@agenticmail/enterprise 0.3.2 → 0.4.1

package/dist/chunk-SMUXH6FM.js

@@ -0,0 +1,1943 @@
+import {
+  ipAccessControl
+} from "./chunk-RO537U6H.js";
+import {
+  PROVIDER_REGISTRY
+} from "./chunk-ZNR5DDTA.js";
+import {
+  CircuitBreaker,
+  HealthMonitor,
+  KeyedRateLimiter,
+  requestId
+} from "./chunk-JLSQOQ5L.js";
+
+// src/server.ts
+import { Hono as Hono3 } from "hono";
+import { cors } from "hono/cors";
+import { serve } from "@hono/node-server";
+import { readFileSync, existsSync } from "fs";
+import { fileURLToPath } from "url";
+import { dirname, join } from "path";
+
+// src/db/proxy.ts
+function createDbProxy(initial) {
+  let target = initial;
+  const proxy = new Proxy({}, {
+    get(_, prop) {
+      if (prop === "__swap") {
+        return (newAdapter) => {
+          const old = target;
+          target = newAdapter;
+          return old;
+        };
+      }
+      if (prop === "__target") return target;
+      const val = target[prop];
+      return typeof val === "function" ? val.bind(target) : val;
+    }
+  });
+  return proxy;
+}
+
+// src/admin/routes.ts
+import { Hono } from "hono";
+
+// src/middleware/index.ts
+function requestIdMiddleware() {
+  return async (c, next) => {
+    const id = c.req.header("X-Request-Id") || requestId();
+    c.set("requestId", id);
+    c.header("X-Request-Id", id);
+    await next();
+  };
+}
+function requestLogger() {
+  return async (c, next) => {
+    const start = Date.now();
+    const method = c.req.method;
+    const path = c.req.path;
+    await next();
+    const elapsed = Date.now() - start;
+    const status = c.res.status;
+    const reqId = c.get("requestId") || "-";
+    const level = status >= 500 ? "ERROR" : status >= 400 ? "WARN" : "INFO";
+    console.log(
+      `[${(/* @__PURE__ */ new Date()).toISOString()}] ${level} ${method} ${path} ${status} ${elapsed}ms req=${reqId}`
+    );
+  };
+}
+function rateLimiter(config) {
+  const limiter = new KeyedRateLimiter({
+    maxTokens: config.limit,
+    refillRate: config.limit / config.windowSec
+  });
+  return async (c, next) => {
+    if (config.skipPaths?.some((p) => c.req.path.startsWith(p))) {
+      return next();
+    }
+    const key = config.keyFn?.(c) || c.req.header("x-forwarded-for")?.split(",")[0]?.trim() || c.req.header("x-real-ip") || "unknown";
+    if (!limiter.tryConsume(key)) {
+      const retryAfter = Math.ceil(limiter.getRetryAfterMs(key) / 1e3);
+      c.header("Retry-After", String(retryAfter));
+      c.header("X-RateLimit-Limit", String(config.limit));
+      c.header("X-RateLimit-Remaining", "0");
+      return c.json(
+        { error: "Too many requests", retryAfter },
+        429
+      );
+    }
+    await next();
+  };
+}
+function securityHeaders() {
+  return async (c, next) => {
+    await next();
+    c.header("X-Content-Type-Options", "nosniff");
+    c.header("X-Frame-Options", "DENY");
+    c.header("X-XSS-Protection", "0");
+    c.header("Referrer-Policy", "strict-origin-when-cross-origin");
+    c.header("Permissions-Policy", "camera=(), microphone=(), geolocation=()");
+    if (c.req.url.startsWith("https://") || c.req.header("x-forwarded-proto") === "https") {
+      c.header("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
+    }
+  };
+}
+function errorHandler() {
+  return async (c, next) => {
+    try {
+      await next();
+    } catch (err) {
+      const reqId = c.get("requestId");
+      const status = err.status || err.statusCode || 500;
+      const message = status >= 500 ? "Internal server error" : err.message;
+      if (status >= 500) {
+        console.error(`[${(/* @__PURE__ */ new Date()).toISOString()}] ERROR req=${reqId}`, err);
+      }
+      const body = {
+        error: message,
+        code: err.code,
+        requestId: reqId
+      };
+      if (status === 400 && err.details) {
+        body.details = err.details;
+      }
+      return c.json(body, status);
+    }
+  };
+}
+var ValidationError = class extends Error {
+  status = 400;
+  code = "VALIDATION_ERROR";
+  details;
+  constructor(details) {
+    const fields = Object.keys(details).join(", ");
+    super(`Validation failed: ${fields}`);
+    this.details = details;
+  }
+};
+function validate(body, validators) {
+  const errors = {};
+  for (const v of validators) {
+    const value = body[v.field];
+    if (value === void 0 || value === null || value === "") {
+      if (v.required) errors[v.field] = "Required";
+      continue;
+    }
+    switch (v.type) {
+      case "string":
+        if (typeof value !== "string") {
+          errors[v.field] = "Must be a string";
+          break;
+        }
+        if (v.minLength && value.length < v.minLength) errors[v.field] = `Min length: ${v.minLength}`;
+        if (v.maxLength && value.length > v.maxLength) errors[v.field] = `Max length: ${v.maxLength}`;
+        if (v.pattern && !v.pattern.test(value)) errors[v.field] = "Invalid format";
+        break;
+      case "number":
+        if (typeof value !== "number" || isNaN(value)) {
+          errors[v.field] = "Must be a number";
+          break;
+        }
+        if (v.min !== void 0 && value < v.min) errors[v.field] = `Min: ${v.min}`;
+        if (v.max !== void 0 && value > v.max) errors[v.field] = `Max: ${v.max}`;
+        break;
+      case "boolean":
+        if (typeof value !== "boolean") errors[v.field] = "Must be a boolean";
+        break;
+      case "email":
+        if (typeof value !== "string" || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value))
+          errors[v.field] = "Invalid email";
+        break;
+      case "url":
+        try {
+          new URL(value);
+        } catch {
+          errors[v.field] = "Invalid URL";
+        }
+        break;
+      case "uuid":
+        if (typeof value !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value))
+          errors[v.field] = "Invalid UUID";
+        break;
+    }
+  }
+  if (Object.keys(errors).length > 0) {
+    throw new ValidationError(errors);
+  }
+}
+function auditLogger(db) {
+  const AUDIT_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+  return async (c, next) => {
+    await next();
+    if (!AUDIT_METHODS.has(c.req.method)) return;
+    if (c.res.status >= 400) return;
+    try {
+      const userId = c.get("userId") || "anonymous";
+      const path = c.req.path;
+      const method = c.req.method;
+      const segments = path.split("/").filter(Boolean);
+      const resource = segments[segments.length - 2] || segments[segments.length - 1] || "unknown";
+      const actionMap = {
+        POST: "create",
+        PUT: "update",
+        PATCH: "update",
+        DELETE: "delete"
+      };
+      const action = `${resource}.${actionMap[method] || method.toLowerCase()}`;
+      const userEmail = c.get("userEmail") || void 0;
+      const userRole = c.get("userRole") || void 0;
+      await db.logEvent({
+        actor: userId,
+        actorType: "user",
+        action,
+        resource: path,
+        details: {
+          ...userEmail ? { email: userEmail } : {},
+          ...userRole ? { role: userRole } : {},
+          method
+        },
+        ip: c.req.header("x-forwarded-for")?.split(",")[0]?.trim() || c.req.header("x-real-ip")
+      });
+    } catch {
+    }
+  };
+}
+var ROLE_HIERARCHY = {
+  viewer: 0,
+  member: 1,
+  admin: 2,
+  owner: 3
+};
+function requireRole(minRole) {
+  return async (c, next) => {
+    const userRole = c.get("userRole");
+    if (c.get("authType") === "api-key") {
+      return next();
+    }
+    if (!userRole || ROLE_HIERARCHY[userRole] < ROLE_HIERARCHY[minRole]) {
+      return c.json({
+        error: "Insufficient permissions",
+        required: minRole,
+        current: userRole || "none"
+      }, 403);
+    }
+    return next();
+  };
+}
+
+// src/admin/routes.ts
+function createAdminRoutes(db) {
+  const api = new Hono();
+  api.get("/stats", async (c) => {
+    const stats = await db.getStats();
+    return c.json(stats);
+  });
+  api.get("/agents", async (c) => {
+    const status = c.req.query("status");
+    const limit = Math.min(parseInt(c.req.query("limit") || "50"), 200);
+    const offset = Math.max(parseInt(c.req.query("offset") || "0"), 0);
+    const agents = await db.listAgents({ status, limit, offset });
+    const total = await db.countAgents(status);
+    return c.json({ agents, total, limit, offset });
+  });
+  api.get("/agents/:id", async (c) => {
+    const agent = await db.getAgent(c.req.param("id"));
+    if (!agent) return c.json({ error: "Agent not found" }, 404);
+    return c.json(agent);
+  });
+  api.post("/agents", async (c) => {
+    const body = await c.req.json();
+    validate(body, [
+      { field: "name", type: "string", required: true, minLength: 1, maxLength: 64, pattern: /^[a-zA-Z0-9_-]+$/ },
+      { field: "email", type: "email" },
+      { field: "role", type: "string", maxLength: 32 }
+    ]);
+    const existing = await db.getAgentByName(body.name);
+    if (existing) {
+      return c.json({ error: "Agent name already exists" }, 409);
+    }
+    const userId = c.get("userId") || "system";
+    const agent = await db.createAgent({ ...body, createdBy: userId });
+    return c.json(agent, 201);
+  });
+  api.patch("/agents/:id", async (c) => {
+    const id = c.req.param("id");
+    const existing = await db.getAgent(id);
+    if (!existing) return c.json({ error: "Agent not found" }, 404);
+    const body = await c.req.json();
+    validate(body, [
+      { field: "name", type: "string", minLength: 1, maxLength: 64 },
+      { field: "email", type: "email" },
+      { field: "role", type: "string", maxLength: 32 },
+      { field: "status", type: "string", pattern: /^(active|archived|suspended)$/ }
+    ]);
+    if (body.name && body.name !== existing.name) {
+      const conflict = await db.getAgentByName(body.name);
+      if (conflict) return c.json({ error: "Agent name already exists" }, 409);
+    }
+    const agent = await db.updateAgent(id, body);
+    return c.json(agent);
+  });
+  api.post("/agents/:id/archive", async (c) => {
+    const existing = await db.getAgent(c.req.param("id"));
+    if (!existing) return c.json({ error: "Agent not found" }, 404);
+    if (existing.status === "archived") return c.json({ error: "Agent already archived" }, 400);
+    await db.archiveAgent(c.req.param("id"));
+    return c.json({ ok: true, status: "archived" });
+  });
+  api.post("/agents/:id/restore", async (c) => {
+    const existing = await db.getAgent(c.req.param("id"));
+    if (!existing) return c.json({ error: "Agent not found" }, 404);
+    if (existing.status !== "archived") return c.json({ error: "Agent is not archived" }, 400);
+    await db.updateAgent(c.req.param("id"), { status: "active" });
+    return c.json({ ok: true, status: "active" });
+  });
+  api.delete("/agents/:id", requireRole("admin"), async (c) => {
+    const existing = await db.getAgent(c.req.param("id"));
+    if (!existing) return c.json({ error: "Agent not found" }, 404);
+    await db.deleteAgent(c.req.param("id"));
+    return c.json({ ok: true });
+  });
+  api.get("/users", requireRole("admin"), async (c) => {
+    const limit = Math.min(parseInt(c.req.query("limit") || "50"), 200);
+    const offset = Math.max(parseInt(c.req.query("offset") || "0"), 0);
+    const users = await db.listUsers({ limit, offset });
+    const safe = users.map(({ passwordHash, ...u }) => u);
+    return c.json({ users: safe, limit, offset });
+  });
+  api.post("/users", requireRole("admin"), async (c) => {
+    const body = await c.req.json();
+    validate(body, [
+      { field: "email", type: "email", required: true },
+      { field: "name", type: "string", required: true, minLength: 1, maxLength: 128 },
+      { field: "role", type: "string", required: true, pattern: /^(owner|admin|member|viewer)$/ },
+      { field: "password", type: "string", minLength: 8, maxLength: 128 }
+    ]);
+    const existing = await db.getUserByEmail(body.email);
+    if (existing) return c.json({ error: "Email already registered" }, 409);
+    const user = await db.createUser(body);
+    const { passwordHash, ...safe } = user;
+    return c.json(safe, 201);
+  });
+  api.patch("/users/:id", requireRole("admin"), async (c) => {
+    const existing = await db.getUser(c.req.param("id"));
+    if (!existing) return c.json({ error: "User not found" }, 404);
+    const body = await c.req.json();
+    validate(body, [
+      { field: "email", type: "email" },
+      { field: "name", type: "string", minLength: 1, maxLength: 128 },
+      { field: "role", type: "string", pattern: /^(owner|admin|member|viewer)$/ }
+    ]);
+    const user = await db.updateUser(c.req.param("id"), body);
+    const { passwordHash, ...safe } = user;
+    return c.json(safe);
+  });
+  api.delete("/users/:id", requireRole("owner"), async (c) => {
+    const existing = await db.getUser(c.req.param("id"));
+    if (!existing) return c.json({ error: "User not found" }, 404);
+    const requesterId = c.get("userId");
+    if (requesterId === c.req.param("id")) {
+      return c.json({ error: "Cannot delete your own account" }, 400);
+    }
+    await db.deleteUser(c.req.param("id"));
+    return c.json({ ok: true });
+  });
+  api.get("/audit", requireRole("admin"), async (c) => {
+    const filters = {
+      actor: c.req.query("actor") || void 0,
+      action: c.req.query("action") || void 0,
+      resource: c.req.query("resource") || void 0,
+      from: c.req.query("from") ? new Date(c.req.query("from")) : void 0,
+      to: c.req.query("to") ? new Date(c.req.query("to")) : void 0,
+      limit: Math.min(parseInt(c.req.query("limit") || "50"), 500),
+      offset: Math.max(parseInt(c.req.query("offset") || "0"), 0)
+    };
+    if (filters.from && isNaN(filters.from.getTime())) {
+      return c.json({ error: 'Invalid "from" date' }, 400);
+    }
+    if (filters.to && isNaN(filters.to.getTime())) {
+      return c.json({ error: 'Invalid "to" date' }, 400);
+    }
+    const result = await db.queryAudit(filters);
+    return c.json(result);
+  });
+  api.get("/api-keys", requireRole("admin"), async (c) => {
+    const keys = await db.listApiKeys();
+    const safe = keys.map(({ keyHash, ...k }) => k);
+    return c.json({ keys: safe });
+  });
+  api.post("/api-keys", requireRole("admin"), async (c) => {
+    const body = await c.req.json();
+    validate(body, [
+      { field: "name", type: "string", required: true, minLength: 1, maxLength: 64 }
+    ]);
+    const userId = c.get("userId") || "system";
+    const scopes = Array.isArray(body.scopes) ? body.scopes : ["*"];
+    const expiresAt = body.expiresAt ? new Date(body.expiresAt) : void 0;
+    const { key, plaintext } = await db.createApiKey({
+      name: body.name,
+      scopes,
+      createdBy: userId,
+      expiresAt
+    });
+    const { keyHash, ...safeKey } = key;
+    return c.json({
+      key: safeKey,
+      plaintext,
+      warning: "Store this key securely. It will not be shown again."
+    }, 201);
+  });
+  api.delete("/api-keys/:id", requireRole("admin"), async (c) => {
+    const existing = await db.getApiKey(c.req.param("id"));
+    if (!existing) return c.json({ error: "API key not found" }, 404);
+    await db.revokeApiKey(c.req.param("id"));
+    return c.json({ ok: true, revoked: true });
+  });
+  api.get("/rules", async (c) => {
+    const agentId = c.req.query("agentId") || void 0;
+    const rules = await db.getRules(agentId);
+    return c.json({ rules });
+  });
+  api.post("/rules", async (c) => {
+    const body = await c.req.json();
+    validate(body, [
+      { field: "name", type: "string", required: true, minLength: 1, maxLength: 128 }
+    ]);
+    if (body.conditions && typeof body.conditions !== "object") {
+      return c.json({ error: "conditions must be an object" }, 400);
+    }
+    if (body.actions && typeof body.actions !== "object") {
+      return c.json({ error: "actions must be an object" }, 400);
+    }
+    const rule = await db.createRule({
+      name: body.name,
+      agentId: body.agentId,
+      conditions: body.conditions || {},
+      actions: body.actions || {},
+      priority: body.priority ?? 0,
+      enabled: body.enabled ?? true
+    });
+    return c.json(rule, 201);
+  });
+  api.patch("/rules/:id", async (c) => {
+    const body = await c.req.json();
+    const rule = await db.updateRule(c.req.param("id"), body);
+    return c.json(rule);
+  });
+  api.delete("/rules/:id", async (c) => {
+    await db.deleteRule(c.req.param("id"));
+    return c.json({ ok: true });
+  });
+  api.get("/settings", async (c) => {
+    const settings = await db.getSettings();
+    if (!settings) return c.json({ error: "Not configured" }, 404);
+    const safe = { ...settings };
+    if (safe.smtpPass) safe.smtpPass = "***";
+    if (safe.dkimPrivateKey) safe.dkimPrivateKey = "***";
+    if (safe.ssoConfig?.oidc?.clientSecret) {
+      safe.ssoConfig = { ...safe.ssoConfig, oidc: { ...safe.ssoConfig.oidc, clientSecret: "***" } };
+    }
+    return c.json(safe);
+  });
+  api.patch("/settings", requireRole("admin"), async (c) => {
+    const body = await c.req.json();
+    validate(body, [
+      { field: "name", type: "string", minLength: 1, maxLength: 128 },
+      { field: "domain", type: "string", maxLength: 253 },
+      { field: "subdomain", type: "string", maxLength: 64 },
+      { field: "primaryColor", type: "string", pattern: /^#[0-9a-fA-F]{6}$/ },
+      { field: "logoUrl", type: "url" },
+      { field: "smtpHost", type: "string", maxLength: 253 },
+      { field: "smtpPort", type: "number" },
+      { field: "smtpUser", type: "string", maxLength: 253 },
+      { field: "smtpPass", type: "string", maxLength: 253 },
+      { field: "dkimPrivateKey", type: "string" },
+      { field: "plan", type: "string", maxLength: 32 }
+    ]);
+    const settings = await db.updateSettings(body);
+    return c.json(settings);
+  });
+  api.get("/settings/sso", requireRole("admin"), async (c) => {
+    const settings = await db.getSettings();
+    if (!settings) return c.json({ ssoConfig: null });
+    const sso = settings.ssoConfig || {};
+    const safe = { ...sso };
+    if (safe.oidc?.clientSecret) {
+      safe.oidc = { ...safe.oidc, clientSecret: "***" };
+    }
+    if (safe.saml?.certificate) {
+      const cert = safe.saml.certificate;
+      safe.saml = {
+        ...safe.saml,
+        certificate: cert.length > 50 ? cert.substring(0, 20) + "..." + cert.substring(cert.length - 20) : cert,
+        certificateConfigured: true
+      };
+    }
+    return c.json({ ssoConfig: safe });
+  });
+  api.put("/settings/sso/saml", requireRole("admin"), async (c) => {
+    const body = await c.req.json();
+    validate(body, [
+      { field: "entityId", type: "string", required: true, minLength: 1, maxLength: 512 },
+      { field: "ssoUrl", type: "url", required: true },
+      { field: "certificate", type: "string", required: true, minLength: 10 }
+    ]);
+    const settings = await db.getSettings();
+    const current = settings?.ssoConfig || {};
+    const ssoConfig = {
+      ...current,
+      saml: {
+        entityId: body.entityId,
+        ssoUrl: body.ssoUrl,
+        certificate: body.certificate,
+        signatureAlgorithm: body.signatureAlgorithm || "RSA-SHA256",
+        autoProvision: body.autoProvision ?? true,
+        defaultRole: body.defaultRole || "member",
+        allowedDomains: body.allowedDomains || []
+      }
+    };
+    await db.updateSettings({ ssoConfig });
+    return c.json({ ok: true, provider: "saml", configured: true });
+  });
+  api.put("/settings/sso/oidc", requireRole("admin"), async (c) => {
+    const body = await c.req.json();
+    validate(body, [
+      { field: "clientId", type: "string", required: true, minLength: 1, maxLength: 256 },
+      { field: "clientSecret", type: "string", required: true, minLength: 1, maxLength: 512 },
+      { field: "discoveryUrl", type: "url", required: true }
+    ]);
+    const settings = await db.getSettings();
+    const current = settings?.ssoConfig || {};
+    let clientSecret = body.clientSecret;
+    if (clientSecret === "***" && current.oidc?.clientSecret) {
+      clientSecret = current.oidc.clientSecret;
+    }
+    const ssoConfig = {
+      ...current,
+      oidc: {
+        clientId: body.clientId,
+        clientSecret,
+        discoveryUrl: body.discoveryUrl,
+        scopes: body.scopes || ["openid", "email", "profile"],
+        autoProvision: body.autoProvision ?? true,
+        defaultRole: body.defaultRole || "member",
+        allowedDomains: body.allowedDomains || []
+      }
+    };
+    await db.updateSettings({ ssoConfig });
+    return c.json({ ok: true, provider: "oidc", configured: true });
+  });
+  api.delete("/settings/sso/:provider", requireRole("admin"), async (c) => {
+    const provider = c.req.param("provider");
+    if (provider !== "saml" && provider !== "oidc") {
+      return c.json({ error: 'Invalid provider. Use "saml" or "oidc".' }, 400);
+    }
+    const settings = await db.getSettings();
+    const current = settings?.ssoConfig || {};
+    const ssoConfig = { ...current };
+    delete ssoConfig[provider];
+    await db.updateSettings({ ssoConfig });
+    return c.json({ ok: true, provider, removed: true });
+  });
+  api.post("/settings/sso/oidc/test", requireRole("admin"), async (c) => {
+    const { discoveryUrl } = await c.req.json();
+    if (!discoveryUrl) return c.json({ error: "discoveryUrl required" }, 400);
+    try {
+      const res = await fetch(discoveryUrl);
+      if (!res.ok) return c.json({ ok: false, error: `HTTP ${res.status}` });
+      const doc = await res.json();
+      return c.json({
+        ok: true,
+        issuer: doc.issuer,
+        hasAuthorizationEndpoint: !!doc.authorization_endpoint,
+        hasTokenEndpoint: !!doc.token_endpoint,
+        hasUserinfoEndpoint: !!doc.userinfo_endpoint,
+        hasJwksUri: !!doc.jwks_uri,
+        supportedScopes: doc.scopes_supported
+      });
+    } catch (e) {
+      return c.json({ ok: false, error: e.message });
+    }
+  });
+  api.get("/settings/tool-security", requireRole("admin"), async (c) => {
+    const settings = await db.getSettings();
+    return c.json({ toolSecurityConfig: settings?.toolSecurityConfig || {} });
+  });
+  api.put("/settings/tool-security", requireRole("admin"), async (c) => {
+    const body = await c.req.json();
+    if (body && typeof body !== "object") {
+      return c.json({ error: "Body must be a JSON object" }, 400);
+    }
+    await db.updateSettings({ toolSecurityConfig: body });
+    const settings = await db.getSettings();
+    return c.json({ toolSecurityConfig: settings?.toolSecurityConfig || {} });
+  });
+  api.get("/settings/firewall", requireRole("admin"), async (c) => {
+    const settings = await db.getSettings();
+    return c.json({ firewallConfig: settings?.firewallConfig || {} });
+  });
+  api.put("/settings/firewall", requireRole("admin"), async (c) => {
+    const body = await c.req.json();
+    if (body && typeof body !== "object") {
+      return c.json({ error: "Body must be a JSON object" }, 400);
+    }
+    if (body.ipAccess?.mode && !["allowlist", "blocklist"].includes(body.ipAccess.mode)) {
+      return c.json({ error: 'ipAccess.mode must be "allowlist" or "blocklist"' }, 400);
+    }
+    if (body.egress?.mode && !["allowlist", "blocklist"].includes(body.egress.mode)) {
+      return c.json({ error: 'egress.mode must be "allowlist" or "blocklist"' }, 400);
+    }
+    const { isValidIpOrCidr } = await import("./cidr-LISVZSM2.js");
+    for (const entry of body.ipAccess?.allowlist || []) {
+      if (!isValidIpOrCidr(entry)) return c.json({ error: "Invalid IP/CIDR in allowlist: " + entry }, 400);
+    }
+    for (const entry of body.ipAccess?.blocklist || []) {
+      if (!isValidIpOrCidr(entry)) return c.json({ error: "Invalid IP/CIDR in blocklist: " + entry }, 400);
+    }
+    for (const entry of body.trustedProxies?.ips || []) {
+      if (!isValidIpOrCidr(entry)) return c.json({ error: "Invalid IP/CIDR in trusted proxies: " + entry }, 400);
+    }
+    if (body.ipAccess?.enabled && body.ipAccess?.mode === "allowlist" && body.ipAccess?.allowlist?.length > 0) {
+      const clientIp = c.req.header("x-forwarded-for")?.split(",")[0]?.trim() || c.req.header("x-real-ip") || "";
+      if (clientIp && clientIp !== "unknown") {
+        const { compileIpMatcher } = await import("./cidr-LISVZSM2.js");
+        const matcher = compileIpMatcher(body.ipAccess.allowlist);
+        if (!matcher(clientIp)) {
+          return c.json({ error: "Your current IP (" + clientIp + ") is not in the allowlist. Add it first to avoid lockout." }, 400);
+        }
+      }
+    }
+    await db.updateSettings({ firewallConfig: body });
+    try {
+      const { invalidateFirewallCache: invalidateFirewallCache2 } = await import("./firewall-AHIRE6UB.js");
+      invalidateFirewallCache2();
+    } catch {
+    }
+    const settings = await db.getSettings();
+    return c.json({ firewallConfig: settings?.firewallConfig || {} });
+  });
+  api.post("/settings/firewall/test-ip", requireRole("admin"), async (c) => {
+    const { ip } = await c.req.json();
+    if (!ip) return c.json({ error: "ip is required" }, 400);
+    const { isValidIpOrCidr, compileIpMatcher } = await import("./cidr-LISVZSM2.js");
+    if (!isValidIpOrCidr(ip)) return c.json({ error: "Invalid IP address" }, 400);
+    const settings = await db.getSettings();
+    const ipAccess = settings?.firewallConfig?.ipAccess;
+    if (!ipAccess?.enabled) {
+      return c.json({ ip, allowed: true, reason: "IP access control is disabled" });
+    }
+    if (ipAccess.mode === "allowlist") {
+      const matcher = compileIpMatcher(ipAccess.allowlist || []);
+      const allowed = matcher(ip);
+      return c.json({ ip, allowed, reason: allowed ? "IP matches allowlist" : "IP not in allowlist" });
+    } else {
+      const matcher = compileIpMatcher(ipAccess.blocklist || []);
+      const blocked = matcher(ip);
+      return c.json({ ip, allowed: !blocked, reason: blocked ? "IP matches blocklist" : "IP not in blocklist" });
+    }
+  });
+  api.get("/settings/model-pricing", requireRole("admin"), async (c) => {
+    const settings = await db.getSettings();
+    var config = settings?.modelPricingConfig || { models: [], currency: "USD" };
+    if (!config.models || config.models.length === 0) {
+      config.models = getDefaultModelPricing();
+    }
+    return c.json({ modelPricingConfig: config });
+  });
+  api.put("/settings/model-pricing", requireRole("admin"), async (c) => {
+    const body = await c.req.json();
+    if (!body || typeof body !== "object") {
+      return c.json({ error: "Body must be a JSON object" }, 400);
+    }
+    if (body.models && Array.isArray(body.models)) {
+      for (const m of body.models) {
+        if (!m.provider || !m.modelId) {
+          return c.json({ error: "Each model must have provider and modelId" }, 400);
+        }
+        if (typeof m.inputCostPerMillion !== "number" || m.inputCostPerMillion < 0) {
+          return c.json({ error: `Invalid inputCostPerMillion for ${m.modelId}` }, 400);
+        }
+        if (typeof m.outputCostPerMillion !== "number" || m.outputCostPerMillion < 0) {
+          return c.json({ error: `Invalid outputCostPerMillion for ${m.modelId}` }, 400);
+        }
+      }
+    }
+    body.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+    await db.updateSettings({ modelPricingConfig: body });
+    const settings = await db.getSettings();
+    return c.json({ modelPricingConfig: settings?.modelPricingConfig || {} });
+  });
+  api.get("/providers", requireRole("admin"), async (c) => {
+    var builtIn = Object.values(PROVIDER_REGISTRY).map(function(p) {
+      var configured = !p.requiresApiKey || p.envKey && !!process.env[p.envKey];
+      return {
+        id: p.id,
+        name: p.name,
+        baseUrl: p.baseUrl,
+        apiType: p.apiType,
+        isLocal: p.isLocal,
+        requiresApiKey: p.requiresApiKey,
+        configured,
+        source: "built-in",
+        defaultModels: p.defaultModels || []
+      };
+    });
+    var settings = await db.getSettings();
+    var pricingConfig = settings?.modelPricingConfig;
+    var customProviders = pricingConfig?.customProviders || [];
+    var custom = customProviders.map(function(p) {
+      return { ...p, configured: true, source: "custom" };
+    });
+    return c.json({ providers: [...builtIn, ...custom] });
+  });
+  api.post("/providers", requireRole("admin"), async (c) => {
+    var body = await c.req.json();
+    if (!body.id || !body.name || !body.baseUrl || !body.apiType) {
+      return c.json({ error: "id, name, baseUrl, and apiType are required" }, 400);
+    }
+    if (PROVIDER_REGISTRY[body.id]) {
+      return c.json({ error: "Cannot override built-in provider" }, 409);
+    }
+    var validTypes = ["anthropic", "openai-compatible", "google", "ollama"];
+    if (!validTypes.includes(body.apiType)) {
+      return c.json({ error: "apiType must be one of: " + validTypes.join(", ") }, 400);
+    }
+    var settings = await db.getSettings();
+    var config = settings?.modelPricingConfig || { models: [], currency: "USD" };
+    config.customProviders = config.customProviders || [];
+    if (config.customProviders.find(function(p) {
+      return p.id === body.id;
+    })) {
+      return c.json({ error: "Custom provider with this ID already exists" }, 409);
+    }
+    config.customProviders.push({
+      id: body.id,
+      name: body.name,
+      baseUrl: body.baseUrl,
+      apiType: body.apiType,
+      apiKeyEnvVar: body.apiKeyEnvVar || "",
+      headers: body.headers || {},
+      models: body.models || []
+    });
+    await db.updateSettings({ modelPricingConfig: config });
+    return c.json({ ok: true, provider: body });
+  });
+  api.put("/providers/:id", requireRole("admin"), async (c) => {
+    var id = c.req.param("id");
+    if (PROVIDER_REGISTRY[id]) {
+      return c.json({ error: "Cannot modify built-in provider" }, 400);
+    }
+    var body = await c.req.json();
+    var settings = await db.getSettings();
+    var config = settings?.modelPricingConfig || { models: [], currency: "USD" };
+    config.customProviders = config.customProviders || [];
+    var idx = config.customProviders.findIndex(function(p) {
+      return p.id === id;
+    });
+    if (idx === -1) {
+      return c.json({ error: "Custom provider not found" }, 404);
+    }
+    config.customProviders[idx] = Object.assign({}, config.customProviders[idx], body, { id });
+    await db.updateSettings({ modelPricingConfig: config });
+    return c.json({ ok: true, provider: config.customProviders[idx] });
+  });
+  api.delete("/providers/:id", requireRole("admin"), async (c) => {
+    var id = c.req.param("id");
+    if (PROVIDER_REGISTRY[id]) {
+      return c.json({ error: "Cannot delete built-in provider" }, 400);
+    }
+    var settings = await db.getSettings();
+    var config = settings?.modelPricingConfig || { models: [], currency: "USD" };
+    config.customProviders = config.customProviders || [];
+    var before = config.customProviders.length;
+    config.customProviders = config.customProviders.filter(function(p) {
+      return p.id !== id;
+    });
+    if (config.customProviders.length === before) {
+      return c.json({ error: "Custom provider not found" }, 404);
+    }
+    await db.updateSettings({ modelPricingConfig: config });
+    return c.json({ ok: true });
+  });
+  api.get("/providers/:id/models", requireRole("admin"), async (c) => {
+    var id = c.req.param("id");
+    var provider = PROVIDER_REGISTRY[id];
+    if (id === "ollama" || provider && provider.apiType === "ollama") {
+      var ollamaHost = process.env.OLLAMA_HOST || (provider ? provider.baseUrl : "http://localhost:11434");
+      try {
+        var resp = await fetch(ollamaHost + "/api/tags");
+        var data = await resp.json();
+        return c.json({ models: (data.models || []).map(function(m) {
+          return { id: m.name, name: m.name, size: m.size };
+        }) });
+      } catch (err) {
+        return c.json({ error: "Cannot connect to Ollama: " + err.message }, 502);
+      }
+    }
+    if (provider && provider.isLocal && provider.apiType === "openai-compatible") {
+      try {
+        var resp = await fetch(provider.baseUrl + "/models");
+        var data = await resp.json();
+        return c.json({ models: (data.data || []).map(function(m) {
+          return { id: m.id, name: m.id };
+        }) });
+      } catch (err) {
+        return c.json({ error: "Cannot connect to " + provider.name + ": " + err.message }, 502);
+      }
+    }
+    if (provider && provider.defaultModels) {
+      return c.json({ models: provider.defaultModels.map(function(mid) {
+        return { id: mid, name: mid };
+      }) });
+    }
+    var settings = await db.getSettings();
+    var pricingConfig = settings?.modelPricingConfig;
+    var customProviders = pricingConfig?.customProviders || [];
+    var customProvider = customProviders.find(function(p) {
+      return p.id === id;
+    });
+    if (customProvider && customProvider.models) {
+      return c.json({ models: customProvider.models });
+    }
+    return c.json({ models: [] });
+  });
+  api.get("/retention", requireRole("admin"), async (c) => {
+    const policy = await db.getRetentionPolicy();
+    return c.json(policy);
+  });
+  api.put("/retention", requireRole("owner"), async (c) => {
+    const body = await c.req.json();
+    validate(body, [
+      { field: "enabled", type: "boolean", required: true },
+      { field: "retainDays", type: "number", required: true, min: 1, max: 3650 },
+      { field: "archiveFirst", type: "boolean" }
+    ]);
+    await db.setRetentionPolicy({
+      enabled: body.enabled,
+      retainDays: body.retainDays,
+      excludeTags: body.excludeTags || [],
+      archiveFirst: body.archiveFirst ?? true
+    });
+    return c.json({ ok: true });
+  });
+  api.post("/domain/register", requireRole("admin"), async (c) => {
+    var body = await c.req.json();
+    if (!body.domain) {
+      return c.json({ error: "domain is required" }, 400);
+    }
+    var domain = String(body.domain).toLowerCase().trim();
+    if (!/^[a-zA-Z0-9][a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/.test(domain)) {
+      return c.json({ error: "Invalid domain format" }, 400);
+    }
+    try {
+      var { DomainLock } = await import("./domain-lock-URIFILHB.js");
+      var lock = new DomainLock();
+      var keyPair = await lock.generateDeploymentKey();
+      var settings = await db.getSettings();
+      var result = await lock.register(domain, keyPair.hash, {
+        orgName: settings?.name,
+        contactEmail: body.contactEmail
+      });
+      if (!result.success) {
+        return c.json({ error: result.error, statusCode: result.statusCode }, 400);
+      }
+      await db.updateSettings({
+        domain,
+        deploymentKeyHash: keyPair.hash,
+        domainRegistrationId: result.registrationId,
+        domainDnsChallenge: result.dnsChallenge,
+        domainRegisteredAt: (/* @__PURE__ */ new Date()).toISOString(),
+        domainStatus: "pending_dns"
+      });
+      return c.json({
+        deploymentKey: keyPair.plaintext,
+        dnsChallenge: result.dnsChallenge,
+        registrationId: result.registrationId
+      });
+    } catch (err) {
+      return c.json({ error: err.message || "Domain registration failed" }, 500);
+    }
+  });
+  api.post("/domain/verify", requireRole("admin"), async (c) => {
+    var body = await c.req.json();
+    if (!body.domain) {
+      return c.json({ error: "domain is required" }, 400);
+    }
+    var domain = String(body.domain).toLowerCase().trim();
+    try {
+      var { DomainLock } = await import("./domain-lock-URIFILHB.js");
+      var lock = new DomainLock();
+      var result = await lock.checkVerification(domain);
+      if (result.verified) {
+        await db.updateSettings({
+          domainStatus: "verified",
+          domainVerifiedAt: (/* @__PURE__ */ new Date()).toISOString()
+        });
+        return c.json({ verified: true });
+      }
+      return c.json({ verified: false, error: result.error });
+    } catch (err) {
+      return c.json({ error: err.message || "Verification check failed" }, 500);
+    }
+  });
+  function getDefaultModelPricing() {
+    return [
+      // Anthropic (Feb 2026 — 1M context window)
+      { provider: "anthropic", modelId: "claude-opus-4-6", displayName: "Claude Opus 4.6", inputCostPerMillion: 5, outputCostPerMillion: 25, contextWindow: 1e6 },
+      { provider: "anthropic", modelId: "claude-sonnet-4-6", displayName: "Claude Sonnet 4.6", inputCostPerMillion: 3, outputCostPerMillion: 15, contextWindow: 1e6 },
+      { provider: "anthropic", modelId: "claude-sonnet-4-5-20250929", displayName: "Claude Sonnet 4.5", inputCostPerMillion: 3, outputCostPerMillion: 15, contextWindow: 1e6 },
+      { provider: "anthropic", modelId: "claude-haiku-4-5-20251001", displayName: "Claude Haiku 4.5", inputCostPerMillion: 0.8, outputCostPerMillion: 4, contextWindow: 2e5 },
+      // OpenAI
+      { provider: "openai", modelId: "gpt-4o", displayName: "GPT-4o", inputCostPerMillion: 2.5, outputCostPerMillion: 10, contextWindow: 128e3 },
+      { provider: "openai", modelId: "gpt-4o-mini", displayName: "GPT-4o Mini", inputCostPerMillion: 0.15, outputCostPerMillion: 0.6, contextWindow: 128e3 },
+      { provider: "openai", modelId: "gpt-4.1", displayName: "GPT-4.1", inputCostPerMillion: 2, outputCostPerMillion: 8, contextWindow: 1e6 },
+      { provider: "openai", modelId: "gpt-4.1-mini", displayName: "GPT-4.1 Mini", inputCostPerMillion: 0.4, outputCostPerMillion: 1.6, contextWindow: 1e6 },
+      { provider: "openai", modelId: "gpt-4.1-nano", displayName: "GPT-4.1 Nano", inputCostPerMillion: 0.1, outputCostPerMillion: 0.4, contextWindow: 1e6 },
+      { provider: "openai", modelId: "o3", displayName: "o3", inputCostPerMillion: 10, outputCostPerMillion: 40, contextWindow: 2e5 },
+      { provider: "openai", modelId: "o4-mini", displayName: "o4-mini", inputCostPerMillion: 1.1, outputCostPerMillion: 4.4, contextWindow: 2e5 },
+      // Google Gemini (up to 2M context)
+      { provider: "google", modelId: "gemini-2.5-pro", displayName: "Gemini 2.5 Pro", inputCostPerMillion: 2.5, outputCostPerMillion: 15, contextWindow: 1e6 },
+      { provider: "google", modelId: "gemini-2.5-flash", displayName: "Gemini 2.5 Flash", inputCostPerMillion: 0.15, outputCostPerMillion: 0.6, contextWindow: 1e6 },
+      { provider: "google", modelId: "gemini-2.0-flash", displayName: "Gemini 2.0 Flash", inputCostPerMillion: 0.1, outputCostPerMillion: 0.4, contextWindow: 1e6 },
+      { provider: "google", modelId: "gemini-3-pro", displayName: "Gemini 3 Pro", inputCostPerMillion: 2.5, outputCostPerMillion: 15, contextWindow: 1e6 },
+      // DeepSeek (128K context)
+      { provider: "deepseek", modelId: "deepseek-chat", displayName: "DeepSeek Chat (V3)", inputCostPerMillion: 0.14, outputCostPerMillion: 0.28, contextWindow: 128e3 },
+      { provider: "deepseek", modelId: "deepseek-reasoner", displayName: "DeepSeek Reasoner (R1)", inputCostPerMillion: 0.55, outputCostPerMillion: 2.19, contextWindow: 128e3 },
+      // xAI Grok (2M context window)
+      { provider: "xai", modelId: "grok-4", displayName: "Grok 4", inputCostPerMillion: 3, outputCostPerMillion: 15, contextWindow: 2e6 },
+      { provider: "xai", modelId: "grok-4-fast", displayName: "Grok 4 Fast", inputCostPerMillion: 0.2, outputCostPerMillion: 0.5, contextWindow: 2e6 },
+      { provider: "xai", modelId: "grok-3", displayName: "Grok 3", inputCostPerMillion: 3, outputCostPerMillion: 15, contextWindow: 131072 },
+      { provider: "xai", modelId: "grok-3-mini", displayName: "Grok 3 Mini", inputCostPerMillion: 0.3, outputCostPerMillion: 0.5, contextWindow: 131072 },
+      // Mistral
+      { provider: "mistral", modelId: "mistral-large-latest", displayName: "Mistral Large", inputCostPerMillion: 2, outputCostPerMillion: 6, contextWindow: 128e3 },
+      { provider: "mistral", modelId: "mistral-small-latest", displayName: "Mistral Small", inputCostPerMillion: 0.1, outputCostPerMillion: 0.3, contextWindow: 128e3 },
+      // Groq (inference provider)
+      { provider: "groq", modelId: "llama-3.3-70b-versatile", displayName: "Llama 3.3 70B (Groq)", inputCostPerMillion: 0.59, outputCostPerMillion: 0.79, contextWindow: 128e3 },
+      // Together (inference provider)
+      { provider: "together", modelId: "meta-llama/Llama-3.3-70B-Instruct-Turbo", displayName: "Llama 3.3 70B (Together)", inputCostPerMillion: 0.88, outputCostPerMillion: 0.88, contextWindow: 128e3 }
+    ];
+  }
+  return api;
+}
+
+// src/auth/routes.ts
+import { Hono as Hono2 } from "hono";
+import { setCookie, getCookie, deleteCookie } from "hono/cookie";
+import { createVerify } from "crypto";
+var COOKIE_NAME = "em_session";
+var REFRESH_COOKIE = "em_refresh";
+var CSRF_COOKIE = "em_csrf";
+var TOKEN_TTL = "24h";
+var REFRESH_TTL = "7d";
+function cookieOpts(maxAge, isSecure) {
+  return {
+    httpOnly: true,
+    secure: isSecure,
+    sameSite: "Lax",
+    path: "/",
+    maxAge
+  };
+}
+function generateCsrf() {
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function generateState() {
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function generateCodeVerifier() {
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes).map((b) => "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~"[b % 66]).join("");
+}
+async function generateCodeChallenge(verifier) {
+  const encoder = new TextEncoder();
+  const data = encoder.encode(verifier);
+  const digest = await crypto.subtle.digest("SHA-256", data);
+  return btoa(String.fromCharCode(...new Uint8Array(digest))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function createAuthRoutes(db, jwtSecret, opts) {
+  const auth = new Hono2();
+  const isSecure = () => {
+    return process.env.NODE_ENV === "production" || process.env.SECURE_COOKIES === "1";
+  };
+  async function issueTokens(userId, email, role) {
+    const { SignJWT } = await import("jose");
+    const secret = new TextEncoder().encode(jwtSecret);
+    const token = await new SignJWT({ sub: userId, email, role }).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime(TOKEN_TTL).sign(secret);
+    const refreshToken = await new SignJWT({ sub: userId, type: "refresh" }).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime(REFRESH_TTL).sign(secret);
+    return { token, refreshToken };
+  }
+  async function setSessionCookies(c, userId, email, role, method) {
+    const { token, refreshToken } = await issueTokens(userId, email, role);
+    const csrf = generateCsrf();
+    const secure = isSecure();
+    setCookie(c, COOKIE_NAME, token, cookieOpts(86400, secure));
+    setCookie(c, REFRESH_COOKIE, refreshToken, cookieOpts(604800, secure));
+    setCookie(c, CSRF_COOKIE, csrf, { ...cookieOpts(86400, secure), httpOnly: false });
+    await db.updateUser(userId, { lastLoginAt: /* @__PURE__ */ new Date() }).catch(() => {
+    });
+    await db.logEvent({
+      actor: userId,
+      actorType: "user",
+      action: "auth.login",
+      resource: `user:${userId}`,
+      details: { method },
+      ip: c.req.header("x-forwarded-for") || c.req.header("x-real-ip")
+    }).catch(() => {
+    });
+    return { token, refreshToken, csrf };
+  }
+  async function findOrProvisionSsoUser(provider, subject, email, name, config) {
+    if (config.allowedDomains?.length) {
+      const domain = email.split("@")[1]?.toLowerCase();
+      if (!config.allowedDomains.some((d) => d.toLowerCase() === domain)) {
+        return { error: `Email domain "${domain}" not allowed for SSO login` };
+      }
+    }
+    let user = await db.getUserBySso(provider, subject);
+    if (user) return { user };
+    user = await db.getUserByEmail(email);
+    if (user) {
+      await db.updateUser(user.id, { ssoProvider: provider, ssoSubject: subject });
+      return { user };
+    }
+    if (!config.autoProvision) {
+      return { error: "No account found. Contact your administrator to create an account." };
+    }
+    const newUser = await db.createUser({
+      email,
+      name: name || email.split("@")[0],
+      role: config.defaultRole || "member",
+      ssoProvider: provider,
+      ssoSubject: subject
+    });
+    return { user: newUser };
+  }
+  async function extractToken(c) {
+    const cookieToken = getCookie(c, COOKIE_NAME);
+    if (cookieToken) return cookieToken;
+    const authHeader = c.req.header("Authorization");
+    if (authHeader?.startsWith("Bearer ")) return authHeader.slice(7);
+    return null;
+  }
+  async function getSsoConfig() {
+    try {
+      const settings = await db.getSettings();
+      return settings?.ssoConfig || null;
+    } catch {
+      return null;
+    }
+  }
+  auth.post("/login", async (c) => {
+    const { email, password } = await c.req.json();
+    if (!email || !password) {
+      return c.json({ error: "Email and password required" }, 400);
+    }
+    const user = await db.getUserByEmail(email);
+    if (!user || !user.passwordHash) {
+      return c.json({ error: "Invalid credentials" }, 401);
+    }
+    const { default: bcrypt } = await import("bcryptjs");
+    const valid = await bcrypt.compare(password, user.passwordHash);
+    if (!valid) {
+      return c.json({ error: "Invalid credentials" }, 401);
+    }
+    const { token, refreshToken, csrf } = await setSessionCookies(c, user.id, user.email, user.role, "password");
+    return c.json({
+      token,
+      refreshToken,
+      csrf,
+      user: { id: user.id, email: user.email, name: user.name, role: user.role }
+    });
+  });
+  auth.post("/refresh", async (c) => {
+    const refreshJwt = getCookie(c, REFRESH_COOKIE) || c.req.header("Authorization")?.slice(7);
+    if (!refreshJwt) {
+      return c.json({ error: "Refresh token required" }, 401);
+    }
+    try {
+      const { jwtVerify } = await import("jose");
+      const secret = new TextEncoder().encode(jwtSecret);
+      const { payload } = await jwtVerify(refreshJwt, secret);
+      if (payload.type !== "refresh") return c.json({ error: "Invalid token type" }, 401);
+      const user = await db.getUser(payload.sub);
+      if (!user) return c.json({ error: "User not found" }, 401);
+      const { token, refreshToken } = await issueTokens(user.id, user.email, user.role);
+      const csrf = generateCsrf();
+      const secure = isSecure();
+      setCookie(c, COOKIE_NAME, token, cookieOpts(86400, secure));
+      setCookie(c, REFRESH_COOKIE, refreshToken, cookieOpts(604800, secure));
+      setCookie(c, CSRF_COOKIE, csrf, { ...cookieOpts(86400, secure), httpOnly: false });
+      return c.json({ token, csrf });
+    } catch {
+      return c.json({ error: "Invalid or expired refresh token" }, 401);
+    }
+  });
+  auth.get("/me", async (c) => {
+    const token = await extractToken(c);
+    if (!token) return c.json({ error: "Authentication required" }, 401);
+    try {
+      const { jwtVerify } = await import("jose");
+      const secret = new TextEncoder().encode(jwtSecret);
+      const { payload } = await jwtVerify(token, secret);
+      const user = await db.getUser(payload.sub);
+      if (!user) return c.json({ error: "User not found" }, 404);
+      const { passwordHash, ...safe } = user;
+      return c.json(safe);
+    } catch {
+      return c.json({ error: "Invalid or expired token" }, 401);
+    }
+  });
+  auth.post("/logout", (c) => {
+    deleteCookie(c, COOKIE_NAME, { path: "/" });
+    deleteCookie(c, REFRESH_COOKIE, { path: "/" });
+    deleteCookie(c, CSRF_COOKIE, { path: "/" });
+    return c.json({ ok: true });
+  });
+  auth.get("/sso/providers", async (c) => {
+    const sso = await getSsoConfig();
+    const providers = [];
+    if (sso?.saml?.entityId && sso?.saml?.ssoUrl) {
+      providers.push({ type: "saml", name: "SAML SSO", url: "/auth/saml/login" });
+    }
+    if (sso?.oidc?.clientId && sso?.oidc?.discoveryUrl) {
+      providers.push({ type: "oidc", name: "OpenID Connect", url: "/auth/oidc/authorize" });
+    }
+    return c.json({ providers, ssoEnabled: providers.length > 0 });
+  });
+  auth.get("/setup-status", async (c) => {
+    try {
+      const stats = await db.getStats();
+      const settings = await db.getSettings();
+      const hasUsers = stats.totalUsers > 0;
+      const hasCompanyName = !!(settings?.name && settings.name !== "" && settings.name !== "My Company");
+      const hasSmtp = !!settings?.smtpHost;
+      const hasAgents = stats.totalAgents > 0;
+      return c.json({
+        setupComplete: hasUsers,
+        needsBootstrap: !hasUsers,
+        checklist: {
+          adminCreated: hasUsers,
+          companyConfigured: hasCompanyName,
+          emailConfigured: hasSmtp,
+          agentCreated: hasAgents
+        }
+      });
+    } catch {
+      return c.json({ setupComplete: false, needsBootstrap: true, checklist: { adminCreated: false, companyConfigured: false, emailConfigured: false, agentCreated: false } });
+    }
+  });
+  auth.post("/test-db", async (c) => {
+    const stats = await db.getStats();
+    if (stats.totalUsers > 0) {
+      return c.json({ error: "Setup already complete. Database configuration is disabled." }, 403);
+    }
+    const body = await c.req.json();
+    if (!body.type) {
+      return c.json({ error: "Database type is required" }, 400);
+    }
+    try {
+      const { createAdapter } = await import("./factory-FVJH5RRY.js");
+      const testAdapter = await createAdapter(body);
+      await testAdapter.getStats();
+      await testAdapter.disconnect();
+      return c.json({ success: true });
+    } catch (err) {
+      return c.json({ success: false, error: err.message || "Connection failed" }, 400);
+    }
+  });
+  auth.post("/configure-db", async (c) => {
+    const stats = await db.getStats();
+    if (stats.totalUsers > 0) {
+      return c.json({ error: "Setup already complete. Database configuration is disabled." }, 403);
+    }
+    if (!opts?.onDbConfigure) {
+      return c.json({ error: "Database hot-swap not available" }, 501);
+    }
+    const body = await c.req.json();
+    if (!body.type) {
+      return c.json({ error: "Database type is required" }, 400);
+    }
+    try {
+      const { createAdapter } = await import("./factory-FVJH5RRY.js");
+      const newAdapter = await createAdapter(body);
+      await newAdapter.migrate();
+      const oldAdapter = opts.onDbConfigure(newAdapter);
+      try {
+        await oldAdapter.disconnect();
+      } catch {
+      }
+      try {
+        const { saveDbConfig } = await import("./config-store-CRMKWBON.js");
+        await saveDbConfig(body, jwtSecret);
+      } catch {
+      }
+      return c.json({ success: true, type: body.type });
+    } catch (err) {
+      return c.json({ success: false, error: err.message || "Configuration failed" }, 400);
+    }
+  });
+  const bootstrapAttempts = /* @__PURE__ */ new Map();
+  auth.post("/bootstrap", async (c) => {
+    const clientIp = c.req.header("x-forwarded-for")?.split(",")[0]?.trim() || c.req.header("x-real-ip") || "unknown";
+    const now = Date.now();
+    const attempt = bootstrapAttempts.get(clientIp);
+    if (attempt && attempt.resetAt > now && attempt.count >= 5) {
+      return c.json({ error: "Too many attempts. Try again later." }, 429);
+    }
+    if (!attempt || attempt.resetAt <= now) {
+      bootstrapAttempts.set(clientIp, { count: 1, resetAt: now + 6e4 });
+    } else {
+      attempt.count++;
+    }
+    const stats = await db.getStats();
+    if (stats.totalUsers > 0) {
+      return c.json({ error: "Setup already complete. Bootstrap is disabled." }, 403);
+    }
+    const { name, email, password, companyName, subdomain } = await c.req.json();
+    if (!email || !password || !name) {
+      return c.json({ error: "Name, email, and password are required" }, 400);
+    }
+    if (password.length < 8) {
+      return c.json({ error: "Password must be at least 8 characters" }, 400);
+    }
+    if (!email.includes("@") || !email.includes(".")) {
+      return c.json({ error: "Invalid email address" }, 400);
+    }
+    try {
+      const user = await db.createUser({
+        email,
+        name,
+        role: "owner",
+        password
+      });
+      if (companyName || subdomain) {
+        const updates = {};
+        if (companyName) updates.name = companyName;
+        if (subdomain) {
+          updates.subdomain = subdomain.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 63);
+        }
+        await db.updateSettings(updates);
+      }
+      await db.logEvent({
+        actor: user.id,
+        actorType: "system",
+        action: "setup.bootstrap",
+        resource: `user:${user.id}`,
+        details: { method: "web-wizard", companyName },
+        ip: c.req.header("x-forwarded-for") || c.req.header("x-real-ip")
+      });
+      const { token, refreshToken, csrf } = await setSessionCookies(c, user.id, user.email, user.role, "bootstrap");
+      opts?.onBootstrap?.();
+      return c.json({
+        token,
+        refreshToken,
+        csrf,
+        user: { id: user.id, email: user.email, name: user.name, role: user.role }
+      });
+    } catch (err) {
+      return c.json({ error: err.message || "Bootstrap failed" }, 500);
+    }
+  });
+  auth.get("/oidc/authorize", async (c) => {
+    const sso = await getSsoConfig();
+    if (!sso?.oidc?.clientId || !sso?.oidc?.discoveryUrl) {
+      return c.json({ error: "OIDC not configured. Set up OIDC in Settings > SSO." }, 400);
+    }
+    const oidc = sso.oidc;
+    let discovery;
+    try {
+      const res = await fetch(oidc.discoveryUrl);
+      if (!res.ok) throw new Error(`Discovery fetch failed: ${res.status}`);
+      discovery = await res.json();
+    } catch (e) {
+      return c.json({ error: `Failed to fetch OIDC discovery: ${e.message}` }, 502);
+    }
+    if (!discovery.authorization_endpoint) {
+      return c.json({ error: "Invalid OIDC discovery: missing authorization_endpoint" }, 502);
+    }
+    const state = generateState();
+    const nonce = generateState();
+    const codeVerifier = generateCodeVerifier();
+    const codeChallenge = await generateCodeChallenge(codeVerifier);
+    const protocol = c.req.header("x-forwarded-proto") || "http";
+    const host = c.req.header("host") || "localhost";
+    const redirectUri = `${protocol}://${host}/auth/oidc/callback`;
+    const { SignJWT } = await import("jose");
+    const secret = new TextEncoder().encode(jwtSecret);
+    const stateToken = await new SignJWT({
+      state,
+      nonce,
+      codeVerifier,
+      redirectUri,
+      discoveryUrl: oidc.discoveryUrl
+    }).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime("10m").sign(secret);
+    setCookie(c, "em_oidc_state", stateToken, {
+      httpOnly: true,
+      secure: isSecure(),
+      sameSite: "Lax",
+      path: "/auth/oidc",
+      maxAge: 600
+    });
+    const scopes = oidc.scopes?.join(" ") || "openid email profile";
+    const authUrl = new URL(discovery.authorization_endpoint);
+    authUrl.searchParams.set("client_id", oidc.clientId);
+    authUrl.searchParams.set("response_type", "code");
+    authUrl.searchParams.set("scope", scopes);
+    authUrl.searchParams.set("redirect_uri", redirectUri);
+    authUrl.searchParams.set("state", state);
+    authUrl.searchParams.set("nonce", nonce);
+    authUrl.searchParams.set("code_challenge", codeChallenge);
+    authUrl.searchParams.set("code_challenge_method", "S256");
+    return c.redirect(authUrl.toString());
+  });
+  auth.get("/oidc/callback", async (c) => {
+    const code = c.req.query("code");
+    const returnedState = c.req.query("state");
+    const error = c.req.query("error");
+    const errorDesc = c.req.query("error_description");
+    if (error) {
+      return c.html(ssoErrorPage("OIDC Error", errorDesc || error));
+    }
+    if (!code || !returnedState) {
+      return c.html(ssoErrorPage("OIDC Error", "Missing code or state parameter"));
+    }
+    const stateCookie = getCookie(c, "em_oidc_state");
+    if (!stateCookie) {
+      return c.html(ssoErrorPage("OIDC Error", "Session expired. Please try again."));
+    }
+    deleteCookie(c, "em_oidc_state", { path: "/auth/oidc" });
+    let statePayload;
+    try {
+      const { jwtVerify } = await import("jose");
+      const secret = new TextEncoder().encode(jwtSecret);
+      const { payload } = await jwtVerify(stateCookie, secret);
+      statePayload = payload;
+    } catch {
+      return c.html(ssoErrorPage("OIDC Error", "Invalid or expired state. Please try again."));
+    }
+    if (statePayload.state !== returnedState) {
+      return c.html(ssoErrorPage("OIDC Error", "State mismatch. Possible CSRF attack."));
+    }
+    const sso = await getSsoConfig();
+    if (!sso?.oidc) {
+      return c.html(ssoErrorPage("OIDC Error", "OIDC is no longer configured."));
+    }
+    const oidc = sso.oidc;
+    let discovery;
+    try {
+      const res = await fetch(oidc.discoveryUrl);
+      discovery = await res.json();
+    } catch (e) {
+      return c.html(ssoErrorPage("OIDC Error", `Discovery fetch failed: ${e.message}`));
+    }
+    let tokenResponse;
+    try {
+      const tokenRes = await fetch(discovery.token_endpoint, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          grant_type: "authorization_code",
+          code,
+          redirect_uri: statePayload.redirectUri,
+          client_id: oidc.clientId,
+          client_secret: oidc.clientSecret,
+          code_verifier: statePayload.codeVerifier
+        }).toString()
+      });
+      if (!tokenRes.ok) {
+        const errBody = await tokenRes.text();
+        throw new Error(`Token exchange failed (${tokenRes.status}): ${errBody}`);
+      }
+      tokenResponse = await tokenRes.json();
+    } catch (e) {
+      return c.html(ssoErrorPage("OIDC Error", e.message));
+    }
+    let email;
+    let name;
+    let sub;
+    if (tokenResponse.id_token) {
+      const parts = tokenResponse.id_token.split(".");
+      if (parts.length !== 3) {
+        return c.html(ssoErrorPage("OIDC Error", "Invalid id_token format"));
+      }
+      try {
+        const { jwtVerify, createRemoteJWKSet } = await import("jose");
+        const jwks = createRemoteJWKSet(new URL(discovery.jwks_uri));
+        const { payload } = await jwtVerify(tokenResponse.id_token, jwks, {
+          issuer: discovery.issuer,
+          audience: oidc.clientId
+        });
+        if (payload.nonce !== statePayload.nonce) {
+          return c.html(ssoErrorPage("OIDC Error", "Nonce mismatch. Possible replay attack."));
+        }
+        sub = payload.sub;
+        email = payload.email || "";
+        name = payload.name || payload.preferred_username || "";
+      } catch (e) {
+        return c.html(ssoErrorPage("OIDC Error", `ID token verification failed: ${e.message}`));
+      }
+    } else if (discovery.userinfo_endpoint) {
+      try {
+        const uiRes = await fetch(discovery.userinfo_endpoint, {
+          headers: { Authorization: `Bearer ${tokenResponse.access_token}` }
+        });
+        const userinfo = await uiRes.json();
+        sub = userinfo.sub;
+        email = userinfo.email || "";
+        name = userinfo.name || userinfo.preferred_username || "";
+      } catch (e) {
+        return c.html(ssoErrorPage("OIDC Error", `Userinfo fetch failed: ${e.message}`));
+      }
+    } else {
+      return c.html(ssoErrorPage("OIDC Error", "No id_token or userinfo endpoint available"));
+    }
+    if (!email) {
+      return c.html(ssoErrorPage("OIDC Error", 'No email claim in the token. Ensure "email" scope is granted.'));
+    }
+    const result = await findOrProvisionSsoUser("oidc", sub, email, name, oidc);
+    if ("error" in result) {
+      return c.html(ssoErrorPage("OIDC Error", result.error ?? "Unknown error"));
+    }
+    await setSessionCookies(c, result.user.id, result.user.email, result.user.role, "oidc");
+    return c.redirect("/dashboard");
+  });
+  auth.get("/saml/login", async (c) => {
+    const sso = await getSsoConfig();
+    if (!sso?.saml?.ssoUrl || !sso?.saml?.entityId) {
+      return c.json({ error: "SAML not configured. Set up SAML in Settings > SSO." }, 400);
+    }
+    const saml = sso.saml;
+    const protocol = c.req.header("x-forwarded-proto") || "http";
+    const host = c.req.header("host") || "localhost";
+    const acsUrl = `${protocol}://${host}/auth/saml/callback`;
+    const requestId2 = "_" + crypto.randomUUID().replace(/-/g, "");
+    const issueInstant = (/* @__PURE__ */ new Date()).toISOString();
+    const authnRequest = `<samlp:AuthnRequest
+  xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
+  xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+  ID="${requestId2}"
+  Version="2.0"
+  IssueInstant="${issueInstant}"
+  Destination="${saml.ssoUrl}"
+  AssertionConsumerServiceURL="${acsUrl}"
+  ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST">
+  <saml:Issuer>${saml.entityId}</saml:Issuer>
+  <samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" AllowCreate="true"/>
+</samlp:AuthnRequest>`;
+    const { deflateRawSync } = await import("zlib");
+    const deflated = deflateRawSync(Buffer.from(authnRequest, "utf-8"));
+    const encoded = deflated.toString("base64");
+    const redirectUrl = new URL(saml.ssoUrl);
+    redirectUrl.searchParams.set("SAMLRequest", encoded);
+    redirectUrl.searchParams.set("RelayState", "/dashboard");
+    return c.redirect(redirectUrl.toString());
+  });
+  auth.get("/saml/metadata", async (c) => {
+    const sso = await getSsoConfig();
+    const entityId = sso?.saml?.entityId || "agenticmail-enterprise";
+    const protocol = c.req.header("x-forwarded-proto") || "http";
+    const host = c.req.header("host") || "localhost";
+    const acsUrl = `${protocol}://${host}/auth/saml/callback`;
+    const sloUrl = `${protocol}://${host}/auth/saml/logout`;
+    const metadata = `<?xml version="1.0" encoding="UTF-8"?>
+<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
+  entityID="${entityId}">
+  <md:SPSSODescriptor
+    AuthnRequestsSigned="false"
+    WantAssertionsSigned="true"
+    protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+    <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
+    <md:AssertionConsumerService
+      Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+      Location="${acsUrl}"
+      index="0"
+      isDefault="true"/>
+    <md:SingleLogoutService
+      Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+      Location="${sloUrl}"/>
+  </md:SPSSODescriptor>
+</md:EntityDescriptor>`;
+    return c.body(metadata, 200, {
+      "Content-Type": "application/xml"
+    });
+  });
+  auth.post("/saml/callback", async (c) => {
+    const sso = await getSsoConfig();
+    if (!sso?.saml?.certificate) {
+      return c.html(ssoErrorPage("SAML Error", "SAML not configured."));
+    }
+    const saml = sso.saml;
+    let samlResponse;
+    const contentType = c.req.header("content-type") || "";
+    if (contentType.includes("application/x-www-form-urlencoded")) {
+      const body = await c.req.parseBody();
+      samlResponse = body["SAMLResponse"];
+    } else {
+      const body = await c.req.json().catch(() => ({}));
+      samlResponse = body.SAMLResponse;
+    }
+    if (!samlResponse) {
+      return c.html(ssoErrorPage("SAML Error", "Missing SAMLResponse"));
+    }
+    let xml;
+    try {
+      xml = Buffer.from(samlResponse, "base64").toString("utf-8");
+    } catch {
+      return c.html(ssoErrorPage("SAML Error", "Invalid base64 encoding"));
+    }
+    const assertion = parseSamlAssertion(xml, saml.certificate);
+    if (assertion.error) {
+      return c.html(ssoErrorPage("SAML Error", assertion.error));
+    }
+    if (!assertion.email) {
+      return c.html(ssoErrorPage("SAML Error", "No email found in SAML assertion. Check your IdP attribute mapping."));
+    }
+    if (assertion.notBefore && new Date(assertion.notBefore) > /* @__PURE__ */ new Date()) {
+      return c.html(ssoErrorPage("SAML Error", "Assertion not yet valid"));
+    }
+    if (assertion.notOnOrAfter && new Date(assertion.notOnOrAfter) <= /* @__PURE__ */ new Date()) {
+      return c.html(ssoErrorPage("SAML Error", "Assertion has expired"));
+    }
+    const subject = assertion.nameId || assertion.email;
+    const result = await findOrProvisionSsoUser("saml", subject, assertion.email, assertion.name || "", saml);
+    if ("error" in result) {
+      return c.html(ssoErrorPage("SAML Error", result.error ?? "Unknown error"));
+    }
+    await setSessionCookies(c, result.user.id, result.user.email, result.user.role, "saml");
+    return c.redirect("/dashboard");
+  });
+  return auth;
+}
+function parseSamlAssertion(xml, certificate) {
+  const result = {};
+  try {
+    const statusMatch = xml.match(/<samlp?:StatusCode[^>]*Value="([^"]+)"/);
+    if (statusMatch) {
+      const statusValue = statusMatch[1];
+      if (!statusValue.includes(":Success")) {
+        result.error = `SAML authentication failed with status: ${statusValue}`;
+        return result;
+      }
+    }
+    const nameIdMatch = xml.match(/<(?:saml2?:)?NameID[^>]*>([^<]+)<\/(?:saml2?:)?NameID>/);
+    if (nameIdMatch) {
+      result.nameId = nameIdMatch[1].trim();
+    }
+    const issuerMatch = xml.match(/<(?:saml2?:)?Issuer[^>]*>([^<]+)<\/(?:saml2?:)?Issuer>/);
+    if (issuerMatch) {
+      result.issuer = issuerMatch[1].trim();
+    }
+    const condMatch = xml.match(/<(?:saml2?:)?Conditions\s+NotBefore="([^"]+)"\s+NotOnOrAfter="([^"]+)"/);
+    if (condMatch) {
+      result.notBefore = condMatch[1];
+      result.notOnOrAfter = condMatch[2];
+    }
+    const sessionMatch = xml.match(/SessionIndex="([^"]+)"/);
+    if (sessionMatch) {
+      result.sessionIndex = sessionMatch[1];
+    }
+    const attrRegex = /<(?:saml2?:)?Attribute\s+Name="([^"]+)"[^>]*>[\s\S]*?<(?:saml2?:)?AttributeValue[^>]*>([^<]*)<\/(?:saml2?:)?AttributeValue>/g;
+    let match;
+    while ((match = attrRegex.exec(xml)) !== null) {
+      const attrName = match[1].toLowerCase();
+      const attrValue = match[2].trim();
+      if (attrName.includes("emailaddress") || attrName.includes("email") || attrName === "mail") {
+        result.email = attrValue;
+      } else if (attrName.includes("displayname") || attrName === "name") {
+        result.name = attrValue;
+      } else if (attrName.includes("givenname") || attrName.includes("firstname")) {
+        result.firstName = attrValue;
+      } else if (attrName.includes("surname") || attrName.includes("lastname")) {
+        result.lastName = attrValue;
+      }
+    }
+    if (!result.email && result.nameId?.includes("@")) {
+      result.email = result.nameId;
+    }
+    if (!result.name && (result.firstName || result.lastName)) {
+      result.name = [result.firstName, result.lastName].filter(Boolean).join(" ");
+    }
+    result.signatureValid = verifySamlSignature(xml, certificate);
+    if (!result.signatureValid) {
+      result.error = "SAML assertion signature verification failed. Check IdP certificate.";
+      return result;
+    }
+  } catch (e) {
+    result.error = `Failed to parse SAML assertion: ${e.message}`;
+  }
+  return result;
+}
+function verifySamlSignature(xml, certPem) {
+  try {
+    const sigMatch = xml.match(/<(?:ds:)?SignatureValue[^>]*>([\s\S]*?)<\/(?:ds:)?SignatureValue>/);
+    if (!sigMatch) return true;
+    const signedInfoMatch = xml.match(/<(?:ds:)?SignedInfo[^>]*>[\s\S]*?<\/(?:ds:)?SignedInfo>/);
+    if (!signedInfoMatch) return false;
+    let cert = certPem.trim();
+    if (!cert.startsWith("-----BEGIN CERTIFICATE-----")) {
+      cert = cert.replace(/\s/g, "");
+      cert = `-----BEGIN CERTIFICATE-----
+${cert.match(/.{1,64}/g)?.join("\n")}
+-----END CERTIFICATE-----`;
+    }
+    const algMatch = xml.match(/SignatureMethod\s+Algorithm="([^"]+)"/);
+    const algorithm = algMatch?.[1]?.includes("rsa-sha256") ? "RSA-SHA256" : "RSA-SHA1";
+    const signature = Buffer.from(sigMatch[1].replace(/\s/g, ""), "base64");
+    const signedInfo = signedInfoMatch[0];
+    const canonicalized = signedInfo.replace(/\r\n/g, "\n").replace(/\r/g, "\n").trim();
+    const verifier = createVerify(algorithm);
+    verifier.update(canonicalized);
+    return verifier.verify(cert, signature);
+  } catch {
+    return false;
+  }
+}
+function ssoErrorPage(title, message) {
+  return `<!DOCTYPE html>
+<html>
+<head><title>${title}</title>
+<style>
+  body { font-family: system-ui, -apple-system, sans-serif; display: flex; align-items: center; justify-content: center; min-height: 100vh; margin: 0; background: #f8f9fa; }
+  .card { background: white; border-radius: 12px; padding: 40px; max-width: 480px; box-shadow: 0 2px 8px rgba(0,0,0,0.1); text-align: center; }
+  h1 { color: #dc2626; font-size: 1.5rem; margin: 0 0 16px; }
+  p { color: #4b5563; margin: 0 0 24px; line-height: 1.5; }
+  a { display: inline-block; padding: 10px 24px; background: #6366f1; color: white; border-radius: 8px; text-decoration: none; }
+  a:hover { background: #4f46e5; }
+</style></head>
+<body>
+<div class="card">
+  <h1>${title}</h1>
+  <p>${message}</p>
+  <a href="/dashboard">Back to Dashboard</a>
+</div>
+</body></html>`;
+}
+
+// src/server.ts
+function createServer(config) {
+  const app = new Hono3();
+  const dbProxy = createDbProxy(config.db);
+  config.db = dbProxy;
+  const dbBreaker = new CircuitBreaker({
+    failureThreshold: 5,
+    recoveryTimeMs: 3e4,
+    timeout: 1e4
+  });
+  const healthMonitor = new HealthMonitor(
+    async () => {
+      await config.db.getStats();
+    },
+    { intervalMs: 3e4, timeoutMs: 5e3, unhealthyThreshold: 3 }
+  );
+  healthMonitor.onStatusChange((healthy) => {
+    console.log(
+      `[${(/* @__PURE__ */ new Date()).toISOString()}] ${healthy ? "\u2705" : "\u274C"} Database health: ${healthy ? "healthy" : "unhealthy"}`
+    );
+  });
+  app.use("*", requestIdMiddleware());
+  app.use("*", errorHandler());
+  app.use("*", securityHeaders());
+  app.use("*", ipAccessControl(() => config.db));
+  app.use("*", cors({
+    origin: config.corsOrigins || "*",
+    credentials: true,
+    allowHeaders: ["Content-Type", "Authorization", "X-API-Key", "X-Request-Id", "X-CSRF-Token"],
+    exposeHeaders: ["X-Request-Id", "X-RateLimit-Limit", "X-RateLimit-Remaining", "Retry-After"]
+  }));
+  app.use("*", rateLimiter({
+    limit: config.rateLimit ?? 120,
+    windowSec: 60,
+    skipPaths: ["/health", "/ready"]
+  }));
+  if (config.logging !== false) {
+    app.use("*", requestLogger());
+  }
+  app.get("/health", (c) => c.json({
+    status: "ok",
+    version: "0.4.0",
+    uptime: process.uptime()
+  }));
+  app.get("/ready", async (c) => {
+    const dbHealthy = healthMonitor.isHealthy();
+    const status = dbHealthy ? 200 : 503;
+    return c.json({
+      ready: dbHealthy,
+      checks: {
+        database: dbHealthy ? "ok" : "unhealthy",
+        circuitBreaker: dbBreaker.getState()
+      }
+    }, status);
+  });
+  let _setupComplete = false;
+  (async () => {
+    try {
+      const stats = await config.db.getStats();
+      if (stats.totalUsers > 0) _setupComplete = true;
+    } catch {
+    }
+  })();
+  const authRoutes = createAuthRoutes(config.db, config.jwtSecret, {
+    onBootstrap: () => {
+      _setupComplete = true;
+    },
+    onDbConfigure: (newAdapter) => {
+      const old = dbProxy.__swap(newAdapter);
+      engineInitialized = false;
+      return old;
+    }
+  });
+  app.route("/auth", authRoutes);
+  const api = new Hono3();
+  api.use("*", async (c, next) => {
+    const apiKeyHeader = c.req.header("X-API-Key");
+    if (apiKeyHeader) {
+      const key = await dbBreaker.execute(() => config.db.validateApiKey(apiKeyHeader));
+      if (!key) return c.json({ error: "Invalid API key" }, 401);
+      c.set("userId", key.createdBy);
+      c.set("authType", "api-key");
+      c.set("apiKeyScopes", key.scopes);
+      return next();
+    }
+    const { getCookie: getCookie2 } = await import("hono/cookie");
+    const cookieToken = getCookie2(c, "em_session");
+    const authHeader = c.req.header("Authorization");
+    const jwt = cookieToken || (authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null);
+    if (!jwt) {
+      return c.json({ error: "Authentication required" }, 401);
+    }
+    try {
+      const { jwtVerify } = await import("jose");
+      const secret = new TextEncoder().encode(config.jwtSecret);
+      const { payload } = await jwtVerify(jwt, secret);
+      c.set("userId", payload.sub);
+      c.set("userRole", payload.role || "");
+      c.set("userEmail", payload.email || "");
+      c.set("authType", cookieToken ? "cookie" : "jwt");
+      return next();
+    } catch {
+      return c.json({ error: "Invalid or expired token" }, 401);
+    }
+  });
+  api.use("*", auditLogger(config.db));
+  const adminRoutes = createAdminRoutes(config.db);
+  api.route("/", adminRoutes);
+  let engineInitialized = false;
+  api.all("/engine/*", async (c, next) => {
+    try {
+      const { engineRoutes, setEngineDb } = await import("./routes-NJK5OI5N.js");
+      const { EngineDatabase } = await import("./db-adapter-5PWMLY67.js");
+      if (!engineInitialized) {
+        const engineDbInterface = config.db.getEngineDB();
+        if (!engineDbInterface) {
+          return c.json({
+            error: "Engine not available",
+            detail: `Engine requires a SQL-compatible database. "${config.db.type}" does not support raw SQL queries. Use postgres, mysql, sqlite, or turso.`
+          }, 501);
+        }
+        const adapterDialect = config.db.getDialect();
+        const dialectMap = {
+          sqlite: "sqlite",
+          postgres: "postgres",
+          supabase: "postgres",
+          neon: "postgres",
+          cockroachdb: "postgres",
+          mysql: "mysql",
+          planetscale: "mysql",
+          turso: "turso"
+        };
+        const engineDialect = dialectMap[adapterDialect] || adapterDialect;
+        const engineDb = new EngineDatabase(engineDbInterface, engineDialect);
+        const migrationResult = await engineDb.migrate();
+        console.log(`[engine] Migrations: ${migrationResult.applied} applied, ${migrationResult.total} total`);
+        await setEngineDb(engineDb, config.db);
+        engineInitialized = true;
+        if (config.runtime?.enabled) {
+          try {
+            const { createAgentRuntime } = await import("./runtime-SMA6JUMP.js");
+            const { mountRuntimeApp } = await import("./routes-NJK5OI5N.js");
+            const runtime = createAgentRuntime({
+              engineDb,
+              adminDb: config.db,
+              defaultModel: config.runtime.defaultModel,
+              apiKeys: config.runtime.apiKeys,
+              gatewayEnabled: true
+            });
+            await runtime.start();
+            const runtimeApp = runtime.getApp();
+            if (runtimeApp) {
+              mountRuntimeApp(runtimeApp);
+            }
+            console.log("[runtime] Agent runtime started and mounted at /api/engine/runtime/*");
+          } catch (runtimeErr) {
+            console.warn(`[runtime] Failed to start agent runtime: ${runtimeErr.message}`);
+          }
+        }
+      }
+      const originalUrl = new URL(c.req.url);
+      const subPath = (c.req.path.replace(/^\/api\/engine/, "") || "/") + originalUrl.search;
+      const headers = new Headers(c.req.raw.headers);
+      const userId = c.get("userId");
+      const userRole = c.get("userRole");
+      const userEmail = c.get("userEmail");
+      const authType = c.get("authType");
+      const requestId2 = c.get("requestId");
+      if (userId) headers.set("X-User-Id", String(userId));
+      if (userRole) headers.set("X-User-Role", String(userRole));
+      if (userEmail) headers.set("X-User-Email", String(userEmail));
+      if (authType) headers.set("X-Auth-Type", String(authType));
+      if (requestId2) headers.set("X-Request-Id", String(requestId2));
+      const subReq = new Request(new URL(subPath, "http://localhost"), {
+        method: c.req.method,
+        headers,
+        body: c.req.method !== "GET" && c.req.method !== "HEAD" ? c.req.raw.body : void 0
+      });
+      return engineRoutes.fetch(subReq);
+    } catch (e) {
+      console.error("[engine] Error:", e.message);
+      return c.json({ error: "Engine module not available", detail: e.message }, 501);
+    }
+  });
+  app.route("/api", api);
+  let dashboardHtml = null;
+  function getDashboardHtml() {
+    if (!dashboardHtml) {
+      try {
+        const dir = dirname(fileURLToPath(import.meta.url));
+        dashboardHtml = readFileSync(join(dir, "dashboard", "index.html"), "utf-8");
+      } catch {
+        try {
+          dashboardHtml = readFileSync(join(process.cwd(), "node_modules", "@agenticmail", "enterprise", "dist", "dashboard", "index.html"), "utf-8");
+        } catch {
+          dashboardHtml = "<html><body><h1>Dashboard not found</h1><p>The dashboard HTML file could not be located.</p></body></html>";
+        }
+      }
+    }
+    return dashboardHtml;
+  }
+  async function serveDashboard(c) {
+    let html = getDashboardHtml();
+    if (!_setupComplete) {
+      const injection = `<script>window.__EM_SETUP_STATE__=${JSON.stringify({ needsBootstrap: true })};</script>`;
+      html = html.replace("</head>", injection + "</head>");
+    }
+    try {
+      const settings = await config.db.getSettings();
+      if (settings.domain && settings.domainStatus) {
+        const domainState = {
+          domain: settings.domain,
+          status: settings.domainStatus,
+          verifiedAt: settings.domainVerifiedAt,
+          dnsChallenge: settings.domainDnsChallenge
+        };
+        const domainScript = `<script>window.__EM_DOMAIN_STATE__=${JSON.stringify(domainState)};</script>`;
+        html = html.replace("</head>", domainScript + "</head>");
+      }
+    } catch {
+    }
+    return c.html(html);
+  }
+  app.get("/", (c) => c.redirect("/dashboard"));
+  app.get("/dashboard", serveDashboard);
+  const STATIC_MIME = { ".js": "application/javascript; charset=utf-8", ".png": "image/png", ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".svg": "image/svg+xml", ".ico": "image/x-icon", ".gif": "image/gif", ".webp": "image/webp", ".css": "text/css; charset=utf-8" };
+  app.get("/dashboard/*", (c) => {
+    const reqPath = c.req.path.replace("/dashboard/", "");
+    const ext = reqPath.substring(reqPath.lastIndexOf("."));
+    const mime = STATIC_MIME[ext];
+    if (mime) {
+      const dir = dirname(fileURLToPath(import.meta.url));
+      const filePath = join(dir, "dashboard", reqPath);
+      if (!filePath.startsWith(join(dir, "dashboard"))) {
+        return c.json({ error: "Forbidden" }, 403);
+      }
+      if (existsSync(filePath)) {
+        const content = readFileSync(filePath);
+        return new Response(content, { status: 200, headers: { "Content-Type": mime, "Cache-Control": ext === ".js" ? "no-cache, no-store, must-revalidate" : "public, max-age=86400" } });
+      }
+    }
+    return serveDashboard(c);
+  });
+  app.notFound((c) => {
+    return c.json({ error: "Not found", path: c.req.path }, 404);
+  });
+  return {
+    app,
+    healthMonitor,
+    start: () => {
+      return new Promise((resolve) => {
+        const server = serve(
+          { fetch: app.fetch, port: config.port },
+          (info) => {
+            console.log(`
+\u{1F3E2} AgenticMail Enterprise`);
+            console.log(`   API:    http://localhost:${info.port}/api`);
+            console.log(`   Auth:   http://localhost:${info.port}/auth`);
+            console.log(`   Health: http://localhost:${info.port}/health`);
+            console.log("");
+            healthMonitor.start();
+            const shutdown = () => {
+              console.log("\n\u23F3 Shutting down gracefully...");
+              healthMonitor.stop();
+              server.close(() => {
+                config.db.disconnect().then(() => {
+                  console.log("\u2705 Shutdown complete");
+                  process.exit(0);
+                });
+              });
+              setTimeout(() => {
+                process.exit(1);
+              }, 1e4).unref();
+            };
+            process.on("SIGINT", shutdown);
+            process.on("SIGTERM", shutdown);
+            resolve({
+              close: () => {
+                healthMonitor.stop();
+                server.close();
+              }
+            });
+          }
+        );
+      });
+    }
+  };
+}
+
+export {
+  requestIdMiddleware,
+  requestLogger,
+  rateLimiter,
+  securityHeaders,
+  errorHandler,
+  ValidationError,
+  validate,
+  auditLogger,
+  requireRole,
+  createAdminRoutes,
+  createAuthRoutes,
+  createServer
+};