@agenthippo-ai/agenthippo 1.110.9 → 1.110.19

package/out/cli/serve-hardening.js

@@ -1,607 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.TurnGate = exports.TURN_LIMIT_BUSY_MESSAGE = exports.RATE_LIMIT_BUSY_MESSAGE = exports.TURN_GATE_BUSY_MESSAGE = exports.TURN_GATE_RETRY_AFTER_SECONDS = exports.TURN_QUEUE_ENV = exports.MAX_CONCURRENT_TURNS_ENV = exports.TurnLimiter = exports.SESSION_WITHOUT_USER_REASON = exports.IDENTITY_HEADER_ENV = exports.PIN_ONLY_IDENTITY_HEADERS = exports.RateLimiter = exports.XFF_TRUSTED_HOPS_ENV = exports.CONTAINER_SERVE_HOST = exports.SERVE_HOST_ENV = exports.DEFAULT_BIND_HOST = exports.DEFAULT_MAX_BODY_BYTES = void 0;
-exports.resolveStateDir = resolveStateDir;
-exports.resolveAnalyticsSessionsDir = resolveAnalyticsSessionsDir;
-exports.isLoopbackHost = isLoopbackHost;
-exports.resolveBindHost = resolveBindHost;
-exports.clientIp = clientIp;
-exports.identityHeaderAdvice = identityHeaderAdvice;
-exports.resolveUserId = resolveUserId;
-exports.resolveDataToken = resolveDataToken;
-exports.peerToUserId = peerToUserId;
-exports.userNamespaceHash = userNamespaceHash;
-exports.resolveServeSessionKey = resolveServeSessionKey;
-exports.corsHeaders = corsHeaders;
-exports.createTurnGateFromEnv = createTurnGateFromEnv;
-exports.createRejectionWarner = createRejectionWarner;
-exports.readBodyWithCap = readBodyWithCap;
-/**
- * Serve helpers: state-dir resolution, identity header reading, CORS, turn limiting, body cap.
- *
- * Auth and credential checking are the deploy layer's responsibility (Caddy, Cloud Run IAP,
- * Databricks Apps SSO, etc.). Serve trusts the identity headers set by the layer in front;
- * it does not validate tokens or enforce bearer keys itself.
- *
- * SECURITY CONTRACT: serve trusts the identity and data-token headers below unconditionally.
- * It MUST sit behind a proxy that (a) authenticates the caller and sets the identity header,
- * and (b) STRIPS any client-supplied copies of these headers on the way in.
- */
-const os = __importStar(require("os"));
-const path = __importStar(require("path"));
-const crypto = __importStar(require("crypto"));
-const paths_1 = require("../utils/paths");
-/** Default cap on a single request body (1 MiB). Chat messages are small; large bodies are abuse or bugs. */
-exports.DEFAULT_MAX_BODY_BYTES = 1024 * 1024;
-/**
- * Resolve where session state is persisted. Precedence:
- *   1. explicit --state-dir
- *   2. AGENTHIPPO_HOME (the documented container mount point)
- *   3. tmpdir (dev/local only; lost on restart)
- *
- * Returns `{ dir, ephemeral }` so the caller can warn when ephemeral state is
- * detected in a long-lived deployment.
- */
-function resolveStateDir(stateDirOpt, env = process.env) {
-    const explicit = stateDirOpt?.trim();
-    if (explicit) {
-        return { dir: path.resolve(explicit), ephemeral: false };
-    }
-    const home = env.AGENTHIPPO_HOME?.trim() || env.AGENTIDE_HOME?.trim();
-    if (home) {
-        return { dir: path.join(path.resolve(home), 'serve-state'), ephemeral: false };
-    }
-    return { dir: path.join(os.tmpdir(), 'agenthippo-server'), ephemeral: true };
-}
-/**
- * Where serve's Layer 2 analytics (tool-call/warrant JSONL) should live. Precedence:
- *   1. AGENT_HOME_DIR / AGENTHIPPO_HOME set → getAgentideHome()/analytics/sessions — the
- *      exact location sessionJsonlFleet.ts and query-analytics.sh already scan by default,
- *      so this data stays discoverable to Spotlight/DuckDB.
- *   2. Neither set, but the resolved state dir is non-ephemeral (an explicit --state-dir
- *      was given) → <stateDir>/analytics/sessions. Not the canonical scan location, but
- *      still durable — never regress below whatever durability the caller already
- *      established just to be discoverable.
- *   3. Neither set and state is ephemeral (no --state-dir, no home-dir env var at all) →
- *      falls through to getAgentideHome()'s own os.homedir() default, matching the
- *      already-correct IDE-local behavior — nothing durable was configured either way.
- */
-function resolveAnalyticsSessionsDir(stateDir, stateDirEphemeral, env = process.env) {
-    const homeOverride = env.AGENT_HOME_DIR?.trim() || env.AGENTHIPPO_HOME?.trim();
-    if (!homeOverride && !stateDirEphemeral) {
-        return path.join(stateDir, 'analytics', 'sessions');
-    }
-    return path.join((0, paths_1.getAgentideHome)(), 'analytics', 'sessions');
-}
-/** Loopback default — safe everywhere a human runs `serve` locally. */
-exports.DEFAULT_BIND_HOST = '127.0.0.1';
-/** True when a bind address is reachable only from this machine. */
-function isLoopbackHost(host) {
-    const h = host.trim().toLowerCase().replace(/^\[|\]$/g, '');
-    return h === 'localhost' || h === '::1' || /^127\./.test(h);
-}
-/** Env var for the listen address (used by generated deploy Dockerfiles). */
-exports.SERVE_HOST_ENV = 'AGENTHIPPO_SERVE_HOST';
-/** Bind address baked into container deploy artifacts (Docker / Cloud Run sidecars). */
-exports.CONTAINER_SERVE_HOST = '0.0.0.0';
-/**
- * Resolve the listen address. Precedence: explicit `--host` → AGENTHIPPO_SERVE_HOST → 127.0.0.1.
- *
- * Defaults to loopback so a local `serve` is never reachable off-box by accident. Containers
- * (where the SSO proxy reaches the agent over a Docker network) MUST opt into `0.0.0.0` —
- * generated deploy artifacts set `AGENTHIPPO_SERVE_HOST=0.0.0.0` for exactly this reason.
- */
-function resolveBindHost(hostOpt, env = process.env) {
-    return hostOpt?.trim() || env.AGENTHIPPO_SERVE_HOST?.trim() || exports.DEFAULT_BIND_HOST;
-}
-/** Env var: number of trusted proxy hops in front of serve (default 1 — the single Caddy). */
-exports.XFF_TRUSTED_HOPS_ENV = 'AGENTHIPPO_XFF_TRUSTED_HOPS';
-/**
- * Best-effort client IP for rate-limiting keys.
- *
- * Each trusted proxy appends the IP it observed to `X-Forwarded-For`, so with N trusted hops
- * the real client is the Nth entry from the right (a client-spoofed left-most entry is just
- * prepended and never reached). Default is 1 (the documented single Caddy). Behind
- * Cloudflare Tunnel → Caddy there are two hops — Caddy appends cloudflared's container IP,
- * which is identical for every client, so leaving hops at 1 there collapses all users into one
- * rate-limit bucket. Set AGENTHIPPO_XFF_TRUSTED_HOPS=2 for the tunnel profile.
- * Falls back to the socket address for direct/local callers. This is a coarse abuse key, not
- * an identity — never use it for authorization.
- */
-function clientIp(req, env = process.env) {
-    const xff = req.headers['x-forwarded-for'];
-    const raw = Array.isArray(xff) ? xff[0] : xff;
-    if (raw) {
-        const parts = raw.split(',').map((s) => s.trim()).filter(Boolean);
-        if (parts.length > 0) {
-            const hopsRaw = Number(env[exports.XFF_TRUSTED_HOPS_ENV]);
-            const hops = Number.isInteger(hopsRaw) && hopsRaw >= 1 ? hopsRaw : 1;
-            return parts[Math.max(0, parts.length - hops)];
-        }
-    }
-    return req.socket?.remoteAddress || 'unknown';
-}
-/**
- * Fixed-window request rate limiter (per key, in-memory, per-process). Complements the
- * per-session TurnLimiter: keying on a stable identity (user id, or client IP) closes the
- * "rotate session_id to bypass" gap. `maxPerWindow <= 0` disables it.
- */
-class RateLimiter {
-    maxPerWindow;
-    windowMs;
-    hits = new Map();
-    /** Cap the key map so a flood of distinct keys can't grow memory unbounded. */
-    static MAX_KEYS = 100_000;
-    constructor(maxPerWindow, windowMs = 60_000) {
-        this.maxPerWindow = maxPerWindow;
-        this.windowMs = windowMs;
-    }
-    /** Returns true if the request is allowed (and records it); false when the window cap is hit. */
-    tryConsume(key, now = Date.now()) {
-        if (!Number.isFinite(this.maxPerWindow) || this.maxPerWindow <= 0) {
-            return true; // disabled
-        }
-        const entry = this.hits.get(key);
-        if (!entry || entry.resetAt <= now) {
-            if (this.hits.size >= RateLimiter.MAX_KEYS) {
-                this.prune(now);
-            }
-            this.hits.set(key, { count: 1, resetAt: now + this.windowMs });
-            return true;
-        }
-        if (entry.count >= this.maxPerWindow) {
-            return false;
-        }
-        entry.count += 1;
-        return true;
-    }
-    /** Seconds until the key's window resets — for a Retry-After header. */
-    retryAfterSeconds(key, now = Date.now()) {
-        const entry = this.hits.get(key);
-        if (!entry) {
-            return Math.ceil(this.windowMs / 1000);
-        }
-        return Math.max(1, Math.ceil((entry.resetAt - now) / 1000));
-    }
-    prune(now) {
-        for (const [key, entry] of this.hits) {
-            if (entry.resetAt <= now) {
-                this.hits.delete(key);
-            }
-        }
-        if (this.hits.size >= RateLimiter.MAX_KEYS) {
-            this.hits.clear();
-        }
-    }
-}
-exports.RateLimiter = RateLimiter;
-/**
- * Identity headers trusted when NOTHING is pinned.
- *
- * Every entry here is a header that exactly one platform sets AND owns the request path for, so
- * a client-supplied copy cannot reach serve without that platform having been bypassed entirely.
- *
- * `x-agent-user` is deliberately NOT in this list, and this is a breaking change for anything
- * that relied on it being trusted by default. It is AgentHippo's own canonical header — the name
- * an arbitrary client is most likely to guess — it belongs to no platform that strips it, and it
- * used to sit FIRST, so it beat every platform header that follows. The consequence on any
- * deployment that had not pinned `AGENTHIPPO_IDENTITY_HEADER`: any HTTP client could send
- * `x-agent-user: victim@example.com` and be namespaced into that user's session state, attach to
- * their conversation, and be issued a data-plane turn nonce scoped to them. Cloud Run IAP makes
- * this concrete — it strips `X-Goog-*` and forwards a client-supplied `x-agent-user` untouched.
- *
- * It remains perfectly valid as a PINNED header (`AGENTHIPPO_IDENTITY_HEADER=x-agent-user`),
- * which is what a deployment whose proxy really does set and strip it should use — including the
- * Caddy `forward_auth` flow, where `auth-broker/server.ts` sets `X-Agent-User` on `/api/ide/me`
- * so Caddy can copy a VALIDATED identity upstream. That direction is the correct and only source
- * of the header, and it is unaffected: pinning is exactly the declaration that it is trustworthy.
- */
-const HEADER_ALIASES = [
-    'x-forwarded-email', // Databricks Apps
-    'x-forwarded-preferred-username', // Databricks Apps
-    'x-goog-authenticated-user-email', // Cloud Run IAP (prefixed value, stripped below)
-    'cf-access-authenticated-user-email', // Cloudflare Access
-];
-/**
- * Headers that are only ever trusted when explicitly pinned.
- *
- * Kept as a named list rather than deleted, because "why is my identity header ignored?" needs an
- * answer, and `identityHeaderAdvice` gives one that names the env var to set.
- */
-exports.PIN_ONLY_IDENTITY_HEADERS = ['x-agent-user'];
-/** Env var: pin the single identity header the deploy layer actually sets (and strips). */
-exports.IDENTITY_HEADER_ENV = 'AGENTHIPPO_IDENTITY_HEADER';
-/**
- * Boot-time advice about identity trust. Returns the lines serve must print, loudest first.
- *
- * Not a refusal. Refusing to boot without a pin would stop deployments that are configured
- * correctly today (Databricks Apps, Cloudflare Access) and whose platform header is genuinely
- * unforgeable — a fail-closed default that mostly punishes the compliant is not a security win.
- * What was actually dangerous was `x-agent-user` being trusted by default, and that is now gone.
- */
-function identityHeaderAdvice(env = process.env, bindHost) {
-    const pinned = env[exports.IDENTITY_HEADER_ENV]?.trim();
-    if (pinned) {
-        return [];
-    }
-    // Severity follows reachability. On loopback nothing off-box can reach the port, so the same
-    // paragraph every local run is warning fatigue — and fatigue is why the message gets ignored
-    // on the deploy where it decides whether strangers can name themselves as another user.
-    const host = bindHost?.trim();
-    if (host && isLoopbackHost(host)) {
-        return [
-            `${exports.IDENTITY_HEADER_ENV} is not set. Fine for this loopback bind; pin it before exposing ` +
-                `serve on a network interface.`,
-        ];
-    }
-    return [
-        ...(host
-            ? [`serve is bound to ${host} — reachable beyond this machine — with no ${exports.IDENTITY_HEADER_ENV} pinned. ` +
-                    `Anyone who can reach this port is trusted to state who they are.`]
-            : []),
-        `${exports.IDENTITY_HEADER_ENV} is not set, so identity falls back to the platform header aliases ` +
-            `(${HEADER_ALIASES.join(', ')}). That is only safe when your proxy sets AND STRIPS every one of them. ` +
-            `Pin the single header your deploy layer really controls, e.g. ${exports.IDENTITY_HEADER_ENV}=x-goog-authenticated-user-email.`,
-        `NOTE: ${exports.PIN_ONLY_IDENTITY_HEADERS.join(', ')} is NO LONGER trusted by default — it is not stripped by any ` +
-            `platform, so an arbitrary client could send it and be namespaced as another user. If your proxy does set it ` +
-            `(the Caddy forward_auth / auth-broker flow does), pin it: ${exports.IDENTITY_HEADER_ENV}=x-agent-user.`,
-    ];
-}
-/**
- * Resolve the end-user identity for a request.
- *
- * Proxy headers win over the request body. When AGENTHIPPO_IDENTITY_HEADER pins
- * trust to one header, that pin is a hard boundary: if the pinned header is
- * absent, identity resolves to undefined (never the request body) — a deployment
- * that pins a header has declared it has a real proxy-verified identity, so an
- * unauthenticated caller must not be able to name themselves via the client-
- * controlled body. Body fallback is dev/internal convenience for the *unpinned*
- * case only (e.g. direct curl against a local serve with no identity proxy) —
- * and it must be OPTED INTO via AGENTHIPPO_ALLOW_BODY_IDENTITY=1 (serve-v4 §10
- * hole 3). Before the gate it was safe "by convention": any deployment that
- * forgot to pin a header silently let every caller name an arbitrary victim.
- *
- * The alias-list default (used when unpinned) is only safe when the proxy strips
- * or overwrites ALL of the aliases; platforms that strip only their own header
- * (Cloud Run IAP strips `X-Goog-*` but forwards a client-supplied `x-agent-user`
- * untouched, which the alias list checks first) MUST pin theirs — deploy
- * artifacts set it (e.g. cloudrun-deploy.sh pins `x-goog-authenticated-user-email`)
- * so an authenticated caller cannot impersonate another user.
- *
- * Resolves identity for `analyticsUserId` attribution and the request-scoped
- * credential context (per-user data scoping). Not folded into the session key —
- * session continuity uses the client-supplied `session_id`.
- *
- * Per-turn *data credentials* (OBO token, e.g. X-Forwarded-Access-Token) are
- * handled by resolveDataToken — not read here.
- */
-function resolveUserId(headers, body, env = process.env) {
-    const pinned = env[exports.IDENTITY_HEADER_ENV]?.trim().toLowerCase();
-    const names = pinned ? [pinned] : HEADER_ALIASES;
-    for (const name of names) {
-        const v = headers[name];
-        const raw = (Array.isArray(v) ? v[0] : v)?.trim();
-        if (raw) {
-            // IAP sends "accounts.google.com:user@x.com"; keep the email half.
-            const colon = raw.lastIndexOf(':');
-            const value = colon >= 0 && raw.slice(colon + 1).includes('@') ? raw.slice(colon + 1) : raw;
-            return value;
-        }
-    }
-    if (pinned) {
-        // Pinned but absent: fail closed. Falling back to the body here would let any
-        // caller that merely reaches this port (proxy misconfiguration, direct network
-        // access, gcloud run services proxy bypassing IAP) name an arbitrary victim.
-        return undefined;
-    }
-    // Unpinned body identity is an explicit opt-in, never a default (§10 hole 3).
-    if (env.AGENTHIPPO_ALLOW_BODY_IDENTITY?.trim() !== '1') {
-        return undefined;
-    }
-    const fromBody = body?.user_id?.trim();
-    return fromBody || undefined;
-}
-const DATA_TOKEN_HEADERS = [
-    'x-forwarded-access-token', // Databricks Apps OBO token
-    'x-agent-data-token', // AgentHippo generic per-turn data credential
-];
-/**
- * Resolve the per-turn *data* credential (the OBO token), distinct from the
- * identity in resolveUserId. Fed into the request-scoped credential context so
- * a data tool can act as the asking user. serve-v3 §11.1 (Design B).
- *
- * Like the identity headers, this is trusted unconditionally and is only safe
- * behind a proxy that strips client-supplied copies (see the module SECURITY
- * CONTRACT above).
- */
-function resolveDataToken(headers) {
-    for (const name of DATA_TOKEN_HEADERS) {
-        const v = headers[name];
-        const raw = (Array.isArray(v) ? v[0] : v)?.trim();
-        if (raw) {
-            return raw;
-        }
-    }
-    return undefined;
-}
-/**
- * Map a gateway channel sender (PeerInfo) to a stable `user_id` (serve-v3 §11 / #4).
- * Prefers the stable channel id, namespaced by channel, so the Slack/Telegram
- * sender becomes the user_id that drives per-user attribution and data scoping —
- * extending the per-user-permission wedge to channel surfaces.
- */
-function peerToUserId(peer) {
-    if (!peer) {
-        return undefined;
-    }
-    const id = peer.senderId?.trim() || peer.senderUsername?.trim() || peer.senderName?.trim();
-    if (!id) {
-        return undefined;
-    }
-    const channel = peer.channel?.trim();
-    return channel ? `${channel}:${id}` : id;
-}
-/** Stable reason code when a session_id is presented without a verified user on a pinned-identity deployment. */
-exports.SESSION_WITHOUT_USER_REASON = 'session_without_verified_user';
-/** Filesystem/S3-safe per-user namespace segment (user ids are emails/subjects — never raw path segments). */
-function userNamespaceHash(userId) {
-    return crypto.createHash('sha256').update(userId).digest('hex').slice(0, 16);
-}
-/**
- * Namespace the session key by the verified user (secure-obo-design §3.4 / §8 Phase 0).
- *
- * `session_id` is client-supplied; un-namespaced, any authenticated user who guesses another
- * user's session_id attaches to that session's conversation state (which holds the other
- * user's row-filtered query results). Prefixing the key with a hash of the verified user makes
- * cross-user attachment structurally impossible without changing client behavior.
- *
- * Fail-closed rule: when the deployment pins an identity header (it declared a real
- * proxy-verified identity exists) and a request carries a session_id but no verified user,
- * reject — never let an unauthenticated caller name a session. Unpinned deployments
- * (local dev, no identity boundary at all) keep today's raw-key behavior.
- */
-function resolveServeSessionKey(sessionId, userId, env = process.env) {
-    const sid = sessionId?.trim();
-    const uid = userId?.trim();
-    if (uid) {
-        return { sessionKey: `u${userNamespaceHash(uid)}--${sid || 'default'}` };
-    }
-    if (sid && env[exports.IDENTITY_HEADER_ENV]?.trim()) {
-        return { sessionKey: '', rejected: exports.SESSION_WITHOUT_USER_REASON };
-    }
-    return { sessionKey: sid || 'anon-unknown' };
-}
-/** Build CORS headers. Serve is always behind a proxy; CORS is wide-open here. */
-function corsHeaders() {
-    return {
-        'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
-        'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-Agent-User',
-        'Access-Control-Allow-Origin': '*',
-    };
-}
-/**
- * Per-session turn admission control. Caps the number of turns a single
- * conversation may run (abuse / runaway-loop guard for exposed deployments).
- * In-memory and per-process — sufficient for single-container tiers; a shared
- * store is a later concern.
- */
-class TurnLimiter {
-    maxPerSession;
-    counts = new Map();
-    constructor(maxPerSession) {
-        this.maxPerSession = maxPerSession;
-    }
-    /** Returns true if the turn is allowed (and records it); false when the cap is exceeded. */
-    tryConsume(sessionKey) {
-        if (!Number.isFinite(this.maxPerSession) || this.maxPerSession <= 0) {
-            return true; // disabled
-        }
-        const current = this.counts.get(sessionKey) ?? 0;
-        if (current >= this.maxPerSession) {
-            return false;
-        }
-        this.counts.set(sessionKey, current + 1);
-        return true;
-    }
-    reset(sessionKey) {
-        this.counts.delete(sessionKey);
-    }
-}
-exports.TurnLimiter = TurnLimiter;
-/** Env: max concurrent engine turns per process (default 10). `0` disables the gate. */
-exports.MAX_CONCURRENT_TURNS_ENV = 'AGENTHIPPO_MAX_CONCURRENT_TURNS';
-/** Env: bounded FIFO waiter depth when at inflight cap (default 20). */
-exports.TURN_QUEUE_ENV = 'AGENTHIPPO_TURN_QUEUE';
-/** Fixed Retry-After seconds when the turn gate rejects (matches default queue timeout). */
-exports.TURN_GATE_RETRY_AFTER_SECONDS = 15;
-/** User-visible capacity message for gateway channels (Slack/Telegram can't receive HTTP 429). */
-exports.TURN_GATE_BUSY_MESSAGE = 'At capacity — please retry in a moment';
-/** User-visible message for gateway channels when the per-identity RateLimiter rejects. */
-exports.RATE_LIMIT_BUSY_MESSAGE = 'Rate limit exceeded — please retry in a moment';
-/** User-visible message for gateway channels when the per-session TurnLimiter rejects. */
-exports.TURN_LIMIT_BUSY_MESSAGE = 'Per-session turn limit reached';
-/**
- * Process-wide concurrency gate for engine turns (semaphore + bounded FIFO).
- *
- * Caps simultaneous engine subprocesses so a burst cannot OOM the container.
- * `maxInflight <= 0` disables. Waiters time out after `queueTimeoutMs` (burst
- * absorber, not a job queue). Rejected callers get `null` — HTTP maps that to
- * 429 + Retry-After; the gateway path emits a short channel message instead.
- */
-class TurnGate {
-    maxInflight;
-    maxQueue;
-    queueTimeoutMs;
-    inflightCount = 0;
-    waiters = [];
-    constructor(maxInflight, maxQueue, queueTimeoutMs = exports.TURN_GATE_RETRY_AFTER_SECONDS * 1000) {
-        this.maxInflight = maxInflight;
-        this.maxQueue = maxQueue;
-        this.queueTimeoutMs = queueTimeoutMs;
-    }
-    /**
-     * Acquire a turn slot. Resolves with a `release()` callback, or `null` when
-     * the queue is full or the wait timed out. Always call `release()` in a
-     * `finally` when non-null.
-     */
-    async acquire() {
-        if (!Number.isFinite(this.maxInflight) || this.maxInflight <= 0) {
-            return () => { };
-        }
-        if (this.inflightCount < this.maxInflight) {
-            this.inflightCount += 1;
-            return () => this.releaseSlot();
-        }
-        if (this.waiters.length >= this.maxQueue) {
-            return null;
-        }
-        return new Promise((resolve) => {
-            let settled = false;
-            const settle = (release) => {
-                if (settled) {
-                    // Timed out after a slot was already offered — give the slot back.
-                    if (release) {
-                        release();
-                    }
-                    return;
-                }
-                settled = true;
-                clearTimeout(timer);
-                resolve(release);
-            };
-            const entry = {
-                resolve: settle,
-                timer: null,
-            };
-            const timer = setTimeout(() => {
-                const idx = this.waiters.indexOf(entry);
-                if (idx >= 0) {
-                    this.waiters.splice(idx, 1);
-                }
-                settle(null);
-            }, this.queueTimeoutMs);
-            entry.timer = timer;
-            this.waiters.push(entry);
-        });
-    }
-    releaseSlot() {
-        const next = this.waiters.shift();
-        if (next) {
-            // Transfer the slot to the head waiter — do not decrement inflight.
-            next.resolve(() => this.releaseSlot());
-            return;
-        }
-        this.inflightCount = Math.max(0, this.inflightCount - 1);
-    }
-    get inflight() {
-        return this.inflightCount;
-    }
-    get queued() {
-        return this.waiters.length;
-    }
-    get max() {
-        return this.maxInflight > 0 ? this.maxInflight : 0;
-    }
-}
-exports.TurnGate = TurnGate;
-/** Build a TurnGate from env (serve-v4 P0.1). Defaults: 10 inflight, 20 queued. */
-function createTurnGateFromEnv(env = process.env) {
-    const inflightRaw = Number(env[exports.MAX_CONCURRENT_TURNS_ENV] ?? 10);
-    const queueRaw = Number(env[exports.TURN_QUEUE_ENV] ?? 20);
-    const maxInflight = Number.isFinite(inflightRaw) ? inflightRaw : 10;
-    const maxQueue = Number.isFinite(queueRaw) && queueRaw >= 0 ? queueRaw : 20;
-    return new TurnGate(maxInflight, maxQueue);
-}
-/**
- * Rate-limited rejection logger — at most one warn per `intervalMs` so a flood
- * of 429s does not spam the console.
- */
-function createRejectionWarner(intervalMs = 5_000) {
-    let lastAt = 0;
-    return (msg) => {
-        const now = Date.now();
-        if (now - lastAt < intervalMs) {
-            return;
-        }
-        lastAt = now;
-        console.warn(msg);
-    };
-}
-/**
- * Read a request body with a hard size cap. Past the cap it stops accumulating
- * and rejects with a `tooLarge`-tagged error so the caller can respond 413.
- *
- * Deliberately does NOT destroy the socket here: destroying mid-upload resets
- * the connection before the 413 can flush (the client only ever sees the
- * interim 100-continue). We detach our listeners and let the handler send 413
- * with `Connection: close`. Replaces serve's unbounded body accumulation.
- */
-function readBodyWithCap(req, maxBytes = exports.DEFAULT_MAX_BODY_BYTES) {
-    return new Promise((resolve, reject) => {
-        let size = 0;
-        const chunks = [];
-        const onData = (chunk) => {
-            size += chunk.length;
-            if (size > maxBytes) {
-                cleanup();
-                const err = new Error(`Request body exceeds ${maxBytes} bytes`);
-                err.tooLarge = true;
-                reject(err);
-                return;
-            }
-            chunks.push(chunk);
-        };
-        const onEnd = () => {
-            cleanup();
-            resolve(Buffer.concat(chunks).toString('utf8'));
-        };
-        const onError = (err) => {
-            cleanup();
-            reject(err);
-        };
-        const cleanup = () => {
-            req.off('data', onData);
-            req.off('end', onEnd);
-            req.off('error', onError);
-        };
-        req.on('data', onData);
-        req.on('end', onEnd);
-        req.on('error', onError);
-    });
-}