for `net.Socket` connections.
+*/
+var SocketInterceptor = class extends Interceptor {
+	static {
+		this.symbol = Symbol.for("socket-interceptor");
+	}
+	predicate() {
+		return true;
+	}
+	setup() {
+		const interceptor = this;
+		/**
+		* @note A synchronous re-entrancy latch for creating passthrough
+		* TLS connections. The original "tls.connect()" constructs a TLS
+		* socket and calls "socket.connect()" on it synchronously, and that
+		* call must reach Node.js as-is instead of being intercepted again.
+		*/
+		let isCreatingPassthroughConnection = false;
+		this.subscriptions.push(
+			/**
+			* @note Intercept connections at the "net.Socket.prototype.connect"
+			* level instead of patching the "net.connect()" module function.
+			* ESM consumers snapshot the module bindings at import time
+			* ("import * as net from 'node:net'"), so reassigning "net.connect"
+			* is invisible to them. Every client connection ends up calling
+			* "Socket.prototype.connect" (including the one made by the original
+			* "net.connect()"), and prototype mutations are visible regardless
+			* of how the module was imported.
+			*/
+			patchesRegistry.applyPatch(net.Socket.prototype, "connect", (realSocketConnect) => {
+				return function connect(...args) {
+					const socket = this;
+					/**
+					* @note Skip the sockets this interceptor already controls
+					* (the mock connect call below, re-connects of an intercepted
+					* socket, passthrough sockets) and the sockets created while
+					* dialing a passthrough TLS connection. Their connects must
+					* reach Node.js as-is.
+					*/
+					if (socket[kPatched] || isCreatingPassthroughConnection) return realSocketConnect.apply(socket, args);
+					logger.verbose("socket.connect() %o", args);
+					/**
+					* @note The original "net.connect()"/"tls.connect()" normalize
+					* the arguments themselves and call this method with the
+					* normalized array instead of the individual arguments.
+					*/
+					const connectArgs = Array.isArray(args[0]) ? args[0] : args;
+					const [transportConnectionOptions, connectionCallback] = normalizeNetConnectArgs(connectArgs);
+					logger.verbose("connection options %o", {
+						transportConnectionOptions,
+						connectionCallback
+					});
+					let controller;
+					let connectionOptions;
+					if (socket instanceof tls.TLSSocket) {
+						/**
+						* @note TLS sockets arrive here from the original
+						* "tls.connect()", which connects the transport of the TLS
+						* socket it constructs ("connectionCallback" is its internal
+						* "_start" handshake trigger). The original TLS connection
+						* options are recovered from the socket instance since the
+						* construction has already happened.
+						*/
+						const realTlsConnectionOptions = getTlsConnectOptions(socket);
+						const [tlsConnectionOptions] = normalizeTlsConnectArgs([{
+							...transportConnectionOptions,
+							...realTlsConnectionOptions
+						}]);
+						connectionOptions = tlsConnectionOptions;
+						controller = new TlsSocketController(socket, () => {
+							/**
+							* @note Create the passthrough connection via the original
+							* "tls.connect()" with the original connection options
+							* (the real DNS lookup and the caller's certificate
+							* validation included). The latch exempts the transport
+							* connect of that connection from interception.
+							*/
+							isCreatingPassthroughConnection = true;
+							try {
+								return tls.connect(realTlsConnectionOptions ?? tlsConnectionOptions);
+							} finally {
+								isCreatingPassthroughConnection = false;
+							}
+						}, tlsConnectionOptions);
+					} else {
+						/**
+						* @note Create passthrough connections without the connection
+						* callback. The callback is already registered as a "connect"
+						* listener on the consumer's socket. Passing it to the
+						* passthrough connection would invoke it twice.
+						*/
+						const passthroughArgs = connectArgs.filter((arg) => {
+							return typeof arg !== "function";
+						});
+						/**
+						* @note Create the passthrough socket with the original
+						* options, the same way "net.connect()" does. Connect it via
+						* the unpatched method so the passthrough connection is not
+						* intercepted again.
+						*/
+						const socketOptions = connectArgs[0] !== null && typeof connectArgs[0] === "object" && !("href" in connectArgs[0]) ? connectArgs[0] : {};
+						connectionOptions = transportConnectionOptions;
+						controller = new TcpSocketController(socket, () => {
+							const passthroughSocket = new net.Socket(socketOptions);
+							Reflect.apply(realSocketConnect, passthroughSocket, passthroughArgs);
+							return passthroughSocket;
+						});
+					}
+					process.nextTick(() => {
+						if (socket.destroyed) return;
+						if (!interceptor.emitter.emit(new SocketConnectionEvent({
+							socket: controller.serverSocket,
+							controller,
+							connectionOptions
+						}))) {
+							logger.verbose("no \"connection\" listeners found on the interceptor, passthrough...");
+							controller.passthrough();
+							return;
+						}
+						logger.verbose("emitted \"connection\" event!");
+					});
+					logger.verbose("connecting the socket...");
+					/**
+					* @note The requested local address/port are stripped from the
+					* actual "socket.connect()" call by the controller to prevent
+					* binding the intercepted socket (see the "connect" proxy).
+					*/
+					const mockConnectionOptions = { ...transportConnectionOptions };
+					mockConnectionOptions.lookup = mockLookup;
+					try {
+						/**
+						* @note The normalized options are looser than the declared
+						* "SocketConnectOpts" (e.g. the port may be a string when a
+						* URL is passed). Node.js validates them at runtime.
+						* This call goes through the controller's "connect" proxy
+						* and lands back in this patch, where the "kPatched" check
+						* above delegates it to the unpatched method.
+						*/
+						return socket.connect(mockConnectionOptions, connectionCallback ?? void 0);
+					} catch (error) {
+						/**
+						* @note "socket.connect()" can throw synchronously on invalid
+						* input (e.g. a bad port). Destroy the socket so the pending
+						* interception tick does not act on it, then let the error
+						* propagate to the consumer like in Node.js.
+						*/
+						socket.destroy();
+						throw error;
+					}
+				};
+			}),
+			this.#stopReusingUnpatchedSockets()
+		);
+		/**
+		* @note "net.connect()"/"net.createConnection()" need no patching of
+		* their own: both construct a "net.Socket" and call the patched
+		* "Socket.prototype.connect" on it.
+		*/
+	}
+	/**
+	* Prevent the `net.Socket` instances created before this interceptor
+	* was applied from getting reused by an `Agent`. Purging them from the
+	* keep-alive pool forces the agent to establish new (intercepted)
+	* connections instead.
+	*/
+	#stopReusingUnpatchedSockets() {
+		/**
+		* @note "Agent.prototype.addRequest" is undocumented but stable:
+		* its signature changed once (the keep-alive Agent rewrite in
+		* Node.js 0.12), and the ecosystem (agent-base, agentkeepalive,
+		* APM wrappers) has relied on it ever since. "https.Agent"
+		* inherits it, so a single patch covers both.
+		*/
+		if (typeof http.Agent.prototype.addRequest !== "function") return () => {};
+		return patchesRegistry.applyPatch(http.Agent.prototype, "addRequest", (realAddRequest) => {
+			return function(...args) {
+				/**
+				* @note Destroy the free sockets created before the interceptor
+				* was applied. Destroying flips their "destroyed" state
+				* synchronously, so the original "addRequest" below discards
+				* them and dials a new (intercepted) connection instead.
+				* The "freeSockets" pool only contains idle sockets by
+				* definition, so destroying them aborts nothing in-flight.
+				*/
+				for (const sockets of Object.values(this.freeSockets)) {
+					if (sockets == null) continue;
+					for (const socket of sockets) if (!socket[kPatched]) socket.destroy();
+				}
+				return realAddRequest?.apply(this, args);
+			};
+		});
+	}
+};
+//#endregion
+export { getDeepPropertyDescriptor as a, unwrapPendingData as i, SocketController as n, patchesRegistry as o, kRawSocket as r, SocketInterceptor as t };
+
+//# sourceMappingURL=net-DtMnyEeg.js.map