@agenticmail/enterprise 0.3.2 → 0.4.0

package/src/deploy/managed.ts

@@ -38,7 +38,7 @@ export async function deployToCloud(
   const token = flyToken || process.env.FLY_API_TOKEN;
   if (!token) {
     return {
-      url: `https://${config.subdomain}.agenticmail.cloud`,
+      url: `https://${config.subdomain}.agenticmail.io`,
       appName: `am-${config.subdomain}`,
       region: config.region || 'iad',
       status: 'pending',
@@ -74,31 +74,47 @@ export async function deployToCloud(
 }
 
 /**
- * Generate a Docker Compose file for self-hosted deployment.
+ * Generate an .env file containing secrets for Docker deployment.
+ * This file should NOT be committed to version control.
  */
-export function generateDockerCompose(opts: {
+export function generateEnvFile(opts: {
   dbType: string;
   dbConnectionString: string;
-  port: number;
   jwtSecret: string;
-  smtpHost?: string;
-  smtpPort?: number;
   smtpUser?: string;
   smtpPass?: string;
+}): string {
+  const lines = [
+    '# AgenticMail Enterprise — Environment Variables',
+    '# WARNING: Contains secrets. Do NOT commit to version control.',
+    `# Generated at ${new Date().toISOString()}`,
+    '',
+    `DATABASE_TYPE=${opts.dbType}`,
+    `DATABASE_URL=${opts.dbConnectionString}`,
+    `JWT_SECRET=${opts.jwtSecret}`,
+  ];
+  if (opts.smtpUser) lines.push(`SMTP_USER=${opts.smtpUser}`);
+  if (opts.smtpPass) lines.push(`SMTP_PASS=${opts.smtpPass}`);
+  return lines.join('\n') + '\n';
+}
+
+/**
+ * Generate a Docker Compose file for self-hosted deployment.
+ * Secrets are loaded from .env file (generated by generateEnvFile).
+ */
+export function generateDockerCompose(opts: {
+  port: number;
+  smtpHost?: string;
+  smtpPort?: number;
 }): string {
   const env: string[] = [
     `      - NODE_ENV=production`,
-    `      - DATABASE_TYPE=${opts.dbType}`,
-    `      - DATABASE_URL=${opts.dbConnectionString}`,
-    `      - JWT_SECRET=${opts.jwtSecret}`,
     `      - PORT=3000`,
   ];
 
   if (opts.smtpHost) {
     env.push(`      - SMTP_HOST=${opts.smtpHost}`);
     env.push(`      - SMTP_PORT=${opts.smtpPort || 587}`);
-    if (opts.smtpUser) env.push(`      - SMTP_USER=${opts.smtpUser}`);
-    if (opts.smtpPass) env.push(`      - SMTP_PASS=${opts.smtpPass}`);
   }
 
   return `# AgenticMail Enterprise — Docker Compose
@@ -107,6 +123,9 @@ export function generateDockerCompose(opts: {
 # Usage:
 #   docker compose up -d
 #   open http://localhost:${opts.port}
+#
+# Secrets are loaded from .env file (DATABASE_URL, JWT_SECRET, etc.)
+# Do NOT commit .env to version control.
 
 version: "3.8"
 
@@ -115,6 +134,8 @@ services:
     image: agenticmail/enterprise:latest
     ports:
       - "${opts.port}:3000"
+    env_file:
+      - .env
     environment:
 ${env.join('\n')}
     restart: unless-stopped

package/src/domain-lock/cli-recover.ts

@@ -0,0 +1,124 @@
+/**
+ * CLI Command: recover
+ *
+ * Recover a domain registration on a new machine.
+ * Requires the original deployment key to prove ownership.
+ *
+ * Usage:
+ *   agenticmail-enterprise recover
+ *   agenticmail-enterprise recover --domain agents.agenticmail.io --key <hex>
+ *   agenticmail-enterprise recover --db ./data.db --db-type sqlite
+ */
+
+import { DomainLock } from './index.js';
+
+function getFlag(args: string[], name: string): string | undefined {
+  const idx = args.indexOf(name);
+  if (idx !== -1 && args[idx + 1]) return args[idx + 1];
+  return undefined;
+}
+
+export async function runRecover(args: string[]): Promise<void> {
+  const { default: inquirer } = await import('inquirer');
+  const { default: chalk } = await import('chalk');
+  const { default: ora } = await import('ora');
+
+  console.log('');
+  console.log(chalk.bold('  AgenticMail Enterprise — Domain Recovery'));
+  console.log(chalk.dim('  Recover your domain registration on a new machine.'));
+  console.log('');
+
+  // ── Collect domain ─────────────────────────────────
+
+  let domain = getFlag(args, '--domain');
+  if (!domain) {
+    const answer = await inquirer.prompt([{
+      type: 'input',
+      name: 'domain',
+      message: 'Domain to recover:',
+      suffix: chalk.dim('  (e.g. agents.agenticmail.io)'),
+      validate: (v: string) => v.includes('.') || 'Enter a valid domain',
+    }]);
+    domain = answer.domain;
+  }
+
+  // ── Collect deployment key ─────────────────────────
+
+  let key = getFlag(args, '--key');
+  if (!key) {
+    const answer = await inquirer.prompt([{
+      type: 'password',
+      name: 'key',
+      message: 'Deployment key:',
+      mask: '*',
+      validate: (v: string) => {
+        if (v.length !== 64) return 'Deployment key should be 64 hex characters';
+        if (!/^[0-9a-fA-F]+$/.test(v)) return 'Deployment key should be hexadecimal';
+        return true;
+      },
+    }]);
+    key = answer.key;
+  }
+
+  // ── Contact registry ───────────────────────────────
+
+  const spinner = ora('Contacting AgenticMail registry...').start();
+
+  const lock = new DomainLock();
+  const result = await lock.recover(domain!, key!);
+
+  if (!result.success) {
+    spinner.fail('Recovery failed');
+    console.log('');
+    console.error(chalk.red(`  ${result.error}`));
+    console.log('');
+    process.exit(1);
+  }
+
+  spinner.succeed('Domain recovery initiated');
+
+  // ── Store locally ──────────────────────────────────
+  // Hash the key for local storage
+  const { default: bcrypt } = await import('bcryptjs');
+  const keyHash = await bcrypt.hash(key!, 12);
+
+  // Try to connect to local DB and store
+  const dbPath = getFlag(args, '--db');
+  const dbType = getFlag(args, '--db-type') || 'sqlite';
+
+  if (dbPath) {
+    try {
+      const spinnerDb = ora('Saving to local database...').start();
+      const { createAdapter } = await import('../db/factory.js');
+      const db = await createAdapter({ type: dbType as any, connectionString: dbPath });
+      await db.migrate();
+      await db.updateSettings({
+        domain: domain!,
+        deploymentKeyHash: keyHash,
+        domainRegistrationId: result.registrationId,
+        domainDnsChallenge: result.dnsChallenge,
+        domainRegisteredAt: new Date().toISOString(),
+        domainStatus: 'pending_dns',
+      } as any);
+      spinnerDb.succeed('Local database updated');
+      await db.disconnect();
+    } catch (err: any) {
+      console.log(chalk.yellow(`\n  Could not update local DB: ${err.message}`));
+      console.log(chalk.dim('  You can manually update settings after setup.'));
+    }
+  }
+
+  // ── Display instructions ───────────────────────────
+
+  console.log('');
+  console.log(chalk.green.bold('  Domain recovery successful!'));
+  console.log('');
+  console.log(chalk.bold('  Update your DNS TXT record:'));
+  console.log('');
+  console.log(`  ${chalk.bold('Host:')}   ${chalk.cyan(`_agenticmail-verify.${domain}`)}`);
+  console.log(`  ${chalk.bold('Type:')}   ${chalk.cyan('TXT')}`);
+  console.log(`  ${chalk.bold('Value:')}  ${chalk.cyan(result.dnsChallenge)}`);
+  console.log('');
+  console.log(chalk.dim('  Then run: agenticmail-enterprise verify-domain'));
+  console.log('');
+}

package/src/domain-lock/cli-verify.ts

@@ -0,0 +1,122 @@
+/**
+ * CLI Command: verify-domain
+ *
+ * Check DNS verification status for a registered domain.
+ * Asks the central registry to resolve the TXT record.
+ *
+ * Usage:
+ *   agenticmail-enterprise verify-domain
+ *   agenticmail-enterprise verify-domain --domain agents.agenticmail.io
+ *   agenticmail-enterprise verify-domain --db ./data.db
+ */
+
+import { DomainLock } from './index.js';
+
+function getFlag(args: string[], name: string): string | undefined {
+  const idx = args.indexOf(name);
+  if (idx !== -1 && args[idx + 1]) return args[idx + 1];
+  return undefined;
+}
+
+export async function runVerifyDomain(args: string[]): Promise<void> {
+  const { default: chalk } = await import('chalk');
+  const { default: ora } = await import('ora');
+
+  console.log('');
+  console.log(chalk.bold('  AgenticMail Enterprise — Domain Verification'));
+  console.log('');
+
+  // ── Determine domain ───────────────────────────────
+
+  let domain = getFlag(args, '--domain');
+  let dnsChallenge: string | undefined;
+  let dbConnected = false;
+  let db: any = null;
+
+  // Try to read from local DB if domain not specified
+  if (!domain) {
+    const dbPath = getFlag(args, '--db');
+    const dbType = getFlag(args, '--db-type') || 'sqlite';
+
+    if (dbPath) {
+      try {
+        const { createAdapter } = await import('../db/factory.js');
+        db = await createAdapter({ type: dbType as any, connectionString: dbPath });
+        await db.migrate();
+        const settings = await db.getSettings();
+        domain = settings?.domain;
+        dnsChallenge = settings?.domainDnsChallenge;
+        dbConnected = true;
+      } catch {
+        // Can't read DB, will ask for domain
+      }
+    }
+  }
+
+  if (!domain) {
+    const { default: inquirer } = await import('inquirer');
+    const answer = await inquirer.prompt([{
+      type: 'input',
+      name: 'domain',
+      message: 'Domain to verify:',
+      suffix: chalk.dim('  (e.g. agents.agenticmail.io)'),
+      validate: (v: string) => v.includes('.') || 'Enter a valid domain',
+    }]);
+    domain = answer.domain;
+  }
+
+  // ── Check verification ─────────────────────────────
+
+  const spinner = ora('Checking DNS verification...').start();
+
+  const lock = new DomainLock();
+  const result = await lock.checkVerification(domain!);
+
+  if (!result.success) {
+    spinner.fail('Verification check failed');
+    console.log('');
+    console.error(chalk.red(`  ${result.error}`));
+    console.log('');
+    if (db) await db.disconnect();
+    process.exit(1);
+  }
+
+  if (result.verified) {
+    spinner.succeed('Domain verified!');
+
+    // Update local DB if connected
+    if (dbConnected && db) {
+      try {
+        await db.updateSettings({
+          domainStatus: 'verified',
+          domainVerifiedAt: new Date().toISOString(),
+        } as any);
+      } catch { /* non-critical */ }
+    }
+
+    console.log('');
+    console.log(chalk.green.bold(`  ${domain} is verified and protected.`));
+    console.log(chalk.dim('  Your deployment domain is locked. No other instance can claim it.'));
+    console.log('');
+  } else {
+    spinner.info('DNS record not found yet');
+    console.log('');
+    console.log(chalk.yellow('  The DNS TXT record has not been detected.'));
+    console.log('');
+    console.log(chalk.bold('  Make sure this record exists:'));
+    console.log('');
+    console.log(`  ${chalk.bold('Host:')}   ${chalk.cyan(`_agenticmail-verify.${domain}`)}`);
+    console.log(`  ${chalk.bold('Type:')}   ${chalk.cyan('TXT')}`);
+    if (dnsChallenge) {
+      console.log(`  ${chalk.bold('Value:')}  ${chalk.cyan(dnsChallenge)}`);
+    } else {
+      console.log(`  ${chalk.bold('Value:')}  ${chalk.dim('(check your setup records or dashboard)')}`);
+    }
+    console.log('');
+    console.log(chalk.dim('  DNS changes can take up to 48 hours to propagate.'));
+    console.log(chalk.dim('  Run this command again after adding the record.'));
+    console.log('');
+  }
+
+  if (db) await db.disconnect();
+}

package/src/domain-lock/index.ts

@@ -0,0 +1,220 @@
+/**
+ * DomainLock — Enterprise Domain Registration & Verification
+ *
+ * Protects enterprise deployments by ensuring domain uniqueness.
+ * Communicates with the AgenticMail central registry for:
+ *   1. Domain registration (one-time, during setup)
+ *   2. DNS verification (one-time, after DNS TXT record is added)
+ *   3. Recovery (if system is lost, re-register on a new machine)
+ *
+ * After verification, the system operates 100% offline.
+ */
+
+import { randomBytes } from 'crypto';
+
+const REGISTRY_BASE_URL = process.env.AGENTICMAIL_REGISTRY_URL
+  || 'https://registry.agenticmail.com/v1';
+
+// ─── Types ──────────────────────────────────────────────
+
+export interface RegistrationResult {
+  success: boolean;
+  registrationId?: string;
+  dnsChallenge?: string;
+  error?: string;
+  /** HTTP status code from registry (e.g. 409 = domain already taken) */
+  statusCode?: number;
+}
+
+export interface VerificationResult {
+  success: boolean;
+  verified?: boolean;
+  error?: string;
+}
+
+export interface RecoveryResult {
+  success: boolean;
+  dnsChallenge?: string;
+  registrationId?: string;
+  error?: string;
+}
+
+export interface DomainStatus {
+  domain: string | null;
+  status: 'unregistered' | 'pending_dns' | 'verified' | 'failed';
+  registeredAt: string | null;
+  verifiedAt: string | null;
+  dnsChallenge: string | null;
+}
+
+// ─── DomainLock Client ──────────────────────────────────
+
+export class DomainLock {
+  private registryUrl: string;
+
+  constructor(opts?: { registryUrl?: string }) {
+    this.registryUrl = (opts?.registryUrl || REGISTRY_BASE_URL).replace(/\/$/, '');
+  }
+
+  /**
+   * Generate a 256-bit deployment key.
+   * Returns the plaintext (hex) and its bcrypt hash.
+   * The plaintext should be shown to the user ONCE and never stored.
+   */
+  async generateDeploymentKey(): Promise<{ plaintext: string; hash: string }> {
+    const { default: bcrypt } = await import('bcryptjs');
+    const plaintext = randomBytes(32).toString('hex'); // 64-char hex
+    const hash = await bcrypt.hash(plaintext, 12);
+    return { plaintext, hash };
+  }
+
+  /**
+   * Register a domain with the central registry.
+   * Called during setup wizard Step 5.
+   *
+   * @param domain - The domain to register (e.g. "agents.agenticmail.io")
+   * @param keyHash - bcrypt hash of the deployment key
+   * @param opts - Optional org name and contact email
+   */
+  async register(
+    domain: string,
+    keyHash: string,
+    opts?: { orgName?: string; contactEmail?: string },
+  ): Promise<RegistrationResult> {
+    try {
+      const res = await fetch(`${this.registryUrl}/domains/register`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          domain: domain.toLowerCase().trim(),
+          keyHash,
+          orgName: opts?.orgName,
+          contactEmail: opts?.contactEmail,
+        }),
+        signal: AbortSignal.timeout(15_000),
+      });
+
+      const data = await res.json().catch(() => ({})) as any;
+
+      if (res.status === 409) {
+        return {
+          success: false,
+          error: data.error || 'Domain is already registered and verified. Use "recover" if this is your domain.',
+          statusCode: 409,
+        };
+      }
+
+      if (!res.ok) {
+        return {
+          success: false,
+          error: data.error || `Registration failed (HTTP ${res.status})`,
+          statusCode: res.status,
+        };
+      }
+
+      return {
+        success: true,
+        registrationId: data.registrationId,
+        dnsChallenge: data.dnsChallenge,
+      };
+    } catch (err: any) {
+      if (err.name === 'TimeoutError' || err.name === 'AbortError') {
+        return { success: false, error: 'Registry server unreachable (timeout). You can retry later or continue without registration.' };
+      }
+      return { success: false, error: `Registry connection failed: ${err.message}` };
+    }
+  }
+
+  /**
+   * Ask the registry to check DNS verification for a domain.
+   * The registry resolves _agenticmail-verify.<domain> TXT record.
+   */
+  async checkVerification(domain: string): Promise<VerificationResult> {
+    try {
+      const res = await fetch(`${this.registryUrl}/domains/verify`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ domain: domain.toLowerCase().trim() }),
+        signal: AbortSignal.timeout(15_000),
+      });
+
+      const data = await res.json().catch(() => ({})) as any;
+
+      if (!res.ok) {
+        return { success: false, error: data.error || `Verification check failed (HTTP ${res.status})` };
+      }
+
+      return {
+        success: true,
+        verified: data.verified === true,
+        error: data.verified ? undefined : (data.error || 'DNS record not found yet'),
+      };
+    } catch (err: any) {
+      if (err.name === 'TimeoutError' || err.name === 'AbortError') {
+        return { success: false, error: 'Registry server unreachable (timeout)' };
+      }
+      return { success: false, error: `Registry connection failed: ${err.message}` };
+    }
+  }
+
+  /**
+   * Recover a domain registration on a new machine.
+   * Requires the original deployment key (plaintext).
+   * The registry verifies via bcrypt.compare against stored hash.
+   * On success, a new DNS challenge is issued (must re-verify DNS).
+   */
+  async recover(domain: string, deploymentKey: string): Promise<RecoveryResult> {
+    try {
+      const res = await fetch(`${this.registryUrl}/domains/recover`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          domain: domain.toLowerCase().trim(),
+          deploymentKey,
+        }),
+        signal: AbortSignal.timeout(15_000),
+      });
+
+      const data = await res.json().catch(() => ({})) as any;
+
+      if (res.status === 403) {
+        return { success: false, error: 'Invalid deployment key. The key does not match the registered domain.' };
+      }
+
+      if (res.status === 404) {
+        return { success: false, error: 'Domain is not registered. Use setup wizard to register first.' };
+      }
+
+      if (!res.ok) {
+        return { success: false, error: data.error || `Recovery failed (HTTP ${res.status})` };
+      }
+
+      return {
+        success: true,
+        dnsChallenge: data.dnsChallenge,
+        registrationId: data.registrationId,
+      };
+    } catch (err: any) {
+      if (err.name === 'TimeoutError' || err.name === 'AbortError') {
+        return { success: false, error: 'Registry server unreachable (timeout)' };
+      }
+      return { success: false, error: `Registry connection failed: ${err.message}` };
+    }
+  }
+
+  /**
+   * Check domain status on the registry (public, read-only).
+   */
+  async getRemoteStatus(domain: string): Promise<{ registered: boolean; verified: boolean } | null> {
+    try {
+      const res = await fetch(
+        `${this.registryUrl}/domains/${encodeURIComponent(domain.toLowerCase().trim())}/status`,
+        { signal: AbortSignal.timeout(10_000) },
+      );
+      if (!res.ok) return null;
+      return await res.json() as { registered: boolean; verified: boolean };
+    } catch {
+      return null;
+    }
+  }
+}

package/src/engine/activity-routes.ts

@@ -0,0 +1,116 @@
+/**
+ * Activity + Monitoring + Engine Stats Routes
+ * Mounted at / on the engine sub-app (routes define /activity/*, /stats/*).
+ */
+
+import { Hono } from 'hono';
+import type { ActivityTracker } from './activity.js';
+import type { TenantManager } from './tenant.js';
+import type { AgentLifecycleManager } from './lifecycle.js';
+
+export function createActivityRoutes(opts: {
+  activity: ActivityTracker;
+  tenants: TenantManager;
+  lifecycle: AgentLifecycleManager;
+}) {
+  const { activity, tenants, lifecycle } = opts;
+  const router = new Hono();
+
+  // ─── Activity & Monitoring ──────────────────────────────
+
+  router.get('/activity/events', (c) => {
+    const events = activity.getEvents({
+      agentId: c.req.query('agentId') || undefined,
+      orgId: c.req.query('orgId') || undefined,
+      since: c.req.query('since') || undefined,
+      limit: parseInt(c.req.query('limit') || '50'),
+    });
+    return c.json({ events, total: events.length });
+  });
+
+  router.get('/activity/tool-calls', (c) => {
+    const calls = activity.getToolCalls({
+      agentId: c.req.query('agentId') || undefined,
+      orgId: c.req.query('orgId') || undefined,
+      toolId: c.req.query('toolId') || undefined,
+      limit: parseInt(c.req.query('limit') || '50'),
+    });
+    return c.json({ toolCalls: calls, total: calls.length });
+  });
+
+  router.get('/activity/conversation/:sessionId', async (c) => {
+    const entries = await activity.getConversation(c.req.param('sessionId'));
+    return c.json({ entries, total: entries.length });
+  });
+
+  router.get('/activity/timeline/:agentId/:date', (c) => {
+    const timeline = activity.getTimeline(c.req.param('agentId'), c.req.param('date'));
+    return c.json({ timeline });
+  });
+
+  router.get('/activity/stats', (c) => {
+    const orgId = c.req.query('orgId');
+    return c.json(activity.getStats(orgId || undefined));
+  });
+
+  // SSE endpoint for real-time events
+  router.get('/activity/stream', (c) => {
+    const orgId = c.req.query('orgId');
+    const agentId = c.req.query('agentId');
+
+    const stream = new ReadableStream({
+      start(controller) {
+        const encoder = new TextEncoder();
+        const send = (data: string) => {
+          try { controller.enqueue(encoder.encode(`data: ${data}\n\n`)); }
+          catch { unsubscribe(); }
+        };
+
+        // Send heartbeat every 30s
+        const heartbeat = setInterval(() => send(JSON.stringify({ type: 'heartbeat' })), 30_000);
+
+        const unsubscribe = activity.subscribe((event) => {
+          if (orgId && event.orgId !== orgId) return;
+          if (agentId && event.agentId !== agentId) return;
+          send(JSON.stringify(event));
+        });
+
+        // Cleanup on close
+        c.req.raw.signal.addEventListener('abort', () => {
+          unsubscribe();
+          clearInterval(heartbeat);
+        });
+      },
+    });
+
+    return new Response(stream, {
+      headers: {
+        'Content-Type': 'text/event-stream',
+        'Cache-Control': 'no-cache',
+        'Connection': 'keep-alive',
+      },
+    });
+  });
+
+  // ─── Engine Stats (Dashboard Overview) ──────────────────
+
+  router.get('/stats/:orgId', (c) => {
+    const orgId = c.req.param('orgId');
+    const org = tenants.getOrg(orgId);
+    const agents = lifecycle.getAgentsByOrg(orgId);
+    const orgUsage = lifecycle.getOrgUsage(orgId);
+    const realTimeStats = activity.getStats(orgId);
+
+    return c.json({
+      org: org ? { name: org.name, plan: org.plan, limits: org.limits, usage: org.usage } : null,
+      agents: {
+        total: agents.length,
+        byState: agents.reduce((acc, a) => { acc[a.state] = (acc[a.state] || 0) + 1; return acc; }, {} as Record<string, number>),
+      },
+      usage: orgUsage,
+      realTime: realTimeStats,
+    });
+  });
+
+  return router;
+}