@jheavenknows/bluerouter 5.5.4 → 5.5.6

package/app/.next-cli-build/server/chunks/9083.js

@@ -1,10 +1,10 @@
-"use strict";exports.id=9083,exports.ids=[9083],exports.modules={45372:(a,b,c)=>{let d=c(81630),e=c(73496),f=c(55591),g=c(91645),h=c(34631),i=c(55511),j=c(74075),{promisify:k}=c(28354),{redactHeaders:l,redactBodyText:m,redactUrlPath:n,scrubString:o}=c(48350),{extractUsageFromBody:p}=c(86455),{resolvePublicTarget:q}=c(78864),{normalizeAllowedTools:r,shouldRefuseClientTool:s,describeUserAgent:t}=c(98586),{createProxyAuthenticator:u,createProxyAuthLimiter:v}=c(7566),w=k(j.brotliDecompress),x=k(j.gunzip),y=k(j.inflate),z=k(j.inflateRaw),A="function"==typeof j.zstdDecompress?k(j.zstdDecompress):null,B=new Set(["connection","proxy-connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade"]);function C(a){return String(a||"").trim().replace(/^\[|\]$/g,"").toLowerCase()}function D(a,b=443){let c=String(a||"").trim();if(!c)throw Error("Missing CONNECT authority");if(c.startsWith("[")){let a=c.indexOf("]");if(a<0)throw Error("Invalid IPv6 CONNECT authority");let d=c.slice(1,a),e=c.slice(a+1);if(e&&!e.startsWith(":"))throw Error("Invalid IPv6 CONNECT authority");let f=e?Number(e.slice(1)):b;if(!Number.isInteger(f)||f<1||f>65535)throw Error("Invalid CONNECT port");return{host:d,port:f}}let d=c.lastIndexOf(":");if(d>0&&c.indexOf(":")===d){let a=c.slice(d+1);if(!/^\d+$/.test(a))throw Error("Invalid CONNECT port");let b=Number(a);if(!Number.isInteger(b)||b<1||b>65535)throw Error("Invalid CONNECT port");return{host:c.slice(0,d),port:b}}return{host:c,port:b}}function E(a,b=[]){let c=C(a);return b.some(a=>{let b=C(a);if(!b)return!1;if(b===c)return!0;if(b.startsWith("*.")){let a=b.slice(1);return c.endsWith(a)&&c.length>a.length}return!1})}function F(a={},{stripInternal:b=!0}={}){let c=new Set([...B,...String(a.connection||"").split(",").map(a=>a.trim().toLowerCase()).filter(Boolean)]),d={};for(let[e,f]of Object.entries(a||{})){let a=e.toLowerCase();!c.has(a)&&(b&&(a.startsWith("x-9r-")||a.startsWith("x-bluerouter-"))||(d[e]=f))}return d}async function G(a,b,c){let d=String(b||"").split(",").map(a=>a.trim().toLowerCase()).filter(a=>a&&"identity"!==a);if(!d.length||!a.length)return{buffer:a,decoded:!1,contentEncoding:d.join(", ")||null};let e=a;for(let a of[...d].reverse()){let b={maxOutputLength:c};if("br"===a)e=await w(e,b);else if("gzip"===a||"x-gzip"===a)e=await x(e,b);else if("deflate"===a)try{e=await y(e,b)}catch{e=await z(e,b)}else if("zstd"===a&&A)e=await A(e,b);else throw Error(`Unsupported content-encoding: ${a}`)}return{buffer:e,decoded:!0,contentEncoding:d.join(", ")}}async function H(a,b,c){let d=String(b||"").split(",").map(a=>a.trim().toLowerCase()).filter(a=>a&&"identity"!==a);if(1!==d.length||!a.length)return null;let e=d[0],f={maxOutputLength:c,finishFlush:j.constants.Z_SYNC_FLUSH};try{if("gzip"===e||"x-gzip"===e)return await x(a,f);if("deflate"===e)try{return await y(a,f)}catch{return await z(a,f)}if("br"===e)return await w(a,{maxOutputLength:c,finishFlush:j.constants.BROTLI_OPERATION_FLUSH})}catch{}return null}class I{constructor(a){this.limitBytes=Math.max(0,Number(a)||0),this.parts=[],this.capturedBytes=0,this.totalBytes=0,this.truncated=!1,this.hash=i.createHash("sha256"),this.finished=!1}add(a){if(!a||this.finished)return;let b=Buffer.isBuffer(a)?a:Buffer.from(a);if(this.hash.update(b),this.totalBytes+=b.length,this.capturedBytes>=this.limitBytes){b.length&&(this.truncated=!0);return}let c=this.limitBytes-this.capturedBytes,d=b.length>c?b.subarray(0,c):b;d.length&&(this.parts.push(Buffer.from(d)),this.capturedBytes+=d.length),d.length<b.length&&(this.truncated=!0)}async finish(a="",b=""){if(this.finished)throw Error("Audit capture was finalized more than once");this.finished=!0;let c=this.hash.digest("hex"),d=Buffer.concat(this.parts),e=String(b||"").trim().toLowerCase(),f=d,g=!1,h=null,i=!1,j=null,k=null,l=!1,n=Math.max(1048576,Math.min(0x4000000,Math.max(8*this.limitBytes,this.limitBytes)));if(this.limitBytes>0&&d.length&&e&&"identity"!==e)if(this.truncated){let a=await H(d,e,n);a&&a.length?(f=a,g=!0,l=!0,h=a.length,i=!0):(j=`Compressed ${e} capture was truncated before decode`,k=`[${e} audit body capture truncated; decoded body unavailable]`)}else try{let a=await G(d,e,n);f=a.buffer,g=a.decoded,h=f.length,f.length>this.limitBytes&&(f=f.subarray(0,this.limitBytes),i=!0)}catch(a){j=o(a?.message||String(a)),k=`[Unable to decode ${e} audit body: ${j}]`}let p=/json|text|javascript|xml|x-www-form-urlencoded|event-stream/i.test(a||"");return{body:null!==k?k:p||!a?m(f.toString("utf8"),a):`[${f.length} bytes captured; binary body omitted]`,capturedBytes:this.capturedBytes,totalBytes:this.totalBytes,wireSha256:c,truncated:this.truncated||i,...e&&"identity"!==e?{contentEncoding:e}:{},...g?{decoded:!0,decodedBytes:h}:{},...l?{decodePartial:!0}:{},...j?{decodeError:j}:{}}}}function J(a){let b=C(a);return"api.anthropic.com"===b||b.endsWith(".anthropic.com")||"claude.ai"===b||b.endsWith(".claude.ai")?"anthropic":"api.openai.com"===b||b.endsWith(".openai.com")||"chatgpt.com"===b||b.endsWith(".chatgpt.com")?"openai":"other"}function K(a){if(!a||"string"!=typeof a)return null;try{let b=JSON.parse(a);return"string"==typeof b?.model?b.model:null}catch{return null}}function L(a){let b=a?.remoteAddress||"";return b.startsWith("::ffff:")?b.slice(7):b}function M(a,b,c,d=null){try{let e=String(c||b),f=(d||[]).filter(a=>"string"==typeof a&&!/[\r\n]/.test(a)).map(a=>`${a}\r
+"use strict";exports.id=9083,exports.ids=[9083],exports.modules={45372:(a,b,c)=>{let d=c(81630),e=c(73496),f=c(55591),g=c(91645),h=c(34631),i=c(55511),j=c(74075),{promisify:k}=c(28354),{redactHeaders:l,redactBodyText:m,redactUrlPath:n,scrubString:o}=c(48350),{extractUsageFromBody:p}=c(86455),{resolvePublicTarget:q}=c(78864),{normalizeAllowedTools:r,shouldRefuseClientTool:s,describeUserAgent:t}=c(98586),{evaluateRules:u,evaluateBody:v,needsBodyInspection:w}=c(87976),{createProxyAuthenticator:x,createProxyAuthLimiter:y}=c(7566),z=k(j.brotliDecompress),A=k(j.gunzip),B=k(j.inflate),C=k(j.inflateRaw),D="function"==typeof j.zstdDecompress?k(j.zstdDecompress):null,E=new Set(["connection","proxy-connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade"]);function F(a){return String(a||"").trim().replace(/^\[|\]$/g,"").toLowerCase()}function G(a,b=443){let c=String(a||"").trim();if(!c)throw Error("Missing CONNECT authority");if(c.startsWith("[")){let a=c.indexOf("]");if(a<0)throw Error("Invalid IPv6 CONNECT authority");let d=c.slice(1,a),e=c.slice(a+1);if(e&&!e.startsWith(":"))throw Error("Invalid IPv6 CONNECT authority");let f=e?Number(e.slice(1)):b;if(!Number.isInteger(f)||f<1||f>65535)throw Error("Invalid CONNECT port");return{host:d,port:f}}let d=c.lastIndexOf(":");if(d>0&&c.indexOf(":")===d){let a=c.slice(d+1);if(!/^\d+$/.test(a))throw Error("Invalid CONNECT port");let b=Number(a);if(!Number.isInteger(b)||b<1||b>65535)throw Error("Invalid CONNECT port");return{host:c.slice(0,d),port:b}}return{host:c,port:b}}function H(a,b=[]){let c=F(a);return b.some(a=>{let b=F(a);if(!b)return!1;if(b===c)return!0;if(b.startsWith("*.")){let a=b.slice(1);return c.endsWith(a)&&c.length>a.length}return!1})}function I(a={},{stripInternal:b=!0}={}){let c=new Set([...E,...String(a.connection||"").split(",").map(a=>a.trim().toLowerCase()).filter(Boolean)]),d={};for(let[e,f]of Object.entries(a||{})){let a=e.toLowerCase();!c.has(a)&&(b&&(a.startsWith("x-9r-")||a.startsWith("x-bluerouter-"))||(d[e]=f))}return d}async function J(a,b,c){let d=String(b||"").split(",").map(a=>a.trim().toLowerCase()).filter(a=>a&&"identity"!==a);if(!d.length||!a.length)return{buffer:a,decoded:!1,contentEncoding:d.join(", ")||null};let e=a;for(let a of[...d].reverse()){let b={maxOutputLength:c};if("br"===a)e=await z(e,b);else if("gzip"===a||"x-gzip"===a)e=await A(e,b);else if("deflate"===a)try{e=await B(e,b)}catch{e=await C(e,b)}else if("zstd"===a&&D)e=await D(e,b);else throw Error(`Unsupported content-encoding: ${a}`)}return{buffer:e,decoded:!0,contentEncoding:d.join(", ")}}async function K(a,b,c){let d=String(b||"").split(",").map(a=>a.trim().toLowerCase()).filter(a=>a&&"identity"!==a);if(1!==d.length||!a.length)return null;let e=d[0],f={maxOutputLength:c,finishFlush:j.constants.Z_SYNC_FLUSH};try{if("gzip"===e||"x-gzip"===e)return await A(a,f);if("deflate"===e)try{return await B(a,f)}catch{return await C(a,f)}if("br"===e)return await z(a,{maxOutputLength:c,finishFlush:j.constants.BROTLI_OPERATION_FLUSH})}catch{}return null}class L{constructor(a){this.limitBytes=Math.max(0,Number(a)||0),this.parts=[],this.capturedBytes=0,this.totalBytes=0,this.truncated=!1,this.hash=i.createHash("sha256"),this.finished=!1}add(a){if(!a||this.finished)return;let b=Buffer.isBuffer(a)?a:Buffer.from(a);if(this.hash.update(b),this.totalBytes+=b.length,this.capturedBytes>=this.limitBytes){b.length&&(this.truncated=!0);return}let c=this.limitBytes-this.capturedBytes,d=b.length>c?b.subarray(0,c):b;d.length&&(this.parts.push(Buffer.from(d)),this.capturedBytes+=d.length),d.length<b.length&&(this.truncated=!0)}async finish(a="",b=""){if(this.finished)throw Error("Audit capture was finalized more than once");this.finished=!0;let c=this.hash.digest("hex"),d=Buffer.concat(this.parts),e=String(b||"").trim().toLowerCase(),f=d,g=!1,h=null,i=!1,j=null,k=null,l=!1,n=Math.max(1048576,Math.min(0x4000000,Math.max(8*this.limitBytes,this.limitBytes)));if(this.limitBytes>0&&d.length&&e&&"identity"!==e)if(this.truncated){let a=await K(d,e,n);a&&a.length?(f=a,g=!0,l=!0,h=a.length,i=!0):(j=`Compressed ${e} capture was truncated before decode`,k=`[${e} audit body capture truncated; decoded body unavailable]`)}else try{let a=await J(d,e,n);f=a.buffer,g=a.decoded,h=f.length,f.length>this.limitBytes&&(f=f.subarray(0,this.limitBytes),i=!0)}catch(a){j=o(a?.message||String(a)),k=`[Unable to decode ${e} audit body: ${j}]`}let p=/json|text|javascript|xml|x-www-form-urlencoded|event-stream/i.test(a||"");return{body:null!==k?k:p||!a?m(f.toString("utf8"),a):`[${f.length} bytes captured; binary body omitted]`,capturedBytes:this.capturedBytes,totalBytes:this.totalBytes,wireSha256:c,truncated:this.truncated||i,...e&&"identity"!==e?{contentEncoding:e}:{},...g?{decoded:!0,decodedBytes:h}:{},...l?{decodePartial:!0}:{},...j?{decodeError:j}:{}}}}function M(a){let b=F(a);return"api.anthropic.com"===b||b.endsWith(".anthropic.com")||"claude.ai"===b||b.endsWith(".claude.ai")?"anthropic":"api.openai.com"===b||b.endsWith(".openai.com")||"chatgpt.com"===b||b.endsWith(".chatgpt.com")?"openai":"other"}function N(a,b,c){let d=Buffer.from("anthropic"===M(b)?JSON.stringify({type:"error",error:{type:"permission_error",message:c}}):JSON.stringify({error:{message:c,type:"invalid_request_error",code:"content_policy_blocked"}}),"utf8");a.writeHead(403,{"content-type":"application/json; charset=utf-8","content-length":String(d.length),connection:"close"}),a.end(d)}function O(a){if(!a||"string"!=typeof a)return null;try{let b=JSON.parse(a);return"string"==typeof b?.model?b.model:null}catch{return null}}function P(a){let b=a?.remoteAddress||"";return b.startsWith("::ffff:")?b.slice(7):b}function Q(a,b,c,d=null){try{let e=String(c||b),f=(d||[]).filter(a=>"string"==typeof a&&!/[\r\n]/.test(a)).map(a=>`${a}\r
 `).join("");a.end(`HTTP/1.1 ${b}\r
 ${f}Connection: close\r
 Content-Type: text/plain; charset=utf-8\r
 Content-Length: ${Buffer.byteLength(e)}\r
 \r
-${e}`)}catch{try{a.destroy()}catch{}}}function N(a={}){let b={};for(let[c,d]of Object.entries(a||{}))b[c]=d;return b}async function O(a){let b=await a.requestCapture.finish(String(a.requestHeaders["content-type"]||""),String(a.requestHeaders["content-encoding"]||"")),c=String(a.responseHeaders?.["content-type"]||""),d=await a.responseCapture.finish(c,String(a.responseHeaders?.["content-encoding"]||"")),e=J(a.target.host),f=n(a.path),g=p({provider:e,body:d.body,contentType:c,path:f}),h=K(b.body)||g?.model||null;return{id:i.randomUUID(),timestamp:new Date().toISOString(),protocol:a.protocol||"http/1.1",client:{ip:a.clientIp||"",port:a.clientPort||null,userAgent:String(a.requestHeaders["user-agent"]||""),proxyUser:a.authUser||null},provider:e,host:C(a.target.host),port:a.target.port,method:a.method,path:f,model:h,usage:g,status:a.statusCode||null,durationMs:Date.now()-a.startedAt,error:a.error?o(a.error.message||a.error):null,denied:!0===a.denied,request:{headers:l(a.requestHeaders),...b},response:{headers:l(a.responseHeaders||{}),...d}}}a.exports={createAuditProxy:function(a={},b={}){let i={allowedHosts:[],passthroughUnknown:!0,captureBodies:!0,captureLimitBytes:2097152,verifyUpstreamTls:!0,allowedConnectPorts:[443],connectTimeoutMs:1e4,tlsHandshakeTimeoutMs:1e4,responseHeaderTimeoutMs:3e4,idleTimeoutMs:9e5,allowPlainHttp:!1,clientToolFilterEnabled:!1,allowedClientTools:[],proxyAuthEnabled:!1,proxyAuthUsers:[],clientAlpnProtocols:["http/1.1"],...a};if(!0!==i.verifyUpstreamTls)throw Error("Upstream TLS verification is mandatory in Audit Proxy mode");let j=b.certificateProvider;if("function"!=typeof j)throw Error("certificateProvider is required");let k="function"==typeof b.onAudit?b.onAudit:()=>{},l="function"==typeof b.onAuditJob?b.onAuditJob:null,m="function"==typeof b.resolveTarget?b.resolveTarget:(a,b)=>q(a,b,{allowedPorts:i.allowedConnectPorts}),n=b.upstreamCa,o=r(i.allowedClientTools),p=i.proxyAuthEnabled?u(i.proxyAuthUsers):null,w=i.proxyAuthEnabled?v():null,x=new Set,y=new Map,z=new WeakMap,A=new Set;function B(a){return!a||x.has(a)||(x.add(a),a.once?.("close",()=>x.delete(a))),a}function C(a,b){try{"function"==typeof a.destroy?a.destroy(b):"function"==typeof a.close&&a.close()}catch{}}function G(a){let b=()=>O(a);if(l){try{l(b)}catch(a){console.warn("[audit-proxy] audit enqueue failed:",a?.message||a)}return}setImmediate(()=>{Promise.resolve().then(b).then(k).catch(a=>console.warn("[audit-proxy] audit callback failed:",a?.message||a))})}function H({requestHeaders:a,method:b,path:c,target:d,requestCapture:e,responseCapture:f,responseHeaders:g,statusCode:h,startedAt:i,error:j,socket:k,protocol:l,authUser:m=null,denied:n=!1}){return{requestHeaders:N(a),method:b,path:c,target:d,requestCapture:e,responseCapture:f,responseHeaders:N(g),statusCode:h,startedAt:i,error:j,clientIp:L(k),clientPort:k?.remotePort||null,authUser:m,protocol:l,denied:n}}let J="This proxy does not support WebSocket connections. Use the HTTP streaming transport instead - most clients fall back to it automatically.";function K(a,b,c,d,{statusCode:e=403,authUser:f=null}={}){let g=String(a.url||""),h=c||{host:g.includes(":")?g.slice(0,g.lastIndexOf(":")):g||"unknown",port:443},j=new I(i.captureBodies?i.captureLimitBytes:0);j.add(Buffer.from(d)),G(H({requestHeaders:a.headers,method:"CONNECT",path:"",target:h,requestCapture:new I(0),responseCapture:j,responseHeaders:{"content-type":"text/plain; charset=utf-8",connection:"close"},statusCode:e,startedAt:Date.now(),error:d,socket:b,protocol:"http/1.1",authUser:f,denied:!0}))}let P=Symbol("refused");async function Q(a,b){if(!p)return null;let d=L(b),e=(c,d=null)=>(M(b,"407 Proxy Authentication Required",c,['Proxy-Authenticate: Basic realm="BlueRouter Audit Proxy", charset="UTF-8"']),K(a,b,void 0,c,{statusCode:407,authUser:d}),P);if(w.isLocked(d))return e("Too many failed proxy authentication attempts");let f=a.headers["proxy-authorization"],g=await p.authenticate(f);if(g.ok)return w.recordSuccess(d),g.username;let h=null;if(f){let{lockedNow:a}=w.recordFailure(d);a&&console.log(`[audit-proxy] proxy auth lockout for ${d||"unknown"}`);try{h=c(7566).parseBasicProxyAuthorization(f)?.username||null}catch{h=null}}return e(g.reason||"Proxy authentication required",h)}function R(a,b,c){if(!c)return;let d=new I(i.captureBodies?i.captureLimitBytes:0);d.add(Buffer.from(J)),G(H({requestHeaders:a.headers,method:a.method,path:a.url,target:c,requestCapture:new I(0),responseCapture:d,responseHeaders:{"content-type":"text/plain; charset=utf-8",connection:"close"},statusCode:501,startedAt:Date.now(),error:null,socket:b,protocol:"http/1.1",authUser:b?.__auditProxyUser||null,denied:!0}))}async function S(a,b,{expectContinue:c=!1}={}){let d=a.socket.__auditTarget,e=a.socket.__auditProxyUser||null;if(!d){b.writeHead(502,{"content-type":"text/plain"}),b.end("Audit target is missing");return}if(function(a={}){return"string"==typeof a.upgrade&&""!==a.upgrade.trim()}(a.headers)){b.writeHead(501,{"content-type":"text/plain; charset=utf-8",connection:"close"}),b.end(J),R(a,a.socket,d);return}let h=Date.now(),j=new I(i.captureBodies?i.captureLimitBytes:0),k=new I(i.captureBodies?i.captureLimitBytes:0),l=F(a.headers,{stripInternal:!0});l.host=443===d.port?d.host:`${d.host}:${d.port}`;let o=null,p=null,q={},r=null,s=!1,t=!1,u=null,v=(b=null)=>{s||(s=!0,u&&clearTimeout(u),G(H({requestHeaders:a.headers,method:a.method,path:a.url,target:d,requestCapture:j,responseCapture:k,responseHeaders:q,statusCode:r,startedAt:h,error:b,socket:a.socket,protocol:"http/1.1",authUser:e})))};try{let e,h,s=await m(d.host,d.port);(o=f.request({hostname:d.host,port:d.port,method:a.method,path:a.url,headers:l,rejectUnauthorized:!0,servername:g.isIP(d.host)?void 0:d.host,ca:n,ALPNProtocols:["http/1.1"],lookup:s.lookup,autoSelectFamily:!0,agent:(e=`${d.host}:${d.port}`,(h=y.get(e))||(h=new f.Agent({keepAlive:!0,maxSockets:32,maxFreeSockets:8,timeout:i.idleTimeoutMs}),y.set(e,h)),h)})).on("socket",a=>{if(B(a),a.setNoDelay(!0),a.setKeepAlive(!0,3e4),a.setTimeout(i.idleTimeoutMs,()=>a.destroy(Error("Upstream idle timeout"))),a.connecting){let b=setTimeout(()=>a.destroy(Error("Upstream TLS connect timeout")),i.connectTimeoutMs+i.tlsHandshakeTimeoutMs);b.unref?.();let c=()=>clearTimeout(b);a.once("secureConnect",c),a.once("error",c),a.once("close",c)}}),o.on("continue",()=>{c&&!b.headersSent&&b.writeContinue()}),o.on("information",a=>{102===a.statusCode&&"function"==typeof b.writeProcessing&&b.writeProcessing(),103===a.statusCode&&"function"==typeof b.writeEarlyHints&&b.writeEarlyHints(a.headers||{})}),o.on("response",a=>{p=a,u&&clearTimeout(u),r=a.statusCode||502,q=N(a.headers||{});let c=F(a.headers,{stripInternal:!1});b.writeHead(r,c),b.flushHeaders?.(),a.on("data",c=>{k.add(c),b.write(c)||a.pause()}),b.on("drain",()=>a.resume()),a.on("aborted",()=>{let a=Error("Upstream response aborted");b.destroyed||b.destroy(a),v(a)}),a.on("error",a=>{b.destroyed||b.destroy(a),v(a)}),a.on("end",()=>{if(a.trailers&&Object.keys(a.trailers).length)try{b.addTrailers(F(a.trailers,{stripInternal:!1}))}catch{}t=!0,b.end(),v(null)})}),o.on("error",a=>{b.headersSent?b.destroyed||b.destroy(a):(b.writeHead(502,{"content-type":"application/json"}),b.end(JSON.stringify({error:"Verified upstream TLS request failed"})),t=!0),v(a)}),a.on("data",b=>{j.add(b),o.write(b)||a.pause()}),o.on("drain",()=>a.resume()),a.on("end",()=>{if(a.trailers&&Object.keys(a.trailers).length)try{o.addTrailers(F(a.trailers,{stripInternal:!0}))}catch{}o.end(),u=setTimeout(()=>o.destroy(Error("Upstream response header timeout")),i.responseHeaderTimeoutMs),u.unref?.()}),a.on("aborted",()=>o.destroy(Error("Client request aborted"))),a.on("error",a=>o.destroy(a)),b.on("close",()=>{t||(p?.destroy(Error("Client response closed")),o?.destroy(Error("Client response closed")),v(Error("Client response closed")))})}catch(a){b.headersSent||(b.writeHead(502,{"content-type":"application/json"}),b.end(JSON.stringify({error:"Destination validation or connection failed"})),t=!0),v(a)}}let T=d.createServer((a,b)=>{S(a,b)});async function U(a){return a.upstreamPromise||(a.upstreamPromise=(async()=>{let b=a.target,c=await m(b.host,b.port),d=B(h.connect({host:b.host,port:b.port,servername:g.isIP(b.host)?void 0:b.host,rejectUnauthorized:!0,ca:n,ALPNProtocols:["h2"],lookup:c.lookup,autoSelectFamily:!0}));d.setNoDelay(!0),d.setKeepAlive(!0,3e4);let f=setTimeout(()=>d.destroy(Error("Upstream HTTP/2 TLS connect timeout")),i.connectTimeoutMs+i.tlsHandshakeTimeoutMs);f.unref?.(),d.once("secureConnect",()=>{clearTimeout(f),"h2"!==d.alpnProtocol&&d.destroy(Error("Upstream did not negotiate HTTP/2"))}),d.once("error",()=>clearTimeout(f)),d.once("close",()=>clearTimeout(f));let j=`https://${b.host}${443===b.port?"":`:${b.port}`}`,k=e.connect(j,{createConnection:()=>d,settings:{enablePush:!1}});return A.add(k),k.setTimeout(i.idleTimeoutMs,()=>k.destroy(Error("Upstream HTTP/2 idle timeout"))),k.once("close",()=>A.delete(k)),await new Promise((a,b)=>{let c=setTimeout(()=>b(Error("Upstream HTTP/2 session timeout")),i.connectTimeoutMs+i.tlsHandshakeTimeoutMs);c.unref?.();let d=(a,b)=>{clearTimeout(c),k.removeListener("connect",e),k.removeListener("error",f),a(b)},e=()=>d(a,k),f=a=>d(b,a);k.once("connect",e),k.once("error",f)}),k})().catch(b=>{throw a.upstreamPromise=null,b})),a.upstreamPromise}async function V(a,b){let c=z.get(a.session),d=c?.target;if(!c||!d){a.respond({":status":502,"content-type":"text/plain"}),a.end("Audit target is missing");return}a.pause();let f=Date.now(),g=new I(i.captureBodies?i.captureLimitBytes:0),h=new I(i.captureBodies?i.captureLimitBytes:0),j={},k=null,l=!1,m=!1,n=null,o=null,p=null,q=(e=null)=>{l||(l=!0,G(H({requestHeaders:b,method:b[":method"]||"GET",path:b[":path"]||"/",target:d,requestCapture:g,responseCapture:h,responseHeaders:j,statusCode:k,startedAt:f,error:e,socket:a.session.socket,protocol:"h2",authUser:c.authUser||null})))};try{(n=(await U(c)).request(function(a,b){let c=F(a,{stripInternal:!0}),d={":method":a[":method"]||"GET",":path":a[":path"]||"/",":scheme":"https",":authority":443===b.port?b.host:`${b.host}:${b.port}`};for(let[a,b]of Object.entries(c))a.startsWith(":")||(d[a.toLowerCase()]=b);return d}(b,d),{endStream:!1,waitForTrailers:!0})).setTimeout(i.idleTimeoutMs,()=>n.close(e.constants.NGHTTP2_CANCEL)),a.setTimeout(i.idleTimeoutMs,()=>a.close(e.constants.NGHTTP2_CANCEL)),n.on("response",b=>{j=N(b),k=Number(b[":status"]||502),a.respond(function(a){let b=F(a,{stripInternal:!1}),c={":status":Number(a[":status"]||502)};for(let[a,d]of Object.entries(b))a.startsWith(":")||(c[a.toLowerCase()]=d);return c}(b),{waitForTrailers:!0})}),n.on("trailers",a=>{p=F(a,{stripInternal:!1})}),a.on("wantTrailers",()=>{try{a.sendTrailers(p||{})}catch{}}),a.on("trailers",a=>{o=F(a,{stripInternal:!0})}),n.on("wantTrailers",()=>{try{n.sendTrailers(o||{})}catch{}}),a.on("data",b=>{g.add(b),n.write(b)||a.pause()}),n.on("drain",()=>a.resume()),a.on("end",()=>n.end()),n.on("data",b=>{h.add(b),a.write(b)||n.pause()}),a.on("drain",()=>n.resume()),n.on("end",()=>{m=!0,a.end(),q(null)}),n.on("aborted",()=>{let b=Error("Upstream HTTP/2 stream aborted");a.close(e.constants.NGHTTP2_INTERNAL_ERROR),q(b)}),n.on("error",b=>{a.closed||a.close(e.constants.NGHTTP2_INTERNAL_ERROR),q(b)}),a.on("aborted",()=>{n.close(e.constants.NGHTTP2_CANCEL),q(Error("Client HTTP/2 stream aborted"))}),a.on("error",a=>{n.close(e.constants.NGHTTP2_CANCEL),q(a)}),a.on("close",()=>{m||!n||n.closed||(n.close(e.constants.NGHTTP2_CANCEL),q(Error("Client HTTP/2 stream closed")))}),a.resume()}catch(b){a.headersSent||a.closed||a.respond({":status":502,"content-type":"application/json"}),a.closed||a.end(JSON.stringify({error:"Verified upstream HTTP/2 request failed"})),q(b)}}T.on("checkContinue",(a,b)=>{S(a,b,{expectContinue:!0})}),T.on("upgrade",(a,b)=>{M(b,"501 Not Implemented",J),R(a,b,b.__auditTarget)}),T.on("clientError",(a,b)=>C(b)),T.headersTimeout=i.responseHeaderTimeoutMs,T.requestTimeout=0,T.keepAliveTimeout=i.idleTimeoutMs;let W=e.createServer({settings:{enablePush:!1}});W.on("session",a=>{let b={target:a.socket.__auditTarget,authUser:a.socket.__auditProxyUser||null,upstreamPromise:null};z.set(a,b),a.setTimeout(i.idleTimeoutMs,()=>a.destroy(Error("Client HTTP/2 idle timeout"))),a.once("close",()=>{Promise.resolve(b.upstreamPromise).then(a=>a?.close()).catch(()=>{})})}),W.on("stream",(a,b)=>{V(a,b)}),W.on("sessionError",a=>{console.warn("[audit-proxy] HTTP/2 client session error:",a?.message||a)});let X=d.createServer((a,b)=>{b.writeHead(403,{"content-type":"text/plain; charset=utf-8",connection:"close"}),b.end("Audit Proxy accepts HTTPS CONNECT traffic only")});function Y(){o=r(i.allowedClientTools),p=i.proxyAuthEnabled?u(i.proxyAuthUsers):null,w=i.proxyAuthEnabled?v():null,X.headersTimeout=i.responseHeaderTimeoutMs,X.keepAliveTimeout=i.idleTimeoutMs,T.headersTimeout=i.responseHeaderTimeoutMs,T.keepAliveTimeout=i.idleTimeoutMs,X.auditCapabilities={http1:!0,http2:i.clientAlpnProtocols.includes("h2"),proxyAuth:!0===i.proxyAuthEnabled,plainHttp:!1,publicConnectPorts:[...i.allowedConnectPorts]}}return X.on("connect",(a,b,c)=>{(async()=>{let d,e;try{d=D(a.url,443)}catch(e){let c=e.message||"Invalid CONNECT authority";M(b,"400 Bad Request",c),K(a,b,d,c,{statusCode:400});return}let f=await Q(a,b);if(f===P)return;try{await m(d.host,d.port)}catch(e){let c=e.message||"Destination is not allowed";M(b,"403 Forbidden",c),K(a,b,d,c,{authUser:f});return}if(i.clientToolFilterEnabled&&s(a.headers["user-agent"],o)){let c=`Client tool is not allowed to use this proxy (${t(a.headers["user-agent"])})`;M(b,"403 Forbidden",c),K(a,b,d,c);return}if(!E(d.host,i.allowedHosts)){if(!i.passthroughUnknown){let c="Host is not in the audit allowlist";M(b,"403 Forbidden",c),K(a,b,d,c);return}let e=!1;try{let a=await m(d.host,d.port),f=B(g.connect({host:d.host,port:d.port,lookup:a.lookup,autoSelectFamily:!0})),h=setTimeout(()=>f.destroy(Error("TCP passthrough connect timeout")),i.connectTimeoutMs);h.unref?.(),f.setNoDelay(!0),f.setKeepAlive(!0,3e4),f.setTimeout(i.idleTimeoutMs,()=>f.destroy(Error("TCP passthrough idle timeout"))),f.once("connect",()=>{clearTimeout(h),e=!0,b.write("HTTP/1.1 200 Connection Established\r\nProxy-Agent: BlueRouter-Audit\r\n\r\n"),c?.length&&f.write(c),f.pipe(b),b.pipe(f)}),f.once("error",()=>{clearTimeout(h),e?C(b):M(b,"502 Bad Gateway","TCP passthrough failed")}),b.once("error",()=>C(f)),b.once("close",()=>C(f))}catch(a){M(b,"502 Bad Gateway",a.message||"TCP passthrough failed")}return}try{if(e=j(d.host),!e?.key||!e?.cert)throw Error("Certificate provider returned no certificate")}catch(a){M(b,"500 Internal Server Error",`Cannot issue audit certificate: ${a.message}`);return}b.write("HTTP/1.1 200 Connection Established\r\nProxy-Agent: BlueRouter-Audit\r\n\r\n"),c?.length&&b.unshift(c);let k=B(new h.TLSSocket(b,{isServer:!0,key:e.key,cert:e.cert,ALPNProtocols:i.clientAlpnProtocols}));k.__auditTarget=d,k.__auditProxyUser=f,k.setNoDelay(!0),k.setKeepAlive(!0,3e4),k.setTimeout(i.idleTimeoutMs,()=>k.destroy(Error("Client TLS idle timeout")));let l=setTimeout(()=>k.destroy(Error("Client TLS handshake timeout")),i.tlsHandshakeTimeoutMs);l.unref?.();let n=!1,p=()=>{n||(n=!0,clearTimeout(l),"h2"===k.alpnProtocol?W.emit("connection",k):T.emit("connection",k))};k.once("secure",p),k.once("secureConnect",p),k.once("error",()=>{clearTimeout(l),C(k)}),k.once("close",()=>clearTimeout(l))})().catch(a=>M(b,"500 Internal Server Error",a.message||"Audit CONNECT failed"))}),X.prependListener("connection",a=>{B(a),a.setNoDelay(!0),a.setKeepAlive(!0,3e4)}),X.on("upgrade",(a,b)=>M(b,"501 Not Implemented",J)),X.on("clientError",(a,b)=>C(b)),X.headersTimeout=i.responseHeaderTimeoutMs,X.requestTimeout=0,X.keepAliveTimeout=i.idleTimeoutMs,X.forceCloseAll=()=>{for(let a of A)try{a.destroy()}catch{}for(let a of y.values())try{a.destroy()}catch{}for(let a of[...x])C(a)},X.getActiveConnectionCount=()=>x.size,X.auditConfig=i,Y(),X.applyConfig=(a={})=>{let b={};for(let[c,d]of(a.bindHost&&String(a.bindHost)!==String(i.bindHost)&&(b.bindHost=String(a.bindHost)),Number(a.port)&&Number(a.port)!==Number(i.port)&&(b.port=Number(a.port)),Object.entries(a)))"bindHost"!==c&&"port"!==c&&(["verifyUpstreamTls","allowPlainHttp","allowedConnectPorts","clientAlpnProtocols"].includes(c)||(i[c]=d));return Y(),{rebindRequired:Object.keys(b).length>0,pending:b}},X},hostMatches:E,parseAuthority:D,stripHopByHop:F,CaptureBuffer:I,detectProvider:J,extractModel:K,decodeCapturedBuffer:G}},48350:a=>{let b=new Set(["authorization","proxy-authorization","x-api-key","api-key","cookie","set-cookie","x-auth-token","x-access-token","cf-access-jwt-assertion"]),c=/(^|[_-])(access[_-]?token|refresh[_-]?token|id[_-]?token|token|api[_-]?key|apikey|password|passwd|secret|authorization|cookie)($|[_-])/i;function d(a){let c=String(a||"").toLowerCase();return b.has(c)||/token|secret|password|credential/i.test(c)}function e(a,b=new WeakSet){if(null==a||"object"!=typeof a)return a;if(b.has(a))return"[CIRCULAR]";if(b.add(a),Array.isArray(a))return a.map(a=>e(a,b));let d={};for(let[f,g]of Object.entries(a))d[f]=c.test(f)?"[REDACTED]":e(g,b);return d}function f(a){if(null==a)return a;let b=String(a);return(b=(b=b.replace(/\bBearer\s+[A-Za-z0-9._~+\/-]+=*/gi,"Bearer [REDACTED]")).replace(/\b(sk-ant-[A-Za-z0-9_-]{8,}|sk-[A-Za-z0-9_-]{8,})\b/g,"[REDACTED]")).replace(/("(?:access_token|refresh_token|id_token|api_key|apikey|password|secret|authorization)"\s*:\s*")([^"]+)(")/gi,"$1[REDACTED]$3")}a.exports={redactHeaders:function(a={}){let b={};for(let[c,e]of Object.entries(a||{}))b[c]=d(c)?"[REDACTED]":e;return b},redactObject:e,redactBodyText:function(a,b=""){let c=String(a||"");if(/application\/(?:[^;]+\+)?json/i.test(b)||/^[\s\r\n]*[\[{]/.test(c))try{let a=JSON.parse(c);return JSON.stringify(e(a))}catch{}return f(c)},scrubString:f,redactUrlPath:function(a){let b=String(a||"");try{let a=new URL(b,"https://audit.invalid");for(let b of[...a.searchParams.keys()])if(/token|secret|key|password|credential|authorization|^code$/i.test(b))a.searchParams.set(b,"[REDACTED]");else{let c=a.searchParams.get(b);c&&a.searchParams.set(b,f(c))}return`${a.pathname}${a.search}`}catch{return f(b)}},containsLikelySecret:function(a){let b="string"==typeof a?a:JSON.stringify(a);return/Bearer\s+(?!\[REDACTED\])\S+|sk-ant-[A-Za-z0-9_-]{8,}|\bsk-[A-Za-z0-9_-]{8,}/i.test(b||"")},shouldRedactHeader:d}},49083:(a,b,c)=>{let{createAuditProxy:d}=c(45372),{loadConfig:e,saveConfig:f,validateConfig:g,CONFIG_PATH:h,AUDIT_LOG_PATH:i,AUDIT_LOG_DIR:j,PROXY_AUTH_FEATURE_ENABLED:k}=c(43096),{hashProxyPassword:l,isValidUsername:m,normalizeProxyUsers:n,redactProxyAuthUsers:o,PASSWORD_MAX_BYTES:p,PASSWORD_MIN_BYTES:q}=c(7566),{normalizeIp:r}=c(5565),{attachClientIpGate:s,effectiveClientIpPolicy:t,normalizeAccessGrants:u,normalizeGrantUserId:v}=c(77407),{getProxySession:w,pruneExpiredProxySessions:x,revokeProxySession:y,revokeProxySessionsForUser:z}=c(68257),{SETTINGS_KEY:A,extractAuditPolicy:B,mergeAuditPolicy:C,policyEquals:D}=c(85463),{enqueueAuditJob:E,readRecent:F,clearAudit:G,pruneExpired:H,startAuditMaintenance:I,stopAuditMaintenance:J,flushAuditQueue:K,registerAuditShutdownFlush:L,unregisterAuditShutdownFlush:M,getAuditStoreStats:N}=c(90173),{ensureAuditRootCA:O,createAuditCertificateProvider:P,getStatusRootCaValidation:Q}=c(85074),{readRootCAInfo:R}=c(2466),{runSelfTest:S}=c(85252);function T(){return globalThis.__blueRouterAuditProxyRuntime||(globalThis.__blueRouterAuditProxyRuntime={server:null,certificateProvider:null,ipPolicy:null,ipGate:null,startedAt:null,lastError:null,autostartPromise:null,autostartRetryTimer:null,lifecycle:Promise.resolve()}),globalThis.__blueRouterAuditProxyRuntime}function U(a){let b=T(),c=b.lifecycle.then(a,a);return b.lifecycle=c.catch(()=>{}),c}async function V(a,b=1500){if(!a)return;let c=Math.max(0,Number(b)||0);await new Promise(b=>{let d=!1,e=()=>{d||(d=!0,b())};try{a.listening?a.close(e):e()}catch{e()}let f=setTimeout(()=>{try{a.forceCloseAll?.()}catch{}},c);f.unref?.();let g=setTimeout(e,c+2e3);g.unref?.()});try{a.forceCloseAll?.()}catch{}}function W(a){let b=e();return{...a,proxyAuthEnabled:!0===b.proxyAuthEnabled,proxyAuthUsers:[...b.proxyAuthUsers||[]],accessGrants:u(b.accessGrants)}}let X=null;function Y(){let a=x();if(0===a)return;let b=T();if(!b.server?.listening)return;let c=b.ipGate?.dropRevoked()||0;console.log(`[audit-proxy] session sweep: ${a} session(s) expired, ${c} connection(s) closed`)}async function Z(a=null){let b=T();if(b.server?.listening)return ag();let c=a?f({...W(a),enabled:!1}):e();await O(),await H(),I(),X||(X=setInterval(Y,3e4),X.unref?.()),L();let g=P({maxEntries:128});g.prewarm(c.allowedHosts);let h=d(c,{certificateProvider:g,onAuditJob:E});b.ipPolicy=t(c),b.ipGate=s(h,()=>T().ipPolicy);try{let a=await new Promise((a,b)=>{let d=a=>{h.removeListener("listening",e),b(a?.code==="EADDRNOTAVAIL"?Error(`Cannot bind ${c.bindHost}:${c.port} - that address does not exist on this machine. In Docker the container cannot bind the host's LAN IP: set the bind address to 0.0.0.0 and let the published port (-p 3128:3128) expose it on the host.`,{cause:a}):a?.code==="EACCES"?Error(`Cannot bind ${c.bindHost}:${c.port} - permission denied. Ports below 1024 need extra privileges; pick a high port such as 3128.`,{cause:a}):a)},e=()=>{h.removeListener("error",d),a(h.address())};h.once("error",d),h.once("listening",e),h.listen(c.port,c.bindHost)});return b.server=h,b.certificateProvider=g,b.startedAt=new Date().toISOString(),b.lastError=null,ae(),f({...c,enabled:!0}),{...await ag(),address:a}}catch(a){b.lastError=a.message||String(a);try{h.forceCloseAll?.()}catch{}try{h.close()}catch{}throw g.clear?.(),a}}async function $({persist:a=!0}={}){let b=T();ae();let c=b.server,d=e();if(b.server=null,b.startedAt=null,await V(c,d.shutdownGraceMs),b.certificateProvider?.clear?.(),b.certificateProvider=null,b.ipGate=null,!await K(3e3)){let a=N();console.warn(`[audit-proxy] audit queue did not drain within 3000ms; ${a.queueDepth} event(s) still queued`)}return M(),J(),X&&clearInterval(X),X=null,a&&f({...d,enabled:!1}),ag()}async function _(a=null){return await $({persist:!1}),a&&f({...W(a),enabled:!1}),Z()}function aa(a=null){return U(()=>Z(a))}let ab=new Set(["1","true","yes","on"]),ac=[2e3,5e3,15e3,3e4,6e4];function ad(a){return a?.code==="EADDRINUSE"||a?.cause?.code==="EADDRINUSE"}function ae(){let a=T();a.autostartRetryTimer&&(clearTimeout(a.autostartRetryTimer),a.autostartRetryTimer=null)}async function af(){let a,b=T();await am();let c=e(),d=null!=(a=process.env.AUDIT_PROXY_ENABLED)&&""!==a&&ab.has(String(a).trim().toLowerCase());return c.enabled||d?b.server?.listening?{started:!1,reason:"already-running",status:await ag()}:(d&&!c.enabled&&console.log("[audit-proxy] starting because AUDIT_PROXY_ENABLED is set, despite stored enabled=false"),b.autostartPromise||(b.autostartPromise=(async()=>{try{let a=await aa();return console.log(`[audit-proxy] autostarted on ${c.bindHost}:${c.port}`),{started:!0,status:a}}catch(c){b.lastError=c?.message||String(c),console.log("[audit-proxy] autostart failed:",b.lastError);let a=ad(c);return a&&function a(b){let c=T(),d=ac[b-1];d?c.autostartRetryTimer||(c.autostartRetryTimer=setTimeout(async()=>{if((c.autostartRetryTimer=null,!c.server?.listening)&&e().enabled)try{await aa(),console.log(`[audit-proxy] autostart succeeded on retry ${b}`)}catch(d){c.lastError=d?.message||String(d),console.log(`[audit-proxy] autostart retry ${b} failed:`,c.lastError),ad(d)&&a(b+1)}},d),c.autostartRetryTimer.unref?.()):console.warn(`[audit-proxy] autostart still failing after ${ac.length} retries; start it from the dashboard once the cause is cleared`)}(1),{started:!1,error:b.lastError,retrying:a}}finally{b.autostartPromise=null}})()),b.autostartPromise):{started:!1,reason:"disabled"}}async function ag(){let a=T(),b=e(),c=t(b),d=!!a.server?.listening,f=R();try{let a=Q();f={...f,validated:!0===a.exists,expiringSoon:!0===a.expiringSoon,autoRotation:!1}}catch(a){f={...f,validated:!1,autoRotation:!1,error:a.message||String(a)}}return{running:d,listening:d,startedAt:a.startedAt,lastError:a.lastError,address:d?a.server.address():null,pendingListenerRestart:d&&!function(a,b){if(!a)return!0;let c=String(b.bindHost||"").trim().toLowerCase(),d=r(a.address||""),e=r("localhost"===c?"127.0.0.1":c);return Number(a.port)===Number(b.port)&&d===e}(a.server.address(),b),activeConnections:d&&a.server.getActiveConnectionCount?.()||0,capabilities:d?a.server.auditCapabilities:{http1:!0,http2:!1,plainHttp:!1,publicConnectPorts:[443]},security:{clientIpFilterEnabled:c.enabled,clientIpFilterSource:c.source,enforcedClientIpCount:c.allowedClientIps.length,accessGrantCount:c.grants.length,sessionIdleTimeoutMs:b.sessionIdleTimeoutMs,activeSessionCount:c.sessions.length,clientToolFilterEnabled:!0===b.clientToolFilterEnabled,proxyAuthEnabled:!0===b.proxyAuthEnabled,proxyAuthFeatureEnabled:k,allowedClientToolCount:(b.allowedClientTools||[]).length,privateDestinationsBlocked:!0,plainHttpBlocked:!0,upstreamTlsVerified:!0},activeSessions:c.sessions.map(a=>({ip:a.ip,userId:a.userId,displayName:a.displayName,activatedAt:new Date(a.activatedAt).toISOString(),expiresAt:new Date(a.expiresAt).toISOString()})),certificateCache:a.certificateProvider?.stats?.()||{entries:0},auditStore:N(),configPath:h,auditLogPath:i,auditLogDirectory:j,rootCA:f}}async function ah(a=50,{includeEvents:b=!0}={}){let c=e(),[d,f]=await Promise.all([ag(),b?F(a):[]]);return{config:ai(c),status:d,events:f}}function ai(a){return a?{...a,proxyAuthUsers:o(a.proxyAuthUsers)}:a}async function aj(){return Promise.resolve().then(c.bind(c,89718))}async function ak(){try{let{isClusterStandby:a}=await c.e(2763).then(c.bind(c,62763));return await a()===!0}catch{return!1}}async function al(a){try{if(await ak())return{mirrored:!1,reason:"standby"};let{getSettings:b,updateSettings:c}=await aj(),d=B(a),e=await b();if(JSON.stringify(e?.[A]||null)===JSON.stringify(d))return{mirrored:!1,reason:"unchanged"};return await c({[A]:d}),{mirrored:!0}}catch(a){return console.warn("[audit-proxy] failed to mirror policy to settings:",a?.message||a),{mirrored:!1,error:a?.message||String(a)}}}async function am({force:a=!1}={}){try{if(!a&&!await ak())return{applied:!1,reason:"not-standby"};let{getSettings:b}=await aj(),c=await b(),d=c?.[A];if(!d||"object"!=typeof d)return{applied:!1,reason:"no-policy"};let f=e();if(D(f,d))return{applied:!1,reason:"unchanged"};let g=C(f,d),h=await an(g,{mirror:!1});return console.log("[audit-proxy] applied cluster policy from snapshot"),{applied:!0,restarted:!0===h.restarted,droppedConnections:h.droppedConnections||0}}catch(a){return console.warn("[audit-proxy] failed to apply cluster policy:",a?.message||a),{applied:!1,error:a?.message||String(a)}}}function an(a,{mirror:b=!0}={}){return U(async()=>{let c=T(),d=!!c.server?.listening,e=f({...g(a),enabled:d});c.ipPolicy=t(e);let h=!1,i={},j=0;if(d){let a=c.server.applyConfig?.(e)||{};h=!0===a.rebindRequired,i=a.pending||{},j=c.ipGate?.dropRevoked()||0;try{c.certificateProvider?.prewarm?.(e.allowedHosts)}catch{}}return b&&await al(e),{config:ai(e),status:await ag(),restarted:!1,appliedInstantly:!0,rebindRequired:h,pendingListener:i,droppedConnections:j}})}a.exports={startProxy:aa,ensureAuditProxyAutostart:af,stopProxy:function(a={}){return U(()=>$(a))},restartProxy:function(a=null){return U(()=>_(a))},getStatus:ag,getSnapshot:ah,readRecentAuditEvents:F,updateConfig:function(a){return an(W(a))},updateClientProxyHost:function(a){return an({...e(),clientProxyHost:String(a||"").trim()})},updateProxyAuth:async function a({enabled:b,users:c}={}){if(!0===b&&!k)throw Error("Proxy authentication is turned off in this deployment (PROXY_AUTH_FEATURE_ENABLED in audit-gateway/config.js)");let d=e(),f=new Map(n(d.proxyAuthUsers).map(a=>[a.username.toLowerCase(),a])),g=new Set,h=[];for(let a of Array.isArray(c)?c:[]){let b=String(a?.username||"").trim();if(!m(b))throw Error(`Invalid username: ${b||"(empty)"}`);let c=b.toLowerCase();if(g.has(c))throw Error(`Duplicate username: ${b}`);g.add(c);let d="string"==typeof a?.password?a.password:"";if(d){let a=Buffer.byteLength(d,"utf8");if(a<q)throw Error(`Password for ${b} must be at least ${q} characters`);if(a>p)throw Error(`Password for ${b} must be at most ${p} bytes`);h.push({username:b,passwordHash:await l(d)});continue}let e=f.get(c);if(!e)throw Error(`Account ${b} requires a password`);h.push({username:b,passwordHash:e.passwordHash})}return an({...d,proxyAuthEnabled:!0===b,proxyAuthUsers:h})},listAccessGrants:function(){return u(e().accessGrants)},applyAuditPolicyFromSettings:am,upsertAccessGrant:function({userId:a,note:b}={}){let c=v(a);if(!c)throw Error("Grant requires a dashboard username or email");let d=e(),f=u(d.accessGrants).filter(a=>a.userId!==c);return f.push({userId:c,note:b}),an({...d,accessGrants:f})},deleteAccessGrant:function(a){let b=v(a);if(!b)throw Error("Grant requires a dashboard username or email");let c=e(),d=u(c.accessGrants).filter(a=>a.userId!==b);return z(b),an({...c,accessGrants:d})},getOwnProxySession:function(a){return w(a)},revokeSession:function({ip:a,userId:b}={}){let c=a?+!!y(a):z(b);if(0===c)return{removed:0,droppedConnections:0};let d=T();return d.server?.listening?{removed:c,droppedConnections:d.ipGate?.dropRevoked()||0}:{removed:c,droppedConnections:0}},clearAudit:G,runSelfTest:S}},78864:(a,b,c)=>{let d=c(14985).promises,e=c(91645),{normalizeIp:f,clientIpMatches:g}=c(5565),h=new Map,i=Object.freeze(["0.0.0.0/8","10.0.0.0/8","100.64.0.0/10","127.0.0.0/8","169.254.0.0/16","172.16.0.0/12","192.0.0.0/24","192.0.2.0/24","192.88.99.0/24","192.168.0.0/16","198.18.0.0/15","198.51.100.0/24","203.0.113.0/24","224.0.0.0/4","240.0.0.0/4","::/96","::1/128","100::/64","2001:2::/48","2001:db8::/32","fc00::/7","fe80::/10","ff00::/8"]),j=Object.freeze([".localhost",".local",".internal",".lan",".home.arpa"]);function k(a){return String(a||"").trim().replace(/^\[|\]$/g,"").replace(/\.$/,"").toLowerCase()}function l(a){let b=k(a);return!(!(!b||"localhost"===b||j.some(a=>b.endsWith(a)))&&(e.isIP(b)||b.includes(".")))}function m(a){let b=f(a);return!!e.isIP(b)&&!g(b,i)}function n(a){let b=[...new Set((Array.isArray(a)?a:[a]).map(a=>Number(a)).filter(a=>Number.isInteger(a)&&a>=1&&a<=65535))];return b.length?b:[443]}function o(a){let b=[...a?.addresses||[]];return function(c,d,e){let f=d,g=e;"function"==typeof d&&(g=d,f={});let h="number"==typeof f?f:Number(f?.family||0);if("object"==typeof f&&f?.all===!0){let c=4===h||6===h?b.filter(a=>a.family===h):b;if(!c.length){let b=Error(`No validated public address for ${a.host}`);b.code="ENOTFOUND",g(b);return}g(null,c.map(({address:a,family:b})=>({address:a,family:b})));return}let i=function(a,b=0){let c=Number(b||0);return 4===c||6===c?a.find(a=>a.family===c)||null:a.find(a=>4===a.family)||a[0]||null}(b,h);if(!i){let b=Error(`No validated public address for ${a.host}`);b.code="ENOTFOUND",g(b);return}g(null,i.address,i.family)}}async function p(a,b,c={}){let g=k(a),i=Number(b||443),j=n(c.allowedPorts||[443]);if(!g)throw Error("Destination host is empty");if(!Number.isInteger(i)||!j.includes(i))throw Error(`CONNECT destination port ${i||"unknown"} is not allowed`);if(l(g))throw Error(`Private or local destination hostname is not allowed: ${g}`);let q=e.isIP(f(g));if(q){let a=f(g);if(!m(a))throw Error(`Private or reserved destination address is not allowed: ${a}`);let b={host:g,port:i,addresses:[{address:a,family:q}]};return{...b,lookup:o(b)}}let r=Date.now(),s=h.get(g);if(!s||s.expiresAt<=r){let a=await d.lookup(g,{all:!0,verbatim:!0}),b=[],c=new Set;for(let d of a||[]){let a=f(d.address),g=e.isIP(a);if(!g||!m(a))continue;let h=`${g}:${a}`;c.has(h)||(c.add(h),b.push({address:a,family:g}))}if(!b.length)throw Error(`Destination did not resolve to a public address: ${g}`);s={addresses:b,expiresAt:r+6e4},h.set(g,s)}let t={host:g,port:i,addresses:[...s.addresses]};return{...t,lookup:o(t)}}a.exports={BLOCKED_ADDRESS_RANGES:i,normalizeTargetHost:k,normalizeAllowedPorts:n,isBlockedHostname:l,isPublicAddress:m,createPinnedLookup:o,resolvePublicTarget:p,clearDnsPolicyCache:function(){h.clear()}}},85252:(a,b,c)=>{let d=c(81630),e=c(73496),f=c(91645),g=c(34631),h=c(74075),i=c(55511),j=c(15296),{createAuditProxy:k,CaptureBuffer:l}=c(45372),{containsLikelySecret:m}=c(48350),{clientIpMatches:n,normalizeAllowedClientIps:o}=c(5565),{normalizeAllowedTools:p,clientToolMatches:q,shouldRefuseClientTool:r}=c(98586),{createProxyAuthenticator:s,createProxyAuthLimiter:t,hashProxyPassword:u,parseBasicProxyAuthorization:v}=c(7566),{isPublicAddress:w}=c(78864),{validateConfig:x,PROXY_AUTH_FEATURE_ENABLED:y}=c(43096),{normalizeAccessGrants:z,effectiveClientIpPolicy:A,attachClientIpGate:B,findAccessGrant:C}=c(77407),{activateProxySession:D,touchProxySession:E,getProxySession:F,revokeProxySession:G,clearAllProxySessions:H}=c(68257),{promptLogMirrorDecision:I}=c(90173);function J(a){return i.createHash("sha256").update(a).digest("hex")}function K(a){let b=j.pki.rsa.generateKeyPair(2048),c=j.pki.createCertificate();c.publicKey=b.publicKey,c.serialNumber=String(Date.now()),c.validity.notBefore=new Date(Date.now()-6e4),c.validity.notAfter=new Date(Date.now()+864e5);let d=[{name:"commonName",value:a}];return c.setSubject(d),c.setIssuer(d),c.setExtensions([{name:"basicConstraints",cA:!0,critical:!0},{name:"keyUsage",keyCertSign:!0,cRLSign:!0,critical:!0}]),c.sign(b.privateKey,j.md.sha256.create()),{cert:c,keys:b,certPem:j.pki.certificateToPem(c)}}function L(a,b){let c=j.pki.rsa.generateKeyPair(2048),d=j.pki.createCertificate();return d.publicKey=c.publicKey,d.serialNumber=`${Date.now()}${Math.floor(1e3*Math.random())}`,d.validity.notBefore=new Date(Date.now()-6e4),d.validity.notAfter=new Date(Date.now()+864e5),d.setSubject([{name:"commonName",value:b}]),d.setIssuer(a.cert.subject.attributes),d.setExtensions([{name:"basicConstraints",cA:!1},{name:"keyUsage",digitalSignature:!0,keyEncipherment:!0},{name:"extKeyUsage",serverAuth:!0},{name:"subjectAltName",altNames:[{type:2,value:b}]}]),d.sign(a.keys.privateKey,j.md.sha256.create()),{cert:j.pki.certificateToPem(d),key:j.pki.privateKeyToPem(c.privateKey)}}function M(a,b="127.0.0.1"){return new Promise((c,d)=>{a.once("error",d),a.listen(0,b,()=>{a.removeListener("error",d),c(a.address())})})}function N(a){return new Promise(b=>{if(!a)return b();try{a.forceCloseAll?.()}catch{}if(!a.listening)return b();a.close(()=>b()),setTimeout(b,1e3).unref?.()})}function O(a,b){let c="127.0.0.1";return Promise.resolve({host:a,port:b,addresses:[{address:c,family:4}],lookup:(a,b,d)=>{let e=b,f=d;"function"==typeof b&&(f=b,e={}),e?.all?f(null,[{address:c,family:4}]):f(null,c,4)}})}function P(a,b,c="",d=""){return new Promise((e,g)=>{let h=f.connect(a,"127.0.0.1"),i=Buffer.alloc(0),j=setTimeout(()=>g(Error("CONNECT timeout")),7e3);h.once("error",g),h.once("connect",()=>{let a=c?`User-Agent: ${c}\r
+${e}`)}catch{try{a.destroy()}catch{}}}function R(a={}){let b={};for(let[c,d]of Object.entries(a||{}))b[c]=d;return b}async function S(a){let b=await a.requestCapture.finish(String(a.requestHeaders["content-type"]||""),String(a.requestHeaders["content-encoding"]||"")),c=String(a.responseHeaders?.["content-type"]||""),d=await a.responseCapture.finish(c,String(a.responseHeaders?.["content-encoding"]||"")),e=M(a.target.host),f=n(a.path),g=p({provider:e,body:d.body,contentType:c,path:f}),h=O(b.body)||g?.model||null;return{id:i.randomUUID(),timestamp:new Date().toISOString(),protocol:a.protocol||"http/1.1",client:{ip:a.clientIp||"",port:a.clientPort||null,userAgent:String(a.requestHeaders["user-agent"]||""),proxyUser:a.authUser||null},provider:e,host:F(a.target.host),port:a.target.port,method:a.method,path:f,model:h,usage:g,status:a.statusCode||null,durationMs:Date.now()-a.startedAt,error:a.error?o(a.error.message||a.error):null,denied:!0===a.denied,request:{headers:l(a.requestHeaders),...b},response:{headers:l(a.responseHeaders||{}),...d}}}a.exports={createAuditProxy:function(a={},b={}){let i={allowedHosts:[],passthroughUnknown:!0,captureBodies:!0,captureLimitBytes:2097152,verifyUpstreamTls:!0,allowedConnectPorts:[443],connectTimeoutMs:1e4,tlsHandshakeTimeoutMs:1e4,responseHeaderTimeoutMs:3e4,idleTimeoutMs:9e5,allowPlainHttp:!1,clientToolFilterEnabled:!1,allowedClientTools:[],proxyAuthEnabled:!1,proxyAuthUsers:[],clientAlpnProtocols:["http/1.1"],...a};if(!0!==i.verifyUpstreamTls)throw Error("Upstream TLS verification is mandatory in Audit Proxy mode");let j=b.certificateProvider;if("function"!=typeof j)throw Error("certificateProvider is required");let k="function"==typeof b.onAudit?b.onAudit:()=>{},l="function"==typeof b.onAuditJob?b.onAuditJob:null,m="function"==typeof b.resolveTarget?b.resolveTarget:(a,b)=>q(a,b,{allowedPorts:i.allowedConnectPorts}),n=b.upstreamCa,o=r(i.allowedClientTools),p=i.proxyAuthEnabled?x(i.proxyAuthUsers):null,z=i.proxyAuthEnabled?y():null,A=new Set,B=new Map,C=new WeakMap,D=new Set;function E(a){return!a||A.has(a)||(A.add(a),a.once?.("close",()=>A.delete(a))),a}function F(a,b){try{"function"==typeof a.destroy?a.destroy(b):"function"==typeof a.close&&a.close()}catch{}}function K(a){let b=()=>S(a);if(l){try{l(b)}catch(a){console.warn("[audit-proxy] audit enqueue failed:",a?.message||a)}return}setImmediate(()=>{Promise.resolve().then(b).then(k).catch(a=>console.warn("[audit-proxy] audit callback failed:",a?.message||a))})}function M({requestHeaders:a,method:b,path:c,target:d,requestCapture:e,responseCapture:f,responseHeaders:g,statusCode:h,startedAt:i,error:j,socket:k,protocol:l,authUser:m=null,denied:n=!1}){return{requestHeaders:R(a),method:b,path:c,target:d,requestCapture:e,responseCapture:f,responseHeaders:R(g),statusCode:h,startedAt:i,error:j,clientIp:P(k),clientPort:k?.remotePort||null,authUser:m,protocol:l,denied:n}}let O="This proxy does not support WebSocket connections. Use the HTTP streaming transport instead - most clients fall back to it automatically.";function T(a,b,c,d,{statusCode:e=403,authUser:f=null}={}){let g=String(a.url||""),h=c||{host:g.includes(":")?g.slice(0,g.lastIndexOf(":")):g||"unknown",port:443},j=new L(i.captureBodies?i.captureLimitBytes:0);j.add(Buffer.from(d)),K(M({requestHeaders:a.headers,method:"CONNECT",path:"",target:h,requestCapture:new L(0),responseCapture:j,responseHeaders:{"content-type":"text/plain; charset=utf-8",connection:"close"},statusCode:e,startedAt:Date.now(),error:d,socket:b,protocol:"http/1.1",authUser:f,denied:!0}))}let U=Symbol("refused");async function V(a,b){if(!p)return null;let d=P(b),e=(c,d=null)=>(Q(b,"407 Proxy Authentication Required",c,['Proxy-Authenticate: Basic realm="BlueRouter Audit Proxy", charset="UTF-8"']),T(a,b,void 0,c,{statusCode:407,authUser:d}),U);if(z.isLocked(d))return e("Too many failed proxy authentication attempts");let f=a.headers["proxy-authorization"],g=await p.authenticate(f);if(g.ok)return z.recordSuccess(d),g.username;let h=null;if(f){let{lockedNow:a}=z.recordFailure(d);a&&console.log(`[audit-proxy] proxy auth lockout for ${d||"unknown"}`);try{h=c(7566).parseBasicProxyAuthorization(f)?.username||null}catch{h=null}}return e(g.reason||"Proxy authentication required",h)}function W(a,b,c){if(!c)return;let d=new L(i.captureBodies?i.captureLimitBytes:0);d.add(Buffer.from(O)),K(M({requestHeaders:a.headers,method:a.method,path:a.url,target:c,requestCapture:new L(0),responseCapture:d,responseHeaders:{"content-type":"text/plain; charset=utf-8",connection:"close"},statusCode:501,startedAt:Date.now(),error:null,socket:b,protocol:"http/1.1",authUser:b?.__auditProxyUser||null,denied:!0}))}async function X(a,b,{expectContinue:c=!1}={}){let d=a.socket.__auditTarget,e=a.socket.__auditProxyUser||null;if(!d){b.writeHead(502,{"content-type":"text/plain"}),b.end("Audit target is missing");return}if(function(a={}){return"string"==typeof a.upgrade&&""!==a.upgrade.trim()}(a.headers)){b.writeHead(501,{"content-type":"text/plain; charset=utf-8",connection:"close"}),b.end(O),W(a,a.socket,d);return}let h=Date.now(),j=new L(i.captureBodies?i.captureLimitBytes:0),k=new L(i.captureBodies?i.captureLimitBytes:0),l=i.dlpEnabled?u(i,{groups:a.socket.__auditDlpGroups||[],host:d.host,userAgent:a.headers["user-agent"],method:a.method,path:a.url}):null,o=I(a.headers,{stripInternal:!0});o.host=443===d.port?d.host:`${d.host}:${d.port}`;let p=null,q=null,r={},s=null,t=!1,x=!1,y=null,z=!1,A=(b=null,{denied:c=!1,statusOverride:f=null}={})=>{t||(t=!0,y&&clearTimeout(y),K(M({requestHeaders:a.headers,method:a.method,path:a.url,target:d,requestCapture:j,responseCapture:k,responseHeaders:r,statusCode:f??s,startedAt:h,error:b,socket:a.socket,protocol:"http/1.1",authUser:e,denied:c})))},C=(c,e)=>{if(z||x)return;z=!0;let f=e?`${c}: ${e}`:c;k.add(Buffer.from(f)),b.headersSent?b.destroyed||b.destroy(Error(f)):N(b,d.host,f),x=!0,F(p,Error(f)),a.destroy(),A(null,{denied:!0,statusOverride:403})};if(l?.action==="deny"){let a=`Blocked by content policy "${l.reason}"`;k.add(Buffer.from(a)),N(b,d.host,a),x=!0,A(null,{denied:!0,statusOverride:403});return}let D=!!l&&w(l,a.method,a.headers);try{let e,h,t=await m(d.host,d.port);(p=f.request({hostname:d.host,port:d.port,method:a.method,path:a.url,headers:o,rejectUnauthorized:!0,servername:g.isIP(d.host)?void 0:d.host,ca:n,ALPNProtocols:["http/1.1"],lookup:t.lookup,autoSelectFamily:!0,agent:(e=`${d.host}:${d.port}`,(h=B.get(e))||(h=new f.Agent({keepAlive:!0,maxSockets:32,maxFreeSockets:8,timeout:i.idleTimeoutMs}),B.set(e,h)),h)})).on("socket",a=>{if(E(a),a.setNoDelay(!0),a.setKeepAlive(!0,3e4),a.setTimeout(i.idleTimeoutMs,()=>a.destroy(Error("Upstream idle timeout"))),a.connecting){let b=setTimeout(()=>a.destroy(Error("Upstream TLS connect timeout")),i.connectTimeoutMs+i.tlsHandshakeTimeoutMs);b.unref?.();let c=()=>clearTimeout(b);a.once("secureConnect",c),a.once("error",c),a.once("close",c)}}),p.on("continue",()=>{c&&!b.headersSent&&b.writeContinue()}),p.on("information",a=>{102===a.statusCode&&"function"==typeof b.writeProcessing&&b.writeProcessing(),103===a.statusCode&&"function"==typeof b.writeEarlyHints&&b.writeEarlyHints(a.headers||{})}),p.on("response",a=>{q=a,y&&clearTimeout(y),s=a.statusCode||502,r=R(a.headers||{});let c=I(a.headers,{stripInternal:!1});b.writeHead(s,c),b.flushHeaders?.(),a.on("data",c=>{k.add(c),b.write(c)||a.pause()}),b.on("drain",()=>a.resume()),a.on("aborted",()=>{let a=Error("Upstream response aborted");b.destroyed||b.destroy(a),A(a)}),a.on("error",a=>{b.destroyed||b.destroy(a),A(a)}),a.on("end",()=>{if(a.trailers&&Object.keys(a.trailers).length)try{b.addTrailers(I(a.trailers,{stripInternal:!1}))}catch{}x=!0,b.end(),A(null)})}),p.on("error",a=>{z||(b.headersSent?b.destroyed||b.destroy(a):(b.writeHead(502,{"content-type":"application/json"}),b.end(JSON.stringify({error:"Verified upstream TLS request failed"})),x=!0),A(a))});let u=()=>{if(a.trailers&&Object.keys(a.trailers).length)try{p.addTrailers(I(a.trailers,{stripInternal:!0}))}catch{}p.end(),y=setTimeout(()=>p.destroy(Error("Upstream response header timeout")),i.responseHeaderTimeoutMs),y.unref?.()};if(D){let b=[],c=0,d=!1;a.on("data",a=>{if(j.add(a),!d&&!z){if((c+=a.length)>i.dlpMaxInspectBytes){d=!0,b.length=0;return}b.push(a)}}),a.on("end",async()=>{try{if(z)return;if(d){if("allow"!==i.dlpOversizeAction)return void C("Request is too large to inspect and your content policy blocks uninspected uploads",`over ${i.dlpMaxInspectBytes} bytes`);u();return}let c=Buffer.concat(b),e=null;try{let b=a.headers["content-encoding"],d=b?(await J(c,b,8*i.dlpMaxInspectBytes)).buffer:c;e=v(JSON.parse(d.toString("utf8")),l.profile)}catch{e=null}if(!e||e.budgetExceeded){if("allow"!==i.dlpOversizeAction)return void C("Request could not be inspected and your content policy blocks uninspected uploads",e?.budgetExceeded?"too complex to inspect":"unreadable body")}else if(e.violations.length){let a=e.violations[0],b=e.violations.length>1?` (+${e.violations.length-1} more)`:"";C(`Blocked by content policy "${l.reason}"`,`${a.message}${b}`);return}c.length&&p.write(c),u()}catch(a){C("Content inspection failed",a?.message||String(a))}})}else a.on("data",b=>{j.add(b),p.write(b)||a.pause()}),p.on("drain",()=>a.resume()),a.on("end",u);a.on("aborted",()=>p.destroy(Error("Client request aborted"))),a.on("error",a=>p.destroy(a)),b.on("close",()=>{x||z||(q?.destroy(Error("Client response closed")),p?.destroy(Error("Client response closed")),A(Error("Client response closed")))})}catch(a){b.headersSent||(b.writeHead(502,{"content-type":"application/json"}),b.end(JSON.stringify({error:"Destination validation or connection failed"})),x=!0),A(a)}}let Y=d.createServer((a,b)=>{X(a,b)});async function Z(a){return a.upstreamPromise||(a.upstreamPromise=(async()=>{let b=a.target,c=await m(b.host,b.port),d=E(h.connect({host:b.host,port:b.port,servername:g.isIP(b.host)?void 0:b.host,rejectUnauthorized:!0,ca:n,ALPNProtocols:["h2"],lookup:c.lookup,autoSelectFamily:!0}));d.setNoDelay(!0),d.setKeepAlive(!0,3e4);let f=setTimeout(()=>d.destroy(Error("Upstream HTTP/2 TLS connect timeout")),i.connectTimeoutMs+i.tlsHandshakeTimeoutMs);f.unref?.(),d.once("secureConnect",()=>{clearTimeout(f),"h2"!==d.alpnProtocol&&d.destroy(Error("Upstream did not negotiate HTTP/2"))}),d.once("error",()=>clearTimeout(f)),d.once("close",()=>clearTimeout(f));let j=`https://${b.host}${443===b.port?"":`:${b.port}`}`,k=e.connect(j,{createConnection:()=>d,settings:{enablePush:!1}});return D.add(k),k.setTimeout(i.idleTimeoutMs,()=>k.destroy(Error("Upstream HTTP/2 idle timeout"))),k.once("close",()=>D.delete(k)),await new Promise((a,b)=>{let c=setTimeout(()=>b(Error("Upstream HTTP/2 session timeout")),i.connectTimeoutMs+i.tlsHandshakeTimeoutMs);c.unref?.();let d=(a,b)=>{clearTimeout(c),k.removeListener("connect",e),k.removeListener("error",f),a(b)},e=()=>d(a,k),f=a=>d(b,a);k.once("connect",e),k.once("error",f)}),k})().catch(b=>{throw a.upstreamPromise=null,b})),a.upstreamPromise}async function $(a,b){let c=C.get(a.session),d=c?.target;if(!c||!d){a.respond({":status":502,"content-type":"text/plain"}),a.end("Audit target is missing");return}a.pause();let f=Date.now(),g=new L(i.captureBodies?i.captureLimitBytes:0),h=new L(i.captureBodies?i.captureLimitBytes:0),j={},k=null,l=!1,m=!1,n=null,o=null,p=null,q=(e=null)=>{l||(l=!0,K(M({requestHeaders:b,method:b[":method"]||"GET",path:b[":path"]||"/",target:d,requestCapture:g,responseCapture:h,responseHeaders:j,statusCode:k,startedAt:f,error:e,socket:a.session.socket,protocol:"h2",authUser:c.authUser||null})))};try{(n=(await Z(c)).request(function(a,b){let c=I(a,{stripInternal:!0}),d={":method":a[":method"]||"GET",":path":a[":path"]||"/",":scheme":"https",":authority":443===b.port?b.host:`${b.host}:${b.port}`};for(let[a,b]of Object.entries(c))a.startsWith(":")||(d[a.toLowerCase()]=b);return d}(b,d),{endStream:!1,waitForTrailers:!0})).setTimeout(i.idleTimeoutMs,()=>n.close(e.constants.NGHTTP2_CANCEL)),a.setTimeout(i.idleTimeoutMs,()=>a.close(e.constants.NGHTTP2_CANCEL)),n.on("response",b=>{j=R(b),k=Number(b[":status"]||502),a.respond(function(a){let b=I(a,{stripInternal:!1}),c={":status":Number(a[":status"]||502)};for(let[a,d]of Object.entries(b))a.startsWith(":")||(c[a.toLowerCase()]=d);return c}(b),{waitForTrailers:!0})}),n.on("trailers",a=>{p=I(a,{stripInternal:!1})}),a.on("wantTrailers",()=>{try{a.sendTrailers(p||{})}catch{}}),a.on("trailers",a=>{o=I(a,{stripInternal:!0})}),n.on("wantTrailers",()=>{try{n.sendTrailers(o||{})}catch{}}),a.on("data",b=>{g.add(b),n.write(b)||a.pause()}),n.on("drain",()=>a.resume()),a.on("end",()=>n.end()),n.on("data",b=>{h.add(b),a.write(b)||n.pause()}),a.on("drain",()=>n.resume()),n.on("end",()=>{m=!0,a.end(),q(null)}),n.on("aborted",()=>{let b=Error("Upstream HTTP/2 stream aborted");a.close(e.constants.NGHTTP2_INTERNAL_ERROR),q(b)}),n.on("error",b=>{a.closed||a.close(e.constants.NGHTTP2_INTERNAL_ERROR),q(b)}),a.on("aborted",()=>{n.close(e.constants.NGHTTP2_CANCEL),q(Error("Client HTTP/2 stream aborted"))}),a.on("error",a=>{n.close(e.constants.NGHTTP2_CANCEL),q(a)}),a.on("close",()=>{m||!n||n.closed||(n.close(e.constants.NGHTTP2_CANCEL),q(Error("Client HTTP/2 stream closed")))}),a.resume()}catch(b){a.headersSent||a.closed||a.respond({":status":502,"content-type":"application/json"}),a.closed||a.end(JSON.stringify({error:"Verified upstream HTTP/2 request failed"})),q(b)}}Y.on("checkContinue",(a,b)=>{X(a,b,{expectContinue:!0})}),Y.on("upgrade",(a,b)=>{Q(b,"501 Not Implemented",O),W(a,b,b.__auditTarget)}),Y.on("clientError",(a,b)=>F(b)),Y.headersTimeout=i.responseHeaderTimeoutMs,Y.requestTimeout=0,Y.keepAliveTimeout=i.idleTimeoutMs;let _=e.createServer({settings:{enablePush:!1}});_.on("session",a=>{let b={target:a.socket.__auditTarget,authUser:a.socket.__auditProxyUser||null,upstreamPromise:null};C.set(a,b),a.setTimeout(i.idleTimeoutMs,()=>a.destroy(Error("Client HTTP/2 idle timeout"))),a.once("close",()=>{Promise.resolve(b.upstreamPromise).then(a=>a?.close()).catch(()=>{})})}),_.on("stream",(a,b)=>{$(a,b)}),_.on("sessionError",a=>{console.warn("[audit-proxy] HTTP/2 client session error:",a?.message||a)});let aa=d.createServer((a,b)=>{b.writeHead(403,{"content-type":"text/plain; charset=utf-8",connection:"close"}),b.end("Audit Proxy accepts HTTPS CONNECT traffic only")});function ab(){o=r(i.allowedClientTools),p=i.proxyAuthEnabled?x(i.proxyAuthUsers):null,z=i.proxyAuthEnabled?y():null,aa.headersTimeout=i.responseHeaderTimeoutMs,aa.keepAliveTimeout=i.idleTimeoutMs,Y.headersTimeout=i.responseHeaderTimeoutMs,Y.keepAliveTimeout=i.idleTimeoutMs,aa.auditCapabilities={http1:!0,http2:i.clientAlpnProtocols.includes("h2"),proxyAuth:!0===i.proxyAuthEnabled,plainHttp:!1,publicConnectPorts:[...i.allowedConnectPorts]}}return aa.on("connect",(a,b,c)=>{(async()=>{let d,e;try{d=G(a.url,443)}catch(e){let c=e.message||"Invalid CONNECT authority";Q(b,"400 Bad Request",c),T(a,b,d,c,{statusCode:400});return}let f=await V(a,b);if(f===U)return;try{await m(d.host,d.port)}catch(e){let c=e.message||"Destination is not allowed";Q(b,"403 Forbidden",c),T(a,b,d,c,{authUser:f});return}if(i.clientToolFilterEnabled&&s(a.headers["user-agent"],o)){let c=`Client tool is not allowed to use this proxy (${t(a.headers["user-agent"])})`;Q(b,"403 Forbidden",c),T(a,b,d,c);return}if(!H(d.host,i.allowedHosts)){if(!i.passthroughUnknown){let c="Host is not in the audit allowlist";Q(b,"403 Forbidden",c),T(a,b,d,c);return}let e=!1;try{let a=await m(d.host,d.port),f=E(g.connect({host:d.host,port:d.port,lookup:a.lookup,autoSelectFamily:!0})),h=setTimeout(()=>f.destroy(Error("TCP passthrough connect timeout")),i.connectTimeoutMs);h.unref?.(),f.setNoDelay(!0),f.setKeepAlive(!0,3e4),f.setTimeout(i.idleTimeoutMs,()=>f.destroy(Error("TCP passthrough idle timeout"))),f.once("connect",()=>{clearTimeout(h),e=!0,b.write("HTTP/1.1 200 Connection Established\r\nProxy-Agent: BlueRouter-Audit\r\n\r\n"),c?.length&&f.write(c),f.pipe(b),b.pipe(f)}),f.once("error",()=>{clearTimeout(h),e?F(b):Q(b,"502 Bad Gateway","TCP passthrough failed")}),b.once("error",()=>F(f)),b.once("close",()=>F(f))}catch(a){Q(b,"502 Bad Gateway",a.message||"TCP passthrough failed")}return}try{if(e=j(d.host),!e?.key||!e?.cert)throw Error("Certificate provider returned no certificate")}catch(a){Q(b,"500 Internal Server Error",`Cannot issue audit certificate: ${a.message}`);return}b.write("HTTP/1.1 200 Connection Established\r\nProxy-Agent: BlueRouter-Audit\r\n\r\n"),c?.length&&b.unshift(c);let k=E(new h.TLSSocket(b,{isServer:!0,key:e.key,cert:e.cert,ALPNProtocols:i.clientAlpnProtocols}));k.__auditTarget=d,k.__auditProxyUser=f,k.__auditDlpGroups=b.__auditDlpGroups||[],k.setNoDelay(!0),k.setKeepAlive(!0,3e4),k.setTimeout(i.idleTimeoutMs,()=>k.destroy(Error("Client TLS idle timeout")));let l=setTimeout(()=>k.destroy(Error("Client TLS handshake timeout")),i.tlsHandshakeTimeoutMs);l.unref?.();let n=!1,p=()=>{n||(n=!0,clearTimeout(l),"h2"===k.alpnProtocol?_.emit("connection",k):Y.emit("connection",k))};k.once("secure",p),k.once("secureConnect",p),k.once("error",()=>{clearTimeout(l),F(k)}),k.once("close",()=>clearTimeout(l))})().catch(a=>Q(b,"500 Internal Server Error",a.message||"Audit CONNECT failed"))}),aa.prependListener("connection",a=>{E(a),a.setNoDelay(!0),a.setKeepAlive(!0,3e4)}),aa.on("upgrade",(a,b)=>Q(b,"501 Not Implemented",O)),aa.on("clientError",(a,b)=>F(b)),aa.headersTimeout=i.responseHeaderTimeoutMs,aa.requestTimeout=0,aa.keepAliveTimeout=i.idleTimeoutMs,aa.forceCloseAll=()=>{for(let a of D)try{a.destroy()}catch{}for(let a of B.values())try{a.destroy()}catch{}for(let a of[...A])F(a)},aa.getActiveConnectionCount=()=>A.size,aa.auditConfig=i,ab(),aa.applyConfig=(a={})=>{let b={};for(let[c,d]of(a.bindHost&&String(a.bindHost)!==String(i.bindHost)&&(b.bindHost=String(a.bindHost)),Number(a.port)&&Number(a.port)!==Number(i.port)&&(b.port=Number(a.port)),Object.entries(a)))"bindHost"!==c&&"port"!==c&&(["verifyUpstreamTls","allowPlainHttp","allowedConnectPorts","clientAlpnProtocols"].includes(c)||(i[c]=d));return ab(),{rebindRequired:Object.keys(b).length>0,pending:b}},aa},hostMatches:H,parseAuthority:G,stripHopByHop:I,CaptureBuffer:L,detectProvider:M,extractModel:O,decodeCapturedBuffer:J}},49083:(a,b,c)=>{let{createAuditProxy:d}=c(45372),{loadConfig:e,saveConfig:f,validateConfig:g,CONFIG_PATH:h,AUDIT_LOG_PATH:i,AUDIT_LOG_DIR:j,PROXY_AUTH_FEATURE_ENABLED:k}=c(43096),{hashProxyPassword:l,isValidUsername:m,normalizeProxyUsers:n,redactProxyAuthUsers:o,PASSWORD_MAX_BYTES:p,PASSWORD_MIN_BYTES:q}=c(7566),{normalizeIp:r}=c(5565),{attachClientIpGate:s,effectiveClientIpPolicy:t,normalizeAccessGrants:u,normalizeGrantUserId:v}=c(77407),{getProxySession:w,pruneExpiredProxySessions:x,revokeProxySession:y,revokeProxySessionsForUser:z}=c(68257),{SETTINGS_KEY:A,extractAuditPolicy:B,mergeAuditPolicy:C,policyEquals:D}=c(85463),{enqueueAuditJob:E,readRecent:F,clearAudit:G,pruneExpired:H,startAuditMaintenance:I,stopAuditMaintenance:J,flushAuditQueue:K,registerAuditShutdownFlush:L,unregisterAuditShutdownFlush:M,getAuditStoreStats:N}=c(90173),{ensureAuditRootCA:O,createAuditCertificateProvider:P,getStatusRootCaValidation:Q}=c(85074),{readRootCAInfo:R}=c(2466),{runSelfTest:S}=c(85252);function T(){return globalThis.__blueRouterAuditProxyRuntime||(globalThis.__blueRouterAuditProxyRuntime={server:null,certificateProvider:null,ipPolicy:null,ipGate:null,startedAt:null,lastError:null,autostartPromise:null,autostartRetryTimer:null,lifecycle:Promise.resolve()}),globalThis.__blueRouterAuditProxyRuntime}function U(a){let b=T(),c=b.lifecycle.then(a,a);return b.lifecycle=c.catch(()=>{}),c}async function V(a,b=1500){if(!a)return;let c=Math.max(0,Number(b)||0);await new Promise(b=>{let d=!1,e=()=>{d||(d=!0,b())};try{a.listening?a.close(e):e()}catch{e()}let f=setTimeout(()=>{try{a.forceCloseAll?.()}catch{}},c);f.unref?.();let g=setTimeout(e,c+2e3);g.unref?.()});try{a.forceCloseAll?.()}catch{}}function W(a){let b=e();return{...a,proxyAuthEnabled:!0===b.proxyAuthEnabled,proxyAuthUsers:[...b.proxyAuthUsers||[]],accessGrants:u(b.accessGrants)}}let X=null;function Y(){let a=x();if(0===a)return;let b=T();if(!b.server?.listening)return;let c=b.ipGate?.dropRevoked()||0;console.log(`[audit-proxy] session sweep: ${a} session(s) expired, ${c} connection(s) closed`)}async function Z(a=null){let b=T();if(b.server?.listening)return ag();let c=a?f({...W(a),enabled:!1}):e();await O(),await H(),I(),X||(X=setInterval(Y,3e4),X.unref?.()),L();let g=P({maxEntries:128});g.prewarm(c.allowedHosts);let h=d(c,{certificateProvider:g,onAuditJob:E});b.ipPolicy=t(c),b.ipGate=s(h,()=>T().ipPolicy);try{let a=await new Promise((a,b)=>{let d=a=>{h.removeListener("listening",e),b(a?.code==="EADDRNOTAVAIL"?Error(`Cannot bind ${c.bindHost}:${c.port} - that address does not exist on this machine. In Docker the container cannot bind the host's LAN IP: set the bind address to 0.0.0.0 and let the published port (-p 3128:3128) expose it on the host.`,{cause:a}):a?.code==="EACCES"?Error(`Cannot bind ${c.bindHost}:${c.port} - permission denied. Ports below 1024 need extra privileges; pick a high port such as 3128.`,{cause:a}):a)},e=()=>{h.removeListener("error",d),a(h.address())};h.once("error",d),h.once("listening",e),h.listen(c.port,c.bindHost)});return b.server=h,b.certificateProvider=g,b.startedAt=new Date().toISOString(),b.lastError=null,ae(),f({...c,enabled:!0}),{...await ag(),address:a}}catch(a){b.lastError=a.message||String(a);try{h.forceCloseAll?.()}catch{}try{h.close()}catch{}throw g.clear?.(),a}}async function $({persist:a=!0}={}){let b=T();ae();let c=b.server,d=e();if(b.server=null,b.startedAt=null,await V(c,d.shutdownGraceMs),b.certificateProvider?.clear?.(),b.certificateProvider=null,b.ipGate=null,!await K(3e3)){let a=N();console.warn(`[audit-proxy] audit queue did not drain within 3000ms; ${a.queueDepth} event(s) still queued`)}return M(),J(),X&&clearInterval(X),X=null,a&&f({...d,enabled:!1}),ag()}async function _(a=null){return await $({persist:!1}),a&&f({...W(a),enabled:!1}),Z()}function aa(a=null){return U(()=>Z(a))}let ab=new Set(["1","true","yes","on"]),ac=[2e3,5e3,15e3,3e4,6e4];function ad(a){return a?.code==="EADDRINUSE"||a?.cause?.code==="EADDRINUSE"}function ae(){let a=T();a.autostartRetryTimer&&(clearTimeout(a.autostartRetryTimer),a.autostartRetryTimer=null)}async function af(){let a,b=T();await am();let c=e(),d=null!=(a=process.env.AUDIT_PROXY_ENABLED)&&""!==a&&ab.has(String(a).trim().toLowerCase());return c.enabled||d?b.server?.listening?{started:!1,reason:"already-running",status:await ag()}:(d&&!c.enabled&&console.log("[audit-proxy] starting because AUDIT_PROXY_ENABLED is set, despite stored enabled=false"),b.autostartPromise||(b.autostartPromise=(async()=>{try{let a=await aa();return console.log(`[audit-proxy] autostarted on ${c.bindHost}:${c.port}`),{started:!0,status:a}}catch(c){b.lastError=c?.message||String(c),console.log("[audit-proxy] autostart failed:",b.lastError);let a=ad(c);return a&&function a(b){let c=T(),d=ac[b-1];d?c.autostartRetryTimer||(c.autostartRetryTimer=setTimeout(async()=>{if((c.autostartRetryTimer=null,!c.server?.listening)&&e().enabled)try{await aa(),console.log(`[audit-proxy] autostart succeeded on retry ${b}`)}catch(d){c.lastError=d?.message||String(d),console.log(`[audit-proxy] autostart retry ${b} failed:`,c.lastError),ad(d)&&a(b+1)}},d),c.autostartRetryTimer.unref?.()):console.warn(`[audit-proxy] autostart still failing after ${ac.length} retries; start it from the dashboard once the cause is cleared`)}(1),{started:!1,error:b.lastError,retrying:a}}finally{b.autostartPromise=null}})()),b.autostartPromise):{started:!1,reason:"disabled"}}async function ag(){let a=T(),b=e(),c=t(b),d=!!a.server?.listening,f=R();try{let a=Q();f={...f,validated:!0===a.exists,expiringSoon:!0===a.expiringSoon,autoRotation:!1}}catch(a){f={...f,validated:!1,autoRotation:!1,error:a.message||String(a)}}return{running:d,listening:d,startedAt:a.startedAt,lastError:a.lastError,address:d?a.server.address():null,pendingListenerRestart:d&&!function(a,b){if(!a)return!0;let c=String(b.bindHost||"").trim().toLowerCase(),d=r(a.address||""),e=r("localhost"===c?"127.0.0.1":c);return Number(a.port)===Number(b.port)&&d===e}(a.server.address(),b),activeConnections:d&&a.server.getActiveConnectionCount?.()||0,capabilities:d?a.server.auditCapabilities:{http1:!0,http2:!1,plainHttp:!1,publicConnectPorts:[443]},security:{clientIpFilterEnabled:c.enabled,clientIpFilterSource:c.source,enforcedClientIpCount:c.allowedClientIps.length,accessGrantCount:c.grants.length,sessionIdleTimeoutMs:b.sessionIdleTimeoutMs,activeSessionCount:c.sessions.length,clientToolFilterEnabled:!0===b.clientToolFilterEnabled,proxyAuthEnabled:!0===b.proxyAuthEnabled,proxyAuthFeatureEnabled:k,allowedClientToolCount:(b.allowedClientTools||[]).length,privateDestinationsBlocked:!0,plainHttpBlocked:!0,upstreamTlsVerified:!0},activeSessions:c.sessions.map(a=>({ip:a.ip,userId:a.userId,displayName:a.displayName,activatedAt:new Date(a.activatedAt).toISOString(),expiresAt:new Date(a.expiresAt).toISOString()})),certificateCache:a.certificateProvider?.stats?.()||{entries:0},auditStore:N(),configPath:h,auditLogPath:i,auditLogDirectory:j,rootCA:f}}async function ah(a=50,{includeEvents:b=!0}={}){let c=e(),[d,f]=await Promise.all([ag(),b?F(a):[]]);return{config:ai(c),status:d,events:f}}function ai(a){return a?{...a,proxyAuthUsers:o(a.proxyAuthUsers)}:a}async function aj(){return Promise.resolve().then(c.bind(c,89718))}async function ak(){try{let{isClusterStandby:a}=await c.e(2763).then(c.bind(c,62763));return await a()===!0}catch{return!1}}async function al(a){try{if(await ak())return{mirrored:!1,reason:"standby"};let{getSettings:b,updateSettings:c}=await aj(),d=B(a),e=await b();if(JSON.stringify(e?.[A]||null)===JSON.stringify(d))return{mirrored:!1,reason:"unchanged"};return await c({[A]:d}),{mirrored:!0}}catch(a){return console.warn("[audit-proxy] failed to mirror policy to settings:",a?.message||a),{mirrored:!1,error:a?.message||String(a)}}}async function am({force:a=!1}={}){try{if(!a&&!await ak())return{applied:!1,reason:"not-standby"};let{getSettings:b}=await aj(),c=await b(),d=c?.[A];if(!d||"object"!=typeof d)return{applied:!1,reason:"no-policy"};let f=e();if(D(f,d))return{applied:!1,reason:"unchanged"};let g=C(f,d),h=await an(g,{mirror:!1});return console.log("[audit-proxy] applied cluster policy from snapshot"),{applied:!0,restarted:!0===h.restarted,droppedConnections:h.droppedConnections||0}}catch(a){return console.warn("[audit-proxy] failed to apply cluster policy:",a?.message||a),{applied:!1,error:a?.message||String(a)}}}function an(a,{mirror:b=!0}={}){return U(async()=>{let c=T(),d=!!c.server?.listening,e=f({...g(a),enabled:d});c.ipPolicy=t(e);let h=!1,i={},j=0;if(d){let a=c.server.applyConfig?.(e)||{};h=!0===a.rebindRequired,i=a.pending||{},j=c.ipGate?.dropRevoked()||0;try{c.certificateProvider?.prewarm?.(e.allowedHosts)}catch{}}return b&&await al(e),{config:ai(e),status:await ag(),restarted:!1,appliedInstantly:!0,rebindRequired:h,pendingListener:i,droppedConnections:j}})}a.exports={startProxy:aa,ensureAuditProxyAutostart:af,stopProxy:function(a={}){return U(()=>$(a))},restartProxy:function(a=null){return U(()=>_(a))},getStatus:ag,getSnapshot:ah,readRecentAuditEvents:F,updateConfig:function(a){return an(W(a))},updateClientProxyHost:function(a){return an({...e(),clientProxyHost:String(a||"").trim()})},updateProxyAuth:async function a({enabled:b,users:c}={}){if(!0===b&&!k)throw Error("Proxy authentication is turned off in this deployment (PROXY_AUTH_FEATURE_ENABLED in audit-gateway/config.js)");let d=e(),f=new Map(n(d.proxyAuthUsers).map(a=>[a.username.toLowerCase(),a])),g=new Set,h=[];for(let a of Array.isArray(c)?c:[]){let b=String(a?.username||"").trim();if(!m(b))throw Error(`Invalid username: ${b||"(empty)"}`);let c=b.toLowerCase();if(g.has(c))throw Error(`Duplicate username: ${b}`);g.add(c);let d="string"==typeof a?.password?a.password:"";if(d){let a=Buffer.byteLength(d,"utf8");if(a<q)throw Error(`Password for ${b} must be at least ${q} characters`);if(a>p)throw Error(`Password for ${b} must be at most ${p} bytes`);h.push({username:b,passwordHash:await l(d)});continue}let e=f.get(c);if(!e)throw Error(`Account ${b} requires a password`);h.push({username:b,passwordHash:e.passwordHash})}return an({...d,proxyAuthEnabled:!0===b,proxyAuthUsers:h})},listAccessGrants:function(){return u(e().accessGrants)},applyAuditPolicyFromSettings:am,upsertAccessGrant:function({userId:a,note:b}={}){let c=v(a);if(!c)throw Error("Grant requires a dashboard username or email");let d=e(),f=u(d.accessGrants).filter(a=>a.userId!==c);return f.push({userId:c,note:b}),an({...d,accessGrants:f})},deleteAccessGrant:function(a){let b=v(a);if(!b)throw Error("Grant requires a dashboard username or email");let c=e(),d=u(c.accessGrants).filter(a=>a.userId!==b);return z(b),an({...c,accessGrants:d})},getOwnProxySession:function(a){return w(a)},revokeSession:function({ip:a,userId:b}={}){let c=a?+!!y(a):z(b);if(0===c)return{removed:0,droppedConnections:0};let d=T();return d.server?.listening?{removed:c,droppedConnections:d.ipGate?.dropRevoked()||0}:{removed:c,droppedConnections:0}},clearAudit:G,runSelfTest:S}},78864:(a,b,c)=>{let d=c(14985).promises,e=c(91645),{normalizeIp:f,clientIpMatches:g}=c(5565),h=new Map,i=Object.freeze(["0.0.0.0/8","10.0.0.0/8","100.64.0.0/10","127.0.0.0/8","169.254.0.0/16","172.16.0.0/12","192.0.0.0/24","192.0.2.0/24","192.88.99.0/24","192.168.0.0/16","198.18.0.0/15","198.51.100.0/24","203.0.113.0/24","224.0.0.0/4","240.0.0.0/4","::/96","::1/128","100::/64","2001:2::/48","2001:db8::/32","fc00::/7","fe80::/10","ff00::/8"]),j=Object.freeze([".localhost",".local",".internal",".lan",".home.arpa"]);function k(a){return String(a||"").trim().replace(/^\[|\]$/g,"").replace(/\.$/,"").toLowerCase()}function l(a){let b=k(a);return!(!(!b||"localhost"===b||j.some(a=>b.endsWith(a)))&&(e.isIP(b)||b.includes(".")))}function m(a){let b=f(a);return!!e.isIP(b)&&!g(b,i)}function n(a){let b=[...new Set((Array.isArray(a)?a:[a]).map(a=>Number(a)).filter(a=>Number.isInteger(a)&&a>=1&&a<=65535))];return b.length?b:[443]}function o(a){let b=[...a?.addresses||[]];return function(c,d,e){let f=d,g=e;"function"==typeof d&&(g=d,f={});let h="number"==typeof f?f:Number(f?.family||0);if("object"==typeof f&&f?.all===!0){let c=4===h||6===h?b.filter(a=>a.family===h):b;if(!c.length){let b=Error(`No validated public address for ${a.host}`);b.code="ENOTFOUND",g(b);return}g(null,c.map(({address:a,family:b})=>({address:a,family:b})));return}let i=function(a,b=0){let c=Number(b||0);return 4===c||6===c?a.find(a=>a.family===c)||null:a.find(a=>4===a.family)||a[0]||null}(b,h);if(!i){let b=Error(`No validated public address for ${a.host}`);b.code="ENOTFOUND",g(b);return}g(null,i.address,i.family)}}async function p(a,b,c={}){let g=k(a),i=Number(b||443),j=n(c.allowedPorts||[443]);if(!g)throw Error("Destination host is empty");if(!Number.isInteger(i)||!j.includes(i))throw Error(`CONNECT destination port ${i||"unknown"} is not allowed`);if(l(g))throw Error(`Private or local destination hostname is not allowed: ${g}`);let q=e.isIP(f(g));if(q){let a=f(g);if(!m(a))throw Error(`Private or reserved destination address is not allowed: ${a}`);let b={host:g,port:i,addresses:[{address:a,family:q}]};return{...b,lookup:o(b)}}let r=Date.now(),s=h.get(g);if(!s||s.expiresAt<=r){let a=await d.lookup(g,{all:!0,verbatim:!0}),b=[],c=new Set;for(let d of a||[]){let a=f(d.address),g=e.isIP(a);if(!g||!m(a))continue;let h=`${g}:${a}`;c.has(h)||(c.add(h),b.push({address:a,family:g}))}if(!b.length)throw Error(`Destination did not resolve to a public address: ${g}`);s={addresses:b,expiresAt:r+6e4},h.set(g,s)}let t={host:g,port:i,addresses:[...s.addresses]};return{...t,lookup:o(t)}}a.exports={BLOCKED_ADDRESS_RANGES:i,normalizeTargetHost:k,normalizeAllowedPorts:n,isBlockedHostname:l,isPublicAddress:m,createPinnedLookup:o,resolvePublicTarget:p,clearDnsPolicyCache:function(){h.clear()}}},85252:(a,b,c)=>{let d=c(81630),e=c(73496),f=c(91645),g=c(34631),h=c(74075),i=c(55511),j=c(15296),{createAuditProxy:k,CaptureBuffer:l}=c(45372),{containsLikelySecret:m}=c(48350),{clientIpMatches:n,normalizeAllowedClientIps:o}=c(5565),{normalizeAllowedTools:p,clientToolMatches:q,shouldRefuseClientTool:r}=c(98586),{createProxyAuthenticator:s,createProxyAuthLimiter:t,hashProxyPassword:u,parseBasicProxyAuthorization:v}=c(7566),{isPublicAddress:w}=c(78864),{validateConfig:x,PROXY_AUTH_FEATURE_ENABLED:y}=c(43096),{normalizeAccessGrants:z,effectiveClientIpPolicy:A,attachClientIpGate:B,findAccessGrant:C}=c(77407),{activateProxySession:D,touchProxySession:E,getProxySession:F,revokeProxySession:G,clearAllProxySessions:H}=c(68257),{promptLogMirrorDecision:I}=c(90173);function J(a){return i.createHash("sha256").update(a).digest("hex")}function K(a){let b=j.pki.rsa.generateKeyPair(2048),c=j.pki.createCertificate();c.publicKey=b.publicKey,c.serialNumber=String(Date.now()),c.validity.notBefore=new Date(Date.now()-6e4),c.validity.notAfter=new Date(Date.now()+864e5);let d=[{name:"commonName",value:a}];return c.setSubject(d),c.setIssuer(d),c.setExtensions([{name:"basicConstraints",cA:!0,critical:!0},{name:"keyUsage",keyCertSign:!0,cRLSign:!0,critical:!0}]),c.sign(b.privateKey,j.md.sha256.create()),{cert:c,keys:b,certPem:j.pki.certificateToPem(c)}}function L(a,b){let c=j.pki.rsa.generateKeyPair(2048),d=j.pki.createCertificate();return d.publicKey=c.publicKey,d.serialNumber=`${Date.now()}${Math.floor(1e3*Math.random())}`,d.validity.notBefore=new Date(Date.now()-6e4),d.validity.notAfter=new Date(Date.now()+864e5),d.setSubject([{name:"commonName",value:b}]),d.setIssuer(a.cert.subject.attributes),d.setExtensions([{name:"basicConstraints",cA:!1},{name:"keyUsage",digitalSignature:!0,keyEncipherment:!0},{name:"extKeyUsage",serverAuth:!0},{name:"subjectAltName",altNames:[{type:2,value:b}]}]),d.sign(a.keys.privateKey,j.md.sha256.create()),{cert:j.pki.certificateToPem(d),key:j.pki.privateKeyToPem(c.privateKey)}}function M(a,b="127.0.0.1"){return new Promise((c,d)=>{a.once("error",d),a.listen(0,b,()=>{a.removeListener("error",d),c(a.address())})})}function N(a){return new Promise(b=>{if(!a)return b();try{a.forceCloseAll?.()}catch{}if(!a.listening)return b();a.close(()=>b()),setTimeout(b,1e3).unref?.()})}function O(a,b){let c="127.0.0.1";return Promise.resolve({host:a,port:b,addresses:[{address:c,family:4}],lookup:(a,b,d)=>{let e=b,f=d;"function"==typeof b&&(f=b,e={}),e?.all?f(null,[{address:c,family:4}]):f(null,c,4)}})}function P(a,b,c="",d=""){return new Promise((e,g)=>{let h=f.connect(a,"127.0.0.1"),i=Buffer.alloc(0),j=setTimeout(()=>g(Error("CONNECT timeout")),7e3);h.once("error",g),h.once("connect",()=>{let a=c?`User-Agent: ${c}\r
 `:"";h.write(`CONNECT ${b} HTTP/1.1\r
 Host: ${b}\r
 ${a}${d}Proxy-Connection: keep-alive\r
@@ -45,7 +45,7 @@ Sec-WebSocket-Version: 13\r
 `)});let m=()=>{clearTimeout(l),f(Buffer.concat(k).toString("latin1"))};j.on("data",a=>{k.push(Buffer.from(a)),Buffer.concat(k).indexOf("\r\n\r\n")>=0&&m()}),j.on("end",m),j.on("close",m)})}({socket:aq,ca:aa.certPem,servername:"localhost",port:a.port,path:"/v1/messages?transport=websocket"});c("Protocol upgrade is refused, not silently downgraded",ar.startsWith("HTTP/1.1 501"),ar.slice(0,40)),c("Upgrade refusal tells the client what to do instead",/HTTP streaming transport/i.test(ar)),c("Upgrade never reaches the origin",!ae.some(a=>String(a.path||"").includes("transport=websocket"))),await new Promise(a=>setTimeout(a,100)),c("Refused upgrade is still audited",ai.some(a=>501===a.status&&String(a.path||"").includes("transport=websocket")));let as=ai.find(a=>501===a.status&&String(a.path||"").includes("transport=websocket"));c("Refused upgrade is flagged as denied",as?.denied===!0,String(as?.denied)),c("Refused upgrade is not mirrored into prompt_logs","denied"===I(as).reason);let at=ae.find(a=>String(a.path||"").includes("encoded=")),au=ae.find(a=>String(a.path||"").includes("h2-preferred"));c("HTTP/1.1 path/query preserved",at?.path===W),c("Downgraded path/query preserved",au?.path===_),c("HTTP/1.1 request body byte-identical",at&&J(at.body)===J(V)),c("Downgraded request body byte-identical",au&&J(au.body)===J(Z)),c("Authorization preserved on wire",ae.every(a=>"Bearer test-secret-authorization-123456789"===a.authorization)),c("x-api-key preserved on wire",ae.every(a=>"sk-test-supersecret-123456789"===a.apiKey)),c("Internal x-9r-* header stripped",ae.every(a=>null==a.internalHeader));let av=ai.find(a=>String(a.path||"").includes("encoded=")),aw=ai.find(a=>String(a.path||"").includes("h2-preferred"));c("HTTP/1.1 audit event captured",!!av),c("Downgraded audit event captured",!!aw),c("Request wire SHA-256 recorded",av?.request?.wireSha256===J(V)&&aw?.request?.wireSha256===J(Z)),c("Response wire SHA-256 recorded",av?.response?.wireSha256===J(ad)&&aw?.response?.wireSha256===J(ad)),c("Compressed audit response decoded",av?.response?.body?.includes("compressed response preserved")&&aw?.response?.body?.includes("compressed response preserved"));let ax=I(av);c("Exchange with a prompt is mirrored with both halves",!0===ax.mirror&&ax.promptText?.includes("hello h1")&&ax.responseText?.includes("compressed response preserved"),JSON.stringify({mirror:ax.mirror,prompt:ax.promptText,response:ax.responseText}));let ay={...av,path:"/api/claude_code/telemetry",request:{...av.request,body:JSON.stringify({events:[{eventName:"tengu_api_success",metadata:{durationMs:120}}]})},response:{...av.response,body:JSON.stringify({accepted_count:17,rejected_count:0})}},az=I(ay);c("Telemetry exchange is not mirrored into prompt_logs",!1===az.mirror&&"not-inference"===az.reason,JSON.stringify(az));let aA={...av,path:"/backend-api/ps/plugins/list?scope=GLOBAL",request:{...av.request,body:""},response:{...av.response,body:JSON.stringify({items:[{text:"gmail@openai-curated-remote"}]})}};c("Plugin listing is not mirrored into prompt_logs","not-inference"===I(aA).reason);let aB={...av,request:{...av.request,body:""},response:{...av.response,body:"[br audit body capture truncated; decoded body unavailable]"}};c("Capture placeholder does not count as content","contentless"===I(aB).reason);let aC=ai.filter(a=>"authorization"in(a.request?.headers||{}));c("Authorization redacted in audit",aC.length>0&&aC.every(a=>"[REDACTED]"===a.request.headers.authorization));let aD=ai.filter(a=>"x-api-key"in(a.request?.headers||{}));c("x-api-key redacted in audit",aD.length>0&&aD.every(a=>"[REDACTED]"===a.request.headers["x-api-key"])),c("No likely API secret persisted",ai.length>=2&&ai.every(a=>!m(a)));let aE={allowedHosts:[...aj.auditConfig.allowedHosts],clientToolFilterEnabled:aj.auditConfig.clientToolFilterEnabled,allowedClientTools:[...aj.auditConfig.allowedClientTools||[]]},aF=aj.auditConfig.port,aG=aj.auditConfig.bindHost;try{let d=`localhost:${a.port}`;aj.applyConfig({...aj.auditConfig,allowedHosts:[]});let e=await function(a,b,c=""){return new Promise(d=>{let e=f.connect(a,"127.0.0.1"),g="",h=!1,i=()=>{if(!h){h=!0,clearTimeout(j);try{e.destroy()}catch{}d(g)}},j=setTimeout(i,3e3);e.once("error",i),e.once("connect",()=>e.write(`CONNECT ${b} HTTP/1.1\r
 Host: ${b}\r
 ${c}\r
-`)),e.on("data",a=>{g+=a.toString("utf8")}),e.on("close",i)})}(b.port,d);c("Removing a host from the allowlist applies with no restart",/HTTP\/1\.1 403\b/.test(e),JSON.stringify(e.slice(0,120))),aj.applyConfig({...aj.auditConfig,allowedHosts:["localhost"]});let g=await P(b.port,d).catch(a=>a);c("Re-adding it works on the next CONNECT",!(g instanceof Error),g instanceof Error?g.message:""),g?.destroy?.(),aj.applyConfig({...aj.auditConfig,clientToolFilterEnabled:!0,allowedClientTools:p(["claude-code"])});let h=await Q(b.port,d,"User-Agent: Mozilla/5.0 Chrome/131.0\r\n");c("Turning the tool filter on applies with no restart",/HTTP\/1\.1 403\b/.test(h),JSON.stringify(h.slice(0,120))),aj.applyConfig({...aj.auditConfig,clientToolFilterEnabled:!1,allowedClientTools:[]});let i=await P(b.port,d,"Mozilla/5.0 Chrome/131.0").catch(a=>a);c("Turning it off applies with no restart",!(i instanceof Error),i instanceof Error?i.message:""),i?.destroy?.(),aj.applyConfig({...aj.auditConfig,captureLimitBytes:4096}),c("Capture limit is updated in place",4096===aj.auditConfig.captureLimitBytes);let j=aj.applyConfig({...aj.auditConfig,port:b.port+1,bindHost:"0.0.0.0"});c("A listener address/port change is reported as pending, not applied",!0===j.rebindRequired&&j.pending.port===b.port+1&&"0.0.0.0"===j.pending.bindHost,JSON.stringify(j.pending)),c("The bound listener is left alone by applyConfig",aj.auditConfig.port===aF&&aj.auditConfig.bindHost===aG&&!0===aj.listening,`${aj.auditConfig.port}/${aj.auditConfig.bindHost} vs ${aF}/${aG}`);let k=await P(b.port,d).catch(a=>a);c("Traffic keeps flowing on the address that is bound",!(k instanceof Error),k instanceof Error?k.message:""),k?.destroy?.()}finally{aj.applyConfig({...aj.auditConfig,...aE})}ak=k({allowedHosts:["localhost"],passthroughUnknown:!1,captureBodies:!0,captureLimitBytes:1048576,verifyUpstreamTls:!0,allowedConnectPorts:[a.port],connectTimeoutMs:5e3,tlsHandshakeTimeoutMs:5e3,responseHeaderTimeoutMs:5e3,idleTimeoutMs:3e4},{certificateProvider:()=>ab,upstreamCa:$.certPem,resolveTarget:O,onAudit:()=>{throw Error("simulated audit sink failure")}});let aH=await M(ak),aI=await P(aH.port,`localhost:${a.port}`),aJ=await T({socket:aI,ca:aa.certPem,servername:"localhost",port:a.port,body:V,path:W});c("Audit sink failure does not fail proxied request",aJ.head.startsWith("HTTP/1.1 200"))}catch(a){c("Self-test execution",!1,a.message||String(a))}finally{await N(ak),await N(aj),await N(ah)}return{ok:b.length>0&&b.every(a=>a.ok),checks:b,passed:b.filter(a=>a.ok).length,total:b.length,durationMs:Date.now()-a}}}},85463:(a,b,c)=>{let{validateConfig:d}=c(43096),e=["accessGrants","allowedHosts","clientToolFilterEnabled","allowedClientTools","captureBodies","captureLimitBytes","passthroughUnknown","retentionDays","sessionIdleTimeoutMs"],f=["enabled","bindHost","port","clientProxyHost","proxyAuthEnabled","proxyAuthUsers"];function g(a={}){let b={};for(let c of e)void 0!==a[c]&&(b[c]=Array.isArray(a[c])?[...a[c]]:a[c]);return b}a.exports={POLICY_FIELDS:e,NODE_LOCAL_FIELDS:f,SETTINGS_KEY:"auditProxyPolicy",extractAuditPolicy:g,mergeAuditPolicy:function(a={},b={}){let c={...a};for(let a of e)void 0!==b[a]&&(c[a]=b[a]);for(let b of f)c[b]=a[b];return d(c)},policyEquals:function(a={},b={}){return JSON.stringify(g(a))===JSON.stringify(g(b))}}},86455:a=>{function b(a){let b=Number(a);return!Number.isFinite(b)||b<0?0:Math.round(b)}function c(){return{inputTokens:0,outputTokens:0,cacheReadTokens:0,cacheCreationTokens:0,reasoningTokens:0,totalTokens:0,model:null,stopReason:null,streaming:!1,complete:!1,source:null}}function d(a){let b=String(a||"").trim();if(!b||"{"!==b[0])return null;try{let a=JSON.parse(b);return a&&"object"==typeof a&&!Array.isArray(a)?a:null}catch{return null}}function e(a,c){"string"==typeof c.model&&c.model&&!a.model&&(a.model=c.model);let d="response.completed"===c.type||"response.done"===c.type?c.response?.usage:null,e=d||c.usage;if(!e||"object"!=typeof e)return!1;d&&"string"==typeof c.response?.model&&c.response.model&&(a.model=c.response.model);let f=b(e.prompt_tokens??e.input_tokens),g=b(e.completion_tokens??e.output_tokens);if(!f&&!g)return!1;let h=b(e.prompt_tokens_details?.cached_tokens??e.input_tokens_details?.cached_tokens??e.cached_tokens??e.prompt_cache_hit_tokens);a.inputTokens=Math.max(0,f-h),a.cacheReadTokens=h,a.outputTokens=g,a.reasoningTokens=b(e.completion_tokens_details?.reasoning_tokens??e.output_tokens_details?.reasoning_tokens),a.complete=!0;let i=c.choices?.[0]?.finish_reason;return"string"==typeof i&&i&&(a.stopReason=i),!0}function f(a,f){let g=c();g.streaming=!0,g.source="sse";let h=!1;for(let c of function*(a){let b=String(a||""),c=0;for(;c<b.length;){let a=b.indexOf("\n",c);-1===a&&(a=b.length);let e=b.slice(c,a).trim();if(c=a+1,!e.startsWith("data:"))continue;let f=e.slice(5).trim();if(!f||"[DONE]"===f)continue;let g=d(f);g&&(yield g)}}(a)){if(("anthropic"===f||"message_start"===c.type||"message_delta"===c.type)&&function(a,c){let d=String(c.type||"");if("message_start"===d&&c.message&&"object"==typeof c.message){let d=c.message;"string"==typeof d.model&&d.model&&(a.model=d.model);let e=d.usage;return e&&"object"==typeof e&&(a.inputTokens=b(e.input_tokens)||a.inputTokens,a.cacheReadTokens=b(e.cache_read_input_tokens)||a.cacheReadTokens,a.cacheCreationTokens=b(e.cache_creation_input_tokens)||a.cacheCreationTokens),!0}if("message_delta"===d){let d=c.usage;d&&"object"==typeof d&&(a.outputTokens=b(d.output_tokens)||a.outputTokens,a.inputTokens=a.inputTokens||b(d.input_tokens),a.cacheReadTokens=a.cacheReadTokens||b(d.cache_read_input_tokens),a.cacheCreationTokens=a.cacheCreationTokens||b(d.cache_creation_input_tokens),a.complete=!0);let e=c.delta?.stop_reason;return"string"==typeof e&&e&&(a.stopReason=e),!0}return!1}(g,c)){h=!0;continue}e(g,c)&&(h=!0)}return h?g:null}function g(a){let f=d(a);if(!f)return null;let g=c();g.source="json","string"==typeof f.model&&f.model&&(g.model=f.model);let h=f.usage;return h&&"object"==typeof h?null!=h.input_tokens||null!=h.output_tokens?(g.inputTokens=b(h.input_tokens),g.outputTokens=b(h.output_tokens),g.cacheReadTokens=b(h.cache_read_input_tokens),g.cacheCreationTokens=b(h.cache_creation_input_tokens),g.complete=!0,"string"==typeof f.stop_reason&&(g.stopReason=f.stop_reason),g):e(g,f)?g:null:null}function h(a){return/\/count_tokens\b/.test(String(a||""))}function i(a){return a.inputTokens+a.cacheReadTokens+a.cacheCreationTokens}a.exports={extractUsageFromBody:function({provider:a,body:b,contentType:c="",path:d=""}={}){if("string"!=typeof b||!b||b.length>0x1000000||h(d))return null;let e=/event-stream/i.test(String(c||""))||b.includes("\ndata:")||b.startsWith("data:")?f(b,a)||g(b):g(b)||f(b,a);return e&&(e&&(e.inputTokens||e.outputTokens||e.cacheReadTokens||e.cacheCreationTokens)||e.model)?(e.totalTokens=e.inputTokens+e.outputTokens+e.cacheReadTokens+e.cacheCreationTokens,e):null},isTokenCountingEndpoint:h,toTokensJson:function(a){if(!a)return null;let b=i(a),c={input_tokens:a.inputTokens,output_tokens:a.outputTokens,prompt_tokens:b,completion_tokens:a.outputTokens,total_tokens:a.totalTokens,display_total_input_tokens:b,display_new_input_tokens:a.inputTokens,display_cached_input_tokens:a.cacheReadTokens,display_cache_creation_input_tokens:a.cacheCreationTokens,display_output_tokens:a.outputTokens};return a.cacheReadTokens&&(c.cache_read_input_tokens=a.cacheReadTokens),a.cacheCreationTokens&&(c.cache_creation_input_tokens=a.cacheCreationTokens),a.cacheReadTokens&&(c.cached_tokens=a.cacheReadTokens),a.reasoningTokens&&(c.reasoning_tokens=a.reasoningTokens),c},totalInputTokens:i}},90173:(a,b,c)=>{let d=c(29021),e=c(33873),f=c(4984),g=c(55511),{AUDIT_LOG_PATH:h,AUDIT_LOG_DIR:i,ensureAuditDir:j,loadConfig:k}=c(43096),{redactObject:l,scrubString:m}=c(48350),{toTokensJson:n,totalInputTokens:o}=c(86455),{publishRecentUsage:p}=c(87662),q="audit-proxy",r="client",s="provider_response",t=/\/(?:messages|responses|chat\/completions)$|generatecontent$/i,u={expiresAt:0,config:null},v=null,w=null,x=null,y=null,z=null,A=null,B="",C=Promise.resolve(),D=Promise.resolve(),E=0,F=null,G=!1,H=new Map,I={queue:[],workers:new Set,activeWorkers:0,clearing:!1,enqueued:0,written:0,dropped:0,failed:0,localFailed:0,sinkTimeouts:0,flushTimeouts:0,mysqlWritten:0,mysqlFailed:0,mysqlSkipped:0,mysqlSkippedByReason:{},usageWritten:0,usageFailed:0,tokensSeen:0,lastError:null,lastWrittenAt:null};function J(a){let b=Date.now();b-E<6e4||(E=b,console.warn(`[AuditProxy][PromptDB] ${a}`))}function K(a){I.lastError=String(a||"Audit store failure"),console.warn(`[AuditProxy][Store] ${I.lastError}`)}function L(a,b,c=3e4){let d=null;return Promise.race([a,new Promise((a,e)=>{d=setTimeout(()=>{I.sinkTimeouts+=1,e(Error(`${b} timed out after ${c}ms`))},c),d.unref?.()})]).finally(()=>{d&&clearTimeout(d)})}async function M(){let a=Date.now();if(u.expiresAt>a)return u.config;v||(v=Promise.resolve().then(c.bind(c,45903)));let b=await v,d=await b.getPromptLogDbConfig();return u={expiresAt:a+5e3,config:d},d}async function N(){return w||(w=c.e(2661).then(c.bind(c,12661))),w}async function O(a){let b=g.createHash("sha256").update(JSON.stringify({host:a.host,port:Number(a.port||3306),database:a.database,username:a.username,password:a.password,ssl:!!a.ssl})).digest("hex");if(A&&B===b)return A;let d=C.then(async()=>{if(A&&B===b)return A;if(A){try{await A.end()}catch{}A=null,B=""}let d=await c.e(8491).then(c.t.bind(c,38491,19)),e=(d.default||d).createPool({host:a.host,port:Number(a.port||3306),database:a.database,user:a.username,password:a.password,ssl:a.ssl?{rejectUnauthorized:!0}:void 0,connectTimeout:3e3,waitForConnections:!0,connectionLimit:4,maxIdle:4,idleTimeout:6e4,queueLimit:100,enableKeepAlive:!0,keepAliveInitialDelay:3e4});return A=e,B=b,e});return C=d.then(()=>void 0,()=>void 0),d}function P(a){let b=a?new Date(a):new Date;return(Number.isNaN(b.getTime())?new Date:b).toISOString().replace("T"," ").replace("Z","")}function Q(a){if("string"!=typeof a)return a;let b=a.trim();if(!b||!b.startsWith("{")&&!b.startsWith("["))return a;try{return JSON.parse(b)}catch{return a}}function R(a,b=0,c=[]){if(null==a||b>12||c.join("\n").length>=2e5)return c;if("string"==typeof a)return a.trim()&&c.push(a.trim()),c;if(Array.isArray(a)){for(let d of a)R(d,b+1,c);return c}if("object"!=typeof a)return c;for(let[d,e]of Object.entries(a)){let a=d.toLowerCase();["content","text","prompt","input","message","output_text"].includes(a)?R(e,b+1,c):b<8&&["messages","contents","parts","body","request","payload","response","choices","output","item","items"].includes(a)&&R(e,b+1,c)}return c}function S(a){if("string"!=typeof a)return!1;let b=a.trim();return!!b&&!/^\[[^\]]*\]$/.test(b)}function T(a){let b=String(a||"").toLowerCase();return b.includes("claude")?{tool:"claude-code",label:"Claude Code"}:b.includes("codex")?{tool:"codex",label:"Codex"}:{tool:"audit-proxy",label:"Enterprise AI Audit Proxy"}}async function U(a){if(!a)return null;let b=g.createHash("sha256").update(a).digest("hex"),c=Buffer.byteLength(String(a||""),"utf8"),d=await N();return await d.writePayloadFile(b,a),{payloadHash:b,payloadSizeBytes:c}}async function V(a,b,c,d){if(!c)return null;let{payloadHash:e,payloadSizeBytes:f}=c;return await a.query(`INSERT INTO prompt_log_payloads (
+`)),e.on("data",a=>{g+=a.toString("utf8")}),e.on("close",i)})}(b.port,d);c("Removing a host from the allowlist applies with no restart",/HTTP\/1\.1 403\b/.test(e),JSON.stringify(e.slice(0,120))),aj.applyConfig({...aj.auditConfig,allowedHosts:["localhost"]});let g=await P(b.port,d).catch(a=>a);c("Re-adding it works on the next CONNECT",!(g instanceof Error),g instanceof Error?g.message:""),g?.destroy?.(),aj.applyConfig({...aj.auditConfig,clientToolFilterEnabled:!0,allowedClientTools:p(["claude-code"])});let h=await Q(b.port,d,"User-Agent: Mozilla/5.0 Chrome/131.0\r\n");c("Turning the tool filter on applies with no restart",/HTTP\/1\.1 403\b/.test(h),JSON.stringify(h.slice(0,120))),aj.applyConfig({...aj.auditConfig,clientToolFilterEnabled:!1,allowedClientTools:[]});let i=await P(b.port,d,"Mozilla/5.0 Chrome/131.0").catch(a=>a);c("Turning it off applies with no restart",!(i instanceof Error),i instanceof Error?i.message:""),i?.destroy?.(),aj.applyConfig({...aj.auditConfig,captureLimitBytes:4096}),c("Capture limit is updated in place",4096===aj.auditConfig.captureLimitBytes);let j=aj.applyConfig({...aj.auditConfig,port:b.port+1,bindHost:"0.0.0.0"});c("A listener address/port change is reported as pending, not applied",!0===j.rebindRequired&&j.pending.port===b.port+1&&"0.0.0.0"===j.pending.bindHost,JSON.stringify(j.pending)),c("The bound listener is left alone by applyConfig",aj.auditConfig.port===aF&&aj.auditConfig.bindHost===aG&&!0===aj.listening,`${aj.auditConfig.port}/${aj.auditConfig.bindHost} vs ${aF}/${aG}`);let k=await P(b.port,d).catch(a=>a);c("Traffic keeps flowing on the address that is bound",!(k instanceof Error),k instanceof Error?k.message:""),k?.destroy?.()}finally{aj.applyConfig({...aj.auditConfig,...aE})}ak=k({allowedHosts:["localhost"],passthroughUnknown:!1,captureBodies:!0,captureLimitBytes:1048576,verifyUpstreamTls:!0,allowedConnectPorts:[a.port],connectTimeoutMs:5e3,tlsHandshakeTimeoutMs:5e3,responseHeaderTimeoutMs:5e3,idleTimeoutMs:3e4},{certificateProvider:()=>ab,upstreamCa:$.certPem,resolveTarget:O,onAudit:()=>{throw Error("simulated audit sink failure")}});let aH=await M(ak),aI=await P(aH.port,`localhost:${a.port}`),aJ=await T({socket:aI,ca:aa.certPem,servername:"localhost",port:a.port,body:V,path:W});c("Audit sink failure does not fail proxied request",aJ.head.startsWith("HTTP/1.1 200"))}catch(a){c("Self-test execution",!1,a.message||String(a))}finally{await N(ak),await N(aj),await N(ah)}return{ok:b.length>0&&b.every(a=>a.ok),checks:b,passed:b.filter(a=>a.ok).length,total:b.length,durationMs:Date.now()-a}}}},85463:(a,b,c)=>{let{validateConfig:d}=c(43096),e=["accessGrants","allowedHosts","clientToolFilterEnabled","allowedClientTools","captureBodies","captureLimitBytes","passthroughUnknown","retentionDays","sessionIdleTimeoutMs","dlpEnabled","dlpMaxInspectBytes","dlpOversizeAction","dlpDefaultAction","dlpProfiles","dlpRules"],f=["enabled","bindHost","port","clientProxyHost","proxyAuthEnabled","proxyAuthUsers"];function g(a={}){let b={};for(let c of e)void 0!==a[c]&&(b[c]=Array.isArray(a[c])?[...a[c]]:a[c]);return b}a.exports={POLICY_FIELDS:e,NODE_LOCAL_FIELDS:f,SETTINGS_KEY:"auditProxyPolicy",extractAuditPolicy:g,mergeAuditPolicy:function(a={},b={}){let c={...a};for(let a of e)void 0!==b[a]&&(c[a]=b[a]);for(let b of f)c[b]=a[b];return d(c)},policyEquals:function(a={},b={}){return JSON.stringify(g(a))===JSON.stringify(g(b))}}},86455:a=>{function b(a){let b=Number(a);return!Number.isFinite(b)||b<0?0:Math.round(b)}function c(){return{inputTokens:0,outputTokens:0,cacheReadTokens:0,cacheCreationTokens:0,reasoningTokens:0,totalTokens:0,model:null,stopReason:null,streaming:!1,complete:!1,source:null}}function d(a){let b=String(a||"").trim();if(!b||"{"!==b[0])return null;try{let a=JSON.parse(b);return a&&"object"==typeof a&&!Array.isArray(a)?a:null}catch{return null}}function e(a,c){"string"==typeof c.model&&c.model&&!a.model&&(a.model=c.model);let d="response.completed"===c.type||"response.done"===c.type?c.response?.usage:null,e=d||c.usage;if(!e||"object"!=typeof e)return!1;d&&"string"==typeof c.response?.model&&c.response.model&&(a.model=c.response.model);let f=b(e.prompt_tokens??e.input_tokens),g=b(e.completion_tokens??e.output_tokens);if(!f&&!g)return!1;let h=b(e.prompt_tokens_details?.cached_tokens??e.input_tokens_details?.cached_tokens??e.cached_tokens??e.prompt_cache_hit_tokens);a.inputTokens=Math.max(0,f-h),a.cacheReadTokens=h,a.outputTokens=g,a.reasoningTokens=b(e.completion_tokens_details?.reasoning_tokens??e.output_tokens_details?.reasoning_tokens),a.complete=!0;let i=c.choices?.[0]?.finish_reason;return"string"==typeof i&&i&&(a.stopReason=i),!0}function f(a,f){let g=c();g.streaming=!0,g.source="sse";let h=!1;for(let c of function*(a){let b=String(a||""),c=0;for(;c<b.length;){let a=b.indexOf("\n",c);-1===a&&(a=b.length);let e=b.slice(c,a).trim();if(c=a+1,!e.startsWith("data:"))continue;let f=e.slice(5).trim();if(!f||"[DONE]"===f)continue;let g=d(f);g&&(yield g)}}(a)){if(("anthropic"===f||"message_start"===c.type||"message_delta"===c.type)&&function(a,c){let d=String(c.type||"");if("message_start"===d&&c.message&&"object"==typeof c.message){let d=c.message;"string"==typeof d.model&&d.model&&(a.model=d.model);let e=d.usage;return e&&"object"==typeof e&&(a.inputTokens=b(e.input_tokens)||a.inputTokens,a.cacheReadTokens=b(e.cache_read_input_tokens)||a.cacheReadTokens,a.cacheCreationTokens=b(e.cache_creation_input_tokens)||a.cacheCreationTokens),!0}if("message_delta"===d){let d=c.usage;d&&"object"==typeof d&&(a.outputTokens=b(d.output_tokens)||a.outputTokens,a.inputTokens=a.inputTokens||b(d.input_tokens),a.cacheReadTokens=a.cacheReadTokens||b(d.cache_read_input_tokens),a.cacheCreationTokens=a.cacheCreationTokens||b(d.cache_creation_input_tokens),a.complete=!0);let e=c.delta?.stop_reason;return"string"==typeof e&&e&&(a.stopReason=e),!0}return!1}(g,c)){h=!0;continue}e(g,c)&&(h=!0)}return h?g:null}function g(a){let f=d(a);if(!f)return null;let g=c();g.source="json","string"==typeof f.model&&f.model&&(g.model=f.model);let h=f.usage;return h&&"object"==typeof h?null!=h.input_tokens||null!=h.output_tokens?(g.inputTokens=b(h.input_tokens),g.outputTokens=b(h.output_tokens),g.cacheReadTokens=b(h.cache_read_input_tokens),g.cacheCreationTokens=b(h.cache_creation_input_tokens),g.complete=!0,"string"==typeof f.stop_reason&&(g.stopReason=f.stop_reason),g):e(g,f)?g:null:null}function h(a){return/\/count_tokens\b/.test(String(a||""))}function i(a){return a.inputTokens+a.cacheReadTokens+a.cacheCreationTokens}a.exports={extractUsageFromBody:function({provider:a,body:b,contentType:c="",path:d=""}={}){if("string"!=typeof b||!b||b.length>0x1000000||h(d))return null;let e=/event-stream/i.test(String(c||""))||b.includes("\ndata:")||b.startsWith("data:")?f(b,a)||g(b):g(b)||f(b,a);return e&&(e&&(e.inputTokens||e.outputTokens||e.cacheReadTokens||e.cacheCreationTokens)||e.model)?(e.totalTokens=e.inputTokens+e.outputTokens+e.cacheReadTokens+e.cacheCreationTokens,e):null},isTokenCountingEndpoint:h,toTokensJson:function(a){if(!a)return null;let b=i(a),c={input_tokens:a.inputTokens,output_tokens:a.outputTokens,prompt_tokens:b,completion_tokens:a.outputTokens,total_tokens:a.totalTokens,display_total_input_tokens:b,display_new_input_tokens:a.inputTokens,display_cached_input_tokens:a.cacheReadTokens,display_cache_creation_input_tokens:a.cacheCreationTokens,display_output_tokens:a.outputTokens};return a.cacheReadTokens&&(c.cache_read_input_tokens=a.cacheReadTokens),a.cacheCreationTokens&&(c.cache_creation_input_tokens=a.cacheCreationTokens),a.cacheReadTokens&&(c.cached_tokens=a.cacheReadTokens),a.reasoningTokens&&(c.reasoning_tokens=a.reasoningTokens),c},totalInputTokens:i}},90173:(a,b,c)=>{let d=c(29021),e=c(33873),f=c(4984),g=c(55511),{AUDIT_LOG_PATH:h,AUDIT_LOG_DIR:i,ensureAuditDir:j,loadConfig:k}=c(43096),{redactObject:l,scrubString:m}=c(48350),{toTokensJson:n,totalInputTokens:o}=c(86455),{publishRecentUsage:p}=c(87662),q="audit-proxy",r="client",s="provider_response",t=/\/(?:messages|responses|chat\/completions)$|generatecontent$/i,u={expiresAt:0,config:null},v=null,w=null,x=null,y=null,z=null,A=null,B="",C=Promise.resolve(),D=Promise.resolve(),E=0,F=null,G=!1,H=new Map,I={queue:[],workers:new Set,activeWorkers:0,clearing:!1,enqueued:0,written:0,dropped:0,failed:0,localFailed:0,sinkTimeouts:0,flushTimeouts:0,mysqlWritten:0,mysqlFailed:0,mysqlSkipped:0,mysqlSkippedByReason:{},usageWritten:0,usageFailed:0,tokensSeen:0,lastError:null,lastWrittenAt:null};function J(a){let b=Date.now();b-E<6e4||(E=b,console.warn(`[AuditProxy][PromptDB] ${a}`))}function K(a){I.lastError=String(a||"Audit store failure"),console.warn(`[AuditProxy][Store] ${I.lastError}`)}function L(a,b,c=3e4){let d=null;return Promise.race([a,new Promise((a,e)=>{d=setTimeout(()=>{I.sinkTimeouts+=1,e(Error(`${b} timed out after ${c}ms`))},c),d.unref?.()})]).finally(()=>{d&&clearTimeout(d)})}async function M(){let a=Date.now();if(u.expiresAt>a)return u.config;v||(v=Promise.resolve().then(c.bind(c,45903)));let b=await v,d=await b.getPromptLogDbConfig();return u={expiresAt:a+5e3,config:d},d}async function N(){return w||(w=c.e(2661).then(c.bind(c,12661))),w}async function O(a){let b=g.createHash("sha256").update(JSON.stringify({host:a.host,port:Number(a.port||3306),database:a.database,username:a.username,password:a.password,ssl:!!a.ssl})).digest("hex");if(A&&B===b)return A;let d=C.then(async()=>{if(A&&B===b)return A;if(A){try{await A.end()}catch{}A=null,B=""}let d=await c.e(8491).then(c.t.bind(c,38491,19)),e=(d.default||d).createPool({host:a.host,port:Number(a.port||3306),database:a.database,user:a.username,password:a.password,ssl:a.ssl?{rejectUnauthorized:!0}:void 0,connectTimeout:3e3,waitForConnections:!0,connectionLimit:4,maxIdle:4,idleTimeout:6e4,queueLimit:100,enableKeepAlive:!0,keepAliveInitialDelay:3e4});return A=e,B=b,e});return C=d.then(()=>void 0,()=>void 0),d}function P(a){let b=a?new Date(a):new Date;return(Number.isNaN(b.getTime())?new Date:b).toISOString().replace("T"," ").replace("Z","")}function Q(a){if("string"!=typeof a)return a;let b=a.trim();if(!b||!b.startsWith("{")&&!b.startsWith("["))return a;try{return JSON.parse(b)}catch{return a}}function R(a,b=0,c=[]){if(null==a||b>12||c.join("\n").length>=2e5)return c;if("string"==typeof a)return a.trim()&&c.push(a.trim()),c;if(Array.isArray(a)){for(let d of a)R(d,b+1,c);return c}if("object"!=typeof a)return c;for(let[d,e]of Object.entries(a)){let a=d.toLowerCase();["content","text","prompt","input","message","output_text"].includes(a)?R(e,b+1,c):b<8&&["messages","contents","parts","body","request","payload","response","choices","output","item","items"].includes(a)&&R(e,b+1,c)}return c}function S(a){if("string"!=typeof a)return!1;let b=a.trim();return!!b&&!/^\[[^\]]*\]$/.test(b)}function T(a){let b=String(a||"").toLowerCase();return b.includes("claude")?{tool:"claude-code",label:"Claude Code"}:b.includes("codex")?{tool:"codex",label:"Codex"}:{tool:"audit-proxy",label:"Enterprise AI Audit Proxy"}}async function U(a){if(!a)return null;let b=g.createHash("sha256").update(a).digest("hex"),c=Buffer.byteLength(String(a||""),"utf8"),d=await N();return await d.writePayloadFile(b,a),{payloadHash:b,payloadSizeBytes:c}}async function V(a,b,c,d){if(!c)return null;let{payloadHash:e,payloadSizeBytes:f}=c;return await a.query(`INSERT INTO prompt_log_payloads (
       payload_hash, created_at, last_seen_at, content_type, payload_size_bytes, ref_count, payload_json
     ) VALUES (?, ?, ?, ?, ?, 1, NULL)
     ON DUPLICATE KEY UPDATE

package/app/.next-cli-build/server/middleware-build-manifest.js

@@ -1 +1 @@
-globalThis.__BUILD_MANIFEST={polyfillFiles:["static/chunks/polyfills-42372ed130431b0a.js"],devFiles:[],lowPriorityFiles:["static/37upEIDGYuLFmIMLB89va/_buildManifest.js","static/37upEIDGYuLFmIMLB89va/_ssgManifest.js"],rootMainFiles:["static/chunks/webpack-0496746bc1f1318c.js","static/chunks/4bd1b696-e356ca5ba0218e27.js","static/chunks/3794-e569667691edc8f7.js","static/chunks/main-app-0a27584eea53a4b0.js"],rootMainFilesTree:{},pages:{"/_app":[]}};
+globalThis.__BUILD_MANIFEST={polyfillFiles:["static/chunks/polyfills-42372ed130431b0a.js"],devFiles:[],lowPriorityFiles:["static/OppdqjPvpwlaAITRb7xYX/_buildManifest.js","static/OppdqjPvpwlaAITRb7xYX/_ssgManifest.js"],rootMainFiles:["static/chunks/webpack-0496746bc1f1318c.js","static/chunks/4bd1b696-e356ca5ba0218e27.js","static/chunks/3794-e569667691edc8f7.js","static/chunks/main-app-0a27584eea53a4b0.js"],rootMainFilesTree:{},pages:{"/_app":[]}};