@jheavenknows/bluerouter 5.4.49 → 5.4.51

package/app/.next-cli-build/server/chunks/7307.js

@@ -1 +1 @@
-"use strict";exports.id=7307,exports.ids=[7307],exports.modules={9588:(a,b,c)=>{c.d(b,{Cy:()=>i,Gk:()=>l,I8:()=>k,Tv:()=>v,UX:()=>p,aV:()=>o,bz:()=>r,hH:()=>u,ny:()=>s,oW:()=>t,s0:()=>m,ub:()=>n,vZ:()=>q});var d=c(65573),e=c(23211),f=c(89718),g=c(33792),h=c(90389);let i="dashboard_view_mode";function j(a){return String(a||"").trim().toLowerCase()}function k(a){return j(a)}function l(a={}){return[a.ldapUsername,a.ldapEmail,a.ldapName,a.oidcEmail,a.oidcName,a.localUsername,a.username,a.email].map(j).filter(Boolean)}function m(a={}){let b=l(a),c=b[0]||"local",d=a.ldapName||a.ldapEmail||a.oidcName||a.oidcEmail||a.localUsername||c;return{userId:c,displayName:d,loginMethod:a.oidc?"OIDC":a.ldap?"LDAP":"Local",candidates:b}}function n(a={},b={}){var c;if(!b?.authenticated)return!1;if(b.local||!b.ldap&&!b.oidc||b.role===h.hS.ADMIN||!0===b.ldapIsAdmin)return!0;let d=Array.isArray(c=a.ldapAllowedUsers)?c.map(j).filter(Boolean):String(c||"").split(/[,\n]/).map(j).filter(Boolean);return 0!==d.length&&l(b).some(a=>d.includes(a))}function o(a={},b={}){return!(!b?.authenticated||n(a,b))&&(b.role===h.hS.MONITOR_ADMIN||!0===b.ldapIsMonitorAdmin)}function p(a={},b={}){return!(!b?.authenticated||n(a,b)||o(a,b))&&(b.role===h.hS.AI_GATEWAYS_MONITOR||!0===b.ldapIsAiGatewaysMonitor)}function q(a={},b={}){return b?.authenticated?n(a,b)?h.hS.ADMIN:o(a,b)?h.hS.MONITOR_ADMIN:p(a,b)?h.hS.AI_GATEWAYS_MONITOR:h.hS.USER:h.hS.GUEST}function r(a={}){return!0===a.isAdmin||!0===a.isMonitorAdmin}async function s(){let a=await (0,f.getSettings)(),b=await (0,d.UL)(),c=await (0,g.dY)(b.get("auth_token")?.value);if(!c?.authenticated)return{authenticated:!1,isAdmin:!1,actualIsAdmin:!1,showAsUser:!1,canToggleUserMode:!1,isMonitorAdmin:!1,isAiGatewaysMonitor:!1,role:h.hS.GUEST,actualRole:h.hS.GUEST,userId:"",displayName:"Guest",loginMethod:"None",settings:{...a,requireLogin:!0},session:null};let e=m(c||{}),j=q(a,c||{}),k=j===h.hS.ADMIN,l=k&&b.get(i)?.value==="user",n=l?h.hS.USER:j,o=n===h.hS.ADMIN,p=n===h.hS.MONITOR_ADMIN,r=n===h.hS.AI_GATEWAYS_MONITOR;return{authenticated:!0,isAdmin:o,actualIsAdmin:k,showAsUser:l,canToggleUserMode:k,isMonitorAdmin:p,isAiGatewaysMonitor:r,role:n,actualRole:j,canManageApiKeys:o||p,canUseMonitorAdminTabs:o||p,canViewAllAnalytics:o||p||r,...e,settings:{...a,requireLogin:!0},session:c}}async function t(){let a=await s();return a.authenticated?{access:a,response:null}:{access:a,response:e.NextResponse.json({error:"Authentication required"},{status:401})}}async function u(a={}){let{allowMonitorAdmin:b=!1}=a||{},{access:c,response:d}=await t();return d?{access:c,response:d}:c.isAdmin||b&&c.isMonitorAdmin?{access:c,response:null}:{access:c,response:e.NextResponse.json({error:"Admin access required"},{status:403})}}function v(a,b){if(!a?.authenticated||!b)return!1;if(r(a))return!0;let c=j(a.userId),d=j(b.ownerUser),e=j(b.createdByUser);return!!c&&(d===c||e===c)}},13424:(a,b,c)=>{let d=c(77598),e="bluerouter-full-node-encrypted",f="aes-256-gcm",g=Buffer.from("bluerouter-full-node-v3","utf8"),h=Object.freeze({name:"scrypt",N:32768,r:8,p:1,keyLength:32});function i(a){return"string"==typeof a?a:""}function j(a){let b=i(a);if(!b)throw Error("Backup password is required");if(8>Buffer.byteLength(b,"utf8"))throw Error("Backup password must be at least 8 characters");return b}function k(a,b,c=h){let e=Number(c?.N),f=Number(c?.r),g=Number(c?.p),i=Number(c?.keyLength);if(e!==h.N||f!==h.r||g!==h.p||i!==h.keyLength)throw Error("Unsupported backup encryption parameters");return d.scryptSync(a,b,i,{N:e,r:f,p:g,maxmem:0x4000000})}a.exports={FULL_BACKUP_FORMAT_VERSION:3,FULL_BACKUP_KIND:"bluerouter-full-node",ENCRYPTED_BACKUP_KIND:e,SCRYPT_PARAMS:h,passwordText:i,encryptBackupPayload:function(a,b){let c=j(b),i=d.randomBytes(16),l=d.randomBytes(12),m=k(c,i),n=d.createCipheriv(f,m,l);n.setAAD(g);let o=Buffer.concat([n.update(JSON.stringify(a),"utf8"),n.final()]),p=n.getAuthTag();return{backup:{formatVersion:3,kind:e,encrypted:!0,exportedAt:a?.backup?.exportedAt||new Date().toISOString()},encryption:{algorithm:f,kdf:h,salt:i.toString("base64"),iv:l.toString("base64"),authTag:p.toString("base64"),ciphertext:o.toString("base64")}}},decryptBackupPayload:function(a,b){let c=j(b),i=a?.encryption;if(a?.backup?.kind!==e||a?.backup?.encrypted!==!0||i?.algorithm!==f||i?.kdf?.name!==h.name)throw Error("Unsupported encrypted backup format");try{let a=Buffer.from(String(i.salt||""),"base64"),b=Buffer.from(String(i.iv||""),"base64"),e=Buffer.from(String(i.authTag||""),"base64"),h=Buffer.from(String(i.ciphertext||""),"base64");if(16!==a.length||12!==b.length||16!==e.length||0===h.length)throw Error("Invalid encrypted backup payload");let j=k(c,a,i.kdf),l=d.createDecipheriv(f,j,b);l.setAAD(g),l.setAuthTag(e);let m=Buffer.concat([l.update(h),l.final()]).toString("utf8");return JSON.parse(m)}catch{throw Error("Invalid backup password or encrypted backup is damaged")}},isEncryptedBackup:function(a){return a?.backup?.encrypted===!0}}},17509:(a,b,c)=>{c.d(b,{V:()=>o});var d=c(91356),e=c(80700),f=c(99129),g=c(73575),h=c(41570),i=c(19035),j=c(44893),k=c(69052);async function l(a,b,c){let l,{protected:m,header:n,payload:o}=a,p={};if(m&&(p=(0,h.OX)(m,f.Ye,"JWS Protected Header is invalid")),void 0!==n){if(!(0,i.fz)(p,n))throw new f.Ye("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");l={...p,...n}}else l=p;let q=(0,j.nI)(f.Ye,j.qc,b[1],p,l),r=!0;if(q.includes("b64")&&"boolean"!=typeof(r=p.b64))throw new f.Ye('The "b64" (base64url-encode payload) Header Parameter must be a boolean');let{alg:s}=l;if("string"!=typeof s||!s)throw new f.Ye('JWS "alg" (Algorithm) Header Parameter missing or invalid');if(b[0]&&!b[0].has(s))throw new f.Rb('"alg" (Algorithm) Header Parameter value not allowed');if(r){if("string"!=typeof o)throw new f.Ye("JWS Payload must be a string")}else if("string"!=typeof o&&!(o instanceof Uint8Array))throw new f.Ye("JWS Payload must be a string or an Uint8Array instance");let t=!1;"function"==typeof c&&(c=await c(p,a),t=!0);let u=(0,e.q)(s),v=(0,g.xW)(void 0!==m?(0,g.lF)(m):new Uint8Array,(0,g.lF)("."),"string"==typeof o?r?b[2]??=(0,h.Fo)(o,"payload",f.Ye):g.Rd.encode(o):o),w=(0,h.h2)(a.signature,"signature",f.Ye),x=await (0,k.d)(u,c,"verify");if(!await (0,d.M)(u,x,w,v))throw new f.h2;return[r?(0,h.h2)(o,"payload",f.Ye):"string"==typeof o?g.Rd.encode(o):o,p,r,x,t]}async function m(a,b,c){if(a instanceof Uint8Array&&(a=g.D0.decode(a)),"string"!=typeof a)throw new f.Ye("Compact JWS must be a string or Uint8Array");let{0:d,1:e,2:h,length:i}=a.split(".");if(3!==i)throw new f.Ye("Invalid Compact JWS");return l({payload:e,protected:d,signature:h},b,c)}var n=c(17347);async function o(a,b,c){let d=await m(a,[c&&(0,j.Fw)("algorithms",c.algorithms),c?.crit],b);if(!d[2])throw new f.Dp("JWTs MUST NOT use unencoded payload");let e={payload:(0,n.k6)(d[1],d[0],c),protectedHeader:d[1]};return"function"==typeof b?{...e,key:d[3]}:e}},19225:(a,b,c)=>{a.exports=c(44870)},33792:(a,b,c)=>{c.d(b,{Dc:()=>p,OZ:()=>s,YK:()=>n,dY:()=>q,tm:()=>r});var d=c(84433),e=c(17509),f=c(73024),g=c.n(f),h=c(76760),i=c.n(h),j=c(77598),k=c.n(j),l=c(49120);let m=new TextEncoder().encode(function(){if(process.env.JWT_SECRET)return process.env.JWT_SECRET;let a=i().join(l.DATA_DIR,"jwt-secret");try{return g().readFileSync(a,"utf8").trim()}catch{}g().mkdirSync(l.DATA_DIR,{recursive:!0});let b=k().randomBytes(32).toString("hex");return g().writeFileSync(a,b,{mode:384}),b}());function n(a){let b="true"===process.env.AUTH_COOKIE_SECURE,c=a?.headers?.get?.("x-forwarded-proto");return b||"https"===c}async function o(a={}){return new d.P({authenticated:!0,...a}).setProtectedHeader({alg:"HS256"}).setIssuedAt().setExpirationTime("86400s").sign(m)}async function p(a){if(!a)return!1;try{return await (0,e.V)(a,m),!0}catch{return!1}}async function q(a){if(!a)return null;try{let{payload:b}=await (0,e.V)(a,m);return b}catch{return null}}async function r(a,b,c={}){let d=await o(c);a.set("auth_token",d,{httpOnly:!0,secure:n(b),sameSite:"lax",path:"/",maxAge:86400})}function s(a){a.delete("auth_token")}},40833:(a,b,c)=>{let d=c(73024),e=c(76760),{loadConfig:f,saveConfig:g,validateConfig:h}=c(43096),{extractAuditPolicy:i}=c(85463),{importRootCAPair:j,validateRootCAPairPem:k,readRootCAInfo:l,ROOT_CA_CERT_PATH:m,ROOT_CA_KEY_PATH:n}=c(8578),{FULL_BACKUP_FORMAT_VERSION:o,FULL_BACKUP_KIND:p,ENCRYPTED_BACKUP_KIND:q,SCRYPT_PARAMS:r,passwordText:s,encryptBackupPayload:t,decryptBackupPayload:u,isEncryptedBackup:v}=c(13424);async function w(){return Promise.resolve().then(c.bind(c,89718))}async function x(){return c.e(5334).then(c.bind(c,25334))}function y(){return{certPem:d.existsSync(m)?d.readFileSync(m,"utf8"):null,keyPem:d.existsSync(n)?d.readFileSync(n,"utf8"):null}}function z(a,b=""){if(!a||"object"!=typeof a||Array.isArray(a))throw Error("Invalid backup payload");let c=v(a)?u(a,b):a;if(c?.backup?.kind===p&&Number(c?.backup?.formatVersion)===o){if(!c.database||"object"!=typeof c.database||Array.isArray(c.database))throw Error("Full backup is missing database data");return{kind:"full",payload:c,auditProxy:function(a){if(!a||"object"!=typeof a||Array.isArray(a))throw Error("Full backup is missing Audit Proxy data");if(1!==Number(a.version))throw Error("Unsupported Audit Proxy backup version");let b=h(a.config),c=a.rootCA;if(null!=c){if(!c||"object"!=typeof c||Array.isArray(c))throw Error("Invalid Root CA backup");k({certPem:c.certificatePem,keyPem:c.privateKeyPem})}return{config:b,rootCA:c||null}}(c.auditProxy)}}if(2===Number(c?.backup?.formatVersion))return{kind:"legacy",payload:c,auditProxy:null};throw Error("Unsupported backup format")}async function A(){let[{getSettings:a},{applyOutboundProxyEnv:b}]=await Promise.all([w(),x()]);b(await a())}async function B({password:a=""}={}){let{exportDb:b}=await w(),c=f(),d=await b();d.settings={...d.settings||{},auditProxyPolicy:i(c)};let e={backup:{formatVersion:o,kind:p,encrypted:!1,exportedAt:new Date().toISOString()},database:d,auditProxy:{version:1,config:c,rootCA:function(){let a=y();if(!a.certPem&&!a.keyPem)return null;if(!a.certPem||!a.keyPem)throw Error("Root CA certificate/private key pair is incomplete");k(a);let b=l();return{certificatePem:a.certPem,privateKeyPem:a.keyPem,fingerprint:b.fingerprint||"",subject:b.subject||"",notAfter:b.notAfter||null}}()}};return s(a)?t(e,a):e}async function C(a){let{importDb:b,getSettings:d}=await w(),e=await b(a,{returnExport:!1});await A();let g=c(49083),h=await g.applyAuditPolicyFromSettings({force:!0});if(h?.error)throw Error(h.error);let i=await g.getStatus(),j=h?.applied===!0||h?.reason==="unchanged";return{...e,backupKind:"legacy-database",auditProxyImported:j,auditProxyReason:h?.reason||null,rootCAImported:!1,rootCAPreserved:!0,listenerDesiredState:f().enabled?"running":"stopped",listenerRunning:i?.running===!0}}async function D(a,{password:b=""}={}){let h=z(a,b);if("legacy"===h.kind)return C(h.payload);let{database:k}=h.payload,{config:l,rootCA:o}=h.auditProxy,q=!0===l.enabled,r=await w(),s=c(49083),t={database:await r.exportDb(),config:f(),rootCA:y(),running:!0===(await s.getStatus()).running},u=null,v=!1;try{let a;t.running&&await s.stopProxy({persist:!1}),u=await r.importDb(k,{returnExport:!1}),o&&(j({certPem:o.certificatePem,keyPem:o.privateKeyPem}),v=!0);let b=g({...l,enabled:!1});return await r.updateSettings({auditProxyPolicy:i(l)}),await A(),q?a=await s.startProxy():(g({...b,enabled:!1}),a=await s.getStatus()),{...u,backupKind:p,databaseImported:!0,auditProxyImported:!0,rootCAImported:v,rootCAPreserved:!o,policyPublished:!0,listenerDesiredState:q?"running":"stopped",listenerRunning:a?.running===!0}}catch(c){let a=[];try{await s.stopProxy({persist:!1})}catch(b){a.push(`stop: ${b?.message||b}`)}try{await r.importDb(t.database,{returnExport:!1})}catch(b){a.push(`database: ${b?.message||b}`)}try{!function(a){if(d.mkdirSync(e.dirname(m),{recursive:!0}),a.certPem&&a.keyPem)return j({certPem:a.certPem,keyPem:a.keyPem});try{d.unlinkSync(m)}catch(a){if(a?.code!=="ENOENT")throw a}try{d.unlinkSync(n)}catch(a){if(a?.code!=="ENOENT")throw a}a.keyPem&&d.writeFileSync(n,a.keyPem,{mode:384}),a.certPem&&d.writeFileSync(m,a.certPem)}(t.rootCA)}catch(b){a.push(`Root CA: ${b?.message||b}`)}try{g({...t.config,enabled:!1}),t.running?await s.startProxy():g(t.config)}catch(b){a.push(`Audit Proxy: ${b?.message||b}`)}try{await A()}catch(b){a.push(`outbound proxy: ${b?.message||b}`)}let b=a.length?` Rollback warnings: ${a.join("; ")}`:"";throw Error(`Full backup restore failed: ${c?.message||c}.${b}`)}}a.exports={FULL_BACKUP_FORMAT_VERSION:o,FULL_BACKUP_KIND:p,ENCRYPTED_BACKUP_KIND:q,SCRYPT_PARAMS:r,encryptBackupPayload:t,decryptBackupPayload:u,isEncryptedBackup:v,decodeBackupPayload:z,exportFullNodeBackup:B,restoreFullNodeBackup:D}},50122:(a,b,c)=>{c.d(b,{k:()=>e});let d=[];for(let a=0;a<256;++a)d.push((a+256).toString(16).slice(1));function e(a,b=0){return(d[a[b+0]]+d[a[b+1]]+d[a[b+2]]+d[a[b+3]]+"-"+d[a[b+4]]+d[a[b+5]]+"-"+d[a[b+6]]+d[a[b+7]]+"-"+d[a[b+8]]+d[a[b+9]]+"-"+d[a[b+10]]+d[a[b+11]]+d[a[b+12]]+d[a[b+13]]+d[a[b+14]]+d[a[b+15]]).toLowerCase()}},90389:(a,b,c)=>{c.d(b,{hS:()=>d});let d=Object.freeze({ADMIN:"admin",MONITOR_ADMIN:"monitor_admin",AI_GATEWAYS_MONITOR:"ai_gateways_monitor",USER:"user",GUEST:"guest"});Object.freeze([{href:"/dashboard/endpoint",label:"Endpoint",icon:"api"},{href:"/dashboard/api-keys",label:"API Keys",icon:"vpn_key"},{href:"/dashboard/usage",label:"Usage",icon:"bar_chart"},{href:"/dashboard/analytics",label:"Analytics",icon:"monitoring"},{href:"/dashboard/ai-power-index",label:"AI Power Index",icon:"electric_bolt"},{href:"/dashboard/quota",label:"Quota Tracker",icon:"data_usage"}]),Object.freeze(["/dashboard","/dashboard/endpoint","/dashboard/api-keys","/dashboard/usage","/dashboard/analytics","/dashboard/ai-power-index","/dashboard/quota"])},92280:(a,b,c)=>{Object.defineProperty(b,"I",{enumerable:!0,get:function(){return g}});let d=c(28208),e=c(47617),f=c(62018);async function g(a,b,c,g){if((0,d.isNodeNextResponse)(b)){var h;b.statusCode=c.status,b.statusMessage=c.statusText;let d=["set-cookie","www-authenticate","proxy-authenticate","vary"];null==(h=c.headers)||h.forEach((a,c)=>{if("x-middleware-set-cookie"!==c.toLowerCase())if("set-cookie"===c.toLowerCase())for(let d of(0,f.splitCookiesString)(a))b.appendHeader(c,d);else{let e=void 0!==b.getHeader(c);(d.includes(c.toLowerCase())||!e)&&b.appendHeader(c,a)}});let{originalResponse:i}=b;c.body&&"HEAD"!==a.method?await (0,e.pipeToNodeResponse)(c.body,i,g):i.end()}}},94755:(a,b,c)=>{c.d(b,{A:()=>i});var d=c(77598);let e={randomUUID:d.randomUUID},f=new Uint8Array(256),g=f.length;var h=c(50122);let i=function(a,b,c){if(e.randomUUID&&!b&&!a)return e.randomUUID();var i=a,j=c;let k=(i=i||{}).random??i.rng?.()??(g>f.length-16&&((0,d.randomFillSync)(f),g=0),f.slice(g,g+=16));if(k.length<16)throw Error("Random bytes length must be >= 16");if(k[6]=15&k[6]|64,k[8]=63&k[8]|128,b){if((j=j||0)<0||j+16>b.length)throw RangeError(`UUID byte range ${j}:${j+15} is out of buffer bounds`);for(let a=0;a<16;++a)b[j+a]=k[a];return b}return(0,h.k)(k)}}};
+"use strict";exports.id=7307,exports.ids=[7307],exports.modules={9588:(a,b,c)=>{c.d(b,{Cy:()=>i,Gk:()=>l,I8:()=>k,Tv:()=>v,UX:()=>p,aV:()=>o,bz:()=>r,hH:()=>u,ny:()=>s,oW:()=>t,s0:()=>m,ub:()=>n,vZ:()=>q});var d=c(65573),e=c(23211),f=c(89718),g=c(33792),h=c(90389);let i="dashboard_view_mode";function j(a){return String(a||"").trim().toLowerCase()}function k(a){return j(a)}function l(a={}){return[a.ldapUsername,a.ldapEmail,a.ldapName,a.oidcEmail,a.oidcName,a.localUsername,a.username,a.email].map(j).filter(Boolean)}function m(a={}){let b=l(a),c=b[0]||"local",d=a.ldapName||a.ldapEmail||a.oidcName||a.oidcEmail||a.localUsername||c;return{userId:c,displayName:d,loginMethod:a.oidc?"OIDC":a.ldap?"LDAP":"Local",candidates:b}}function n(a={},b={}){var c;if(!b?.authenticated)return!1;if(b.local||!b.ldap&&!b.oidc||b.role===h.hS.ADMIN||!0===b.ldapIsAdmin)return!0;let d=Array.isArray(c=a.ldapAllowedUsers)?c.map(j).filter(Boolean):String(c||"").split(/[,\n]/).map(j).filter(Boolean);return 0!==d.length&&l(b).some(a=>d.includes(a))}function o(a={},b={}){return!(!b?.authenticated||n(a,b))&&(b.role===h.hS.MONITOR_ADMIN||!0===b.ldapIsMonitorAdmin)}function p(a={},b={}){return!(!b?.authenticated||n(a,b)||o(a,b))&&(b.role===h.hS.AI_GATEWAYS_MONITOR||!0===b.ldapIsAiGatewaysMonitor)}function q(a={},b={}){return b?.authenticated?n(a,b)?h.hS.ADMIN:o(a,b)?h.hS.MONITOR_ADMIN:p(a,b)?h.hS.AI_GATEWAYS_MONITOR:h.hS.USER:h.hS.GUEST}function r(a={}){return!0===a.isAdmin||!0===a.isMonitorAdmin}async function s(){let a=await (0,f.getSettings)(),b=await (0,d.UL)(),c=await (0,g.dY)(b.get("auth_token")?.value);if(!c?.authenticated)return{authenticated:!1,isAdmin:!1,actualIsAdmin:!1,showAsUser:!1,canToggleUserMode:!1,isMonitorAdmin:!1,isAiGatewaysMonitor:!1,role:h.hS.GUEST,actualRole:h.hS.GUEST,userId:"",displayName:"Guest",loginMethod:"None",settings:{...a,requireLogin:!0},session:null};let e=m(c||{}),j=q(a,c||{}),k=j===h.hS.ADMIN,l=k&&b.get(i)?.value==="user",n=l?h.hS.USER:j,o=n===h.hS.ADMIN,p=n===h.hS.MONITOR_ADMIN,r=n===h.hS.AI_GATEWAYS_MONITOR;return{authenticated:!0,isAdmin:o,actualIsAdmin:k,showAsUser:l,canToggleUserMode:k,isMonitorAdmin:p,isAiGatewaysMonitor:r,role:n,actualRole:j,canManageApiKeys:o||p,canUseMonitorAdminTabs:o||p,canViewAllAnalytics:o||p||r,...e,settings:{...a,requireLogin:!0},session:c}}async function t(){let a=await s();return a.authenticated?{access:a,response:null}:{access:a,response:e.NextResponse.json({error:"Authentication required"},{status:401})}}async function u(a={}){let{allowMonitorAdmin:b=!1}=a||{},{access:c,response:d}=await t();return d?{access:c,response:d}:c.isAdmin||b&&c.isMonitorAdmin?{access:c,response:null}:{access:c,response:e.NextResponse.json({error:"Admin access required"},{status:403})}}function v(a,b){if(!a?.authenticated||!b)return!1;if(r(a))return!0;let c=j(a.userId),d=j(b.ownerUser),e=j(b.createdByUser);return!!c&&(d===c||e===c)}},13424:(a,b,c)=>{let d=c(77598),e="bluerouter-full-node-encrypted",f="aes-256-gcm",g=Buffer.from("bluerouter-full-node-v3","utf8"),h=Object.freeze({name:"scrypt",N:32768,r:8,p:1,keyLength:32});function i(a){return"string"==typeof a?a:""}function j(a){let b=i(a);if(!b)throw Error("Backup password is required");if(8>Buffer.byteLength(b,"utf8"))throw Error("Backup password must be at least 8 characters");return b}function k(a,b,c=h){let e=Number(c?.N),f=Number(c?.r),g=Number(c?.p),i=Number(c?.keyLength);if(e!==h.N||f!==h.r||g!==h.p||i!==h.keyLength)throw Error("Unsupported backup encryption parameters");return d.scryptSync(a,b,i,{N:e,r:f,p:g,maxmem:0x4000000})}a.exports={FULL_BACKUP_FORMAT_VERSION:3,FULL_BACKUP_KIND:"bluerouter-full-node",ENCRYPTED_BACKUP_KIND:e,SCRYPT_PARAMS:h,passwordText:i,encryptBackupPayload:function(a,b){let c=j(b),i=d.randomBytes(16),l=d.randomBytes(12),m=k(c,i),n=d.createCipheriv(f,m,l);n.setAAD(g);let o=Buffer.concat([n.update(JSON.stringify(a),"utf8"),n.final()]),p=n.getAuthTag();return{backup:{formatVersion:3,kind:e,encrypted:!0,exportedAt:a?.backup?.exportedAt||new Date().toISOString()},encryption:{algorithm:f,kdf:h,salt:i.toString("base64"),iv:l.toString("base64"),authTag:p.toString("base64"),ciphertext:o.toString("base64")}}},decryptBackupPayload:function(a,b){let c=j(b),i=a?.encryption;if(a?.backup?.kind!==e||a?.backup?.encrypted!==!0||i?.algorithm!==f||i?.kdf?.name!==h.name)throw Error("Unsupported encrypted backup format");try{let a=Buffer.from(String(i.salt||""),"base64"),b=Buffer.from(String(i.iv||""),"base64"),e=Buffer.from(String(i.authTag||""),"base64"),h=Buffer.from(String(i.ciphertext||""),"base64");if(16!==a.length||12!==b.length||16!==e.length||0===h.length)throw Error("Invalid encrypted backup payload");let j=k(c,a,i.kdf),l=d.createDecipheriv(f,j,b);l.setAAD(g),l.setAuthTag(e);let m=Buffer.concat([l.update(h),l.final()]).toString("utf8");return JSON.parse(m)}catch{throw Error("Invalid backup password or encrypted backup is damaged")}},isEncryptedBackup:function(a){return a?.backup?.encrypted===!0}}},19225:(a,b,c)=>{a.exports=c(44870)},40833:(a,b,c)=>{let d=c(73024),e=c(76760),{loadConfig:f,saveConfig:g,validateConfig:h}=c(43096),{extractAuditPolicy:i}=c(85463),{importRootCAPair:j,validateRootCAPairPem:k,readRootCAInfo:l,ROOT_CA_CERT_PATH:m,ROOT_CA_KEY_PATH:n}=c(8578),{FULL_BACKUP_FORMAT_VERSION:o,FULL_BACKUP_KIND:p,ENCRYPTED_BACKUP_KIND:q,SCRYPT_PARAMS:r,passwordText:s,encryptBackupPayload:t,decryptBackupPayload:u,isEncryptedBackup:v}=c(13424);async function w(){return Promise.resolve().then(c.bind(c,89718))}async function x(){return c.e(5334).then(c.bind(c,25334))}function y(){return{certPem:d.existsSync(m)?d.readFileSync(m,"utf8"):null,keyPem:d.existsSync(n)?d.readFileSync(n,"utf8"):null}}function z(a,b=""){if(!a||"object"!=typeof a||Array.isArray(a))throw Error("Invalid backup payload");let c=v(a)?u(a,b):a;if(c?.backup?.kind===p&&Number(c?.backup?.formatVersion)===o){if(!c.database||"object"!=typeof c.database||Array.isArray(c.database))throw Error("Full backup is missing database data");return{kind:"full",payload:c,auditProxy:function(a){if(!a||"object"!=typeof a||Array.isArray(a))throw Error("Full backup is missing Audit Proxy data");if(1!==Number(a.version))throw Error("Unsupported Audit Proxy backup version");let b=h(a.config),c=a.rootCA;if(null!=c){if(!c||"object"!=typeof c||Array.isArray(c))throw Error("Invalid Root CA backup");k({certPem:c.certificatePem,keyPem:c.privateKeyPem})}return{config:b,rootCA:c||null}}(c.auditProxy)}}if(2===Number(c?.backup?.formatVersion))return{kind:"legacy",payload:c,auditProxy:null};throw Error("Unsupported backup format")}async function A(){let[{getSettings:a},{applyOutboundProxyEnv:b}]=await Promise.all([w(),x()]);b(await a())}async function B({password:a=""}={}){let{exportDb:b}=await w(),c=f(),d=await b();d.settings={...d.settings||{},auditProxyPolicy:i(c)};let e={backup:{formatVersion:o,kind:p,encrypted:!1,exportedAt:new Date().toISOString()},database:d,auditProxy:{version:1,config:c,rootCA:function(){let a=y();if(!a.certPem&&!a.keyPem)return null;if(!a.certPem||!a.keyPem)throw Error("Root CA certificate/private key pair is incomplete");k(a);let b=l();return{certificatePem:a.certPem,privateKeyPem:a.keyPem,fingerprint:b.fingerprint||"",subject:b.subject||"",notAfter:b.notAfter||null}}()}};return s(a)?t(e,a):e}async function C(a){let{importDb:b,getSettings:d}=await w(),e=await b(a,{returnExport:!1});await A();let g=c(49083),h=await g.applyAuditPolicyFromSettings({force:!0});if(h?.error)throw Error(h.error);let i=await g.getStatus(),j=h?.applied===!0||h?.reason==="unchanged";return{...e,backupKind:"legacy-database",auditProxyImported:j,auditProxyReason:h?.reason||null,rootCAImported:!1,rootCAPreserved:!0,listenerDesiredState:f().enabled?"running":"stopped",listenerRunning:i?.running===!0}}async function D(a,{password:b=""}={}){let h=z(a,b);if("legacy"===h.kind)return C(h.payload);let{database:k}=h.payload,{config:l,rootCA:o}=h.auditProxy,q=!0===l.enabled,r=await w(),s=c(49083),t={database:await r.exportDb(),config:f(),rootCA:y(),running:!0===(await s.getStatus()).running},u=null,v=!1;try{let a;t.running&&await s.stopProxy({persist:!1}),u=await r.importDb(k,{returnExport:!1}),o&&(j({certPem:o.certificatePem,keyPem:o.privateKeyPem}),v=!0);let b=g({...l,enabled:!1});return await r.updateSettings({auditProxyPolicy:i(l)}),await A(),q?a=await s.startProxy():(g({...b,enabled:!1}),a=await s.getStatus()),{...u,backupKind:p,databaseImported:!0,auditProxyImported:!0,rootCAImported:v,rootCAPreserved:!o,policyPublished:!0,listenerDesiredState:q?"running":"stopped",listenerRunning:a?.running===!0}}catch(c){let a=[];try{await s.stopProxy({persist:!1})}catch(b){a.push(`stop: ${b?.message||b}`)}try{await r.importDb(t.database,{returnExport:!1})}catch(b){a.push(`database: ${b?.message||b}`)}try{!function(a){if(d.mkdirSync(e.dirname(m),{recursive:!0}),a.certPem&&a.keyPem)return j({certPem:a.certPem,keyPem:a.keyPem});try{d.unlinkSync(m)}catch(a){if(a?.code!=="ENOENT")throw a}try{d.unlinkSync(n)}catch(a){if(a?.code!=="ENOENT")throw a}a.keyPem&&d.writeFileSync(n,a.keyPem,{mode:384}),a.certPem&&d.writeFileSync(m,a.certPem)}(t.rootCA)}catch(b){a.push(`Root CA: ${b?.message||b}`)}try{g({...t.config,enabled:!1}),t.running?await s.startProxy():g(t.config)}catch(b){a.push(`Audit Proxy: ${b?.message||b}`)}try{await A()}catch(b){a.push(`outbound proxy: ${b?.message||b}`)}let b=a.length?` Rollback warnings: ${a.join("; ")}`:"";throw Error(`Full backup restore failed: ${c?.message||c}.${b}`)}}a.exports={FULL_BACKUP_FORMAT_VERSION:o,FULL_BACKUP_KIND:p,ENCRYPTED_BACKUP_KIND:q,SCRYPT_PARAMS:r,encryptBackupPayload:t,decryptBackupPayload:u,isEncryptedBackup:v,decodeBackupPayload:z,exportFullNodeBackup:B,restoreFullNodeBackup:D}},50122:(a,b,c)=>{c.d(b,{k:()=>e});let d=[];for(let a=0;a<256;++a)d.push((a+256).toString(16).slice(1));function e(a,b=0){return(d[a[b+0]]+d[a[b+1]]+d[a[b+2]]+d[a[b+3]]+"-"+d[a[b+4]]+d[a[b+5]]+"-"+d[a[b+6]]+d[a[b+7]]+"-"+d[a[b+8]]+d[a[b+9]]+"-"+d[a[b+10]]+d[a[b+11]]+d[a[b+12]]+d[a[b+13]]+d[a[b+14]]+d[a[b+15]]).toLowerCase()}},90389:(a,b,c)=>{c.d(b,{hS:()=>d});let d=Object.freeze({ADMIN:"admin",MONITOR_ADMIN:"monitor_admin",AI_GATEWAYS_MONITOR:"ai_gateways_monitor",USER:"user",GUEST:"guest"});Object.freeze([{href:"/dashboard/endpoint",label:"Endpoint",icon:"api"},{href:"/dashboard/api-keys",label:"API Keys",icon:"vpn_key"},{href:"/dashboard/usage",label:"Usage",icon:"bar_chart"},{href:"/dashboard/analytics",label:"Analytics",icon:"monitoring"},{href:"/dashboard/ai-power-index",label:"AI Power Index",icon:"electric_bolt"},{href:"/dashboard/quota",label:"Quota Tracker",icon:"data_usage"}]),Object.freeze(["/dashboard","/dashboard/endpoint","/dashboard/api-keys","/dashboard/usage","/dashboard/analytics","/dashboard/ai-power-index","/dashboard/quota"])},92280:(a,b,c)=>{Object.defineProperty(b,"I",{enumerable:!0,get:function(){return g}});let d=c(28208),e=c(47617),f=c(62018);async function g(a,b,c,g){if((0,d.isNodeNextResponse)(b)){var h;b.statusCode=c.status,b.statusMessage=c.statusText;let d=["set-cookie","www-authenticate","proxy-authenticate","vary"];null==(h=c.headers)||h.forEach((a,c)=>{if("x-middleware-set-cookie"!==c.toLowerCase())if("set-cookie"===c.toLowerCase())for(let d of(0,f.splitCookiesString)(a))b.appendHeader(c,d);else{let e=void 0!==b.getHeader(c);(d.includes(c.toLowerCase())||!e)&&b.appendHeader(c,a)}});let{originalResponse:i}=b;c.body&&"HEAD"!==a.method?await (0,e.pipeToNodeResponse)(c.body,i,g):i.end()}}},94755:(a,b,c)=>{c.d(b,{A:()=>i});var d=c(77598);let e={randomUUID:d.randomUUID},f=new Uint8Array(256),g=f.length;var h=c(50122);let i=function(a,b,c){if(e.randomUUID&&!b&&!a)return e.randomUUID();var i=a,j=c;let k=(i=i||{}).random??i.rng?.()??(g>f.length-16&&((0,d.randomFillSync)(f),g=0),f.slice(g,g+=16));if(k.length<16)throw Error("Random bytes length must be >= 16");if(k[6]=15&k[6]|64,k[8]=63&k[8]|128,b){if((j=j||0)<0||j+16>b.length)throw RangeError(`UUID byte range ${j}:${j+15} is out of buffer bounds`);for(let a=0;a<16;++a)b[j+a]=k[a];return b}return(0,h.k)(k)}}};

package/app/.next-cli-build/server/chunks/8049.js

@@ -1,4 +1,4 @@
-"use strict";exports.id=8049,exports.ids=[3960,8049,9841],exports.modules={23248:(a,b,c)=>{c.d(b,{ensureClusterSyncService:()=>t});var d=c(77598),e=c.n(d),f=c(48161),g=c.n(f),h=c(70321);function i(a){return null==a?"":String(a).trim()}var j=c(43913),k=c(79709),l=c(75870);let m="__blueRouterClusterSync";function n(){return globalThis[m]||(globalThis[m]={timer:null,running:null,started:!1,heartbeatSucceeded:!1}),globalThis[m]}async function o(a=null){var b,c;let d=a||await (0,l.Jc)({includeSecrets:!0});if("slave"!==d.role)throw Error("Node is not in Standby mode");if(!d.masterUrl)throw Error("Master URL is not configured");if(!d.syncToken)throw Error("Sync token is not configured");let f=await fetch((b=d.masterUrl,`${String(b||"").replace(/\/+$/,"")}/api/cluster/snapshot`),{headers:{Authorization:`Bearer ${d.syncToken}`,"X-BlueRouter-Node-Id":d.nodeId},cache:"no-store",signal:AbortSignal.timeout(12e4)});if(!f.ok)throw Error((await f.json().catch(()=>({}))).error||`Master returned HTTP ${f.status}`);if((Number(f.headers.get("content-length"))||0)>0x10000000)throw Error("Cluster snapshot exceeds the 256 MB limit");let g=await f.text();if(Buffer.byteLength(g,"utf8")>0x10000000)throw Error("Cluster snapshot exceeds the 256 MB limit");let h=JSON.parse(g);if(!h||"object"!=typeof h||!h.manifest||!h.payload)throw Error("Invalid cluster snapshot response");if(c=h.payload,e().createHash("sha256").update(JSON.stringify(c)).digest("hex")!==h.manifest.sha256)throw Error("Cluster snapshot checksum mismatch");if(2!==Number(h.payload?.backup?.formatVersion))throw Error("Unsupported cluster backup format");if(Number(h.manifest.schemaVersion)!==(0,j.q)())throw Error(`Schema version mismatch: Master=${h.manifest.schemaVersion}, Standby=${(0,j.q)()}`);return h}async function p({force:a=!1,allowDisabled:b=!1}={}){let d=n();return d.running||(d.running=(async()=>{let d=await (0,l.Jc)({includeSecrets:!0});if("slave"!==d.role||!d.enabled&&!b)throw Error("Standby sync is not enabled");let e=new Date().toISOString();await (0,l.X_)({lastAttemptAt:e});try{let b=await o(d);if(!a&&b.manifest.sha256===d.lastSnapshotHash){let a={status:"unchanged",snapshotHash:b.manifest.sha256,masterCreatedAt:b.manifest.createdAt};return await (0,l.X_)({lastSyncAt:new Date().toISOString(),lastError:"",lastResult:a}),a}let e=await (0,h.importDb)(b.payload,{returnExport:!1});try{!function({outboundProxyEnabled:a,outboundProxyUrl:b,outboundNoProxy:c}={}){if("u"<typeof process||!process.env)return;let d=i(b),e=i(c);if(!a){"1"===process.env.NINE_ROUTER_PROXY_MANAGED&&(delete process.env.HTTP_PROXY,delete process.env.HTTPS_PROXY,delete process.env.ALL_PROXY,delete process.env.NO_PROXY,delete process.env.NINE_ROUTER_PROXY_MANAGED,delete process.env.NINE_ROUTER_PROXY_URL,delete process.env.NINE_ROUTER_NO_PROXY);return}let f="1"===process.env.NINE_ROUTER_PROXY_MANAGED,g=!1;f&&(d||(delete process.env.HTTP_PROXY,delete process.env.HTTPS_PROXY,delete process.env.ALL_PROXY,delete process.env.NINE_ROUTER_PROXY_URL),e||(delete process.env.NO_PROXY,delete process.env.NINE_ROUTER_NO_PROXY)),d&&(process.env.HTTP_PROXY=d,process.env.HTTPS_PROXY=d,process.env.ALL_PROXY=d,process.env.NINE_ROUTER_PROXY_URL=d,g=!0),e&&(process.env.NO_PROXY=e,process.env.NINE_ROUTER_NO_PROXY=e,g=!0),g?process.env.NINE_ROUTER_PROXY_MANAGED="1":f&&delete process.env.NINE_ROUTER_PROXY_MANAGED}(await (0,h.getSettings)())}catch(a){console.warn("[cluster] failed to apply restored outbound proxy settings:",a?.message||a)}let f=null;try{let{applyAuditPolicyFromSettings:a}=await Promise.all([c.e(3503),c.e(3958)]).then(c.t.bind(c,93958,23));f=await a()}catch(a){console.warn("[cluster] failed to apply Audit Proxy policy from snapshot:",a?.message||a)}let g={status:"synced",snapshotHash:b.manifest.sha256,masterCreatedAt:b.manifest.createdAt,serverCount:e.resourceMonitorServerCount||0,historyCount:e.resourceMonitorHistoryCount||0,brandingAssetCount:e.brandingAssetCount||0,auditProxyPolicyApplied:f?.applied===!0};return await (0,l.X_)({lastSyncAt:new Date().toISOString(),lastSnapshotHash:b.manifest.sha256,lastError:"",lastResult:g}),g}catch(a){throw await (0,l.X_)({lastError:a?.message||"Cluster sync failed",lastResult:{status:"error"}}),a}})().finally(()=>{d.running=null})),d.running}async function q(a){if(!a?.id||!a?.type)return;let b="ok",c="Command completed";try{if("sync_now"===a.type){let a=await p({force:!0,allowDisabled:!0});c=`Sync completed: ${a.status}`}else if("pause_sync"===a.type)await (0,l.Q1)({enabled:!1}),c="Scheduled sync paused";else if("resume_sync"===a.type)await (0,l.Q1)({enabled:!0}),c="Scheduled sync resumed";else throw Error(`Unsupported Master command: ${a.type}`)}catch(a){b="error",c=a?.message||"Command failed"}await (0,l.X_)({commandAck:{id:a.id,status:b,message:c,completedAt:new Date().toISOString()}})}async function r(a=null){var b;let c=a||await (0,l.Jc)({includeSecrets:!0});if("slave"!==c.role)return{skipped:!0};if(!c.masterUrl||!c.syncToken)throw Error("Master URL and sync token are required for heartbeat");let d=await fetch((b=c.masterUrl,`${String(b||"").replace(/\/+$/,"")}/api/cluster/heartbeat`),{method:"POST",headers:{Authorization:`Bearer ${c.syncToken}`,"Content-Type":"application/json"},body:JSON.stringify({nodeId:c.nodeId,hostname:g().hostname(),appVersion:(0,k.s)(),schemaVersion:(0,j.q)(),syncEnabled:c.enabled,intervalMinutes:c.intervalMinutes,lastAttemptAt:c.lastAttemptAt,lastSyncAt:c.lastSyncAt,lastSnapshotHash:c.lastSnapshotHash,lastError:c.lastError,commandAck:c.commandAck}),cache:"no-store",signal:AbortSignal.timeout(15e3)}),e=await d.json().catch(()=>({}));if(!d.ok)throw Error(e.error||`Master heartbeat returned HTTP ${d.status}`);return c.commandAck&&e.ackAccepted&&await (0,l.X_)({commandAck:null}),e.command&&await q(e.command),e}async function s(){let a=n();try{let b=await (0,l.Jc)({includeSecrets:!0});if("slave"===b.role){let c=!a.heartbeatSucceeded,d=await r(b).then(b=>(a.heartbeatSucceeded=!0,b),b=>(a.heartbeatSucceeded=!1,console.warn("[cluster] heartbeat failed:",b?.message||b),null)),e=await (0,l.Jc)({includeSecrets:!0});if(!e.enabled)return;let f=Date.parse(e.lastAttemptAt||"")||0,g=60*e.intervalMinutes*1e3,h=d&&c&&d.command?.type!=="sync_now";(h||Date.now()-f>=g)&&await p({force:!!h}).catch(a=>{console.warn("[cluster] scheduled sync failed:",a?.message||a)})}else a.heartbeatSucceeded=!1}finally{a.timer=setTimeout(s,3e4),a.timer.unref?.()}}function t(){let a=n();a.started||(a.started=!0,a.timer=setTimeout(s,5e3),a.timer.unref?.())}},34050:(a,b,c)=>{c.d(b,{CG:()=>e,oG:()=>d,zE:()=>f});let d=`
+"use strict";exports.id=8049,exports.ids=[3960,8049,9841],exports.modules={23248:(a,b,c)=>{c.d(b,{ensureClusterSyncService:()=>t});var d=c(77598),e=c.n(d),f=c(48161),g=c.n(f),h=c(70321);function i(a){return null==a?"":String(a).trim()}var j=c(43913),k=c(79709),l=c(75870);let m="__blueRouterClusterSync";function n(){return globalThis[m]||(globalThis[m]={timer:null,running:null,started:!1,heartbeatSucceeded:!1}),globalThis[m]}async function o(a=null){var b,c;let d=a||await (0,l.Jc)({includeSecrets:!0});if("slave"!==d.role)throw Error("Node is not in Standby mode");if(!d.masterUrl)throw Error("Master URL is not configured");if(!d.syncToken)throw Error("Sync token is not configured");let f=await fetch((b=d.masterUrl,`${String(b||"").replace(/\/+$/,"")}/api/cluster/snapshot`),{headers:{Authorization:`Bearer ${d.syncToken}`,"X-BlueRouter-Node-Id":d.nodeId},cache:"no-store",signal:AbortSignal.timeout(12e4)});if(!f.ok)throw Error((await f.json().catch(()=>({}))).error||`Master returned HTTP ${f.status}`);if((Number(f.headers.get("content-length"))||0)>0x10000000)throw Error("Cluster snapshot exceeds the 256 MB limit");let g=await f.text();if(Buffer.byteLength(g,"utf8")>0x10000000)throw Error("Cluster snapshot exceeds the 256 MB limit");let h=JSON.parse(g);if(!h||"object"!=typeof h||!h.manifest||!h.payload)throw Error("Invalid cluster snapshot response");if(c=h.payload,e().createHash("sha256").update(JSON.stringify(c)).digest("hex")!==h.manifest.sha256)throw Error("Cluster snapshot checksum mismatch");if(2!==Number(h.payload?.backup?.formatVersion))throw Error("Unsupported cluster backup format");if(Number(h.manifest.schemaVersion)!==(0,j.q)())throw Error(`Schema version mismatch: Master=${h.manifest.schemaVersion}, Standby=${(0,j.q)()}`);return h}async function p({force:a=!1,allowDisabled:b=!1}={}){let d=n();return d.running||(d.running=(async()=>{let d=await (0,l.Jc)({includeSecrets:!0});if("slave"!==d.role||!d.enabled&&!b)throw Error("Standby sync is not enabled");let e=new Date().toISOString();await (0,l.X_)({lastAttemptAt:e});try{let b=await o(d);if(!a&&b.manifest.sha256===d.lastSnapshotHash){let a={status:"unchanged",snapshotHash:b.manifest.sha256,masterCreatedAt:b.manifest.createdAt};return await (0,l.X_)({lastSyncAt:new Date().toISOString(),lastError:"",lastResult:a}),a}let e=await (0,h.importDb)(b.payload,{returnExport:!1});try{!function({outboundProxyEnabled:a,outboundProxyUrl:b,outboundNoProxy:c}={}){if("u"<typeof process||!process.env)return;let d=i(b),e=i(c);if(!a){"1"===process.env.NINE_ROUTER_PROXY_MANAGED&&(delete process.env.HTTP_PROXY,delete process.env.HTTPS_PROXY,delete process.env.ALL_PROXY,delete process.env.NO_PROXY,delete process.env.NINE_ROUTER_PROXY_MANAGED,delete process.env.NINE_ROUTER_PROXY_URL,delete process.env.NINE_ROUTER_NO_PROXY);return}let f="1"===process.env.NINE_ROUTER_PROXY_MANAGED,g=!1;f&&(d||(delete process.env.HTTP_PROXY,delete process.env.HTTPS_PROXY,delete process.env.ALL_PROXY,delete process.env.NINE_ROUTER_PROXY_URL),e||(delete process.env.NO_PROXY,delete process.env.NINE_ROUTER_NO_PROXY)),d&&(process.env.HTTP_PROXY=d,process.env.HTTPS_PROXY=d,process.env.ALL_PROXY=d,process.env.NINE_ROUTER_PROXY_URL=d,g=!0),e&&(process.env.NO_PROXY=e,process.env.NINE_ROUTER_NO_PROXY=e,g=!0),g?process.env.NINE_ROUTER_PROXY_MANAGED="1":f&&delete process.env.NINE_ROUTER_PROXY_MANAGED}(await (0,h.getSettings)())}catch(a){console.warn("[cluster] failed to apply restored outbound proxy settings:",a?.message||a)}let f=null;try{let{applyAuditPolicyFromSettings:a}=await Promise.all([c.e(1893),c.e(5019),c.e(2947),c.e(3958)]).then(c.t.bind(c,93958,23));f=await a()}catch(a){console.warn("[cluster] failed to apply Audit Proxy policy from snapshot:",a?.message||a)}let g={status:"synced",snapshotHash:b.manifest.sha256,masterCreatedAt:b.manifest.createdAt,serverCount:e.resourceMonitorServerCount||0,historyCount:e.resourceMonitorHistoryCount||0,brandingAssetCount:e.brandingAssetCount||0,auditProxyPolicyApplied:f?.applied===!0};return await (0,l.X_)({lastSyncAt:new Date().toISOString(),lastSnapshotHash:b.manifest.sha256,lastError:"",lastResult:g}),g}catch(a){throw await (0,l.X_)({lastError:a?.message||"Cluster sync failed",lastResult:{status:"error"}}),a}})().finally(()=>{d.running=null})),d.running}async function q(a){if(!a?.id||!a?.type)return;let b="ok",c="Command completed";try{if("sync_now"===a.type){let a=await p({force:!0,allowDisabled:!0});c=`Sync completed: ${a.status}`}else if("pause_sync"===a.type)await (0,l.Q1)({enabled:!1}),c="Scheduled sync paused";else if("resume_sync"===a.type)await (0,l.Q1)({enabled:!0}),c="Scheduled sync resumed";else throw Error(`Unsupported Master command: ${a.type}`)}catch(a){b="error",c=a?.message||"Command failed"}await (0,l.X_)({commandAck:{id:a.id,status:b,message:c,completedAt:new Date().toISOString()}})}async function r(a=null){var b;let c=a||await (0,l.Jc)({includeSecrets:!0});if("slave"!==c.role)return{skipped:!0};if(!c.masterUrl||!c.syncToken)throw Error("Master URL and sync token are required for heartbeat");let d=await fetch((b=c.masterUrl,`${String(b||"").replace(/\/+$/,"")}/api/cluster/heartbeat`),{method:"POST",headers:{Authorization:`Bearer ${c.syncToken}`,"Content-Type":"application/json"},body:JSON.stringify({nodeId:c.nodeId,hostname:g().hostname(),appVersion:(0,k.s)(),schemaVersion:(0,j.q)(),syncEnabled:c.enabled,intervalMinutes:c.intervalMinutes,lastAttemptAt:c.lastAttemptAt,lastSyncAt:c.lastSyncAt,lastSnapshotHash:c.lastSnapshotHash,lastError:c.lastError,commandAck:c.commandAck}),cache:"no-store",signal:AbortSignal.timeout(15e3)}),e=await d.json().catch(()=>({}));if(!d.ok)throw Error(e.error||`Master heartbeat returned HTTP ${d.status}`);return c.commandAck&&e.ackAccepted&&await (0,l.X_)({commandAck:null}),e.command&&await q(e.command),e}async function s(){let a=n();try{let b=await (0,l.Jc)({includeSecrets:!0});if("slave"===b.role){let c=!a.heartbeatSucceeded,d=await r(b).then(b=>(a.heartbeatSucceeded=!0,b),b=>(a.heartbeatSucceeded=!1,console.warn("[cluster] heartbeat failed:",b?.message||b),null)),e=await (0,l.Jc)({includeSecrets:!0});if(!e.enabled)return;let f=Date.parse(e.lastAttemptAt||"")||0,g=60*e.intervalMinutes*1e3,h=d&&c&&d.command?.type!=="sync_now";(h||Date.now()-f>=g)&&await p({force:!!h}).catch(a=>{console.warn("[cluster] scheduled sync failed:",a?.message||a)})}else a.heartbeatSucceeded=!1}finally{a.timer=setTimeout(s,3e4),a.timer.unref?.()}}function t(){let a=n();a.started||(a.started=!0,a.timer=setTimeout(s,5e3),a.timer.unref?.())}},34050:(a,b,c)=>{c.d(b,{CG:()=>e,oG:()=>d,zE:()=>f});let d=`
 PRAGMA journal_mode = WAL;
 PRAGMA synchronous = NORMAL;
 PRAGMA temp_store = MEMORY;

package/app/.next-cli-build/server/chunks/9083.js

@@ -4,16 +4,16 @@ ${f}Connection: close\r
 Content-Type: text/plain; charset=utf-8\r
 Content-Length: ${Buffer.byteLength(e)}\r
 \r
-${e}`)}catch{try{a.destroy()}catch{}}}function N(a={}){let b={};for(let[c,d]of Object.entries(a||{}))b[c]=d;return b}async function O(a){let b=await a.requestCapture.finish(String(a.requestHeaders["content-type"]||""),String(a.requestHeaders["content-encoding"]||"")),c=String(a.responseHeaders?.["content-type"]||""),d=await a.responseCapture.finish(c,String(a.responseHeaders?.["content-encoding"]||"")),e=J(a.target.host),f=n(a.path),g=p({provider:e,body:d.body,contentType:c,path:f}),h=K(b.body)||g?.model||null;return{id:i.randomUUID(),timestamp:new Date().toISOString(),protocol:a.protocol||"http/1.1",client:{ip:a.clientIp||"",port:a.clientPort||null,userAgent:String(a.requestHeaders["user-agent"]||""),proxyUser:a.authUser||null},provider:e,host:C(a.target.host),port:a.target.port,method:a.method,path:f,model:h,usage:g,status:a.statusCode||null,durationMs:Date.now()-a.startedAt,error:a.error?o(a.error.message||a.error):null,denied:!0===a.denied,request:{headers:l(a.requestHeaders),...b},response:{headers:l(a.responseHeaders||{}),...d}}}a.exports={createAuditProxy:function(a={},b={}){let i={allowedHosts:[],passthroughUnknown:!0,captureBodies:!0,captureLimitBytes:2097152,verifyUpstreamTls:!0,allowedConnectPorts:[443],connectTimeoutMs:1e4,tlsHandshakeTimeoutMs:1e4,responseHeaderTimeoutMs:3e4,idleTimeoutMs:9e5,allowPlainHttp:!1,clientToolFilterEnabled:!1,allowedClientTools:[],proxyAuthEnabled:!1,proxyAuthUsers:[],clientAlpnProtocols:["http/1.1"],...a};if(!0!==i.verifyUpstreamTls)throw Error("Upstream TLS verification is mandatory in Audit Proxy mode");let j=b.certificateProvider;if("function"!=typeof j)throw Error("certificateProvider is required");let k="function"==typeof b.onAudit?b.onAudit:()=>{},l="function"==typeof b.onAuditJob?b.onAuditJob:null,m="function"==typeof b.resolveTarget?b.resolveTarget:(a,b)=>q(a,b,{allowedPorts:i.allowedConnectPorts}),n=b.upstreamCa,o=r(i.allowedClientTools),p=i.proxyAuthEnabled?u(i.proxyAuthUsers):null,w=i.proxyAuthEnabled?v():null,x=new Set,y=new Map,z=new WeakMap,A=new Set;function B(a){return!a||x.has(a)||(x.add(a),a.once?.("close",()=>x.delete(a))),a}function C(a,b){try{"function"==typeof a.destroy?a.destroy(b):"function"==typeof a.close&&a.close()}catch{}}function G(a){let b=()=>O(a);if(l){try{l(b)}catch(a){console.warn("[audit-proxy] audit enqueue failed:",a?.message||a)}return}setImmediate(()=>{Promise.resolve().then(b).then(k).catch(a=>console.warn("[audit-proxy] audit callback failed:",a?.message||a))})}function H({requestHeaders:a,method:b,path:c,target:d,requestCapture:e,responseCapture:f,responseHeaders:g,statusCode:h,startedAt:i,error:j,socket:k,protocol:l,authUser:m=null,denied:n=!1}){return{requestHeaders:N(a),method:b,path:c,target:d,requestCapture:e,responseCapture:f,responseHeaders:N(g),statusCode:h,startedAt:i,error:j,clientIp:L(k),clientPort:k?.remotePort||null,authUser:m,protocol:l,denied:n}}let J="This proxy does not support WebSocket connections. Use the HTTP streaming transport instead - most clients fall back to it automatically.";function K(a,b,c,d,{statusCode:e=403,authUser:f=null}={}){let g=String(a.url||""),h=c||{host:g.includes(":")?g.slice(0,g.lastIndexOf(":")):g||"unknown",port:443},j=new I(i.captureBodies?i.captureLimitBytes:0);j.add(Buffer.from(d)),G(H({requestHeaders:a.headers,method:"CONNECT",path:"",target:h,requestCapture:new I(0),responseCapture:j,responseHeaders:{"content-type":"text/plain; charset=utf-8",connection:"close"},statusCode:e,startedAt:Date.now(),error:d,socket:b,protocol:"http/1.1",authUser:f,denied:!0}))}let P=Symbol("refused");async function Q(a,b){if(!p)return null;let d=L(b),e=(c,d=null)=>(M(b,"407 Proxy Authentication Required",c,['Proxy-Authenticate: Basic realm="BlueRouter Audit Proxy", charset="UTF-8"']),K(a,b,void 0,c,{statusCode:407,authUser:d}),P);if(w.isLocked(d))return e("Too many failed proxy authentication attempts");let f=a.headers["proxy-authorization"],g=await p.authenticate(f);if(g.ok)return w.recordSuccess(d),g.username;let h=null;if(f){let{lockedNow:a}=w.recordFailure(d);a&&console.log(`[audit-proxy] proxy auth lockout for ${d||"unknown"}`);try{h=c(7566).parseBasicProxyAuthorization(f)?.username||null}catch{h=null}}return e(g.reason||"Proxy authentication required",h)}function R(a,b,c){if(!c)return;let d=new I(i.captureBodies?i.captureLimitBytes:0);d.add(Buffer.from(J)),G(H({requestHeaders:a.headers,method:a.method,path:a.url,target:c,requestCapture:new I(0),responseCapture:d,responseHeaders:{"content-type":"text/plain; charset=utf-8",connection:"close"},statusCode:501,startedAt:Date.now(),error:null,socket:b,protocol:"http/1.1",authUser:b?.__auditProxyUser||null,denied:!0}))}async function S(a,b,{expectContinue:c=!1}={}){let d=a.socket.__auditTarget,e=a.socket.__auditProxyUser||null;if(!d){b.writeHead(502,{"content-type":"text/plain"}),b.end("Audit target is missing");return}if(function(a={}){return"string"==typeof a.upgrade&&""!==a.upgrade.trim()}(a.headers)){b.writeHead(501,{"content-type":"text/plain; charset=utf-8",connection:"close"}),b.end(J),R(a,a.socket,d);return}let h=Date.now(),j=new I(i.captureBodies?i.captureLimitBytes:0),k=new I(i.captureBodies?i.captureLimitBytes:0),l=F(a.headers,{stripInternal:!0});l.host=443===d.port?d.host:`${d.host}:${d.port}`;let o=null,p=null,q={},r=null,s=!1,t=!1,u=null,v=(b=null)=>{s||(s=!0,u&&clearTimeout(u),G(H({requestHeaders:a.headers,method:a.method,path:a.url,target:d,requestCapture:j,responseCapture:k,responseHeaders:q,statusCode:r,startedAt:h,error:b,socket:a.socket,protocol:"http/1.1",authUser:e})))};try{let e,h,s=await m(d.host,d.port);(o=f.request({hostname:d.host,port:d.port,method:a.method,path:a.url,headers:l,rejectUnauthorized:!0,servername:g.isIP(d.host)?void 0:d.host,ca:n,ALPNProtocols:["http/1.1"],lookup:s.lookup,autoSelectFamily:!0,agent:(e=`${d.host}:${d.port}`,(h=y.get(e))||(h=new f.Agent({keepAlive:!0,maxSockets:32,maxFreeSockets:8,timeout:i.idleTimeoutMs}),y.set(e,h)),h)})).on("socket",a=>{if(B(a),a.setNoDelay(!0),a.setKeepAlive(!0,3e4),a.setTimeout(i.idleTimeoutMs,()=>a.destroy(Error("Upstream idle timeout"))),a.connecting){let b=setTimeout(()=>a.destroy(Error("Upstream TLS connect timeout")),i.connectTimeoutMs+i.tlsHandshakeTimeoutMs);b.unref?.();let c=()=>clearTimeout(b);a.once("secureConnect",c),a.once("error",c),a.once("close",c)}}),o.on("continue",()=>{c&&!b.headersSent&&b.writeContinue()}),o.on("information",a=>{102===a.statusCode&&"function"==typeof b.writeProcessing&&b.writeProcessing(),103===a.statusCode&&"function"==typeof b.writeEarlyHints&&b.writeEarlyHints(a.headers||{})}),o.on("response",a=>{p=a,u&&clearTimeout(u),r=a.statusCode||502,q=N(a.headers||{});let c=F(a.headers,{stripInternal:!1});b.writeHead(r,c),b.flushHeaders?.(),a.on("data",c=>{k.add(c),b.write(c)||a.pause()}),b.on("drain",()=>a.resume()),a.on("aborted",()=>{let a=Error("Upstream response aborted");b.destroyed||b.destroy(a),v(a)}),a.on("error",a=>{b.destroyed||b.destroy(a),v(a)}),a.on("end",()=>{if(a.trailers&&Object.keys(a.trailers).length)try{b.addTrailers(F(a.trailers,{stripInternal:!1}))}catch{}t=!0,b.end(),v(null)})}),o.on("error",a=>{b.headersSent?b.destroyed||b.destroy(a):(b.writeHead(502,{"content-type":"application/json"}),b.end(JSON.stringify({error:"Verified upstream TLS request failed"})),t=!0),v(a)}),a.on("data",b=>{j.add(b),o.write(b)||a.pause()}),o.on("drain",()=>a.resume()),a.on("end",()=>{if(a.trailers&&Object.keys(a.trailers).length)try{o.addTrailers(F(a.trailers,{stripInternal:!0}))}catch{}o.end(),u=setTimeout(()=>o.destroy(Error("Upstream response header timeout")),i.responseHeaderTimeoutMs),u.unref?.()}),a.on("aborted",()=>o.destroy(Error("Client request aborted"))),a.on("error",a=>o.destroy(a)),b.on("close",()=>{t||(p?.destroy(Error("Client response closed")),o?.destroy(Error("Client response closed")),v(Error("Client response closed")))})}catch(a){b.headersSent||(b.writeHead(502,{"content-type":"application/json"}),b.end(JSON.stringify({error:"Destination validation or connection failed"})),t=!0),v(a)}}let T=d.createServer((a,b)=>{S(a,b)});async function U(a){return a.upstreamPromise||(a.upstreamPromise=(async()=>{let b=a.target,c=await m(b.host,b.port),d=B(h.connect({host:b.host,port:b.port,servername:g.isIP(b.host)?void 0:b.host,rejectUnauthorized:!0,ca:n,ALPNProtocols:["h2"],lookup:c.lookup,autoSelectFamily:!0}));d.setNoDelay(!0),d.setKeepAlive(!0,3e4);let f=setTimeout(()=>d.destroy(Error("Upstream HTTP/2 TLS connect timeout")),i.connectTimeoutMs+i.tlsHandshakeTimeoutMs);f.unref?.(),d.once("secureConnect",()=>{clearTimeout(f),"h2"!==d.alpnProtocol&&d.destroy(Error("Upstream did not negotiate HTTP/2"))}),d.once("error",()=>clearTimeout(f)),d.once("close",()=>clearTimeout(f));let j=`https://${b.host}${443===b.port?"":`:${b.port}`}`,k=e.connect(j,{createConnection:()=>d,settings:{enablePush:!1}});return A.add(k),k.setTimeout(i.idleTimeoutMs,()=>k.destroy(Error("Upstream HTTP/2 idle timeout"))),k.once("close",()=>A.delete(k)),await new Promise((a,b)=>{let c=setTimeout(()=>b(Error("Upstream HTTP/2 session timeout")),i.connectTimeoutMs+i.tlsHandshakeTimeoutMs);c.unref?.();let d=(a,b)=>{clearTimeout(c),k.removeListener("connect",e),k.removeListener("error",f),a(b)},e=()=>d(a,k),f=a=>d(b,a);k.once("connect",e),k.once("error",f)}),k})().catch(b=>{throw a.upstreamPromise=null,b})),a.upstreamPromise}async function V(a,b){let c=z.get(a.session),d=c?.target;if(!c||!d){a.respond({":status":502,"content-type":"text/plain"}),a.end("Audit target is missing");return}a.pause();let f=Date.now(),g=new I(i.captureBodies?i.captureLimitBytes:0),h=new I(i.captureBodies?i.captureLimitBytes:0),j={},k=null,l=!1,m=!1,n=null,o=null,p=null,q=(e=null)=>{l||(l=!0,G(H({requestHeaders:b,method:b[":method"]||"GET",path:b[":path"]||"/",target:d,requestCapture:g,responseCapture:h,responseHeaders:j,statusCode:k,startedAt:f,error:e,socket:a.session.socket,protocol:"h2",authUser:c.authUser||null})))};try{(n=(await U(c)).request(function(a,b){let c=F(a,{stripInternal:!0}),d={":method":a[":method"]||"GET",":path":a[":path"]||"/",":scheme":"https",":authority":443===b.port?b.host:`${b.host}:${b.port}`};for(let[a,b]of Object.entries(c))a.startsWith(":")||(d[a.toLowerCase()]=b);return d}(b,d),{endStream:!1,waitForTrailers:!0})).setTimeout(i.idleTimeoutMs,()=>n.close(e.constants.NGHTTP2_CANCEL)),a.setTimeout(i.idleTimeoutMs,()=>a.close(e.constants.NGHTTP2_CANCEL)),n.on("response",b=>{j=N(b),k=Number(b[":status"]||502),a.respond(function(a){let b=F(a,{stripInternal:!1}),c={":status":Number(a[":status"]||502)};for(let[a,d]of Object.entries(b))a.startsWith(":")||(c[a.toLowerCase()]=d);return c}(b),{waitForTrailers:!0})}),n.on("trailers",a=>{p=F(a,{stripInternal:!1})}),a.on("wantTrailers",()=>{try{a.sendTrailers(p||{})}catch{}}),a.on("trailers",a=>{o=F(a,{stripInternal:!0})}),n.on("wantTrailers",()=>{try{n.sendTrailers(o||{})}catch{}}),a.on("data",b=>{g.add(b),n.write(b)||a.pause()}),n.on("drain",()=>a.resume()),a.on("end",()=>n.end()),n.on("data",b=>{h.add(b),a.write(b)||n.pause()}),a.on("drain",()=>n.resume()),n.on("end",()=>{m=!0,a.end(),q(null)}),n.on("aborted",()=>{let b=Error("Upstream HTTP/2 stream aborted");a.close(e.constants.NGHTTP2_INTERNAL_ERROR),q(b)}),n.on("error",b=>{a.closed||a.close(e.constants.NGHTTP2_INTERNAL_ERROR),q(b)}),a.on("aborted",()=>{n.close(e.constants.NGHTTP2_CANCEL),q(Error("Client HTTP/2 stream aborted"))}),a.on("error",a=>{n.close(e.constants.NGHTTP2_CANCEL),q(a)}),a.on("close",()=>{m||!n||n.closed||(n.close(e.constants.NGHTTP2_CANCEL),q(Error("Client HTTP/2 stream closed")))}),a.resume()}catch(b){a.headersSent||a.closed||a.respond({":status":502,"content-type":"application/json"}),a.closed||a.end(JSON.stringify({error:"Verified upstream HTTP/2 request failed"})),q(b)}}T.on("checkContinue",(a,b)=>{S(a,b,{expectContinue:!0})}),T.on("upgrade",(a,b)=>{M(b,"501 Not Implemented",J),R(a,b,b.__auditTarget)}),T.on("clientError",(a,b)=>C(b)),T.headersTimeout=i.responseHeaderTimeoutMs,T.requestTimeout=0,T.keepAliveTimeout=i.idleTimeoutMs;let W=e.createServer({settings:{enablePush:!1}});W.on("session",a=>{let b={target:a.socket.__auditTarget,authUser:a.socket.__auditProxyUser||null,upstreamPromise:null};z.set(a,b),a.setTimeout(i.idleTimeoutMs,()=>a.destroy(Error("Client HTTP/2 idle timeout"))),a.once("close",()=>{Promise.resolve(b.upstreamPromise).then(a=>a?.close()).catch(()=>{})})}),W.on("stream",(a,b)=>{V(a,b)}),W.on("sessionError",a=>{console.warn("[audit-proxy] HTTP/2 client session error:",a?.message||a)});let X=d.createServer((a,b)=>{b.writeHead(403,{"content-type":"text/plain; charset=utf-8",connection:"close"}),b.end("Audit Proxy accepts HTTPS CONNECT traffic only")});function Y(){o=r(i.allowedClientTools),p=i.proxyAuthEnabled?u(i.proxyAuthUsers):null,w=i.proxyAuthEnabled?v():null,X.headersTimeout=i.responseHeaderTimeoutMs,X.keepAliveTimeout=i.idleTimeoutMs,T.headersTimeout=i.responseHeaderTimeoutMs,T.keepAliveTimeout=i.idleTimeoutMs,X.auditCapabilities={http1:!0,http2:i.clientAlpnProtocols.includes("h2"),proxyAuth:!0===i.proxyAuthEnabled,plainHttp:!1,publicConnectPorts:[...i.allowedConnectPorts]}}return X.on("connect",(a,b,c)=>{(async()=>{let d,e;try{d=D(a.url,443)}catch(e){let c=e.message||"Invalid CONNECT authority";M(b,"400 Bad Request",c),K(a,b,d,c,{statusCode:400});return}let f=await Q(a,b);if(f===P)return;try{await m(d.host,d.port)}catch(e){let c=e.message||"Destination is not allowed";M(b,"403 Forbidden",c),K(a,b,d,c,{authUser:f});return}if(i.clientToolFilterEnabled&&s(a.headers["user-agent"],o)){let c=`Client tool is not allowed to use this proxy (${t(a.headers["user-agent"])})`;M(b,"403 Forbidden",c),K(a,b,d,c);return}if(!E(d.host,i.allowedHosts)){if(!i.passthroughUnknown){let c="Host is not in the audit allowlist";M(b,"403 Forbidden",c),K(a,b,d,c);return}let e=!1;try{let a=await m(d.host,d.port),f=B(g.connect({host:d.host,port:d.port,lookup:a.lookup,autoSelectFamily:!0})),h=setTimeout(()=>f.destroy(Error("TCP passthrough connect timeout")),i.connectTimeoutMs);h.unref?.(),f.setNoDelay(!0),f.setKeepAlive(!0,3e4),f.setTimeout(i.idleTimeoutMs,()=>f.destroy(Error("TCP passthrough idle timeout"))),f.once("connect",()=>{clearTimeout(h),e=!0,b.write("HTTP/1.1 200 Connection Established\r\nProxy-Agent: BlueRouter-Audit\r\n\r\n"),c?.length&&f.write(c),f.pipe(b),b.pipe(f)}),f.once("error",()=>{clearTimeout(h),e?C(b):M(b,"502 Bad Gateway","TCP passthrough failed")}),b.once("error",()=>C(f)),b.once("close",()=>C(f))}catch(a){M(b,"502 Bad Gateway",a.message||"TCP passthrough failed")}return}try{if(e=j(d.host),!e?.key||!e?.cert)throw Error("Certificate provider returned no certificate")}catch(a){M(b,"500 Internal Server Error",`Cannot issue audit certificate: ${a.message}`);return}b.write("HTTP/1.1 200 Connection Established\r\nProxy-Agent: BlueRouter-Audit\r\n\r\n"),c?.length&&b.unshift(c);let k=B(new h.TLSSocket(b,{isServer:!0,key:e.key,cert:e.cert,ALPNProtocols:i.clientAlpnProtocols}));k.__auditTarget=d,k.__auditProxyUser=f,k.setNoDelay(!0),k.setKeepAlive(!0,3e4),k.setTimeout(i.idleTimeoutMs,()=>k.destroy(Error("Client TLS idle timeout")));let l=setTimeout(()=>k.destroy(Error("Client TLS handshake timeout")),i.tlsHandshakeTimeoutMs);l.unref?.();let n=!1,p=()=>{n||(n=!0,clearTimeout(l),"h2"===k.alpnProtocol?W.emit("connection",k):T.emit("connection",k))};k.once("secure",p),k.once("secureConnect",p),k.once("error",()=>{clearTimeout(l),C(k)}),k.once("close",()=>clearTimeout(l))})().catch(a=>M(b,"500 Internal Server Error",a.message||"Audit CONNECT failed"))}),X.prependListener("connection",a=>{B(a),a.setNoDelay(!0),a.setKeepAlive(!0,3e4)}),X.on("upgrade",(a,b)=>M(b,"501 Not Implemented",J)),X.on("clientError",(a,b)=>C(b)),X.headersTimeout=i.responseHeaderTimeoutMs,X.requestTimeout=0,X.keepAliveTimeout=i.idleTimeoutMs,X.forceCloseAll=()=>{for(let a of A)try{a.destroy()}catch{}for(let a of y.values())try{a.destroy()}catch{}for(let a of[...x])C(a)},X.getActiveConnectionCount=()=>x.size,X.auditConfig=i,Y(),X.applyConfig=(a={})=>{let b={};for(let[c,d]of(a.bindHost&&String(a.bindHost)!==String(i.bindHost)&&(b.bindHost=String(a.bindHost)),Number(a.port)&&Number(a.port)!==Number(i.port)&&(b.port=Number(a.port)),Object.entries(a)))"bindHost"!==c&&"port"!==c&&(["verifyUpstreamTls","allowPlainHttp","allowedConnectPorts","clientAlpnProtocols"].includes(c)||(i[c]=d));return Y(),{rebindRequired:Object.keys(b).length>0,pending:b}},X},hostMatches:E,parseAuthority:D,stripHopByHop:F,CaptureBuffer:I,detectProvider:J,extractModel:K,decodeCapturedBuffer:G}},48350:a=>{let b=new Set(["authorization","proxy-authorization","x-api-key","api-key","cookie","set-cookie","x-auth-token","x-access-token","cf-access-jwt-assertion"]),c=/(^|[_-])(access[_-]?token|refresh[_-]?token|id[_-]?token|token|api[_-]?key|apikey|password|passwd|secret|authorization|cookie)($|[_-])/i;function d(a){let c=String(a||"").toLowerCase();return b.has(c)||/token|secret|password|credential/i.test(c)}function e(a,b=new WeakSet){if(null==a||"object"!=typeof a)return a;if(b.has(a))return"[CIRCULAR]";if(b.add(a),Array.isArray(a))return a.map(a=>e(a,b));let d={};for(let[f,g]of Object.entries(a))d[f]=c.test(f)?"[REDACTED]":e(g,b);return d}function f(a){if(null==a)return a;let b=String(a);return(b=(b=b.replace(/\bBearer\s+[A-Za-z0-9._~+\/-]+=*/gi,"Bearer [REDACTED]")).replace(/\b(sk-ant-[A-Za-z0-9_-]{8,}|sk-[A-Za-z0-9_-]{8,})\b/g,"[REDACTED]")).replace(/("(?:access_token|refresh_token|id_token|api_key|apikey|password|secret|authorization)"\s*:\s*")([^"]+)(")/gi,"$1[REDACTED]$3")}a.exports={redactHeaders:function(a={}){let b={};for(let[c,e]of Object.entries(a||{}))b[c]=d(c)?"[REDACTED]":e;return b},redactObject:e,redactBodyText:function(a,b=""){let c=String(a||"");if(/application\/(?:[^;]+\+)?json/i.test(b)||/^[\s\r\n]*[\[{]/.test(c))try{let a=JSON.parse(c);return JSON.stringify(e(a))}catch{}return f(c)},scrubString:f,redactUrlPath:function(a){let b=String(a||"");try{let a=new URL(b,"https://audit.invalid");for(let b of[...a.searchParams.keys()])if(/token|secret|key|password|credential|authorization|^code$/i.test(b))a.searchParams.set(b,"[REDACTED]");else{let c=a.searchParams.get(b);c&&a.searchParams.set(b,f(c))}return`${a.pathname}${a.search}`}catch{return f(b)}},containsLikelySecret:function(a){let b="string"==typeof a?a:JSON.stringify(a);return/Bearer\s+(?!\[REDACTED\])\S+|sk-ant-[A-Za-z0-9_-]{8,}|\bsk-[A-Za-z0-9_-]{8,}/i.test(b||"")},shouldRedactHeader:d}},49083:(a,b,c)=>{let{createAuditProxy:d}=c(45372),{loadConfig:e,saveConfig:f,validateConfig:g,CONFIG_PATH:h,AUDIT_LOG_PATH:i,AUDIT_LOG_DIR:j,PROXY_AUTH_FEATURE_ENABLED:k}=c(43096),{hashProxyPassword:l,isValidUsername:m,normalizeProxyUsers:n,redactProxyAuthUsers:o,PASSWORD_MAX_BYTES:p,PASSWORD_MIN_BYTES:q}=c(7566),{normalizeAllowedClientIps:r,normalizeIp:s}=c(5565),{attachClientIpGate:t,effectiveClientIpPolicy:u,normalizeAccessGrants:v,normalizeGrantUserId:w}=c(77407),{SETTINGS_KEY:x,extractAuditPolicy:y,mergeAuditPolicy:z,policyEquals:A}=c(85463),{enqueueAuditJob:B,readRecent:C,clearAudit:D,pruneExpired:E,startAuditMaintenance:F,stopAuditMaintenance:G,flushAuditQueue:H,getAuditStoreStats:I}=c(90173),{ensureAuditRootCA:J,createAuditCertificateProvider:K,getStatusRootCaValidation:L}=c(85074),{readRootCAInfo:M}=c(8578),{runSelfTest:N}=c(85252);function O(){return globalThis.__blueRouterAuditProxyRuntime||(globalThis.__blueRouterAuditProxyRuntime={server:null,certificateProvider:null,ipPolicy:null,ipGate:null,startedAt:null,lastError:null,autostartPromise:null,lifecycle:Promise.resolve()}),globalThis.__blueRouterAuditProxyRuntime}function P(a){let b=O(),c=b.lifecycle.then(a,a);return b.lifecycle=c.catch(()=>{}),c}async function Q(a,b=1500){if(!a)return;let c=Math.max(0,Number(b)||0);await new Promise(b=>{let d=!1,e=()=>{d||(d=!0,b())};try{a.listening?a.close(e):e()}catch{e()}let f=setTimeout(()=>{try{a.forceCloseAll?.()}catch{}},c);f.unref?.();let g=setTimeout(e,c+2e3);g.unref?.()});try{a.forceCloseAll?.()}catch{}}function R(a){let b=e();return{...a,proxyAuthEnabled:!0===b.proxyAuthEnabled,proxyAuthUsers:[...b.proxyAuthUsers||[]],accessGrants:v(b.accessGrants)}}async function S(a=null){let b=O();if(b.server?.listening)return X();let c=a?f({...R(a),enabled:!1}):e();await J(),await E(),F();let g=K({maxEntries:128});g.prewarm(c.allowedHosts);let h=d(c,{certificateProvider:g,onAuditJob:B});b.ipPolicy=u(c),b.ipGate=t(h,()=>O().ipPolicy);try{let a=await new Promise((a,b)=>{let d=a=>{h.removeListener("listening",e),b(a)},e=()=>{h.removeListener("error",d),a(h.address())};h.once("error",d),h.once("listening",e),h.listen(c.port,c.bindHost)});return b.server=h,b.certificateProvider=g,b.startedAt=new Date().toISOString(),b.lastError=null,f({...c,enabled:!0}),{...await X(),address:a}}catch(a){b.lastError=a.message||String(a);try{h.forceCloseAll?.()}catch{}try{h.close()}catch{}throw g.clear?.(),a}}async function T({persist:a=!0}={}){let b=O(),c=b.server,d=e();return b.server=null,b.startedAt=null,await Q(c,d.shutdownGraceMs),b.certificateProvider?.clear?.(),b.certificateProvider=null,b.ipGate=null,await H(3e3),G(),a&&f({...d,enabled:!1}),X()}async function U(a=null){return await T({persist:!1}),a&&f({...R(a),enabled:!1}),S()}function V(a=null){return P(()=>S(a))}async function W(){let a=O();await ab();let b=e();return b.enabled?a.server?.listening?{started:!1,reason:"already-running",status:await X()}:(a.autostartPromise||(a.autostartPromise=(async()=>{try{let a=await V();return console.log(`[audit-proxy] autostarted on ${b.bindHost}:${b.port}`),{started:!0,status:a}}catch(b){return a.lastError=b?.message||String(b),console.log("[audit-proxy] autostart failed:",a.lastError),{started:!1,error:a.lastError}}finally{a.autostartPromise=null}})()),a.autostartPromise):{started:!1,reason:"disabled"}}async function X(){let a=O(),b=e(),c=u(b),d=!!a.server?.listening,f=M();try{let a=L();f={...f,validated:!0===a.exists,expiringSoon:!0===a.expiringSoon,autoRotation:!1}}catch(a){f={...f,validated:!1,autoRotation:!1,error:a.message||String(a)}}return{running:d,listening:d,startedAt:a.startedAt,lastError:a.lastError,address:d?a.server.address():null,pendingListenerRestart:d&&!function(a,b){if(!a)return!0;let c=String(b.bindHost||"").trim().toLowerCase(),d=s(a.address||""),e=s("localhost"===c?"127.0.0.1":c);return Number(a.port)===Number(b.port)&&d===e}(a.server.address(),b),activeConnections:d&&a.server.getActiveConnectionCount?.()||0,capabilities:d?a.server.auditCapabilities:{http1:!0,http2:!1,plainHttp:!1,publicConnectPorts:[443]},security:{clientIpFilterEnabled:c.enabled,clientIpFilterSource:c.source,enforcedClientIpCount:c.allowedClientIps.length,accessGrantCount:c.grants.length,clientToolFilterEnabled:!0===b.clientToolFilterEnabled,proxyAuthEnabled:!0===b.proxyAuthEnabled,proxyAuthFeatureEnabled:k,allowedClientToolCount:(b.allowedClientTools||[]).length,privateDestinationsBlocked:!0,plainHttpBlocked:!0,upstreamTlsVerified:!0},certificateCache:a.certificateProvider?.stats?.()||{entries:0},auditStore:I(),configPath:h,auditLogPath:i,auditLogDirectory:j,rootCA:f}}async function Y(a=50){let b=e(),[c,d]=await Promise.all([X(),C(a)]);return{config:Z(b),status:c,events:d}}function Z(a){return a?{...a,proxyAuthUsers:o(a.proxyAuthUsers)}:a}async function $(){return Promise.resolve().then(c.bind(c,89718))}async function _(){try{let{isClusterStandby:a}=await c.e(2763).then(c.bind(c,62763));return await a()===!0}catch{return!1}}async function aa(a){try{if(await _())return{mirrored:!1,reason:"standby"};let{getSettings:b,updateSettings:c}=await $(),d=y(a),e=await b();if(JSON.stringify(e?.[x]||null)===JSON.stringify(d))return{mirrored:!1,reason:"unchanged"};return await c({[x]:d}),{mirrored:!0}}catch(a){return console.warn("[audit-proxy] failed to mirror policy to settings:",a?.message||a),{mirrored:!1,error:a?.message||String(a)}}}async function ab({force:a=!1}={}){try{if(!a&&!await _())return{applied:!1,reason:"not-standby"};let{getSettings:b}=await $(),c=await b(),d=c?.[x];if(!d||"object"!=typeof d)return{applied:!1,reason:"no-policy"};let f=e();if(A(f,d))return{applied:!1,reason:"unchanged"};let g=z(f,d),h=await ac(g,{mirror:!1});return console.log("[audit-proxy] applied cluster policy from snapshot"),{applied:!0,restarted:!0===h.restarted,droppedConnections:h.droppedConnections||0}}catch(a){return console.warn("[audit-proxy] failed to apply cluster policy:",a?.message||a),{applied:!1,error:a?.message||String(a)}}}function ac(a,{mirror:b=!0}={}){return P(async()=>{let c=O(),d=!!c.server?.listening,e=f({...g(a),enabled:d});c.ipPolicy=u(e);let h=!1,i={},j=0;if(d){let a=c.server.applyConfig?.(e)||{};h=!0===a.rebindRequired,i=a.pending||{},j=c.ipGate?.dropRevoked()||0;try{c.certificateProvider?.prewarm?.(e.allowedHosts)}catch{}}return b&&await aa(e),{config:Z(e),status:await X(),restarted:!1,appliedInstantly:!0,rebindRequired:h,pendingListener:i,droppedConnections:j}})}a.exports={startProxy:V,ensureAuditProxyAutostart:W,stopProxy:function(a={}){return P(()=>T(a))},restartProxy:function(a=null){return P(()=>U(a))},getStatus:X,getSnapshot:Y,updateConfig:function(a){return ac(R(a))},updateClientProxyHost:function(a){return ac({...e(),clientProxyHost:String(a||"").trim()})},updateProxyAuth:async function a({enabled:b,users:c}={}){if(!0===b&&!k)throw Error("Proxy authentication is turned off in this deployment (PROXY_AUTH_FEATURE_ENABLED in audit-gateway/config.js)");let d=e(),f=new Map(n(d.proxyAuthUsers).map(a=>[a.username.toLowerCase(),a])),g=new Set,h=[];for(let a of Array.isArray(c)?c:[]){let b=String(a?.username||"").trim();if(!m(b))throw Error(`Invalid username: ${b||"(empty)"}`);let c=b.toLowerCase();if(g.has(c))throw Error(`Duplicate username: ${b}`);g.add(c);let d="string"==typeof a?.password?a.password:"";if(d){let a=Buffer.byteLength(d,"utf8");if(a<q)throw Error(`Password for ${b} must be at least ${q} characters`);if(a>p)throw Error(`Password for ${b} must be at most ${p} bytes`);h.push({username:b,passwordHash:await l(d)});continue}let e=f.get(c);if(!e)throw Error(`Account ${b} requires a password`);h.push({username:b,passwordHash:e.passwordHash})}return ac({...d,proxyAuthEnabled:!0===b,proxyAuthUsers:h})},listAccessGrants:function(){return v(e().accessGrants)},applyAuditPolicyFromSettings:ab,upsertAccessGrant:function({userId:a,ips:b,note:c}={}){let d=w(a);if(!d)throw Error("Grant requires a dashboard username or email");let f=e(),g=v(f.accessGrants).filter(a=>a.userId!==d);return g.push({userId:d,ips:r(b),note:c}),ac({...f,accessGrants:g})},deleteAccessGrant:function(a){let b=w(a);if(!b)throw Error("Grant requires a dashboard username or email");let c=e(),d=v(c.accessGrants).filter(a=>a.userId!==b);return ac({...c,accessGrants:d})},clearAudit:D,runSelfTest:N}},78864:(a,b,c)=>{let d=c(14985).promises,e=c(91645),{normalizeIp:f,clientIpMatches:g}=c(5565),h=new Map,i=Object.freeze(["0.0.0.0/8","10.0.0.0/8","100.64.0.0/10","127.0.0.0/8","169.254.0.0/16","172.16.0.0/12","192.0.0.0/24","192.0.2.0/24","192.88.99.0/24","192.168.0.0/16","198.18.0.0/15","198.51.100.0/24","203.0.113.0/24","224.0.0.0/4","240.0.0.0/4","::/96","::1/128","100::/64","2001:2::/48","2001:db8::/32","fc00::/7","fe80::/10","ff00::/8"]),j=Object.freeze([".localhost",".local",".internal",".lan",".home.arpa"]);function k(a){return String(a||"").trim().replace(/^\[|\]$/g,"").replace(/\.$/,"").toLowerCase()}function l(a){let b=k(a);return!(!(!b||"localhost"===b||j.some(a=>b.endsWith(a)))&&(e.isIP(b)||b.includes(".")))}function m(a){let b=f(a);return!!e.isIP(b)&&!g(b,i)}function n(a){let b=[...new Set((Array.isArray(a)?a:[a]).map(a=>Number(a)).filter(a=>Number.isInteger(a)&&a>=1&&a<=65535))];return b.length?b:[443]}function o(a){let b=[...a?.addresses||[]];return function(c,d,e){let f=d,g=e;"function"==typeof d&&(g=d,f={});let h="number"==typeof f?f:Number(f?.family||0);if("object"==typeof f&&f?.all===!0){let c=4===h||6===h?b.filter(a=>a.family===h):b;if(!c.length){let b=Error(`No validated public address for ${a.host}`);b.code="ENOTFOUND",g(b);return}g(null,c.map(({address:a,family:b})=>({address:a,family:b})));return}let i=function(a,b=0){let c=Number(b||0);return 4===c||6===c?a.find(a=>a.family===c)||null:a.find(a=>4===a.family)||a[0]||null}(b,h);if(!i){let b=Error(`No validated public address for ${a.host}`);b.code="ENOTFOUND",g(b);return}g(null,i.address,i.family)}}async function p(a,b,c={}){let g=k(a),i=Number(b||443),j=n(c.allowedPorts||[443]);if(!g)throw Error("Destination host is empty");if(!Number.isInteger(i)||!j.includes(i))throw Error(`CONNECT destination port ${i||"unknown"} is not allowed`);if(l(g))throw Error(`Private or local destination hostname is not allowed: ${g}`);let q=e.isIP(f(g));if(q){let a=f(g);if(!m(a))throw Error(`Private or reserved destination address is not allowed: ${a}`);let b={host:g,port:i,addresses:[{address:a,family:q}]};return{...b,lookup:o(b)}}let r=Date.now(),s=h.get(g);if(!s||s.expiresAt<=r){let a=await d.lookup(g,{all:!0,verbatim:!0}),b=[],c=new Set;for(let d of a||[]){let a=f(d.address),g=e.isIP(a);if(!g||!m(a))continue;let h=`${g}:${a}`;c.has(h)||(c.add(h),b.push({address:a,family:g}))}if(!b.length)throw Error(`Destination did not resolve to a public address: ${g}`);s={addresses:b,expiresAt:r+6e4},h.set(g,s)}let t={host:g,port:i,addresses:[...s.addresses]};return{...t,lookup:o(t)}}a.exports={BLOCKED_ADDRESS_RANGES:i,normalizeTargetHost:k,normalizeAllowedPorts:n,isBlockedHostname:l,isPublicAddress:m,createPinnedLookup:o,resolvePublicTarget:p,clearDnsPolicyCache:function(){h.clear()}}},85252:(a,b,c)=>{let d=c(81630),e=c(73496),f=c(91645),g=c(34631),h=c(74075),i=c(55511),j=c(15296),{createAuditProxy:k,CaptureBuffer:l}=c(45372),{containsLikelySecret:m}=c(48350),{clientIpMatches:n,normalizeAllowedClientIps:o}=c(5565),{normalizeAllowedTools:p,clientToolMatches:q,shouldRefuseClientTool:r}=c(98586),{createProxyAuthenticator:s,createProxyAuthLimiter:t,hashProxyPassword:u,parseBasicProxyAuthorization:v}=c(7566),{isPublicAddress:w}=c(78864),{validateConfig:x,PROXY_AUTH_FEATURE_ENABLED:y}=c(43096),{normalizeAccessGrants:z,effectiveClientIpPolicy:A,attachClientIpGate:B,findAccessGrant:C}=c(77407),{promptLogMirrorDecision:D}=c(90173);function E(a){return i.createHash("sha256").update(a).digest("hex")}function F(a){let b=j.pki.rsa.generateKeyPair(2048),c=j.pki.createCertificate();c.publicKey=b.publicKey,c.serialNumber=String(Date.now()),c.validity.notBefore=new Date(Date.now()-6e4),c.validity.notAfter=new Date(Date.now()+864e5);let d=[{name:"commonName",value:a}];return c.setSubject(d),c.setIssuer(d),c.setExtensions([{name:"basicConstraints",cA:!0,critical:!0},{name:"keyUsage",keyCertSign:!0,cRLSign:!0,critical:!0}]),c.sign(b.privateKey,j.md.sha256.create()),{cert:c,keys:b,certPem:j.pki.certificateToPem(c)}}function G(a,b){let c=j.pki.rsa.generateKeyPair(2048),d=j.pki.createCertificate();return d.publicKey=c.publicKey,d.serialNumber=`${Date.now()}${Math.floor(1e3*Math.random())}`,d.validity.notBefore=new Date(Date.now()-6e4),d.validity.notAfter=new Date(Date.now()+864e5),d.setSubject([{name:"commonName",value:b}]),d.setIssuer(a.cert.subject.attributes),d.setExtensions([{name:"basicConstraints",cA:!1},{name:"keyUsage",digitalSignature:!0,keyEncipherment:!0},{name:"extKeyUsage",serverAuth:!0},{name:"subjectAltName",altNames:[{type:2,value:b}]}]),d.sign(a.keys.privateKey,j.md.sha256.create()),{cert:j.pki.certificateToPem(d),key:j.pki.privateKeyToPem(c.privateKey)}}function H(a,b="127.0.0.1"){return new Promise((c,d)=>{a.once("error",d),a.listen(0,b,()=>{a.removeListener("error",d),c(a.address())})})}function I(a){return new Promise(b=>{if(!a)return b();try{a.forceCloseAll?.()}catch{}if(!a.listening)return b();a.close(()=>b()),setTimeout(b,1e3).unref?.()})}function J(a,b){let c="127.0.0.1";return Promise.resolve({host:a,port:b,addresses:[{address:c,family:4}],lookup:(a,b,d)=>{let e=b,f=d;"function"==typeof b&&(f=b,e={}),e?.all?f(null,[{address:c,family:4}]):f(null,c,4)}})}function K(a,b,c="",d=""){return new Promise((e,g)=>{let h=f.connect(a,"127.0.0.1"),i=Buffer.alloc(0),j=setTimeout(()=>g(Error("CONNECT timeout")),7e3);h.once("error",g),h.once("connect",()=>{let a=c?`User-Agent: ${c}\r
+${e}`)}catch{try{a.destroy()}catch{}}}function N(a={}){let b={};for(let[c,d]of Object.entries(a||{}))b[c]=d;return b}async function O(a){let b=await a.requestCapture.finish(String(a.requestHeaders["content-type"]||""),String(a.requestHeaders["content-encoding"]||"")),c=String(a.responseHeaders?.["content-type"]||""),d=await a.responseCapture.finish(c,String(a.responseHeaders?.["content-encoding"]||"")),e=J(a.target.host),f=n(a.path),g=p({provider:e,body:d.body,contentType:c,path:f}),h=K(b.body)||g?.model||null;return{id:i.randomUUID(),timestamp:new Date().toISOString(),protocol:a.protocol||"http/1.1",client:{ip:a.clientIp||"",port:a.clientPort||null,userAgent:String(a.requestHeaders["user-agent"]||""),proxyUser:a.authUser||null},provider:e,host:C(a.target.host),port:a.target.port,method:a.method,path:f,model:h,usage:g,status:a.statusCode||null,durationMs:Date.now()-a.startedAt,error:a.error?o(a.error.message||a.error):null,denied:!0===a.denied,request:{headers:l(a.requestHeaders),...b},response:{headers:l(a.responseHeaders||{}),...d}}}a.exports={createAuditProxy:function(a={},b={}){let i={allowedHosts:[],passthroughUnknown:!0,captureBodies:!0,captureLimitBytes:2097152,verifyUpstreamTls:!0,allowedConnectPorts:[443],connectTimeoutMs:1e4,tlsHandshakeTimeoutMs:1e4,responseHeaderTimeoutMs:3e4,idleTimeoutMs:9e5,allowPlainHttp:!1,clientToolFilterEnabled:!1,allowedClientTools:[],proxyAuthEnabled:!1,proxyAuthUsers:[],clientAlpnProtocols:["http/1.1"],...a};if(!0!==i.verifyUpstreamTls)throw Error("Upstream TLS verification is mandatory in Audit Proxy mode");let j=b.certificateProvider;if("function"!=typeof j)throw Error("certificateProvider is required");let k="function"==typeof b.onAudit?b.onAudit:()=>{},l="function"==typeof b.onAuditJob?b.onAuditJob:null,m="function"==typeof b.resolveTarget?b.resolveTarget:(a,b)=>q(a,b,{allowedPorts:i.allowedConnectPorts}),n=b.upstreamCa,o=r(i.allowedClientTools),p=i.proxyAuthEnabled?u(i.proxyAuthUsers):null,w=i.proxyAuthEnabled?v():null,x=new Set,y=new Map,z=new WeakMap,A=new Set;function B(a){return!a||x.has(a)||(x.add(a),a.once?.("close",()=>x.delete(a))),a}function C(a,b){try{"function"==typeof a.destroy?a.destroy(b):"function"==typeof a.close&&a.close()}catch{}}function G(a){let b=()=>O(a);if(l){try{l(b)}catch(a){console.warn("[audit-proxy] audit enqueue failed:",a?.message||a)}return}setImmediate(()=>{Promise.resolve().then(b).then(k).catch(a=>console.warn("[audit-proxy] audit callback failed:",a?.message||a))})}function H({requestHeaders:a,method:b,path:c,target:d,requestCapture:e,responseCapture:f,responseHeaders:g,statusCode:h,startedAt:i,error:j,socket:k,protocol:l,authUser:m=null,denied:n=!1}){return{requestHeaders:N(a),method:b,path:c,target:d,requestCapture:e,responseCapture:f,responseHeaders:N(g),statusCode:h,startedAt:i,error:j,clientIp:L(k),clientPort:k?.remotePort||null,authUser:m,protocol:l,denied:n}}let J="This proxy does not support WebSocket connections. Use the HTTP streaming transport instead - most clients fall back to it automatically.";function K(a,b,c,d,{statusCode:e=403,authUser:f=null}={}){let g=String(a.url||""),h=c||{host:g.includes(":")?g.slice(0,g.lastIndexOf(":")):g||"unknown",port:443},j=new I(i.captureBodies?i.captureLimitBytes:0);j.add(Buffer.from(d)),G(H({requestHeaders:a.headers,method:"CONNECT",path:"",target:h,requestCapture:new I(0),responseCapture:j,responseHeaders:{"content-type":"text/plain; charset=utf-8",connection:"close"},statusCode:e,startedAt:Date.now(),error:d,socket:b,protocol:"http/1.1",authUser:f,denied:!0}))}let P=Symbol("refused");async function Q(a,b){if(!p)return null;let d=L(b),e=(c,d=null)=>(M(b,"407 Proxy Authentication Required",c,['Proxy-Authenticate: Basic realm="BlueRouter Audit Proxy", charset="UTF-8"']),K(a,b,void 0,c,{statusCode:407,authUser:d}),P);if(w.isLocked(d))return e("Too many failed proxy authentication attempts");let f=a.headers["proxy-authorization"],g=await p.authenticate(f);if(g.ok)return w.recordSuccess(d),g.username;let h=null;if(f){let{lockedNow:a}=w.recordFailure(d);a&&console.log(`[audit-proxy] proxy auth lockout for ${d||"unknown"}`);try{h=c(7566).parseBasicProxyAuthorization(f)?.username||null}catch{h=null}}return e(g.reason||"Proxy authentication required",h)}function R(a,b,c){if(!c)return;let d=new I(i.captureBodies?i.captureLimitBytes:0);d.add(Buffer.from(J)),G(H({requestHeaders:a.headers,method:a.method,path:a.url,target:c,requestCapture:new I(0),responseCapture:d,responseHeaders:{"content-type":"text/plain; charset=utf-8",connection:"close"},statusCode:501,startedAt:Date.now(),error:null,socket:b,protocol:"http/1.1",authUser:b?.__auditProxyUser||null,denied:!0}))}async function S(a,b,{expectContinue:c=!1}={}){let d=a.socket.__auditTarget,e=a.socket.__auditProxyUser||null;if(!d){b.writeHead(502,{"content-type":"text/plain"}),b.end("Audit target is missing");return}if(function(a={}){return"string"==typeof a.upgrade&&""!==a.upgrade.trim()}(a.headers)){b.writeHead(501,{"content-type":"text/plain; charset=utf-8",connection:"close"}),b.end(J),R(a,a.socket,d);return}let h=Date.now(),j=new I(i.captureBodies?i.captureLimitBytes:0),k=new I(i.captureBodies?i.captureLimitBytes:0),l=F(a.headers,{stripInternal:!0});l.host=443===d.port?d.host:`${d.host}:${d.port}`;let o=null,p=null,q={},r=null,s=!1,t=!1,u=null,v=(b=null)=>{s||(s=!0,u&&clearTimeout(u),G(H({requestHeaders:a.headers,method:a.method,path:a.url,target:d,requestCapture:j,responseCapture:k,responseHeaders:q,statusCode:r,startedAt:h,error:b,socket:a.socket,protocol:"http/1.1",authUser:e})))};try{let e,h,s=await m(d.host,d.port);(o=f.request({hostname:d.host,port:d.port,method:a.method,path:a.url,headers:l,rejectUnauthorized:!0,servername:g.isIP(d.host)?void 0:d.host,ca:n,ALPNProtocols:["http/1.1"],lookup:s.lookup,autoSelectFamily:!0,agent:(e=`${d.host}:${d.port}`,(h=y.get(e))||(h=new f.Agent({keepAlive:!0,maxSockets:32,maxFreeSockets:8,timeout:i.idleTimeoutMs}),y.set(e,h)),h)})).on("socket",a=>{if(B(a),a.setNoDelay(!0),a.setKeepAlive(!0,3e4),a.setTimeout(i.idleTimeoutMs,()=>a.destroy(Error("Upstream idle timeout"))),a.connecting){let b=setTimeout(()=>a.destroy(Error("Upstream TLS connect timeout")),i.connectTimeoutMs+i.tlsHandshakeTimeoutMs);b.unref?.();let c=()=>clearTimeout(b);a.once("secureConnect",c),a.once("error",c),a.once("close",c)}}),o.on("continue",()=>{c&&!b.headersSent&&b.writeContinue()}),o.on("information",a=>{102===a.statusCode&&"function"==typeof b.writeProcessing&&b.writeProcessing(),103===a.statusCode&&"function"==typeof b.writeEarlyHints&&b.writeEarlyHints(a.headers||{})}),o.on("response",a=>{p=a,u&&clearTimeout(u),r=a.statusCode||502,q=N(a.headers||{});let c=F(a.headers,{stripInternal:!1});b.writeHead(r,c),b.flushHeaders?.(),a.on("data",c=>{k.add(c),b.write(c)||a.pause()}),b.on("drain",()=>a.resume()),a.on("aborted",()=>{let a=Error("Upstream response aborted");b.destroyed||b.destroy(a),v(a)}),a.on("error",a=>{b.destroyed||b.destroy(a),v(a)}),a.on("end",()=>{if(a.trailers&&Object.keys(a.trailers).length)try{b.addTrailers(F(a.trailers,{stripInternal:!1}))}catch{}t=!0,b.end(),v(null)})}),o.on("error",a=>{b.headersSent?b.destroyed||b.destroy(a):(b.writeHead(502,{"content-type":"application/json"}),b.end(JSON.stringify({error:"Verified upstream TLS request failed"})),t=!0),v(a)}),a.on("data",b=>{j.add(b),o.write(b)||a.pause()}),o.on("drain",()=>a.resume()),a.on("end",()=>{if(a.trailers&&Object.keys(a.trailers).length)try{o.addTrailers(F(a.trailers,{stripInternal:!0}))}catch{}o.end(),u=setTimeout(()=>o.destroy(Error("Upstream response header timeout")),i.responseHeaderTimeoutMs),u.unref?.()}),a.on("aborted",()=>o.destroy(Error("Client request aborted"))),a.on("error",a=>o.destroy(a)),b.on("close",()=>{t||(p?.destroy(Error("Client response closed")),o?.destroy(Error("Client response closed")),v(Error("Client response closed")))})}catch(a){b.headersSent||(b.writeHead(502,{"content-type":"application/json"}),b.end(JSON.stringify({error:"Destination validation or connection failed"})),t=!0),v(a)}}let T=d.createServer((a,b)=>{S(a,b)});async function U(a){return a.upstreamPromise||(a.upstreamPromise=(async()=>{let b=a.target,c=await m(b.host,b.port),d=B(h.connect({host:b.host,port:b.port,servername:g.isIP(b.host)?void 0:b.host,rejectUnauthorized:!0,ca:n,ALPNProtocols:["h2"],lookup:c.lookup,autoSelectFamily:!0}));d.setNoDelay(!0),d.setKeepAlive(!0,3e4);let f=setTimeout(()=>d.destroy(Error("Upstream HTTP/2 TLS connect timeout")),i.connectTimeoutMs+i.tlsHandshakeTimeoutMs);f.unref?.(),d.once("secureConnect",()=>{clearTimeout(f),"h2"!==d.alpnProtocol&&d.destroy(Error("Upstream did not negotiate HTTP/2"))}),d.once("error",()=>clearTimeout(f)),d.once("close",()=>clearTimeout(f));let j=`https://${b.host}${443===b.port?"":`:${b.port}`}`,k=e.connect(j,{createConnection:()=>d,settings:{enablePush:!1}});return A.add(k),k.setTimeout(i.idleTimeoutMs,()=>k.destroy(Error("Upstream HTTP/2 idle timeout"))),k.once("close",()=>A.delete(k)),await new Promise((a,b)=>{let c=setTimeout(()=>b(Error("Upstream HTTP/2 session timeout")),i.connectTimeoutMs+i.tlsHandshakeTimeoutMs);c.unref?.();let d=(a,b)=>{clearTimeout(c),k.removeListener("connect",e),k.removeListener("error",f),a(b)},e=()=>d(a,k),f=a=>d(b,a);k.once("connect",e),k.once("error",f)}),k})().catch(b=>{throw a.upstreamPromise=null,b})),a.upstreamPromise}async function V(a,b){let c=z.get(a.session),d=c?.target;if(!c||!d){a.respond({":status":502,"content-type":"text/plain"}),a.end("Audit target is missing");return}a.pause();let f=Date.now(),g=new I(i.captureBodies?i.captureLimitBytes:0),h=new I(i.captureBodies?i.captureLimitBytes:0),j={},k=null,l=!1,m=!1,n=null,o=null,p=null,q=(e=null)=>{l||(l=!0,G(H({requestHeaders:b,method:b[":method"]||"GET",path:b[":path"]||"/",target:d,requestCapture:g,responseCapture:h,responseHeaders:j,statusCode:k,startedAt:f,error:e,socket:a.session.socket,protocol:"h2",authUser:c.authUser||null})))};try{(n=(await U(c)).request(function(a,b){let c=F(a,{stripInternal:!0}),d={":method":a[":method"]||"GET",":path":a[":path"]||"/",":scheme":"https",":authority":443===b.port?b.host:`${b.host}:${b.port}`};for(let[a,b]of Object.entries(c))a.startsWith(":")||(d[a.toLowerCase()]=b);return d}(b,d),{endStream:!1,waitForTrailers:!0})).setTimeout(i.idleTimeoutMs,()=>n.close(e.constants.NGHTTP2_CANCEL)),a.setTimeout(i.idleTimeoutMs,()=>a.close(e.constants.NGHTTP2_CANCEL)),n.on("response",b=>{j=N(b),k=Number(b[":status"]||502),a.respond(function(a){let b=F(a,{stripInternal:!1}),c={":status":Number(a[":status"]||502)};for(let[a,d]of Object.entries(b))a.startsWith(":")||(c[a.toLowerCase()]=d);return c}(b),{waitForTrailers:!0})}),n.on("trailers",a=>{p=F(a,{stripInternal:!1})}),a.on("wantTrailers",()=>{try{a.sendTrailers(p||{})}catch{}}),a.on("trailers",a=>{o=F(a,{stripInternal:!0})}),n.on("wantTrailers",()=>{try{n.sendTrailers(o||{})}catch{}}),a.on("data",b=>{g.add(b),n.write(b)||a.pause()}),n.on("drain",()=>a.resume()),a.on("end",()=>n.end()),n.on("data",b=>{h.add(b),a.write(b)||n.pause()}),a.on("drain",()=>n.resume()),n.on("end",()=>{m=!0,a.end(),q(null)}),n.on("aborted",()=>{let b=Error("Upstream HTTP/2 stream aborted");a.close(e.constants.NGHTTP2_INTERNAL_ERROR),q(b)}),n.on("error",b=>{a.closed||a.close(e.constants.NGHTTP2_INTERNAL_ERROR),q(b)}),a.on("aborted",()=>{n.close(e.constants.NGHTTP2_CANCEL),q(Error("Client HTTP/2 stream aborted"))}),a.on("error",a=>{n.close(e.constants.NGHTTP2_CANCEL),q(a)}),a.on("close",()=>{m||!n||n.closed||(n.close(e.constants.NGHTTP2_CANCEL),q(Error("Client HTTP/2 stream closed")))}),a.resume()}catch(b){a.headersSent||a.closed||a.respond({":status":502,"content-type":"application/json"}),a.closed||a.end(JSON.stringify({error:"Verified upstream HTTP/2 request failed"})),q(b)}}T.on("checkContinue",(a,b)=>{S(a,b,{expectContinue:!0})}),T.on("upgrade",(a,b)=>{M(b,"501 Not Implemented",J),R(a,b,b.__auditTarget)}),T.on("clientError",(a,b)=>C(b)),T.headersTimeout=i.responseHeaderTimeoutMs,T.requestTimeout=0,T.keepAliveTimeout=i.idleTimeoutMs;let W=e.createServer({settings:{enablePush:!1}});W.on("session",a=>{let b={target:a.socket.__auditTarget,authUser:a.socket.__auditProxyUser||null,upstreamPromise:null};z.set(a,b),a.setTimeout(i.idleTimeoutMs,()=>a.destroy(Error("Client HTTP/2 idle timeout"))),a.once("close",()=>{Promise.resolve(b.upstreamPromise).then(a=>a?.close()).catch(()=>{})})}),W.on("stream",(a,b)=>{V(a,b)}),W.on("sessionError",a=>{console.warn("[audit-proxy] HTTP/2 client session error:",a?.message||a)});let X=d.createServer((a,b)=>{b.writeHead(403,{"content-type":"text/plain; charset=utf-8",connection:"close"}),b.end("Audit Proxy accepts HTTPS CONNECT traffic only")});function Y(){o=r(i.allowedClientTools),p=i.proxyAuthEnabled?u(i.proxyAuthUsers):null,w=i.proxyAuthEnabled?v():null,X.headersTimeout=i.responseHeaderTimeoutMs,X.keepAliveTimeout=i.idleTimeoutMs,T.headersTimeout=i.responseHeaderTimeoutMs,T.keepAliveTimeout=i.idleTimeoutMs,X.auditCapabilities={http1:!0,http2:i.clientAlpnProtocols.includes("h2"),proxyAuth:!0===i.proxyAuthEnabled,plainHttp:!1,publicConnectPorts:[...i.allowedConnectPorts]}}return X.on("connect",(a,b,c)=>{(async()=>{let d,e;try{d=D(a.url,443)}catch(e){let c=e.message||"Invalid CONNECT authority";M(b,"400 Bad Request",c),K(a,b,d,c,{statusCode:400});return}let f=await Q(a,b);if(f===P)return;try{await m(d.host,d.port)}catch(e){let c=e.message||"Destination is not allowed";M(b,"403 Forbidden",c),K(a,b,d,c,{authUser:f});return}if(i.clientToolFilterEnabled&&s(a.headers["user-agent"],o)){let c=`Client tool is not allowed to use this proxy (${t(a.headers["user-agent"])})`;M(b,"403 Forbidden",c),K(a,b,d,c);return}if(!E(d.host,i.allowedHosts)){if(!i.passthroughUnknown){let c="Host is not in the audit allowlist";M(b,"403 Forbidden",c),K(a,b,d,c);return}let e=!1;try{let a=await m(d.host,d.port),f=B(g.connect({host:d.host,port:d.port,lookup:a.lookup,autoSelectFamily:!0})),h=setTimeout(()=>f.destroy(Error("TCP passthrough connect timeout")),i.connectTimeoutMs);h.unref?.(),f.setNoDelay(!0),f.setKeepAlive(!0,3e4),f.setTimeout(i.idleTimeoutMs,()=>f.destroy(Error("TCP passthrough idle timeout"))),f.once("connect",()=>{clearTimeout(h),e=!0,b.write("HTTP/1.1 200 Connection Established\r\nProxy-Agent: BlueRouter-Audit\r\n\r\n"),c?.length&&f.write(c),f.pipe(b),b.pipe(f)}),f.once("error",()=>{clearTimeout(h),e?C(b):M(b,"502 Bad Gateway","TCP passthrough failed")}),b.once("error",()=>C(f)),b.once("close",()=>C(f))}catch(a){M(b,"502 Bad Gateway",a.message||"TCP passthrough failed")}return}try{if(e=j(d.host),!e?.key||!e?.cert)throw Error("Certificate provider returned no certificate")}catch(a){M(b,"500 Internal Server Error",`Cannot issue audit certificate: ${a.message}`);return}b.write("HTTP/1.1 200 Connection Established\r\nProxy-Agent: BlueRouter-Audit\r\n\r\n"),c?.length&&b.unshift(c);let k=B(new h.TLSSocket(b,{isServer:!0,key:e.key,cert:e.cert,ALPNProtocols:i.clientAlpnProtocols}));k.__auditTarget=d,k.__auditProxyUser=f,k.setNoDelay(!0),k.setKeepAlive(!0,3e4),k.setTimeout(i.idleTimeoutMs,()=>k.destroy(Error("Client TLS idle timeout")));let l=setTimeout(()=>k.destroy(Error("Client TLS handshake timeout")),i.tlsHandshakeTimeoutMs);l.unref?.();let n=!1,p=()=>{n||(n=!0,clearTimeout(l),"h2"===k.alpnProtocol?W.emit("connection",k):T.emit("connection",k))};k.once("secure",p),k.once("secureConnect",p),k.once("error",()=>{clearTimeout(l),C(k)}),k.once("close",()=>clearTimeout(l))})().catch(a=>M(b,"500 Internal Server Error",a.message||"Audit CONNECT failed"))}),X.prependListener("connection",a=>{B(a),a.setNoDelay(!0),a.setKeepAlive(!0,3e4)}),X.on("upgrade",(a,b)=>M(b,"501 Not Implemented",J)),X.on("clientError",(a,b)=>C(b)),X.headersTimeout=i.responseHeaderTimeoutMs,X.requestTimeout=0,X.keepAliveTimeout=i.idleTimeoutMs,X.forceCloseAll=()=>{for(let a of A)try{a.destroy()}catch{}for(let a of y.values())try{a.destroy()}catch{}for(let a of[...x])C(a)},X.getActiveConnectionCount=()=>x.size,X.auditConfig=i,Y(),X.applyConfig=(a={})=>{let b={};for(let[c,d]of(a.bindHost&&String(a.bindHost)!==String(i.bindHost)&&(b.bindHost=String(a.bindHost)),Number(a.port)&&Number(a.port)!==Number(i.port)&&(b.port=Number(a.port)),Object.entries(a)))"bindHost"!==c&&"port"!==c&&(["verifyUpstreamTls","allowPlainHttp","allowedConnectPorts","clientAlpnProtocols"].includes(c)||(i[c]=d));return Y(),{rebindRequired:Object.keys(b).length>0,pending:b}},X},hostMatches:E,parseAuthority:D,stripHopByHop:F,CaptureBuffer:I,detectProvider:J,extractModel:K,decodeCapturedBuffer:G}},48350:a=>{let b=new Set(["authorization","proxy-authorization","x-api-key","api-key","cookie","set-cookie","x-auth-token","x-access-token","cf-access-jwt-assertion"]),c=/(^|[_-])(access[_-]?token|refresh[_-]?token|id[_-]?token|token|api[_-]?key|apikey|password|passwd|secret|authorization|cookie)($|[_-])/i;function d(a){let c=String(a||"").toLowerCase();return b.has(c)||/token|secret|password|credential/i.test(c)}function e(a,b=new WeakSet){if(null==a||"object"!=typeof a)return a;if(b.has(a))return"[CIRCULAR]";if(b.add(a),Array.isArray(a))return a.map(a=>e(a,b));let d={};for(let[f,g]of Object.entries(a))d[f]=c.test(f)?"[REDACTED]":e(g,b);return d}function f(a){if(null==a)return a;let b=String(a);return(b=(b=b.replace(/\bBearer\s+[A-Za-z0-9._~+\/-]+=*/gi,"Bearer [REDACTED]")).replace(/\b(sk-ant-[A-Za-z0-9_-]{8,}|sk-[A-Za-z0-9_-]{8,})\b/g,"[REDACTED]")).replace(/("(?:access_token|refresh_token|id_token|api_key|apikey|password|secret|authorization)"\s*:\s*")([^"]+)(")/gi,"$1[REDACTED]$3")}a.exports={redactHeaders:function(a={}){let b={};for(let[c,e]of Object.entries(a||{}))b[c]=d(c)?"[REDACTED]":e;return b},redactObject:e,redactBodyText:function(a,b=""){let c=String(a||"");if(/application\/(?:[^;]+\+)?json/i.test(b)||/^[\s\r\n]*[\[{]/.test(c))try{let a=JSON.parse(c);return JSON.stringify(e(a))}catch{}return f(c)},scrubString:f,redactUrlPath:function(a){let b=String(a||"");try{let a=new URL(b,"https://audit.invalid");for(let b of[...a.searchParams.keys()])if(/token|secret|key|password|credential|authorization|^code$/i.test(b))a.searchParams.set(b,"[REDACTED]");else{let c=a.searchParams.get(b);c&&a.searchParams.set(b,f(c))}return`${a.pathname}${a.search}`}catch{return f(b)}},containsLikelySecret:function(a){let b="string"==typeof a?a:JSON.stringify(a);return/Bearer\s+(?!\[REDACTED\])\S+|sk-ant-[A-Za-z0-9_-]{8,}|\bsk-[A-Za-z0-9_-]{8,}/i.test(b||"")},shouldRedactHeader:d}},49083:(a,b,c)=>{let{createAuditProxy:d}=c(45372),{loadConfig:e,saveConfig:f,validateConfig:g,CONFIG_PATH:h,AUDIT_LOG_PATH:i,AUDIT_LOG_DIR:j,PROXY_AUTH_FEATURE_ENABLED:k}=c(43096),{hashProxyPassword:l,isValidUsername:m,normalizeProxyUsers:n,redactProxyAuthUsers:o,PASSWORD_MAX_BYTES:p,PASSWORD_MIN_BYTES:q}=c(7566),{normalizeIp:r}=c(5565),{attachClientIpGate:s,effectiveClientIpPolicy:t,normalizeAccessGrants:u,normalizeGrantUserId:v}=c(77407),{getProxySession:w,pruneExpiredProxySessions:x,revokeProxySession:y,revokeProxySessionsForUser:z}=c(68257),{SETTINGS_KEY:A,extractAuditPolicy:B,mergeAuditPolicy:C,policyEquals:D}=c(85463),{enqueueAuditJob:E,readRecent:F,clearAudit:G,pruneExpired:H,startAuditMaintenance:I,stopAuditMaintenance:J,flushAuditQueue:K,getAuditStoreStats:L}=c(90173),{ensureAuditRootCA:M,createAuditCertificateProvider:N,getStatusRootCaValidation:O}=c(85074),{readRootCAInfo:P}=c(8578),{runSelfTest:Q}=c(85252);function R(){return globalThis.__blueRouterAuditProxyRuntime||(globalThis.__blueRouterAuditProxyRuntime={server:null,certificateProvider:null,ipPolicy:null,ipGate:null,startedAt:null,lastError:null,autostartPromise:null,lifecycle:Promise.resolve()}),globalThis.__blueRouterAuditProxyRuntime}function S(a){let b=R(),c=b.lifecycle.then(a,a);return b.lifecycle=c.catch(()=>{}),c}async function T(a,b=1500){if(!a)return;let c=Math.max(0,Number(b)||0);await new Promise(b=>{let d=!1,e=()=>{d||(d=!0,b())};try{a.listening?a.close(e):e()}catch{e()}let f=setTimeout(()=>{try{a.forceCloseAll?.()}catch{}},c);f.unref?.();let g=setTimeout(e,c+2e3);g.unref?.()});try{a.forceCloseAll?.()}catch{}}function U(a){let b=e();return{...a,proxyAuthEnabled:!0===b.proxyAuthEnabled,proxyAuthUsers:[...b.proxyAuthUsers||[]],accessGrants:u(b.accessGrants)}}let V=null;function W(){let a=x();if(0===a)return;let b=R();if(!b.server?.listening)return;let c=b.ipGate?.dropRevoked()||0;console.log(`[audit-proxy] session sweep: ${a} session(s) expired, ${c} connection(s) closed`)}async function X(a=null){let b=R();if(b.server?.listening)return aa();let c=a?f({...U(a),enabled:!1}):e();await M(),await H(),I(),V||(V=setInterval(W,3e4),V.unref?.());let g=N({maxEntries:128});g.prewarm(c.allowedHosts);let h=d(c,{certificateProvider:g,onAuditJob:E});b.ipPolicy=t(c),b.ipGate=s(h,()=>R().ipPolicy);try{let a=await new Promise((a,b)=>{let d=a=>{h.removeListener("listening",e),b(a)},e=()=>{h.removeListener("error",d),a(h.address())};h.once("error",d),h.once("listening",e),h.listen(c.port,c.bindHost)});return b.server=h,b.certificateProvider=g,b.startedAt=new Date().toISOString(),b.lastError=null,f({...c,enabled:!0}),{...await aa(),address:a}}catch(a){b.lastError=a.message||String(a);try{h.forceCloseAll?.()}catch{}try{h.close()}catch{}throw g.clear?.(),a}}async function Y({persist:a=!0}={}){let b=R(),c=b.server,d=e();return b.server=null,b.startedAt=null,await T(c,d.shutdownGraceMs),b.certificateProvider?.clear?.(),b.certificateProvider=null,b.ipGate=null,await K(3e3),J(),V&&clearInterval(V),V=null,a&&f({...d,enabled:!1}),aa()}async function Z(a=null){return await Y({persist:!1}),a&&f({...U(a),enabled:!1}),X()}function $(a=null){return S(()=>X(a))}async function _(){let a=R();await ag();let b=e();return b.enabled?a.server?.listening?{started:!1,reason:"already-running",status:await aa()}:(a.autostartPromise||(a.autostartPromise=(async()=>{try{let a=await $();return console.log(`[audit-proxy] autostarted on ${b.bindHost}:${b.port}`),{started:!0,status:a}}catch(b){return a.lastError=b?.message||String(b),console.log("[audit-proxy] autostart failed:",a.lastError),{started:!1,error:a.lastError}}finally{a.autostartPromise=null}})()),a.autostartPromise):{started:!1,reason:"disabled"}}async function aa(){let a=R(),b=e(),c=t(b),d=!!a.server?.listening,f=P();try{let a=O();f={...f,validated:!0===a.exists,expiringSoon:!0===a.expiringSoon,autoRotation:!1}}catch(a){f={...f,validated:!1,autoRotation:!1,error:a.message||String(a)}}return{running:d,listening:d,startedAt:a.startedAt,lastError:a.lastError,address:d?a.server.address():null,pendingListenerRestart:d&&!function(a,b){if(!a)return!0;let c=String(b.bindHost||"").trim().toLowerCase(),d=r(a.address||""),e=r("localhost"===c?"127.0.0.1":c);return Number(a.port)===Number(b.port)&&d===e}(a.server.address(),b),activeConnections:d&&a.server.getActiveConnectionCount?.()||0,capabilities:d?a.server.auditCapabilities:{http1:!0,http2:!1,plainHttp:!1,publicConnectPorts:[443]},security:{clientIpFilterEnabled:c.enabled,clientIpFilterSource:c.source,enforcedClientIpCount:c.allowedClientIps.length,accessGrantCount:c.grants.length,sessionIdleTimeoutMs:b.sessionIdleTimeoutMs,activeSessionCount:c.sessions.length,clientToolFilterEnabled:!0===b.clientToolFilterEnabled,proxyAuthEnabled:!0===b.proxyAuthEnabled,proxyAuthFeatureEnabled:k,allowedClientToolCount:(b.allowedClientTools||[]).length,privateDestinationsBlocked:!0,plainHttpBlocked:!0,upstreamTlsVerified:!0},activeSessions:c.sessions.map(a=>({ip:a.ip,userId:a.userId,displayName:a.displayName,activatedAt:new Date(a.activatedAt).toISOString(),expiresAt:new Date(a.expiresAt).toISOString()})),certificateCache:a.certificateProvider?.stats?.()||{entries:0},auditStore:L(),configPath:h,auditLogPath:i,auditLogDirectory:j,rootCA:f}}async function ab(a=50){let b=e(),[c,d]=await Promise.all([aa(),F(a)]);return{config:ac(b),status:c,events:d}}function ac(a){return a?{...a,proxyAuthUsers:o(a.proxyAuthUsers)}:a}async function ad(){return Promise.resolve().then(c.bind(c,89718))}async function ae(){try{let{isClusterStandby:a}=await c.e(2763).then(c.bind(c,62763));return await a()===!0}catch{return!1}}async function af(a){try{if(await ae())return{mirrored:!1,reason:"standby"};let{getSettings:b,updateSettings:c}=await ad(),d=B(a),e=await b();if(JSON.stringify(e?.[A]||null)===JSON.stringify(d))return{mirrored:!1,reason:"unchanged"};return await c({[A]:d}),{mirrored:!0}}catch(a){return console.warn("[audit-proxy] failed to mirror policy to settings:",a?.message||a),{mirrored:!1,error:a?.message||String(a)}}}async function ag({force:a=!1}={}){try{if(!a&&!await ae())return{applied:!1,reason:"not-standby"};let{getSettings:b}=await ad(),c=await b(),d=c?.[A];if(!d||"object"!=typeof d)return{applied:!1,reason:"no-policy"};let f=e();if(D(f,d))return{applied:!1,reason:"unchanged"};let g=C(f,d),h=await ah(g,{mirror:!1});return console.log("[audit-proxy] applied cluster policy from snapshot"),{applied:!0,restarted:!0===h.restarted,droppedConnections:h.droppedConnections||0}}catch(a){return console.warn("[audit-proxy] failed to apply cluster policy:",a?.message||a),{applied:!1,error:a?.message||String(a)}}}function ah(a,{mirror:b=!0}={}){return S(async()=>{let c=R(),d=!!c.server?.listening,e=f({...g(a),enabled:d});c.ipPolicy=t(e);let h=!1,i={},j=0;if(d){let a=c.server.applyConfig?.(e)||{};h=!0===a.rebindRequired,i=a.pending||{},j=c.ipGate?.dropRevoked()||0;try{c.certificateProvider?.prewarm?.(e.allowedHosts)}catch{}}return b&&await af(e),{config:ac(e),status:await aa(),restarted:!1,appliedInstantly:!0,rebindRequired:h,pendingListener:i,droppedConnections:j}})}a.exports={startProxy:$,ensureAuditProxyAutostart:_,stopProxy:function(a={}){return S(()=>Y(a))},restartProxy:function(a=null){return S(()=>Z(a))},getStatus:aa,getSnapshot:ab,updateConfig:function(a){return ah(U(a))},updateClientProxyHost:function(a){return ah({...e(),clientProxyHost:String(a||"").trim()})},updateProxyAuth:async function a({enabled:b,users:c}={}){if(!0===b&&!k)throw Error("Proxy authentication is turned off in this deployment (PROXY_AUTH_FEATURE_ENABLED in audit-gateway/config.js)");let d=e(),f=new Map(n(d.proxyAuthUsers).map(a=>[a.username.toLowerCase(),a])),g=new Set,h=[];for(let a of Array.isArray(c)?c:[]){let b=String(a?.username||"").trim();if(!m(b))throw Error(`Invalid username: ${b||"(empty)"}`);let c=b.toLowerCase();if(g.has(c))throw Error(`Duplicate username: ${b}`);g.add(c);let d="string"==typeof a?.password?a.password:"";if(d){let a=Buffer.byteLength(d,"utf8");if(a<q)throw Error(`Password for ${b} must be at least ${q} characters`);if(a>p)throw Error(`Password for ${b} must be at most ${p} bytes`);h.push({username:b,passwordHash:await l(d)});continue}let e=f.get(c);if(!e)throw Error(`Account ${b} requires a password`);h.push({username:b,passwordHash:e.passwordHash})}return ah({...d,proxyAuthEnabled:!0===b,proxyAuthUsers:h})},listAccessGrants:function(){return u(e().accessGrants)},applyAuditPolicyFromSettings:ag,upsertAccessGrant:function({userId:a,note:b}={}){let c=v(a);if(!c)throw Error("Grant requires a dashboard username or email");let d=e(),f=u(d.accessGrants).filter(a=>a.userId!==c);return f.push({userId:c,note:b}),ah({...d,accessGrants:f})},deleteAccessGrant:function(a){let b=v(a);if(!b)throw Error("Grant requires a dashboard username or email");let c=e(),d=u(c.accessGrants).filter(a=>a.userId!==b);return z(b),ah({...c,accessGrants:d})},getOwnProxySession:function(a){return w(a)},revokeSession:function({ip:a,userId:b}={}){let c=a?+!!y(a):z(b);if(0===c)return{removed:0,droppedConnections:0};let d=R();return d.server?.listening?{removed:c,droppedConnections:d.ipGate?.dropRevoked()||0}:{removed:c,droppedConnections:0}},clearAudit:G,runSelfTest:Q}},78864:(a,b,c)=>{let d=c(14985).promises,e=c(91645),{normalizeIp:f,clientIpMatches:g}=c(5565),h=new Map,i=Object.freeze(["0.0.0.0/8","10.0.0.0/8","100.64.0.0/10","127.0.0.0/8","169.254.0.0/16","172.16.0.0/12","192.0.0.0/24","192.0.2.0/24","192.88.99.0/24","192.168.0.0/16","198.18.0.0/15","198.51.100.0/24","203.0.113.0/24","224.0.0.0/4","240.0.0.0/4","::/96","::1/128","100::/64","2001:2::/48","2001:db8::/32","fc00::/7","fe80::/10","ff00::/8"]),j=Object.freeze([".localhost",".local",".internal",".lan",".home.arpa"]);function k(a){return String(a||"").trim().replace(/^\[|\]$/g,"").replace(/\.$/,"").toLowerCase()}function l(a){let b=k(a);return!(!(!b||"localhost"===b||j.some(a=>b.endsWith(a)))&&(e.isIP(b)||b.includes(".")))}function m(a){let b=f(a);return!!e.isIP(b)&&!g(b,i)}function n(a){let b=[...new Set((Array.isArray(a)?a:[a]).map(a=>Number(a)).filter(a=>Number.isInteger(a)&&a>=1&&a<=65535))];return b.length?b:[443]}function o(a){let b=[...a?.addresses||[]];return function(c,d,e){let f=d,g=e;"function"==typeof d&&(g=d,f={});let h="number"==typeof f?f:Number(f?.family||0);if("object"==typeof f&&f?.all===!0){let c=4===h||6===h?b.filter(a=>a.family===h):b;if(!c.length){let b=Error(`No validated public address for ${a.host}`);b.code="ENOTFOUND",g(b);return}g(null,c.map(({address:a,family:b})=>({address:a,family:b})));return}let i=function(a,b=0){let c=Number(b||0);return 4===c||6===c?a.find(a=>a.family===c)||null:a.find(a=>4===a.family)||a[0]||null}(b,h);if(!i){let b=Error(`No validated public address for ${a.host}`);b.code="ENOTFOUND",g(b);return}g(null,i.address,i.family)}}async function p(a,b,c={}){let g=k(a),i=Number(b||443),j=n(c.allowedPorts||[443]);if(!g)throw Error("Destination host is empty");if(!Number.isInteger(i)||!j.includes(i))throw Error(`CONNECT destination port ${i||"unknown"} is not allowed`);if(l(g))throw Error(`Private or local destination hostname is not allowed: ${g}`);let q=e.isIP(f(g));if(q){let a=f(g);if(!m(a))throw Error(`Private or reserved destination address is not allowed: ${a}`);let b={host:g,port:i,addresses:[{address:a,family:q}]};return{...b,lookup:o(b)}}let r=Date.now(),s=h.get(g);if(!s||s.expiresAt<=r){let a=await d.lookup(g,{all:!0,verbatim:!0}),b=[],c=new Set;for(let d of a||[]){let a=f(d.address),g=e.isIP(a);if(!g||!m(a))continue;let h=`${g}:${a}`;c.has(h)||(c.add(h),b.push({address:a,family:g}))}if(!b.length)throw Error(`Destination did not resolve to a public address: ${g}`);s={addresses:b,expiresAt:r+6e4},h.set(g,s)}let t={host:g,port:i,addresses:[...s.addresses]};return{...t,lookup:o(t)}}a.exports={BLOCKED_ADDRESS_RANGES:i,normalizeTargetHost:k,normalizeAllowedPorts:n,isBlockedHostname:l,isPublicAddress:m,createPinnedLookup:o,resolvePublicTarget:p,clearDnsPolicyCache:function(){h.clear()}}},85252:(a,b,c)=>{let d=c(81630),e=c(73496),f=c(91645),g=c(34631),h=c(74075),i=c(55511),j=c(15296),{createAuditProxy:k,CaptureBuffer:l}=c(45372),{containsLikelySecret:m}=c(48350),{clientIpMatches:n,normalizeAllowedClientIps:o}=c(5565),{normalizeAllowedTools:p,clientToolMatches:q,shouldRefuseClientTool:r}=c(98586),{createProxyAuthenticator:s,createProxyAuthLimiter:t,hashProxyPassword:u,parseBasicProxyAuthorization:v}=c(7566),{isPublicAddress:w}=c(78864),{validateConfig:x,PROXY_AUTH_FEATURE_ENABLED:y}=c(43096),{normalizeAccessGrants:z,effectiveClientIpPolicy:A,attachClientIpGate:B,findAccessGrant:C}=c(77407),{activateProxySession:D,touchProxySession:E,getProxySession:F,revokeProxySession:G,clearAllProxySessions:H}=c(68257),{promptLogMirrorDecision:I}=c(90173);function J(a){return i.createHash("sha256").update(a).digest("hex")}function K(a){let b=j.pki.rsa.generateKeyPair(2048),c=j.pki.createCertificate();c.publicKey=b.publicKey,c.serialNumber=String(Date.now()),c.validity.notBefore=new Date(Date.now()-6e4),c.validity.notAfter=new Date(Date.now()+864e5);let d=[{name:"commonName",value:a}];return c.setSubject(d),c.setIssuer(d),c.setExtensions([{name:"basicConstraints",cA:!0,critical:!0},{name:"keyUsage",keyCertSign:!0,cRLSign:!0,critical:!0}]),c.sign(b.privateKey,j.md.sha256.create()),{cert:c,keys:b,certPem:j.pki.certificateToPem(c)}}function L(a,b){let c=j.pki.rsa.generateKeyPair(2048),d=j.pki.createCertificate();return d.publicKey=c.publicKey,d.serialNumber=`${Date.now()}${Math.floor(1e3*Math.random())}`,d.validity.notBefore=new Date(Date.now()-6e4),d.validity.notAfter=new Date(Date.now()+864e5),d.setSubject([{name:"commonName",value:b}]),d.setIssuer(a.cert.subject.attributes),d.setExtensions([{name:"basicConstraints",cA:!1},{name:"keyUsage",digitalSignature:!0,keyEncipherment:!0},{name:"extKeyUsage",serverAuth:!0},{name:"subjectAltName",altNames:[{type:2,value:b}]}]),d.sign(a.keys.privateKey,j.md.sha256.create()),{cert:j.pki.certificateToPem(d),key:j.pki.privateKeyToPem(c.privateKey)}}function M(a,b="127.0.0.1"){return new Promise((c,d)=>{a.once("error",d),a.listen(0,b,()=>{a.removeListener("error",d),c(a.address())})})}function N(a){return new Promise(b=>{if(!a)return b();try{a.forceCloseAll?.()}catch{}if(!a.listening)return b();a.close(()=>b()),setTimeout(b,1e3).unref?.()})}function O(a,b){let c="127.0.0.1";return Promise.resolve({host:a,port:b,addresses:[{address:c,family:4}],lookup:(a,b,d)=>{let e=b,f=d;"function"==typeof b&&(f=b,e={}),e?.all?f(null,[{address:c,family:4}]):f(null,c,4)}})}function P(a,b,c="",d=""){return new Promise((e,g)=>{let h=f.connect(a,"127.0.0.1"),i=Buffer.alloc(0),j=setTimeout(()=>g(Error("CONNECT timeout")),7e3);h.once("error",g),h.once("connect",()=>{let a=c?`User-Agent: ${c}\r
 `:"";h.write(`CONNECT ${b} HTTP/1.1\r
 Host: ${b}\r
 ${a}${d}Proxy-Connection: keep-alive\r
 \r
-`)});let k=a=>{let b=(i=Buffer.concat([i,a])).indexOf("\r\n\r\n");if(b<0)return;h.removeListener("data",k),clearTimeout(j);let c=i.subarray(0,b).toString("utf8"),d=i.subarray(b+4);if(!/^HTTP\/1\.1 200\b/.test(c)){h.destroy(),g(Error(`CONNECT failed: ${c.split("\r\n")[0]}`));return}d.length&&h.unshift(d),e(h)};h.on("data",k)})}function L(a,b,c=""){return new Promise((d,e)=>{let g=f.connect(a,"127.0.0.1"),h=Buffer.alloc(0),i=setTimeout(()=>e(Error("CONNECT raw timeout")),7e3);g.once("error",e),g.once("connect",()=>{g.write(`CONNECT ${b} HTTP/1.1\r
+`)});let k=a=>{let b=(i=Buffer.concat([i,a])).indexOf("\r\n\r\n");if(b<0)return;h.removeListener("data",k),clearTimeout(j);let c=i.subarray(0,b).toString("utf8"),d=i.subarray(b+4);if(!/^HTTP\/1\.1 200\b/.test(c)){h.destroy(),g(Error(`CONNECT failed: ${c.split("\r\n")[0]}`));return}d.length&&h.unshift(d),e(h)};h.on("data",k)})}function Q(a,b,c=""){return new Promise((d,e)=>{let g=f.connect(a,"127.0.0.1"),h=Buffer.alloc(0),i=setTimeout(()=>e(Error("CONNECT raw timeout")),7e3);g.once("error",e),g.once("connect",()=>{g.write(`CONNECT ${b} HTTP/1.1\r
 Host: ${b}\r
 ${c}\r
-`)}),g.on("data",a=>{let b=(h=Buffer.concat([h,a])).indexOf("\r\n\r\n");if(b<0)return;clearTimeout(i);let c=h.subarray(0,b).toString("utf8");try{g.destroy()}catch{}d(c)}),g.on("close",()=>{clearTimeout(i),d(h.toString("utf8"))})})}function M(a){return new Promise(b=>{let c=f.connect(a,"127.0.0.1"),d="",e=!1,g=a=>{if(!e){e=!0,clearTimeout(h);try{c.destroy()}catch{}b(a)}},h=setTimeout(()=>g({served:d.length>0,hungUp:!1,received:d}),1500);c.on("connect",()=>c.write("GET / HTTP/1.1\r\nHost: gate.test\r\nConnection: close\r\n\r\n")),c.on("data",a=>{d+=a.toString("utf8")}),c.on("error",()=>g({served:!1,hungUp:!0,received:d})),c.on("close",()=>g({served:d.length>0,hungUp:0===d.length,received:d}))})}function N(a,b){return`Proxy-Authorization: Basic ${Buffer.from(`${a}:${b}`).toString("base64")}\r
-`}function O({socket:a,ca:b,servername:c,port:d,body:e,path:f,alpnProtocols:h=["http/1.1"],onAlpn:i}){return new Promise((j,k)=>{let l=g.connect({socket:a,ca:b,servername:c,rejectUnauthorized:!0,ALPNProtocols:h}),m=[],n=setTimeout(()=>k(Error("TLS HTTP/1.1 test timeout")),1e4);l.once("error",k),l.once("secureConnect",()=>{i?.(l.alpnProtocol),l.write(`POST ${f} HTTP/1.1\r
+`)}),g.on("data",a=>{let b=(h=Buffer.concat([h,a])).indexOf("\r\n\r\n");if(b<0)return;clearTimeout(i);let c=h.subarray(0,b).toString("utf8");try{g.destroy()}catch{}d(c)}),g.on("close",()=>{clearTimeout(i),d(h.toString("utf8"))})})}function R(a){return new Promise(b=>{let c=f.connect(a,"127.0.0.1"),d="",e=!1,g=a=>{if(!e){e=!0,clearTimeout(h);try{c.destroy()}catch{}b(a)}},h=setTimeout(()=>g({served:d.length>0,hungUp:!1,received:d}),1500);c.on("connect",()=>c.write("GET / HTTP/1.1\r\nHost: gate.test\r\nConnection: close\r\n\r\n")),c.on("data",a=>{d+=a.toString("utf8")}),c.on("error",()=>g({served:!1,hungUp:!0,received:d})),c.on("close",()=>g({served:d.length>0,hungUp:0===d.length,received:d}))})}function S(a,b){return`Proxy-Authorization: Basic ${Buffer.from(`${a}:${b}`).toString("base64")}\r
+`}function T({socket:a,ca:b,servername:c,port:d,body:e,path:f,alpnProtocols:h=["http/1.1"],onAlpn:i}){return new Promise((j,k)=>{let l=g.connect({socket:a,ca:b,servername:c,rejectUnauthorized:!0,ALPNProtocols:h}),m=[],n=setTimeout(()=>k(Error("TLS HTTP/1.1 test timeout")),1e4);l.once("error",k),l.once("secureConnect",()=>{i?.(l.alpnProtocol),l.write(`POST ${f} HTTP/1.1\r
 Host: localhost:${d}\r
 Authorization: Bearer test-secret-authorization-123456789\r
 x-api-key: sk-test-supersecret-123456789\r
@@ -22,7 +22,7 @@ Content-Type: application/json\r
 Content-Length: ${e.length}\r
 Connection: close\r
 \r
-`),l.write(e)}),l.on("data",a=>m.push(Buffer.from(a))),l.on("end",()=>{clearTimeout(n),j(function(a){let b=a.indexOf("\r\n\r\n");if(b<0)throw Error("Invalid HTTP/1.1 response");let c=a.subarray(0,b).toString("latin1"),d={};for(let a of c.split("\r\n").slice(1)){let b=a.indexOf(":");b>0&&(d[a.slice(0,b).toLowerCase()]=a.slice(b+1).trim())}let e=Number(d["content-length"]||0);return{head:c,headers:d,body:a.subarray(b+4,e?b+4+e:void 0)}}(Buffer.concat(m)))})})}a.exports={runSelfTest:async function(){let a=Date.now(),b=[],c=(a,c,d="")=>b.push({name:a,ok:!!c,detail:d}),j=z([{userId:"Anh-TCT@Fujinet.net",ips:["172.16.253.2","172.16.253.2","172.16.6.0/24"],note:"  Laptop  "},{userId:"anh-tct@fujinet.net",ips:["10.9.9.9"]},{userId:"",ips:["10.0.0.1"]}]);c("Grant user id is normalised and duplicates merge",1===j.length&&"anh-tct@fujinet.net"===j[0].userId,JSON.stringify(j)),c("Grant addresses deduplicate and keep CIDR form",j[0]?.ips.join(",")==="172.16.253.2,172.16.6.0/24,10.9.9.9",j[0]?.ips.join(",")),c("Grant note is trimmed",j[0]?.note==="Laptop",j[0]?.note);let s=z([{userId:"anh-tct",ips:["10.1.1.1"]},{userId:"bob@fujinet.net",ips:["10.1.1.2"]}]);c("Grant lookup matches a bare username",C(s,"Anh-TCT")?.ips.join()==="10.1.1.1"),c("Grant lookup matches an email identity",C(s,"BOB@fujinet.net")?.ips.join()==="10.1.1.2"),c("Grant lookup refuses an unknown identity",null===C(s,"carol"));let t="";try{z([{userId:"u",ips:["not-an-ip"]}])}catch(a){t=a.message||String(a)}c("Grant with an invalid address is rejected",/Invalid client IP/.test(t),t);let v=A({accessGrants:[{userId:"u",ips:["10.9.9.9"]}],clientIpFilterEnabled:!1,allowedClientIps:["192.168.1.1"]});c("Only a granted address is allowed",!0===v.enabled&&"grants"===v.source&&n("10.9.9.9",v.allowedClientIps)&&!n("192.168.1.1",v.allowedClientIps),JSON.stringify(v.allowedClientIps));let P=A({accessGrants:[{userId:"u",ips:[]}],clientIpFilterEnabled:!0,allowedClientIps:["192.168.1.1"]});c("Grants without addresses keep the listener fail-closed","grants"===P.source&&!0===P.enabled&&0===P.allowedClientIps.length&&!n("192.168.1.1",P.allowedClientIps),JSON.stringify(P));let Q=A({accessGrants:[]});c("No granted address means IP filtering is on with a deny-all allowlist",!0===Q.enabled&&"grants"===Q.source&&0===Q.allowedClientIps.length,JSON.stringify(Q));let R=d.createServer((a,b)=>b.end("served"));try{let a=A({accessGrants:[{userId:"elsewhere",ips:["10.99.99.99"]}]}),b=B(R,()=>a),d=await H(R),e=await M(d.port);c("A client IP nobody was granted is hung up on",!1===e.served,JSON.stringify(e)),a=A({accessGrants:[{userId:"granted",ips:["127.0.0.1"]}]});let g=await M(d.port);c("Granting an address applies on the next connection, no restart",!0===g.served&&/served/.test(g.received)&&!0===R.listening,JSON.stringify(g.received.slice(0,40)));let h=f.connect(d.port,"127.0.0.1");await new Promise(a=>h.once("connect",a)),a=A({accessGrants:[{userId:"elsewhere",ips:["10.99.99.99"]}]});let i=b.dropRevoked();await new Promise(a=>setTimeout(a,50)),c("Revoking closes the connection that address already held",1===i&&!0===h.destroyed,`dropped=${i} destroyed=${h.destroyed}`);let j=await M(d.port);c("And refuses it on the next attempt",!1===j.served&&!0===R.listening,JSON.stringify(j.hungUp))}finally{await I(R)}let S=o(["172.16.253.3","10.20.30.0/24","2001:db8::/64"]);c("Client IP exact allowlist match",n("::ffff:172.16.253.3",S)),c("Client IPv4 CIDR allowlist match",n("10.20.30.77",S)),c("Client IPv6 CIDR allowlist match",n("2001:db8::1234",S)),c("Client IP outside allowlist denied",!n("10.20.31.77",S)),c("Public destination accepted",w("1.1.1.1"));let T=x({proxyAuthEnabled:!0,proxyAuthUsers:[{username:"anh-tct",passwordHash:`$2b$10$${"x".repeat(53)}`}]});c("A parked proxy-auth flag is enforced, not just hidden",y?!0===T.proxyAuthEnabled:!1===T.proxyAuthEnabled,`feature=${y} enforced=${T.proxyAuthEnabled}`),c("Parking proxy auth keeps saved accounts for later",1===T.proxyAuthUsers.length,JSON.stringify(T.proxyAuthUsers.map(a=>a.username)));let U=p(["claude-code","codex"]);if(c("Preset expands to the tool's User-Agent patterns",q("claude-cli/2.0.1 (external, cli)",U)),c("Codex User-Agent matches its preset",q("codex_cli_rs/0.147.0 (Windows 10.0.26200; x86_64)",U)),c("A browser is refused",r("Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/131.0",U)),c("An allowed tool is not refused",!r("claude-cli/2.1.241 (external, cli)",U)),c("A CONNECT without a User-Agent is let through",!r("",U)),c("A free-text entry is matched verbatim",q("my-internal-agent/3",p(["my-internal-agent"]))),c("Private destination rejected",!w("127.0.0.1")&&!w("169.254.169.254")),"function"==typeof h.zstdCompressSync){let a=JSON.stringify({input:[{content:[{text:"zstd audit ok"}]}]}),b=new l(1048576);b.add(h.zstdCompressSync(Buffer.from(a)));let d=await b.finish("application/json","zstd");c("Zstd audit body decoded",!0===d.decoded&&d.body.includes("zstd audit ok")&&!d.decodeError,d.decodeError||"")}else c("Zstd audit body decoded",!1,`This runtime has no zlib zstd support (${process.version}); Codex request bodies cannot be decoded. Run Node 22.15 or newer.`);let V=JSON.stringify({type:"message",content:[{type:"text",text:"brotli audit ok"}]}),W=new l(1048576);W.add(h.brotliCompressSync(Buffer.from(V)));let X=await W.finish("application/json","br");c("Brotli audit body decoded",!0===X.decoded&&X.body.includes("brotli audit ok")&&!X.decodeError);let Y=Buffer.from(`TRUNCATED-GZIP-PREFIX-OK${i.randomBytes(8192).toString("hex")}`),Z=h.gzipSync(Y),$=new l(Math.floor(.7*Z.length));$.add(Z);let _=await $.finish("application/json","gzip");c("Truncated gzip audit body partially decoded",!0===_.decodePartial&&!0===_.truncated&&_.body.includes("TRUNCATED-GZIP-PREFIX-OK"),_.decodeError||"");let aa=F("BlueRouter Audit Self Test Upstream CA"),ab=G(aa,"localhost"),ac=F("BlueRouter Audit Self Test Proxy CA"),ad=G(ac,"localhost"),ae=Buffer.from(JSON.stringify({type:"message",content:[{type:"text",text:"compressed response preserved"}]})),af=h.brotliCompressSync(ae),ag=[],ah=`event: message_start
+`),l.write(e)}),l.on("data",a=>m.push(Buffer.from(a))),l.on("end",()=>{clearTimeout(n),j(function(a){let b=a.indexOf("\r\n\r\n");if(b<0)throw Error("Invalid HTTP/1.1 response");let c=a.subarray(0,b).toString("latin1"),d={};for(let a of c.split("\r\n").slice(1)){let b=a.indexOf(":");b>0&&(d[a.slice(0,b).toLowerCase()]=a.slice(b+1).trim())}let e=Number(d["content-length"]||0);return{head:c,headers:d,body:a.subarray(b+4,e?b+4+e:void 0)}}(Buffer.concat(m)))})})}a.exports={runSelfTest:async function(){let a=Date.now(),b=[],c=(a,c,d="")=>b.push({name:a,ok:!!c,detail:d});H();try{let a=z([{userId:"Anh-TCT@Fujinet.net",note:"  Laptop  "},{userId:"anh-tct@fujinet.net",note:"kept"},{userId:"",note:"dropped: no userId"}]);c("Grant user id is normalised and duplicates merge",1===a.length&&"anh-tct@fujinet.net"===a[0].userId,JSON.stringify(a)),c("A later duplicate's note wins",a[0]?.note==="kept",a[0]?.note);let b=z([{userId:"anh-tct",note:"  Laptop  "}]);c("Grant note is trimmed",b[0]?.note==="Laptop",b[0]?.note);let e=z([{userId:"anh-tct"},{userId:"bob@fujinet.net"}]);c("Grant lookup matches a bare username",C(e,"Anh-TCT")?.userId==="anh-tct"),c("Grant lookup matches an email identity",C(e,"BOB@fujinet.net")?.userId==="bob@fujinet.net"),c("Grant lookup refuses an unknown identity",null===C(e,"carol")),D({userId:"u",ip:"10.9.9.9",idleTimeoutMs:6e4});let g=A({accessGrants:[{userId:"u"}]});c("A session for a permitted user is allowed",!0===g.enabled&&"sessions"===g.source&&n("10.9.9.9",g.allowedClientIps),JSON.stringify(g.allowedClientIps));let h=A({accessGrants:[{userId:"someone-else"}]});c("That same session is ignored once its user is no longer granted",!0===h.enabled&&0===h.allowedClientIps.length&&!n("10.9.9.9",h.allowedClientIps),JSON.stringify(h.allowedClientIps));let i=A({accessGrants:[]});c("No grant at all means IP filtering is on with a deny-all allowlist",!0===i.enabled&&"sessions"===i.source&&0===i.allowedClientIps.length,JSON.stringify(i)),G("10.9.9.9"),c("The session is gone from the active list once revoked",null===F("10.9.9.9")),D({userId:"u",ip:"10.5.5.5",idleTimeoutMs:6e4});let j=F("10.5.5.5")?.expiresAt;await new Promise(a=>setTimeout(a,5)),E("10.5.5.5",12e4);let k=F("10.5.5.5")?.expiresAt;c("Touching a session slides its expiry forward",Number.isFinite(k)&&k>j,`${j} -> ${k}`),G("10.5.5.5");let l=d.createServer((a,b)=>b.end("served"));try{let a=A({accessGrants:[{userId:"granted"}]}),b=B(l,()=>a),d=await M(l),e=await R(d.port);c("A client IP with no active session is hung up on",!1===e.served,JSON.stringify(e)),D({userId:"granted",ip:"127.0.0.1",idleTimeoutMs:6e4});let g=await R(d.port);c("Logging in applies on the next connection, no restart",!0===g.served&&/served/.test(g.received)&&!0===l.listening,JSON.stringify(g.received.slice(0,40)));let h=f.connect(d.port,"127.0.0.1");await new Promise(a=>h.once("connect",a)),G("127.0.0.1");let i=b.dropRevoked();await new Promise(a=>setTimeout(a,50)),c("Revoking closes the connection that address already held",1===i&&!0===h.destroyed,`dropped=${i} destroyed=${h.destroyed}`);let j=await R(d.port);c("And refuses it on the next attempt",!1===j.served&&!0===l.listening,JSON.stringify(j.hungUp))}finally{await N(l)}}finally{H()}let j=o(["172.16.253.3","10.20.30.0/24","2001:db8::/64"]);c("Client IP exact allowlist match",n("::ffff:172.16.253.3",j)),c("Client IPv4 CIDR allowlist match",n("10.20.30.77",j)),c("Client IPv6 CIDR allowlist match",n("2001:db8::1234",j)),c("Client IP outside allowlist denied",!n("10.20.31.77",j)),c("Public destination accepted",w("1.1.1.1"));let s=x({proxyAuthEnabled:!0,proxyAuthUsers:[{username:"anh-tct",passwordHash:`$2b$10$${"x".repeat(53)}`}]});c("A parked proxy-auth flag is enforced, not just hidden",y?!0===s.proxyAuthEnabled:!1===s.proxyAuthEnabled,`feature=${y} enforced=${s.proxyAuthEnabled}`),c("Parking proxy auth keeps saved accounts for later",1===s.proxyAuthUsers.length,JSON.stringify(s.proxyAuthUsers.map(a=>a.username)));let t=p(["claude-code","codex"]);if(c("Preset expands to the tool's User-Agent patterns",q("claude-cli/2.0.1 (external, cli)",t)),c("Codex User-Agent matches its preset",q("codex_cli_rs/0.147.0 (Windows 10.0.26200; x86_64)",t)),c("A browser is refused",r("Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/131.0",t)),c("An allowed tool is not refused",!r("claude-cli/2.1.241 (external, cli)",t)),c("A CONNECT without a User-Agent is let through",!r("",t)),c("A free-text entry is matched verbatim",q("my-internal-agent/3",p(["my-internal-agent"]))),c("Private destination rejected",!w("127.0.0.1")&&!w("169.254.169.254")),"function"==typeof h.zstdCompressSync){let a=JSON.stringify({input:[{content:[{text:"zstd audit ok"}]}]}),b=new l(1048576);b.add(h.zstdCompressSync(Buffer.from(a)));let d=await b.finish("application/json","zstd");c("Zstd audit body decoded",!0===d.decoded&&d.body.includes("zstd audit ok")&&!d.decodeError,d.decodeError||"")}else c("Zstd audit body decoded",!1,`This runtime has no zlib zstd support (${process.version}); Codex request bodies cannot be decoded. Run Node 22.15 or newer.`);let v=JSON.stringify({type:"message",content:[{type:"text",text:"brotli audit ok"}]}),U=new l(1048576);U.add(h.brotliCompressSync(Buffer.from(v)));let V=await U.finish("application/json","br");c("Brotli audit body decoded",!0===V.decoded&&V.body.includes("brotli audit ok")&&!V.decodeError);let W=Buffer.from(`TRUNCATED-GZIP-PREFIX-OK${i.randomBytes(8192).toString("hex")}`),X=h.gzipSync(W),Y=new l(Math.floor(.7*X.length));Y.add(X);let Z=await Y.finish("application/json","gzip");c("Truncated gzip audit body partially decoded",!0===Z.decodePartial&&!0===Z.truncated&&Z.body.includes("TRUNCATED-GZIP-PREFIX-OK"),Z.decodeError||"");let $=K("BlueRouter Audit Self Test Upstream CA"),_=L($,"localhost"),aa=K("BlueRouter Audit Self Test Proxy CA"),ab=L(aa,"localhost"),ac=Buffer.from(JSON.stringify({type:"message",content:[{type:"text",text:"compressed response preserved"}]})),ad=h.brotliCompressSync(ac),ae=[],af=`event: message_start
 data: ${JSON.stringify({type:"message_start",message:{id:"msg_selftest",type:"message",role:"assistant",model:"audit-self-test-stream-model",content:[],usage:{input_tokens:11,cache_creation_input_tokens:22,cache_read_input_tokens:33,output_tokens:1}}})}
 
 event: content_block_delta
@@ -33,7 +33,7 @@ data: ${JSON.stringify({type:"message_delta",delta:{stop_reason:"end_turn"},usag
 
 event: message_stop
 data: ${JSON.stringify({type:"message_stop"})}
-`,ai=h.gzipSync(Buffer.from(ah,"utf8")),aj=e.createSecureServer({key:ab.key,cert:ab.cert,allowHTTP1:!0});aj.on("request",(a,b)=>{let c=[];a.on("data",a=>c.push(Buffer.from(a))),a.on("end",()=>{if(ag.push({proxyAuthorization:a.headers["proxy-authorization"]||null,protocol:2===a.httpVersionMajor?"h2":"http/1.1",path:a.url,authorization:a.headers.authorization,apiKey:a.headers["x-api-key"],internalHeader:a.headers["x-9r-source-tool"],body:Buffer.concat(c)}),String(a.url||"").includes("stream=1")){b.writeHead(200,{"content-type":"text/event-stream","content-encoding":"gzip","content-length":String(ai.length)}),b.end(ai);return}b.writeHead(200,{"content-type":"application/json","content-encoding":"br","content-length":String(af.length)}),b.end(af)})});let ak=[],al=null,am=null;try{var an;let a=await H(aj);al=k({allowedHosts:["localhost"],passthroughUnknown:!1,captureBodies:!0,captureLimitBytes:1048576,verifyUpstreamTls:!0,allowedConnectPorts:[a.port],connectTimeoutMs:5e3,tlsHandshakeTimeoutMs:5e3,responseHeaderTimeoutMs:5e3,idleTimeoutMs:3e4},{certificateProvider:()=>ad,upstreamCa:aa.certPem,resolveTarget:J,onAudit:a=>ak.push(a)});let b=await H(al),d=await (an=b.port,new Promise((a,b)=>{let c=f.connect(an,"127.0.0.1"),d=[],e=setTimeout(()=>b(Error("Plain HTTP rejection timeout")),5e3);c.once("connect",()=>c.end("GET http://example.com/ HTTP/1.1\r\nHost: example.com\r\nConnection: close\r\n\r\n")),c.on("data",a=>d.push(Buffer.from(a))),c.once("error",b),c.once("end",()=>{clearTimeout(e),a(Buffer.concat(d).toString("utf8"))})}));c("Plain HTTP forward proxy is disabled",d.startsWith("HTTP/1.1 403"));let e="";try{await K(b.port,`blocked.invalid:${a.port}`)}catch(a){e=a.message||String(a)}c("CONNECT to a non-allowlisted host is refused",e.includes("403"),e),await new Promise(a=>setTimeout(a,100));let h=ak.find(a=>"CONNECT"===a.method&&"blocked.invalid"===a.host);c("Refused CONNECT is audited with the blocked host",!!h,h?"":"no CONNECT event recorded"),c("Refused CONNECT records why it was blocked",/allowlist/i.test(h?.error||""),h?.error||""),c("Refused CONNECT is flagged as denied",h?.denied===!0,String(h?.denied));let j=D(h);c("Denied event is not mirrored into prompt_logs",!1===j.mirror&&"denied"===j.reason,JSON.stringify(j));let l=k({allowedHosts:["localhost"],passthroughUnknown:!1,captureBodies:!0,captureLimitBytes:1048576,verifyUpstreamTls:!0,allowedConnectPorts:[a.port],connectTimeoutMs:5e3,tlsHandshakeTimeoutMs:5e3,responseHeaderTimeoutMs:5e3,idleTimeoutMs:3e4,clientToolFilterEnabled:!0,allowedClientTools:["claude-code"]},{certificateProvider:()=>ad,upstreamCa:aa.certPem,resolveTarget:J,onAudit:a=>ak.push(a)}),n=await H(l),o="";try{(await K(n.port,`localhost:${a.port}`,"claude-cli/2.0.1 (external, cli)")).destroy()}catch(a){o=a.message||String(a)}c("Allowed tool still opens a tunnel",""===o,o);let q="";try{await K(n.port,`localhost:${a.port}`,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/131.0")}catch(a){q=a.message||String(a)}c("Browser is turned away by the tool filter",q.includes("403"),q);let r="";try{(await K(n.port,`localhost:${a.port}`)).destroy()}catch(a){r=a.message||String(a)}c("A client sending no User-Agent still connects",""===r,r),await new Promise(a=>setTimeout(a,100));let s=ak.find(a=>/Client tool is not allowed/i.test(a.error||""));c("Refused tool is audited with the User-Agent that was rejected",/Chrome|no User-Agent/i.test(s?.error||""),s?.error||""),await I(l);let t="selftest-user",v="selftest:pass:with:colons",w=await u(v),x=0,y=k({allowedHosts:["localhost"],passthroughUnknown:!0,captureBodies:!0,captureLimitBytes:1048576,verifyUpstreamTls:!0,allowedConnectPorts:[a.port],connectTimeoutMs:5e3,tlsHandshakeTimeoutMs:5e3,responseHeaderTimeoutMs:5e3,idleTimeoutMs:3e4,proxyAuthEnabled:!0,proxyAuthUsers:[{username:t,passwordHash:w}]},{certificateProvider:()=>ad,upstreamCa:aa.certPem,resolveTarget:(a,b)=>(x+=1,J(a,b)),onAudit:a=>ak.push(a)}),z=await H(y),A=`localhost:${a.port}`,B=await L(z.port,A);c("CONNECT without credentials is refused with 407",B.startsWith("HTTP/1.1 407 Proxy Authentication Required"),B.split("\r\n")[0]),c("407 carries a Basic challenge",/Proxy-Authenticate: Basic realm="BlueRouter Audit Proxy", charset="UTF-8"/.test(B)),c("407 closes the connection",/Connection: close/i.test(B));let C=await L(z.port,A,N(t,"wrong"));c("Wrong password is refused with 407",C.startsWith("HTTP/1.1 407"),C.split("\r\n")[0]);let F=await L(z.port,A,N("nobody",v));c("Unknown username is refused with 407",F.startsWith("HTTP/1.1 407"),F.split("\r\n")[0]);let G=await L(z.port,`blocked.invalid:${a.port}`);c("Unauthenticated client cannot use the passthrough tunnel",G.startsWith("HTTP/1.1 407"),G.split("\r\n")[0]),c("Unauthenticated client cannot tell an allowlisted host from a blocked one",B.split("\r\n")[0]===G.split("\r\n")[0]),c("Unauthenticated CONNECT does not resolve the destination",0===x,`resolver called ${x} times`);let M=Buffer.from(JSON.stringify({model:"audit-self-test-auth",messages:[]})),P=await K(z.port,A,"",N(t,v)),Q=await O({socket:P,ca:ac.certPem,servername:"localhost",port:a.port,body:M,path:"/v1/messages?auth=1"});c("Correct credentials open a working tunnel",Q.head.startsWith("HTTP/1.1 200"),Q.head.split("\r\n")[0]),c("Authenticated CONNECT does resolve the destination",x>0,`resolver called ${x} times`),await new Promise(a=>setTimeout(a,100));let R=ak.find(a=>String(a.path||"").includes("auth=1"));c("Authenticated tunnel attributes the username on the request event",R?.client?.proxyUser===t,R?.client?.proxyUser||"(none)");let S=ak.find(a=>407===a.status&&a.error&&/Invalid proxy credentials/.test(a.error));c("Failed proxy auth is audited",!!S,S?"":"no 407 event recorded");let T=Buffer.from(`${t}:${v}`).toString("base64"),U=ak.some(a=>{let b=JSON.stringify(a);return b.includes(v)||b.includes(T)});c("No audit event records the proxy credential",!U),c("Proxy-Authorization is redacted in audit events",ak.filter(a=>"proxy-authorization"in(a.request?.headers||{})).every(a=>"[REDACTED]"===a.request.headers["proxy-authorization"])),c("Proxy-Authorization never reaches the origin",ag.every(a=>null==a.proxyAuthorization)),await I(y);let V=Buffer.from(JSON.stringify({model:"audit-self-test-h1",messages:[{role:"user",content:"hello h1 ✓"}]})),W="/v1/messages?beta=true&encoded=%2F",X=await K(b.port,`localhost:${a.port}`),Y=await O({socket:X,ca:ac.certPem,servername:"localhost",port:a.port,body:V,path:W});c("HTTP/1.1 CONNECT and TLS succeeded",Y.head.startsWith("HTTP/1.1 200")),c("HTTP/1.1 compressed response bytes preserved",E(Y.body)===E(af));let Z=Buffer.from(JSON.stringify({model:"audit-self-test-h2-downgrade",messages:[{role:"user",content:"hello downgrade ✓"}]})),$="/v1/messages?beta=true&protocol=h2-preferred",_=await K(b.port,`localhost:${a.port}`),ab=null,ae=await O({socket:_,ca:ac.certPem,servername:"localhost",port:a.port,body:Z,path:$,alpnProtocols:["h2","http/1.1"],onAlpn:a=>{ab=a}});c("h2-preferring client is downgraded to HTTP/1.1","http/1.1"===ab,`negotiated ${ab||"none"}`),c("Downgraded client still gets a response",ae.head.startsWith("HTTP/1.1 200")),c("Downgraded compressed response bytes preserved",E(ae.body)===E(af)),c("HTTP/2 is not advertised while the h2 path is unfixed",al.auditCapabilities?.http2===!1);let ah=Buffer.from(JSON.stringify({model:"audit-self-test-stream-model",messages:[{role:"user",content:"x".repeat(1052672)}]})),ai=await K(b.port,`localhost:${a.port}`),ao=await O({socket:ai,ca:ac.certPem,servername:"localhost",port:a.port,body:ah,path:"/v1/messages?beta=true&stream=1"});c("Streaming response forwarded",ao.head.startsWith("HTTP/1.1 200")),await new Promise(a=>setTimeout(a,100));let ap=ak.find(a=>String(a.path||"").includes("stream=1"));c("Streaming audit event captured",!!ap),c("Token usage extracted from streamed response",ap?.usage?.inputTokens===11&&ap?.usage?.cacheCreationTokens===22&&ap?.usage?.cacheReadTokens===33&&ap?.usage?.outputTokens===44&&ap?.usage?.totalTokens===110,JSON.stringify(ap?.usage||null)),c("Streamed usage marked complete",ap?.usage?.complete===!0&&ap?.usage?.stopReason==="end_turn"),c("Model recovered from response when request body is truncated",ap?.request?.truncated===!0&&ap?.model==="audit-self-test-stream-model"),c("Exchange without token usage reports none",ak.some(a=>String(a.path||"").includes("encoded=")&&null==a.usage));let aq=await K(b.port,`localhost:${a.port}`),ar=await function({socket:a,ca:b,servername:c,port:d,path:e}){return new Promise((f,h)=>{let j=g.connect({socket:a,ca:b,servername:c,rejectUnauthorized:!0,ALPNProtocols:["http/1.1"]}),k=[],l=setTimeout(()=>h(Error("Upgrade test timeout")),1e4);j.once("error",h),j.once("secureConnect",()=>{j.write(`GET ${e} HTTP/1.1\r
+`,ag=h.gzipSync(Buffer.from(af,"utf8")),ah=e.createSecureServer({key:_.key,cert:_.cert,allowHTTP1:!0});ah.on("request",(a,b)=>{let c=[];a.on("data",a=>c.push(Buffer.from(a))),a.on("end",()=>{if(ae.push({proxyAuthorization:a.headers["proxy-authorization"]||null,protocol:2===a.httpVersionMajor?"h2":"http/1.1",path:a.url,authorization:a.headers.authorization,apiKey:a.headers["x-api-key"],internalHeader:a.headers["x-9r-source-tool"],body:Buffer.concat(c)}),String(a.url||"").includes("stream=1")){b.writeHead(200,{"content-type":"text/event-stream","content-encoding":"gzip","content-length":String(ag.length)}),b.end(ag);return}b.writeHead(200,{"content-type":"application/json","content-encoding":"br","content-length":String(ad.length)}),b.end(ad)})});let ai=[],aj=null,ak=null;try{var al;let a=await M(ah);aj=k({allowedHosts:["localhost"],passthroughUnknown:!1,captureBodies:!0,captureLimitBytes:1048576,verifyUpstreamTls:!0,allowedConnectPorts:[a.port],connectTimeoutMs:5e3,tlsHandshakeTimeoutMs:5e3,responseHeaderTimeoutMs:5e3,idleTimeoutMs:3e4},{certificateProvider:()=>ab,upstreamCa:$.certPem,resolveTarget:O,onAudit:a=>ai.push(a)});let b=await M(aj),d=await (al=b.port,new Promise((a,b)=>{let c=f.connect(al,"127.0.0.1"),d=[],e=setTimeout(()=>b(Error("Plain HTTP rejection timeout")),5e3);c.once("connect",()=>c.end("GET http://example.com/ HTTP/1.1\r\nHost: example.com\r\nConnection: close\r\n\r\n")),c.on("data",a=>d.push(Buffer.from(a))),c.once("error",b),c.once("end",()=>{clearTimeout(e),a(Buffer.concat(d).toString("utf8"))})}));c("Plain HTTP forward proxy is disabled",d.startsWith("HTTP/1.1 403"));let e="";try{await P(b.port,`blocked.invalid:${a.port}`)}catch(a){e=a.message||String(a)}c("CONNECT to a non-allowlisted host is refused",e.includes("403"),e),await new Promise(a=>setTimeout(a,100));let h=ai.find(a=>"CONNECT"===a.method&&"blocked.invalid"===a.host);c("Refused CONNECT is audited with the blocked host",!!h,h?"":"no CONNECT event recorded"),c("Refused CONNECT records why it was blocked",/allowlist/i.test(h?.error||""),h?.error||""),c("Refused CONNECT is flagged as denied",h?.denied===!0,String(h?.denied));let j=I(h);c("Denied event is not mirrored into prompt_logs",!1===j.mirror&&"denied"===j.reason,JSON.stringify(j));let l=k({allowedHosts:["localhost"],passthroughUnknown:!1,captureBodies:!0,captureLimitBytes:1048576,verifyUpstreamTls:!0,allowedConnectPorts:[a.port],connectTimeoutMs:5e3,tlsHandshakeTimeoutMs:5e3,responseHeaderTimeoutMs:5e3,idleTimeoutMs:3e4,clientToolFilterEnabled:!0,allowedClientTools:["claude-code"]},{certificateProvider:()=>ab,upstreamCa:$.certPem,resolveTarget:O,onAudit:a=>ai.push(a)}),n=await M(l),o="";try{(await P(n.port,`localhost:${a.port}`,"claude-cli/2.0.1 (external, cli)")).destroy()}catch(a){o=a.message||String(a)}c("Allowed tool still opens a tunnel",""===o,o);let q="";try{await P(n.port,`localhost:${a.port}`,"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/131.0")}catch(a){q=a.message||String(a)}c("Browser is turned away by the tool filter",q.includes("403"),q);let r="";try{(await P(n.port,`localhost:${a.port}`)).destroy()}catch(a){r=a.message||String(a)}c("A client sending no User-Agent still connects",""===r,r),await new Promise(a=>setTimeout(a,100));let s=ai.find(a=>/Client tool is not allowed/i.test(a.error||""));c("Refused tool is audited with the User-Agent that was rejected",/Chrome|no User-Agent/i.test(s?.error||""),s?.error||""),await N(l);let t="selftest-user",v="selftest:pass:with:colons",w=await u(v),x=0,y=k({allowedHosts:["localhost"],passthroughUnknown:!0,captureBodies:!0,captureLimitBytes:1048576,verifyUpstreamTls:!0,allowedConnectPorts:[a.port],connectTimeoutMs:5e3,tlsHandshakeTimeoutMs:5e3,responseHeaderTimeoutMs:5e3,idleTimeoutMs:3e4,proxyAuthEnabled:!0,proxyAuthUsers:[{username:t,passwordHash:w}]},{certificateProvider:()=>ab,upstreamCa:$.certPem,resolveTarget:(a,b)=>(x+=1,O(a,b)),onAudit:a=>ai.push(a)}),z=await M(y),A=`localhost:${a.port}`,B=await Q(z.port,A);c("CONNECT without credentials is refused with 407",B.startsWith("HTTP/1.1 407 Proxy Authentication Required"),B.split("\r\n")[0]),c("407 carries a Basic challenge",/Proxy-Authenticate: Basic realm="BlueRouter Audit Proxy", charset="UTF-8"/.test(B)),c("407 closes the connection",/Connection: close/i.test(B));let C=await Q(z.port,A,S(t,"wrong"));c("Wrong password is refused with 407",C.startsWith("HTTP/1.1 407"),C.split("\r\n")[0]);let D=await Q(z.port,A,S("nobody",v));c("Unknown username is refused with 407",D.startsWith("HTTP/1.1 407"),D.split("\r\n")[0]);let E=await Q(z.port,`blocked.invalid:${a.port}`);c("Unauthenticated client cannot use the passthrough tunnel",E.startsWith("HTTP/1.1 407"),E.split("\r\n")[0]),c("Unauthenticated client cannot tell an allowlisted host from a blocked one",B.split("\r\n")[0]===E.split("\r\n")[0]),c("Unauthenticated CONNECT does not resolve the destination",0===x,`resolver called ${x} times`);let F=Buffer.from(JSON.stringify({model:"audit-self-test-auth",messages:[]})),G=await P(z.port,A,"",S(t,v)),H=await T({socket:G,ca:aa.certPem,servername:"localhost",port:a.port,body:F,path:"/v1/messages?auth=1"});c("Correct credentials open a working tunnel",H.head.startsWith("HTTP/1.1 200"),H.head.split("\r\n")[0]),c("Authenticated CONNECT does resolve the destination",x>0,`resolver called ${x} times`),await new Promise(a=>setTimeout(a,100));let K=ai.find(a=>String(a.path||"").includes("auth=1"));c("Authenticated tunnel attributes the username on the request event",K?.client?.proxyUser===t,K?.client?.proxyUser||"(none)");let L=ai.find(a=>407===a.status&&a.error&&/Invalid proxy credentials/.test(a.error));c("Failed proxy auth is audited",!!L,L?"":"no 407 event recorded");let R=Buffer.from(`${t}:${v}`).toString("base64"),U=ai.some(a=>{let b=JSON.stringify(a);return b.includes(v)||b.includes(R)});c("No audit event records the proxy credential",!U),c("Proxy-Authorization is redacted in audit events",ai.filter(a=>"proxy-authorization"in(a.request?.headers||{})).every(a=>"[REDACTED]"===a.request.headers["proxy-authorization"])),c("Proxy-Authorization never reaches the origin",ae.every(a=>null==a.proxyAuthorization)),await N(y);let V=Buffer.from(JSON.stringify({model:"audit-self-test-h1",messages:[{role:"user",content:"hello h1 ✓"}]})),W="/v1/messages?beta=true&encoded=%2F",X=await P(b.port,`localhost:${a.port}`),Y=await T({socket:X,ca:aa.certPem,servername:"localhost",port:a.port,body:V,path:W});c("HTTP/1.1 CONNECT and TLS succeeded",Y.head.startsWith("HTTP/1.1 200")),c("HTTP/1.1 compressed response bytes preserved",J(Y.body)===J(ad));let Z=Buffer.from(JSON.stringify({model:"audit-self-test-h2-downgrade",messages:[{role:"user",content:"hello downgrade ✓"}]})),_="/v1/messages?beta=true&protocol=h2-preferred",ac=await P(b.port,`localhost:${a.port}`),af=null,ag=await T({socket:ac,ca:aa.certPem,servername:"localhost",port:a.port,body:Z,path:_,alpnProtocols:["h2","http/1.1"],onAlpn:a=>{af=a}});c("h2-preferring client is downgraded to HTTP/1.1","http/1.1"===af,`negotiated ${af||"none"}`),c("Downgraded client still gets a response",ag.head.startsWith("HTTP/1.1 200")),c("Downgraded compressed response bytes preserved",J(ag.body)===J(ad)),c("HTTP/2 is not advertised while the h2 path is unfixed",aj.auditCapabilities?.http2===!1);let am=Buffer.from(JSON.stringify({model:"audit-self-test-stream-model",messages:[{role:"user",content:"x".repeat(1052672)}]})),an=await P(b.port,`localhost:${a.port}`),ao=await T({socket:an,ca:aa.certPem,servername:"localhost",port:a.port,body:am,path:"/v1/messages?beta=true&stream=1"});c("Streaming response forwarded",ao.head.startsWith("HTTP/1.1 200")),await new Promise(a=>setTimeout(a,100));let ap=ai.find(a=>String(a.path||"").includes("stream=1"));c("Streaming audit event captured",!!ap),c("Token usage extracted from streamed response",ap?.usage?.inputTokens===11&&ap?.usage?.cacheCreationTokens===22&&ap?.usage?.cacheReadTokens===33&&ap?.usage?.outputTokens===44&&ap?.usage?.totalTokens===110,JSON.stringify(ap?.usage||null)),c("Streamed usage marked complete",ap?.usage?.complete===!0&&ap?.usage?.stopReason==="end_turn"),c("Model recovered from response when request body is truncated",ap?.request?.truncated===!0&&ap?.model==="audit-self-test-stream-model"),c("Exchange without token usage reports none",ai.some(a=>String(a.path||"").includes("encoded=")&&null==a.usage));let aq=await P(b.port,`localhost:${a.port}`),ar=await function({socket:a,ca:b,servername:c,port:d,path:e}){return new Promise((f,h)=>{let j=g.connect({socket:a,ca:b,servername:c,rejectUnauthorized:!0,ALPNProtocols:["http/1.1"]}),k=[],l=setTimeout(()=>h(Error("Upgrade test timeout")),1e4);j.once("error",h),j.once("secureConnect",()=>{j.write(`GET ${e} HTTP/1.1\r
 Host: localhost:${d}\r
 Upgrade: websocket\r
 Connection: Upgrade\r
@@ -42,10 +42,10 @@ x-api-key: sk-test-supersecret-123456789\r
 Sec-WebSocket-Key: ${i.randomBytes(16).toString("base64")}\r
 Sec-WebSocket-Version: 13\r
 \r
-`)});let m=()=>{clearTimeout(l),f(Buffer.concat(k).toString("latin1"))};j.on("data",a=>{k.push(Buffer.from(a)),Buffer.concat(k).indexOf("\r\n\r\n")>=0&&m()}),j.on("end",m),j.on("close",m)})}({socket:aq,ca:ac.certPem,servername:"localhost",port:a.port,path:"/v1/messages?transport=websocket"});c("Protocol upgrade is refused, not silently downgraded",ar.startsWith("HTTP/1.1 501"),ar.slice(0,40)),c("Upgrade refusal tells the client what to do instead",/HTTP streaming transport/i.test(ar)),c("Upgrade never reaches the origin",!ag.some(a=>String(a.path||"").includes("transport=websocket"))),await new Promise(a=>setTimeout(a,100)),c("Refused upgrade is still audited",ak.some(a=>501===a.status&&String(a.path||"").includes("transport=websocket")));let as=ak.find(a=>501===a.status&&String(a.path||"").includes("transport=websocket"));c("Refused upgrade is flagged as denied",as?.denied===!0,String(as?.denied)),c("Refused upgrade is not mirrored into prompt_logs","denied"===D(as).reason);let at=ag.find(a=>String(a.path||"").includes("encoded=")),au=ag.find(a=>String(a.path||"").includes("h2-preferred"));c("HTTP/1.1 path/query preserved",at?.path===W),c("Downgraded path/query preserved",au?.path===$),c("HTTP/1.1 request body byte-identical",at&&E(at.body)===E(V)),c("Downgraded request body byte-identical",au&&E(au.body)===E(Z)),c("Authorization preserved on wire",ag.every(a=>"Bearer test-secret-authorization-123456789"===a.authorization)),c("x-api-key preserved on wire",ag.every(a=>"sk-test-supersecret-123456789"===a.apiKey)),c("Internal x-9r-* header stripped",ag.every(a=>null==a.internalHeader));let av=ak.find(a=>String(a.path||"").includes("encoded=")),aw=ak.find(a=>String(a.path||"").includes("h2-preferred"));c("HTTP/1.1 audit event captured",!!av),c("Downgraded audit event captured",!!aw),c("Request wire SHA-256 recorded",av?.request?.wireSha256===E(V)&&aw?.request?.wireSha256===E(Z)),c("Response wire SHA-256 recorded",av?.response?.wireSha256===E(af)&&aw?.response?.wireSha256===E(af)),c("Compressed audit response decoded",av?.response?.body?.includes("compressed response preserved")&&aw?.response?.body?.includes("compressed response preserved"));let ax=D(av);c("Exchange with a prompt is mirrored with both halves",!0===ax.mirror&&ax.promptText?.includes("hello h1")&&ax.responseText?.includes("compressed response preserved"),JSON.stringify({mirror:ax.mirror,prompt:ax.promptText,response:ax.responseText}));let ay={...av,path:"/api/claude_code/telemetry",request:{...av.request,body:JSON.stringify({events:[{eventName:"tengu_api_success",metadata:{durationMs:120}}]})},response:{...av.response,body:JSON.stringify({accepted_count:17,rejected_count:0})}},az=D(ay);c("Telemetry exchange is not mirrored into prompt_logs",!1===az.mirror&&"not-inference"===az.reason,JSON.stringify(az));let aA={...av,path:"/backend-api/ps/plugins/list?scope=GLOBAL",request:{...av.request,body:""},response:{...av.response,body:JSON.stringify({items:[{text:"gmail@openai-curated-remote"}]})}};c("Plugin listing is not mirrored into prompt_logs","not-inference"===D(aA).reason);let aB={...av,request:{...av.request,body:""},response:{...av.response,body:"[br audit body capture truncated; decoded body unavailable]"}};c("Capture placeholder does not count as content","contentless"===D(aB).reason);let aC=ak.filter(a=>"authorization"in(a.request?.headers||{}));c("Authorization redacted in audit",aC.length>0&&aC.every(a=>"[REDACTED]"===a.request.headers.authorization));let aD=ak.filter(a=>"x-api-key"in(a.request?.headers||{}));c("x-api-key redacted in audit",aD.length>0&&aD.every(a=>"[REDACTED]"===a.request.headers["x-api-key"])),c("No likely API secret persisted",ak.length>=2&&ak.every(a=>!m(a)));let aE={allowedHosts:[...al.auditConfig.allowedHosts],clientToolFilterEnabled:al.auditConfig.clientToolFilterEnabled,allowedClientTools:[...al.auditConfig.allowedClientTools||[]]},aF=al.auditConfig.port,aG=al.auditConfig.bindHost;try{let d=`localhost:${a.port}`;al.applyConfig({...al.auditConfig,allowedHosts:[]});let e=await function(a,b,c=""){return new Promise(d=>{let e=f.connect(a,"127.0.0.1"),g="",h=!1,i=()=>{if(!h){h=!0,clearTimeout(j);try{e.destroy()}catch{}d(g)}},j=setTimeout(i,3e3);e.once("error",i),e.once("connect",()=>e.write(`CONNECT ${b} HTTP/1.1\r
+`)});let m=()=>{clearTimeout(l),f(Buffer.concat(k).toString("latin1"))};j.on("data",a=>{k.push(Buffer.from(a)),Buffer.concat(k).indexOf("\r\n\r\n")>=0&&m()}),j.on("end",m),j.on("close",m)})}({socket:aq,ca:aa.certPem,servername:"localhost",port:a.port,path:"/v1/messages?transport=websocket"});c("Protocol upgrade is refused, not silently downgraded",ar.startsWith("HTTP/1.1 501"),ar.slice(0,40)),c("Upgrade refusal tells the client what to do instead",/HTTP streaming transport/i.test(ar)),c("Upgrade never reaches the origin",!ae.some(a=>String(a.path||"").includes("transport=websocket"))),await new Promise(a=>setTimeout(a,100)),c("Refused upgrade is still audited",ai.some(a=>501===a.status&&String(a.path||"").includes("transport=websocket")));let as=ai.find(a=>501===a.status&&String(a.path||"").includes("transport=websocket"));c("Refused upgrade is flagged as denied",as?.denied===!0,String(as?.denied)),c("Refused upgrade is not mirrored into prompt_logs","denied"===I(as).reason);let at=ae.find(a=>String(a.path||"").includes("encoded=")),au=ae.find(a=>String(a.path||"").includes("h2-preferred"));c("HTTP/1.1 path/query preserved",at?.path===W),c("Downgraded path/query preserved",au?.path===_),c("HTTP/1.1 request body byte-identical",at&&J(at.body)===J(V)),c("Downgraded request body byte-identical",au&&J(au.body)===J(Z)),c("Authorization preserved on wire",ae.every(a=>"Bearer test-secret-authorization-123456789"===a.authorization)),c("x-api-key preserved on wire",ae.every(a=>"sk-test-supersecret-123456789"===a.apiKey)),c("Internal x-9r-* header stripped",ae.every(a=>null==a.internalHeader));let av=ai.find(a=>String(a.path||"").includes("encoded=")),aw=ai.find(a=>String(a.path||"").includes("h2-preferred"));c("HTTP/1.1 audit event captured",!!av),c("Downgraded audit event captured",!!aw),c("Request wire SHA-256 recorded",av?.request?.wireSha256===J(V)&&aw?.request?.wireSha256===J(Z)),c("Response wire SHA-256 recorded",av?.response?.wireSha256===J(ad)&&aw?.response?.wireSha256===J(ad)),c("Compressed audit response decoded",av?.response?.body?.includes("compressed response preserved")&&aw?.response?.body?.includes("compressed response preserved"));let ax=I(av);c("Exchange with a prompt is mirrored with both halves",!0===ax.mirror&&ax.promptText?.includes("hello h1")&&ax.responseText?.includes("compressed response preserved"),JSON.stringify({mirror:ax.mirror,prompt:ax.promptText,response:ax.responseText}));let ay={...av,path:"/api/claude_code/telemetry",request:{...av.request,body:JSON.stringify({events:[{eventName:"tengu_api_success",metadata:{durationMs:120}}]})},response:{...av.response,body:JSON.stringify({accepted_count:17,rejected_count:0})}},az=I(ay);c("Telemetry exchange is not mirrored into prompt_logs",!1===az.mirror&&"not-inference"===az.reason,JSON.stringify(az));let aA={...av,path:"/backend-api/ps/plugins/list?scope=GLOBAL",request:{...av.request,body:""},response:{...av.response,body:JSON.stringify({items:[{text:"gmail@openai-curated-remote"}]})}};c("Plugin listing is not mirrored into prompt_logs","not-inference"===I(aA).reason);let aB={...av,request:{...av.request,body:""},response:{...av.response,body:"[br audit body capture truncated; decoded body unavailable]"}};c("Capture placeholder does not count as content","contentless"===I(aB).reason);let aC=ai.filter(a=>"authorization"in(a.request?.headers||{}));c("Authorization redacted in audit",aC.length>0&&aC.every(a=>"[REDACTED]"===a.request.headers.authorization));let aD=ai.filter(a=>"x-api-key"in(a.request?.headers||{}));c("x-api-key redacted in audit",aD.length>0&&aD.every(a=>"[REDACTED]"===a.request.headers["x-api-key"])),c("No likely API secret persisted",ai.length>=2&&ai.every(a=>!m(a)));let aE={allowedHosts:[...aj.auditConfig.allowedHosts],clientToolFilterEnabled:aj.auditConfig.clientToolFilterEnabled,allowedClientTools:[...aj.auditConfig.allowedClientTools||[]]},aF=aj.auditConfig.port,aG=aj.auditConfig.bindHost;try{let d=`localhost:${a.port}`;aj.applyConfig({...aj.auditConfig,allowedHosts:[]});let e=await function(a,b,c=""){return new Promise(d=>{let e=f.connect(a,"127.0.0.1"),g="",h=!1,i=()=>{if(!h){h=!0,clearTimeout(j);try{e.destroy()}catch{}d(g)}},j=setTimeout(i,3e3);e.once("error",i),e.once("connect",()=>e.write(`CONNECT ${b} HTTP/1.1\r
 Host: ${b}\r
 ${c}\r
-`)),e.on("data",a=>{g+=a.toString("utf8")}),e.on("close",i)})}(b.port,d);c("Removing a host from the allowlist applies with no restart",/HTTP\/1\.1 403\b/.test(e),JSON.stringify(e.slice(0,120))),al.applyConfig({...al.auditConfig,allowedHosts:["localhost"]});let g=await K(b.port,d).catch(a=>a);c("Re-adding it works on the next CONNECT",!(g instanceof Error),g instanceof Error?g.message:""),g?.destroy?.(),al.applyConfig({...al.auditConfig,clientToolFilterEnabled:!0,allowedClientTools:p(["claude-code"])});let h=await L(b.port,d,"User-Agent: Mozilla/5.0 Chrome/131.0\r\n");c("Turning the tool filter on applies with no restart",/HTTP\/1\.1 403\b/.test(h),JSON.stringify(h.slice(0,120))),al.applyConfig({...al.auditConfig,clientToolFilterEnabled:!1,allowedClientTools:[]});let i=await K(b.port,d,"Mozilla/5.0 Chrome/131.0").catch(a=>a);c("Turning it off applies with no restart",!(i instanceof Error),i instanceof Error?i.message:""),i?.destroy?.(),al.applyConfig({...al.auditConfig,captureLimitBytes:4096}),c("Capture limit is updated in place",4096===al.auditConfig.captureLimitBytes);let j=al.applyConfig({...al.auditConfig,port:b.port+1,bindHost:"0.0.0.0"});c("A listener address/port change is reported as pending, not applied",!0===j.rebindRequired&&j.pending.port===b.port+1&&"0.0.0.0"===j.pending.bindHost,JSON.stringify(j.pending)),c("The bound listener is left alone by applyConfig",al.auditConfig.port===aF&&al.auditConfig.bindHost===aG&&!0===al.listening,`${al.auditConfig.port}/${al.auditConfig.bindHost} vs ${aF}/${aG}`);let k=await K(b.port,d).catch(a=>a);c("Traffic keeps flowing on the address that is bound",!(k instanceof Error),k instanceof Error?k.message:""),k?.destroy?.()}finally{al.applyConfig({...al.auditConfig,...aE})}am=k({allowedHosts:["localhost"],passthroughUnknown:!1,captureBodies:!0,captureLimitBytes:1048576,verifyUpstreamTls:!0,allowedConnectPorts:[a.port],connectTimeoutMs:5e3,tlsHandshakeTimeoutMs:5e3,responseHeaderTimeoutMs:5e3,idleTimeoutMs:3e4},{certificateProvider:()=>ad,upstreamCa:aa.certPem,resolveTarget:J,onAudit:()=>{throw Error("simulated audit sink failure")}});let aH=await H(am),aI=await K(aH.port,`localhost:${a.port}`),aJ=await O({socket:aI,ca:ac.certPem,servername:"localhost",port:a.port,body:V,path:W});c("Audit sink failure does not fail proxied request",aJ.head.startsWith("HTTP/1.1 200"))}catch(a){c("Self-test execution",!1,a.message||String(a))}finally{await I(am),await I(al),await I(aj)}return{ok:b.length>0&&b.every(a=>a.ok),checks:b,passed:b.filter(a=>a.ok).length,total:b.length,durationMs:Date.now()-a}}}},85463:(a,b,c)=>{let{validateConfig:d}=c(43096),e=["accessGrants","allowedHosts","clientToolFilterEnabled","allowedClientTools","captureBodies","captureLimitBytes","passthroughUnknown","retentionDays"],f=["enabled","bindHost","port","clientProxyHost","proxyAuthEnabled","proxyAuthUsers"];function g(a={}){let b={};for(let c of e)void 0!==a[c]&&(b[c]=Array.isArray(a[c])?[...a[c]]:a[c]);return b}a.exports={POLICY_FIELDS:e,NODE_LOCAL_FIELDS:f,SETTINGS_KEY:"auditProxyPolicy",extractAuditPolicy:g,mergeAuditPolicy:function(a={},b={}){let c={...a};for(let a of e)void 0!==b[a]&&(c[a]=b[a]);for(let b of f)c[b]=a[b];return d(c)},policyEquals:function(a={},b={}){return JSON.stringify(g(a))===JSON.stringify(g(b))}}},86455:a=>{function b(a){let b=Number(a);return!Number.isFinite(b)||b<0?0:Math.round(b)}function c(){return{inputTokens:0,outputTokens:0,cacheReadTokens:0,cacheCreationTokens:0,reasoningTokens:0,totalTokens:0,model:null,stopReason:null,streaming:!1,complete:!1,source:null}}function d(a){let b=String(a||"").trim();if(!b||"{"!==b[0])return null;try{let a=JSON.parse(b);return a&&"object"==typeof a&&!Array.isArray(a)?a:null}catch{return null}}function e(a,c){"string"==typeof c.model&&c.model&&!a.model&&(a.model=c.model);let d="response.completed"===c.type||"response.done"===c.type?c.response?.usage:null,e=d||c.usage;if(!e||"object"!=typeof e)return!1;d&&"string"==typeof c.response?.model&&c.response.model&&(a.model=c.response.model);let f=b(e.prompt_tokens??e.input_tokens),g=b(e.completion_tokens??e.output_tokens);if(!f&&!g)return!1;let h=b(e.prompt_tokens_details?.cached_tokens??e.input_tokens_details?.cached_tokens??e.cached_tokens??e.prompt_cache_hit_tokens);a.inputTokens=Math.max(0,f-h),a.cacheReadTokens=h,a.outputTokens=g,a.reasoningTokens=b(e.completion_tokens_details?.reasoning_tokens??e.output_tokens_details?.reasoning_tokens),a.complete=!0;let i=c.choices?.[0]?.finish_reason;return"string"==typeof i&&i&&(a.stopReason=i),!0}function f(a,f){let g=c();g.streaming=!0,g.source="sse";let h=!1;for(let c of function*(a){let b=String(a||""),c=0;for(;c<b.length;){let a=b.indexOf("\n",c);-1===a&&(a=b.length);let e=b.slice(c,a).trim();if(c=a+1,!e.startsWith("data:"))continue;let f=e.slice(5).trim();if(!f||"[DONE]"===f)continue;let g=d(f);g&&(yield g)}}(a)){if(("anthropic"===f||"message_start"===c.type||"message_delta"===c.type)&&function(a,c){let d=String(c.type||"");if("message_start"===d&&c.message&&"object"==typeof c.message){let d=c.message;"string"==typeof d.model&&d.model&&(a.model=d.model);let e=d.usage;return e&&"object"==typeof e&&(a.inputTokens=b(e.input_tokens)||a.inputTokens,a.cacheReadTokens=b(e.cache_read_input_tokens)||a.cacheReadTokens,a.cacheCreationTokens=b(e.cache_creation_input_tokens)||a.cacheCreationTokens),!0}if("message_delta"===d){let d=c.usage;d&&"object"==typeof d&&(a.outputTokens=b(d.output_tokens)||a.outputTokens,a.inputTokens=a.inputTokens||b(d.input_tokens),a.cacheReadTokens=a.cacheReadTokens||b(d.cache_read_input_tokens),a.cacheCreationTokens=a.cacheCreationTokens||b(d.cache_creation_input_tokens),a.complete=!0);let e=c.delta?.stop_reason;return"string"==typeof e&&e&&(a.stopReason=e),!0}return!1}(g,c)){h=!0;continue}e(g,c)&&(h=!0)}return h?g:null}function g(a){let f=d(a);if(!f)return null;let g=c();g.source="json","string"==typeof f.model&&f.model&&(g.model=f.model);let h=f.usage;return h&&"object"==typeof h?null!=h.input_tokens||null!=h.output_tokens?(g.inputTokens=b(h.input_tokens),g.outputTokens=b(h.output_tokens),g.cacheReadTokens=b(h.cache_read_input_tokens),g.cacheCreationTokens=b(h.cache_creation_input_tokens),g.complete=!0,"string"==typeof f.stop_reason&&(g.stopReason=f.stop_reason),g):e(g,f)?g:null:null}function h(a){return/\/count_tokens\b/.test(String(a||""))}function i(a){return a.inputTokens+a.cacheReadTokens+a.cacheCreationTokens}a.exports={extractUsageFromBody:function({provider:a,body:b,contentType:c="",path:d=""}={}){if("string"!=typeof b||!b||b.length>0x1000000||h(d))return null;let e=/event-stream/i.test(String(c||""))||b.includes("\ndata:")||b.startsWith("data:")?f(b,a)||g(b):g(b)||f(b,a);return e&&(e&&(e.inputTokens||e.outputTokens||e.cacheReadTokens||e.cacheCreationTokens)||e.model)?(e.totalTokens=e.inputTokens+e.outputTokens+e.cacheReadTokens+e.cacheCreationTokens,e):null},isTokenCountingEndpoint:h,toTokensJson:function(a){if(!a)return null;let b=i(a),c={input_tokens:a.inputTokens,output_tokens:a.outputTokens,prompt_tokens:b,completion_tokens:a.outputTokens,total_tokens:a.totalTokens,display_total_input_tokens:b,display_new_input_tokens:a.inputTokens,display_cached_input_tokens:a.cacheReadTokens,display_cache_creation_input_tokens:a.cacheCreationTokens,display_output_tokens:a.outputTokens};return a.cacheReadTokens&&(c.cache_read_input_tokens=a.cacheReadTokens),a.cacheCreationTokens&&(c.cache_creation_input_tokens=a.cacheCreationTokens),a.cacheReadTokens&&(c.cached_tokens=a.cacheReadTokens),a.reasoningTokens&&(c.reasoning_tokens=a.reasoningTokens),c},totalInputTokens:i}},90173:(a,b,c)=>{let d=c(29021),e=c(33873),f=c(4984),g=c(55511),{AUDIT_LOG_PATH:h,AUDIT_LOG_DIR:i,ensureAuditDir:j,loadConfig:k}=c(43096),{redactObject:l,scrubString:m}=c(48350),{toTokensJson:n,totalInputTokens:o}=c(86455),{publishRecentUsage:p}=c(87662),q="audit-proxy",r="client",s="provider_response",t=/\/(?:messages|responses|chat\/completions)$|generatecontent$/i,u={expiresAt:0,config:null},v=null,w=null,x=null,y=null,z=null,A=null,B="",C=Promise.resolve(),D=Promise.resolve(),E=0,F=null,G=new Map,H={queue:[],workers:new Set,activeWorkers:0,clearing:!1,enqueued:0,written:0,dropped:0,failed:0,mysqlWritten:0,mysqlFailed:0,mysqlSkipped:0,mysqlSkippedByReason:{},usageWritten:0,usageFailed:0,tokensSeen:0,lastError:null,lastWrittenAt:null};function I(a){let b=Date.now();b-E<6e4||(E=b,console.warn(`[AuditProxy][PromptDB] ${a}`))}function J(a){H.lastError=String(a||"Audit store failure"),console.warn(`[AuditProxy][Store] ${H.lastError}`)}async function K(){let a=Date.now();if(u.expiresAt>a)return u.config;v||(v=Promise.resolve().then(c.bind(c,45903)));let b=await v,d=await b.getPromptLogDbConfig();return u={expiresAt:a+5e3,config:d},d}async function L(){return w||(w=c.e(2661).then(c.bind(c,12661))),w}async function M(a){let b=g.createHash("sha256").update(JSON.stringify({host:a.host,port:Number(a.port||3306),database:a.database,username:a.username,password:a.password,ssl:!!a.ssl})).digest("hex");if(A&&B===b)return A;let d=C.then(async()=>{if(A&&B===b)return A;if(A){try{await A.end()}catch{}A=null,B=""}let d=await c.e(8491).then(c.t.bind(c,38491,19)),e=(d.default||d).createPool({host:a.host,port:Number(a.port||3306),database:a.database,user:a.username,password:a.password,ssl:a.ssl?{rejectUnauthorized:!0}:void 0,connectTimeout:3e3,waitForConnections:!0,connectionLimit:4,maxIdle:4,idleTimeout:6e4,queueLimit:100,enableKeepAlive:!0,keepAliveInitialDelay:3e4});return A=e,B=b,e});return C=d.then(()=>void 0,()=>void 0),d}function N(a){let b=a?new Date(a):new Date;return(Number.isNaN(b.getTime())?new Date:b).toISOString().replace("T"," ").replace("Z","")}function O(a){if("string"!=typeof a)return a;let b=a.trim();if(!b||!b.startsWith("{")&&!b.startsWith("["))return a;try{return JSON.parse(b)}catch{return a}}function P(a,b=0,c=[]){if(null==a||b>12||c.join("\n").length>=2e5)return c;if("string"==typeof a)return a.trim()&&c.push(a.trim()),c;if(Array.isArray(a)){for(let d of a)P(d,b+1,c);return c}if("object"!=typeof a)return c;for(let[d,e]of Object.entries(a)){let a=d.toLowerCase();["content","text","prompt","input","message","output_text"].includes(a)?P(e,b+1,c):b<8&&["messages","contents","parts","body","request","payload","response","choices","output","item","items"].includes(a)&&P(e,b+1,c)}return c}function Q(a){if("string"!=typeof a)return!1;let b=a.trim();return!!b&&!/^\[[^\]]*\]$/.test(b)}function R(a){let b=String(a||"").toLowerCase();return b.includes("claude")?{tool:"claude-code",label:"Claude Code"}:b.includes("codex")?{tool:"codex",label:"Codex"}:{tool:"audit-proxy",label:"Enterprise AI Audit Proxy"}}async function S(a){if(!a)return null;let b=g.createHash("sha256").update(a).digest("hex"),c=Buffer.byteLength(String(a||""),"utf8"),d=await L();return await d.writePayloadFile(b,a),{payloadHash:b,payloadSizeBytes:c}}async function T(a,b,c,d){if(!c)return null;let{payloadHash:e,payloadSizeBytes:f}=c;return await a.query(`INSERT INTO prompt_log_payloads (
+`)),e.on("data",a=>{g+=a.toString("utf8")}),e.on("close",i)})}(b.port,d);c("Removing a host from the allowlist applies with no restart",/HTTP\/1\.1 403\b/.test(e),JSON.stringify(e.slice(0,120))),aj.applyConfig({...aj.auditConfig,allowedHosts:["localhost"]});let g=await P(b.port,d).catch(a=>a);c("Re-adding it works on the next CONNECT",!(g instanceof Error),g instanceof Error?g.message:""),g?.destroy?.(),aj.applyConfig({...aj.auditConfig,clientToolFilterEnabled:!0,allowedClientTools:p(["claude-code"])});let h=await Q(b.port,d,"User-Agent: Mozilla/5.0 Chrome/131.0\r\n");c("Turning the tool filter on applies with no restart",/HTTP\/1\.1 403\b/.test(h),JSON.stringify(h.slice(0,120))),aj.applyConfig({...aj.auditConfig,clientToolFilterEnabled:!1,allowedClientTools:[]});let i=await P(b.port,d,"Mozilla/5.0 Chrome/131.0").catch(a=>a);c("Turning it off applies with no restart",!(i instanceof Error),i instanceof Error?i.message:""),i?.destroy?.(),aj.applyConfig({...aj.auditConfig,captureLimitBytes:4096}),c("Capture limit is updated in place",4096===aj.auditConfig.captureLimitBytes);let j=aj.applyConfig({...aj.auditConfig,port:b.port+1,bindHost:"0.0.0.0"});c("A listener address/port change is reported as pending, not applied",!0===j.rebindRequired&&j.pending.port===b.port+1&&"0.0.0.0"===j.pending.bindHost,JSON.stringify(j.pending)),c("The bound listener is left alone by applyConfig",aj.auditConfig.port===aF&&aj.auditConfig.bindHost===aG&&!0===aj.listening,`${aj.auditConfig.port}/${aj.auditConfig.bindHost} vs ${aF}/${aG}`);let k=await P(b.port,d).catch(a=>a);c("Traffic keeps flowing on the address that is bound",!(k instanceof Error),k instanceof Error?k.message:""),k?.destroy?.()}finally{aj.applyConfig({...aj.auditConfig,...aE})}ak=k({allowedHosts:["localhost"],passthroughUnknown:!1,captureBodies:!0,captureLimitBytes:1048576,verifyUpstreamTls:!0,allowedConnectPorts:[a.port],connectTimeoutMs:5e3,tlsHandshakeTimeoutMs:5e3,responseHeaderTimeoutMs:5e3,idleTimeoutMs:3e4},{certificateProvider:()=>ab,upstreamCa:$.certPem,resolveTarget:O,onAudit:()=>{throw Error("simulated audit sink failure")}});let aH=await M(ak),aI=await P(aH.port,`localhost:${a.port}`),aJ=await T({socket:aI,ca:aa.certPem,servername:"localhost",port:a.port,body:V,path:W});c("Audit sink failure does not fail proxied request",aJ.head.startsWith("HTTP/1.1 200"))}catch(a){c("Self-test execution",!1,a.message||String(a))}finally{await N(ak),await N(aj),await N(ah)}return{ok:b.length>0&&b.every(a=>a.ok),checks:b,passed:b.filter(a=>a.ok).length,total:b.length,durationMs:Date.now()-a}}}},85463:(a,b,c)=>{let{validateConfig:d}=c(43096),e=["accessGrants","allowedHosts","clientToolFilterEnabled","allowedClientTools","captureBodies","captureLimitBytes","passthroughUnknown","retentionDays","sessionIdleTimeoutMs"],f=["enabled","bindHost","port","clientProxyHost","proxyAuthEnabled","proxyAuthUsers"];function g(a={}){let b={};for(let c of e)void 0!==a[c]&&(b[c]=Array.isArray(a[c])?[...a[c]]:a[c]);return b}a.exports={POLICY_FIELDS:e,NODE_LOCAL_FIELDS:f,SETTINGS_KEY:"auditProxyPolicy",extractAuditPolicy:g,mergeAuditPolicy:function(a={},b={}){let c={...a};for(let a of e)void 0!==b[a]&&(c[a]=b[a]);for(let b of f)c[b]=a[b];return d(c)},policyEquals:function(a={},b={}){return JSON.stringify(g(a))===JSON.stringify(g(b))}}},86455:a=>{function b(a){let b=Number(a);return!Number.isFinite(b)||b<0?0:Math.round(b)}function c(){return{inputTokens:0,outputTokens:0,cacheReadTokens:0,cacheCreationTokens:0,reasoningTokens:0,totalTokens:0,model:null,stopReason:null,streaming:!1,complete:!1,source:null}}function d(a){let b=String(a||"").trim();if(!b||"{"!==b[0])return null;try{let a=JSON.parse(b);return a&&"object"==typeof a&&!Array.isArray(a)?a:null}catch{return null}}function e(a,c){"string"==typeof c.model&&c.model&&!a.model&&(a.model=c.model);let d="response.completed"===c.type||"response.done"===c.type?c.response?.usage:null,e=d||c.usage;if(!e||"object"!=typeof e)return!1;d&&"string"==typeof c.response?.model&&c.response.model&&(a.model=c.response.model);let f=b(e.prompt_tokens??e.input_tokens),g=b(e.completion_tokens??e.output_tokens);if(!f&&!g)return!1;let h=b(e.prompt_tokens_details?.cached_tokens??e.input_tokens_details?.cached_tokens??e.cached_tokens??e.prompt_cache_hit_tokens);a.inputTokens=Math.max(0,f-h),a.cacheReadTokens=h,a.outputTokens=g,a.reasoningTokens=b(e.completion_tokens_details?.reasoning_tokens??e.output_tokens_details?.reasoning_tokens),a.complete=!0;let i=c.choices?.[0]?.finish_reason;return"string"==typeof i&&i&&(a.stopReason=i),!0}function f(a,f){let g=c();g.streaming=!0,g.source="sse";let h=!1;for(let c of function*(a){let b=String(a||""),c=0;for(;c<b.length;){let a=b.indexOf("\n",c);-1===a&&(a=b.length);let e=b.slice(c,a).trim();if(c=a+1,!e.startsWith("data:"))continue;let f=e.slice(5).trim();if(!f||"[DONE]"===f)continue;let g=d(f);g&&(yield g)}}(a)){if(("anthropic"===f||"message_start"===c.type||"message_delta"===c.type)&&function(a,c){let d=String(c.type||"");if("message_start"===d&&c.message&&"object"==typeof c.message){let d=c.message;"string"==typeof d.model&&d.model&&(a.model=d.model);let e=d.usage;return e&&"object"==typeof e&&(a.inputTokens=b(e.input_tokens)||a.inputTokens,a.cacheReadTokens=b(e.cache_read_input_tokens)||a.cacheReadTokens,a.cacheCreationTokens=b(e.cache_creation_input_tokens)||a.cacheCreationTokens),!0}if("message_delta"===d){let d=c.usage;d&&"object"==typeof d&&(a.outputTokens=b(d.output_tokens)||a.outputTokens,a.inputTokens=a.inputTokens||b(d.input_tokens),a.cacheReadTokens=a.cacheReadTokens||b(d.cache_read_input_tokens),a.cacheCreationTokens=a.cacheCreationTokens||b(d.cache_creation_input_tokens),a.complete=!0);let e=c.delta?.stop_reason;return"string"==typeof e&&e&&(a.stopReason=e),!0}return!1}(g,c)){h=!0;continue}e(g,c)&&(h=!0)}return h?g:null}function g(a){let f=d(a);if(!f)return null;let g=c();g.source="json","string"==typeof f.model&&f.model&&(g.model=f.model);let h=f.usage;return h&&"object"==typeof h?null!=h.input_tokens||null!=h.output_tokens?(g.inputTokens=b(h.input_tokens),g.outputTokens=b(h.output_tokens),g.cacheReadTokens=b(h.cache_read_input_tokens),g.cacheCreationTokens=b(h.cache_creation_input_tokens),g.complete=!0,"string"==typeof f.stop_reason&&(g.stopReason=f.stop_reason),g):e(g,f)?g:null:null}function h(a){return/\/count_tokens\b/.test(String(a||""))}function i(a){return a.inputTokens+a.cacheReadTokens+a.cacheCreationTokens}a.exports={extractUsageFromBody:function({provider:a,body:b,contentType:c="",path:d=""}={}){if("string"!=typeof b||!b||b.length>0x1000000||h(d))return null;let e=/event-stream/i.test(String(c||""))||b.includes("\ndata:")||b.startsWith("data:")?f(b,a)||g(b):g(b)||f(b,a);return e&&(e&&(e.inputTokens||e.outputTokens||e.cacheReadTokens||e.cacheCreationTokens)||e.model)?(e.totalTokens=e.inputTokens+e.outputTokens+e.cacheReadTokens+e.cacheCreationTokens,e):null},isTokenCountingEndpoint:h,toTokensJson:function(a){if(!a)return null;let b=i(a),c={input_tokens:a.inputTokens,output_tokens:a.outputTokens,prompt_tokens:b,completion_tokens:a.outputTokens,total_tokens:a.totalTokens,display_total_input_tokens:b,display_new_input_tokens:a.inputTokens,display_cached_input_tokens:a.cacheReadTokens,display_cache_creation_input_tokens:a.cacheCreationTokens,display_output_tokens:a.outputTokens};return a.cacheReadTokens&&(c.cache_read_input_tokens=a.cacheReadTokens),a.cacheCreationTokens&&(c.cache_creation_input_tokens=a.cacheCreationTokens),a.cacheReadTokens&&(c.cached_tokens=a.cacheReadTokens),a.reasoningTokens&&(c.reasoning_tokens=a.reasoningTokens),c},totalInputTokens:i}},90173:(a,b,c)=>{let d=c(29021),e=c(33873),f=c(4984),g=c(55511),{AUDIT_LOG_PATH:h,AUDIT_LOG_DIR:i,ensureAuditDir:j,loadConfig:k}=c(43096),{redactObject:l,scrubString:m}=c(48350),{toTokensJson:n,totalInputTokens:o}=c(86455),{publishRecentUsage:p}=c(87662),q="audit-proxy",r="client",s="provider_response",t=/\/(?:messages|responses|chat\/completions)$|generatecontent$/i,u={expiresAt:0,config:null},v=null,w=null,x=null,y=null,z=null,A=null,B="",C=Promise.resolve(),D=Promise.resolve(),E=0,F=null,G=new Map,H={queue:[],workers:new Set,activeWorkers:0,clearing:!1,enqueued:0,written:0,dropped:0,failed:0,mysqlWritten:0,mysqlFailed:0,mysqlSkipped:0,mysqlSkippedByReason:{},usageWritten:0,usageFailed:0,tokensSeen:0,lastError:null,lastWrittenAt:null};function I(a){let b=Date.now();b-E<6e4||(E=b,console.warn(`[AuditProxy][PromptDB] ${a}`))}function J(a){H.lastError=String(a||"Audit store failure"),console.warn(`[AuditProxy][Store] ${H.lastError}`)}async function K(){let a=Date.now();if(u.expiresAt>a)return u.config;v||(v=Promise.resolve().then(c.bind(c,45903)));let b=await v,d=await b.getPromptLogDbConfig();return u={expiresAt:a+5e3,config:d},d}async function L(){return w||(w=c.e(2661).then(c.bind(c,12661))),w}async function M(a){let b=g.createHash("sha256").update(JSON.stringify({host:a.host,port:Number(a.port||3306),database:a.database,username:a.username,password:a.password,ssl:!!a.ssl})).digest("hex");if(A&&B===b)return A;let d=C.then(async()=>{if(A&&B===b)return A;if(A){try{await A.end()}catch{}A=null,B=""}let d=await c.e(8491).then(c.t.bind(c,38491,19)),e=(d.default||d).createPool({host:a.host,port:Number(a.port||3306),database:a.database,user:a.username,password:a.password,ssl:a.ssl?{rejectUnauthorized:!0}:void 0,connectTimeout:3e3,waitForConnections:!0,connectionLimit:4,maxIdle:4,idleTimeout:6e4,queueLimit:100,enableKeepAlive:!0,keepAliveInitialDelay:3e4});return A=e,B=b,e});return C=d.then(()=>void 0,()=>void 0),d}function N(a){let b=a?new Date(a):new Date;return(Number.isNaN(b.getTime())?new Date:b).toISOString().replace("T"," ").replace("Z","")}function O(a){if("string"!=typeof a)return a;let b=a.trim();if(!b||!b.startsWith("{")&&!b.startsWith("["))return a;try{return JSON.parse(b)}catch{return a}}function P(a,b=0,c=[]){if(null==a||b>12||c.join("\n").length>=2e5)return c;if("string"==typeof a)return a.trim()&&c.push(a.trim()),c;if(Array.isArray(a)){for(let d of a)P(d,b+1,c);return c}if("object"!=typeof a)return c;for(let[d,e]of Object.entries(a)){let a=d.toLowerCase();["content","text","prompt","input","message","output_text"].includes(a)?P(e,b+1,c):b<8&&["messages","contents","parts","body","request","payload","response","choices","output","item","items"].includes(a)&&P(e,b+1,c)}return c}function Q(a){if("string"!=typeof a)return!1;let b=a.trim();return!!b&&!/^\[[^\]]*\]$/.test(b)}function R(a){let b=String(a||"").toLowerCase();return b.includes("claude")?{tool:"claude-code",label:"Claude Code"}:b.includes("codex")?{tool:"codex",label:"Codex"}:{tool:"audit-proxy",label:"Enterprise AI Audit Proxy"}}async function S(a){if(!a)return null;let b=g.createHash("sha256").update(a).digest("hex"),c=Buffer.byteLength(String(a||""),"utf8"),d=await L();return await d.writePayloadFile(b,a),{payloadHash:b,payloadSizeBytes:c}}async function T(a,b,c,d){if(!c)return null;let{payloadHash:e,payloadSizeBytes:f}=c;return await a.query(`INSERT INTO prompt_log_payloads (
       payload_hash, created_at, last_seen_at, content_type, payload_size_bytes, ref_count, payload_json
     ) VALUES (?, ?, ?, ?, ?, 1, NULL)
     ON DUPLICATE KEY UPDATE

package/app/.next-cli-build/server/chunks/9905.js

@@ -1 +1 @@
-"use strict";exports.id=9905,exports.ids=[9905],exports.modules={9588:(a,b,c)=>{c.d(b,{Cy:()=>i,Gk:()=>l,I8:()=>k,Tv:()=>v,UX:()=>p,aV:()=>o,bz:()=>r,hH:()=>u,ny:()=>s,oW:()=>t,s0:()=>m,ub:()=>n,vZ:()=>q});var d=c(65573),e=c(23211),f=c(89718),g=c(33792),h=c(90389);let i="dashboard_view_mode";function j(a){return String(a||"").trim().toLowerCase()}function k(a){return j(a)}function l(a={}){return[a.ldapUsername,a.ldapEmail,a.ldapName,a.oidcEmail,a.oidcName,a.localUsername,a.username,a.email].map(j).filter(Boolean)}function m(a={}){let b=l(a),c=b[0]||"local",d=a.ldapName||a.ldapEmail||a.oidcName||a.oidcEmail||a.localUsername||c;return{userId:c,displayName:d,loginMethod:a.oidc?"OIDC":a.ldap?"LDAP":"Local",candidates:b}}function n(a={},b={}){var c;if(!b?.authenticated)return!1;if(b.local||!b.ldap&&!b.oidc||b.role===h.hS.ADMIN||!0===b.ldapIsAdmin)return!0;let d=Array.isArray(c=a.ldapAllowedUsers)?c.map(j).filter(Boolean):String(c||"").split(/[,\n]/).map(j).filter(Boolean);return 0!==d.length&&l(b).some(a=>d.includes(a))}function o(a={},b={}){return!(!b?.authenticated||n(a,b))&&(b.role===h.hS.MONITOR_ADMIN||!0===b.ldapIsMonitorAdmin)}function p(a={},b={}){return!(!b?.authenticated||n(a,b)||o(a,b))&&(b.role===h.hS.AI_GATEWAYS_MONITOR||!0===b.ldapIsAiGatewaysMonitor)}function q(a={},b={}){return b?.authenticated?n(a,b)?h.hS.ADMIN:o(a,b)?h.hS.MONITOR_ADMIN:p(a,b)?h.hS.AI_GATEWAYS_MONITOR:h.hS.USER:h.hS.GUEST}function r(a={}){return!0===a.isAdmin||!0===a.isMonitorAdmin}async function s(){let a=await (0,f.getSettings)(),b=await (0,d.UL)(),c=await (0,g.dY)(b.get("auth_token")?.value);if(!c?.authenticated)return{authenticated:!1,isAdmin:!1,actualIsAdmin:!1,showAsUser:!1,canToggleUserMode:!1,isMonitorAdmin:!1,isAiGatewaysMonitor:!1,role:h.hS.GUEST,actualRole:h.hS.GUEST,userId:"",displayName:"Guest",loginMethod:"None",settings:{...a,requireLogin:!0},session:null};let e=m(c||{}),j=q(a,c||{}),k=j===h.hS.ADMIN,l=k&&b.get(i)?.value==="user",n=l?h.hS.USER:j,o=n===h.hS.ADMIN,p=n===h.hS.MONITOR_ADMIN,r=n===h.hS.AI_GATEWAYS_MONITOR;return{authenticated:!0,isAdmin:o,actualIsAdmin:k,showAsUser:l,canToggleUserMode:k,isMonitorAdmin:p,isAiGatewaysMonitor:r,role:n,actualRole:j,canManageApiKeys:o||p,canUseMonitorAdminTabs:o||p,canViewAllAnalytics:o||p||r,...e,settings:{...a,requireLogin:!0},session:c}}async function t(){let a=await s();return a.authenticated?{access:a,response:null}:{access:a,response:e.NextResponse.json({error:"Authentication required"},{status:401})}}async function u(a={}){let{allowMonitorAdmin:b=!1}=a||{},{access:c,response:d}=await t();return d?{access:c,response:d}:c.isAdmin||b&&c.isMonitorAdmin?{access:c,response:null}:{access:c,response:e.NextResponse.json({error:"Admin access required"},{status:403})}}function v(a,b){if(!a?.authenticated||!b)return!1;if(r(a))return!0;let c=j(a.userId),d=j(b.ownerUser),e=j(b.createdByUser);return!!c&&(d===c||e===c)}},17509:(a,b,c)=>{c.d(b,{V:()=>o});var d=c(91356),e=c(80700),f=c(99129),g=c(73575),h=c(41570),i=c(19035),j=c(44893),k=c(69052);async function l(a,b,c){let l,{protected:m,header:n,payload:o}=a,p={};if(m&&(p=(0,h.OX)(m,f.Ye,"JWS Protected Header is invalid")),void 0!==n){if(!(0,i.fz)(p,n))throw new f.Ye("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");l={...p,...n}}else l=p;let q=(0,j.nI)(f.Ye,j.qc,b[1],p,l),r=!0;if(q.includes("b64")&&"boolean"!=typeof(r=p.b64))throw new f.Ye('The "b64" (base64url-encode payload) Header Parameter must be a boolean');let{alg:s}=l;if("string"!=typeof s||!s)throw new f.Ye('JWS "alg" (Algorithm) Header Parameter missing or invalid');if(b[0]&&!b[0].has(s))throw new f.Rb('"alg" (Algorithm) Header Parameter value not allowed');if(r){if("string"!=typeof o)throw new f.Ye("JWS Payload must be a string")}else if("string"!=typeof o&&!(o instanceof Uint8Array))throw new f.Ye("JWS Payload must be a string or an Uint8Array instance");let t=!1;"function"==typeof c&&(c=await c(p,a),t=!0);let u=(0,e.q)(s),v=(0,g.xW)(void 0!==m?(0,g.lF)(m):new Uint8Array,(0,g.lF)("."),"string"==typeof o?r?b[2]??=(0,h.Fo)(o,"payload",f.Ye):g.Rd.encode(o):o),w=(0,h.h2)(a.signature,"signature",f.Ye),x=await (0,k.d)(u,c,"verify");if(!await (0,d.M)(u,x,w,v))throw new f.h2;return[r?(0,h.h2)(o,"payload",f.Ye):"string"==typeof o?g.Rd.encode(o):o,p,r,x,t]}async function m(a,b,c){if(a instanceof Uint8Array&&(a=g.D0.decode(a)),"string"!=typeof a)throw new f.Ye("Compact JWS must be a string or Uint8Array");let{0:d,1:e,2:h,length:i}=a.split(".");if(3!==i)throw new f.Ye("Invalid Compact JWS");return l({payload:e,protected:d,signature:h},b,c)}var n=c(17347);async function o(a,b,c){let d=await m(a,[c&&(0,j.Fw)("algorithms",c.algorithms),c?.crit],b);if(!d[2])throw new f.Dp("JWTs MUST NOT use unencoded payload");let e={payload:(0,n.k6)(d[1],d[0],c),protectedHeader:d[1]};return"function"==typeof b?{...e,key:d[3]}:e}},19225:(a,b,c)=>{a.exports=c(44870)},33792:(a,b,c)=>{c.d(b,{Dc:()=>p,OZ:()=>s,YK:()=>n,dY:()=>q,tm:()=>r});var d=c(84433),e=c(17509),f=c(73024),g=c.n(f),h=c(76760),i=c.n(h),j=c(77598),k=c.n(j),l=c(49120);let m=new TextEncoder().encode(function(){if(process.env.JWT_SECRET)return process.env.JWT_SECRET;let a=i().join(l.DATA_DIR,"jwt-secret");try{return g().readFileSync(a,"utf8").trim()}catch{}g().mkdirSync(l.DATA_DIR,{recursive:!0});let b=k().randomBytes(32).toString("hex");return g().writeFileSync(a,b,{mode:384}),b}());function n(a){let b="true"===process.env.AUTH_COOKIE_SECURE,c=a?.headers?.get?.("x-forwarded-proto");return b||"https"===c}async function o(a={}){return new d.P({authenticated:!0,...a}).setProtectedHeader({alg:"HS256"}).setIssuedAt().setExpirationTime("86400s").sign(m)}async function p(a){if(!a)return!1;try{return await (0,e.V)(a,m),!0}catch{return!1}}async function q(a){if(!a)return null;try{let{payload:b}=await (0,e.V)(a,m);return b}catch{return null}}async function r(a,b,c={}){let d=await o(c);a.set("auth_token",d,{httpOnly:!0,secure:n(b),sameSite:"lax",path:"/",maxAge:86400})}function s(a){a.delete("auth_token")}},50122:(a,b,c)=>{c.d(b,{k:()=>e});let d=[];for(let a=0;a<256;++a)d.push((a+256).toString(16).slice(1));function e(a,b=0){return(d[a[b+0]]+d[a[b+1]]+d[a[b+2]]+d[a[b+3]]+"-"+d[a[b+4]]+d[a[b+5]]+"-"+d[a[b+6]]+d[a[b+7]]+"-"+d[a[b+8]]+d[a[b+9]]+"-"+d[a[b+10]]+d[a[b+11]]+d[a[b+12]]+d[a[b+13]]+d[a[b+14]]+d[a[b+15]]).toLowerCase()}},61305:(a,b,c)=>{c.d(b,{KT:()=>r,MN:()=>t,NK:()=>n,OY:()=>l,PX:()=>u,m3:()=>s});var d=c(73024),e=c.n(d),f=c(76760),g=c.n(f),h=c(77598),i=c.n(h),j=c(49120);let k=g().join(j.DATA_DIR,"codex"),l="model_catalog.json",m=g().join(k,l),n=8388608;function o(a){let b;if(!a||0===a.length)throw Error("File rỗng");if(a.length>n)throw Error(`File vượt giới hạn ${Math.floor(n/1024/1024)} MB`);try{b=JSON.parse(a.toString("utf8"))}catch{throw Error("Kh\xf4ng phải JSON hợp lệ")}if(!b||"object"!=typeof b||Array.isArray(b))throw Error("Catalog phải l\xe0 một JSON object");if(!Array.isArray(b.models)||0===b.models.length)throw Error("Catalog thiếu mảng `models` (hoặc mảng rỗng)");let c=[];for(let a of b.models){let b="string"==typeof a?.slug?a.slug.trim():"";if(!b)throw Error("C\xf3 entry trong `models` thiếu trường `slug`");c.push(b)}return{modelCount:b.models.length,slugs:c}}let p={key:"",value:null},q={exists:!1,sizeBytes:0,updatedAt:null,version:null,modelCount:0,slugs:[],truncatedSlugs:!1,filename:l};function r(){let a,b;try{a=e().statSync(m)}catch{return{...q}}if(!a.isFile())return{...q};let c=`${a.mtimeMs}:${a.size}`;try{b=function(a){if(p.key===a)return p.value;let b=o(e().readFileSync(m));return p={key:a,value:b},b}(c)}catch{return{...q}}return{exists:!0,sizeBytes:a.size,updatedAt:new Date(a.mtimeMs).toISOString(),version:i().createHash("sha1").update(c).digest("hex").slice(0,12),modelCount:b.modelCount,slugs:b.slugs.slice(0,24),truncatedSlugs:b.slugs.length>24,filename:l}}function s(a){o(a),e().mkdirSync(k,{recursive:!0});let b=`${m}.${i().randomBytes(4).toString("hex")}.tmp`;return e().writeFileSync(b,a,{mode:420}),e().renameSync(b,m),r()}function t(){try{e().unlinkSync(m)}catch{}return p={key:"",value:null},r()}function u(){let a=r();if(!a.exists)return null;try{return{data:e().readFileSync(m),meta:a}}catch{return null}}},90389:(a,b,c)=>{c.d(b,{hS:()=>d});let d=Object.freeze({ADMIN:"admin",MONITOR_ADMIN:"monitor_admin",AI_GATEWAYS_MONITOR:"ai_gateways_monitor",USER:"user",GUEST:"guest"});Object.freeze([{href:"/dashboard/endpoint",label:"Endpoint",icon:"api"},{href:"/dashboard/api-keys",label:"API Keys",icon:"vpn_key"},{href:"/dashboard/usage",label:"Usage",icon:"bar_chart"},{href:"/dashboard/analytics",label:"Analytics",icon:"monitoring"},{href:"/dashboard/ai-power-index",label:"AI Power Index",icon:"electric_bolt"},{href:"/dashboard/quota",label:"Quota Tracker",icon:"data_usage"}]),Object.freeze(["/dashboard","/dashboard/endpoint","/dashboard/api-keys","/dashboard/usage","/dashboard/analytics","/dashboard/ai-power-index","/dashboard/quota"])},92280:(a,b,c)=>{Object.defineProperty(b,"I",{enumerable:!0,get:function(){return g}});let d=c(28208),e=c(47617),f=c(62018);async function g(a,b,c,g){if((0,d.isNodeNextResponse)(b)){var h;b.statusCode=c.status,b.statusMessage=c.statusText;let d=["set-cookie","www-authenticate","proxy-authenticate","vary"];null==(h=c.headers)||h.forEach((a,c)=>{if("x-middleware-set-cookie"!==c.toLowerCase())if("set-cookie"===c.toLowerCase())for(let d of(0,f.splitCookiesString)(a))b.appendHeader(c,d);else{let e=void 0!==b.getHeader(c);(d.includes(c.toLowerCase())||!e)&&b.appendHeader(c,a)}});let{originalResponse:i}=b;c.body&&"HEAD"!==a.method?await (0,e.pipeToNodeResponse)(c.body,i,g):i.end()}}},94755:(a,b,c)=>{c.d(b,{A:()=>i});var d=c(77598);let e={randomUUID:d.randomUUID},f=new Uint8Array(256),g=f.length;var h=c(50122);let i=function(a,b,c){if(e.randomUUID&&!b&&!a)return e.randomUUID();var i=a,j=c;let k=(i=i||{}).random??i.rng?.()??(g>f.length-16&&((0,d.randomFillSync)(f),g=0),f.slice(g,g+=16));if(k.length<16)throw Error("Random bytes length must be >= 16");if(k[6]=15&k[6]|64,k[8]=63&k[8]|128,b){if((j=j||0)<0||j+16>b.length)throw RangeError(`UUID byte range ${j}:${j+15} is out of buffer bounds`);for(let a=0;a<16;++a)b[j+a]=k[a];return b}return(0,h.k)(k)}}};
+"use strict";exports.id=9905,exports.ids=[9905],exports.modules={9588:(a,b,c)=>{c.d(b,{Cy:()=>i,Gk:()=>l,I8:()=>k,Tv:()=>v,UX:()=>p,aV:()=>o,bz:()=>r,hH:()=>u,ny:()=>s,oW:()=>t,s0:()=>m,ub:()=>n,vZ:()=>q});var d=c(65573),e=c(23211),f=c(89718),g=c(33792),h=c(90389);let i="dashboard_view_mode";function j(a){return String(a||"").trim().toLowerCase()}function k(a){return j(a)}function l(a={}){return[a.ldapUsername,a.ldapEmail,a.ldapName,a.oidcEmail,a.oidcName,a.localUsername,a.username,a.email].map(j).filter(Boolean)}function m(a={}){let b=l(a),c=b[0]||"local",d=a.ldapName||a.ldapEmail||a.oidcName||a.oidcEmail||a.localUsername||c;return{userId:c,displayName:d,loginMethod:a.oidc?"OIDC":a.ldap?"LDAP":"Local",candidates:b}}function n(a={},b={}){var c;if(!b?.authenticated)return!1;if(b.local||!b.ldap&&!b.oidc||b.role===h.hS.ADMIN||!0===b.ldapIsAdmin)return!0;let d=Array.isArray(c=a.ldapAllowedUsers)?c.map(j).filter(Boolean):String(c||"").split(/[,\n]/).map(j).filter(Boolean);return 0!==d.length&&l(b).some(a=>d.includes(a))}function o(a={},b={}){return!(!b?.authenticated||n(a,b))&&(b.role===h.hS.MONITOR_ADMIN||!0===b.ldapIsMonitorAdmin)}function p(a={},b={}){return!(!b?.authenticated||n(a,b)||o(a,b))&&(b.role===h.hS.AI_GATEWAYS_MONITOR||!0===b.ldapIsAiGatewaysMonitor)}function q(a={},b={}){return b?.authenticated?n(a,b)?h.hS.ADMIN:o(a,b)?h.hS.MONITOR_ADMIN:p(a,b)?h.hS.AI_GATEWAYS_MONITOR:h.hS.USER:h.hS.GUEST}function r(a={}){return!0===a.isAdmin||!0===a.isMonitorAdmin}async function s(){let a=await (0,f.getSettings)(),b=await (0,d.UL)(),c=await (0,g.dY)(b.get("auth_token")?.value);if(!c?.authenticated)return{authenticated:!1,isAdmin:!1,actualIsAdmin:!1,showAsUser:!1,canToggleUserMode:!1,isMonitorAdmin:!1,isAiGatewaysMonitor:!1,role:h.hS.GUEST,actualRole:h.hS.GUEST,userId:"",displayName:"Guest",loginMethod:"None",settings:{...a,requireLogin:!0},session:null};let e=m(c||{}),j=q(a,c||{}),k=j===h.hS.ADMIN,l=k&&b.get(i)?.value==="user",n=l?h.hS.USER:j,o=n===h.hS.ADMIN,p=n===h.hS.MONITOR_ADMIN,r=n===h.hS.AI_GATEWAYS_MONITOR;return{authenticated:!0,isAdmin:o,actualIsAdmin:k,showAsUser:l,canToggleUserMode:k,isMonitorAdmin:p,isAiGatewaysMonitor:r,role:n,actualRole:j,canManageApiKeys:o||p,canUseMonitorAdminTabs:o||p,canViewAllAnalytics:o||p||r,...e,settings:{...a,requireLogin:!0},session:c}}async function t(){let a=await s();return a.authenticated?{access:a,response:null}:{access:a,response:e.NextResponse.json({error:"Authentication required"},{status:401})}}async function u(a={}){let{allowMonitorAdmin:b=!1}=a||{},{access:c,response:d}=await t();return d?{access:c,response:d}:c.isAdmin||b&&c.isMonitorAdmin?{access:c,response:null}:{access:c,response:e.NextResponse.json({error:"Admin access required"},{status:403})}}function v(a,b){if(!a?.authenticated||!b)return!1;if(r(a))return!0;let c=j(a.userId),d=j(b.ownerUser),e=j(b.createdByUser);return!!c&&(d===c||e===c)}},19225:(a,b,c)=>{a.exports=c(44870)},50122:(a,b,c)=>{c.d(b,{k:()=>e});let d=[];for(let a=0;a<256;++a)d.push((a+256).toString(16).slice(1));function e(a,b=0){return(d[a[b+0]]+d[a[b+1]]+d[a[b+2]]+d[a[b+3]]+"-"+d[a[b+4]]+d[a[b+5]]+"-"+d[a[b+6]]+d[a[b+7]]+"-"+d[a[b+8]]+d[a[b+9]]+"-"+d[a[b+10]]+d[a[b+11]]+d[a[b+12]]+d[a[b+13]]+d[a[b+14]]+d[a[b+15]]).toLowerCase()}},61305:(a,b,c)=>{c.d(b,{KT:()=>r,MN:()=>t,NK:()=>n,OY:()=>l,PX:()=>u,m3:()=>s});var d=c(73024),e=c.n(d),f=c(76760),g=c.n(f),h=c(77598),i=c.n(h),j=c(49120);let k=g().join(j.DATA_DIR,"codex"),l="model_catalog.json",m=g().join(k,l),n=8388608;function o(a){let b;if(!a||0===a.length)throw Error("File rỗng");if(a.length>n)throw Error(`File vượt giới hạn ${Math.floor(n/1024/1024)} MB`);try{b=JSON.parse(a.toString("utf8"))}catch{throw Error("Kh\xf4ng phải JSON hợp lệ")}if(!b||"object"!=typeof b||Array.isArray(b))throw Error("Catalog phải l\xe0 một JSON object");if(!Array.isArray(b.models)||0===b.models.length)throw Error("Catalog thiếu mảng `models` (hoặc mảng rỗng)");let c=[];for(let a of b.models){let b="string"==typeof a?.slug?a.slug.trim():"";if(!b)throw Error("C\xf3 entry trong `models` thiếu trường `slug`");c.push(b)}return{modelCount:b.models.length,slugs:c}}let p={key:"",value:null},q={exists:!1,sizeBytes:0,updatedAt:null,version:null,modelCount:0,slugs:[],truncatedSlugs:!1,filename:l};function r(){let a,b;try{a=e().statSync(m)}catch{return{...q}}if(!a.isFile())return{...q};let c=`${a.mtimeMs}:${a.size}`;try{b=function(a){if(p.key===a)return p.value;let b=o(e().readFileSync(m));return p={key:a,value:b},b}(c)}catch{return{...q}}return{exists:!0,sizeBytes:a.size,updatedAt:new Date(a.mtimeMs).toISOString(),version:i().createHash("sha1").update(c).digest("hex").slice(0,12),modelCount:b.modelCount,slugs:b.slugs.slice(0,24),truncatedSlugs:b.slugs.length>24,filename:l}}function s(a){o(a),e().mkdirSync(k,{recursive:!0});let b=`${m}.${i().randomBytes(4).toString("hex")}.tmp`;return e().writeFileSync(b,a,{mode:420}),e().renameSync(b,m),r()}function t(){try{e().unlinkSync(m)}catch{}return p={key:"",value:null},r()}function u(){let a=r();if(!a.exists)return null;try{return{data:e().readFileSync(m),meta:a}}catch{return null}}},90389:(a,b,c)=>{c.d(b,{hS:()=>d});let d=Object.freeze({ADMIN:"admin",MONITOR_ADMIN:"monitor_admin",AI_GATEWAYS_MONITOR:"ai_gateways_monitor",USER:"user",GUEST:"guest"});Object.freeze([{href:"/dashboard/endpoint",label:"Endpoint",icon:"api"},{href:"/dashboard/api-keys",label:"API Keys",icon:"vpn_key"},{href:"/dashboard/usage",label:"Usage",icon:"bar_chart"},{href:"/dashboard/analytics",label:"Analytics",icon:"monitoring"},{href:"/dashboard/ai-power-index",label:"AI Power Index",icon:"electric_bolt"},{href:"/dashboard/quota",label:"Quota Tracker",icon:"data_usage"}]),Object.freeze(["/dashboard","/dashboard/endpoint","/dashboard/api-keys","/dashboard/usage","/dashboard/analytics","/dashboard/ai-power-index","/dashboard/quota"])},92280:(a,b,c)=>{Object.defineProperty(b,"I",{enumerable:!0,get:function(){return g}});let d=c(28208),e=c(47617),f=c(62018);async function g(a,b,c,g){if((0,d.isNodeNextResponse)(b)){var h;b.statusCode=c.status,b.statusMessage=c.statusText;let d=["set-cookie","www-authenticate","proxy-authenticate","vary"];null==(h=c.headers)||h.forEach((a,c)=>{if("x-middleware-set-cookie"!==c.toLowerCase())if("set-cookie"===c.toLowerCase())for(let d of(0,f.splitCookiesString)(a))b.appendHeader(c,d);else{let e=void 0!==b.getHeader(c);(d.includes(c.toLowerCase())||!e)&&b.appendHeader(c,a)}});let{originalResponse:i}=b;c.body&&"HEAD"!==a.method?await (0,e.pipeToNodeResponse)(c.body,i,g):i.end()}}},94755:(a,b,c)=>{c.d(b,{A:()=>i});var d=c(77598);let e={randomUUID:d.randomUUID},f=new Uint8Array(256),g=f.length;var h=c(50122);let i=function(a,b,c){if(e.randomUUID&&!b&&!a)return e.randomUUID();var i=a,j=c;let k=(i=i||{}).random??i.rng?.()??(g>f.length-16&&((0,d.randomFillSync)(f),g=0),f.slice(g,g+=16));if(k.length<16)throw Error("Random bytes length must be >= 16");if(k[6]=15&k[6]|64,k[8]=63&k[8]|128,b){if((j=j||0)<0||j+16>b.length)throw RangeError(`UUID byte range ${j}:${j+15} is out of buffer bounds`);for(let a=0;a<16;++a)b[j+a]=k[a];return b}return(0,h.k)(k)}}};