@poolzin/pool-bot 2026.2.11 → 2026.2.18

package/dist/discord/guilds.js

@@ -0,0 +1,12 @@
+import { fetchDiscord } from "./api.js";
+import { normalizeDiscordSlug } from "./monitor/allow-list.js";
+export async function listGuilds(token, fetcher) {
+    const raw = await fetchDiscord("/users/@me/guilds", token, fetcher);
+    return raw
+        .filter((guild) => typeof guild.id === "string" && typeof guild.name === "string")
+        .map((guild) => ({
+        id: guild.id,
+        name: guild.name,
+        slug: normalizeDiscordSlug(guild.name),
+    }));
+}

package/dist/discord/monitor/gateway-plugin.js

@@ -0,0 +1,48 @@
+import { GatewayIntents, GatewayPlugin } from "@buape/carbon/gateway";
+import { HttpsProxyAgent } from "https-proxy-agent";
+import WebSocket from "ws";
+import { danger } from "../../globals.js";
+export function resolveDiscordGatewayIntents(intentsConfig) {
+    let intents = GatewayIntents.Guilds |
+        GatewayIntents.GuildMessages |
+        GatewayIntents.MessageContent |
+        GatewayIntents.DirectMessages |
+        GatewayIntents.GuildMessageReactions |
+        GatewayIntents.DirectMessageReactions;
+    if (intentsConfig?.presence) {
+        intents |= GatewayIntents.GuildPresences;
+    }
+    if (intentsConfig?.guildMembers) {
+        intents |= GatewayIntents.GuildMembers;
+    }
+    return intents;
+}
+export function createDiscordGatewayPlugin(params) {
+    const intents = resolveDiscordGatewayIntents(params.discordConfig?.intents);
+    const proxy = params.discordConfig?.proxy?.trim();
+    const options = {
+        reconnect: { maxAttempts: 50 },
+        intents,
+        autoInteractions: true,
+    };
+    if (!proxy) {
+        return new GatewayPlugin(options);
+    }
+    try {
+        const agent = new HttpsProxyAgent(proxy);
+        params.runtime.log?.("discord: gateway proxy enabled");
+        class ProxyGatewayPlugin extends GatewayPlugin {
+            constructor() {
+                super(options);
+            }
+            createWebSocket(url) {
+                return new WebSocket(url, { agent });
+            }
+        }
+        return new ProxyGatewayPlugin();
+    }
+    catch (err) {
+        params.runtime.error?.(danger(`discord: invalid gateway proxy: ${String(err)}`));
+        return new GatewayPlugin(options);
+    }
+}

package/dist/discord/monitor/presence.js

@@ -0,0 +1,30 @@
+const DEFAULT_CUSTOM_ACTIVITY_TYPE = 4;
+const CUSTOM_STATUS_NAME = "Custom Status";
+export function resolveDiscordPresenceUpdate(config) {
+    const activityText = typeof config.activity === "string" ? config.activity.trim() : "";
+    const status = typeof config.status === "string" ? config.status.trim() : "";
+    const activityType = config.activityType;
+    const activityUrl = typeof config.activityUrl === "string" ? config.activityUrl.trim() : "";
+    const hasActivity = Boolean(activityText);
+    const hasStatus = Boolean(status);
+    if (!hasActivity && !hasStatus) {
+        return null;
+    }
+    const activities = [];
+    if (hasActivity) {
+        const resolvedType = activityType ?? DEFAULT_CUSTOM_ACTIVITY_TYPE;
+        const activity = resolvedType === DEFAULT_CUSTOM_ACTIVITY_TYPE
+            ? { name: CUSTOM_STATUS_NAME, type: resolvedType, state: activityText }
+            : { name: activityText, type: resolvedType };
+        if (resolvedType === 1 && activityUrl) {
+            activity.url = activityUrl;
+        }
+        activities.push(activity);
+    }
+    return {
+        since: null,
+        activities,
+        status: (status || "online"),
+        afk: false,
+    };
+}

package/dist/discord/send.components.js

@@ -0,0 +1,115 @@
+import { serializePayload, } from "@buape/carbon";
+import { ChannelType, Routes } from "discord-api-types/v10";
+import { loadConfig } from "../config/config.js";
+import { recordChannelActivity } from "../infra/channel-activity.js";
+import { loadWebMedia } from "../web/media.js";
+import { resolveDiscordAccount } from "./accounts.js";
+import { registerDiscordComponentEntries } from "./components-registry.js";
+import { buildDiscordComponentMessage, buildDiscordComponentMessageFlags, resolveDiscordComponentAttachmentName, } from "./components.js";
+import { buildDiscordSendError, createDiscordClient, parseAndResolveRecipient, resolveChannelId, stripUndefinedFields, SUPPRESS_NOTIFICATIONS_FLAG, } from "./send.shared.js";
+const DISCORD_FORUM_LIKE_TYPES = new Set([ChannelType.GuildForum, ChannelType.GuildMedia]);
+function extractComponentAttachmentNames(spec) {
+    const names = [];
+    for (const block of spec.blocks ?? []) {
+        if (block.type === "file") {
+            names.push(resolveDiscordComponentAttachmentName(block.file));
+        }
+    }
+    return names;
+}
+export async function sendDiscordComponentMessage(to, spec, opts = {}) {
+    const cfg = loadConfig();
+    const accountInfo = resolveDiscordAccount({ cfg, accountId: opts.accountId });
+    const { token, rest, request } = createDiscordClient(opts, cfg);
+    const recipient = await parseAndResolveRecipient(to, opts.accountId);
+    const { channelId } = await resolveChannelId(rest, recipient, request);
+    let channelType;
+    try {
+        const channel = (await rest.get(Routes.channel(channelId)));
+        channelType = channel?.type;
+    }
+    catch {
+        channelType = undefined;
+    }
+    if (channelType && DISCORD_FORUM_LIKE_TYPES.has(channelType)) {
+        throw new Error("Discord components are not supported in forum-style channels");
+    }
+    const buildResult = buildDiscordComponentMessage({
+        spec,
+        sessionKey: opts.sessionKey,
+        agentId: opts.agentId,
+        accountId: accountInfo.accountId,
+    });
+    const flags = buildDiscordComponentMessageFlags(buildResult.components);
+    const finalFlags = opts.silent
+        ? (flags ?? 0) | SUPPRESS_NOTIFICATIONS_FLAG
+        : (flags ?? undefined);
+    const messageReference = opts.replyTo
+        ? { message_id: opts.replyTo, fail_if_not_exists: false }
+        : undefined;
+    const attachmentNames = extractComponentAttachmentNames(spec);
+    const uniqueAttachmentNames = [...new Set(attachmentNames)];
+    if (uniqueAttachmentNames.length > 1) {
+        throw new Error("Discord component attachments currently support a single file. Use media-gallery for multiple files.");
+    }
+    const expectedAttachmentName = uniqueAttachmentNames[0];
+    let files;
+    if (opts.mediaUrl) {
+        const media = await loadWebMedia(opts.mediaUrl, { localRoots: opts.mediaLocalRoots });
+        const filenameOverride = opts.filename?.trim();
+        const fileName = filenameOverride || media.fileName || "upload";
+        if (expectedAttachmentName && expectedAttachmentName !== fileName) {
+            throw new Error(`Component file block expects attachment "${expectedAttachmentName}", but the uploaded file is "${fileName}". Update components.blocks[].file or provide a matching filename.`);
+        }
+        let fileData;
+        if (media.buffer instanceof Blob) {
+            fileData = media.buffer;
+        }
+        else {
+            const arrayBuffer = new ArrayBuffer(media.buffer.byteLength);
+            new Uint8Array(arrayBuffer).set(media.buffer);
+            fileData = new Blob([arrayBuffer]);
+        }
+        files = [{ data: fileData, name: fileName }];
+    }
+    else if (expectedAttachmentName) {
+        throw new Error("Discord component file blocks require a media attachment (media/path/filePath).");
+    }
+    const payload = {
+        components: buildResult.components,
+        ...(finalFlags ? { flags: finalFlags } : {}),
+        ...(files ? { files } : {}),
+    };
+    const body = stripUndefinedFields({
+        ...serializePayload(payload),
+        ...(messageReference ? { message_reference: messageReference } : {}),
+    });
+    let result;
+    try {
+        result = (await request(() => rest.post(Routes.channelMessages(channelId), {
+            body,
+        }), "components"));
+    }
+    catch (err) {
+        throw await buildDiscordSendError(err, {
+            channelId,
+            rest,
+            token,
+            hasMedia: Boolean(files?.length),
+        });
+    }
+    registerDiscordComponentEntries({
+        entries: buildResult.entries,
+        modals: buildResult.modals,
+        messageId: result.id,
+    });
+    recordChannelActivity({
+        channel: "discord",
+        accountId: accountInfo.accountId,
+        direction: "outbound",
+    });
+    return {
+        messageId: result.id ?? "unknown",
+        channelId: result.channel_id ?? channelId,
+    };
+}

package/dist/discord/send.shared.js

@@ -17,6 +17,7 @@ const DISCORD_POLL_MAX_ANSWERS = 10;
 const DISCORD_POLL_MAX_DURATION_HOURS = 32 * 24;
 const DISCORD_MISSING_PERMISSIONS = 50013;
 const DISCORD_CANNOT_DM = 50007;
+export const SUPPRESS_NOTIFICATIONS_FLAG = 1 << 12;
 function resolveToken(params) {
     const explicit = normalizeDiscordToken(params.explicit);
     if (explicit) {
@@ -283,4 +284,7 @@ function buildReactionIdentifier(emoji) {
 function formatReactionEmoji(emoji) {
     return buildReactionIdentifier(emoji);
 }
+export function stripUndefinedFields(obj) {
+    return Object.fromEntries(Object.entries(obj).filter(([, v]) => v !== undefined));
+}
 export { buildDiscordSendError, buildReactionIdentifier, createDiscordClient, formatReactionEmoji, normalizeDiscordPollInput, normalizeEmojiName, normalizeReactionEmoji, normalizeStickerIds, parseRecipient, resolveChannelId, resolveDiscordRest, sendDiscordMedia, sendDiscordText, };

package/dist/discord/ui.js

@@ -0,0 +1,26 @@
+import { Container } from "@buape/carbon";
+import { resolveDiscordAccount } from "./accounts.js";
+const DEFAULT_DISCORD_ACCENT_COLOR = "#5865F2";
+export function normalizeDiscordAccentColor(raw) {
+    const trimmed = (raw ?? "").trim();
+    if (!trimmed) {
+        return null;
+    }
+    const normalized = trimmed.startsWith("#") ? trimmed : `#${trimmed}`;
+    if (!/^#[0-9a-fA-F]{6}$/.test(normalized)) {
+        return null;
+    }
+    return normalized.toUpperCase();
+}
+export function resolveDiscordAccentColor(params) {
+    const account = resolveDiscordAccount({ cfg: params.cfg, accountId: params.accountId });
+    const configured = normalizeDiscordAccentColor(account.config.ui?.components?.accentColor);
+    return configured ?? DEFAULT_DISCORD_ACCENT_COLOR;
+}
+export class DiscordUiContainer extends Container {
+    constructor(params) {
+        const accentOverride = normalizeDiscordAccentColor(params.accentColor);
+        const accentColor = accentOverride ?? resolveDiscordAccentColor({ cfg: params.cfg, accountId: params.accountId });
+        super(params.components, { accentColor, spoiler: params.spoiler });
+    }
+}

package/dist/discord/voice-message.js

@@ -0,0 +1,254 @@
+/**
+ * Discord Voice Message Support
+ *
+ * Implements sending voice messages via Discord's API.
+ * Voice messages require:
+ * - OGG/Opus format audio
+ * - Waveform data (base64 encoded, up to 256 samples, 0-255 values)
+ * - Duration in seconds
+ * - Message flag 8192 (IS_VOICE_MESSAGE)
+ * - No other content (text, embeds, etc.)
+ */
+import { execFile } from "node:child_process";
+import crypto from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { promisify } from "node:util";
+import { resolvePreferredOpenClawTmpDir } from "../infra/tmp-poolbot-dir.js";
+const execFileAsync = promisify(execFile);
+const DISCORD_VOICE_MESSAGE_FLAG = 1 << 13;
+const SUPPRESS_NOTIFICATIONS_FLAG = 1 << 12;
+const WAVEFORM_SAMPLES = 256;
+/**
+ * Get audio duration using ffprobe
+ */
+export async function getAudioDuration(filePath) {
+    try {
+        const { stdout } = await execFileAsync("ffprobe", [
+            "-v",
+            "error",
+            "-show_entries",
+            "format=duration",
+            "-of",
+            "csv=p=0",
+            filePath,
+        ]);
+        const duration = parseFloat(stdout.trim());
+        if (isNaN(duration)) {
+            throw new Error("Could not parse duration");
+        }
+        return Math.round(duration * 100) / 100; // Round to 2 decimal places
+    }
+    catch (err) {
+        const errMessage = err instanceof Error ? err.message : String(err);
+        throw new Error(`Failed to get audio duration: ${errMessage}`, { cause: err });
+    }
+}
+/**
+ * Generate waveform data from audio file using ffmpeg
+ * Returns base64 encoded byte array of amplitude samples (0-255)
+ */
+export async function generateWaveform(filePath) {
+    try {
+        // Extract raw PCM and sample amplitude values
+        return await generateWaveformFromPcm(filePath);
+    }
+    catch {
+        // If PCM extraction fails, generate a placeholder waveform
+        return generatePlaceholderWaveform();
+    }
+}
+/**
+ * Generate waveform by extracting raw PCM data and sampling amplitudes
+ */
+async function generateWaveformFromPcm(filePath) {
+    const tempDir = resolvePreferredOpenClawTmpDir();
+    const tempPcm = path.join(tempDir, `waveform-${crypto.randomUUID()}.raw`);
+    try {
+        // Convert to raw 16-bit signed PCM, mono, 8kHz
+        await execFileAsync("ffmpeg", [
+            "-y",
+            "-i",
+            filePath,
+            "-f",
+            "s16le",
+            "-acodec",
+            "pcm_s16le",
+            "-ac",
+            "1",
+            "-ar",
+            "8000",
+            tempPcm,
+        ]);
+        const pcmData = await fs.readFile(tempPcm);
+        const samples = new Int16Array(pcmData.buffer, pcmData.byteOffset, pcmData.byteLength / 2);
+        // Sample the PCM data to get WAVEFORM_SAMPLES points
+        const step = Math.max(1, Math.floor(samples.length / WAVEFORM_SAMPLES));
+        const waveform = [];
+        for (let i = 0; i < WAVEFORM_SAMPLES && i * step < samples.length; i++) {
+            // Get average absolute amplitude for this segment
+            let sum = 0;
+            let count = 0;
+            for (let j = 0; j < step && i * step + j < samples.length; j++) {
+                sum += Math.abs(samples[i * step + j]);
+                count++;
+            }
+            const avg = count > 0 ? sum / count : 0;
+            // Normalize to 0-255 (16-bit signed max is 32767)
+            const normalized = Math.min(255, Math.round((avg / 32767) * 255));
+            waveform.push(normalized);
+        }
+        // Pad with zeros if we don't have enough samples
+        while (waveform.length < WAVEFORM_SAMPLES) {
+            waveform.push(0);
+        }
+        return Buffer.from(waveform).toString("base64");
+    }
+    finally {
+        // Clean up temp file
+        try {
+            await fs.unlink(tempPcm);
+        }
+        catch {
+            // Ignore cleanup errors
+        }
+    }
+}
+/**
+ * Generate a placeholder waveform (for when audio processing fails)
+ */
+function generatePlaceholderWaveform() {
+    // Generate a simple sine-wave-like pattern
+    const waveform = [];
+    for (let i = 0; i < WAVEFORM_SAMPLES; i++) {
+        const value = Math.round(128 + 64 * Math.sin((i / WAVEFORM_SAMPLES) * Math.PI * 8));
+        waveform.push(Math.min(255, Math.max(0, value)));
+    }
+    return Buffer.from(waveform).toString("base64");
+}
+/**
+ * Convert audio file to OGG/Opus format if needed
+ * Returns path to the OGG file (may be same as input if already OGG/Opus)
+ */
+export async function ensureOggOpus(filePath) {
+    const trimmed = filePath.trim();
+    // Defense-in-depth: callers should never hand ffmpeg/ffprobe a URL/protocol path.
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed)) {
+        throw new Error(`Voice message conversion requires a local file path; received a URL/protocol source: ${trimmed}`);
+    }
+    const ext = path.extname(filePath).toLowerCase();
+    // Check if already OGG
+    if (ext === ".ogg") {
+        // Verify it's Opus codec, not Vorbis (Vorbis won't play on mobile)
+        try {
+            const { stdout } = await execFileAsync("ffprobe", [
+                "-v",
+                "error",
+                "-select_streams",
+                "a:0",
+                "-show_entries",
+                "stream=codec_name",
+                "-of",
+                "csv=p=0",
+                filePath,
+            ]);
+            if (stdout.trim().toLowerCase() === "opus") {
+                return { path: filePath, cleanup: false };
+            }
+        }
+        catch {
+            // If probe fails, convert anyway
+        }
+    }
+    // Convert to OGG/Opus
+    const tempDir = resolvePreferredOpenClawTmpDir();
+    const outputPath = path.join(tempDir, `voice-${crypto.randomUUID()}.ogg`);
+    await execFileAsync("ffmpeg", [
+        "-y",
+        "-i",
+        filePath,
+        "-c:a",
+        "libopus",
+        "-b:a",
+        "64k",
+        outputPath,
+    ]);
+    return { path: outputPath, cleanup: true };
+}
+/**
+ * Get voice message metadata (duration and waveform)
+ */
+export async function getVoiceMessageMetadata(filePath) {
+    const [durationSecs, waveform] = await Promise.all([
+        getAudioDuration(filePath),
+        generateWaveform(filePath),
+    ]);
+    return { durationSecs, waveform };
+}
+/**
+ * Send a voice message to Discord
+ *
+ * This follows Discord's voice message protocol:
+ * 1. Request upload URL from Discord
+ * 2. Upload the OGG file to the provided URL
+ * 3. Send the message with flag 8192 and attachment metadata
+ */
+export async function sendDiscordVoiceMessage(rest, channelId, audioBuffer, metadata, replyTo, request, silent) {
+    const filename = "voice-message.ogg";
+    const fileSize = audioBuffer.byteLength;
+    // Step 1: Request upload URL from Discord
+    const uploadUrlResponse = await request(() => rest.post(`/channels/${channelId}/attachments`, {
+        body: {
+            files: [
+                {
+                    filename,
+                    file_size: fileSize,
+                    id: "0",
+                },
+            ],
+        },
+    }), "voice-upload-url");
+    if (!uploadUrlResponse.attachments?.[0]) {
+        throw new Error("Failed to get upload URL for voice message");
+    }
+    const { upload_url, upload_filename } = uploadUrlResponse.attachments[0];
+    // Step 2: Upload the file to Discord's CDN
+    // Note: Not wrapped in retry runner - upload URLs are single-use and CDN behavior differs
+    const uploadResponse = await fetch(upload_url, {
+        method: "PUT",
+        headers: {
+            "Content-Type": "audio/ogg",
+        },
+        body: new Uint8Array(audioBuffer),
+    });
+    if (!uploadResponse.ok) {
+        throw new Error(`Failed to upload voice message: ${uploadResponse.status}`);
+    }
+    // Step 3: Send the message with voice message flag and metadata
+    const flags = silent
+        ? DISCORD_VOICE_MESSAGE_FLAG | SUPPRESS_NOTIFICATIONS_FLAG
+        : DISCORD_VOICE_MESSAGE_FLAG;
+    const messagePayload = {
+        flags,
+        attachments: [
+            {
+                id: "0",
+                filename,
+                uploaded_filename: upload_filename,
+                duration_secs: metadata.durationSecs,
+                waveform: metadata.waveform,
+            },
+        ],
+    };
+    // Note: Voice messages cannot have content, but can have message_reference for replies
+    if (replyTo) {
+        messagePayload.message_reference = {
+            message_id: replyTo,
+            fail_if_not_exists: false,
+        };
+    }
+    const res = (await request(() => rest.post(`/channels/${channelId}/messages`, {
+        body: messagePayload,
+    }), "voice-message"));
+    return res;
+}

package/dist/gateway/agent-event-assistant-text.js

@@ -0,0 +1,5 @@
+export function resolveAssistantStreamDeltaText(evt) {
+    const delta = evt.data.delta;
+    const text = evt.data.text;
+    return typeof delta === "string" ? delta : typeof text === "string" ? text : "";
+}

package/dist/gateway/agent-prompt.js

@@ -0,0 +1,33 @@
+import { buildHistoryContextFromEntries } from "../auto-reply/reply/history.js";
+export function buildAgentMessageFromConversationEntries(entries) {
+    if (entries.length === 0) {
+        return "";
+    }
+    // Prefer the last user/tool entry as "current message" so the agent responds to
+    // the latest user input or tool output, not the assistant's previous message.
+    let currentIndex = -1;
+    for (let i = entries.length - 1; i >= 0; i -= 1) {
+        const role = entries[i]?.role;
+        if (role === "user" || role === "tool") {
+            currentIndex = i;
+            break;
+        }
+    }
+    if (currentIndex < 0) {
+        currentIndex = entries.length - 1;
+    }
+    const currentEntry = entries[currentIndex]?.entry;
+    if (!currentEntry) {
+        return "";
+    }
+    const historyEntries = entries.slice(0, currentIndex).map((e) => e.entry);
+    if (historyEntries.length === 0) {
+        return currentEntry.body;
+    }
+    const formatEntry = (entry) => `${entry.sender}: ${entry.body}`;
+    return buildHistoryContextFromEntries({
+        entries: [...historyEntries, currentEntry],
+        currentMessage: formatEntry(currentEntry),
+        formatEntry,
+    });
+}

package/dist/gateway/auth-rate-limit.js

@@ -0,0 +1,136 @@
+/**
+ * In-memory sliding-window rate limiter for gateway authentication attempts.
+ *
+ * Tracks failed auth attempts by {scope, clientIp}. A scope lets callers keep
+ * independent counters for different credential classes (for example, shared
+ * gateway token/password vs device-token auth) while still sharing one
+ * limiter instance.
+ *
+ * Design decisions:
+ * - Pure in-memory Map – no external dependencies; suitable for a single
+ *   gateway process.  The Map is periodically pruned to avoid unbounded
+ *   growth.
+ * - Loopback addresses (127.0.0.1 / ::1) are exempt by default so that local
+ *   CLI sessions are never locked out.
+ * - The module is side-effect-free: callers create an instance via
+ *   {@link createAuthRateLimiter} and pass it where needed.
+ */
+import { isLoopbackAddress } from "./net.js";
+export const AUTH_RATE_LIMIT_SCOPE_DEFAULT = "default";
+export const AUTH_RATE_LIMIT_SCOPE_SHARED_SECRET = "shared-secret";
+export const AUTH_RATE_LIMIT_SCOPE_DEVICE_TOKEN = "device-token";
+// ---------------------------------------------------------------------------
+// Defaults
+// ---------------------------------------------------------------------------
+const DEFAULT_MAX_ATTEMPTS = 10;
+const DEFAULT_WINDOW_MS = 60_000; // 1 minute
+const DEFAULT_LOCKOUT_MS = 300_000; // 5 minutes
+const PRUNE_INTERVAL_MS = 60_000; // prune stale entries every minute
+// ---------------------------------------------------------------------------
+// Implementation
+// ---------------------------------------------------------------------------
+export function createAuthRateLimiter(config) {
+    const maxAttempts = config?.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
+    const windowMs = config?.windowMs ?? DEFAULT_WINDOW_MS;
+    const lockoutMs = config?.lockoutMs ?? DEFAULT_LOCKOUT_MS;
+    const exemptLoopback = config?.exemptLoopback ?? true;
+    const entries = new Map();
+    // Periodic cleanup to avoid unbounded map growth.
+    const pruneTimer = setInterval(() => prune(), PRUNE_INTERVAL_MS);
+    // Allow the Node.js process to exit even if the timer is still active.
+    if (pruneTimer.unref) {
+        pruneTimer.unref();
+    }
+    function normalizeScope(scope) {
+        return (scope ?? AUTH_RATE_LIMIT_SCOPE_DEFAULT).trim() || AUTH_RATE_LIMIT_SCOPE_DEFAULT;
+    }
+    function normalizeIp(ip) {
+        return (ip ?? "").trim() || "unknown";
+    }
+    function resolveKey(rawIp, rawScope) {
+        const ip = normalizeIp(rawIp);
+        const scope = normalizeScope(rawScope);
+        return { key: `${scope}:${ip}`, ip };
+    }
+    function isExempt(ip) {
+        return exemptLoopback && isLoopbackAddress(ip);
+    }
+    function slideWindow(entry, now) {
+        const cutoff = now - windowMs;
+        // Remove attempts that fell outside the window.
+        entry.attempts = entry.attempts.filter((ts) => ts > cutoff);
+    }
+    function check(rawIp, rawScope) {
+        const { key, ip } = resolveKey(rawIp, rawScope);
+        if (isExempt(ip)) {
+            return { allowed: true, remaining: maxAttempts, retryAfterMs: 0 };
+        }
+        const now = Date.now();
+        const entry = entries.get(key);
+        if (!entry) {
+            return { allowed: true, remaining: maxAttempts, retryAfterMs: 0 };
+        }
+        // Still locked out?
+        if (entry.lockedUntil && now < entry.lockedUntil) {
+            return {
+                allowed: false,
+                remaining: 0,
+                retryAfterMs: entry.lockedUntil - now,
+            };
+        }
+        // Lockout expired – clear it.
+        if (entry.lockedUntil && now >= entry.lockedUntil) {
+            entry.lockedUntil = undefined;
+            entry.attempts = [];
+        }
+        slideWindow(entry, now);
+        const remaining = Math.max(0, maxAttempts - entry.attempts.length);
+        return { allowed: remaining > 0, remaining, retryAfterMs: 0 };
+    }
+    function recordFailure(rawIp, rawScope) {
+        const { key, ip } = resolveKey(rawIp, rawScope);
+        if (isExempt(ip)) {
+            return;
+        }
+        const now = Date.now();
+        let entry = entries.get(key);
+        if (!entry) {
+            entry = { attempts: [] };
+            entries.set(key, entry);
+        }
+        // If currently locked, do nothing (already blocked).
+        if (entry.lockedUntil && now < entry.lockedUntil) {
+            return;
+        }
+        slideWindow(entry, now);
+        entry.attempts.push(now);
+        if (entry.attempts.length >= maxAttempts) {
+            entry.lockedUntil = now + lockoutMs;
+        }
+    }
+    function reset(rawIp, rawScope) {
+        const { key } = resolveKey(rawIp, rawScope);
+        entries.delete(key);
+    }
+    function prune() {
+        const now = Date.now();
+        for (const [key, entry] of entries) {
+            // If locked out, keep the entry until the lockout expires.
+            if (entry.lockedUntil && now < entry.lockedUntil) {
+                continue;
+            }
+            slideWindow(entry, now);
+            if (entry.attempts.length === 0) {
+                entries.delete(key);
+            }
+        }
+    }
+    function size() {
+        return entries.size;
+    }
+    function dispose() {
+        clearInterval(pruneTimer);
+        entries.clear();
+    }
+    return { check, recordFailure, reset, size, prune, dispose };
+}