@proteinjs/user-server 1.22.1 → 1.22.2

package/dist/src/throttle/ClientAddress.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClientAddress = void 0;
+/**
+ * The client's address, as a throttle should key on it.
+ *
+ * Behind Google's external Application Load Balancer the `X-Forwarded-For` header ENDS with the
+ * two entries the balancer appends — `<client-ip>,<load-balancer-ip>` — and everything before
+ * them is whatever the client itself sent. So the client is the second entry from the right:
+ * - never the LAST entry: that is the balancer's own forwarding-rule address, the same for every
+ *   visitor. It is what express's `request.ip` resolves to under the server's `trust proxy 1`
+ *   (one trusted hop: the Google front end that opened the connection), so a throttle keyed on
+ *   `request.ip` there is one bucket for the whole world;
+ * - never the FIRST entry: a client can send its own header, and the balancer keeps it.
+ *
+ * Only when the server trusts a proxy (the deployed shape; `trust proxy` is unset in
+ * development) is the header read at all. A request that did not come through the balancer —
+ * no appended pair: an in-cluster call, a probe — and every request in development key on the
+ * connection's own address.
+ */
+var ClientAddress = /** @class */ (function () {
+    function ClientAddress() {
+    }
+    ClientAddress.prototype.of = function (request) {
+        var _a, _b, _c, _d;
+        if ((_b = (_a = request.app) === null || _a === void 0 ? void 0 : _a.get) === null || _b === void 0 ? void 0 : _b.call(_a, 'trust proxy')) {
+            var entries = this.forwardedFor(request);
+            if (entries.length >= ClientAddress.BALANCER_APPENDED_ENTRIES) {
+                return entries[entries.length - ClientAddress.BALANCER_APPENDED_ENTRIES];
+            }
+        }
+        return (_d = (_c = request.socket) === null || _c === void 0 ? void 0 : _c.remoteAddress) !== null && _d !== void 0 ? _d : '';
+    };
+    ClientAddress.prototype.forwardedFor = function (request) {
+        var _a;
+        var header = (_a = request.headers) === null || _a === void 0 ? void 0 : _a['x-forwarded-for'];
+        var value = Array.isArray(header) ? header.join(',') : header !== null && header !== void 0 ? header : '';
+        return value
+            .split(',')
+            .map(function (entry) { return entry.trim(); })
+            .filter(function (entry) { return entry.length > 0; });
+    };
+    /** How many entries the load balancer appends to the header: the client, then itself. */
+    ClientAddress.BALANCER_APPENDED_ENTRIES = 2;
+    return ClientAddress;
+}());
+exports.ClientAddress = ClientAddress;
+//# sourceMappingURL=ClientAddress.js.map

package/dist/src/throttle/ClientAddress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientAddress.js","sourceRoot":"","sources":["../../../src/throttle/ClientAddress.ts"],"names":[],"mappings":";;;AAOA;;;;;;;;;;;;;;;;GAgBG;AACH;IAAA;IAsBA,CAAC;IAlBC,0BAAE,GAAF,UAAG,OAAsB;;QACvB,IAAI,MAAA,MAAA,OAAO,CAAC,GAAG,0CAAE,GAAG,mDAAG,aAAa,CAAC,EAAE;YACrC,IAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC,yBAAyB,EAAE;gBAC7D,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,aAAa,CAAC,yBAAyB,CAAC,CAAC;aAC1E;SACF;QACD,OAAO,MAAA,MAAA,OAAO,CAAC,MAAM,0CAAE,aAAa,mCAAI,EAAE,CAAC;IAC7C,CAAC;IAEO,oCAAY,GAApB,UAAqB,OAAsB;;QACzC,IAAM,MAAM,GAAG,MAAA,OAAO,CAAC,OAAO,0CAAG,iBAAiB,CAAC,CAAC;QACpD,IAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,EAAE,CAAC;QACtE,OAAO,KAAK;aACT,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,UAAC,KAAK,IAAK,OAAA,KAAK,CAAC,IAAI,EAAE,EAAZ,CAAY,CAAC;aAC5B,MAAM,CAAC,UAAC,KAAK,IAAK,OAAA,KAAK,CAAC,MAAM,GAAG,CAAC,EAAhB,CAAgB,CAAC,CAAC;IACzC,CAAC;IApBD,yFAAyF;IACjE,uCAAyB,GAAG,CAAC,CAAC;IAoBxD,oBAAC;CAAA,AAtBD,IAsBC;AAtBY,sCAAa"}

package/dist/src/throttle/PasswordResetThrottle.d.ts

@@ -0,0 +1,39 @@
+import { ThrottleWindow } from './SignInThrottle';
+/**
+ * The password-reset door's two windows (`POST /user/initiate-password-reset`), keyed by digests
+ * (`RequestDigests`), never by an address. Both count every request, whether or not the address
+ * has an account — a window that only counted real accounts would itself say which addresses
+ * have one. Past either window nothing is looked up, minted or mailed; the door's answer is the
+ * same sentence as always (see the route).
+ *
+ * These sit on top of the account row's own five-minute gap between links, which spans replicas
+ * (it is stored); the windows are in process memory (`SlidingWindow`): per replica. A
+ * deployment of three replicas behind a load balancer (up to ten under load) keeps three sets
+ * of windows, so its effective ceiling is ~3× the numbers below (up to ~10×) — for one address
+ * still at most one mail per five minutes. Friction, not the wall — a shared store is a
+ * separate step.
+ */
+export declare class PasswordResetThrottle {
+    /**
+     * Per client: 10 requests an hour. Someone asking for their own address again, or a household
+     * asking for a few addresses, passes; a script sweeping addresses stops at ten.
+     */
+    private static readonly CLIENT_LIMIT;
+    private static readonly CLIENT_WINDOW_MS;
+    /**
+     * Per address: 3 requests an hour. A person whose mail is slow asks once or twice more; beyond
+     * that it is mail aimed at somebody's inbox.
+     */
+    private static readonly ACCOUNT_LIMIT;
+    private static readonly ACCOUNT_WINDOW_MS;
+    private readonly clients;
+    private readonly accounts;
+    constructor(options?: {
+        now?: () => number;
+    });
+    /** Count this request and answer which window refuses it, if any. */
+    admit(client: string, account: string): ThrottleWindow | undefined;
+}
+/** The process-wide windows the reset door shares — they must span requests. */
+export declare const passwordResetThrottle: PasswordResetThrottle;
+//# sourceMappingURL=PasswordResetThrottle.d.ts.map

package/dist/src/throttle/PasswordResetThrottle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordResetThrottle.d.ts","sourceRoot":"","sources":["../../../src/throttle/PasswordResetThrottle.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD;;;;;;;;;;;;;GAaG;AACH,qBAAa,qBAAqB;IAChC;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAM;IAC1C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAkB;IAE1D;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAK;IAC1C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAkB;IAE3D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;gBAE7B,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;KAAE;IAa5C,qEAAqE;IACrE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;CASnE;AAED,gFAAgF;AAChF,eAAO,MAAM,qBAAqB,uBAA8B,CAAC"}

package/dist/src/throttle/PasswordResetThrottle.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.passwordResetThrottle = exports.PasswordResetThrottle = void 0;
+var SlidingWindow_1 = require("./SlidingWindow");
+/**
+ * The password-reset door's two windows (`POST /user/initiate-password-reset`), keyed by digests
+ * (`RequestDigests`), never by an address. Both count every request, whether or not the address
+ * has an account — a window that only counted real accounts would itself say which addresses
+ * have one. Past either window nothing is looked up, minted or mailed; the door's answer is the
+ * same sentence as always (see the route).
+ *
+ * These sit on top of the account row's own five-minute gap between links, which spans replicas
+ * (it is stored); the windows are in process memory (`SlidingWindow`): per replica. A
+ * deployment of three replicas behind a load balancer (up to ten under load) keeps three sets
+ * of windows, so its effective ceiling is ~3× the numbers below (up to ~10×) — for one address
+ * still at most one mail per five minutes. Friction, not the wall — a shared store is a
+ * separate step.
+ */
+var PasswordResetThrottle = /** @class */ (function () {
+    function PasswordResetThrottle(options) {
+        this.clients = new SlidingWindow_1.SlidingWindow({
+            windowMs: PasswordResetThrottle.CLIENT_WINDOW_MS,
+            limit: PasswordResetThrottle.CLIENT_LIMIT,
+            now: options === null || options === void 0 ? void 0 : options.now,
+        });
+        this.accounts = new SlidingWindow_1.SlidingWindow({
+            windowMs: PasswordResetThrottle.ACCOUNT_WINDOW_MS,
+            limit: PasswordResetThrottle.ACCOUNT_LIMIT,
+            now: options === null || options === void 0 ? void 0 : options.now,
+        });
+    }
+    /** Count this request and answer which window refuses it, if any. */
+    PasswordResetThrottle.prototype.admit = function (client, account) {
+        if (this.clients.hit(client)) {
+            return 'client';
+        }
+        if (this.accounts.hit(account)) {
+            return 'account';
+        }
+        return undefined;
+    };
+    /**
+     * Per client: 10 requests an hour. Someone asking for their own address again, or a household
+     * asking for a few addresses, passes; a script sweeping addresses stops at ten.
+     */
+    PasswordResetThrottle.CLIENT_LIMIT = 10;
+    PasswordResetThrottle.CLIENT_WINDOW_MS = 60 * 60 * 1000;
+    /**
+     * Per address: 3 requests an hour. A person whose mail is slow asks once or twice more; beyond
+     * that it is mail aimed at somebody's inbox.
+     */
+    PasswordResetThrottle.ACCOUNT_LIMIT = 3;
+    PasswordResetThrottle.ACCOUNT_WINDOW_MS = 60 * 60 * 1000;
+    return PasswordResetThrottle;
+}());
+exports.PasswordResetThrottle = PasswordResetThrottle;
+/** The process-wide windows the reset door shares — they must span requests. */
+exports.passwordResetThrottle = new PasswordResetThrottle();
+//# sourceMappingURL=PasswordResetThrottle.js.map

package/dist/src/throttle/PasswordResetThrottle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordResetThrottle.js","sourceRoot":"","sources":["../../../src/throttle/PasswordResetThrottle.ts"],"names":[],"mappings":";;;AAAA,iDAAgD;AAGhD;;;;;;;;;;;;;GAaG;AACH;IAkBE,+BAAY,OAAgC;QAC1C,IAAI,CAAC,OAAO,GAAG,IAAI,6BAAa,CAAC;YAC/B,QAAQ,EAAE,qBAAqB,CAAC,gBAAgB;YAChD,KAAK,EAAE,qBAAqB,CAAC,YAAY;YACzC,GAAG,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAG,IAAI,6BAAa,CAAC;YAChC,QAAQ,EAAE,qBAAqB,CAAC,iBAAiB;YACjD,KAAK,EAAE,qBAAqB,CAAC,aAAa;YAC1C,GAAG,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG;SAClB,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IACrE,qCAAK,GAAL,UAAM,MAAc,EAAE,OAAe;QACnC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;YAC5B,OAAO,QAAQ,CAAC;SACjB;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;YAC9B,OAAO,SAAS,CAAC;SAClB;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAvCD;;;OAGG;IACqB,kCAAY,GAAG,EAAE,CAAC;IAClB,sCAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAE1D;;;OAGG;IACqB,mCAAa,GAAG,CAAC,CAAC;IAClB,uCAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IA4B7D,4BAAC;CAAA,AAzCD,IAyCC;AAzCY,sDAAqB;AA2ClC,gFAAgF;AACnE,QAAA,qBAAqB,GAAG,IAAI,qBAAqB,EAAE,CAAC"}

package/dist/src/throttle/RequestDigests.d.ts

@@ -0,0 +1,42 @@
+/**
+ * The two keyed digests the throttled doors key their windows on and write on their log lines,
+ * in place of what they stand for:
+ * - `account(email)` — the ACCOUNT DIGEST: a keyed hash of the trimmed, lowercased address.
+ *   One address gives one digest however it was typed, on every replica and across restarts, so
+ *   an operator can say "one account" across lines without the address.
+ * - `coarseIp(address)` — the COARSE IP HASH: a keyed hash of the client address at the grain
+ *   one device holds (an IPv4 address; an IPv6 /64, inside which a device rotates freely), so
+ *   an operator can say "one device" and a throttle cannot be dodged by rotating inside a /64.
+ *
+ * Keyed with HMAC-SHA256 under a key DERIVED from the session secret — the one secret every
+ * replica already shares, the same keying the invite-request door's IP hash uses; derived per
+ * purpose, never used raw, so neither digest weakens the session's own use of it, and the two
+ * digests never collide in meaning. Truncated to 64 bits: enough to tell accounts and devices
+ * apart, useless to anyone without the key — never the address, never a plain hash a list of
+ * addresses could reverse.
+ *
+ * The key is the deployment's `SESSION_SECRET` unless the constructor is given one (the tests).
+ * Without either the digests refuse to run: a server with no `SESSION_SECRET` has no sessions
+ * either (the session middleware refuses to start), so nothing ever runs unkeyed — never a plain
+ * hash a list of addresses could reverse, never a per-process key that quietly stops matching
+ * across replicas.
+ */
+export declare class RequestDigests {
+    private readonly options?;
+    /** Hex characters kept from the HMAC: 64 bits. */
+    private static readonly DIGEST_HEX_LENGTH;
+    constructor(options?: {
+        secret?: string | undefined;
+    } | undefined);
+    /** The account digest of an address, however it was typed. */
+    account(email: string): string;
+    /** The coarse IP hash of a client address (see `ClientAddress`). */
+    coarseIp(address: string): string;
+    private digest;
+    private secret;
+    /** An IPv4 address as itself (an IPv4-mapped IPv6 address as its IPv4); an IPv6 address as its /64. */
+    private coarsen;
+    /** The first four groups (the /64) of an IPv6 address, each without leading zeros; undefined when it does not parse. */
+    private ipv6Groups;
+}
+//# sourceMappingURL=RequestDigests.d.ts.map

package/dist/src/throttle/RequestDigests.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RequestDigests.d.ts","sourceRoot":"","sources":["../../../src/throttle/RequestDigests.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,cAAc;IAIb,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAHrC,kDAAkD;IAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAM;gBAElB,OAAO,CAAC;;iBAAqB;IAE1D,8DAA8D;IAC9D,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAI9B,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAIjC,OAAO,CAAC,MAAM;IAOd,OAAO,CAAC,MAAM;IAUd,uGAAuG;IACvG,OAAO,CAAC,OAAO;IAYf,wHAAwH;IACxH,OAAO,CAAC,UAAU;CAwBnB"}

package/dist/src/throttle/RequestDigests.js

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RequestDigests = void 0;
+var crypto_1 = require("crypto");
+/**
+ * The two keyed digests the throttled doors key their windows on and write on their log lines,
+ * in place of what they stand for:
+ * - `account(email)` — the ACCOUNT DIGEST: a keyed hash of the trimmed, lowercased address.
+ *   One address gives one digest however it was typed, on every replica and across restarts, so
+ *   an operator can say "one account" across lines without the address.
+ * - `coarseIp(address)` — the COARSE IP HASH: a keyed hash of the client address at the grain
+ *   one device holds (an IPv4 address; an IPv6 /64, inside which a device rotates freely), so
+ *   an operator can say "one device" and a throttle cannot be dodged by rotating inside a /64.
+ *
+ * Keyed with HMAC-SHA256 under a key DERIVED from the session secret — the one secret every
+ * replica already shares, the same keying the invite-request door's IP hash uses; derived per
+ * purpose, never used raw, so neither digest weakens the session's own use of it, and the two
+ * digests never collide in meaning. Truncated to 64 bits: enough to tell accounts and devices
+ * apart, useless to anyone without the key — never the address, never a plain hash a list of
+ * addresses could reverse.
+ *
+ * The key is the deployment's `SESSION_SECRET` unless the constructor is given one (the tests).
+ * Without either the digests refuse to run: a server with no `SESSION_SECRET` has no sessions
+ * either (the session middleware refuses to start), so nothing ever runs unkeyed — never a plain
+ * hash a list of addresses could reverse, never a per-process key that quietly stops matching
+ * across replicas.
+ */
+var RequestDigests = /** @class */ (function () {
+    function RequestDigests(options) {
+        this.options = options;
+    }
+    /** The account digest of an address, however it was typed. */
+    RequestDigests.prototype.account = function (email) {
+        return this.digest('account-digest', email.trim().toLowerCase());
+    };
+    /** The coarse IP hash of a client address (see `ClientAddress`). */
+    RequestDigests.prototype.coarseIp = function (address) {
+        return this.digest('coarse-ip', this.coarsen(address.trim().toLowerCase()));
+    };
+    RequestDigests.prototype.digest = function (purpose, value) {
+        return (0, crypto_1.createHmac)('sha256', "".concat(purpose, ":").concat(this.secret()))
+            .update(value)
+            .digest('hex')
+            .slice(0, RequestDigests.DIGEST_HEX_LENGTH);
+    };
+    RequestDigests.prototype.secret = function () {
+        var _a, _b;
+        var configured = (_b = (_a = this.options) === null || _a === void 0 ? void 0 : _a.secret) !== null && _b !== void 0 ? _b : process.env.SESSION_SECRET;
+        if (!configured) {
+            throw new Error('SESSION_SECRET is not set: the account digest and the coarse IP hash need the key every replica shares');
+        }
+        return configured;
+    };
+    /** An IPv4 address as itself (an IPv4-mapped IPv6 address as its IPv4); an IPv6 address as its /64. */
+    RequestDigests.prototype.coarsen = function (address) {
+        var mapped = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/.exec(address);
+        if (mapped) {
+            return mapped[1];
+        }
+        if (!address.includes(':')) {
+            return address;
+        }
+        var groups = this.ipv6Groups(address.split('%')[0]);
+        return groups ? "".concat(groups.slice(0, 4).join(':'), "::/64") : address;
+    };
+    /** The first four groups (the /64) of an IPv6 address, each without leading zeros; undefined when it does not parse. */
+    RequestDigests.prototype.ipv6Groups = function (address) {
+        var halves = address.split('::');
+        if (halves.length > 2) {
+            return undefined;
+        }
+        var parts = function (half) { return (half ? half.split(':') : []); };
+        var head = parts(halves[0]);
+        var tail = parts(halves[1]);
+        // A trailing dotted IPv4 part stands for two groups.
+        var groupsIn = function (list) { return list.reduce(function (count, part) { return count + (part.includes('.') ? 2 : 1); }, 0); };
+        var missing = 8 - groupsIn(head) - groupsIn(tail);
+        if (missing < 0 || (halves.length === 1 && missing !== 0)) {
+            return undefined;
+        }
+        var zeros = [];
+        for (var i = 0; i < missing; i++) {
+            zeros.push('0');
+        }
+        var groups = head.concat(zeros, tail).slice(0, 4);
+        if (groups.some(function (group) { return !/^[0-9a-f]{1,4}$/.test(group); })) {
+            return undefined;
+        }
+        return groups.map(function (group) { return parseInt(group, 16).toString(16); });
+    };
+    /** Hex characters kept from the HMAC: 64 bits. */
+    RequestDigests.DIGEST_HEX_LENGTH = 16;
+    return RequestDigests;
+}());
+exports.RequestDigests = RequestDigests;
+//# sourceMappingURL=RequestDigests.js.map

package/dist/src/throttle/RequestDigests.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RequestDigests.js","sourceRoot":"","sources":["../../../src/throttle/RequestDigests.ts"],"names":[],"mappings":";;;AAAA,iCAAoC;AAEpC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH;IAIE,wBAA6B,OAA6B;QAA7B,YAAO,GAAP,OAAO,CAAsB;IAAG,CAAC;IAE9D,8DAA8D;IAC9D,gCAAO,GAAP,UAAQ,KAAa;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,oEAAoE;IACpE,iCAAQ,GAAR,UAAS,OAAe;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC9E,CAAC;IAEO,+BAAM,GAAd,UAAe,OAAe,EAAE,KAAa;QAC3C,OAAO,IAAA,mBAAU,EAAC,QAAQ,EAAE,UAAG,OAAO,cAAI,IAAI,CAAC,MAAM,EAAE,CAAE,CAAC;aACvD,MAAM,CAAC,KAAK,CAAC;aACb,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,iBAAiB,CAAC,CAAC;IAChD,CAAC;IAEO,+BAAM,GAAd;;QACE,IAAM,UAAU,GAAG,MAAA,MAAA,IAAI,CAAC,OAAO,0CAAE,MAAM,mCAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QACtE,IAAI,CAAC,UAAU,EAAE;YACf,MAAM,IAAI,KAAK,CACb,wGAAwG,CACzG,CAAC;SACH;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,uGAAuG;IAC/F,gCAAO,GAAf,UAAgB,OAAe;QAC7B,IAAM,MAAM,GAAG,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClE,IAAI,MAAM,EAAE;YACV,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;SAClB;QACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE;YAC1B,OAAO,OAAO,CAAC;SAChB;QACD,IAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,OAAO,MAAM,CAAC,CAAC,CAAC,UAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,UAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IACnE,CAAC;IAED,wHAAwH;IAChH,mCAAU,GAAlB,UAAmB,OAAe;QAChC,IAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE;YACrB,OAAO,SAAS,CAAC;SAClB;QACD,IAAM,KAAK,GAAG,UAAC,IAAwB,IAAK,OAAA,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAA7B,CAA6B,CAAC;QAC1E,IAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,qDAAqD;QACrD,IAAM,QAAQ,GAAG,UAAC,IAAc,IAAK,OAAA,IAAI,CAAC,MAAM,CAAC,UAAC,KAAK,EAAE,IAAI,IAAK,OAAA,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAApC,CAAoC,EAAE,CAAC,CAAC,EAArE,CAAqE,CAAC;QAC3G,IAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE;YACzD,OAAO,SAAS,CAAC;SAClB;QACD,IAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,EAAE;YAChC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;SACjB;QACD,IAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpD,IAAI,MAAM,CAAC,IAAI,CAAC,UAAC,KAAK,IAAK,OAAA,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAA9B,CAA8B,CAAC,EAAE;YAC1D,OAAO,SAAS,CAAC;SAClB;QACD,OAAO,MAAM,CAAC,GAAG,CAAC,UAAC,KAAK,IAAK,OAAA,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAhC,CAAgC,CAAC,CAAC;IACjE,CAAC;IArED,kDAAkD;IAC1B,gCAAiB,GAAG,EAAE,CAAC;IAqEjD,qBAAC;CAAA,AAvED,IAuEC;AAvEY,wCAAc"}

package/dist/src/throttle/SignInThrottle.d.ts

@@ -0,0 +1,67 @@
+/** Which window refused a try: the client's (its coarse IP hash) or the account's (its digest). */
+export type ThrottleWindow = 'client' | 'account';
+/**
+ * The sign-in door's two windows (`POST /user/login`), keyed by digests (`RequestDigests`),
+ * never by an address:
+ * - per CLIENT: every try that is not a success counts — wrong passwords, blank ones too, the
+ *   client made them — so one device cannot sweep many accounts; a successful sign-in never
+ *   counts (it is forgiven the moment it succeeds), so the people behind one shared address
+ *   signing in do not spend the window on each other;
+ * - per ACCOUNT: every try that carries a password counts (a blank submission judges no
+ *   password, so it never counts), so guesses spread over many devices still stop; a success
+ *   clears the account's count. A try is counted as it ARRIVES, before it is judged: tries in
+ *   flight at the same moment cannot all pass the window together.
+ *
+ * A throttled try is told `ANSWER` whichever window refused it and whether or not the address
+ * has an account, in the same time a refused password takes (the door runs the same password
+ * check and discards its verdict).
+ *
+ * The windows are in process memory (`SlidingWindow`): per replica. A deployment of three
+ * replicas behind a load balancer (up to ten under load) keeps three sets of windows, so its
+ * effective ceiling is ~3× the numbers below (up to ~10×). Friction, not the wall — a shared
+ * store is a separate step.
+ */
+export declare class SignInThrottle {
+    /** What a throttled try is told — in plain words, the same for every address, known or not. */
+    static readonly ANSWER = "Too many attempts. Try again in a few minutes.";
+    /**
+     * Per client: 50 tries that are not successes in 10 minutes (the founder's number, 2026-09-23).
+     * Successes never count, so an office or a school behind one address signing in at nine o'clock
+     * never spends this window on itself — only its mistypes do, and fifty wrong or blank tries in
+     * ten minutes is beyond any human population behind one address; a guessing script from one
+     * device is held to ~300 tries an hour per replica.
+     */
+    private static readonly CLIENT_LIMIT;
+    private static readonly CLIENT_WINDOW_MS;
+    /**
+     * Per account: 10 tries in 15 minutes (a success clears them, so only wrong ones ever add up).
+     * Someone who has forgotten a password tries a handful and asks for a reset link; ten wrong in
+     * a quarter of an hour is guessing, and counting per account holds however many devices the
+     * guesses come from. "A few minutes" in the answer is honest: the oldest try leaves the window
+     * within 15.
+     */
+    private static readonly ACCOUNT_LIMIT;
+    private static readonly ACCOUNT_WINDOW_MS;
+    private readonly clients;
+    private readonly accounts;
+    constructor(options?: {
+        now?: () => number;
+    });
+    /**
+     * Count this try against the client and against the account, and answer which window refuses
+     * it, if any. `account` is the digest of the address tried, given only when a password came
+     * with it (a blank submission judges no password, so it never counts toward an account). The
+     * count is taken here, before the try is judged, so tries in flight at once cannot all pass
+     * the window; a success clears it (`recordSuccess`).
+     */
+    admit(client: string, account?: string): ThrottleWindow | undefined;
+    /**
+     * The account proved itself: its window opens again. When it was a sign-in try from `client`
+     * (rather than a reset link redeemed), that try is forgiven — a success never counts against
+     * the device.
+     */
+    recordSuccess(account: string, client?: string): void;
+}
+/** The process-wide windows the sign-in door shares — they must span requests. */
+export declare const signInThrottle: SignInThrottle;
+//# sourceMappingURL=SignInThrottle.d.ts.map

package/dist/src/throttle/SignInThrottle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignInThrottle.d.ts","sourceRoot":"","sources":["../../../src/throttle/SignInThrottle.ts"],"names":[],"mappings":"AAEA,mGAAmG;AACnG,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,SAAS,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,cAAc;IACzB,+FAA+F;IAC/F,MAAM,CAAC,QAAQ,CAAC,MAAM,oDAAoD;IAE1E;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAM;IAC1C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAkB;IAE1D;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAM;IAC3C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAkB;IAE3D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;gBAE7B,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;KAAE;IAa5C;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAUnE;;;;OAIG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;CAMtD;AAED,kFAAkF;AAClF,eAAO,MAAM,cAAc,gBAAuB,CAAC"}

package/dist/src/throttle/SignInThrottle.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signInThrottle = exports.SignInThrottle = void 0;
+var SlidingWindow_1 = require("./SlidingWindow");
+/**
+ * The sign-in door's two windows (`POST /user/login`), keyed by digests (`RequestDigests`),
+ * never by an address:
+ * - per CLIENT: every try that is not a success counts — wrong passwords, blank ones too, the
+ *   client made them — so one device cannot sweep many accounts; a successful sign-in never
+ *   counts (it is forgiven the moment it succeeds), so the people behind one shared address
+ *   signing in do not spend the window on each other;
+ * - per ACCOUNT: every try that carries a password counts (a blank submission judges no
+ *   password, so it never counts), so guesses spread over many devices still stop; a success
+ *   clears the account's count. A try is counted as it ARRIVES, before it is judged: tries in
+ *   flight at the same moment cannot all pass the window together.
+ *
+ * A throttled try is told `ANSWER` whichever window refused it and whether or not the address
+ * has an account, in the same time a refused password takes (the door runs the same password
+ * check and discards its verdict).
+ *
+ * The windows are in process memory (`SlidingWindow`): per replica. A deployment of three
+ * replicas behind a load balancer (up to ten under load) keeps three sets of windows, so its
+ * effective ceiling is ~3× the numbers below (up to ~10×). Friction, not the wall — a shared
+ * store is a separate step.
+ */
+var SignInThrottle = /** @class */ (function () {
+    function SignInThrottle(options) {
+        this.clients = new SlidingWindow_1.SlidingWindow({
+            windowMs: SignInThrottle.CLIENT_WINDOW_MS,
+            limit: SignInThrottle.CLIENT_LIMIT,
+            now: options === null || options === void 0 ? void 0 : options.now,
+        });
+        this.accounts = new SlidingWindow_1.SlidingWindow({
+            windowMs: SignInThrottle.ACCOUNT_WINDOW_MS,
+            limit: SignInThrottle.ACCOUNT_LIMIT,
+            now: options === null || options === void 0 ? void 0 : options.now,
+        });
+    }
+    /**
+     * Count this try against the client and against the account, and answer which window refuses
+     * it, if any. `account` is the digest of the address tried, given only when a password came
+     * with it (a blank submission judges no password, so it never counts toward an account). The
+     * count is taken here, before the try is judged, so tries in flight at once cannot all pass
+     * the window; a success clears it (`recordSuccess`).
+     */
+    SignInThrottle.prototype.admit = function (client, account) {
+        if (this.clients.hit(client)) {
+            return 'client';
+        }
+        if (account !== undefined && this.accounts.hit(account)) {
+            return 'account';
+        }
+        return undefined;
+    };
+    /**
+     * The account proved itself: its window opens again. When it was a sign-in try from `client`
+     * (rather than a reset link redeemed), that try is forgiven — a success never counts against
+     * the device.
+     */
+    SignInThrottle.prototype.recordSuccess = function (account, client) {
+        this.accounts.clear(account);
+        if (client !== undefined) {
+            this.clients.forgive(client);
+        }
+    };
+    /** What a throttled try is told — in plain words, the same for every address, known or not. */
+    SignInThrottle.ANSWER = 'Too many attempts. Try again in a few minutes.';
+    /**
+     * Per client: 50 tries that are not successes in 10 minutes (the founder's number, 2026-09-23).
+     * Successes never count, so an office or a school behind one address signing in at nine o'clock
+     * never spends this window on itself — only its mistypes do, and fifty wrong or blank tries in
+     * ten minutes is beyond any human population behind one address; a guessing script from one
+     * device is held to ~300 tries an hour per replica.
+     */
+    SignInThrottle.CLIENT_LIMIT = 50;
+    SignInThrottle.CLIENT_WINDOW_MS = 10 * 60 * 1000;
+    /**
+     * Per account: 10 tries in 15 minutes (a success clears them, so only wrong ones ever add up).
+     * Someone who has forgotten a password tries a handful and asks for a reset link; ten wrong in
+     * a quarter of an hour is guessing, and counting per account holds however many devices the
+     * guesses come from. "A few minutes" in the answer is honest: the oldest try leaves the window
+     * within 15.
+     */
+    SignInThrottle.ACCOUNT_LIMIT = 10;
+    SignInThrottle.ACCOUNT_WINDOW_MS = 15 * 60 * 1000;
+    return SignInThrottle;
+}());
+exports.SignInThrottle = SignInThrottle;
+/** The process-wide windows the sign-in door shares — they must span requests. */
+exports.signInThrottle = new SignInThrottle();
+//# sourceMappingURL=SignInThrottle.js.map

package/dist/src/throttle/SignInThrottle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignInThrottle.js","sourceRoot":"","sources":["../../../src/throttle/SignInThrottle.ts"],"names":[],"mappings":";;;AAAA,iDAAgD;AAKhD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH;IA2BE,wBAAY,OAAgC;QAC1C,IAAI,CAAC,OAAO,GAAG,IAAI,6BAAa,CAAC;YAC/B,QAAQ,EAAE,cAAc,CAAC,gBAAgB;YACzC,KAAK,EAAE,cAAc,CAAC,YAAY;YAClC,GAAG,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAG,IAAI,6BAAa,CAAC;YAChC,QAAQ,EAAE,cAAc,CAAC,iBAAiB;YAC1C,KAAK,EAAE,cAAc,CAAC,aAAa;YACnC,GAAG,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG;SAClB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,8BAAK,GAAL,UAAM,MAAc,EAAE,OAAgB;QACpC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;YAC5B,OAAO,QAAQ,CAAC;SACjB;QACD,IAAI,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;YACvD,OAAO,SAAS,CAAC;SAClB;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,sCAAa,GAAb,UAAc,OAAe,EAAE,MAAe;QAC5C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,MAAM,KAAK,SAAS,EAAE;YACxB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;SAC9B;IACH,CAAC;IAlED,+FAA+F;IAC/E,qBAAM,GAAG,gDAAgD,CAAC;IAE1E;;;;;;OAMG;IACqB,2BAAY,GAAG,EAAE,CAAC;IAClB,+BAAgB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAE1D;;;;;;OAMG;IACqB,4BAAa,GAAG,EAAE,CAAC;IACnB,gCAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IA8C7D,qBAAC;CAAA,AApED,IAoEC;AApEY,wCAAc;AAsE3B,kFAAkF;AACrE,QAAA,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC"}

package/dist/src/throttle/SlidingWindow.d.ts

@@ -0,0 +1,51 @@
+/**
+ * A per-key sliding window: how many attempts a key made in the last `windowMs`, against a
+ * `limit`. The one window every throttled door shares — the sign-in and password-reset doors in
+ * this package, and any consumer door throttling per client (lifted from the invite-request
+ * door's per-IP throttle, which it replaces).
+ *
+ * Held in process memory only, which is what makes it cheap and what bounds it:
+ * - PER PROCESS. Each replica keeps its own windows, so behind a load balancer spreading a
+ *   client over N replicas the effective ceiling is ~N× the limit; a restart forgets them.
+ *   A throttle built on this is friction, not the wall. A shared store is a separate step.
+ * - BOUNDED. At most `maxKeys` keys are tracked; at the bound the oldest-touched key is
+ *   forgotten first, so a flood of fresh keys degrades the friction before it grows memory.
+ *
+ * Keys are whatever the caller passes — callers pass digests (see `RequestDigests`), never raw
+ * addresses, so nothing identifying is held here either.
+ */
+export declare class SlidingWindow {
+    private static readonly DEFAULT_MAX_KEYS;
+    private readonly windowMs;
+    private readonly limit;
+    private readonly maxKeys;
+    private readonly now;
+    /** key → the counted attempt times inside the window (pruned on touch), in touch order. */
+    private readonly attempts;
+    constructor(options: {
+        windowMs: number;
+        limit: number;
+        maxKeys?: number;
+        now?: () => number;
+    });
+    /**
+     * Record an attempt for `key` and answer whether it was over the window — `true` means refuse.
+     * A refused attempt is not counted, so a key drains one window after its last counted attempt.
+     */
+    hit(key: string): boolean;
+    /** Whether `key` has used up its window, without counting anything. */
+    isOver(key: string): boolean;
+    /** Count an attempt for `key` without answering (for doors that judge the attempt first). */
+    record(key: string): void;
+    /** Forget `key`'s attempts. */
+    clear(key: string): void;
+    /**
+     * Uncount `key`'s latest attempt (for doors that count a try as it arrives and learn afterwards
+     * that it should never have counted — a sign-in that succeeded).
+     */
+    forgive(key: string): void;
+    private inWindow;
+    /** Store `key`'s attempts as the most recently touched, evicting the oldest-touched key at the bound. */
+    private touch;
+}
+//# sourceMappingURL=SlidingWindow.d.ts.map

package/dist/src/throttle/SlidingWindow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SlidingWindow.d.ts","sourceRoot":"","sources":["../../../src/throttle/SlidingWindow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAU;IAElD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+B;gBAE5C,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;KAAE;IAO9F;;;OAGG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IASzB,uEAAuE;IACvE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAI5B,6FAA6F;IAC7F,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAMzB,+BAA+B;IAC/B,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAIxB;;;OAGG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAM1B,OAAO,CAAC,QAAQ;IAKhB,yGAAyG;IACzG,OAAO,CAAC,KAAK;CAUd"}

package/dist/src/throttle/SlidingWindow.js

@@ -0,0 +1,85 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SlidingWindow = void 0;
+/**
+ * A per-key sliding window: how many attempts a key made in the last `windowMs`, against a
+ * `limit`. The one window every throttled door shares — the sign-in and password-reset doors in
+ * this package, and any consumer door throttling per client (lifted from the invite-request
+ * door's per-IP throttle, which it replaces).
+ *
+ * Held in process memory only, which is what makes it cheap and what bounds it:
+ * - PER PROCESS. Each replica keeps its own windows, so behind a load balancer spreading a
+ *   client over N replicas the effective ceiling is ~N× the limit; a restart forgets them.
+ *   A throttle built on this is friction, not the wall. A shared store is a separate step.
+ * - BOUNDED. At most `maxKeys` keys are tracked; at the bound the oldest-touched key is
+ *   forgotten first, so a flood of fresh keys degrades the friction before it grows memory.
+ *
+ * Keys are whatever the caller passes — callers pass digests (see `RequestDigests`), never raw
+ * addresses, so nothing identifying is held here either.
+ */
+var SlidingWindow = /** @class */ (function () {
+    function SlidingWindow(options) {
+        var _a, _b;
+        /** key → the counted attempt times inside the window (pruned on touch), in touch order. */
+        this.attempts = new Map();
+        this.windowMs = options.windowMs;
+        this.limit = options.limit;
+        this.maxKeys = (_a = options.maxKeys) !== null && _a !== void 0 ? _a : SlidingWindow.DEFAULT_MAX_KEYS;
+        this.now = (_b = options.now) !== null && _b !== void 0 ? _b : Date.now;
+    }
+    /**
+     * Record an attempt for `key` and answer whether it was over the window — `true` means refuse.
+     * A refused attempt is not counted, so a key drains one window after its last counted attempt.
+     */
+    SlidingWindow.prototype.hit = function (key) {
+        if (this.isOver(key)) {
+            this.touch(key, this.inWindow(key));
+            return true;
+        }
+        this.record(key);
+        return false;
+    };
+    /** Whether `key` has used up its window, without counting anything. */
+    SlidingWindow.prototype.isOver = function (key) {
+        return this.inWindow(key).length >= this.limit;
+    };
+    /** Count an attempt for `key` without answering (for doors that judge the attempt first). */
+    SlidingWindow.prototype.record = function (key) {
+        var attempts = this.inWindow(key);
+        attempts.push(this.now());
+        this.touch(key, attempts);
+    };
+    /** Forget `key`'s attempts. */
+    SlidingWindow.prototype.clear = function (key) {
+        this.attempts.delete(key);
+    };
+    /**
+     * Uncount `key`'s latest attempt (for doors that count a try as it arrives and learn afterwards
+     * that it should never have counted — a sign-in that succeeded).
+     */
+    SlidingWindow.prototype.forgive = function (key) {
+        var attempts = this.inWindow(key);
+        attempts.pop();
+        this.touch(key, attempts);
+    };
+    SlidingWindow.prototype.inWindow = function (key) {
+        var _a;
+        var cutoff = this.now() - this.windowMs;
+        return ((_a = this.attempts.get(key)) !== null && _a !== void 0 ? _a : []).filter(function (time) { return time > cutoff; });
+    };
+    /** Store `key`'s attempts as the most recently touched, evicting the oldest-touched key at the bound. */
+    SlidingWindow.prototype.touch = function (key, attempts) {
+        if (!this.attempts.has(key) && this.attempts.size >= this.maxKeys) {
+            var oldest = this.attempts.keys().next().value;
+            if (oldest !== undefined) {
+                this.attempts.delete(oldest);
+            }
+        }
+        this.attempts.delete(key);
+        this.attempts.set(key, attempts);
+    };
+    SlidingWindow.DEFAULT_MAX_KEYS = 10000;
+    return SlidingWindow;
+}());
+exports.SlidingWindow = SlidingWindow;
+//# sourceMappingURL=SlidingWindow.js.map

package/dist/src/throttle/SlidingWindow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SlidingWindow.js","sourceRoot":"","sources":["../../../src/throttle/SlidingWindow.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;GAeG;AACH;IAUE,uBAAY,OAAkF;;QAH9F,2FAA2F;QAC1E,aAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;QAGtD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,MAAA,OAAO,CAAC,OAAO,mCAAI,aAAa,CAAC,gBAAgB,CAAC;QACjE,IAAI,CAAC,GAAG,GAAG,MAAA,OAAO,CAAC,GAAG,mCAAI,IAAI,CAAC,GAAG,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,2BAAG,GAAH,UAAI,GAAW;QACb,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;YACpB,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YACpC,OAAO,IAAI,CAAC;SACb;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,uEAAuE;IACvE,8BAAM,GAAN,UAAO,GAAW;QAChB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC;IACjD,CAAC;IAED,6FAA6F;IAC7F,8BAAM,GAAN,UAAO,GAAW;QAChB,IAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED,+BAA+B;IAC/B,6BAAK,GAAL,UAAM,GAAW;QACf,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACH,+BAAO,GAAP,UAAQ,GAAW;QACjB,IAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpC,QAAQ,CAAC,GAAG,EAAE,CAAC;QACf,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAEO,gCAAQ,GAAhB,UAAiB,GAAW;;QAC1B,IAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC1C,OAAO,CAAC,MAAA,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,mCAAI,EAAE,CAAC,CAAC,MAAM,CAAC,UAAC,IAAI,IAAK,OAAA,IAAI,GAAG,MAAM,EAAb,CAAa,CAAC,CAAC;IACxE,CAAC;IAED,yGAAyG;IACjG,6BAAK,GAAb,UAAc,GAAW,EAAE,QAAkB;QAC3C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE;YACjE,IAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YACjD,IAAI,MAAM,KAAK,SAAS,EAAE;gBACxB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;aAC9B;SACF;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;IAvEuB,8BAAgB,GAAG,KAAM,AAAT,CAAU;IAwEpD,oBAAC;CAAA,AAzED,IAyEC;AAzEY,sCAAa"}

package/dist/test/ClientAddress.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ClientAddress.test.d.ts.map

package/dist/test/ClientAddress.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientAddress.test.d.ts","sourceRoot":"","sources":["../../test/ClientAddress.test.ts"],"names":[],"mappings":""}