@jheavenknows/bluerouter 5.5.36 → 5.5.37

package/app/.next-cli-build/server/chunks/9083.js

@@ -1,10 +1,10 @@
-"use strict";exports.id=9083,exports.ids=[9083],exports.modules={45372:(a,b,c)=>{let d=c(81630),e=c(73496),f=c(55591),g=c(91645),h=c(34631),i=c(55511),j=c(74075),{promisify:k}=c(28354),{redactHeaders:l,redactBodyText:m,redactUrlPath:n,scrubString:o}=c(48350),{extractUsageFromBody:p}=c(86455),{resolvePublicTarget:q}=c(78864),{normalizeAllowedTools:r,shouldRefuseClientTool:s,describeUserAgent:t}=c(98586),{evaluateRules:u,evaluateBody:v,needsBodyInspection:w}=c(87976),{createProxyAuthenticator:x,createProxyAuthLimiter:y}=c(7566),z=k(j.brotliDecompress),A=k(j.gunzip),B=k(j.inflate),C=k(j.inflateRaw),D="function"==typeof j.zstdDecompress?k(j.zstdDecompress):null,E=new Set(["connection","proxy-connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade"]);function F(a){return String(a||"").trim().replace(/^\[|\]$/g,"").toLowerCase()}function G(a,b=443){let c=String(a||"").trim();if(!c)throw Error("Missing CONNECT authority");if(c.startsWith("[")){let a=c.indexOf("]");if(a<0)throw Error("Invalid IPv6 CONNECT authority");let d=c.slice(1,a),e=c.slice(a+1);if(e&&!e.startsWith(":"))throw Error("Invalid IPv6 CONNECT authority");let f=e?Number(e.slice(1)):b;if(!Number.isInteger(f)||f<1||f>65535)throw Error("Invalid CONNECT port");return{host:d,port:f}}let d=c.lastIndexOf(":");if(d>0&&c.indexOf(":")===d){let a=c.slice(d+1);if(!/^\d+$/.test(a))throw Error("Invalid CONNECT port");let b=Number(a);if(!Number.isInteger(b)||b<1||b>65535)throw Error("Invalid CONNECT port");return{host:c.slice(0,d),port:b}}return{host:c,port:b}}function H(a,b=[]){let c=F(a);return b.some(a=>{let b=F(a);if(!b)return!1;if(b===c)return!0;if(b.startsWith("*.")){let a=b.slice(1);return c.endsWith(a)&&c.length>a.length}return!1})}function I(a={},{stripInternal:b=!0}={}){let c=new Set([...E,...String(a.connection||"").split(",").map(a=>a.trim().toLowerCase()).filter(Boolean)]),d={};for(let[e,f]of Object.entries(a||{})){let a=e.toLowerCase();!c.has(a)&&(b&&(a.startsWith("x-9r-")||a.startsWith("x-bluerouter-"))||(d[e]=f))}return d}async function J(a,b,c){let d=String(b||"").split(",").map(a=>a.trim().toLowerCase()).filter(a=>a&&"identity"!==a);if(!d.length||!a.length)return{buffer:a,decoded:!1,contentEncoding:d.join(", ")||null};let e=a;for(let a of[...d].reverse()){let b={maxOutputLength:c};if("br"===a)e=await z(e,b);else if("gzip"===a||"x-gzip"===a)e=await A(e,b);else if("deflate"===a)try{e=await B(e,b)}catch{e=await C(e,b)}else if("zstd"===a&&D)e=await D(e,b);else throw Error(`Unsupported content-encoding: ${a}`)}return{buffer:e,decoded:!0,contentEncoding:d.join(", ")}}async function K(a,b,c){let d=String(b||"").split(",").map(a=>a.trim().toLowerCase()).filter(a=>a&&"identity"!==a);if(1!==d.length||!a.length)return null;let e=d[0],f={maxOutputLength:c,finishFlush:j.constants.Z_SYNC_FLUSH};try{if("gzip"===e||"x-gzip"===e)return await A(a,f);if("deflate"===e)try{return await B(a,f)}catch{return await C(a,f)}if("br"===e)return await z(a,{maxOutputLength:c,finishFlush:j.constants.BROTLI_OPERATION_FLUSH})}catch{}return null}class L{constructor(a){this.limitBytes=Math.max(0,Number(a)||0),this.parts=[],this.capturedBytes=0,this.totalBytes=0,this.truncated=!1,this.hash=i.createHash("sha256"),this.finished=!1}add(a){if(!a||this.finished)return;let b=Buffer.isBuffer(a)?a:Buffer.from(a);if(this.hash.update(b),this.totalBytes+=b.length,this.capturedBytes>=this.limitBytes){b.length&&(this.truncated=!0);return}let c=this.limitBytes-this.capturedBytes,d=b.length>c?b.subarray(0,c):b;d.length&&(this.parts.push(Buffer.from(d)),this.capturedBytes+=d.length),d.length<b.length&&(this.truncated=!0)}async finish(a="",b=""){if(this.finished)throw Error("Audit capture was finalized more than once");this.finished=!0;let c=this.hash.digest("hex"),d=Buffer.concat(this.parts),e=String(b||"").trim().toLowerCase(),f=d,g=!1,h=null,i=!1,j=null,k=null,l=!1,n=Math.max(1048576,Math.min(0x4000000,Math.max(8*this.limitBytes,this.limitBytes)));if(this.limitBytes>0&&d.length&&e&&"identity"!==e)if(this.truncated){let a=await K(d,e,n);a&&a.length?(f=a,g=!0,l=!0,h=a.length,i=!0):(j=`Compressed ${e} capture was truncated before decode`,k=`[${e} audit body capture truncated; decoded body unavailable]`)}else try{let a=await J(d,e,n);f=a.buffer,g=a.decoded,h=f.length,f.length>this.limitBytes&&(f=f.subarray(0,this.limitBytes),i=!0)}catch(a){j=o(a?.message||String(a)),k=`[Unable to decode ${e} audit body: ${j}]`}let p=/json|text|javascript|xml|x-www-form-urlencoded|event-stream/i.test(a||"");return{body:null!==k?k:p||!a?m(f.toString("utf8"),a):`[${f.length} bytes captured; binary body omitted]`,capturedBytes:this.capturedBytes,totalBytes:this.totalBytes,wireSha256:c,truncated:this.truncated||i,...e&&"identity"!==e?{contentEncoding:e}:{},...g?{decoded:!0,decodedBytes:h}:{},...l?{decodePartial:!0}:{},...j?{decodeError:j}:{}}}}function M(a){let b=F(a);return"api.anthropic.com"===b||b.endsWith(".anthropic.com")||"claude.ai"===b||b.endsWith(".claude.ai")?"anthropic":"api.openai.com"===b||b.endsWith(".openai.com")||"chatgpt.com"===b||b.endsWith(".chatgpt.com")?"openai":"other"}function N(a,b,c){let d=Buffer.from("anthropic"===M(b)?JSON.stringify({type:"error",error:{type:"permission_error",message:c}}):JSON.stringify({error:{message:c,type:"invalid_request_error",code:"content_policy_blocked"}}),"utf8");a.writeHead(403,{"content-type":"application/json; charset=utf-8","content-length":String(d.length),connection:"close"}),a.end(d)}function O(a){if(!a||"string"!=typeof a)return null;try{let b=JSON.parse(a);return"string"==typeof b?.model?b.model:null}catch{return null}}function P(a){let b=a?.remoteAddress||"";return b.startsWith("::ffff:")?b.slice(7):b}function Q(a,b,c,d=null){try{let e=String(c||b),f=(d||[]).filter(a=>"string"==typeof a&&!/[\r\n]/.test(a)).map(a=>`${a}\r
+"use strict";exports.id=9083,exports.ids=[9083],exports.modules={45372:(a,b,c)=>{let d=c(81630),e=c(73496),f=c(55591),g=c(91645),h=c(34631),i=c(55511),j=c(74075),{promisify:k}=c(28354),{redactHeaders:l,redactBodyText:m,redactUrlPath:n,scrubString:o}=c(48350),{extractUsageFromBody:p}=c(86455),{resolvePublicTarget:q}=c(78864),{normalizeAllowedTools:r,shouldRefuseClientTool:s,describeUserAgent:t}=c(98586),{evaluateRules:u,evaluateBody:v,needsBodyInspection:w}=c(87976),{createProxyAuthenticator:x,createProxyAuthLimiter:y}=c(7566),z=k(j.brotliDecompress),A=k(j.gunzip),B=k(j.inflate),C=k(j.inflateRaw),D="function"==typeof j.zstdDecompress?k(j.zstdDecompress):null,E=new Set(["connection","proxy-connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade"]);function F(a){return String(a||"").trim().replace(/^\[|\]$/g,"").toLowerCase()}function G(a,b=443){let c=String(a||"").trim();if(!c)throw Error("Missing CONNECT authority");if(c.startsWith("[")){let a=c.indexOf("]");if(a<0)throw Error("Invalid IPv6 CONNECT authority");let d=c.slice(1,a),e=c.slice(a+1);if(e&&!e.startsWith(":"))throw Error("Invalid IPv6 CONNECT authority");let f=e?Number(e.slice(1)):b;if(!Number.isInteger(f)||f<1||f>65535)throw Error("Invalid CONNECT port");return{host:d,port:f}}let d=c.lastIndexOf(":");if(d>0&&c.indexOf(":")===d){let a=c.slice(d+1);if(!/^\d+$/.test(a))throw Error("Invalid CONNECT port");let b=Number(a);if(!Number.isInteger(b)||b<1||b>65535)throw Error("Invalid CONNECT port");return{host:c.slice(0,d),port:b}}return{host:c,port:b}}function H(a,b=[]){let c=F(a);return b.some(a=>{let b=F(a);if(!b)return!1;if(b===c)return!0;if(b.startsWith("*.")){let a=b.slice(1);return c.endsWith(a)&&c.length>a.length}return!1})}function I(a={},{stripInternal:b=!0}={}){let c=new Set([...E,...String(a.connection||"").split(",").map(a=>a.trim().toLowerCase()).filter(Boolean)]),d={};for(let[e,f]of Object.entries(a||{})){let a=e.toLowerCase();!c.has(a)&&(b&&(a.startsWith("x-9r-")||a.startsWith("x-bluerouter-"))||(d[e]=f))}return d}async function J(a,b,c){let d=String(b||"").split(",").map(a=>a.trim().toLowerCase()).filter(a=>a&&"identity"!==a);if(!d.length||!a.length)return{buffer:a,decoded:!1,contentEncoding:d.join(", ")||null};let e=a;for(let a of[...d].reverse()){let b={maxOutputLength:c};if("br"===a)e=await z(e,b);else if("gzip"===a||"x-gzip"===a)e=await A(e,b);else if("deflate"===a)try{e=await B(e,b)}catch{e=await C(e,b)}else if("zstd"===a&&D)e=await D(e,b);else throw Error(`Unsupported content-encoding: ${a}`)}return{buffer:e,decoded:!0,contentEncoding:d.join(", ")}}async function K(a,b,c){let d=String(b||"").split(",").map(a=>a.trim().toLowerCase()).filter(a=>a&&"identity"!==a);if(1!==d.length||!a.length)return null;let e=d[0],f={maxOutputLength:c,finishFlush:j.constants.Z_SYNC_FLUSH};try{if("gzip"===e||"x-gzip"===e)return await A(a,f);if("deflate"===e)try{return await B(a,f)}catch{return await C(a,f)}if("br"===e)return await z(a,{maxOutputLength:c,finishFlush:j.constants.BROTLI_OPERATION_FLUSH})}catch{}return null}class L{constructor(a){this.limitBytes=Math.max(0,Number(a)||0),this.parts=[],this.capturedBytes=0,this.totalBytes=0,this.truncated=!1,this.hash=i.createHash("sha256"),this.finished=!1}add(a){if(!a||this.finished)return;let b=Buffer.isBuffer(a)?a:Buffer.from(a);if(this.hash.update(b),this.totalBytes+=b.length,this.capturedBytes>=this.limitBytes){b.length&&(this.truncated=!0);return}let c=this.limitBytes-this.capturedBytes,d=b.length>c?b.subarray(0,c):b;d.length&&(this.parts.push(Buffer.from(d)),this.capturedBytes+=d.length),d.length<b.length&&(this.truncated=!0)}async finish(a="",b=""){if(this.finished)throw Error("Audit capture was finalized more than once");this.finished=!0;let c=this.hash.digest("hex"),d=Buffer.concat(this.parts),e=String(b||"").trim().toLowerCase(),f=d,g=!1,h=null,i=!1,j=null,k=null,l=!1,n=Math.max(1048576,Math.min(0x4000000,Math.max(8*this.limitBytes,this.limitBytes)));if(this.limitBytes>0&&d.length&&e&&"identity"!==e)if(this.truncated){let a=await K(d,e,n);a&&a.length?(f=a,g=!0,l=!0,h=a.length,i=!0):(j=`Compressed ${e} capture was truncated before decode`,k=`[${e} audit body capture truncated; decoded body unavailable]`)}else try{let a=await J(d,e,n);f=a.buffer,g=a.decoded,h=f.length,f.length>this.limitBytes&&(f=f.subarray(0,this.limitBytes),i=!0)}catch(a){j=o(a?.message||String(a)),k=`[Unable to decode ${e} audit body: ${j}]`}let p=/json|text|javascript|xml|x-www-form-urlencoded|event-stream/i.test(a||"");return{body:null!==k?k:p||!a?m(f.toString("utf8"),a):`[${f.length} bytes captured; binary body omitted]`,capturedBytes:this.capturedBytes,totalBytes:this.totalBytes,wireSha256:c,truncated:this.truncated||i,...e&&"identity"!==e?{contentEncoding:e}:{},...g?{decoded:!0,decodedBytes:h}:{},...l?{decodePartial:!0}:{},...j?{decodeError:j}:{}}}}function M(a){let b=F(a);return"api.anthropic.com"===b||b.endsWith(".anthropic.com")||"claude.ai"===b||b.endsWith(".claude.ai")?"anthropic":"api.openai.com"===b||b.endsWith(".openai.com")||"chatgpt.com"===b||b.endsWith(".chatgpt.com")?"openai":"kiro.dev"===b||b.endsWith(".kiro.dev")||/^(?:q|codewhisperer)\.[a-z0-9-]+\.amazonaws\.com$/.test(b)?"kiro":"other"}function N(a,b,c){let d=Buffer.from("anthropic"===M(b)?JSON.stringify({type:"error",error:{type:"permission_error",message:c}}):JSON.stringify({error:{message:c,type:"invalid_request_error",code:"content_policy_blocked"}}),"utf8");a.writeHead(403,{"content-type":"application/json; charset=utf-8","content-length":String(d.length),connection:"close"}),a.end(d)}function O(a){if(!a||"string"!=typeof a)return null;try{let b=JSON.parse(a);if("string"==typeof b?.model)return b.model;let c=b?.conversationState?.currentMessage?.userInputMessage?.modelId;return"string"==typeof c&&c?c:null}catch{return null}}function P(a){let b=a?.remoteAddress||"";return b.startsWith("::ffff:")?b.slice(7):b}function Q(a,b,c,d=null){try{let e=String(c||b),f=(d||[]).filter(a=>"string"==typeof a&&!/[\r\n]/.test(a)).map(a=>`${a}\r
 `).join("");a.end(`HTTP/1.1 ${b}\r
 ${f}Connection: close\r
 Content-Type: text/plain; charset=utf-8\r
 Content-Length: ${Buffer.byteLength(e)}\r
 \r
-${e}`)}catch{try{a.destroy()}catch{}}}function R(a={}){let b={};for(let[c,d]of Object.entries(a||{}))b[c]=d;return b}async function S(a){let b=await a.requestCapture.finish(String(a.requestHeaders["content-type"]||""),String(a.requestHeaders["content-encoding"]||"")),c=String(a.responseHeaders?.["content-type"]||""),d=await a.responseCapture.finish(c,String(a.responseHeaders?.["content-encoding"]||"")),e=M(a.target.host),f=n(a.path),g=p({provider:e,body:d.body,contentType:c,path:f}),h=O(b.body)||g?.model||null;return{id:i.randomUUID(),timestamp:new Date().toISOString(),protocol:a.protocol||"http/1.1",client:{ip:a.clientIp||"",port:a.clientPort||null,userAgent:String(a.requestHeaders["user-agent"]||""),proxyUser:a.authUser||null,dashboardUser:a.dashboardUser||null},provider:e,host:F(a.target.host),port:a.target.port,method:a.method,path:f,model:h,usage:g,status:a.statusCode||null,durationMs:Date.now()-a.startedAt,error:a.error?o(a.error.message||a.error):null,denied:!0===a.denied,request:{headers:l(a.requestHeaders),...b},response:{headers:l(a.responseHeaders||{}),...d}}}a.exports={createAuditProxy:function(a={},b={}){let i={allowedHosts:[],passthroughUnknown:!0,captureBodies:!0,captureLimitBytes:2097152,verifyUpstreamTls:!0,allowedConnectPorts:[443],connectTimeoutMs:1e4,tlsHandshakeTimeoutMs:1e4,responseHeaderTimeoutMs:3e4,idleTimeoutMs:9e5,allowPlainHttp:!1,clientToolFilterEnabled:!1,allowedClientTools:[],proxyAuthEnabled:!1,proxyAuthUsers:[],clientAlpnProtocols:["http/1.1"],...a};if(!0!==i.verifyUpstreamTls)throw Error("Upstream TLS verification is mandatory in Audit Proxy mode");let j=b.certificateProvider;if("function"!=typeof j)throw Error("certificateProvider is required");let k="function"==typeof b.onAudit?b.onAudit:()=>{},l="function"==typeof b.onAuditJob?b.onAuditJob:null,m="function"==typeof b.resolveTarget?b.resolveTarget:(a,b)=>q(a,b,{allowedPorts:i.allowedConnectPorts}),n=b.upstreamCa,o=r(i.allowedClientTools),p=i.proxyAuthEnabled?x(i.proxyAuthUsers):null,z=i.proxyAuthEnabled?y():null,A=new Set,B=new Map,C=new WeakMap,D=new Set;function E(a){return!a||A.has(a)||(A.add(a),a.once?.("close",()=>A.delete(a))),a}function F(a,b){try{"function"==typeof a.destroy?a.destroy(b):"function"==typeof a.close&&a.close()}catch{}}function K(a){let b=()=>S(a);if(l){try{l(b)}catch(a){console.warn("[audit-proxy] audit enqueue failed:",a?.message||a)}return}setImmediate(()=>{Promise.resolve().then(b).then(k).catch(a=>console.warn("[audit-proxy] audit callback failed:",a?.message||a))})}function M({requestHeaders:a,method:b,path:c,target:d,requestCapture:e,responseCapture:f,responseHeaders:g,statusCode:h,startedAt:i,error:j,socket:k,protocol:l,authUser:m=null,denied:n=!1}){return{requestHeaders:R(a),method:b,path:c,target:d,requestCapture:e,responseCapture:f,responseHeaders:R(g),statusCode:h,startedAt:i,error:j,clientIp:P(k),clientPort:k?.remotePort||null,authUser:m,dashboardUser:k?.__auditDashboardUser||null,protocol:l,denied:n}}let O="This proxy does not support WebSocket connections. Use the HTTP streaming transport instead - most clients fall back to it automatically.";function T(a,b,c,d,{statusCode:e=403,authUser:f=null}={}){let g=String(a.url||""),h=c||{host:g.includes(":")?g.slice(0,g.lastIndexOf(":")):g||"unknown",port:443},j=new L(i.captureBodies?i.captureLimitBytes:0);j.add(Buffer.from(d)),K(M({requestHeaders:a.headers,method:"CONNECT",path:"",target:h,requestCapture:new L(0),responseCapture:j,responseHeaders:{"content-type":"text/plain; charset=utf-8",connection:"close"},statusCode:e,startedAt:Date.now(),error:d,socket:b,protocol:"http/1.1",authUser:f,denied:!0}))}let U=Symbol("refused");async function V(a,b){if(!p)return null;let d=P(b),e=(c,d=null)=>(Q(b,"407 Proxy Authentication Required",c,['Proxy-Authenticate: Basic realm="BlueRouter Audit Proxy", charset="UTF-8"']),T(a,b,void 0,c,{statusCode:407,authUser:d}),U);if(z.isLocked(d))return e("Too many failed proxy authentication attempts");let f=a.headers["proxy-authorization"],g=await p.authenticate(f);if(g.ok)return z.recordSuccess(d),g.username;let h=null;if(f){let{lockedNow:a}=z.recordFailure(d);a&&console.log(`[audit-proxy] proxy auth lockout for ${d||"unknown"}`);try{h=c(7566).parseBasicProxyAuthorization(f)?.username||null}catch{h=null}}return e(g.reason||"Proxy authentication required",h)}function W(a,b,c){if(!c)return;let d=new L(i.captureBodies?i.captureLimitBytes:0);d.add(Buffer.from(O)),K(M({requestHeaders:a.headers,method:a.method,path:a.url,target:c,requestCapture:new L(0),responseCapture:d,responseHeaders:{"content-type":"text/plain; charset=utf-8",connection:"close"},statusCode:501,startedAt:Date.now(),error:null,socket:b,protocol:"http/1.1",authUser:b?.__auditProxyUser||null,denied:!0}))}async function X(a,b,{expectContinue:c=!1}={}){let d=a.socket.__auditTarget,e=a.socket.__auditProxyUser||null;if(!d){b.writeHead(502,{"content-type":"text/plain"}),b.end("Audit target is missing");return}if(function(a={}){return"string"==typeof a.upgrade&&""!==a.upgrade.trim()}(a.headers)){b.writeHead(501,{"content-type":"text/plain; charset=utf-8",connection:"close"}),b.end(O),W(a,a.socket,d);return}let h=Date.now(),j=new L(i.captureBodies?i.captureLimitBytes:0),k=new L(i.captureBodies?i.captureLimitBytes:0),l=i.dlpEnabled?u(i,{groups:a.socket.__auditDlpGroups||[],host:d.host,userAgent:a.headers["user-agent"],method:a.method,path:a.url}):null,o=I(a.headers,{stripInternal:!0});o.host=443===d.port?d.host:`${d.host}:${d.port}`;let p=null,q=null,r={},s=null,t=!1,x=!1,y=null,z=!1,A=(b=null,{denied:c=!1,statusOverride:f=null}={})=>{t||(t=!0,y&&clearTimeout(y),K(M({requestHeaders:a.headers,method:a.method,path:a.url,target:d,requestCapture:j,responseCapture:k,responseHeaders:r,statusCode:f??s,startedAt:h,error:b,socket:a.socket,protocol:"http/1.1",authUser:e,denied:c})))},C=(c,e)=>{if(z||x)return;z=!0;let f=e?`${c}: ${e}`:c;k.add(Buffer.from(f)),b.headersSent?b.destroyed||b.destroy(Error(f)):N(b,d.host,f),x=!0,F(p,Error(f)),a.destroy(),A(null,{denied:!0,statusOverride:403})};if(l?.action==="deny"){let a=`Blocked by content policy "${l.reason}"`;k.add(Buffer.from(a)),N(b,d.host,a),x=!0,A(null,{denied:!0,statusOverride:403});return}let D=!!l&&w(l,a.method,a.headers);try{let e,h,t=await m(d.host,d.port);(p=f.request({hostname:d.host,port:d.port,method:a.method,path:a.url,headers:o,rejectUnauthorized:!0,servername:g.isIP(d.host)?void 0:d.host,ca:n,ALPNProtocols:["http/1.1"],lookup:t.lookup,autoSelectFamily:!0,agent:(e=`${d.host}:${d.port}`,(h=B.get(e))||(h=new f.Agent({keepAlive:!0,maxSockets:32,maxFreeSockets:8,timeout:i.idleTimeoutMs}),B.set(e,h)),h)})).on("socket",a=>{if(E(a),a.setNoDelay(!0),a.setKeepAlive(!0,3e4),a.setTimeout(i.idleTimeoutMs,()=>a.destroy(Error("Upstream idle timeout"))),a.connecting){let b=setTimeout(()=>a.destroy(Error("Upstream TLS connect timeout")),i.connectTimeoutMs+i.tlsHandshakeTimeoutMs);b.unref?.();let c=()=>clearTimeout(b);a.once("secureConnect",c),a.once("error",c),a.once("close",c)}}),p.on("continue",()=>{c&&!b.headersSent&&b.writeContinue()}),p.on("information",a=>{102===a.statusCode&&"function"==typeof b.writeProcessing&&b.writeProcessing(),103===a.statusCode&&"function"==typeof b.writeEarlyHints&&b.writeEarlyHints(a.headers||{})}),p.on("response",a=>{q=a,y&&clearTimeout(y),s=a.statusCode||502,r=R(a.headers||{});let c=I(a.headers,{stripInternal:!1});b.writeHead(s,c),b.flushHeaders?.(),a.on("data",c=>{k.add(c),b.write(c)||a.pause()}),b.on("drain",()=>a.resume()),a.on("aborted",()=>{let a=Error("Upstream response aborted");b.destroyed||b.destroy(a),A(a)}),a.on("error",a=>{b.destroyed||b.destroy(a),A(a)}),a.on("end",()=>{if(a.trailers&&Object.keys(a.trailers).length)try{b.addTrailers(I(a.trailers,{stripInternal:!1}))}catch{}x=!0,b.end(),A(null)})}),p.on("error",a=>{z||(b.headersSent?b.destroyed||b.destroy(a):(b.writeHead(502,{"content-type":"application/json"}),b.end(JSON.stringify({error:"Verified upstream TLS request failed"})),x=!0),A(a))});let u=()=>{if(a.trailers&&Object.keys(a.trailers).length)try{p.addTrailers(I(a.trailers,{stripInternal:!0}))}catch{}p.end(),y=setTimeout(()=>p.destroy(Error("Upstream response header timeout")),i.responseHeaderTimeoutMs),y.unref?.()};if(D){let b=[],c=0,d=!1;a.on("data",a=>{if(j.add(a),!d&&!z){if((c+=a.length)>i.dlpMaxInspectBytes){d=!0,b.length=0;return}b.push(a)}}),a.on("end",async()=>{try{if(z)return;if(d){if("allow"!==i.dlpOversizeAction)return void C("Request is too large to inspect and your content policy blocks uninspected uploads",`over ${i.dlpMaxInspectBytes} bytes`);u();return}let c=Buffer.concat(b),e=null;try{let b=a.headers["content-encoding"],d=b?(await J(c,b,8*i.dlpMaxInspectBytes)).buffer:c;e=v(JSON.parse(d.toString("utf8")),l.profile)}catch{e=null}if(!e||e.budgetExceeded){if("allow"!==i.dlpOversizeAction)return void C("Request could not be inspected and your content policy blocks uninspected uploads",e?.budgetExceeded?"too complex to inspect":"unreadable body")}else if(e.violations.length){let a=e.violations[0],b=e.violations.length>1?` (+${e.violations.length-1} more)`:"";C(`Blocked by content policy "${l.reason}"`,`${a.message}${b}`);return}c.length&&p.write(c),u()}catch(a){C("Content inspection failed",a?.message||String(a))}})}else a.on("data",b=>{j.add(b),p.write(b)||a.pause()}),p.on("drain",()=>a.resume()),a.on("end",u);a.on("aborted",()=>p.destroy(Error("Client request aborted"))),a.on("error",a=>p.destroy(a)),b.on("close",()=>{x||z||(q?.destroy(Error("Client response closed")),p?.destroy(Error("Client response closed")),A(Error("Client response closed")))})}catch(a){b.headersSent||(b.writeHead(502,{"content-type":"application/json"}),b.end(JSON.stringify({error:"Destination validation or connection failed"})),x=!0),A(a)}}let Y=d.createServer((a,b)=>{X(a,b)});async function Z(a){return a.upstreamPromise||(a.upstreamPromise=(async()=>{let b=a.target,c=await m(b.host,b.port),d=E(h.connect({host:b.host,port:b.port,servername:g.isIP(b.host)?void 0:b.host,rejectUnauthorized:!0,ca:n,ALPNProtocols:["h2"],lookup:c.lookup,autoSelectFamily:!0}));d.setNoDelay(!0),d.setKeepAlive(!0,3e4);let f=setTimeout(()=>d.destroy(Error("Upstream HTTP/2 TLS connect timeout")),i.connectTimeoutMs+i.tlsHandshakeTimeoutMs);f.unref?.(),d.once("secureConnect",()=>{clearTimeout(f),"h2"!==d.alpnProtocol&&d.destroy(Error("Upstream did not negotiate HTTP/2"))}),d.once("error",()=>clearTimeout(f)),d.once("close",()=>clearTimeout(f));let j=`https://${b.host}${443===b.port?"":`:${b.port}`}`,k=e.connect(j,{createConnection:()=>d,settings:{enablePush:!1}});return D.add(k),k.setTimeout(i.idleTimeoutMs,()=>k.destroy(Error("Upstream HTTP/2 idle timeout"))),k.once("close",()=>D.delete(k)),await new Promise((a,b)=>{let c=setTimeout(()=>b(Error("Upstream HTTP/2 session timeout")),i.connectTimeoutMs+i.tlsHandshakeTimeoutMs);c.unref?.();let d=(a,b)=>{clearTimeout(c),k.removeListener("connect",e),k.removeListener("error",f),a(b)},e=()=>d(a,k),f=a=>d(b,a);k.once("connect",e),k.once("error",f)}),k})().catch(b=>{throw a.upstreamPromise=null,b})),a.upstreamPromise}async function $(a,b){let c=C.get(a.session),d=c?.target;if(!c||!d){a.respond({":status":502,"content-type":"text/plain"}),a.end("Audit target is missing");return}a.pause();let f=Date.now(),g=new L(i.captureBodies?i.captureLimitBytes:0),h=new L(i.captureBodies?i.captureLimitBytes:0),j={},k=null,l=!1,m=!1,n=null,o=null,p=null,q=(e=null)=>{l||(l=!0,K(M({requestHeaders:b,method:b[":method"]||"GET",path:b[":path"]||"/",target:d,requestCapture:g,responseCapture:h,responseHeaders:j,statusCode:k,startedAt:f,error:e,socket:a.session.socket,protocol:"h2",authUser:c.authUser||null})))};try{(n=(await Z(c)).request(function(a,b){let c=I(a,{stripInternal:!0}),d={":method":a[":method"]||"GET",":path":a[":path"]||"/",":scheme":"https",":authority":443===b.port?b.host:`${b.host}:${b.port}`};for(let[a,b]of Object.entries(c))a.startsWith(":")||(d[a.toLowerCase()]=b);return d}(b,d),{endStream:!1,waitForTrailers:!0})).setTimeout(i.idleTimeoutMs,()=>n.close(e.constants.NGHTTP2_CANCEL)),a.setTimeout(i.idleTimeoutMs,()=>a.close(e.constants.NGHTTP2_CANCEL)),n.on("response",b=>{j=R(b),k=Number(b[":status"]||502),a.respond(function(a){let b=I(a,{stripInternal:!1}),c={":status":Number(a[":status"]||502)};for(let[a,d]of Object.entries(b))a.startsWith(":")||(c[a.toLowerCase()]=d);return c}(b),{waitForTrailers:!0})}),n.on("trailers",a=>{p=I(a,{stripInternal:!1})}),a.on("wantTrailers",()=>{try{a.sendTrailers(p||{})}catch{}}),a.on("trailers",a=>{o=I(a,{stripInternal:!0})}),n.on("wantTrailers",()=>{try{n.sendTrailers(o||{})}catch{}}),a.on("data",b=>{g.add(b),n.write(b)||a.pause()}),n.on("drain",()=>a.resume()),a.on("end",()=>n.end()),n.on("data",b=>{h.add(b),a.write(b)||n.pause()}),a.on("drain",()=>n.resume()),n.on("end",()=>{m=!0,a.end(),q(null)}),n.on("aborted",()=>{let b=Error("Upstream HTTP/2 stream aborted");a.close(e.constants.NGHTTP2_INTERNAL_ERROR),q(b)}),n.on("error",b=>{a.closed||a.close(e.constants.NGHTTP2_INTERNAL_ERROR),q(b)}),a.on("aborted",()=>{n.close(e.constants.NGHTTP2_CANCEL),q(Error("Client HTTP/2 stream aborted"))}),a.on("error",a=>{n.close(e.constants.NGHTTP2_CANCEL),q(a)}),a.on("close",()=>{m||!n||n.closed||(n.close(e.constants.NGHTTP2_CANCEL),q(Error("Client HTTP/2 stream closed")))}),a.resume()}catch(b){a.headersSent||a.closed||a.respond({":status":502,"content-type":"application/json"}),a.closed||a.end(JSON.stringify({error:"Verified upstream HTTP/2 request failed"})),q(b)}}Y.on("checkContinue",(a,b)=>{X(a,b,{expectContinue:!0})}),Y.on("upgrade",(a,b)=>{Q(b,"501 Not Implemented",O),W(a,b,b.__auditTarget)}),Y.on("clientError",(a,b)=>F(b)),Y.headersTimeout=i.responseHeaderTimeoutMs,Y.requestTimeout=0,Y.keepAliveTimeout=i.idleTimeoutMs;let _=e.createServer({settings:{enablePush:!1}});_.on("session",a=>{let b={target:a.socket.__auditTarget,authUser:a.socket.__auditProxyUser||null,upstreamPromise:null};C.set(a,b),a.setTimeout(i.idleTimeoutMs,()=>a.destroy(Error("Client HTTP/2 idle timeout"))),a.once("close",()=>{Promise.resolve(b.upstreamPromise).then(a=>a?.close()).catch(()=>{})})}),_.on("stream",(a,b)=>{$(a,b)}),_.on("sessionError",a=>{console.warn("[audit-proxy] HTTP/2 client session error:",a?.message||a)});let aa=d.createServer((a,b)=>{b.writeHead(403,{"content-type":"text/plain; charset=utf-8",connection:"close"}),b.end("Audit Proxy accepts HTTPS CONNECT traffic only")});function ab(){o=r(i.allowedClientTools),p=i.proxyAuthEnabled?x(i.proxyAuthUsers):null,z=i.proxyAuthEnabled?y():null,aa.headersTimeout=i.responseHeaderTimeoutMs,aa.keepAliveTimeout=i.idleTimeoutMs,Y.headersTimeout=i.responseHeaderTimeoutMs,Y.keepAliveTimeout=i.idleTimeoutMs,aa.auditCapabilities={http1:!0,http2:i.clientAlpnProtocols.includes("h2"),proxyAuth:!0===i.proxyAuthEnabled,plainHttp:!1,publicConnectPorts:[...i.allowedConnectPorts]}}return aa.on("connect",(a,b,c)=>{(async()=>{let d,e;try{d=G(a.url,443)}catch(e){let c=e.message||"Invalid CONNECT authority";Q(b,"400 Bad Request",c),T(a,b,d,c,{statusCode:400});return}let f=await V(a,b);if(f===U)return;try{await m(d.host,d.port)}catch(e){let c=e.message||"Destination is not allowed";Q(b,"403 Forbidden",c),T(a,b,d,c,{authUser:f});return}if(i.clientToolFilterEnabled&&s(a.headers["user-agent"],o)){let c=`Client tool is not allowed to use this proxy (${t(a.headers["user-agent"])})`;Q(b,"403 Forbidden",c),T(a,b,d,c);return}if(!H(d.host,i.allowedHosts)){if(!i.passthroughUnknown){let c="Host is not in the audit allowlist";Q(b,"403 Forbidden",c),T(a,b,d,c);return}let e=!1;try{let a=await m(d.host,d.port),f=E(g.connect({host:d.host,port:d.port,lookup:a.lookup,autoSelectFamily:!0})),h=setTimeout(()=>f.destroy(Error("TCP passthrough connect timeout")),i.connectTimeoutMs);h.unref?.(),f.setNoDelay(!0),f.setKeepAlive(!0,3e4),f.setTimeout(i.idleTimeoutMs,()=>f.destroy(Error("TCP passthrough idle timeout"))),f.once("connect",()=>{clearTimeout(h),e=!0,b.write("HTTP/1.1 200 Connection Established\r\nProxy-Agent: BlueRouter-Audit\r\n\r\n"),c?.length&&f.write(c),f.pipe(b),b.pipe(f)}),f.once("error",()=>{clearTimeout(h),e?F(b):Q(b,"502 Bad Gateway","TCP passthrough failed")}),b.once("error",()=>F(f)),b.once("close",()=>F(f))}catch(a){Q(b,"502 Bad Gateway",a.message||"TCP passthrough failed")}return}try{if(e=j(d.host),!e?.key||!e?.cert)throw Error("Certificate provider returned no certificate")}catch(a){Q(b,"500 Internal Server Error",`Cannot issue audit certificate: ${a.message}`);return}b.write("HTTP/1.1 200 Connection Established\r\nProxy-Agent: BlueRouter-Audit\r\n\r\n"),c?.length&&b.unshift(c);let k=E(new h.TLSSocket(b,{isServer:!0,key:e.key,cert:e.cert,ALPNProtocols:i.clientAlpnProtocols}));k.__auditTarget=d,k.__auditProxyUser=f,k.__auditDlpGroups=b.__auditDlpGroups||[],k.__auditDashboardUser=b.__auditDashboardUser||null,k.setNoDelay(!0),k.setKeepAlive(!0,3e4),k.setTimeout(i.idleTimeoutMs,()=>k.destroy(Error("Client TLS idle timeout")));let l=setTimeout(()=>k.destroy(Error("Client TLS handshake timeout")),i.tlsHandshakeTimeoutMs);l.unref?.();let n=!1,p=()=>{n||(n=!0,clearTimeout(l),"h2"===k.alpnProtocol?_.emit("connection",k):Y.emit("connection",k))};k.once("secure",p),k.once("secureConnect",p),k.once("error",()=>{clearTimeout(l),F(k)}),k.once("close",()=>clearTimeout(l))})().catch(a=>Q(b,"500 Internal Server Error",a.message||"Audit CONNECT failed"))}),aa.prependListener("connection",a=>{E(a),a.setNoDelay(!0),a.setKeepAlive(!0,3e4)}),aa.on("upgrade",(a,b)=>Q(b,"501 Not Implemented",O)),aa.on("clientError",(a,b)=>F(b)),aa.headersTimeout=i.responseHeaderTimeoutMs,aa.requestTimeout=0,aa.keepAliveTimeout=i.idleTimeoutMs,aa.forceCloseAll=()=>{for(let a of D)try{a.destroy()}catch{}for(let a of B.values())try{a.destroy()}catch{}for(let a of[...A])F(a)},aa.getActiveConnectionCount=()=>A.size,aa.auditConfig=i,ab(),aa.applyConfig=(a={})=>{let b={};for(let[c,d]of(a.bindHost&&String(a.bindHost)!==String(i.bindHost)&&(b.bindHost=String(a.bindHost)),Number(a.port)&&Number(a.port)!==Number(i.port)&&(b.port=Number(a.port)),Object.entries(a)))"bindHost"!==c&&"port"!==c&&(["verifyUpstreamTls","allowPlainHttp","allowedConnectPorts","clientAlpnProtocols"].includes(c)||(i[c]=d));return ab(),{rebindRequired:Object.keys(b).length>0,pending:b}},aa},hostMatches:H,parseAuthority:G,stripHopByHop:I,CaptureBuffer:L,detectProvider:M,extractModel:O,decodeCapturedBuffer:J}},49083:(a,b,c)=>{let{createAuditProxy:d}=c(45372),{loadConfig:e,saveConfig:f,validateConfig:g,CONFIG_PATH:h,AUDIT_LOG_PATH:i,AUDIT_LOG_DIR:j,PROXY_AUTH_FEATURE_ENABLED:k}=c(43096),{hashProxyPassword:l,isValidUsername:m,normalizeProxyUsers:n,redactProxyAuthUsers:o,PASSWORD_MAX_BYTES:p,PASSWORD_MIN_BYTES:q}=c(7566),{normalizeIp:r}=c(5565),{attachClientIpGate:s,effectiveClientIpPolicy:t,normalizeAccessGrants:u,normalizeGrantUserId:v}=c(77407),{getProxySession:w,pruneExpiredProxySessions:x,revokeProxySession:y,revokeProxySessionsForUser:z}=c(68257),{SETTINGS_KEY:A,extractAuditPolicy:B,mergeAuditPolicy:C,policyEquals:D}=c(85463),{enqueueAuditJob:E,readRecent:F,clearAudit:G,pruneExpired:H,startAuditMaintenance:I,stopAuditMaintenance:J,flushAuditQueue:K,registerAuditShutdownFlush:L,unregisterAuditShutdownFlush:M,getAuditStoreStats:N}=c(90173),{ensureAuditRootCA:O,createAuditCertificateProvider:P,getStatusRootCaValidation:Q}=c(85074),{readRootCAInfo:R}=c(2466),{runSelfTest:S}=c(85252);function T(){return globalThis.__blueRouterAuditProxyRuntime||(globalThis.__blueRouterAuditProxyRuntime={server:null,certificateProvider:null,ipPolicy:null,ipGate:null,startedAt:null,lastError:null,autostartPromise:null,autostartRetryTimer:null,lifecycle:Promise.resolve()}),globalThis.__blueRouterAuditProxyRuntime}function U(a){let b=T(),c=b.lifecycle.then(a,a);return b.lifecycle=c.catch(()=>{}),c}async function V(a,b=1500){if(!a)return;let c=Math.max(0,Number(b)||0);await new Promise(b=>{let d=!1,e=()=>{d||(d=!0,b())};try{a.listening?a.close(e):e()}catch{e()}let f=setTimeout(()=>{try{a.forceCloseAll?.()}catch{}},c);f.unref?.();let g=setTimeout(e,c+2e3);g.unref?.()});try{a.forceCloseAll?.()}catch{}}function W(a){let b=e();return{...a,proxyAuthEnabled:!0===b.proxyAuthEnabled,proxyAuthUsers:[...b.proxyAuthUsers||[]],accessGrants:u(b.accessGrants)}}let X=null;function Y(){let a=x();if(0===a)return;let b=T();if(!b.server?.listening)return;let c=b.ipGate?.dropRevoked()||0;console.log(`[audit-proxy] session sweep: ${a} session(s) expired, ${c} connection(s) closed`)}async function Z(a=null){let b=T();if(b.server?.listening)return ag();let c=a?f({...W(a),enabled:!1}):e();await O(),await H(),I(),X||(X=setInterval(Y,3e4),X.unref?.()),L();let g=P({maxEntries:128});g.prewarm(c.allowedHosts);let h=d(c,{certificateProvider:g,onAuditJob:E});b.ipPolicy=t(c),b.ipGate=s(h,()=>T().ipPolicy);try{let a=await new Promise((a,b)=>{let d=a=>{h.removeListener("listening",e),b(a?.code==="EADDRNOTAVAIL"?Error(`Cannot bind ${c.bindHost}:${c.port} - that address does not exist on this machine. In Docker the container cannot bind the host's LAN IP: set the bind address to 0.0.0.0 and let the published port (-p 3128:3128) expose it on the host.`,{cause:a}):a?.code==="EACCES"?Error(`Cannot bind ${c.bindHost}:${c.port} - permission denied. Ports below 1024 need extra privileges; pick a high port such as 3128.`,{cause:a}):a)},e=()=>{h.removeListener("error",d),a(h.address())};h.once("error",d),h.once("listening",e),h.listen(c.port,c.bindHost)});return b.server=h,b.certificateProvider=g,b.startedAt=new Date().toISOString(),b.lastError=null,ae(),f({...c,enabled:!0}),{...await ag(),address:a}}catch(a){b.lastError=a.message||String(a);try{h.forceCloseAll?.()}catch{}try{h.close()}catch{}throw g.clear?.(),a}}async function $({persist:a=!0}={}){let b=T();ae();let c=b.server,d=e();if(b.server=null,b.startedAt=null,await V(c,d.shutdownGraceMs),b.certificateProvider?.clear?.(),b.certificateProvider=null,b.ipGate=null,!await K(3e3)){let a=N();console.warn(`[audit-proxy] audit queue did not drain within 3000ms; ${a.queueDepth} event(s) still queued`)}return M(),J(),X&&clearInterval(X),X=null,a&&f({...d,enabled:!1}),ag()}async function _(a=null){return await $({persist:!1}),a&&f({...W(a),enabled:!1}),Z()}function aa(a=null){return U(()=>Z(a))}let ab=new Set(["1","true","yes","on"]),ac=[2e3,5e3,15e3,3e4,6e4];function ad(a){return a?.code==="EADDRINUSE"||a?.cause?.code==="EADDRINUSE"}function ae(){let a=T();a.autostartRetryTimer&&(clearTimeout(a.autostartRetryTimer),a.autostartRetryTimer=null)}async function af(){let a,b=T();await am();let c=e(),d=null!=(a=process.env.AUDIT_PROXY_ENABLED)&&""!==a&&ab.has(String(a).trim().toLowerCase());return c.enabled||d?b.server?.listening?{started:!1,reason:"already-running",status:await ag()}:(d&&!c.enabled&&console.log("[audit-proxy] starting because AUDIT_PROXY_ENABLED is set, despite stored enabled=false"),b.autostartPromise||(b.autostartPromise=(async()=>{try{let a=await aa();return console.log(`[audit-proxy] autostarted on ${c.bindHost}:${c.port}`),{started:!0,status:a}}catch(c){b.lastError=c?.message||String(c),console.log("[audit-proxy] autostart failed:",b.lastError);let a=ad(c);return a&&function a(b){let c=T(),d=ac[b-1];d?c.autostartRetryTimer||(c.autostartRetryTimer=setTimeout(async()=>{if((c.autostartRetryTimer=null,!c.server?.listening)&&e().enabled)try{await aa(),console.log(`[audit-proxy] autostart succeeded on retry ${b}`)}catch(d){c.lastError=d?.message||String(d),console.log(`[audit-proxy] autostart retry ${b} failed:`,c.lastError),ad(d)&&a(b+1)}},d),c.autostartRetryTimer.unref?.()):console.warn(`[audit-proxy] autostart still failing after ${ac.length} retries; start it from the dashboard once the cause is cleared`)}(1),{started:!1,error:b.lastError,retrying:a}}finally{b.autostartPromise=null}})()),b.autostartPromise):{started:!1,reason:"disabled"}}async function ag(){let a=T(),b=e(),c=t(b),d=!!a.server?.listening,f=R();try{let a=Q();f={...f,validated:!0===a.exists,expiringSoon:!0===a.expiringSoon,autoRotation:!1}}catch(a){f={...f,validated:!1,autoRotation:!1,error:a.message||String(a)}}return{running:d,listening:d,startedAt:a.startedAt,lastError:a.lastError,address:d?a.server.address():null,pendingListenerRestart:d&&!function(a,b){if(!a)return!0;let c=String(b.bindHost||"").trim().toLowerCase(),d=r(a.address||""),e=r("localhost"===c?"127.0.0.1":c);return Number(a.port)===Number(b.port)&&d===e}(a.server.address(),b),activeConnections:d&&a.server.getActiveConnectionCount?.()||0,capabilities:d?a.server.auditCapabilities:{http1:!0,http2:!1,plainHttp:!1,publicConnectPorts:[443]},security:{clientIpFilterEnabled:c.enabled,clientIpFilterSource:c.source,enforcedClientIpCount:c.allowedClientIps.length,accessGrantCount:c.grants.length,sessionIdleTimeoutMs:b.sessionIdleTimeoutMs,activeSessionCount:c.sessions.length,clientToolFilterEnabled:!0===b.clientToolFilterEnabled,proxyAuthEnabled:!0===b.proxyAuthEnabled,proxyAuthFeatureEnabled:k,allowedClientToolCount:(b.allowedClientTools||[]).length,privateDestinationsBlocked:!0,plainHttpBlocked:!0,upstreamTlsVerified:!0},activeSessions:c.sessions.map(a=>({ip:a.ip,userId:a.userId,displayName:a.displayName,activatedAt:new Date(a.activatedAt).toISOString(),expiresAt:new Date(a.expiresAt).toISOString()})),certificateCache:a.certificateProvider?.stats?.()||{entries:0},auditStore:N(),configPath:h,auditLogPath:i,auditLogDirectory:j,rootCA:f}}async function ah(a=50,{includeEvents:b=!0}={}){let c=e(),[d,f]=await Promise.all([ag(),b?F(a):[]]);return{config:ai(c),status:d,events:f}}function ai(a){return a?{...a,proxyAuthUsers:o(a.proxyAuthUsers)}:a}async function aj(){return Promise.resolve().then(c.bind(c,89718))}async function ak(){try{let{isClusterStandby:a}=await c.e(2763).then(c.bind(c,62763));return await a()===!0}catch{return!1}}async function al(a){try{if(await ak())return{mirrored:!1,reason:"standby"};let{getSettings:b,updateSettings:c}=await aj(),d=B(a),e=await b();if(JSON.stringify(e?.[A]||null)===JSON.stringify(d))return{mirrored:!1,reason:"unchanged"};return await c({[A]:d}),{mirrored:!0}}catch(a){return console.warn("[audit-proxy] failed to mirror policy to settings:",a?.message||a),{mirrored:!1,error:a?.message||String(a)}}}async function am({force:a=!1}={}){try{if(!a&&!await ak())return{applied:!1,reason:"not-standby"};let{getSettings:b}=await aj(),c=await b(),d=c?.[A];if(!d||"object"!=typeof d)return{applied:!1,reason:"no-policy"};let f=e();if(D(f,d))return{applied:!1,reason:"unchanged"};let g=C(f,d),h=await an(g,{mirror:!1});return console.log("[audit-proxy] applied cluster policy from snapshot"),{applied:!0,restarted:!0===h.restarted,droppedConnections:h.droppedConnections||0}}catch(a){return console.warn("[audit-proxy] failed to apply cluster policy:",a?.message||a),{applied:!1,error:a?.message||String(a)}}}function an(a,{mirror:b=!0}={}){return U(async()=>{let c=T(),d=!!c.server?.listening,e=f({...g(a),enabled:d});c.ipPolicy=t(e);let h=!1,i={},j=0;if(d){let a=c.server.applyConfig?.(e)||{};h=!0===a.rebindRequired,i=a.pending||{},j=c.ipGate?.dropRevoked()||0;try{c.certificateProvider?.prewarm?.(e.allowedHosts)}catch{}}return b&&await al(e),{config:ai(e),status:await ag(),restarted:!1,appliedInstantly:!0,rebindRequired:h,pendingListener:i,droppedConnections:j}})}a.exports={startProxy:aa,ensureAuditProxyAutostart:af,stopProxy:function(a={}){return U(()=>$(a))},restartProxy:function(a=null){return U(()=>_(a))},getStatus:ag,getSnapshot:ah,readRecentAuditEvents:F,updateConfig:function(a){return an(W(a))},updateClientProxyHost:function(a){return an({...e(),clientProxyHost:String(a||"").trim()})},updateProxyAuth:async function a({enabled:b,users:c}={}){if(!0===b&&!k)throw Error("Proxy authentication is turned off in this deployment (PROXY_AUTH_FEATURE_ENABLED in audit-gateway/config.js)");let d=e(),f=new Map(n(d.proxyAuthUsers).map(a=>[a.username.toLowerCase(),a])),g=new Set,h=[];for(let a of Array.isArray(c)?c:[]){let b=String(a?.username||"").trim();if(!m(b))throw Error(`Invalid username: ${b||"(empty)"}`);let c=b.toLowerCase();if(g.has(c))throw Error(`Duplicate username: ${b}`);g.add(c);let d="string"==typeof a?.password?a.password:"";if(d){let a=Buffer.byteLength(d,"utf8");if(a<q)throw Error(`Password for ${b} must be at least ${q} characters`);if(a>p)throw Error(`Password for ${b} must be at most ${p} bytes`);h.push({username:b,passwordHash:await l(d)});continue}let e=f.get(c);if(!e)throw Error(`Account ${b} requires a password`);h.push({username:b,passwordHash:e.passwordHash})}return an({...d,proxyAuthEnabled:!0===b,proxyAuthUsers:h})},listAccessGrants:function(){return u(e().accessGrants)},applyAuditPolicyFromSettings:am,upsertAccessGrant:function({userId:a,note:b}={}){let c=v(a);if(!c)throw Error("Grant requires a dashboard username or email");let d=e(),f=u(d.accessGrants).filter(a=>a.userId!==c);return f.push({userId:c,note:b}),an({...d,accessGrants:f})},deleteAccessGrant:function(a){let b=v(a);if(!b)throw Error("Grant requires a dashboard username or email");let c=e(),d=u(c.accessGrants).filter(a=>a.userId!==b);return z(b),an({...c,accessGrants:d})},getOwnProxySession:function(a){return w(a)},revokeSession:function({ip:a,userId:b}={}){let c=a?+!!y(a):z(b);if(0===c)return{removed:0,droppedConnections:0};let d=T();return d.server?.listening?{removed:c,droppedConnections:d.ipGate?.dropRevoked()||0}:{removed:c,droppedConnections:0}},clearAudit:G,runSelfTest:S}},78864:(a,b,c)=>{let d=c(14985).promises,e=c(91645),{normalizeIp:f,clientIpMatches:g}=c(5565),h=new Map,i=Object.freeze(["0.0.0.0/8","10.0.0.0/8","100.64.0.0/10","127.0.0.0/8","169.254.0.0/16","172.16.0.0/12","192.0.0.0/24","192.0.2.0/24","192.88.99.0/24","192.168.0.0/16","198.18.0.0/15","198.51.100.0/24","203.0.113.0/24","224.0.0.0/4","240.0.0.0/4","::/96","::1/128","100::/64","2001:2::/48","2001:db8::/32","fc00::/7","fe80::/10","ff00::/8"]),j=Object.freeze([".localhost",".local",".internal",".lan",".home.arpa"]);function k(a){return String(a||"").trim().replace(/^\[|\]$/g,"").replace(/\.$/,"").toLowerCase()}function l(a){let b=k(a);return!(!(!b||"localhost"===b||j.some(a=>b.endsWith(a)))&&(e.isIP(b)||b.includes(".")))}function m(a){let b=f(a);return!!e.isIP(b)&&!g(b,i)}function n(a){let b=[...new Set((Array.isArray(a)?a:[a]).map(a=>Number(a)).filter(a=>Number.isInteger(a)&&a>=1&&a<=65535))];return b.length?b:[443]}function o(a){let b=[...a?.addresses||[]];return function(c,d,e){let f=d,g=e;"function"==typeof d&&(g=d,f={});let h="number"==typeof f?f:Number(f?.family||0);if("object"==typeof f&&f?.all===!0){let c=4===h||6===h?b.filter(a=>a.family===h):b;if(!c.length){let b=Error(`No validated public address for ${a.host}`);b.code="ENOTFOUND",g(b);return}g(null,c.map(({address:a,family:b})=>({address:a,family:b})));return}let i=function(a,b=0){let c=Number(b||0);return 4===c||6===c?a.find(a=>a.family===c)||null:a.find(a=>4===a.family)||a[0]||null}(b,h);if(!i){let b=Error(`No validated public address for ${a.host}`);b.code="ENOTFOUND",g(b);return}g(null,i.address,i.family)}}async function p(a,b,c={}){let g=k(a),i=Number(b||443),j=n(c.allowedPorts||[443]);if(!g)throw Error("Destination host is empty");if(!Number.isInteger(i)||!j.includes(i))throw Error(`CONNECT destination port ${i||"unknown"} is not allowed`);if(l(g))throw Error(`Private or local destination hostname is not allowed: ${g}`);let q=e.isIP(f(g));if(q){let a=f(g);if(!m(a))throw Error(`Private or reserved destination address is not allowed: ${a}`);let b={host:g,port:i,addresses:[{address:a,family:q}]};return{...b,lookup:o(b)}}let r=Date.now(),s=h.get(g);if(!s||s.expiresAt<=r){let a=await d.lookup(g,{all:!0,verbatim:!0}),b=[],c=new Set;for(let d of a||[]){let a=f(d.address),g=e.isIP(a);if(!g||!m(a))continue;let h=`${g}:${a}`;c.has(h)||(c.add(h),b.push({address:a,family:g}))}if(!b.length)throw Error(`Destination did not resolve to a public address: ${g}`);s={addresses:b,expiresAt:r+6e4},h.set(g,s)}let t={host:g,port:i,addresses:[...s.addresses]};return{...t,lookup:o(t)}}a.exports={BLOCKED_ADDRESS_RANGES:i,normalizeTargetHost:k,normalizeAllowedPorts:n,isBlockedHostname:l,isPublicAddress:m,createPinnedLookup:o,resolvePublicTarget:p,clearDnsPolicyCache:function(){h.clear()}}},85252:(a,b,c)=>{let d=c(81630),e=c(73496),f=c(91645),g=c(34631),h=c(74075),i=c(55511),j=c(15296),{createAuditProxy:k,CaptureBuffer:l}=c(45372),{containsLikelySecret:m}=c(48350),{clientIpMatches:n,normalizeAllowedClientIps:o}=c(5565),{normalizeAllowedTools:p,clientToolMatches:q,shouldRefuseClientTool:r}=c(98586),{createProxyAuthenticator:s,createProxyAuthLimiter:t,hashProxyPassword:u,parseBasicProxyAuthorization:v}=c(7566),{isPublicAddress:w}=c(78864),{validateConfig:x,PROXY_AUTH_FEATURE_ENABLED:y}=c(43096),{normalizeAccessGrants:z,effectiveClientIpPolicy:A,attachClientIpGate:B,findAccessGrant:C}=c(77407),{activateProxySession:D,touchProxySession:E,getProxySession:F,revokeProxySession:G,clearAllProxySessions:H}=c(68257),{promptLogMirrorDecision:I}=c(90173);function J(a){return i.createHash("sha256").update(a).digest("hex")}function K(a){let b=j.pki.rsa.generateKeyPair(2048),c=j.pki.createCertificate();c.publicKey=b.publicKey,c.serialNumber=String(Date.now()),c.validity.notBefore=new Date(Date.now()-6e4),c.validity.notAfter=new Date(Date.now()+864e5);let d=[{name:"commonName",value:a}];return c.setSubject(d),c.setIssuer(d),c.setExtensions([{name:"basicConstraints",cA:!0,critical:!0},{name:"keyUsage",keyCertSign:!0,cRLSign:!0,critical:!0}]),c.sign(b.privateKey,j.md.sha256.create()),{cert:c,keys:b,certPem:j.pki.certificateToPem(c)}}function L(a,b){let c=j.pki.rsa.generateKeyPair(2048),d=j.pki.createCertificate();return d.publicKey=c.publicKey,d.serialNumber=`${Date.now()}${Math.floor(1e3*Math.random())}`,d.validity.notBefore=new Date(Date.now()-6e4),d.validity.notAfter=new Date(Date.now()+864e5),d.setSubject([{name:"commonName",value:b}]),d.setIssuer(a.cert.subject.attributes),d.setExtensions([{name:"basicConstraints",cA:!1},{name:"keyUsage",digitalSignature:!0,keyEncipherment:!0},{name:"extKeyUsage",serverAuth:!0},{name:"subjectAltName",altNames:[{type:2,value:b}]}]),d.sign(a.keys.privateKey,j.md.sha256.create()),{cert:j.pki.certificateToPem(d),key:j.pki.privateKeyToPem(c.privateKey)}}function M(a,b="127.0.0.1"){return new Promise((c,d)=>{a.once("error",d),a.listen(0,b,()=>{a.removeListener("error",d),c(a.address())})})}function N(a){return new Promise(b=>{if(!a)return b();try{a.forceCloseAll?.()}catch{}if(!a.listening)return b();a.close(()=>b()),setTimeout(b,1e3).unref?.()})}function O(a,b){let c="127.0.0.1";return Promise.resolve({host:a,port:b,addresses:[{address:c,family:4}],lookup:(a,b,d)=>{let e=b,f=d;"function"==typeof b&&(f=b,e={}),e?.all?f(null,[{address:c,family:4}]):f(null,c,4)}})}function P(a,b,c="",d=""){return new Promise((e,g)=>{let h=f.connect(a,"127.0.0.1"),i=Buffer.alloc(0),j=setTimeout(()=>g(Error("CONNECT timeout")),7e3);h.once("error",g),h.once("connect",()=>{let a=c?`User-Agent: ${c}\r
+${e}`)}catch{try{a.destroy()}catch{}}}function R(a={}){let b={};for(let[c,d]of Object.entries(a||{}))b[c]=d;return b}async function S(a){let b=await a.requestCapture.finish(String(a.requestHeaders["content-type"]||""),String(a.requestHeaders["content-encoding"]||"")),c=String(a.responseHeaders?.["content-type"]||""),d=await a.responseCapture.finish(c,String(a.responseHeaders?.["content-encoding"]||"")),e=M(a.target.host),f=n(a.path),g=p({provider:e,body:d.body,contentType:c,path:f}),h=O(b.body)||g?.model||null;return{id:i.randomUUID(),timestamp:new Date().toISOString(),protocol:a.protocol||"http/1.1",client:{ip:a.clientIp||"",port:a.clientPort||null,userAgent:String(a.requestHeaders["user-agent"]||""),proxyUser:a.authUser||null,dashboardUser:a.dashboardUser||null},provider:e,host:F(a.target.host),port:a.target.port,method:a.method,path:f,model:h,usage:g,status:a.statusCode||null,durationMs:Date.now()-a.startedAt,error:a.error?o(a.error.message||a.error):null,denied:!0===a.denied,request:{headers:l(a.requestHeaders),...b},response:{headers:l(a.responseHeaders||{}),...d}}}a.exports={createAuditProxy:function(a={},b={}){let i={allowedHosts:[],passthroughUnknown:!0,captureBodies:!0,captureLimitBytes:2097152,verifyUpstreamTls:!0,allowedConnectPorts:[443],connectTimeoutMs:1e4,tlsHandshakeTimeoutMs:1e4,responseHeaderTimeoutMs:3e4,idleTimeoutMs:9e5,allowPlainHttp:!1,clientToolFilterEnabled:!1,allowedClientTools:[],proxyAuthEnabled:!1,proxyAuthUsers:[],clientAlpnProtocols:["http/1.1"],...a};if(!0!==i.verifyUpstreamTls)throw Error("Upstream TLS verification is mandatory in Audit Proxy mode");let j=b.certificateProvider;if("function"!=typeof j)throw Error("certificateProvider is required");let k="function"==typeof b.onAudit?b.onAudit:()=>{},l="function"==typeof b.onAuditJob?b.onAuditJob:null,m="function"==typeof b.resolveTarget?b.resolveTarget:(a,b)=>q(a,b,{allowedPorts:i.allowedConnectPorts}),n=b.upstreamCa,o=r(i.allowedClientTools),p=i.proxyAuthEnabled?x(i.proxyAuthUsers):null,z=i.proxyAuthEnabled?y():null,A=new Set,B=new Map,C=new WeakMap,D=new Set;function E(a){return!a||A.has(a)||(A.add(a),a.once?.("close",()=>A.delete(a))),a}function F(a,b){try{"function"==typeof a.destroy?a.destroy(b):"function"==typeof a.close&&a.close()}catch{}}function K(a){let b=()=>S(a);if(l){try{l(b)}catch(a){console.warn("[audit-proxy] audit enqueue failed:",a?.message||a)}return}setImmediate(()=>{Promise.resolve().then(b).then(k).catch(a=>console.warn("[audit-proxy] audit callback failed:",a?.message||a))})}function M({requestHeaders:a,method:b,path:c,target:d,requestCapture:e,responseCapture:f,responseHeaders:g,statusCode:h,startedAt:i,error:j,socket:k,protocol:l,authUser:m=null,denied:n=!1}){return{requestHeaders:R(a),method:b,path:c,target:d,requestCapture:e,responseCapture:f,responseHeaders:R(g),statusCode:h,startedAt:i,error:j,clientIp:P(k),clientPort:k?.remotePort||null,authUser:m,dashboardUser:k?.__auditDashboardUser||null,protocol:l,denied:n}}let O="This proxy does not support WebSocket connections. Use the HTTP streaming transport instead - most clients fall back to it automatically.";function T(a,b,c,d,{statusCode:e=403,authUser:f=null}={}){let g=String(a.url||""),h=c||{host:g.includes(":")?g.slice(0,g.lastIndexOf(":")):g||"unknown",port:443},j=new L(i.captureBodies?i.captureLimitBytes:0);j.add(Buffer.from(d)),K(M({requestHeaders:a.headers,method:"CONNECT",path:"",target:h,requestCapture:new L(0),responseCapture:j,responseHeaders:{"content-type":"text/plain; charset=utf-8",connection:"close"},statusCode:e,startedAt:Date.now(),error:d,socket:b,protocol:"http/1.1",authUser:f,denied:!0}))}let U=Symbol("refused");async function V(a,b){if(!p)return null;let d=P(b),e=(c,d=null)=>(Q(b,"407 Proxy Authentication Required",c,['Proxy-Authenticate: Basic realm="BlueRouter Audit Proxy", charset="UTF-8"']),T(a,b,void 0,c,{statusCode:407,authUser:d}),U);if(z.isLocked(d))return e("Too many failed proxy authentication attempts");let f=a.headers["proxy-authorization"],g=await p.authenticate(f);if(g.ok)return z.recordSuccess(d),g.username;let h=null;if(f){let{lockedNow:a}=z.recordFailure(d);a&&console.log(`[audit-proxy] proxy auth lockout for ${d||"unknown"}`);try{h=c(7566).parseBasicProxyAuthorization(f)?.username||null}catch{h=null}}return e(g.reason||"Proxy authentication required",h)}function W(a,b,c){if(!c)return;let d=new L(i.captureBodies?i.captureLimitBytes:0);d.add(Buffer.from(O)),K(M({requestHeaders:a.headers,method:a.method,path:a.url,target:c,requestCapture:new L(0),responseCapture:d,responseHeaders:{"content-type":"text/plain; charset=utf-8",connection:"close"},statusCode:501,startedAt:Date.now(),error:null,socket:b,protocol:"http/1.1",authUser:b?.__auditProxyUser||null,denied:!0}))}async function X(a,b,{expectContinue:c=!1}={}){let d=a.socket.__auditTarget,e=a.socket.__auditProxyUser||null;if(!d){b.writeHead(502,{"content-type":"text/plain"}),b.end("Audit target is missing");return}if(function(a={}){return"string"==typeof a.upgrade&&""!==a.upgrade.trim()}(a.headers)){b.writeHead(501,{"content-type":"text/plain; charset=utf-8",connection:"close"}),b.end(O),W(a,a.socket,d);return}let h=Date.now(),j=new L(i.captureBodies?i.captureLimitBytes:0),k=new L(i.captureBodies?i.captureLimitBytes:0),l=i.dlpEnabled?u(i,{groups:a.socket.__auditDlpGroups||[],host:d.host,userAgent:a.headers["user-agent"],method:a.method,path:a.url}):null,o=I(a.headers,{stripInternal:!0});o.host=443===d.port?d.host:`${d.host}:${d.port}`;let p=null,q=null,r={},s=null,t=!1,x=!1,y=null,z=!1,A=(b=null,{denied:c=!1,statusOverride:f=null}={})=>{t||(t=!0,y&&clearTimeout(y),K(M({requestHeaders:a.headers,method:a.method,path:a.url,target:d,requestCapture:j,responseCapture:k,responseHeaders:r,statusCode:f??s,startedAt:h,error:b,socket:a.socket,protocol:"http/1.1",authUser:e,denied:c})))},C=(c,e)=>{if(z||x)return;z=!0;let f=e?`${c}: ${e}`:c;k.add(Buffer.from(f)),b.headersSent?b.destroyed||b.destroy(Error(f)):N(b,d.host,f),x=!0,F(p,Error(f)),a.destroy(),A(null,{denied:!0,statusOverride:403})};if(l?.action==="deny"){let a=`Blocked by content policy "${l.reason}"`;k.add(Buffer.from(a)),N(b,d.host,a),x=!0,A(null,{denied:!0,statusOverride:403});return}let D=!!l&&w(l,a.method,a.headers);try{let e,h,t=await m(d.host,d.port);(p=f.request({hostname:d.host,port:d.port,method:a.method,path:a.url,headers:o,rejectUnauthorized:!0,servername:g.isIP(d.host)?void 0:d.host,ca:n,ALPNProtocols:["http/1.1"],lookup:t.lookup,autoSelectFamily:!0,agent:(e=`${d.host}:${d.port}`,(h=B.get(e))||(h=new f.Agent({keepAlive:!0,maxSockets:32,maxFreeSockets:8,timeout:i.idleTimeoutMs}),B.set(e,h)),h)})).on("socket",a=>{if(E(a),a.setNoDelay(!0),a.setKeepAlive(!0,3e4),a.setTimeout(i.idleTimeoutMs,()=>a.destroy(Error("Upstream idle timeout"))),a.connecting){let b=setTimeout(()=>a.destroy(Error("Upstream TLS connect timeout")),i.connectTimeoutMs+i.tlsHandshakeTimeoutMs);b.unref?.();let c=()=>clearTimeout(b);a.once("secureConnect",c),a.once("error",c),a.once("close",c)}}),p.on("continue",()=>{c&&!b.headersSent&&b.writeContinue()}),p.on("information",a=>{102===a.statusCode&&"function"==typeof b.writeProcessing&&b.writeProcessing(),103===a.statusCode&&"function"==typeof b.writeEarlyHints&&b.writeEarlyHints(a.headers||{})}),p.on("response",a=>{q=a,y&&clearTimeout(y),s=a.statusCode||502,r=R(a.headers||{});let c=I(a.headers,{stripInternal:!1});b.writeHead(s,c),b.flushHeaders?.(),a.on("data",c=>{k.add(c),b.write(c)||a.pause()}),b.on("drain",()=>a.resume()),a.on("aborted",()=>{let a=Error("Upstream response aborted");b.destroyed||b.destroy(a),A(a)}),a.on("error",a=>{b.destroyed||b.destroy(a),A(a)}),a.on("end",()=>{if(a.trailers&&Object.keys(a.trailers).length)try{b.addTrailers(I(a.trailers,{stripInternal:!1}))}catch{}x=!0,b.end(),A(null)})}),p.on("error",a=>{z||(b.headersSent?b.destroyed||b.destroy(a):(b.writeHead(502,{"content-type":"application/json"}),b.end(JSON.stringify({error:"Verified upstream TLS request failed"})),x=!0),A(a))});let u=()=>{if(a.trailers&&Object.keys(a.trailers).length)try{p.addTrailers(I(a.trailers,{stripInternal:!0}))}catch{}p.end(),y=setTimeout(()=>p.destroy(Error("Upstream response header timeout")),i.responseHeaderTimeoutMs),y.unref?.()};if(D){let b=[],c=0,d=!1;a.on("data",a=>{if(j.add(a),!d&&!z){if((c+=a.length)>i.dlpMaxInspectBytes){d=!0,b.length=0;return}b.push(a)}}),a.on("end",async()=>{try{if(z)return;if(d){if("allow"!==i.dlpOversizeAction)return void C("Request is too large to inspect and your content policy blocks uninspected uploads",`over ${i.dlpMaxInspectBytes} bytes`);u();return}let c=Buffer.concat(b),e=null;try{let b=a.headers["content-encoding"],d=b?(await J(c,b,8*i.dlpMaxInspectBytes)).buffer:c;e=v(JSON.parse(d.toString("utf8")),l.profile)}catch{e=null}if(!e||e.budgetExceeded){if("allow"!==i.dlpOversizeAction)return void C("Request could not be inspected and your content policy blocks uninspected uploads",e?.budgetExceeded?"too complex to inspect":"unreadable body")}else if(e.violations.length){let a=e.violations[0],b=e.violations.length>1?` (+${e.violations.length-1} more)`:"";C(`Blocked by content policy "${l.reason}"`,`${a.message}${b}`);return}c.length&&p.write(c),u()}catch(a){C("Content inspection failed",a?.message||String(a))}})}else a.on("data",b=>{j.add(b),p.write(b)||a.pause()}),p.on("drain",()=>a.resume()),a.on("end",u);a.on("aborted",()=>p.destroy(Error("Client request aborted"))),a.on("error",a=>p.destroy(a)),b.on("close",()=>{x||z||(q?.destroy(Error("Client response closed")),p?.destroy(Error("Client response closed")),A(Error("Client response closed")))})}catch(a){b.headersSent||(b.writeHead(502,{"content-type":"application/json"}),b.end(JSON.stringify({error:"Destination validation or connection failed"})),x=!0),A(a)}}let Y=d.createServer((a,b)=>{X(a,b)});async function Z(a){return a.upstreamPromise||(a.upstreamPromise=(async()=>{let b=a.target,c=await m(b.host,b.port),d=E(h.connect({host:b.host,port:b.port,servername:g.isIP(b.host)?void 0:b.host,rejectUnauthorized:!0,ca:n,ALPNProtocols:["h2"],lookup:c.lookup,autoSelectFamily:!0}));d.setNoDelay(!0),d.setKeepAlive(!0,3e4);let f=setTimeout(()=>d.destroy(Error("Upstream HTTP/2 TLS connect timeout")),i.connectTimeoutMs+i.tlsHandshakeTimeoutMs);f.unref?.(),d.once("secureConnect",()=>{clearTimeout(f),"h2"!==d.alpnProtocol&&d.destroy(Error("Upstream did not negotiate HTTP/2"))}),d.once("error",()=>clearTimeout(f)),d.once("close",()=>clearTimeout(f));let j=`https://${b.host}${443===b.port?"":`:${b.port}`}`,k=e.connect(j,{createConnection:()=>d,settings:{enablePush:!1}});return D.add(k),k.setTimeout(i.idleTimeoutMs,()=>k.destroy(Error("Upstream HTTP/2 idle timeout"))),k.once("close",()=>D.delete(k)),await new Promise((a,b)=>{let c=setTimeout(()=>b(Error("Upstream HTTP/2 session timeout")),i.connectTimeoutMs+i.tlsHandshakeTimeoutMs);c.unref?.();let d=(a,b)=>{clearTimeout(c),k.removeListener("connect",e),k.removeListener("error",f),a(b)},e=()=>d(a,k),f=a=>d(b,a);k.once("connect",e),k.once("error",f)}),k})().catch(b=>{throw a.upstreamPromise=null,b})),a.upstreamPromise}async function $(a,b){let c=C.get(a.session),d=c?.target;if(!c||!d){a.respond({":status":502,"content-type":"text/plain"}),a.end("Audit target is missing");return}a.pause();let f=Date.now(),g=new L(i.captureBodies?i.captureLimitBytes:0),h=new L(i.captureBodies?i.captureLimitBytes:0),j={},k=null,l=!1,m=!1,n=null,o=null,p=null,q=(e=null)=>{l||(l=!0,K(M({requestHeaders:b,method:b[":method"]||"GET",path:b[":path"]||"/",target:d,requestCapture:g,responseCapture:h,responseHeaders:j,statusCode:k,startedAt:f,error:e,socket:a.session.socket,protocol:"h2",authUser:c.authUser||null})))};try{(n=(await Z(c)).request(function(a,b){let c=I(a,{stripInternal:!0}),d={":method":a[":method"]||"GET",":path":a[":path"]||"/",":scheme":"https",":authority":443===b.port?b.host:`${b.host}:${b.port}`};for(let[a,b]of Object.entries(c))a.startsWith(":")||(d[a.toLowerCase()]=b);return d}(b,d),{endStream:!1,waitForTrailers:!0})).setTimeout(i.idleTimeoutMs,()=>n.close(e.constants.NGHTTP2_CANCEL)),a.setTimeout(i.idleTimeoutMs,()=>a.close(e.constants.NGHTTP2_CANCEL)),n.on("response",b=>{j=R(b),k=Number(b[":status"]||502),a.respond(function(a){let b=I(a,{stripInternal:!1}),c={":status":Number(a[":status"]||502)};for(let[a,d]of Object.entries(b))a.startsWith(":")||(c[a.toLowerCase()]=d);return c}(b),{waitForTrailers:!0})}),n.on("trailers",a=>{p=I(a,{stripInternal:!1})}),a.on("wantTrailers",()=>{try{a.sendTrailers(p||{})}catch{}}),a.on("trailers",a=>{o=I(a,{stripInternal:!0})}),n.on("wantTrailers",()=>{try{n.sendTrailers(o||{})}catch{}}),a.on("data",b=>{g.add(b),n.write(b)||a.pause()}),n.on("drain",()=>a.resume()),a.on("end",()=>n.end()),n.on("data",b=>{h.add(b),a.write(b)||n.pause()}),a.on("drain",()=>n.resume()),n.on("end",()=>{m=!0,a.end(),q(null)}),n.on("aborted",()=>{let b=Error("Upstream HTTP/2 stream aborted");a.close(e.constants.NGHTTP2_INTERNAL_ERROR),q(b)}),n.on("error",b=>{a.closed||a.close(e.constants.NGHTTP2_INTERNAL_ERROR),q(b)}),a.on("aborted",()=>{n.close(e.constants.NGHTTP2_CANCEL),q(Error("Client HTTP/2 stream aborted"))}),a.on("error",a=>{n.close(e.constants.NGHTTP2_CANCEL),q(a)}),a.on("close",()=>{m||!n||n.closed||(n.close(e.constants.NGHTTP2_CANCEL),q(Error("Client HTTP/2 stream closed")))}),a.resume()}catch(b){a.headersSent||a.closed||a.respond({":status":502,"content-type":"application/json"}),a.closed||a.end(JSON.stringify({error:"Verified upstream HTTP/2 request failed"})),q(b)}}Y.on("checkContinue",(a,b)=>{X(a,b,{expectContinue:!0})}),Y.on("upgrade",(a,b)=>{Q(b,"501 Not Implemented",O),W(a,b,b.__auditTarget)}),Y.on("clientError",(a,b)=>F(b)),Y.headersTimeout=i.responseHeaderTimeoutMs,Y.requestTimeout=0,Y.keepAliveTimeout=i.idleTimeoutMs;let _=e.createServer({settings:{enablePush:!1}});_.on("session",a=>{let b={target:a.socket.__auditTarget,authUser:a.socket.__auditProxyUser||null,upstreamPromise:null};C.set(a,b),a.setTimeout(i.idleTimeoutMs,()=>a.destroy(Error("Client HTTP/2 idle timeout"))),a.once("close",()=>{Promise.resolve(b.upstreamPromise).then(a=>a?.close()).catch(()=>{})})}),_.on("stream",(a,b)=>{$(a,b)}),_.on("sessionError",a=>{console.warn("[audit-proxy] HTTP/2 client session error:",a?.message||a)});let aa=d.createServer((a,b)=>{b.writeHead(403,{"content-type":"text/plain; charset=utf-8",connection:"close"}),b.end("Audit Proxy accepts HTTPS CONNECT traffic only")});function ab(){o=r(i.allowedClientTools),p=i.proxyAuthEnabled?x(i.proxyAuthUsers):null,z=i.proxyAuthEnabled?y():null,aa.headersTimeout=i.responseHeaderTimeoutMs,aa.keepAliveTimeout=i.idleTimeoutMs,Y.headersTimeout=i.responseHeaderTimeoutMs,Y.keepAliveTimeout=i.idleTimeoutMs,aa.auditCapabilities={http1:!0,http2:i.clientAlpnProtocols.includes("h2"),proxyAuth:!0===i.proxyAuthEnabled,plainHttp:!1,publicConnectPorts:[...i.allowedConnectPorts]}}return aa.on("connect",(a,b,c)=>{(async()=>{let d,e;try{d=G(a.url,443)}catch(e){let c=e.message||"Invalid CONNECT authority";Q(b,"400 Bad Request",c),T(a,b,d,c,{statusCode:400});return}let f=await V(a,b);if(f===U)return;try{await m(d.host,d.port)}catch(e){let c=e.message||"Destination is not allowed";Q(b,"403 Forbidden",c),T(a,b,d,c,{authUser:f});return}if(i.clientToolFilterEnabled&&s(a.headers["user-agent"],o)){let c=`Client tool is not allowed to use this proxy (${t(a.headers["user-agent"])})`;Q(b,"403 Forbidden",c),T(a,b,d,c);return}if(!H(d.host,i.allowedHosts)){if(!i.passthroughUnknown){let c="Host is not in the audit allowlist";Q(b,"403 Forbidden",c),T(a,b,d,c);return}let e=!1;try{let a=await m(d.host,d.port),f=E(g.connect({host:d.host,port:d.port,lookup:a.lookup,autoSelectFamily:!0})),h=setTimeout(()=>f.destroy(Error("TCP passthrough connect timeout")),i.connectTimeoutMs);h.unref?.(),f.setNoDelay(!0),f.setKeepAlive(!0,3e4),f.setTimeout(i.idleTimeoutMs,()=>f.destroy(Error("TCP passthrough idle timeout"))),f.once("connect",()=>{clearTimeout(h),e=!0,b.write("HTTP/1.1 200 Connection Established\r\nProxy-Agent: BlueRouter-Audit\r\n\r\n"),c?.length&&f.write(c),f.pipe(b),b.pipe(f)}),f.once("error",()=>{clearTimeout(h),e?F(b):Q(b,"502 Bad Gateway","TCP passthrough failed")}),b.once("error",()=>F(f)),b.once("close",()=>F(f))}catch(a){Q(b,"502 Bad Gateway",a.message||"TCP passthrough failed")}return}try{if(e=j(d.host),!e?.key||!e?.cert)throw Error("Certificate provider returned no certificate")}catch(a){Q(b,"500 Internal Server Error",`Cannot issue audit certificate: ${a.message}`);return}b.write("HTTP/1.1 200 Connection Established\r\nProxy-Agent: BlueRouter-Audit\r\n\r\n"),c?.length&&b.unshift(c);let k=E(new h.TLSSocket(b,{isServer:!0,key:e.key,cert:e.cert,ALPNProtocols:i.clientAlpnProtocols}));k.__auditTarget=d,k.__auditProxyUser=f,k.__auditDlpGroups=b.__auditDlpGroups||[],k.__auditDashboardUser=b.__auditDashboardUser||null,k.setNoDelay(!0),k.setKeepAlive(!0,3e4),k.setTimeout(i.idleTimeoutMs,()=>k.destroy(Error("Client TLS idle timeout")));let l=setTimeout(()=>k.destroy(Error("Client TLS handshake timeout")),i.tlsHandshakeTimeoutMs);l.unref?.();let n=!1,p=()=>{n||(n=!0,clearTimeout(l),"h2"===k.alpnProtocol?_.emit("connection",k):Y.emit("connection",k))};k.once("secure",p),k.once("secureConnect",p),k.once("error",()=>{clearTimeout(l),F(k)}),k.once("close",()=>clearTimeout(l))})().catch(a=>Q(b,"500 Internal Server Error",a.message||"Audit CONNECT failed"))}),aa.prependListener("connection",a=>{E(a),a.setNoDelay(!0),a.setKeepAlive(!0,3e4)}),aa.on("upgrade",(a,b)=>Q(b,"501 Not Implemented",O)),aa.on("clientError",(a,b)=>F(b)),aa.headersTimeout=i.responseHeaderTimeoutMs,aa.requestTimeout=0,aa.keepAliveTimeout=i.idleTimeoutMs,aa.forceCloseAll=()=>{for(let a of D)try{a.destroy()}catch{}for(let a of B.values())try{a.destroy()}catch{}for(let a of[...A])F(a)},aa.getActiveConnectionCount=()=>A.size,aa.auditConfig=i,ab(),aa.applyConfig=(a={})=>{let b={};for(let[c,d]of(a.bindHost&&String(a.bindHost)!==String(i.bindHost)&&(b.bindHost=String(a.bindHost)),Number(a.port)&&Number(a.port)!==Number(i.port)&&(b.port=Number(a.port)),Object.entries(a)))"bindHost"!==c&&"port"!==c&&(["verifyUpstreamTls","allowPlainHttp","allowedConnectPorts","clientAlpnProtocols"].includes(c)||(i[c]=d));return ab(),{rebindRequired:Object.keys(b).length>0,pending:b}},aa},hostMatches:H,parseAuthority:G,stripHopByHop:I,CaptureBuffer:L,detectProvider:M,extractModel:O,decodeCapturedBuffer:J}},49083:(a,b,c)=>{let{createAuditProxy:d}=c(45372),{loadConfig:e,saveConfig:f,validateConfig:g,CONFIG_PATH:h,AUDIT_LOG_PATH:i,AUDIT_LOG_DIR:j,PROXY_AUTH_FEATURE_ENABLED:k}=c(43096),{hashProxyPassword:l,isValidUsername:m,normalizeProxyUsers:n,redactProxyAuthUsers:o,PASSWORD_MAX_BYTES:p,PASSWORD_MIN_BYTES:q}=c(7566),{normalizeIp:r}=c(5565),{attachClientIpGate:s,effectiveClientIpPolicy:t,normalizeAccessGrants:u,normalizeGrantUserId:v}=c(77407),{getProxySession:w,pruneExpiredProxySessions:x,revokeProxySession:y,revokeProxySessionsForUser:z}=c(68257),{SETTINGS_KEY:A,extractAuditPolicy:B,mergeAuditPolicy:C,policyEquals:D}=c(85463),{enqueueAuditJob:E,readRecent:F,clearAudit:G,pruneExpired:H,startAuditMaintenance:I,stopAuditMaintenance:J,flushAuditQueue:K,registerAuditShutdownFlush:L,unregisterAuditShutdownFlush:M,getAuditStoreStats:N}=c(90173),{ensureAuditRootCA:O,createAuditCertificateProvider:P,getStatusRootCaValidation:Q}=c(85074),{readRootCAInfo:R}=c(2466),{runSelfTest:S}=c(85252);function T(){return globalThis.__blueRouterAuditProxyRuntime||(globalThis.__blueRouterAuditProxyRuntime={server:null,certificateProvider:null,ipPolicy:null,ipGate:null,startedAt:null,lastError:null,autostartPromise:null,autostartRetryTimer:null,lifecycle:Promise.resolve()}),globalThis.__blueRouterAuditProxyRuntime}function U(a){let b=T(),c=b.lifecycle.then(a,a);return b.lifecycle=c.catch(()=>{}),c}async function V(a,b=1500){if(!a)return;let c=Math.max(0,Number(b)||0);await new Promise(b=>{let d=!1,e=()=>{d||(d=!0,b())};try{a.listening?a.close(e):e()}catch{e()}let f=setTimeout(()=>{try{a.forceCloseAll?.()}catch{}},c);f.unref?.();let g=setTimeout(e,c+2e3);g.unref?.()});try{a.forceCloseAll?.()}catch{}}function W(a){let b=e();return{...a,proxyAuthEnabled:!0===b.proxyAuthEnabled,proxyAuthUsers:[...b.proxyAuthUsers||[]],accessGrants:u(b.accessGrants)}}let X=null;function Y(){let a=x();if(0===a)return;let b=T();if(!b.server?.listening)return;let c=b.ipGate?.dropRevoked()||0;console.log(`[audit-proxy] session sweep: ${a} session(s) expired, ${c} connection(s) closed`)}async function Z(a=null){let b=T();if(b.server?.listening)return ag();let c=a?f({...W(a),enabled:!1}):e();await O(),await H(),I(),X||(X=setInterval(Y,3e4),X.unref?.()),L();let g=P({maxEntries:128});g.prewarm(c.allowedHosts);let h=d(c,{certificateProvider:g,onAuditJob:E});b.ipPolicy=t(c),b.ipGate=s(h,()=>T().ipPolicy);try{let a=await new Promise((a,b)=>{let d=a=>{h.removeListener("listening",e),b(a?.code==="EADDRNOTAVAIL"?Error(`Cannot bind ${c.bindHost}:${c.port} - that address does not exist on this machine. In Docker the container cannot bind the host's LAN IP: set the bind address to 0.0.0.0 and let the published port (-p 3128:3128) expose it on the host.`,{cause:a}):a?.code==="EACCES"?Error(`Cannot bind ${c.bindHost}:${c.port} - permission denied. Ports below 1024 need extra privileges; pick a high port such as 3128.`,{cause:a}):a)},e=()=>{h.removeListener("error",d),a(h.address())};h.once("error",d),h.once("listening",e),h.listen(c.port,c.bindHost)});return b.server=h,b.certificateProvider=g,b.startedAt=new Date().toISOString(),b.lastError=null,ae(),f({...c,enabled:!0}),{...await ag(),address:a}}catch(a){b.lastError=a.message||String(a);try{h.forceCloseAll?.()}catch{}try{h.close()}catch{}throw g.clear?.(),a}}async function $({persist:a=!0}={}){let b=T();ae();let c=b.server,d=e();if(b.server=null,b.startedAt=null,await V(c,d.shutdownGraceMs),b.certificateProvider?.clear?.(),b.certificateProvider=null,b.ipGate=null,!await K(3e3)){let a=N();console.warn(`[audit-proxy] audit queue did not drain within 3000ms; ${a.queueDepth} event(s) still queued`)}return M(),J(),X&&clearInterval(X),X=null,a&&f({...d,enabled:!1}),ag()}async function _(a=null){return await $({persist:!1}),a&&f({...W(a),enabled:!1}),Z()}function aa(a=null){return U(()=>Z(a))}let ab=new Set(["1","true","yes","on"]),ac=[2e3,5e3,15e3,3e4,6e4];function ad(a){return a?.code==="EADDRINUSE"||a?.cause?.code==="EADDRINUSE"}function ae(){let a=T();a.autostartRetryTimer&&(clearTimeout(a.autostartRetryTimer),a.autostartRetryTimer=null)}async function af(){let a,b=T();await am();let c=e(),d=null!=(a=process.env.AUDIT_PROXY_ENABLED)&&""!==a&&ab.has(String(a).trim().toLowerCase());return c.enabled||d?b.server?.listening?{started:!1,reason:"already-running",status:await ag()}:(d&&!c.enabled&&console.log("[audit-proxy] starting because AUDIT_PROXY_ENABLED is set, despite stored enabled=false"),b.autostartPromise||(b.autostartPromise=(async()=>{try{let a=await aa();return console.log(`[audit-proxy] autostarted on ${c.bindHost}:${c.port}`),{started:!0,status:a}}catch(c){b.lastError=c?.message||String(c),console.log("[audit-proxy] autostart failed:",b.lastError);let a=ad(c);return a&&function a(b){let c=T(),d=ac[b-1];d?c.autostartRetryTimer||(c.autostartRetryTimer=setTimeout(async()=>{if((c.autostartRetryTimer=null,!c.server?.listening)&&e().enabled)try{await aa(),console.log(`[audit-proxy] autostart succeeded on retry ${b}`)}catch(d){c.lastError=d?.message||String(d),console.log(`[audit-proxy] autostart retry ${b} failed:`,c.lastError),ad(d)&&a(b+1)}},d),c.autostartRetryTimer.unref?.()):console.warn(`[audit-proxy] autostart still failing after ${ac.length} retries; start it from the dashboard once the cause is cleared`)}(1),{started:!1,error:b.lastError,retrying:a}}finally{b.autostartPromise=null}})()),b.autostartPromise):{started:!1,reason:"disabled"}}async function ag(){let a=T(),b=e(),c=t(b),d=!!a.server?.listening,f=R();try{let a=Q();f={...f,validated:!0===a.exists,expiringSoon:!0===a.expiringSoon,autoRotation:!1}}catch(a){f={...f,validated:!1,autoRotation:!1,error:a.message||String(a)}}return{running:d,listening:d,startedAt:a.startedAt,lastError:a.lastError,address:d?a.server.address():null,pendingListenerRestart:d&&!function(a,b){if(!a)return!0;let c=String(b.bindHost||"").trim().toLowerCase(),d=r(a.address||""),e=r("localhost"===c?"127.0.0.1":c);return Number(a.port)===Number(b.port)&&d===e}(a.server.address(),b),activeConnections:d&&a.server.getActiveConnectionCount?.()||0,capabilities:d?a.server.auditCapabilities:{http1:!0,http2:!1,plainHttp:!1,publicConnectPorts:[443]},security:{clientIpFilterEnabled:c.enabled,clientIpFilterSource:c.source,enforcedClientIpCount:c.allowedClientIps.length,accessGrantCount:c.grants.length,sessionIdleTimeoutMs:b.sessionIdleTimeoutMs,activeSessionCount:c.sessions.length,clientToolFilterEnabled:!0===b.clientToolFilterEnabled,proxyAuthEnabled:!0===b.proxyAuthEnabled,proxyAuthFeatureEnabled:k,allowedClientToolCount:(b.allowedClientTools||[]).length,privateDestinationsBlocked:!0,plainHttpBlocked:!0,upstreamTlsVerified:!0},activeSessions:c.sessions.map(a=>({ip:a.ip,userId:a.userId,displayName:a.displayName,activatedAt:new Date(a.activatedAt).toISOString(),expiresAt:new Date(a.expiresAt).toISOString()})),certificateCache:a.certificateProvider?.stats?.()||{entries:0},auditStore:N(),configPath:h,auditLogPath:i,auditLogDirectory:j,rootCA:f}}async function ah(a=50,{includeEvents:b=!0}={}){let c=e(),[d,f]=await Promise.all([ag(),b?F(a):[]]);return{config:ai(c),status:d,events:f}}function ai(a){return a?{...a,proxyAuthUsers:o(a.proxyAuthUsers)}:a}async function aj(){return Promise.resolve().then(c.bind(c,89718))}async function ak(){try{let{isClusterStandby:a}=await c.e(2763).then(c.bind(c,62763));return await a()===!0}catch{return!1}}async function al(a){try{if(await ak())return{mirrored:!1,reason:"standby"};let{getSettings:b,updateSettings:c}=await aj(),d=B(a),e=await b();if(JSON.stringify(e?.[A]||null)===JSON.stringify(d))return{mirrored:!1,reason:"unchanged"};return await c({[A]:d}),{mirrored:!0}}catch(a){return console.warn("[audit-proxy] failed to mirror policy to settings:",a?.message||a),{mirrored:!1,error:a?.message||String(a)}}}async function am({force:a=!1}={}){try{if(!a&&!await ak())return{applied:!1,reason:"not-standby"};let{getSettings:b}=await aj(),c=await b(),d=c?.[A];if(!d||"object"!=typeof d)return{applied:!1,reason:"no-policy"};let f=e();if(D(f,d))return{applied:!1,reason:"unchanged"};let g=C(f,d),h=await an(g,{mirror:!1});return console.log("[audit-proxy] applied cluster policy from snapshot"),{applied:!0,restarted:!0===h.restarted,droppedConnections:h.droppedConnections||0}}catch(a){return console.warn("[audit-proxy] failed to apply cluster policy:",a?.message||a),{applied:!1,error:a?.message||String(a)}}}function an(a,{mirror:b=!0}={}){return U(async()=>{let c=T(),d=!!c.server?.listening,e=f({...g(a),enabled:d});c.ipPolicy=t(e);let h=!1,i={},j=0;if(d){let a=c.server.applyConfig?.(e)||{};h=!0===a.rebindRequired,i=a.pending||{},j=c.ipGate?.dropRevoked()||0;try{c.certificateProvider?.prewarm?.(e.allowedHosts)}catch{}}return b&&await al(e),{config:ai(e),status:await ag(),restarted:!1,appliedInstantly:!0,rebindRequired:h,pendingListener:i,droppedConnections:j}})}a.exports={startProxy:aa,ensureAuditProxyAutostart:af,stopProxy:function(a={}){return U(()=>$(a))},restartProxy:function(a=null){return U(()=>_(a))},getStatus:ag,getSnapshot:ah,readRecentAuditEvents:F,updateConfig:function(a){return an(W(a))},updateClientProxyHost:function(a){return an({...e(),clientProxyHost:String(a||"").trim()})},updateProxyAuth:async function a({enabled:b,users:c}={}){if(!0===b&&!k)throw Error("Proxy authentication is turned off in this deployment (PROXY_AUTH_FEATURE_ENABLED in audit-gateway/config.js)");let d=e(),f=new Map(n(d.proxyAuthUsers).map(a=>[a.username.toLowerCase(),a])),g=new Set,h=[];for(let a of Array.isArray(c)?c:[]){let b=String(a?.username||"").trim();if(!m(b))throw Error(`Invalid username: ${b||"(empty)"}`);let c=b.toLowerCase();if(g.has(c))throw Error(`Duplicate username: ${b}`);g.add(c);let d="string"==typeof a?.password?a.password:"";if(d){let a=Buffer.byteLength(d,"utf8");if(a<q)throw Error(`Password for ${b} must be at least ${q} characters`);if(a>p)throw Error(`Password for ${b} must be at most ${p} bytes`);h.push({username:b,passwordHash:await l(d)});continue}let e=f.get(c);if(!e)throw Error(`Account ${b} requires a password`);h.push({username:b,passwordHash:e.passwordHash})}return an({...d,proxyAuthEnabled:!0===b,proxyAuthUsers:h})},listAccessGrants:function(){return u(e().accessGrants)},applyAuditPolicyFromSettings:am,upsertAccessGrant:function({userId:a,note:b}={}){let c=v(a);if(!c)throw Error("Grant requires a dashboard username or email");let d=e(),f=u(d.accessGrants).filter(a=>a.userId!==c);return f.push({userId:c,note:b}),an({...d,accessGrants:f})},deleteAccessGrant:function(a){let b=v(a);if(!b)throw Error("Grant requires a dashboard username or email");let c=e(),d=u(c.accessGrants).filter(a=>a.userId!==b);return z(b),an({...c,accessGrants:d})},getOwnProxySession:function(a){return w(a)},revokeSession:function({ip:a,userId:b}={}){let c=a?+!!y(a):z(b);if(0===c)return{removed:0,droppedConnections:0};let d=T();return d.server?.listening?{removed:c,droppedConnections:d.ipGate?.dropRevoked()||0}:{removed:c,droppedConnections:0}},clearAudit:G,runSelfTest:S}},78864:(a,b,c)=>{let d=c(14985).promises,e=c(91645),{normalizeIp:f,clientIpMatches:g}=c(5565),h=new Map,i=Object.freeze(["0.0.0.0/8","10.0.0.0/8","100.64.0.0/10","127.0.0.0/8","169.254.0.0/16","172.16.0.0/12","192.0.0.0/24","192.0.2.0/24","192.88.99.0/24","192.168.0.0/16","198.18.0.0/15","198.51.100.0/24","203.0.113.0/24","224.0.0.0/4","240.0.0.0/4","::/96","::1/128","100::/64","2001:2::/48","2001:db8::/32","fc00::/7","fe80::/10","ff00::/8"]),j=Object.freeze(["0.0.0.0/8","127.0.0.0/8","169.254.0.0/16","224.0.0.0/4","240.0.0.0/4","::/96","::1/128","fe80::/10","ff00::/8"]),k=Object.freeze([".localhost",".local",".internal",".lan",".home.arpa"]);function l(a){return String(a||"").trim().replace(/^\[|\]$/g,"").replace(/\.$/,"").toLowerCase()}function m(a){let b=l(a);return!(!(!b||"localhost"===b||k.some(a=>b.endsWith(a)))&&(e.isIP(b)||b.includes(".")))}function n(a,b=process.env){let c=l(a);return!(!c||e.isIP(c))&&(function(a=process.env){return String(a.AUDIT_PROXY_PRIVATE_HOSTS||"").split(",").map(a=>l(a)).filter(Boolean)})(b).some(a=>a.startsWith("*.")?c.endsWith(a.slice(1))&&c.length>a.length-1:c===a)}function o(a){let b=f(a);return!!e.isIP(b)&&!g(b,j)}function p(a){let b=f(a);return!!e.isIP(b)&&!g(b,i)}function q(a){let b=[...new Set((Array.isArray(a)?a:[a]).map(a=>Number(a)).filter(a=>Number.isInteger(a)&&a>=1&&a<=65535))];return b.length?b:[443]}function r(a){let b=[...a?.addresses||[]];return function(c,d,e){let f=d,g=e;"function"==typeof d&&(g=d,f={});let h="number"==typeof f?f:Number(f?.family||0);if("object"==typeof f&&f?.all===!0){let c=4===h||6===h?b.filter(a=>a.family===h):b;if(!c.length){let b=Error(`No validated public address for ${a.host}`);b.code="ENOTFOUND",g(b);return}g(null,c.map(({address:a,family:b})=>({address:a,family:b})));return}let i=function(a,b=0){let c=Number(b||0);return 4===c||6===c?a.find(a=>a.family===c)||null:a.find(a=>4===a.family)||a[0]||null}(b,h);if(!i){let b=Error(`No validated public address for ${a.host}`);b.code="ENOTFOUND",g(b);return}g(null,i.address,i.family)}}async function s(a,b,c={}){let g=l(a),i=Number(b||443),j=q(c.allowedPorts||[443]);if(!g)throw Error("Destination host is empty");if(!Number.isInteger(i)||!j.includes(i))throw Error(`CONNECT destination port ${i||"unknown"} is not allowed`);let k=n(g);if(!k&&m(g))throw Error(`Private or local destination hostname is not allowed: ${g}`);let t=e.isIP(f(g));if(t){let a=f(g);if(!p(a))throw Error(`Private or reserved destination address is not allowed: ${a}`);let b={host:g,port:i,addresses:[{address:a,family:t}]};return{...b,lookup:r(b)}}let u=Date.now(),v=k?`private:${g}`:g,w=h.get(v);if(!w||w.expiresAt<=u){let a=await d.lookup(g,{all:!0,verbatim:!0}),b=[],c=new Set;for(let d of a||[]){let a=f(d.address),g=e.isIP(a);if(!g||!(k?o(a):p(a)))continue;let h=`${g}:${a}`;c.has(h)||(c.add(h),b.push({address:a,family:g}))}if(!b.length)throw Error(k?`Destination did not resolve to a permitted address: ${g}`:`Destination did not resolve to a public address: ${g}`);w={addresses:b,expiresAt:u+6e4},h.set(v,w)}let x={host:g,port:i,addresses:[...w.addresses]};return{...x,lookup:r(x)}}a.exports={BLOCKED_ADDRESS_RANGES:i,normalizeTargetHost:l,normalizeAllowedPorts:q,isBlockedHostname:m,isPublicAddress:p,isPrivateAllowedHost:n,isPermittedPrivateAddress:o,createPinnedLookup:r,resolvePublicTarget:s,clearDnsPolicyCache:function(){h.clear()}}},85252:(a,b,c)=>{let d=c(81630),e=c(73496),f=c(91645),g=c(34631),h=c(74075),i=c(55511),j=c(15296),{createAuditProxy:k,CaptureBuffer:l}=c(45372),{containsLikelySecret:m}=c(48350),{clientIpMatches:n,normalizeAllowedClientIps:o}=c(5565),{normalizeAllowedTools:p,clientToolMatches:q,shouldRefuseClientTool:r}=c(98586),{createProxyAuthenticator:s,createProxyAuthLimiter:t,hashProxyPassword:u,parseBasicProxyAuthorization:v}=c(7566),{isPublicAddress:w}=c(78864),{validateConfig:x,PROXY_AUTH_FEATURE_ENABLED:y}=c(43096),{normalizeAccessGrants:z,effectiveClientIpPolicy:A,attachClientIpGate:B,findAccessGrant:C}=c(77407),{activateProxySession:D,touchProxySession:E,getProxySession:F,revokeProxySession:G,clearAllProxySessions:H}=c(68257),{promptLogMirrorDecision:I}=c(90173);function J(a){return i.createHash("sha256").update(a).digest("hex")}function K(a){let b=j.pki.rsa.generateKeyPair(2048),c=j.pki.createCertificate();c.publicKey=b.publicKey,c.serialNumber=String(Date.now()),c.validity.notBefore=new Date(Date.now()-6e4),c.validity.notAfter=new Date(Date.now()+864e5);let d=[{name:"commonName",value:a}];return c.setSubject(d),c.setIssuer(d),c.setExtensions([{name:"basicConstraints",cA:!0,critical:!0},{name:"keyUsage",keyCertSign:!0,cRLSign:!0,critical:!0}]),c.sign(b.privateKey,j.md.sha256.create()),{cert:c,keys:b,certPem:j.pki.certificateToPem(c)}}function L(a,b){let c=j.pki.rsa.generateKeyPair(2048),d=j.pki.createCertificate();return d.publicKey=c.publicKey,d.serialNumber=`${Date.now()}${Math.floor(1e3*Math.random())}`,d.validity.notBefore=new Date(Date.now()-6e4),d.validity.notAfter=new Date(Date.now()+864e5),d.setSubject([{name:"commonName",value:b}]),d.setIssuer(a.cert.subject.attributes),d.setExtensions([{name:"basicConstraints",cA:!1},{name:"keyUsage",digitalSignature:!0,keyEncipherment:!0},{name:"extKeyUsage",serverAuth:!0},{name:"subjectAltName",altNames:[{type:2,value:b}]}]),d.sign(a.keys.privateKey,j.md.sha256.create()),{cert:j.pki.certificateToPem(d),key:j.pki.privateKeyToPem(c.privateKey)}}function M(a,b="127.0.0.1"){return new Promise((c,d)=>{a.once("error",d),a.listen(0,b,()=>{a.removeListener("error",d),c(a.address())})})}function N(a){return new Promise(b=>{if(!a)return b();try{a.forceCloseAll?.()}catch{}if(!a.listening)return b();a.close(()=>b()),setTimeout(b,1e3).unref?.()})}function O(a,b){let c="127.0.0.1";return Promise.resolve({host:a,port:b,addresses:[{address:c,family:4}],lookup:(a,b,d)=>{let e=b,f=d;"function"==typeof b&&(f=b,e={}),e?.all?f(null,[{address:c,family:4}]):f(null,c,4)}})}function P(a,b,c="",d=""){return new Promise((e,g)=>{let h=f.connect(a,"127.0.0.1"),i=Buffer.alloc(0),j=setTimeout(()=>g(Error("CONNECT timeout")),7e3);h.once("error",g),h.once("connect",()=>{let a=c?`User-Agent: ${c}\r
 `:"";h.write(`CONNECT ${b} HTTP/1.1\r
 Host: ${b}\r
 ${a}${d}Proxy-Connection: keep-alive\r
@@ -45,7 +45,7 @@ Sec-WebSocket-Version: 13\r
 `)});let m=()=>{clearTimeout(l),f(Buffer.concat(k).toString("latin1"))};j.on("data",a=>{k.push(Buffer.from(a)),Buffer.concat(k).indexOf("\r\n\r\n")>=0&&m()}),j.on("end",m),j.on("close",m)})}({socket:aq,ca:aa.certPem,servername:"localhost",port:a.port,path:"/v1/messages?transport=websocket"});c("Protocol upgrade is refused, not silently downgraded",ar.startsWith("HTTP/1.1 501"),ar.slice(0,40)),c("Upgrade refusal tells the client what to do instead",/HTTP streaming transport/i.test(ar)),c("Upgrade never reaches the origin",!ae.some(a=>String(a.path||"").includes("transport=websocket"))),await new Promise(a=>setTimeout(a,100)),c("Refused upgrade is still audited",ai.some(a=>501===a.status&&String(a.path||"").includes("transport=websocket")));let as=ai.find(a=>501===a.status&&String(a.path||"").includes("transport=websocket"));c("Refused upgrade is flagged as denied",as?.denied===!0,String(as?.denied)),c("Refused upgrade is not mirrored into prompt_logs","denied"===I(as).reason);let at=ae.find(a=>String(a.path||"").includes("encoded=")),au=ae.find(a=>String(a.path||"").includes("h2-preferred"));c("HTTP/1.1 path/query preserved",at?.path===W),c("Downgraded path/query preserved",au?.path===_),c("HTTP/1.1 request body byte-identical",at&&J(at.body)===J(V)),c("Downgraded request body byte-identical",au&&J(au.body)===J(Z)),c("Authorization preserved on wire",ae.every(a=>"Bearer test-secret-authorization-123456789"===a.authorization)),c("x-api-key preserved on wire",ae.every(a=>"sk-test-supersecret-123456789"===a.apiKey)),c("Internal x-9r-* header stripped",ae.every(a=>null==a.internalHeader));let av=ai.find(a=>String(a.path||"").includes("encoded=")),aw=ai.find(a=>String(a.path||"").includes("h2-preferred"));c("HTTP/1.1 audit event captured",!!av),c("Downgraded audit event captured",!!aw),c("Request wire SHA-256 recorded",av?.request?.wireSha256===J(V)&&aw?.request?.wireSha256===J(Z)),c("Response wire SHA-256 recorded",av?.response?.wireSha256===J(ad)&&aw?.response?.wireSha256===J(ad)),c("Compressed audit response decoded",av?.response?.body?.includes("compressed response preserved")&&aw?.response?.body?.includes("compressed response preserved"));let ax=I(av);c("Exchange with a prompt is mirrored with both halves",!0===ax.mirror&&ax.promptText?.includes("hello h1")&&ax.responseText?.includes("compressed response preserved"),JSON.stringify({mirror:ax.mirror,prompt:ax.promptText,response:ax.responseText}));let ay={...av,path:"/api/claude_code/telemetry",request:{...av.request,body:JSON.stringify({events:[{eventName:"tengu_api_success",metadata:{durationMs:120}}]})},response:{...av.response,body:JSON.stringify({accepted_count:17,rejected_count:0})}},az=I(ay);c("Telemetry exchange is not mirrored into prompt_logs",!1===az.mirror&&"not-inference"===az.reason,JSON.stringify(az));let aA={...av,path:"/backend-api/ps/plugins/list?scope=GLOBAL",request:{...av.request,body:""},response:{...av.response,body:JSON.stringify({items:[{text:"gmail@openai-curated-remote"}]})}};c("Plugin listing is not mirrored into prompt_logs","not-inference"===I(aA).reason);let aB={...av,request:{...av.request,body:""},response:{...av.response,body:"[br audit body capture truncated; decoded body unavailable]"}};c("Capture placeholder does not count as content","contentless"===I(aB).reason);let aC=ai.filter(a=>"authorization"in(a.request?.headers||{}));c("Authorization redacted in audit",aC.length>0&&aC.every(a=>"[REDACTED]"===a.request.headers.authorization));let aD=ai.filter(a=>"x-api-key"in(a.request?.headers||{}));c("x-api-key redacted in audit",aD.length>0&&aD.every(a=>"[REDACTED]"===a.request.headers["x-api-key"])),c("No likely API secret persisted",ai.length>=2&&ai.every(a=>!m(a)));let aE={allowedHosts:[...aj.auditConfig.allowedHosts],clientToolFilterEnabled:aj.auditConfig.clientToolFilterEnabled,allowedClientTools:[...aj.auditConfig.allowedClientTools||[]]},aF=aj.auditConfig.port,aG=aj.auditConfig.bindHost;try{let d=`localhost:${a.port}`;aj.applyConfig({...aj.auditConfig,allowedHosts:[]});let e=await function(a,b,c=""){return new Promise(d=>{let e=f.connect(a,"127.0.0.1"),g="",h=!1,i=()=>{if(!h){h=!0,clearTimeout(j);try{e.destroy()}catch{}d(g)}},j=setTimeout(i,3e3);e.once("error",i),e.once("connect",()=>e.write(`CONNECT ${b} HTTP/1.1\r
 Host: ${b}\r
 ${c}\r
-`)),e.on("data",a=>{g+=a.toString("utf8")}),e.on("close",i)})}(b.port,d);c("Removing a host from the allowlist applies with no restart",/HTTP\/1\.1 403\b/.test(e),JSON.stringify(e.slice(0,120))),aj.applyConfig({...aj.auditConfig,allowedHosts:["localhost"]});let g=await P(b.port,d).catch(a=>a);c("Re-adding it works on the next CONNECT",!(g instanceof Error),g instanceof Error?g.message:""),g?.destroy?.(),aj.applyConfig({...aj.auditConfig,clientToolFilterEnabled:!0,allowedClientTools:p(["claude-code"])});let h=await Q(b.port,d,"User-Agent: Mozilla/5.0 Chrome/131.0\r\n");c("Turning the tool filter on applies with no restart",/HTTP\/1\.1 403\b/.test(h),JSON.stringify(h.slice(0,120))),aj.applyConfig({...aj.auditConfig,clientToolFilterEnabled:!1,allowedClientTools:[]});let i=await P(b.port,d,"Mozilla/5.0 Chrome/131.0").catch(a=>a);c("Turning it off applies with no restart",!(i instanceof Error),i instanceof Error?i.message:""),i?.destroy?.(),aj.applyConfig({...aj.auditConfig,captureLimitBytes:4096}),c("Capture limit is updated in place",4096===aj.auditConfig.captureLimitBytes);let j=aj.applyConfig({...aj.auditConfig,port:b.port+1,bindHost:"0.0.0.0"});c("A listener address/port change is reported as pending, not applied",!0===j.rebindRequired&&j.pending.port===b.port+1&&"0.0.0.0"===j.pending.bindHost,JSON.stringify(j.pending)),c("The bound listener is left alone by applyConfig",aj.auditConfig.port===aF&&aj.auditConfig.bindHost===aG&&!0===aj.listening,`${aj.auditConfig.port}/${aj.auditConfig.bindHost} vs ${aF}/${aG}`);let k=await P(b.port,d).catch(a=>a);c("Traffic keeps flowing on the address that is bound",!(k instanceof Error),k instanceof Error?k.message:""),k?.destroy?.()}finally{aj.applyConfig({...aj.auditConfig,...aE})}ak=k({allowedHosts:["localhost"],passthroughUnknown:!1,captureBodies:!0,captureLimitBytes:1048576,verifyUpstreamTls:!0,allowedConnectPorts:[a.port],connectTimeoutMs:5e3,tlsHandshakeTimeoutMs:5e3,responseHeaderTimeoutMs:5e3,idleTimeoutMs:3e4},{certificateProvider:()=>ab,upstreamCa:$.certPem,resolveTarget:O,onAudit:()=>{throw Error("simulated audit sink failure")}});let aH=await M(ak),aI=await P(aH.port,`localhost:${a.port}`),aJ=await T({socket:aI,ca:aa.certPem,servername:"localhost",port:a.port,body:V,path:W});c("Audit sink failure does not fail proxied request",aJ.head.startsWith("HTTP/1.1 200"))}catch(a){c("Self-test execution",!1,a.message||String(a))}finally{await N(ak),await N(aj),await N(ah)}return{ok:b.length>0&&b.every(a=>a.ok),checks:b,passed:b.filter(a=>a.ok).length,total:b.length,durationMs:Date.now()-a}}}},85463:(a,b,c)=>{let{validateConfig:d}=c(43096),e=["accessGrants","allowedHosts","clientToolFilterEnabled","allowedClientTools","captureBodies","captureLimitBytes","passthroughUnknown","retentionDays","sessionIdleTimeoutMs","dlpEnabled","dlpMaxInspectBytes","dlpOversizeAction","dlpDefaultAction","dlpProfiles","dlpRules"],f=["enabled","bindHost","port","clientProxyHost","proxyAuthEnabled","proxyAuthUsers"];function g(a={}){let b={};for(let c of e)void 0!==a[c]&&(b[c]=Array.isArray(a[c])?[...a[c]]:a[c]);return b}a.exports={POLICY_FIELDS:e,NODE_LOCAL_FIELDS:f,SETTINGS_KEY:"auditProxyPolicy",extractAuditPolicy:g,mergeAuditPolicy:function(a={},b={}){let c={...a};for(let a of e)void 0!==b[a]&&(c[a]=b[a]);for(let b of f)c[b]=a[b];return d(c)},policyEquals:function(a={},b={}){return JSON.stringify(g(a))===JSON.stringify(g(b))}}},86455:a=>{function b(a){let b=Number(a);return!Number.isFinite(b)||b<0?0:Math.round(b)}function c(){return{inputTokens:0,outputTokens:0,cacheReadTokens:0,cacheCreationTokens:0,reasoningTokens:0,totalTokens:0,model:null,stopReason:null,streaming:!1,complete:!1,source:null}}function d(a){let b=String(a||"").trim();if(!b||"{"!==b[0])return null;try{let a=JSON.parse(b);return a&&"object"==typeof a&&!Array.isArray(a)?a:null}catch{return null}}function e(a,c){"string"==typeof c.model&&c.model&&!a.model&&(a.model=c.model);let d="response.completed"===c.type||"response.done"===c.type?c.response?.usage:null,e=d||c.usage;if(!e||"object"!=typeof e)return!1;d&&"string"==typeof c.response?.model&&c.response.model&&(a.model=c.response.model);let f=b(e.prompt_tokens??e.input_tokens),g=b(e.completion_tokens??e.output_tokens);if(!f&&!g)return!1;let h=b(e.prompt_tokens_details?.cached_tokens??e.input_tokens_details?.cached_tokens??e.cached_tokens??e.prompt_cache_hit_tokens);a.inputTokens=Math.max(0,f-h),a.cacheReadTokens=h,a.outputTokens=g,a.reasoningTokens=b(e.completion_tokens_details?.reasoning_tokens??e.output_tokens_details?.reasoning_tokens),a.complete=!0;let i=c.choices?.[0]?.finish_reason;return"string"==typeof i&&i&&(a.stopReason=i),!0}function f(a,f){let g=c();g.streaming=!0,g.source="sse";let h=!1;for(let c of function*(a){let b=String(a||""),c=0;for(;c<b.length;){let a=b.indexOf("\n",c);-1===a&&(a=b.length);let e=b.slice(c,a).trim();if(c=a+1,!e.startsWith("data:"))continue;let f=e.slice(5).trim();if(!f||"[DONE]"===f)continue;let g=d(f);g&&(yield g)}}(a)){if(("anthropic"===f||"message_start"===c.type||"message_delta"===c.type)&&function(a,c){let d=String(c.type||"");if("message_start"===d&&c.message&&"object"==typeof c.message){let d=c.message;"string"==typeof d.model&&d.model&&(a.model=d.model);let e=d.usage;return e&&"object"==typeof e&&(a.inputTokens=b(e.input_tokens)||a.inputTokens,a.cacheReadTokens=b(e.cache_read_input_tokens)||a.cacheReadTokens,a.cacheCreationTokens=b(e.cache_creation_input_tokens)||a.cacheCreationTokens),!0}if("message_delta"===d){let d=c.usage;d&&"object"==typeof d&&(a.outputTokens=b(d.output_tokens)||a.outputTokens,a.inputTokens=a.inputTokens||b(d.input_tokens),a.cacheReadTokens=a.cacheReadTokens||b(d.cache_read_input_tokens),a.cacheCreationTokens=a.cacheCreationTokens||b(d.cache_creation_input_tokens),a.complete=!0);let e=c.delta?.stop_reason;return"string"==typeof e&&e&&(a.stopReason=e),!0}return!1}(g,c)){h=!0;continue}e(g,c)&&(h=!0)}return h?g:null}function g(a){let f=d(a);if(!f)return null;let g=c();g.source="json","string"==typeof f.model&&f.model&&(g.model=f.model);let h=f.usage;return h&&"object"==typeof h?null!=h.input_tokens||null!=h.output_tokens?(g.inputTokens=b(h.input_tokens),g.outputTokens=b(h.output_tokens),g.cacheReadTokens=b(h.cache_read_input_tokens),g.cacheCreationTokens=b(h.cache_creation_input_tokens),g.complete=!0,"string"==typeof f.stop_reason&&(g.stopReason=f.stop_reason),g):e(g,f)?g:null:null}function h(a){return/\/count_tokens\b/.test(String(a||""))}function i(a){return a.inputTokens+a.cacheReadTokens+a.cacheCreationTokens}a.exports={extractUsageFromBody:function({provider:a,body:b,contentType:c="",path:d=""}={}){if("string"!=typeof b||!b||b.length>0x1000000||h(d))return null;let e=/event-stream/i.test(String(c||""))||b.includes("\ndata:")||b.startsWith("data:")?f(b,a)||g(b):g(b)||f(b,a);return e&&(e&&(e.inputTokens||e.outputTokens||e.cacheReadTokens||e.cacheCreationTokens)||e.model)?(e.totalTokens=e.inputTokens+e.outputTokens+e.cacheReadTokens+e.cacheCreationTokens,e):null},isTokenCountingEndpoint:h,toTokensJson:function(a){if(!a)return null;let b=i(a),c={input_tokens:a.inputTokens,output_tokens:a.outputTokens,prompt_tokens:b,completion_tokens:a.outputTokens,total_tokens:a.totalTokens,display_total_input_tokens:b,display_new_input_tokens:a.inputTokens,display_cached_input_tokens:a.cacheReadTokens,display_cache_creation_input_tokens:a.cacheCreationTokens,display_output_tokens:a.outputTokens};return a.cacheReadTokens&&(c.cache_read_input_tokens=a.cacheReadTokens),a.cacheCreationTokens&&(c.cache_creation_input_tokens=a.cacheCreationTokens),a.cacheReadTokens&&(c.cached_tokens=a.cacheReadTokens),a.reasoningTokens&&(c.reasoning_tokens=a.reasoningTokens),c},totalInputTokens:i}},90173:(a,b,c)=>{let d=c(29021),e=c(33873),f=c(4984),g=c(55511),{AUDIT_LOG_PATH:h,AUDIT_LOG_DIR:i,ensureAuditDir:j,loadConfig:k}=c(43096),{redactObject:l,scrubString:m}=c(48350),{toTokensJson:n,totalInputTokens:o}=c(86455),{publishRecentUsage:p}=c(87662),q="audit-proxy",r="client",s="provider_response",t=/\/(?:messages|responses|chat\/completions)$|generatecontent$/i,u={expiresAt:0,config:null},v=null,w=null,x=null,y=null,z=null,A=null,B="",C=Promise.resolve(),D=Promise.resolve(),E=0,F=null,G=!1,H=new Map,I={queue:[],workers:new Set,activeWorkers:0,clearing:!1,enqueued:0,written:0,dropped:0,failed:0,localFailed:0,sinkTimeouts:0,flushTimeouts:0,mysqlWritten:0,mysqlFailed:0,mysqlSkipped:0,mysqlSkippedByReason:{},usageWritten:0,usageFailed:0,tokensSeen:0,lastError:null,lastWrittenAt:null};function J(a){let b=Date.now();b-E<6e4||(E=b,console.warn(`[AuditProxy][PromptDB] ${a}`))}function K(a){I.lastError=String(a||"Audit store failure"),console.warn(`[AuditProxy][Store] ${I.lastError}`)}function L(a,b,c=3e4){let d=null;return Promise.race([a,new Promise((a,e)=>{d=setTimeout(()=>{I.sinkTimeouts+=1,e(Error(`${b} timed out after ${c}ms`))},c),d.unref?.()})]).finally(()=>{d&&clearTimeout(d)})}async function M(){let a=Date.now();if(u.expiresAt>a)return u.config;v||(v=Promise.resolve().then(c.bind(c,45903)));let b=await v,d=await b.getPromptLogDbConfig();return u={expiresAt:a+5e3,config:d},d}async function N(){return w||(w=c.e(2661).then(c.bind(c,12661))),w}async function O(a){let b=g.createHash("sha256").update(JSON.stringify({host:a.host,port:Number(a.port||3306),database:a.database,username:a.username,password:a.password,ssl:!!a.ssl})).digest("hex");if(A&&B===b)return A;let d=C.then(async()=>{if(A&&B===b)return A;if(A){try{await A.end()}catch{}A=null,B=""}let d=await c.e(8491).then(c.t.bind(c,38491,19)),e=(d.default||d).createPool({host:a.host,port:Number(a.port||3306),database:a.database,user:a.username,password:a.password,ssl:a.ssl?{rejectUnauthorized:!0}:void 0,connectTimeout:3e3,waitForConnections:!0,connectionLimit:4,maxIdle:4,idleTimeout:6e4,queueLimit:100,enableKeepAlive:!0,keepAliveInitialDelay:3e4});return A=e,B=b,e});return C=d.then(()=>void 0,()=>void 0),d}function P(a){let b=a?new Date(a):new Date;return(Number.isNaN(b.getTime())?new Date:b).toISOString().replace("T"," ").replace("Z","")}function Q(a){if("string"!=typeof a)return a;let b=a.trim();if(!b||!b.startsWith("{")&&!b.startsWith("["))return a;try{return JSON.parse(b)}catch{return a}}function R(a,b=0,c=[]){if(null==a||b>12||c.join("\n").length>=2e5)return c;if("string"==typeof a)return a.trim()&&c.push(a.trim()),c;if(Array.isArray(a)){for(let d of a)R(d,b+1,c);return c}if("object"!=typeof a)return c;for(let[d,e]of Object.entries(a)){let a=d.toLowerCase();["content","text","prompt","input","message","output_text"].includes(a)?R(e,b+1,c):b<8&&["messages","contents","parts","body","request","payload","response","choices","output","item","items"].includes(a)&&R(e,b+1,c)}return c}function S(a){if("string"!=typeof a)return!1;let b=a.trim();return!!b&&!/^\[[^\]]*\]$/.test(b)}function T(a){let b=String(a||"").toLowerCase();return b.includes("claude")?{tool:"claude-code",label:"Claude Code"}:b.includes("codex")?{tool:"codex",label:"Codex"}:{tool:"audit-proxy",label:"Enterprise AI Audit Proxy"}}async function U(a){if(!a)return null;let b=g.createHash("sha256").update(a).digest("hex"),c=Buffer.byteLength(String(a||""),"utf8"),d=await N();return await d.writePayloadFile(b,a),{payloadHash:b,payloadSizeBytes:c}}async function V(a,b,c,d){if(!c)return null;let{payloadHash:e,payloadSizeBytes:f}=c;return await a.query(`INSERT INTO prompt_log_payloads (
+`)),e.on("data",a=>{g+=a.toString("utf8")}),e.on("close",i)})}(b.port,d);c("Removing a host from the allowlist applies with no restart",/HTTP\/1\.1 403\b/.test(e),JSON.stringify(e.slice(0,120))),aj.applyConfig({...aj.auditConfig,allowedHosts:["localhost"]});let g=await P(b.port,d).catch(a=>a);c("Re-adding it works on the next CONNECT",!(g instanceof Error),g instanceof Error?g.message:""),g?.destroy?.(),aj.applyConfig({...aj.auditConfig,clientToolFilterEnabled:!0,allowedClientTools:p(["claude-code"])});let h=await Q(b.port,d,"User-Agent: Mozilla/5.0 Chrome/131.0\r\n");c("Turning the tool filter on applies with no restart",/HTTP\/1\.1 403\b/.test(h),JSON.stringify(h.slice(0,120))),aj.applyConfig({...aj.auditConfig,clientToolFilterEnabled:!1,allowedClientTools:[]});let i=await P(b.port,d,"Mozilla/5.0 Chrome/131.0").catch(a=>a);c("Turning it off applies with no restart",!(i instanceof Error),i instanceof Error?i.message:""),i?.destroy?.(),aj.applyConfig({...aj.auditConfig,captureLimitBytes:4096}),c("Capture limit is updated in place",4096===aj.auditConfig.captureLimitBytes);let j=aj.applyConfig({...aj.auditConfig,port:b.port+1,bindHost:"0.0.0.0"});c("A listener address/port change is reported as pending, not applied",!0===j.rebindRequired&&j.pending.port===b.port+1&&"0.0.0.0"===j.pending.bindHost,JSON.stringify(j.pending)),c("The bound listener is left alone by applyConfig",aj.auditConfig.port===aF&&aj.auditConfig.bindHost===aG&&!0===aj.listening,`${aj.auditConfig.port}/${aj.auditConfig.bindHost} vs ${aF}/${aG}`);let k=await P(b.port,d).catch(a=>a);c("Traffic keeps flowing on the address that is bound",!(k instanceof Error),k instanceof Error?k.message:""),k?.destroy?.()}finally{aj.applyConfig({...aj.auditConfig,...aE})}ak=k({allowedHosts:["localhost"],passthroughUnknown:!1,captureBodies:!0,captureLimitBytes:1048576,verifyUpstreamTls:!0,allowedConnectPorts:[a.port],connectTimeoutMs:5e3,tlsHandshakeTimeoutMs:5e3,responseHeaderTimeoutMs:5e3,idleTimeoutMs:3e4},{certificateProvider:()=>ab,upstreamCa:$.certPem,resolveTarget:O,onAudit:()=>{throw Error("simulated audit sink failure")}});let aH=await M(ak),aI=await P(aH.port,`localhost:${a.port}`),aJ=await T({socket:aI,ca:aa.certPem,servername:"localhost",port:a.port,body:V,path:W});c("Audit sink failure does not fail proxied request",aJ.head.startsWith("HTTP/1.1 200"))}catch(a){c("Self-test execution",!1,a.message||String(a))}finally{await N(ak),await N(aj),await N(ah)}return{ok:b.length>0&&b.every(a=>a.ok),checks:b,passed:b.filter(a=>a.ok).length,total:b.length,durationMs:Date.now()-a}}}},85463:(a,b,c)=>{let{validateConfig:d}=c(43096),e=["accessGrants","allowedHosts","clientToolFilterEnabled","allowedClientTools","captureBodies","captureLimitBytes","passthroughUnknown","retentionDays","sessionIdleTimeoutMs","dlpEnabled","dlpMaxInspectBytes","dlpOversizeAction","dlpDefaultAction","dlpProfiles","dlpRules"],f=["enabled","bindHost","port","clientProxyHost","proxyAuthEnabled","proxyAuthUsers"];function g(a={}){let b={};for(let c of e)void 0!==a[c]&&(b[c]=Array.isArray(a[c])?[...a[c]]:a[c]);return b}a.exports={POLICY_FIELDS:e,NODE_LOCAL_FIELDS:f,SETTINGS_KEY:"auditProxyPolicy",extractAuditPolicy:g,mergeAuditPolicy:function(a={},b={}){let c={...a};for(let a of e)void 0!==b[a]&&(c[a]=b[a]);for(let b of f)c[b]=a[b];return d(c)},policyEquals:function(a={},b={}){return JSON.stringify(g(a))===JSON.stringify(g(b))}}},86455:a=>{function b(a){let b=Number(a);return!Number.isFinite(b)||b<0?0:Math.round(b)}function c(){return{inputTokens:0,outputTokens:0,cacheReadTokens:0,cacheCreationTokens:0,reasoningTokens:0,totalTokens:0,model:null,stopReason:null,streaming:!1,complete:!1,source:null}}function d(a){let b=String(a||"").trim();if(!b||"{"!==b[0])return null;try{let a=JSON.parse(b);return a&&"object"==typeof a&&!Array.isArray(a)?a:null}catch{return null}}function e(a,c){"string"==typeof c.model&&c.model&&!a.model&&(a.model=c.model);let d="response.completed"===c.type||"response.done"===c.type?c.response?.usage:null,e=d||c.usage;if(!e||"object"!=typeof e)return!1;d&&"string"==typeof c.response?.model&&c.response.model&&(a.model=c.response.model);let f=b(e.prompt_tokens??e.input_tokens),g=b(e.completion_tokens??e.output_tokens);if(!f&&!g)return!1;let h=b(e.prompt_tokens_details?.cached_tokens??e.input_tokens_details?.cached_tokens??e.cached_tokens??e.prompt_cache_hit_tokens);a.inputTokens=Math.max(0,f-h),a.cacheReadTokens=h,a.outputTokens=g,a.reasoningTokens=b(e.completion_tokens_details?.reasoning_tokens??e.output_tokens_details?.reasoning_tokens),a.complete=!0;let i=c.choices?.[0]?.finish_reason;return"string"==typeof i&&i&&(a.stopReason=i),!0}function f(a,f){let g=c();g.streaming=!0,g.source="sse";let h=!1;for(let c of function*(a){let b=String(a||""),c=0;for(;c<b.length;){let a=b.indexOf("\n",c);-1===a&&(a=b.length);let e=b.slice(c,a).trim();if(c=a+1,!e.startsWith("data:"))continue;let f=e.slice(5).trim();if(!f||"[DONE]"===f)continue;let g=d(f);g&&(yield g)}}(a)){if(("anthropic"===f||"message_start"===c.type||"message_delta"===c.type)&&function(a,c){let d=String(c.type||"");if("message_start"===d&&c.message&&"object"==typeof c.message){let d=c.message;"string"==typeof d.model&&d.model&&(a.model=d.model);let e=d.usage;return e&&"object"==typeof e&&(a.inputTokens=b(e.input_tokens)||a.inputTokens,a.cacheReadTokens=b(e.cache_read_input_tokens)||a.cacheReadTokens,a.cacheCreationTokens=b(e.cache_creation_input_tokens)||a.cacheCreationTokens),!0}if("message_delta"===d){let d=c.usage;d&&"object"==typeof d&&(a.outputTokens=b(d.output_tokens)||a.outputTokens,a.inputTokens=a.inputTokens||b(d.input_tokens),a.cacheReadTokens=a.cacheReadTokens||b(d.cache_read_input_tokens),a.cacheCreationTokens=a.cacheCreationTokens||b(d.cache_creation_input_tokens),a.complete=!0);let e=c.delta?.stop_reason;return"string"==typeof e&&e&&(a.stopReason=e),!0}return!1}(g,c)){h=!0;continue}e(g,c)&&(h=!0)}return h?g:null}function g(a){let f=d(a);if(!f)return null;let g=c();g.source="json","string"==typeof f.model&&f.model&&(g.model=f.model);let h=f.usage;return h&&"object"==typeof h?null!=h.input_tokens||null!=h.output_tokens?(g.inputTokens=b(h.input_tokens),g.outputTokens=b(h.output_tokens),g.cacheReadTokens=b(h.cache_read_input_tokens),g.cacheCreationTokens=b(h.cache_creation_input_tokens),g.complete=!0,"string"==typeof f.stop_reason&&(g.stopReason=f.stop_reason),g):e(g,f)?g:null:null}function h(a){return/\/count_tokens\b/.test(String(a||""))}function i(a){return a.inputTokens+a.cacheReadTokens+a.cacheCreationTokens}a.exports={extractUsageFromBody:function({provider:a,body:b,contentType:c="",path:d=""}={}){if("string"!=typeof b||!b||b.length>0x1000000||h(d))return null;let e=/event-stream/i.test(String(c||""))||b.includes("\ndata:")||b.startsWith("data:")?f(b,a)||g(b):g(b)||f(b,a);return e&&(e&&(e.inputTokens||e.outputTokens||e.cacheReadTokens||e.cacheCreationTokens)||e.model)?(e.totalTokens=e.inputTokens+e.outputTokens+e.cacheReadTokens+e.cacheCreationTokens,e):null},isTokenCountingEndpoint:h,toTokensJson:function(a){if(!a)return null;let b=i(a),c={input_tokens:a.inputTokens,output_tokens:a.outputTokens,prompt_tokens:b,completion_tokens:a.outputTokens,total_tokens:a.totalTokens,display_total_input_tokens:b,display_new_input_tokens:a.inputTokens,display_cached_input_tokens:a.cacheReadTokens,display_cache_creation_input_tokens:a.cacheCreationTokens,display_output_tokens:a.outputTokens};return a.cacheReadTokens&&(c.cache_read_input_tokens=a.cacheReadTokens),a.cacheCreationTokens&&(c.cache_creation_input_tokens=a.cacheCreationTokens),a.cacheReadTokens&&(c.cached_tokens=a.cacheReadTokens),a.reasoningTokens&&(c.reasoning_tokens=a.reasoningTokens),c},totalInputTokens:i}},90173:(a,b,c)=>{let d=c(29021),e=c(33873),f=c(4984),g=c(55511),{AUDIT_LOG_PATH:h,AUDIT_LOG_DIR:i,ensureAuditDir:j,loadConfig:k}=c(43096),{redactObject:l,scrubString:m}=c(48350),{toTokensJson:n,totalInputTokens:o}=c(86455),{publishRecentUsage:p}=c(87662),q="audit-proxy",r="client",s="provider_response",t=/\/(?:messages|responses|chat\/completions)$|generatecontent$|\/generateassistantresponse$/i,u={expiresAt:0,config:null},v=null,w=null,x=null,y=null,z=null,A=null,B="",C=Promise.resolve(),D=Promise.resolve(),E=0,F=null,G=!1,H=new Map,I={queue:[],workers:new Set,activeWorkers:0,clearing:!1,enqueued:0,written:0,dropped:0,failed:0,localFailed:0,sinkTimeouts:0,flushTimeouts:0,mysqlWritten:0,mysqlFailed:0,mysqlSkipped:0,mysqlSkippedByReason:{},usageWritten:0,usageFailed:0,tokensSeen:0,lastError:null,lastWrittenAt:null};function J(a){let b=Date.now();b-E<6e4||(E=b,console.warn(`[AuditProxy][PromptDB] ${a}`))}function K(a){I.lastError=String(a||"Audit store failure"),console.warn(`[AuditProxy][Store] ${I.lastError}`)}function L(a,b,c=3e4){let d=null;return Promise.race([a,new Promise((a,e)=>{d=setTimeout(()=>{I.sinkTimeouts+=1,e(Error(`${b} timed out after ${c}ms`))},c),d.unref?.()})]).finally(()=>{d&&clearTimeout(d)})}async function M(){let a=Date.now();if(u.expiresAt>a)return u.config;v||(v=Promise.resolve().then(c.bind(c,45903)));let b=await v,d=await b.getPromptLogDbConfig();return u={expiresAt:a+5e3,config:d},d}async function N(){return w||(w=c.e(2661).then(c.bind(c,12661))),w}async function O(a){let b=g.createHash("sha256").update(JSON.stringify({host:a.host,port:Number(a.port||3306),database:a.database,username:a.username,password:a.password,ssl:!!a.ssl})).digest("hex");if(A&&B===b)return A;let d=C.then(async()=>{if(A&&B===b)return A;if(A){try{await A.end()}catch{}A=null,B=""}let d=await c.e(8491).then(c.t.bind(c,38491,19)),e=(d.default||d).createPool({host:a.host,port:Number(a.port||3306),database:a.database,user:a.username,password:a.password,ssl:a.ssl?{rejectUnauthorized:!0}:void 0,connectTimeout:3e3,waitForConnections:!0,connectionLimit:4,maxIdle:4,idleTimeout:6e4,queueLimit:100,enableKeepAlive:!0,keepAliveInitialDelay:3e4});return A=e,B=b,e});return C=d.then(()=>void 0,()=>void 0),d}function P(a){let b=a?new Date(a):new Date;return(Number.isNaN(b.getTime())?new Date:b).toISOString().replace("T"," ").replace("Z","")}function Q(a){if("string"!=typeof a)return a;let b=a.trim();if(!b||!b.startsWith("{")&&!b.startsWith("["))return a;try{return JSON.parse(b)}catch{return a}}function R(a,b=0,c=[]){if(null==a||b>12||c.join("\n").length>=2e5)return c;if("string"==typeof a)return a.trim()&&c.push(a.trim()),c;if(Array.isArray(a)){for(let d of a)R(d,b+1,c);return c}if("object"!=typeof a)return c;for(let[d,e]of Object.entries(a)){let a=d.toLowerCase();["content","text","prompt","input","message","output_text"].includes(a)?R(e,b+1,c):b<8&&["messages","contents","parts","body","request","payload","response","choices","output","item","items","conversationstate","currentmessage","userinputmessage","history","assistantresponsemessage"].includes(a)&&R(e,b+1,c)}return c}function S(a){if("string"!=typeof a)return!1;let b=a.trim();return!!b&&!/^\[[^\]]*\]$/.test(b)}function T(a){let b=String(a||"").toLowerCase();return b.includes("claude")?{tool:"claude-code",label:"Claude Code"}:b.includes("codex")?{tool:"codex",label:"Codex"}:{tool:"audit-proxy",label:"Enterprise AI Audit Proxy"}}async function U(a){if(!a)return null;let b=g.createHash("sha256").update(a).digest("hex"),c=Buffer.byteLength(String(a||""),"utf8"),d=await N();return await d.writePayloadFile(b,a),{payloadHash:b,payloadSizeBytes:c}}async function V(a,b,c,d){if(!c)return null;let{payloadHash:e,payloadSizeBytes:f}=c;return await a.query(`INSERT INTO prompt_log_payloads (
       payload_hash, created_at, last_seen_at, content_type, payload_size_bytes, ref_count, payload_json
     ) VALUES (?, ?, ?, ?, ?, 1, NULL)
     ON DUPLICATE KEY UPDATE
@@ -63,7 +63,7 @@ ${c}\r
       response_payload_hash, response_payload_size_bytes,
       prompt_text, full_request_json,
       response_text, status_code, error_text, meta_json
-    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, CAST(? AS JSON), ?, ?, ?, CAST(? AS JSON))`,[b.id,b.createdAt,b.sessionId,b.sourceFormat,b.targetFormat,b.model,b.endpoint,b.stage,b.providerUrl,b.provider,b.accountName,b.connectionId,b.displayModel,b.clientIp,b.clientPort,b.clientUserAgent,b.clientHost,b.sourceTool,b.sourceToolLabel,b.sourceHost,b.contentMode,b.payloadHash,b.payloadSizeBytes,b.responsePayloadHash,b.responsePayloadSizeBytes,b.promptText,b.fullRequestJson,b.responseText,b.statusCode,b.errorText,JSON.stringify(b.meta||{})])}function X(a){return a?.denied===!0}function Y(a){let b,c,d;if(X(a))return{mirror:!1,reason:"denied"};if(!function(a){if(a?.usage)return!0;let b=String(a?.path||"").split("?")[0].replace(/\/+$/,"");return t.test(b)}(a))return{mirror:!1,reason:"not-inference"};let e=function(a){try{let b=JSON.parse(JSON.stringify(a??null)),c=l(b);return JSON.parse(m(JSON.stringify(c)))}catch{return m(String(a??""))}}(a),{requestPayload:f,responsePayload:g}=(b=e.request||{},c=e.response||{},{requestPayload:{timestamp:e.timestamp,protocol:e.protocol||"http/1.1",method:e.method,endpoint:e.path,headers:b.headers||{},body:Q(b.body),capturedBytes:Number(b.capturedBytes||0),totalBytes:Number(b.totalBytes||0),wireSha256:b.wireSha256||null,truncated:!0===b.truncated},responsePayload:{timestamp:e.timestamp,protocol:e.protocol||"http/1.1",status:e.status,headers:c.headers||{},body:Q(c.body),capturedBytes:Number(c.capturedBytes||0),totalBytes:Number(c.totalBytes||0),wireSha256:c.wireSha256||null,truncated:!0===c.truncated}}),h=(d=R(f?.body??f??{}).join("\n\n"))?d.slice(0,2e3):null,i=function(a){let b=a?.body;if("string"==typeof b)return b.slice(0,2e3)||null;let c=R(b??a??{}).join("\n\n");return c?c.slice(0,2e3):null}(g),j=S(h)?h:null,k=S(i)?i:null;return j||k?{mirror:!0,safeEvent:e,requestPayload:f,responsePayload:g,promptText:j,responseText:k}:{mirror:!1,reason:"contentless"}}async function Z(a){if(X(a))return{written:!1,skipped:!0,reason:"denied"};let b=null;try{let c=await M();if(!c?.enabled)return{written:!1,disabled:!0};if("mysql"!==String(c.type||"").toLowerCase())return J(`Audit mirroring requires MySQL; current type is ${c.type||"unknown"}`),{written:!1,unsupported:!0};let d=Y(a);if(!d.mirror)return{written:!1,skipped:!0,reason:d.reason};let{safeEvent:e,requestPayload:f,responsePayload:h,promptText:i,responseText:j}=d,k=JSON.stringify(f),l=JSON.stringify(h),m=Math.max(0,Number(e.durationMs||0)),n=new Date(e.timestamp||Date.now()),o=Number.isNaN(n.getTime())?new Date:n,p=new Date(o.getTime()-m),t=P(p),u=P(o),v=T(e.client?.userAgent),w=String(e.provider||"other"),x=e.model?String(e.model):null,y=String(e.host||""),z=Number(e.port||443),A=String(e.path||""),B=y?`https://${y}${443!==z?`:${z}`:""}${A}`:null,C=await O(c);b=await C.getConnection();let[D,E]=await Promise.all([U(k),U(l)]);await b.beginTransaction();let F=await V(b,t,D,"request_json"),G=await V(b,u,E,"response_json"),H={source:q,auditEventId:e.id||null,protocol:e.protocol||"http/1.1",host:y||null,port:z,method:e.method||null,path:A||null,proxyUser:e.client?.proxyUser||null,durationMs:m,requestCapturedBytes:Number(e.request?.capturedBytes||0),requestTotalBytes:Number(e.request?.totalBytes||0),requestWireSha256:e.request?.wireSha256||null,requestTruncated:e.request?.truncated===!0,responseCapturedBytes:Number(e.response?.capturedBytes||0),responseTotalBytes:Number(e.response?.totalBytes||0),responseWireSha256:e.response?.wireSha256||null,responseTruncated:e.response?.truncated===!0,payloadHash:F?.payloadHash||null,payloadSizeBytes:F?.payloadSizeBytes||0,payloadStorage:F?"prompt_log_payloads":null,responsePayloadHash:G?.payloadHash||null,responsePayloadSizeBytes:G?.payloadSizeBytes||0,responsePayloadStorage:G?"prompt_log_payloads":null,...e.usage?{inputTokens:Number(e.usage.inputTokens||0),outputTokens:Number(e.usage.outputTokens||0),cacheReadTokens:Number(e.usage.cacheReadTokens||0),cacheCreationTokens:Number(e.usage.cacheCreationTokens||0),reasoningTokens:Number(e.usage.reasoningTokens||0),totalTokens:Number(e.usage.totalTokens||0),usageComplete:!0===e.usage.complete,usageSource:e.usage.source||null,stopReason:e.usage.stopReason||null}:{}},I=String(e.id||g.randomUUID()),K={sessionId:`audit-${I}`,sourceFormat:w,targetFormat:w,model:x,endpoint:A||null,providerUrl:B,provider:w,accountName:null,connectionId:null,displayModel:x?`${w}/${x}`:null,clientIp:e.client?.ip||null,clientPort:e.client?.port!=null?String(e.client.port):null,clientUserAgent:e.client?.userAgent||null,clientHost:y||null,sourceTool:v.tool,sourceToolLabel:v.label,sourceHost:y||null};return await W(b,{...K,id:`${I}:request`,createdAt:t,stage:r,contentMode:e.request?.body?"raw_json_preview":"metadata_only",payloadHash:F?.payloadHash||null,payloadSizeBytes:F?.payloadSizeBytes||0,responsePayloadHash:null,responsePayloadSizeBytes:0,promptText:i,fullRequestJson:null,responseText:null,statusCode:null,errorText:null,meta:{...H,auditDirection:"request"}}),await W(b,{...K,id:`${I}:response`,createdAt:u,stage:s,contentMode:e.response?.body?"raw_json_preview":"metadata_only",payloadHash:null,payloadSizeBytes:0,responsePayloadHash:G?.payloadHash||null,responsePayloadSizeBytes:G?.payloadSizeBytes||0,promptText:null,fullRequestJson:null,responseText:j,statusCode:null!=e.status?Number(e.status):null,errorText:e.error||null,meta:{...H,auditDirection:"response"}}),await b.commit(),{written:!0,rowsWritten:2}}catch(a){if(b)try{await b.rollback()}catch{}return J(`Failed to mirror audit event to prompt_logs: ${a.message||a}`),{written:!1,error:a.message||String(a)}}finally{try{b?.release()}catch{}}}async function $(){return x||(x=Promise.resolve().then(c.bind(c,77638))),x}async function _(a,b,d){if(!b||!d)return 0;try{z||(z=Promise.resolve().then(c.bind(c,97914))),y||(y=c.e(7341).then(c.bind(c,57341)));let[e,f]=await Promise.all([z,y]),g=await e.getPricingForModel(a,b);if(!g)return 0;let h=f.calculateCostFromTokens(d,g);return Number.isFinite(h)&&h>0?h:0}catch{return 0}}async function aa(a,b){let c=a?.usage,d=!!(c&&(c.inputTokens||c.outputTokens||c.cacheReadTokens||c.cacheCreationTokens||c.reasoningTokens)),e=Number(a?.status),f=String(a?.path||"").split("?")[0].replace(/\/+$/,""),g=!a?.error&&Number.isFinite(e)&&e>=200&&e<300&&"POST"===String(a?.method||"").toUpperCase()&&t.test(f);if(!d&&!g)return{written:!1,skipped:!0};let h=d?c:{inputTokens:0,outputTokens:0,cacheReadTokens:0,cacheCreationTokens:0,reasoningTokens:0,totalTokens:0,model:c?.model||null,stopReason:c?.stopReason||null,streaming:c?.streaming===!0,complete:!1,source:c?.source||"missing"},i=String(a.provider||"other"),j=a.model||h.model||null,k=n(h),l=a.timestamp||new Date().toISOString(),m=Number.isFinite(e)&&e>=200&&e<300,r=!!a.error&&m&&!0===h.complete,s=!r&&(a.error||a.status&&a.status>=400)?"error":"success",u=a.error?String(a.error).slice(0,500):null,v=r?null:u;p({timestamp:l,provider:i,model:j,connectionId:"",endpoint:a.path||null,requestId:a.id||null,cost:0,status:s,statusCode:null!=a.status?Number(a.status):null,errorMessageShort:v,tokens:k,sourceTool:b.tool,sourceToolLabel:b.label});try{let c=await $();if(!await c.isMysqlObservabilityEnabled())return{written:!1,disabled:!0,realtimePublished:!0};let e=await _(i,j,k),f=await c.saveMysqlUsageEvent({timestamp:l,provider:i,model:j,endpoint:a.path||null,requestId:a.id||null,sessionId:a.id?`audit-${a.id}`:null,apiKeyOwner:a.client?.dashboardUser?.userId||null,apiKeyName:a.client?.dashboardUser?`Audit Proxy — ${a.client.dashboardUser.displayName||a.client.dashboardUser.userId}`:null,clientIp:a.client?.ip||null,clientIpNormalized:a.client?.ip||null,clientHost:a.host||null,clientUserAgent:a.client?.userAgent||null,sourceTool:b.tool,sourceToolLabel:b.label,sourceHost:a.host||null,latencyMs:Math.max(0,Number(a.durationMs||0)),statusCode:null!=a.status?Number(a.status):null,errorMessageShort:v,isStreaming:!0===h.streaming,promptTokens:o(h),completionTokens:h.outputTokens,totalTokens:h.totalTokens,cachedTokens:h.cacheReadTokens,cacheCreationTokens:h.cacheCreationTokens,reasoningTokens:h.reasoningTokens,cost:e,status:s,tokens:k,meta:{source:q,auditEventId:a.id||null,host:a.host||null,method:a.method||null,stopReason:h.stopReason||null,usageComplete:!0===h.complete,usageSource:h.source||null,usageMissing:!d,responseTruncated:a.response?.truncated===!0,transportError:u,settledAfterUsage:r}});return f&&global._usageStatsCache?.clear?.(),{written:!!f,realtimePublished:!0}}catch(a){return J(`Failed to mirror audit usage to usage_events: ${a.message||a}`),{written:!1,error:a.message||String(a)}}}async function ab(a,b){let c;j();let f=(Number.isNaN((c=a?new Date(a):new Date).getTime())?new Date:c).toISOString().slice(0,10),g=H.get(f);if(!g){let a=await d.promises.readdir(i).catch(()=>[]),b=RegExp(`^audit-${f.replace(/-/g,"\\-")}(?:\\.(\\d+))?\\.jsonl$`),c=0;for(let d of a){let a=d.match(b);a&&(c=Math.max(c,Number(a[1]||0)))}let h=e.join(i,`audit-${f}${c?`.${c}`:""}.jsonl`),j=await d.promises.stat(h).catch(()=>null);g={segment:c,filePath:h,size:j?.size||0},H.set(f,g)}return g.size>0&&g.size+b>0x8000000&&(g={segment:g.segment+1,filePath:e.join(i,`audit-${f}.${g.segment+1}.jsonl`),size:0},H.set(f,g)),g}async function ac(a){let b=`${JSON.stringify(a)}
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, CAST(? AS JSON), ?, ?, ?, CAST(? AS JSON))`,[b.id,b.createdAt,b.sessionId,b.sourceFormat,b.targetFormat,b.model,b.endpoint,b.stage,b.providerUrl,b.provider,b.accountName,b.connectionId,b.displayModel,b.clientIp,b.clientPort,b.clientUserAgent,b.clientHost,b.sourceTool,b.sourceToolLabel,b.sourceHost,b.contentMode,b.payloadHash,b.payloadSizeBytes,b.responsePayloadHash,b.responsePayloadSizeBytes,b.promptText,b.fullRequestJson,b.responseText,b.statusCode,b.errorText,JSON.stringify(b.meta||{})])}function X(a){return a?.denied===!0}function Y(a){let b,c,d;if(X(a))return{mirror:!1,reason:"denied"};if(!function(a){if(a?.usage)return!0;let b=String(a?.request?.headers?.["x-amz-target"]||"");if(/\.GenerateAssistantResponse$/i.test(b))return!0;let c=String(a?.path||"").split("?")[0].replace(/\/+$/,"");return t.test(c)}(a))return{mirror:!1,reason:"not-inference"};let e=function(a){try{let b=JSON.parse(JSON.stringify(a??null)),c=l(b);return JSON.parse(m(JSON.stringify(c)))}catch{return m(String(a??""))}}(a),{requestPayload:f,responsePayload:g}=(b=e.request||{},c=e.response||{},{requestPayload:{timestamp:e.timestamp,protocol:e.protocol||"http/1.1",method:e.method,endpoint:e.path,headers:b.headers||{},body:Q(b.body),capturedBytes:Number(b.capturedBytes||0),totalBytes:Number(b.totalBytes||0),wireSha256:b.wireSha256||null,truncated:!0===b.truncated},responsePayload:{timestamp:e.timestamp,protocol:e.protocol||"http/1.1",status:e.status,headers:c.headers||{},body:Q(c.body),capturedBytes:Number(c.capturedBytes||0),totalBytes:Number(c.totalBytes||0),wireSha256:c.wireSha256||null,truncated:!0===c.truncated}}),h=(d=R(f?.body??f??{}).join("\n\n"))?d.slice(0,2e3):null,i=function(a){let b=a?.body;if("string"==typeof b)return b.slice(0,2e3)||null;let c=R(b??a??{}).join("\n\n");return c?c.slice(0,2e3):null}(g),j=S(h)?h:null,k=S(i)?i:null;return j||k?{mirror:!0,safeEvent:e,requestPayload:f,responsePayload:g,promptText:j,responseText:k}:{mirror:!1,reason:"contentless"}}async function Z(a){if(X(a))return{written:!1,skipped:!0,reason:"denied"};let b=null;try{let c=await M();if(!c?.enabled)return{written:!1,disabled:!0};if("mysql"!==String(c.type||"").toLowerCase())return J(`Audit mirroring requires MySQL; current type is ${c.type||"unknown"}`),{written:!1,unsupported:!0};let d=Y(a);if(!d.mirror)return{written:!1,skipped:!0,reason:d.reason};let{safeEvent:e,requestPayload:f,responsePayload:h,promptText:i,responseText:j}=d,k=JSON.stringify(f),l=JSON.stringify(h),m=Math.max(0,Number(e.durationMs||0)),n=new Date(e.timestamp||Date.now()),o=Number.isNaN(n.getTime())?new Date:n,p=new Date(o.getTime()-m),t=P(p),u=P(o),v=T(e.client?.userAgent),w=String(e.provider||"other"),x=e.model?String(e.model):null,y=String(e.host||""),z=Number(e.port||443),A=String(e.path||""),B=y?`https://${y}${443!==z?`:${z}`:""}${A}`:null,C=await O(c);b=await C.getConnection();let[D,E]=await Promise.all([U(k),U(l)]);await b.beginTransaction();let F=await V(b,t,D,"request_json"),G=await V(b,u,E,"response_json"),H={source:q,auditEventId:e.id||null,protocol:e.protocol||"http/1.1",host:y||null,port:z,method:e.method||null,path:A||null,proxyUser:e.client?.proxyUser||null,durationMs:m,requestCapturedBytes:Number(e.request?.capturedBytes||0),requestTotalBytes:Number(e.request?.totalBytes||0),requestWireSha256:e.request?.wireSha256||null,requestTruncated:e.request?.truncated===!0,responseCapturedBytes:Number(e.response?.capturedBytes||0),responseTotalBytes:Number(e.response?.totalBytes||0),responseWireSha256:e.response?.wireSha256||null,responseTruncated:e.response?.truncated===!0,payloadHash:F?.payloadHash||null,payloadSizeBytes:F?.payloadSizeBytes||0,payloadStorage:F?"prompt_log_payloads":null,responsePayloadHash:G?.payloadHash||null,responsePayloadSizeBytes:G?.payloadSizeBytes||0,responsePayloadStorage:G?"prompt_log_payloads":null,...e.usage?{inputTokens:Number(e.usage.inputTokens||0),outputTokens:Number(e.usage.outputTokens||0),cacheReadTokens:Number(e.usage.cacheReadTokens||0),cacheCreationTokens:Number(e.usage.cacheCreationTokens||0),reasoningTokens:Number(e.usage.reasoningTokens||0),totalTokens:Number(e.usage.totalTokens||0),usageComplete:!0===e.usage.complete,usageSource:e.usage.source||null,stopReason:e.usage.stopReason||null}:{}},I=String(e.id||g.randomUUID()),K={sessionId:`audit-${I}`,sourceFormat:w,targetFormat:w,model:x,endpoint:A||null,providerUrl:B,provider:w,accountName:null,connectionId:null,displayModel:x?`${w}/${x}`:null,clientIp:e.client?.ip||null,clientPort:e.client?.port!=null?String(e.client.port):null,clientUserAgent:e.client?.userAgent||null,clientHost:y||null,sourceTool:v.tool,sourceToolLabel:v.label,sourceHost:y||null};return await W(b,{...K,id:`${I}:request`,createdAt:t,stage:r,contentMode:e.request?.body?"raw_json_preview":"metadata_only",payloadHash:F?.payloadHash||null,payloadSizeBytes:F?.payloadSizeBytes||0,responsePayloadHash:null,responsePayloadSizeBytes:0,promptText:i,fullRequestJson:null,responseText:null,statusCode:null,errorText:null,meta:{...H,auditDirection:"request"}}),await W(b,{...K,id:`${I}:response`,createdAt:u,stage:s,contentMode:e.response?.body?"raw_json_preview":"metadata_only",payloadHash:null,payloadSizeBytes:0,responsePayloadHash:G?.payloadHash||null,responsePayloadSizeBytes:G?.payloadSizeBytes||0,promptText:null,fullRequestJson:null,responseText:j,statusCode:null!=e.status?Number(e.status):null,errorText:e.error||null,meta:{...H,auditDirection:"response"}}),await b.commit(),{written:!0,rowsWritten:2}}catch(a){if(b)try{await b.rollback()}catch{}return J(`Failed to mirror audit event to prompt_logs: ${a.message||a}`),{written:!1,error:a.message||String(a)}}finally{try{b?.release()}catch{}}}async function $(){return x||(x=Promise.resolve().then(c.bind(c,77638))),x}async function _(a,b,d){if(!b||!d)return 0;try{z||(z=Promise.resolve().then(c.bind(c,97914))),y||(y=c.e(7341).then(c.bind(c,57341)));let[e,f]=await Promise.all([z,y]),g=await e.getPricingForModel(a,b);if(!g)return 0;let h=f.calculateCostFromTokens(d,g);return Number.isFinite(h)&&h>0?h:0}catch{return 0}}async function aa(a,b){let c=a?.usage,d=!!(c&&(c.inputTokens||c.outputTokens||c.cacheReadTokens||c.cacheCreationTokens||c.reasoningTokens)),e=Number(a?.status),f=String(a?.path||"").split("?")[0].replace(/\/+$/,""),g=!a?.error&&Number.isFinite(e)&&e>=200&&e<300&&"POST"===String(a?.method||"").toUpperCase()&&t.test(f);if(!d&&!g)return{written:!1,skipped:!0};let h=d?c:{inputTokens:0,outputTokens:0,cacheReadTokens:0,cacheCreationTokens:0,reasoningTokens:0,totalTokens:0,model:c?.model||null,stopReason:c?.stopReason||null,streaming:c?.streaming===!0,complete:!1,source:c?.source||"missing"},i=String(a.provider||"other"),j=a.model||h.model||null,k=n(h),l=a.timestamp||new Date().toISOString(),m=Number.isFinite(e)&&e>=200&&e<300,r=!!a.error&&m&&!0===h.complete,s=!r&&(a.error||a.status&&a.status>=400)?"error":"success",u=a.error?String(a.error).slice(0,500):null,v=r?null:u;p({timestamp:l,provider:i,model:j,connectionId:"",endpoint:a.path||null,requestId:a.id||null,cost:0,status:s,statusCode:null!=a.status?Number(a.status):null,errorMessageShort:v,tokens:k,sourceTool:b.tool,sourceToolLabel:b.label});try{let c=await $();if(!await c.isMysqlObservabilityEnabled())return{written:!1,disabled:!0,realtimePublished:!0};let e=await _(i,j,k),f=await c.saveMysqlUsageEvent({timestamp:l,provider:i,model:j,endpoint:a.path||null,requestId:a.id||null,sessionId:a.id?`audit-${a.id}`:null,apiKeyOwner:a.client?.dashboardUser?.userId||null,apiKeyName:a.client?.dashboardUser?`Audit Proxy — ${a.client.dashboardUser.displayName||a.client.dashboardUser.userId}`:null,clientIp:a.client?.ip||null,clientIpNormalized:a.client?.ip||null,clientHost:a.host||null,clientUserAgent:a.client?.userAgent||null,sourceTool:b.tool,sourceToolLabel:b.label,sourceHost:a.host||null,latencyMs:Math.max(0,Number(a.durationMs||0)),statusCode:null!=a.status?Number(a.status):null,errorMessageShort:v,isStreaming:!0===h.streaming,promptTokens:o(h),completionTokens:h.outputTokens,totalTokens:h.totalTokens,cachedTokens:h.cacheReadTokens,cacheCreationTokens:h.cacheCreationTokens,reasoningTokens:h.reasoningTokens,cost:e,status:s,tokens:k,meta:{source:q,auditEventId:a.id||null,host:a.host||null,method:a.method||null,stopReason:h.stopReason||null,usageComplete:!0===h.complete,usageSource:h.source||null,usageMissing:!d,responseTruncated:a.response?.truncated===!0,transportError:u,settledAfterUsage:r}});return f&&global._usageStatsCache?.clear?.(),{written:!!f,realtimePublished:!0}}catch(a){return J(`Failed to mirror audit usage to usage_events: ${a.message||a}`),{written:!1,error:a.message||String(a)}}}async function ab(a,b){let c;j();let f=(Number.isNaN((c=a?new Date(a):new Date).getTime())?new Date:c).toISOString().slice(0,10),g=H.get(f);if(!g){let a=await d.promises.readdir(i).catch(()=>[]),b=RegExp(`^audit-${f.replace(/-/g,"\\-")}(?:\\.(\\d+))?\\.jsonl$`),c=0;for(let d of a){let a=d.match(b);a&&(c=Math.max(c,Number(a[1]||0)))}let h=e.join(i,`audit-${f}${c?`.${c}`:""}.jsonl`),j=await d.promises.stat(h).catch(()=>null);g={segment:c,filePath:h,size:j?.size||0},H.set(f,g)}return g.size>0&&g.size+b>0x8000000&&(g={segment:g.segment+1,filePath:e.join(i,`audit-${f}.${g.segment+1}.jsonl`),size:0},H.set(f,g)),g}async function ac(a){let b=`${JSON.stringify(a)}
 `,c=Buffer.byteLength(b),e=await ab(a.timestamp,c);return await d.promises.appendFile(e.filePath,b,{encoding:"utf8",mode:384}),e.size+=c,e.filePath}async function ad(a){try{let b,c=await L(Promise.resolve(a.finalize()),"Audit event finalize"),d=L((D=(b=D.then(()=>ac(c))).then(()=>void 0,()=>void 0),b),"Local JSONL write").catch(a=>(I.localFailed+=1,K(`Local JSONL write failed: ${a.message||a}`),null)),e=L(Z(c),"Prompt log mirror").catch(a=>({written:!1,error:a.message||String(a)})),f=L(aa(c,T(c.client?.userAgent)),"Usage mirror").catch(a=>({written:!1,error:a.message||String(a)})),[,g,h]=await Promise.all([d,e,f]);if(g?.written)I.mysqlWritten+=1;else if(g?.error)I.mysqlFailed+=1;else if(g?.skipped){I.mysqlSkipped+=1;let a=String(g.reason||"unknown");I.mysqlSkippedByReason[a]=(I.mysqlSkippedByReason[a]||0)+1}h?.written?I.usageWritten+=1:h?.error&&(I.usageFailed+=1),c.usage&&(I.tokensSeen+=Number(c.usage.totalTokens||0)),I.written+=1,I.lastWrittenAt=new Date().toISOString()}catch(a){I.failed+=1,K(a.message||a)}}async function ae(){I.activeWorkers+=1;try{for(;!I.clearing;){let a=I.queue.shift();if(!a)break;await ad(a)}}finally{I.activeWorkers=Math.max(0,I.activeWorkers-1)}}function af(){if(!I.clearing)for(;I.queue.length&&I.activeWorkers<4;){let a;a=ae().finally(()=>{I.workers.delete(a),!I.clearing&&I.queue.length&&setImmediate(af)}),I.workers.add(a)}}function ag(a){return"function"==typeof a&&(I.queue.length>=1e3?(I.dropped+=1,K(`Audit queue full; dropped event ${I.dropped}`),!1):(I.queue.push({finalize:a,enqueuedAt:Date.now()}),I.enqueued+=1,I.clearing||setImmediate(af),!0))}async function ah(){j();let a=(await d.promises.readdir(i).catch(()=>[])).filter(a=>/^audit-\d{4}-\d{2}-\d{2}(?:\.\d+)?\.jsonl$/.test(a)).sort((a,b)=>b.localeCompare(a,void 0,{numeric:!0})).map(a=>e.join(i,a));return d.existsSync(h)&&a.push(h),a}async function ai(a,b){let c=await d.promises.stat(a).catch(()=>null);if(!c?.size||b<=0)return[];let e=await d.promises.open(a,"r");try{let a=c.size,d=Buffer.alloc(0),f=0;for(;a>0&&d.length<0x4000000&&f<=b;){let b=Math.min(262144,a,0x4000000-d.length);a-=b;let c=Buffer.alloc(b);await e.read(c,0,b,a),d=Buffer.concat([c,d]),f+=c.reduce((a,b)=>a+ +(10===b),0)}let g=d.toString("utf8");if(a>0){let a=g.indexOf("\n");g=a>=0?g.slice(a+1):""}return g.split("\n").filter(Boolean).slice(-b).reverse().map(a=>{try{return JSON.parse(a)}catch{return null}}).filter(Boolean)}finally{await e.close()}}async function aj(a=50){let b=Math.max(1,Math.min(1e3,Number(a)||50)),c=[];for(let a of(await ah())){if(c.length>=b)break;let d=await ai(a,b-c.length);c.push(...d)}return c.slice(0,b)}async function ak(a){if(!d.existsSync(h))return;let b=`${h}.tmp`,c=d.createReadStream(h,{encoding:"utf8"}),e=d.createWriteStream(b,{encoding:"utf8",mode:384});for await(let b of f.createInterface({input:c,crlfDelay:1/0}))if(b)try{let c=JSON.parse(b);Date.parse(c.timestamp||0)>=a&&e.write(`${b}
 `)}catch{}await new Promise((a,b)=>{e.end(a),e.once("error",b)}),await d.promises.rename(b,h)}async function al(){j();let a=k(),b=Date.now()-24*a.retentionDays*36e5;for(let a of(await d.promises.readdir(i).catch(()=>[]))){if(!/^audit-\d{4}-\d{2}-\d{2}(?:\.\d+)?\.jsonl$/.test(a))continue;let c=e.join(i,a),f=await d.promises.stat(c).catch(()=>null);if(f&&f.mtimeMs<b)for(let[a,b]of(await d.promises.unlink(c).catch(()=>{}),H.entries()))b.filePath===c&&H.delete(a)}await ak(b).catch(a=>K(`Legacy log prune failed: ${a.message||a}`))}async function am(a=5e3){let b=Date.now()+Math.max(0,Number(a)||0);for(;(I.queue.length||I.activeWorkers)&&Date.now()<b;){af();let a=[...I.workers];a.length?await Promise.race([Promise.allSettled(a),new Promise(a=>setTimeout(a,50))]):await new Promise(a=>setTimeout(a,10))}let c=0===I.queue.length&&0===I.activeWorkers;return c||(I.flushTimeouts+=1),c}let an=async()=>{let a=I.queue.length;(a||I.activeWorkers)&&(await am(1e4)?console.log(`[AuditProxy][Store] flushed ${a} queued audit event(s) before shutdown`):K(`Shutdown flush incomplete; ${I.queue.length} audit event(s) still queued`))};async function ao(){let a=null;try{let b=await M();if(!b?.enabled||"mysql"!==String(b.type||"").toLowerCase())return;let c=await O(b);a=await c.getConnection(),await a.beginTransaction();let d="(stage = ? OR (session_id LIKE 'audit-%' AND stage IN (?, ?)))",[e]=await a.query(`SELECT payload_hash, response_payload_hash FROM prompt_logs WHERE ${d}`,[q,r,s]);await a.query(`DELETE FROM prompt_logs WHERE ${d}`,[q,r,s]);let f=new Map;for(let a of e||[])for(let b of[a.payload_hash,a.response_payload_hash]){let a=String(b||"").trim();a&&f.set(a,(f.get(a)||0)+1)}let g=[];for(let[b,c]of f.entries()){await a.query("UPDATE prompt_log_payloads SET ref_count = GREATEST(ref_count - ?, 0) WHERE payload_hash = ?",[c,b]);let[d]=await a.query(`DELETE p FROM prompt_log_payloads p
           WHERE p.payload_hash = ?

package/app/.next-cli-build/server/middleware-build-manifest.js

@@ -1 +1 @@
-globalThis.__BUILD_MANIFEST={polyfillFiles:["static/chunks/polyfills-42372ed130431b0a.js"],devFiles:[],lowPriorityFiles:["static/xOi7_D4lBYmsajJ_tW7MH/_buildManifest.js","static/xOi7_D4lBYmsajJ_tW7MH/_ssgManifest.js"],rootMainFiles:["static/chunks/webpack-a5e5f61cb7910e6b.js","static/chunks/4bd1b696-8a4ab4fdf0ae305a.js","static/chunks/3794-6cecce02b123eb1f.js","static/chunks/main-app-eacc433ef218cf40.js"],rootMainFilesTree:{},pages:{"/_app":[]}};
+globalThis.__BUILD_MANIFEST={polyfillFiles:["static/chunks/polyfills-42372ed130431b0a.js"],devFiles:[],lowPriorityFiles:["static/n4mhcK0NMGFEKCUUi5TBc/_buildManifest.js","static/n4mhcK0NMGFEKCUUi5TBc/_ssgManifest.js"],rootMainFiles:["static/chunks/webpack-a5e5f61cb7910e6b.js","static/chunks/4bd1b696-8a4ab4fdf0ae305a.js","static/chunks/3794-6cecce02b123eb1f.js","static/chunks/main-app-eacc433ef218cf40.js"],rootMainFilesTree:{},pages:{"/_app":[]}};