@magland/mochi 0.3.1

package/dist/lfsstore.js

@@ -0,0 +1,425 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LfsConfigError = void 0;
+exports.lfsKey = lfsKey;
+exports.localLfsDir = localLfsDir;
+exports.localObjectPath = localObjectPath;
+exports.signTransfer = signTransfer;
+exports.verifyTransfer = verifyTransfer;
+exports.createLfsStore = createLfsStore;
+const aws4fetch_1 = require("aws4fetch");
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const ops_1 = require("./ops");
+const layout_1 = require("./layout");
+const scan_1 = require("./scan");
+const session_1 = require("./session");
+// Storage for Git LFS objects. Two backends behind one interface: "s3" issues
+// presigned URLs against any S3-compatible bucket, so large-file bytes never
+// pass through this process; "local" stores objects inside the vault and
+// issues HMAC-signed URLs pointing back at mochi's own transfer routes, so
+// LFS works with no credentials (dev, smoke test, laptop vaults). The choice
+// is made from the environment at startup and never recorded in the vault.
+//
+// Objects are sharded the way git-lfs itself shards them on the client:
+//   <collection>/<repo>.lfs/<oid[0:2]>/<oid[2:4]>/<oid>
+// That is a bucket key as written; on the volume the same shards sit under
+// the repository, at <vault>/collections/<collection>/repos/<repo>.lfs/. The
+// key kept its shape when the vault's layout changed, since a bucket is not
+// the vault's directory and rewriting every key would mean moving objects
+// nobody asked to move.
+const EXPIRES_SECONDS = 3600;
+const DEFAULT_MAX_SIZE = 5_000_000_000; // below the S3 single-PUT ceiling of 5 GB
+class LfsConfigError extends Error {
+}
+exports.LfsConfigError = LfsConfigError;
+// Content-Disposition filenames must stay inside printable ASCII with no
+// quote or backslash, or the header becomes malformed.
+function sanitizeFilename(name) {
+    return name.replace(/[^\x20-\x7e]|["\\]/g, '_');
+}
+// The route layer validates names with isValidName and object ids against
+// /^[0-9a-f]{64}$/ before anything reaches this module. Re-checking here means
+// a future caller that forgets cannot turn a name or an id into a path
+// outside the vault, or into a key outside the repository's own prefix.
+function checkTarget(collection, repo, oid) {
+    if (!(0, scan_1.isValidName)(collection) || !(0, scan_1.isValidName)(repo)) {
+        throw new Error(`invalid collection or repository name for LFS storage: ${collection}/${repo}`);
+    }
+    if (!/^[0-9a-f]{64}$/.test(oid)) {
+        throw new Error('invalid LFS object id');
+    }
+}
+function checkRepoTarget(collection, repo) {
+    if (!(0, scan_1.isValidName)(collection) || !(0, scan_1.isValidName)(repo)) {
+        throw new Error(`invalid collection or repository name for LFS storage: ${collection}/${repo}`);
+    }
+}
+function lfsKey(collection, repo, oid) {
+    checkTarget(collection, repo, oid);
+    return `${collection}/${repo}.lfs/${oid.slice(0, 2)}/${oid.slice(2, 4)}/${oid}`;
+}
+// ---- the local backend ----
+function localLfsDir(root, collection, repo) {
+    checkRepoTarget(collection, repo);
+    return (0, layout_1.repoPath)(root, collection, `${repo}.lfs`);
+}
+function localObjectPath(root, collection, repo, oid) {
+    checkTarget(collection, repo, oid);
+    return path.join(localLfsDir(root, collection, repo), oid.slice(0, 2), oid.slice(2, 4), oid);
+}
+// HMAC over a NUL-delimited payload with an explicit domain prefix. The same
+// secret signs session cookies; the "lfs" prefix guarantees an LFS href can
+// never be replayed as a session token. Every value that appears in the URL
+// is inside the signed payload, so none of them can be altered.
+function signTransfer(root, op, collection, repo, oid, exp, disp) {
+    const payload = ['lfs', op, collection, repo, oid, String(exp), disp].join('\0');
+    return crypto.createHmac('sha256', (0, session_1.getSecret)(root)).update(payload).digest('base64url');
+}
+function verifyTransfer(root, op, collection, repo, oid, exp, disp, sig) {
+    const a = Buffer.from(sig);
+    const b = Buffer.from(signTransfer(root, op, collection, repo, oid, exp, disp));
+    return a.length === b.length && crypto.timingSafeEqual(a, b);
+}
+class LocalLfsStore {
+    root;
+    kind = 'local';
+    constructor(root) {
+        this.root = root;
+    }
+    async head(collection, repo, oid) {
+        // The path is built outside the try so a rejected name or object id
+        // propagates as an error; only a missing file becomes null.
+        const file = localObjectPath(this.root, collection, repo, oid);
+        try {
+            const st = fs.statSync(file);
+            return st.isFile() ? { size: st.size } : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    // The hrefs are relative; the route layer prefixes the request's own base
+    // URL, since the store does not know what host it is being served under.
+    sign(op, collection, repo, oid, disp) {
+        const exp = Math.floor(Date.now() / 1000) + EXPIRES_SECONDS;
+        const sig = signTransfer(this.root, op, collection, repo, oid, exp, disp);
+        const q = new URLSearchParams({ exp: String(exp), sig });
+        if (disp !== '')
+            q.set('disp', disp);
+        const href = `/${encodeURIComponent(collection)}/${encodeURIComponent(repo)}/info/lfs/objects/${oid}?${q.toString()}`;
+        return { href, header: {}, expiresIn: EXPIRES_SECONDS };
+    }
+    async signDownload(collection, repo, oid, opts) {
+        const disp = opts?.filename ? sanitizeFilename(path.basename(opts.filename)) : '';
+        return this.sign('download', collection, repo, oid, disp);
+    }
+    async signUpload(collection, repo, oid, _size) {
+        return this.sign('upload', collection, repo, oid, '');
+    }
+    async deleteRepo(collection, repo) {
+        const dir = localLfsDir(this.root, collection, repo);
+        let rootReal;
+        try {
+            rootReal = fs.realpathSync(this.root);
+        }
+        catch {
+            return;
+        }
+        // containedIn resolves the real path, so a missing directory (already
+        // deleted, or never created) is a no-op rather than an error.
+        if (!(0, ops_1.containedIn)(rootReal, dir))
+            return;
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+    // The objects are a directory beside the repository, so moving them is
+    // moving that directory. A repository with no LFS objects has none.
+    async renameRepo(collection, repo, toCollection, toRepo) {
+        const from = localLfsDir(this.root, collection, repo);
+        const to = localLfsDir(this.root, toCollection, toRepo);
+        let rootReal;
+        try {
+            rootReal = fs.realpathSync(this.root);
+        }
+        catch {
+            return;
+        }
+        if (!(0, ops_1.containedIn)(rootReal, from))
+            return;
+        if (fs.existsSync(to))
+            throw new Error(`LFS objects already exist at ${toCollection}/${toRepo}`);
+        fs.mkdirSync(path.dirname(to), { recursive: true });
+        fs.renameSync(from, to);
+    }
+}
+// SigV4 signs a canonical query string in which a space is `%20`, but the URL
+// aws4fetch hands back is serialized by URLSearchParams, which writes a space
+// as `+`. The two disagree for any parameter containing a space, which for us
+// is every `response-content-disposition` (the `; ` alone contains one), and
+// the bucket then answers 403 SignatureDoesNotMatch. Rewriting `+` to `%20`
+// in the query is unambiguous: URLSearchParams emits a literal plus as `%2B`,
+// so no `+` here ever stands for itself.
+function fixQueryEncoding(href) {
+    const i = href.indexOf('?');
+    if (i === -1)
+        return href;
+    return href.slice(0, i) + href.slice(i).replace(/\+/g, '%20');
+}
+function escapeXml(s) {
+    return s
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;');
+}
+function decodeXml(s) {
+    return s
+        .replace(/&lt;/g, '<')
+        .replace(/&gt;/g, '>')
+        .replace(/&quot;/g, '"')
+        .replace(/&apos;/g, "'")
+        .replace(/&#(\d+);/g, (_, n) => String.fromCodePoint(parseInt(n, 10)))
+        .replace(/&amp;/g, '&');
+}
+class S3LfsStore {
+    kind = 's3';
+    bucket;
+    endpoint;
+    aws;
+    baseUrl;
+    prefix;
+    constructor(opts) {
+        this.bucket = opts.bucket;
+        this.endpoint = opts.endpoint;
+        this.prefix = opts.prefix;
+        this.aws = new aws4fetch_1.AwsClient({
+            accessKeyId: opts.accessKeyId,
+            secretAccessKey: opts.secretAccessKey,
+            region: opts.region,
+            service: 's3',
+        });
+        let url;
+        try {
+            url = new URL(opts.endpoint);
+        }
+        catch {
+            throw new LfsConfigError(`the LFS endpoint is not a valid URL: ${opts.endpoint}`);
+        }
+        if (opts.addressing === 'vhost') {
+            url.host = `${opts.bucket}.${url.host}`;
+            this.baseUrl = url.origin;
+        }
+        else {
+            this.baseUrl = `${url.origin}/${opts.bucket}`;
+        }
+    }
+    key(collection, repo, oid) {
+        return this.prefix + lfsKey(collection, repo, oid);
+    }
+    objectUrl(collection, repo, oid) {
+        return new URL(`${this.baseUrl}/${this.key(collection, repo, oid)}`);
+    }
+    async head(collection, repo, oid) {
+        const res = await this.aws.fetch(this.objectUrl(collection, repo, oid).toString(), { method: 'HEAD' });
+        if (res.status === 404)
+            return null;
+        if (!res.ok)
+            throw new Error(`LFS bucket HEAD returned ${res.status}`);
+        const len = res.headers.get('content-length');
+        return { size: len ? parseInt(len, 10) : 0 };
+    }
+    async signDownload(collection, repo, oid, opts) {
+        const url = this.objectUrl(collection, repo, oid);
+        url.searchParams.set('X-Amz-Expires', String(EXPIRES_SECONDS));
+        if (opts?.filename) {
+            url.searchParams.set('response-content-disposition', `attachment; filename="${sanitizeFilename(path.basename(opts.filename))}"`);
+        }
+        const signed = await this.aws.sign(new Request(url.toString(), { method: 'GET' }), {
+            aws: { signQuery: true },
+        });
+        return { href: fixQueryEncoding(signed.url), header: {}, expiresIn: EXPIRES_SECONDS };
+    }
+    // No Content-Type is signed: R2 requires the client to send a header
+    // exactly matching any content type in the signature, and git-lfs sends its
+    // own, so signing one is a reliable source of 403s at upload time.
+    async signUpload(collection, repo, oid, _size) {
+        const url = this.objectUrl(collection, repo, oid);
+        url.searchParams.set('X-Amz-Expires', String(EXPIRES_SECONDS));
+        const signed = await this.aws.sign(new Request(url.toString(), { method: 'PUT' }), {
+            aws: { signQuery: true },
+        });
+        return { href: fixQueryEncoding(signed.url), header: {}, expiresIn: EXPIRES_SECONDS };
+    }
+    // List the repository's key prefix and delete in batches of up to 1000,
+    // following continuation tokens. Idempotent: deleting keys that are already
+    // gone succeeds, and an empty listing does nothing.
+    async deleteRepo(collection, repo) {
+        // Validated before it becomes a delete prefix: an unchecked name here
+        // would widen the prefix and delete other repositories' objects.
+        checkRepoTarget(collection, repo);
+        for (const keys of await this.listKeys(`${this.prefix}${collection}/${repo}.lfs/`)) {
+            await this.deleteKeys(keys);
+        }
+    }
+    /**
+     * Objects carry the repository in their key, so moving a repository means
+     * copying every object to the new prefix and deleting the old ones. There
+     * is no rename in S3; a server-side copy is the closest thing, and it never
+     * moves bytes through this process.
+     */
+    async renameRepo(collection, repo, toCollection, toRepo) {
+        checkRepoTarget(collection, repo);
+        checkRepoTarget(toCollection, toRepo);
+        const fromPrefix = `${this.prefix}${collection}/${repo}.lfs/`;
+        const toPrefix = `${this.prefix}${toCollection}/${toRepo}.lfs/`;
+        for (const keys of await this.listKeys(fromPrefix)) {
+            for (const key of keys) {
+                const target = toPrefix + key.slice(fromPrefix.length);
+                const res = await this.aws.fetch(`${this.baseUrl}/${target}`, {
+                    method: 'PUT',
+                    headers: { 'x-amz-copy-source': `/${this.bucket}/${key}` },
+                });
+                if (!res.ok)
+                    throw new Error(`LFS bucket COPY returned ${res.status}`);
+            }
+            await this.deleteKeys(keys);
+        }
+    }
+    /** Every key under a prefix, in the batches the listing returns them in. */
+    async listKeys(prefix) {
+        const batches = [];
+        let continuation;
+        do {
+            const listUrl = new URL(`${this.baseUrl}/`);
+            listUrl.searchParams.set('list-type', '2');
+            listUrl.searchParams.set('prefix', prefix);
+            if (continuation)
+                listUrl.searchParams.set('continuation-token', continuation);
+            const res = await this.aws.fetch(listUrl.toString());
+            if (!res.ok)
+                throw new Error(`LFS bucket LIST returned ${res.status}`);
+            const xml = await res.text();
+            const keys = [...xml.matchAll(/<Key>([^<]*)<\/Key>/g)].map((m) => decodeXml(m[1]));
+            if (keys.length > 0)
+                batches.push(keys);
+            continuation = undefined;
+            if (/<IsTruncated>true<\/IsTruncated>/.test(xml)) {
+                const m = xml.match(/<NextContinuationToken>([^<]*)<\/NextContinuationToken>/);
+                // Stopping quietly here would leave the rest of the repository's
+                // objects behind with nothing left to point at them, so raise it.
+                if (!m)
+                    throw new Error('LFS bucket listing was truncated without a continuation token');
+                continuation = decodeXml(m[1]);
+            }
+        } while (continuation);
+        return batches;
+    }
+    async deleteKeys(keys) {
+        const body = '<Delete><Quiet>true</Quiet>' +
+            keys.map((k) => `<Object><Key>${escapeXml(k)}</Key></Object>`).join('') +
+            '</Delete>';
+        const url = new URL(`${this.baseUrl}/`);
+        url.searchParams.set('delete', '');
+        const res = await this.aws.fetch(url.toString(), {
+            method: 'POST',
+            headers: {
+                // DeleteObjects requires Content-MD5 on AWS; harmless elsewhere.
+                'Content-MD5': crypto.createHash('md5').update(body).digest('base64'),
+                'Content-Type': 'application/xml',
+            },
+            body,
+        });
+        if (!res.ok)
+            throw new Error(`LFS bucket DELETE returned ${res.status}`);
+    }
+}
+// ---- backend selection ----
+// Credentials come from the environment only; nothing about the choice is
+// recorded in the vault, which stays portable between deployments. The
+// BUCKET_NAME and AWS_* spellings are honored so a Fly deployment using
+// Tigris works with the credentials Fly injects.
+function createLfsStore(root, env = process.env) {
+    let maxSize = DEFAULT_MAX_SIZE;
+    if (env.MOCHI_LFS_MAX_SIZE !== undefined) {
+        maxSize = parseInt(env.MOCHI_LFS_MAX_SIZE, 10);
+        if (!Number.isSafeInteger(maxSize) || maxSize <= 0) {
+            throw new LfsConfigError(`MOCHI_LFS_MAX_SIZE must be a positive integer, got: ${env.MOCHI_LFS_MAX_SIZE}`);
+        }
+    }
+    const local = () => ({
+        store: new LocalLfsStore(root),
+        maxSize,
+        label: 'local (objects stored inside the vault)',
+        offloaded: false,
+    });
+    if (env.MOCHI_LFS === 'off')
+        return local();
+    const vars = [
+        ['MOCHI_LFS_BUCKET (or BUCKET_NAME)', env.MOCHI_LFS_BUCKET || env.BUCKET_NAME],
+        ['MOCHI_LFS_ENDPOINT (or AWS_ENDPOINT_URL_S3)', env.MOCHI_LFS_ENDPOINT || env.AWS_ENDPOINT_URL_S3],
+        ['AWS_ACCESS_KEY_ID', env.AWS_ACCESS_KEY_ID],
+        ['AWS_SECRET_ACCESS_KEY', env.AWS_SECRET_ACCESS_KEY],
+    ];
+    const missing = vars.filter(([, v]) => !v).map(([name]) => name);
+    if (missing.length === vars.length)
+        return local();
+    if (missing.length > 0) {
+        // A partially configured deployment must not silently fall back to
+        // storing large objects on the volume; that is the exact failure the
+        // bucket backend exists to prevent.
+        throw new LfsConfigError(`Git LFS bucket configuration is incomplete; missing: ${missing.join(', ')}. ` +
+            `Set the missing variables, or set MOCHI_LFS=off to store LFS objects inside the vault.`);
+    }
+    const [bucket, endpoint] = [vars[0][1], vars[1][1]];
+    const addressing = env.MOCHI_LFS_ADDRESSING ?? 'path';
+    if (addressing !== 'path' && addressing !== 'vhost') {
+        throw new LfsConfigError(`MOCHI_LFS_ADDRESSING must be "path" or "vhost", got: ${addressing}`);
+    }
+    let prefix = env.MOCHI_LFS_PREFIX ?? '';
+    if (prefix !== '')
+        prefix = prefix.replace(/^\/+|\/+$/g, '') + '/';
+    const store = new S3LfsStore({
+        bucket,
+        endpoint,
+        accessKeyId: env.AWS_ACCESS_KEY_ID,
+        secretAccessKey: env.AWS_SECRET_ACCESS_KEY,
+        region: env.AWS_REGION || 'auto',
+        prefix,
+        addressing,
+    });
+    return { store, maxSize, label: `s3 (endpoint ${endpoint}, bucket ${bucket})`, offloaded: true };
+}

package/dist/limit.js

@@ -0,0 +1,259 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BUSY_RETRY_SECONDS = void 0;
+exports.clientKey = clientKey;
+exports.createLimiter = createLimiter;
+exports.createGate = createGate;
+exports.createGates = createGates;
+exports.createAuthLimiter = createAuthLimiter;
+// Rate limiting and abuse controls, in two primitives and one key function.
+//
+// Both primitives return a decision rather than writing a response, the way
+// checkPushAuth does, because the callers refuse in four content types: HTML for
+// the web, JSON for the API, plain text for git, and LFS's own JSON shape.
+//
+// Nothing here survives a restart or is shared between processes. Rate-limit
+// state is high-frequency and worthless once stale, and it does not belong in a
+// vault directory whose whole design is plain files written durably. Two servers
+// pointed at one vault therefore count separately, and a restart forgives every
+// offender. Both are documented limitations rather than bugs to engineer around.
+/**
+ * The address a limit is charged to. Express's req.ip reads X-Forwarded-For when
+ * trust proxy is set, which is client-supplied, so it is used only when the
+ * operator has said a proxy is in front. Otherwise the socket's peer address is
+ * the only thing an attacker cannot choose.
+ *
+ * Every limiter keys on this. No route may key on req.ip directly, or a vault
+ * exposed without a proxy would have every per-address limit defeated by one
+ * fabricated header, and the limiter's own key space would be unbounded.
+ */
+function clientKey(req) {
+    const trusted = Boolean(req.app?.get('trust proxy'));
+    const raw = trusted ? req.ip ?? req.socket.remoteAddress : req.socket.remoteAddress;
+    return normalizeAddress(raw ?? 'unknown');
+}
+/**
+ * One address, one key. Without this an attacker gets a fresh bucket per
+ * spelling of the same address.
+ *
+ * IPv6 addresses are deliberately not aggregated into a /64. That would be the
+ * more effective choice against a single host with a routed prefix and the more
+ * damaging one behind a CGNAT or a university, and guessing wrong is worse than
+ * the coarse behaviour.
+ */
+function normalizeAddress(address) {
+    const lower = address.trim().toLowerCase();
+    return lower.startsWith('::ffff:') ? lower.slice('::ffff:'.length) : lower;
+}
+const OK = { ok: true, retryAfter: 0 };
+/** How many expired entries one call may clear, so that a request cannot pay for a very large map. */
+const SWEEP_BUDGET = 64;
+/**
+ * A fixed-window counter. A fixed window lets twice the limit through across a
+ * window boundary; a token bucket would not, and buys a smoothness none of these
+ * limits need.
+ *
+ * maxKeys is a hard ceiling, because an unbounded map keyed on anything an
+ * attacker influences is itself a memory-exhaustion vector. When the map is full
+ * and a sweep frees nothing, a hit on an unseen key is allowed. That is failing
+ * open, and it is the right way round: a limiter that refuses everyone the moment
+ * it is full has become the outage it exists to prevent. clientKey is what makes
+ * this rare, by bounding the key space to real peers.
+ */
+function createLimiter(opts) {
+    const { limit, windowMs, maxKeys } = opts;
+    const counts = new Map();
+    let fullWarnedAt = 0;
+    const retryAfter = (resetAt) => Math.max(1, Math.ceil((resetAt - Date.now()) / 1000));
+    // Amortised over a bounded number of entries, and only on a write, so one
+    // request cannot pay for a very large map.
+    const sweep = (now) => {
+        let looked = 0;
+        for (const [key, entry] of counts) {
+            if (looked++ >= SWEEP_BUDGET)
+                break;
+            if (entry.resetAt <= now)
+                counts.delete(key);
+        }
+    };
+    return {
+        // check and hit agree on the boundary: after exactly `limit` events in a
+        // window, check says not ok and the next hit would too.
+        check(key) {
+            if (limit <= 0)
+                return OK;
+            const entry = counts.get(key);
+            const now = Date.now();
+            if (!entry || entry.resetAt <= now)
+                return OK;
+            if (entry.count < limit)
+                return OK;
+            return { ok: false, retryAfter: retryAfter(entry.resetAt) };
+        },
+        hit(key) {
+            if (limit <= 0)
+                return OK;
+            const now = Date.now();
+            let entry = counts.get(key);
+            if (!entry || entry.resetAt <= now) {
+                if (!entry) {
+                    sweep(now);
+                    if (counts.size >= maxKeys) {
+                        // Once per window at most: a full map under attack would otherwise
+                        // fill the log faster than it fills memory.
+                        if (now - fullWarnedAt > windowMs) {
+                            fullWarnedAt = now;
+                            console.warn(`rate limiter at its ${maxKeys}-key ceiling; new addresses are not being counted until entries expire`);
+                        }
+                        return OK;
+                    }
+                }
+                entry = { count: 0, resetAt: now + windowMs };
+                counts.set(key, entry);
+            }
+            entry.count++;
+            if (entry.count > limit)
+                return { ok: false, retryAfter: retryAfter(entry.resetAt) };
+            return OK;
+        },
+    };
+}
+/**
+ * A concurrency gate: a count of slots in use and a FIFO of waiters.
+ *
+ * This is the primitive that bounds git. Counting requests per minute does not
+ * help there, because the requests are slow rather than frequent: a clone holds a
+ * subprocess and a socket for as long as the client cares to read, and a handful
+ * of concurrent ls-tree calls on a large repository is already a memory problem
+ * given execGit's 256 MB maxBuffer. What bounds it is a limit on how many may run
+ * at once.
+ *
+ * The release function is idempotent, and every caller must invoke it from
+ * somewhere that runs on every path out of the request, a client disconnect
+ * included. An aborted clone is ordinary traffic, not an error, and a gate that
+ * leaks a slot per abort stops answering after `concurrency` of them.
+ */
+function createGate(opts) {
+    const { concurrency, queue, timeoutMs } = opts;
+    let busy = 0;
+    const waiters = [];
+    const releaser = () => {
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            const next = waiters.shift();
+            if (next) {
+                clearTimeout(next.timer);
+                // The slot passes straight to the waiter, so busy stays as it is.
+                next.resolve(releaser());
+                return;
+            }
+            busy--;
+        };
+    };
+    return {
+        get busy() {
+            return busy;
+        },
+        get queued() {
+            return waiters.length;
+        },
+        enter() {
+            if (busy < concurrency) {
+                busy++;
+                return Promise.resolve(releaser());
+            }
+            if (waiters.length >= queue)
+                return Promise.resolve(null);
+            return new Promise((resolve) => {
+                // A waiter that has been queued longer than this is dropped, so a
+                // request never waits indefinitely for work a client has probably
+                // given up on.
+                const timer = setTimeout(() => {
+                    const i = waiters.findIndex((w) => w.timer === timer);
+                    if (i !== -1)
+                        waiters.splice(i, 1);
+                    resolve(null);
+                }, timeoutMs);
+                // Nothing should keep the process alive for a queued waiter.
+                timer.unref?.();
+                waiters.push({ resolve, timer });
+            });
+        },
+    };
+}
+// ---- the gates a vault holds ----
+/**
+ * What to put in Retry-After when a gate refuses. A gate refusal is about server
+ * capacity right now rather than about a client's quota over a window, so there
+ * is no window to compute from; a few seconds is long enough for the queue to
+ * drain and short enough that a client retry is not a second outage.
+ */
+exports.BUSY_RETRY_SECONDS = 5;
+// Queue depths and timeouts are constants rather than configuration: nobody
+// tunes these without reading the code, and they can be promoted later if anyone
+// asks. The concurrencies are configurable, because those are the numbers that
+// depend on the machine.
+const QUEUES = {
+    clone: { queue: 16, timeoutMs: 10000 },
+    push: { queue: 16, timeoutMs: 30000 },
+    search: { queue: 8, timeoutMs: 5000 },
+    tree: { queue: 16, timeoutMs: 10000 },
+};
+/**
+ * Separate gates and not one, so that a flood of anonymous clones cannot stop an
+ * authorized push, which is the operation whose failure costs a person their
+ * work.
+ */
+function createGates(limits) {
+    return {
+        clone: createGate({ concurrency: limits.clone, ...QUEUES.clone }),
+        push: createGate({ concurrency: limits.push, ...QUEUES.push }),
+        search: createGate({ concurrency: limits.search, ...QUEUES.search }),
+        tree: createGate({ concurrency: limits.tree, ...QUEUES.tree }),
+    };
+}
+const AUTH_WINDOW_MS = 15 * 60 * 1000;
+const AUTH_MAX_KEYS = 20000;
+/** Bearer and runner tokens carry no username, so they share one bucket in the fine-grained window. */
+const NO_USERNAME = 'token';
+/**
+ * A limiter charged only on failure, so a working credential is never throttled
+ * however often it is used. That matters for /api/runner/*, which a runner calls
+ * continuously with a valid token.
+ *
+ * Two windows. The fine-grained one is per address and username; the coarse one
+ * is per address alone and deliberately the more generous, so that a shared
+ * address behind NAT is not cut off by one person mistyping a token, while an
+ * attacker spreading attempts over many usernames is still caught.
+ *
+ * The fine-grained map is the one an attacker can grow, by varying the username.
+ * When it is full its hits stop counting, so `allow` falls back to the coarse
+ * decision alone rather than failing open altogether; the coarse map's key space
+ * is bounded by real peers. That is the reason there are two windows and not one.
+ */
+function createAuthLimiter(authFailures) {
+    const fine = createLimiter({ limit: authFailures, windowMs: AUTH_WINDOW_MS, maxKeys: AUTH_MAX_KEYS });
+    // Derived rather than configured, so there is one number to think about.
+    const coarse = createLimiter({ limit: authFailures * 5, windowMs: AUTH_WINDOW_MS, maxKeys: AUTH_MAX_KEYS });
+    const keys = (req, username) => {
+        const address = clientKey(req);
+        return { address, fine: `${address}${username ?? NO_USERNAME}` };
+    };
+    return {
+        allow(req, username) {
+            const k = keys(req, username);
+            const a = fine.check(k.fine);
+            if (!a.ok)
+                return a;
+            return coarse.check(k.address);
+        },
+        fail(req, username) {
+            const k = keys(req, username);
+            fine.hit(k.fine);
+            coarse.hit(k.address);
+        },
+    };
+}