@jheavenknows/bluerouter 5.5.35 → 5.5.37

package/app/.next-cli-build/server/chunks/3792.js

@@ -1,2 +1,2 @@
-"use strict";exports.id=3792,exports.ids=[3792],exports.modules={5565:(a,b,c)=>{let d=c(91645);function e(a){let b=String(a||"").trim().toLowerCase();b.startsWith("[")&&b.endsWith("]")&&(b=b.slice(1,-1));let c=b.indexOf("%");return c>=0&&(b=b.slice(0,c)),b.startsWith("::ffff:")&&4===d.isIP(b.slice(7))&&(b=b.slice(7)),b}function f(a){return Buffer.from(a.split(".").map(a=>Number(a)))}function g(a,b){return 4===b?f(a):function(a){let b=e(a),c=b.lastIndexOf(":");if(c>=0){let a=b.slice(c+1);if(4===d.isIP(a)){let d=f(a),e=(d[0]<<8|d[1]).toString(16),g=(d[2]<<8|d[3]).toString(16);b=`${b.slice(0,c)}:${e}:${g}`}}let g=b.split("::");if(g.length>2)throw Error("Invalid IPv6 address");let h=g[0]?g[0].split(":").filter(Boolean):[],i=2===g.length&&g[1]?g[1].split(":").filter(Boolean):[],j=8-h.length-i.length;if(1===g.length&&0!==j||j<0)throw Error("Invalid IPv6 address");let k=2===g.length?[...h,...Array(j).fill("0"),...i]:h;if(8!==k.length)throw Error("Invalid IPv6 address");let l=Buffer.alloc(16);return k.forEach((a,b)=>{let c=Number.parseInt(a||"0",16);if(!Number.isInteger(c)||c<0||c>65535)throw Error("Invalid IPv6 address");l[2*b]=c>>8&255,l[2*b+1]=255&c}),l}(a)}function h(a){let b=String(a||"").trim();if(!b)throw Error("Empty IP rule");let c=b.indexOf("/"),f=e(c>=0?b.slice(0,c):b),g=d.isIP(f);if(!g)throw Error(`Invalid client IP/CIDR: ${b}`);let h=4===g?32:128,i=c>=0?Number(b.slice(c+1)):h;if(!Number.isInteger(i)||i<0||i>h)throw Error(`Invalid CIDR prefix: ${b}`);return{text:c>=0?`${f}/${i}`:f,ip:f,family:g,prefix:i}}a.exports={normalizeIp:e,parseIpRule:h,normalizeAllowedClientIps:function(a){let b=Array.isArray(a)?a:String(a||"").split(/[\r\n,]+/),c=[],d=new Set;for(let a of b){let b=String(a||"").trim();if(!b)continue;let e=h(b);d.has(e.text)||(d.add(e.text),c.push(e.text))}return c},clientIpMatches:function(a,b=[]){let c=e(a),f=d.isIP(c);if(!f)return!1;let i=g(c,f);for(let a of b||[]){let b;try{b=h(a)}catch{continue}if(b.family===f&&function(a,b,c){let d=Math.floor(c/8),e=c%8;for(let c=0;c<d;c+=1)if(a[c]!==b[c])return!1;if(!e)return!0;let f=255<<8-e&255;return(a[d]&f)==(b[d]&f)}(i,g(b.ip,b.family),b.prefix))return!0}return!1}}},7566:(a,b,c)=>{let d=c(55511),e=/^[a-z0-9][a-z0-9._-]{0,63}$/i,f=null;function g(){return f||(f=c(81370)),f}function h(a){return String(a||"").trim()}function i(a){let b=Array.isArray(a)?a:[],c=new Set,d=[];for(let a of b){if(!a||"object"!=typeof a)continue;let b=h(a.username),f=String(a.passwordHash||"");if(!e.test(b)||!f.startsWith("$2"))continue;let g=b.toLowerCase();c.has(g)||(c.add(g),d.push({username:b,passwordHash:f}))}return d}function j(a){if(Array.isArray(a))return null;let b=String(a||"").trim();if(!b||b.length>1024)return null;let c=b.indexOf(" ");if(c<0||"basic"!==b.slice(0,c).toLowerCase())return null;let d=b.slice(c+1).trim();if(!d||!/^[A-Za-z0-9+/]+={0,2}$/.test(d))return null;let e="";try{e=Buffer.from(d,"base64").toString("utf8")}catch{return null}let f=e.indexOf(":");return f<0?null:{username:e.slice(0,f),password:e.slice(f+1)}}a.exports={CACHE_TTL_MS:3e5,PASSWORD_MAX_BYTES:72,PASSWORD_MIN_BYTES:8,createProxyAuthLimiter:function({maxFailures:a=10,windowMs:b=6e4,cooldownMs:c=3e4,maxCooldownMs:d=3e5,maxEntries:e=1024}={}){let f=new Map;return{isLocked(a){let b=f.get(a);return!!b&&b.lockedUntil>Date.now()},recordFailure(g){let h=Date.now();!function(a){if(f.size<e)return;for(let[c,d]of f)if(d.lockedUntil<=a&&a-d.lastFailAt>b&&f.delete(c),f.size<e)return;let c=f.keys().next();c.done||f.delete(c.value)}(h);let i=f.get(g)||{failures:0,lastFailAt:0,lockedUntil:0,cooldownMs:c};h-i.lastFailAt>b&&(i.failures=0),i.failures+=1,i.lastFailAt=h;let j=!1;return i.failures>=a&&(i.lockedUntil=h+i.cooldownMs,i.cooldownMs=Math.min(2*i.cooldownMs,d),i.failures=0,j=!0),f.set(g,i),{lockedNow:j}},recordSuccess(a){f.delete(a)}}},createProxyAuthenticator:function(a){let b=new Map(i(a).map(a=>[a.username.toLowerCase(),a])),c=new Map,e=new Map;return{get accountCount(){return b.size},async authenticate(a){let f,h=j(a);if(!h)return{ok:!1,username:null,reason:a?"Unsupported proxy credentials":"Proxy authentication required"};let{username:i,password:k}=h,l=d.createHash("sha256").update(`${i}\0${k}`).digest("hex"),m=(f=c.get(l))?f.expiresAt<=Date.now()?(c.delete(l),null):f.username:null;if(m)return{ok:!0,username:m,reason:null};let n=b.get(i.trim().toLowerCase()),o=n?n.passwordHash:"$2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy",p=e.get(l);p||(p=g().compare(k,o).catch(()=>!1),e.set(l,p),p.finally(()=>e.delete(l)));let q=await p;if(!n||!q)return{ok:!1,username:null,reason:"Invalid proxy credentials"};var r=n.username;if(c.size>=256){let a=c.keys().next();a.done||c.delete(a.value)}return c.set(l,{username:r,expiresAt:Date.now()+3e5}),{ok:!0,username:n.username,reason:null}}}},hashProxyPassword:async function a(a){let b=await g().genSalt(10);return g().hash(String(a),b)},isValidUsername:function(a){return e.test(h(a))},normalizeProxyUsers:i,parseBasicProxyAuthorization:j,redactProxyAuthUsers:function(a){return i(a).map(a=>({username:a.username,hasPassword:!0}))}}},8303:(a,b,c)=>{c.d(b,{B3:()=>j,T1:()=>k,im:()=>i,sv:()=>h});let d=[3e4,12e4,6e5,18e5],e=new Map;function f(){return Date.now()}function g(a){let b=e.get(a);return b?b.lastFailAt&&f()-b.lastFailAt>36e5&&(!b.lockUntil||f()>=b.lockUntil)?(e.delete(a),null):b:null}function h(a){let b=g(a);if(!b||!b.lockUntil)return{locked:!1};let c=b.lockUntil-f();return c<=0?{locked:!1}:{locked:!0,retryAfter:Math.ceil(c/1e3)}}function i(a){let b=g(a)||{fails:0,lockUntil:0,lockLevel:0,lastFailAt:0};if(b.fails+=1,b.lastFailAt=f(),b.fails>=5){let a=d[Math.min(b.lockLevel,d.length-1)];b.lockUntil=f()+a,b.lockLevel+=1,b.fails=0}return e.set(a,b),{remainingBeforeLock:Math.max(0,5-b.fails)}}function j(a){e.delete(a)}function k(a){let b=a.headers.get("x-forwarded-for");return b?b.split(",")[0].trim():a.headers.get("x-real-ip")||"unknown"}},33792:(a,b,c)=>{c.d(b,{Dc:()=>t,OZ:()=>y,YK:()=>r,dY:()=>u,m9:()=>w,tm:()=>x});var d=c(8292),e=c(17509),f=c(73024),g=c.n(f),h=c(76760),i=c.n(h),j=c(77598),k=c.n(j),l=c(49120),m=c(8303),n=c(77407),o=c(68257),p=c(43096);let q=new TextEncoder().encode(function(){if(process.env.JWT_SECRET)return process.env.JWT_SECRET;let a=i().join(l.DATA_DIR,"jwt-secret");try{return g().readFileSync(a,"utf8").trim()}catch{}g().mkdirSync(l.DATA_DIR,{recursive:!0});let b=k().randomBytes(32).toString("hex");return g().writeFileSync(a,b,{mode:384}),b}());function r(a){let b="true"===process.env.AUTH_COOKIE_SECURE,c=a?.headers?.get?.("x-forwarded-proto");return b||"https"===c}async function s(a={}){return new d.P({authenticated:!0,...a}).setProtectedHeader({alg:"HS256"}).setIssuedAt().setExpirationTime("86400s").sign(q)}async function t(a){if(!a)return!1;try{return await (0,e.V)(a,q),!0}catch{return!1}}async function u(a){if(!a)return null;try{let{payload:b}=await (0,e.V)(a,q);return b}catch{return null}}async function v(a,b){try{let c=function(a={}){return[a.ldapUsername,a.ldapEmail,a.ldapName,a.oidcEmail,a.oidcName,a.localUsername,a.username,a.email].map(a=>String(a||"").trim().toLowerCase()).filter(Boolean)}(b);if(!c.length)return;let d=(0,m.T1)(a);if(!d||"unknown"===d)return;let e=(0,p.loadConfig)(),f=function(a={}){return a.ldapName||a.ldapEmail||a.oidcName||a.oidcEmail||a.localUsername||""}(b),g=Array.isArray(b?.dlpGroups)?b.dlpGroups:[],h=c[0];for(let a of c)if((0,n.activateProxySessionOnLogin)({userId:a,dashboardUserId:h,displayName:f,ip:d,config:e,groups:g}))break}catch(a){console.log("Audit Proxy session activation skipped:",a?.message||a)}}async function w(a,b){if(b?.authenticated)try{let c=(0,m.T1)(a);if(!c||"unknown"===c||(0,o.getProxySession)(c))return;await v(a,b)}catch(a){console.log("Audit Proxy session restore skipped:",a?.message||a)}}async function x(a,b,c={}){let d=await s(c);a.set("auth_token",d,{httpOnly:!0,secure:r(b),sameSite:"lax",path:"/",maxAge:86400}),await v(b,c)}function y(a){a.delete("auth_token")}},43096:(a,b,c)=>{let d=c(29021),e=c(33873),{DATA_DIR:f}=c(99504),{normalizeAllowedClientIps:g}=c(5565),{normalizeAllowedToolsInput:h}=c(98586),{normalizeProxyUsers:i}=c(7566),{normalizeAccessGrants:j}=c(77407),{normalizeDlpProfiles:k,normalizeDlpRules:l}=c(87976),m=e.join(f,"audit-gateway"),n=e.join(m,"config.json"),o=e.join(m,"audit.jsonl"),p=e.join(m,"logs"),q=Object.freeze({enabled:!1,bindHost:"127.0.0.1",port:3128,clientProxyHost:"",clientToolFilterEnabled:!1,allowedClientTools:[],proxyAuthEnabled:!1,proxyAuthUsers:[],accessGrants:[],allowedHosts:["api.anthropic.com","*.anthropic.com","claude.ai","*.claude.ai","api.openai.com","*.openai.com","chatgpt.com","*.chatgpt.com","api.githubcopilot.com","*.githubcopilot.com","api.github.com","q.us-east-1.amazonaws.com","codewhisperer.us-east-1.amazonaws.com","oidc.us-east-1.amazonaws.com","*.auth.desktop.kiro.dev"],passthroughUnknown:!0,captureBodies:!0,captureLimitBytes:2097152,retentionDays:7,verifyUpstreamTls:!0,connectTimeoutMs:1e4,tlsHandshakeTimeoutMs:1e4,responseHeaderTimeoutMs:3e4,idleTimeoutMs:9e5,shutdownGraceMs:1500,sessionIdleTimeoutMs:36e5,dlpEnabled:!1,dlpMaxInspectBytes:8388608,dlpOversizeAction:"block",dlpDefaultAction:"accept",dlpProfiles:[],dlpRules:[],allowPlainHttp:!1,allowedConnectPorts:[443]});function r(){return{...q,allowedClientTools:[...q.allowedClientTools],proxyAuthUsers:[...q.proxyAuthUsers],accessGrants:[],allowedHosts:[...q.allowedHosts],allowedConnectPorts:[...q.allowedConnectPorts],dlpProfiles:[],dlpRules:[]}}function s(){d.mkdirSync(m,{recursive:!0}),d.mkdirSync(p,{recursive:!0})}function t(a){return[...new Set((Array.isArray(a)?a:String(a||"").split(/[\r\n,]+/)).map(a=>String(a||"").trim().toLowerCase()).filter(Boolean).filter(a=>!a.includes("://")&&/^[*a-z0-9._-]+$/.test(a)))]}function u(a,b,c,d,e){let f=null==a?b:Number(a);if(!Number.isInteger(f)||f<c||f>d)throw Error(`${e} must be between ${c} and ${d}`);return f}function v(a={}){let b={...q,...a},c=u(b.port,q.port,1,65535,"Proxy port"),d=Number(b.captureLimitBytes);if(!Number.isFinite(d)||d<0||d>0x1000000)throw Error("Capture limit must be between 0 and 16 MB");let e=u(b.retentionDays,q.retentionDays,1,365,"Retention days"),f=u(b.connectTimeoutMs,q.connectTimeoutMs,1e3,12e4,"Connect timeout"),g=u(b.tlsHandshakeTimeoutMs,q.tlsHandshakeTimeoutMs,1e3,12e4,"TLS handshake timeout"),m=u(b.responseHeaderTimeoutMs,q.responseHeaderTimeoutMs,1e3,3e5,"Response header timeout"),n=u(b.idleTimeoutMs,q.idleTimeoutMs,3e4,36e5,"Idle timeout"),o=u(b.shutdownGraceMs,q.shutdownGraceMs,0,3e4,"Shutdown grace period"),p=u(b.sessionIdleTimeoutMs,q.sessionIdleTimeoutMs,3e5,864e5,"Session idle timeout"),r=String(b.bindHost||"127.0.0.1").trim();if(!r||/\s/.test(r))throw Error("Invalid bind address");let s=String(b.clientProxyHost||"").trim();if(/\s/.test(s)||s.includes("://"))throw Error("Client proxy host must be a hostname or IP without protocol");let w=i(b.proxyAuthUsers);0;let x=j(b.accessGrants),y=!0===b.clientToolFilterEnabled,z=h(b.allowedClientTools);if(y&&0===z.length)throw Error("Client tool filter requires at least one allowed tool");let A=k(b.dlpProfiles),B=l(b.dlpRules,A),C=u(b.dlpMaxInspectBytes,q.dlpMaxInspectBytes,65536,0x4000000,"DLP inspection limit"),D="allow"===b.dlpOversizeAction?"allow":"block",E="deny"===b.dlpDefaultAction?"deny":"accept",F=!0===b.dlpEnabled;if(F&&!B.length&&"deny"===E)throw Error("Content control is set to deny by default with no rules - every request would be blocked");return{enabled:!0===b.enabled,bindHost:r,port:c,clientProxyHost:s,clientToolFilterEnabled:y,allowedClientTools:z,proxyAuthEnabled:!1,proxyAuthUsers:w,accessGrants:x,allowedHosts:t(b.allowedHosts),passthroughUnknown:!1!==b.passthroughUnknown,captureBodies:!1!==b.captureBodies,captureLimitBytes:Math.round(d),retentionDays:e,verifyUpstreamTls:!0,connectTimeoutMs:f,tlsHandshakeTimeoutMs:g,responseHeaderTimeoutMs:m,idleTimeoutMs:n,shutdownGraceMs:o,sessionIdleTimeoutMs:p,dlpEnabled:F,dlpMaxInspectBytes:C,dlpOversizeAction:D,dlpDefaultAction:E,dlpProfiles:A,dlpRules:B,allowPlainHttp:!1,allowedConnectPorts:[443]}}a.exports={PROXY_AUTH_FEATURE_ENABLED:!1,AUDIT_DIR:m,CONFIG_PATH:n,AUDIT_LOG_PATH:o,AUDIT_LOG_DIR:p,DEFAULT_CONFIG:q,ensureAuditDir:s,loadConfig:function(){if(s(),!d.existsSync(n))return r();try{return v(JSON.parse(d.readFileSync(n,"utf8")))}catch(a){return console.warn(`[audit-proxy] invalid config ignored: ${a.message||a}`),r()}},saveConfig:function(a){s();let b=v(a),c=`${n}.tmp`;return d.writeFileSync(c,`${JSON.stringify(b,null,2)}
-`,{mode:384}),d.renameSync(c,n),b},validateConfig:v,normalizeAllowedHosts:t,normalizeAllowedClientIps:g}},48350:a=>{let b=new Set(["authorization","proxy-authorization","x-api-key","api-key","cookie","set-cookie","x-auth-token","x-access-token","cf-access-jwt-assertion"]),c=/(^|[_-])(access[_-]?token|refresh[_-]?token|id[_-]?token|token|api[_-]?key|apikey|password|passwd|secret|authorization|cookie)($|[_-])/i;function d(a){let c=String(a||"").toLowerCase();return b.has(c)||/token|secret|password|credential/i.test(c)}function e(a,b=new WeakSet){if(null==a||"object"!=typeof a)return a;if(b.has(a))return"[CIRCULAR]";if(b.add(a),Array.isArray(a))return a.map(a=>e(a,b));let d={};for(let[f,g]of Object.entries(a))d[f]=c.test(f)?"[REDACTED]":e(g,b);return d}function f(a){if(null==a)return a;let b=String(a);return(b=(b=b.replace(/\bBearer\s+[A-Za-z0-9._~+\/-]+=*/gi,"Bearer [REDACTED]")).replace(/\b(sk-ant-[A-Za-z0-9_-]{8,}|sk-[A-Za-z0-9_-]{8,})\b/g,"[REDACTED]")).replace(/("(?:access_token|refresh_token|id_token|api_key|apikey|password|secret|authorization)"\s*:\s*")([^"]+)(")/gi,"$1[REDACTED]$3")}a.exports={redactHeaders:function(a={}){let b={};for(let[c,e]of Object.entries(a||{}))b[c]=d(c)?"[REDACTED]":e;return b},redactObject:e,redactBodyText:function(a,b=""){let c=String(a||"");if(/application\/(?:[^;]+\+)?json/i.test(b)||/^[\s\r\n]*[\[{]/.test(c))try{let a=JSON.parse(c);return JSON.stringify(e(a))}catch{}return f(c)},scrubString:f,redactUrlPath:function(a){let b=String(a||"");try{let a=new URL(b,"https://audit.invalid");for(let b of[...a.searchParams.keys()])if(/token|secret|key|password|credential|authorization|^code$/i.test(b))a.searchParams.set(b,"[REDACTED]");else{let c=a.searchParams.get(b);c&&a.searchParams.set(b,f(c))}return`${a.pathname}${a.search}`}catch{return f(b)}},containsLikelySecret:function(a){let b="string"==typeof a?a:JSON.stringify(a);return/Bearer\s+(?!\[REDACTED\])\S+|sk-ant-[A-Za-z0-9_-]{8,}|\bsk-[A-Za-z0-9_-]{8,}/i.test(b||"")},shouldRedactHeader:d}},68257:(a,b,c)=>{let{normalizeIp:d}=c(5565),e="__blueRouterAuditProxySessions";function f(){return globalThis[e]||(globalThis[e]=new Map),globalThis[e]}function g(a){let b=Number(a);return Number.isFinite(b)&&b>=6e4?b:36e5}a.exports={DEFAULT_IDLE_TIMEOUT_MS:36e5,MIN_IDLE_TIMEOUT_MS:6e4,activateProxySession:function({userId:a,dashboardUserId:b,displayName:c,ip:e,idleTimeoutMs:h,groups:i}={}){let j=String(a||"").trim().toLowerCase(),k=d(e);if(!j||!k)return null;let l=Date.now(),m=g(h),n=f().get(k);n&&n.userId!==j&&console.log(`[audit-proxy] session for ${k} reassigned from ${n.userId} to ${j}`);let o={userId:j,dashboardUserId:String(b||"").trim().toLowerCase()||j,displayName:String(c||"").trim()||j,groups:Array.isArray(i)?i.filter(Boolean).map(String):[],activatedAt:n?.userId===j?n.activatedAt:l,expiresAt:l+m};return f().set(k,o),{ip:k,...o}},touchProxySession:function(a,b){let c=d(a),e=f().get(c);return e?(e.expiresAt=Date.now()+g(b),{ip:c,...e}):null},getProxySession:function(a){let b=d(a),c=f().get(b);return c?c.expiresAt<=Date.now()?(f().delete(b),null):{ip:b,...c}:null},listActiveProxySessions:function(){let a=Date.now(),b=[];for(let[c,d]of f()){if(d.expiresAt<=a){f().delete(c);continue}b.push({ip:c,...d})}return b.sort((a,b)=>b.expiresAt-a.expiresAt)},pruneExpiredProxySessions:function(){let a=Date.now(),b=0;for(let[c,d]of f())d.expiresAt<=a&&(f().delete(c),b+=1);return b},revokeProxySession:function(a){return f().delete(d(a))},revokeProxySessionsForUser:function(a){let b=String(a||"").trim().toLowerCase();if(!b)return 0;let c=0;for(let[a,d]of f())d.userId===b&&(f().delete(a),c+=1);return c},clearAllProxySessions:function(){let a=f().size;return f().clear(),a}}},77407:(a,b,c)=>{let{normalizeIp:d,clientIpMatches:e}=c(5565),{activateProxySession:f,touchProxySession:g,listActiveProxySessions:h}=c(68257);function i(a){return String(a||"").trim().toLowerCase()}function j(a){let b=Array.isArray(a)?a:a&&"object"==typeof a?Object.entries(a).map(([a,b])=>({userId:a,note:b})):[],c=new Map;for(let a of b){let b=i(a?.userId??a?.user??a?.id);b&&c.set(b,{userId:b,note:String((a?.note??c.get(b)?.note)||"").trim().slice(0,200)})}if(c.size>500)throw Error("At most 500 Audit Proxy access grants are supported");return[...c.values()].sort((a,b)=>a.userId.localeCompare(b.userId))}function k(a=[],b=""){let c=i(b);return c&&a.find(a=>a.userId===c)||null}function l(a={}){let b=a.grants||[],c=new Set(b.map(a=>a.userId)),d=h().filter(a=>c.has(a.userId));return{...a,enabled:!0,allowedClientIps:d.map(a=>a.ip),source:"sessions",grants:b,sessions:d}}a.exports={MAX_GRANTS:500,normalizeGrantUserId:i,normalizeAccessGrants:j,findAccessGrant:k,effectiveClientIpPolicy:function(a={}){return l({grants:j(a.accessGrants),sessionIdleTimeoutMs:a.sessionIdleTimeoutMs})},attachClientIpGate:function(a,b){let c=new Map;return a.prependListener("connection",a=>{let f=d(a?.remoteAddress||""),h=l(b()||{});if(h.enabled&&!e(f,h.allowedClientIps||[])){console.log(`[audit-proxy] denied client IP ${f||"unknown"} (${h.source||"manual"} allowlist)`);try{a.destroy()}catch{}return}g(f,h.sessionIdleTimeoutMs);let i=(h.sessions||[]).find(a=>a.ip===f);a.__auditDlpGroups=i?.groups||[],a.__auditDashboardUser=i?{userId:i.dashboardUserId||i.userId,displayName:i.displayName}:null,c.set(a,f),a.once("close",()=>c.delete(a))}),{dropRevoked(){let a=l(b()||{});if(!a.enabled)return 0;let d=0;for(let[b,f]of[...c])if(!e(f,a.allowedClientIps||[])){console.log(`[audit-proxy] closing connection from revoked client IP ${f||"unknown"}`);try{b.destroy()}catch{}c.delete(b),d+=1}return d},connectionCount:()=>c.size}},activateProxySessionOnLogin:function({userId:a,dashboardUserId:b,displayName:c,ip:d,config:e,groups:g}={}){let h=i(a);return h&&k(j(e?.accessGrants),h)?f({userId:h,dashboardUserId:b,displayName:c,ip:d,idleTimeoutMs:e?.sessionIdleTimeoutMs,groups:g}):null}}},87976:(a,b,c)=>{let{containsLikelySecret:d}=c(48350),{clientToolMatches:e,normalizeAllowedTools:f}=c(98586),g=/^data:([^;,]*)(;[^,]*)?,/i;function h(a){let b="string"==typeof a?a:"";if(!b)return 0;let c=b.replace(/\s/g,"");if(!c)return 0;let d=0;return c.endsWith("==")?d=2:c.endsWith("=")&&(d=1),Math.max(0,Math.floor(3*c.length/4)-d)}function i(a){let b="string"==typeof a?a:"",c=g.exec(b);return c?{mediaType:String(c[1]||"").toLowerCase()||"application/octet-stream",data:b.slice(c[0].length),isBase64:/;base64/i.test(c[2]||"")}:null}function j(a,b){let c=String(a||"").toLowerCase().trim(),d=String(b||"").toLowerCase().trim();return!!d&&("*"===d||"*/*"===d||(d.endsWith("/*")?c.startsWith(d.slice(0,-1)):c===d))}function k(a){return String(a||"").trim().toLowerCase().replace(/\.$/,"")}function l(a,b=[]){let c=k(a);return b.some(a=>{let b=k(a);if(!b)return!1;if(b===c)return!0;if(b.startsWith("*.")){let a=b.slice(1);return c.endsWith(a)&&c.length>a.length}return!1})}function m(a){return String(a||"").trim().toLowerCase().replace(/\s*,\s*/g,",")}function n(a){if(!a||"object"!=typeof a)return null;let b="string"==typeof a.type?a.type.toLowerCase():"";if(("image"===b||"document"===b)&&a.source&&"object"==typeof a.source){let c=a.source;if("base64"===c.type||"string"==typeof c.data)return{kind:b,mediaType:String(c.media_type||c.mediaType||"application/octet-stream").toLowerCase(),bytes:h(c.data),inline:!0};if("url"===c.type||"string"==typeof c.url)return{kind:b,mediaType:"",bytes:0,inline:!1}}if("image_url"===b){let b=i("string"==typeof a.image_url?a.image_url:a.image_url?.url);return b?{kind:"image",mediaType:b.mediaType,bytes:b.isBase64?h(b.data):Buffer.byteLength(b.data,"utf8"),inline:!0}:{kind:"image",mediaType:"",bytes:0,inline:!1}}if("input_image"===b||"input_file"===b){let c=i("string"==typeof a.image_url?a.image_url:a.file_data);if(c)return{kind:"input_image"===b?"image":"file",mediaType:c.mediaType,bytes:c.isBase64?h(c.data):Buffer.byteLength(c.data,"utf8"),inline:!0};if(a.file_id)return{kind:"file",mediaType:"",bytes:0,inline:!1}}let c=a.inline_data||a.inlineData;return c&&"object"==typeof c&&"string"==typeof c.data?{kind:"file",mediaType:String(c.mime_type||c.mimeType||"application/octet-stream").toLowerCase(),bytes:h(c.data),inline:!0}:null}function o(a){let b=[],c=[],d=0,e=0,f=!1,g=new WeakSet,h=(a,i)=>{if(f||null==a)return;if(d++>2e5){f=!0;return}if("string"==typeof a){e<1e6&&(c.push(a),e+=a.length);return}if("object"!=typeof a||i>16||g.has(a))return;if(g.add(a),Array.isArray(a)){for(let b of a)h(b,i+1);return}let j=n(a);if(j)return void b.push(j);for(let[b,c]of Object.entries(a))"data"!==b&&"file_data"!==b&&h(c,i+1)};return h(a,0),{attachments:b,text:c.join("\n"),budgetExceeded:f}}function p(a){let b=Number(a||0);return b>=1048576?`${(b/1048576).toFixed(1)} MB`:b>=1024?`${Math.round(b/1024)} KB`:`${b} bytes`}function q(a,b){if(!a||!1===a.enabled)return!1;let c=(a.sourceGroups||[]).filter(Boolean);if(c.length){let a=new Set((b.groups||[]).map(m));if(!c.some(b=>a.has(m(b))))return!1}let d=(a.destHosts||[]).filter(Boolean);if(d.length&&!l(b.host,d))return!1;let g=f(a.clientTools||[]);if(g.length&&!e(b.userAgent,g))return!1;let h=(a.methods||[]).filter(Boolean).map(a=>String(a).toUpperCase());return!h.length||!!h.includes(String(b.method||"").toUpperCase())}function r(a,b){return String(a||"").trim().toLowerCase().replace(/[^a-z0-9._-]/g,"-").slice(0,64)||b}function s(a,b=120){return String(a||"").trim().slice(0,b)}function t(a,b=100){let c=Array.isArray(a)?a:String(a||"").split(/[\n,]/),d=[];for(let a of c){let c=String(a||"").trim();if(c&&!d.includes(c)&&d.push(c),d.length>=b)break}return d}function u(a,b){let c=Number(a||0);if(!Number.isFinite(c)||c<0||c>0x20000000)throw Error(`${b} must be between 0 and 536870912 bytes`);return Math.round(c)}a.exports={base64DecodedSize:h,parseDataUrl:i,mediaTypeMatches:j,hostMatchesAny:l,describeAttachment:n,inspectBody:o,ruleMatches:q,evaluateRules:function(a,b){for(let c of a?.dlpRules||[]){if(!q(c,b))continue;let d="deny"===c.action?"deny":"accept",e="accept"===d&&c.profileId&&(a.dlpProfiles||[]).find(a=>a.id===c.profileId)||null;return{action:d,rule:c,profile:e,reason:c.name||c.id||"rule"}}return{action:a?.dlpDefaultAction==="deny"?"deny":"accept",rule:null,profile:null,reason:"default action"}},evaluateBody:function(a,b){let c={violations:[],attachments:[],totalBytes:0,budgetExceeded:!1};if(!b)return c;let{attachments:e,text:f,budgetExceeded:g}=o(a);c.attachments=e,c.budgetExceeded=g;let h=e.filter(a=>a.inline),i=h.reduce((a,b)=>a+b.bytes,0);c.totalBytes=i;let k=b.attachments||{},l=k.mode||"allow";if(e.length){if("deny"===l)c.violations.push({rule:"attachment-type",message:"Attachments are not allowed by the policy that applies to you",detail:`${e.length} attachment(s)`});else if("allowlist"===l)for(let a of e){if(!a.inline){c.violations.push({rule:"attachment-type",message:"Attachments referenced by URL cannot be inspected and are not allowed",detail:a.kind});continue}!function(a,b){return(b||[]).some(b=>j(a,b))}(a.mediaType,k.allowedMediaTypes)&&c.violations.push({rule:"attachment-type",message:`File type ${a.mediaType||"unknown"} is not allowed`,detail:`allowed: ${(k.allowedMediaTypes||[]).join(", ")||"none"}`})}let a=Number(k.maxCount||0);a>0&&e.length>a&&c.violations.push({rule:"attachment-count",message:`Too many attachments: ${e.length}, limit is ${a}`,detail:`count=${e.length}`});let b=Number(k.maxBytesEach||0);if(b>0)for(let a of h)a.bytes>b&&c.violations.push({rule:"attachment-size",message:`Attachment is ${p(a.bytes)}, limit is ${p(b)}`,detail:a.mediaType||a.kind});let d=Number(k.maxBytesTotal||0);d>0&&i>d&&c.violations.push({rule:"attachment-size",message:`Attachments total ${p(i)}, limit is ${p(d)}`,detail:`total=${i}`})}let m=b.text||{};for(let a of(m.blockLikelySecrets&&f&&d(f)&&c.violations.push({rule:"text-secret",message:"Request appears to contain a credential",detail:"likely-secret"}),function(a){let b=[];for(let c of a||[]){let a="string"==typeof c?c:c?.pattern;if(a)try{b.push({label:"object"==typeof c&&c?.label||a,re:RegExp(a,"i")})}catch{}}return b}(m.patterns)))a.re.test(f)&&c.violations.push({rule:"text-pattern",message:"Request matches a blocked content pattern",detail:a.label});return c},needsBodyInspection:function(a,b,c={}){if(!a?.profile)return!1;let d=String(b||"").toUpperCase();if("GET"===d||"HEAD"===d||"DELETE"===d||"OPTIONS"===d||!(Number(c["content-length"]||0)>0||c["transfer-encoding"]))return!1;let e=String(c["content-type"]||"").toLowerCase();return e.includes("json")||e.includes("multipart")},normalizeDlpProfiles:function(a){if(!Array.isArray(a))return[];if(a.length>50)throw Error("At most 50 DLP profiles are supported");let b=new Set;return a.map((a,c)=>{let d=r(a?.id,`profile-${c+1}`);if(b.has(d))throw Error(`Duplicate DLP profile id: ${d}`);b.add(d);let e=a?.attachments||{},f=["allow","deny","allowlist"].includes(e.mode)?e.mode:"allow",g=t(e.allowedMediaTypes).map(a=>a.toLowerCase());if("allowlist"===f&&!g.length)throw Error(`DLP profile "${d}": an allowlist needs at least one media type`);let h=a?.text||{},i=[];for(let a of Array.isArray(h.patterns)?h.patterns:[]){let b=String(("string"==typeof a?a:a?.pattern)||"").trim();if(b){if(b.length>500)throw Error(`DLP profile "${d}": pattern is longer than 500 characters`);try{RegExp(b,"i")}catch(a){throw Error(`DLP profile "${d}": invalid pattern ${b} (${a.message})`)}if(i.push({label:s("object"==typeof a?a?.label:"")||b,pattern:b}),i.length>=50)break}}return{id:d,label:s(a?.label)||d,attachments:{mode:f,allowedMediaTypes:g,maxBytesEach:u(e.maxBytesEach,`DLP profile "${d}" per-file limit`),maxBytesTotal:u(e.maxBytesTotal,`DLP profile "${d}" total limit`),maxCount:Math.max(0,Math.min(1e3,Math.round(Number(e.maxCount||0))||0))},text:{blockLikelySecrets:!0===h.blockLikelySecrets,patterns:i}}})},normalizeDlpRules:function(a,b=[]){if(!Array.isArray(a))return[];if(a.length>200)throw Error("At most 200 DLP rules are supported");let c=new Set(b.map(a=>a.id)),d=new Set;return a.map((a,b)=>{let e=r(a?.id,`rule-${b+1}`);if(d.has(e))throw Error(`Duplicate DLP rule id: ${e}`);d.add(e);let g=a?.action==="deny"?"deny":"accept",h="accept"===g?r(a?.profileId,""):"";if(h&&!c.has(h))throw Error(`DLP rule "${e}" refers to unknown profile "${h}"`);return{id:e,name:s(a?.name)||e,enabled:a?.enabled!==!1,sourceGroups:t(a?.sourceGroups),destHosts:t(a?.destHosts).map(a=>a.toLowerCase()),clientTools:f(a?.clientTools||[]),methods:t(a?.methods).map(a=>a.toUpperCase()),action:g,profileId:h,log:a?.log!==!1}})},formatBytes:p,MAX_DEPTH:16,MAX_NODES:2e5,MAX_RULES:200,MAX_PROFILES:50}},98586:a=>{let b=[{id:"claude-code",label:"Claude Code",patterns:["claude-cli","claude-code","anthropic"]},{id:"codex",label:"OpenAI Codex",patterns:["codex_cli","codex-cli","codex"]},{id:"gemini-cli",label:"Gemini CLI",patterns:["gemini-cli","google-genai"]},{id:"cursor",label:"Cursor",patterns:["cursor"]},{id:"copilot",label:"GitHub Copilot",patterns:["copilot","githubcopilot"]},{id:"kiro",label:"Kiro",patterns:["kiro","aws-sdk-js"]},{id:"curl",label:"curl / scripts",patterns:["curl","wget","httpie"]}];function c(a){return String(a||"").trim().toLowerCase()}function d(a,b=[]){let e=c(a);return!!e&&!!b.length&&b.some(a=>a&&e.includes(a))}a.exports={TOOL_PRESETS:b,normalizeAllowedTools:function(a){let d=Array.isArray(a)?a:String(a||"").split(/[\r\n,]+/),e=[];for(let a of d){let d=c(a);if(!d)continue;let f=b.find(a=>a.id===d);f?e.push(...f.patterns):e.push(d)}return[...new Set(e)]},normalizeAllowedToolsInput:function(a){return[...new Set((Array.isArray(a)?a:String(a||"").split(/[\r\n,]+/)).map(c).filter(Boolean))]},clientToolMatches:d,shouldRefuseClientTool:function(a,b=[]){return!!c(a)&&!d(a,b)},describeUserAgent:function(a){let b=String(a||"").trim();return b?b.length>120?`${b.slice(0,119)}…`:b:"no User-Agent"}}},99504:(a,b,c)=>{let d=c(29021),e=c(33873),f=c(21820),g="bluerouter";function h(){return"win32"===process.platform?e.join(process.env.APPDATA||e.join(f.homedir(),"AppData","Roaming"),g):e.join(f.homedir(),`.${g}`)}let i=function(){let a=process.env.DATA_DIR;if(!a)return h();try{return d.mkdirSync(a,{recursive:!0}),a}catch(b){if(b?.code==="EACCES"||b?.code==="EPERM")return console.warn(`[DATA_DIR] '${a}' not writable → fallback ~/.${g}`),h();throw b}}(),j=e.join(i,"mitm");a.exports={DATA_DIR:i,CA_DIR:j}}};
+"use strict";exports.id=3792,exports.ids=[3792],exports.modules={5565:(a,b,c)=>{let d=c(91645);function e(a){let b=String(a||"").trim().toLowerCase();b.startsWith("[")&&b.endsWith("]")&&(b=b.slice(1,-1));let c=b.indexOf("%");return c>=0&&(b=b.slice(0,c)),b.startsWith("::ffff:")&&4===d.isIP(b.slice(7))&&(b=b.slice(7)),b}function f(a){return Buffer.from(a.split(".").map(a=>Number(a)))}function g(a,b){return 4===b?f(a):function(a){let b=e(a),c=b.lastIndexOf(":");if(c>=0){let a=b.slice(c+1);if(4===d.isIP(a)){let d=f(a),e=(d[0]<<8|d[1]).toString(16),g=(d[2]<<8|d[3]).toString(16);b=`${b.slice(0,c)}:${e}:${g}`}}let g=b.split("::");if(g.length>2)throw Error("Invalid IPv6 address");let h=g[0]?g[0].split(":").filter(Boolean):[],i=2===g.length&&g[1]?g[1].split(":").filter(Boolean):[],j=8-h.length-i.length;if(1===g.length&&0!==j||j<0)throw Error("Invalid IPv6 address");let k=2===g.length?[...h,...Array(j).fill("0"),...i]:h;if(8!==k.length)throw Error("Invalid IPv6 address");let l=Buffer.alloc(16);return k.forEach((a,b)=>{let c=Number.parseInt(a||"0",16);if(!Number.isInteger(c)||c<0||c>65535)throw Error("Invalid IPv6 address");l[2*b]=c>>8&255,l[2*b+1]=255&c}),l}(a)}function h(a){let b=String(a||"").trim();if(!b)throw Error("Empty IP rule");let c=b.indexOf("/"),f=e(c>=0?b.slice(0,c):b),g=d.isIP(f);if(!g)throw Error(`Invalid client IP/CIDR: ${b}`);let h=4===g?32:128,i=c>=0?Number(b.slice(c+1)):h;if(!Number.isInteger(i)||i<0||i>h)throw Error(`Invalid CIDR prefix: ${b}`);return{text:c>=0?`${f}/${i}`:f,ip:f,family:g,prefix:i}}a.exports={normalizeIp:e,parseIpRule:h,normalizeAllowedClientIps:function(a){let b=Array.isArray(a)?a:String(a||"").split(/[\r\n,]+/),c=[],d=new Set;for(let a of b){let b=String(a||"").trim();if(!b)continue;let e=h(b);d.has(e.text)||(d.add(e.text),c.push(e.text))}return c},clientIpMatches:function(a,b=[]){let c=e(a),f=d.isIP(c);if(!f)return!1;let i=g(c,f);for(let a of b||[]){let b;try{b=h(a)}catch{continue}if(b.family===f&&function(a,b,c){let d=Math.floor(c/8),e=c%8;for(let c=0;c<d;c+=1)if(a[c]!==b[c])return!1;if(!e)return!0;let f=255<<8-e&255;return(a[d]&f)==(b[d]&f)}(i,g(b.ip,b.family),b.prefix))return!0}return!1}}},7566:(a,b,c)=>{let d=c(55511),e=/^[a-z0-9][a-z0-9._-]{0,63}$/i,f=null;function g(){return f||(f=c(81370)),f}function h(a){return String(a||"").trim()}function i(a){let b=Array.isArray(a)?a:[],c=new Set,d=[];for(let a of b){if(!a||"object"!=typeof a)continue;let b=h(a.username),f=String(a.passwordHash||"");if(!e.test(b)||!f.startsWith("$2"))continue;let g=b.toLowerCase();c.has(g)||(c.add(g),d.push({username:b,passwordHash:f}))}return d}function j(a){if(Array.isArray(a))return null;let b=String(a||"").trim();if(!b||b.length>1024)return null;let c=b.indexOf(" ");if(c<0||"basic"!==b.slice(0,c).toLowerCase())return null;let d=b.slice(c+1).trim();if(!d||!/^[A-Za-z0-9+/]+={0,2}$/.test(d))return null;let e="";try{e=Buffer.from(d,"base64").toString("utf8")}catch{return null}let f=e.indexOf(":");return f<0?null:{username:e.slice(0,f),password:e.slice(f+1)}}a.exports={CACHE_TTL_MS:3e5,PASSWORD_MAX_BYTES:72,PASSWORD_MIN_BYTES:8,createProxyAuthLimiter:function({maxFailures:a=10,windowMs:b=6e4,cooldownMs:c=3e4,maxCooldownMs:d=3e5,maxEntries:e=1024}={}){let f=new Map;return{isLocked(a){let b=f.get(a);return!!b&&b.lockedUntil>Date.now()},recordFailure(g){let h=Date.now();!function(a){if(f.size<e)return;for(let[c,d]of f)if(d.lockedUntil<=a&&a-d.lastFailAt>b&&f.delete(c),f.size<e)return;let c=f.keys().next();c.done||f.delete(c.value)}(h);let i=f.get(g)||{failures:0,lastFailAt:0,lockedUntil:0,cooldownMs:c};h-i.lastFailAt>b&&(i.failures=0),i.failures+=1,i.lastFailAt=h;let j=!1;return i.failures>=a&&(i.lockedUntil=h+i.cooldownMs,i.cooldownMs=Math.min(2*i.cooldownMs,d),i.failures=0,j=!0),f.set(g,i),{lockedNow:j}},recordSuccess(a){f.delete(a)}}},createProxyAuthenticator:function(a){let b=new Map(i(a).map(a=>[a.username.toLowerCase(),a])),c=new Map,e=new Map;return{get accountCount(){return b.size},async authenticate(a){let f,h=j(a);if(!h)return{ok:!1,username:null,reason:a?"Unsupported proxy credentials":"Proxy authentication required"};let{username:i,password:k}=h,l=d.createHash("sha256").update(`${i}\0${k}`).digest("hex"),m=(f=c.get(l))?f.expiresAt<=Date.now()?(c.delete(l),null):f.username:null;if(m)return{ok:!0,username:m,reason:null};let n=b.get(i.trim().toLowerCase()),o=n?n.passwordHash:"$2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy",p=e.get(l);p||(p=g().compare(k,o).catch(()=>!1),e.set(l,p),p.finally(()=>e.delete(l)));let q=await p;if(!n||!q)return{ok:!1,username:null,reason:"Invalid proxy credentials"};var r=n.username;if(c.size>=256){let a=c.keys().next();a.done||c.delete(a.value)}return c.set(l,{username:r,expiresAt:Date.now()+3e5}),{ok:!0,username:n.username,reason:null}}}},hashProxyPassword:async function a(a){let b=await g().genSalt(10);return g().hash(String(a),b)},isValidUsername:function(a){return e.test(h(a))},normalizeProxyUsers:i,parseBasicProxyAuthorization:j,redactProxyAuthUsers:function(a){return i(a).map(a=>({username:a.username,hasPassword:!0}))}}},8303:(a,b,c)=>{c.d(b,{B3:()=>j,T1:()=>k,im:()=>i,sv:()=>h});let d=[3e4,12e4,6e5,18e5],e=new Map;function f(){return Date.now()}function g(a){let b=e.get(a);return b?b.lastFailAt&&f()-b.lastFailAt>36e5&&(!b.lockUntil||f()>=b.lockUntil)?(e.delete(a),null):b:null}function h(a){let b=g(a);if(!b||!b.lockUntil)return{locked:!1};let c=b.lockUntil-f();return c<=0?{locked:!1}:{locked:!0,retryAfter:Math.ceil(c/1e3)}}function i(a){let b=g(a)||{fails:0,lockUntil:0,lockLevel:0,lastFailAt:0};if(b.fails+=1,b.lastFailAt=f(),b.fails>=5){let a=d[Math.min(b.lockLevel,d.length-1)];b.lockUntil=f()+a,b.lockLevel+=1,b.fails=0}return e.set(a,b),{remainingBeforeLock:Math.max(0,5-b.fails)}}function j(a){e.delete(a)}function k(a){let b=a.headers.get("x-forwarded-for");return b?b.split(",")[0].trim():a.headers.get("x-real-ip")||"unknown"}},33792:(a,b,c)=>{c.d(b,{Dc:()=>t,OZ:()=>y,YK:()=>r,dY:()=>u,m9:()=>w,tm:()=>x});var d=c(8292),e=c(17509),f=c(73024),g=c.n(f),h=c(76760),i=c.n(h),j=c(77598),k=c.n(j),l=c(49120),m=c(8303),n=c(77407),o=c(68257),p=c(43096);let q=new TextEncoder().encode(function(){if(process.env.JWT_SECRET)return process.env.JWT_SECRET;let a=i().join(l.DATA_DIR,"jwt-secret");try{return g().readFileSync(a,"utf8").trim()}catch{}g().mkdirSync(l.DATA_DIR,{recursive:!0});let b=k().randomBytes(32).toString("hex");return g().writeFileSync(a,b,{mode:384}),b}());function r(a){let b="true"===process.env.AUTH_COOKIE_SECURE,c=a?.headers?.get?.("x-forwarded-proto");return b||"https"===c}async function s(a={}){return new d.P({authenticated:!0,...a}).setProtectedHeader({alg:"HS256"}).setIssuedAt().setExpirationTime("86400s").sign(q)}async function t(a){if(!a)return!1;try{return await (0,e.V)(a,q),!0}catch{return!1}}async function u(a){if(!a)return null;try{let{payload:b}=await (0,e.V)(a,q);return b}catch{return null}}async function v(a,b){try{let c=function(a={}){return[a.ldapUsername,a.ldapEmail,a.ldapName,a.oidcEmail,a.oidcName,a.localUsername,a.username,a.email].map(a=>String(a||"").trim().toLowerCase()).filter(Boolean)}(b);if(!c.length)return;let d=(0,m.T1)(a);if(!d||"unknown"===d)return;let e=(0,p.loadConfig)(),f=function(a={}){return a.ldapName||a.ldapEmail||a.oidcName||a.oidcEmail||a.localUsername||""}(b),g=Array.isArray(b?.dlpGroups)?b.dlpGroups:[],h=c[0];for(let a of c)if((0,n.activateProxySessionOnLogin)({userId:a,dashboardUserId:h,displayName:f,ip:d,config:e,groups:g}))break}catch(a){console.log("Audit Proxy session activation skipped:",a?.message||a)}}async function w(a,b){if(b?.authenticated)try{let c=(0,m.T1)(a);if(!c||"unknown"===c||(0,o.getProxySession)(c))return;await v(a,b)}catch(a){console.log("Audit Proxy session restore skipped:",a?.message||a)}}async function x(a,b,c={}){let d=await s(c);a.set("auth_token",d,{httpOnly:!0,secure:r(b),sameSite:"lax",path:"/",maxAge:86400}),await v(b,c)}function y(a){a.delete("auth_token")}},43096:(a,b,c)=>{let d=c(29021),e=c(33873),{DATA_DIR:f}=c(99504),{normalizeAllowedClientIps:g}=c(5565),{normalizeAllowedToolsInput:h}=c(98586),{normalizeProxyUsers:i}=c(7566),{normalizeAccessGrants:j}=c(77407),{normalizeDlpProfiles:k,normalizeDlpRules:l}=c(87976),m=e.join(f,"audit-gateway"),n=e.join(m,"config.json"),o=e.join(m,"audit.jsonl"),p=e.join(m,"logs"),q=Object.freeze({enabled:!1,bindHost:"127.0.0.1",port:3128,clientProxyHost:"",clientToolFilterEnabled:!1,allowedClientTools:[],proxyAuthEnabled:!1,proxyAuthUsers:[],accessGrants:[],allowedHosts:["api.anthropic.com","*.anthropic.com","claude.ai","*.claude.ai","api.openai.com","*.openai.com","chatgpt.com","*.chatgpt.com","api.githubcopilot.com","*.githubcopilot.com","api.github.com","q.us-east-1.amazonaws.com","codewhisperer.us-east-1.amazonaws.com","oidc.us-east-1.amazonaws.com","*.auth.desktop.kiro.dev","q.eu-central-1.amazonaws.com","runtime.us-east-1.kiro.dev","runtime.eu-central-1.kiro.dev","management.us-east-1.kiro.dev","management.eu-central-1.kiro.dev","prod.download.desktop.kiro.dev","app.kiro.dev"],passthroughUnknown:!0,captureBodies:!0,captureLimitBytes:2097152,retentionDays:7,verifyUpstreamTls:!0,connectTimeoutMs:1e4,tlsHandshakeTimeoutMs:1e4,responseHeaderTimeoutMs:3e4,idleTimeoutMs:9e5,shutdownGraceMs:1500,sessionIdleTimeoutMs:36e5,dlpEnabled:!1,dlpMaxInspectBytes:8388608,dlpOversizeAction:"block",dlpDefaultAction:"accept",dlpProfiles:[],dlpRules:[],allowPlainHttp:!1,allowedConnectPorts:[443]});function r(){return{...q,allowedClientTools:[...q.allowedClientTools],proxyAuthUsers:[...q.proxyAuthUsers],accessGrants:[],allowedHosts:[...q.allowedHosts],allowedConnectPorts:[...q.allowedConnectPorts],dlpProfiles:[],dlpRules:[]}}function s(){d.mkdirSync(m,{recursive:!0}),d.mkdirSync(p,{recursive:!0})}function t(a){return[...new Set((Array.isArray(a)?a:String(a||"").split(/[\r\n,]+/)).map(a=>String(a||"").trim().toLowerCase()).filter(Boolean).filter(a=>!a.includes("://")&&/^[*a-z0-9._-]+$/.test(a)))]}function u(a,b,c,d,e){let f=null==a?b:Number(a);if(!Number.isInteger(f)||f<c||f>d)throw Error(`${e} must be between ${c} and ${d}`);return f}function v(a={}){let b={...q,...a},c=u(b.port,q.port,1,65535,"Proxy port"),d=Number(b.captureLimitBytes);if(!Number.isFinite(d)||d<0||d>0x1000000)throw Error("Capture limit must be between 0 and 16 MB");let e=u(b.retentionDays,q.retentionDays,1,365,"Retention days"),f=u(b.connectTimeoutMs,q.connectTimeoutMs,1e3,12e4,"Connect timeout"),g=u(b.tlsHandshakeTimeoutMs,q.tlsHandshakeTimeoutMs,1e3,12e4,"TLS handshake timeout"),m=u(b.responseHeaderTimeoutMs,q.responseHeaderTimeoutMs,1e3,3e5,"Response header timeout"),n=u(b.idleTimeoutMs,q.idleTimeoutMs,3e4,36e5,"Idle timeout"),o=u(b.shutdownGraceMs,q.shutdownGraceMs,0,3e4,"Shutdown grace period"),p=u(b.sessionIdleTimeoutMs,q.sessionIdleTimeoutMs,3e5,864e5,"Session idle timeout"),r=String(b.bindHost||"127.0.0.1").trim();if(!r||/\s/.test(r))throw Error("Invalid bind address");let s=String(b.clientProxyHost||"").trim();if(/\s/.test(s)||s.includes("://"))throw Error("Client proxy host must be a hostname or IP without protocol");let w=i(b.proxyAuthUsers);0;let x=j(b.accessGrants),y=!0===b.clientToolFilterEnabled,z=h(b.allowedClientTools);if(y&&0===z.length)throw Error("Client tool filter requires at least one allowed tool");let A=k(b.dlpProfiles),B=l(b.dlpRules,A),C=u(b.dlpMaxInspectBytes,q.dlpMaxInspectBytes,65536,0x4000000,"DLP inspection limit"),D="allow"===b.dlpOversizeAction?"allow":"block",E="deny"===b.dlpDefaultAction?"deny":"accept",F=!0===b.dlpEnabled;if(F&&!B.length&&"deny"===E)throw Error("Content control is set to deny by default with no rules - every request would be blocked");return{enabled:!0===b.enabled,bindHost:r,port:c,clientProxyHost:s,clientToolFilterEnabled:y,allowedClientTools:z,proxyAuthEnabled:!1,proxyAuthUsers:w,accessGrants:x,allowedHosts:t(b.allowedHosts),passthroughUnknown:!1!==b.passthroughUnknown,captureBodies:!1!==b.captureBodies,captureLimitBytes:Math.round(d),retentionDays:e,verifyUpstreamTls:!0,connectTimeoutMs:f,tlsHandshakeTimeoutMs:g,responseHeaderTimeoutMs:m,idleTimeoutMs:n,shutdownGraceMs:o,sessionIdleTimeoutMs:p,dlpEnabled:F,dlpMaxInspectBytes:C,dlpOversizeAction:D,dlpDefaultAction:E,dlpProfiles:A,dlpRules:B,allowPlainHttp:!1,allowedConnectPorts:[443]}}a.exports={PROXY_AUTH_FEATURE_ENABLED:!1,AUDIT_DIR:m,CONFIG_PATH:n,AUDIT_LOG_PATH:o,AUDIT_LOG_DIR:p,DEFAULT_CONFIG:q,ensureAuditDir:s,loadConfig:function(){if(s(),!d.existsSync(n))return r();try{return v(JSON.parse(d.readFileSync(n,"utf8")))}catch(a){return console.warn(`[audit-proxy] invalid config ignored: ${a.message||a}`),r()}},saveConfig:function(a){s();let b=v(a),c=`${n}.tmp`;return d.writeFileSync(c,`${JSON.stringify(b,null,2)}
+`,{mode:384}),d.renameSync(c,n),b},validateConfig:v,normalizeAllowedHosts:t,normalizeAllowedClientIps:g}},48350:a=>{let b=new Set(["authorization","proxy-authorization","x-api-key","api-key","cookie","set-cookie","x-auth-token","x-access-token","cf-access-jwt-assertion"]),c=/(^|[_-])(access[_-]?token|refresh[_-]?token|id[_-]?token|token|api[_-]?key|apikey|password|passwd|secret|authorization|cookie)($|[_-])/i;function d(a){let c=String(a||"").toLowerCase();return b.has(c)||/token|secret|password|credential/i.test(c)}function e(a,b=new WeakSet){if(null==a||"object"!=typeof a)return a;if(b.has(a))return"[CIRCULAR]";if(b.add(a),Array.isArray(a))return a.map(a=>e(a,b));let d={};for(let[f,g]of Object.entries(a))d[f]=c.test(f)?"[REDACTED]":e(g,b);return d}function f(a){if(null==a)return a;let b=String(a);return(b=(b=b.replace(/\bBearer\s+[A-Za-z0-9._~+\/-]+=*/gi,"Bearer [REDACTED]")).replace(/\b(sk-ant-[A-Za-z0-9_-]{8,}|sk-[A-Za-z0-9_-]{8,})\b/g,"[REDACTED]")).replace(/("(?:access_token|refresh_token|id_token|api_key|apikey|password|secret|authorization)"\s*:\s*")([^"]+)(")/gi,"$1[REDACTED]$3")}a.exports={redactHeaders:function(a={}){let b={};for(let[c,e]of Object.entries(a||{}))b[c]=d(c)?"[REDACTED]":e;return b},redactObject:e,redactBodyText:function(a,b=""){let c=String(a||"");if(/application\/(?:[^;]+\+)?json/i.test(b)||/^[\s\r\n]*[\[{]/.test(c))try{let a=JSON.parse(c);return JSON.stringify(e(a))}catch{}return f(c)},scrubString:f,redactUrlPath:function(a){let b=String(a||"");try{let a=new URL(b,"https://audit.invalid");for(let b of[...a.searchParams.keys()])if(/token|secret|key|password|credential|authorization|^code$/i.test(b))a.searchParams.set(b,"[REDACTED]");else{let c=a.searchParams.get(b);c&&a.searchParams.set(b,f(c))}return`${a.pathname}${a.search}`}catch{return f(b)}},containsLikelySecret:function(a){let b="string"==typeof a?a:JSON.stringify(a);return/Bearer\s+(?!\[REDACTED\])\S+|sk-ant-[A-Za-z0-9_-]{8,}|\bsk-[A-Za-z0-9_-]{8,}/i.test(b||"")},shouldRedactHeader:d}},68257:(a,b,c)=>{let{normalizeIp:d}=c(5565),e="__blueRouterAuditProxySessions";function f(){return globalThis[e]||(globalThis[e]=new Map),globalThis[e]}function g(a){let b=Number(a);return Number.isFinite(b)&&b>=6e4?b:36e5}a.exports={DEFAULT_IDLE_TIMEOUT_MS:36e5,MIN_IDLE_TIMEOUT_MS:6e4,activateProxySession:function({userId:a,dashboardUserId:b,displayName:c,ip:e,idleTimeoutMs:h,groups:i}={}){let j=String(a||"").trim().toLowerCase(),k=d(e);if(!j||!k)return null;let l=Date.now(),m=g(h),n=f().get(k);n&&n.userId!==j&&console.log(`[audit-proxy] session for ${k} reassigned from ${n.userId} to ${j}`);let o={userId:j,dashboardUserId:String(b||"").trim().toLowerCase()||j,displayName:String(c||"").trim()||j,groups:Array.isArray(i)?i.filter(Boolean).map(String):[],activatedAt:n?.userId===j?n.activatedAt:l,expiresAt:l+m};return f().set(k,o),{ip:k,...o}},touchProxySession:function(a,b){let c=d(a),e=f().get(c);return e?(e.expiresAt=Date.now()+g(b),{ip:c,...e}):null},getProxySession:function(a){let b=d(a),c=f().get(b);return c?c.expiresAt<=Date.now()?(f().delete(b),null):{ip:b,...c}:null},listActiveProxySessions:function(){let a=Date.now(),b=[];for(let[c,d]of f()){if(d.expiresAt<=a){f().delete(c);continue}b.push({ip:c,...d})}return b.sort((a,b)=>b.expiresAt-a.expiresAt)},pruneExpiredProxySessions:function(){let a=Date.now(),b=0;for(let[c,d]of f())d.expiresAt<=a&&(f().delete(c),b+=1);return b},revokeProxySession:function(a){return f().delete(d(a))},revokeProxySessionsForUser:function(a){let b=String(a||"").trim().toLowerCase();if(!b)return 0;let c=0;for(let[a,d]of f())d.userId===b&&(f().delete(a),c+=1);return c},clearAllProxySessions:function(){let a=f().size;return f().clear(),a}}},77407:(a,b,c)=>{let{normalizeIp:d,clientIpMatches:e}=c(5565),{activateProxySession:f,touchProxySession:g,listActiveProxySessions:h}=c(68257);function i(a){return String(a||"").trim().toLowerCase()}function j(a){let b=Array.isArray(a)?a:a&&"object"==typeof a?Object.entries(a).map(([a,b])=>({userId:a,note:b})):[],c=new Map;for(let a of b){let b=i(a?.userId??a?.user??a?.id);b&&c.set(b,{userId:b,note:String((a?.note??c.get(b)?.note)||"").trim().slice(0,200)})}if(c.size>500)throw Error("At most 500 Audit Proxy access grants are supported");return[...c.values()].sort((a,b)=>a.userId.localeCompare(b.userId))}function k(a=[],b=""){let c=i(b);return c&&a.find(a=>a.userId===c)||null}function l(a={}){let b=a.grants||[],c=new Set(b.map(a=>a.userId)),d=h().filter(a=>c.has(a.userId));return{...a,enabled:!0,allowedClientIps:d.map(a=>a.ip),source:"sessions",grants:b,sessions:d}}a.exports={MAX_GRANTS:500,normalizeGrantUserId:i,normalizeAccessGrants:j,findAccessGrant:k,effectiveClientIpPolicy:function(a={}){return l({grants:j(a.accessGrants),sessionIdleTimeoutMs:a.sessionIdleTimeoutMs})},attachClientIpGate:function(a,b){let c=new Map;return a.prependListener("connection",a=>{let f=d(a?.remoteAddress||""),h=l(b()||{});if(h.enabled&&!e(f,h.allowedClientIps||[])){console.log(`[audit-proxy] denied client IP ${f||"unknown"} (${h.source||"manual"} allowlist)`);try{a.destroy()}catch{}return}g(f,h.sessionIdleTimeoutMs);let i=(h.sessions||[]).find(a=>a.ip===f);a.__auditDlpGroups=i?.groups||[],a.__auditDashboardUser=i?{userId:i.dashboardUserId||i.userId,displayName:i.displayName}:null,c.set(a,f),a.once("close",()=>c.delete(a))}),{dropRevoked(){let a=l(b()||{});if(!a.enabled)return 0;let d=0;for(let[b,f]of[...c])if(!e(f,a.allowedClientIps||[])){console.log(`[audit-proxy] closing connection from revoked client IP ${f||"unknown"}`);try{b.destroy()}catch{}c.delete(b),d+=1}return d},connectionCount:()=>c.size}},activateProxySessionOnLogin:function({userId:a,dashboardUserId:b,displayName:c,ip:d,config:e,groups:g}={}){let h=i(a);return h&&k(j(e?.accessGrants),h)?f({userId:h,dashboardUserId:b,displayName:c,ip:d,idleTimeoutMs:e?.sessionIdleTimeoutMs,groups:g}):null}}},87976:(a,b,c)=>{let{containsLikelySecret:d}=c(48350),{clientToolMatches:e,normalizeAllowedTools:f}=c(98586),g=/^data:([^;,]*)(;[^,]*)?,/i;function h(a){let b="string"==typeof a?a:"";if(!b)return 0;let c=b.replace(/\s/g,"");if(!c)return 0;let d=0;return c.endsWith("==")?d=2:c.endsWith("=")&&(d=1),Math.max(0,Math.floor(3*c.length/4)-d)}function i(a){let b="string"==typeof a?a:"",c=g.exec(b);return c?{mediaType:String(c[1]||"").toLowerCase()||"application/octet-stream",data:b.slice(c[0].length),isBase64:/;base64/i.test(c[2]||"")}:null}function j(a,b){let c=String(a||"").toLowerCase().trim(),d=String(b||"").toLowerCase().trim();return!!d&&("*"===d||"*/*"===d||(d.endsWith("/*")?c.startsWith(d.slice(0,-1)):c===d))}function k(a){return String(a||"").trim().toLowerCase().replace(/\.$/,"")}function l(a,b=[]){let c=k(a);return b.some(a=>{let b=k(a);if(!b)return!1;if(b===c)return!0;if(b.startsWith("*.")){let a=b.slice(1);return c.endsWith(a)&&c.length>a.length}return!1})}function m(a){return String(a||"").trim().toLowerCase().replace(/\s*,\s*/g,",")}function n(a){if(!a||"object"!=typeof a)return null;let b="string"==typeof a.type?a.type.toLowerCase():"";if(("image"===b||"document"===b)&&a.source&&"object"==typeof a.source){let c=a.source;if("base64"===c.type||"string"==typeof c.data)return{kind:b,mediaType:String(c.media_type||c.mediaType||"application/octet-stream").toLowerCase(),bytes:h(c.data),inline:!0};if("url"===c.type||"string"==typeof c.url)return{kind:b,mediaType:"",bytes:0,inline:!1}}if("image_url"===b){let b=i("string"==typeof a.image_url?a.image_url:a.image_url?.url);return b?{kind:"image",mediaType:b.mediaType,bytes:b.isBase64?h(b.data):Buffer.byteLength(b.data,"utf8"),inline:!0}:{kind:"image",mediaType:"",bytes:0,inline:!1}}if("input_image"===b||"input_file"===b){let c=i("string"==typeof a.image_url?a.image_url:a.file_data);if(c)return{kind:"input_image"===b?"image":"file",mediaType:c.mediaType,bytes:c.isBase64?h(c.data):Buffer.byteLength(c.data,"utf8"),inline:!0};if(a.file_id)return{kind:"file",mediaType:"",bytes:0,inline:!1}}let c=a.inline_data||a.inlineData;return c&&"object"==typeof c&&"string"==typeof c.data?{kind:"file",mediaType:String(c.mime_type||c.mimeType||"application/octet-stream").toLowerCase(),bytes:h(c.data),inline:!0}:null}function o(a){let b=[],c=[],d=0,e=0,f=!1,g=new WeakSet,h=(a,i)=>{if(f||null==a)return;if(d++>2e5){f=!0;return}if("string"==typeof a){e<1e6&&(c.push(a),e+=a.length);return}if("object"!=typeof a||i>16||g.has(a))return;if(g.add(a),Array.isArray(a)){for(let b of a)h(b,i+1);return}let j=n(a);if(j)return void b.push(j);for(let[b,c]of Object.entries(a))"data"!==b&&"file_data"!==b&&h(c,i+1)};return h(a,0),{attachments:b,text:c.join("\n"),budgetExceeded:f}}function p(a){let b=Number(a||0);return b>=1048576?`${(b/1048576).toFixed(1)} MB`:b>=1024?`${Math.round(b/1024)} KB`:`${b} bytes`}function q(a,b){if(!a||!1===a.enabled)return!1;let c=(a.sourceGroups||[]).filter(Boolean);if(c.length){let a=new Set((b.groups||[]).map(m));if(!c.some(b=>a.has(m(b))))return!1}let d=(a.destHosts||[]).filter(Boolean);if(d.length&&!l(b.host,d))return!1;let g=f(a.clientTools||[]);if(g.length&&!e(b.userAgent,g))return!1;let h=(a.methods||[]).filter(Boolean).map(a=>String(a).toUpperCase());return!h.length||!!h.includes(String(b.method||"").toUpperCase())}function r(a,b){return String(a||"").trim().toLowerCase().replace(/[^a-z0-9._-]/g,"-").slice(0,64)||b}function s(a,b=120){return String(a||"").trim().slice(0,b)}function t(a,b=100){let c=Array.isArray(a)?a:String(a||"").split(/[\n,]/),d=[];for(let a of c){let c=String(a||"").trim();if(c&&!d.includes(c)&&d.push(c),d.length>=b)break}return d}function u(a,b){let c=Number(a||0);if(!Number.isFinite(c)||c<0||c>0x20000000)throw Error(`${b} must be between 0 and 536870912 bytes`);return Math.round(c)}a.exports={base64DecodedSize:h,parseDataUrl:i,mediaTypeMatches:j,hostMatchesAny:l,describeAttachment:n,inspectBody:o,ruleMatches:q,evaluateRules:function(a,b){for(let c of a?.dlpRules||[]){if(!q(c,b))continue;let d="deny"===c.action?"deny":"accept",e="accept"===d&&c.profileId&&(a.dlpProfiles||[]).find(a=>a.id===c.profileId)||null;return{action:d,rule:c,profile:e,reason:c.name||c.id||"rule"}}return{action:a?.dlpDefaultAction==="deny"?"deny":"accept",rule:null,profile:null,reason:"default action"}},evaluateBody:function(a,b){let c={violations:[],attachments:[],totalBytes:0,budgetExceeded:!1};if(!b)return c;let{attachments:e,text:f,budgetExceeded:g}=o(a);c.attachments=e,c.budgetExceeded=g;let h=e.filter(a=>a.inline),i=h.reduce((a,b)=>a+b.bytes,0);c.totalBytes=i;let k=b.attachments||{},l=k.mode||"allow";if(e.length){if("deny"===l)c.violations.push({rule:"attachment-type",message:"Attachments are not allowed by the policy that applies to you",detail:`${e.length} attachment(s)`});else if("allowlist"===l)for(let a of e){if(!a.inline){c.violations.push({rule:"attachment-type",message:"Attachments referenced by URL cannot be inspected and are not allowed",detail:a.kind});continue}!function(a,b){return(b||[]).some(b=>j(a,b))}(a.mediaType,k.allowedMediaTypes)&&c.violations.push({rule:"attachment-type",message:`File type ${a.mediaType||"unknown"} is not allowed`,detail:`allowed: ${(k.allowedMediaTypes||[]).join(", ")||"none"}`})}let a=Number(k.maxCount||0);a>0&&e.length>a&&c.violations.push({rule:"attachment-count",message:`Too many attachments: ${e.length}, limit is ${a}`,detail:`count=${e.length}`});let b=Number(k.maxBytesEach||0);if(b>0)for(let a of h)a.bytes>b&&c.violations.push({rule:"attachment-size",message:`Attachment is ${p(a.bytes)}, limit is ${p(b)}`,detail:a.mediaType||a.kind});let d=Number(k.maxBytesTotal||0);d>0&&i>d&&c.violations.push({rule:"attachment-size",message:`Attachments total ${p(i)}, limit is ${p(d)}`,detail:`total=${i}`})}let m=b.text||{};for(let a of(m.blockLikelySecrets&&f&&d(f)&&c.violations.push({rule:"text-secret",message:"Request appears to contain a credential",detail:"likely-secret"}),function(a){let b=[];for(let c of a||[]){let a="string"==typeof c?c:c?.pattern;if(a)try{b.push({label:"object"==typeof c&&c?.label||a,re:RegExp(a,"i")})}catch{}}return b}(m.patterns)))a.re.test(f)&&c.violations.push({rule:"text-pattern",message:"Request matches a blocked content pattern",detail:a.label});return c},needsBodyInspection:function(a,b,c={}){if(!a?.profile)return!1;let d=String(b||"").toUpperCase();if("GET"===d||"HEAD"===d||"DELETE"===d||"OPTIONS"===d||!(Number(c["content-length"]||0)>0||c["transfer-encoding"]))return!1;let e=String(c["content-type"]||"").toLowerCase();return e.includes("json")||e.includes("multipart")},normalizeDlpProfiles:function(a){if(!Array.isArray(a))return[];if(a.length>50)throw Error("At most 50 DLP profiles are supported");let b=new Set;return a.map((a,c)=>{let d=r(a?.id,`profile-${c+1}`);if(b.has(d))throw Error(`Duplicate DLP profile id: ${d}`);b.add(d);let e=a?.attachments||{},f=["allow","deny","allowlist"].includes(e.mode)?e.mode:"allow",g=t(e.allowedMediaTypes).map(a=>a.toLowerCase());if("allowlist"===f&&!g.length)throw Error(`DLP profile "${d}": an allowlist needs at least one media type`);let h=a?.text||{},i=[];for(let a of Array.isArray(h.patterns)?h.patterns:[]){let b=String(("string"==typeof a?a:a?.pattern)||"").trim();if(b){if(b.length>500)throw Error(`DLP profile "${d}": pattern is longer than 500 characters`);try{RegExp(b,"i")}catch(a){throw Error(`DLP profile "${d}": invalid pattern ${b} (${a.message})`)}if(i.push({label:s("object"==typeof a?a?.label:"")||b,pattern:b}),i.length>=50)break}}return{id:d,label:s(a?.label)||d,attachments:{mode:f,allowedMediaTypes:g,maxBytesEach:u(e.maxBytesEach,`DLP profile "${d}" per-file limit`),maxBytesTotal:u(e.maxBytesTotal,`DLP profile "${d}" total limit`),maxCount:Math.max(0,Math.min(1e3,Math.round(Number(e.maxCount||0))||0))},text:{blockLikelySecrets:!0===h.blockLikelySecrets,patterns:i}}})},normalizeDlpRules:function(a,b=[]){if(!Array.isArray(a))return[];if(a.length>200)throw Error("At most 200 DLP rules are supported");let c=new Set(b.map(a=>a.id)),d=new Set;return a.map((a,b)=>{let e=r(a?.id,`rule-${b+1}`);if(d.has(e))throw Error(`Duplicate DLP rule id: ${e}`);d.add(e);let g=a?.action==="deny"?"deny":"accept",h="accept"===g?r(a?.profileId,""):"";if(h&&!c.has(h))throw Error(`DLP rule "${e}" refers to unknown profile "${h}"`);return{id:e,name:s(a?.name)||e,enabled:a?.enabled!==!1,sourceGroups:t(a?.sourceGroups),destHosts:t(a?.destHosts).map(a=>a.toLowerCase()),clientTools:f(a?.clientTools||[]),methods:t(a?.methods).map(a=>a.toUpperCase()),action:g,profileId:h,log:a?.log!==!1}})},formatBytes:p,MAX_DEPTH:16,MAX_NODES:2e5,MAX_RULES:200,MAX_PROFILES:50}},98586:a=>{let b=[{id:"claude-code",label:"Claude Code",patterns:["claude-cli","claude-code","anthropic"]},{id:"codex",label:"OpenAI Codex",patterns:["codex_cli","codex-cli","codex"]},{id:"gemini-cli",label:"Gemini CLI",patterns:["gemini-cli","google-genai"]},{id:"cursor",label:"Cursor",patterns:["cursor"]},{id:"copilot",label:"GitHub Copilot",patterns:["copilot","githubcopilot"]},{id:"kiro",label:"Kiro",patterns:["kiro","aws-sdk-js"]},{id:"vscode",label:"VS Code",patterns:["code/","code - insiders/","vscode"]},{id:"curl",label:"curl / scripts",patterns:["curl","wget","httpie"]}];function c(a){return String(a||"").trim().toLowerCase()}function d(a,b=[]){let e=c(a);return!!e&&!!b.length&&b.some(a=>a&&e.includes(a))}a.exports={TOOL_PRESETS:b,normalizeAllowedTools:function(a){let d=Array.isArray(a)?a:String(a||"").split(/[\r\n,]+/),e=[];for(let a of d){let d=c(a);if(!d)continue;let f=b.find(a=>a.id===d);f?e.push(...f.patterns):e.push(d)}return[...new Set(e)]},normalizeAllowedToolsInput:function(a){return[...new Set((Array.isArray(a)?a:String(a||"").split(/[\r\n,]+/)).map(c).filter(Boolean))]},clientToolMatches:d,shouldRefuseClientTool:function(a,b=[]){return!!c(a)&&!d(a,b)},describeUserAgent:function(a){let b=String(a||"").trim();return b?b.length>120?`${b.slice(0,119)}…`:b:"no User-Agent"}}},99504:(a,b,c)=>{let d=c(29021),e=c(33873),f=c(21820),g="bluerouter";function h(){return"win32"===process.platform?e.join(process.env.APPDATA||e.join(f.homedir(),"AppData","Roaming"),g):e.join(f.homedir(),`.${g}`)}let i=function(){let a=process.env.DATA_DIR;if(!a)return h();try{return d.mkdirSync(a,{recursive:!0}),a}catch(b){if(b?.code==="EACCES"||b?.code==="EPERM")return console.warn(`[DATA_DIR] '${a}' not writable → fallback ~/.${g}`),h();throw b}}(),j=e.join(i,"mitm");a.exports={DATA_DIR:i,CA_DIR:j}}};

package/app/.next-cli-build/server/chunks/3958.js

@@ -1,4 +1,4 @@
-"use strict";exports.id=3958,exports.ids=[3958],exports.modules={5541:(a,b,c)=>{let d=c(29021),e=c(91645),f=c(55511),g=c(5019),{generateRootCA:h,loadRootCA:i,readRootCAInfo:j,ROOT_CA_CERT_PATH:k,ROOT_CA_KEY_PATH:l}=c(6949);function m(a){return g.md.sha256.create().update(g.pki.publicKeyToPem(a),"utf8").digest().toHex()}function n(){let a=d.existsSync(k),b=d.existsSync(l);if(!a&&!b)return{exists:!1};if(!a||!b)throw Error("Root CA certificate/private key pair is incomplete; repair it from Advanced CA management");let c=i(),e=m(c.cert.publicKey);if(e!==m(function(a){if(!a?.n||!a?.e)throw Error("Audit Proxy supports RSA Root CA private keys only");return g.pki.setRsaPublicKey(a.n,a.e)}(c.key)))throw Error("Root CA certificate does not match its private key");let f=c.cert.getExtension("basicConstraints"),h=c.cert.getExtension("keyUsage");if(!f?.cA||h&&!0!==h.keyCertSign)throw Error("Root CA certificate is not authorized to sign leaf certificates");let j=new Date;if(c.cert.validity.notBefore>j)throw Error("Root CA certificate is not valid yet");if(c.cert.validity.notAfter<=j)throw Error("Root CA certificate has expired; Audit Proxy will not rotate it automatically");return{exists:!0,root:c,certFingerprint:e,expiresAt:c.cert.validity.notAfter,expiringSoon:c.cert.validity.notAfter.getTime()-Date.now()<2592e6}}let o=null;a.exports={ensureAuditRootCA:async function a(){let a=n();return a.exists||(await h(),a=n()),a.expiringSoon&&console.warn(`[audit-proxy] Root CA expires at ${a.expiresAt.toISOString()}; automatic CA rotation is disabled`),{...j(),validated:!0,autoRotation:!1}},validateRootCaPair:n,getStatusRootCaValidation:function(){let a=Date.now();if(o&&o.expiresAt>a){if(o.result.ok)return o.result.value;throw o.result.error}try{let b=n();return o={expiresAt:a+15e3,result:{ok:!0,value:b}},b}catch(b){throw o={expiresAt:a+15e3,result:{ok:!1,error:b}},b}},createAuditCertificateProvider:function({maxEntries:a=128}={}){let b=n();if(!b.exists)throw Error("Root CA is not initialized");let c=b.root,d=g.pki.rsa.generateKeyPair(2048),h=g.pki.privateKeyToPem(d.privateKey),i=new Map;function j(j){let k=function(a){let b=String(a||"").trim().replace(/^\[|\]$/g,"").toLowerCase();if(!b||/[\s/@\\]/.test(b)||!e.isIP(b)&&!/^[a-z0-9._-]+$/i.test(b))throw Error("Invalid certificate hostname");return b}(j),l=i.get(k);if(l&&l.notAfter>Date.now()+36e5)return i.delete(k),i.set(k,l),l.value;let m=g.pki.createCertificate();m.publicKey=d.publicKey,m.serialNumber=`00${f.randomBytes(16).toString("hex")}`,m.validity.notBefore=new Date(Date.now()-3e5);let n=Date.now()+7776e6,o=c.cert.validity.notAfter.getTime()-6e4;if(m.validity.notAfter=new Date(Math.min(n,o)),m.validity.notAfter<=m.validity.notBefore)throw Error("Root CA lifetime is too short to issue a valid leaf certificate");m.setSubject([{name:"commonName",value:k}]),m.setIssuer(c.cert.subject.attributes);let p=e.isIP(k)?{type:7,ip:k}:{type:2,value:k};m.setExtensions([{name:"basicConstraints",cA:!1,critical:!0},{name:"keyUsage",digitalSignature:!0,keyEncipherment:!0,critical:!0},{name:"extKeyUsage",serverAuth:!0},{name:"subjectAltName",altNames:[p]},{name:"subjectKeyIdentifier"}]),m.sign(c.key,g.md.sha256.create());let q={key:h,cert:`${g.pki.certificateToPem(m)}${g.pki.certificateToPem(c.cert)}`,host:k,notAfter:m.validity.notAfter.toISOString(),rootFingerprint:b.certFingerprint};for(i.set(k,{value:q,notAfter:m.validity.notAfter.getTime()});i.size>Math.max(8,Number(a)||128);)i.delete(i.keys().next().value);return q}return j.prewarm=(a=[])=>{for(let b of a||[]){let a=String(b||"").trim();a&&!a.includes("*")&&j(a)}},j.clear=()=>i.clear(),j.stats=()=>({entries:i.size,rootFingerprint:b.certFingerprint}),j}}},6949:(a,b,c)=>{let d=c(33873),e=c(29021),f=c(5019),{execFileSync:g}=c(79646),{CA_DIR:h}=c(35723),i=d.join(h,"rootCA.key"),j=d.join(h,"rootCA.crt"),k=d.join(h,"rootCA.csr"),l=d.join(h,"rootCA.csr.cnf"),m=d.join(h,"rootCA.pending.key"),n=d.join(h,"backup");function o(){e.existsSync(h)||e.mkdirSync(h,{recursive:!0})}function p(a,b){let c=String(a||"").trim();if(!c)throw Error(`${b} is empty`);return`${c}
+"use strict";exports.id=3958,exports.ids=[3958],exports.modules={5541:(a,b,c)=>{let d=c(29021),e=c(91645),f=c(55511),g=c(5019),{generateRootCA:h,loadRootCA:i,readRootCAInfo:j,ROOT_CA_CERT_PATH:k,ROOT_CA_KEY_PATH:l}=c(6949);function m(a){return g.md.sha256.create().update(g.pki.publicKeyToPem(a),"utf8").digest().toHex()}function n(){let a=d.existsSync(k),b=d.existsSync(l);if(!a&&!b)return{exists:!1};if(!a||!b)throw Error("Root CA certificate/private key pair is incomplete; repair it from Advanced CA management");let c=i(),e=m(c.cert.publicKey);if(e!==m(function(a){if(!a?.n||!a?.e)throw Error("Audit Proxy supports RSA Root CA private keys only");return g.pki.setRsaPublicKey(a.n,a.e)}(c.key)))throw Error("Root CA certificate does not match its private key");let f=c.cert.getExtension("basicConstraints"),h=c.cert.getExtension("keyUsage");if(!f?.cA||h&&!0!==h.keyCertSign)throw Error("Root CA certificate is not authorized to sign leaf certificates");let j=new Date;if(c.cert.validity.notBefore>j)throw Error("Root CA certificate is not valid yet");if(c.cert.validity.notAfter<=j)throw Error("Root CA certificate has expired; Audit Proxy will not rotate it automatically");return{exists:!0,root:c,certFingerprint:e,expiresAt:c.cert.validity.notAfter,expiringSoon:c.cert.validity.notAfter.getTime()-Date.now()<2592e6}}let o=null;a.exports={ensureAuditRootCA:async function a(){let a=n();return a.exists||(await h(),a=n()),a.expiringSoon&&console.warn(`[audit-proxy] Root CA expires at ${a.expiresAt.toISOString()}; automatic CA rotation is disabled`),{...j(),validated:!0,autoRotation:!1}},validateRootCaPair:n,getStatusRootCaValidation:function(){let a=Date.now();if(o&&o.expiresAt>a){if(o.result.ok)return o.result.value;throw o.result.error}try{let b=n();return o={expiresAt:a+15e3,result:{ok:!0,value:b}},b}catch(b){throw o={expiresAt:a+15e3,result:{ok:!1,error:b}},b}},createAuditCertificateProvider:function({maxEntries:a=128}={}){let b=n();if(!b.exists)throw Error("Root CA is not initialized");let c=b.root,d=g.pki.rsa.generateKeyPair(2048),h=g.pki.privateKeyToPem(d.privateKey),i=new Map,j=c.cert.getExtension("subjectKeyIdentifier"),k=j?.subjectKeyIdentifier?g.util.hexToBytes(j.subjectKeyIdentifier):c.cert.generateSubjectKeyIdentifier().getBytes();function l(j){let l=function(a){let b=String(a||"").trim().replace(/^\[|\]$/g,"").toLowerCase();if(!b||/[\s/@\\]/.test(b)||!e.isIP(b)&&!/^[a-z0-9._-]+$/i.test(b))throw Error("Invalid certificate hostname");return b}(j),m=i.get(l);if(m&&m.notAfter>Date.now()+36e5)return i.delete(l),i.set(l,m),m.value;let n=g.pki.createCertificate();n.publicKey=d.publicKey,n.serialNumber=`00${f.randomBytes(16).toString("hex")}`,n.validity.notBefore=new Date(Date.now()-3e5);let o=Date.now()+7776e6,p=c.cert.validity.notAfter.getTime()-6e4;if(n.validity.notAfter=new Date(Math.min(o,p)),n.validity.notAfter<=n.validity.notBefore)throw Error("Root CA lifetime is too short to issue a valid leaf certificate");n.setSubject([{name:"commonName",value:l}]),n.setIssuer(c.cert.subject.attributes);let q=e.isIP(l)?{type:7,ip:l}:{type:2,value:l};n.setExtensions([{name:"basicConstraints",cA:!1,critical:!0},{name:"keyUsage",digitalSignature:!0,keyEncipherment:!0,critical:!0},{name:"extKeyUsage",serverAuth:!0},{name:"subjectAltName",altNames:[q]},{name:"subjectKeyIdentifier"},{name:"authorityKeyIdentifier",keyIdentifier:k}]),n.sign(c.key,g.md.sha256.create());let r={key:h,cert:`${g.pki.certificateToPem(n)}${g.pki.certificateToPem(c.cert)}`,host:l,notAfter:n.validity.notAfter.toISOString(),rootFingerprint:b.certFingerprint};for(i.set(l,{value:r,notAfter:n.validity.notAfter.getTime()});i.size>Math.max(8,Number(a)||128);)i.delete(i.keys().next().value);return r}return l.prewarm=(a=[])=>{for(let b of a||[]){let a=String(b||"").trim();a&&!a.includes("*")&&l(a)}},l.clear=()=>i.clear(),l.stats=()=>({entries:i.size,rootFingerprint:b.certFingerprint}),l}}},6949:(a,b,c)=>{let d=c(33873),e=c(29021),f=c(5019),{execFileSync:g}=c(79646),{CA_DIR:h}=c(35723),i=d.join(h,"rootCA.key"),j=d.join(h,"rootCA.crt"),k=d.join(h,"rootCA.csr"),l=d.join(h,"rootCA.csr.cnf"),m=d.join(h,"rootCA.pending.key"),n=d.join(h,"backup");function o(){e.existsSync(h)||e.mkdirSync(h,{recursive:!0})}function p(a,b){let c=String(a||"").trim();if(!c)throw Error(`${b} is empty`);return`${c}
 `}function q(a){return f.md.sha256.create().update(f.pki.publicKeyToPem(a),"utf8").digest().toHex()}function r(a){let b=a.getExtension("basicConstraints"),c=a.getExtension("keyUsage");return!!b?.cA&&(!c||!0===c.keyCertSign)}function s(a,b){if(q(a.publicKey)!==q(function(a){if(!a?.n||!a?.e)throw Error("Only RSA private keys are supported for Audit Root CA");return f.pki.setRsaPublicKey(a.n,a.e)}(b)))throw Error("Certificate public key does not match private key")}function t(){o();let a=e.existsSync(i),b=e.existsSync(j);if(!a&&!b)return null;e.mkdirSync(n,{recursive:!0});let c=new Date().toISOString().replace(/[:.]/g,"-"),f={key:d.join(n,`rootCA.${c}.key`),cert:d.join(n,`rootCA.${c}.crt`)};return a&&e.copyFileSync(i,f.key),b&&e.copyFileSync(j,f.cert),f}function u(a,b="Certificate"){try{return f.pki.certificateFromPem(p(a,b))}catch(a){throw Error(`${b} is not a valid PEM certificate: ${a.message}`)}}function v(a,b="Private key"){try{return f.pki.privateKeyFromPem(p(a,b))}catch(a){throw Error(`${b} is not a valid PEM private key: ${a.message}`)}}function w(a){try{let b=f.pki.certificateFromPem(e.readFileSync(a,"utf8")),c=new Date(Date.now()+2592e6);return b.validity.notAfter<c}catch{return!0}}function x(){let a=e.existsSync(j),b=e.existsSync(i),c={certExists:a,keyExists:b,csrExists:e.existsSync(k),pendingKeyExists:e.existsSync(m),certPath:j,keyPath:i,csrPath:k,pendingKeyPath:m};if(!a)return c;try{let a=u(e.readFileSync(j,"utf8")),b=a.subject.attributes.map(a=>`${a.shortName||a.name}=${a.value}`).join(", "),d=a.issuer.attributes.map(a=>`${a.shortName||a.name}=${a.value}`).join(", ");c.subject=b,c.issuer=d,c.serialNumber=a.serialNumber,c.notBefore=a.validity.notBefore.toISOString(),c.notAfter=a.validity.notAfter.toISOString(),c.expiredOrExpiringSoon=w(j),c.isCa=r(a),c.isSelfSigned=b===d,c.fingerprint=q(a.publicKey)}catch(a){c.error=a.message}return c}function y({certPem:a,keyPem:b}){let c=p(a,"Certificate"),d=p(b,"Private key"),e=u(c),f=v(d);if(s(e,f),!r(e))throw Error("Certificate must be a CA certificate with basicConstraints CA:true and keyCertSign usage");if(e.validity.notAfter<new Date)throw Error("Certificate is already expired");return{certText:c,keyText:d,cert:e,privateKey:f}}function z(a,b){return String(a||b||"").replace(/[\r\n]+/g," ").replace(/[\\]/g,"\\\\").trim()||String(b||"")}a.exports={generateRootCA:async function a(){let a=e.existsSync(i)&&e.existsSync(j);if(a&&!w(j))return console.log("✅ Root CA already exists"),{key:i,cert:j};if(a){console.log("\uD83D\uDD10 Root CA expired or expiring soon — regenerating...");try{e.unlinkSync(i)}catch{}try{e.unlinkSync(j)}catch{}}o(),console.log("\uD83D\uDD10 Generating Root CA certificate...");let b=f.pki.rsa.generateKeyPair(2048),c=f.pki.createCertificate();c.publicKey=b.publicKey,c.serialNumber="01",c.validity.notBefore=new Date,c.validity.notAfter=new Date,c.validity.notAfter.setFullYear(c.validity.notBefore.getFullYear()+10);let d=[{name:"commonName",value:"Blue Router Gateway Root CA"},{name:"organizationName",value:"Blue Router Gateway"},{name:"countryName",value:"VN"}];c.setSubject(d),c.setIssuer(d),c.setExtensions([{name:"basicConstraints",cA:!0,critical:!0},{name:"keyUsage",keyCertSign:!0,cRLSign:!0,critical:!0},{name:"subjectKeyIdentifier"}]),c.sign(b.privateKey,f.md.sha256.create());let g=f.pki.privateKeyToPem(b.privateKey),h=f.pki.certificateToPem(c);return e.writeFileSync(i,g,{mode:384}),e.writeFileSync(j,h),console.log("✅ Root CA generated successfully"),{key:i,cert:j}},importRootCAPair:function({certPem:a,keyPem:b}){o();let{certText:c,keyText:d}=y({certPem:a,keyPem:b}),f=t();e.writeFileSync(i,d,{mode:384}),e.writeFileSync(j,c);try{e.unlinkSync(k)}catch{}try{e.unlinkSync(m)}catch{}return{key:i,cert:j,backup:f,info:x()}},validateRootCAPairPem:y,generateRootCACsr:function({commonName:a,organizationName:b,countryName:c}={}){if(o(),function(){try{return g("openssl",["version"],{stdio:"ignore"}),!0}catch{return!1}}())return function({commonName:a,organizationName:b,countryName:c}={}){let d=z(a,"Fujinet Bluerouter Audit CA"),f=z(b,"Fujinet"),h=z(c,"VN").slice(0,2).toUpperCase()||"VN",i=`[ req ]
 default_bits       = 4096
 prompt             = no
@@ -15,13 +15,13 @@ CN = ${d}
 basicConstraints = critical, CA:true, pathlen:0
 keyUsage = critical, keyCertSign, cRLSign
 subjectKeyIdentifier = hash
-`,j=t();e.writeFileSync(l,i,"utf8");try{g("openssl",["genrsa","-out",m,"4096"],{stdio:["ignore","pipe","pipe"]}),g("openssl",["req","-new","-key",m,"-out",k,"-config",l],{stdio:["ignore","pipe","pipe"]});try{e.chmodSync(m,384)}catch{}return{csr:k,pendingKey:m,config:l,backup:j}}catch(b){try{e.unlinkSync(m)}catch{}try{e.unlinkSync(k)}catch{}let a=b?.stderr?String(b.stderr).trim():"";throw Error(`OpenSSL CSR generation failed${a?`: ${a}`:""}`)}}({commonName:a,organizationName:b,countryName:c});let d=[{name:"commonName",value:String(a||"Fujinet Bluerouter Audit CA").trim()||"Fujinet Bluerouter Audit CA"},{name:"organizationName",value:String(b||"Fujinet").trim()||"Fujinet"},{name:"organizationalUnitName",value:"AI Gateway"}],h=String(c||"VN").trim().slice(0,2).toUpperCase();h&&d.push({name:"countryName",value:h});let i=f.pki.rsa.generateKeyPair(4096),j=f.pki.createCertificationRequest();if(j.publicKey=i.publicKey,j.setSubject(d),j.sign(i.privateKey,f.md.sha256.create()),!j.verify())throw Error("Generated CSR failed verification");let n=t(),p=f.pki.certificationRequestToPem(j),q=f.pki.privateKeyToPem(i.privateKey);return e.writeFileSync(m,q,{mode:384}),e.writeFileSync(k,p),{csr:k,pendingKey:m,backup:n}},importSignedRootCACert:function({certPem:a}){if(o(),!e.existsSync(m))throw Error("No pending CSR private key found. Generate a CSR first.");let b=p(a,"Signed certificate"),c=u(b,"Signed certificate");if(s(c,v(e.readFileSync(m,"utf8"),"Pending private key")),!r(c))throw Error("Signed certificate must be a CA certificate with CA:true and keyCertSign usage");if(c.validity.notAfter<new Date)throw Error("Signed certificate is already expired");let d=t();e.copyFileSync(m,i);try{e.chmodSync(i,384)}catch{}e.writeFileSync(j,b);try{e.unlinkSync(k)}catch{}try{e.unlinkSync(m)}catch{}return{key:i,cert:j,backup:d,info:x()}},loadRootCA:function(){if(!e.existsSync(i)||!e.existsSync(j))throw Error("Root CA not found. Generate it first.");let a=e.readFileSync(i,"utf8"),b=e.readFileSync(j,"utf8");return{key:f.pki.privateKeyFromPem(a),cert:f.pki.certificateFromPem(b)}},generateLeafCert:function(a,b){let c=f.pki.rsa.generateKeyPair(2048),d=f.pki.createCertificate();return d.publicKey=c.publicKey,d.serialNumber=Math.floor(1e6*Math.random()).toString(),d.validity.notBefore=new Date,d.validity.notAfter=new Date,d.validity.notAfter.setFullYear(d.validity.notBefore.getFullYear()+1),d.setSubject([{name:"commonName",value:a}]),d.setIssuer(b.cert.subject.attributes),d.setExtensions([{name:"basicConstraints",cA:!1},{name:"keyUsage",digitalSignature:!0,keyEncipherment:!0},{name:"extKeyUsage",serverAuth:!0,clientAuth:!0},{name:"subjectAltName",altNames:[{type:2,value:a},{type:2,value:`*.${a}`}]}]),d.sign(b.key,f.md.sha256.create()),{key:f.pki.privateKeyToPem(c.privateKey),cert:f.pki.certificateToPem(d)}},isCertExpired:w,readRootCAInfo:x,ROOT_CA_CERT_PATH:j,ROOT_CA_KEY_PATH:i,ROOT_CA_CSR_PATH:k,ROOT_CA_PENDING_KEY_PATH:m}},11562:a=>{function b(a){let b=Number(a);return!Number.isFinite(b)||b<0?0:Math.round(b)}function c(){return{inputTokens:0,outputTokens:0,cacheReadTokens:0,cacheCreationTokens:0,reasoningTokens:0,totalTokens:0,model:null,stopReason:null,streaming:!1,complete:!1,source:null}}function d(a){let b=String(a||"").trim();if(!b||"{"!==b[0])return null;try{let a=JSON.parse(b);return a&&"object"==typeof a&&!Array.isArray(a)?a:null}catch{return null}}function e(a,c){"string"==typeof c.model&&c.model&&!a.model&&(a.model=c.model);let d="response.completed"===c.type||"response.done"===c.type?c.response?.usage:null,e=d||c.usage;if(!e||"object"!=typeof e)return!1;d&&"string"==typeof c.response?.model&&c.response.model&&(a.model=c.response.model);let f=b(e.prompt_tokens??e.input_tokens),g=b(e.completion_tokens??e.output_tokens);if(!f&&!g)return!1;let h=b(e.prompt_tokens_details?.cached_tokens??e.input_tokens_details?.cached_tokens??e.cached_tokens??e.prompt_cache_hit_tokens);a.inputTokens=Math.max(0,f-h),a.cacheReadTokens=h,a.outputTokens=g,a.reasoningTokens=b(e.completion_tokens_details?.reasoning_tokens??e.output_tokens_details?.reasoning_tokens),a.complete=!0;let i=c.choices?.[0]?.finish_reason;return"string"==typeof i&&i&&(a.stopReason=i),!0}function f(a,f){let g=c();g.streaming=!0,g.source="sse";let h=!1;for(let c of function*(a){let b=String(a||""),c=0;for(;c<b.length;){let a=b.indexOf("\n",c);-1===a&&(a=b.length);let e=b.slice(c,a).trim();if(c=a+1,!e.startsWith("data:"))continue;let f=e.slice(5).trim();if(!f||"[DONE]"===f)continue;let g=d(f);g&&(yield g)}}(a)){if(("anthropic"===f||"message_start"===c.type||"message_delta"===c.type)&&function(a,c){let d=String(c.type||"");if("message_start"===d&&c.message&&"object"==typeof c.message){let d=c.message;"string"==typeof d.model&&d.model&&(a.model=d.model);let e=d.usage;return e&&"object"==typeof e&&(a.inputTokens=b(e.input_tokens)||a.inputTokens,a.cacheReadTokens=b(e.cache_read_input_tokens)||a.cacheReadTokens,a.cacheCreationTokens=b(e.cache_creation_input_tokens)||a.cacheCreationTokens),!0}if("message_delta"===d){let d=c.usage;d&&"object"==typeof d&&(a.outputTokens=b(d.output_tokens)||a.outputTokens,a.inputTokens=a.inputTokens||b(d.input_tokens),a.cacheReadTokens=a.cacheReadTokens||b(d.cache_read_input_tokens),a.cacheCreationTokens=a.cacheCreationTokens||b(d.cache_creation_input_tokens),a.complete=!0);let e=c.delta?.stop_reason;return"string"==typeof e&&e&&(a.stopReason=e),!0}return!1}(g,c)){h=!0;continue}e(g,c)&&(h=!0)}return h?g:null}function g(a){let f=d(a);if(!f)return null;let g=c();g.source="json","string"==typeof f.model&&f.model&&(g.model=f.model);let h=f.usage;return h&&"object"==typeof h?null!=h.input_tokens||null!=h.output_tokens?(g.inputTokens=b(h.input_tokens),g.outputTokens=b(h.output_tokens),g.cacheReadTokens=b(h.cache_read_input_tokens),g.cacheCreationTokens=b(h.cache_creation_input_tokens),g.complete=!0,"string"==typeof f.stop_reason&&(g.stopReason=f.stop_reason),g):e(g,f)?g:null:null}function h(a){return/\/count_tokens\b/.test(String(a||""))}function i(a){return a.inputTokens+a.cacheReadTokens+a.cacheCreationTokens}a.exports={extractUsageFromBody:function({provider:a,body:b,contentType:c="",path:d=""}={}){if("string"!=typeof b||!b||b.length>0x1000000||h(d))return null;let e=/event-stream/i.test(String(c||""))||b.includes("\ndata:")||b.startsWith("data:")?f(b,a)||g(b):g(b)||f(b,a);return e&&(e&&(e.inputTokens||e.outputTokens||e.cacheReadTokens||e.cacheCreationTokens)||e.model)?(e.totalTokens=e.inputTokens+e.outputTokens+e.cacheReadTokens+e.cacheCreationTokens,e):null},isTokenCountingEndpoint:h,toTokensJson:function(a){if(!a)return null;let b=i(a),c={input_tokens:a.inputTokens,output_tokens:a.outputTokens,prompt_tokens:b,completion_tokens:a.outputTokens,total_tokens:a.totalTokens,display_total_input_tokens:b,display_new_input_tokens:a.inputTokens,display_cached_input_tokens:a.cacheReadTokens,display_cache_creation_input_tokens:a.cacheCreationTokens,display_output_tokens:a.outputTokens};return a.cacheReadTokens&&(c.cache_read_input_tokens=a.cacheReadTokens),a.cacheCreationTokens&&(c.cache_creation_input_tokens=a.cacheCreationTokens),a.cacheReadTokens&&(c.cached_tokens=a.cacheReadTokens),a.reasoningTokens&&(c.reasoning_tokens=a.reasoningTokens),c},totalInputTokens:i}},33575:(a,b,c)=>{let d=c(81630),e=c(73496),f=c(55591),g=c(91645),h=c(34631),i=c(55511),j=c(74075),{promisify:k}=c(28354),{redactHeaders:l,redactBodyText:m,redactUrlPath:n,scrubString:o}=c(14681),{extractUsageFromBody:p}=c(11562),{resolvePublicTarget:q}=c(77051),{normalizeAllowedTools:r,shouldRefuseClientTool:s,describeUserAgent:t}=c(47141),{evaluateRules:u,evaluateBody:v,needsBodyInspection:w}=c(96059),{createProxyAuthenticator:x,createProxyAuthLimiter:y}=c(99721),z=k(j.brotliDecompress),A=k(j.gunzip),B=k(j.inflate),C=k(j.inflateRaw),D="function"==typeof j.zstdDecompress?k(j.zstdDecompress):null,E=new Set(["connection","proxy-connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade"]);function F(a){return String(a||"").trim().replace(/^\[|\]$/g,"").toLowerCase()}function G(a,b=443){let c=String(a||"").trim();if(!c)throw Error("Missing CONNECT authority");if(c.startsWith("[")){let a=c.indexOf("]");if(a<0)throw Error("Invalid IPv6 CONNECT authority");let d=c.slice(1,a),e=c.slice(a+1);if(e&&!e.startsWith(":"))throw Error("Invalid IPv6 CONNECT authority");let f=e?Number(e.slice(1)):b;if(!Number.isInteger(f)||f<1||f>65535)throw Error("Invalid CONNECT port");return{host:d,port:f}}let d=c.lastIndexOf(":");if(d>0&&c.indexOf(":")===d){let a=c.slice(d+1);if(!/^\d+$/.test(a))throw Error("Invalid CONNECT port");let b=Number(a);if(!Number.isInteger(b)||b<1||b>65535)throw Error("Invalid CONNECT port");return{host:c.slice(0,d),port:b}}return{host:c,port:b}}function H(a,b=[]){let c=F(a);return b.some(a=>{let b=F(a);if(!b)return!1;if(b===c)return!0;if(b.startsWith("*.")){let a=b.slice(1);return c.endsWith(a)&&c.length>a.length}return!1})}function I(a={},{stripInternal:b=!0}={}){let c=new Set([...E,...String(a.connection||"").split(",").map(a=>a.trim().toLowerCase()).filter(Boolean)]),d={};for(let[e,f]of Object.entries(a||{})){let a=e.toLowerCase();!c.has(a)&&(b&&(a.startsWith("x-9r-")||a.startsWith("x-bluerouter-"))||(d[e]=f))}return d}async function J(a,b,c){let d=String(b||"").split(",").map(a=>a.trim().toLowerCase()).filter(a=>a&&"identity"!==a);if(!d.length||!a.length)return{buffer:a,decoded:!1,contentEncoding:d.join(", ")||null};let e=a;for(let a of[...d].reverse()){let b={maxOutputLength:c};if("br"===a)e=await z(e,b);else if("gzip"===a||"x-gzip"===a)e=await A(e,b);else if("deflate"===a)try{e=await B(e,b)}catch{e=await C(e,b)}else if("zstd"===a&&D)e=await D(e,b);else throw Error(`Unsupported content-encoding: ${a}`)}return{buffer:e,decoded:!0,contentEncoding:d.join(", ")}}async function K(a,b,c){let d=String(b||"").split(",").map(a=>a.trim().toLowerCase()).filter(a=>a&&"identity"!==a);if(1!==d.length||!a.length)return null;let e=d[0],f={maxOutputLength:c,finishFlush:j.constants.Z_SYNC_FLUSH};try{if("gzip"===e||"x-gzip"===e)return await A(a,f);if("deflate"===e)try{return await B(a,f)}catch{return await C(a,f)}if("br"===e)return await z(a,{maxOutputLength:c,finishFlush:j.constants.BROTLI_OPERATION_FLUSH})}catch{}return null}class L{constructor(a){this.limitBytes=Math.max(0,Number(a)||0),this.parts=[],this.capturedBytes=0,this.totalBytes=0,this.truncated=!1,this.hash=i.createHash("sha256"),this.finished=!1}add(a){if(!a||this.finished)return;let b=Buffer.isBuffer(a)?a:Buffer.from(a);if(this.hash.update(b),this.totalBytes+=b.length,this.capturedBytes>=this.limitBytes){b.length&&(this.truncated=!0);return}let c=this.limitBytes-this.capturedBytes,d=b.length>c?b.subarray(0,c):b;d.length&&(this.parts.push(Buffer.from(d)),this.capturedBytes+=d.length),d.length<b.length&&(this.truncated=!0)}async finish(a="",b=""){if(this.finished)throw Error("Audit capture was finalized more than once");this.finished=!0;let c=this.hash.digest("hex"),d=Buffer.concat(this.parts),e=String(b||"").trim().toLowerCase(),f=d,g=!1,h=null,i=!1,j=null,k=null,l=!1,n=Math.max(1048576,Math.min(0x4000000,Math.max(8*this.limitBytes,this.limitBytes)));if(this.limitBytes>0&&d.length&&e&&"identity"!==e)if(this.truncated){let a=await K(d,e,n);a&&a.length?(f=a,g=!0,l=!0,h=a.length,i=!0):(j=`Compressed ${e} capture was truncated before decode`,k=`[${e} audit body capture truncated; decoded body unavailable]`)}else try{let a=await J(d,e,n);f=a.buffer,g=a.decoded,h=f.length,f.length>this.limitBytes&&(f=f.subarray(0,this.limitBytes),i=!0)}catch(a){j=o(a?.message||String(a)),k=`[Unable to decode ${e} audit body: ${j}]`}let p=/json|text|javascript|xml|x-www-form-urlencoded|event-stream/i.test(a||"");return{body:null!==k?k:p||!a?m(f.toString("utf8"),a):`[${f.length} bytes captured; binary body omitted]`,capturedBytes:this.capturedBytes,totalBytes:this.totalBytes,wireSha256:c,truncated:this.truncated||i,...e&&"identity"!==e?{contentEncoding:e}:{},...g?{decoded:!0,decodedBytes:h}:{},...l?{decodePartial:!0}:{},...j?{decodeError:j}:{}}}}function M(a){let b=F(a);return"api.anthropic.com"===b||b.endsWith(".anthropic.com")||"claude.ai"===b||b.endsWith(".claude.ai")?"anthropic":"api.openai.com"===b||b.endsWith(".openai.com")||"chatgpt.com"===b||b.endsWith(".chatgpt.com")?"openai":"other"}function N(a,b,c){let d=Buffer.from("anthropic"===M(b)?JSON.stringify({type:"error",error:{type:"permission_error",message:c}}):JSON.stringify({error:{message:c,type:"invalid_request_error",code:"content_policy_blocked"}}),"utf8");a.writeHead(403,{"content-type":"application/json; charset=utf-8","content-length":String(d.length),connection:"close"}),a.end(d)}function O(a){if(!a||"string"!=typeof a)return null;try{let b=JSON.parse(a);return"string"==typeof b?.model?b.model:null}catch{return null}}function P(a){let b=a?.remoteAddress||"";return b.startsWith("::ffff:")?b.slice(7):b}function Q(a,b,c,d=null){try{let e=String(c||b),f=(d||[]).filter(a=>"string"==typeof a&&!/[\r\n]/.test(a)).map(a=>`${a}\r
+`,j=t();e.writeFileSync(l,i,"utf8");try{g("openssl",["genrsa","-out",m,"4096"],{stdio:["ignore","pipe","pipe"]}),g("openssl",["req","-new","-key",m,"-out",k,"-config",l],{stdio:["ignore","pipe","pipe"]});try{e.chmodSync(m,384)}catch{}return{csr:k,pendingKey:m,config:l,backup:j}}catch(b){try{e.unlinkSync(m)}catch{}try{e.unlinkSync(k)}catch{}let a=b?.stderr?String(b.stderr).trim():"";throw Error(`OpenSSL CSR generation failed${a?`: ${a}`:""}`)}}({commonName:a,organizationName:b,countryName:c});let d=[{name:"commonName",value:String(a||"Fujinet Bluerouter Audit CA").trim()||"Fujinet Bluerouter Audit CA"},{name:"organizationName",value:String(b||"Fujinet").trim()||"Fujinet"},{name:"organizationalUnitName",value:"AI Gateway"}],h=String(c||"VN").trim().slice(0,2).toUpperCase();h&&d.push({name:"countryName",value:h});let i=f.pki.rsa.generateKeyPair(4096),j=f.pki.createCertificationRequest();if(j.publicKey=i.publicKey,j.setSubject(d),j.sign(i.privateKey,f.md.sha256.create()),!j.verify())throw Error("Generated CSR failed verification");let n=t(),p=f.pki.certificationRequestToPem(j),q=f.pki.privateKeyToPem(i.privateKey);return e.writeFileSync(m,q,{mode:384}),e.writeFileSync(k,p),{csr:k,pendingKey:m,backup:n}},importSignedRootCACert:function({certPem:a}){if(o(),!e.existsSync(m))throw Error("No pending CSR private key found. Generate a CSR first.");let b=p(a,"Signed certificate"),c=u(b,"Signed certificate");if(s(c,v(e.readFileSync(m,"utf8"),"Pending private key")),!r(c))throw Error("Signed certificate must be a CA certificate with CA:true and keyCertSign usage");if(c.validity.notAfter<new Date)throw Error("Signed certificate is already expired");let d=t();e.copyFileSync(m,i);try{e.chmodSync(i,384)}catch{}e.writeFileSync(j,b);try{e.unlinkSync(k)}catch{}try{e.unlinkSync(m)}catch{}return{key:i,cert:j,backup:d,info:x()}},loadRootCA:function(){if(!e.existsSync(i)||!e.existsSync(j))throw Error("Root CA not found. Generate it first.");let a=e.readFileSync(i,"utf8"),b=e.readFileSync(j,"utf8");return{key:f.pki.privateKeyFromPem(a),cert:f.pki.certificateFromPem(b)}},generateLeafCert:function(a,b){let c=f.pki.rsa.generateKeyPair(2048),d=f.pki.createCertificate();return d.publicKey=c.publicKey,d.serialNumber=Math.floor(1e6*Math.random()).toString(),d.validity.notBefore=new Date,d.validity.notAfter=new Date,d.validity.notAfter.setFullYear(d.validity.notBefore.getFullYear()+1),d.setSubject([{name:"commonName",value:a}]),d.setIssuer(b.cert.subject.attributes),d.setExtensions([{name:"basicConstraints",cA:!1},{name:"keyUsage",digitalSignature:!0,keyEncipherment:!0},{name:"extKeyUsage",serverAuth:!0,clientAuth:!0},{name:"subjectAltName",altNames:[{type:2,value:a},{type:2,value:`*.${a}`}]}]),d.sign(b.key,f.md.sha256.create()),{key:f.pki.privateKeyToPem(c.privateKey),cert:f.pki.certificateToPem(d)}},isCertExpired:w,readRootCAInfo:x,ROOT_CA_CERT_PATH:j,ROOT_CA_KEY_PATH:i,ROOT_CA_CSR_PATH:k,ROOT_CA_PENDING_KEY_PATH:m}},11562:a=>{function b(a){let b=Number(a);return!Number.isFinite(b)||b<0?0:Math.round(b)}function c(){return{inputTokens:0,outputTokens:0,cacheReadTokens:0,cacheCreationTokens:0,reasoningTokens:0,totalTokens:0,model:null,stopReason:null,streaming:!1,complete:!1,source:null}}function d(a){let b=String(a||"").trim();if(!b||"{"!==b[0])return null;try{let a=JSON.parse(b);return a&&"object"==typeof a&&!Array.isArray(a)?a:null}catch{return null}}function e(a,c){"string"==typeof c.model&&c.model&&!a.model&&(a.model=c.model);let d="response.completed"===c.type||"response.done"===c.type?c.response?.usage:null,e=d||c.usage;if(!e||"object"!=typeof e)return!1;d&&"string"==typeof c.response?.model&&c.response.model&&(a.model=c.response.model);let f=b(e.prompt_tokens??e.input_tokens),g=b(e.completion_tokens??e.output_tokens);if(!f&&!g)return!1;let h=b(e.prompt_tokens_details?.cached_tokens??e.input_tokens_details?.cached_tokens??e.cached_tokens??e.prompt_cache_hit_tokens);a.inputTokens=Math.max(0,f-h),a.cacheReadTokens=h,a.outputTokens=g,a.reasoningTokens=b(e.completion_tokens_details?.reasoning_tokens??e.output_tokens_details?.reasoning_tokens),a.complete=!0;let i=c.choices?.[0]?.finish_reason;return"string"==typeof i&&i&&(a.stopReason=i),!0}function f(a,f){let g=c();g.streaming=!0,g.source="sse";let h=!1;for(let c of function*(a){let b=String(a||""),c=0;for(;c<b.length;){let a=b.indexOf("\n",c);-1===a&&(a=b.length);let e=b.slice(c,a).trim();if(c=a+1,!e.startsWith("data:"))continue;let f=e.slice(5).trim();if(!f||"[DONE]"===f)continue;let g=d(f);g&&(yield g)}}(a)){if(("anthropic"===f||"message_start"===c.type||"message_delta"===c.type)&&function(a,c){let d=String(c.type||"");if("message_start"===d&&c.message&&"object"==typeof c.message){let d=c.message;"string"==typeof d.model&&d.model&&(a.model=d.model);let e=d.usage;return e&&"object"==typeof e&&(a.inputTokens=b(e.input_tokens)||a.inputTokens,a.cacheReadTokens=b(e.cache_read_input_tokens)||a.cacheReadTokens,a.cacheCreationTokens=b(e.cache_creation_input_tokens)||a.cacheCreationTokens),!0}if("message_delta"===d){let d=c.usage;d&&"object"==typeof d&&(a.outputTokens=b(d.output_tokens)||a.outputTokens,a.inputTokens=a.inputTokens||b(d.input_tokens),a.cacheReadTokens=a.cacheReadTokens||b(d.cache_read_input_tokens),a.cacheCreationTokens=a.cacheCreationTokens||b(d.cache_creation_input_tokens),a.complete=!0);let e=c.delta?.stop_reason;return"string"==typeof e&&e&&(a.stopReason=e),!0}return!1}(g,c)){h=!0;continue}e(g,c)&&(h=!0)}return h?g:null}function g(a){let f=d(a);if(!f)return null;let g=c();g.source="json","string"==typeof f.model&&f.model&&(g.model=f.model);let h=f.usage;return h&&"object"==typeof h?null!=h.input_tokens||null!=h.output_tokens?(g.inputTokens=b(h.input_tokens),g.outputTokens=b(h.output_tokens),g.cacheReadTokens=b(h.cache_read_input_tokens),g.cacheCreationTokens=b(h.cache_creation_input_tokens),g.complete=!0,"string"==typeof f.stop_reason&&(g.stopReason=f.stop_reason),g):e(g,f)?g:null:null}function h(a){return/\/count_tokens\b/.test(String(a||""))}function i(a){return a.inputTokens+a.cacheReadTokens+a.cacheCreationTokens}a.exports={extractUsageFromBody:function({provider:a,body:b,contentType:c="",path:d=""}={}){if("string"!=typeof b||!b||b.length>0x1000000||h(d))return null;let e=/event-stream/i.test(String(c||""))||b.includes("\ndata:")||b.startsWith("data:")?f(b,a)||g(b):g(b)||f(b,a);return e&&(e&&(e.inputTokens||e.outputTokens||e.cacheReadTokens||e.cacheCreationTokens)||e.model)?(e.totalTokens=e.inputTokens+e.outputTokens+e.cacheReadTokens+e.cacheCreationTokens,e):null},isTokenCountingEndpoint:h,toTokensJson:function(a){if(!a)return null;let b=i(a),c={input_tokens:a.inputTokens,output_tokens:a.outputTokens,prompt_tokens:b,completion_tokens:a.outputTokens,total_tokens:a.totalTokens,display_total_input_tokens:b,display_new_input_tokens:a.inputTokens,display_cached_input_tokens:a.cacheReadTokens,display_cache_creation_input_tokens:a.cacheCreationTokens,display_output_tokens:a.outputTokens};return a.cacheReadTokens&&(c.cache_read_input_tokens=a.cacheReadTokens),a.cacheCreationTokens&&(c.cache_creation_input_tokens=a.cacheCreationTokens),a.cacheReadTokens&&(c.cached_tokens=a.cacheReadTokens),a.reasoningTokens&&(c.reasoning_tokens=a.reasoningTokens),c},totalInputTokens:i}},33575:(a,b,c)=>{let d=c(81630),e=c(73496),f=c(55591),g=c(91645),h=c(34631),i=c(55511),j=c(74075),{promisify:k}=c(28354),{redactHeaders:l,redactBodyText:m,redactUrlPath:n,scrubString:o}=c(14681),{extractUsageFromBody:p}=c(11562),{resolvePublicTarget:q}=c(77051),{normalizeAllowedTools:r,shouldRefuseClientTool:s,describeUserAgent:t}=c(47141),{evaluateRules:u,evaluateBody:v,needsBodyInspection:w}=c(96059),{createProxyAuthenticator:x,createProxyAuthLimiter:y}=c(99721),z=k(j.brotliDecompress),A=k(j.gunzip),B=k(j.inflate),C=k(j.inflateRaw),D="function"==typeof j.zstdDecompress?k(j.zstdDecompress):null,E=new Set(["connection","proxy-connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade"]);function F(a){return String(a||"").trim().replace(/^\[|\]$/g,"").toLowerCase()}function G(a,b=443){let c=String(a||"").trim();if(!c)throw Error("Missing CONNECT authority");if(c.startsWith("[")){let a=c.indexOf("]");if(a<0)throw Error("Invalid IPv6 CONNECT authority");let d=c.slice(1,a),e=c.slice(a+1);if(e&&!e.startsWith(":"))throw Error("Invalid IPv6 CONNECT authority");let f=e?Number(e.slice(1)):b;if(!Number.isInteger(f)||f<1||f>65535)throw Error("Invalid CONNECT port");return{host:d,port:f}}let d=c.lastIndexOf(":");if(d>0&&c.indexOf(":")===d){let a=c.slice(d+1);if(!/^\d+$/.test(a))throw Error("Invalid CONNECT port");let b=Number(a);if(!Number.isInteger(b)||b<1||b>65535)throw Error("Invalid CONNECT port");return{host:c.slice(0,d),port:b}}return{host:c,port:b}}function H(a,b=[]){let c=F(a);return b.some(a=>{let b=F(a);if(!b)return!1;if(b===c)return!0;if(b.startsWith("*.")){let a=b.slice(1);return c.endsWith(a)&&c.length>a.length}return!1})}function I(a={},{stripInternal:b=!0}={}){let c=new Set([...E,...String(a.connection||"").split(",").map(a=>a.trim().toLowerCase()).filter(Boolean)]),d={};for(let[e,f]of Object.entries(a||{})){let a=e.toLowerCase();!c.has(a)&&(b&&(a.startsWith("x-9r-")||a.startsWith("x-bluerouter-"))||(d[e]=f))}return d}async function J(a,b,c){let d=String(b||"").split(",").map(a=>a.trim().toLowerCase()).filter(a=>a&&"identity"!==a);if(!d.length||!a.length)return{buffer:a,decoded:!1,contentEncoding:d.join(", ")||null};let e=a;for(let a of[...d].reverse()){let b={maxOutputLength:c};if("br"===a)e=await z(e,b);else if("gzip"===a||"x-gzip"===a)e=await A(e,b);else if("deflate"===a)try{e=await B(e,b)}catch{e=await C(e,b)}else if("zstd"===a&&D)e=await D(e,b);else throw Error(`Unsupported content-encoding: ${a}`)}return{buffer:e,decoded:!0,contentEncoding:d.join(", ")}}async function K(a,b,c){let d=String(b||"").split(",").map(a=>a.trim().toLowerCase()).filter(a=>a&&"identity"!==a);if(1!==d.length||!a.length)return null;let e=d[0],f={maxOutputLength:c,finishFlush:j.constants.Z_SYNC_FLUSH};try{if("gzip"===e||"x-gzip"===e)return await A(a,f);if("deflate"===e)try{return await B(a,f)}catch{return await C(a,f)}if("br"===e)return await z(a,{maxOutputLength:c,finishFlush:j.constants.BROTLI_OPERATION_FLUSH})}catch{}return null}class L{constructor(a){this.limitBytes=Math.max(0,Number(a)||0),this.parts=[],this.capturedBytes=0,this.totalBytes=0,this.truncated=!1,this.hash=i.createHash("sha256"),this.finished=!1}add(a){if(!a||this.finished)return;let b=Buffer.isBuffer(a)?a:Buffer.from(a);if(this.hash.update(b),this.totalBytes+=b.length,this.capturedBytes>=this.limitBytes){b.length&&(this.truncated=!0);return}let c=this.limitBytes-this.capturedBytes,d=b.length>c?b.subarray(0,c):b;d.length&&(this.parts.push(Buffer.from(d)),this.capturedBytes+=d.length),d.length<b.length&&(this.truncated=!0)}async finish(a="",b=""){if(this.finished)throw Error("Audit capture was finalized more than once");this.finished=!0;let c=this.hash.digest("hex"),d=Buffer.concat(this.parts),e=String(b||"").trim().toLowerCase(),f=d,g=!1,h=null,i=!1,j=null,k=null,l=!1,n=Math.max(1048576,Math.min(0x4000000,Math.max(8*this.limitBytes,this.limitBytes)));if(this.limitBytes>0&&d.length&&e&&"identity"!==e)if(this.truncated){let a=await K(d,e,n);a&&a.length?(f=a,g=!0,l=!0,h=a.length,i=!0):(j=`Compressed ${e} capture was truncated before decode`,k=`[${e} audit body capture truncated; decoded body unavailable]`)}else try{let a=await J(d,e,n);f=a.buffer,g=a.decoded,h=f.length,f.length>this.limitBytes&&(f=f.subarray(0,this.limitBytes),i=!0)}catch(a){j=o(a?.message||String(a)),k=`[Unable to decode ${e} audit body: ${j}]`}let p=/json|text|javascript|xml|x-www-form-urlencoded|event-stream/i.test(a||"");return{body:null!==k?k:p||!a?m(f.toString("utf8"),a):`[${f.length} bytes captured; binary body omitted]`,capturedBytes:this.capturedBytes,totalBytes:this.totalBytes,wireSha256:c,truncated:this.truncated||i,...e&&"identity"!==e?{contentEncoding:e}:{},...g?{decoded:!0,decodedBytes:h}:{},...l?{decodePartial:!0}:{},...j?{decodeError:j}:{}}}}function M(a){let b=F(a);return"api.anthropic.com"===b||b.endsWith(".anthropic.com")||"claude.ai"===b||b.endsWith(".claude.ai")?"anthropic":"api.openai.com"===b||b.endsWith(".openai.com")||"chatgpt.com"===b||b.endsWith(".chatgpt.com")?"openai":"kiro.dev"===b||b.endsWith(".kiro.dev")||/^(?:q|codewhisperer)\.[a-z0-9-]+\.amazonaws\.com$/.test(b)?"kiro":"other"}function N(a,b,c){let d=Buffer.from("anthropic"===M(b)?JSON.stringify({type:"error",error:{type:"permission_error",message:c}}):JSON.stringify({error:{message:c,type:"invalid_request_error",code:"content_policy_blocked"}}),"utf8");a.writeHead(403,{"content-type":"application/json; charset=utf-8","content-length":String(d.length),connection:"close"}),a.end(d)}function O(a){if(!a||"string"!=typeof a)return null;try{let b=JSON.parse(a);if("string"==typeof b?.model)return b.model;let c=b?.conversationState?.currentMessage?.userInputMessage?.modelId;return"string"==typeof c&&c?c:null}catch{return null}}function P(a){let b=a?.remoteAddress||"";return b.startsWith("::ffff:")?b.slice(7):b}function Q(a,b,c,d=null){try{let e=String(c||b),f=(d||[]).filter(a=>"string"==typeof a&&!/[\r\n]/.test(a)).map(a=>`${a}\r
 `).join("");a.end(`HTTP/1.1 ${b}\r
 ${f}Connection: close\r
 Content-Type: text/plain; charset=utf-8\r
 Content-Length: ${Buffer.byteLength(e)}\r
 \r
-${e}`)}catch{try{a.destroy()}catch{}}}function R(a={}){let b={};for(let[c,d]of Object.entries(a||{}))b[c]=d;return b}async function S(a){let b=await a.requestCapture.finish(String(a.requestHeaders["content-type"]||""),String(a.requestHeaders["content-encoding"]||"")),c=String(a.responseHeaders?.["content-type"]||""),d=await a.responseCapture.finish(c,String(a.responseHeaders?.["content-encoding"]||"")),e=M(a.target.host),f=n(a.path),g=p({provider:e,body:d.body,contentType:c,path:f}),h=O(b.body)||g?.model||null;return{id:i.randomUUID(),timestamp:new Date().toISOString(),protocol:a.protocol||"http/1.1",client:{ip:a.clientIp||"",port:a.clientPort||null,userAgent:String(a.requestHeaders["user-agent"]||""),proxyUser:a.authUser||null,dashboardUser:a.dashboardUser||null},provider:e,host:F(a.target.host),port:a.target.port,method:a.method,path:f,model:h,usage:g,status:a.statusCode||null,durationMs:Date.now()-a.startedAt,error:a.error?o(a.error.message||a.error):null,denied:!0===a.denied,request:{headers:l(a.requestHeaders),...b},response:{headers:l(a.responseHeaders||{}),...d}}}a.exports={createAuditProxy:function(a={},b={}){let i={allowedHosts:[],passthroughUnknown:!0,captureBodies:!0,captureLimitBytes:2097152,verifyUpstreamTls:!0,allowedConnectPorts:[443],connectTimeoutMs:1e4,tlsHandshakeTimeoutMs:1e4,responseHeaderTimeoutMs:3e4,idleTimeoutMs:9e5,allowPlainHttp:!1,clientToolFilterEnabled:!1,allowedClientTools:[],proxyAuthEnabled:!1,proxyAuthUsers:[],clientAlpnProtocols:["http/1.1"],...a};if(!0!==i.verifyUpstreamTls)throw Error("Upstream TLS verification is mandatory in Audit Proxy mode");let j=b.certificateProvider;if("function"!=typeof j)throw Error("certificateProvider is required");let k="function"==typeof b.onAudit?b.onAudit:()=>{},l="function"==typeof b.onAuditJob?b.onAuditJob:null,m="function"==typeof b.resolveTarget?b.resolveTarget:(a,b)=>q(a,b,{allowedPorts:i.allowedConnectPorts}),n=b.upstreamCa,o=r(i.allowedClientTools),p=i.proxyAuthEnabled?x(i.proxyAuthUsers):null,z=i.proxyAuthEnabled?y():null,A=new Set,B=new Map,C=new WeakMap,D=new Set;function E(a){return!a||A.has(a)||(A.add(a),a.once?.("close",()=>A.delete(a))),a}function F(a,b){try{"function"==typeof a.destroy?a.destroy(b):"function"==typeof a.close&&a.close()}catch{}}function K(a){let b=()=>S(a);if(l){try{l(b)}catch(a){console.warn("[audit-proxy] audit enqueue failed:",a?.message||a)}return}setImmediate(()=>{Promise.resolve().then(b).then(k).catch(a=>console.warn("[audit-proxy] audit callback failed:",a?.message||a))})}function M({requestHeaders:a,method:b,path:c,target:d,requestCapture:e,responseCapture:f,responseHeaders:g,statusCode:h,startedAt:i,error:j,socket:k,protocol:l,authUser:m=null,denied:n=!1}){return{requestHeaders:R(a),method:b,path:c,target:d,requestCapture:e,responseCapture:f,responseHeaders:R(g),statusCode:h,startedAt:i,error:j,clientIp:P(k),clientPort:k?.remotePort||null,authUser:m,dashboardUser:k?.__auditDashboardUser||null,protocol:l,denied:n}}let O="This proxy does not support WebSocket connections. Use the HTTP streaming transport instead - most clients fall back to it automatically.";function T(a,b,c,d,{statusCode:e=403,authUser:f=null}={}){let g=String(a.url||""),h=c||{host:g.includes(":")?g.slice(0,g.lastIndexOf(":")):g||"unknown",port:443},j=new L(i.captureBodies?i.captureLimitBytes:0);j.add(Buffer.from(d)),K(M({requestHeaders:a.headers,method:"CONNECT",path:"",target:h,requestCapture:new L(0),responseCapture:j,responseHeaders:{"content-type":"text/plain; charset=utf-8",connection:"close"},statusCode:e,startedAt:Date.now(),error:d,socket:b,protocol:"http/1.1",authUser:f,denied:!0}))}let U=Symbol("refused");async function V(a,b){if(!p)return null;let d=P(b),e=(c,d=null)=>(Q(b,"407 Proxy Authentication Required",c,['Proxy-Authenticate: Basic realm="BlueRouter Audit Proxy", charset="UTF-8"']),T(a,b,void 0,c,{statusCode:407,authUser:d}),U);if(z.isLocked(d))return e("Too many failed proxy authentication attempts");let f=a.headers["proxy-authorization"],g=await p.authenticate(f);if(g.ok)return z.recordSuccess(d),g.username;let h=null;if(f){let{lockedNow:a}=z.recordFailure(d);a&&console.log(`[audit-proxy] proxy auth lockout for ${d||"unknown"}`);try{h=c(99721).parseBasicProxyAuthorization(f)?.username||null}catch{h=null}}return e(g.reason||"Proxy authentication required",h)}function W(a,b,c){if(!c)return;let d=new L(i.captureBodies?i.captureLimitBytes:0);d.add(Buffer.from(O)),K(M({requestHeaders:a.headers,method:a.method,path:a.url,target:c,requestCapture:new L(0),responseCapture:d,responseHeaders:{"content-type":"text/plain; charset=utf-8",connection:"close"},statusCode:501,startedAt:Date.now(),error:null,socket:b,protocol:"http/1.1",authUser:b?.__auditProxyUser||null,denied:!0}))}async function X(a,b,{expectContinue:c=!1}={}){let d=a.socket.__auditTarget,e=a.socket.__auditProxyUser||null;if(!d){b.writeHead(502,{"content-type":"text/plain"}),b.end("Audit target is missing");return}if(function(a={}){return"string"==typeof a.upgrade&&""!==a.upgrade.trim()}(a.headers)){b.writeHead(501,{"content-type":"text/plain; charset=utf-8",connection:"close"}),b.end(O),W(a,a.socket,d);return}let h=Date.now(),j=new L(i.captureBodies?i.captureLimitBytes:0),k=new L(i.captureBodies?i.captureLimitBytes:0),l=i.dlpEnabled?u(i,{groups:a.socket.__auditDlpGroups||[],host:d.host,userAgent:a.headers["user-agent"],method:a.method,path:a.url}):null,o=I(a.headers,{stripInternal:!0});o.host=443===d.port?d.host:`${d.host}:${d.port}`;let p=null,q=null,r={},s=null,t=!1,x=!1,y=null,z=!1,A=(b=null,{denied:c=!1,statusOverride:f=null}={})=>{t||(t=!0,y&&clearTimeout(y),K(M({requestHeaders:a.headers,method:a.method,path:a.url,target:d,requestCapture:j,responseCapture:k,responseHeaders:r,statusCode:f??s,startedAt:h,error:b,socket:a.socket,protocol:"http/1.1",authUser:e,denied:c})))},C=(c,e)=>{if(z||x)return;z=!0;let f=e?`${c}: ${e}`:c;k.add(Buffer.from(f)),b.headersSent?b.destroyed||b.destroy(Error(f)):N(b,d.host,f),x=!0,F(p,Error(f)),a.destroy(),A(null,{denied:!0,statusOverride:403})};if(l?.action==="deny"){let a=`Blocked by content policy "${l.reason}"`;k.add(Buffer.from(a)),N(b,d.host,a),x=!0,A(null,{denied:!0,statusOverride:403});return}let D=!!l&&w(l,a.method,a.headers);try{let e,h,t=await m(d.host,d.port);(p=f.request({hostname:d.host,port:d.port,method:a.method,path:a.url,headers:o,rejectUnauthorized:!0,servername:g.isIP(d.host)?void 0:d.host,ca:n,ALPNProtocols:["http/1.1"],lookup:t.lookup,autoSelectFamily:!0,agent:(e=`${d.host}:${d.port}`,(h=B.get(e))||(h=new f.Agent({keepAlive:!0,maxSockets:32,maxFreeSockets:8,timeout:i.idleTimeoutMs}),B.set(e,h)),h)})).on("socket",a=>{if(E(a),a.setNoDelay(!0),a.setKeepAlive(!0,3e4),a.setTimeout(i.idleTimeoutMs,()=>a.destroy(Error("Upstream idle timeout"))),a.connecting){let b=setTimeout(()=>a.destroy(Error("Upstream TLS connect timeout")),i.connectTimeoutMs+i.tlsHandshakeTimeoutMs);b.unref?.();let c=()=>clearTimeout(b);a.once("secureConnect",c),a.once("error",c),a.once("close",c)}}),p.on("continue",()=>{c&&!b.headersSent&&b.writeContinue()}),p.on("information",a=>{102===a.statusCode&&"function"==typeof b.writeProcessing&&b.writeProcessing(),103===a.statusCode&&"function"==typeof b.writeEarlyHints&&b.writeEarlyHints(a.headers||{})}),p.on("response",a=>{q=a,y&&clearTimeout(y),s=a.statusCode||502,r=R(a.headers||{});let c=I(a.headers,{stripInternal:!1});b.writeHead(s,c),b.flushHeaders?.(),a.on("data",c=>{k.add(c),b.write(c)||a.pause()}),b.on("drain",()=>a.resume()),a.on("aborted",()=>{let a=Error("Upstream response aborted");b.destroyed||b.destroy(a),A(a)}),a.on("error",a=>{b.destroyed||b.destroy(a),A(a)}),a.on("end",()=>{if(a.trailers&&Object.keys(a.trailers).length)try{b.addTrailers(I(a.trailers,{stripInternal:!1}))}catch{}x=!0,b.end(),A(null)})}),p.on("error",a=>{z||(b.headersSent?b.destroyed||b.destroy(a):(b.writeHead(502,{"content-type":"application/json"}),b.end(JSON.stringify({error:"Verified upstream TLS request failed"})),x=!0),A(a))});let u=()=>{if(a.trailers&&Object.keys(a.trailers).length)try{p.addTrailers(I(a.trailers,{stripInternal:!0}))}catch{}p.end(),y=setTimeout(()=>p.destroy(Error("Upstream response header timeout")),i.responseHeaderTimeoutMs),y.unref?.()};if(D){let b=[],c=0,d=!1;a.on("data",a=>{if(j.add(a),!d&&!z){if((c+=a.length)>i.dlpMaxInspectBytes){d=!0,b.length=0;return}b.push(a)}}),a.on("end",async()=>{try{if(z)return;if(d){if("allow"!==i.dlpOversizeAction)return void C("Request is too large to inspect and your content policy blocks uninspected uploads",`over ${i.dlpMaxInspectBytes} bytes`);u();return}let c=Buffer.concat(b),e=null;try{let b=a.headers["content-encoding"],d=b?(await J(c,b,8*i.dlpMaxInspectBytes)).buffer:c;e=v(JSON.parse(d.toString("utf8")),l.profile)}catch{e=null}if(!e||e.budgetExceeded){if("allow"!==i.dlpOversizeAction)return void C("Request could not be inspected and your content policy blocks uninspected uploads",e?.budgetExceeded?"too complex to inspect":"unreadable body")}else if(e.violations.length){let a=e.violations[0],b=e.violations.length>1?` (+${e.violations.length-1} more)`:"";C(`Blocked by content policy "${l.reason}"`,`${a.message}${b}`);return}c.length&&p.write(c),u()}catch(a){C("Content inspection failed",a?.message||String(a))}})}else a.on("data",b=>{j.add(b),p.write(b)||a.pause()}),p.on("drain",()=>a.resume()),a.on("end",u);a.on("aborted",()=>p.destroy(Error("Client request aborted"))),a.on("error",a=>p.destroy(a)),b.on("close",()=>{x||z||(q?.destroy(Error("Client response closed")),p?.destroy(Error("Client response closed")),A(Error("Client response closed")))})}catch(a){b.headersSent||(b.writeHead(502,{"content-type":"application/json"}),b.end(JSON.stringify({error:"Destination validation or connection failed"})),x=!0),A(a)}}let Y=d.createServer((a,b)=>{X(a,b)});async function Z(a){return a.upstreamPromise||(a.upstreamPromise=(async()=>{let b=a.target,c=await m(b.host,b.port),d=E(h.connect({host:b.host,port:b.port,servername:g.isIP(b.host)?void 0:b.host,rejectUnauthorized:!0,ca:n,ALPNProtocols:["h2"],lookup:c.lookup,autoSelectFamily:!0}));d.setNoDelay(!0),d.setKeepAlive(!0,3e4);let f=setTimeout(()=>d.destroy(Error("Upstream HTTP/2 TLS connect timeout")),i.connectTimeoutMs+i.tlsHandshakeTimeoutMs);f.unref?.(),d.once("secureConnect",()=>{clearTimeout(f),"h2"!==d.alpnProtocol&&d.destroy(Error("Upstream did not negotiate HTTP/2"))}),d.once("error",()=>clearTimeout(f)),d.once("close",()=>clearTimeout(f));let j=`https://${b.host}${443===b.port?"":`:${b.port}`}`,k=e.connect(j,{createConnection:()=>d,settings:{enablePush:!1}});return D.add(k),k.setTimeout(i.idleTimeoutMs,()=>k.destroy(Error("Upstream HTTP/2 idle timeout"))),k.once("close",()=>D.delete(k)),await new Promise((a,b)=>{let c=setTimeout(()=>b(Error("Upstream HTTP/2 session timeout")),i.connectTimeoutMs+i.tlsHandshakeTimeoutMs);c.unref?.();let d=(a,b)=>{clearTimeout(c),k.removeListener("connect",e),k.removeListener("error",f),a(b)},e=()=>d(a,k),f=a=>d(b,a);k.once("connect",e),k.once("error",f)}),k})().catch(b=>{throw a.upstreamPromise=null,b})),a.upstreamPromise}async function $(a,b){let c=C.get(a.session),d=c?.target;if(!c||!d){a.respond({":status":502,"content-type":"text/plain"}),a.end("Audit target is missing");return}a.pause();let f=Date.now(),g=new L(i.captureBodies?i.captureLimitBytes:0),h=new L(i.captureBodies?i.captureLimitBytes:0),j={},k=null,l=!1,m=!1,n=null,o=null,p=null,q=(e=null)=>{l||(l=!0,K(M({requestHeaders:b,method:b[":method"]||"GET",path:b[":path"]||"/",target:d,requestCapture:g,responseCapture:h,responseHeaders:j,statusCode:k,startedAt:f,error:e,socket:a.session.socket,protocol:"h2",authUser:c.authUser||null})))};try{(n=(await Z(c)).request(function(a,b){let c=I(a,{stripInternal:!0}),d={":method":a[":method"]||"GET",":path":a[":path"]||"/",":scheme":"https",":authority":443===b.port?b.host:`${b.host}:${b.port}`};for(let[a,b]of Object.entries(c))a.startsWith(":")||(d[a.toLowerCase()]=b);return d}(b,d),{endStream:!1,waitForTrailers:!0})).setTimeout(i.idleTimeoutMs,()=>n.close(e.constants.NGHTTP2_CANCEL)),a.setTimeout(i.idleTimeoutMs,()=>a.close(e.constants.NGHTTP2_CANCEL)),n.on("response",b=>{j=R(b),k=Number(b[":status"]||502),a.respond(function(a){let b=I(a,{stripInternal:!1}),c={":status":Number(a[":status"]||502)};for(let[a,d]of Object.entries(b))a.startsWith(":")||(c[a.toLowerCase()]=d);return c}(b),{waitForTrailers:!0})}),n.on("trailers",a=>{p=I(a,{stripInternal:!1})}),a.on("wantTrailers",()=>{try{a.sendTrailers(p||{})}catch{}}),a.on("trailers",a=>{o=I(a,{stripInternal:!0})}),n.on("wantTrailers",()=>{try{n.sendTrailers(o||{})}catch{}}),a.on("data",b=>{g.add(b),n.write(b)||a.pause()}),n.on("drain",()=>a.resume()),a.on("end",()=>n.end()),n.on("data",b=>{h.add(b),a.write(b)||n.pause()}),a.on("drain",()=>n.resume()),n.on("end",()=>{m=!0,a.end(),q(null)}),n.on("aborted",()=>{let b=Error("Upstream HTTP/2 stream aborted");a.close(e.constants.NGHTTP2_INTERNAL_ERROR),q(b)}),n.on("error",b=>{a.closed||a.close(e.constants.NGHTTP2_INTERNAL_ERROR),q(b)}),a.on("aborted",()=>{n.close(e.constants.NGHTTP2_CANCEL),q(Error("Client HTTP/2 stream aborted"))}),a.on("error",a=>{n.close(e.constants.NGHTTP2_CANCEL),q(a)}),a.on("close",()=>{m||!n||n.closed||(n.close(e.constants.NGHTTP2_CANCEL),q(Error("Client HTTP/2 stream closed")))}),a.resume()}catch(b){a.headersSent||a.closed||a.respond({":status":502,"content-type":"application/json"}),a.closed||a.end(JSON.stringify({error:"Verified upstream HTTP/2 request failed"})),q(b)}}Y.on("checkContinue",(a,b)=>{X(a,b,{expectContinue:!0})}),Y.on("upgrade",(a,b)=>{Q(b,"501 Not Implemented",O),W(a,b,b.__auditTarget)}),Y.on("clientError",(a,b)=>F(b)),Y.headersTimeout=i.responseHeaderTimeoutMs,Y.requestTimeout=0,Y.keepAliveTimeout=i.idleTimeoutMs;let _=e.createServer({settings:{enablePush:!1}});_.on("session",a=>{let b={target:a.socket.__auditTarget,authUser:a.socket.__auditProxyUser||null,upstreamPromise:null};C.set(a,b),a.setTimeout(i.idleTimeoutMs,()=>a.destroy(Error("Client HTTP/2 idle timeout"))),a.once("close",()=>{Promise.resolve(b.upstreamPromise).then(a=>a?.close()).catch(()=>{})})}),_.on("stream",(a,b)=>{$(a,b)}),_.on("sessionError",a=>{console.warn("[audit-proxy] HTTP/2 client session error:",a?.message||a)});let aa=d.createServer((a,b)=>{b.writeHead(403,{"content-type":"text/plain; charset=utf-8",connection:"close"}),b.end("Audit Proxy accepts HTTPS CONNECT traffic only")});function ab(){o=r(i.allowedClientTools),p=i.proxyAuthEnabled?x(i.proxyAuthUsers):null,z=i.proxyAuthEnabled?y():null,aa.headersTimeout=i.responseHeaderTimeoutMs,aa.keepAliveTimeout=i.idleTimeoutMs,Y.headersTimeout=i.responseHeaderTimeoutMs,Y.keepAliveTimeout=i.idleTimeoutMs,aa.auditCapabilities={http1:!0,http2:i.clientAlpnProtocols.includes("h2"),proxyAuth:!0===i.proxyAuthEnabled,plainHttp:!1,publicConnectPorts:[...i.allowedConnectPorts]}}return aa.on("connect",(a,b,c)=>{(async()=>{let d,e;try{d=G(a.url,443)}catch(e){let c=e.message||"Invalid CONNECT authority";Q(b,"400 Bad Request",c),T(a,b,d,c,{statusCode:400});return}let f=await V(a,b);if(f===U)return;try{await m(d.host,d.port)}catch(e){let c=e.message||"Destination is not allowed";Q(b,"403 Forbidden",c),T(a,b,d,c,{authUser:f});return}if(i.clientToolFilterEnabled&&s(a.headers["user-agent"],o)){let c=`Client tool is not allowed to use this proxy (${t(a.headers["user-agent"])})`;Q(b,"403 Forbidden",c),T(a,b,d,c);return}if(!H(d.host,i.allowedHosts)){if(!i.passthroughUnknown){let c="Host is not in the audit allowlist";Q(b,"403 Forbidden",c),T(a,b,d,c);return}let e=!1;try{let a=await m(d.host,d.port),f=E(g.connect({host:d.host,port:d.port,lookup:a.lookup,autoSelectFamily:!0})),h=setTimeout(()=>f.destroy(Error("TCP passthrough connect timeout")),i.connectTimeoutMs);h.unref?.(),f.setNoDelay(!0),f.setKeepAlive(!0,3e4),f.setTimeout(i.idleTimeoutMs,()=>f.destroy(Error("TCP passthrough idle timeout"))),f.once("connect",()=>{clearTimeout(h),e=!0,b.write("HTTP/1.1 200 Connection Established\r\nProxy-Agent: BlueRouter-Audit\r\n\r\n"),c?.length&&f.write(c),f.pipe(b),b.pipe(f)}),f.once("error",()=>{clearTimeout(h),e?F(b):Q(b,"502 Bad Gateway","TCP passthrough failed")}),b.once("error",()=>F(f)),b.once("close",()=>F(f))}catch(a){Q(b,"502 Bad Gateway",a.message||"TCP passthrough failed")}return}try{if(e=j(d.host),!e?.key||!e?.cert)throw Error("Certificate provider returned no certificate")}catch(a){Q(b,"500 Internal Server Error",`Cannot issue audit certificate: ${a.message}`);return}b.write("HTTP/1.1 200 Connection Established\r\nProxy-Agent: BlueRouter-Audit\r\n\r\n"),c?.length&&b.unshift(c);let k=E(new h.TLSSocket(b,{isServer:!0,key:e.key,cert:e.cert,ALPNProtocols:i.clientAlpnProtocols}));k.__auditTarget=d,k.__auditProxyUser=f,k.__auditDlpGroups=b.__auditDlpGroups||[],k.__auditDashboardUser=b.__auditDashboardUser||null,k.setNoDelay(!0),k.setKeepAlive(!0,3e4),k.setTimeout(i.idleTimeoutMs,()=>k.destroy(Error("Client TLS idle timeout")));let l=setTimeout(()=>k.destroy(Error("Client TLS handshake timeout")),i.tlsHandshakeTimeoutMs);l.unref?.();let n=!1,p=()=>{n||(n=!0,clearTimeout(l),"h2"===k.alpnProtocol?_.emit("connection",k):Y.emit("connection",k))};k.once("secure",p),k.once("secureConnect",p),k.once("error",()=>{clearTimeout(l),F(k)}),k.once("close",()=>clearTimeout(l))})().catch(a=>Q(b,"500 Internal Server Error",a.message||"Audit CONNECT failed"))}),aa.prependListener("connection",a=>{E(a),a.setNoDelay(!0),a.setKeepAlive(!0,3e4)}),aa.on("upgrade",(a,b)=>Q(b,"501 Not Implemented",O)),aa.on("clientError",(a,b)=>F(b)),aa.headersTimeout=i.responseHeaderTimeoutMs,aa.requestTimeout=0,aa.keepAliveTimeout=i.idleTimeoutMs,aa.forceCloseAll=()=>{for(let a of D)try{a.destroy()}catch{}for(let a of B.values())try{a.destroy()}catch{}for(let a of[...A])F(a)},aa.getActiveConnectionCount=()=>A.size,aa.auditConfig=i,ab(),aa.applyConfig=(a={})=>{let b={};for(let[c,d]of(a.bindHost&&String(a.bindHost)!==String(i.bindHost)&&(b.bindHost=String(a.bindHost)),Number(a.port)&&Number(a.port)!==Number(i.port)&&(b.port=Number(a.port)),Object.entries(a)))"bindHost"!==c&&"port"!==c&&(["verifyUpstreamTls","allowPlainHttp","allowedConnectPorts","clientAlpnProtocols"].includes(c)||(i[c]=d));return ab(),{rebindRequired:Object.keys(b).length>0,pending:b}},aa},hostMatches:H,parseAuthority:G,stripHopByHop:I,CaptureBuffer:L,detectProvider:M,extractModel:O,decodeCapturedBuffer:J}},62952:(a,b,c)=>{let d=c(29021),e=c(33873),f=c(4984),g=c(55511),{AUDIT_LOG_PATH:h,AUDIT_LOG_DIR:i,ensureAuditDir:j,loadConfig:k}=c(42947),{redactObject:l,scrubString:m}=c(14681),{toTokensJson:n,totalInputTokens:o}=c(11562),{publishRecentUsage:p}=c(79841),q="audit-proxy",r="client",s="provider_response",t=/\/(?:messages|responses|chat\/completions)$|generatecontent$/i,u={expiresAt:0,config:null},v=null,w=null,x=null,y=null,z=null,A=null,B="",C=Promise.resolve(),D=Promise.resolve(),E=0,F=null,G=!1,H=new Map,I={queue:[],workers:new Set,activeWorkers:0,clearing:!1,enqueued:0,written:0,dropped:0,failed:0,localFailed:0,sinkTimeouts:0,flushTimeouts:0,mysqlWritten:0,mysqlFailed:0,mysqlSkipped:0,mysqlSkippedByReason:{},usageWritten:0,usageFailed:0,tokensSeen:0,lastError:null,lastWrittenAt:null};function J(a){let b=Date.now();b-E<6e4||(E=b,console.warn(`[AuditProxy][PromptDB] ${a}`))}function K(a){I.lastError=String(a||"Audit store failure"),console.warn(`[AuditProxy][Store] ${I.lastError}`)}function L(a,b,c=3e4){let d=null;return Promise.race([a,new Promise((a,e)=>{d=setTimeout(()=>{I.sinkTimeouts+=1,e(Error(`${b} timed out after ${c}ms`))},c),d.unref?.()})]).finally(()=>{d&&clearTimeout(d)})}async function M(){let a=Date.now();if(u.expiresAt>a)return u.config;v||(v=Promise.all([c.e(689),c.e(3960)]).then(c.bind(c,41170)));let b=await v,d=await b.getPromptLogDbConfig();return u={expiresAt:a+5e3,config:d},d}async function N(){return w||(w=c.e(3056).then(c.bind(c,93056))),w}async function O(a){let b=g.createHash("sha256").update(JSON.stringify({host:a.host,port:Number(a.port||3306),database:a.database,username:a.username,password:a.password,ssl:!!a.ssl})).digest("hex");if(A&&B===b)return A;let d=C.then(async()=>{if(A&&B===b)return A;if(A){try{await A.end()}catch{}A=null,B=""}let d=await c.e(4790).then(c.t.bind(c,94790,19)),e=(d.default||d).createPool({host:a.host,port:Number(a.port||3306),database:a.database,user:a.username,password:a.password,ssl:a.ssl?{rejectUnauthorized:!0}:void 0,connectTimeout:3e3,waitForConnections:!0,connectionLimit:4,maxIdle:4,idleTimeout:6e4,queueLimit:100,enableKeepAlive:!0,keepAliveInitialDelay:3e4});return A=e,B=b,e});return C=d.then(()=>void 0,()=>void 0),d}function P(a){let b=a?new Date(a):new Date;return(Number.isNaN(b.getTime())?new Date:b).toISOString().replace("T"," ").replace("Z","")}function Q(a){if("string"!=typeof a)return a;let b=a.trim();if(!b||!b.startsWith("{")&&!b.startsWith("["))return a;try{return JSON.parse(b)}catch{return a}}function R(a,b=0,c=[]){if(null==a||b>12||c.join("\n").length>=2e5)return c;if("string"==typeof a)return a.trim()&&c.push(a.trim()),c;if(Array.isArray(a)){for(let d of a)R(d,b+1,c);return c}if("object"!=typeof a)return c;for(let[d,e]of Object.entries(a)){let a=d.toLowerCase();["content","text","prompt","input","message","output_text"].includes(a)?R(e,b+1,c):b<8&&["messages","contents","parts","body","request","payload","response","choices","output","item","items"].includes(a)&&R(e,b+1,c)}return c}function S(a){if("string"!=typeof a)return!1;let b=a.trim();return!!b&&!/^\[[^\]]*\]$/.test(b)}function T(a){let b=String(a||"").toLowerCase();return b.includes("claude")?{tool:"claude-code",label:"Claude Code"}:b.includes("codex")?{tool:"codex",label:"Codex"}:{tool:"audit-proxy",label:"Enterprise AI Audit Proxy"}}async function U(a){if(!a)return null;let b=g.createHash("sha256").update(a).digest("hex"),c=Buffer.byteLength(String(a||""),"utf8"),d=await N();return await d.writePayloadFile(b,a),{payloadHash:b,payloadSizeBytes:c}}async function V(a,b,c,d){if(!c)return null;let{payloadHash:e,payloadSizeBytes:f}=c;return await a.query(`INSERT INTO prompt_log_payloads (
+${e}`)}catch{try{a.destroy()}catch{}}}function R(a={}){let b={};for(let[c,d]of Object.entries(a||{}))b[c]=d;return b}async function S(a){let b=await a.requestCapture.finish(String(a.requestHeaders["content-type"]||""),String(a.requestHeaders["content-encoding"]||"")),c=String(a.responseHeaders?.["content-type"]||""),d=await a.responseCapture.finish(c,String(a.responseHeaders?.["content-encoding"]||"")),e=M(a.target.host),f=n(a.path),g=p({provider:e,body:d.body,contentType:c,path:f}),h=O(b.body)||g?.model||null;return{id:i.randomUUID(),timestamp:new Date().toISOString(),protocol:a.protocol||"http/1.1",client:{ip:a.clientIp||"",port:a.clientPort||null,userAgent:String(a.requestHeaders["user-agent"]||""),proxyUser:a.authUser||null,dashboardUser:a.dashboardUser||null},provider:e,host:F(a.target.host),port:a.target.port,method:a.method,path:f,model:h,usage:g,status:a.statusCode||null,durationMs:Date.now()-a.startedAt,error:a.error?o(a.error.message||a.error):null,denied:!0===a.denied,request:{headers:l(a.requestHeaders),...b},response:{headers:l(a.responseHeaders||{}),...d}}}a.exports={createAuditProxy:function(a={},b={}){let i={allowedHosts:[],passthroughUnknown:!0,captureBodies:!0,captureLimitBytes:2097152,verifyUpstreamTls:!0,allowedConnectPorts:[443],connectTimeoutMs:1e4,tlsHandshakeTimeoutMs:1e4,responseHeaderTimeoutMs:3e4,idleTimeoutMs:9e5,allowPlainHttp:!1,clientToolFilterEnabled:!1,allowedClientTools:[],proxyAuthEnabled:!1,proxyAuthUsers:[],clientAlpnProtocols:["http/1.1"],...a};if(!0!==i.verifyUpstreamTls)throw Error("Upstream TLS verification is mandatory in Audit Proxy mode");let j=b.certificateProvider;if("function"!=typeof j)throw Error("certificateProvider is required");let k="function"==typeof b.onAudit?b.onAudit:()=>{},l="function"==typeof b.onAuditJob?b.onAuditJob:null,m="function"==typeof b.resolveTarget?b.resolveTarget:(a,b)=>q(a,b,{allowedPorts:i.allowedConnectPorts}),n=b.upstreamCa,o=r(i.allowedClientTools),p=i.proxyAuthEnabled?x(i.proxyAuthUsers):null,z=i.proxyAuthEnabled?y():null,A=new Set,B=new Map,C=new WeakMap,D=new Set;function E(a){return!a||A.has(a)||(A.add(a),a.once?.("close",()=>A.delete(a))),a}function F(a,b){try{"function"==typeof a.destroy?a.destroy(b):"function"==typeof a.close&&a.close()}catch{}}function K(a){let b=()=>S(a);if(l){try{l(b)}catch(a){console.warn("[audit-proxy] audit enqueue failed:",a?.message||a)}return}setImmediate(()=>{Promise.resolve().then(b).then(k).catch(a=>console.warn("[audit-proxy] audit callback failed:",a?.message||a))})}function M({requestHeaders:a,method:b,path:c,target:d,requestCapture:e,responseCapture:f,responseHeaders:g,statusCode:h,startedAt:i,error:j,socket:k,protocol:l,authUser:m=null,denied:n=!1}){return{requestHeaders:R(a),method:b,path:c,target:d,requestCapture:e,responseCapture:f,responseHeaders:R(g),statusCode:h,startedAt:i,error:j,clientIp:P(k),clientPort:k?.remotePort||null,authUser:m,dashboardUser:k?.__auditDashboardUser||null,protocol:l,denied:n}}let O="This proxy does not support WebSocket connections. Use the HTTP streaming transport instead - most clients fall back to it automatically.";function T(a,b,c,d,{statusCode:e=403,authUser:f=null}={}){let g=String(a.url||""),h=c||{host:g.includes(":")?g.slice(0,g.lastIndexOf(":")):g||"unknown",port:443},j=new L(i.captureBodies?i.captureLimitBytes:0);j.add(Buffer.from(d)),K(M({requestHeaders:a.headers,method:"CONNECT",path:"",target:h,requestCapture:new L(0),responseCapture:j,responseHeaders:{"content-type":"text/plain; charset=utf-8",connection:"close"},statusCode:e,startedAt:Date.now(),error:d,socket:b,protocol:"http/1.1",authUser:f,denied:!0}))}let U=Symbol("refused");async function V(a,b){if(!p)return null;let d=P(b),e=(c,d=null)=>(Q(b,"407 Proxy Authentication Required",c,['Proxy-Authenticate: Basic realm="BlueRouter Audit Proxy", charset="UTF-8"']),T(a,b,void 0,c,{statusCode:407,authUser:d}),U);if(z.isLocked(d))return e("Too many failed proxy authentication attempts");let f=a.headers["proxy-authorization"],g=await p.authenticate(f);if(g.ok)return z.recordSuccess(d),g.username;let h=null;if(f){let{lockedNow:a}=z.recordFailure(d);a&&console.log(`[audit-proxy] proxy auth lockout for ${d||"unknown"}`);try{h=c(99721).parseBasicProxyAuthorization(f)?.username||null}catch{h=null}}return e(g.reason||"Proxy authentication required",h)}function W(a,b,c){if(!c)return;let d=new L(i.captureBodies?i.captureLimitBytes:0);d.add(Buffer.from(O)),K(M({requestHeaders:a.headers,method:a.method,path:a.url,target:c,requestCapture:new L(0),responseCapture:d,responseHeaders:{"content-type":"text/plain; charset=utf-8",connection:"close"},statusCode:501,startedAt:Date.now(),error:null,socket:b,protocol:"http/1.1",authUser:b?.__auditProxyUser||null,denied:!0}))}async function X(a,b,{expectContinue:c=!1}={}){let d=a.socket.__auditTarget,e=a.socket.__auditProxyUser||null;if(!d){b.writeHead(502,{"content-type":"text/plain"}),b.end("Audit target is missing");return}if(function(a={}){return"string"==typeof a.upgrade&&""!==a.upgrade.trim()}(a.headers)){b.writeHead(501,{"content-type":"text/plain; charset=utf-8",connection:"close"}),b.end(O),W(a,a.socket,d);return}let h=Date.now(),j=new L(i.captureBodies?i.captureLimitBytes:0),k=new L(i.captureBodies?i.captureLimitBytes:0),l=i.dlpEnabled?u(i,{groups:a.socket.__auditDlpGroups||[],host:d.host,userAgent:a.headers["user-agent"],method:a.method,path:a.url}):null,o=I(a.headers,{stripInternal:!0});o.host=443===d.port?d.host:`${d.host}:${d.port}`;let p=null,q=null,r={},s=null,t=!1,x=!1,y=null,z=!1,A=(b=null,{denied:c=!1,statusOverride:f=null}={})=>{t||(t=!0,y&&clearTimeout(y),K(M({requestHeaders:a.headers,method:a.method,path:a.url,target:d,requestCapture:j,responseCapture:k,responseHeaders:r,statusCode:f??s,startedAt:h,error:b,socket:a.socket,protocol:"http/1.1",authUser:e,denied:c})))},C=(c,e)=>{if(z||x)return;z=!0;let f=e?`${c}: ${e}`:c;k.add(Buffer.from(f)),b.headersSent?b.destroyed||b.destroy(Error(f)):N(b,d.host,f),x=!0,F(p,Error(f)),a.destroy(),A(null,{denied:!0,statusOverride:403})};if(l?.action==="deny"){let a=`Blocked by content policy "${l.reason}"`;k.add(Buffer.from(a)),N(b,d.host,a),x=!0,A(null,{denied:!0,statusOverride:403});return}let D=!!l&&w(l,a.method,a.headers);try{let e,h,t=await m(d.host,d.port);(p=f.request({hostname:d.host,port:d.port,method:a.method,path:a.url,headers:o,rejectUnauthorized:!0,servername:g.isIP(d.host)?void 0:d.host,ca:n,ALPNProtocols:["http/1.1"],lookup:t.lookup,autoSelectFamily:!0,agent:(e=`${d.host}:${d.port}`,(h=B.get(e))||(h=new f.Agent({keepAlive:!0,maxSockets:32,maxFreeSockets:8,timeout:i.idleTimeoutMs}),B.set(e,h)),h)})).on("socket",a=>{if(E(a),a.setNoDelay(!0),a.setKeepAlive(!0,3e4),a.setTimeout(i.idleTimeoutMs,()=>a.destroy(Error("Upstream idle timeout"))),a.connecting){let b=setTimeout(()=>a.destroy(Error("Upstream TLS connect timeout")),i.connectTimeoutMs+i.tlsHandshakeTimeoutMs);b.unref?.();let c=()=>clearTimeout(b);a.once("secureConnect",c),a.once("error",c),a.once("close",c)}}),p.on("continue",()=>{c&&!b.headersSent&&b.writeContinue()}),p.on("information",a=>{102===a.statusCode&&"function"==typeof b.writeProcessing&&b.writeProcessing(),103===a.statusCode&&"function"==typeof b.writeEarlyHints&&b.writeEarlyHints(a.headers||{})}),p.on("response",a=>{q=a,y&&clearTimeout(y),s=a.statusCode||502,r=R(a.headers||{});let c=I(a.headers,{stripInternal:!1});b.writeHead(s,c),b.flushHeaders?.(),a.on("data",c=>{k.add(c),b.write(c)||a.pause()}),b.on("drain",()=>a.resume()),a.on("aborted",()=>{let a=Error("Upstream response aborted");b.destroyed||b.destroy(a),A(a)}),a.on("error",a=>{b.destroyed||b.destroy(a),A(a)}),a.on("end",()=>{if(a.trailers&&Object.keys(a.trailers).length)try{b.addTrailers(I(a.trailers,{stripInternal:!1}))}catch{}x=!0,b.end(),A(null)})}),p.on("error",a=>{z||(b.headersSent?b.destroyed||b.destroy(a):(b.writeHead(502,{"content-type":"application/json"}),b.end(JSON.stringify({error:"Verified upstream TLS request failed"})),x=!0),A(a))});let u=()=>{if(a.trailers&&Object.keys(a.trailers).length)try{p.addTrailers(I(a.trailers,{stripInternal:!0}))}catch{}p.end(),y=setTimeout(()=>p.destroy(Error("Upstream response header timeout")),i.responseHeaderTimeoutMs),y.unref?.()};if(D){let b=[],c=0,d=!1;a.on("data",a=>{if(j.add(a),!d&&!z){if((c+=a.length)>i.dlpMaxInspectBytes){d=!0,b.length=0;return}b.push(a)}}),a.on("end",async()=>{try{if(z)return;if(d){if("allow"!==i.dlpOversizeAction)return void C("Request is too large to inspect and your content policy blocks uninspected uploads",`over ${i.dlpMaxInspectBytes} bytes`);u();return}let c=Buffer.concat(b),e=null;try{let b=a.headers["content-encoding"],d=b?(await J(c,b,8*i.dlpMaxInspectBytes)).buffer:c;e=v(JSON.parse(d.toString("utf8")),l.profile)}catch{e=null}if(!e||e.budgetExceeded){if("allow"!==i.dlpOversizeAction)return void C("Request could not be inspected and your content policy blocks uninspected uploads",e?.budgetExceeded?"too complex to inspect":"unreadable body")}else if(e.violations.length){let a=e.violations[0],b=e.violations.length>1?` (+${e.violations.length-1} more)`:"";C(`Blocked by content policy "${l.reason}"`,`${a.message}${b}`);return}c.length&&p.write(c),u()}catch(a){C("Content inspection failed",a?.message||String(a))}})}else a.on("data",b=>{j.add(b),p.write(b)||a.pause()}),p.on("drain",()=>a.resume()),a.on("end",u);a.on("aborted",()=>p.destroy(Error("Client request aborted"))),a.on("error",a=>p.destroy(a)),b.on("close",()=>{x||z||(q?.destroy(Error("Client response closed")),p?.destroy(Error("Client response closed")),A(Error("Client response closed")))})}catch(a){b.headersSent||(b.writeHead(502,{"content-type":"application/json"}),b.end(JSON.stringify({error:"Destination validation or connection failed"})),x=!0),A(a)}}let Y=d.createServer((a,b)=>{X(a,b)});async function Z(a){return a.upstreamPromise||(a.upstreamPromise=(async()=>{let b=a.target,c=await m(b.host,b.port),d=E(h.connect({host:b.host,port:b.port,servername:g.isIP(b.host)?void 0:b.host,rejectUnauthorized:!0,ca:n,ALPNProtocols:["h2"],lookup:c.lookup,autoSelectFamily:!0}));d.setNoDelay(!0),d.setKeepAlive(!0,3e4);let f=setTimeout(()=>d.destroy(Error("Upstream HTTP/2 TLS connect timeout")),i.connectTimeoutMs+i.tlsHandshakeTimeoutMs);f.unref?.(),d.once("secureConnect",()=>{clearTimeout(f),"h2"!==d.alpnProtocol&&d.destroy(Error("Upstream did not negotiate HTTP/2"))}),d.once("error",()=>clearTimeout(f)),d.once("close",()=>clearTimeout(f));let j=`https://${b.host}${443===b.port?"":`:${b.port}`}`,k=e.connect(j,{createConnection:()=>d,settings:{enablePush:!1}});return D.add(k),k.setTimeout(i.idleTimeoutMs,()=>k.destroy(Error("Upstream HTTP/2 idle timeout"))),k.once("close",()=>D.delete(k)),await new Promise((a,b)=>{let c=setTimeout(()=>b(Error("Upstream HTTP/2 session timeout")),i.connectTimeoutMs+i.tlsHandshakeTimeoutMs);c.unref?.();let d=(a,b)=>{clearTimeout(c),k.removeListener("connect",e),k.removeListener("error",f),a(b)},e=()=>d(a,k),f=a=>d(b,a);k.once("connect",e),k.once("error",f)}),k})().catch(b=>{throw a.upstreamPromise=null,b})),a.upstreamPromise}async function $(a,b){let c=C.get(a.session),d=c?.target;if(!c||!d){a.respond({":status":502,"content-type":"text/plain"}),a.end("Audit target is missing");return}a.pause();let f=Date.now(),g=new L(i.captureBodies?i.captureLimitBytes:0),h=new L(i.captureBodies?i.captureLimitBytes:0),j={},k=null,l=!1,m=!1,n=null,o=null,p=null,q=(e=null)=>{l||(l=!0,K(M({requestHeaders:b,method:b[":method"]||"GET",path:b[":path"]||"/",target:d,requestCapture:g,responseCapture:h,responseHeaders:j,statusCode:k,startedAt:f,error:e,socket:a.session.socket,protocol:"h2",authUser:c.authUser||null})))};try{(n=(await Z(c)).request(function(a,b){let c=I(a,{stripInternal:!0}),d={":method":a[":method"]||"GET",":path":a[":path"]||"/",":scheme":"https",":authority":443===b.port?b.host:`${b.host}:${b.port}`};for(let[a,b]of Object.entries(c))a.startsWith(":")||(d[a.toLowerCase()]=b);return d}(b,d),{endStream:!1,waitForTrailers:!0})).setTimeout(i.idleTimeoutMs,()=>n.close(e.constants.NGHTTP2_CANCEL)),a.setTimeout(i.idleTimeoutMs,()=>a.close(e.constants.NGHTTP2_CANCEL)),n.on("response",b=>{j=R(b),k=Number(b[":status"]||502),a.respond(function(a){let b=I(a,{stripInternal:!1}),c={":status":Number(a[":status"]||502)};for(let[a,d]of Object.entries(b))a.startsWith(":")||(c[a.toLowerCase()]=d);return c}(b),{waitForTrailers:!0})}),n.on("trailers",a=>{p=I(a,{stripInternal:!1})}),a.on("wantTrailers",()=>{try{a.sendTrailers(p||{})}catch{}}),a.on("trailers",a=>{o=I(a,{stripInternal:!0})}),n.on("wantTrailers",()=>{try{n.sendTrailers(o||{})}catch{}}),a.on("data",b=>{g.add(b),n.write(b)||a.pause()}),n.on("drain",()=>a.resume()),a.on("end",()=>n.end()),n.on("data",b=>{h.add(b),a.write(b)||n.pause()}),a.on("drain",()=>n.resume()),n.on("end",()=>{m=!0,a.end(),q(null)}),n.on("aborted",()=>{let b=Error("Upstream HTTP/2 stream aborted");a.close(e.constants.NGHTTP2_INTERNAL_ERROR),q(b)}),n.on("error",b=>{a.closed||a.close(e.constants.NGHTTP2_INTERNAL_ERROR),q(b)}),a.on("aborted",()=>{n.close(e.constants.NGHTTP2_CANCEL),q(Error("Client HTTP/2 stream aborted"))}),a.on("error",a=>{n.close(e.constants.NGHTTP2_CANCEL),q(a)}),a.on("close",()=>{m||!n||n.closed||(n.close(e.constants.NGHTTP2_CANCEL),q(Error("Client HTTP/2 stream closed")))}),a.resume()}catch(b){a.headersSent||a.closed||a.respond({":status":502,"content-type":"application/json"}),a.closed||a.end(JSON.stringify({error:"Verified upstream HTTP/2 request failed"})),q(b)}}Y.on("checkContinue",(a,b)=>{X(a,b,{expectContinue:!0})}),Y.on("upgrade",(a,b)=>{Q(b,"501 Not Implemented",O),W(a,b,b.__auditTarget)}),Y.on("clientError",(a,b)=>F(b)),Y.headersTimeout=i.responseHeaderTimeoutMs,Y.requestTimeout=0,Y.keepAliveTimeout=i.idleTimeoutMs;let _=e.createServer({settings:{enablePush:!1}});_.on("session",a=>{let b={target:a.socket.__auditTarget,authUser:a.socket.__auditProxyUser||null,upstreamPromise:null};C.set(a,b),a.setTimeout(i.idleTimeoutMs,()=>a.destroy(Error("Client HTTP/2 idle timeout"))),a.once("close",()=>{Promise.resolve(b.upstreamPromise).then(a=>a?.close()).catch(()=>{})})}),_.on("stream",(a,b)=>{$(a,b)}),_.on("sessionError",a=>{console.warn("[audit-proxy] HTTP/2 client session error:",a?.message||a)});let aa=d.createServer((a,b)=>{b.writeHead(403,{"content-type":"text/plain; charset=utf-8",connection:"close"}),b.end("Audit Proxy accepts HTTPS CONNECT traffic only")});function ab(){o=r(i.allowedClientTools),p=i.proxyAuthEnabled?x(i.proxyAuthUsers):null,z=i.proxyAuthEnabled?y():null,aa.headersTimeout=i.responseHeaderTimeoutMs,aa.keepAliveTimeout=i.idleTimeoutMs,Y.headersTimeout=i.responseHeaderTimeoutMs,Y.keepAliveTimeout=i.idleTimeoutMs,aa.auditCapabilities={http1:!0,http2:i.clientAlpnProtocols.includes("h2"),proxyAuth:!0===i.proxyAuthEnabled,plainHttp:!1,publicConnectPorts:[...i.allowedConnectPorts]}}return aa.on("connect",(a,b,c)=>{(async()=>{let d,e;try{d=G(a.url,443)}catch(e){let c=e.message||"Invalid CONNECT authority";Q(b,"400 Bad Request",c),T(a,b,d,c,{statusCode:400});return}let f=await V(a,b);if(f===U)return;try{await m(d.host,d.port)}catch(e){let c=e.message||"Destination is not allowed";Q(b,"403 Forbidden",c),T(a,b,d,c,{authUser:f});return}if(i.clientToolFilterEnabled&&s(a.headers["user-agent"],o)){let c=`Client tool is not allowed to use this proxy (${t(a.headers["user-agent"])})`;Q(b,"403 Forbidden",c),T(a,b,d,c);return}if(!H(d.host,i.allowedHosts)){if(!i.passthroughUnknown){let c="Host is not in the audit allowlist";Q(b,"403 Forbidden",c),T(a,b,d,c);return}let e=!1;try{let a=await m(d.host,d.port),f=E(g.connect({host:d.host,port:d.port,lookup:a.lookup,autoSelectFamily:!0})),h=setTimeout(()=>f.destroy(Error("TCP passthrough connect timeout")),i.connectTimeoutMs);h.unref?.(),f.setNoDelay(!0),f.setKeepAlive(!0,3e4),f.setTimeout(i.idleTimeoutMs,()=>f.destroy(Error("TCP passthrough idle timeout"))),f.once("connect",()=>{clearTimeout(h),e=!0,b.write("HTTP/1.1 200 Connection Established\r\nProxy-Agent: BlueRouter-Audit\r\n\r\n"),c?.length&&f.write(c),f.pipe(b),b.pipe(f)}),f.once("error",()=>{clearTimeout(h),e?F(b):Q(b,"502 Bad Gateway","TCP passthrough failed")}),b.once("error",()=>F(f)),b.once("close",()=>F(f))}catch(a){Q(b,"502 Bad Gateway",a.message||"TCP passthrough failed")}return}try{if(e=j(d.host),!e?.key||!e?.cert)throw Error("Certificate provider returned no certificate")}catch(a){Q(b,"500 Internal Server Error",`Cannot issue audit certificate: ${a.message}`);return}b.write("HTTP/1.1 200 Connection Established\r\nProxy-Agent: BlueRouter-Audit\r\n\r\n"),c?.length&&b.unshift(c);let k=E(new h.TLSSocket(b,{isServer:!0,key:e.key,cert:e.cert,ALPNProtocols:i.clientAlpnProtocols}));k.__auditTarget=d,k.__auditProxyUser=f,k.__auditDlpGroups=b.__auditDlpGroups||[],k.__auditDashboardUser=b.__auditDashboardUser||null,k.setNoDelay(!0),k.setKeepAlive(!0,3e4),k.setTimeout(i.idleTimeoutMs,()=>k.destroy(Error("Client TLS idle timeout")));let l=setTimeout(()=>k.destroy(Error("Client TLS handshake timeout")),i.tlsHandshakeTimeoutMs);l.unref?.();let n=!1,p=()=>{n||(n=!0,clearTimeout(l),"h2"===k.alpnProtocol?_.emit("connection",k):Y.emit("connection",k))};k.once("secure",p),k.once("secureConnect",p),k.once("error",()=>{clearTimeout(l),F(k)}),k.once("close",()=>clearTimeout(l))})().catch(a=>Q(b,"500 Internal Server Error",a.message||"Audit CONNECT failed"))}),aa.prependListener("connection",a=>{E(a),a.setNoDelay(!0),a.setKeepAlive(!0,3e4)}),aa.on("upgrade",(a,b)=>Q(b,"501 Not Implemented",O)),aa.on("clientError",(a,b)=>F(b)),aa.headersTimeout=i.responseHeaderTimeoutMs,aa.requestTimeout=0,aa.keepAliveTimeout=i.idleTimeoutMs,aa.forceCloseAll=()=>{for(let a of D)try{a.destroy()}catch{}for(let a of B.values())try{a.destroy()}catch{}for(let a of[...A])F(a)},aa.getActiveConnectionCount=()=>A.size,aa.auditConfig=i,ab(),aa.applyConfig=(a={})=>{let b={};for(let[c,d]of(a.bindHost&&String(a.bindHost)!==String(i.bindHost)&&(b.bindHost=String(a.bindHost)),Number(a.port)&&Number(a.port)!==Number(i.port)&&(b.port=Number(a.port)),Object.entries(a)))"bindHost"!==c&&"port"!==c&&(["verifyUpstreamTls","allowPlainHttp","allowedConnectPorts","clientAlpnProtocols"].includes(c)||(i[c]=d));return ab(),{rebindRequired:Object.keys(b).length>0,pending:b}},aa},hostMatches:H,parseAuthority:G,stripHopByHop:I,CaptureBuffer:L,detectProvider:M,extractModel:O,decodeCapturedBuffer:J}},62952:(a,b,c)=>{let d=c(29021),e=c(33873),f=c(4984),g=c(55511),{AUDIT_LOG_PATH:h,AUDIT_LOG_DIR:i,ensureAuditDir:j,loadConfig:k}=c(42947),{redactObject:l,scrubString:m}=c(14681),{toTokensJson:n,totalInputTokens:o}=c(11562),{publishRecentUsage:p}=c(79841),q="audit-proxy",r="client",s="provider_response",t=/\/(?:messages|responses|chat\/completions)$|generatecontent$|\/generateassistantresponse$/i,u={expiresAt:0,config:null},v=null,w=null,x=null,y=null,z=null,A=null,B="",C=Promise.resolve(),D=Promise.resolve(),E=0,F=null,G=!1,H=new Map,I={queue:[],workers:new Set,activeWorkers:0,clearing:!1,enqueued:0,written:0,dropped:0,failed:0,localFailed:0,sinkTimeouts:0,flushTimeouts:0,mysqlWritten:0,mysqlFailed:0,mysqlSkipped:0,mysqlSkippedByReason:{},usageWritten:0,usageFailed:0,tokensSeen:0,lastError:null,lastWrittenAt:null};function J(a){let b=Date.now();b-E<6e4||(E=b,console.warn(`[AuditProxy][PromptDB] ${a}`))}function K(a){I.lastError=String(a||"Audit store failure"),console.warn(`[AuditProxy][Store] ${I.lastError}`)}function L(a,b,c=3e4){let d=null;return Promise.race([a,new Promise((a,e)=>{d=setTimeout(()=>{I.sinkTimeouts+=1,e(Error(`${b} timed out after ${c}ms`))},c),d.unref?.()})]).finally(()=>{d&&clearTimeout(d)})}async function M(){let a=Date.now();if(u.expiresAt>a)return u.config;v||(v=Promise.all([c.e(689),c.e(3960)]).then(c.bind(c,41170)));let b=await v,d=await b.getPromptLogDbConfig();return u={expiresAt:a+5e3,config:d},d}async function N(){return w||(w=c.e(3056).then(c.bind(c,93056))),w}async function O(a){let b=g.createHash("sha256").update(JSON.stringify({host:a.host,port:Number(a.port||3306),database:a.database,username:a.username,password:a.password,ssl:!!a.ssl})).digest("hex");if(A&&B===b)return A;let d=C.then(async()=>{if(A&&B===b)return A;if(A){try{await A.end()}catch{}A=null,B=""}let d=await c.e(4790).then(c.t.bind(c,94790,19)),e=(d.default||d).createPool({host:a.host,port:Number(a.port||3306),database:a.database,user:a.username,password:a.password,ssl:a.ssl?{rejectUnauthorized:!0}:void 0,connectTimeout:3e3,waitForConnections:!0,connectionLimit:4,maxIdle:4,idleTimeout:6e4,queueLimit:100,enableKeepAlive:!0,keepAliveInitialDelay:3e4});return A=e,B=b,e});return C=d.then(()=>void 0,()=>void 0),d}function P(a){let b=a?new Date(a):new Date;return(Number.isNaN(b.getTime())?new Date:b).toISOString().replace("T"," ").replace("Z","")}function Q(a){if("string"!=typeof a)return a;let b=a.trim();if(!b||!b.startsWith("{")&&!b.startsWith("["))return a;try{return JSON.parse(b)}catch{return a}}function R(a,b=0,c=[]){if(null==a||b>12||c.join("\n").length>=2e5)return c;if("string"==typeof a)return a.trim()&&c.push(a.trim()),c;if(Array.isArray(a)){for(let d of a)R(d,b+1,c);return c}if("object"!=typeof a)return c;for(let[d,e]of Object.entries(a)){let a=d.toLowerCase();["content","text","prompt","input","message","output_text"].includes(a)?R(e,b+1,c):b<8&&["messages","contents","parts","body","request","payload","response","choices","output","item","items","conversationstate","currentmessage","userinputmessage","history","assistantresponsemessage"].includes(a)&&R(e,b+1,c)}return c}function S(a){if("string"!=typeof a)return!1;let b=a.trim();return!!b&&!/^\[[^\]]*\]$/.test(b)}function T(a){let b=String(a||"").toLowerCase();return b.includes("claude")?{tool:"claude-code",label:"Claude Code"}:b.includes("codex")?{tool:"codex",label:"Codex"}:{tool:"audit-proxy",label:"Enterprise AI Audit Proxy"}}async function U(a){if(!a)return null;let b=g.createHash("sha256").update(a).digest("hex"),c=Buffer.byteLength(String(a||""),"utf8"),d=await N();return await d.writePayloadFile(b,a),{payloadHash:b,payloadSizeBytes:c}}async function V(a,b,c,d){if(!c)return null;let{payloadHash:e,payloadSizeBytes:f}=c;return await a.query(`INSERT INTO prompt_log_payloads (
       payload_hash, created_at, last_seen_at, content_type, payload_size_bytes, ref_count, payload_json
     ) VALUES (?, ?, ?, ?, ?, 1, NULL)
     ON DUPLICATE KEY UPDATE
@@ -39,13 +39,13 @@ ${e}`)}catch{try{a.destroy()}catch{}}}function R(a={}){let b={};for(let[c,d]of O
       response_payload_hash, response_payload_size_bytes,
       prompt_text, full_request_json,
       response_text, status_code, error_text, meta_json
-    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, CAST(? AS JSON), ?, ?, ?, CAST(? AS JSON))`,[b.id,b.createdAt,b.sessionId,b.sourceFormat,b.targetFormat,b.model,b.endpoint,b.stage,b.providerUrl,b.provider,b.accountName,b.connectionId,b.displayModel,b.clientIp,b.clientPort,b.clientUserAgent,b.clientHost,b.sourceTool,b.sourceToolLabel,b.sourceHost,b.contentMode,b.payloadHash,b.payloadSizeBytes,b.responsePayloadHash,b.responsePayloadSizeBytes,b.promptText,b.fullRequestJson,b.responseText,b.statusCode,b.errorText,JSON.stringify(b.meta||{})])}function X(a){return a?.denied===!0}function Y(a){let b,c,d;if(X(a))return{mirror:!1,reason:"denied"};if(!function(a){if(a?.usage)return!0;let b=String(a?.path||"").split("?")[0].replace(/\/+$/,"");return t.test(b)}(a))return{mirror:!1,reason:"not-inference"};let e=function(a){try{let b=JSON.parse(JSON.stringify(a??null)),c=l(b);return JSON.parse(m(JSON.stringify(c)))}catch{return m(String(a??""))}}(a),{requestPayload:f,responsePayload:g}=(b=e.request||{},c=e.response||{},{requestPayload:{timestamp:e.timestamp,protocol:e.protocol||"http/1.1",method:e.method,endpoint:e.path,headers:b.headers||{},body:Q(b.body),capturedBytes:Number(b.capturedBytes||0),totalBytes:Number(b.totalBytes||0),wireSha256:b.wireSha256||null,truncated:!0===b.truncated},responsePayload:{timestamp:e.timestamp,protocol:e.protocol||"http/1.1",status:e.status,headers:c.headers||{},body:Q(c.body),capturedBytes:Number(c.capturedBytes||0),totalBytes:Number(c.totalBytes||0),wireSha256:c.wireSha256||null,truncated:!0===c.truncated}}),h=(d=R(f?.body??f??{}).join("\n\n"))?d.slice(0,2e3):null,i=function(a){let b=a?.body;if("string"==typeof b)return b.slice(0,2e3)||null;let c=R(b??a??{}).join("\n\n");return c?c.slice(0,2e3):null}(g),j=S(h)?h:null,k=S(i)?i:null;return j||k?{mirror:!0,safeEvent:e,requestPayload:f,responsePayload:g,promptText:j,responseText:k}:{mirror:!1,reason:"contentless"}}async function Z(a){if(X(a))return{written:!1,skipped:!0,reason:"denied"};let b=null;try{let c=await M();if(!c?.enabled)return{written:!1,disabled:!0};if("mysql"!==String(c.type||"").toLowerCase())return J(`Audit mirroring requires MySQL; current type is ${c.type||"unknown"}`),{written:!1,unsupported:!0};let d=Y(a);if(!d.mirror)return{written:!1,skipped:!0,reason:d.reason};let{safeEvent:e,requestPayload:f,responsePayload:h,promptText:i,responseText:j}=d,k=JSON.stringify(f),l=JSON.stringify(h),m=Math.max(0,Number(e.durationMs||0)),n=new Date(e.timestamp||Date.now()),o=Number.isNaN(n.getTime())?new Date:n,p=new Date(o.getTime()-m),t=P(p),u=P(o),v=T(e.client?.userAgent),w=String(e.provider||"other"),x=e.model?String(e.model):null,y=String(e.host||""),z=Number(e.port||443),A=String(e.path||""),B=y?`https://${y}${443!==z?`:${z}`:""}${A}`:null,C=await O(c);b=await C.getConnection();let[D,E]=await Promise.all([U(k),U(l)]);await b.beginTransaction();let F=await V(b,t,D,"request_json"),G=await V(b,u,E,"response_json"),H={source:q,auditEventId:e.id||null,protocol:e.protocol||"http/1.1",host:y||null,port:z,method:e.method||null,path:A||null,proxyUser:e.client?.proxyUser||null,durationMs:m,requestCapturedBytes:Number(e.request?.capturedBytes||0),requestTotalBytes:Number(e.request?.totalBytes||0),requestWireSha256:e.request?.wireSha256||null,requestTruncated:e.request?.truncated===!0,responseCapturedBytes:Number(e.response?.capturedBytes||0),responseTotalBytes:Number(e.response?.totalBytes||0),responseWireSha256:e.response?.wireSha256||null,responseTruncated:e.response?.truncated===!0,payloadHash:F?.payloadHash||null,payloadSizeBytes:F?.payloadSizeBytes||0,payloadStorage:F?"prompt_log_payloads":null,responsePayloadHash:G?.payloadHash||null,responsePayloadSizeBytes:G?.payloadSizeBytes||0,responsePayloadStorage:G?"prompt_log_payloads":null,...e.usage?{inputTokens:Number(e.usage.inputTokens||0),outputTokens:Number(e.usage.outputTokens||0),cacheReadTokens:Number(e.usage.cacheReadTokens||0),cacheCreationTokens:Number(e.usage.cacheCreationTokens||0),reasoningTokens:Number(e.usage.reasoningTokens||0),totalTokens:Number(e.usage.totalTokens||0),usageComplete:!0===e.usage.complete,usageSource:e.usage.source||null,stopReason:e.usage.stopReason||null}:{}},I=String(e.id||g.randomUUID()),K={sessionId:`audit-${I}`,sourceFormat:w,targetFormat:w,model:x,endpoint:A||null,providerUrl:B,provider:w,accountName:null,connectionId:null,displayModel:x?`${w}/${x}`:null,clientIp:e.client?.ip||null,clientPort:e.client?.port!=null?String(e.client.port):null,clientUserAgent:e.client?.userAgent||null,clientHost:y||null,sourceTool:v.tool,sourceToolLabel:v.label,sourceHost:y||null};return await W(b,{...K,id:`${I}:request`,createdAt:t,stage:r,contentMode:e.request?.body?"raw_json_preview":"metadata_only",payloadHash:F?.payloadHash||null,payloadSizeBytes:F?.payloadSizeBytes||0,responsePayloadHash:null,responsePayloadSizeBytes:0,promptText:i,fullRequestJson:null,responseText:null,statusCode:null,errorText:null,meta:{...H,auditDirection:"request"}}),await W(b,{...K,id:`${I}:response`,createdAt:u,stage:s,contentMode:e.response?.body?"raw_json_preview":"metadata_only",payloadHash:null,payloadSizeBytes:0,responsePayloadHash:G?.payloadHash||null,responsePayloadSizeBytes:G?.payloadSizeBytes||0,promptText:null,fullRequestJson:null,responseText:j,statusCode:null!=e.status?Number(e.status):null,errorText:e.error||null,meta:{...H,auditDirection:"response"}}),await b.commit(),{written:!0,rowsWritten:2}}catch(a){if(b)try{await b.rollback()}catch{}return J(`Failed to mirror audit event to prompt_logs: ${a.message||a}`),{written:!1,error:a.message||String(a)}}finally{try{b?.release()}catch{}}}async function $(){return x||(x=Promise.all([c.e(689),c.e(3960)]).then(c.bind(c,689))),x}async function _(a,b,d){if(!b||!d)return 0;try{z||(z=c.e(181).then(c.bind(c,90181))),y||(y=c.e(7464).then(c.bind(c,87464)));let[e,f]=await Promise.all([z,y]),g=await e.getPricingForModel(a,b);if(!g)return 0;let h=f.calculateCostFromTokens(d,g);return Number.isFinite(h)&&h>0?h:0}catch{return 0}}async function aa(a,b){let c=a?.usage,d=!!(c&&(c.inputTokens||c.outputTokens||c.cacheReadTokens||c.cacheCreationTokens||c.reasoningTokens)),e=Number(a?.status),f=String(a?.path||"").split("?")[0].replace(/\/+$/,""),g=!a?.error&&Number.isFinite(e)&&e>=200&&e<300&&"POST"===String(a?.method||"").toUpperCase()&&t.test(f);if(!d&&!g)return{written:!1,skipped:!0};let h=d?c:{inputTokens:0,outputTokens:0,cacheReadTokens:0,cacheCreationTokens:0,reasoningTokens:0,totalTokens:0,model:c?.model||null,stopReason:c?.stopReason||null,streaming:c?.streaming===!0,complete:!1,source:c?.source||"missing"},i=String(a.provider||"other"),j=a.model||h.model||null,k=n(h),l=a.timestamp||new Date().toISOString(),m=Number.isFinite(e)&&e>=200&&e<300,r=!!a.error&&m&&!0===h.complete,s=!r&&(a.error||a.status&&a.status>=400)?"error":"success",u=a.error?String(a.error).slice(0,500):null,v=r?null:u;p({timestamp:l,provider:i,model:j,connectionId:"",endpoint:a.path||null,requestId:a.id||null,cost:0,status:s,statusCode:null!=a.status?Number(a.status):null,errorMessageShort:v,tokens:k,sourceTool:b.tool,sourceToolLabel:b.label});try{let c=await $();if(!await c.isMysqlObservabilityEnabled())return{written:!1,disabled:!0,realtimePublished:!0};let e=await _(i,j,k),f=await c.saveMysqlUsageEvent({timestamp:l,provider:i,model:j,endpoint:a.path||null,requestId:a.id||null,sessionId:a.id?`audit-${a.id}`:null,apiKeyOwner:a.client?.dashboardUser?.userId||null,apiKeyName:a.client?.dashboardUser?`Audit Proxy — ${a.client.dashboardUser.displayName||a.client.dashboardUser.userId}`:null,clientIp:a.client?.ip||null,clientIpNormalized:a.client?.ip||null,clientHost:a.host||null,clientUserAgent:a.client?.userAgent||null,sourceTool:b.tool,sourceToolLabel:b.label,sourceHost:a.host||null,latencyMs:Math.max(0,Number(a.durationMs||0)),statusCode:null!=a.status?Number(a.status):null,errorMessageShort:v,isStreaming:!0===h.streaming,promptTokens:o(h),completionTokens:h.outputTokens,totalTokens:h.totalTokens,cachedTokens:h.cacheReadTokens,cacheCreationTokens:h.cacheCreationTokens,reasoningTokens:h.reasoningTokens,cost:e,status:s,tokens:k,meta:{source:q,auditEventId:a.id||null,host:a.host||null,method:a.method||null,stopReason:h.stopReason||null,usageComplete:!0===h.complete,usageSource:h.source||null,usageMissing:!d,responseTruncated:a.response?.truncated===!0,transportError:u,settledAfterUsage:r}});return f&&global._usageStatsCache?.clear?.(),{written:!!f,realtimePublished:!0}}catch(a){return J(`Failed to mirror audit usage to usage_events: ${a.message||a}`),{written:!1,error:a.message||String(a)}}}async function ab(a,b){let c;j();let f=(Number.isNaN((c=a?new Date(a):new Date).getTime())?new Date:c).toISOString().slice(0,10),g=H.get(f);if(!g){let a=await d.promises.readdir(i).catch(()=>[]),b=RegExp(`^audit-${f.replace(/-/g,"\\-")}(?:\\.(\\d+))?\\.jsonl$`),c=0;for(let d of a){let a=d.match(b);a&&(c=Math.max(c,Number(a[1]||0)))}let h=e.join(i,`audit-${f}${c?`.${c}`:""}.jsonl`),j=await d.promises.stat(h).catch(()=>null);g={segment:c,filePath:h,size:j?.size||0},H.set(f,g)}return g.size>0&&g.size+b>0x8000000&&(g={segment:g.segment+1,filePath:e.join(i,`audit-${f}.${g.segment+1}.jsonl`),size:0},H.set(f,g)),g}async function ac(a){let b=`${JSON.stringify(a)}
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, CAST(? AS JSON), ?, ?, ?, CAST(? AS JSON))`,[b.id,b.createdAt,b.sessionId,b.sourceFormat,b.targetFormat,b.model,b.endpoint,b.stage,b.providerUrl,b.provider,b.accountName,b.connectionId,b.displayModel,b.clientIp,b.clientPort,b.clientUserAgent,b.clientHost,b.sourceTool,b.sourceToolLabel,b.sourceHost,b.contentMode,b.payloadHash,b.payloadSizeBytes,b.responsePayloadHash,b.responsePayloadSizeBytes,b.promptText,b.fullRequestJson,b.responseText,b.statusCode,b.errorText,JSON.stringify(b.meta||{})])}function X(a){return a?.denied===!0}function Y(a){let b,c,d;if(X(a))return{mirror:!1,reason:"denied"};if(!function(a){if(a?.usage)return!0;let b=String(a?.request?.headers?.["x-amz-target"]||"");if(/\.GenerateAssistantResponse$/i.test(b))return!0;let c=String(a?.path||"").split("?")[0].replace(/\/+$/,"");return t.test(c)}(a))return{mirror:!1,reason:"not-inference"};let e=function(a){try{let b=JSON.parse(JSON.stringify(a??null)),c=l(b);return JSON.parse(m(JSON.stringify(c)))}catch{return m(String(a??""))}}(a),{requestPayload:f,responsePayload:g}=(b=e.request||{},c=e.response||{},{requestPayload:{timestamp:e.timestamp,protocol:e.protocol||"http/1.1",method:e.method,endpoint:e.path,headers:b.headers||{},body:Q(b.body),capturedBytes:Number(b.capturedBytes||0),totalBytes:Number(b.totalBytes||0),wireSha256:b.wireSha256||null,truncated:!0===b.truncated},responsePayload:{timestamp:e.timestamp,protocol:e.protocol||"http/1.1",status:e.status,headers:c.headers||{},body:Q(c.body),capturedBytes:Number(c.capturedBytes||0),totalBytes:Number(c.totalBytes||0),wireSha256:c.wireSha256||null,truncated:!0===c.truncated}}),h=(d=R(f?.body??f??{}).join("\n\n"))?d.slice(0,2e3):null,i=function(a){let b=a?.body;if("string"==typeof b)return b.slice(0,2e3)||null;let c=R(b??a??{}).join("\n\n");return c?c.slice(0,2e3):null}(g),j=S(h)?h:null,k=S(i)?i:null;return j||k?{mirror:!0,safeEvent:e,requestPayload:f,responsePayload:g,promptText:j,responseText:k}:{mirror:!1,reason:"contentless"}}async function Z(a){if(X(a))return{written:!1,skipped:!0,reason:"denied"};let b=null;try{let c=await M();if(!c?.enabled)return{written:!1,disabled:!0};if("mysql"!==String(c.type||"").toLowerCase())return J(`Audit mirroring requires MySQL; current type is ${c.type||"unknown"}`),{written:!1,unsupported:!0};let d=Y(a);if(!d.mirror)return{written:!1,skipped:!0,reason:d.reason};let{safeEvent:e,requestPayload:f,responsePayload:h,promptText:i,responseText:j}=d,k=JSON.stringify(f),l=JSON.stringify(h),m=Math.max(0,Number(e.durationMs||0)),n=new Date(e.timestamp||Date.now()),o=Number.isNaN(n.getTime())?new Date:n,p=new Date(o.getTime()-m),t=P(p),u=P(o),v=T(e.client?.userAgent),w=String(e.provider||"other"),x=e.model?String(e.model):null,y=String(e.host||""),z=Number(e.port||443),A=String(e.path||""),B=y?`https://${y}${443!==z?`:${z}`:""}${A}`:null,C=await O(c);b=await C.getConnection();let[D,E]=await Promise.all([U(k),U(l)]);await b.beginTransaction();let F=await V(b,t,D,"request_json"),G=await V(b,u,E,"response_json"),H={source:q,auditEventId:e.id||null,protocol:e.protocol||"http/1.1",host:y||null,port:z,method:e.method||null,path:A||null,proxyUser:e.client?.proxyUser||null,durationMs:m,requestCapturedBytes:Number(e.request?.capturedBytes||0),requestTotalBytes:Number(e.request?.totalBytes||0),requestWireSha256:e.request?.wireSha256||null,requestTruncated:e.request?.truncated===!0,responseCapturedBytes:Number(e.response?.capturedBytes||0),responseTotalBytes:Number(e.response?.totalBytes||0),responseWireSha256:e.response?.wireSha256||null,responseTruncated:e.response?.truncated===!0,payloadHash:F?.payloadHash||null,payloadSizeBytes:F?.payloadSizeBytes||0,payloadStorage:F?"prompt_log_payloads":null,responsePayloadHash:G?.payloadHash||null,responsePayloadSizeBytes:G?.payloadSizeBytes||0,responsePayloadStorage:G?"prompt_log_payloads":null,...e.usage?{inputTokens:Number(e.usage.inputTokens||0),outputTokens:Number(e.usage.outputTokens||0),cacheReadTokens:Number(e.usage.cacheReadTokens||0),cacheCreationTokens:Number(e.usage.cacheCreationTokens||0),reasoningTokens:Number(e.usage.reasoningTokens||0),totalTokens:Number(e.usage.totalTokens||0),usageComplete:!0===e.usage.complete,usageSource:e.usage.source||null,stopReason:e.usage.stopReason||null}:{}},I=String(e.id||g.randomUUID()),K={sessionId:`audit-${I}`,sourceFormat:w,targetFormat:w,model:x,endpoint:A||null,providerUrl:B,provider:w,accountName:null,connectionId:null,displayModel:x?`${w}/${x}`:null,clientIp:e.client?.ip||null,clientPort:e.client?.port!=null?String(e.client.port):null,clientUserAgent:e.client?.userAgent||null,clientHost:y||null,sourceTool:v.tool,sourceToolLabel:v.label,sourceHost:y||null};return await W(b,{...K,id:`${I}:request`,createdAt:t,stage:r,contentMode:e.request?.body?"raw_json_preview":"metadata_only",payloadHash:F?.payloadHash||null,payloadSizeBytes:F?.payloadSizeBytes||0,responsePayloadHash:null,responsePayloadSizeBytes:0,promptText:i,fullRequestJson:null,responseText:null,statusCode:null,errorText:null,meta:{...H,auditDirection:"request"}}),await W(b,{...K,id:`${I}:response`,createdAt:u,stage:s,contentMode:e.response?.body?"raw_json_preview":"metadata_only",payloadHash:null,payloadSizeBytes:0,responsePayloadHash:G?.payloadHash||null,responsePayloadSizeBytes:G?.payloadSizeBytes||0,promptText:null,fullRequestJson:null,responseText:j,statusCode:null!=e.status?Number(e.status):null,errorText:e.error||null,meta:{...H,auditDirection:"response"}}),await b.commit(),{written:!0,rowsWritten:2}}catch(a){if(b)try{await b.rollback()}catch{}return J(`Failed to mirror audit event to prompt_logs: ${a.message||a}`),{written:!1,error:a.message||String(a)}}finally{try{b?.release()}catch{}}}async function $(){return x||(x=Promise.all([c.e(689),c.e(3960)]).then(c.bind(c,689))),x}async function _(a,b,d){if(!b||!d)return 0;try{z||(z=c.e(181).then(c.bind(c,90181))),y||(y=c.e(7464).then(c.bind(c,87464)));let[e,f]=await Promise.all([z,y]),g=await e.getPricingForModel(a,b);if(!g)return 0;let h=f.calculateCostFromTokens(d,g);return Number.isFinite(h)&&h>0?h:0}catch{return 0}}async function aa(a,b){let c=a?.usage,d=!!(c&&(c.inputTokens||c.outputTokens||c.cacheReadTokens||c.cacheCreationTokens||c.reasoningTokens)),e=Number(a?.status),f=String(a?.path||"").split("?")[0].replace(/\/+$/,""),g=!a?.error&&Number.isFinite(e)&&e>=200&&e<300&&"POST"===String(a?.method||"").toUpperCase()&&t.test(f);if(!d&&!g)return{written:!1,skipped:!0};let h=d?c:{inputTokens:0,outputTokens:0,cacheReadTokens:0,cacheCreationTokens:0,reasoningTokens:0,totalTokens:0,model:c?.model||null,stopReason:c?.stopReason||null,streaming:c?.streaming===!0,complete:!1,source:c?.source||"missing"},i=String(a.provider||"other"),j=a.model||h.model||null,k=n(h),l=a.timestamp||new Date().toISOString(),m=Number.isFinite(e)&&e>=200&&e<300,r=!!a.error&&m&&!0===h.complete,s=!r&&(a.error||a.status&&a.status>=400)?"error":"success",u=a.error?String(a.error).slice(0,500):null,v=r?null:u;p({timestamp:l,provider:i,model:j,connectionId:"",endpoint:a.path||null,requestId:a.id||null,cost:0,status:s,statusCode:null!=a.status?Number(a.status):null,errorMessageShort:v,tokens:k,sourceTool:b.tool,sourceToolLabel:b.label});try{let c=await $();if(!await c.isMysqlObservabilityEnabled())return{written:!1,disabled:!0,realtimePublished:!0};let e=await _(i,j,k),f=await c.saveMysqlUsageEvent({timestamp:l,provider:i,model:j,endpoint:a.path||null,requestId:a.id||null,sessionId:a.id?`audit-${a.id}`:null,apiKeyOwner:a.client?.dashboardUser?.userId||null,apiKeyName:a.client?.dashboardUser?`Audit Proxy — ${a.client.dashboardUser.displayName||a.client.dashboardUser.userId}`:null,clientIp:a.client?.ip||null,clientIpNormalized:a.client?.ip||null,clientHost:a.host||null,clientUserAgent:a.client?.userAgent||null,sourceTool:b.tool,sourceToolLabel:b.label,sourceHost:a.host||null,latencyMs:Math.max(0,Number(a.durationMs||0)),statusCode:null!=a.status?Number(a.status):null,errorMessageShort:v,isStreaming:!0===h.streaming,promptTokens:o(h),completionTokens:h.outputTokens,totalTokens:h.totalTokens,cachedTokens:h.cacheReadTokens,cacheCreationTokens:h.cacheCreationTokens,reasoningTokens:h.reasoningTokens,cost:e,status:s,tokens:k,meta:{source:q,auditEventId:a.id||null,host:a.host||null,method:a.method||null,stopReason:h.stopReason||null,usageComplete:!0===h.complete,usageSource:h.source||null,usageMissing:!d,responseTruncated:a.response?.truncated===!0,transportError:u,settledAfterUsage:r}});return f&&global._usageStatsCache?.clear?.(),{written:!!f,realtimePublished:!0}}catch(a){return J(`Failed to mirror audit usage to usage_events: ${a.message||a}`),{written:!1,error:a.message||String(a)}}}async function ab(a,b){let c;j();let f=(Number.isNaN((c=a?new Date(a):new Date).getTime())?new Date:c).toISOString().slice(0,10),g=H.get(f);if(!g){let a=await d.promises.readdir(i).catch(()=>[]),b=RegExp(`^audit-${f.replace(/-/g,"\\-")}(?:\\.(\\d+))?\\.jsonl$`),c=0;for(let d of a){let a=d.match(b);a&&(c=Math.max(c,Number(a[1]||0)))}let h=e.join(i,`audit-${f}${c?`.${c}`:""}.jsonl`),j=await d.promises.stat(h).catch(()=>null);g={segment:c,filePath:h,size:j?.size||0},H.set(f,g)}return g.size>0&&g.size+b>0x8000000&&(g={segment:g.segment+1,filePath:e.join(i,`audit-${f}.${g.segment+1}.jsonl`),size:0},H.set(f,g)),g}async function ac(a){let b=`${JSON.stringify(a)}
 `,c=Buffer.byteLength(b),e=await ab(a.timestamp,c);return await d.promises.appendFile(e.filePath,b,{encoding:"utf8",mode:384}),e.size+=c,e.filePath}async function ad(a){try{let b,c=await L(Promise.resolve(a.finalize()),"Audit event finalize"),d=L((D=(b=D.then(()=>ac(c))).then(()=>void 0,()=>void 0),b),"Local JSONL write").catch(a=>(I.localFailed+=1,K(`Local JSONL write failed: ${a.message||a}`),null)),e=L(Z(c),"Prompt log mirror").catch(a=>({written:!1,error:a.message||String(a)})),f=L(aa(c,T(c.client?.userAgent)),"Usage mirror").catch(a=>({written:!1,error:a.message||String(a)})),[,g,h]=await Promise.all([d,e,f]);if(g?.written)I.mysqlWritten+=1;else if(g?.error)I.mysqlFailed+=1;else if(g?.skipped){I.mysqlSkipped+=1;let a=String(g.reason||"unknown");I.mysqlSkippedByReason[a]=(I.mysqlSkippedByReason[a]||0)+1}h?.written?I.usageWritten+=1:h?.error&&(I.usageFailed+=1),c.usage&&(I.tokensSeen+=Number(c.usage.totalTokens||0)),I.written+=1,I.lastWrittenAt=new Date().toISOString()}catch(a){I.failed+=1,K(a.message||a)}}async function ae(){I.activeWorkers+=1;try{for(;!I.clearing;){let a=I.queue.shift();if(!a)break;await ad(a)}}finally{I.activeWorkers=Math.max(0,I.activeWorkers-1)}}function af(){if(!I.clearing)for(;I.queue.length&&I.activeWorkers<4;){let a;a=ae().finally(()=>{I.workers.delete(a),!I.clearing&&I.queue.length&&setImmediate(af)}),I.workers.add(a)}}function ag(a){return"function"==typeof a&&(I.queue.length>=1e3?(I.dropped+=1,K(`Audit queue full; dropped event ${I.dropped}`),!1):(I.queue.push({finalize:a,enqueuedAt:Date.now()}),I.enqueued+=1,I.clearing||setImmediate(af),!0))}async function ah(){j();let a=(await d.promises.readdir(i).catch(()=>[])).filter(a=>/^audit-\d{4}-\d{2}-\d{2}(?:\.\d+)?\.jsonl$/.test(a)).sort((a,b)=>b.localeCompare(a,void 0,{numeric:!0})).map(a=>e.join(i,a));return d.existsSync(h)&&a.push(h),a}async function ai(a,b){let c=await d.promises.stat(a).catch(()=>null);if(!c?.size||b<=0)return[];let e=await d.promises.open(a,"r");try{let a=c.size,d=Buffer.alloc(0),f=0;for(;a>0&&d.length<0x4000000&&f<=b;){let b=Math.min(262144,a,0x4000000-d.length);a-=b;let c=Buffer.alloc(b);await e.read(c,0,b,a),d=Buffer.concat([c,d]),f+=c.reduce((a,b)=>a+ +(10===b),0)}let g=d.toString("utf8");if(a>0){let a=g.indexOf("\n");g=a>=0?g.slice(a+1):""}return g.split("\n").filter(Boolean).slice(-b).reverse().map(a=>{try{return JSON.parse(a)}catch{return null}}).filter(Boolean)}finally{await e.close()}}async function aj(a=50){let b=Math.max(1,Math.min(1e3,Number(a)||50)),c=[];for(let a of(await ah())){if(c.length>=b)break;let d=await ai(a,b-c.length);c.push(...d)}return c.slice(0,b)}async function ak(a){if(!d.existsSync(h))return;let b=`${h}.tmp`,c=d.createReadStream(h,{encoding:"utf8"}),e=d.createWriteStream(b,{encoding:"utf8",mode:384});for await(let b of f.createInterface({input:c,crlfDelay:1/0}))if(b)try{let c=JSON.parse(b);Date.parse(c.timestamp||0)>=a&&e.write(`${b}
 `)}catch{}await new Promise((a,b)=>{e.end(a),e.once("error",b)}),await d.promises.rename(b,h)}async function al(){j();let a=k(),b=Date.now()-24*a.retentionDays*36e5;for(let a of(await d.promises.readdir(i).catch(()=>[]))){if(!/^audit-\d{4}-\d{2}-\d{2}(?:\.\d+)?\.jsonl$/.test(a))continue;let c=e.join(i,a),f=await d.promises.stat(c).catch(()=>null);if(f&&f.mtimeMs<b)for(let[a,b]of(await d.promises.unlink(c).catch(()=>{}),H.entries()))b.filePath===c&&H.delete(a)}await ak(b).catch(a=>K(`Legacy log prune failed: ${a.message||a}`))}async function am(a=5e3){let b=Date.now()+Math.max(0,Number(a)||0);for(;(I.queue.length||I.activeWorkers)&&Date.now()<b;){af();let a=[...I.workers];a.length?await Promise.race([Promise.allSettled(a),new Promise(a=>setTimeout(a,50))]):await new Promise(a=>setTimeout(a,10))}let c=0===I.queue.length&&0===I.activeWorkers;return c||(I.flushTimeouts+=1),c}let an=async()=>{let a=I.queue.length;(a||I.activeWorkers)&&(await am(1e4)?console.log(`[AuditProxy][Store] flushed ${a} queued audit event(s) before shutdown`):K(`Shutdown flush incomplete; ${I.queue.length} audit event(s) still queued`))};async function ao(){let a=null;try{let b=await M();if(!b?.enabled||"mysql"!==String(b.type||"").toLowerCase())return;let c=await O(b);a=await c.getConnection(),await a.beginTransaction();let d="(stage = ? OR (session_id LIKE 'audit-%' AND stage IN (?, ?)))",[e]=await a.query(`SELECT payload_hash, response_payload_hash FROM prompt_logs WHERE ${d}`,[q,r,s]);await a.query(`DELETE FROM prompt_logs WHERE ${d}`,[q,r,s]);let f=new Map;for(let a of e||[])for(let b of[a.payload_hash,a.response_payload_hash]){let a=String(b||"").trim();a&&f.set(a,(f.get(a)||0)+1)}let g=[];for(let[b,c]of f.entries()){await a.query("UPDATE prompt_log_payloads SET ref_count = GREATEST(ref_count - ?, 0) WHERE payload_hash = ?",[c,b]);let[d]=await a.query(`DELETE p FROM prompt_log_payloads p
           WHERE p.payload_hash = ?
             AND p.last_seen_at < UTC_TIMESTAMP(3) - INTERVAL 5 MINUTE
             AND NOT EXISTS (SELECT 1 FROM prompt_logs r WHERE r.payload_hash = p.payload_hash)
-            AND NOT EXISTS (SELECT 1 FROM prompt_logs r WHERE r.response_payload_hash = p.payload_hash)`,[b]);d?.affectedRows&&g.push(b)}await a.commit();let h=await N();await Promise.all(g.map(a=>h.deletePayloadFile(a).catch(()=>{})))}catch(b){if(a)try{await a.rollback()}catch{}J(`Failed to clear mirrored audit rows: ${b.message||b}`)}finally{try{a?.release()}catch{}}}a.exports={appendAudit:function(a){return ag(async()=>a)},enqueueAuditJob:ag,readRecent:aj,clearAudit:async function a(){I.clearing=!0,I.queue.length=0,I.workers.size&&await Promise.allSettled([...I.workers]),j();let a=await d.promises.readdir(i).catch(()=>[]);await Promise.all(a.filter(a=>a.endsWith(".jsonl")).map(a=>d.promises.unlink(e.join(i,a)).catch(()=>{}))),await d.promises.writeFile(h,"",{mode:384}).catch(()=>{}),H.clear(),await ao(),I.clearing=!1,I.queue.length&&setImmediate(af)},pruneExpired:al,startAuditMaintenance:function(){F||(F=setInterval(()=>void al(),36e5),F.unref?.())},stopAuditMaintenance:function(){F&&clearInterval(F),F=null},flushAuditQueue:am,registerAuditShutdownFlush:function(){G||(G=!0,process.on("beforeExit",an),process.on("SIGINT",an),process.on("SIGTERM",an))},unregisterAuditShutdownFlush:function(){G&&(G=!1,process.off("beforeExit",an),process.off("SIGINT",an),process.off("SIGTERM",an))},getAuditStoreStats:function(){let a=I.queue[0];return{queueDepth:I.queue.length,queueLimit:1e3,oldestQueuedAgeMs:a?Math.max(0,Date.now()-a.enqueuedAt):0,workerRunning:I.activeWorkers>0,workerConcurrency:4,activeWorkers:I.activeWorkers,mysqlPoolConnections:4,enqueued:I.enqueued,written:I.written,dropped:I.dropped,failed:I.failed,localFailed:I.localFailed,sinkTimeouts:I.sinkTimeouts,flushTimeouts:I.flushTimeouts,mysqlWritten:I.mysqlWritten,mysqlFailed:I.mysqlFailed,mysqlSkipped:I.mysqlSkipped,mysqlSkippedByReason:{...I.mysqlSkippedByReason},usageWritten:I.usageWritten,usageFailed:I.usageFailed,tokensSeen:I.tokensSeen,lastError:I.lastError,lastWrittenAt:I.lastWrittenAt,logDirectory:i}},appendPromptLog:Z,appendUsageEvent:aa,promptLogMirrorDecision:Y}},77051:(a,b,c)=>{let d=c(14985).promises,e=c(91645),{normalizeIp:f,clientIpMatches:g}=c(54584),h=new Map,i=Object.freeze(["0.0.0.0/8","10.0.0.0/8","100.64.0.0/10","127.0.0.0/8","169.254.0.0/16","172.16.0.0/12","192.0.0.0/24","192.0.2.0/24","192.88.99.0/24","192.168.0.0/16","198.18.0.0/15","198.51.100.0/24","203.0.113.0/24","224.0.0.0/4","240.0.0.0/4","::/96","::1/128","100::/64","2001:2::/48","2001:db8::/32","fc00::/7","fe80::/10","ff00::/8"]),j=Object.freeze([".localhost",".local",".internal",".lan",".home.arpa"]);function k(a){return String(a||"").trim().replace(/^\[|\]$/g,"").replace(/\.$/,"").toLowerCase()}function l(a){let b=k(a);return!(!(!b||"localhost"===b||j.some(a=>b.endsWith(a)))&&(e.isIP(b)||b.includes(".")))}function m(a){let b=f(a);return!!e.isIP(b)&&!g(b,i)}function n(a){let b=[...new Set((Array.isArray(a)?a:[a]).map(a=>Number(a)).filter(a=>Number.isInteger(a)&&a>=1&&a<=65535))];return b.length?b:[443]}function o(a){let b=[...a?.addresses||[]];return function(c,d,e){let f=d,g=e;"function"==typeof d&&(g=d,f={});let h="number"==typeof f?f:Number(f?.family||0);if("object"==typeof f&&f?.all===!0){let c=4===h||6===h?b.filter(a=>a.family===h):b;if(!c.length){let b=Error(`No validated public address for ${a.host}`);b.code="ENOTFOUND",g(b);return}g(null,c.map(({address:a,family:b})=>({address:a,family:b})));return}let i=function(a,b=0){let c=Number(b||0);return 4===c||6===c?a.find(a=>a.family===c)||null:a.find(a=>4===a.family)||a[0]||null}(b,h);if(!i){let b=Error(`No validated public address for ${a.host}`);b.code="ENOTFOUND",g(b);return}g(null,i.address,i.family)}}async function p(a,b,c={}){let g=k(a),i=Number(b||443),j=n(c.allowedPorts||[443]);if(!g)throw Error("Destination host is empty");if(!Number.isInteger(i)||!j.includes(i))throw Error(`CONNECT destination port ${i||"unknown"} is not allowed`);if(l(g))throw Error(`Private or local destination hostname is not allowed: ${g}`);let q=e.isIP(f(g));if(q){let a=f(g);if(!m(a))throw Error(`Private or reserved destination address is not allowed: ${a}`);let b={host:g,port:i,addresses:[{address:a,family:q}]};return{...b,lookup:o(b)}}let r=Date.now(),s=h.get(g);if(!s||s.expiresAt<=r){let a=await d.lookup(g,{all:!0,verbatim:!0}),b=[],c=new Set;for(let d of a||[]){let a=f(d.address),g=e.isIP(a);if(!g||!m(a))continue;let h=`${g}:${a}`;c.has(h)||(c.add(h),b.push({address:a,family:g}))}if(!b.length)throw Error(`Destination did not resolve to a public address: ${g}`);s={addresses:b,expiresAt:r+6e4},h.set(g,s)}let t={host:g,port:i,addresses:[...s.addresses]};return{...t,lookup:o(t)}}a.exports={BLOCKED_ADDRESS_RANGES:i,normalizeTargetHost:k,normalizeAllowedPorts:n,isBlockedHostname:l,isPublicAddress:m,createPinnedLookup:o,resolvePublicTarget:p,clearDnsPolicyCache:function(){h.clear()}}},93599:(a,b,c)=>{let d=c(81630),e=c(73496),f=c(91645),g=c(34631),h=c(74075),i=c(55511),j=c(5019),{createAuditProxy:k,CaptureBuffer:l}=c(33575),{containsLikelySecret:m}=c(14681),{clientIpMatches:n,normalizeAllowedClientIps:o}=c(54584),{normalizeAllowedTools:p,clientToolMatches:q,shouldRefuseClientTool:r}=c(47141),{createProxyAuthenticator:s,createProxyAuthLimiter:t,hashProxyPassword:u,parseBasicProxyAuthorization:v}=c(99721),{isPublicAddress:w}=c(77051),{validateConfig:x,PROXY_AUTH_FEATURE_ENABLED:y}=c(42947),{normalizeAccessGrants:z,effectiveClientIpPolicy:A,attachClientIpGate:B,findAccessGrant:C}=c(68370),{activateProxySession:D,touchProxySession:E,getProxySession:F,revokeProxySession:G,clearAllProxySessions:H}=c(60484),{promptLogMirrorDecision:I}=c(62952);function J(a){return i.createHash("sha256").update(a).digest("hex")}function K(a){let b=j.pki.rsa.generateKeyPair(2048),c=j.pki.createCertificate();c.publicKey=b.publicKey,c.serialNumber=String(Date.now()),c.validity.notBefore=new Date(Date.now()-6e4),c.validity.notAfter=new Date(Date.now()+864e5);let d=[{name:"commonName",value:a}];return c.setSubject(d),c.setIssuer(d),c.setExtensions([{name:"basicConstraints",cA:!0,critical:!0},{name:"keyUsage",keyCertSign:!0,cRLSign:!0,critical:!0}]),c.sign(b.privateKey,j.md.sha256.create()),{cert:c,keys:b,certPem:j.pki.certificateToPem(c)}}function L(a,b){let c=j.pki.rsa.generateKeyPair(2048),d=j.pki.createCertificate();return d.publicKey=c.publicKey,d.serialNumber=`${Date.now()}${Math.floor(1e3*Math.random())}`,d.validity.notBefore=new Date(Date.now()-6e4),d.validity.notAfter=new Date(Date.now()+864e5),d.setSubject([{name:"commonName",value:b}]),d.setIssuer(a.cert.subject.attributes),d.setExtensions([{name:"basicConstraints",cA:!1},{name:"keyUsage",digitalSignature:!0,keyEncipherment:!0},{name:"extKeyUsage",serverAuth:!0},{name:"subjectAltName",altNames:[{type:2,value:b}]}]),d.sign(a.keys.privateKey,j.md.sha256.create()),{cert:j.pki.certificateToPem(d),key:j.pki.privateKeyToPem(c.privateKey)}}function M(a,b="127.0.0.1"){return new Promise((c,d)=>{a.once("error",d),a.listen(0,b,()=>{a.removeListener("error",d),c(a.address())})})}function N(a){return new Promise(b=>{if(!a)return b();try{a.forceCloseAll?.()}catch{}if(!a.listening)return b();a.close(()=>b()),setTimeout(b,1e3).unref?.()})}function O(a,b){let c="127.0.0.1";return Promise.resolve({host:a,port:b,addresses:[{address:c,family:4}],lookup:(a,b,d)=>{let e=b,f=d;"function"==typeof b&&(f=b,e={}),e?.all?f(null,[{address:c,family:4}]):f(null,c,4)}})}function P(a,b,c="",d=""){return new Promise((e,g)=>{let h=f.connect(a,"127.0.0.1"),i=Buffer.alloc(0),j=setTimeout(()=>g(Error("CONNECT timeout")),7e3);h.once("error",g),h.once("connect",()=>{let a=c?`User-Agent: ${c}\r
+            AND NOT EXISTS (SELECT 1 FROM prompt_logs r WHERE r.response_payload_hash = p.payload_hash)`,[b]);d?.affectedRows&&g.push(b)}await a.commit();let h=await N();await Promise.all(g.map(a=>h.deletePayloadFile(a).catch(()=>{})))}catch(b){if(a)try{await a.rollback()}catch{}J(`Failed to clear mirrored audit rows: ${b.message||b}`)}finally{try{a?.release()}catch{}}}a.exports={appendAudit:function(a){return ag(async()=>a)},enqueueAuditJob:ag,readRecent:aj,clearAudit:async function a(){I.clearing=!0,I.queue.length=0,I.workers.size&&await Promise.allSettled([...I.workers]),j();let a=await d.promises.readdir(i).catch(()=>[]);await Promise.all(a.filter(a=>a.endsWith(".jsonl")).map(a=>d.promises.unlink(e.join(i,a)).catch(()=>{}))),await d.promises.writeFile(h,"",{mode:384}).catch(()=>{}),H.clear(),await ao(),I.clearing=!1,I.queue.length&&setImmediate(af)},pruneExpired:al,startAuditMaintenance:function(){F||(F=setInterval(()=>void al(),36e5),F.unref?.())},stopAuditMaintenance:function(){F&&clearInterval(F),F=null},flushAuditQueue:am,registerAuditShutdownFlush:function(){G||(G=!0,process.on("beforeExit",an),process.on("SIGINT",an),process.on("SIGTERM",an))},unregisterAuditShutdownFlush:function(){G&&(G=!1,process.off("beforeExit",an),process.off("SIGINT",an),process.off("SIGTERM",an))},getAuditStoreStats:function(){let a=I.queue[0];return{queueDepth:I.queue.length,queueLimit:1e3,oldestQueuedAgeMs:a?Math.max(0,Date.now()-a.enqueuedAt):0,workerRunning:I.activeWorkers>0,workerConcurrency:4,activeWorkers:I.activeWorkers,mysqlPoolConnections:4,enqueued:I.enqueued,written:I.written,dropped:I.dropped,failed:I.failed,localFailed:I.localFailed,sinkTimeouts:I.sinkTimeouts,flushTimeouts:I.flushTimeouts,mysqlWritten:I.mysqlWritten,mysqlFailed:I.mysqlFailed,mysqlSkipped:I.mysqlSkipped,mysqlSkippedByReason:{...I.mysqlSkippedByReason},usageWritten:I.usageWritten,usageFailed:I.usageFailed,tokensSeen:I.tokensSeen,lastError:I.lastError,lastWrittenAt:I.lastWrittenAt,logDirectory:i}},appendPromptLog:Z,appendUsageEvent:aa,promptLogMirrorDecision:Y}},77051:(a,b,c)=>{let d=c(14985).promises,e=c(91645),{normalizeIp:f,clientIpMatches:g}=c(54584),h=new Map,i=Object.freeze(["0.0.0.0/8","10.0.0.0/8","100.64.0.0/10","127.0.0.0/8","169.254.0.0/16","172.16.0.0/12","192.0.0.0/24","192.0.2.0/24","192.88.99.0/24","192.168.0.0/16","198.18.0.0/15","198.51.100.0/24","203.0.113.0/24","224.0.0.0/4","240.0.0.0/4","::/96","::1/128","100::/64","2001:2::/48","2001:db8::/32","fc00::/7","fe80::/10","ff00::/8"]),j=Object.freeze(["0.0.0.0/8","127.0.0.0/8","169.254.0.0/16","224.0.0.0/4","240.0.0.0/4","::/96","::1/128","fe80::/10","ff00::/8"]),k=Object.freeze([".localhost",".local",".internal",".lan",".home.arpa"]);function l(a){return String(a||"").trim().replace(/^\[|\]$/g,"").replace(/\.$/,"").toLowerCase()}function m(a){let b=l(a);return!(!(!b||"localhost"===b||k.some(a=>b.endsWith(a)))&&(e.isIP(b)||b.includes(".")))}function n(a,b=process.env){let c=l(a);return!(!c||e.isIP(c))&&(function(a=process.env){return String(a.AUDIT_PROXY_PRIVATE_HOSTS||"").split(",").map(a=>l(a)).filter(Boolean)})(b).some(a=>a.startsWith("*.")?c.endsWith(a.slice(1))&&c.length>a.length-1:c===a)}function o(a){let b=f(a);return!!e.isIP(b)&&!g(b,j)}function p(a){let b=f(a);return!!e.isIP(b)&&!g(b,i)}function q(a){let b=[...new Set((Array.isArray(a)?a:[a]).map(a=>Number(a)).filter(a=>Number.isInteger(a)&&a>=1&&a<=65535))];return b.length?b:[443]}function r(a){let b=[...a?.addresses||[]];return function(c,d,e){let f=d,g=e;"function"==typeof d&&(g=d,f={});let h="number"==typeof f?f:Number(f?.family||0);if("object"==typeof f&&f?.all===!0){let c=4===h||6===h?b.filter(a=>a.family===h):b;if(!c.length){let b=Error(`No validated public address for ${a.host}`);b.code="ENOTFOUND",g(b);return}g(null,c.map(({address:a,family:b})=>({address:a,family:b})));return}let i=function(a,b=0){let c=Number(b||0);return 4===c||6===c?a.find(a=>a.family===c)||null:a.find(a=>4===a.family)||a[0]||null}(b,h);if(!i){let b=Error(`No validated public address for ${a.host}`);b.code="ENOTFOUND",g(b);return}g(null,i.address,i.family)}}async function s(a,b,c={}){let g=l(a),i=Number(b||443),j=q(c.allowedPorts||[443]);if(!g)throw Error("Destination host is empty");if(!Number.isInteger(i)||!j.includes(i))throw Error(`CONNECT destination port ${i||"unknown"} is not allowed`);let k=n(g);if(!k&&m(g))throw Error(`Private or local destination hostname is not allowed: ${g}`);let t=e.isIP(f(g));if(t){let a=f(g);if(!p(a))throw Error(`Private or reserved destination address is not allowed: ${a}`);let b={host:g,port:i,addresses:[{address:a,family:t}]};return{...b,lookup:r(b)}}let u=Date.now(),v=k?`private:${g}`:g,w=h.get(v);if(!w||w.expiresAt<=u){let a=await d.lookup(g,{all:!0,verbatim:!0}),b=[],c=new Set;for(let d of a||[]){let a=f(d.address),g=e.isIP(a);if(!g||!(k?o(a):p(a)))continue;let h=`${g}:${a}`;c.has(h)||(c.add(h),b.push({address:a,family:g}))}if(!b.length)throw Error(k?`Destination did not resolve to a permitted address: ${g}`:`Destination did not resolve to a public address: ${g}`);w={addresses:b,expiresAt:u+6e4},h.set(v,w)}let x={host:g,port:i,addresses:[...w.addresses]};return{...x,lookup:r(x)}}a.exports={BLOCKED_ADDRESS_RANGES:i,normalizeTargetHost:l,normalizeAllowedPorts:q,isBlockedHostname:m,isPublicAddress:p,isPrivateAllowedHost:n,isPermittedPrivateAddress:o,createPinnedLookup:r,resolvePublicTarget:s,clearDnsPolicyCache:function(){h.clear()}}},93599:(a,b,c)=>{let d=c(81630),e=c(73496),f=c(91645),g=c(34631),h=c(74075),i=c(55511),j=c(5019),{createAuditProxy:k,CaptureBuffer:l}=c(33575),{containsLikelySecret:m}=c(14681),{clientIpMatches:n,normalizeAllowedClientIps:o}=c(54584),{normalizeAllowedTools:p,clientToolMatches:q,shouldRefuseClientTool:r}=c(47141),{createProxyAuthenticator:s,createProxyAuthLimiter:t,hashProxyPassword:u,parseBasicProxyAuthorization:v}=c(99721),{isPublicAddress:w}=c(77051),{validateConfig:x,PROXY_AUTH_FEATURE_ENABLED:y}=c(42947),{normalizeAccessGrants:z,effectiveClientIpPolicy:A,attachClientIpGate:B,findAccessGrant:C}=c(68370),{activateProxySession:D,touchProxySession:E,getProxySession:F,revokeProxySession:G,clearAllProxySessions:H}=c(60484),{promptLogMirrorDecision:I}=c(62952);function J(a){return i.createHash("sha256").update(a).digest("hex")}function K(a){let b=j.pki.rsa.generateKeyPair(2048),c=j.pki.createCertificate();c.publicKey=b.publicKey,c.serialNumber=String(Date.now()),c.validity.notBefore=new Date(Date.now()-6e4),c.validity.notAfter=new Date(Date.now()+864e5);let d=[{name:"commonName",value:a}];return c.setSubject(d),c.setIssuer(d),c.setExtensions([{name:"basicConstraints",cA:!0,critical:!0},{name:"keyUsage",keyCertSign:!0,cRLSign:!0,critical:!0}]),c.sign(b.privateKey,j.md.sha256.create()),{cert:c,keys:b,certPem:j.pki.certificateToPem(c)}}function L(a,b){let c=j.pki.rsa.generateKeyPair(2048),d=j.pki.createCertificate();return d.publicKey=c.publicKey,d.serialNumber=`${Date.now()}${Math.floor(1e3*Math.random())}`,d.validity.notBefore=new Date(Date.now()-6e4),d.validity.notAfter=new Date(Date.now()+864e5),d.setSubject([{name:"commonName",value:b}]),d.setIssuer(a.cert.subject.attributes),d.setExtensions([{name:"basicConstraints",cA:!1},{name:"keyUsage",digitalSignature:!0,keyEncipherment:!0},{name:"extKeyUsage",serverAuth:!0},{name:"subjectAltName",altNames:[{type:2,value:b}]}]),d.sign(a.keys.privateKey,j.md.sha256.create()),{cert:j.pki.certificateToPem(d),key:j.pki.privateKeyToPem(c.privateKey)}}function M(a,b="127.0.0.1"){return new Promise((c,d)=>{a.once("error",d),a.listen(0,b,()=>{a.removeListener("error",d),c(a.address())})})}function N(a){return new Promise(b=>{if(!a)return b();try{a.forceCloseAll?.()}catch{}if(!a.listening)return b();a.close(()=>b()),setTimeout(b,1e3).unref?.()})}function O(a,b){let c="127.0.0.1";return Promise.resolve({host:a,port:b,addresses:[{address:c,family:4}],lookup:(a,b,d)=>{let e=b,f=d;"function"==typeof b&&(f=b,e={}),e?.all?f(null,[{address:c,family:4}]):f(null,c,4)}})}function P(a,b,c="",d=""){return new Promise((e,g)=>{let h=f.connect(a,"127.0.0.1"),i=Buffer.alloc(0),j=setTimeout(()=>g(Error("CONNECT timeout")),7e3);h.once("error",g),h.once("connect",()=>{let a=c?`User-Agent: ${c}\r
 `:"";h.write(`CONNECT ${b} HTTP/1.1\r
 Host: ${b}\r
 ${a}${d}Proxy-Connection: keep-alive\r