@agenticmail/enterprise 0.5.1 → 0.5.2

package/dist/chunk-UPU23ZRG.js

@@ -0,0 +1,154 @@
+// src/domain-lock/index.ts
+import { randomBytes } from "crypto";
+var REGISTRY_BASE_URL = process.env.AGENTICMAIL_REGISTRY_URL || "https://agenticmail.io/enterprise/v1";
+var DomainLock = class {
+  registryUrl;
+  constructor(opts) {
+    this.registryUrl = (opts?.registryUrl || REGISTRY_BASE_URL).replace(/\/$/, "");
+  }
+  /**
+   * Generate a 256-bit deployment key.
+   * Returns the plaintext (hex) and its bcrypt hash.
+   * The plaintext should be shown to the user ONCE and never stored.
+   */
+  async generateDeploymentKey() {
+    const { default: bcrypt } = await import("bcryptjs");
+    const plaintext = randomBytes(32).toString("hex");
+    const hash = await bcrypt.hash(plaintext, 12);
+    return { plaintext, hash };
+  }
+  /**
+   * Register a domain with the central registry.
+   * Called during setup wizard Step 5.
+   *
+   * @param domain - The domain to register (e.g. "agents.agenticmail.io")
+   * @param keyHash - bcrypt hash of the deployment key
+   * @param opts - Optional org name and contact email
+   */
+  async register(domain, keyHash, opts) {
+    try {
+      const res = await fetch(`${this.registryUrl}/domains/register`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          domain: domain.toLowerCase().trim(),
+          keyHash,
+          orgName: opts?.orgName,
+          contactEmail: opts?.contactEmail
+        }),
+        signal: AbortSignal.timeout(15e3)
+      });
+      const data = await res.json().catch(() => ({}));
+      if (res.status === 409) {
+        return {
+          success: false,
+          error: data.error || 'Domain is already registered and verified. Use "recover" if this is your domain.',
+          statusCode: 409
+        };
+      }
+      if (!res.ok) {
+        return {
+          success: false,
+          error: data.error || `Registration failed (HTTP ${res.status})`,
+          statusCode: res.status
+        };
+      }
+      return {
+        success: true,
+        registrationId: data.registrationId,
+        dnsChallenge: data.dnsChallenge
+      };
+    } catch (err) {
+      if (err.name === "TimeoutError" || err.name === "AbortError") {
+        return { success: false, error: "Registry server unreachable (timeout). You can retry later or continue without registration." };
+      }
+      return { success: false, error: `Registry connection failed: ${err.message}` };
+    }
+  }
+  /**
+   * Ask the registry to check DNS verification for a domain.
+   * The registry resolves _agenticmail-verify.<domain> TXT record.
+   */
+  async checkVerification(domain) {
+    try {
+      const res = await fetch(`${this.registryUrl}/domains/verify`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ domain: domain.toLowerCase().trim() }),
+        signal: AbortSignal.timeout(15e3)
+      });
+      const data = await res.json().catch(() => ({}));
+      if (!res.ok) {
+        return { success: false, error: data.error || `Verification check failed (HTTP ${res.status})` };
+      }
+      return {
+        success: true,
+        verified: data.verified === true,
+        error: data.verified ? void 0 : data.error || "DNS record not found yet"
+      };
+    } catch (err) {
+      if (err.name === "TimeoutError" || err.name === "AbortError") {
+        return { success: false, error: "Registry server unreachable (timeout)" };
+      }
+      return { success: false, error: `Registry connection failed: ${err.message}` };
+    }
+  }
+  /**
+   * Recover a domain registration on a new machine.
+   * Requires the original deployment key (plaintext).
+   * The registry verifies via bcrypt.compare against stored hash.
+   * On success, a new DNS challenge is issued (must re-verify DNS).
+   */
+  async recover(domain, deploymentKey) {
+    try {
+      const res = await fetch(`${this.registryUrl}/domains/recover`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          domain: domain.toLowerCase().trim(),
+          deploymentKey
+        }),
+        signal: AbortSignal.timeout(15e3)
+      });
+      const data = await res.json().catch(() => ({}));
+      if (res.status === 403) {
+        return { success: false, error: "Invalid deployment key. The key does not match the registered domain." };
+      }
+      if (res.status === 404) {
+        return { success: false, error: "Domain is not registered. Use setup wizard to register first." };
+      }
+      if (!res.ok) {
+        return { success: false, error: data.error || `Recovery failed (HTTP ${res.status})` };
+      }
+      return {
+        success: true,
+        dnsChallenge: data.dnsChallenge,
+        registrationId: data.registrationId
+      };
+    } catch (err) {
+      if (err.name === "TimeoutError" || err.name === "AbortError") {
+        return { success: false, error: "Registry server unreachable (timeout)" };
+      }
+      return { success: false, error: `Registry connection failed: ${err.message}` };
+    }
+  }
+  /**
+   * Check domain status on the registry (public, read-only).
+   */
+  async getRemoteStatus(domain) {
+    try {
+      const res = await fetch(
+        `${this.registryUrl}/domains/${encodeURIComponent(domain.toLowerCase().trim())}/status`,
+        { signal: AbortSignal.timeout(1e4) }
+      );
+      if (!res.ok) return null;
+      return await res.json();
+    } catch {
+      return null;
+    }
+  }
+};
+
+export {
+  DomainLock
+};

package/dist/cli-recover-X4MKJQVV.js

@@ -0,0 +1,97 @@
+import {
+  DomainLock
+} from "./chunk-UPU23ZRG.js";
+import "./chunk-KFQGP6VL.js";
+
+// src/domain-lock/cli-recover.ts
+function getFlag(args, name) {
+  const idx = args.indexOf(name);
+  if (idx !== -1 && args[idx + 1]) return args[idx + 1];
+  return void 0;
+}
+async function runRecover(args) {
+  const { default: inquirer } = await import("inquirer");
+  const { default: chalk } = await import("chalk");
+  const { default: ora } = await import("ora");
+  console.log("");
+  console.log(chalk.bold("  AgenticMail Enterprise \u2014 Domain Recovery"));
+  console.log(chalk.dim("  Recover your domain registration on a new machine."));
+  console.log("");
+  let domain = getFlag(args, "--domain");
+  if (!domain) {
+    const answer = await inquirer.prompt([{
+      type: "input",
+      name: "domain",
+      message: "Domain to recover:",
+      suffix: chalk.dim("  (e.g. agents.agenticmail.io)"),
+      validate: (v) => v.includes(".") || "Enter a valid domain"
+    }]);
+    domain = answer.domain;
+  }
+  let key = getFlag(args, "--key");
+  if (!key) {
+    const answer = await inquirer.prompt([{
+      type: "password",
+      name: "key",
+      message: "Deployment key:",
+      mask: "*",
+      validate: (v) => {
+        if (v.length !== 64) return "Deployment key should be 64 hex characters";
+        if (!/^[0-9a-fA-F]+$/.test(v)) return "Deployment key should be hexadecimal";
+        return true;
+      }
+    }]);
+    key = answer.key;
+  }
+  const spinner = ora("Contacting AgenticMail registry...").start();
+  const lock = new DomainLock();
+  const result = await lock.recover(domain, key);
+  if (!result.success) {
+    spinner.fail("Recovery failed");
+    console.log("");
+    console.error(chalk.red(`  ${result.error}`));
+    console.log("");
+    process.exit(1);
+  }
+  spinner.succeed("Domain recovery initiated");
+  const { default: bcrypt } = await import("bcryptjs");
+  const keyHash = await bcrypt.hash(key, 12);
+  const dbPath = getFlag(args, "--db");
+  const dbType = getFlag(args, "--db-type") || "sqlite";
+  if (dbPath) {
+    try {
+      const spinnerDb = ora("Saving to local database...").start();
+      const { createAdapter } = await import("./factory-FVJH5RRY.js");
+      const db = await createAdapter({ type: dbType, connectionString: dbPath });
+      await db.migrate();
+      await db.updateSettings({
+        domain,
+        deploymentKeyHash: keyHash,
+        domainRegistrationId: result.registrationId,
+        domainDnsChallenge: result.dnsChallenge,
+        domainRegisteredAt: (/* @__PURE__ */ new Date()).toISOString(),
+        domainStatus: "pending_dns"
+      });
+      spinnerDb.succeed("Local database updated");
+      await db.disconnect();
+    } catch (err) {
+      console.log(chalk.yellow(`
+  Could not update local DB: ${err.message}`));
+      console.log(chalk.dim("  You can manually update settings after setup."));
+    }
+  }
+  console.log("");
+  console.log(chalk.green.bold("  Domain recovery successful!"));
+  console.log("");
+  console.log(chalk.bold("  Update your DNS TXT record:"));
+  console.log("");
+  console.log(`  ${chalk.bold("Host:")}   ${chalk.cyan(`_agenticmail-verify.${domain}`)}`);
+  console.log(`  ${chalk.bold("Type:")}   ${chalk.cyan("TXT")}`);
+  console.log(`  ${chalk.bold("Value:")}  ${chalk.cyan(result.dnsChallenge)}`);
+  console.log("");
+  console.log(chalk.dim("  Then run: agenticmail-enterprise verify-domain"));
+  console.log("");
+}
+export {
+  runRecover
+};

package/dist/cli-verify-YT7IADFX.js

@@ -0,0 +1,98 @@
+import {
+  DomainLock
+} from "./chunk-UPU23ZRG.js";
+import "./chunk-KFQGP6VL.js";
+
+// src/domain-lock/cli-verify.ts
+function getFlag(args, name) {
+  const idx = args.indexOf(name);
+  if (idx !== -1 && args[idx + 1]) return args[idx + 1];
+  return void 0;
+}
+async function runVerifyDomain(args) {
+  const { default: chalk } = await import("chalk");
+  const { default: ora } = await import("ora");
+  console.log("");
+  console.log(chalk.bold("  AgenticMail Enterprise \u2014 Domain Verification"));
+  console.log("");
+  let domain = getFlag(args, "--domain");
+  let dnsChallenge;
+  let dbConnected = false;
+  let db = null;
+  if (!domain) {
+    const dbPath = getFlag(args, "--db");
+    const dbType = getFlag(args, "--db-type") || "sqlite";
+    if (dbPath) {
+      try {
+        const { createAdapter } = await import("./factory-FVJH5RRY.js");
+        db = await createAdapter({ type: dbType, connectionString: dbPath });
+        await db.migrate();
+        const settings = await db.getSettings();
+        domain = settings?.domain;
+        dnsChallenge = settings?.domainDnsChallenge;
+        dbConnected = true;
+      } catch {
+      }
+    }
+  }
+  if (!domain) {
+    const { default: inquirer } = await import("inquirer");
+    const answer = await inquirer.prompt([{
+      type: "input",
+      name: "domain",
+      message: "Domain to verify:",
+      suffix: chalk.dim("  (e.g. agents.agenticmail.io)"),
+      validate: (v) => v.includes(".") || "Enter a valid domain"
+    }]);
+    domain = answer.domain;
+  }
+  const spinner = ora("Checking DNS verification...").start();
+  const lock = new DomainLock();
+  const result = await lock.checkVerification(domain);
+  if (!result.success) {
+    spinner.fail("Verification check failed");
+    console.log("");
+    console.error(chalk.red(`  ${result.error}`));
+    console.log("");
+    if (db) await db.disconnect();
+    process.exit(1);
+  }
+  if (result.verified) {
+    spinner.succeed("Domain verified!");
+    if (dbConnected && db) {
+      try {
+        await db.updateSettings({
+          domainStatus: "verified",
+          domainVerifiedAt: (/* @__PURE__ */ new Date()).toISOString()
+        });
+      } catch {
+      }
+    }
+    console.log("");
+    console.log(chalk.green.bold(`  ${domain} is verified and protected.`));
+    console.log(chalk.dim("  Your deployment domain is locked. No other instance can claim it."));
+    console.log("");
+  } else {
+    spinner.info("DNS record not found yet");
+    console.log("");
+    console.log(chalk.yellow("  The DNS TXT record has not been detected."));
+    console.log("");
+    console.log(chalk.bold("  Make sure this record exists:"));
+    console.log("");
+    console.log(`  ${chalk.bold("Host:")}   ${chalk.cyan(`_agenticmail-verify.${domain}`)}`);
+    console.log(`  ${chalk.bold("Type:")}   ${chalk.cyan("TXT")}`);
+    if (dnsChallenge) {
+      console.log(`  ${chalk.bold("Value:")}  ${chalk.cyan(dnsChallenge)}`);
+    } else {
+      console.log(`  ${chalk.bold("Value:")}  ${chalk.dim("(check your setup records or dashboard)")}`);
+    }
+    console.log("");
+    console.log(chalk.dim("  DNS changes can take up to 48 hours to propagate."));
+    console.log(chalk.dim("  Run this command again after adding the record."));
+    console.log("");
+  }
+  if (db) await db.disconnect();
+}
+export {
+  runVerifyDomain
+};

package/dist/cli.js

@@ -14,10 +14,10 @@ switch (command) {
     import("./cli-submit-skill-RSBLF5XN.js").then((m) => m.runSubmitSkill(args.slice(1))).catch(fatal);
     break;
   case "recover":
-    import("./cli-recover-SSGGSKZJ.js").then((m) => m.runRecover(args.slice(1))).catch(fatal);
+    import("./cli-recover-X4MKJQVV.js").then((m) => m.runRecover(args.slice(1))).catch(fatal);
     break;
   case "verify-domain":
-    import("./cli-verify-V3GPFMWU.js").then((m) => m.runVerifyDomain(args.slice(1))).catch(fatal);
+    import("./cli-verify-YT7IADFX.js").then((m) => m.runVerifyDomain(args.slice(1))).catch(fatal);
     break;
   case "--help":
   case "-h":
@@ -48,7 +48,7 @@ Skill Development:
     break;
   case "setup":
   default:
-    import("./setup-HCMMUEW6.js").then((m) => m.runSetupWizard()).catch(fatal);
+    import("./setup-5CVRQ5ES.js").then((m) => m.runSetupWizard()).catch(fatal);
     break;
 }
 function fatal(err) {

package/dist/domain-lock-Z5A74VJK.js

@@ -0,0 +1,7 @@
+import {
+  DomainLock
+} from "./chunk-UPU23ZRG.js";
+import "./chunk-KFQGP6VL.js";
+export {
+  DomainLock
+};

package/dist/index.js

@@ -11,11 +11,11 @@ import {
   requireRole,
   securityHeaders,
   validate
-} from "./chunk-V2YIXYDJ.js";
+} from "./chunk-ISOODMEF.js";
 import {
   provision,
   runSetupWizard
-} from "./chunk-ANW4OHXR.js";
+} from "./chunk-PQADDAC2.js";
 import {
   ENGINE_TABLES,
   ENGINE_TABLES_POSTGRES,

package/dist/server-6LWKND7R.js

@@ -0,0 +1,11 @@
+import {
+  createServer
+} from "./chunk-ISOODMEF.js";
+import "./chunk-RO537U6H.js";
+import "./chunk-DRXMYYKN.js";
+import "./chunk-ZNR5DDTA.js";
+import "./chunk-JLSQOQ5L.js";
+import "./chunk-KFQGP6VL.js";
+export {
+  createServer
+};

package/dist/setup-5CVRQ5ES.js

@@ -0,0 +1,20 @@
+import {
+  promptCompanyInfo,
+  promptDatabase,
+  promptDeployment,
+  promptDomain,
+  promptRegistration,
+  provision,
+  runSetupWizard
+} from "./chunk-PQADDAC2.js";
+import "./chunk-NTVN3JHS.js";
+import "./chunk-KFQGP6VL.js";
+export {
+  promptCompanyInfo,
+  promptDatabase,
+  promptDeployment,
+  promptDomain,
+  promptRegistration,
+  provision,
+  runSetupWizard
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticmail/enterprise",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "AgenticMail Enterprise — cloud-hosted AI agent identity, email, auth & compliance for organizations",
   "type": "module",
   "bin": {

package/src/domain-lock/index.ts

@@ -13,7 +13,7 @@
 import { randomBytes } from 'crypto';
 
 const REGISTRY_BASE_URL = process.env.AGENTICMAIL_REGISTRY_URL
-  || 'https://registry.agenticmail.com/v1';
+  || 'https://agenticmail.io/enterprise/v1';
 
 // ─── Types ──────────────────────────────────────────────
 

package/src/setup/registration.ts

@@ -13,7 +13,7 @@
 import { randomBytes } from 'crypto';
 
 const REGISTRY_BASE_URL = process.env.AGENTICMAIL_REGISTRY_URL
-  || 'https://registry.agenticmail.com/v1';
+  || 'https://agenticmail.io/enterprise/v1';
 
 // ─── Types ──────────────────────────────────────────────
 
@@ -60,9 +60,9 @@ export async function promptRegistration(
 
   const spinner = ora('Generating deployment key...').start();
 
-  const { default: bcrypt } = await import('bcryptjs');
+  const { createHash } = await import('crypto');
   const plaintextKey = randomBytes(32).toString('hex'); // 64-char hex
-  const keyHash = await bcrypt.hash(plaintextKey, 12);
+  const keyHash = createHash('sha256').update(plaintextKey).digest('hex');
 
   spinner.succeed('Deployment key generated');
 
@@ -81,6 +81,7 @@ export async function promptRegistration(
       body: JSON.stringify({
         domain: domain.toLowerCase().trim(),
         keyHash,
+        sha256Hash: keyHash,
         orgName: companyName,
         contactEmail: adminEmail,
       }),