abelworkflow 1.0.0 → 1.1.1

package/extensions/pi-gpt-responses-compat/index.ts

@@ -1,23 +1,6 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { createNodeInsecureDispatcher, installProviderTlsFetch } from "./tls-fetch.mjs";
-
-let nodeInsecureDispatcher: unknown;
-
-function getNodeInsecureDispatcher() {
-  if (nodeInsecureDispatcher) return nodeInsecureDispatcher;
-  nodeInsecureDispatcher = createNodeInsecureDispatcher();
-  return nodeInsecureDispatcher;
-}
 
 export default function (pi: ExtensionAPI) {
-  if (typeof globalThis.fetch === "function") {
-    const runtime = typeof (globalThis as any).Bun === "undefined" ? "node" : "bun";
-    installProviderTlsFetch({
-      runtime,
-      insecureDispatcher: runtime === "node" ? getNodeInsecureDispatcher : undefined
-    });
-  }
-
   pi.on("before_provider_request", (event, ctx) => {
     const payload = event.payload as any;
     if (!payload || typeof payload !== "object" || Array.isArray(payload)) return;

package/lib/providers/claude.mjs

@@ -62,23 +62,12 @@ function mergeClaudeSettingsWithDefaults(settings) {
   };
 }
 
-function applyClaudeInsecureTlsSetting(env = {}, enabled = false) {
-  const nextEnv = { ...env };
-  if (enabled) {
-    nextEnv.NODE_TLS_REJECT_UNAUTHORIZED = "0";
-  } else if (nextEnv.NODE_TLS_REJECT_UNAUTHORIZED === "0") {
-    delete nextEnv.NODE_TLS_REJECT_UNAUTHORIZED;
-  }
-  return nextEnv;
-}
-
 function getExistingClaudeApiConfig(settings) {
   const env = mergeClaudeSettingsWithDefaults(settings).env;
   return {
     baseUrl: env.ANTHROPIC_BASE_URL || "https://api.anthropic.com",
     key: env.ANTHROPIC_API_KEY || "",
-    model: claudeModelEnvKeys.map((field) => env[field]).find(Boolean) || "",
-    insecureTls: env.NODE_TLS_REJECT_UNAUTHORIZED === "0"
+    model: claudeModelEnvKeys.map((field) => env[field]).find(Boolean) || ""
   };
 }
 
@@ -109,14 +98,9 @@ function ensureApprovedClaudeApiKey(config, apiKey) {
 function buildClaudeApiSettings(settings, {
   baseUrl,
   key,
-  model,
-  insecureTls = false
+  model
 }) {
   const nextSettings = mergeClaudeSettingsWithDefaults(settings);
-  nextSettings.env = applyClaudeInsecureTlsSetting(
-    nextSettings.env && typeof nextSettings.env === "object" ? nextSettings.env : {},
-    insecureTls
-  );
   nextSettings.env.ANTHROPIC_BASE_URL = baseUrl;
   nextSettings.env.ANTHROPIC_API_KEY = key;
   delete nextSettings.env.ANTHROPIC_AUTH_TOKEN;
@@ -134,7 +118,6 @@ async function persistClaudeConfiguration(paths, { settings, metaConfig }) {
 async function configureClaudeApi(paths = defaultPaths, promptApi) {
   const {
     assertNotCancelled,
-    confirmOrCancel,
     passwordPromptOptions,
     required,
     requiredUnlessExisting,
@@ -158,11 +141,6 @@ async function configureClaudeApi(paths = defaultPaths, promptApi) {
   assertNotCancelled(key);
   const finalKey = resolvePasswordValue(key, existing.key);
 
-  const insecureTls = await confirmOrCancel({
-    message: "是否跳过 Claude Code TLS 证书校验？仅证书无法修复时启用（会放宽该进程全部 HTTPS 请求）",
-    initialValue: existing.insecureTls
-  });
-
   const model = await p.text({
     message: "Claude Code 模型",
     initialValue: existing.model || undefined,
@@ -173,8 +151,7 @@ async function configureClaudeApi(paths = defaultPaths, promptApi) {
   const apiSettings = buildClaudeApiSettings(settings, {
     baseUrl,
     key: finalKey,
-    model,
-    insecureTls
+    model
   });
   const metaConfig = await readJsonFileSafe(paths.claudeMetaConfigPath, {}, { sensitive: true });
   metaConfig.hasCompletedOnboarding = true;
@@ -188,7 +165,6 @@ async function configureClaudeApi(paths = defaultPaths, promptApi) {
 }
 
 export {
-  applyClaudeInsecureTlsSetting,
   buildClaudeApiSettings,
   buildDefaultClaudeSettings,
   configureClaudeApi,

package/lib/providers/codex.mjs

@@ -25,6 +25,8 @@ import {
 import { defaultPaths, maskSecret, pathToLabel } from "../paths.mjs";
 import { normalizeOpenAiBaseUrl } from "./pi.mjs";
 
+const CODEX_ENV_KEY = "OPENAI_API_KEY";
+
 const publishedCodexDeveloperInstructionHashes = new Set([
   "957adb227dd3fc298985acca38db4c22b8e018d387dab91f1ea8287db35385db"
 ]);
@@ -249,13 +251,6 @@ async function deployBundledCodexAgents(paths = defaultPaths, previousManagedFil
   return result;
 }
 
-function getDefaultCodexEnvKey(providerId) {
-  if (providerId === "openai") return "OPENAI_API_KEY";
-  if (providerId === "abelworkflow") return "ABELWORKFLOW_API_KEY";
-  const digest = createHash("sha256").update(providerId).digest("hex").toUpperCase();
-  return `ABELWORKFLOW_PROVIDER_${digest}_API_KEY`;
-}
-
 function getCodexProviderSectionName(providerId) {
   return `model_providers.${formatTomlKeySegment(providerId)}`;
 }
@@ -275,8 +270,7 @@ function assertCodexAuthKeyAvailable(auth, envKey) {
 function resolveExistingCodexApiConfig(content, auth = {}) {
   const providerId = readTopLevelTomlString(content, "model_provider") || "abelworkflow";
   const provider = parseTomlSection(content, getCodexProviderSectionName(providerId));
-  const configuredEnvKey = provider.temp_env_key || "";
-  const envKey = configuredEnvKey || getDefaultCodexEnvKey(providerId);
+  const envKey = CODEX_ENV_KEY;
   assertCodexAuthKeyAvailable(auth, envKey);
   const apiKey = typeof auth[envKey] === "string" ? auth[envKey] : "";
 
@@ -331,7 +325,7 @@ async function configureCodexApi(paths = defaultPaths, promptApi, ownership = {}
   const shouldDeploySubagents = await confirmOrCancel({ message: "是否部署 Codex subagents 配置？", initialValue: true });
   let managedCodexAgentFiles = { ...(ownership.managedCodexAgentFiles ?? {}) };
 
-  const envKey = existing.envKey || "OPENAI_API_KEY";
+  const envKey = CODEX_ENV_KEY;
   const currentContent = await pathExists(paths.codexConfigPath) ? await readFile(paths.codexConfigPath, "utf8") : "";
   const templateContent = await loadBundledCodexConfigTemplate(paths);
   const content = buildCodexConfigContent(currentContent, {
@@ -340,8 +334,7 @@ async function configureCodexApi(paths = defaultPaths, promptApi, ownership = {}
     includeSubagentDefaults: shouldDeploySubagents,
     providerId,
     providerName,
-    baseUrl,
-    envKey
+    baseUrl
   });
 
   const auth = mergeCodexAuthData(
@@ -382,8 +375,7 @@ function buildCodexConfigContent(currentContent, {
   includeSubagentDefaults = true,
   providerId,
   providerName,
-  baseUrl,
-  envKey
+  baseUrl
 }) {
   const effectiveTemplateContent = includeSubagentDefaults
     ? templateContent
@@ -403,7 +395,7 @@ function buildCodexConfigContent(currentContent, {
     name: providerName,
     base_url: baseUrl,
     wire_api: "responses",
-    temp_env_key: envKey,
+    temp_env_key: CODEX_ENV_KEY,
     requires_openai_auth: true,
     supports_websockets: true
   });

package/lib/providers/pi.mjs

@@ -1,7 +1,6 @@
 import { spawn, spawnSync } from "node:child_process";
 import { join } from "node:path";
 import * as p from "@clack/prompts";
-import { piInsecureTlsHeader } from "../../extensions/pi-gpt-responses-compat/tls-fetch.mjs";
 import {
   readJsonFileSafe,
   readJsoncFileSafe,
@@ -310,36 +309,17 @@ function buildPiModelConfig(modelId, existingModel = {}) {
   };
 }
 
-function hasPiInsecureTlsSetting(modelsConfig = {}, providerId) {
-  const headers = modelsConfig.providers?.[requirePiProviderId(providerId)]?.headers;
-  return headers && typeof headers === "object"
-    ? Object.keys(headers).some((key) => key.toLowerCase() === piInsecureTlsHeader)
-    : false;
-}
-
 function buildPiModelsConfig(modelsConfig = {}, {
   providerId,
   baseUrl,
   api,
-  modelIds,
-  insecureTls = false
+  modelIds
 }) {
   const targetProviderId = requirePiProviderId(providerId);
   const providers = modelsConfig.providers && typeof modelsConfig.providers === "object" ? modelsConfig.providers : {};
   const currentProvider = providers[targetProviderId] && typeof providers[targetProviderId] === "object"
     ? providers[targetProviderId]
     : {};
-  const headers = currentProvider.headers && typeof currentProvider.headers === "object"
-    ? { ...currentProvider.headers }
-    : {};
-  for (const key of Object.keys(headers)) {
-    if (key.toLowerCase() === piInsecureTlsHeader) {
-      delete headers[key];
-    }
-  }
-  if (insecureTls) {
-    headers[piInsecureTlsHeader] = new URL(baseUrl).origin;
-  }
   const existingModels = new Map(
     (Array.isArray(currentProvider.models) ? currentProvider.models : [])
       .filter((model) => model?.id)
@@ -357,11 +337,6 @@ function buildPiModelsConfig(modelsConfig = {}, {
     models: modelIds.map((modelId) => buildPiModelConfig(modelId, existingModels.get(modelId)))
   };
   delete provider.apiKey;
-  if (Object.keys(headers).length) {
-    provider.headers = headers;
-  } else {
-    delete provider.headers;
-  }
 
   return {
     ...modelsConfig,
@@ -413,7 +388,6 @@ function buildPiConfiguration({ auth, models, settings }, {
   baseUrl,
   api,
   modelIds,
-  insecureTls,
   defaultModel
 }) {
   const targetProviderId = requirePiProviderId(providerId);
@@ -425,8 +399,7 @@ function buildPiConfiguration({ auth, models, settings }, {
       providerId: targetProviderId,
       baseUrl,
       api,
-      modelIds,
-      insecureTls
+      modelIds
     }),
     settings: buildPiSettingsConfig(settings, targetProviderId, defaultModel)
   };
@@ -455,7 +428,6 @@ async function configurePiApi(paths = defaultPaths, ensurePiResourcesLinked = as
   }
   const {
     assertNotCancelled,
-    confirmOrCancel,
     passwordPromptOptions,
     required,
     requiredUnlessExisting,
@@ -495,11 +467,6 @@ async function configurePiApi(paths = defaultPaths, ensurePiResourcesLinked = as
   const inferredApi = inferPiApiFromBaseUrl(baseUrlInput);
   const baseUrl = normalizeOpenAiBaseUrl(baseUrlInput);
 
-  const insecureTls = await confirmOrCancel({
-    message: `是否仅为 ${providerLabel} 中转请求跳过 TLS 证书校验？仅证书无法修复时启用`,
-    initialValue: hasPiInsecureTlsSetting(modelsConfig, providerId)
-  });
-
   const piApiOptions = getPiApiPromptOptions();
   const initialApi = piApiOptions.some((option) => option.value === existing.api)
     ? existing.api
@@ -542,7 +509,6 @@ async function configurePiApi(paths = defaultPaths, ensurePiResourcesLinked = as
     baseUrl,
     api,
     modelIds,
-    insecureTls,
     defaultModel: finalDefaultModel
   });
   await ensurePiResourcesLinked(paths);
@@ -564,7 +530,6 @@ export {
   configurePiApi,
   detectPiEffectiveModel,
   getPiApiPromptOptions,
-  hasPiInsecureTlsSetting,
   inferPiApiFromBaseUrl,
   normalizeOpenAiBaseUrl,
   parsePiRpcEffectiveModel,

package/lib/providers/skills.mjs

@@ -56,6 +56,15 @@ async function configureGrokSearchEnv(paths, ensureSkillPresent = async () => {}
     initialValue: Boolean(existing.TAVILY_API_KEY)
   });
 
+  const tavilyUrl = useTavily
+    ? await p.text({
+        message: "Tavily API URL",
+        initialValue: existing.TAVILY_API_URL || "https://api.tavily.com",
+        validate: required()
+      })
+    : null;
+  if (useTavily) assertNotCancelled(tavilyUrl);
+
   const tavilyKey = useTavily
     ? await p.password(passwordPromptOptions(
         "Tavily API Key",
@@ -70,6 +79,7 @@ async function configureGrokSearchEnv(paths, ensureSkillPresent = async () => {}
     GROK_API_URL: baseUrl,
     GROK_API_KEY: finalApiKey,
     GROK_MODEL: model,
+    TAVILY_API_URL: tavilyUrl,
     TAVILY_API_KEY: finalTavilyKey,
     TAVILY_ENABLED: useTavily ? "true" : null
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "abelworkflow",
-  "version": "1.0.0",
+  "version": "1.1.1",
   "description": "Install AbelWorkflow into ~/.agents and create Claude/Codex symlinks.",
   "type": "module",
   "scripts": {

package/skills/grok-search/scripts/groksearch_cli.py

@@ -216,7 +216,17 @@ def _emit_tavily_warning(message: str) -> None:
 RETRYABLE_STATUS_CODES = {408, 429, 500, 502, 503, 504}
 
 
+class StreamEmbeddedError(Exception):
+    """SSE 流内嵌错误事件（HTTP 200 + data: {"error": ...}）。"""
+
+
+class EmptyStreamError(Exception):
+    """流式响应解析完成但内容为空。"""
+
+
 def _is_retryable_exception(exc) -> bool:
+    if isinstance(exc, (StreamEmbeddedError, EmptyStreamError)):
+        return True
     if isinstance(exc, (httpx.TimeoutException, httpx.NetworkError, httpx.ConnectError, httpx.RemoteProtocolError)):
         return True
     if isinstance(exc, httpx.HTTPStatusError):
@@ -501,6 +511,7 @@ def _normalize_tavily_base_url(raw: str) -> str:
 
 _http_client: Optional[httpx.AsyncClient] = None
 _DEFAULT_TIMEOUT = httpx.Timeout(connect=6.0, read=60.0, write=10.0, pool=None)
+_NON_STREAM_TIMEOUT = httpx.Timeout(connect=6.0, read=10.0, write=10.0, pool=None)
 
 
 async def get_http_client() -> httpx.AsyncClient:
@@ -586,16 +597,23 @@ class GrokSearchProvider:
         return await self._execute(payload)
 
     async def _execute(self, payload: dict) -> str:
-        """执行请求：先尝试非流式，失败时回退到流式。"""
+        """执行请求：流式优先，失败时回退到非流式（10s 超时 fail-fast）。"""
         try:
+            return await self._execute_stream(payload)
+        except httpx.HTTPStatusError as e:
+            if e.response.status_code not in RETRYABLE_STATUS_CODES:
+                raise
+            if config.debug_enabled:
+                print(f"[DEBUG] 流式失败: {e}，回退到非流式", file=sys.stderr)
             return await self._execute_non_stream(payload)
-        except (httpx.HTTPStatusError, json.JSONDecodeError) as e:
+        except (httpx.TimeoutException, httpx.NetworkError, httpx.RemoteProtocolError,
+                StreamEmbeddedError, EmptyStreamError, json.JSONDecodeError) as e:
             if config.debug_enabled:
-                print(f"[DEBUG] 非流式失败: {e}，回退到流式", file=sys.stderr)
-            return await self._execute_stream(payload)
+                print(f"[DEBUG] 流式失败: {e}，回退到非流式", file=sys.stderr)
+            return await self._execute_non_stream(payload)
 
     async def _execute_non_stream(self, payload: dict) -> str:
-        """非流式请求（首选，对短响应更快）。"""
+        """非流式请求（流式失败后的回退方案，10s read 超时 fail-fast）。"""
         payload_copy = {**payload, "stream": False}
         client = await get_http_client()
 
@@ -610,6 +628,7 @@ class GrokSearchProvider:
                     f"{self.api_url}/chat/completions",
                     headers=self._headers,
                     json=payload_copy,
+                    timeout=_NON_STREAM_TIMEOUT,
                 )
                 response.raise_for_status()
                 data = response.json()
@@ -619,7 +638,7 @@ class GrokSearchProvider:
                 return ""
 
     async def _execute_stream(self, payload: dict) -> str:
-        """流式请求（大响应的回退方案）。"""
+        """流式请求（首选，chunk 保活避免网关超时）。"""
         payload_copy = {**payload, "stream": True}
         client = await get_http_client()
 
@@ -655,24 +674,30 @@ class GrokSearchProvider:
                 try:
                     json_str = line[5:].lstrip()
                     data = json.loads(json_str)
-                    choices = data.get("choices", [])
-                    if choices:
-                        delta = choices[0].get("delta", {})
-                        if "content" in delta:
-                            content += delta["content"]
                 except (json.JSONDecodeError, IndexError):
                     continue
+                if isinstance(data, dict) and "error" in data:
+                    raise StreamEmbeddedError(json.dumps(data["error"], ensure_ascii=False)[:300])
+                choices = data.get("choices", [])
+                if choices:
+                    delta = choices[0].get("delta", {})
+                    if "content" in delta:
+                        content += delta["content"]
 
         if not content and full_body_buffer:
             try:
                 full_text = "".join(full_body_buffer)
                 data = json.loads(full_text)
+                if isinstance(data, dict) and "error" in data:
+                    raise StreamEmbeddedError(json.dumps(data["error"], ensure_ascii=False)[:300])
                 if "choices" in data and data["choices"]:
                     message = data["choices"][0].get("message", {})
                     content = message.get("content", "")
             except json.JSONDecodeError:
                 pass
 
+        if not content.strip():
+            raise EmptyStreamError("流式响应内容为空")
         return content
 
 
@@ -935,8 +960,9 @@ async def cmd_web_search(args):
     except ValueError as e:
         print(json.dumps({"error": str(e)}, ensure_ascii=False), file=sys.stderr)
         sys.exit(1)
-    except httpx.HTTPStatusError as e:
-        print(json.dumps({"error": f"API错误: {e.response.status_code}"}, ensure_ascii=False), file=sys.stderr)
+    except httpx.HTTPError as e:
+        detail = str(e.response.status_code) if isinstance(e, httpx.HTTPStatusError) else (str(e) or type(e).__name__)
+        print(json.dumps({"error": f"API错误: {detail}"}, ensure_ascii=False), file=sys.stderr)
         sys.exit(1)
 
 
@@ -974,8 +1000,9 @@ async def cmd_web_fetch(args):
         except ValueError as e:
             print(f"错误: {e}", file=sys.stderr)
             sys.exit(1)
-        except httpx.HTTPStatusError as e:
-            print(f"API错误: {e.response.status_code}", file=sys.stderr)
+        except httpx.HTTPError as e:
+            detail = str(e.response.status_code) if isinstance(e, httpx.HTTPStatusError) else (str(e) or type(e).__name__)
+            print(f"API错误: {detail}", file=sys.stderr)
             sys.exit(1)
 
     if not result and tavily_error and not use_grok_fallback:

package/extensions/pi-gpt-responses-compat/tls-fetch.mjs

@@ -1,188 +0,0 @@
-export const piInsecureTlsHeader = "x-abelworkflow-insecure-tls";
-
-const installedFetchMarker = Symbol.for("abelworkflow.pi-provider-tls-fetch");
-const undiciGlobalDispatchers = [
-  Symbol.for("undici.globalDispatcher.2"),
-  Symbol.for("undici.globalDispatcher.1")
-];
-const redirectStatuses = new Set([301, 302, 303, 307, 308]);
-const maxRedirects = 5;
-
-function getMarkedHeaders(input, init) {
-  const source = init?.headers !== undefined
-    ? init.headers
-    : typeof Request !== "undefined" && input instanceof Request
-      ? input.headers
-      : undefined;
-  if (source === undefined) return null;
-
-  const headers = new Headers(source);
-  if (!headers.has(piInsecureTlsHeader)) return null;
-  const allowedOrigin = headers.get(piInsecureTlsHeader);
-  headers.delete(piInsecureTlsHeader);
-  return { allowedOrigin, headers };
-}
-
-function getRequestUrl(input) {
-  return typeof Request !== "undefined" && input instanceof Request
-    ? input.url
-    : input instanceof URL
-      ? input.href
-      : input;
-}
-
-function getRequestOrigin(input) {
-  try {
-    return new URL(getRequestUrl(input)).origin;
-  } catch {
-    return null;
-  }
-}
-
-function redirectRequestInit(input, init, status) {
-  const method = String(init.method ?? (
-    typeof Request !== "undefined" && input instanceof Request ? input.method : "GET"
-  )).toUpperCase();
-  const switchToGet = status === 303 && method !== "HEAD"
-    || (status === 301 || status === 302) && method === "POST";
-  if (!switchToGet) {
-    if (typeof Request !== "undefined" && input instanceof Request && method !== "GET" && method !== "HEAD") {
-      throw new Error("Pi insecure TLS cannot safely replay a redirected Request body");
-    }
-    return init;
-  }
-
-  const headers = new Headers(init.headers);
-  for (const name of ["content-encoding", "content-language", "content-length", "content-location", "content-type"]) {
-    headers.delete(name);
-  }
-  const nextInit = { ...init, method: "GET", headers };
-  delete nextInit.body;
-  return nextInit;
-}
-
-async function fetchWithSameOriginRedirects({ fetchOnce, input, init, allowedOrigin }) {
-  let nextInput = input;
-  let nextInit = init;
-
-  for (let redirectCount = 0; redirectCount <= maxRedirects; redirectCount += 1) {
-    const response = await fetchOnce(nextInput, nextInit);
-    const location = redirectStatuses.has(response?.status) ? response.headers?.get?.("location") : null;
-    if (!location) return response;
-    if (redirectCount === maxRedirects) {
-      await response.body?.cancel?.();
-      throw new Error(`Pi insecure TLS exceeded ${maxRedirects} same-origin redirects`);
-    }
-
-    const target = new URL(location, getRequestUrl(nextInput));
-    if (target.origin !== allowedOrigin) {
-      await response.body?.cancel?.();
-      throw new Error(`Pi insecure TLS blocked cross-origin redirect to ${target.origin}`);
-    }
-    await response.body?.cancel?.();
-    nextInit = redirectRequestInit(nextInput, nextInit, response.status);
-    nextInput = target.href;
-  }
-}
-
-function applyNodeDispatcher(fetchImpl, input, init, dispatcherSource) {
-  let dispatcher;
-  try {
-    dispatcher = typeof dispatcherSource === "function" ? dispatcherSource() : dispatcherSource;
-  } catch (error) {
-    return Promise.reject(error);
-  }
-
-  if (dispatcher && typeof dispatcher.then === "function") {
-    return dispatcher.then((resolved) => applyNodeDispatcher(fetchImpl, input, init, resolved));
-  }
-  if (!dispatcher || typeof dispatcher.dispatch !== "function") {
-    return Promise.reject(new Error("Pi insecure TLS requires an injected Undici dispatcher"));
-  }
-  return fetchImpl(input, { ...init, dispatcher });
-}
-
-function getUndiciDispatcherConstructor(target) {
-  return undiciGlobalDispatchers
-    .map((symbol) => target[symbol]?.constructor)
-    .find((constructor) => typeof constructor === "function");
-}
-
-function initializeUndiciGlobalDispatcher(target) {
-  if (typeof target.fetch !== "function") return;
-  try {
-    void Promise.resolve(target.fetch("data:,")).catch(() => {});
-  } catch {
-  }
-}
-
-export function createNodeInsecureDispatcher(target = globalThis) {
-  let Dispatcher = getUndiciDispatcherConstructor(target);
-  if (typeof Dispatcher !== "function") {
-    initializeUndiciGlobalDispatcher(target);
-    Dispatcher = getUndiciDispatcherConstructor(target);
-  }
-  if (typeof Dispatcher !== "function") {
-    throw new Error("Pi insecure TLS requires the active Undici dispatcher");
-  }
-  return new Dispatcher({
-    allowH2: false,
-    connect: { rejectUnauthorized: false },
-    requestTls: { rejectUnauthorized: false }
-  });
-}
-
-export function createProviderTlsFetch({
-  fetchImpl = globalThis.fetch,
-  runtime = typeof globalThis.Bun === "undefined" ? "node" : "bun",
-  insecureDispatcher
-} = {}) {
-  if (typeof fetchImpl !== "function") {
-    throw new TypeError("A fetch implementation is required");
-  }
-
-  return function providerTlsFetch(input, init) {
-    const marked = getMarkedHeaders(input, init);
-    if (!marked) return fetchImpl(input, init);
-
-    const nextInit = { ...(init ?? {}), headers: marked.headers };
-    if (!marked.allowedOrigin || getRequestOrigin(input) !== marked.allowedOrigin) {
-      return fetchImpl(input, nextInit);
-    }
-
-    nextInit.redirect = "manual";
-    const fetchOnce = runtime === "bun"
-      ? (nextInput, redirectInit) => {
-          const tls = redirectInit.tls && typeof redirectInit.tls === "object" ? redirectInit.tls : {};
-          return fetchImpl(nextInput, {
-            ...redirectInit,
-            tls: { ...tls, rejectUnauthorized: false }
-          });
-        }
-      : (nextInput, redirectInit) => applyNodeDispatcher(
-          fetchImpl,
-          nextInput,
-          redirectInit,
-          insecureDispatcher
-        );
-
-    return fetchWithSameOriginRedirects({
-      fetchOnce,
-      input,
-      init: nextInit,
-      allowedOrigin: marked.allowedOrigin
-    });
-  };
-}
-
-export function installProviderTlsFetch({ target = globalThis, ...options } = {}) {
-  if (target.fetch?.[installedFetchMarker]) return target.fetch;
-
-  const wrapped = createProviderTlsFetch({
-    ...options,
-    fetchImpl: target.fetch.bind(target)
-  });
-  Object.defineProperty(wrapped, installedFetchMarker, { value: true });
-  target.fetch = wrapped;
-  return wrapped;
-}