* Returns the HMAC key used to hash relay tokens. * Uses TOKEN_HMAC_SECRET if set; otherwise falls back to ENCRYPTION_SECRET. * Both are acceptable;

* Returns the HMAC-SHA256 hex digest of `token` using `key`.

* Hash a plaintext relay token for safe storage.

* Create a new user. * * @returns {{ id: string, token: string }} * `token` is the **plaintext** random token — returned to the caller ONCE, *

* Forward a request to the AI provider. * Returns a node-fetch Response (streaming-capable). * * @param {string} provider - Provider name from PROV

* Look up a user by their plaintext relay token. * Hashes the token before querying so plaintext is never compared in SQL.

Convert a dotted-decimal IPv4 string to a 32-bit unsigned integer.

* Parse a colon-separated IPv6 address string (without surrounding brackets) * into a 128-bit BigInt. Returns null on any parse error.

Return true if ipStr falls inside any blocked CIDR range.

Return true if an IPv6 address string (without brackets) is in a blocked range.

* Validate that a client-supplied base URL is safe to use as an upstream * target. Throws RelayUrlValidationError on any policy violation. * * Rul

* requireAppSecret — guards POST /users when APP_SECRET is configured. * If APP_SECRET env var is set, the caller must supply: * Authorization: Be