@jheavenknows/bluerouter 5.5.35 → 5.5.37

package/app/.next-cli-build/server/chunks/9083.js

@@ -1,10 +1,10 @@
-"use strict";exports.id=9083,exports.ids=[9083],exports.modules={45372:(a,b,c)=>{let d=c(81630),e=c(73496),f=c(55591),g=c(91645),h=c(34631),i=c(55511),j=c(74075),{promisify:k}=c(28354),{redactHeaders:l,redactBodyText:m,redactUrlPath:n,scrubString:o}=c(48350),{extractUsageFromBody:p}=c(86455),{resolvePublicTarget:q}=c(78864),{normalizeAllowedTools:r,shouldRefuseClientTool:s,describeUserAgent:t}=c(98586),{evaluateRules:u,evaluateBody:v,needsBodyInspection:w}=c(87976),{createProxyAuthenticator:x,createProxyAuthLimiter:y}=c(7566),z=k(j.brotliDecompress),A=k(j.gunzip),B=k(j.inflate),C=k(j.inflateRaw),D="function"==typeof j.zstdDecompress?k(j.zstdDecompress):null,E=new Set(["connection","proxy-connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade"]);function F(a){return String(a||"").trim().replace(/^\[|\]$/g,"").toLowerCase()}function G(a,b=443){let c=String(a||"").trim();if(!c)throw Error("Missing CONNECT authority");if(c.startsWith("[")){let a=c.indexOf("]");if(a<0)throw Error("Invalid IPv6 CONNECT authority");let d=c.slice(1,a),e=c.slice(a+1);if(e&&!e.startsWith(":"))throw Error("Invalid IPv6 CONNECT authority");let f=e?Number(e.slice(1)):b;if(!Number.isInteger(f)||f<1||f>65535)throw Error("Invalid CONNECT port");return{host:d,port:f}}let d=c.lastIndexOf(":");if(d>0&&c.indexOf(":")===d){let a=c.slice(d+1);if(!/^\d+$/.test(a))throw Error("Invalid CONNECT port");let b=Number(a);if(!Number.isInteger(b)||b<1||b>65535)throw Error("Invalid CONNECT port");return{host:c.slice(0,d),port:b}}return{host:c,port:b}}function H(a,b=[]){let c=F(a);return b.some(a=>{let b=F(a);if(!b)return!1;if(b===c)return!0;if(b.startsWith("*.")){let a=b.slice(1);return c.endsWith(a)&&c.length>a.length}return!1})}function I(a={},{stripInternal:b=!0}={}){let c=new Set([...E,...String(a.connection||"").split(",").map(a=>a.trim().toLowerCase()).filter(Boolean)]),d={};for(let[e,f]of Object.entries(a||{})){let a=e.toLowerCase();!c.has(a)&&(b&&(a.startsWith("x-9r-")||a.startsWith("x-bluerouter-"))||(d[e]=f))}return d}async function J(a,b,c){let d=String(b||"").split(",").map(a=>a.trim().toLowerCase()).filter(a=>a&&"identity"!==a);if(!d.length||!a.length)return{buffer:a,decoded:!1,contentEncoding:d.join(", ")||null};let e=a;for(let a of[...d].reverse()){let b={maxOutputLength:c};if("br"===a)e=await z(e,b);else if("gzip"===a||"x-gzip"===a)e=await A(e,b);else if("deflate"===a)try{e=await B(e,b)}catch{e=await C(e,b)}else if("zstd"===a&&D)e=await D(e,b);else throw Error(`Unsupported content-encoding: ${a}`)}return{buffer:e,decoded:!0,contentEncoding:d.join(", ")}}async function K(a,b,c){let d=String(b||"").split(",").map(a=>a.trim().toLowerCase()).filter(a=>a&&"identity"!==a);if(1!==d.length||!a.length)return null;let e=d[0],f={maxOutputLength:c,finishFlush:j.constants.Z_SYNC_FLUSH};try{if("gzip"===e||"x-gzip"===e)return await A(a,f);if("deflate"===e)try{return await B(a,f)}catch{return await C(a,f)}if("br"===e)return await z(a,{maxOutputLength:c,finishFlush:j.constants.BROTLI_OPERATION_FLUSH})}catch{}return null}class L{constructor(a){this.limitBytes=Math.max(0,Number(a)||0),this.parts=[],this.capturedBytes=0,this.totalBytes=0,this.truncated=!1,this.hash=i.createHash("sha256"),this.finished=!1}add(a){if(!a||this.finished)return;let b=Buffer.isBuffer(a)?a:Buffer.from(a);if(this.hash.update(b),this.totalBytes+=b.length,this.capturedBytes>=this.limitBytes){b.length&&(this.truncated=!0);return}let c=this.limitBytes-this.capturedBytes,d=b.length>c?b.subarray(0,c):b;d.length&&(this.parts.push(Buffer.from(d)),this.capturedBytes+=d.length),d.length<b.length&&(this.truncated=!0)}async finish(a="",b=""){if(this.finished)throw Error("Audit capture was finalized more than once");this.finished=!0;let c=this.hash.digest("hex"),d=Buffer.concat(this.parts),e=String(b||"").trim().toLowerCase(),f=d,g=!1,h=null,i=!1,j=null,k=null,l=!1,n=Math.max(1048576,Math.min(0x4000000,Math.max(8*this.limitBytes,this.limitBytes)));if(this.limitBytes>0&&d.length&&e&&"identity"!==e)if(this.truncated){let a=await K(d,e,n);a&&a.length?(f=a,g=!0,l=!0,h=a.length,i=!0):(j=`Compressed ${e} capture was truncated before decode`,k=`[${e} audit body capture truncated; decoded body unavailable]`)}else try{let a=await J(d,e,n);f=a.buffer,g=a.decoded,h=f.length,f.length>this.limitBytes&&(f=f.subarray(0,this.limitBytes),i=!0)}catch(a){j=o(a?.message||String(a)),k=`[Unable to decode ${e} audit body: ${j}]`}let p=/json|text|javascript|xml|x-www-form-urlencoded|event-stream/i.test(a||"");return{body:null!==k?k:p||!a?m(f.toString("utf8"),a):`[${f.length} bytes captured; binary body omitted]`,capturedBytes:this.capturedBytes,totalBytes:this.totalBytes,wireSha256:c,truncated:this.truncated||i,...e&&"identity"!==e?{contentEncoding:e}:{},...g?{decoded:!0,decodedBytes:h}:{},...l?{decodePartial:!0}:{},...j?{decodeError:j}:{}}}}function M(a){let b=F(a);return"api.anthropic.com"===b||b.endsWith(".anthropic.com")||"claude.ai"===b||b.endsWith(".claude.ai")?"anthropic":"api.openai.com"===b||b.endsWith(".openai.com")||"chatgpt.com"===b||b.endsWith(".chatgpt.com")?"openai":"other"}function N(a,b,c){let d=Buffer.from("anthropic"===M(b)?JSON.stringify({type:"error",error:{type:"permission_error",message:c}}):JSON.stringify({error:{message:c,type:"invalid_request_error",code:"content_policy_blocked"}}),"utf8");a.writeHead(403,{"content-type":"application/json; charset=utf-8","content-length":String(d.length),connection:"close"}),a.end(d)}function O(a){if(!a||"string"!=typeof a)return null;try{let b=JSON.parse(a);return"string"==typeof b?.model?b.model:null}catch{return null}}function P(a){let b=a?.remoteAddress||"";return b.startsWith("::ffff:")?b.slice(7):b}function Q(a,b,c,d=null){try{let e=String(c||b),f=(d||[]).filter(a=>"string"==typeof a&&!/[\r\n]/.test(a)).map(a=>`${a}\r
+"use strict";exports.id=9083,exports.ids=[9083],exports.modules={45372:(a,b,c)=>{let d=c(81630),e=c(73496),f=c(55591),g=c(91645),h=c(34631),i=c(55511),j=c(74075),{promisify:k}=c(28354),{redactHeaders:l,redactBodyText:m,redactUrlPath:n,scrubString:o}=c(48350),{extractUsageFromBody:p}=c(86455),{resolvePublicTarget:q}=c(78864),{normalizeAllowedTools:r,shouldRefuseClientTool:s,describeUserAgent:t}=c(98586),{evaluateRules:u,evaluateBody:v,needsBodyInspection:w}=c(87976),{createProxyAuthenticator:x,createProxyAuthLimiter:y}=c(7566),z=k(j.brotliDecompress),A=k(j.gunzip),B=k(j.inflate),C=k(j.inflateRaw),D="function"==typeof j.zstdDecompress?k(j.zstdDecompress):null,E=new Set(["connection","proxy-connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade"]);function F(a){return String(a||"").trim().replace(/^\[|\]$/g,"").toLowerCase()}function G(a,b=443){let c=String(a||"").trim();if(!c)throw Error("Missing CONNECT authority");if(c.startsWith("[")){let a=c.indexOf("]");if(a<0)throw Error("Invalid IPv6 CONNECT authority");let d=c.slice(1,a),e=c.slice(a+1);if(e&&!e.startsWith(":"))throw Error("Invalid IPv6 CONNECT authority");let f=e?Number(e.slice(1)):b;if(!Number.isInteger(f)||f<1||f>65535)throw Error("Invalid CONNECT port");return{host:d,port:f}}let d=c.lastIndexOf(":");if(d>0&&c.indexOf(":")===d){let a=c.slice(d+1);if(!/^\d+$/.test(a))throw Error("Invalid CONNECT port");let b=Number(a);if(!Number.isInteger(b)||b<1||b>65535)throw Error("Invalid CONNECT port");return{host:c.slice(0,d),port:b}}return{host:c,port:b}}function H(a,b=[]){let c=F(a);return b.some(a=>{let b=F(a);if(!b)return!1;if(b===c)return!0;if(b.startsWith("*.")){let a=b.slice(1);return c.endsWith(a)&&c.length>a.length}return!1})}function I(a={},{stripInternal:b=!0}={}){let c=new Set([...E,...String(a.connection||"").split(",").map(a=>a.trim().toLowerCase()).filter(Boolean)]),d={};for(let[e,f]of Object.entries(a||{})){let a=e.toLowerCase();!c.has(a)&&(b&&(a.startsWith("x-9r-")||a.startsWith("x-bluerouter-"))||(d[e]=f))}return d}async function J(a,b,c){let d=String(b||"").split(",").map(a=>a.trim().toLowerCase()).filter(a=>a&&"identity"!==a);if(!d.length||!a.length)return{buffer:a,decoded:!1,contentEncoding:d.join(", ")||null};let e=a;for(let a of[...d].reverse()){let b={maxOutputLength:c};if("br"===a)e=await z(e,b);else if("gzip"===a||"x-gzip"===a)e=await A(e,b);else if("deflate"===a)try{e=await B(e,b)}catch{e=await C(e,b)}else if("zstd"===a&&D)e=await D(e,b);else throw Error(`Unsupported content-encoding: ${a}`)}return{buffer:e,decoded:!0,contentEncoding:d.join(", ")}}async function K(a,b,c){let d=String(b||"").split(",").map(a=>a.trim().toLowerCase()).filter(a=>a&&"identity"!==a);if(1!==d.length||!a.length)return null;let e=d[0],f={maxOutputLength:c,finishFlush:j.constants.Z_SYNC_FLUSH};try{if("gzip"===e||"x-gzip"===e)return await A(a,f);if("deflate"===e)try{return await B(a,f)}catch{return await C(a,f)}if("br"===e)return await z(a,{maxOutputLength:c,finishFlush:j.constants.BROTLI_OPERATION_FLUSH})}catch{}return null}class L{constructor(a){this.limitBytes=Math.max(0,Number(a)||0),this.parts=[],this.capturedBytes=0,this.totalBytes=0,this.truncated=!1,this.hash=i.createHash("sha256"),this.finished=!1}add(a){if(!a||this.finished)return;let b=Buffer.isBuffer(a)?a:Buffer.from(a);if(this.hash.update(b),this.totalBytes+=b.length,this.capturedBytes>=this.limitBytes){b.length&&(this.truncated=!0);return}let c=this.limitBytes-this.capturedBytes,d=b.length>c?b.subarray(0,c):b;d.length&&(this.parts.push(Buffer.from(d)),this.capturedBytes+=d.length),d.length<b.length&&(this.truncated=!0)}async finish(a="",b=""){if(this.finished)throw Error("Audit capture was finalized more than once");this.finished=!0;let c=this.hash.digest("hex"),d=Buffer.concat(this.parts),e=String(b||"").trim().toLowerCase(),f=d,g=!1,h=null,i=!1,j=null,k=null,l=!1,n=Math.max(1048576,Math.min(0x4000000,Math.max(8*this.limitBytes,this.limitBytes)));if(this.limitBytes>0&&d.length&&e&&"identity"!==e)if(this.truncated){let a=await K(d,e,n);a&&a.length?(f=a,g=!0,l=!0,h=a.length,i=!0):(j=`Compressed ${e} capture was truncated before decode`,k=`[${e} audit body capture truncated; decoded body unavailable]`)}else try{let a=await J(d,e,n);f=a.buffer,g=a.decoded,h=f.length,f.length>this.limitBytes&&(f=f.subarray(0,this.limitBytes),i=!0)}catch(a){j=o(a?.message||String(a)),k=`[Unable to decode ${e} audit body: ${j}]`}let p=/json|text|javascript|xml|x-www-form-urlencoded|event-stream/i.test(a||"");return{body:null!==k?k:p||!a?m(f.toString("utf8"),a):`[${f.length} bytes captured; binary body omitted]`,capturedBytes:this.capturedBytes,totalBytes:this.totalBytes,wireSha256:c,truncated:this.truncated||i,...e&&"identity"!==e?{contentEncoding:e}:{},...g?{decoded:!0,decodedBytes:h}:{},...l?{decodePartial:!0}:{},...j?{decodeError:j}:{}}}}function M(a){let b=F(a);return"api.anthropic.com"===b||b.endsWith(".anthropic.com")||"claude.ai"===b||b.endsWith(".claude.ai")?"anthropic":"api.openai.com"===b||b.endsWith(".openai.com")||"chatgpt.com"===b||b.endsWith(".chatgpt.com")?"openai":"kiro.dev"===b||b.endsWith(".kiro.dev")||/^(?:q|codewhisperer)\.[a-z0-9-]+\.amazonaws\.com$/.test(b)?"kiro":"other"}function N(a,b,c){let d=Buffer.from("anthropic"===M(b)?JSON.stringify({type:"error",error:{type:"permission_error",message:c}}):JSON.stringify({error:{message:c,type:"invalid_request_error",code:"content_policy_blocked"}}),"utf8");a.writeHead(403,{"content-type":"application/json; charset=utf-8","content-length":String(d.length),connection:"close"}),a.end(d)}function O(a){if(!a||"string"!=typeof a)return null;try{let b=JSON.parse(a);if("string"==typeof b?.model)return b.model;let c=b?.conversationState?.currentMessage?.userInputMessage?.modelId;return"string"==typeof c&&c?c:null}catch{return null}}function P(a){let b=a?.remoteAddress||"";return b.startsWith("::ffff:")?b.slice(7):b}function Q(a,b,c,d=null){try{let e=String(c||b),f=(d||[]).filter(a=>"string"==typeof a&&!/[\r\n]/.test(a)).map(a=>`${a}\r
 `).join("");a.end(`HTTP/1.1 ${b}\r
 ${f}Connection: close\r
 Content-Type: text/plain; charset=utf-8\r
 Content-Length: ${Buffer.byteLength(e)}\r
 \r
-${e}`)}catch{try{a.destroy()}catch{}}}function R(a={}){let b={};for(let[c,d]of Object.entries(a||{}))b[c]=d;return b}async function S(a){let b=await a.requestCapture.finish(String(a.requestHeaders["content-type"]||""),String(a.requestHeaders["content-encoding"]||"")),c=String(a.responseHeaders?.["content-type"]||""),d=await a.responseCapture.finish(c,String(a.responseHeaders?.["content-encoding"]||"")),e=M(a.target.host),f=n(a.path),g=p({provider:e,body:d.body,contentType:c,path:f}),h=O(b.body)||g?.model||null;return{id:i.randomUUID(),timestamp:new Date().toISOString(),protocol:a.protocol||"http/1.1",client:{ip:a.clientIp||"",port:a.clientPort||null,userAgent:String(a.requestHeaders["user-agent"]||""),proxyUser:a.authUser||null,dashboardUser:a.dashboardUser||null},provider:e,host:F(a.target.host),port:a.target.port,method:a.method,path:f,model:h,usage:g,status:a.statusCode||null,durationMs:Date.now()-a.startedAt,error:a.error?o(a.error.message||a.error):null,denied:!0===a.denied,request:{headers:l(a.requestHeaders),...b},response:{headers:l(a.responseHeaders||{}),...d}}}a.exports={createAuditProxy:function(a={},b={}){let i={allowedHosts:[],passthroughUnknown:!0,captureBodies:!0,captureLimitBytes:2097152,verifyUpstreamTls:!0,allowedConnectPorts:[443],connectTimeoutMs:1e4,tlsHandshakeTimeoutMs:1e4,responseHeaderTimeoutMs:3e4,idleTimeoutMs:9e5,allowPlainHttp:!1,clientToolFilterEnabled:!1,allowedClientTools:[],proxyAuthEnabled:!1,proxyAuthUsers:[],clientAlpnProtocols:["http/1.1"],...a};if(!0!==i.verifyUpstreamTls)throw Error("Upstream TLS verification is mandatory in Audit Proxy mode");let j=b.certificateProvider;if("function"!=typeof j)throw Error("certificateProvider is required");let k="function"==typeof b.onAudit?b.onAudit:()=>{},l="function"==typeof b.onAuditJob?b.onAuditJob:null,m="function"==typeof b.resolveTarget?b.resolveTarget:(a,b)=>q(a,b,{allowedPorts:i.allowedConnectPorts}),n=b.upstreamCa,o=r(i.allowedClientTools),p=i.proxyAuthEnabled?x(i.proxyAuthUsers):null,z=i.proxyAuthEnabled?y():null,A=new Set,B=new Map,C=new WeakMap,D=new Set;function E(a){return!a||A.has(a)||(A.add(a),a.once?.("close",()=>A.delete(a))),a}function F(a,b){try{"function"==typeof a.destroy?a.destroy(b):"function"==typeof a.close&&a.close()}catch{}}function K(a){let b=()=>S(a);if(l){try{l(b)}catch(a){console.warn("[audit-proxy] audit enqueue failed:",a?.message||a)}return}setImmediate(()=>{Promise.resolve().then(b).then(k).catch(a=>console.warn("[audit-proxy] audit callback failed:",a?.message||a))})}function M({requestHeaders:a,method:b,path:c,target:d,requestCapture:e,responseCapture:f,responseHeaders:g,statusCode:h,startedAt:i,error:j,socket:k,protocol:l,authUser:m=null,denied:n=!1}){return{requestHeaders:R(a),method:b,path:c,target:d,requestCapture:e,responseCapture:f,responseHeaders:R(g),statusCode:h,startedAt:i,error:j,clientIp:P(k),clientPort:k?.remotePort||null,authUser:m,dashboardUser:k?.__auditDashboardUser||null,protocol:l,denied:n}}let O="This proxy does not support WebSocket connections. Use the HTTP streaming transport instead - most clients fall back to it automatically.";function T(a,b,c,d,{statusCode:e=403,authUser:f=null}={}){let g=String(a.url||""),h=c||{host:g.includes(":")?g.slice(0,g.lastIndexOf(":")):g||"unknown",port:443},j=new L(i.captureBodies?i.captureLimitBytes:0);j.add(Buffer.from(d)),K(M({requestHeaders:a.headers,method:"CONNECT",path:"",target:h,requestCapture:new L(0),responseCapture:j,responseHeaders:{"content-type":"text/plain; charset=utf-8",connection:"close"},statusCode:e,startedAt:Date.now(),error:d,socket:b,protocol:"http/1.1",authUser:f,denied:!0}))}let U=Symbol("refused");async function V(a,b){if(!p)return null;let d=P(b),e=(c,d=null)=>(Q(b,"407 Proxy Authentication Required",c,['Proxy-Authenticate: Basic realm="BlueRouter Audit Proxy", charset="UTF-8"']),T(a,b,void 0,c,{statusCode:407,authUser:d}),U);if(z.isLocked(d))return e("Too many failed proxy authentication attempts");let f=a.headers["proxy-authorization"],g=await p.authenticate(f);if(g.ok)return z.recordSuccess(d),g.username;let h=null;if(f){let{lockedNow:a}=z.recordFailure(d);a&&console.log(`[audit-proxy] proxy auth lockout for ${d||"unknown"}`);try{h=c(7566).parseBasicProxyAuthorization(f)?.username||null}catch{h=null}}return e(g.reason||"Proxy authentication required",h)}function W(a,b,c){if(!c)return;let d=new L(i.captureBodies?i.captureLimitBytes:0);d.add(Buffer.from(O)),K(M({requestHeaders:a.headers,method:a.method,path:a.url,target:c,requestCapture:new L(0),responseCapture:d,responseHeaders:{"content-type":"text/plain; charset=utf-8",connection:"close"},statusCode:501,startedAt:Date.now(),error:null,socket:b,protocol:"http/1.1",authUser:b?.__auditProxyUser||null,denied:!0}))}async function X(a,b,{expectContinue:c=!1}={}){let d=a.socket.__auditTarget,e=a.socket.__auditProxyUser||null;if(!d){b.writeHead(502,{"content-type":"text/plain"}),b.end("Audit target is missing");return}if(function(a={}){return"string"==typeof a.upgrade&&""!==a.upgrade.trim()}(a.headers)){b.writeHead(501,{"content-type":"text/plain; charset=utf-8",connection:"close"}),b.end(O),W(a,a.socket,d);return}let h=Date.now(),j=new L(i.captureBodies?i.captureLimitBytes:0),k=new L(i.captureBodies?i.captureLimitBytes:0),l=i.dlpEnabled?u(i,{groups:a.socket.__auditDlpGroups||[],host:d.host,userAgent:a.headers["user-agent"],method:a.method,path:a.url}):null,o=I(a.headers,{stripInternal:!0});o.host=443===d.port?d.host:`${d.host}:${d.port}`;let p=null,q=null,r={},s=null,t=!1,x=!1,y=null,z=!1,A=(b=null,{denied:c=!1,statusOverride:f=null}={})=>{t||(t=!0,y&&clearTimeout(y),K(M({requestHeaders:a.headers,method:a.method,path:a.url,target:d,requestCapture:j,responseCapture:k,responseHeaders:r,statusCode:f??s,startedAt:h,error:b,socket:a.socket,protocol:"http/1.1",authUser:e,denied:c})))},C=(c,e)=>{if(z||x)return;z=!0;let f=e?`${c}: ${e}`:c;k.add(Buffer.from(f)),b.headersSent?b.destroyed||b.destroy(Error(f)):N(b,d.host,f),x=!0,F(p,Error(f)),a.destroy(),A(null,{denied:!0,statusOverride:403})};if(l?.action==="deny"){let a=`Blocked by content policy "${l.reason}"`;k.add(Buffer.from(a)),N(b,d.host,a),x=!0,A(null,{denied:!0,statusOverride:403});return}let D=!!l&&w(l,a.method,a.headers);try{let e,h,t=await m(d.host,d.port);(p=f.request({hostname:d.host,port:d.port,method:a.method,path:a.url,headers:o,rejectUnauthorized:!0,servername:g.isIP(d.host)?void 0:d.host,ca:n,ALPNProtocols:["http/1.1"],lookup:t.lookup,autoSelectFamily:!0,agent:(e=`${d.host}:${d.port}`,(h=B.get(e))||(h=new f.Agent({keepAlive:!0,maxSockets:32,maxFreeSockets:8,timeout:i.idleTimeoutMs}),B.set(e,h)),h)})).on("socket",a=>{if(E(a),a.setNoDelay(!0),a.setKeepAlive(!0,3e4),a.setTimeout(i.idleTimeoutMs,()=>a.destroy(Error("Upstream idle timeout"))),a.connecting){let b=setTimeout(()=>a.destroy(Error("Upstream TLS connect timeout")),i.connectTimeoutMs+i.tlsHandshakeTimeoutMs);b.unref?.();let c=()=>clearTimeout(b);a.once("secureConnect",c),a.once("error",c),a.once("close",c)}}),p.on("continue",()=>{c&&!b.headersSent&&b.writeContinue()}),p.on("information",a=>{102===a.statusCode&&"function"==typeof b.writeProcessing&&b.writeProcessing(),103===a.statusCode&&"function"==typeof b.writeEarlyHints&&b.writeEarlyHints(a.headers||{})}),p.on("response",a=>{q=a,y&&clearTimeout(y),s=a.statusCode||502,r=R(a.headers||{});let c=I(a.headers,{stripInternal:!1});b.writeHead(s,c),b.flushHeaders?.(),a.on("data",c=>{k.add(c),b.write(c)||a.pause()}),b.on("drain",()=>a.resume()),a.on("aborted",()=>{let a=Error("Upstream response aborted");b.destroyed||b.destroy(a),A(a)}),a.on("error",a=>{b.destroyed||b.destroy(a),A(a)}),a.on("end",()=>{if(a.trailers&&Object.keys(a.trailers).length)try{b.addTrailers(I(a.trailers,{stripInternal:!1}))}catch{}x=!0,b.end(),A(null)})}),p.on("error",a=>{z||(b.headersSent?b.destroyed||b.destroy(a):(b.writeHead(502,{"content-type":"application/json"}),b.end(JSON.stringify({error:"Verified upstream TLS request failed"})),x=!0),A(a))});let u=()=>{if(a.trailers&&Object.keys(a.trailers).length)try{p.addTrailers(I(a.trailers,{stripInternal:!0}))}catch{}p.end(),y=setTimeout(()=>p.destroy(Error("Upstream response header timeout")),i.responseHeaderTimeoutMs),y.unref?.()};if(D){let b=[],c=0,d=!1;a.on("data",a=>{if(j.add(a),!d&&!z){if((c+=a.length)>i.dlpMaxInspectBytes){d=!0,b.length=0;return}b.push(a)}}),a.on("end",async()=>{try{if(z)return;if(d){if("allow"!==i.dlpOversizeAction)return void C("Request is too large to inspect and your content policy blocks uninspected uploads",`over ${i.dlpMaxInspectBytes} bytes`);u();return}let c=Buffer.concat(b),e=null;try{let b=a.headers["content-encoding"],d=b?(await J(c,b,8*i.dlpMaxInspectBytes)).buffer:c;e=v(JSON.parse(d.toString("utf8")),l.profile)}catch{e=null}if(!e||e.budgetExceeded){if("allow"!==i.dlpOversizeAction)return void C("Request could not be inspected and your content policy blocks uninspected uploads",e?.budgetExceeded?"too complex to inspect":"unreadable body")}else if(e.violations.length){let a=e.violations[0],b=e.violations.length>1?` (+${e.violations.length-1} more)`:"";C(`Blocked by content policy "${l.reason}"`,`${a.message}${b}`);return}c.length&&p.write(c),u()}catch(a){C("Content inspection failed",a?.message||String(a))}})}else a.on("data",b=>{j.add(b),p.write(b)||a.pause()}),p.on("drain",()=>a.resume()),a.on("end",u);a.on("aborted",()=>p.destroy(Error("Client request aborted"))),a.on("error",a=>p.destroy(a)),b.on("close",()=>{x||z||(q?.destroy(Error("Client response closed")),p?.destroy(Error("Client response closed")),A(Error("Client response closed")))})}catch(a){b.headersSent||(b.writeHead(502,{"content-type":"application/json"}),b.end(JSON.stringify({error:"Destination validation or connection failed"})),x=!0),A(a)}}let Y=d.createServer((a,b)=>{X(a,b)});async function Z(a){return a.upstreamPromise||(a.upstreamPromise=(async()=>{let b=a.target,c=await m(b.host,b.port),d=E(h.connect({host:b.host,port:b.port,servername:g.isIP(b.host)?void 0:b.host,rejectUnauthorized:!0,ca:n,ALPNProtocols:["h2"],lookup:c.lookup,autoSelectFamily:!0}));d.setNoDelay(!0),d.setKeepAlive(!0,3e4);let f=setTimeout(()=>d.destroy(Error("Upstream HTTP/2 TLS connect timeout")),i.connectTimeoutMs+i.tlsHandshakeTimeoutMs);f.unref?.(),d.once("secureConnect",()=>{clearTimeout(f),"h2"!==d.alpnProtocol&&d.destroy(Error("Upstream did not negotiate HTTP/2"))}),d.once("error",()=>clearTimeout(f)),d.once("close",()=>clearTimeout(f));let j=`https://${b.host}${443===b.port?"":`:${b.port}`}`,k=e.connect(j,{createConnection:()=>d,settings:{enablePush:!1}});return D.add(k),k.setTimeout(i.idleTimeoutMs,()=>k.destroy(Error("Upstream HTTP/2 idle timeout"))),k.once("close",()=>D.delete(k)),await new Promise((a,b)=>{let c=setTimeout(()=>b(Error("Upstream HTTP/2 session timeout")),i.connectTimeoutMs+i.tlsHandshakeTimeoutMs);c.unref?.();let d=(a,b)=>{clearTimeout(c),k.removeListener("connect",e),k.removeListener("error",f),a(b)},e=()=>d(a,k),f=a=>d(b,a);k.once("connect",e),k.once("error",f)}),k})().catch(b=>{throw a.upstreamPromise=null,b})),a.upstreamPromise}async function $(a,b){let c=C.get(a.session),d=c?.target;if(!c||!d){a.respond({":status":502,"content-type":"text/plain"}),a.end("Audit target is missing");return}a.pause();let f=Date.now(),g=new L(i.captureBodies?i.captureLimitBytes:0),h=new L(i.captureBodies?i.captureLimitBytes:0),j={},k=null,l=!1,m=!1,n=null,o=null,p=null,q=(e=null)=>{l||(l=!0,K(M({requestHeaders:b,method:b[":method"]||"GET",path:b[":path"]||"/",target:d,requestCapture:g,responseCapture:h,responseHeaders:j,statusCode:k,startedAt:f,error:e,socket:a.session.socket,protocol:"h2",authUser:c.authUser||null})))};try{(n=(await Z(c)).request(function(a,b){let c=I(a,{stripInternal:!0}),d={":method":a[":method"]||"GET",":path":a[":path"]||"/",":scheme":"https",":authority":443===b.port?b.host:`${b.host}:${b.port}`};for(let[a,b]of Object.entries(c))a.startsWith(":")||(d[a.toLowerCase()]=b);return d}(b,d),{endStream:!1,waitForTrailers:!0})).setTimeout(i.idleTimeoutMs,()=>n.close(e.constants.NGHTTP2_CANCEL)),a.setTimeout(i.idleTimeoutMs,()=>a.close(e.constants.NGHTTP2_CANCEL)),n.on("response",b=>{j=R(b),k=Number(b[":status"]||502),a.respond(function(a){let b=I(a,{stripInternal:!1}),c={":status":Number(a[":status"]||502)};for(let[a,d]of Object.entries(b))a.startsWith(":")||(c[a.toLowerCase()]=d);return c}(b),{waitForTrailers:!0})}),n.on("trailers",a=>{p=I(a,{stripInternal:!1})}),a.on("wantTrailers",()=>{try{a.sendTrailers(p||{})}catch{}}),a.on("trailers",a=>{o=I(a,{stripInternal:!0})}),n.on("wantTrailers",()=>{try{n.sendTrailers(o||{})}catch{}}),a.on("data",b=>{g.add(b),n.write(b)||a.pause()}),n.on("drain",()=>a.resume()),a.on("end",()=>n.end()),n.on("data",b=>{h.add(b),a.write(b)||n.pause()}),a.on("drain",()=>n.resume()),n.on("end",()=>{m=!0,a.end(),q(null)}),n.on("aborted",()=>{let b=Error("Upstream HTTP/2 stream aborted");a.close(e.constants.NGHTTP2_INTERNAL_ERROR),q(b)}),n.on("error",b=>{a.closed||a.close(e.constants.NGHTTP2_INTERNAL_ERROR),q(b)}),a.on("aborted",()=>{n.close(e.constants.NGHTTP2_CANCEL),q(Error("Client HTTP/2 stream aborted"))}),a.on("error",a=>{n.close(e.constants.NGHTTP2_CANCEL),q(a)}),a.on("close",()=>{m||!n||n.closed||(n.close(e.constants.NGHTTP2_CANCEL),q(Error("Client HTTP/2 stream closed")))}),a.resume()}catch(b){a.headersSent||a.closed||a.respond({":status":502,"content-type":"application/json"}),a.closed||a.end(JSON.stringify({error:"Verified upstream HTTP/2 request failed"})),q(b)}}Y.on("checkContinue",(a,b)=>{X(a,b,{expectContinue:!0})}),Y.on("upgrade",(a,b)=>{Q(b,"501 Not Implemented",O),W(a,b,b.__auditTarget)}),Y.on("clientError",(a,b)=>F(b)),Y.headersTimeout=i.responseHeaderTimeoutMs,Y.requestTimeout=0,Y.keepAliveTimeout=i.idleTimeoutMs;let _=e.createServer({settings:{enablePush:!1}});_.on("session",a=>{let b={target:a.socket.__auditTarget,authUser:a.socket.__auditProxyUser||null,upstreamPromise:null};C.set(a,b),a.setTimeout(i.idleTimeoutMs,()=>a.destroy(Error("Client HTTP/2 idle timeout"))),a.once("close",()=>{Promise.resolve(b.upstreamPromise).then(a=>a?.close()).catch(()=>{})})}),_.on("stream",(a,b)=>{$(a,b)}),_.on("sessionError",a=>{console.warn("[audit-proxy] HTTP/2 client session error:",a?.message||a)});let aa=d.createServer((a,b)=>{b.writeHead(403,{"content-type":"text/plain; charset=utf-8",connection:"close"}),b.end("Audit Proxy accepts HTTPS CONNECT traffic only")});function ab(){o=r(i.allowedClientTools),p=i.proxyAuthEnabled?x(i.proxyAuthUsers):null,z=i.proxyAuthEnabled?y():null,aa.headersTimeout=i.responseHeaderTimeoutMs,aa.keepAliveTimeout=i.idleTimeoutMs,Y.headersTimeout=i.responseHeaderTimeoutMs,Y.keepAliveTimeout=i.idleTimeoutMs,aa.auditCapabilities={http1:!0,http2:i.clientAlpnProtocols.includes("h2"),proxyAuth:!0===i.proxyAuthEnabled,plainHttp:!1,publicConnectPorts:[...i.allowedConnectPorts]}}return aa.on("connect",(a,b,c)=>{(async()=>{let d,e;try{d=G(a.url,443)}catch(e){let c=e.message||"Invalid CONNECT authority";Q(b,"400 Bad Request",c),T(a,b,d,c,{statusCode:400});return}let f=await V(a,b);if(f===U)return;try{await m(d.host,d.port)}catch(e){let c=e.message||"Destination is not allowed";Q(b,"403 Forbidden",c),T(a,b,d,c,{authUser:f});return}if(i.clientToolFilterEnabled&&s(a.headers["user-agent"],o)){let c=`Client tool is not allowed to use this proxy (${t(a.headers["user-agent"])})`;Q(b,"403 Forbidden",c),T(a,b,d,c);return}if(!H(d.host,i.allowedHosts)){if(!i.passthroughUnknown){let c="Host is not in the audit allowlist";Q(b,"403 Forbidden",c),T(a,b,d,c);return}let e=!1;try{let a=await m(d.host,d.port),f=E(g.connect({host:d.host,port:d.port,lookup:a.lookup,autoSelectFamily:!0})),h=setTimeout(()=>f.destroy(Error("TCP passthrough connect timeout")),i.connectTimeoutMs);h.unref?.(),f.setNoDelay(!0),f.setKeepAlive(!0,3e4),f.setTimeout(i.idleTimeoutMs,()=>f.destroy(Error("TCP passthrough idle timeout"))),f.once("connect",()=>{clearTimeout(h),e=!0,b.write("HTTP/1.1 200 Connection Established\r\nProxy-Agent: BlueRouter-Audit\r\n\r\n"),c?.length&&f.write(c),f.pipe(b),b.pipe(f)}),f.once("error",()=>{clearTimeout(h),e?F(b):Q(b,"502 Bad Gateway","TCP passthrough failed")}),b.once("error",()=>F(f)),b.once("close",()=>F(f))}catch(a){Q(b,"502 Bad Gateway",a.message||"TCP passthrough failed")}return}try{if(e=j(d.host),!e?.key||!e?.cert)throw Error("Certificate provider returned no certificate")}catch(a){Q(b,"500 Internal Server Error",`Cannot issue audit certificate: ${a.message}`);return}b.write("HTTP/1.1 200 Connection Established\r\nProxy-Agent: BlueRouter-Audit\r\n\r\n"),c?.length&&b.unshift(c);let k=E(new h.TLSSocket(b,{isServer:!0,key:e.key,cert:e.cert,ALPNProtocols:i.clientAlpnProtocols}));k.__auditTarget=d,k.__auditProxyUser=f,k.__auditDlpGroups=b.__auditDlpGroups||[],k.__auditDashboardUser=b.__auditDashboardUser||null,k.setNoDelay(!0),k.setKeepAlive(!0,3e4),k.setTimeout(i.idleTimeoutMs,()=>k.destroy(Error("Client TLS idle timeout")));let l=setTimeout(()=>k.destroy(Error("Client TLS handshake timeout")),i.tlsHandshakeTimeoutMs);l.unref?.();let n=!1,p=()=>{n||(n=!0,clearTimeout(l),"h2"===k.alpnProtocol?_.emit("connection",k):Y.emit("connection",k))};k.once("secure",p),k.once("secureConnect",p),k.once("error",()=>{clearTimeout(l),F(k)}),k.once("close",()=>clearTimeout(l))})().catch(a=>Q(b,"500 Internal Server Error",a.message||"Audit CONNECT failed"))}),aa.prependListener("connection",a=>{E(a),a.setNoDelay(!0),a.setKeepAlive(!0,3e4)}),aa.on("upgrade",(a,b)=>Q(b,"501 Not Implemented",O)),aa.on("clientError",(a,b)=>F(b)),aa.headersTimeout=i.responseHeaderTimeoutMs,aa.requestTimeout=0,aa.keepAliveTimeout=i.idleTimeoutMs,aa.forceCloseAll=()=>{for(let a of D)try{a.destroy()}catch{}for(let a of B.values())try{a.destroy()}catch{}for(let a of[...A])F(a)},aa.getActiveConnectionCount=()=>A.size,aa.auditConfig=i,ab(),aa.applyConfig=(a={})=>{let b={};for(let[c,d]of(a.bindHost&&String(a.bindHost)!==String(i.bindHost)&&(b.bindHost=String(a.bindHost)),Number(a.port)&&Number(a.port)!==Number(i.port)&&(b.port=Number(a.port)),Object.entries(a)))"bindHost"!==c&&"port"!==c&&(["verifyUpstreamTls","allowPlainHttp","allowedConnectPorts","clientAlpnProtocols"].includes(c)||(i[c]=d));return ab(),{rebindRequired:Object.keys(b).length>0,pending:b}},aa},hostMatches:H,parseAuthority:G,stripHopByHop:I,CaptureBuffer:L,detectProvider:M,extractModel:O,decodeCapturedBuffer:J}},49083:(a,b,c)=>{let{createAuditProxy:d}=c(45372),{loadConfig:e,saveConfig:f,validateConfig:g,CONFIG_PATH:h,AUDIT_LOG_PATH:i,AUDIT_LOG_DIR:j,PROXY_AUTH_FEATURE_ENABLED:k}=c(43096),{hashProxyPassword:l,isValidUsername:m,normalizeProxyUsers:n,redactProxyAuthUsers:o,PASSWORD_MAX_BYTES:p,PASSWORD_MIN_BYTES:q}=c(7566),{normalizeIp:r}=c(5565),{attachClientIpGate:s,effectiveClientIpPolicy:t,normalizeAccessGrants:u,normalizeGrantUserId:v}=c(77407),{getProxySession:w,pruneExpiredProxySessions:x,revokeProxySession:y,revokeProxySessionsForUser:z}=c(68257),{SETTINGS_KEY:A,extractAuditPolicy:B,mergeAuditPolicy:C,policyEquals:D}=c(85463),{enqueueAuditJob:E,readRecent:F,clearAudit:G,pruneExpired:H,startAuditMaintenance:I,stopAuditMaintenance:J,flushAuditQueue:K,registerAuditShutdownFlush:L,unregisterAuditShutdownFlush:M,getAuditStoreStats:N}=c(90173),{ensureAuditRootCA:O,createAuditCertificateProvider:P,getStatusRootCaValidation:Q}=c(85074),{readRootCAInfo:R}=c(2466),{runSelfTest:S}=c(85252);function T(){return globalThis.__blueRouterAuditProxyRuntime||(globalThis.__blueRouterAuditProxyRuntime={server:null,certificateProvider:null,ipPolicy:null,ipGate:null,startedAt:null,lastError:null,autostartPromise:null,autostartRetryTimer:null,lifecycle:Promise.resolve()}),globalThis.__blueRouterAuditProxyRuntime}function U(a){let b=T(),c=b.lifecycle.then(a,a);return b.lifecycle=c.catch(()=>{}),c}async function V(a,b=1500){if(!a)return;let c=Math.max(0,Number(b)||0);await new Promise(b=>{let d=!1,e=()=>{d||(d=!0,b())};try{a.listening?a.close(e):e()}catch{e()}let f=setTimeout(()=>{try{a.forceCloseAll?.()}catch{}},c);f.unref?.();let g=setTimeout(e,c+2e3);g.unref?.()});try{a.forceCloseAll?.()}catch{}}function W(a){let b=e();return{...a,proxyAuthEnabled:!0===b.proxyAuthEnabled,proxyAuthUsers:[...b.proxyAuthUsers||[]],accessGrants:u(b.accessGrants)}}let X=null;function Y(){let a=x();if(0===a)return;let b=T();if(!b.server?.listening)return;let c=b.ipGate?.dropRevoked()||0;console.log(`[audit-proxy] session sweep: ${a} session(s) expired, ${c} connection(s) closed`)}async function Z(a=null){let b=T();if(b.server?.listening)return ag();let c=a?f({...W(a),enabled:!1}):e();await O(),await H(),I(),X||(X=setInterval(Y,3e4),X.unref?.()),L();let g=P({maxEntries:128});g.prewarm(c.allowedHosts);let h=d(c,{certificateProvider:g,onAuditJob:E});b.ipPolicy=t(c),b.ipGate=s(h,()=>T().ipPolicy);try{let a=await new Promise((a,b)=>{let d=a=>{h.removeListener("listening",e),b(a?.code==="EADDRNOTAVAIL"?Error(`Cannot bind ${c.bindHost}:${c.port} - that address does not exist on this machine. In Docker the container cannot bind the host's LAN IP: set the bind address to 0.0.0.0 and let the published port (-p 3128:3128) expose it on the host.`,{cause:a}):a?.code==="EACCES"?Error(`Cannot bind ${c.bindHost}:${c.port} - permission denied. Ports below 1024 need extra privileges; pick a high port such as 3128.`,{cause:a}):a)},e=()=>{h.removeListener("error",d),a(h.address())};h.once("error",d),h.once("listening",e),h.listen(c.port,c.bindHost)});return b.server=h,b.certificateProvider=g,b.startedAt=new Date().toISOString(),b.lastError=null,ae(),f({...c,enabled:!0}),{...await ag(),address:a}}catch(a){b.lastError=a.message||String(a);try{h.forceCloseAll?.()}catch{}try{h.close()}catch{}throw g.clear?.(),a}}async function $({persist:a=!0}={}){let b=T();ae();let c=b.server,d=e();if(b.server=null,b.startedAt=null,await V(c,d.shutdownGraceMs),b.certificateProvider?.clear?.(),b.certificateProvider=null,b.ipGate=null,!await K(3e3)){let a=N();console.warn(`[audit-proxy] audit queue did not drain within 3000ms; ${a.queueDepth} event(s) still queued`)}return M(),J(),X&&clearInterval(X),X=null,a&&f({...d,enabled:!1}),ag()}async function _(a=null){return await $({persist:!1}),a&&f({...W(a),enabled:!1}),Z()}function aa(a=null){return U(()=>Z(a))}let ab=new Set(["1","true","yes","on"]),ac=[2e3,5e3,15e3,3e4,6e4];function ad(a){return a?.code==="EADDRINUSE"||a?.cause?.code==="EADDRINUSE"}function ae(){let a=T();a.autostartRetryTimer&&(clearTimeout(a.autostartRetryTimer),a.autostartRetryTimer=null)}async function af(){let a,b=T();await am();let c=e(),d=null!=(a=process.env.AUDIT_PROXY_ENABLED)&&""!==a&&ab.has(String(a).trim().toLowerCase());return c.enabled||d?b.server?.listening?{started:!1,reason:"already-running",status:await ag()}:(d&&!c.enabled&&console.log("[audit-proxy] starting because AUDIT_PROXY_ENABLED is set, despite stored enabled=false"),b.autostartPromise||(b.autostartPromise=(async()=>{try{let a=await aa();return console.log(`[audit-proxy] autostarted on ${c.bindHost}:${c.port}`),{started:!0,status:a}}catch(c){b.lastError=c?.message||String(c),console.log("[audit-proxy] autostart failed:",b.lastError);let a=ad(c);return a&&function a(b){let c=T(),d=ac[b-1];d?c.autostartRetryTimer||(c.autostartRetryTimer=setTimeout(async()=>{if((c.autostartRetryTimer=null,!c.server?.listening)&&e().enabled)try{await aa(),console.log(`[audit-proxy] autostart succeeded on retry ${b}`)}catch(d){c.lastError=d?.message||String(d),console.log(`[audit-proxy] autostart retry ${b} failed:`,c.lastError),ad(d)&&a(b+1)}},d),c.autostartRetryTimer.unref?.()):console.warn(`[audit-proxy] autostart still failing after ${ac.length} retries; start it from the dashboard once the cause is cleared`)}(1),{started:!1,error:b.lastError,retrying:a}}finally{b.autostartPromise=null}})()),b.autostartPromise):{started:!1,reason:"disabled"}}async function ag(){let a=T(),b=e(),c=t(b),d=!!a.server?.listening,f=R();try{let a=Q();f={...f,validated:!0===a.exists,expiringSoon:!0===a.expiringSoon,autoRotation:!1}}catch(a){f={...f,validated:!1,autoRotation:!1,error:a.message||String(a)}}return{running:d,listening:d,startedAt:a.startedAt,lastError:a.lastError,address:d?a.server.address():null,pendingListenerRestart:d&&!function(a,b){if(!a)return!0;let c=String(b.bindHost||"").trim().toLowerCase(),d=r(a.address||""),e=r("localhost"===c?"127.0.0.1":c);return Number(a.port)===Number(b.port)&&d===e}(a.server.address(),b),activeConnections:d&&a.server.getActiveConnectionCount?.()||0,capabilities:d?a.server.auditCapabilities:{http1:!0,http2:!1,plainHttp:!1,publicConnectPorts:[443]},security:{clientIpFilterEnabled:c.enabled,clientIpFilterSource:c.source,enforcedClientIpCount:c.allowedClientIps.length,accessGrantCount:c.grants.length,sessionIdleTimeoutMs:b.sessionIdleTimeoutMs,activeSessionCount:c.sessions.length,clientToolFilterEnabled:!0===b.clientToolFilterEnabled,proxyAuthEnabled:!0===b.proxyAuthEnabled,proxyAuthFeatureEnabled:k,allowedClientToolCount:(b.allowedClientTools||[]).length,privateDestinationsBlocked:!0,plainHttpBlocked:!0,upstreamTlsVerified:!0},activeSessions:c.sessions.map(a=>({ip:a.ip,userId:a.userId,displayName:a.displayName,activatedAt:new Date(a.activatedAt).toISOString(),expiresAt:new Date(a.expiresAt).toISOString()})),certificateCache:a.certificateProvider?.stats?.()||{entries:0},auditStore:N(),configPath:h,auditLogPath:i,auditLogDirectory:j,rootCA:f}}async function ah(a=50,{includeEvents:b=!0}={}){let c=e(),[d,f]=await Promise.all([ag(),b?F(a):[]]);return{config:ai(c),status:d,events:f}}function ai(a){return a?{...a,proxyAuthUsers:o(a.proxyAuthUsers)}:a}async function aj(){return Promise.resolve().then(c.bind(c,89718))}async function ak(){try{let{isClusterStandby:a}=await c.e(2763).then(c.bind(c,62763));return await a()===!0}catch{return!1}}async function al(a){try{if(await ak())return{mirrored:!1,reason:"standby"};let{getSettings:b,updateSettings:c}=await aj(),d=B(a),e=await b();if(JSON.stringify(e?.[A]||null)===JSON.stringify(d))return{mirrored:!1,reason:"unchanged"};return await c({[A]:d}),{mirrored:!0}}catch(a){return console.warn("[audit-proxy] failed to mirror policy to settings:",a?.message||a),{mirrored:!1,error:a?.message||String(a)}}}async function am({force:a=!1}={}){try{if(!a&&!await ak())return{applied:!1,reason:"not-standby"};let{getSettings:b}=await aj(),c=await b(),d=c?.[A];if(!d||"object"!=typeof d)return{applied:!1,reason:"no-policy"};let f=e();if(D(f,d))return{applied:!1,reason:"unchanged"};let g=C(f,d),h=await an(g,{mirror:!1});return console.log("[audit-proxy] applied cluster policy from snapshot"),{applied:!0,restarted:!0===h.restarted,droppedConnections:h.droppedConnections||0}}catch(a){return console.warn("[audit-proxy] failed to apply cluster policy:",a?.message||a),{applied:!1,error:a?.message||String(a)}}}function an(a,{mirror:b=!0}={}){return U(async()=>{let c=T(),d=!!c.server?.listening,e=f({...g(a),enabled:d});c.ipPolicy=t(e);let h=!1,i={},j=0;if(d){let a=c.server.applyConfig?.(e)||{};h=!0===a.rebindRequired,i=a.pending||{},j=c.ipGate?.dropRevoked()||0;try{c.certificateProvider?.prewarm?.(e.allowedHosts)}catch{}}return b&&await al(e),{config:ai(e),status:await ag(),restarted:!1,appliedInstantly:!0,rebindRequired:h,pendingListener:i,droppedConnections:j}})}a.exports={startProxy:aa,ensureAuditProxyAutostart:af,stopProxy:function(a={}){return U(()=>$(a))},restartProxy:function(a=null){return U(()=>_(a))},getStatus:ag,getSnapshot:ah,readRecentAuditEvents:F,updateConfig:function(a){return an(W(a))},updateClientProxyHost:function(a){return an({...e(),clientProxyHost:String(a||"").trim()})},updateProxyAuth:async function a({enabled:b,users:c}={}){if(!0===b&&!k)throw Error("Proxy authentication is turned off in this deployment (PROXY_AUTH_FEATURE_ENABLED in audit-gateway/config.js)");let d=e(),f=new Map(n(d.proxyAuthUsers).map(a=>[a.username.toLowerCase(),a])),g=new Set,h=[];for(let a of Array.isArray(c)?c:[]){let b=String(a?.username||"").trim();if(!m(b))throw Error(`Invalid username: ${b||"(empty)"}`);let c=b.toLowerCase();if(g.has(c))throw Error(`Duplicate username: ${b}`);g.add(c);let d="string"==typeof a?.password?a.password:"";if(d){let a=Buffer.byteLength(d,"utf8");if(a<q)throw Error(`Password for ${b} must be at least ${q} characters`);if(a>p)throw Error(`Password for ${b} must be at most ${p} bytes`);h.push({username:b,passwordHash:await l(d)});continue}let e=f.get(c);if(!e)throw Error(`Account ${b} requires a password`);h.push({username:b,passwordHash:e.passwordHash})}return an({...d,proxyAuthEnabled:!0===b,proxyAuthUsers:h})},listAccessGrants:function(){return u(e().accessGrants)},applyAuditPolicyFromSettings:am,upsertAccessGrant:function({userId:a,note:b}={}){let c=v(a);if(!c)throw Error("Grant requires a dashboard username or email");let d=e(),f=u(d.accessGrants).filter(a=>a.userId!==c);return f.push({userId:c,note:b}),an({...d,accessGrants:f})},deleteAccessGrant:function(a){let b=v(a);if(!b)throw Error("Grant requires a dashboard username or email");let c=e(),d=u(c.accessGrants).filter(a=>a.userId!==b);return z(b),an({...c,accessGrants:d})},getOwnProxySession:function(a){return w(a)},revokeSession:function({ip:a,userId:b}={}){let c=a?+!!y(a):z(b);if(0===c)return{removed:0,droppedConnections:0};let d=T();return d.server?.listening?{removed:c,droppedConnections:d.ipGate?.dropRevoked()||0}:{removed:c,droppedConnections:0}},clearAudit:G,runSelfTest:S}},78864:(a,b,c)=>{let d=c(14985).promises,e=c(91645),{normalizeIp:f,clientIpMatches:g}=c(5565),h=new Map,i=Object.freeze(["0.0.0.0/8","10.0.0.0/8","100.64.0.0/10","127.0.0.0/8","169.254.0.0/16","172.16.0.0/12","192.0.0.0/24","192.0.2.0/24","192.88.99.0/24","192.168.0.0/16","198.18.0.0/15","198.51.100.0/24","203.0.113.0/24","224.0.0.0/4","240.0.0.0/4","::/96","::1/128","100::/64","2001:2::/48","2001:db8::/32","fc00::/7","fe80::/10","ff00::/8"]),j=Object.freeze([".localhost",".local",".internal",".lan",".home.arpa"]);function k(a){return String(a||"").trim().replace(/^\[|\]$/g,"").replace(/\.$/,"").toLowerCase()}function l(a){let b=k(a);return!(!(!b||"localhost"===b||j.some(a=>b.endsWith(a)))&&(e.isIP(b)||b.includes(".")))}function m(a){let b=f(a);return!!e.isIP(b)&&!g(b,i)}function n(a){let b=[...new Set((Array.isArray(a)?a:[a]).map(a=>Number(a)).filter(a=>Number.isInteger(a)&&a>=1&&a<=65535))];return b.length?b:[443]}function o(a){let b=[...a?.addresses||[]];return function(c,d,e){let f=d,g=e;"function"==typeof d&&(g=d,f={});let h="number"==typeof f?f:Number(f?.family||0);if("object"==typeof f&&f?.all===!0){let c=4===h||6===h?b.filter(a=>a.family===h):b;if(!c.length){let b=Error(`No validated public address for ${a.host}`);b.code="ENOTFOUND",g(b);return}g(null,c.map(({address:a,family:b})=>({address:a,family:b})));return}let i=function(a,b=0){let c=Number(b||0);return 4===c||6===c?a.find(a=>a.family===c)||null:a.find(a=>4===a.family)||a[0]||null}(b,h);if(!i){let b=Error(`No validated public address for ${a.host}`);b.code="ENOTFOUND",g(b);return}g(null,i.address,i.family)}}async function p(a,b,c={}){let g=k(a),i=Number(b||443),j=n(c.allowedPorts||[443]);if(!g)throw Error("Destination host is empty");if(!Number.isInteger(i)||!j.includes(i))throw Error(`CONNECT destination port ${i||"unknown"} is not allowed`);if(l(g))throw Error(`Private or local destination hostname is not allowed: ${g}`);let q=e.isIP(f(g));if(q){let a=f(g);if(!m(a))throw Error(`Private or reserved destination address is not allowed: ${a}`);let b={host:g,port:i,addresses:[{address:a,family:q}]};return{...b,lookup:o(b)}}let r=Date.now(),s=h.get(g);if(!s||s.expiresAt<=r){let a=await d.lookup(g,{all:!0,verbatim:!0}),b=[],c=new Set;for(let d of a||[]){let a=f(d.address),g=e.isIP(a);if(!g||!m(a))continue;let h=`${g}:${a}`;c.has(h)||(c.add(h),b.push({address:a,family:g}))}if(!b.length)throw Error(`Destination did not resolve to a public address: ${g}`);s={addresses:b,expiresAt:r+6e4},h.set(g,s)}let t={host:g,port:i,addresses:[...s.addresses]};return{...t,lookup:o(t)}}a.exports={BLOCKED_ADDRESS_RANGES:i,normalizeTargetHost:k,normalizeAllowedPorts:n,isBlockedHostname:l,isPublicAddress:m,createPinnedLookup:o,resolvePublicTarget:p,clearDnsPolicyCache:function(){h.clear()}}},85252:(a,b,c)=>{let d=c(81630),e=c(73496),f=c(91645),g=c(34631),h=c(74075),i=c(55511),j=c(15296),{createAuditProxy:k,CaptureBuffer:l}=c(45372),{containsLikelySecret:m}=c(48350),{clientIpMatches:n,normalizeAllowedClientIps:o}=c(5565),{normalizeAllowedTools:p,clientToolMatches:q,shouldRefuseClientTool:r}=c(98586),{createProxyAuthenticator:s,createProxyAuthLimiter:t,hashProxyPassword:u,parseBasicProxyAuthorization:v}=c(7566),{isPublicAddress:w}=c(78864),{validateConfig:x,PROXY_AUTH_FEATURE_ENABLED:y}=c(43096),{normalizeAccessGrants:z,effectiveClientIpPolicy:A,attachClientIpGate:B,findAccessGrant:C}=c(77407),{activateProxySession:D,touchProxySession:E,getProxySession:F,revokeProxySession:G,clearAllProxySessions:H}=c(68257),{promptLogMirrorDecision:I}=c(90173);function J(a){return i.createHash("sha256").update(a).digest("hex")}function K(a){let b=j.pki.rsa.generateKeyPair(2048),c=j.pki.createCertificate();c.publicKey=b.publicKey,c.serialNumber=String(Date.now()),c.validity.notBefore=new Date(Date.now()-6e4),c.validity.notAfter=new Date(Date.now()+864e5);let d=[{name:"commonName",value:a}];return c.setSubject(d),c.setIssuer(d),c.setExtensions([{name:"basicConstraints",cA:!0,critical:!0},{name:"keyUsage",keyCertSign:!0,cRLSign:!0,critical:!0}]),c.sign(b.privateKey,j.md.sha256.create()),{cert:c,keys:b,certPem:j.pki.certificateToPem(c)}}function L(a,b){let c=j.pki.rsa.generateKeyPair(2048),d=j.pki.createCertificate();return d.publicKey=c.publicKey,d.serialNumber=`${Date.now()}${Math.floor(1e3*Math.random())}`,d.validity.notBefore=new Date(Date.now()-6e4),d.validity.notAfter=new Date(Date.now()+864e5),d.setSubject([{name:"commonName",value:b}]),d.setIssuer(a.cert.subject.attributes),d.setExtensions([{name:"basicConstraints",cA:!1},{name:"keyUsage",digitalSignature:!0,keyEncipherment:!0},{name:"extKeyUsage",serverAuth:!0},{name:"subjectAltName",altNames:[{type:2,value:b}]}]),d.sign(a.keys.privateKey,j.md.sha256.create()),{cert:j.pki.certificateToPem(d),key:j.pki.privateKeyToPem(c.privateKey)}}function M(a,b="127.0.0.1"){return new Promise((c,d)=>{a.once("error",d),a.listen(0,b,()=>{a.removeListener("error",d),c(a.address())})})}function N(a){return new Promise(b=>{if(!a)return b();try{a.forceCloseAll?.()}catch{}if(!a.listening)return b();a.close(()=>b()),setTimeout(b,1e3).unref?.()})}function O(a,b){let c="127.0.0.1";return Promise.resolve({host:a,port:b,addresses:[{address:c,family:4}],lookup:(a,b,d)=>{let e=b,f=d;"function"==typeof b&&(f=b,e={}),e?.all?f(null,[{address:c,family:4}]):f(null,c,4)}})}function P(a,b,c="",d=""){return new Promise((e,g)=>{let h=f.connect(a,"127.0.0.1"),i=Buffer.alloc(0),j=setTimeout(()=>g(Error("CONNECT timeout")),7e3);h.once("error",g),h.once("connect",()=>{let a=c?`User-Agent: ${c}\r
+${e}`)}catch{try{a.destroy()}catch{}}}function R(a={}){let b={};for(let[c,d]of Object.entries(a||{}))b[c]=d;return b}async function S(a){let b=await a.requestCapture.finish(String(a.requestHeaders["content-type"]||""),String(a.requestHeaders["content-encoding"]||"")),c=String(a.responseHeaders?.["content-type"]||""),d=await a.responseCapture.finish(c,String(a.responseHeaders?.["content-encoding"]||"")),e=M(a.target.host),f=n(a.path),g=p({provider:e,body:d.body,contentType:c,path:f}),h=O(b.body)||g?.model||null;return{id:i.randomUUID(),timestamp:new Date().toISOString(),protocol:a.protocol||"http/1.1",client:{ip:a.clientIp||"",port:a.clientPort||null,userAgent:String(a.requestHeaders["user-agent"]||""),proxyUser:a.authUser||null,dashboardUser:a.dashboardUser||null},provider:e,host:F(a.target.host),port:a.target.port,method:a.method,path:f,model:h,usage:g,status:a.statusCode||null,durationMs:Date.now()-a.startedAt,error:a.error?o(a.error.message||a.error):null,denied:!0===a.denied,request:{headers:l(a.requestHeaders),...b},response:{headers:l(a.responseHeaders||{}),...d}}}a.exports={createAuditProxy:function(a={},b={}){let i={allowedHosts:[],passthroughUnknown:!0,captureBodies:!0,captureLimitBytes:2097152,verifyUpstreamTls:!0,allowedConnectPorts:[443],connectTimeoutMs:1e4,tlsHandshakeTimeoutMs:1e4,responseHeaderTimeoutMs:3e4,idleTimeoutMs:9e5,allowPlainHttp:!1,clientToolFilterEnabled:!1,allowedClientTools:[],proxyAuthEnabled:!1,proxyAuthUsers:[],clientAlpnProtocols:["http/1.1"],...a};if(!0!==i.verifyUpstreamTls)throw Error("Upstream TLS verification is mandatory in Audit Proxy mode");let j=b.certificateProvider;if("function"!=typeof j)throw Error("certificateProvider is required");let k="function"==typeof b.onAudit?b.onAudit:()=>{},l="function"==typeof b.onAuditJob?b.onAuditJob:null,m="function"==typeof b.resolveTarget?b.resolveTarget:(a,b)=>q(a,b,{allowedPorts:i.allowedConnectPorts}),n=b.upstreamCa,o=r(i.allowedClientTools),p=i.proxyAuthEnabled?x(i.proxyAuthUsers):null,z=i.proxyAuthEnabled?y():null,A=new Set,B=new Map,C=new WeakMap,D=new Set;function E(a){return!a||A.has(a)||(A.add(a),a.once?.("close",()=>A.delete(a))),a}function F(a,b){try{"function"==typeof a.destroy?a.destroy(b):"function"==typeof a.close&&a.close()}catch{}}function K(a){let b=()=>S(a);if(l){try{l(b)}catch(a){console.warn("[audit-proxy] audit enqueue failed:",a?.message||a)}return}setImmediate(()=>{Promise.resolve().then(b).then(k).catch(a=>console.warn("[audit-proxy] audit callback failed:",a?.message||a))})}function M({requestHeaders:a,method:b,path:c,target:d,requestCapture:e,responseCapture:f,responseHeaders:g,statusCode:h,startedAt:i,error:j,socket:k,protocol:l,authUser:m=null,denied:n=!1}){return{requestHeaders:R(a),method:b,path:c,target:d,requestCapture:e,responseCapture:f,responseHeaders:R(g),statusCode:h,startedAt:i,error:j,clientIp:P(k),clientPort:k?.remotePort||null,authUser:m,dashboardUser:k?.__auditDashboardUser||null,protocol:l,denied:n}}let O="This proxy does not support WebSocket connections. Use the HTTP streaming transport instead - most clients fall back to it automatically.";function T(a,b,c,d,{statusCode:e=403,authUser:f=null}={}){let g=String(a.url||""),h=c||{host:g.includes(":")?g.slice(0,g.lastIndexOf(":")):g||"unknown",port:443},j=new L(i.captureBodies?i.captureLimitBytes:0);j.add(Buffer.from(d)),K(M({requestHeaders:a.headers,method:"CONNECT",path:"",target:h,requestCapture:new L(0),responseCapture:j,responseHeaders:{"content-type":"text/plain; charset=utf-8",connection:"close"},statusCode:e,startedAt:Date.now(),error:d,socket:b,protocol:"http/1.1",authUser:f,denied:!0}))}let U=Symbol("refused");async function V(a,b){if(!p)return null;let d=P(b),e=(c,d=null)=>(Q(b,"407 Proxy Authentication Required",c,['Proxy-Authenticate: Basic realm="BlueRouter Audit Proxy", charset="UTF-8"']),T(a,b,void 0,c,{statusCode:407,authUser:d}),U);if(z.isLocked(d))return e("Too many failed proxy authentication attempts");let f=a.headers["proxy-authorization"],g=await p.authenticate(f);if(g.ok)return z.recordSuccess(d),g.username;let h=null;if(f){let{lockedNow:a}=z.recordFailure(d);a&&console.log(`[audit-proxy] proxy auth lockout for ${d||"unknown"}`);try{h=c(7566).parseBasicProxyAuthorization(f)?.username||null}catch{h=null}}return e(g.reason||"Proxy authentication required",h)}function W(a,b,c){if(!c)return;let d=new L(i.captureBodies?i.captureLimitBytes:0);d.add(Buffer.from(O)),K(M({requestHeaders:a.headers,method:a.method,path:a.url,target:c,requestCapture:new L(0),responseCapture:d,responseHeaders:{"content-type":"text/plain; charset=utf-8",connection:"close"},statusCode:501,startedAt:Date.now(),error:null,socket:b,protocol:"http/1.1",authUser:b?.__auditProxyUser||null,denied:!0}))}async function X(a,b,{expectContinue:c=!1}={}){let d=a.socket.__auditTarget,e=a.socket.__auditProxyUser||null;if(!d){b.writeHead(502,{"content-type":"text/plain"}),b.end("Audit target is missing");return}if(function(a={}){return"string"==typeof a.upgrade&&""!==a.upgrade.trim()}(a.headers)){b.writeHead(501,{"content-type":"text/plain; charset=utf-8",connection:"close"}),b.end(O),W(a,a.socket,d);return}let h=Date.now(),j=new L(i.captureBodies?i.captureLimitBytes:0),k=new L(i.captureBodies?i.captureLimitBytes:0),l=i.dlpEnabled?u(i,{groups:a.socket.__auditDlpGroups||[],host:d.host,userAgent:a.headers["user-agent"],method:a.method,path:a.url}):null,o=I(a.headers,{stripInternal:!0});o.host=443===d.port?d.host:`${d.host}:${d.port}`;let p=null,q=null,r={},s=null,t=!1,x=!1,y=null,z=!1,A=(b=null,{denied:c=!1,statusOverride:f=null}={})=>{t||(t=!0,y&&clearTimeout(y),K(M({requestHeaders:a.headers,method:a.method,path:a.url,target:d,requestCapture:j,responseCapture:k,responseHeaders:r,statusCode:f??s,startedAt:h,error:b,socket:a.socket,protocol:"http/1.1",authUser:e,denied:c})))},C=(c,e)=>{if(z||x)return;z=!0;let f=e?`${c}: ${e}`:c;k.add(Buffer.from(f)),b.headersSent?b.destroyed||b.destroy(Error(f)):N(b,d.host,f),x=!0,F(p,Error(f)),a.destroy(),A(null,{denied:!0,statusOverride:403})};if(l?.action==="deny"){let a=`Blocked by content policy "${l.reason}"`;k.add(Buffer.from(a)),N(b,d.host,a),x=!0,A(null,{denied:!0,statusOverride:403});return}let D=!!l&&w(l,a.method,a.headers);try{let e,h,t=await m(d.host,d.port);(p=f.request({hostname:d.host,port:d.port,method:a.method,path:a.url,headers:o,rejectUnauthorized:!0,servername:g.isIP(d.host)?void 0:d.host,ca:n,ALPNProtocols:["http/1.1"],lookup:t.lookup,autoSelectFamily:!0,agent:(e=`${d.host}:${d.port}`,(h=B.get(e))||(h=new f.Agent({keepAlive:!0,maxSockets:32,maxFreeSockets:8,timeout:i.idleTimeoutMs}),B.set(e,h)),h)})).on("socket",a=>{if(E(a),a.setNoDelay(!0),a.setKeepAlive(!0,3e4),a.setTimeout(i.idleTimeoutMs,()=>a.destroy(Error("Upstream idle timeout"))),a.connecting){let b=setTimeout(()=>a.destroy(Error("Upstream TLS connect timeout")),i.connectTimeoutMs+i.tlsHandshakeTimeoutMs);b.unref?.();let c=()=>clearTimeout(b);a.once("secureConnect",c),a.once("error",c),a.once("close",c)}}),p.on("continue",()=>{c&&!b.headersSent&&b.writeContinue()}),p.on("information",a=>{102===a.statusCode&&"function"==typeof b.writeProcessing&&b.writeProcessing(),103===a.statusCode&&"function"==typeof b.writeEarlyHints&&b.writeEarlyHints(a.headers||{})}),p.on("response",a=>{q=a,y&&clearTimeout(y),s=a.statusCode||502,r=R(a.headers||{});let c=I(a.headers,{stripInternal:!1});b.writeHead(s,c),b.flushHeaders?.(),a.on("data",c=>{k.add(c),b.write(c)||a.pause()}),b.on("drain",()=>a.resume()),a.on("aborted",()=>{let a=Error("Upstream response aborted");b.destroyed||b.destroy(a),A(a)}),a.on("error",a=>{b.destroyed||b.destroy(a),A(a)}),a.on("end",()=>{if(a.trailers&&Object.keys(a.trailers).length)try{b.addTrailers(I(a.trailers,{stripInternal:!1}))}catch{}x=!0,b.end(),A(null)})}),p.on("error",a=>{z||(b.headersSent?b.destroyed||b.destroy(a):(b.writeHead(502,{"content-type":"application/json"}),b.end(JSON.stringify({error:"Verified upstream TLS request failed"})),x=!0),A(a))});let u=()=>{if(a.trailers&&Object.keys(a.trailers).length)try{p.addTrailers(I(a.trailers,{stripInternal:!0}))}catch{}p.end(),y=setTimeout(()=>p.destroy(Error("Upstream response header timeout")),i.responseHeaderTimeoutMs),y.unref?.()};if(D){let b=[],c=0,d=!1;a.on("data",a=>{if(j.add(a),!d&&!z){if((c+=a.length)>i.dlpMaxInspectBytes){d=!0,b.length=0;return}b.push(a)}}),a.on("end",async()=>{try{if(z)return;if(d){if("allow"!==i.dlpOversizeAction)return void C("Request is too large to inspect and your content policy blocks uninspected uploads",`over ${i.dlpMaxInspectBytes} bytes`);u();return}let c=Buffer.concat(b),e=null;try{let b=a.headers["content-encoding"],d=b?(await J(c,b,8*i.dlpMaxInspectBytes)).buffer:c;e=v(JSON.parse(d.toString("utf8")),l.profile)}catch{e=null}if(!e||e.budgetExceeded){if("allow"!==i.dlpOversizeAction)return void C("Request could not be inspected and your content policy blocks uninspected uploads",e?.budgetExceeded?"too complex to inspect":"unreadable body")}else if(e.violations.length){let a=e.violations[0],b=e.violations.length>1?` (+${e.violations.length-1} more)`:"";C(`Blocked by content policy "${l.reason}"`,`${a.message}${b}`);return}c.length&&p.write(c),u()}catch(a){C("Content inspection failed",a?.message||String(a))}})}else a.on("data",b=>{j.add(b),p.write(b)||a.pause()}),p.on("drain",()=>a.resume()),a.on("end",u);a.on("aborted",()=>p.destroy(Error("Client request aborted"))),a.on("error",a=>p.destroy(a)),b.on("close",()=>{x||z||(q?.destroy(Error("Client response closed")),p?.destroy(Error("Client response closed")),A(Error("Client response closed")))})}catch(a){b.headersSent||(b.writeHead(502,{"content-type":"application/json"}),b.end(JSON.stringify({error:"Destination validation or connection failed"})),x=!0),A(a)}}let Y=d.createServer((a,b)=>{X(a,b)});async function Z(a){return a.upstreamPromise||(a.upstreamPromise=(async()=>{let b=a.target,c=await m(b.host,b.port),d=E(h.connect({host:b.host,port:b.port,servername:g.isIP(b.host)?void 0:b.host,rejectUnauthorized:!0,ca:n,ALPNProtocols:["h2"],lookup:c.lookup,autoSelectFamily:!0}));d.setNoDelay(!0),d.setKeepAlive(!0,3e4);let f=setTimeout(()=>d.destroy(Error("Upstream HTTP/2 TLS connect timeout")),i.connectTimeoutMs+i.tlsHandshakeTimeoutMs);f.unref?.(),d.once("secureConnect",()=>{clearTimeout(f),"h2"!==d.alpnProtocol&&d.destroy(Error("Upstream did not negotiate HTTP/2"))}),d.once("error",()=>clearTimeout(f)),d.once("close",()=>clearTimeout(f));let j=`https://${b.host}${443===b.port?"":`:${b.port}`}`,k=e.connect(j,{createConnection:()=>d,settings:{enablePush:!1}});return D.add(k),k.setTimeout(i.idleTimeoutMs,()=>k.destroy(Error("Upstream HTTP/2 idle timeout"))),k.once("close",()=>D.delete(k)),await new Promise((a,b)=>{let c=setTimeout(()=>b(Error("Upstream HTTP/2 session timeout")),i.connectTimeoutMs+i.tlsHandshakeTimeoutMs);c.unref?.();let d=(a,b)=>{clearTimeout(c),k.removeListener("connect",e),k.removeListener("error",f),a(b)},e=()=>d(a,k),f=a=>d(b,a);k.once("connect",e),k.once("error",f)}),k})().catch(b=>{throw a.upstreamPromise=null,b})),a.upstreamPromise}async function $(a,b){let c=C.get(a.session),d=c?.target;if(!c||!d){a.respond({":status":502,"content-type":"text/plain"}),a.end("Audit target is missing");return}a.pause();let f=Date.now(),g=new L(i.captureBodies?i.captureLimitBytes:0),h=new L(i.captureBodies?i.captureLimitBytes:0),j={},k=null,l=!1,m=!1,n=null,o=null,p=null,q=(e=null)=>{l||(l=!0,K(M({requestHeaders:b,method:b[":method"]||"GET",path:b[":path"]||"/",target:d,requestCapture:g,responseCapture:h,responseHeaders:j,statusCode:k,startedAt:f,error:e,socket:a.session.socket,protocol:"h2",authUser:c.authUser||null})))};try{(n=(await Z(c)).request(function(a,b){let c=I(a,{stripInternal:!0}),d={":method":a[":method"]||"GET",":path":a[":path"]||"/",":scheme":"https",":authority":443===b.port?b.host:`${b.host}:${b.port}`};for(let[a,b]of Object.entries(c))a.startsWith(":")||(d[a.toLowerCase()]=b);return d}(b,d),{endStream:!1,waitForTrailers:!0})).setTimeout(i.idleTimeoutMs,()=>n.close(e.constants.NGHTTP2_CANCEL)),a.setTimeout(i.idleTimeoutMs,()=>a.close(e.constants.NGHTTP2_CANCEL)),n.on("response",b=>{j=R(b),k=Number(b[":status"]||502),a.respond(function(a){let b=I(a,{stripInternal:!1}),c={":status":Number(a[":status"]||502)};for(let[a,d]of Object.entries(b))a.startsWith(":")||(c[a.toLowerCase()]=d);return c}(b),{waitForTrailers:!0})}),n.on("trailers",a=>{p=I(a,{stripInternal:!1})}),a.on("wantTrailers",()=>{try{a.sendTrailers(p||{})}catch{}}),a.on("trailers",a=>{o=I(a,{stripInternal:!0})}),n.on("wantTrailers",()=>{try{n.sendTrailers(o||{})}catch{}}),a.on("data",b=>{g.add(b),n.write(b)||a.pause()}),n.on("drain",()=>a.resume()),a.on("end",()=>n.end()),n.on("data",b=>{h.add(b),a.write(b)||n.pause()}),a.on("drain",()=>n.resume()),n.on("end",()=>{m=!0,a.end(),q(null)}),n.on("aborted",()=>{let b=Error("Upstream HTTP/2 stream aborted");a.close(e.constants.NGHTTP2_INTERNAL_ERROR),q(b)}),n.on("error",b=>{a.closed||a.close(e.constants.NGHTTP2_INTERNAL_ERROR),q(b)}),a.on("aborted",()=>{n.close(e.constants.NGHTTP2_CANCEL),q(Error("Client HTTP/2 stream aborted"))}),a.on("error",a=>{n.close(e.constants.NGHTTP2_CANCEL),q(a)}),a.on("close",()=>{m||!n||n.closed||(n.close(e.constants.NGHTTP2_CANCEL),q(Error("Client HTTP/2 stream closed")))}),a.resume()}catch(b){a.headersSent||a.closed||a.respond({":status":502,"content-type":"application/json"}),a.closed||a.end(JSON.stringify({error:"Verified upstream HTTP/2 request failed"})),q(b)}}Y.on("checkContinue",(a,b)=>{X(a,b,{expectContinue:!0})}),Y.on("upgrade",(a,b)=>{Q(b,"501 Not Implemented",O),W(a,b,b.__auditTarget)}),Y.on("clientError",(a,b)=>F(b)),Y.headersTimeout=i.responseHeaderTimeoutMs,Y.requestTimeout=0,Y.keepAliveTimeout=i.idleTimeoutMs;let _=e.createServer({settings:{enablePush:!1}});_.on("session",a=>{let b={target:a.socket.__auditTarget,authUser:a.socket.__auditProxyUser||null,upstreamPromise:null};C.set(a,b),a.setTimeout(i.idleTimeoutMs,()=>a.destroy(Error("Client HTTP/2 idle timeout"))),a.once("close",()=>{Promise.resolve(b.upstreamPromise).then(a=>a?.close()).catch(()=>{})})}),_.on("stream",(a,b)=>{$(a,b)}),_.on("sessionError",a=>{console.warn("[audit-proxy] HTTP/2 client session error:",a?.message||a)});let aa=d.createServer((a,b)=>{b.writeHead(403,{"content-type":"text/plain; charset=utf-8",connection:"close"}),b.end("Audit Proxy accepts HTTPS CONNECT traffic only")});function ab(){o=r(i.allowedClientTools),p=i.proxyAuthEnabled?x(i.proxyAuthUsers):null,z=i.proxyAuthEnabled?y():null,aa.headersTimeout=i.responseHeaderTimeoutMs,aa.keepAliveTimeout=i.idleTimeoutMs,Y.headersTimeout=i.responseHeaderTimeoutMs,Y.keepAliveTimeout=i.idleTimeoutMs,aa.auditCapabilities={http1:!0,http2:i.clientAlpnProtocols.includes("h2"),proxyAuth:!0===i.proxyAuthEnabled,plainHttp:!1,publicConnectPorts:[...i.allowedConnectPorts]}}return aa.on("connect",(a,b,c)=>{(async()=>{let d,e;try{d=G(a.url,443)}catch(e){let c=e.message||"Invalid CONNECT authority";Q(b,"400 Bad Request",c),T(a,b,d,c,{statusCode:400});return}let f=await V(a,b);if(f===U)return;try{await m(d.host,d.port)}catch(e){let c=e.message||"Destination is not allowed";Q(b,"403 Forbidden",c),T(a,b,d,c,{authUser:f});return}if(i.clientToolFilterEnabled&&s(a.headers["user-agent"],o)){let c=`Client tool is not allowed to use this proxy (${t(a.headers["user-agent"])})`;Q(b,"403 Forbidden",c),T(a,b,d,c);return}if(!H(d.host,i.allowedHosts)){if(!i.passthroughUnknown){let c="Host is not in the audit allowlist";Q(b,"403 Forbidden",c),T(a,b,d,c);return}let e=!1;try{let a=await m(d.host,d.port),f=E(g.connect({host:d.host,port:d.port,lookup:a.lookup,autoSelectFamily:!0})),h=setTimeout(()=>f.destroy(Error("TCP passthrough connect timeout")),i.connectTimeoutMs);h.unref?.(),f.setNoDelay(!0),f.setKeepAlive(!0,3e4),f.setTimeout(i.idleTimeoutMs,()=>f.destroy(Error("TCP passthrough idle timeout"))),f.once("connect",()=>{clearTimeout(h),e=!0,b.write("HTTP/1.1 200 Connection Established\r\nProxy-Agent: BlueRouter-Audit\r\n\r\n"),c?.length&&f.write(c),f.pipe(b),b.pipe(f)}),f.once("error",()=>{clearTimeout(h),e?F(b):Q(b,"502 Bad Gateway","TCP passthrough failed")}),b.once("error",()=>F(f)),b.once("close",()=>F(f))}catch(a){Q(b,"502 Bad Gateway",a.message||"TCP passthrough failed")}return}try{if(e=j(d.host),!e?.key||!e?.cert)throw Error("Certificate provider returned no certificate")}catch(a){Q(b,"500 Internal Server Error",`Cannot issue audit certificate: ${a.message}`);return}b.write("HTTP/1.1 200 Connection Established\r\nProxy-Agent: BlueRouter-Audit\r\n\r\n"),c?.length&&b.unshift(c);let k=E(new h.TLSSocket(b,{isServer:!0,key:e.key,cert:e.cert,ALPNProtocols:i.clientAlpnProtocols}));k.__auditTarget=d,k.__auditProxyUser=f,k.__auditDlpGroups=b.__auditDlpGroups||[],k.__auditDashboardUser=b.__auditDashboardUser||null,k.setNoDelay(!0),k.setKeepAlive(!0,3e4),k.setTimeout(i.idleTimeoutMs,()=>k.destroy(Error("Client TLS idle timeout")));let l=setTimeout(()=>k.destroy(Error("Client TLS handshake timeout")),i.tlsHandshakeTimeoutMs);l.unref?.();let n=!1,p=()=>{n||(n=!0,clearTimeout(l),"h2"===k.alpnProtocol?_.emit("connection",k):Y.emit("connection",k))};k.once("secure",p),k.once("secureConnect",p),k.once("error",()=>{clearTimeout(l),F(k)}),k.once("close",()=>clearTimeout(l))})().catch(a=>Q(b,"500 Internal Server Error",a.message||"Audit CONNECT failed"))}),aa.prependListener("connection",a=>{E(a),a.setNoDelay(!0),a.setKeepAlive(!0,3e4)}),aa.on("upgrade",(a,b)=>Q(b,"501 Not Implemented",O)),aa.on("clientError",(a,b)=>F(b)),aa.headersTimeout=i.responseHeaderTimeoutMs,aa.requestTimeout=0,aa.keepAliveTimeout=i.idleTimeoutMs,aa.forceCloseAll=()=>{for(let a of D)try{a.destroy()}catch{}for(let a of B.values())try{a.destroy()}catch{}for(let a of[...A])F(a)},aa.getActiveConnectionCount=()=>A.size,aa.auditConfig=i,ab(),aa.applyConfig=(a={})=>{let b={};for(let[c,d]of(a.bindHost&&String(a.bindHost)!==String(i.bindHost)&&(b.bindHost=String(a.bindHost)),Number(a.port)&&Number(a.port)!==Number(i.port)&&(b.port=Number(a.port)),Object.entries(a)))"bindHost"!==c&&"port"!==c&&(["verifyUpstreamTls","allowPlainHttp","allowedConnectPorts","clientAlpnProtocols"].includes(c)||(i[c]=d));return ab(),{rebindRequired:Object.keys(b).length>0,pending:b}},aa},hostMatches:H,parseAuthority:G,stripHopByHop:I,CaptureBuffer:L,detectProvider:M,extractModel:O,decodeCapturedBuffer:J}},49083:(a,b,c)=>{let{createAuditProxy:d}=c(45372),{loadConfig:e,saveConfig:f,validateConfig:g,CONFIG_PATH:h,AUDIT_LOG_PATH:i,AUDIT_LOG_DIR:j,PROXY_AUTH_FEATURE_ENABLED:k}=c(43096),{hashProxyPassword:l,isValidUsername:m,normalizeProxyUsers:n,redactProxyAuthUsers:o,PASSWORD_MAX_BYTES:p,PASSWORD_MIN_BYTES:q}=c(7566),{normalizeIp:r}=c(5565),{attachClientIpGate:s,effectiveClientIpPolicy:t,normalizeAccessGrants:u,normalizeGrantUserId:v}=c(77407),{getProxySession:w,pruneExpiredProxySessions:x,revokeProxySession:y,revokeProxySessionsForUser:z}=c(68257),{SETTINGS_KEY:A,extractAuditPolicy:B,mergeAuditPolicy:C,policyEquals:D}=c(85463),{enqueueAuditJob:E,readRecent:F,clearAudit:G,pruneExpired:H,startAuditMaintenance:I,stopAuditMaintenance:J,flushAuditQueue:K,registerAuditShutdownFlush:L,unregisterAuditShutdownFlush:M,getAuditStoreStats:N}=c(90173),{ensureAuditRootCA:O,createAuditCertificateProvider:P,getStatusRootCaValidation:Q}=c(85074),{readRootCAInfo:R}=c(2466),{runSelfTest:S}=c(85252);function T(){return globalThis.__blueRouterAuditProxyRuntime||(globalThis.__blueRouterAuditProxyRuntime={server:null,certificateProvider:null,ipPolicy:null,ipGate:null,startedAt:null,lastError:null,autostartPromise:null,autostartRetryTimer:null,lifecycle:Promise.resolve()}),globalThis.__blueRouterAuditProxyRuntime}function U(a){let b=T(),c=b.lifecycle.then(a,a);return b.lifecycle=c.catch(()=>{}),c}async function V(a,b=1500){if(!a)return;let c=Math.max(0,Number(b)||0);await new Promise(b=>{let d=!1,e=()=>{d||(d=!0,b())};try{a.listening?a.close(e):e()}catch{e()}let f=setTimeout(()=>{try{a.forceCloseAll?.()}catch{}},c);f.unref?.();let g=setTimeout(e,c+2e3);g.unref?.()});try{a.forceCloseAll?.()}catch{}}function W(a){let b=e();return{...a,proxyAuthEnabled:!0===b.proxyAuthEnabled,proxyAuthUsers:[...b.proxyAuthUsers||[]],accessGrants:u(b.accessGrants)}}let X=null;function Y(){let a=x();if(0===a)return;let b=T();if(!b.server?.listening)return;let c=b.ipGate?.dropRevoked()||0;console.log(`[audit-proxy] session sweep: ${a} session(s) expired, ${c} connection(s) closed`)}async function Z(a=null){let b=T();if(b.server?.listening)return ag();let c=a?f({...W(a),enabled:!1}):e();await O(),await H(),I(),X||(X=setInterval(Y,3e4),X.unref?.()),L();let g=P({maxEntries:128});g.prewarm(c.allowedHosts);let h=d(c,{certificateProvider:g,onAuditJob:E});b.ipPolicy=t(c),b.ipGate=s(h,()=>T().ipPolicy);try{let a=await new Promise((a,b)=>{let d=a=>{h.removeListener("listening",e),b(a?.code==="EADDRNOTAVAIL"?Error(`Cannot bind ${c.bindHost}:${c.port} - that address does not exist on this machine. In Docker the container cannot bind the host's LAN IP: set the bind address to 0.0.0.0 and let the published port (-p 3128:3128) expose it on the host.`,{cause:a}):a?.code==="EACCES"?Error(`Cannot bind ${c.bindHost}:${c.port} - permission denied. Ports below 1024 need extra privileges; pick a high port such as 3128.`,{cause:a}):a)},e=()=>{h.removeListener("error",d),a(h.address())};h.once("error",d),h.once("listening",e),h.listen(c.port,c.bindHost)});return b.server=h,b.certificateProvider=g,b.startedAt=new Date().toISOString(),b.lastError=null,ae(),f({...c,enabled:!0}),{...await ag(),address:a}}catch(a){b.lastError=a.message||String(a);try{h.forceCloseAll?.()}catch{}try{h.close()}catch{}throw g.clear?.(),a}}async function $({persist:a=!0}={}){let b=T();ae();let c=b.server,d=e();if(b.server=null,b.startedAt=null,await V(c,d.shutdownGraceMs),b.certificateProvider?.clear?.(),b.certificateProvider=null,b.ipGate=null,!await K(3e3)){let a=N();console.warn(`[audit-proxy] audit queue did not drain within 3000ms; ${a.queueDepth} event(s) still queued`)}return M(),J(),X&&clearInterval(X),X=null,a&&f({...d,enabled:!1}),ag()}async function _(a=null){return await $({persist:!1}),a&&f({...W(a),enabled:!1}),Z()}function aa(a=null){return U(()=>Z(a))}let ab=new Set(["1","true","yes","on"]),ac=[2e3,5e3,15e3,3e4,6e4];function ad(a){return a?.code==="EADDRINUSE"||a?.cause?.code==="EADDRINUSE"}function ae(){let a=T();a.autostartRetryTimer&&(clearTimeout(a.autostartRetryTimer),a.autostartRetryTimer=null)}async function af(){let a,b=T();await am();let c=e(),d=null!=(a=process.env.AUDIT_PROXY_ENABLED)&&""!==a&&ab.has(String(a).trim().toLowerCase());return c.enabled||d?b.server?.listening?{started:!1,reason:"already-running",status:await ag()}:(d&&!c.enabled&&console.log("[audit-proxy] starting because AUDIT_PROXY_ENABLED is set, despite stored enabled=false"),b.autostartPromise||(b.autostartPromise=(async()=>{try{let a=await aa();return console.log(`[audit-proxy] autostarted on ${c.bindHost}:${c.port}`),{started:!0,status:a}}catch(c){b.lastError=c?.message||String(c),console.log("[audit-proxy] autostart failed:",b.lastError);let a=ad(c);return a&&function a(b){let c=T(),d=ac[b-1];d?c.autostartRetryTimer||(c.autostartRetryTimer=setTimeout(async()=>{if((c.autostartRetryTimer=null,!c.server?.listening)&&e().enabled)try{await aa(),console.log(`[audit-proxy] autostart succeeded on retry ${b}`)}catch(d){c.lastError=d?.message||String(d),console.log(`[audit-proxy] autostart retry ${b} failed:`,c.lastError),ad(d)&&a(b+1)}},d),c.autostartRetryTimer.unref?.()):console.warn(`[audit-proxy] autostart still failing after ${ac.length} retries; start it from the dashboard once the cause is cleared`)}(1),{started:!1,error:b.lastError,retrying:a}}finally{b.autostartPromise=null}})()),b.autostartPromise):{started:!1,reason:"disabled"}}async function ag(){let a=T(),b=e(),c=t(b),d=!!a.server?.listening,f=R();try{let a=Q();f={...f,validated:!0===a.exists,expiringSoon:!0===a.expiringSoon,autoRotation:!1}}catch(a){f={...f,validated:!1,autoRotation:!1,error:a.message||String(a)}}return{running:d,listening:d,startedAt:a.startedAt,lastError:a.lastError,address:d?a.server.address():null,pendingListenerRestart:d&&!function(a,b){if(!a)return!0;let c=String(b.bindHost||"").trim().toLowerCase(),d=r(a.address||""),e=r("localhost"===c?"127.0.0.1":c);return Number(a.port)===Number(b.port)&&d===e}(a.server.address(),b),activeConnections:d&&a.server.getActiveConnectionCount?.()||0,capabilities:d?a.server.auditCapabilities:{http1:!0,http2:!1,plainHttp:!1,publicConnectPorts:[443]},security:{clientIpFilterEnabled:c.enabled,clientIpFilterSource:c.source,enforcedClientIpCount:c.allowedClientIps.length,accessGrantCount:c.grants.length,sessionIdleTimeoutMs:b.sessionIdleTimeoutMs,activeSessionCount:c.sessions.length,clientToolFilterEnabled:!0===b.clientToolFilterEnabled,proxyAuthEnabled:!0===b.proxyAuthEnabled,proxyAuthFeatureEnabled:k,allowedClientToolCount:(b.allowedClientTools||[]).length,privateDestinationsBlocked:!0,plainHttpBlocked:!0,upstreamTlsVerified:!0},activeSessions:c.sessions.map(a=>({ip:a.ip,userId:a.userId,displayName:a.displayName,activatedAt:new Date(a.activatedAt).toISOString(),expiresAt:new Date(a.expiresAt).toISOString()})),certificateCache:a.certificateProvider?.stats?.()||{entries:0},auditStore:N(),configPath:h,auditLogPath:i,auditLogDirectory:j,rootCA:f}}async function ah(a=50,{includeEvents:b=!0}={}){let c=e(),[d,f]=await Promise.all([ag(),b?F(a):[]]);return{config:ai(c),status:d,events:f}}function ai(a){return a?{...a,proxyAuthUsers:o(a.proxyAuthUsers)}:a}async function aj(){return Promise.resolve().then(c.bind(c,89718))}async function ak(){try{let{isClusterStandby:a}=await c.e(2763).then(c.bind(c,62763));return await a()===!0}catch{return!1}}async function al(a){try{if(await ak())return{mirrored:!1,reason:"standby"};let{getSettings:b,updateSettings:c}=await aj(),d=B(a),e=await b();if(JSON.stringify(e?.[A]||null)===JSON.stringify(d))return{mirrored:!1,reason:"unchanged"};return await c({[A]:d}),{mirrored:!0}}catch(a){return console.warn("[audit-proxy] failed to mirror policy to settings:",a?.message||a),{mirrored:!1,error:a?.message||String(a)}}}async function am({force:a=!1}={}){try{if(!a&&!await ak())return{applied:!1,reason:"not-standby"};let{getSettings:b}=await aj(),c=await b(),d=c?.[A];if(!d||"object"!=typeof d)return{applied:!1,reason:"no-policy"};let f=e();if(D(f,d))return{applied:!1,reason:"unchanged"};let g=C(f,d),h=await an(g,{mirror:!1});return console.log("[audit-proxy] applied cluster policy from snapshot"),{applied:!0,restarted:!0===h.restarted,droppedConnections:h.droppedConnections||0}}catch(a){return console.warn("[audit-proxy] failed to apply cluster policy:",a?.message||a),{applied:!1,error:a?.message||String(a)}}}function an(a,{mirror:b=!0}={}){return U(async()=>{let c=T(),d=!!c.server?.listening,e=f({...g(a),enabled:d});c.ipPolicy=t(e);let h=!1,i={},j=0;if(d){let a=c.server.applyConfig?.(e)||{};h=!0===a.rebindRequired,i=a.pending||{},j=c.ipGate?.dropRevoked()||0;try{c.certificateProvider?.prewarm?.(e.allowedHosts)}catch{}}return b&&await al(e),{config:ai(e),status:await ag(),restarted:!1,appliedInstantly:!0,rebindRequired:h,pendingListener:i,droppedConnections:j}})}a.exports={startProxy:aa,ensureAuditProxyAutostart:af,stopProxy:function(a={}){return U(()=>$(a))},restartProxy:function(a=null){return U(()=>_(a))},getStatus:ag,getSnapshot:ah,readRecentAuditEvents:F,updateConfig:function(a){return an(W(a))},updateClientProxyHost:function(a){return an({...e(),clientProxyHost:String(a||"").trim()})},updateProxyAuth:async function a({enabled:b,users:c}={}){if(!0===b&&!k)throw Error("Proxy authentication is turned off in this deployment (PROXY_AUTH_FEATURE_ENABLED in audit-gateway/config.js)");let d=e(),f=new Map(n(d.proxyAuthUsers).map(a=>[a.username.toLowerCase(),a])),g=new Set,h=[];for(let a of Array.isArray(c)?c:[]){let b=String(a?.username||"").trim();if(!m(b))throw Error(`Invalid username: ${b||"(empty)"}`);let c=b.toLowerCase();if(g.has(c))throw Error(`Duplicate username: ${b}`);g.add(c);let d="string"==typeof a?.password?a.password:"";if(d){let a=Buffer.byteLength(d,"utf8");if(a<q)throw Error(`Password for ${b} must be at least ${q} characters`);if(a>p)throw Error(`Password for ${b} must be at most ${p} bytes`);h.push({username:b,passwordHash:await l(d)});continue}let e=f.get(c);if(!e)throw Error(`Account ${b} requires a password`);h.push({username:b,passwordHash:e.passwordHash})}return an({...d,proxyAuthEnabled:!0===b,proxyAuthUsers:h})},listAccessGrants:function(){return u(e().accessGrants)},applyAuditPolicyFromSettings:am,upsertAccessGrant:function({userId:a,note:b}={}){let c=v(a);if(!c)throw Error("Grant requires a dashboard username or email");let d=e(),f=u(d.accessGrants).filter(a=>a.userId!==c);return f.push({userId:c,note:b}),an({...d,accessGrants:f})},deleteAccessGrant:function(a){let b=v(a);if(!b)throw Error("Grant requires a dashboard username or email");let c=e(),d=u(c.accessGrants).filter(a=>a.userId!==b);return z(b),an({...c,accessGrants:d})},getOwnProxySession:function(a){return w(a)},revokeSession:function({ip:a,userId:b}={}){let c=a?+!!y(a):z(b);if(0===c)return{removed:0,droppedConnections:0};let d=T();return d.server?.listening?{removed:c,droppedConnections:d.ipGate?.dropRevoked()||0}:{removed:c,droppedConnections:0}},clearAudit:G,runSelfTest:S}},78864:(a,b,c)=>{let d=c(14985).promises,e=c(91645),{normalizeIp:f,clientIpMatches:g}=c(5565),h=new Map,i=Object.freeze(["0.0.0.0/8","10.0.0.0/8","100.64.0.0/10","127.0.0.0/8","169.254.0.0/16","172.16.0.0/12","192.0.0.0/24","192.0.2.0/24","192.88.99.0/24","192.168.0.0/16","198.18.0.0/15","198.51.100.0/24","203.0.113.0/24","224.0.0.0/4","240.0.0.0/4","::/96","::1/128","100::/64","2001:2::/48","2001:db8::/32","fc00::/7","fe80::/10","ff00::/8"]),j=Object.freeze(["0.0.0.0/8","127.0.0.0/8","169.254.0.0/16","224.0.0.0/4","240.0.0.0/4","::/96","::1/128","fe80::/10","ff00::/8"]),k=Object.freeze([".localhost",".local",".internal",".lan",".home.arpa"]);function l(a){return String(a||"").trim().replace(/^\[|\]$/g,"").replace(/\.$/,"").toLowerCase()}function m(a){let b=l(a);return!(!(!b||"localhost"===b||k.some(a=>b.endsWith(a)))&&(e.isIP(b)||b.includes(".")))}function n(a,b=process.env){let c=l(a);return!(!c||e.isIP(c))&&(function(a=process.env){return String(a.AUDIT_PROXY_PRIVATE_HOSTS||"").split(",").map(a=>l(a)).filter(Boolean)})(b).some(a=>a.startsWith("*.")?c.endsWith(a.slice(1))&&c.length>a.length-1:c===a)}function o(a){let b=f(a);return!!e.isIP(b)&&!g(b,j)}function p(a){let b=f(a);return!!e.isIP(b)&&!g(b,i)}function q(a){let b=[...new Set((Array.isArray(a)?a:[a]).map(a=>Number(a)).filter(a=>Number.isInteger(a)&&a>=1&&a<=65535))];return b.length?b:[443]}function r(a){let b=[...a?.addresses||[]];return function(c,d,e){let f=d,g=e;"function"==typeof d&&(g=d,f={});let h="number"==typeof f?f:Number(f?.family||0);if("object"==typeof f&&f?.all===!0){let c=4===h||6===h?b.filter(a=>a.family===h):b;if(!c.length){let b=Error(`No validated public address for ${a.host}`);b.code="ENOTFOUND",g(b);return}g(null,c.map(({address:a,family:b})=>({address:a,family:b})));return}let i=function(a,b=0){let c=Number(b||0);return 4===c||6===c?a.find(a=>a.family===c)||null:a.find(a=>4===a.family)||a[0]||null}(b,h);if(!i){let b=Error(`No validated public address for ${a.host}`);b.code="ENOTFOUND",g(b);return}g(null,i.address,i.family)}}async function s(a,b,c={}){let g=l(a),i=Number(b||443),j=q(c.allowedPorts||[443]);if(!g)throw Error("Destination host is empty");if(!Number.isInteger(i)||!j.includes(i))throw Error(`CONNECT destination port ${i||"unknown"} is not allowed`);let k=n(g);if(!k&&m(g))throw Error(`Private or local destination hostname is not allowed: ${g}`);let t=e.isIP(f(g));if(t){let a=f(g);if(!p(a))throw Error(`Private or reserved destination address is not allowed: ${a}`);let b={host:g,port:i,addresses:[{address:a,family:t}]};return{...b,lookup:r(b)}}let u=Date.now(),v=k?`private:${g}`:g,w=h.get(v);if(!w||w.expiresAt<=u){let a=await d.lookup(g,{all:!0,verbatim:!0}),b=[],c=new Set;for(let d of a||[]){let a=f(d.address),g=e.isIP(a);if(!g||!(k?o(a):p(a)))continue;let h=`${g}:${a}`;c.has(h)||(c.add(h),b.push({address:a,family:g}))}if(!b.length)throw Error(k?`Destination did not resolve to a permitted address: ${g}`:`Destination did not resolve to a public address: ${g}`);w={addresses:b,expiresAt:u+6e4},h.set(v,w)}let x={host:g,port:i,addresses:[...w.addresses]};return{...x,lookup:r(x)}}a.exports={BLOCKED_ADDRESS_RANGES:i,normalizeTargetHost:l,normalizeAllowedPorts:q,isBlockedHostname:m,isPublicAddress:p,isPrivateAllowedHost:n,isPermittedPrivateAddress:o,createPinnedLookup:r,resolvePublicTarget:s,clearDnsPolicyCache:function(){h.clear()}}},85252:(a,b,c)=>{let d=c(81630),e=c(73496),f=c(91645),g=c(34631),h=c(74075),i=c(55511),j=c(15296),{createAuditProxy:k,CaptureBuffer:l}=c(45372),{containsLikelySecret:m}=c(48350),{clientIpMatches:n,normalizeAllowedClientIps:o}=c(5565),{normalizeAllowedTools:p,clientToolMatches:q,shouldRefuseClientTool:r}=c(98586),{createProxyAuthenticator:s,createProxyAuthLimiter:t,hashProxyPassword:u,parseBasicProxyAuthorization:v}=c(7566),{isPublicAddress:w}=c(78864),{validateConfig:x,PROXY_AUTH_FEATURE_ENABLED:y}=c(43096),{normalizeAccessGrants:z,effectiveClientIpPolicy:A,attachClientIpGate:B,findAccessGrant:C}=c(77407),{activateProxySession:D,touchProxySession:E,getProxySession:F,revokeProxySession:G,clearAllProxySessions:H}=c(68257),{promptLogMirrorDecision:I}=c(90173);function J(a){return i.createHash("sha256").update(a).digest("hex")}function K(a){let b=j.pki.rsa.generateKeyPair(2048),c=j.pki.createCertificate();c.publicKey=b.publicKey,c.serialNumber=String(Date.now()),c.validity.notBefore=new Date(Date.now()-6e4),c.validity.notAfter=new Date(Date.now()+864e5);let d=[{name:"commonName",value:a}];return c.setSubject(d),c.setIssuer(d),c.setExtensions([{name:"basicConstraints",cA:!0,critical:!0},{name:"keyUsage",keyCertSign:!0,cRLSign:!0,critical:!0}]),c.sign(b.privateKey,j.md.sha256.create()),{cert:c,keys:b,certPem:j.pki.certificateToPem(c)}}function L(a,b){let c=j.pki.rsa.generateKeyPair(2048),d=j.pki.createCertificate();return d.publicKey=c.publicKey,d.serialNumber=`${Date.now()}${Math.floor(1e3*Math.random())}`,d.validity.notBefore=new Date(Date.now()-6e4),d.validity.notAfter=new Date(Date.now()+864e5),d.setSubject([{name:"commonName",value:b}]),d.setIssuer(a.cert.subject.attributes),d.setExtensions([{name:"basicConstraints",cA:!1},{name:"keyUsage",digitalSignature:!0,keyEncipherment:!0},{name:"extKeyUsage",serverAuth:!0},{name:"subjectAltName",altNames:[{type:2,value:b}]}]),d.sign(a.keys.privateKey,j.md.sha256.create()),{cert:j.pki.certificateToPem(d),key:j.pki.privateKeyToPem(c.privateKey)}}function M(a,b="127.0.0.1"){return new Promise((c,d)=>{a.once("error",d),a.listen(0,b,()=>{a.removeListener("error",d),c(a.address())})})}function N(a){return new Promise(b=>{if(!a)return b();try{a.forceCloseAll?.()}catch{}if(!a.listening)return b();a.close(()=>b()),setTimeout(b,1e3).unref?.()})}function O(a,b){let c="127.0.0.1";return Promise.resolve({host:a,port:b,addresses:[{address:c,family:4}],lookup:(a,b,d)=>{let e=b,f=d;"function"==typeof b&&(f=b,e={}),e?.all?f(null,[{address:c,family:4}]):f(null,c,4)}})}function P(a,b,c="",d=""){return new Promise((e,g)=>{let h=f.connect(a,"127.0.0.1"),i=Buffer.alloc(0),j=setTimeout(()=>g(Error("CONNECT timeout")),7e3);h.once("error",g),h.once("connect",()=>{let a=c?`User-Agent: ${c}\r
 `:"";h.write(`CONNECT ${b} HTTP/1.1\r
 Host: ${b}\r
 ${a}${d}Proxy-Connection: keep-alive\r
@@ -45,7 +45,7 @@ Sec-WebSocket-Version: 13\r
 `)});let m=()=>{clearTimeout(l),f(Buffer.concat(k).toString("latin1"))};j.on("data",a=>{k.push(Buffer.from(a)),Buffer.concat(k).indexOf("\r\n\r\n")>=0&&m()}),j.on("end",m),j.on("close",m)})}({socket:aq,ca:aa.certPem,servername:"localhost",port:a.port,path:"/v1/messages?transport=websocket"});c("Protocol upgrade is refused, not silently downgraded",ar.startsWith("HTTP/1.1 501"),ar.slice(0,40)),c("Upgrade refusal tells the client what to do instead",/HTTP streaming transport/i.test(ar)),c("Upgrade never reaches the origin",!ae.some(a=>String(a.path||"").includes("transport=websocket"))),await new Promise(a=>setTimeout(a,100)),c("Refused upgrade is still audited",ai.some(a=>501===a.status&&String(a.path||"").includes("transport=websocket")));let as=ai.find(a=>501===a.status&&String(a.path||"").includes("transport=websocket"));c("Refused upgrade is flagged as denied",as?.denied===!0,String(as?.denied)),c("Refused upgrade is not mirrored into prompt_logs","denied"===I(as).reason);let at=ae.find(a=>String(a.path||"").includes("encoded=")),au=ae.find(a=>String(a.path||"").includes("h2-preferred"));c("HTTP/1.1 path/query preserved",at?.path===W),c("Downgraded path/query preserved",au?.path===_),c("HTTP/1.1 request body byte-identical",at&&J(at.body)===J(V)),c("Downgraded request body byte-identical",au&&J(au.body)===J(Z)),c("Authorization preserved on wire",ae.every(a=>"Bearer test-secret-authorization-123456789"===a.authorization)),c("x-api-key preserved on wire",ae.every(a=>"sk-test-supersecret-123456789"===a.apiKey)),c("Internal x-9r-* header stripped",ae.every(a=>null==a.internalHeader));let av=ai.find(a=>String(a.path||"").includes("encoded=")),aw=ai.find(a=>String(a.path||"").includes("h2-preferred"));c("HTTP/1.1 audit event captured",!!av),c("Downgraded audit event captured",!!aw),c("Request wire SHA-256 recorded",av?.request?.wireSha256===J(V)&&aw?.request?.wireSha256===J(Z)),c("Response wire SHA-256 recorded",av?.response?.wireSha256===J(ad)&&aw?.response?.wireSha256===J(ad)),c("Compressed audit response decoded",av?.response?.body?.includes("compressed response preserved")&&aw?.response?.body?.includes("compressed response preserved"));let ax=I(av);c("Exchange with a prompt is mirrored with both halves",!0===ax.mirror&&ax.promptText?.includes("hello h1")&&ax.responseText?.includes("compressed response preserved"),JSON.stringify({mirror:ax.mirror,prompt:ax.promptText,response:ax.responseText}));let ay={...av,path:"/api/claude_code/telemetry",request:{...av.request,body:JSON.stringify({events:[{eventName:"tengu_api_success",metadata:{durationMs:120}}]})},response:{...av.response,body:JSON.stringify({accepted_count:17,rejected_count:0})}},az=I(ay);c("Telemetry exchange is not mirrored into prompt_logs",!1===az.mirror&&"not-inference"===az.reason,JSON.stringify(az));let aA={...av,path:"/backend-api/ps/plugins/list?scope=GLOBAL",request:{...av.request,body:""},response:{...av.response,body:JSON.stringify({items:[{text:"gmail@openai-curated-remote"}]})}};c("Plugin listing is not mirrored into prompt_logs","not-inference"===I(aA).reason);let aB={...av,request:{...av.request,body:""},response:{...av.response,body:"[br audit body capture truncated; decoded body unavailable]"}};c("Capture placeholder does not count as content","contentless"===I(aB).reason);let aC=ai.filter(a=>"authorization"in(a.request?.headers||{}));c("Authorization redacted in audit",aC.length>0&&aC.every(a=>"[REDACTED]"===a.request.headers.authorization));let aD=ai.filter(a=>"x-api-key"in(a.request?.headers||{}));c("x-api-key redacted in audit",aD.length>0&&aD.every(a=>"[REDACTED]"===a.request.headers["x-api-key"])),c("No likely API secret persisted",ai.length>=2&&ai.every(a=>!m(a)));let aE={allowedHosts:[...aj.auditConfig.allowedHosts],clientToolFilterEnabled:aj.auditConfig.clientToolFilterEnabled,allowedClientTools:[...aj.auditConfig.allowedClientTools||[]]},aF=aj.auditConfig.port,aG=aj.auditConfig.bindHost;try{let d=`localhost:${a.port}`;aj.applyConfig({...aj.auditConfig,allowedHosts:[]});let e=await function(a,b,c=""){return new Promise(d=>{let e=f.connect(a,"127.0.0.1"),g="",h=!1,i=()=>{if(!h){h=!0,clearTimeout(j);try{e.destroy()}catch{}d(g)}},j=setTimeout(i,3e3);e.once("error",i),e.once("connect",()=>e.write(`CONNECT ${b} HTTP/1.1\r
 Host: ${b}\r
 ${c}\r
-`)),e.on("data",a=>{g+=a.toString("utf8")}),e.on("close",i)})}(b.port,d);c("Removing a host from the allowlist applies with no restart",/HTTP\/1\.1 403\b/.test(e),JSON.stringify(e.slice(0,120))),aj.applyConfig({...aj.auditConfig,allowedHosts:["localhost"]});let g=await P(b.port,d).catch(a=>a);c("Re-adding it works on the next CONNECT",!(g instanceof Error),g instanceof Error?g.message:""),g?.destroy?.(),aj.applyConfig({...aj.auditConfig,clientToolFilterEnabled:!0,allowedClientTools:p(["claude-code"])});let h=await Q(b.port,d,"User-Agent: Mozilla/5.0 Chrome/131.0\r\n");c("Turning the tool filter on applies with no restart",/HTTP\/1\.1 403\b/.test(h),JSON.stringify(h.slice(0,120))),aj.applyConfig({...aj.auditConfig,clientToolFilterEnabled:!1,allowedClientTools:[]});let i=await P(b.port,d,"Mozilla/5.0 Chrome/131.0").catch(a=>a);c("Turning it off applies with no restart",!(i instanceof Error),i instanceof Error?i.message:""),i?.destroy?.(),aj.applyConfig({...aj.auditConfig,captureLimitBytes:4096}),c("Capture limit is updated in place",4096===aj.auditConfig.captureLimitBytes);let j=aj.applyConfig({...aj.auditConfig,port:b.port+1,bindHost:"0.0.0.0"});c("A listener address/port change is reported as pending, not applied",!0===j.rebindRequired&&j.pending.port===b.port+1&&"0.0.0.0"===j.pending.bindHost,JSON.stringify(j.pending)),c("The bound listener is left alone by applyConfig",aj.auditConfig.port===aF&&aj.auditConfig.bindHost===aG&&!0===aj.listening,`${aj.auditConfig.port}/${aj.auditConfig.bindHost} vs ${aF}/${aG}`);let k=await P(b.port,d).catch(a=>a);c("Traffic keeps flowing on the address that is bound",!(k instanceof Error),k instanceof Error?k.message:""),k?.destroy?.()}finally{aj.applyConfig({...aj.auditConfig,...aE})}ak=k({allowedHosts:["localhost"],passthroughUnknown:!1,captureBodies:!0,captureLimitBytes:1048576,verifyUpstreamTls:!0,allowedConnectPorts:[a.port],connectTimeoutMs:5e3,tlsHandshakeTimeoutMs:5e3,responseHeaderTimeoutMs:5e3,idleTimeoutMs:3e4},{certificateProvider:()=>ab,upstreamCa:$.certPem,resolveTarget:O,onAudit:()=>{throw Error("simulated audit sink failure")}});let aH=await M(ak),aI=await P(aH.port,`localhost:${a.port}`),aJ=await T({socket:aI,ca:aa.certPem,servername:"localhost",port:a.port,body:V,path:W});c("Audit sink failure does not fail proxied request",aJ.head.startsWith("HTTP/1.1 200"))}catch(a){c("Self-test execution",!1,a.message||String(a))}finally{await N(ak),await N(aj),await N(ah)}return{ok:b.length>0&&b.every(a=>a.ok),checks:b,passed:b.filter(a=>a.ok).length,total:b.length,durationMs:Date.now()-a}}}},85463:(a,b,c)=>{let{validateConfig:d}=c(43096),e=["accessGrants","allowedHosts","clientToolFilterEnabled","allowedClientTools","captureBodies","captureLimitBytes","passthroughUnknown","retentionDays","sessionIdleTimeoutMs","dlpEnabled","dlpMaxInspectBytes","dlpOversizeAction","dlpDefaultAction","dlpProfiles","dlpRules"],f=["enabled","bindHost","port","clientProxyHost","proxyAuthEnabled","proxyAuthUsers"];function g(a={}){let b={};for(let c of e)void 0!==a[c]&&(b[c]=Array.isArray(a[c])?[...a[c]]:a[c]);return b}a.exports={POLICY_FIELDS:e,NODE_LOCAL_FIELDS:f,SETTINGS_KEY:"auditProxyPolicy",extractAuditPolicy:g,mergeAuditPolicy:function(a={},b={}){let c={...a};for(let a of e)void 0!==b[a]&&(c[a]=b[a]);for(let b of f)c[b]=a[b];return d(c)},policyEquals:function(a={},b={}){return JSON.stringify(g(a))===JSON.stringify(g(b))}}},86455:a=>{function b(a){let b=Number(a);return!Number.isFinite(b)||b<0?0:Math.round(b)}function c(){return{inputTokens:0,outputTokens:0,cacheReadTokens:0,cacheCreationTokens:0,reasoningTokens:0,totalTokens:0,model:null,stopReason:null,streaming:!1,complete:!1,source:null}}function d(a){let b=String(a||"").trim();if(!b||"{"!==b[0])return null;try{let a=JSON.parse(b);return a&&"object"==typeof a&&!Array.isArray(a)?a:null}catch{return null}}function e(a,c){"string"==typeof c.model&&c.model&&!a.model&&(a.model=c.model);let d="response.completed"===c.type||"response.done"===c.type?c.response?.usage:null,e=d||c.usage;if(!e||"object"!=typeof e)return!1;d&&"string"==typeof c.response?.model&&c.response.model&&(a.model=c.response.model);let f=b(e.prompt_tokens??e.input_tokens),g=b(e.completion_tokens??e.output_tokens);if(!f&&!g)return!1;let h=b(e.prompt_tokens_details?.cached_tokens??e.input_tokens_details?.cached_tokens??e.cached_tokens??e.prompt_cache_hit_tokens);a.inputTokens=Math.max(0,f-h),a.cacheReadTokens=h,a.outputTokens=g,a.reasoningTokens=b(e.completion_tokens_details?.reasoning_tokens??e.output_tokens_details?.reasoning_tokens),a.complete=!0;let i=c.choices?.[0]?.finish_reason;return"string"==typeof i&&i&&(a.stopReason=i),!0}function f(a,f){let g=c();g.streaming=!0,g.source="sse";let h=!1;for(let c of function*(a){let b=String(a||""),c=0;for(;c<b.length;){let a=b.indexOf("\n",c);-1===a&&(a=b.length);let e=b.slice(c,a).trim();if(c=a+1,!e.startsWith("data:"))continue;let f=e.slice(5).trim();if(!f||"[DONE]"===f)continue;let g=d(f);g&&(yield g)}}(a)){if(("anthropic"===f||"message_start"===c.type||"message_delta"===c.type)&&function(a,c){let d=String(c.type||"");if("message_start"===d&&c.message&&"object"==typeof c.message){let d=c.message;"string"==typeof d.model&&d.model&&(a.model=d.model);let e=d.usage;return e&&"object"==typeof e&&(a.inputTokens=b(e.input_tokens)||a.inputTokens,a.cacheReadTokens=b(e.cache_read_input_tokens)||a.cacheReadTokens,a.cacheCreationTokens=b(e.cache_creation_input_tokens)||a.cacheCreationTokens),!0}if("message_delta"===d){let d=c.usage;d&&"object"==typeof d&&(a.outputTokens=b(d.output_tokens)||a.outputTokens,a.inputTokens=a.inputTokens||b(d.input_tokens),a.cacheReadTokens=a.cacheReadTokens||b(d.cache_read_input_tokens),a.cacheCreationTokens=a.cacheCreationTokens||b(d.cache_creation_input_tokens),a.complete=!0);let e=c.delta?.stop_reason;return"string"==typeof e&&e&&(a.stopReason=e),!0}return!1}(g,c)){h=!0;continue}e(g,c)&&(h=!0)}return h?g:null}function g(a){let f=d(a);if(!f)return null;let g=c();g.source="json","string"==typeof f.model&&f.model&&(g.model=f.model);let h=f.usage;return h&&"object"==typeof h?null!=h.input_tokens||null!=h.output_tokens?(g.inputTokens=b(h.input_tokens),g.outputTokens=b(h.output_tokens),g.cacheReadTokens=b(h.cache_read_input_tokens),g.cacheCreationTokens=b(h.cache_creation_input_tokens),g.complete=!0,"string"==typeof f.stop_reason&&(g.stopReason=f.stop_reason),g):e(g,f)?g:null:null}function h(a){return/\/count_tokens\b/.test(String(a||""))}function i(a){return a.inputTokens+a.cacheReadTokens+a.cacheCreationTokens}a.exports={extractUsageFromBody:function({provider:a,body:b,contentType:c="",path:d=""}={}){if("string"!=typeof b||!b||b.length>0x1000000||h(d))return null;let e=/event-stream/i.test(String(c||""))||b.includes("\ndata:")||b.startsWith("data:")?f(b,a)||g(b):g(b)||f(b,a);return e&&(e&&(e.inputTokens||e.outputTokens||e.cacheReadTokens||e.cacheCreationTokens)||e.model)?(e.totalTokens=e.inputTokens+e.outputTokens+e.cacheReadTokens+e.cacheCreationTokens,e):null},isTokenCountingEndpoint:h,toTokensJson:function(a){if(!a)return null;let b=i(a),c={input_tokens:a.inputTokens,output_tokens:a.outputTokens,prompt_tokens:b,completion_tokens:a.outputTokens,total_tokens:a.totalTokens,display_total_input_tokens:b,display_new_input_tokens:a.inputTokens,display_cached_input_tokens:a.cacheReadTokens,display_cache_creation_input_tokens:a.cacheCreationTokens,display_output_tokens:a.outputTokens};return a.cacheReadTokens&&(c.cache_read_input_tokens=a.cacheReadTokens),a.cacheCreationTokens&&(c.cache_creation_input_tokens=a.cacheCreationTokens),a.cacheReadTokens&&(c.cached_tokens=a.cacheReadTokens),a.reasoningTokens&&(c.reasoning_tokens=a.reasoningTokens),c},totalInputTokens:i}},90173:(a,b,c)=>{let d=c(29021),e=c(33873),f=c(4984),g=c(55511),{AUDIT_LOG_PATH:h,AUDIT_LOG_DIR:i,ensureAuditDir:j,loadConfig:k}=c(43096),{redactObject:l,scrubString:m}=c(48350),{toTokensJson:n,totalInputTokens:o}=c(86455),{publishRecentUsage:p}=c(87662),q="audit-proxy",r="client",s="provider_response",t=/\/(?:messages|responses|chat\/completions)$|generatecontent$/i,u={expiresAt:0,config:null},v=null,w=null,x=null,y=null,z=null,A=null,B="",C=Promise.resolve(),D=Promise.resolve(),E=0,F=null,G=!1,H=new Map,I={queue:[],workers:new Set,activeWorkers:0,clearing:!1,enqueued:0,written:0,dropped:0,failed:0,localFailed:0,sinkTimeouts:0,flushTimeouts:0,mysqlWritten:0,mysqlFailed:0,mysqlSkipped:0,mysqlSkippedByReason:{},usageWritten:0,usageFailed:0,tokensSeen:0,lastError:null,lastWrittenAt:null};function J(a){let b=Date.now();b-E<6e4||(E=b,console.warn(`[AuditProxy][PromptDB] ${a}`))}function K(a){I.lastError=String(a||"Audit store failure"),console.warn(`[AuditProxy][Store] ${I.lastError}`)}function L(a,b,c=3e4){let d=null;return Promise.race([a,new Promise((a,e)=>{d=setTimeout(()=>{I.sinkTimeouts+=1,e(Error(`${b} timed out after ${c}ms`))},c),d.unref?.()})]).finally(()=>{d&&clearTimeout(d)})}async function M(){let a=Date.now();if(u.expiresAt>a)return u.config;v||(v=Promise.resolve().then(c.bind(c,45903)));let b=await v,d=await b.getPromptLogDbConfig();return u={expiresAt:a+5e3,config:d},d}async function N(){return w||(w=c.e(2661).then(c.bind(c,12661))),w}async function O(a){let b=g.createHash("sha256").update(JSON.stringify({host:a.host,port:Number(a.port||3306),database:a.database,username:a.username,password:a.password,ssl:!!a.ssl})).digest("hex");if(A&&B===b)return A;let d=C.then(async()=>{if(A&&B===b)return A;if(A){try{await A.end()}catch{}A=null,B=""}let d=await c.e(8491).then(c.t.bind(c,38491,19)),e=(d.default||d).createPool({host:a.host,port:Number(a.port||3306),database:a.database,user:a.username,password:a.password,ssl:a.ssl?{rejectUnauthorized:!0}:void 0,connectTimeout:3e3,waitForConnections:!0,connectionLimit:4,maxIdle:4,idleTimeout:6e4,queueLimit:100,enableKeepAlive:!0,keepAliveInitialDelay:3e4});return A=e,B=b,e});return C=d.then(()=>void 0,()=>void 0),d}function P(a){let b=a?new Date(a):new Date;return(Number.isNaN(b.getTime())?new Date:b).toISOString().replace("T"," ").replace("Z","")}function Q(a){if("string"!=typeof a)return a;let b=a.trim();if(!b||!b.startsWith("{")&&!b.startsWith("["))return a;try{return JSON.parse(b)}catch{return a}}function R(a,b=0,c=[]){if(null==a||b>12||c.join("\n").length>=2e5)return c;if("string"==typeof a)return a.trim()&&c.push(a.trim()),c;if(Array.isArray(a)){for(let d of a)R(d,b+1,c);return c}if("object"!=typeof a)return c;for(let[d,e]of Object.entries(a)){let a=d.toLowerCase();["content","text","prompt","input","message","output_text"].includes(a)?R(e,b+1,c):b<8&&["messages","contents","parts","body","request","payload","response","choices","output","item","items"].includes(a)&&R(e,b+1,c)}return c}function S(a){if("string"!=typeof a)return!1;let b=a.trim();return!!b&&!/^\[[^\]]*\]$/.test(b)}function T(a){let b=String(a||"").toLowerCase();return b.includes("claude")?{tool:"claude-code",label:"Claude Code"}:b.includes("codex")?{tool:"codex",label:"Codex"}:{tool:"audit-proxy",label:"Enterprise AI Audit Proxy"}}async function U(a){if(!a)return null;let b=g.createHash("sha256").update(a).digest("hex"),c=Buffer.byteLength(String(a||""),"utf8"),d=await N();return await d.writePayloadFile(b,a),{payloadHash:b,payloadSizeBytes:c}}async function V(a,b,c,d){if(!c)return null;let{payloadHash:e,payloadSizeBytes:f}=c;return await a.query(`INSERT INTO prompt_log_payloads (
+`)),e.on("data",a=>{g+=a.toString("utf8")}),e.on("close",i)})}(b.port,d);c("Removing a host from the allowlist applies with no restart",/HTTP\/1\.1 403\b/.test(e),JSON.stringify(e.slice(0,120))),aj.applyConfig({...aj.auditConfig,allowedHosts:["localhost"]});let g=await P(b.port,d).catch(a=>a);c("Re-adding it works on the next CONNECT",!(g instanceof Error),g instanceof Error?g.message:""),g?.destroy?.(),aj.applyConfig({...aj.auditConfig,clientToolFilterEnabled:!0,allowedClientTools:p(["claude-code"])});let h=await Q(b.port,d,"User-Agent: Mozilla/5.0 Chrome/131.0\r\n");c("Turning the tool filter on applies with no restart",/HTTP\/1\.1 403\b/.test(h),JSON.stringify(h.slice(0,120))),aj.applyConfig({...aj.auditConfig,clientToolFilterEnabled:!1,allowedClientTools:[]});let i=await P(b.port,d,"Mozilla/5.0 Chrome/131.0").catch(a=>a);c("Turning it off applies with no restart",!(i instanceof Error),i instanceof Error?i.message:""),i?.destroy?.(),aj.applyConfig({...aj.auditConfig,captureLimitBytes:4096}),c("Capture limit is updated in place",4096===aj.auditConfig.captureLimitBytes);let j=aj.applyConfig({...aj.auditConfig,port:b.port+1,bindHost:"0.0.0.0"});c("A listener address/port change is reported as pending, not applied",!0===j.rebindRequired&&j.pending.port===b.port+1&&"0.0.0.0"===j.pending.bindHost,JSON.stringify(j.pending)),c("The bound listener is left alone by applyConfig",aj.auditConfig.port===aF&&aj.auditConfig.bindHost===aG&&!0===aj.listening,`${aj.auditConfig.port}/${aj.auditConfig.bindHost} vs ${aF}/${aG}`);let k=await P(b.port,d).catch(a=>a);c("Traffic keeps flowing on the address that is bound",!(k instanceof Error),k instanceof Error?k.message:""),k?.destroy?.()}finally{aj.applyConfig({...aj.auditConfig,...aE})}ak=k({allowedHosts:["localhost"],passthroughUnknown:!1,captureBodies:!0,captureLimitBytes:1048576,verifyUpstreamTls:!0,allowedConnectPorts:[a.port],connectTimeoutMs:5e3,tlsHandshakeTimeoutMs:5e3,responseHeaderTimeoutMs:5e3,idleTimeoutMs:3e4},{certificateProvider:()=>ab,upstreamCa:$.certPem,resolveTarget:O,onAudit:()=>{throw Error("simulated audit sink failure")}});let aH=await M(ak),aI=await P(aH.port,`localhost:${a.port}`),aJ=await T({socket:aI,ca:aa.certPem,servername:"localhost",port:a.port,body:V,path:W});c("Audit sink failure does not fail proxied request",aJ.head.startsWith("HTTP/1.1 200"))}catch(a){c("Self-test execution",!1,a.message||String(a))}finally{await N(ak),await N(aj),await N(ah)}return{ok:b.length>0&&b.every(a=>a.ok),checks:b,passed:b.filter(a=>a.ok).length,total:b.length,durationMs:Date.now()-a}}}},85463:(a,b,c)=>{let{validateConfig:d}=c(43096),e=["accessGrants","allowedHosts","clientToolFilterEnabled","allowedClientTools","captureBodies","captureLimitBytes","passthroughUnknown","retentionDays","sessionIdleTimeoutMs","dlpEnabled","dlpMaxInspectBytes","dlpOversizeAction","dlpDefaultAction","dlpProfiles","dlpRules"],f=["enabled","bindHost","port","clientProxyHost","proxyAuthEnabled","proxyAuthUsers"];function g(a={}){let b={};for(let c of e)void 0!==a[c]&&(b[c]=Array.isArray(a[c])?[...a[c]]:a[c]);return b}a.exports={POLICY_FIELDS:e,NODE_LOCAL_FIELDS:f,SETTINGS_KEY:"auditProxyPolicy",extractAuditPolicy:g,mergeAuditPolicy:function(a={},b={}){let c={...a};for(let a of e)void 0!==b[a]&&(c[a]=b[a]);for(let b of f)c[b]=a[b];return d(c)},policyEquals:function(a={},b={}){return JSON.stringify(g(a))===JSON.stringify(g(b))}}},86455:a=>{function b(a){let b=Number(a);return!Number.isFinite(b)||b<0?0:Math.round(b)}function c(){return{inputTokens:0,outputTokens:0,cacheReadTokens:0,cacheCreationTokens:0,reasoningTokens:0,totalTokens:0,model:null,stopReason:null,streaming:!1,complete:!1,source:null}}function d(a){let b=String(a||"").trim();if(!b||"{"!==b[0])return null;try{let a=JSON.parse(b);return a&&"object"==typeof a&&!Array.isArray(a)?a:null}catch{return null}}function e(a,c){"string"==typeof c.model&&c.model&&!a.model&&(a.model=c.model);let d="response.completed"===c.type||"response.done"===c.type?c.response?.usage:null,e=d||c.usage;if(!e||"object"!=typeof e)return!1;d&&"string"==typeof c.response?.model&&c.response.model&&(a.model=c.response.model);let f=b(e.prompt_tokens??e.input_tokens),g=b(e.completion_tokens??e.output_tokens);if(!f&&!g)return!1;let h=b(e.prompt_tokens_details?.cached_tokens??e.input_tokens_details?.cached_tokens??e.cached_tokens??e.prompt_cache_hit_tokens);a.inputTokens=Math.max(0,f-h),a.cacheReadTokens=h,a.outputTokens=g,a.reasoningTokens=b(e.completion_tokens_details?.reasoning_tokens??e.output_tokens_details?.reasoning_tokens),a.complete=!0;let i=c.choices?.[0]?.finish_reason;return"string"==typeof i&&i&&(a.stopReason=i),!0}function f(a,f){let g=c();g.streaming=!0,g.source="sse";let h=!1;for(let c of function*(a){let b=String(a||""),c=0;for(;c<b.length;){let a=b.indexOf("\n",c);-1===a&&(a=b.length);let e=b.slice(c,a).trim();if(c=a+1,!e.startsWith("data:"))continue;let f=e.slice(5).trim();if(!f||"[DONE]"===f)continue;let g=d(f);g&&(yield g)}}(a)){if(("anthropic"===f||"message_start"===c.type||"message_delta"===c.type)&&function(a,c){let d=String(c.type||"");if("message_start"===d&&c.message&&"object"==typeof c.message){let d=c.message;"string"==typeof d.model&&d.model&&(a.model=d.model);let e=d.usage;return e&&"object"==typeof e&&(a.inputTokens=b(e.input_tokens)||a.inputTokens,a.cacheReadTokens=b(e.cache_read_input_tokens)||a.cacheReadTokens,a.cacheCreationTokens=b(e.cache_creation_input_tokens)||a.cacheCreationTokens),!0}if("message_delta"===d){let d=c.usage;d&&"object"==typeof d&&(a.outputTokens=b(d.output_tokens)||a.outputTokens,a.inputTokens=a.inputTokens||b(d.input_tokens),a.cacheReadTokens=a.cacheReadTokens||b(d.cache_read_input_tokens),a.cacheCreationTokens=a.cacheCreationTokens||b(d.cache_creation_input_tokens),a.complete=!0);let e=c.delta?.stop_reason;return"string"==typeof e&&e&&(a.stopReason=e),!0}return!1}(g,c)){h=!0;continue}e(g,c)&&(h=!0)}return h?g:null}function g(a){let f=d(a);if(!f)return null;let g=c();g.source="json","string"==typeof f.model&&f.model&&(g.model=f.model);let h=f.usage;return h&&"object"==typeof h?null!=h.input_tokens||null!=h.output_tokens?(g.inputTokens=b(h.input_tokens),g.outputTokens=b(h.output_tokens),g.cacheReadTokens=b(h.cache_read_input_tokens),g.cacheCreationTokens=b(h.cache_creation_input_tokens),g.complete=!0,"string"==typeof f.stop_reason&&(g.stopReason=f.stop_reason),g):e(g,f)?g:null:null}function h(a){return/\/count_tokens\b/.test(String(a||""))}function i(a){return a.inputTokens+a.cacheReadTokens+a.cacheCreationTokens}a.exports={extractUsageFromBody:function({provider:a,body:b,contentType:c="",path:d=""}={}){if("string"!=typeof b||!b||b.length>0x1000000||h(d))return null;let e=/event-stream/i.test(String(c||""))||b.includes("\ndata:")||b.startsWith("data:")?f(b,a)||g(b):g(b)||f(b,a);return e&&(e&&(e.inputTokens||e.outputTokens||e.cacheReadTokens||e.cacheCreationTokens)||e.model)?(e.totalTokens=e.inputTokens+e.outputTokens+e.cacheReadTokens+e.cacheCreationTokens,e):null},isTokenCountingEndpoint:h,toTokensJson:function(a){if(!a)return null;let b=i(a),c={input_tokens:a.inputTokens,output_tokens:a.outputTokens,prompt_tokens:b,completion_tokens:a.outputTokens,total_tokens:a.totalTokens,display_total_input_tokens:b,display_new_input_tokens:a.inputTokens,display_cached_input_tokens:a.cacheReadTokens,display_cache_creation_input_tokens:a.cacheCreationTokens,display_output_tokens:a.outputTokens};return a.cacheReadTokens&&(c.cache_read_input_tokens=a.cacheReadTokens),a.cacheCreationTokens&&(c.cache_creation_input_tokens=a.cacheCreationTokens),a.cacheReadTokens&&(c.cached_tokens=a.cacheReadTokens),a.reasoningTokens&&(c.reasoning_tokens=a.reasoningTokens),c},totalInputTokens:i}},90173:(a,b,c)=>{let d=c(29021),e=c(33873),f=c(4984),g=c(55511),{AUDIT_LOG_PATH:h,AUDIT_LOG_DIR:i,ensureAuditDir:j,loadConfig:k}=c(43096),{redactObject:l,scrubString:m}=c(48350),{toTokensJson:n,totalInputTokens:o}=c(86455),{publishRecentUsage:p}=c(87662),q="audit-proxy",r="client",s="provider_response",t=/\/(?:messages|responses|chat\/completions)$|generatecontent$|\/generateassistantresponse$/i,u={expiresAt:0,config:null},v=null,w=null,x=null,y=null,z=null,A=null,B="",C=Promise.resolve(),D=Promise.resolve(),E=0,F=null,G=!1,H=new Map,I={queue:[],workers:new Set,activeWorkers:0,clearing:!1,enqueued:0,written:0,dropped:0,failed:0,localFailed:0,sinkTimeouts:0,flushTimeouts:0,mysqlWritten:0,mysqlFailed:0,mysqlSkipped:0,mysqlSkippedByReason:{},usageWritten:0,usageFailed:0,tokensSeen:0,lastError:null,lastWrittenAt:null};function J(a){let b=Date.now();b-E<6e4||(E=b,console.warn(`[AuditProxy][PromptDB] ${a}`))}function K(a){I.lastError=String(a||"Audit store failure"),console.warn(`[AuditProxy][Store] ${I.lastError}`)}function L(a,b,c=3e4){let d=null;return Promise.race([a,new Promise((a,e)=>{d=setTimeout(()=>{I.sinkTimeouts+=1,e(Error(`${b} timed out after ${c}ms`))},c),d.unref?.()})]).finally(()=>{d&&clearTimeout(d)})}async function M(){let a=Date.now();if(u.expiresAt>a)return u.config;v||(v=Promise.resolve().then(c.bind(c,45903)));let b=await v,d=await b.getPromptLogDbConfig();return u={expiresAt:a+5e3,config:d},d}async function N(){return w||(w=c.e(2661).then(c.bind(c,12661))),w}async function O(a){let b=g.createHash("sha256").update(JSON.stringify({host:a.host,port:Number(a.port||3306),database:a.database,username:a.username,password:a.password,ssl:!!a.ssl})).digest("hex");if(A&&B===b)return A;let d=C.then(async()=>{if(A&&B===b)return A;if(A){try{await A.end()}catch{}A=null,B=""}let d=await c.e(8491).then(c.t.bind(c,38491,19)),e=(d.default||d).createPool({host:a.host,port:Number(a.port||3306),database:a.database,user:a.username,password:a.password,ssl:a.ssl?{rejectUnauthorized:!0}:void 0,connectTimeout:3e3,waitForConnections:!0,connectionLimit:4,maxIdle:4,idleTimeout:6e4,queueLimit:100,enableKeepAlive:!0,keepAliveInitialDelay:3e4});return A=e,B=b,e});return C=d.then(()=>void 0,()=>void 0),d}function P(a){let b=a?new Date(a):new Date;return(Number.isNaN(b.getTime())?new Date:b).toISOString().replace("T"," ").replace("Z","")}function Q(a){if("string"!=typeof a)return a;let b=a.trim();if(!b||!b.startsWith("{")&&!b.startsWith("["))return a;try{return JSON.parse(b)}catch{return a}}function R(a,b=0,c=[]){if(null==a||b>12||c.join("\n").length>=2e5)return c;if("string"==typeof a)return a.trim()&&c.push(a.trim()),c;if(Array.isArray(a)){for(let d of a)R(d,b+1,c);return c}if("object"!=typeof a)return c;for(let[d,e]of Object.entries(a)){let a=d.toLowerCase();["content","text","prompt","input","message","output_text"].includes(a)?R(e,b+1,c):b<8&&["messages","contents","parts","body","request","payload","response","choices","output","item","items","conversationstate","currentmessage","userinputmessage","history","assistantresponsemessage"].includes(a)&&R(e,b+1,c)}return c}function S(a){if("string"!=typeof a)return!1;let b=a.trim();return!!b&&!/^\[[^\]]*\]$/.test(b)}function T(a){let b=String(a||"").toLowerCase();return b.includes("claude")?{tool:"claude-code",label:"Claude Code"}:b.includes("codex")?{tool:"codex",label:"Codex"}:{tool:"audit-proxy",label:"Enterprise AI Audit Proxy"}}async function U(a){if(!a)return null;let b=g.createHash("sha256").update(a).digest("hex"),c=Buffer.byteLength(String(a||""),"utf8"),d=await N();return await d.writePayloadFile(b,a),{payloadHash:b,payloadSizeBytes:c}}async function V(a,b,c,d){if(!c)return null;let{payloadHash:e,payloadSizeBytes:f}=c;return await a.query(`INSERT INTO prompt_log_payloads (
       payload_hash, created_at, last_seen_at, content_type, payload_size_bytes, ref_count, payload_json
     ) VALUES (?, ?, ?, ?, ?, 1, NULL)
     ON DUPLICATE KEY UPDATE
@@ -63,7 +63,7 @@ ${c}\r
       response_payload_hash, response_payload_size_bytes,
       prompt_text, full_request_json,
       response_text, status_code, error_text, meta_json
-    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, CAST(? AS JSON), ?, ?, ?, CAST(? AS JSON))`,[b.id,b.createdAt,b.sessionId,b.sourceFormat,b.targetFormat,b.model,b.endpoint,b.stage,b.providerUrl,b.provider,b.accountName,b.connectionId,b.displayModel,b.clientIp,b.clientPort,b.clientUserAgent,b.clientHost,b.sourceTool,b.sourceToolLabel,b.sourceHost,b.contentMode,b.payloadHash,b.payloadSizeBytes,b.responsePayloadHash,b.responsePayloadSizeBytes,b.promptText,b.fullRequestJson,b.responseText,b.statusCode,b.errorText,JSON.stringify(b.meta||{})])}function X(a){return a?.denied===!0}function Y(a){let b,c,d;if(X(a))return{mirror:!1,reason:"denied"};if(!function(a){if(a?.usage)return!0;let b=String(a?.path||"").split("?")[0].replace(/\/+$/,"");return t.test(b)}(a))return{mirror:!1,reason:"not-inference"};let e=function(a){try{let b=JSON.parse(JSON.stringify(a??null)),c=l(b);return JSON.parse(m(JSON.stringify(c)))}catch{return m(String(a??""))}}(a),{requestPayload:f,responsePayload:g}=(b=e.request||{},c=e.response||{},{requestPayload:{timestamp:e.timestamp,protocol:e.protocol||"http/1.1",method:e.method,endpoint:e.path,headers:b.headers||{},body:Q(b.body),capturedBytes:Number(b.capturedBytes||0),totalBytes:Number(b.totalBytes||0),wireSha256:b.wireSha256||null,truncated:!0===b.truncated},responsePayload:{timestamp:e.timestamp,protocol:e.protocol||"http/1.1",status:e.status,headers:c.headers||{},body:Q(c.body),capturedBytes:Number(c.capturedBytes||0),totalBytes:Number(c.totalBytes||0),wireSha256:c.wireSha256||null,truncated:!0===c.truncated}}),h=(d=R(f?.body??f??{}).join("\n\n"))?d.slice(0,2e3):null,i=function(a){let b=a?.body;if("string"==typeof b)return b.slice(0,2e3)||null;let c=R(b??a??{}).join("\n\n");return c?c.slice(0,2e3):null}(g),j=S(h)?h:null,k=S(i)?i:null;return j||k?{mirror:!0,safeEvent:e,requestPayload:f,responsePayload:g,promptText:j,responseText:k}:{mirror:!1,reason:"contentless"}}async function Z(a){if(X(a))return{written:!1,skipped:!0,reason:"denied"};let b=null;try{let c=await M();if(!c?.enabled)return{written:!1,disabled:!0};if("mysql"!==String(c.type||"").toLowerCase())return J(`Audit mirroring requires MySQL; current type is ${c.type||"unknown"}`),{written:!1,unsupported:!0};let d=Y(a);if(!d.mirror)return{written:!1,skipped:!0,reason:d.reason};let{safeEvent:e,requestPayload:f,responsePayload:h,promptText:i,responseText:j}=d,k=JSON.stringify(f),l=JSON.stringify(h),m=Math.max(0,Number(e.durationMs||0)),n=new Date(e.timestamp||Date.now()),o=Number.isNaN(n.getTime())?new Date:n,p=new Date(o.getTime()-m),t=P(p),u=P(o),v=T(e.client?.userAgent),w=String(e.provider||"other"),x=e.model?String(e.model):null,y=String(e.host||""),z=Number(e.port||443),A=String(e.path||""),B=y?`https://${y}${443!==z?`:${z}`:""}${A}`:null,C=await O(c);b=await C.getConnection();let[D,E]=await Promise.all([U(k),U(l)]);await b.beginTransaction();let F=await V(b,t,D,"request_json"),G=await V(b,u,E,"response_json"),H={source:q,auditEventId:e.id||null,protocol:e.protocol||"http/1.1",host:y||null,port:z,method:e.method||null,path:A||null,proxyUser:e.client?.proxyUser||null,durationMs:m,requestCapturedBytes:Number(e.request?.capturedBytes||0),requestTotalBytes:Number(e.request?.totalBytes||0),requestWireSha256:e.request?.wireSha256||null,requestTruncated:e.request?.truncated===!0,responseCapturedBytes:Number(e.response?.capturedBytes||0),responseTotalBytes:Number(e.response?.totalBytes||0),responseWireSha256:e.response?.wireSha256||null,responseTruncated:e.response?.truncated===!0,payloadHash:F?.payloadHash||null,payloadSizeBytes:F?.payloadSizeBytes||0,payloadStorage:F?"prompt_log_payloads":null,responsePayloadHash:G?.payloadHash||null,responsePayloadSizeBytes:G?.payloadSizeBytes||0,responsePayloadStorage:G?"prompt_log_payloads":null,...e.usage?{inputTokens:Number(e.usage.inputTokens||0),outputTokens:Number(e.usage.outputTokens||0),cacheReadTokens:Number(e.usage.cacheReadTokens||0),cacheCreationTokens:Number(e.usage.cacheCreationTokens||0),reasoningTokens:Number(e.usage.reasoningTokens||0),totalTokens:Number(e.usage.totalTokens||0),usageComplete:!0===e.usage.complete,usageSource:e.usage.source||null,stopReason:e.usage.stopReason||null}:{}},I=String(e.id||g.randomUUID()),K={sessionId:`audit-${I}`,sourceFormat:w,targetFormat:w,model:x,endpoint:A||null,providerUrl:B,provider:w,accountName:null,connectionId:null,displayModel:x?`${w}/${x}`:null,clientIp:e.client?.ip||null,clientPort:e.client?.port!=null?String(e.client.port):null,clientUserAgent:e.client?.userAgent||null,clientHost:y||null,sourceTool:v.tool,sourceToolLabel:v.label,sourceHost:y||null};return await W(b,{...K,id:`${I}:request`,createdAt:t,stage:r,contentMode:e.request?.body?"raw_json_preview":"metadata_only",payloadHash:F?.payloadHash||null,payloadSizeBytes:F?.payloadSizeBytes||0,responsePayloadHash:null,responsePayloadSizeBytes:0,promptText:i,fullRequestJson:null,responseText:null,statusCode:null,errorText:null,meta:{...H,auditDirection:"request"}}),await W(b,{...K,id:`${I}:response`,createdAt:u,stage:s,contentMode:e.response?.body?"raw_json_preview":"metadata_only",payloadHash:null,payloadSizeBytes:0,responsePayloadHash:G?.payloadHash||null,responsePayloadSizeBytes:G?.payloadSizeBytes||0,promptText:null,fullRequestJson:null,responseText:j,statusCode:null!=e.status?Number(e.status):null,errorText:e.error||null,meta:{...H,auditDirection:"response"}}),await b.commit(),{written:!0,rowsWritten:2}}catch(a){if(b)try{await b.rollback()}catch{}return J(`Failed to mirror audit event to prompt_logs: ${a.message||a}`),{written:!1,error:a.message||String(a)}}finally{try{b?.release()}catch{}}}async function $(){return x||(x=Promise.resolve().then(c.bind(c,77638))),x}async function _(a,b,d){if(!b||!d)return 0;try{z||(z=Promise.resolve().then(c.bind(c,97914))),y||(y=c.e(7341).then(c.bind(c,57341)));let[e,f]=await Promise.all([z,y]),g=await e.getPricingForModel(a,b);if(!g)return 0;let h=f.calculateCostFromTokens(d,g);return Number.isFinite(h)&&h>0?h:0}catch{return 0}}async function aa(a,b){let c=a?.usage,d=!!(c&&(c.inputTokens||c.outputTokens||c.cacheReadTokens||c.cacheCreationTokens||c.reasoningTokens)),e=Number(a?.status),f=String(a?.path||"").split("?")[0].replace(/\/+$/,""),g=!a?.error&&Number.isFinite(e)&&e>=200&&e<300&&"POST"===String(a?.method||"").toUpperCase()&&t.test(f);if(!d&&!g)return{written:!1,skipped:!0};let h=d?c:{inputTokens:0,outputTokens:0,cacheReadTokens:0,cacheCreationTokens:0,reasoningTokens:0,totalTokens:0,model:c?.model||null,stopReason:c?.stopReason||null,streaming:c?.streaming===!0,complete:!1,source:c?.source||"missing"},i=String(a.provider||"other"),j=a.model||h.model||null,k=n(h),l=a.timestamp||new Date().toISOString(),m=Number.isFinite(e)&&e>=200&&e<300,r=!!a.error&&m&&!0===h.complete,s=!r&&(a.error||a.status&&a.status>=400)?"error":"success",u=a.error?String(a.error).slice(0,500):null,v=r?null:u;p({timestamp:l,provider:i,model:j,connectionId:"",endpoint:a.path||null,requestId:a.id||null,cost:0,status:s,statusCode:null!=a.status?Number(a.status):null,errorMessageShort:v,tokens:k,sourceTool:b.tool,sourceToolLabel:b.label});try{let c=await $();if(!await c.isMysqlObservabilityEnabled())return{written:!1,disabled:!0,realtimePublished:!0};let e=await _(i,j,k),f=await c.saveMysqlUsageEvent({timestamp:l,provider:i,model:j,endpoint:a.path||null,requestId:a.id||null,sessionId:a.id?`audit-${a.id}`:null,apiKeyOwner:a.client?.dashboardUser?.userId||null,apiKeyName:a.client?.dashboardUser?`Audit Proxy — ${a.client.dashboardUser.displayName||a.client.dashboardUser.userId}`:null,clientIp:a.client?.ip||null,clientIpNormalized:a.client?.ip||null,clientHost:a.host||null,clientUserAgent:a.client?.userAgent||null,sourceTool:b.tool,sourceToolLabel:b.label,sourceHost:a.host||null,latencyMs:Math.max(0,Number(a.durationMs||0)),statusCode:null!=a.status?Number(a.status):null,errorMessageShort:v,isStreaming:!0===h.streaming,promptTokens:o(h),completionTokens:h.outputTokens,totalTokens:h.totalTokens,cachedTokens:h.cacheReadTokens,cacheCreationTokens:h.cacheCreationTokens,reasoningTokens:h.reasoningTokens,cost:e,status:s,tokens:k,meta:{source:q,auditEventId:a.id||null,host:a.host||null,method:a.method||null,stopReason:h.stopReason||null,usageComplete:!0===h.complete,usageSource:h.source||null,usageMissing:!d,responseTruncated:a.response?.truncated===!0,transportError:u,settledAfterUsage:r}});return f&&global._usageStatsCache?.clear?.(),{written:!!f,realtimePublished:!0}}catch(a){return J(`Failed to mirror audit usage to usage_events: ${a.message||a}`),{written:!1,error:a.message||String(a)}}}async function ab(a,b){let c;j();let f=(Number.isNaN((c=a?new Date(a):new Date).getTime())?new Date:c).toISOString().slice(0,10),g=H.get(f);if(!g){let a=await d.promises.readdir(i).catch(()=>[]),b=RegExp(`^audit-${f.replace(/-/g,"\\-")}(?:\\.(\\d+))?\\.jsonl$`),c=0;for(let d of a){let a=d.match(b);a&&(c=Math.max(c,Number(a[1]||0)))}let h=e.join(i,`audit-${f}${c?`.${c}`:""}.jsonl`),j=await d.promises.stat(h).catch(()=>null);g={segment:c,filePath:h,size:j?.size||0},H.set(f,g)}return g.size>0&&g.size+b>0x8000000&&(g={segment:g.segment+1,filePath:e.join(i,`audit-${f}.${g.segment+1}.jsonl`),size:0},H.set(f,g)),g}async function ac(a){let b=`${JSON.stringify(a)}
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, CAST(? AS JSON), ?, ?, ?, CAST(? AS JSON))`,[b.id,b.createdAt,b.sessionId,b.sourceFormat,b.targetFormat,b.model,b.endpoint,b.stage,b.providerUrl,b.provider,b.accountName,b.connectionId,b.displayModel,b.clientIp,b.clientPort,b.clientUserAgent,b.clientHost,b.sourceTool,b.sourceToolLabel,b.sourceHost,b.contentMode,b.payloadHash,b.payloadSizeBytes,b.responsePayloadHash,b.responsePayloadSizeBytes,b.promptText,b.fullRequestJson,b.responseText,b.statusCode,b.errorText,JSON.stringify(b.meta||{})])}function X(a){return a?.denied===!0}function Y(a){let b,c,d;if(X(a))return{mirror:!1,reason:"denied"};if(!function(a){if(a?.usage)return!0;let b=String(a?.request?.headers?.["x-amz-target"]||"");if(/\.GenerateAssistantResponse$/i.test(b))return!0;let c=String(a?.path||"").split("?")[0].replace(/\/+$/,"");return t.test(c)}(a))return{mirror:!1,reason:"not-inference"};let e=function(a){try{let b=JSON.parse(JSON.stringify(a??null)),c=l(b);return JSON.parse(m(JSON.stringify(c)))}catch{return m(String(a??""))}}(a),{requestPayload:f,responsePayload:g}=(b=e.request||{},c=e.response||{},{requestPayload:{timestamp:e.timestamp,protocol:e.protocol||"http/1.1",method:e.method,endpoint:e.path,headers:b.headers||{},body:Q(b.body),capturedBytes:Number(b.capturedBytes||0),totalBytes:Number(b.totalBytes||0),wireSha256:b.wireSha256||null,truncated:!0===b.truncated},responsePayload:{timestamp:e.timestamp,protocol:e.protocol||"http/1.1",status:e.status,headers:c.headers||{},body:Q(c.body),capturedBytes:Number(c.capturedBytes||0),totalBytes:Number(c.totalBytes||0),wireSha256:c.wireSha256||null,truncated:!0===c.truncated}}),h=(d=R(f?.body??f??{}).join("\n\n"))?d.slice(0,2e3):null,i=function(a){let b=a?.body;if("string"==typeof b)return b.slice(0,2e3)||null;let c=R(b??a??{}).join("\n\n");return c?c.slice(0,2e3):null}(g),j=S(h)?h:null,k=S(i)?i:null;return j||k?{mirror:!0,safeEvent:e,requestPayload:f,responsePayload:g,promptText:j,responseText:k}:{mirror:!1,reason:"contentless"}}async function Z(a){if(X(a))return{written:!1,skipped:!0,reason:"denied"};let b=null;try{let c=await M();if(!c?.enabled)return{written:!1,disabled:!0};if("mysql"!==String(c.type||"").toLowerCase())return J(`Audit mirroring requires MySQL; current type is ${c.type||"unknown"}`),{written:!1,unsupported:!0};let d=Y(a);if(!d.mirror)return{written:!1,skipped:!0,reason:d.reason};let{safeEvent:e,requestPayload:f,responsePayload:h,promptText:i,responseText:j}=d,k=JSON.stringify(f),l=JSON.stringify(h),m=Math.max(0,Number(e.durationMs||0)),n=new Date(e.timestamp||Date.now()),o=Number.isNaN(n.getTime())?new Date:n,p=new Date(o.getTime()-m),t=P(p),u=P(o),v=T(e.client?.userAgent),w=String(e.provider||"other"),x=e.model?String(e.model):null,y=String(e.host||""),z=Number(e.port||443),A=String(e.path||""),B=y?`https://${y}${443!==z?`:${z}`:""}${A}`:null,C=await O(c);b=await C.getConnection();let[D,E]=await Promise.all([U(k),U(l)]);await b.beginTransaction();let F=await V(b,t,D,"request_json"),G=await V(b,u,E,"response_json"),H={source:q,auditEventId:e.id||null,protocol:e.protocol||"http/1.1",host:y||null,port:z,method:e.method||null,path:A||null,proxyUser:e.client?.proxyUser||null,durationMs:m,requestCapturedBytes:Number(e.request?.capturedBytes||0),requestTotalBytes:Number(e.request?.totalBytes||0),requestWireSha256:e.request?.wireSha256||null,requestTruncated:e.request?.truncated===!0,responseCapturedBytes:Number(e.response?.capturedBytes||0),responseTotalBytes:Number(e.response?.totalBytes||0),responseWireSha256:e.response?.wireSha256||null,responseTruncated:e.response?.truncated===!0,payloadHash:F?.payloadHash||null,payloadSizeBytes:F?.payloadSizeBytes||0,payloadStorage:F?"prompt_log_payloads":null,responsePayloadHash:G?.payloadHash||null,responsePayloadSizeBytes:G?.payloadSizeBytes||0,responsePayloadStorage:G?"prompt_log_payloads":null,...e.usage?{inputTokens:Number(e.usage.inputTokens||0),outputTokens:Number(e.usage.outputTokens||0),cacheReadTokens:Number(e.usage.cacheReadTokens||0),cacheCreationTokens:Number(e.usage.cacheCreationTokens||0),reasoningTokens:Number(e.usage.reasoningTokens||0),totalTokens:Number(e.usage.totalTokens||0),usageComplete:!0===e.usage.complete,usageSource:e.usage.source||null,stopReason:e.usage.stopReason||null}:{}},I=String(e.id||g.randomUUID()),K={sessionId:`audit-${I}`,sourceFormat:w,targetFormat:w,model:x,endpoint:A||null,providerUrl:B,provider:w,accountName:null,connectionId:null,displayModel:x?`${w}/${x}`:null,clientIp:e.client?.ip||null,clientPort:e.client?.port!=null?String(e.client.port):null,clientUserAgent:e.client?.userAgent||null,clientHost:y||null,sourceTool:v.tool,sourceToolLabel:v.label,sourceHost:y||null};return await W(b,{...K,id:`${I}:request`,createdAt:t,stage:r,contentMode:e.request?.body?"raw_json_preview":"metadata_only",payloadHash:F?.payloadHash||null,payloadSizeBytes:F?.payloadSizeBytes||0,responsePayloadHash:null,responsePayloadSizeBytes:0,promptText:i,fullRequestJson:null,responseText:null,statusCode:null,errorText:null,meta:{...H,auditDirection:"request"}}),await W(b,{...K,id:`${I}:response`,createdAt:u,stage:s,contentMode:e.response?.body?"raw_json_preview":"metadata_only",payloadHash:null,payloadSizeBytes:0,responsePayloadHash:G?.payloadHash||null,responsePayloadSizeBytes:G?.payloadSizeBytes||0,promptText:null,fullRequestJson:null,responseText:j,statusCode:null!=e.status?Number(e.status):null,errorText:e.error||null,meta:{...H,auditDirection:"response"}}),await b.commit(),{written:!0,rowsWritten:2}}catch(a){if(b)try{await b.rollback()}catch{}return J(`Failed to mirror audit event to prompt_logs: ${a.message||a}`),{written:!1,error:a.message||String(a)}}finally{try{b?.release()}catch{}}}async function $(){return x||(x=Promise.resolve().then(c.bind(c,77638))),x}async function _(a,b,d){if(!b||!d)return 0;try{z||(z=Promise.resolve().then(c.bind(c,97914))),y||(y=c.e(7341).then(c.bind(c,57341)));let[e,f]=await Promise.all([z,y]),g=await e.getPricingForModel(a,b);if(!g)return 0;let h=f.calculateCostFromTokens(d,g);return Number.isFinite(h)&&h>0?h:0}catch{return 0}}async function aa(a,b){let c=a?.usage,d=!!(c&&(c.inputTokens||c.outputTokens||c.cacheReadTokens||c.cacheCreationTokens||c.reasoningTokens)),e=Number(a?.status),f=String(a?.path||"").split("?")[0].replace(/\/+$/,""),g=!a?.error&&Number.isFinite(e)&&e>=200&&e<300&&"POST"===String(a?.method||"").toUpperCase()&&t.test(f);if(!d&&!g)return{written:!1,skipped:!0};let h=d?c:{inputTokens:0,outputTokens:0,cacheReadTokens:0,cacheCreationTokens:0,reasoningTokens:0,totalTokens:0,model:c?.model||null,stopReason:c?.stopReason||null,streaming:c?.streaming===!0,complete:!1,source:c?.source||"missing"},i=String(a.provider||"other"),j=a.model||h.model||null,k=n(h),l=a.timestamp||new Date().toISOString(),m=Number.isFinite(e)&&e>=200&&e<300,r=!!a.error&&m&&!0===h.complete,s=!r&&(a.error||a.status&&a.status>=400)?"error":"success",u=a.error?String(a.error).slice(0,500):null,v=r?null:u;p({timestamp:l,provider:i,model:j,connectionId:"",endpoint:a.path||null,requestId:a.id||null,cost:0,status:s,statusCode:null!=a.status?Number(a.status):null,errorMessageShort:v,tokens:k,sourceTool:b.tool,sourceToolLabel:b.label});try{let c=await $();if(!await c.isMysqlObservabilityEnabled())return{written:!1,disabled:!0,realtimePublished:!0};let e=await _(i,j,k),f=await c.saveMysqlUsageEvent({timestamp:l,provider:i,model:j,endpoint:a.path||null,requestId:a.id||null,sessionId:a.id?`audit-${a.id}`:null,apiKeyOwner:a.client?.dashboardUser?.userId||null,apiKeyName:a.client?.dashboardUser?`Audit Proxy — ${a.client.dashboardUser.displayName||a.client.dashboardUser.userId}`:null,clientIp:a.client?.ip||null,clientIpNormalized:a.client?.ip||null,clientHost:a.host||null,clientUserAgent:a.client?.userAgent||null,sourceTool:b.tool,sourceToolLabel:b.label,sourceHost:a.host||null,latencyMs:Math.max(0,Number(a.durationMs||0)),statusCode:null!=a.status?Number(a.status):null,errorMessageShort:v,isStreaming:!0===h.streaming,promptTokens:o(h),completionTokens:h.outputTokens,totalTokens:h.totalTokens,cachedTokens:h.cacheReadTokens,cacheCreationTokens:h.cacheCreationTokens,reasoningTokens:h.reasoningTokens,cost:e,status:s,tokens:k,meta:{source:q,auditEventId:a.id||null,host:a.host||null,method:a.method||null,stopReason:h.stopReason||null,usageComplete:!0===h.complete,usageSource:h.source||null,usageMissing:!d,responseTruncated:a.response?.truncated===!0,transportError:u,settledAfterUsage:r}});return f&&global._usageStatsCache?.clear?.(),{written:!!f,realtimePublished:!0}}catch(a){return J(`Failed to mirror audit usage to usage_events: ${a.message||a}`),{written:!1,error:a.message||String(a)}}}async function ab(a,b){let c;j();let f=(Number.isNaN((c=a?new Date(a):new Date).getTime())?new Date:c).toISOString().slice(0,10),g=H.get(f);if(!g){let a=await d.promises.readdir(i).catch(()=>[]),b=RegExp(`^audit-${f.replace(/-/g,"\\-")}(?:\\.(\\d+))?\\.jsonl$`),c=0;for(let d of a){let a=d.match(b);a&&(c=Math.max(c,Number(a[1]||0)))}let h=e.join(i,`audit-${f}${c?`.${c}`:""}.jsonl`),j=await d.promises.stat(h).catch(()=>null);g={segment:c,filePath:h,size:j?.size||0},H.set(f,g)}return g.size>0&&g.size+b>0x8000000&&(g={segment:g.segment+1,filePath:e.join(i,`audit-${f}.${g.segment+1}.jsonl`),size:0},H.set(f,g)),g}async function ac(a){let b=`${JSON.stringify(a)}
 `,c=Buffer.byteLength(b),e=await ab(a.timestamp,c);return await d.promises.appendFile(e.filePath,b,{encoding:"utf8",mode:384}),e.size+=c,e.filePath}async function ad(a){try{let b,c=await L(Promise.resolve(a.finalize()),"Audit event finalize"),d=L((D=(b=D.then(()=>ac(c))).then(()=>void 0,()=>void 0),b),"Local JSONL write").catch(a=>(I.localFailed+=1,K(`Local JSONL write failed: ${a.message||a}`),null)),e=L(Z(c),"Prompt log mirror").catch(a=>({written:!1,error:a.message||String(a)})),f=L(aa(c,T(c.client?.userAgent)),"Usage mirror").catch(a=>({written:!1,error:a.message||String(a)})),[,g,h]=await Promise.all([d,e,f]);if(g?.written)I.mysqlWritten+=1;else if(g?.error)I.mysqlFailed+=1;else if(g?.skipped){I.mysqlSkipped+=1;let a=String(g.reason||"unknown");I.mysqlSkippedByReason[a]=(I.mysqlSkippedByReason[a]||0)+1}h?.written?I.usageWritten+=1:h?.error&&(I.usageFailed+=1),c.usage&&(I.tokensSeen+=Number(c.usage.totalTokens||0)),I.written+=1,I.lastWrittenAt=new Date().toISOString()}catch(a){I.failed+=1,K(a.message||a)}}async function ae(){I.activeWorkers+=1;try{for(;!I.clearing;){let a=I.queue.shift();if(!a)break;await ad(a)}}finally{I.activeWorkers=Math.max(0,I.activeWorkers-1)}}function af(){if(!I.clearing)for(;I.queue.length&&I.activeWorkers<4;){let a;a=ae().finally(()=>{I.workers.delete(a),!I.clearing&&I.queue.length&&setImmediate(af)}),I.workers.add(a)}}function ag(a){return"function"==typeof a&&(I.queue.length>=1e3?(I.dropped+=1,K(`Audit queue full; dropped event ${I.dropped}`),!1):(I.queue.push({finalize:a,enqueuedAt:Date.now()}),I.enqueued+=1,I.clearing||setImmediate(af),!0))}async function ah(){j();let a=(await d.promises.readdir(i).catch(()=>[])).filter(a=>/^audit-\d{4}-\d{2}-\d{2}(?:\.\d+)?\.jsonl$/.test(a)).sort((a,b)=>b.localeCompare(a,void 0,{numeric:!0})).map(a=>e.join(i,a));return d.existsSync(h)&&a.push(h),a}async function ai(a,b){let c=await d.promises.stat(a).catch(()=>null);if(!c?.size||b<=0)return[];let e=await d.promises.open(a,"r");try{let a=c.size,d=Buffer.alloc(0),f=0;for(;a>0&&d.length<0x4000000&&f<=b;){let b=Math.min(262144,a,0x4000000-d.length);a-=b;let c=Buffer.alloc(b);await e.read(c,0,b,a),d=Buffer.concat([c,d]),f+=c.reduce((a,b)=>a+ +(10===b),0)}let g=d.toString("utf8");if(a>0){let a=g.indexOf("\n");g=a>=0?g.slice(a+1):""}return g.split("\n").filter(Boolean).slice(-b).reverse().map(a=>{try{return JSON.parse(a)}catch{return null}}).filter(Boolean)}finally{await e.close()}}async function aj(a=50){let b=Math.max(1,Math.min(1e3,Number(a)||50)),c=[];for(let a of(await ah())){if(c.length>=b)break;let d=await ai(a,b-c.length);c.push(...d)}return c.slice(0,b)}async function ak(a){if(!d.existsSync(h))return;let b=`${h}.tmp`,c=d.createReadStream(h,{encoding:"utf8"}),e=d.createWriteStream(b,{encoding:"utf8",mode:384});for await(let b of f.createInterface({input:c,crlfDelay:1/0}))if(b)try{let c=JSON.parse(b);Date.parse(c.timestamp||0)>=a&&e.write(`${b}
 `)}catch{}await new Promise((a,b)=>{e.end(a),e.once("error",b)}),await d.promises.rename(b,h)}async function al(){j();let a=k(),b=Date.now()-24*a.retentionDays*36e5;for(let a of(await d.promises.readdir(i).catch(()=>[]))){if(!/^audit-\d{4}-\d{2}-\d{2}(?:\.\d+)?\.jsonl$/.test(a))continue;let c=e.join(i,a),f=await d.promises.stat(c).catch(()=>null);if(f&&f.mtimeMs<b)for(let[a,b]of(await d.promises.unlink(c).catch(()=>{}),H.entries()))b.filePath===c&&H.delete(a)}await ak(b).catch(a=>K(`Legacy log prune failed: ${a.message||a}`))}async function am(a=5e3){let b=Date.now()+Math.max(0,Number(a)||0);for(;(I.queue.length||I.activeWorkers)&&Date.now()<b;){af();let a=[...I.workers];a.length?await Promise.race([Promise.allSettled(a),new Promise(a=>setTimeout(a,50))]):await new Promise(a=>setTimeout(a,10))}let c=0===I.queue.length&&0===I.activeWorkers;return c||(I.flushTimeouts+=1),c}let an=async()=>{let a=I.queue.length;(a||I.activeWorkers)&&(await am(1e4)?console.log(`[AuditProxy][Store] flushed ${a} queued audit event(s) before shutdown`):K(`Shutdown flush incomplete; ${I.queue.length} audit event(s) still queued`))};async function ao(){let a=null;try{let b=await M();if(!b?.enabled||"mysql"!==String(b.type||"").toLowerCase())return;let c=await O(b);a=await c.getConnection(),await a.beginTransaction();let d="(stage = ? OR (session_id LIKE 'audit-%' AND stage IN (?, ?)))",[e]=await a.query(`SELECT payload_hash, response_payload_hash FROM prompt_logs WHERE ${d}`,[q,r,s]);await a.query(`DELETE FROM prompt_logs WHERE ${d}`,[q,r,s]);let f=new Map;for(let a of e||[])for(let b of[a.payload_hash,a.response_payload_hash]){let a=String(b||"").trim();a&&f.set(a,(f.get(a)||0)+1)}let g=[];for(let[b,c]of f.entries()){await a.query("UPDATE prompt_log_payloads SET ref_count = GREATEST(ref_count - ?, 0) WHERE payload_hash = ?",[c,b]);let[d]=await a.query(`DELETE p FROM prompt_log_payloads p
           WHERE p.payload_hash = ?

package/app/.next-cli-build/server/chunks/9489.js

@@ -1 +1 @@
-"use strict";exports.id=9489,exports.ids=[9489],exports.modules={18910:(a,b,c)=>{c.d(b,{Pr:()=>s,UP:()=>q,Vu:()=>r});var d=c(12557),e=c(43659),f=c(11893);let g=new Map,h=new Map,i=0;function j(a){return"client_ip"===a||"client_session"===a?a:"global"}function k(a){let b=Number.parseInt(a,10);return!Number.isFinite(b)||b<=0?120:Math.min(b,10080)}function l(a,b){let c=[...a];for(let a=0;a<b;a++){let a=c.shift();c.push(a)}return c}function m(a){let b=g.get(a);return"number"==typeof b?{index:b,consecutiveUseCount:0}:b||{index:0,consecutiveUseCount:0}}function n(a,b,c,d){let e=m(a).consecutiveUseCount+1;e>=d?g.set(a,{index:(b+1)%c,consecutiveUseCount:0}):g.set(a,{index:b,consecutiveUseCount:e})}function o(a,b,c){let d=b||"__default__",e=m(d).index%a.length,f=l(a,e);return n(d,e,a.length,c),f}function p(a,b){return{model:a,label:a,provider:b||"combo"}}function q(a){if(!a){g.clear(),h.clear();return}g.delete(a);let b=`${a}::`;for(let a of h.keys())a.startsWith(b)&&h.delete(a)}function r(a,b){if(a.includes("/"))return null;let c=(Array.isArray(b)?b:b?.combos||[]).find(b=>b.name===a);return c&&c.models&&c.models.length>0?c.models:null}async function s({body:a,models:b,handleSingleModel:c,log:g,comboName:q,comboStrategy:r,comboStickyLimit:t=1,comboStickyScope:u="global",comboStickyTtlMinutes:v=120,comboStickyContext:w=null,sourceFormat:x=null}){let y=r||"fallback",z=function(a,b,c,d=1,e={}){let g;if(!a||a.length<=1)return a;let q=c||"fallback",r=a.map(a=>p(a,b));if((0,f.OI)(r),"least-latency"===q||"least_latency"===q)return(0,f.Gc)(r,{includeSkippedAtEnd:!0}).map(a=>a.model);if("p2c"===q||"power-of-two"===q||"power_of_two"===q)return(0,f.ZL)(r,{includeSkippedAtEnd:!0}).map(a=>a.model);if("round-robin"!==q)return a;let s=Number.isFinite(g=Number.parseInt(d,10))&&g>0?g:1,t=j(e.stickyScope),u=k(e.stickyTtlMinutes);return"global"===t?o(a,b,s):function(a,b,c,d,e,f){let g,p=Date.now();if(!(p-i<6e4))for(let[a,b]of(i=p,h.entries()))(!b?.expiresAt||b.expiresAt<=p)&&h.delete(a);let q=j(d),r="global"!==(g=j(q))&&f?.key?`${b||"__default__"}::${g}::${f.key}`:null;if(!r)return o(a,b,c);let s=Date.now(),t=6e4*k(e),u=h.get(r);if(u&&u.expiresAt>s){let b=Number.isFinite(u.index)?u.index:0;if(u.model){let c=a.indexOf(u.model);c>=0&&(b=c)}return b%=a.length,h.set(r,{...u,index:b,model:a[b],lastUsedAt:s,expiresAt:s+t}),l(a,b)}let v=b||"__default__",w=m(v).index%a.length;return h.set(r,{index:w,model:a[w],stickyScope:q,stickyKey:f.key,sessionId:f.sessionId||null,clientIp:f.clientIp||null,createdAt:s,lastUsedAt:s,expiresAt:s+t}),n(v,w,a.length,c),l(a,w)}(a,b,s,t,u,e.stickyContext||null)}(b,q,y,t,{stickyScope:u,stickyTtlMinutes:v,stickyContext:w});["round-robin","least-latency","least_latency","p2c","power-of-two","power_of_two"].includes(y)&&g?.debug?.("COMBO",`${y} combo "${q||"__default__"}" | sticky=${u||"global"}${w?.label?` | key=${w.label}`:""}`);let A=null,B=null,C=null;for(let b=0;b<z.length;b++){let e=z[b],h=p(e,q),i=(0,f.kb)(h);if(i.skipped&&b<z.length-1){g?.warn?.("COMBO",`Skipping ${e}: ${i.reason}`);continue}let j=Date.now();g.info("COMBO",`Trying model ${b+1}/${z.length}: ${e}`);try{let b=await c(a,e),k=Date.now()-j;if(i.end?.(),b.ok)return(0,f.Fg)(h,k),g.info("COMBO",`Model ${e} succeeded`),b;let l=b.statusText||"",m=null;try{let a=await b.clone().json();l=a?.error?.message||a?.error||a?.message||l,m=a?.retryAfter||null}catch{}if("string"!=typeof l)try{l=JSON.stringify(l)}catch{l=String(l)}(0,f.h6)(h,{status:b.status,message:l}),m&&(!B||new Date(m)<new Date(B))&&(B=m);let{shouldFallback:n,cooldownMs:o}=(0,d.L5)(b.status,l);if(!n)return g.warn("COMBO",`Model ${e} failed (no fallback)`,{status:b.status}),b;o&&o>0&&o<=5e3&&[502,503,504].includes(b.status)&&(g.info("COMBO",`Model ${e} transient ${b.status}, waiting ${o}ms before next`),await new Promise(a=>setTimeout(a,o))),A=l||String(b.status),C=b.status,g.warn("COMBO",`Model ${e} failed, trying next`,{status:b.status})}catch(a){i.end?.(),A=a.message||String(a),C=Number(a?.status||a?.statusCode)||500,(0,f.h6)(h,a),g.warn("COMBO",`Model ${e} threw error, trying next`,{error:A})}}let D=A&&A.toLowerCase().includes("no credentials")?503:C||503,E=A||"All combo models unavailable";if(B){let a=(0,d.Qo)(B);return g.warn("COMBO",`All models failed | ${E} (${a})`),(0,e.wO)(D,E,B,a,x)}return g.warn("COMBO",`All models failed | ${E}`),(0,e.yj)(D,E,x)}},29069:(a,b,c)=>{c.d(b,{HX:()=>i,mH:()=>j});var d=c(11893),e=c(43659);function f(a){return String(a||"").trim()}function g(a){return Array.isArray(a)?[...new Set(a.map(a=>f(a)).filter(Boolean))]:"string"==typeof a?[...new Set(a.split(/[\n,;]+/).map(a=>f(a)).filter(Boolean))]:a&&"object"==typeof a?Object.entries(a).filter(([,a])=>!1!==a&&null!=a).map(([a,b])=>!0===b?f(a):`${f(a)}:${f(b)}`).filter(Boolean):[]}function h(a){if(!a||"object"!=typeof a)return null;let b=f(a.name||a.id||a.exposedModel||a.model),c=f(a.exposedModel||a.model||a.name||a.id),d=f(a.type||"virtual");if("ollama-local"===d.toLowerCase())return null;let e=(a.targets||a.endpoints||a.models||[]).map(b=>(function(a,b={}){if("string"==typeof a)return{model:f(a),label:f(a),tags:[]};if(!a||"object"!=typeof a)return null;let c=f(a.model||a.value||a.id||a.fullModel);return c?{...a,id:f(a.id)||f(a.connectionId)||c,model:c,label:f(a.label||a.name||a.displayName)||c,connectionId:f(a.connectionId||a.connection_id||a.accountId),provider:f(a.provider||b.provider),endpoint:f(a.endpoint||a.baseUrl||a.baseURL||a.url),tags:g(a.tags||a.labels||a.routingTags),maxInFlight:Number(a.maxInFlight||a.maxInFlightPerTarget||b.maxInFlight||0)||void 0}:null})(b,a)).filter(Boolean);return b&&c&&0!==e.length?{...a,name:b,id:f(a.id)||b,exposedModel:c,enabled:!1!==a.enabled,type:d,strategy:f(a.strategy||a.fallbackStrategy||"least-latency"),requiredTags:g(a.requiredTags||a.tags),modelTagRules:function(a){if(!a||"object"!=typeof a)return{};let b={};for(let[c,d]of Object.entries(a)){let a=f(c),e=g(d);a&&e.length&&(b[a]=e)}return b}(a.modelTagRules||a.requiredTagsByModel||a.tagRules),targets:e}:null}function i(a={},b=""){let c=f(b);return c&&(function(a={}){let b=a.virtualCombos||[];return(Array.isArray(b)?b:Object.values(b||{})).map(h).filter(Boolean)})(a).find(a=>!1!==a.enabled&&(a.exposedModel===c||a.name===c))||null}async function j({body:a,combo:b,handleSingleTarget:c,log:g,sourceFormat:i=null}){let k,l,m,n,o=f(a?.model||b?.exposedModel||b?.name),p=h(b);if(!p)return(0,e.yj)(400,"Invalid virtual combo",i);let q=(k=[...p.targets],l=p.modelTagRules||{},0===(k=(k=(0,d.OF)(k,o,l)).filter(a=>(function(a,b=[]){if(!b.length)return!0;let c=new Set((a.tags||[]).map(a=>String(a).toLowerCase()));return b.every(a=>c.has(String(a).toLowerCase()))})(a,p.requiredTags||[]))).length&&(k=[...p.targets]),m=k.map(a=>({...a,id:a.id||`${p.name}:${a.model}:${a.connectionId||"any"}`,connectionId:a.connectionId||"",provider:a.provider||"virtual-combo",providerLabel:p.name,label:a.label||a.model,model:o||p.exposedModel,upstreamModel:a.model,endpoint:a.endpoint||"",tags:a.tags||[],maxInFlight:a.maxInFlight})),(0,d.OI)(m),("p2c"===(n=String(p.strategy||"least-latency").toLowerCase())||"power-of-two"===n||"power_of_two"===n?(0,d.ZL)(m,{model:o,modelTagRules:l,includeSkippedAtEnd:!0}):"fallback"===n||"priority"===n?(0,d.Gc)(m,{model:o,modelTagRules:l,preserveOrder:!0,includeSkippedAtEnd:!0}):(0,d.Gc)(m,{model:o,modelTagRules:l,includeSkippedAtEnd:!0})).map(a=>({healthTarget:a,target:k.find(b=>a.upstreamModel===b.model&&(a.connectionId||"")===(b.connectionId||""))})).filter(a=>a.target)),r="All virtual combo targets unavailable",s=503;g?.info?.("VIRTUAL_COMBO",`Virtual combo "${p.name}" -> ${q.length} target(s), strategy=${p.strategy}`);for(let b=0;b<q.length;b+=1){let{target:e,healthTarget:f}=q[b],h=(0,d.kb)(f);if(h.skipped){g?.warn?.("VIRTUAL_COMBO",`Skip ${e.label||e.model}: ${h.reason}`);continue}let i=Date.now();try{let j={...a,model:e.model};g?.info?.("VIRTUAL_COMBO",`Trying ${b+1}/${q.length}: ${e.label||e.model}`);let k=await c(j,e),l=Date.now()-i;if(k?.ok)return(0,d.Fg)(f,l),h.end(),k;let m=k?.statusText||"request_failed";try{let a=await k.clone().json();m=a?.error?.message||a?.error||a?.message||m}catch{}s=k?.status||503,r="string"==typeof m?m:JSON.stringify(m),(0,d.h6)(f,{status:s,message:r}),g?.warn?.("VIRTUAL_COMBO",`${e.label||e.model} failed`,{status:s})}catch(a){s=500,r=a?.message||String(a),(0,d.h6)(f,a),g?.warn?.("VIRTUAL_COMBO",`${e.label||e.model} threw`,{error:r})}finally{h.end()}}return(0,e.yj)(s||503,r,i)}},38775:(a,b,c)=>{c.d(b,{d_:()=>h,gL:()=>i,mA:()=>g});var d=c(89718),e=c(40669);let f={xmtp:"xiaomi-tokenplan","xiaomi-tokenplan":"xiaomi-tokenplan"};async function g(a){let b,c=(b=(0,e.Xh)(a),b?.providerAlias&&f[b.providerAlias]?{...b,provider:f[b.providerAlias]}:b);if(!c.isAlias){let a=(await (0,d.getProviderNodes)({type:"openai-compatible"})).find(a=>a.prefix===c.providerAlias);if(a)return{provider:a.id,model:c.model};let b=(await (0,d.getProviderNodes)({type:"anthropic-compatible"})).find(a=>a.prefix===c.providerAlias);if(b)return{provider:b.id,model:c.model};let e=(await (0,d.getProviderNodes)({type:"custom-embedding"})).find(a=>a.prefix===c.providerAlias);return e?{provider:e.id,model:c.model}:{provider:c.provider,model:c.model}}return await (0,d.getComboByName)(c.model)?{provider:null,model:c.model}:(0,e.js)(a,d.getModelAliases)}async function h(a){if(a.includes("/"))return null;let b=await (0,d.getComboByName)(a);return b&&b.models&&b.models.length>0?b.models:null}async function i(a,b){if(!a||a.includes("/"))return null;let c=String(b||"").trim().toLowerCase();if(!c)return null;let e=await (0,d.getCloudComboById)(a);return e&&!1!==e.isActive&&String(e.ownerUser||"").trim().toLowerCase()===c&&e.models&&0!==e.models.length?e:null}},42318:(a,b,c)=>{function d(a={},b){let c=String(b||"").toLowerCase();for(let[b,d]of Object.entries(a||{}))if(String(b).toLowerCase()===c)return String((Array.isArray(d)?d[0]||"":d||"")||"");return""}function e({body:a,headers:b={},scope:c="global",fallbackToClientIp:f=!0}){if("client_ip"!==c&&"client_session"!==c)return null;let g=function(a={}){return String(d(a,"x-9r-client-ip")||d(a,"x-forwarded-for")||d(a,"x-real-ip")||d(a,"cf-connecting-ip")||"").split(",")[0].trim().replace(/^::ffff:/,"").replace(/^::1$/,"127.0.0.1")}(b),h=function(a={}){return d(a,"x-9r-source-tool")||d(a,"originator")||d(a,"copilot-integration-id")||""}(b),i="client_session"===c?String(function(a,b={}){return d(b,"x-client-session-id")||d(b,"session_id")||d(b,"session-id")||d(b,"x-session-id")||d(b,"x-interaction-id")||d(b,"conversation_id")||d(b,"conversation-id")||d(b,"x-conversation-id")||a?.conversationId||a?.conversation_id||a?.sessionId||a?.session_id||a?.metadata?.conversationId||a?.metadata?.conversation_id||a?.metadata?.sessionId||a?.metadata?.session_id||a?.conversationState?.conversationId||a?.conversationState?.sessionId||a?.conversationState?.currentConversationId||""}(a,b)||""):"";return"client_session"===c&&i?{key:[h||"tool",g||"unknown-ip",i].join("::"),label:i,scope:c,sourceTool:h,clientIp:g,sessionId:i}:"client_session"===c&&!1===f?null:g?{key:[h||"tool",g].join("::"),label:g,scope:"client_ip",sourceTool:h,clientIp:g,sessionId:""}:null}c.d(b,{lV:()=>e})},79489:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{P:()=>V});var e=c(27513),f=c(48895),g=c(80238),h=c(89718),i=c(33669),j=c(490),k=c(38775),l=c(92500),m=c(43659),n=c(18910),o=c(42318),p=c(29069),q=c(41004),r=c(14170),s=c(57647),t=c(7803),u=c(67828),v=c(38160),w=c(35901),x=c(97242),y=c(86171),z=c(75681),A=a([f,g,l]);function B(a,b){try{let c=a?.url?new URL(a.url).pathname:"";return(0,r.t)(c,b)||(0,s.Tz)(b||{})}catch{return null}}function C({request:a,clientRawRequest:b,body:c,apiKey:d,model:e,provider:f="gateway",connectionId:g="",statusCode:h=500,errorCode:i="gateway_error",errorType:j="gateway",errorSource:k="gateway_validation",message:l="Gateway error"}){try{let m=b?.headers||{},n=b?.endpoint||"";if(a)try{m=m&&Object.keys(m).length?m:Object.fromEntries(a.headers.entries()),n=n||new URL(a.url).pathname}catch{}let o=(0,y.wS)({headers:m,requestId:b?.requestId,sessionId:b?.sessionId}),p={...o,requestContext:o,provider:f,model:e||c?.model||"unknown",connectionId:g,apiKey:d,endpoint:n,gatewayStatusCode:h,errorSource:k,errorType:j,errorCode:i,errorMessageShort:l,latencyMs:0};(0,w.jk)(p).catch(()=>{}),(0,y.sx)({provider:f,model:e||c?.model||"unknown",connectionId:g,apiKey:d,endpoint:n,statusCode:h,errorCode:i,errorType:j,errorMessage:l,requestContext:o,meta:{errorSource:k}})}catch{}}function D(a){return a&&"object"==typeof a&&!Array.isArray(a)}function E(a,b){return Object.prototype.hasOwnProperty.call(a||{},b)}function F(a){return null==a?"":String(a).trim()}[f,g,l]=A.then?(await A)():A;let X=new Set(["claude","codex"]);function G(a,{min:b,max:c,precision:d=3}={}){if(null==a||""===a)return;let e=Number(a);if(!Number.isFinite(e))return;let f=Math.min(c,Math.max(b,e));return Number(f.toFixed(d))}function H(a,{min:b,max:c}={}){let d=G(a,{min:b,max:c,precision:0});return void 0===d?void 0:Math.trunc(d)}function I(a){if(!0===a)return"on";if(!1===a)return"off";let b=F(a).toLowerCase();return["on","true","1","enable","enabled"].includes(b)?"on":["off","false","0","disable","disabled"].includes(b)?"off":["inherit","default","request","client"].includes(b)?"inherit":void 0}let Y=["temperature","top_p","top_k","min_p","presence_penalty","max_tokens"];function J(a={}){let b=D(a)?a:{},c={};if(E(b,"temperature")){let a=G(b.temperature,{min:0,max:2});void 0!==a&&(c.temperature=a)}if(E(b,"top_p")||E(b,"topP")){let a=G(b.top_p??b.topP,{min:.01,max:1});void 0!==a&&(c.top_p=a)}if(E(b,"top_k")||E(b,"topK")){let a=H(b.top_k??b.topK,{min:0,max:1e3});void 0!==a&&(c.top_k=a)}if(E(b,"min_p")||E(b,"minP")){let a=G(b.min_p??b.minP,{min:0,max:1});void 0!==a&&(c.min_p=a)}let d=b.presence_penalty??b.presencePenalty??b["presence-penalty"];if(E(b,"presence_penalty")||E(b,"presencePenalty")||E(b,"presence-penalty")){let a=G(d,{min:-2,max:2});void 0!==a&&(c.presence_penalty=a)}let e=b.max_tokens??b.maxTokens??b.max_token;if(E(b,"max_tokens")||E(b,"maxTokens")||E(b,"max_token")){let a=H(e,{min:1,max:262144});void 0!==a&&(c.max_tokens=a)}return c}function K(a={},b={},c=null){let d=J(b),e={...a};return void 0!==d.temperature&&(e.temperature=d.temperature),void 0!==d.top_p&&(e.top_p=d.top_p),c?.supportsExtendedSampling===!0&&(void 0!==d.top_k&&(e.top_k=d.top_k),void 0!==d.min_p&&(e.min_p=d.min_p)),void 0!==d.presence_penalty&&(e.presence_penalty=d.presence_penalty),void 0!==d.max_tokens&&(e.max_tokens=d.max_tokens,E(e,"max_completion_tokens")&&delete e.max_completion_tokens),e}function L(a={}){let b=D(a)?a:{},c={};if(E(b,"temperature")){let a=G(b.temperature,{min:0,max:2});void 0!==a&&(c.temperature=a)}if(E(b,"top_p")||E(b,"topP")){let a=G(b.top_p??b.topP,{min:.01,max:1});void 0!==a&&(c.top_p=a)}if(E(b,"top_k")||E(b,"topK")){let a=H(b.top_k??b.topK,{min:0,max:1e3});void 0!==a&&(c.top_k=a)}if(E(b,"min_p")||E(b,"minP")){let a=G(b.min_p??b.minP,{min:0,max:1});void 0!==a&&(c.min_p=a)}let d=b.presence_penalty??b.presencePenalty??b["presence-penalty"];if(E(b,"presence_penalty")||E(b,"presencePenalty")||E(b,"presence-penalty")){let a=G(d,{min:-2,max:2});void 0!==a&&(c.presence_penalty=a)}let e=b.max_tokens??b.maxTokens??b.max_token;if(E(b,"max_tokens")||E(b,"maxTokens")||E(b,"max_token")){let a=H(e,{min:1,max:262144});void 0!==a&&(c.max_tokens=a)}let f=b.reasoning_budget??b.reasoningBudget??b["reasoning-budget"];if(E(b,"reasoning_budget")||E(b,"reasoningBudget")||E(b,"reasoning-budget")){let a=H(f,{min:0,max:262144});void 0!==a&&(c.reasoning_budget=a)}let g=b.inheritThinkRequestOverrides??b.thinkRequestOverrides??b.thinkingOnRequestOverrides;if(E(b,"inheritThinkRequestOverrides")||E(b,"thinkRequestOverrides")||E(b,"thinkingOnRequestOverrides")){let a=J(g);Object.keys(a).length>0&&(c.inheritThinkRequestOverrides=a)}let h=b.inheritNoThinkRequestOverrides??b.noThinkRequestOverrides??b.thinkingOffRequestOverrides;if(E(b,"inheritNoThinkRequestOverrides")||E(b,"noThinkRequestOverrides")||E(b,"thinkingOffRequestOverrides")){let a=J(h);Object.keys(a).length>0&&(c.inheritNoThinkRequestOverrides=a)}let i=I(b.thinkingMode??b.thinking);if(i&&"inherit"!==i&&(c.thinkingMode=i),"off"===c.thinkingMode&&delete c.reasoning_budget,!c.thinkingMode){let a=J(c);if(Object.keys(a).length>0)for(let b of(c.inheritThinkRequestOverrides={...a,...c.inheritThinkRequestOverrides||{}},c.inheritNoThinkRequestOverrides={...a,...c.inheritNoThinkRequestOverrides||{}},Y))delete c[b]}return c}function M(a={}){let b={...a};return E(b,"reasoning_budget")&&delete b.reasoning_budget,E(b,"thinking_token_budget")&&delete b.thinking_token_budget,b}function N(a={},b,c){let d=function(a={}){let b={...a};if(E(b,"enable_thinking")&&delete b.enable_thinking,D(b.chat_template_kwargs)&&E(b.chat_template_kwargs,"enable_thinking")){let a={...b.chat_template_kwargs};delete a.enable_thinking,Object.keys(a).length?b.chat_template_kwargs=a:delete b.chat_template_kwargs}return b}(a);return!0===b.supportsChatTemplateKwargs&&(d.chat_template_kwargs={...D(d.chat_template_kwargs)?d.chat_template_kwargs:{},enable_thinking:c}),d}function O(a={},b,c){let d=M(a);return b.reasoningBudgetField&&(d[b.reasoningBudgetField]=c),d}function P(a={}){if(D(a.chat_template_kwargs)&&E(a.chat_template_kwargs,"enable_thinking"))return!0===a.chat_template_kwargs.enable_thinking;if(E(a,"enable_thinking"))return!0===a.enable_thinking;if(E(a,"reasoning_budget"))return H(a.reasoning_budget,{min:0,max:262144})>0;if(E(a,"thinking_token_budget"))return H(a.thinking_token_budget,{min:0,max:262144})>0;if(D(a.thinking)){let b=F(a.thinking.type).toLowerCase();if(["enabled","on","true","adaptive","auto"].includes(b))return!0;if(["disabled","off","false"].includes(b))return!1}return null}function Q(a={},b=null){let c=D(a)?a:{};return"think"===b?J(c.inheritThinkRequestOverrides??c.thinkRequestOverrides??c.thinkingOnRequestOverrides??{}):"nothink"===b?J(c.inheritNoThinkRequestOverrides??c.noThinkRequestOverrides??c.thinkingOffRequestOverrides??{}):{}}function R({body:a={},overrides:b={},apiKeyForceThinkingOff:c=!1}={}){let d=D(b)?b:{},e=I(d.thinkingMode??d.thinking);return"on"===e||"off"===e?null:c?"nothink":!0===P(a)?"think":"nothink"}function S(a,b,c=null){var d;let e;if(c)return{comboStrategy:c.strategy||"fallback",comboStickyLimit:1,comboStickyScope:c.stickyScope||"global",comboStickyTtlMinutes:120,comboStickyFallbackToClientIp:!0,requestOverrides:{},contentLoggingMode:void 0};let f=(a.comboStrategies||{})[b]||{};return{comboStrategy:f.fallbackStrategy||a.comboStrategy||"fallback",comboStickyLimit:f.stickyRoundRobinLimit||f.stickyLimit||a.comboStickyRoundRobinLimit||1,comboStickyScope:f.stickyScope||a.comboRoundRobinStickyScope||"global",comboStickyTtlMinutes:f.stickyTtlMinutes||a.comboRoundRobinStickyTtlMinutes||120,comboStickyFallbackToClientIp:void 0!==f.stickyFallbackToClientIp?f.stickyFallbackToClientIp:!1!==a.comboStickyFallbackToClientIp,requestOverrides:L(f.requestOverrides||{}),contentLoggingMode:(d=f.contentLoggingMode,e=F(d).toLowerCase(),"enabled"===e||"disabled"===e?e:"inherit")}}async function T({body:a,modelStr:b,comboModels:c,settings:d,clientRawRequest:e,request:f,apiKey:g,apiKeyForceThinkingOff:h=!1,cloudCombo:i=null}){let j=B(f,a),k=S(d,b,i),l=(0,o.lV)({body:a,headers:e?.headers||{},scope:k.comboStickyScope,fallbackToClientIp:k.comboStickyFallbackToClientIp});return t.info("CHAT",`Combo "${b}" with ${c.length} models (strategy: ${k.comboStrategy}, stickyLimit: ${k.comboStickyLimit}, stickyScope: ${k.comboStickyScope})`),(0,n.Pr)({body:a,models:c,handleSingleModel:(a,c)=>{let d=function(a){if("string"==typeof a)return{modelStr:F(a),preferredConnectionId:null,label:F(a)};if(!D(a)){let b=F(a);return{modelStr:b,preferredConnectionId:null,label:b}}let b=F(a.model||a.modelStr||a.model_name||a.rawModel||a.raw_model),c=F(a.connectionId||a.connection_id||a.providerConnectionId||a.provider_connection_id)||null,d=F(a.label||a.displayName||a.name)||b;return{modelStr:b,preferredConnectionId:c,label:d}}(c);return d.modelStr?W(a,d.modelStr,e,f,g,{preferredConnectionId:d.preferredConnectionId,apiKeyForceThinkingOff:h,allowSystemFallback:!i,skipProviderRetry:!0,comboRequestOverrides:k.requestOverrides,contentLoggingMode:k.contentLoggingMode,routingMetadata:{routeType:"combo",comboName:b,comboTarget:d.label||d.modelStr,comboStrategy:k.comboStrategy}}):(t.warn("CHAT",`Combo "${b}" contains an invalid target`,{target:c}),(0,m.yj)(q.gx.BAD_REQUEST,`Invalid combo target in ${b}`,j))},log:t,comboName:b,comboStrategy:k.comboStrategy,comboStickyLimit:k.comboStickyLimit,comboStickyScope:k.comboStickyScope,comboStickyTtlMinutes:k.comboStickyTtlMinutes,comboStickyContext:l,sourceFormat:j})}async function U({body:a,modelStr:b,virtualCombo:c,settings:d=null,clientRawRequest:e,request:f,apiKey:g,apiKeyForceThinkingOff:h=!1}){let i=B(f,a),j=S(d||{},b);return t.info("CHAT",`Virtual combo "${b}" matched ${c.targets?.length||0} target(s)`),(0,p.mH)({body:a,combo:c,log:t,sourceFormat:i,handleSingleTarget:(a,c)=>W(a,c.model,e,f,g,{preferredConnectionId:c.connectionId||null,apiKeyForceThinkingOff:h,allowSystemFallback:!0,skipProviderRetry:!0,comboRequestOverrides:j.requestOverrides,contentLoggingMode:j.contentLoggingMode,routingMetadata:{routeType:"combo",comboName:b,comboTarget:c?.label||c?.model||"",comboStrategy:j.comboStrategy}})})}async function V(a,b=null){let c;try{c=await a.json()}catch{return t.warn("CHAT","Invalid JSON body"),C({request:a,clientRawRequest:b,statusCode:q.gx.BAD_REQUEST,errorCode:"invalid_json_body",errorType:"invalid_request",message:"Invalid JSON body"}),(0,m.yj)(q.gx.BAD_REQUEST,"Invalid JSON body",(0,r.t)(new URL(a.url).pathname,null))}if(!b){let d=new URL(a.url);b={endpoint:d.pathname,query:d.search,body:c,headers:Object.fromEntries(a.headers.entries())}}let d=new URL(a.url);b&&void 0===b.query&&(b.query=d.search);let e=B(a,c),f=c.model,j=c.messages?.length||c.input?.length||0,l=c.tools?.length||0,n=c.reasoning_effort||c.reasoning?.effort||null;t.request("POST",`${d.pathname} | ${f} | ${j} msgs${l?` | ${l} tools`:""}${n?` | effort=${n}`:""}`);let o=a.headers.get("Authorization"),s=(0,g.Tr)(a);o&&s?t.debug("AUTH",`API Key: ${t.maskKey(s)}`):t.debug("AUTH","No API key provided");let u=await (0,h.getSettings)(),v=null;if(s&&(v=await (0,h.getApiKeyByKey)(s)),!s)return t.warn("AUTH","Missing API key"),C({request:a,clientRawRequest:b,body:c,model:f,statusCode:q.gx.UNAUTHORIZED,errorCode:"missing_api_key",errorType:"auth_error",message:"Missing API key"}),(0,m.yj)(q.gx.UNAUTHORIZED,"Missing API key",e);let w=v?!1!==v.isActive:await (0,g.kI)(s);if(v&&b&&(b.apiKeyRecordId=v.id,b.apiKeyOwnerUser=String(v.ownerUser||v.createdByUser||"").trim().toLowerCase()),!w)return t.warn("AUTH","Invalid API key"),C({request:a,clientRawRequest:b,body:c,apiKey:s,model:f,statusCode:q.gx.UNAUTHORIZED,errorCode:"invalid_api_key",errorType:"auth_error",message:"Invalid API key"}),(0,m.yj)(q.gx.UNAUTHORIZED,"Invalid API key",e);if(!f)return t.warn("CHAT","Missing model"),C({request:a,clientRawRequest:b,body:c,apiKey:s,statusCode:q.gx.BAD_REQUEST,errorCode:"missing_model",errorType:"invalid_request",message:"Missing model"}),(0,m.yj)(q.gx.BAD_REQUEST,"Missing model",e);if(v&&b?.internalTrustedRequest!==!0){let a=(0,i.NJ)(v,f);a&&(f=a)}if(v&&b?.internalTrustedRequest!==!0&&!(0,i.zx)(v,f))return t.warn("AUTH",`API key not allowed to use model: ${f}`),C({request:a,clientRawRequest:b,body:c,apiKey:s,model:f,statusCode:q.gx.FORBIDDEN||403,errorCode:"model_not_allowed",errorType:"forbidden",message:`API key is not allowed to use model: ${f}`}),(0,m.yj)(q.gx.FORBIDDEN||403,`API key is not allowed to use model: ${f}`,e);let x=(0,p.HX)(u,f);if(x)return U({body:c,modelStr:f,virtualCombo:x,settings:u,clientRawRequest:b,request:a,apiKey:s,apiKeyForceThinkingOff:b?.apiKeyForceThinkingOff===!0});let y=await (0,k.d_)(f);if(y)return T({body:c,modelStr:f,comboModels:y,settings:u,clientRawRequest:b,request:a,apiKey:s,apiKeyForceThinkingOff:b?.apiKeyForceThinkingOff===!0});let z=await (0,k.gL)(f,b?.apiKeyOwnerUser);if(z)return T({body:c,modelStr:f,comboModels:z.models,settings:u,clientRawRequest:b,request:a,apiKey:s,apiKeyForceThinkingOff:b?.apiKeyForceThinkingOff===!0,cloudCombo:z});let A=a?.headers?.get?.("x-connection-id")||null;return W(c,f,b,a,s,A?{preferredConnectionId:A}:{})}async function W(a,b,c=null,d=null,f=null,i={}){let n=B(d,a),o=await (0,k.mA)(b);if(!o.provider){let e=await (0,h.getSettings)(),g=(0,p.HX)(e,b);if(g)return U({body:a,modelStr:b,virtualCombo:g,settings:e,clientRawRequest:c,request:d,apiKey:f,apiKeyForceThinkingOff:!0===i.apiKeyForceThinkingOff||c?.apiKeyForceThinkingOff===!0});let j=await (0,k.d_)(b);if(j)return T({body:a,modelStr:b,comboModels:j,settings:e,clientRawRequest:c,request:d,apiKey:f,apiKeyForceThinkingOff:!0===i.apiKeyForceThinkingOff||c?.apiKeyForceThinkingOff===!0});let l=await (0,k.gL)(b,c?.apiKeyOwnerUser);return l?T({body:a,modelStr:b,comboModels:l.models,settings:e,clientRawRequest:c,request:d,apiKey:f,apiKeyForceThinkingOff:!0===i.apiKeyForceThinkingOff||c?.apiKeyForceThinkingOff===!0,cloudCombo:l}):(t.warn("CHAT","Invalid model format",{model:b}),C({request:d,clientRawRequest:c,body:a,apiKey:f,model:b,statusCode:q.gx.BAD_REQUEST,errorCode:"invalid_model_format",errorType:"model_not_found",message:"Invalid model format"}),(0,m.yj)(q.gx.BAD_REQUEST,"Invalid model format",n))}let{provider:s,model:w}=o;b!==`${s}/${w}`?t.info("ROUTING",`${b} -> ${s}/${w}`):t.info("ROUTING",`Provider: ${s}, Model: ${w}`);let y=d?.headers?.get("user-agent")||"",A=new Set,G=null,I=null;for(;;){let b=await (0,g.c1)(s,A,w,{body:a,headers:c?.headers||{},preferredConnectionId:i.preferredConnectionId||null,ownerUser:c?.apiKeyOwnerUser||"",apiKeyId:c?.apiKeyRecordId||"",allowSystemFallback:!0===i.allowSystemFallback});if(!b||b.allRateLimited||b.allUnavailableByPolicy||b.personalAccountRequired){if(b?.personalAccountRequired){let e=b.lastError||`Personal account is required for provider: ${s}`,g=Number(b.lastErrorCode)||q.gx.FORBIDDEN||403;return t.warn("AUTH",`[${s}/${w}] ${e}`),C({request:d,clientRawRequest:c,body:a,apiKey:f,provider:s,model:w,statusCode:g,errorCode:"personal_account_required",errorType:"forbidden",errorSource:"routing",message:`[${s}/${w}] ${e}`}),(0,m.yj)(g,e,n)}if(b?.allRateLimited||b?.allUnavailableByPolicy){let e=G||b.lastError||"Unavailable",g=I||Number(b.lastErrorCode)||q.gx.SERVICE_UNAVAILABLE;return t.warn("CHAT",`[${s}/${w}] ${e} (${b.retryAfterHuman})`),C({request:d,clientRawRequest:c,body:a,apiKey:f,provider:s,model:w,statusCode:g,errorCode:b.allRateLimited?"all_accounts_rate_limited":"all_accounts_unavailable",errorType:b.allRateLimited?"rate_limit":"provider_unavailable",errorSource:"routing",message:`[${s}/${w}] ${e}`}),(0,m.wO)(g,`[${s}/${w}] ${e}`,b.retryAfter,b.retryAfterHuman,n)}if(0===A.size)return t.warn("AUTH",`No active credentials for provider: ${s}`),C({request:d,clientRawRequest:c,body:a,apiKey:f,provider:s,model:w,statusCode:q.gx.NOT_FOUND,errorCode:"no_active_credentials",errorType:"provider_unavailable",errorSource:"routing",message:`No active credentials for provider: ${s}`}),(0,m.yj)(q.gx.NOT_FOUND,`No active credentials for provider: ${s}`,n);return t.warn("CHAT","No more accounts available",{provider:s}),C({request:d,clientRawRequest:c,body:a,apiKey:f,provider:s,model:w,statusCode:I||q.gx.SERVICE_UNAVAILABLE,errorCode:"all_accounts_unavailable",errorType:"provider_unavailable",errorSource:"routing",message:G||"All accounts unavailable"}),(0,m.yj)(I||q.gx.SERVICE_UNAVAILABLE,G||"All accounts unavailable",n)}t.info("AUTH",`\x1b[32mUsing ${s} account: ${b.connectionName}\x1b[0m`);let k=await (0,u.eU)(s,b);if(("antigravity"===s||"gemini-cli"===s)&&!k.projectId){let a=await (0,v.eG)(b.connectionId,k.accessToken);a&&(k.projectId=a,(0,u.vN)(b.connectionId,{projectId:a}).catch(()=>{}))}let o=await (0,h.getSettings)(),p=(o.providerThinking||{})[s]||null,B=!1!==o.rtkEnabled,S=k.rtkEnabled,T=!0===S||!1===S?S:B,U=(0,e.Tu)({apiKeyMode:c?.apiKeyCavemanMode,apiKeyLevel:c?.apiKeyCavemanLevel,globalEnabled:!!o.cavemanEnabled,globalLevel:o.cavemanLevel||"full"}),V=!0===i.apiKeyForceThinkingOff||c?.apiKeyForceThinkingOff===!0,W=i.comboRequestOverrides||{},Z={...a,model:`${s}/${w}`},$=(0,z.mq)(s),_=function(a={},b="",c={}){if(!(0,z.mq)(b))return a;let d=function(a={}){let b=a?.providerSpecificData&&"object"==typeof a.providerSpecificData?a.providerSpecificData:{},c=a.openAICompatibleRuntime||a.runtimeKind||b.openAICompatibleRuntime||b.runtimeKind||b.runtimeType||b.serverType||z.hb;return(0,z.tl)(c,z.hb)}(c),e=L(c.comboRequestOverrides||{}),f=c?.apiKeyForceThinkingOff===!0,g={...a};g=K(g,e,d);let h=R({body:a,overrides:e,apiKeyForceThinkingOff:f});if(f)return g=K(g,Q(e,h),d),g=function(a={}){let b={...a};if(E(b,"enable_thinking")&&delete b.enable_thinking,E(b,"reasoning_budget")&&delete b.reasoning_budget,E(b,"thinking_token_budget")&&delete b.thinking_token_budget,D(b.chat_template_kwargs)&&E(b.chat_template_kwargs,"enable_thinking")){let a={...b.chat_template_kwargs};delete a.enable_thinking,Object.keys(a).length?b.chat_template_kwargs=a:delete b.chat_template_kwargs}return b}(g),!0===d.supportsChatTemplateKwargs?N(g,d,!1):g;g=K(g,Q(e,h),d);let i=!e.thinkingMode&&!0!==P(a),j=H(a?.thinking?.budget_tokens,{min:0,max:262144});return void 0===e.reasoning_budget||i?j>0&&!i&&(g=O(g,d,j)):g=O(g,d,e.reasoning_budget),"off"===e.thinkingMode?(g=M(g),g=N(g,d,!1)):"on"===e.thinkingMode?g=N(g,d,!0):i&&function(a={}){return Object.keys(Q(a,"think")).length>0||Object.keys(Q(a,"nothink")).length>0}(e)&&(g=N(g,d,!1)),g}(Z,s,{apiKeyForceThinkingOff:V,comboRequestOverrides:W,providerSpecificData:k.providerSpecificData||{}}),aa=function({originalBody:a={},finalBody:b={},apiKeyForceThinkingOff:c=!1,providerPolicyApplies:d=!0}={}){let e=(0,j.iz)(b||a||{}),f=!0===d,g=f&&!0===c;return{thinkingEnabled:P(b),thinkingAutoOff:g,thinkingAutoOffReason:g?"api_key_force_off":"",promptChars:e,forceThinkingOffAboveChars:0,providerPolicyApplies:f,thinkingAutoOffThresholdMatched:!1}}({originalBody:Z,finalBody:_,apiKeyForceThinkingOff:V,providerPolicyApplies:$}),ab=function({route:a={},provider:b="",model:c="",connectionId:d="",originalBody:e={},finalBody:f={},overrides:g={},apiKeyForceThinkingOff:h=!1}={}){return{combo_name:a.comboName||null,combo_target:a.comboTarget||null,combo_strategy:a.comboStrategy||null,route_type:a.routeType||(a.comboName?"combo":"direct"),selected_provider_id:d||b||null,selected_model:c||f?.model||e?.model||null,request_overrides_applied:function({originalBody:a={},finalBody:b={},overrides:c={},apiKeyForceThinkingOff:d=!1}={}){let e=R({body:a,overrides:c,apiKeyForceThinkingOff:d}),f=Q(c,e),g={...J(c||{}),...f},h={};for(let c of Y)void 0!==g[c]&&b?.[c]!==void 0&&b[c]!==a?.[c]&&(h[c]=b[c]);return void 0!==c.reasoning_budget&&b?.reasoning_budget!==a?.reasoning_budget&&(h.reasoning_budget=b?.reasoning_budget),c.thinkingMode&&"inherit"!==c.thinkingMode&&(h.thinkingMode=c.thinkingMode),e&&Object.keys(f).length>0&&(h.thinkingBranch=e),h}({originalBody:e,finalBody:f,overrides:g,apiKeyForceThinkingOff:h})}}({route:i.routingMetadata||{routeType:"direct"},provider:s,model:w,connectionId:b.connectionId,originalBody:Z,finalBody:_,overrides:W,apiKeyForceThinkingOff:V}),ac=k?._connection||b?._connection||{},ad=function({provider:a="",model:b="",connection:c={},credentials:d={}}={}){var e,f,g,h,i;let j=F(a).toLowerCase(),k=(e=d.connectionName||c.displayName||c.name||c.email||c.id,F(e)),l=function(a={},b={}){var c;let d=function(...a){for(let b of a)if(b&&"object"==typeof b&&!Array.isArray(b)){let a=b.providerSpecificData;if(a&&"object"==typeof a&&!Array.isArray(a))return a}return{}}(a,b);return c=a.email||b.email||b.accountEmail||d.email||d.accountEmail||d.account_email||d.preferredUsername||d.preferred_username||d.username,F(c)}(c,d),m=(f=c.ownerUser,F(f)),n=function(a={}){return"personal"===a.scope||"private"===a.visibility||!!a.ownerUser}(c),o=l&&X.has(j),p=o?l:k,q=o?function({ownerUser:a="",accountEmail:b="",accountName:c="",provider:d="",model:e=""}={}){let f=F(a),g=F(b),h=F(c),i=F(d).toLowerCase(),j=F(e);if(i&&j.startsWith(`${i}/`)&&(j=j.slice(i.length+1)),!i||!j)return"";let k=[];return(f&&k.push(f),g&&g!==f?k.push(g):h&&h!==f&&k.push(h),k.length)?(k.push(i,j),k.join("/")):""}({ownerUser:m,accountEmail:l,accountName:k,provider:j,model:b}):"";return{accountName:p,connectionName:p,originalConnectionName:k,accountEmail:l,accountDisplayName:(g=c.displayName||c.name||k,F(g)),ownerUser:m,connectionScope:(h=c.scope,F(h)),visibility:(i=c.visibility,F(i)),isPersonalOAuth:n,displayModel:q}}({provider:s,model:w,connection:ac,credentials:b}),ae={...ab,account_name:ad.accountName||null,account_email:ad.accountEmail||null,account_display_name:ad.accountDisplayName||null,owner_user:ad.ownerUser||null,connection_scope:ad.connectionScope||null,visibility:ad.visibility||null,display_model:ad.displayModel||null},af={...c||{},accountName:ad.accountName||"",connectionName:ad.connectionName||"",accountEmail:ad.accountEmail||"",accountDisplayName:ad.accountDisplayName||"",ownerUser:ad.ownerUser||"",connectionScope:ad.connectionScope||"",visibility:ad.visibility||"",originalConnectionName:ad.originalConnectionName||"",isPersonalOAuth:!0===ad.isPersonalOAuth,requestPolicyMeta:aa,routingMetadata:ae},ag=await (0,l.w)({body:_,modelInfo:{provider:s,model:w},credentials:k,log:t,clientRawRequest:af,requestPolicyMeta:aa,skipProviderRetry:!0===i.skipProviderRetry,connectionId:b.connectionId,userAgent:y,apiKey:f,ccFilterNaming:!!o.ccFilterNaming,rtkEnabled:T,cavemanEnabled:U.enabled,cavemanLevel:U.level,providerThinking:!1===aa.thinkingEnabled?null:p,contentLoggingMode:i.contentLoggingMode||"inherit",sourceFormatOverride:d?.url?(0,r.t)(new URL(d.url).pathname,a):null,onCredentialsRefreshed:async a=>{await (0,u.vN)(b.connectionId,{accessToken:a.accessToken,refreshToken:a.refreshToken,providerSpecificData:a.providerSpecificData,testStatus:"active"})},onRequestSuccess:async()=>{await (0,g.Pt)(b.connectionId,b,w)}});if(!function(a,b){let c=a?.sessionId||a?.session_id||a?.requestContext?.sessionId;c&&(0,x.gl)({sessionId:c,metadata:b}).catch(()=>{})}(af,ae),ag.success)return ag.response;let{shouldFallback:ah}=await (0,g.vk)(b.connectionId,ag.status,ag.error,s,w,ag.resetsAtMs);if(ah){t.warn("AUTH",`Account ${b.connectionName} unavailable (${ag.status}), trying fallback`),A.add(b.connectionId),G=ag.error,I=ag.status;continue}return ag.response}}d()}catch(a){d(a)}})}};
+"use strict";exports.id=9489,exports.ids=[9489],exports.modules={18910:(a,b,c)=>{c.d(b,{Pr:()=>s,UP:()=>q,Vu:()=>r});var d=c(12557),e=c(43659),f=c(11893);let g=new Map,h=new Map,i=0;function j(a){return"client_ip"===a||"client_session"===a?a:"global"}function k(a){let b=Number.parseInt(a,10);return!Number.isFinite(b)||b<=0?120:Math.min(b,10080)}function l(a,b){let c=[...a];for(let a=0;a<b;a++){let a=c.shift();c.push(a)}return c}function m(a){let b=g.get(a);return"number"==typeof b?{index:b,consecutiveUseCount:0}:b||{index:0,consecutiveUseCount:0}}function n(a,b,c,d){let e=m(a).consecutiveUseCount+1;e>=d?g.set(a,{index:(b+1)%c,consecutiveUseCount:0}):g.set(a,{index:b,consecutiveUseCount:e})}function o(a,b,c){let d=b||"__default__",e=m(d).index%a.length,f=l(a,e);return n(d,e,a.length,c),f}function p(a,b){return{model:a,label:a,provider:b||"combo"}}function q(a){if(!a){g.clear(),h.clear();return}g.delete(a);let b=`${a}::`;for(let a of h.keys())a.startsWith(b)&&h.delete(a)}function r(a,b){if(a.includes("/"))return null;let c=(Array.isArray(b)?b:b?.combos||[]).find(b=>b.name===a);return c&&c.models&&c.models.length>0?c.models:null}async function s({body:a,models:b,handleSingleModel:c,log:g,comboName:q,comboStrategy:r,comboStickyLimit:t=1,comboStickyScope:u="global",comboStickyTtlMinutes:v=120,comboStickyContext:w=null,sourceFormat:x=null}){let y=r||"fallback",z=function(a,b,c,d=1,e={}){let g;if(!a||a.length<=1)return a;let q=c||"fallback",r=a.map(a=>p(a,b));if((0,f.OI)(r),"least-latency"===q||"least_latency"===q)return(0,f.Gc)(r,{includeSkippedAtEnd:!0}).map(a=>a.model);if("p2c"===q||"power-of-two"===q||"power_of_two"===q)return(0,f.ZL)(r,{includeSkippedAtEnd:!0}).map(a=>a.model);if("round-robin"!==q)return a;let s=Number.isFinite(g=Number.parseInt(d,10))&&g>0?g:1,t=j(e.stickyScope),u=k(e.stickyTtlMinutes);return"global"===t?o(a,b,s):function(a,b,c,d,e,f){let g,p=Date.now();if(!(p-i<6e4))for(let[a,b]of(i=p,h.entries()))(!b?.expiresAt||b.expiresAt<=p)&&h.delete(a);let q=j(d),r="global"!==(g=j(q))&&f?.key?`${b||"__default__"}::${g}::${f.key}`:null;if(!r)return o(a,b,c);let s=Date.now(),t=6e4*k(e),u=h.get(r);if(u&&u.expiresAt>s){let b=Number.isFinite(u.index)?u.index:0;if(u.model){let c=a.indexOf(u.model);c>=0&&(b=c)}return b%=a.length,h.set(r,{...u,index:b,model:a[b],lastUsedAt:s,expiresAt:s+t}),l(a,b)}let v=b||"__default__",w=m(v).index%a.length;return h.set(r,{index:w,model:a[w],stickyScope:q,stickyKey:f.key,sessionId:f.sessionId||null,clientIp:f.clientIp||null,createdAt:s,lastUsedAt:s,expiresAt:s+t}),n(v,w,a.length,c),l(a,w)}(a,b,s,t,u,e.stickyContext||null)}(b,q,y,t,{stickyScope:u,stickyTtlMinutes:v,stickyContext:w});["round-robin","least-latency","least_latency","p2c","power-of-two","power_of_two"].includes(y)&&g?.debug?.("COMBO",`${y} combo "${q||"__default__"}" | sticky=${u||"global"}${w?.label?` | key=${w.label}`:""}`);let A=null,B=null,C=null;for(let b=0;b<z.length;b++){let e=z[b],h=p(e,q),i=(0,f.kb)(h);if(i.skipped&&b<z.length-1){g?.warn?.("COMBO",`Skipping ${e}: ${i.reason}`);continue}let j=Date.now();g.info("COMBO",`Trying model ${b+1}/${z.length}: ${e}`);try{let b=await c(a,e),k=Date.now()-j;if(i.end?.(),b.ok)return(0,f.Fg)(h,k),g.info("COMBO",`Model ${e} succeeded`),b;let l=b.statusText||"",m=null;try{let a=await b.clone().json();l=a?.error?.message||a?.error||a?.message||l,m=a?.retryAfter||null}catch{}if("string"!=typeof l)try{l=JSON.stringify(l)}catch{l=String(l)}(0,f.h6)(h,{status:b.status,message:l}),m&&(!B||new Date(m)<new Date(B))&&(B=m);let{shouldFallback:n,cooldownMs:o}=(0,d.L5)(b.status,l);if(!n)return g.warn("COMBO",`Model ${e} failed (no fallback)`,{status:b.status}),b;o&&o>0&&o<=5e3&&[502,503,504].includes(b.status)&&(g.info("COMBO",`Model ${e} transient ${b.status}, waiting ${o}ms before next`),await new Promise(a=>setTimeout(a,o))),A=l||String(b.status),C=b.status,g.warn("COMBO",`Model ${e} failed, trying next`,{status:b.status})}catch(a){i.end?.(),A=a.message||String(a),C=Number(a?.status||a?.statusCode)||500,(0,f.h6)(h,a),g.warn("COMBO",`Model ${e} threw error, trying next`,{error:A})}}let D=A&&A.toLowerCase().includes("no credentials")?503:C||503,E=A||"All combo models unavailable";if(B){let a=(0,d.Qo)(B);return g.warn("COMBO",`All models failed | ${E} (${a})`),(0,e.wO)(D,E,B,a,x)}return g.warn("COMBO",`All models failed | ${E}`),(0,e.yj)(D,E,x)}},29069:(a,b,c)=>{c.d(b,{HX:()=>i,mH:()=>j});var d=c(11893),e=c(43659);function f(a){return String(a||"").trim()}function g(a){return Array.isArray(a)?[...new Set(a.map(a=>f(a)).filter(Boolean))]:"string"==typeof a?[...new Set(a.split(/[\n,;]+/).map(a=>f(a)).filter(Boolean))]:a&&"object"==typeof a?Object.entries(a).filter(([,a])=>!1!==a&&null!=a).map(([a,b])=>!0===b?f(a):`${f(a)}:${f(b)}`).filter(Boolean):[]}function h(a){if(!a||"object"!=typeof a)return null;let b=f(a.name||a.id||a.exposedModel||a.model),c=f(a.exposedModel||a.model||a.name||a.id),d=f(a.type||"virtual");if("ollama-local"===d.toLowerCase())return null;let e=(a.targets||a.endpoints||a.models||[]).map(b=>(function(a,b={}){if("string"==typeof a)return{model:f(a),label:f(a),tags:[]};if(!a||"object"!=typeof a)return null;let c=f(a.model||a.value||a.id||a.fullModel);return c?{...a,id:f(a.id)||f(a.connectionId)||c,model:c,label:f(a.label||a.name||a.displayName)||c,connectionId:f(a.connectionId||a.connection_id||a.accountId),provider:f(a.provider||b.provider),endpoint:f(a.endpoint||a.baseUrl||a.baseURL||a.url),tags:g(a.tags||a.labels||a.routingTags),maxInFlight:Number(a.maxInFlight||a.maxInFlightPerTarget||b.maxInFlight||0)||void 0}:null})(b,a)).filter(Boolean);return b&&c&&0!==e.length?{...a,name:b,id:f(a.id)||b,exposedModel:c,enabled:!1!==a.enabled,type:d,strategy:f(a.strategy||a.fallbackStrategy||"least-latency"),requiredTags:g(a.requiredTags||a.tags),modelTagRules:function(a){if(!a||"object"!=typeof a)return{};let b={};for(let[c,d]of Object.entries(a)){let a=f(c),e=g(d);a&&e.length&&(b[a]=e)}return b}(a.modelTagRules||a.requiredTagsByModel||a.tagRules),targets:e}:null}function i(a={},b=""){let c=f(b);return c&&(function(a={}){let b=a.virtualCombos||[];return(Array.isArray(b)?b:Object.values(b||{})).map(h).filter(Boolean)})(a).find(a=>!1!==a.enabled&&(a.exposedModel===c||a.name===c))||null}async function j({body:a,combo:b,handleSingleTarget:c,log:g,sourceFormat:i=null}){let k,l,m,n,o=f(a?.model||b?.exposedModel||b?.name),p=h(b);if(!p)return(0,e.yj)(400,"Invalid virtual combo",i);let q=(k=[...p.targets],l=p.modelTagRules||{},0===(k=(k=(0,d.OF)(k,o,l)).filter(a=>(function(a,b=[]){if(!b.length)return!0;let c=new Set((a.tags||[]).map(a=>String(a).toLowerCase()));return b.every(a=>c.has(String(a).toLowerCase()))})(a,p.requiredTags||[]))).length&&(k=[...p.targets]),m=k.map(a=>({...a,id:a.id||`${p.name}:${a.model}:${a.connectionId||"any"}`,connectionId:a.connectionId||"",provider:a.provider||"virtual-combo",providerLabel:p.name,label:a.label||a.model,model:o||p.exposedModel,upstreamModel:a.model,endpoint:a.endpoint||"",tags:a.tags||[],maxInFlight:a.maxInFlight})),(0,d.OI)(m),("p2c"===(n=String(p.strategy||"least-latency").toLowerCase())||"power-of-two"===n||"power_of_two"===n?(0,d.ZL)(m,{model:o,modelTagRules:l,includeSkippedAtEnd:!0}):"fallback"===n||"priority"===n?(0,d.Gc)(m,{model:o,modelTagRules:l,preserveOrder:!0,includeSkippedAtEnd:!0}):(0,d.Gc)(m,{model:o,modelTagRules:l,includeSkippedAtEnd:!0})).map(a=>({healthTarget:a,target:k.find(b=>a.upstreamModel===b.model&&(a.connectionId||"")===(b.connectionId||""))})).filter(a=>a.target)),r="All virtual combo targets unavailable",s=503;g?.info?.("VIRTUAL_COMBO",`Virtual combo "${p.name}" -> ${q.length} target(s), strategy=${p.strategy}`);for(let b=0;b<q.length;b+=1){let{target:e,healthTarget:f}=q[b],h=(0,d.kb)(f);if(h.skipped){g?.warn?.("VIRTUAL_COMBO",`Skip ${e.label||e.model}: ${h.reason}`);continue}let i=Date.now();try{let j={...a,model:e.model};g?.info?.("VIRTUAL_COMBO",`Trying ${b+1}/${q.length}: ${e.label||e.model}`);let k=await c(j,e),l=Date.now()-i;if(k?.ok)return(0,d.Fg)(f,l),h.end(),k;let m=k?.statusText||"request_failed";try{let a=await k.clone().json();m=a?.error?.message||a?.error||a?.message||m}catch{}s=k?.status||503,r="string"==typeof m?m:JSON.stringify(m),(0,d.h6)(f,{status:s,message:r}),g?.warn?.("VIRTUAL_COMBO",`${e.label||e.model} failed`,{status:s})}catch(a){s=500,r=a?.message||String(a),(0,d.h6)(f,a),g?.warn?.("VIRTUAL_COMBO",`${e.label||e.model} threw`,{error:r})}finally{h.end()}}return(0,e.yj)(s||503,r,i)}},38775:(a,b,c)=>{c.d(b,{d_:()=>h,gL:()=>i,mA:()=>g});var d=c(89718),e=c(40669);let f={xmtp:"xiaomi-tokenplan","xiaomi-tokenplan":"xiaomi-tokenplan"};async function g(a){let b,c=(b=(0,e.Xh)(a),b?.providerAlias&&f[b.providerAlias]?{...b,provider:f[b.providerAlias]}:b);if(!c.isAlias){let a=(await (0,d.getProviderNodes)({type:"openai-compatible"})).find(a=>a.prefix===c.providerAlias);if(a)return{provider:a.id,model:c.model};let b=(await (0,d.getProviderNodes)({type:"anthropic-compatible"})).find(a=>a.prefix===c.providerAlias);if(b)return{provider:b.id,model:c.model};let e=(await (0,d.getProviderNodes)({type:"custom-embedding"})).find(a=>a.prefix===c.providerAlias);return e?{provider:e.id,model:c.model}:{provider:c.provider,model:c.model}}return await (0,d.getComboByName)(c.model)?{provider:null,model:c.model}:(0,e.js)(a,d.getModelAliases)}async function h(a){if(a.includes("/"))return null;let b=await (0,d.getComboByName)(a);return b&&b.models&&b.models.length>0?b.models:null}async function i(a,b){if(!a||a.includes("/"))return null;let c=String(b||"").trim().toLowerCase();if(!c)return null;let e=await (0,d.getCloudComboById)(a);return e&&!1!==e.isActive&&String(e.ownerUser||"").trim().toLowerCase()===c&&e.models&&0!==e.models.length?e:null}},42318:(a,b,c)=>{function d(a={},b){let c=String(b||"").toLowerCase();for(let[b,d]of Object.entries(a||{}))if(String(b).toLowerCase()===c)return String((Array.isArray(d)?d[0]||"":d||"")||"");return""}function e({body:a,headers:b={},scope:c="global",fallbackToClientIp:f=!0}){if("client_ip"!==c&&"client_session"!==c)return null;let g=function(a={}){return String(d(a,"x-9r-client-ip")||d(a,"x-forwarded-for")||d(a,"x-real-ip")||d(a,"cf-connecting-ip")||"").split(",")[0].trim().replace(/^::ffff:/,"").replace(/^::1$/,"127.0.0.1")}(b),h=function(a={}){return d(a,"x-9r-source-tool")||d(a,"originator")||d(a,"copilot-integration-id")||""}(b),i="client_session"===c?String(function(a,b={}){return d(b,"x-client-session-id")||d(b,"session_id")||d(b,"session-id")||d(b,"x-session-id")||d(b,"x-interaction-id")||d(b,"conversation_id")||d(b,"conversation-id")||d(b,"x-conversation-id")||a?.conversationId||a?.conversation_id||a?.sessionId||a?.session_id||a?.metadata?.conversationId||a?.metadata?.conversation_id||a?.metadata?.sessionId||a?.metadata?.session_id||a?.conversationState?.conversationId||a?.conversationState?.sessionId||a?.conversationState?.currentConversationId||""}(a,b)||""):"";return"client_session"===c&&i?{key:[h||"tool",g||"unknown-ip",i].join("::"),label:i,scope:c,sourceTool:h,clientIp:g,sessionId:i}:"client_session"===c&&!1===f?null:g?{key:[h||"tool",g].join("::"),label:g,scope:"client_ip",sourceTool:h,clientIp:g,sessionId:""}:null}c.d(b,{lV:()=>e})},79489:(a,b,c)=>{c.a(a,async(a,d)=>{try{c.d(b,{P:()=>W});var e=c(27513),f=c(48895),g=c(80238),h=c(89718),i=c(33669),j=c(490),k=c(34778),l=c(38775),m=c(92500),n=c(43659),o=c(18910),p=c(42318),q=c(29069),r=c(41004),s=c(14170),t=c(57647),u=c(7803),v=c(67828),w=c(38160),x=c(35901),y=c(97242),z=c(86171),A=c(75681),B=a([f,g,k,m]);function C(a,b){try{let c=a?.url?new URL(a.url).pathname:"";return(0,s.t)(c,b)||(0,t.Tz)(b||{})}catch{return null}}function D({request:a,clientRawRequest:b,body:c,apiKey:d,model:e,provider:f="gateway",connectionId:g="",statusCode:h=500,errorCode:i="gateway_error",errorType:j="gateway",errorSource:k="gateway_validation",message:l="Gateway error"}){try{let m=b?.headers||{},n=b?.endpoint||"";if(a)try{m=m&&Object.keys(m).length?m:Object.fromEntries(a.headers.entries()),n=n||new URL(a.url).pathname}catch{}let o=(0,z.wS)({headers:m,requestId:b?.requestId,sessionId:b?.sessionId}),p={...o,requestContext:o,provider:f,model:e||c?.model||"unknown",connectionId:g,apiKey:d,endpoint:n,gatewayStatusCode:h,errorSource:k,errorType:j,errorCode:i,errorMessageShort:l,latencyMs:0};(0,x.jk)(p).catch(()=>{}),(0,z.sx)({provider:f,model:e||c?.model||"unknown",connectionId:g,apiKey:d,endpoint:n,statusCode:h,errorCode:i,errorType:j,errorMessage:l,requestContext:o,meta:{errorSource:k}})}catch{}}function E(a){return a&&"object"==typeof a&&!Array.isArray(a)}function F(a,b){return Object.prototype.hasOwnProperty.call(a||{},b)}function G(a){return null==a?"":String(a).trim()}[f,g,k,m]=B.then?(await B)():B;let Y=new Set(["claude","codex"]);function H(a,{min:b,max:c,precision:d=3}={}){if(null==a||""===a)return;let e=Number(a);if(!Number.isFinite(e))return;let f=Math.min(c,Math.max(b,e));return Number(f.toFixed(d))}function I(a,{min:b,max:c}={}){let d=H(a,{min:b,max:c,precision:0});return void 0===d?void 0:Math.trunc(d)}function J(a){if(!0===a)return"on";if(!1===a)return"off";let b=G(a).toLowerCase();return["on","true","1","enable","enabled"].includes(b)?"on":["off","false","0","disable","disabled"].includes(b)?"off":["inherit","default","request","client"].includes(b)?"inherit":void 0}let Z=["temperature","top_p","top_k","min_p","presence_penalty","max_tokens"];function K(a={}){let b=E(a)?a:{},c={};if(F(b,"temperature")){let a=H(b.temperature,{min:0,max:2});void 0!==a&&(c.temperature=a)}if(F(b,"top_p")||F(b,"topP")){let a=H(b.top_p??b.topP,{min:.01,max:1});void 0!==a&&(c.top_p=a)}if(F(b,"top_k")||F(b,"topK")){let a=I(b.top_k??b.topK,{min:0,max:1e3});void 0!==a&&(c.top_k=a)}if(F(b,"min_p")||F(b,"minP")){let a=H(b.min_p??b.minP,{min:0,max:1});void 0!==a&&(c.min_p=a)}let d=b.presence_penalty??b.presencePenalty??b["presence-penalty"];if(F(b,"presence_penalty")||F(b,"presencePenalty")||F(b,"presence-penalty")){let a=H(d,{min:-2,max:2});void 0!==a&&(c.presence_penalty=a)}let e=b.max_tokens??b.maxTokens??b.max_token;if(F(b,"max_tokens")||F(b,"maxTokens")||F(b,"max_token")){let a=I(e,{min:1,max:262144});void 0!==a&&(c.max_tokens=a)}return c}function L(a={},b={},c=null){let d=K(b),e={...a};return void 0!==d.temperature&&(e.temperature=d.temperature),void 0!==d.top_p&&(e.top_p=d.top_p),c?.supportsExtendedSampling===!0&&(void 0!==d.top_k&&(e.top_k=d.top_k),void 0!==d.min_p&&(e.min_p=d.min_p)),void 0!==d.presence_penalty&&(e.presence_penalty=d.presence_penalty),void 0!==d.max_tokens&&(e.max_tokens=d.max_tokens,F(e,"max_completion_tokens")&&delete e.max_completion_tokens),e}function M(a={}){let b=E(a)?a:{},c={};if(F(b,"temperature")){let a=H(b.temperature,{min:0,max:2});void 0!==a&&(c.temperature=a)}if(F(b,"top_p")||F(b,"topP")){let a=H(b.top_p??b.topP,{min:.01,max:1});void 0!==a&&(c.top_p=a)}if(F(b,"top_k")||F(b,"topK")){let a=I(b.top_k??b.topK,{min:0,max:1e3});void 0!==a&&(c.top_k=a)}if(F(b,"min_p")||F(b,"minP")){let a=H(b.min_p??b.minP,{min:0,max:1});void 0!==a&&(c.min_p=a)}let d=b.presence_penalty??b.presencePenalty??b["presence-penalty"];if(F(b,"presence_penalty")||F(b,"presencePenalty")||F(b,"presence-penalty")){let a=H(d,{min:-2,max:2});void 0!==a&&(c.presence_penalty=a)}let e=b.max_tokens??b.maxTokens??b.max_token;if(F(b,"max_tokens")||F(b,"maxTokens")||F(b,"max_token")){let a=I(e,{min:1,max:262144});void 0!==a&&(c.max_tokens=a)}let f=b.reasoning_budget??b.reasoningBudget??b["reasoning-budget"];if(F(b,"reasoning_budget")||F(b,"reasoningBudget")||F(b,"reasoning-budget")){let a=I(f,{min:0,max:262144});void 0!==a&&(c.reasoning_budget=a)}let g=b.inheritThinkRequestOverrides??b.thinkRequestOverrides??b.thinkingOnRequestOverrides;if(F(b,"inheritThinkRequestOverrides")||F(b,"thinkRequestOverrides")||F(b,"thinkingOnRequestOverrides")){let a=K(g);Object.keys(a).length>0&&(c.inheritThinkRequestOverrides=a)}let h=b.inheritNoThinkRequestOverrides??b.noThinkRequestOverrides??b.thinkingOffRequestOverrides;if(F(b,"inheritNoThinkRequestOverrides")||F(b,"noThinkRequestOverrides")||F(b,"thinkingOffRequestOverrides")){let a=K(h);Object.keys(a).length>0&&(c.inheritNoThinkRequestOverrides=a)}let i=J(b.thinkingMode??b.thinking);if(i&&"inherit"!==i&&(c.thinkingMode=i),"off"===c.thinkingMode&&delete c.reasoning_budget,!c.thinkingMode){let a=K(c);if(Object.keys(a).length>0)for(let b of(c.inheritThinkRequestOverrides={...a,...c.inheritThinkRequestOverrides||{}},c.inheritNoThinkRequestOverrides={...a,...c.inheritNoThinkRequestOverrides||{}},Z))delete c[b]}return c}function N(a={}){let b={...a};return F(b,"reasoning_budget")&&delete b.reasoning_budget,F(b,"thinking_token_budget")&&delete b.thinking_token_budget,b}function O(a={},b,c){let d=function(a={}){let b={...a};if(F(b,"enable_thinking")&&delete b.enable_thinking,E(b.chat_template_kwargs)&&F(b.chat_template_kwargs,"enable_thinking")){let a={...b.chat_template_kwargs};delete a.enable_thinking,Object.keys(a).length?b.chat_template_kwargs=a:delete b.chat_template_kwargs}return b}(a);return!0===b.supportsChatTemplateKwargs&&(d.chat_template_kwargs={...E(d.chat_template_kwargs)?d.chat_template_kwargs:{},enable_thinking:c}),d}function P(a={},b,c){let d=N(a);return b.reasoningBudgetField&&(d[b.reasoningBudgetField]=c),d}function Q(a={}){if(E(a.chat_template_kwargs)&&F(a.chat_template_kwargs,"enable_thinking"))return!0===a.chat_template_kwargs.enable_thinking;if(F(a,"enable_thinking"))return!0===a.enable_thinking;if(F(a,"reasoning_budget"))return I(a.reasoning_budget,{min:0,max:262144})>0;if(F(a,"thinking_token_budget"))return I(a.thinking_token_budget,{min:0,max:262144})>0;if(E(a.thinking)){let b=G(a.thinking.type).toLowerCase();if(["enabled","on","true","adaptive","auto"].includes(b))return!0;if(["disabled","off","false"].includes(b))return!1}return null}function R(a={},b=null){let c=E(a)?a:{};return"think"===b?K(c.inheritThinkRequestOverrides??c.thinkRequestOverrides??c.thinkingOnRequestOverrides??{}):"nothink"===b?K(c.inheritNoThinkRequestOverrides??c.noThinkRequestOverrides??c.thinkingOffRequestOverrides??{}):{}}function S({body:a={},overrides:b={},apiKeyForceThinkingOff:c=!1}={}){let d=E(b)?b:{},e=J(d.thinkingMode??d.thinking);return"on"===e||"off"===e?null:c?"nothink":!0===Q(a)?"think":"nothink"}function T(a,b,c=null){var d;let e;if(c)return{comboStrategy:c.strategy||"fallback",comboStickyLimit:1,comboStickyScope:c.stickyScope||"global",comboStickyTtlMinutes:120,comboStickyFallbackToClientIp:!0,requestOverrides:{},contentLoggingMode:void 0};let f=(a.comboStrategies||{})[b]||{};return{comboStrategy:f.fallbackStrategy||a.comboStrategy||"fallback",comboStickyLimit:f.stickyRoundRobinLimit||f.stickyLimit||a.comboStickyRoundRobinLimit||1,comboStickyScope:f.stickyScope||a.comboRoundRobinStickyScope||"global",comboStickyTtlMinutes:f.stickyTtlMinutes||a.comboRoundRobinStickyTtlMinutes||120,comboStickyFallbackToClientIp:void 0!==f.stickyFallbackToClientIp?f.stickyFallbackToClientIp:!1!==a.comboStickyFallbackToClientIp,requestOverrides:M(f.requestOverrides||{}),contentLoggingMode:(d=f.contentLoggingMode,e=G(d).toLowerCase(),"enabled"===e||"disabled"===e?e:"inherit")}}async function U({body:a,modelStr:b,comboModels:c,settings:d,clientRawRequest:e,request:f,apiKey:g,apiKeyForceThinkingOff:h=!1,cloudCombo:i=null}){let j=C(f,a);if(i){let h=(0,k.qI)(c,d);if(0===h.length)return u.warn("CHAT",`Cloud combo "${b}" has no usable members (local members must still be in Default models)`),D({request:f,clientRawRequest:e,body:a,apiKey:g,model:b,statusCode:r.gx.FORBIDDEN||403,errorCode:"model_not_allowed",errorType:"forbidden",message:`Cloud combo ${b} has no usable models`}),(0,n.yj)(r.gx.FORBIDDEN||403,`Combo ${b} has no usable models`,j);c=h}let l=T(d,b,i),m=(0,p.lV)({body:a,headers:e?.headers||{},scope:l.comboStickyScope,fallbackToClientIp:l.comboStickyFallbackToClientIp});return u.info("CHAT",`Combo "${b}" with ${c.length} models (strategy: ${l.comboStrategy}, stickyLimit: ${l.comboStickyLimit}, stickyScope: ${l.comboStickyScope})`),(0,o.Pr)({body:a,models:c,handleSingleModel:(a,c)=>{let d=function(a){if("string"==typeof a)return{modelStr:G(a),preferredConnectionId:null,label:G(a)};if(!E(a)){let b=G(a);return{modelStr:b,preferredConnectionId:null,label:b}}let b=G(a.model||a.modelStr||a.model_name||a.rawModel||a.raw_model),c=G(a.connectionId||a.connection_id||a.providerConnectionId||a.provider_connection_id)||null,d=G(a.label||a.displayName||a.name)||b;return{modelStr:b,preferredConnectionId:c,label:d}}(c);return d.modelStr?X(a,d.modelStr,e,f,g,{preferredConnectionId:d.preferredConnectionId,apiKeyForceThinkingOff:h,allowSystemFallback:!i,skipProviderRetry:!0,comboRequestOverrides:l.requestOverrides,contentLoggingMode:l.contentLoggingMode,routingMetadata:{routeType:"combo",comboName:b,comboTarget:d.label||d.modelStr,comboStrategy:l.comboStrategy}}):(u.warn("CHAT",`Combo "${b}" contains an invalid target`,{target:c}),(0,n.yj)(r.gx.BAD_REQUEST,`Invalid combo target in ${b}`,j))},log:u,comboName:b,comboStrategy:l.comboStrategy,comboStickyLimit:l.comboStickyLimit,comboStickyScope:l.comboStickyScope,comboStickyTtlMinutes:l.comboStickyTtlMinutes,comboStickyContext:m,sourceFormat:j})}async function V({body:a,modelStr:b,virtualCombo:c,settings:d=null,clientRawRequest:e,request:f,apiKey:g,apiKeyForceThinkingOff:h=!1}){let i=C(f,a),j=T(d||{},b);return u.info("CHAT",`Virtual combo "${b}" matched ${c.targets?.length||0} target(s)`),(0,q.mH)({body:a,combo:c,log:u,sourceFormat:i,handleSingleTarget:(a,c)=>X(a,c.model,e,f,g,{preferredConnectionId:c.connectionId||null,apiKeyForceThinkingOff:h,allowSystemFallback:!0,skipProviderRetry:!0,comboRequestOverrides:j.requestOverrides,contentLoggingMode:j.contentLoggingMode,routingMetadata:{routeType:"combo",comboName:b,comboTarget:c?.label||c?.model||"",comboStrategy:j.comboStrategy}})})}async function W(a,b=null){let c;try{c=await a.json()}catch{return u.warn("CHAT","Invalid JSON body"),D({request:a,clientRawRequest:b,statusCode:r.gx.BAD_REQUEST,errorCode:"invalid_json_body",errorType:"invalid_request",message:"Invalid JSON body"}),(0,n.yj)(r.gx.BAD_REQUEST,"Invalid JSON body",(0,s.t)(new URL(a.url).pathname,null))}if(!b){let d=new URL(a.url);b={endpoint:d.pathname,query:d.search,body:c,headers:Object.fromEntries(a.headers.entries())}}let d=new URL(a.url);b&&void 0===b.query&&(b.query=d.search);let e=C(a,c),f=c.model,j=c.messages?.length||c.input?.length||0,k=c.tools?.length||0,m=c.reasoning_effort||c.reasoning?.effort||null;u.request("POST",`${d.pathname} | ${f} | ${j} msgs${k?` | ${k} tools`:""}${m?` | effort=${m}`:""}`);let o=a.headers.get("Authorization"),p=(0,g.Tr)(a);o&&p?u.debug("AUTH",`API Key: ${u.maskKey(p)}`):u.debug("AUTH","No API key provided");let t=await (0,h.getSettings)(),v=null;if(p&&(v=await (0,h.getApiKeyByKey)(p)),!p)return u.warn("AUTH","Missing API key"),D({request:a,clientRawRequest:b,body:c,model:f,statusCode:r.gx.UNAUTHORIZED,errorCode:"missing_api_key",errorType:"auth_error",message:"Missing API key"}),(0,n.yj)(r.gx.UNAUTHORIZED,"Missing API key",e);let w=v?!1!==v.isActive:await (0,g.kI)(p);if(v&&b&&(b.apiKeyRecordId=v.id,b.apiKeyOwnerUser=String(v.ownerUser||v.createdByUser||"").trim().toLowerCase()),!w)return u.warn("AUTH","Invalid API key"),D({request:a,clientRawRequest:b,body:c,apiKey:p,model:f,statusCode:r.gx.UNAUTHORIZED,errorCode:"invalid_api_key",errorType:"auth_error",message:"Invalid API key"}),(0,n.yj)(r.gx.UNAUTHORIZED,"Invalid API key",e);if(!f)return u.warn("CHAT","Missing model"),D({request:a,clientRawRequest:b,body:c,apiKey:p,statusCode:r.gx.BAD_REQUEST,errorCode:"missing_model",errorType:"invalid_request",message:"Missing model"}),(0,n.yj)(r.gx.BAD_REQUEST,"Missing model",e);if(v&&b?.internalTrustedRequest!==!0){let a=(0,i.NJ)(v,f);a&&(f=a)}if(v&&b?.internalTrustedRequest!==!0&&!(0,i.zx)(v,f))return u.warn("AUTH",`API key not allowed to use model: ${f}`),D({request:a,clientRawRequest:b,body:c,apiKey:p,model:f,statusCode:r.gx.FORBIDDEN||403,errorCode:"model_not_allowed",errorType:"forbidden",message:`API key is not allowed to use model: ${f}`}),(0,n.yj)(r.gx.FORBIDDEN||403,`API key is not allowed to use model: ${f}`,e);let x=(0,q.HX)(t,f);if(x)return V({body:c,modelStr:f,virtualCombo:x,settings:t,clientRawRequest:b,request:a,apiKey:p,apiKeyForceThinkingOff:b?.apiKeyForceThinkingOff===!0});let y=await (0,l.d_)(f);if(y)return U({body:c,modelStr:f,comboModels:y,settings:t,clientRawRequest:b,request:a,apiKey:p,apiKeyForceThinkingOff:b?.apiKeyForceThinkingOff===!0});let z=await (0,l.gL)(f,b?.apiKeyOwnerUser);if(z)return U({body:c,modelStr:f,comboModels:z.models,settings:t,clientRawRequest:b,request:a,apiKey:p,apiKeyForceThinkingOff:b?.apiKeyForceThinkingOff===!0,cloudCombo:z});let A=a?.headers?.get?.("x-connection-id")||null;return X(c,f,b,a,p,A?{preferredConnectionId:A}:{})}async function X(a,b,c=null,d=null,f=null,i={}){let k=C(d,a),o=await (0,l.mA)(b);if(!o.provider){let e=await (0,h.getSettings)(),g=(0,q.HX)(e,b);if(g)return V({body:a,modelStr:b,virtualCombo:g,settings:e,clientRawRequest:c,request:d,apiKey:f,apiKeyForceThinkingOff:!0===i.apiKeyForceThinkingOff||c?.apiKeyForceThinkingOff===!0});let j=await (0,l.d_)(b);if(j)return U({body:a,modelStr:b,comboModels:j,settings:e,clientRawRequest:c,request:d,apiKey:f,apiKeyForceThinkingOff:!0===i.apiKeyForceThinkingOff||c?.apiKeyForceThinkingOff===!0});let m=await (0,l.gL)(b,c?.apiKeyOwnerUser);return m?U({body:a,modelStr:b,comboModels:m.models,settings:e,clientRawRequest:c,request:d,apiKey:f,apiKeyForceThinkingOff:!0===i.apiKeyForceThinkingOff||c?.apiKeyForceThinkingOff===!0,cloudCombo:m}):(u.warn("CHAT","Invalid model format",{model:b}),D({request:d,clientRawRequest:c,body:a,apiKey:f,model:b,statusCode:r.gx.BAD_REQUEST,errorCode:"invalid_model_format",errorType:"model_not_found",message:"Invalid model format"}),(0,n.yj)(r.gx.BAD_REQUEST,"Invalid model format",k))}let{provider:p,model:t}=o;b!==`${p}/${t}`?u.info("ROUTING",`${b} -> ${p}/${t}`):u.info("ROUTING",`Provider: ${p}, Model: ${t}`);let x=d?.headers?.get("user-agent")||"",z=new Set,B=null,H=null;for(;;){let b=await (0,g.c1)(p,z,t,{body:a,headers:c?.headers||{},preferredConnectionId:i.preferredConnectionId||null,ownerUser:c?.apiKeyOwnerUser||"",apiKeyId:c?.apiKeyRecordId||"",allowSystemFallback:!0===i.allowSystemFallback});if(!b||b.allRateLimited||b.allUnavailableByPolicy||b.personalAccountRequired){if(b?.personalAccountRequired){let e=b.lastError||`Personal account is required for provider: ${p}`,g=Number(b.lastErrorCode)||r.gx.FORBIDDEN||403;return u.warn("AUTH",`[${p}/${t}] ${e}`),D({request:d,clientRawRequest:c,body:a,apiKey:f,provider:p,model:t,statusCode:g,errorCode:"personal_account_required",errorType:"forbidden",errorSource:"routing",message:`[${p}/${t}] ${e}`}),(0,n.yj)(g,e,k)}if(b?.allRateLimited||b?.allUnavailableByPolicy){let e=B||b.lastError||"Unavailable",g=H||Number(b.lastErrorCode)||r.gx.SERVICE_UNAVAILABLE;return u.warn("CHAT",`[${p}/${t}] ${e} (${b.retryAfterHuman})`),D({request:d,clientRawRequest:c,body:a,apiKey:f,provider:p,model:t,statusCode:g,errorCode:b.allRateLimited?"all_accounts_rate_limited":"all_accounts_unavailable",errorType:b.allRateLimited?"rate_limit":"provider_unavailable",errorSource:"routing",message:`[${p}/${t}] ${e}`}),(0,n.wO)(g,`[${p}/${t}] ${e}`,b.retryAfter,b.retryAfterHuman,k)}if(0===z.size)return u.warn("AUTH",`No active credentials for provider: ${p}`),D({request:d,clientRawRequest:c,body:a,apiKey:f,provider:p,model:t,statusCode:r.gx.NOT_FOUND,errorCode:"no_active_credentials",errorType:"provider_unavailable",errorSource:"routing",message:`No active credentials for provider: ${p}`}),(0,n.yj)(r.gx.NOT_FOUND,`No active credentials for provider: ${p}`,k);return u.warn("CHAT","No more accounts available",{provider:p}),D({request:d,clientRawRequest:c,body:a,apiKey:f,provider:p,model:t,statusCode:H||r.gx.SERVICE_UNAVAILABLE,errorCode:"all_accounts_unavailable",errorType:"provider_unavailable",errorSource:"routing",message:B||"All accounts unavailable"}),(0,n.yj)(H||r.gx.SERVICE_UNAVAILABLE,B||"All accounts unavailable",k)}u.info("AUTH",`\x1b[32mUsing ${p} account: ${b.connectionName}\x1b[0m`);let l=await (0,v.eU)(p,b);if(("antigravity"===p||"gemini-cli"===p)&&!l.projectId){let a=await (0,w.eG)(b.connectionId,l.accessToken);a&&(l.projectId=a,(0,v.vN)(b.connectionId,{projectId:a}).catch(()=>{}))}let o=await (0,h.getSettings)(),q=(o.providerThinking||{})[p]||null,C=!1!==o.rtkEnabled,J=l.rtkEnabled,T=!0===J||!1===J?J:C,U=(0,e.Tu)({apiKeyMode:c?.apiKeyCavemanMode,apiKeyLevel:c?.apiKeyCavemanLevel,globalEnabled:!!o.cavemanEnabled,globalLevel:o.cavemanLevel||"full"}),V=!0===i.apiKeyForceThinkingOff||c?.apiKeyForceThinkingOff===!0,W=i.comboRequestOverrides||{},X={...a,model:`${p}/${t}`},$=(0,A.mq)(p),_=function(a={},b="",c={}){if(!(0,A.mq)(b))return a;let d=function(a={}){let b=a?.providerSpecificData&&"object"==typeof a.providerSpecificData?a.providerSpecificData:{},c=a.openAICompatibleRuntime||a.runtimeKind||b.openAICompatibleRuntime||b.runtimeKind||b.runtimeType||b.serverType||A.hb;return(0,A.tl)(c,A.hb)}(c),e=M(c.comboRequestOverrides||{}),f=c?.apiKeyForceThinkingOff===!0,g={...a};g=L(g,e,d);let h=S({body:a,overrides:e,apiKeyForceThinkingOff:f});if(f)return g=L(g,R(e,h),d),g=function(a={}){let b={...a};if(F(b,"enable_thinking")&&delete b.enable_thinking,F(b,"reasoning_budget")&&delete b.reasoning_budget,F(b,"thinking_token_budget")&&delete b.thinking_token_budget,E(b.chat_template_kwargs)&&F(b.chat_template_kwargs,"enable_thinking")){let a={...b.chat_template_kwargs};delete a.enable_thinking,Object.keys(a).length?b.chat_template_kwargs=a:delete b.chat_template_kwargs}return b}(g),!0===d.supportsChatTemplateKwargs?O(g,d,!1):g;g=L(g,R(e,h),d);let i=!e.thinkingMode&&!0!==Q(a),j=I(a?.thinking?.budget_tokens,{min:0,max:262144});return void 0===e.reasoning_budget||i?j>0&&!i&&(g=P(g,d,j)):g=P(g,d,e.reasoning_budget),"off"===e.thinkingMode?(g=N(g),g=O(g,d,!1)):"on"===e.thinkingMode?g=O(g,d,!0):i&&function(a={}){return Object.keys(R(a,"think")).length>0||Object.keys(R(a,"nothink")).length>0}(e)&&(g=O(g,d,!1)),g}(X,p,{apiKeyForceThinkingOff:V,comboRequestOverrides:W,providerSpecificData:l.providerSpecificData||{}}),aa=function({originalBody:a={},finalBody:b={},apiKeyForceThinkingOff:c=!1,providerPolicyApplies:d=!0}={}){let e=(0,j.iz)(b||a||{}),f=!0===d,g=f&&!0===c;return{thinkingEnabled:Q(b),thinkingAutoOff:g,thinkingAutoOffReason:g?"api_key_force_off":"",promptChars:e,forceThinkingOffAboveChars:0,providerPolicyApplies:f,thinkingAutoOffThresholdMatched:!1}}({originalBody:X,finalBody:_,apiKeyForceThinkingOff:V,providerPolicyApplies:$}),ab=function({route:a={},provider:b="",model:c="",connectionId:d="",originalBody:e={},finalBody:f={},overrides:g={},apiKeyForceThinkingOff:h=!1}={}){return{combo_name:a.comboName||null,combo_target:a.comboTarget||null,combo_strategy:a.comboStrategy||null,route_type:a.routeType||(a.comboName?"combo":"direct"),selected_provider_id:d||b||null,selected_model:c||f?.model||e?.model||null,request_overrides_applied:function({originalBody:a={},finalBody:b={},overrides:c={},apiKeyForceThinkingOff:d=!1}={}){let e=S({body:a,overrides:c,apiKeyForceThinkingOff:d}),f=R(c,e),g={...K(c||{}),...f},h={};for(let c of Z)void 0!==g[c]&&b?.[c]!==void 0&&b[c]!==a?.[c]&&(h[c]=b[c]);return void 0!==c.reasoning_budget&&b?.reasoning_budget!==a?.reasoning_budget&&(h.reasoning_budget=b?.reasoning_budget),c.thinkingMode&&"inherit"!==c.thinkingMode&&(h.thinkingMode=c.thinkingMode),e&&Object.keys(f).length>0&&(h.thinkingBranch=e),h}({originalBody:e,finalBody:f,overrides:g,apiKeyForceThinkingOff:h})}}({route:i.routingMetadata||{routeType:"direct"},provider:p,model:t,connectionId:b.connectionId,originalBody:X,finalBody:_,overrides:W,apiKeyForceThinkingOff:V}),ac=l?._connection||b?._connection||{},ad=function({provider:a="",model:b="",connection:c={},credentials:d={}}={}){var e,f,g,h,i;let j=G(a).toLowerCase(),k=(e=d.connectionName||c.displayName||c.name||c.email||c.id,G(e)),l=function(a={},b={}){var c;let d=function(...a){for(let b of a)if(b&&"object"==typeof b&&!Array.isArray(b)){let a=b.providerSpecificData;if(a&&"object"==typeof a&&!Array.isArray(a))return a}return{}}(a,b);return c=a.email||b.email||b.accountEmail||d.email||d.accountEmail||d.account_email||d.preferredUsername||d.preferred_username||d.username,G(c)}(c,d),m=(f=c.ownerUser,G(f)),n=function(a={}){return"personal"===a.scope||"private"===a.visibility||!!a.ownerUser}(c),o=l&&Y.has(j),p=o?l:k,q=o?function({ownerUser:a="",accountEmail:b="",accountName:c="",provider:d="",model:e=""}={}){let f=G(a),g=G(b),h=G(c),i=G(d).toLowerCase(),j=G(e);if(i&&j.startsWith(`${i}/`)&&(j=j.slice(i.length+1)),!i||!j)return"";let k=[];return(f&&k.push(f),g&&g!==f?k.push(g):h&&h!==f&&k.push(h),k.length)?(k.push(i,j),k.join("/")):""}({ownerUser:m,accountEmail:l,accountName:k,provider:j,model:b}):"";return{accountName:p,connectionName:p,originalConnectionName:k,accountEmail:l,accountDisplayName:(g=c.displayName||c.name||k,G(g)),ownerUser:m,connectionScope:(h=c.scope,G(h)),visibility:(i=c.visibility,G(i)),isPersonalOAuth:n,displayModel:q}}({provider:p,model:t,connection:ac,credentials:b}),ae={...ab,account_name:ad.accountName||null,account_email:ad.accountEmail||null,account_display_name:ad.accountDisplayName||null,owner_user:ad.ownerUser||null,connection_scope:ad.connectionScope||null,visibility:ad.visibility||null,display_model:ad.displayModel||null},af={...c||{},accountName:ad.accountName||"",connectionName:ad.connectionName||"",accountEmail:ad.accountEmail||"",accountDisplayName:ad.accountDisplayName||"",ownerUser:ad.ownerUser||"",connectionScope:ad.connectionScope||"",visibility:ad.visibility||"",originalConnectionName:ad.originalConnectionName||"",isPersonalOAuth:!0===ad.isPersonalOAuth,requestPolicyMeta:aa,routingMetadata:ae},ag=await (0,m.w)({body:_,modelInfo:{provider:p,model:t},credentials:l,log:u,clientRawRequest:af,requestPolicyMeta:aa,skipProviderRetry:!0===i.skipProviderRetry,connectionId:b.connectionId,userAgent:x,apiKey:f,ccFilterNaming:!!o.ccFilterNaming,rtkEnabled:T,cavemanEnabled:U.enabled,cavemanLevel:U.level,providerThinking:!1===aa.thinkingEnabled?null:q,contentLoggingMode:i.contentLoggingMode||"inherit",sourceFormatOverride:d?.url?(0,s.t)(new URL(d.url).pathname,a):null,onCredentialsRefreshed:async a=>{await (0,v.vN)(b.connectionId,{accessToken:a.accessToken,refreshToken:a.refreshToken,providerSpecificData:a.providerSpecificData,testStatus:"active"})},onRequestSuccess:async()=>{await (0,g.Pt)(b.connectionId,b,t)}});if(!function(a,b){let c=a?.sessionId||a?.session_id||a?.requestContext?.sessionId;c&&(0,y.gl)({sessionId:c,metadata:b}).catch(()=>{})}(af,ae),ag.success)return ag.response;let{shouldFallback:ah}=await (0,g.vk)(b.connectionId,ag.status,ag.error,p,t,ag.resetsAtMs);if(ah){u.warn("AUTH",`Account ${b.connectionName} unavailable (${ag.status}), trying fallback`),z.add(b.connectionId),B=ag.error,H=ag.status;continue}return ag.response}}d()}catch(a){d(a)}})}};

package/app/.next-cli-build/server/middleware-build-manifest.js

@@ -1 +1 @@
-globalThis.__BUILD_MANIFEST={polyfillFiles:["static/chunks/polyfills-42372ed130431b0a.js"],devFiles:[],lowPriorityFiles:["static/rVGCgsHSCtpMPfhNHYRvX/_buildManifest.js","static/rVGCgsHSCtpMPfhNHYRvX/_ssgManifest.js"],rootMainFiles:["static/chunks/webpack-a5e5f61cb7910e6b.js","static/chunks/4bd1b696-8a4ab4fdf0ae305a.js","static/chunks/3794-6cecce02b123eb1f.js","static/chunks/main-app-eacc433ef218cf40.js"],rootMainFilesTree:{},pages:{"/_app":[]}};
+globalThis.__BUILD_MANIFEST={polyfillFiles:["static/chunks/polyfills-42372ed130431b0a.js"],devFiles:[],lowPriorityFiles:["static/n4mhcK0NMGFEKCUUi5TBc/_buildManifest.js","static/n4mhcK0NMGFEKCUUi5TBc/_ssgManifest.js"],rootMainFiles:["static/chunks/webpack-a5e5f61cb7910e6b.js","static/chunks/4bd1b696-8a4ab4fdf0ae305a.js","static/chunks/3794-6cecce02b123eb1f.js","static/chunks/main-app-eacc433ef218cf40.js"],rootMainFilesTree:{},pages:{"/_app":[]}};