agentinbox-cli 0.0.0 → 0.1.0-nightly.10

package/dist/audit-bItbJYFP.js

@@ -0,0 +1,65 @@
+#!/usr/bin/env node
+import { i as now, r as json } from "./db-D0gvshCc.js";
+//#region server/audit.ts
+const SELECT = `SELECT a.*, CASE a.actor_type WHEN 'agent' THEN ag.name WHEN 'admin' THEN 'admin' ELSE NULL END AS actor_name
+  FROM audit_log a LEFT JOIN agents ag ON a.actor_type = 'agent' AND ag.id = a.actor_id`;
+const toEntry = (r) => ({
+	id: r.id,
+	ts: r.ts,
+	actorType: r.actor_type,
+	actorId: r.actor_id,
+	actorName: r.actor_name,
+	action: r.action,
+	accountId: r.account_id,
+	target: r.target,
+	outcome: r.outcome,
+	reason: r.reason,
+	durationMs: r.duration_ms,
+	detail: json.parse(r.detail, null)
+});
+/** Append-only audit log. Every agent tool call and every admin mutation is recorded. */
+var AuditLog = class {
+	db;
+	bus;
+	constructor(db, bus) {
+		this.db = db;
+		this.bus = bus;
+	}
+	record(input) {
+		const { lastInsertRowid } = this.db.run(`INSERT INTO audit_log (ts, actor_type, actor_id, action, account_id, target, outcome, reason, duration_ms, detail)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, now(), input.actorType, input.actorId ?? null, input.action, input.accountId ?? null, input.target ?? null, input.outcome, input.reason ?? null, input.durationMs ?? null, input.detail ? json.str(input.detail) : null);
+		const entry = toEntry(this.db.get(`${SELECT} WHERE a.id = ?`, lastInsertRowid));
+		this.bus.emit("audit", entry);
+		return entry;
+	}
+	/** Newest first. */
+	list(q = {}) {
+		const where = [];
+		const params = [];
+		const add = (clause, value) => {
+			where.push(clause);
+			params.push(value);
+		};
+		if (q.agentId) add("a.actor_id = ?", q.agentId);
+		if (q.accountId) add("a.account_id = ?", q.accountId);
+		if (q.outcome) add("a.outcome = ?", q.outcome);
+		if (q.action) add("a.action = ?", q.action);
+		const before = Number(q.cursor);
+		if (q.cursor && Number.isInteger(before)) add("a.id < ?", before);
+		const limit = Math.min(Math.max(q.limit ?? 50, 1), 200);
+		const rows = this.db.all(`${SELECT} ${where.length ? "WHERE " + where.join(" AND ") : ""} ORDER BY a.id DESC LIMIT ?`, ...params, limit + 1);
+		const items = rows.slice(0, limit).map(toEntry);
+		return {
+			items,
+			nextCursor: rows.length > limit ? String(items.at(-1).id) : null
+		};
+	}
+	/** Deletes entries older than `beforeIso`. Returns the number removed. */
+	prune(beforeIso) {
+		return this.db.run("DELETE FROM audit_log WHERE ts < ?", beforeIso).changes;
+	}
+};
+//#endregion
+export { AuditLog as t };
+
+//# sourceMappingURL=audit-bItbJYFP.js.map

package/dist/audit-bItbJYFP.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-bItbJYFP.js","names":[],"sources":["../server/audit.ts"],"sourcesContent":["import type { ActorType, AuditEntry, AuditOutcome, Page } from \"../shared/types.ts\";\nimport type { Bus } from \"./bus.ts\";\nimport { type Db, json, now } from \"./db/index.ts\";\n\nexport interface AuditInput {\n  actorType: ActorType;\n  actorId?: string | null;\n  /** MCP tool name or console action, e.g. \"send_message\", \"agent.create\", \"account.connect\". */\n  action: string;\n  accountId?: string | null;\n  target?: string | null;\n  outcome: AuditOutcome;\n  /** Required for denials: the guardrail that blocked it (\"allow_to\", \"label_scope\", \"rate_limit\", …). */\n  reason?: string | null;\n  durationMs?: number | null;\n  /** Small, non-sensitive context. Never message bodies, keys or tokens. */\n  detail?: Record<string, unknown> | null;\n}\n\nexport interface AuditQuery {\n  agentId?: string;\n  accountId?: string;\n  outcome?: AuditOutcome;\n  action?: string;\n  /** Opaque cursor from a previous page. */\n  cursor?: string | null;\n  limit?: number;\n}\n\ninterface AuditRow {\n  id: number;\n  ts: string;\n  actor_type: ActorType;\n  actor_id: string | null;\n  actor_name: string | null;\n  action: string;\n  account_id: string | null;\n  target: string | null;\n  outcome: AuditOutcome;\n  reason: string | null;\n  duration_ms: number | null;\n  detail: string | null;\n}\n\nconst SELECT = `SELECT a.*, CASE a.actor_type WHEN 'agent' THEN ag.name WHEN 'admin' THEN 'admin' ELSE NULL END AS actor_name\n  FROM audit_log a LEFT JOIN agents ag ON a.actor_type = 'agent' AND ag.id = a.actor_id`;\n\nconst toEntry = (r: AuditRow): AuditEntry => ({\n  id: r.id,\n  ts: r.ts,\n  actorType: r.actor_type,\n  actorId: r.actor_id,\n  actorName: r.actor_name,\n  action: r.action,\n  accountId: r.account_id,\n  target: r.target,\n  outcome: r.outcome,\n  reason: r.reason,\n  durationMs: r.duration_ms,\n  detail: json.parse<Record<string, unknown> | null>(r.detail, null),\n});\n\n/** Append-only audit log. Every agent tool call and every admin mutation is recorded. */\nexport class AuditLog {\n  constructor(\n    private readonly db: Db,\n    private readonly bus: Bus,\n  ) {}\n\n  record(input: AuditInput): AuditEntry {\n    const { lastInsertRowid } = this.db.run(\n      `INSERT INTO audit_log (ts, actor_type, actor_id, action, account_id, target, outcome, reason, duration_ms, detail)\n       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n      now(),\n      input.actorType,\n      input.actorId ?? null,\n      input.action,\n      input.accountId ?? null,\n      input.target ?? null,\n      input.outcome,\n      input.reason ?? null,\n      input.durationMs ?? null,\n      input.detail ? json.str(input.detail) : null,\n    );\n    const entry = toEntry(this.db.get<AuditRow>(`${SELECT} WHERE a.id = ?`, lastInsertRowid)!);\n    this.bus.emit(\"audit\", entry);\n    return entry;\n  }\n\n  /** Newest first. */\n  list(q: AuditQuery = {}): Page<AuditEntry> {\n    const where: string[] = [];\n    const params: (string | number)[] = [];\n    const add = (clause: string, value: string | number) => {\n      where.push(clause);\n      params.push(value);\n    };\n    if (q.agentId) add(\"a.actor_id = ?\", q.agentId);\n    if (q.accountId) add(\"a.account_id = ?\", q.accountId);\n    if (q.outcome) add(\"a.outcome = ?\", q.outcome);\n    if (q.action) add(\"a.action = ?\", q.action);\n    const before = Number(q.cursor);\n    if (q.cursor && Number.isInteger(before)) add(\"a.id < ?\", before);\n    const limit = Math.min(Math.max(q.limit ?? 50, 1), 200);\n    const rows = this.db.all<AuditRow>(\n      `${SELECT} ${where.length ? \"WHERE \" + where.join(\" AND \") : \"\"} ORDER BY a.id DESC LIMIT ?`,\n      ...params,\n      limit + 1,\n    );\n    const items = rows.slice(0, limit).map(toEntry);\n    return { items, nextCursor: rows.length > limit ? String(items.at(-1)!.id) : null };\n  }\n\n  /** Deletes entries older than `beforeIso`. Returns the number removed. */\n  prune(beforeIso: string): number {\n    return this.db.run(\"DELETE FROM audit_log WHERE ts < ?\", beforeIso).changes;\n  }\n}\n"],"mappings":";;;AA4CA,MAAM,SAAS;;AAGf,MAAM,WAAW,OAA6B;CAC5C,IAAI,EAAE;CACN,IAAI,EAAE;CACN,WAAW,EAAE;CACb,SAAS,EAAE;CACX,WAAW,EAAE;CACb,QAAQ,EAAE;CACV,WAAW,EAAE;CACb,QAAQ,EAAE;CACV,SAAS,EAAE;CACX,QAAQ,EAAE;CACV,YAAY,EAAE;CACd,QAAQ,KAAK,MAAsC,EAAE,QAAQ,IAAI;AACnE;;AAGA,IAAa,WAAb,MAAsB;CAED;CACA;CAFnB,YACE,IACA,KACA;EAFiB,KAAA,KAAA;EACA,KAAA,MAAA;CAChB;CAEH,OAAO,OAA+B;EACpC,MAAM,EAAE,oBAAoB,KAAK,GAAG,IAClC;+CAEA,IAAI,GACJ,MAAM,WACN,MAAM,WAAW,MACjB,MAAM,QACN,MAAM,aAAa,MACnB,MAAM,UAAU,MAChB,MAAM,SACN,MAAM,UAAU,MAChB,MAAM,cAAc,MACpB,MAAM,SAAS,KAAK,IAAI,MAAM,MAAM,IAAI,IAC1C;EACA,MAAM,QAAQ,QAAQ,KAAK,GAAG,IAAc,GAAG,OAAO,kBAAkB,eAAe,CAAE;EACzF,KAAK,IAAI,KAAK,SAAS,KAAK;EAC5B,OAAO;CACT;;CAGA,KAAK,IAAgB,CAAC,GAAqB;EACzC,MAAM,QAAkB,CAAC;EACzB,MAAM,SAA8B,CAAC;EACrC,MAAM,OAAO,QAAgB,UAA2B;GACtD,MAAM,KAAK,MAAM;GACjB,OAAO,KAAK,KAAK;EACnB;EACA,IAAI,EAAE,SAAS,IAAI,kBAAkB,EAAE,OAAO;EAC9C,IAAI,EAAE,WAAW,IAAI,oBAAoB,EAAE,SAAS;EACpD,IAAI,EAAE,SAAS,IAAI,iBAAiB,EAAE,OAAO;EAC7C,IAAI,EAAE,QAAQ,IAAI,gBAAgB,EAAE,MAAM;EAC1C,MAAM,SAAS,OAAO,EAAE,MAAM;EAC9B,IAAI,EAAE,UAAU,OAAO,UAAU,MAAM,GAAG,IAAI,YAAY,MAAM;EAChE,MAAM,QAAQ,KAAK,IAAI,KAAK,IAAI,EAAE,SAAS,IAAI,CAAC,GAAG,GAAG;EACtD,MAAM,OAAO,KAAK,GAAG,IACnB,GAAG,OAAO,GAAG,MAAM,SAAS,WAAW,MAAM,KAAK,OAAO,IAAI,GAAG,8BAChE,GAAG,QACH,QAAQ,CACV;EACA,MAAM,QAAQ,KAAK,MAAM,GAAG,KAAK,CAAC,CAAC,IAAI,OAAO;EAC9C,OAAO;GAAE;GAAO,YAAY,KAAK,SAAS,QAAQ,OAAO,MAAM,GAAG,EAAE,CAAC,CAAE,EAAE,IAAI;EAAK;CACpF;;CAGA,MAAM,WAA2B;EAC/B,OAAO,KAAK,GAAG,IAAI,sCAAsC,SAAS,CAAC,CAAC;CACtE;AACF"}

package/dist/audit-gVdDzkAE.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export { t as AuditLog } from "./audit-bItbJYFP.js";

package/dist/auth-0NrMvHdE.js

@@ -0,0 +1,550 @@
+#!/usr/bin/env node
+import { t as HttpError } from "./errors-FbMS3QBo.js";
+import { i as sha256 } from "./crypto-DYZ4R7c2.js";
+import { i as regenerateSetupToken, n as ensureSetupToken } from "./setup-token-BO89xnpb.js";
+import { isIP, isIPv4, isIPv6 } from "node:net";
+import { getConnInfo } from "@hono/node-server/conninfo";
+import { deleteCookie, getCookie, setCookie } from "hono/cookie";
+import { randomBytes } from "node:crypto";
+const BAN_MS = 9e5;
+/** Tracked clients; the least recently seen is dropped beyond this. */
+const MAX_ENTRIES = 1e4;
+/**
+* Failed sign-in limiter. Per client (IPv4 address or IPv6 /64): 5 distinct wrong secrets or 30
+* attempts within 15 minutes ban it for 15 minutes. A secret already known to be wrong is
+* rejected without hashing (`knownBad`) and counts only as an attempt, so a client retrying a stale
+* password can't spend every attempt, and can't make the server hash it again either. Past a global
+* budget of distinct failures, every attempt is slowed down (never refused, so many clients can't
+* lock the owner out).
+*/
+var LoginLimiter = class {
+	clock;
+	entries = /* @__PURE__ */ new Map();
+	global = {
+		failures: 0,
+		since: 0
+	};
+	constructor(clock = Date.now) {
+		this.clock = clock;
+	}
+	/** Minutes until this client may try again, or 0. */
+	bannedMinutes(ip) {
+		const t = this.clock();
+		const entry = this.entries.get(clientKey(ip));
+		const until = entry && entry.bannedUntil > t ? entry.bannedUntil : 0;
+		return until > t ? Math.ceil((until - t) / 6e4) : 0;
+	}
+	/** The global failure budget is exhausted: slow every attempt down. */
+	overGlobalBudget() {
+		return this.global.failures >= 100 && this.clock() - this.global.since < 9e5;
+	}
+	/** The client already failed with exactly this secret in the current window. */
+	knownBad(ip, secret) {
+		return !!this.current(clientKey(ip), this.clock())?.tried.has(sha256(secret));
+	}
+	/** Records a failure; returns true when it started a ban for this client. `global: false` keeps it out of the global budget. */
+	fail(ip, secret, opts = {}) {
+		return this.record(ip, secret, opts).banned;
+	}
+	/**
+	* Counts an attempt with this secret now, before it is verified, so concurrent requests can't
+	* all pass the ban check first. `countedGlobally` says whether it used global budget (refund it
+	* with `refundGlobal` when the secret turns out to be right).
+	*/
+	record(ip, secret, opts = {}) {
+		const t = this.clock();
+		const key = clientKey(ip);
+		const entry = this.current(key, t) ?? {
+			tried: /* @__PURE__ */ new Set(),
+			attempts: 0,
+			since: t,
+			bannedUntil: 0
+		};
+		const hash = sha256(secret);
+		let countedGlobally = false;
+		if (!entry.tried.has(hash)) {
+			entry.tried.add(hash);
+			if (opts.global !== false) {
+				if (t - this.global.since >= 9e5) this.global = {
+					failures: 0,
+					since: t
+				};
+				this.global.failures++;
+				countedGlobally = true;
+			}
+		}
+		entry.attempts++;
+		const banned = entry.tried.size >= 5 || entry.attempts >= 30;
+		if (banned) entry.bannedUntil = t + BAN_MS;
+		this.touch(key, entry);
+		return {
+			banned,
+			countedGlobally
+		};
+	}
+	refundGlobal() {
+		if (this.global.failures > 0) this.global.failures--;
+	}
+	clear(ip) {
+		this.entries.delete(clientKey(ip));
+	}
+	/** After the password changes, previously wrong secrets may be right. */
+	reset() {
+		this.entries.clear();
+		this.global = {
+			failures: 0,
+			since: 0
+		};
+	}
+	get size() {
+		return this.entries.size;
+	}
+	/** The client's entry if its window (or ban) is still running. */
+	current(key, t) {
+		const entry = this.entries.get(key);
+		if (!entry) return void 0;
+		if (entry.bannedUntil > t || !entry.bannedUntil && t - entry.since < 9e5) return entry;
+		this.entries.delete(key);
+	}
+	/** Map order doubles as LRU order: re-insert on use, evict from the front. */
+	touch(key, entry) {
+		this.entries.delete(key);
+		this.entries.set(key, entry);
+		while (this.entries.size > MAX_ENTRIES) this.entries.delete(this.entries.keys().next().value);
+	}
+};
+/** IPv4 addresses as is (also when IPv4-mapped); IPv6 by /64, since one client usually owns the whole prefix. */
+function clientKey(ip) {
+	const addr = ip.replace(/%.*$/, "").toLowerCase();
+	const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(addr);
+	if (mapped) return mapped[1];
+	if (!isIPv6(addr)) return addr;
+	const [head = "", tail] = addr.split("::");
+	const left = head ? head.split(":") : [];
+	const right = tail ? tail.split(":") : [];
+	return `${(tail === void 0 ? left : [
+		...left,
+		...Array(8 - left.length - right.length).fill("0"),
+		...right
+	]).slice(0, 4).map((g) => g.replace(/^0+(?=.)/, "")).join(":")}::/64`;
+}
+//#endregion
+//#region server/auth/proxy.ts
+function parseV4(ip) {
+	return ip.split(".").reduce((acc, part) => acc << 8n | BigInt(Number(part)), 0n);
+}
+function parseAddress(raw) {
+	const ip = raw.trim().replace(/^\[|\]$/g, "").replace(/%.*$/, "").toLowerCase();
+	if (isIPv4(ip)) return {
+		v6: false,
+		n: parseV4(ip)
+	};
+	if (!isIPv6(ip)) return null;
+	const mapped = /^(?:0{0,4}:){0,5}:?ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(ip);
+	if (mapped && isIPv4(mapped[1])) return {
+		v6: false,
+		n: parseV4(mapped[1])
+	};
+	let text = ip;
+	const v4Tail = /(\d+\.\d+\.\d+\.\d+)$/.exec(text);
+	if (v4Tail) {
+		const n = parseV4(v4Tail[1]);
+		text = text.slice(0, -v4Tail[1].length) + `${(n >> 16n).toString(16)}:${(n & 65535n).toString(16)}`;
+	}
+	const [head = "", tail] = text.split("::");
+	const left = head ? head.split(":") : [];
+	const right = tail ? tail.split(":") : [];
+	const groups = tail === void 0 ? left : [
+		...left,
+		...Array(8 - left.length - right.length).fill("0"),
+		...right
+	];
+	if (groups.length !== 8) return null;
+	return {
+		v6: true,
+		n: groups.reduce((acc, g) => acc << 16n | BigInt(Number.parseInt(g || "0", 16)), 0n)
+	};
+}
+/**
+* Parses "10.0.0.5", "10.0.0.0/8", "fd00::/8", "::ffff:10.0.0.0/104"; null when invalid. A /0
+* (trust everyone) is refused: it would let any client pick its own address.
+*/
+function parseRange(entry) {
+	const parts = entry.trim().split("/");
+	if (parts.length > 2) return null;
+	const [ip = "", prefix] = parts;
+	const addr = parseAddress(ip);
+	if (!addr) return null;
+	let bits = addr.v6 ? 128 : 32;
+	if (prefix !== void 0) {
+		if (!/^\d{1,3}$/.test(prefix)) return null;
+		bits = Number(prefix);
+		if (!addr.v6 && ip.includes(":")) bits -= 96;
+		if (bits <= 0 || bits > (addr.v6 ? 128 : 32)) return null;
+	}
+	const width = BigInt(addr.v6 ? 128 : 32);
+	const mask = bits === 0 ? 0n : (1n << BigInt(bits)) - 1n << width - BigInt(bits);
+	return {
+		v6: addr.v6,
+		base: addr.n & mask,
+		bits
+	};
+}
+function inRange(addr, r) {
+	if (addr.v6 !== r.v6) return false;
+	const width = BigInt(r.v6 ? 128 : 32);
+	const mask = r.bits === 0 ? 0n : (1n << BigInt(r.bits)) - 1n << width - BigInt(r.bits);
+	return (addr.n & mask) === r.base;
+}
+const LOOPBACK = [parseRange("127.0.0.0/8"), parseRange("::1/128")];
+let cache;
+/** TRUST_PROXY_FROM as ranges. Invalid entries are reported once and ignored. */
+function trustedRanges(raw) {
+	if (cache?.raw === raw) return cache.ranges;
+	const ranges = [];
+	const invalid = [];
+	for (const entry of raw.split(/[,\s]+/).filter(Boolean)) {
+		const r = parseRange(entry);
+		if (r) ranges.push(r);
+		else invalid.push(entry);
+	}
+	if (invalid.length) process.stderr.write(`agentinbox: ignoring invalid TRUST_PROXY_FROM entries: ${invalid.join(", ")}\n`);
+	cache = {
+		raw,
+		ranges
+	};
+	return ranges;
+}
+/**
+* Whether forwarding headers from this socket peer may be believed: loopback always (a proxy on
+* the same host), anything else only when listed in TRUST_PROXY_FROM (IPs or CIDRs, comma-separated).
+* The daemon usually binds 0.0.0.0, so trusting whole private ranges would let any LAN or tailnet
+* peer forge its address.
+*/
+function isTrustedProxy(peer, trustFrom = process.env.TRUST_PROXY_FROM ?? "") {
+	const addr = parseAddress(peer);
+	if (!addr) return false;
+	return [...LOOPBACK, ...trustedRanges(trustFrom)].some((r) => inRange(addr, r));
+}
+//#endregion
+//#region server/auth/sessions.ts
+const SESSION_TTL_MS = 2592e6;
+/** Sliding refresh never extends a session past this age: sign in again after 90 days. */
+const SESSION_MAX_AGE_MS = 7776e6;
+/** Sliding expiry is pushed forward at most once per this interval, to avoid a write per request. */
+const REFRESH_AFTER_MS = 864e5;
+/** Admin console sessions. Only sha256(token) is stored. */
+var SessionStore = class {
+	db;
+	clock;
+	constructor(db, clock = Date.now) {
+		this.db = db;
+		this.clock = clock;
+	}
+	create(meta = {}) {
+		const token = randomBytes(32).toString("base64url");
+		const t = this.clock();
+		this.db.run("INSERT INTO admin_sessions (token_hash, created_at, expires_at, ip, user_agent) VALUES (?, ?, ?, ?, ?)", sha256(token), new Date(t).toISOString(), new Date(t + SESSION_TTL_MS).toISOString(), meta.ip ?? null, meta.userAgent?.slice(0, 300) ?? null);
+		return token;
+	}
+	check(token) {
+		if (!token) return {
+			valid: false,
+			refreshed: false
+		};
+		const hash = sha256(token);
+		const row = this.db.get("SELECT created_at, expires_at FROM admin_sessions WHERE token_hash = ?", hash);
+		if (!row) return {
+			valid: false,
+			refreshed: false
+		};
+		const t = this.clock();
+		const expires = Date.parse(row.expires_at);
+		const hardLimit = Date.parse(row.created_at) + SESSION_MAX_AGE_MS;
+		if (!(expires > t) || !(hardLimit > t)) {
+			this.db.run("DELETE FROM admin_sessions WHERE token_hash = ?", hash);
+			return {
+				valid: false,
+				refreshed: false
+			};
+		}
+		const next = Math.min(t + SESSION_TTL_MS, hardLimit);
+		if (next - expires < REFRESH_AFTER_MS) return {
+			valid: true,
+			refreshed: false
+		};
+		this.db.run("UPDATE admin_sessions SET expires_at = ? WHERE token_hash = ?", new Date(next).toISOString(), hash);
+		return {
+			valid: true,
+			refreshed: true
+		};
+	}
+	delete(token) {
+		this.db.run("DELETE FROM admin_sessions WHERE token_hash = ?", sha256(token));
+	}
+	/** Revokes every session, optionally keeping one (the caller's own). */
+	deleteAll(exceptToken) {
+		if (exceptToken) return this.db.run("DELETE FROM admin_sessions WHERE token_hash != ?", sha256(exceptToken)).changes;
+		return this.db.run("DELETE FROM admin_sessions").changes;
+	}
+	pruneExpired() {
+		return this.db.run("DELETE FROM admin_sessions WHERE expires_at <= ?", new Date(this.clock()).toISOString()).changes;
+	}
+};
+//#endregion
+//#region server/auth/index.ts
+const SESSION_COOKIE = "aib_session";
+const CSRF_HEADER = "x-agentinbox-csrf";
+const MAX_PASSWORD_LENGTH = 1024;
+/** Hands out at most `max` slots; waiters are served in order. */
+var Semaphore = class {
+	max;
+	active = 0;
+	waiters = [];
+	constructor(max) {
+		this.max = max;
+	}
+	get inUse() {
+		return this.active;
+	}
+	async acquire() {
+		if (this.active < this.max) this.active++;
+		else await new Promise((resolve) => this.waiters.push(resolve));
+		let released = false;
+		return () => {
+			if (released) return;
+			released = true;
+			const next = this.waiters.shift();
+			if (next) next();
+			else this.active--;
+		};
+	}
+};
+const instances = /* @__PURE__ */ new WeakMap();
+function adminAuth(ctx) {
+	let auth = instances.get(ctx);
+	if (!auth) {
+		auth = {
+			sessions: new SessionStore(ctx.db),
+			limiter: new LoginLimiter(),
+			lanes: /* @__PURE__ */ new Map(),
+			verifySlots: new Semaphore(4)
+		};
+		instances.set(ctx, auth);
+	}
+	return auth;
+}
+/** Claimed = an admin password exists. Before that only the setup-token claim works. */
+const isClaimed = (ctx) => !!ctx.settings.getState("admin.passwordHash");
+/** The current setup token while unclaimed (created on demand), otherwise null. */
+function currentSetupToken(ctx) {
+	return isClaimed(ctx) ? null : ensureSetupToken(ctx.config.dataDir);
+}
+/** `agentinbox reset-password`: back to the unclaimed state with a fresh setup link. */
+function resetAdminPassword(ctx) {
+	const auth = adminAuth(ctx);
+	ctx.db.tx(() => {
+		ctx.settings.deleteState("admin.passwordHash");
+		auth.sessions.deleteAll();
+	});
+	auth.limiter.reset();
+	ctx.audit.record({
+		actorType: "system",
+		action: "admin.password_reset",
+		outcome: "ok"
+	});
+	return regenerateSetupToken(ctx.config.dataDir);
+}
+function socketAddress(c) {
+	try {
+		return getConnInfo(c).remote.address ?? null;
+	} catch {
+		return null;
+	}
+}
+/**
+* The client address. X-Forwarded-For is honored only with TRUST_PROXY and only when the
+* connection comes from a trusted proxy (loopback, or TRUST_PROXY_FROM); it is read from the
+* right, since proxies append the address they saw and entries further left are client-controlled.
+* TRUST_PROXY_HOPS (default 1) is the number of proxies in front of agentinbox.
+*/
+/** Some proxies (Azure, IIS) append ":port" to X-Forwarded-For entries. */
+function stripPort(entry) {
+	const v6 = /^\[([^\]]+)\](?::\d+)?$/.exec(entry);
+	if (v6) return v6[1];
+	const v4 = /^(\d{1,3}(?:\.\d{1,3}){3}):\d+$/.exec(entry);
+	return v4 ? v4[1] : entry;
+}
+let warnedUntrustedProxy = false;
+/** Upgrades from the old private-range rule silently lost proxy trust; say so once. */
+function warnUntrustedProxy(peer) {
+	if (warnedUntrustedProxy) return;
+	warnedUntrustedProxy = true;
+	process.stderr.write(`agentinbox: ignoring X-Forwarded-For from ${peer}: TRUST_PROXY only trusts loopback proxies unless TRUST_PROXY_FROM lists them (e.g. TRUST_PROXY_FROM=${peer}).\n`);
+}
+function clientIp(c, trustProxy) {
+	const peer = socketAddress(c);
+	if (trustProxy && peer && !isTrustedProxy(peer) && c.req.header("x-forwarded-for")) warnUntrustedProxy(peer);
+	if (trustProxy && peer && isTrustedProxy(peer)) {
+		const hops = Math.max(1, Number.parseInt(process.env.TRUST_PROXY_HOPS ?? "1", 10) || 1);
+		const chain = (c.req.header("x-forwarded-for") ?? "").split(",").map((s) => stripPort(s.trim())).filter(Boolean);
+		const forwarded = chain[chain.length - hops];
+		if (forwarded && isIP(forwarded)) return forwarded;
+	}
+	return peer ?? "unknown";
+}
+function isSecure(c, trustProxy) {
+	if (new URL(c.req.url).protocol === "https:") return true;
+	const peer = socketAddress(c);
+	return trustProxy && !!peer && isTrustedProxy(peer) && c.req.header("x-forwarded-proto")?.split(",")[0]?.trim().toLowerCase() === "https";
+}
+function sessionToken(c) {
+	return getCookie(c, "aib_session") || void 0;
+}
+function writeSessionCookie(c, token, trustProxy) {
+	setCookie(c, SESSION_COOKIE, token, {
+		httpOnly: true,
+		sameSite: "Lax",
+		path: "/",
+		secure: isSecure(c, trustProxy),
+		maxAge: Math.floor(SESSION_TTL_MS / 1e3)
+	});
+}
+/** Creates a session for the requester and sets the cookie. */
+function startSession(c, ctx) {
+	writeSessionCookie(c, adminAuth(ctx).sessions.create({
+		ip: clientIp(c, ctx.config.trustProxy),
+		userAgent: c.req.header("user-agent")
+	}), ctx.config.trustProxy);
+}
+function endSession(c, ctx) {
+	const token = sessionToken(c);
+	if (token) adminAuth(ctx).sessions.delete(token);
+	deleteCookie(c, SESSION_COOKIE, { path: "/" });
+}
+/** Whether the request carries a valid session; refreshes the cookie when the expiry slid forward. */
+function hasSession(c, ctx) {
+	const token = sessionToken(c);
+	const check = adminAuth(ctx).sessions.check(token);
+	if (check.refreshed && token) writeSessionCookie(c, token, ctx.config.trustProxy);
+	return check.valid;
+}
+/** Requires an admin session on every route it guards. */
+function requireAdmin(ctx) {
+	return async (c, next) => {
+		if (!hasSession(c, ctx)) {
+			if (!isClaimed(ctx)) throw new HttpError(401, "setup_required", "This instance has not been claimed yet", "Open the setup link printed by agentinbox on startup.");
+			throw new HttpError(401, "unauthorized", "Sign in to continue");
+		}
+		c.set("admin", true);
+		await next();
+	};
+}
+const MUTATING = /* @__PURE__ */ new Set([
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE"
+]);
+/**
+* CSRF guard: a custom header can't be sent cross-site without a CORS preflight (which this server
+* never approves), and SameSite=Lax already keeps the cookie off cross-site POSTs.
+*/
+function csrfGuard() {
+	return async (c, next) => {
+		if (MUTATING.has(c.req.method) && c.req.header("x-agentinbox-csrf") !== "1") throw new HttpError(403, "csrf", `Missing ${CSRF_HEADER} header`, `Send "${CSRF_HEADER}: 1" with every mutating /api request.`);
+		await next();
+	};
+}
+/** 429 response for a locked-out address. */
+function lockedOut(c, minutes) {
+	c.header("Retry-After", String(minutes * 60));
+	const message = `Too many failed attempts. Try again in ${minutes} minute${minutes === 1 ? "" : "s"}.`;
+	return c.json({ error: {
+		code: "locked_out",
+		message
+	} }, 429);
+}
+/**
+* Verifies a secret under the failed-login limiter.
+* - Each client gets one check at a time (a few more may queue, the rest get `busy`), and at most
+*   MAX_CONCURRENT_VERIFICATIONS run at once overall.
+* - The attempt is recorded before `verify` (scrypt) runs and refunded if it succeeds, so
+*   concurrent requests can't all slip past the ban.
+* - Locked-out clients and secrets this client already failed with never reach `verify`.
+* - While the instance-wide budget is exhausted, each attempt waits a little first; it is never refused.
+*/
+async function checkSecret(ctx, ip, secret, verify, opts = {}) {
+	const auth = adminAuth(ctx);
+	const key = clientKey(ip);
+	const lane = auth.lanes.get(key) ?? {
+		tail: Promise.resolve(),
+		queued: 0
+	};
+	if (lane.queued > 4) return {
+		ok: false,
+		lockedMinutes: 0,
+		nowBanned: false,
+		busy: true
+	};
+	lane.queued++;
+	auth.lanes.set(key, lane);
+	const previous = lane.tail;
+	let done;
+	lane.tail = new Promise((resolve) => done = resolve);
+	try {
+		await previous;
+		return await checkOnce(auth, ip, secret, verify, opts);
+	} finally {
+		done();
+		if (--lane.queued === 0) auth.lanes.delete(key);
+	}
+}
+async function checkOnce(auth, ip, secret, verify, opts) {
+	const { limiter } = auth;
+	const global = opts.global !== false;
+	if (global && limiter.overGlobalBudget() && !limiter.bannedMinutes(ip)) await new Promise((r) => setTimeout(r, opts.slowdownMs ?? 2e3));
+	const locked = limiter.bannedMinutes(ip);
+	if (locked) return {
+		ok: false,
+		lockedMinutes: locked,
+		nowBanned: false
+	};
+	if (limiter.knownBad(ip, secret)) return {
+		ok: false,
+		lockedMinutes: 0,
+		nowBanned: limiter.fail(ip, secret, { global })
+	};
+	const reservation = limiter.record(ip, secret, { global });
+	const release = await auth.verifySlots.acquire();
+	let ok = false;
+	try {
+		ok = await verify();
+	} finally {
+		release();
+	}
+	if (!ok) return {
+		ok: false,
+		lockedMinutes: 0,
+		nowBanned: reservation.banned
+	};
+	limiter.clear(ip);
+	if (reservation.countedGlobally) limiter.refundGlobal();
+	return { ok: true };
+}
+/** The 429 for a rejected check (locked out or too many at once), or null to continue. */
+function rejection(c, check) {
+	if (check.ok) return null;
+	if (check.busy) {
+		c.header("Retry-After", "2");
+		return c.json({ error: {
+			code: "too_many_requests",
+			message: "Another sign-in attempt from your address is still being checked. Try again in a moment."
+		} }, 429);
+	}
+	return check.lockedMinutes ? lockedOut(c, check.lockedMinutes) : null;
+}
+//#endregion
+export { sessionToken as _, adminAuth as a, LoginLimiter as b, csrfGuard as c, hasSession as d, isClaimed as f, resetAdminPassword as g, requireAdmin as h, Semaphore as i, currentSetupToken as l, rejection as m, MAX_PASSWORD_LENGTH as n, checkSecret as o, lockedOut as p, SESSION_COOKIE as r, clientIp as s, CSRF_HEADER as t, endSession as u, startSession as v, clientKey as x, BAN_MS as y };
+
+//# sourceMappingURL=auth-0NrMvHdE.js.map