@jheavenknows/bluerouter 5.5.4 → 5.5.5

package/app/.next-cli-build/server/chunks/2947.js

@@ -1,2 +1,2 @@
 "use strict";exports.id=2947,exports.ids=[2947],exports.modules={35723:(a,b,c)=>{let d=c(29021),e=c(33873),f=c(21820),g="bluerouter";function h(){return"win32"===process.platform?e.join(process.env.APPDATA||e.join(f.homedir(),"AppData","Roaming"),g):e.join(f.homedir(),`.${g}`)}let i=function(){let a=process.env.DATA_DIR;if(!a)return h();try{return d.mkdirSync(a,{recursive:!0}),a}catch(b){if(b?.code==="EACCES"||b?.code==="EPERM")return console.warn(`[DATA_DIR] '${a}' not writable → fallback ~/.${g}`),h();throw b}}(),j=e.join(i,"mitm");a.exports={DATA_DIR:i,CA_DIR:j}},42947:(a,b,c)=>{let d=c(29021),e=c(33873),{DATA_DIR:f}=c(35723),{normalizeAllowedClientIps:g}=c(54584),{normalizeAllowedToolsInput:h}=c(47141),{normalizeProxyUsers:i}=c(99721),{normalizeAccessGrants:j}=c(68370),k=e.join(f,"audit-gateway"),l=e.join(k,"config.json"),m=e.join(k,"audit.jsonl"),n=e.join(k,"logs"),o=Object.freeze({enabled:!1,bindHost:"127.0.0.1",port:3128,clientProxyHost:"",clientToolFilterEnabled:!1,allowedClientTools:[],proxyAuthEnabled:!1,proxyAuthUsers:[],accessGrants:[],allowedHosts:["api.anthropic.com","*.anthropic.com","claude.ai","*.claude.ai","api.openai.com","*.openai.com","chatgpt.com","*.chatgpt.com","api.githubcopilot.com","*.githubcopilot.com","api.github.com","q.us-east-1.amazonaws.com","codewhisperer.us-east-1.amazonaws.com","oidc.us-east-1.amazonaws.com","*.auth.desktop.kiro.dev"],passthroughUnknown:!0,captureBodies:!0,captureLimitBytes:2097152,retentionDays:7,verifyUpstreamTls:!0,connectTimeoutMs:1e4,tlsHandshakeTimeoutMs:1e4,responseHeaderTimeoutMs:3e4,idleTimeoutMs:9e5,shutdownGraceMs:1500,sessionIdleTimeoutMs:36e5,allowPlainHttp:!1,allowedConnectPorts:[443]});function p(){return{...o,allowedClientTools:[...o.allowedClientTools],proxyAuthUsers:[...o.proxyAuthUsers],accessGrants:[],allowedHosts:[...o.allowedHosts],allowedConnectPorts:[...o.allowedConnectPorts]}}function q(){d.mkdirSync(k,{recursive:!0}),d.mkdirSync(n,{recursive:!0})}function r(a){return[...new Set((Array.isArray(a)?a:String(a||"").split(/[\r\n,]+/)).map(a=>String(a||"").trim().toLowerCase()).filter(Boolean).filter(a=>!a.includes("://")&&/^[*a-z0-9._-]+$/.test(a)))]}function s(a,b,c,d,e){let f=null==a?b:Number(a);if(!Number.isInteger(f)||f<c||f>d)throw Error(`${e} must be between ${c} and ${d}`);return f}function t(a={}){let b={...o,...a},c=s(b.port,o.port,1,65535,"Proxy port"),d=Number(b.captureLimitBytes);if(!Number.isFinite(d)||d<0||d>0x1000000)throw Error("Capture limit must be between 0 and 16 MB");let e=s(b.retentionDays,o.retentionDays,1,365,"Retention days"),f=s(b.connectTimeoutMs,o.connectTimeoutMs,1e3,12e4,"Connect timeout"),g=s(b.tlsHandshakeTimeoutMs,o.tlsHandshakeTimeoutMs,1e3,12e4,"TLS handshake timeout"),k=s(b.responseHeaderTimeoutMs,o.responseHeaderTimeoutMs,1e3,3e5,"Response header timeout"),l=s(b.idleTimeoutMs,o.idleTimeoutMs,3e4,36e5,"Idle timeout"),m=s(b.shutdownGraceMs,o.shutdownGraceMs,0,3e4,"Shutdown grace period"),n=s(b.sessionIdleTimeoutMs,o.sessionIdleTimeoutMs,3e5,864e5,"Session idle timeout"),p=String(b.bindHost||"127.0.0.1").trim();if(!p||/\s/.test(p))throw Error("Invalid bind address");let q=String(b.clientProxyHost||"").trim();if(/\s/.test(q)||q.includes("://"))throw Error("Client proxy host must be a hostname or IP without protocol");let u=i(b.proxyAuthUsers);0;let v=j(b.accessGrants),w=!0===b.clientToolFilterEnabled,x=h(b.allowedClientTools);if(w&&0===x.length)throw Error("Client tool filter requires at least one allowed tool");return{enabled:!0===b.enabled,bindHost:p,port:c,clientProxyHost:q,clientToolFilterEnabled:w,allowedClientTools:x,proxyAuthEnabled:!1,proxyAuthUsers:u,accessGrants:v,allowedHosts:r(b.allowedHosts),passthroughUnknown:!1!==b.passthroughUnknown,captureBodies:!1!==b.captureBodies,captureLimitBytes:Math.round(d),retentionDays:e,verifyUpstreamTls:!0,connectTimeoutMs:f,tlsHandshakeTimeoutMs:g,responseHeaderTimeoutMs:k,idleTimeoutMs:l,shutdownGraceMs:m,sessionIdleTimeoutMs:n,allowPlainHttp:!1,allowedConnectPorts:[443]}}a.exports={PROXY_AUTH_FEATURE_ENABLED:!1,AUDIT_DIR:k,CONFIG_PATH:l,AUDIT_LOG_PATH:m,AUDIT_LOG_DIR:n,DEFAULT_CONFIG:o,ensureAuditDir:q,loadConfig:function(){if(q(),!d.existsSync(l))return p();try{return t(JSON.parse(d.readFileSync(l,"utf8")))}catch(a){return console.warn(`[audit-proxy] invalid config ignored: ${a.message||a}`),p()}},saveConfig:function(a){q();let b=t(a),c=`${l}.tmp`;return d.writeFileSync(c,`${JSON.stringify(b,null,2)}
-`,{mode:384}),d.renameSync(c,l),b},validateConfig:t,normalizeAllowedHosts:r,normalizeAllowedClientIps:g}},47141:a=>{let b=[{id:"claude-code",label:"Claude Code",patterns:["claude-cli","claude-code","anthropic"]},{id:"codex",label:"OpenAI Codex",patterns:["codex_cli","codex-cli","codex"]},{id:"gemini-cli",label:"Gemini CLI",patterns:["gemini-cli","google-genai"]},{id:"cursor",label:"Cursor",patterns:["cursor"]},{id:"copilot",label:"GitHub Copilot",patterns:["copilot","githubcopilot"]},{id:"kiro",label:"Kiro",patterns:["kiro","aws-sdk-js"]},{id:"curl",label:"curl / scripts",patterns:["curl","wget","httpie"]}];function c(a){return String(a||"").trim().toLowerCase()}function d(a,b=[]){let e=c(a);return!!e&&!!b.length&&b.some(a=>a&&e.includes(a))}a.exports={TOOL_PRESETS:b,normalizeAllowedTools:function(a){let d=Array.isArray(a)?a:String(a||"").split(/[\r\n,]+/),e=[];for(let a of d){let d=c(a);if(!d)continue;let f=b.find(a=>a.id===d);f?e.push(...f.patterns):e.push(d)}return[...new Set(e)]},normalizeAllowedToolsInput:function(a){return[...new Set((Array.isArray(a)?a:String(a||"").split(/[\r\n,]+/)).map(c).filter(Boolean))]},clientToolMatches:d,shouldRefuseClientTool:function(a,b=[]){return!!c(a)&&!d(a,b)},describeUserAgent:function(a){let b=String(a||"").trim();return b?b.length>120?`${b.slice(0,119)}…`:b:"no User-Agent"}}},54584:(a,b,c)=>{let d=c(91645);function e(a){let b=String(a||"").trim().toLowerCase();b.startsWith("[")&&b.endsWith("]")&&(b=b.slice(1,-1));let c=b.indexOf("%");return c>=0&&(b=b.slice(0,c)),b.startsWith("::ffff:")&&4===d.isIP(b.slice(7))&&(b=b.slice(7)),b}function f(a){return Buffer.from(a.split(".").map(a=>Number(a)))}function g(a,b){return 4===b?f(a):function(a){let b=e(a),c=b.lastIndexOf(":");if(c>=0){let a=b.slice(c+1);if(4===d.isIP(a)){let d=f(a),e=(d[0]<<8|d[1]).toString(16),g=(d[2]<<8|d[3]).toString(16);b=`${b.slice(0,c)}:${e}:${g}`}}let g=b.split("::");if(g.length>2)throw Error("Invalid IPv6 address");let h=g[0]?g[0].split(":").filter(Boolean):[],i=2===g.length&&g[1]?g[1].split(":").filter(Boolean):[],j=8-h.length-i.length;if(1===g.length&&0!==j||j<0)throw Error("Invalid IPv6 address");let k=2===g.length?[...h,...Array(j).fill("0"),...i]:h;if(8!==k.length)throw Error("Invalid IPv6 address");let l=Buffer.alloc(16);return k.forEach((a,b)=>{let c=Number.parseInt(a||"0",16);if(!Number.isInteger(c)||c<0||c>65535)throw Error("Invalid IPv6 address");l[2*b]=c>>8&255,l[2*b+1]=255&c}),l}(a)}function h(a){let b=String(a||"").trim();if(!b)throw Error("Empty IP rule");let c=b.indexOf("/"),f=e(c>=0?b.slice(0,c):b),g=d.isIP(f);if(!g)throw Error(`Invalid client IP/CIDR: ${b}`);let h=4===g?32:128,i=c>=0?Number(b.slice(c+1)):h;if(!Number.isInteger(i)||i<0||i>h)throw Error(`Invalid CIDR prefix: ${b}`);return{text:c>=0?`${f}/${i}`:f,ip:f,family:g,prefix:i}}a.exports={normalizeIp:e,parseIpRule:h,normalizeAllowedClientIps:function(a){let b=Array.isArray(a)?a:String(a||"").split(/[\r\n,]+/),c=[],d=new Set;for(let a of b){let b=String(a||"").trim();if(!b)continue;let e=h(b);d.has(e.text)||(d.add(e.text),c.push(e.text))}return c},clientIpMatches:function(a,b=[]){let c=e(a),f=d.isIP(c);if(!f)return!1;let i=g(c,f);for(let a of b||[]){let b;try{b=h(a)}catch{continue}if(b.family===f&&function(a,b,c){let d=Math.floor(c/8),e=c%8;for(let c=0;c<d;c+=1)if(a[c]!==b[c])return!1;if(!e)return!0;let f=255<<8-e&255;return(a[d]&f)==(b[d]&f)}(i,g(b.ip,b.family),b.prefix))return!0}return!1}}},60484:(a,b,c)=>{let{normalizeIp:d}=c(54584),e=new Map;function f(a){let b=Number(a);return Number.isFinite(b)&&b>=6e4?b:36e5}a.exports={DEFAULT_IDLE_TIMEOUT_MS:36e5,MIN_IDLE_TIMEOUT_MS:6e4,activateProxySession:function({userId:a,displayName:b,ip:c,idleTimeoutMs:g}={}){let h=String(a||"").trim().toLowerCase(),i=d(c);if(!h||!i)return null;let j=Date.now(),k=f(g),l=e.get(i);l&&l.userId!==h&&console.log(`[audit-proxy] session for ${i} reassigned from ${l.userId} to ${h}`);let m={userId:h,displayName:String(b||"").trim()||h,activatedAt:l?.userId===h?l.activatedAt:j,expiresAt:j+k};return e.set(i,m),{ip:i,...m}},touchProxySession:function(a,b){let c=d(a),g=e.get(c);return g?(g.expiresAt=Date.now()+f(b),{ip:c,...g}):null},getProxySession:function(a){let b=d(a),c=e.get(b);return c?c.expiresAt<=Date.now()?(e.delete(b),null):{ip:b,...c}:null},listActiveProxySessions:function(){let a=Date.now(),b=[];for(let[c,d]of e){if(d.expiresAt<=a){e.delete(c);continue}b.push({ip:c,...d})}return b.sort((a,b)=>b.expiresAt-a.expiresAt)},pruneExpiredProxySessions:function(){let a=Date.now(),b=0;for(let[c,d]of e)d.expiresAt<=a&&(e.delete(c),b+=1);return b},revokeProxySession:function(a){return e.delete(d(a))},revokeProxySessionsForUser:function(a){let b=String(a||"").trim().toLowerCase();if(!b)return 0;let c=0;for(let[a,d]of e)d.userId===b&&(e.delete(a),c+=1);return c},clearAllProxySessions:function(){let a=e.size;return e.clear(),a}}},68370:(a,b,c)=>{let{normalizeIp:d,clientIpMatches:e}=c(54584),{activateProxySession:f,touchProxySession:g,listActiveProxySessions:h}=c(60484);function i(a){return String(a||"").trim().toLowerCase()}function j(a){let b=Array.isArray(a)?a:a&&"object"==typeof a?Object.entries(a).map(([a,b])=>({userId:a,note:b})):[],c=new Map;for(let a of b){let b=i(a?.userId??a?.user??a?.id);b&&c.set(b,{userId:b,note:String((a?.note??c.get(b)?.note)||"").trim().slice(0,200)})}if(c.size>500)throw Error("At most 500 Audit Proxy access grants are supported");return[...c.values()].sort((a,b)=>a.userId.localeCompare(b.userId))}function k(a=[],b=""){let c=i(b);return c&&a.find(a=>a.userId===c)||null}function l(a={}){let b=a.grants||[],c=new Set(b.map(a=>a.userId)),d=h().filter(a=>c.has(a.userId));return{...a,enabled:!0,allowedClientIps:d.map(a=>a.ip),source:"sessions",grants:b,sessions:d}}a.exports={MAX_GRANTS:500,normalizeGrantUserId:i,normalizeAccessGrants:j,findAccessGrant:k,effectiveClientIpPolicy:function(a={}){return l({grants:j(a.accessGrants),sessionIdleTimeoutMs:a.sessionIdleTimeoutMs})},attachClientIpGate:function(a,b){let c=new Map;return a.prependListener("connection",a=>{let f=d(a?.remoteAddress||""),h=l(b()||{});if(h.enabled&&!e(f,h.allowedClientIps||[])){console.log(`[audit-proxy] denied client IP ${f||"unknown"} (${h.source||"manual"} allowlist)`);try{a.destroy()}catch{}return}g(f,h.sessionIdleTimeoutMs),c.set(a,f),a.once("close",()=>c.delete(a))}),{dropRevoked(){let a=l(b()||{});if(!a.enabled)return 0;let d=0;for(let[b,f]of[...c])if(!e(f,a.allowedClientIps||[])){console.log(`[audit-proxy] closing connection from revoked client IP ${f||"unknown"}`);try{b.destroy()}catch{}c.delete(b),d+=1}return d},connectionCount:()=>c.size}},activateProxySessionOnLogin:function({userId:a,displayName:b,ip:c,config:d}={}){let e=i(a);return e&&k(j(d?.accessGrants),e)?f({userId:e,displayName:b,ip:c,idleTimeoutMs:d?.sessionIdleTimeoutMs}):null}}},99721:(a,b,c)=>{let d=c(55511),e=/^[a-z0-9][a-z0-9._-]{0,63}$/i,f=null;function g(){return f||(f=c(1893)),f}function h(a){return String(a||"").trim()}function i(a){let b=Array.isArray(a)?a:[],c=new Set,d=[];for(let a of b){if(!a||"object"!=typeof a)continue;let b=h(a.username),f=String(a.passwordHash||"");if(!e.test(b)||!f.startsWith("$2"))continue;let g=b.toLowerCase();c.has(g)||(c.add(g),d.push({username:b,passwordHash:f}))}return d}function j(a){if(Array.isArray(a))return null;let b=String(a||"").trim();if(!b||b.length>1024)return null;let c=b.indexOf(" ");if(c<0||"basic"!==b.slice(0,c).toLowerCase())return null;let d=b.slice(c+1).trim();if(!d||!/^[A-Za-z0-9+/]+={0,2}$/.test(d))return null;let e="";try{e=Buffer.from(d,"base64").toString("utf8")}catch{return null}let f=e.indexOf(":");return f<0?null:{username:e.slice(0,f),password:e.slice(f+1)}}a.exports={CACHE_TTL_MS:3e5,PASSWORD_MAX_BYTES:72,PASSWORD_MIN_BYTES:8,createProxyAuthLimiter:function({maxFailures:a=10,windowMs:b=6e4,cooldownMs:c=3e4,maxCooldownMs:d=3e5,maxEntries:e=1024}={}){let f=new Map;return{isLocked(a){let b=f.get(a);return!!b&&b.lockedUntil>Date.now()},recordFailure(g){let h=Date.now();!function(a){if(f.size<e)return;for(let[c,d]of f)if(d.lockedUntil<=a&&a-d.lastFailAt>b&&f.delete(c),f.size<e)return;let c=f.keys().next();c.done||f.delete(c.value)}(h);let i=f.get(g)||{failures:0,lastFailAt:0,lockedUntil:0,cooldownMs:c};h-i.lastFailAt>b&&(i.failures=0),i.failures+=1,i.lastFailAt=h;let j=!1;return i.failures>=a&&(i.lockedUntil=h+i.cooldownMs,i.cooldownMs=Math.min(2*i.cooldownMs,d),i.failures=0,j=!0),f.set(g,i),{lockedNow:j}},recordSuccess(a){f.delete(a)}}},createProxyAuthenticator:function(a){let b=new Map(i(a).map(a=>[a.username.toLowerCase(),a])),c=new Map,e=new Map;return{get accountCount(){return b.size},async authenticate(a){let f,h=j(a);if(!h)return{ok:!1,username:null,reason:a?"Unsupported proxy credentials":"Proxy authentication required"};let{username:i,password:k}=h,l=d.createHash("sha256").update(`${i}\0${k}`).digest("hex"),m=(f=c.get(l))?f.expiresAt<=Date.now()?(c.delete(l),null):f.username:null;if(m)return{ok:!0,username:m,reason:null};let n=b.get(i.trim().toLowerCase()),o=n?n.passwordHash:"$2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy",p=e.get(l);p||(p=g().compare(k,o).catch(()=>!1),e.set(l,p),p.finally(()=>e.delete(l)));let q=await p;if(!n||!q)return{ok:!1,username:null,reason:"Invalid proxy credentials"};var r=n.username;if(c.size>=256){let a=c.keys().next();a.done||c.delete(a.value)}return c.set(l,{username:r,expiresAt:Date.now()+3e5}),{ok:!0,username:n.username,reason:null}}}},hashProxyPassword:async function a(a){let b=await g().genSalt(10);return g().hash(String(a),b)},isValidUsername:function(a){return e.test(h(a))},normalizeProxyUsers:i,parseBasicProxyAuthorization:j,redactProxyAuthUsers:function(a){return i(a).map(a=>({username:a.username,hasPassword:!0}))}}}};
+`,{mode:384}),d.renameSync(c,l),b},validateConfig:t,normalizeAllowedHosts:r,normalizeAllowedClientIps:g}},47141:a=>{let b=[{id:"claude-code",label:"Claude Code",patterns:["claude-cli","claude-code","anthropic"]},{id:"codex",label:"OpenAI Codex",patterns:["codex_cli","codex-cli","codex"]},{id:"gemini-cli",label:"Gemini CLI",patterns:["gemini-cli","google-genai"]},{id:"cursor",label:"Cursor",patterns:["cursor"]},{id:"copilot",label:"GitHub Copilot",patterns:["copilot","githubcopilot"]},{id:"kiro",label:"Kiro",patterns:["kiro","aws-sdk-js"]},{id:"curl",label:"curl / scripts",patterns:["curl","wget","httpie"]}];function c(a){return String(a||"").trim().toLowerCase()}function d(a,b=[]){let e=c(a);return!!e&&!!b.length&&b.some(a=>a&&e.includes(a))}a.exports={TOOL_PRESETS:b,normalizeAllowedTools:function(a){let d=Array.isArray(a)?a:String(a||"").split(/[\r\n,]+/),e=[];for(let a of d){let d=c(a);if(!d)continue;let f=b.find(a=>a.id===d);f?e.push(...f.patterns):e.push(d)}return[...new Set(e)]},normalizeAllowedToolsInput:function(a){return[...new Set((Array.isArray(a)?a:String(a||"").split(/[\r\n,]+/)).map(c).filter(Boolean))]},clientToolMatches:d,shouldRefuseClientTool:function(a,b=[]){return!!c(a)&&!d(a,b)},describeUserAgent:function(a){let b=String(a||"").trim();return b?b.length>120?`${b.slice(0,119)}…`:b:"no User-Agent"}}},54584:(a,b,c)=>{let d=c(91645);function e(a){let b=String(a||"").trim().toLowerCase();b.startsWith("[")&&b.endsWith("]")&&(b=b.slice(1,-1));let c=b.indexOf("%");return c>=0&&(b=b.slice(0,c)),b.startsWith("::ffff:")&&4===d.isIP(b.slice(7))&&(b=b.slice(7)),b}function f(a){return Buffer.from(a.split(".").map(a=>Number(a)))}function g(a,b){return 4===b?f(a):function(a){let b=e(a),c=b.lastIndexOf(":");if(c>=0){let a=b.slice(c+1);if(4===d.isIP(a)){let d=f(a),e=(d[0]<<8|d[1]).toString(16),g=(d[2]<<8|d[3]).toString(16);b=`${b.slice(0,c)}:${e}:${g}`}}let g=b.split("::");if(g.length>2)throw Error("Invalid IPv6 address");let h=g[0]?g[0].split(":").filter(Boolean):[],i=2===g.length&&g[1]?g[1].split(":").filter(Boolean):[],j=8-h.length-i.length;if(1===g.length&&0!==j||j<0)throw Error("Invalid IPv6 address");let k=2===g.length?[...h,...Array(j).fill("0"),...i]:h;if(8!==k.length)throw Error("Invalid IPv6 address");let l=Buffer.alloc(16);return k.forEach((a,b)=>{let c=Number.parseInt(a||"0",16);if(!Number.isInteger(c)||c<0||c>65535)throw Error("Invalid IPv6 address");l[2*b]=c>>8&255,l[2*b+1]=255&c}),l}(a)}function h(a){let b=String(a||"").trim();if(!b)throw Error("Empty IP rule");let c=b.indexOf("/"),f=e(c>=0?b.slice(0,c):b),g=d.isIP(f);if(!g)throw Error(`Invalid client IP/CIDR: ${b}`);let h=4===g?32:128,i=c>=0?Number(b.slice(c+1)):h;if(!Number.isInteger(i)||i<0||i>h)throw Error(`Invalid CIDR prefix: ${b}`);return{text:c>=0?`${f}/${i}`:f,ip:f,family:g,prefix:i}}a.exports={normalizeIp:e,parseIpRule:h,normalizeAllowedClientIps:function(a){let b=Array.isArray(a)?a:String(a||"").split(/[\r\n,]+/),c=[],d=new Set;for(let a of b){let b=String(a||"").trim();if(!b)continue;let e=h(b);d.has(e.text)||(d.add(e.text),c.push(e.text))}return c},clientIpMatches:function(a,b=[]){let c=e(a),f=d.isIP(c);if(!f)return!1;let i=g(c,f);for(let a of b||[]){let b;try{b=h(a)}catch{continue}if(b.family===f&&function(a,b,c){let d=Math.floor(c/8),e=c%8;for(let c=0;c<d;c+=1)if(a[c]!==b[c])return!1;if(!e)return!0;let f=255<<8-e&255;return(a[d]&f)==(b[d]&f)}(i,g(b.ip,b.family),b.prefix))return!0}return!1}}},60484:(a,b,c)=>{let{normalizeIp:d}=c(54584),e="__blueRouterAuditProxySessions";function f(){return globalThis[e]||(globalThis[e]=new Map),globalThis[e]}function g(a){let b=Number(a);return Number.isFinite(b)&&b>=6e4?b:36e5}a.exports={DEFAULT_IDLE_TIMEOUT_MS:36e5,MIN_IDLE_TIMEOUT_MS:6e4,activateProxySession:function({userId:a,displayName:b,ip:c,idleTimeoutMs:e}={}){let h=String(a||"").trim().toLowerCase(),i=d(c);if(!h||!i)return null;let j=Date.now(),k=g(e),l=f().get(i);l&&l.userId!==h&&console.log(`[audit-proxy] session for ${i} reassigned from ${l.userId} to ${h}`);let m={userId:h,displayName:String(b||"").trim()||h,activatedAt:l?.userId===h?l.activatedAt:j,expiresAt:j+k};return f().set(i,m),{ip:i,...m}},touchProxySession:function(a,b){let c=d(a),e=f().get(c);return e?(e.expiresAt=Date.now()+g(b),{ip:c,...e}):null},getProxySession:function(a){let b=d(a),c=f().get(b);return c?c.expiresAt<=Date.now()?(f().delete(b),null):{ip:b,...c}:null},listActiveProxySessions:function(){let a=Date.now(),b=[];for(let[c,d]of f()){if(d.expiresAt<=a){f().delete(c);continue}b.push({ip:c,...d})}return b.sort((a,b)=>b.expiresAt-a.expiresAt)},pruneExpiredProxySessions:function(){let a=Date.now(),b=0;for(let[c,d]of f())d.expiresAt<=a&&(f().delete(c),b+=1);return b},revokeProxySession:function(a){return f().delete(d(a))},revokeProxySessionsForUser:function(a){let b=String(a||"").trim().toLowerCase();if(!b)return 0;let c=0;for(let[a,d]of f())d.userId===b&&(f().delete(a),c+=1);return c},clearAllProxySessions:function(){let a=f().size;return f().clear(),a}}},68370:(a,b,c)=>{let{normalizeIp:d,clientIpMatches:e}=c(54584),{activateProxySession:f,touchProxySession:g,listActiveProxySessions:h}=c(60484);function i(a){return String(a||"").trim().toLowerCase()}function j(a){let b=Array.isArray(a)?a:a&&"object"==typeof a?Object.entries(a).map(([a,b])=>({userId:a,note:b})):[],c=new Map;for(let a of b){let b=i(a?.userId??a?.user??a?.id);b&&c.set(b,{userId:b,note:String((a?.note??c.get(b)?.note)||"").trim().slice(0,200)})}if(c.size>500)throw Error("At most 500 Audit Proxy access grants are supported");return[...c.values()].sort((a,b)=>a.userId.localeCompare(b.userId))}function k(a=[],b=""){let c=i(b);return c&&a.find(a=>a.userId===c)||null}function l(a={}){let b=a.grants||[],c=new Set(b.map(a=>a.userId)),d=h().filter(a=>c.has(a.userId));return{...a,enabled:!0,allowedClientIps:d.map(a=>a.ip),source:"sessions",grants:b,sessions:d}}a.exports={MAX_GRANTS:500,normalizeGrantUserId:i,normalizeAccessGrants:j,findAccessGrant:k,effectiveClientIpPolicy:function(a={}){return l({grants:j(a.accessGrants),sessionIdleTimeoutMs:a.sessionIdleTimeoutMs})},attachClientIpGate:function(a,b){let c=new Map;return a.prependListener("connection",a=>{let f=d(a?.remoteAddress||""),h=l(b()||{});if(h.enabled&&!e(f,h.allowedClientIps||[])){console.log(`[audit-proxy] denied client IP ${f||"unknown"} (${h.source||"manual"} allowlist)`);try{a.destroy()}catch{}return}g(f,h.sessionIdleTimeoutMs),c.set(a,f),a.once("close",()=>c.delete(a))}),{dropRevoked(){let a=l(b()||{});if(!a.enabled)return 0;let d=0;for(let[b,f]of[...c])if(!e(f,a.allowedClientIps||[])){console.log(`[audit-proxy] closing connection from revoked client IP ${f||"unknown"}`);try{b.destroy()}catch{}c.delete(b),d+=1}return d},connectionCount:()=>c.size}},activateProxySessionOnLogin:function({userId:a,displayName:b,ip:c,config:d}={}){let e=i(a);return e&&k(j(d?.accessGrants),e)?f({userId:e,displayName:b,ip:c,idleTimeoutMs:d?.sessionIdleTimeoutMs}):null}}},99721:(a,b,c)=>{let d=c(55511),e=/^[a-z0-9][a-z0-9._-]{0,63}$/i,f=null;function g(){return f||(f=c(1893)),f}function h(a){return String(a||"").trim()}function i(a){let b=Array.isArray(a)?a:[],c=new Set,d=[];for(let a of b){if(!a||"object"!=typeof a)continue;let b=h(a.username),f=String(a.passwordHash||"");if(!e.test(b)||!f.startsWith("$2"))continue;let g=b.toLowerCase();c.has(g)||(c.add(g),d.push({username:b,passwordHash:f}))}return d}function j(a){if(Array.isArray(a))return null;let b=String(a||"").trim();if(!b||b.length>1024)return null;let c=b.indexOf(" ");if(c<0||"basic"!==b.slice(0,c).toLowerCase())return null;let d=b.slice(c+1).trim();if(!d||!/^[A-Za-z0-9+/]+={0,2}$/.test(d))return null;let e="";try{e=Buffer.from(d,"base64").toString("utf8")}catch{return null}let f=e.indexOf(":");return f<0?null:{username:e.slice(0,f),password:e.slice(f+1)}}a.exports={CACHE_TTL_MS:3e5,PASSWORD_MAX_BYTES:72,PASSWORD_MIN_BYTES:8,createProxyAuthLimiter:function({maxFailures:a=10,windowMs:b=6e4,cooldownMs:c=3e4,maxCooldownMs:d=3e5,maxEntries:e=1024}={}){let f=new Map;return{isLocked(a){let b=f.get(a);return!!b&&b.lockedUntil>Date.now()},recordFailure(g){let h=Date.now();!function(a){if(f.size<e)return;for(let[c,d]of f)if(d.lockedUntil<=a&&a-d.lastFailAt>b&&f.delete(c),f.size<e)return;let c=f.keys().next();c.done||f.delete(c.value)}(h);let i=f.get(g)||{failures:0,lastFailAt:0,lockedUntil:0,cooldownMs:c};h-i.lastFailAt>b&&(i.failures=0),i.failures+=1,i.lastFailAt=h;let j=!1;return i.failures>=a&&(i.lockedUntil=h+i.cooldownMs,i.cooldownMs=Math.min(2*i.cooldownMs,d),i.failures=0,j=!0),f.set(g,i),{lockedNow:j}},recordSuccess(a){f.delete(a)}}},createProxyAuthenticator:function(a){let b=new Map(i(a).map(a=>[a.username.toLowerCase(),a])),c=new Map,e=new Map;return{get accountCount(){return b.size},async authenticate(a){let f,h=j(a);if(!h)return{ok:!1,username:null,reason:a?"Unsupported proxy credentials":"Proxy authentication required"};let{username:i,password:k}=h,l=d.createHash("sha256").update(`${i}\0${k}`).digest("hex"),m=(f=c.get(l))?f.expiresAt<=Date.now()?(c.delete(l),null):f.username:null;if(m)return{ok:!0,username:m,reason:null};let n=b.get(i.trim().toLowerCase()),o=n?n.passwordHash:"$2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy",p=e.get(l);p||(p=g().compare(k,o).catch(()=>!1),e.set(l,p),p.finally(()=>e.delete(l)));let q=await p;if(!n||!q)return{ok:!1,username:null,reason:"Invalid proxy credentials"};var r=n.username;if(c.size>=256){let a=c.keys().next();a.done||c.delete(a.value)}return c.set(l,{username:r,expiresAt:Date.now()+3e5}),{ok:!0,username:n.username,reason:null}}}},hashProxyPassword:async function a(a){let b=await g().genSalt(10);return g().hash(String(a),b)},isValidUsername:function(a){return e.test(h(a))},normalizeProxyUsers:i,parseBasicProxyAuthorization:j,redactProxyAuthUsers:function(a){return i(a).map(a=>({username:a.username,hasPassword:!0}))}}}};