module.exports=[254799,(e,r,t)=>{r.exports=e.x("crypto",()=>require("crypto"))},831073,e=>{"use strict";let r=new Set;e.s(["logServerError",0,function(e,r,t){let n=t instanceof Error?t.stack||t.message:null!=t?String(t):"";console.error(`[${e}] ${r}${n?": "+n:""}`)},"logStartupWarn",0,function(e,t){r.has(e)||(r.add(e),console.warn(`[BridgeLink] ${t}`))}])},633625,e=>{"use strict";var r=e.i(831073);function t(e){let r;if(!e)return null;try{r=new URL(e.trim())}catch{return null}if("https:"!==r.protocol)return null;let t=r.port?`:${r.port}`:"";return`https://${r.hostname.toLowerCase()}${t}`}function n(){return"1"===process.env.BL_ALLOW_ANY_SERVER}function i(){(0,r.logStartupWarn)("open-mode","OPEN MODE: BridgeLink server allowlist is DISABLED (BL_ALLOW_ANY_SERVER=1). Any server URL supplied by a client will be proxied. Never set this on a shared or internet-facing deployment.")}function o(e){try{return new URL(`http://${e}`).hostname.toLowerCase()||null}catch{return null}}function s(e){let r=process.env.BRIDGELINK_PUBLIC_HOST;if(r){let e=o(r.trim());if(e)return`https://${e}:8443`}if(process.env.TRUST_PROXY?.toLowerCase()!=="false"){let r=e.headers.get("host");if(r){let e=o(r);if(e)return`https://${e}:8443`}}return null}function l(e){if(n())return i(),{mode:"open",servers:[],defaultServer:s(e)??t(process.env.BRIDGELINK_SERVER_URL)??""};let o=function(){let e=process.env.BRIDGELINK_ALLOWED_SERVERS;if(!e)return[];let n=[];for(let i of e.split(",")){let e=i.trim();if(!e)continue;let o=t(e);o?n.includes(o)||n.push(o):(0,r.logStartupWarn)(`bad-allow:${e}`,`Ignoring invalid BRIDGELINK_ALLOWED_SERVERS entry (must be an absolute https URL): ${e}`)}return n}();if(o.length>0)return{mode:"multi",servers:o,defaultServer:o[0]};let l=t(process.env.BRIDGELINK_SERVER_URL);if(l)return{mode:"single",servers:[l],defaultServer:l};let u=s(e);return{mode:"sameHost",servers:u?[u]:[],defaultServer:u??""}}e.s(["getServerConfig",0,l,"resolveAllowedServer",0,function(e){let r=e.headers.get("x-bl-server")??process.env.BRIDGELINK_SERVER_URL??null;if(!r)return{error:"No BridgeLink server configured"};let o=t(r);if(!o)return{error:"Requested server is not allowed"};if(n())return i(),{url:o};let{servers:s}=l(e);return s.includes(o)?{url:o}:{error:"Requested server is not allowed"}}])},581276,e=>{"use strict";let r;var t=e.i(831073);async function n(){let{Agent:e}=await import("undici"),r=process.env.BRIDGELINK_CA_CERT;if(r){let n,{readFileSync:i}=await import("node:fs");try{n=i(r)}catch(e){throw(0,t.logServerError)("tls",`BRIDGELINK_CA_CERT is set but the file could not be read (${r}). The BridgeLink hop is pinned to this CA, so requests will fail until the file is readable. Fix the path or permissions (the container runs as UID 1000).`,e),Error(`Unable to read BRIDGELINK_CA_CERT at ${r}`)}return(0,t.logStartupWarn)("tls-pinned",`TLS verification PINNED to BRIDGELINK_CA_CERT (${r}) for the BridgeLink hop.`),new e({connect:{ca:n,rejectUnauthorized:!0}})}return(0,t.logStartupWarn)("tls-relaxed","TLS certificate verification is RELAXED for the BridgeLink server hop (self-signed certificates are accepted). Set BRIDGELINK_CA_CERT to pin a CA and enable full verification. All other outbound TLS verifies normally."),new e({connect:{rejectUnauthorized:!1}})}async function i(e,t){let i=await function(){if(!r){let e=n();e.catch(()=>{r===e&&(r=void 0)}),r=e}return r}();return fetch(e,{...t??{},dispatcher:i})}e.s(["fetchBridgeLink",0,i])},587744,33298,e=>{"use strict";e.s(["parseCookieHeader",0,function(e){let r={};for(let t of e.split(";")){let e=t.indexOf("=");if(-1===e)continue;let n=t.slice(0,e).trim(),i=t.slice(e+1).trim();n&&(r[n]=i)}return r}],587744);var r=e.i(254799);e.s(["serverHash",0,function(e){return r.default.createHash("sha256").update(e).digest("hex").slice(0,8)}],33298)}];

//# sourceMappingURL=%5Broot-of-the-server%5D__07pzmpt._.js.map