v4.0.0

This release adds VLESS, VMess and Trojan outbounds next to the HTTP/HTTPS/SOCKS clients, with the same zero-dependency, Stream-returning API. VLESS REALITY and the xtls-rprx-vision flow are implemented in managed code — no Xray or other external binary is involved. No public type or member from 3.0.0 was removed or changed.

Breaking changes

• ProxyType gained Vless, Vmess, Trojan; ProxyErrorCode gained StringTooLong and TransportUpgradeFailed. Exhaustive switch statements over these enums need a default arm.
• ProxyClientFactory.Create(Uri) now returns a client for vless://, trojan:// and vmess:// instead of throwing NotSupportedException.
• ProxyClient constructors accept IPv6 literals as the proxy host (previously threw UriFormatException while building ProxyUri).
• ProxyClientFactory.Create(null) / Proxy.ConnectAsync(null, …) are ambiguous at compile time because of the new string overloads.
• Target frameworks: net8.0, net9.0, net10.0 and now net11.0. Nothing dropped.

New

• Proxy.ConnectAsync(string link, host, port, [timeout], ct) and ProxyClientFactory.Create(string link): one entry point for any supported link, including vmess:// share links that System.Uri cannot represent. The scheme is read from the text, so you no longer pick a parser yourself.
• VlessClient, VlessOptions, VlessSecurity, VlessShareLink: VLESS over tcp/raw, ws, httpupgrade, with security=none|tls|reality and the xtls-rprx-vision flow. grpc, xhttp and other flows are parsed but rejected with NotSupportedException at connect time.
• VLESS REALITY in-process: a managed TLS 1.3 client (ClientHello with the sealed session_id, X25519, HKDF key schedule, record layer). Verified against live REALITY nodes. RealityHandshakeException is a ProxyProtocolException with ErrorCode AuthFailed when the server did not recognise the client (check pbk/sid/sni) or InvalidResponse otherwise.
• TrojanClient, TrojanOptions, TrojanShareLink: Trojan over TLS with tcp, ws, httpupgrade.
• VmessClient, VmessOptions, VmessSecurityKind, VmessShareLink: VMessAEAD (alterId=0 only) with aes-128-gcm / chacha20-poly1305 / auto, over tcp, ws, httpupgrade, with or without TLS.
• Each new client exposes Options, FromShareLink(string), ServerCertificateValidationCallback and SslProtocols.
• Every error message is free of credentials, and the VPN-style protocols use the same ProxyErrorCodes as the classic ones — a VLESS or VMess server that silently drops an unknown id comes back as ConnectionFailed with a message naming the protocol and what to check.
• IProxyClient.LocalEndPoint binds the outgoing socket to a specific local address — useful to route around a TUN VPN that owns the default route.

Fixed

• HTTP CONNECT response parsing no longer matches header names inside bytes that belong to the tunnelled payload.
• ProxyClient.ProxyUri is built correctly for IPv6 proxy hosts.
• A proxy that resets the connection mid-handshake surfaces as ProxyProtocolException(ConnectionFailed) rather than a raw IOException.

Not in this release

• grpc and xhttp transports, Hysteria2/TUIC (QUIC), and UDP.
• Vision's TLS-in-TLS splice (a throughput optimisation; the wire format is complete).
• A browser-grade ClientHello fingerprint for REALITY: the handshake connects to real servers, but a DPI that fingerprints ClientHellos can tell it from a browser. See docs/reality-fingerprint-plan.md.

What's Changed

• Add VPN protocols by @Titlehhhh in #2

Full Changelog: v3.0.0...v4.0.0