@xiaoso/dsh-tool-plus 0.1.0-beta.2 → 0.1.0-beta.4

package/lib/perplexity-Uu7Jzg5b.mjs

@@ -0,0 +1,194 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { D as Cookie, E as $, O as CookieMap, P as $env } from "./src-lDmkSRbm.mjs";
+import { V as ProviderHttpError, _ as OnPromptRequiredError, c as OAuthError, h as LoginCancelledError } from "./error-yCSG0mGC.mjs";
+import * as os from "node:os";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/registry/oauth/perplexity.ts
+/**
+* Perplexity login and token refresh.
+*
+* Login paths (in priority order):
+* 1. macOS native app: reads JWT from NSUserDefaults (`defaults read ai.perplexity.mac authToken`)
+* 2. HTTP email OTP: `GET /api/auth/csrf` → `POST /api/auth/signin-email` → `POST /api/auth/signin-otp`
+*
+* No browser or manual cookie paste required.
+* Refresh: Socket.IO `refreshJWT` RPC over authenticated WebSocket connection.
+*
+* Protocol: Engine.IO v4 + Socket.IO v4 over WebSocket (bypasses Cloudflare managed challenge).
+* Architecture reverse-engineered from Perplexity macOS app (ai.perplexity.mac).
+*/
+const API_VERSION = "2.18";
+const NATIVE_APP_BUNDLE = "ai.perplexity.mac";
+const APP_USER_AGENT = "Perplexity/641 CFNetwork/1568 Darwin/25.2.0";
+function serializeCookies(cookies) {
+	let header = "";
+	for (const [name, value] of cookies) header += `${header ? "; " : ""}${name}=${value}`;
+	return header;
+}
+function rememberCookies(cookies, response) {
+	for (const setCookie of response.headers.getSetCookie()) {
+		const cookie = Cookie.parse(setCookie);
+		if (cookie.isExpired()) cookies.delete(cookie.name);
+		else cookies.set(cookie.name, cookie.value);
+	}
+}
+/**
+* Extract expiry from a JWT. Perplexity tokens generally lack an `exp` claim
+* (their sessions are server-side and effectively non-expiring from the client's
+* point of view), so we return a far-future sentinel when no `exp` is present.
+* When `exp` IS present, subtract a 5-minute safety margin.
+*/
+const NEVER_EXPIRES = 864e13;
+function getJwtExpiry(token) {
+	try {
+		const parts = token.split(".");
+		if (parts.length !== 3) return NEVER_EXPIRES;
+		const payload = parts[1] ?? "";
+		const decoded = JSON.parse(atob(payload.replace(/-/g, "+").replace(/_/g, "/")));
+		if (typeof decoded?.exp === "number" && Number.isFinite(decoded.exp)) return decoded.exp * 1e3 - 3e5;
+	} catch {}
+	return NEVER_EXPIRES;
+}
+/** Build OAuthCredentials from a Perplexity JWT string. */
+function jwtToCredentials(jwt, email) {
+	return {
+		access: jwt,
+		refresh: jwt,
+		expires: getJwtExpiry(jwt),
+		email
+	};
+}
+/**
+* Read the Perplexity JWT from the native macOS Catalyst app's UserDefaults.
+* Tokens are stored in NSUserDefaults (not Keychain), readable by any same-UID process.
+*/
+async function extractFromNativeApp() {
+	if (os.platform() !== "darwin") return null;
+	try {
+		const result = await $`defaults read ${NATIVE_APP_BUNDLE} authToken`.quiet().nothrow();
+		if (result.exitCode !== 0) return null;
+		const token = result.text().trim();
+		if (!token || token === "(null)") return null;
+		return token;
+	} catch {
+		return null;
+	}
+}
+/**
+* Send email OTP and exchange it for a Perplexity JWT via HTTP endpoints.
+*/
+async function httpEmailLogin(ctrl) {
+	if (!ctrl.onPrompt) throw new OnPromptRequiredError("Perplexity");
+	const trimmedEmail = (await ctrl.onPrompt({
+		message: "Enter your Perplexity email address",
+		placeholder: "user@example.com"
+	})).trim();
+	if (!trimmedEmail) throw new OAuthError("Email is required for Perplexity login", {
+		kind: "validation",
+		provider: "perplexity"
+	});
+	if (ctrl.signal?.aborted) throw new LoginCancelledError();
+	const fetchImpl = ctrl.fetch ?? fetch;
+	const cookies = new CookieMap();
+	const request = async (url, init = {}) => {
+		const headers = new Headers(init.headers);
+		if (cookies.size > 0) headers.set("Cookie", serializeCookies(cookies));
+		const response = await fetchImpl(url, {
+			...init,
+			headers
+		});
+		rememberCookies(cookies, response);
+		return response;
+	};
+	ctrl.onProgress?.("Fetching Perplexity CSRF token...");
+	const csrfResponse = await request("https://www.perplexity.ai/api/auth/csrf", {
+		headers: {
+			"User-Agent": APP_USER_AGENT,
+			"X-App-ApiVersion": API_VERSION
+		},
+		signal: ctrl.signal
+	});
+	if (!csrfResponse.ok) throw new ProviderHttpError(`Perplexity CSRF request failed: ${csrfResponse.status}`, csrfResponse.status);
+	const csrfData = await csrfResponse.json();
+	if (!csrfData.csrfToken) throw new OAuthError("Perplexity CSRF response missing csrfToken", {
+		kind: "validation",
+		provider: "perplexity"
+	});
+	ctrl.onProgress?.("Sending login code to your email...");
+	const sendResponse = await request("https://www.perplexity.ai/api/auth/signin-email", {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			"User-Agent": APP_USER_AGENT,
+			"X-App-ApiVersion": API_VERSION
+		},
+		body: JSON.stringify({
+			email: trimmedEmail,
+			csrfToken: csrfData.csrfToken
+		}),
+		signal: ctrl.signal
+	});
+	if (!sendResponse.ok) {
+		const body = await sendResponse.text();
+		throw new ProviderHttpError(`Perplexity send login code failed (${sendResponse.status}): ${body}`, sendResponse.status);
+	}
+	const trimmedOtp = (await ctrl.onPrompt({
+		message: "Enter the code sent to your email",
+		placeholder: "123456"
+	})).trim();
+	if (!trimmedOtp) throw new OAuthError("OTP code is required", {
+		kind: "validation",
+		provider: "perplexity"
+	});
+	if (ctrl.signal?.aborted) throw new LoginCancelledError();
+	ctrl.onProgress?.("Verifying login code...");
+	const verifyResponse = await request("https://www.perplexity.ai/api/auth/signin-otp", {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			"User-Agent": APP_USER_AGENT,
+			"X-App-ApiVersion": API_VERSION
+		},
+		body: JSON.stringify({
+			email: trimmedEmail,
+			otp: trimmedOtp,
+			csrfToken: csrfData.csrfToken
+		}),
+		signal: ctrl.signal
+	});
+	const verifyData = await verifyResponse.json();
+	if (!verifyResponse.ok) {
+		const reason = verifyData.text ?? verifyData.error_code ?? verifyData.status ?? "OTP verification failed";
+		throw new OAuthError(`Perplexity OTP verification failed: ${reason}`, {
+			kind: "validation",
+			provider: "perplexity",
+			status: verifyResponse.status
+		});
+	}
+	if (!verifyData.token) throw new OAuthError("Perplexity OTP verification response missing token", {
+		kind: "validation",
+		provider: "perplexity"
+	});
+	return jwtToCredentials(verifyData.token, trimmedEmail);
+}
+/**
+* Login to Perplexity.
+*
+* Tries auto-extraction from the desktop app, then runs HTTP email OTP login.
+*
+* No browser/manual token paste fallback is used.
+*/
+async function loginPerplexity(ctrl) {
+	if (!ctrl.onPrompt) throw new OnPromptRequiredError("Perplexity");
+	if (!$env.PI_AUTH_NO_BORROW) {
+		ctrl.onProgress?.("Checking for Perplexity desktop app...");
+		const nativeJwt = await extractFromNativeApp();
+		if (nativeJwt) {
+			ctrl.onProgress?.("Found Perplexity JWT from native app");
+			return jwtToCredentials(nativeJwt);
+		}
+	}
+	return httpEmailLogin(ctrl);
+}
+//#endregion
+export { loginPerplexity };

package/lib/proxy-DDqrmjjC.mjs

@@ -0,0 +1,190 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { n as StreamTimeoutError, r as ValidationError, v as AbortError } from "./error-yCSG0mGC.mjs";
+import * as tls from "node:tls";
+import * as net from "node:net";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/utils/proxy.ts
+/**
+* Checks if a host is local or cloud metadata, which should always bypass the proxy
+* (e.g. localhost, 127/8, ::1, 169.254.169.254, metadata.google.internal).
+*/
+function isLocalOrMetadataHost(host) {
+	const lowerHost = host.toLowerCase();
+	if (lowerHost === "localhost" || lowerHost.endsWith(".localhost") || lowerHost === "metadata.google.internal") return true;
+	const ip = lowerHost.replace(/^\[|\]$/g, "");
+	const v4 = ip.match(/^(\d{1,3})\.(\d{1,3})\.\d{1,3}\.\d{1,3}$/);
+	if (v4) {
+		const a = Number(v4[1]);
+		const b = Number(v4[2]);
+		if (a === 127 || a === 10 || a === 0) return true;
+		if (a === 169 && b === 254) return true;
+		if (a === 192 && b === 168) return true;
+		if (a === 172 && b >= 16 && b <= 31) return true;
+		return false;
+	}
+	if (ip === "::1" || ip === "::") return true;
+	if (/^fe[89ab][0-9a-f]:/.test(ip)) return true;
+	if (/^f[cd][0-9a-f]{2}:/.test(ip)) return true;
+	return false;
+}
+/**
+* Check if the url should bypass the proxy due to hard-coded localhost/metadata checks
+* or custom NO_PROXY/no_proxy environment variables rules.
+*/
+function shouldBypassProxy(urlObj) {
+	if (isLocalOrMetadataHost(urlObj.hostname)) return true;
+	const noProxyVal = Bun.env.NO_PROXY || Bun.env.no_proxy;
+	if (!noProxyVal) return false;
+	const rules = noProxyVal.split(/[,\s]+/).map((r) => r.trim()).filter(Boolean);
+	const targetHost = urlObj.hostname.toLowerCase();
+	const targetPort = urlObj.port || (urlObj.protocol === "https:" || urlObj.protocol === "wss:" ? "443" : "80");
+	for (const rule of rules) {
+		if (rule === "*") return true;
+		let ruleHost = rule.toLowerCase();
+		let rulePort;
+		if (ruleHost.includes("]:")) {
+			const lastColon = ruleHost.lastIndexOf(":");
+			rulePort = ruleHost.slice(lastColon + 1);
+			ruleHost = ruleHost.slice(0, lastColon);
+		} else if (!ruleHost.includes("]") && ruleHost.includes(":")) {
+			const lastColon = ruleHost.lastIndexOf(":");
+			rulePort = ruleHost.slice(lastColon + 1);
+			ruleHost = ruleHost.slice(0, lastColon);
+		}
+		ruleHost = ruleHost.replace(/^\[|\]$/g, "");
+		if (rulePort && rulePort !== targetPort) continue;
+		if (ruleHost.startsWith(".")) {
+			const suffix = ruleHost;
+			if (targetHost === ruleHost.slice(1) || targetHost.endsWith(suffix)) return true;
+		} else if (targetHost === ruleHost || targetHost.endsWith(`.${ruleHost}`)) return true;
+	}
+	return false;
+}
+const proxyCache = /* @__PURE__ */ new Map();
+/**
+* Normalizes provider id (e.g. github-copilot -> PI_PROXY_GITHUB_COPILOT) and looks it up.
+* If not found, falls back to PI_PROXY. Results are memoized because env values are static
+* for the lifetime of the process and this function is called for every outgoing request.
+*/
+function getProxyForProvider(provider) {
+	if (proxyCache.has(provider)) return proxyCache.get(provider);
+	const envKey = `PI_PROXY_${provider.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`;
+	const value = Bun.env[envKey] || Bun.env.PI_PROXY;
+	proxyCache.set(provider, value);
+	return value;
+}
+/** Resolves provider-specific and standard proxy variables for a target URL, honoring NO_PROXY. */
+function getProxyForUrl(provider, url) {
+	if (shouldBypassProxy(url)) return void 0;
+	const protocolProxy = url.protocol === "https:" || url.protocol === "wss:" ? Bun.env.HTTPS_PROXY || Bun.env.https_proxy : Bun.env.HTTP_PROXY || Bun.env.http_proxy;
+	return getProxyForProvider(provider) || protocolProxy || Bun.env.ALL_PROXY || Bun.env.all_proxy || void 0;
+}
+/**
+* Tunnel a socket connection through an HTTP CONNECT proxy.
+* This is used specifically to wrap Node's `http2.connect(baseUrl, { createConnection })` for Cursor.
+*/
+async function connectProxiedSocket(proxyUrlStr, targetUrlStr, options) {
+	if (options?.signal?.aborted) throw new AbortError("Proxy tunnel aborted");
+	const proxyUrl = new URL(proxyUrlStr);
+	const targetUrl = new URL(targetUrlStr);
+	const useProxySsl = proxyUrl.protocol === "https:";
+	const proxyPort = proxyUrl.port ? parseInt(proxyUrl.port, 10) : useProxySsl ? 443 : 80;
+	const proxyHost = proxyUrl.hostname;
+	const targetPort = targetUrl.port ? parseInt(targetUrl.port, 10) : 443;
+	const targetHost = targetUrl.hostname;
+	const { promise, resolve, reject } = Promise.withResolvers();
+	const readyEvent = useProxySsl ? "secureConnect" : "connect";
+	let rawSocket;
+	let tunnelSocket;
+	let timeout;
+	let responseData = "";
+	let settled = false;
+	const cleanup = () => {
+		if (timeout) {
+			clearTimeout(timeout);
+			timeout = void 0;
+		}
+		options?.signal?.removeEventListener("abort", onAbort);
+		rawSocket?.off("error", onRawError);
+		rawSocket?.off(readyEvent, onProxyReady);
+		rawSocket?.off("data", onProxyData);
+		tunnelSocket?.off("secureConnect", onTunnelReady);
+		tunnelSocket?.off("error", onTunnelError);
+	};
+	const destroyInProgress = () => {
+		tunnelSocket?.destroy();
+		rawSocket?.destroy();
+	};
+	const rejectOnce = (error) => {
+		if (settled) return;
+		settled = true;
+		cleanup();
+		destroyInProgress();
+		reject(error);
+	};
+	const resolveOnce = (socket) => {
+		if (settled) return;
+		settled = true;
+		cleanup();
+		resolve(socket);
+	};
+	const onAbort = () => rejectOnce(new AbortError("Proxy tunnel aborted"));
+	const onRawError = (error) => rejectOnce(error);
+	const onTunnelError = (error) => rejectOnce(error);
+	const onTunnelReady = () => {
+		if (!tunnelSocket) return;
+		resolveOnce(tunnelSocket);
+	};
+	const onProxyData = (chunk) => {
+		if (!rawSocket) return;
+		responseData += chunk.toString("binary");
+		if (!responseData.includes("\r\n\r\n")) return;
+		rawSocket.off("data", onProxyData);
+		rawSocket.off("error", onRawError);
+		const firstLine = responseData.split("\r\n")[0];
+		if (!firstLine.includes(" 200 ")) {
+			rejectOnce(new ValidationError(`Proxy tunnel failed: ${firstLine}`));
+			return;
+		}
+		const tlsOptions = options?.tls;
+		tunnelSocket = tls.connect({
+			...tlsOptions,
+			socket: rawSocket,
+			servername: tlsOptions?.servername ?? targetHost,
+			ALPNProtocols: tlsOptions?.ALPNProtocols ?? ["h2"]
+		});
+		tunnelSocket.once("secureConnect", onTunnelReady);
+		tunnelSocket.once("error", onTunnelError);
+	};
+	const onProxyReady = () => {
+		if (!rawSocket) return;
+		let connectReq = `CONNECT ${targetHost}:${targetPort} HTTP/1.1\r\nHost: ${targetHost}:${targetPort}\r\n`;
+		if (proxyUrl.username || proxyUrl.password) {
+			const creds = Buffer.from(`${decodeURIComponent(proxyUrl.username)}:${decodeURIComponent(proxyUrl.password)}`).toString("base64");
+			connectReq += `Proxy-Authorization: Basic ${creds}\r\n`;
+		}
+		connectReq += "\r\n";
+		rawSocket.write(connectReq);
+		rawSocket.on("data", onProxyData);
+	};
+	options?.signal?.addEventListener("abort", onAbort, { once: true });
+	if (options?.timeoutMs !== void 0 && Number.isFinite(options.timeoutMs) && options.timeoutMs > 0) {
+		const timeoutMs = Math.trunc(options.timeoutMs);
+		timeout = setTimeout(() => {
+			rejectOnce(new StreamTimeoutError(`Proxy tunnel timed out after ${timeoutMs}ms`));
+		}, timeoutMs);
+		timeout.unref?.();
+	}
+	rawSocket = useProxySsl ? tls.connect({
+		host: proxyHost,
+		port: proxyPort
+	}) : net.connect({
+		host: proxyHost,
+		port: proxyPort
+	});
+	rawSocket.once("error", onRawError);
+	rawSocket.once(readyEvent, onProxyReady);
+	return promise;
+}
+//#endregion
+export { shouldBypassProxy as a, isLocalOrMetadataHost as i, getProxyForProvider as n, getProxyForUrl as r, connectProxiedSocket as t };

package/lib/proxy-ZtUcl6r5.mjs

@@ -0,0 +1,190 @@
+import { installBunShim as __installBunShim } from "./bun-shim.mjs";
+__installBunShim();
+import { n as StreamTimeoutError, r as ValidationError, v as AbortError } from "./error-B3bevhrs.mjs";
+import * as tls from "node:tls";
+import * as net from "node:net";
+//#region node_modules/.pnpm/@oh-my-pi+pi-ai@17.3.5/node_modules/@oh-my-pi/pi-ai/src/utils/proxy.ts
+/**
+* Checks if a host is local or cloud metadata, which should always bypass the proxy
+* (e.g. localhost, 127/8, ::1, 169.254.169.254, metadata.google.internal).
+*/
+function isLocalOrMetadataHost(host) {
+	const lowerHost = host.toLowerCase();
+	if (lowerHost === "localhost" || lowerHost.endsWith(".localhost") || lowerHost === "metadata.google.internal") return true;
+	const ip = lowerHost.replace(/^\[|\]$/g, "");
+	const v4 = ip.match(/^(\d{1,3})\.(\d{1,3})\.\d{1,3}\.\d{1,3}$/);
+	if (v4) {
+		const a = Number(v4[1]);
+		const b = Number(v4[2]);
+		if (a === 127 || a === 10 || a === 0) return true;
+		if (a === 169 && b === 254) return true;
+		if (a === 192 && b === 168) return true;
+		if (a === 172 && b >= 16 && b <= 31) return true;
+		return false;
+	}
+	if (ip === "::1" || ip === "::") return true;
+	if (/^fe[89ab][0-9a-f]:/.test(ip)) return true;
+	if (/^f[cd][0-9a-f]{2}:/.test(ip)) return true;
+	return false;
+}
+/**
+* Check if the url should bypass the proxy due to hard-coded localhost/metadata checks
+* or custom NO_PROXY/no_proxy environment variables rules.
+*/
+function shouldBypassProxy(urlObj) {
+	if (isLocalOrMetadataHost(urlObj.hostname)) return true;
+	const noProxyVal = Bun.env.NO_PROXY || Bun.env.no_proxy;
+	if (!noProxyVal) return false;
+	const rules = noProxyVal.split(/[,\s]+/).map((r) => r.trim()).filter(Boolean);
+	const targetHost = urlObj.hostname.toLowerCase();
+	const targetPort = urlObj.port || (urlObj.protocol === "https:" || urlObj.protocol === "wss:" ? "443" : "80");
+	for (const rule of rules) {
+		if (rule === "*") return true;
+		let ruleHost = rule.toLowerCase();
+		let rulePort;
+		if (ruleHost.includes("]:")) {
+			const lastColon = ruleHost.lastIndexOf(":");
+			rulePort = ruleHost.slice(lastColon + 1);
+			ruleHost = ruleHost.slice(0, lastColon);
+		} else if (!ruleHost.includes("]") && ruleHost.includes(":")) {
+			const lastColon = ruleHost.lastIndexOf(":");
+			rulePort = ruleHost.slice(lastColon + 1);
+			ruleHost = ruleHost.slice(0, lastColon);
+		}
+		ruleHost = ruleHost.replace(/^\[|\]$/g, "");
+		if (rulePort && rulePort !== targetPort) continue;
+		if (ruleHost.startsWith(".")) {
+			const suffix = ruleHost;
+			if (targetHost === ruleHost.slice(1) || targetHost.endsWith(suffix)) return true;
+		} else if (targetHost === ruleHost || targetHost.endsWith(`.${ruleHost}`)) return true;
+	}
+	return false;
+}
+const proxyCache = /* @__PURE__ */ new Map();
+/**
+* Normalizes provider id (e.g. github-copilot -> PI_PROXY_GITHUB_COPILOT) and looks it up.
+* If not found, falls back to PI_PROXY. Results are memoized because env values are static
+* for the lifetime of the process and this function is called for every outgoing request.
+*/
+function getProxyForProvider(provider) {
+	if (proxyCache.has(provider)) return proxyCache.get(provider);
+	const envKey = `PI_PROXY_${provider.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`;
+	const value = Bun.env[envKey] || Bun.env.PI_PROXY;
+	proxyCache.set(provider, value);
+	return value;
+}
+/** Resolves provider-specific and standard proxy variables for a target URL, honoring NO_PROXY. */
+function getProxyForUrl(provider, url) {
+	if (shouldBypassProxy(url)) return void 0;
+	const protocolProxy = url.protocol === "https:" || url.protocol === "wss:" ? Bun.env.HTTPS_PROXY || Bun.env.https_proxy : Bun.env.HTTP_PROXY || Bun.env.http_proxy;
+	return getProxyForProvider(provider) || protocolProxy || Bun.env.ALL_PROXY || Bun.env.all_proxy || void 0;
+}
+/**
+* Tunnel a socket connection through an HTTP CONNECT proxy.
+* This is used specifically to wrap Node's `http2.connect(baseUrl, { createConnection })` for Cursor.
+*/
+async function connectProxiedSocket(proxyUrlStr, targetUrlStr, options) {
+	if (options?.signal?.aborted) throw new AbortError("Proxy tunnel aborted");
+	const proxyUrl = new URL(proxyUrlStr);
+	const targetUrl = new URL(targetUrlStr);
+	const useProxySsl = proxyUrl.protocol === "https:";
+	const proxyPort = proxyUrl.port ? parseInt(proxyUrl.port, 10) : useProxySsl ? 443 : 80;
+	const proxyHost = proxyUrl.hostname;
+	const targetPort = targetUrl.port ? parseInt(targetUrl.port, 10) : 443;
+	const targetHost = targetUrl.hostname;
+	const { promise, resolve, reject } = Promise.withResolvers();
+	const readyEvent = useProxySsl ? "secureConnect" : "connect";
+	let rawSocket;
+	let tunnelSocket;
+	let timeout;
+	let responseData = "";
+	let settled = false;
+	const cleanup = () => {
+		if (timeout) {
+			clearTimeout(timeout);
+			timeout = void 0;
+		}
+		options?.signal?.removeEventListener("abort", onAbort);
+		rawSocket?.off("error", onRawError);
+		rawSocket?.off(readyEvent, onProxyReady);
+		rawSocket?.off("data", onProxyData);
+		tunnelSocket?.off("secureConnect", onTunnelReady);
+		tunnelSocket?.off("error", onTunnelError);
+	};
+	const destroyInProgress = () => {
+		tunnelSocket?.destroy();
+		rawSocket?.destroy();
+	};
+	const rejectOnce = (error) => {
+		if (settled) return;
+		settled = true;
+		cleanup();
+		destroyInProgress();
+		reject(error);
+	};
+	const resolveOnce = (socket) => {
+		if (settled) return;
+		settled = true;
+		cleanup();
+		resolve(socket);
+	};
+	const onAbort = () => rejectOnce(new AbortError("Proxy tunnel aborted"));
+	const onRawError = (error) => rejectOnce(error);
+	const onTunnelError = (error) => rejectOnce(error);
+	const onTunnelReady = () => {
+		if (!tunnelSocket) return;
+		resolveOnce(tunnelSocket);
+	};
+	const onProxyData = (chunk) => {
+		if (!rawSocket) return;
+		responseData += chunk.toString("binary");
+		if (!responseData.includes("\r\n\r\n")) return;
+		rawSocket.off("data", onProxyData);
+		rawSocket.off("error", onRawError);
+		const firstLine = responseData.split("\r\n")[0];
+		if (!firstLine.includes(" 200 ")) {
+			rejectOnce(new ValidationError(`Proxy tunnel failed: ${firstLine}`));
+			return;
+		}
+		const tlsOptions = options?.tls;
+		tunnelSocket = tls.connect({
+			...tlsOptions,
+			socket: rawSocket,
+			servername: tlsOptions?.servername ?? targetHost,
+			ALPNProtocols: tlsOptions?.ALPNProtocols ?? ["h2"]
+		});
+		tunnelSocket.once("secureConnect", onTunnelReady);
+		tunnelSocket.once("error", onTunnelError);
+	};
+	const onProxyReady = () => {
+		if (!rawSocket) return;
+		let connectReq = `CONNECT ${targetHost}:${targetPort} HTTP/1.1\r\nHost: ${targetHost}:${targetPort}\r\n`;
+		if (proxyUrl.username || proxyUrl.password) {
+			const creds = Buffer.from(`${decodeURIComponent(proxyUrl.username)}:${decodeURIComponent(proxyUrl.password)}`).toString("base64");
+			connectReq += `Proxy-Authorization: Basic ${creds}\r\n`;
+		}
+		connectReq += "\r\n";
+		rawSocket.write(connectReq);
+		rawSocket.on("data", onProxyData);
+	};
+	options?.signal?.addEventListener("abort", onAbort, { once: true });
+	if (options?.timeoutMs !== void 0 && Number.isFinite(options.timeoutMs) && options.timeoutMs > 0) {
+		const timeoutMs = Math.trunc(options.timeoutMs);
+		timeout = setTimeout(() => {
+			rejectOnce(new StreamTimeoutError(`Proxy tunnel timed out after ${timeoutMs}ms`));
+		}, timeoutMs);
+		timeout.unref?.();
+	}
+	rawSocket = useProxySsl ? tls.connect({
+		host: proxyHost,
+		port: proxyPort
+	}) : net.connect({
+		host: proxyHost,
+		port: proxyPort
+	});
+	rawSocket.once("error", onRawError);
+	rawSocket.once(readyEvent, onProxyReady);
+	return promise;
+}
+//#endregion
+export { shouldBypassProxy as a, isLocalOrMetadataHost as i, getProxyForProvider as n, getProxyForUrl as r, connectProxiedSocket as t };