module.exports=[254799,(e,r,t)=>{r.exports=e.x("crypto",()=>require("crypto"))},831073,e=>{"use strict";let r=new Set;e.s(["logServerError",0,function(e,r,t){let n=t instanceof Error?t.stack||t.message:null!=t?String(t):"";console.error(`[${e}] ${r}${n?": "+n:""}`)},"logStartupWarn",0,function(e,t){r.has(e)||(r.add(e),console.warn(`[BridgeLink] ${t}`))}])},633625,e=>{"use strict";var r=e.i(831073);function t(e){let r;if(!e)return null;try{r=new URL(e.trim())}catch{return null}if("https:"!==r.protocol)return null;let t=r.port?`:${r.port}`:"";return`https://${r.hostname.toLowerCase()}${t}`}function n(){return"1"===process.env.BL_ALLOW_ANY_SERVER}function o(){(0,r.logStartupWarn)("open-mode","OPEN MODE: BridgeLink server allowlist is DISABLED (BL_ALLOW_ANY_SERVER=1). Any server URL supplied by a client will be proxied. Never set this on a shared or internet-facing deployment.")}function i(e){try{return new URL(`http://${e}`).hostname.toLowerCase()||null}catch{return null}}function s(e){let r=process.env.BRIDGELINK_PUBLIC_HOST;if(r){let e=i(r.trim());if(e)return`https://${e}:8443`}if(process.env.TRUST_PROXY?.toLowerCase()!=="false"){let r=e.headers.get("host");if(r){let e=i(r);if(e)return`https://${e}:8443`}}return null}function l(e){if(n())return o(),{mode:"open",servers:[],defaultServer:s(e)??t(process.env.BRIDGELINK_SERVER_URL)??""};let i=function(){let e=process.env.BRIDGELINK_ALLOWED_SERVERS;if(!e)return[];let n=[];for(let o of e.split(",")){let e=o.trim();if(!e)continue;let i=t(e);i?n.includes(i)||n.push(i):(0,r.logStartupWarn)(`bad-allow:${e}`,`Ignoring invalid BRIDGELINK_ALLOWED_SERVERS entry (must be an absolute https URL): ${e}`)}return n}();if(i.length>0)return{mode:"multi",servers:i,defaultServer:i[0]};let l=t(process.env.BRIDGELINK_SERVER_URL);if(l)return{mode:"single",servers:[l],defaultServer:l};let u=s(e);return{mode:"sameHost",servers:u?[u]:[],defaultServer:u??""}}e.s(["getServerConfig",0,l,"resolveAllowedServer",0,function(e){let r=e.headers.get("x-bl-server")??process.env.BRIDGELINK_SERVER_URL??null;if(!r)return{error:"No BridgeLink server configured"};let i=t(r);if(!i)return{error:"Requested server is not allowed"};if(n())return o(),{url:i};let{servers:s}=l(e);return s.includes(i)?{url:i}:{error:"Requested server is not allowed"}}])},581276,e=>{"use strict";let r;var t=e.i(831073);async function n(){let{Agent:e}=await import("undici"),r=process.env.BRIDGELINK_CA_CERT;if(r){let n,{readFileSync:o}=await import("node:fs");try{n=o(r)}catch(e){throw(0,t.logServerError)("tls",`BRIDGELINK_CA_CERT is set but the file could not be read (${r}). The BridgeLink hop is pinned to this CA, so requests will fail until the file is readable. Fix the path or permissions (the container runs as UID 1000).`,e),Error(`Unable to read BRIDGELINK_CA_CERT at ${r}`)}return(0,t.logStartupWarn)("tls-pinned",`TLS verification PINNED to BRIDGELINK_CA_CERT (${r}) for the BridgeLink hop.`),new e({connect:{ca:n,rejectUnauthorized:!0}})}return(0,t.logStartupWarn)("tls-relaxed","TLS certificate verification is RELAXED for the BridgeLink server hop (self-signed certificates are accepted). Set BRIDGELINK_CA_CERT to pin a CA and enable full verification. All other outbound TLS verifies normally."),new e({connect:{rejectUnauthorized:!1}})}async function o(e,t){let o=await function(){if(!r){let e=n();e.catch(()=>{r===e&&(r=void 0)}),r=e}return r}();return fetch(e,{...t??{},dispatcher:o})}e.s(["fetchBridgeLink",0,o])},800579,e=>{"use strict";e.s(["resolveCookieSecure",0,function(e){return function({getHeader:e,directTls:r=!1}){let t=process.env.COOKIE_SECURE?.toLowerCase();if("true"===t)return!0;if("false"===t)return!1;if(r||"true"===process.env.HTTPS)return!0;if(process.env.TRUST_PROXY?.toLowerCase()!=="false"){let r=e("x-forwarded-proto");if(r){let e=r.split(",")[0]?.trim().toLowerCase();if("https"===e)return!0;if("http"===e)return!1}}return!0}({getHeader:r=>e.headers.get(r)})}])}];

//# sourceMappingURL=%5Broot-of-the-server%5D__0zmn6tb._.js.map