// Force strict mode and setup for ESM
"use strict";
import {
  isTlsVerificationDisabled
} from "./chunk-D5KISTLW.js";
import {
  getErrorMessage,
  isNodeError
} from "./chunk-AVQDCKNF.js";
import {
  init_esbuild_shims
} from "./chunk-A4BMJM77.js";
import {
  __name
} from "./chunk-J2S4EL5Y.js";

// packages/core/src/utils/fetch.ts
init_esbuild_shims();
import { URL } from "node:url";
var PRIVATE_IP_RANGES = [
  /^10\./,
  /^127\./,
  /^172\.(1[6-9]|2[0-9]|3[0-1])\./,
  /^192\.168\./,
  /^::1$/,
  /^fc00:/,
  /^fe80:/
];
var TLS_ERROR_CODES = /* @__PURE__ */ new Set([
  "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
  "UNABLE_TO_VERIFY_LEAF_SIGNATURE",
  "SELF_SIGNED_CERT_IN_CHAIN",
  "DEPTH_ZERO_SELF_SIGNED_CERT",
  "CERT_HAS_EXPIRED",
  "ERR_TLS_CERT_ALTNAME_INVALID"
]);
var FETCH_TROUBLESHOOTING_ERROR_CODES = /* @__PURE__ */ new Set([
  ...TLS_ERROR_CODES,
  "ECONNRESET",
  "ETIMEDOUT",
  "ECONNREFUSED",
  "ENOTFOUND",
  "EAI_AGAIN",
  "EHOSTUNREACH",
  "ENETUNREACH"
]);
var FetchError = class extends Error {
  constructor(message, code) {
    super(message);
    this.code = code;
    this.name = "FetchError";
  }
  static {
    __name(this, "FetchError");
  }
};
function isPrivateIp(url) {
  try {
    const hostname = new URL(url).hostname;
    return PRIVATE_IP_RANGES.some((range) => range.test(hostname));
  } catch (_e) {
    return false;
  }
}
__name(isPrivateIp, "isPrivateIp");
async function fetchWithTimeout(url, timeout, headers) {
  const controller = new AbortController();
  const timeoutId = setTimeout(() => controller.abort(), timeout);
  try {
    const response = await fetch(url, {
      signal: controller.signal,
      headers
    });
    return response;
  } catch (error) {
    if (isNodeError(error) && error.code === "ABORT_ERR") {
      throw new FetchError(`Request timed out after ${timeout}ms`, "ETIMEDOUT");
    }
    throw new FetchError(getErrorMessage(error));
  } finally {
    clearTimeout(timeoutId);
  }
}
__name(fetchWithTimeout, "fetchWithTimeout");
function getErrorCode(error) {
  if (!error || typeof error !== "object") {
    return void 0;
  }
  if ("code" in error && typeof error["code"] === "string") {
    return error["code"];
  }
  return void 0;
}
__name(getErrorCode, "getErrorCode");
function formatUnknownErrorMessage(error) {
  if (typeof error === "string") {
    return error;
  }
  if (typeof error === "number" || typeof error === "boolean" || typeof error === "bigint") {
    return String(error);
  }
  if (error instanceof Error) {
    return error.message;
  }
  if (!error || typeof error !== "object") {
    return void 0;
  }
  const message = error["message"];
  if (typeof message === "string") {
    return message;
  }
  return void 0;
}
__name(formatUnknownErrorMessage, "formatUnknownErrorMessage");
function formatErrorCause(error) {
  if (!(error instanceof Error)) {
    return void 0;
  }
  const cause = error.cause;
  if (!cause) {
    return void 0;
  }
  const causeCode = getErrorCode(cause);
  const causeMessage = formatUnknownErrorMessage(cause);
  if (!causeCode && !causeMessage) {
    return void 0;
  }
  if (causeCode && causeMessage && !causeMessage.includes(causeCode)) {
    return `${causeCode}: ${causeMessage}`;
  }
  return causeMessage ?? causeCode;
}
__name(formatErrorCause, "formatErrorCause");
function formatFetchErrorForUser(error, options = {}) {
  const errorMessage = getErrorMessage(error);
  const code = error instanceof Error ? getErrorCode(error.cause) ?? getErrorCode(error) : getErrorCode(error);
  const cause = formatErrorCause(error);
  const fullErrorMessage = [
    errorMessage,
    cause ? `(cause: ${cause})` : void 0
  ].filter(Boolean).join(" ");
  const shouldShowFetchHints = errorMessage.toLowerCase().includes("fetch failed") || code != null && FETCH_TROUBLESHOOTING_ERROR_CODES.has(code);
  const shouldShowTlsHint = code != null && TLS_ERROR_CODES.has(code);
  if (!shouldShowFetchHints) {
    return fullErrorMessage;
  }
  const hintLines = [
    "",
    "Troubleshooting:",
    ...options.url ? [`- Confirm you can reach ${options.url} from this machine.`] : [],
    "- If you are behind a proxy, pass `--proxy <url>` (or set `proxy` in settings).",
    ...shouldShowTlsHint ? isTlsVerificationDisabled() ? [
      "- TLS verification is already disabled (`--insecure` / `QWEN_TLS_INSECURE`), so this is likely a network or protocol issue rather than a certificate trust problem."
    ] : [
      "- If your network uses a corporate TLS inspection CA, set `NODE_EXTRA_CA_CERTS` to your CA bundle.",
      "- For a trusted self-signed endpoint, pass `--insecure` (or set `QWEN_TLS_INSECURE=1`) to skip certificate verification."
    ] : []
  ];
  return `${fullErrorMessage}${hintLines.join("\n")}`;
}
__name(formatFetchErrorForUser, "formatFetchErrorForUser");

export {
  isPrivateIp,
  fetchWithTimeout,
  formatFetchErrorForUser
};
/**
 * @license
 * Copyright 2025 Google LLC
 * SPDX-License-Identifier: Apache-2.0
 */
