module.exports=[254799,(a,b,c)=>{b.exports=a.x("crypto",()=>require("crypto"))},419124,136253,994267,a=>{"use strict";let b,c=new Set;function d(a,b){c.has(a)||(c.add(a),console.warn(`[BridgeLink] ${b}`))}function e(a,b,c){let d=c instanceof Error?c.stack||c.message:null!=c?String(c):"";console.error(`[${a}] ${b}${d?": "+d:""}`)}async function f(){let{Agent:a}=await import("undici"),b=process.env.BRIDGELINK_CA_CERT;if(b){let c,{readFileSync:f}=await import("node:fs");try{c=f(b)}catch(a){throw e("tls",`BRIDGELINK_CA_CERT is set but the file could not be read (${b}). The BridgeLink hop is pinned to this CA, so requests will fail until the file is readable. Fix the path or permissions (the container runs as UID 1000).`,a),Error(`Unable to read BRIDGELINK_CA_CERT at ${b}`)}return d("tls-pinned",`TLS verification PINNED to BRIDGELINK_CA_CERT (${b}) for the BridgeLink hop.`),new a({connect:{ca:c,rejectUnauthorized:!0}})}return d("tls-relaxed","TLS certificate verification is RELAXED for the BridgeLink server hop (self-signed certificates are accepted). Set BRIDGELINK_CA_CERT to pin a CA and enable full verification. All other outbound TLS verifies normally."),new a({connect:{rejectUnauthorized:!1}})}async function g(a,c){let d=await function(){if(!b){let a=f();a.catch(()=>{b===a&&(b=void 0)}),b=a}return b}();return fetch(a,{...c??{},dispatcher:d})}function h(a){let b;if(!a)return null;try{b=new URL(a.trim())}catch{return null}if("https:"!==b.protocol)return null;let c=b.port?`:${b.port}`:"";return`https://${b.hostname.toLowerCase()}${c}`}function i(){return"1"===process.env.BL_ALLOW_ANY_SERVER}function j(){d("open-mode","OPEN MODE: BridgeLink server allowlist is DISABLED (BL_ALLOW_ANY_SERVER=1). Any server URL supplied by a client will be proxied. Never set this on a shared or internet-facing deployment.")}function k(a){try{return new URL(`http://${a}`).hostname.toLowerCase()||null}catch{return null}}function l(a){let b=process.env.BRIDGELINK_PUBLIC_HOST;if(b){let a=k(b.trim());if(a)return`https://${a}:8443`}if(process.env.TRUST_PROXY?.toLowerCase()!=="false"){let b=a.headers.get("host");if(b){let a=k(b);if(a)return`https://${a}:8443`}}return null}a.s(["logServerError",0,e,"logStartupWarn",0,d],136253),a.s(["fetchBridgeLink",0,g],419124),a.s(["resolveAllowedServer",0,function(a){let b=a.headers.get("x-bl-server")??process.env.BRIDGELINK_SERVER_URL??null;if(!b)return{error:"No BridgeLink server configured"};let c=h(b);if(!c)return{error:"Requested server is not allowed"};if(i())return j(),{url:c};let{servers:e}=function(a){if(i())return j(),{mode:"open",servers:[],defaultServer:l(a)??h(process.env.BRIDGELINK_SERVER_URL)??""};let b=function(){let a=process.env.BRIDGELINK_ALLOWED_SERVERS;if(!a)return[];let b=[];for(let c of a.split(",")){let a=c.trim();if(!a)continue;let e=h(a);e?b.includes(e)||b.push(e):d(`bad-allow:${a}`,`Ignoring invalid BRIDGELINK_ALLOWED_SERVERS entry (must be an absolute https URL): ${a}`)}return b}();if(b.length>0)return{mode:"multi",servers:b,defaultServer:b[0]};let c=h(process.env.BRIDGELINK_SERVER_URL);if(c)return{mode:"single",servers:[c],defaultServer:c};let e=l(a);return{mode:"sameHost",servers:e?[e]:[],defaultServer:e??""}}(a);return e.includes(c)?{url:c}:{error:"Requested server is not allowed"}}],994267)}];

//# sourceMappingURL=%5Broot-of-the-server%5D__1v6r8uy._.js.map