npm - @agenticmail/enterprise - Versions diffs - 0.5.254 → 0.5.255 - Mend

@agenticmail/enterprise 0.5.254 → 0.5.255

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (16) hide show

package/dist/agent-heartbeat-YENMEEVX.js +510 -0
package/dist/chunk-75FNJLUP.js +1224 -0
package/dist/chunk-APCWGN56.js +479 -0
package/dist/chunk-HE4H2WNG.js +4488 -0
package/dist/chunk-TOD2HH7L.js +3778 -0
package/dist/cli-agent-UP7UVQ4S.js +1768 -0
package/dist/cli-serve-TMYT73ZR.js +114 -0
package/dist/cli.js +3 -3
package/dist/index.js +3 -3
package/dist/routes-GYKER7K7.js +13510 -0
package/dist/runtime-3CAEEFSI.js +45 -0
package/dist/server-37QX4BUZ.js +15 -0
package/dist/setup-5BEVJLTF.js +20 -0
package/dist/task-queue-3BUUISTK.js +7 -0
package/package.json +1 -1
package/src/engine/task-queue.ts +13 -2

package/dist/chunk-TOD2HH7L.js ADDED Viewed

@@ -0,0 +1,3778 @@
+import {
+  deployToFly,
+  destroyApp,
+  getAppStatus
+} from "./chunk-OF4MUWWS.js";
+import {
+  PROVIDER_REGISTRY
+} from "./chunk-UF3ZJMJO.js";
+import {
+  configBus
+} from "./chunk-3OC6RH7W.js";
+import {
+  CircuitBreaker,
+  HealthMonitor,
+  KeyedRateLimiter,
+  requestId
+} from "./chunk-2DDKGTD6.js";
+import {
+  getNetworkConfig,
+  getNetworkConfigSync,
+  invalidateNetworkConfig,
+  onNetworkConfigChange,
+  setNetworkDb
+} from "./chunk-MKRNEM5A.js";
+import {
+  compileIpMatcher
+} from "./chunk-DRXMYYKN.js";
+import {
+  SecureVault
+} from "./chunk-6WSX7QXF.js";
+import {
+  __require
+} from "./chunk-KFQGP6VL.js";
+// src/server.ts
+import { Hono as Hono3 } from "hono";
+import { cors } from "hono/cors";
+import { serve } from "@hono/node-server";
+import { readFileSync, existsSync } from "fs";
+import { homedir } from "os";
+import { fileURLToPath } from "url";
+import { dirname, join } from "path";
+import { createRequire } from "module";
+// src/db/proxy.ts
+function createDbProxy(initial) {
+  let target = initial;
+  const proxy = new Proxy({}, {
+    get(_, prop) {
+      if (prop === "__swap") {
+        return (newAdapter) => {
+          const old = target;
+          target = newAdapter;
+          return old;
+        };
+      }
+      if (prop === "__target") return target;
+      const val = target[prop];
+      return typeof val === "function" ? val.bind(target) : val;
+    }
+  });
+  return proxy;
+}
+// src/admin/routes.ts
+import { Hono } from "hono";
+// src/middleware/firewall.ts
+var FIREWALL_BLOCK_PAGE = `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Access Denied</title>
+<style>
+  *{margin:0;padding:0;box-sizing:border-box}
+  body{min-height:100vh;display:flex;align-items:center;justify-content:center;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;background:#0f1117;color:#e1e4e8}
+  .container{text-align:center;max-width:480px;padding:40px 24px}
+  .icon{width:64px;height:64px;margin:0 auto 24px;border-radius:16px;background:rgba(255,107,107,0.1);display:flex;align-items:center;justify-content:center}
+  .icon svg{width:32px;height:32px;stroke:#ff6b6b;fill:none;stroke-width:2;stroke-linecap:round;stroke-linejoin:round}
+  h1{font-size:24px;font-weight:700;margin-bottom:12px;color:#fff}
+  p{font-size:15px;line-height:1.6;color:#8b949e;margin-bottom:8px}
+  .subtle{font-size:13px;color:#484f58;margin-top:24px}
+</style>
+</head>
+<body>
+<div class="container">
+  <div class="icon"><svg viewBox="0 0 24 24"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/><line x1="9" y1="9" x2="15" y2="15"/><line x1="15" y1="9" x2="9" y2="15"/></svg></div>
+  <h1>Access Denied</h1>
+  <p>Your request has been blocked by the firewall. Access to this service is restricted by the administrator.</p>
+  <p>If you believe this is an error, please contact the site owner.</p>
+  <div class="subtle">Error 403</div>
+</div>
+</body>
+</html>`;
+function firewallBlock(c) {
+  const accept = c.req.header("accept") || "";
+  if (accept.includes("application/json") || c.req.path.startsWith("/api/")) {
+    return c.json({ error: "Access denied by firewall policy", code: "IP_BLOCKED" }, 403);
+  }
+  return c.html(FIREWALL_BLOCK_PAGE, 403);
+}
+var _compiled = {
+  enabled: false,
+  mode: "blocklist",
+  allowlistMatcher: null,
+  blocklistMatcher: null,
+  bypassPaths: [],
+  trustedProxyMatcher: null,
+  trustedProxyEnabled: false
+};
+function recompile(config) {
+  const ipAccess = config.ipAccess;
+  const tp = config.trustedProxies;
+  _compiled = {
+    enabled: ipAccess?.enabled === true,
+    mode: ipAccess?.mode || "blocklist",
+    allowlistMatcher: ipAccess?.allowlist?.length ? compileIpMatcher(ipAccess.allowlist) : null,
+    blocklistMatcher: ipAccess?.blocklist?.length ? compileIpMatcher(ipAccess.blocklist) : null,
+    bypassPaths: ["/health", "/ready", ...ipAccess?.bypassPaths || []],
+    trustedProxyMatcher: tp?.ips?.length ? compileIpMatcher(tp.ips) : null,
+    trustedProxyEnabled: tp?.enabled === true
+  };
+}
+onNetworkConfigChange(recompile);
+function extractClientIp(c, connectingIp) {
+  const xff = c.req.header("x-forwarded-for");
+  const xri = c.req.header("x-real-ip");
+  if (_compiled.trustedProxyEnabled && _compiled.trustedProxyMatcher) {
+    if (!_compiled.trustedProxyMatcher(connectingIp)) {
+      return connectingIp;
+    }
+    if (xff) {
+      const parts = xff.split(",").map((s) => s.trim()).filter(Boolean);
+      for (let i = parts.length - 1; i >= 0; i--) {
+        if (!_compiled.trustedProxyMatcher(parts[i])) {
+          return parts[i];
+        }
+      }
+      return parts[0] || connectingIp;
+    }
+    return xri || connectingIp;
+  }
+  return xff?.split(",")[0]?.trim() || xri || connectingIp;
+}
+function ipAccessControl(_getDb) {
+  return async (c, next) => {
+    await getNetworkConfig();
+    if (!_compiled.enabled) return next();
+    const connectingIp = c.env?.remoteAddress || c.req.raw?.socket?.remoteAddress || "unknown";
+    const clientIp = extractClientIp(c, connectingIp || "unknown");
+    c.set("clientIp", clientIp);
+    if (_compiled.bypassPaths.some((p) => c.req.path.startsWith(p))) {
+      return next();
+    }
+    if (_compiled.mode === "allowlist") {
+      if (_compiled.allowlistMatcher && !_compiled.allowlistMatcher(clientIp)) {
+        return firewallBlock(c);
+      }
+      return next();
+    }
+    if (_compiled.mode === "blocklist") {
+      if (_compiled.blocklistMatcher && _compiled.blocklistMatcher(clientIp)) {
+        return firewallBlock(c);
+      }
+      return next();
+    }
+    return next();
+  };
+}
+// src/middleware/dns-rebinding.ts
+function dnsRebindingProtection() {
+  return async (c, next) => {
+    const config = await getNetworkConfig();
+    const dns = config.dnsRebinding;
+    if (!dns?.enabled || !dns.allowedHosts?.length) return next();
+    const host = c.req.header("host")?.split(":")[0]?.toLowerCase();
+    if (!host) return next();
+    const allowed = dns.allowedHosts.some((h) => {
+      const pattern = h.toLowerCase();
+      if (pattern === host) return true;
+      if (pattern.startsWith("*.")) {
+        const suffix = pattern.slice(1);
+        return host.endsWith(suffix) || host === pattern.slice(2);
+      }
+      return false;
+    });
+    if (!allowed) {
+      return c.json(
+        { error: "Invalid Host header", code: "DNS_REBINDING_BLOCKED" },
+        403
+      );
+    }
+    return next();
+  };
+}
+// src/middleware/request-limits.ts
+var DEFAULT_MAX_BODY_KB = 10240;
+function requestBodyLimit() {
+  return async (c, next) => {
+    const config = await getNetworkConfig();
+    const maxKb = config.network?.maxBodySizeKb || DEFAULT_MAX_BODY_KB;
+    const maxBytes = maxKb * 1024;
+    const contentLength = c.req.header("content-length");
+    if (contentLength) {
+      const size = parseInt(contentLength, 10);
+      if (!isNaN(size) && size > maxBytes) {
+        return c.json(
+          {
+            error: `Request body too large (${Math.round(size / 1024)}KB). Maximum is ${maxKb}KB.`,
+            code: "BODY_TOO_LARGE"
+          },
+          413
+        );
+      }
+    }
+    return next();
+  };
+}
+// src/middleware/geo-ip.ts
+var COUNTRY_HEADERS = [
+  "cf-ipcountry",
+  // Cloudflare (proxy mode)
+  "x-country-code",
+  // Generic / custom
+  "x-vercel-ip-country"
+  // Vercel
+];
+var GEO_CACHE = /* @__PURE__ */ new Map();
+var GEO_CACHE_TTL = 36e5;
+var GEO_CACHE_MAX = 1e4;
+var GEO_LOOKUP_TIMEOUT = 3e3;
+async function lookupCountry(ip) {
+  const cached = GEO_CACHE.get(ip);
+  if (cached && Date.now() - cached.ts < GEO_CACHE_TTL) {
+    return cached.country;
+  }
+  if (ip === "unknown" || ip === "127.0.0.1" || ip === "::1" || ip.startsWith("192.168.") || ip.startsWith("10.") || ip === "localhost") {
+    return null;
+  }
+  try {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), GEO_LOOKUP_TIMEOUT);
+    const resp = await fetch(`http://ip-api.com/json/${ip}?fields=status,countryCode`, {
+      signal: controller.signal
+    });
+    clearTimeout(timer);
+    if (!resp.ok) return null;
+    const data = await resp.json();
+    if (data.status !== "success" || !data.countryCode) return null;
+    const country = data.countryCode.toUpperCase();
+    if (GEO_CACHE.size >= GEO_CACHE_MAX) {
+      const oldest = GEO_CACHE.keys().next().value;
+      if (oldest) GEO_CACHE.delete(oldest);
+    }
+    GEO_CACHE.set(ip, { country, ts: Date.now() });
+    return country;
+  } catch {
+    return null;
+  }
+}
+var GEO_BLOCK_PAGE = `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Access Restricted</title>
+<style>
+  *{margin:0;padding:0;box-sizing:border-box}
+  body{min-height:100vh;display:flex;align-items:center;justify-content:center;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;background:#0f1117;color:#e1e4e8}
+  .container{text-align:center;max-width:480px;padding:40px 24px}
+  .icon{width:64px;height:64px;margin:0 auto 24px;border-radius:16px;background:rgba(255,107,107,0.1);display:flex;align-items:center;justify-content:center}
+  .icon svg{width:32px;height:32px;stroke:#ff6b6b;fill:none;stroke-width:2;stroke-linecap:round;stroke-linejoin:round}
+  h1{font-size:24px;font-weight:700;margin-bottom:12px;color:#fff}
+  p{font-size:15px;line-height:1.6;color:#8b949e;margin-bottom:8px}
+  .subtle{font-size:13px;color:#484f58;margin-top:24px}
+</style>
+</head>
+<body>
+<div class="container">
+  <div class="icon"><svg viewBox="0 0 24 24"><circle cx="12" cy="12" r="10"/><path d="M2 12h20"/><path d="M12 2a15.3 15.3 0 0 1 4 10 15.3 15.3 0 0 1-4 10 15.3 15.3 0 0 1-4-10 15.3 15.3 0 0 1 4-10z"/><line x1="4.93" y1="4.93" x2="19.07" y2="19.07"/></svg></div>
+  <h1>Access Restricted</h1>
+  <p>This service is not available in your region. Access has been restricted by the administrator.</p>
+  <p>If you believe this is an error, please contact the site owner.</p>
+  <div class="subtle">Error 403</div>
+</div>
+</body>
+</html>`;
+function geoIpRestriction() {
+  return async (c, next) => {
+    const config = await getNetworkConfig();
+    const geo = config.geoIp;
+    if (!geo?.enabled || !geo.countries?.length) return next();
+    let country = null;
+    for (const header of COUNTRY_HEADERS) {
+      const val = c.req.header(header);
+      if (val) {
+        country = val.toUpperCase().trim();
+        break;
+      }
+    }
+    if (!country) {
+      const clientIp = c.req.header("cf-connecting-ip") || c.req.header("x-forwarded-for")?.split(",")[0]?.trim() || c.req.header("x-real-ip") || c.get?.("clientIp") || null;
+      if (clientIp) {
+        country = await lookupCountry(clientIp);
+      }
+    }
+    if (!country) return next();
+    const countries = new Set(geo.countries.map((c2) => c2.toUpperCase()));
+    const mode = geo.mode || "blocklist";
+    let blocked = false;
+    if (mode === "allowlist" && !countries.has(country)) blocked = true;
+    if (mode === "blocklist" && countries.has(country)) blocked = true;
+    if (blocked) {
+      const accept = c.req.header("accept") || "";
+      if (accept.includes("application/json") || c.req.path.startsWith("/api/")) {
+        return c.json({ error: "Access restricted", code: "GEO_BLOCKED" }, 403);
+      }
+      return c.html(GEO_BLOCK_PAGE, 403);
+    }
+    return next();
+  };
+}
+// src/middleware/proxy-config.ts
+var _applied = false;
+function applyProxy(config) {
+  const proxy = config.proxy;
+  if (!proxy) {
+    if (_applied) {
+      delete process.env.HTTP_PROXY;
+      delete process.env.HTTPS_PROXY;
+      delete process.env.NO_PROXY;
+      delete process.env.http_proxy;
+      delete process.env.https_proxy;
+      delete process.env.no_proxy;
+      _applied = false;
+    }
+    return;
+  }
+  if (proxy.httpProxy) {
+    process.env.HTTP_PROXY = proxy.httpProxy;
+    process.env.http_proxy = proxy.httpProxy;
+    _applied = true;
+  } else {
+    delete process.env.HTTP_PROXY;
+    delete process.env.http_proxy;
+  }
+  if (proxy.httpsProxy) {
+    process.env.HTTPS_PROXY = proxy.httpsProxy;
+    process.env.https_proxy = proxy.httpsProxy;
+    _applied = true;
+  } else {
+    delete process.env.HTTPS_PROXY;
+    delete process.env.https_proxy;
+  }
+  if (proxy.noProxy && proxy.noProxy.length > 0) {
+    const noProxyStr = proxy.noProxy.join(",");
+    process.env.NO_PROXY = noProxyStr;
+    process.env.no_proxy = noProxyStr;
+    _applied = true;
+  } else {
+    delete process.env.NO_PROXY;
+    delete process.env.no_proxy;
+  }
+  if (_applied) {
+    console.log(`[${(/* @__PURE__ */ new Date()).toISOString()}] Proxy config applied: HTTP=${proxy.httpProxy || "none"} HTTPS=${proxy.httpsProxy || "none"} NO_PROXY=${proxy.noProxy?.join(",") || "none"}`);
+  }
+}
+function initProxyConfig() {
+  const config = getNetworkConfigSync();
+  applyProxy(config);
+  onNetworkConfigChange(applyProxy);
+}
+// src/middleware/index.ts
+function requestIdMiddleware() {
+  return async (c, next) => {
+    const id = c.req.header("X-Request-Id") || requestId();
+    c.set("requestId", id);
+    c.header("X-Request-Id", id);
+    await next();
+  };
+}
+function requestLogger() {
+  return async (c, next) => {
+    const start = Date.now();
+    const method = c.req.method;
+    const path = c.req.path;
+    await next();
+    const elapsed = Date.now() - start;
+    const status = c.res.status;
+    const reqId = c.get("requestId") || "-";
+    const level = status >= 500 ? "ERROR" : status >= 400 ? "WARN" : "INFO";
+    console.log(
+      `[${(/* @__PURE__ */ new Date()).toISOString()}] ${level} ${method} ${path} ${status} ${elapsed}ms req=${reqId}`
+    );
+  };
+}
+function requireHttps() {
+  return async (c, next) => {
+    const netConfig = await getNetworkConfig();
+    const https = netConfig.network?.httpsEnforcement;
+    const enforcing = https?.enabled ?? process.env.NODE_ENV === "production";
+    if (!enforcing) return next();
+    const excludePaths = https?.excludePaths || [];
+    if (excludePaths.some((p) => c.req.path.startsWith(p))) {
+      return next();
+    }
+    const host = c.req.header("host") || "";
+    if (host.startsWith("localhost") || host.startsWith("127.0.0.1") || host.startsWith("[::1]")) {
+      return next();
+    }
+    const isSecure = c.req.url.startsWith("https://") || c.req.header("x-forwarded-proto") === "https" || c.req.header("x-forwarded-ssl") === "on";
+    if (!isSecure) {
+      return c.json({ error: "HTTPS required by security policy", code: "HTTPS_REQUIRED" }, 403);
+    }
+    await next();
+  };
+}
+function rateLimiter(config) {
+  let limiter = new KeyedRateLimiter({
+    maxTokens: config.limit,
+    refillRate: config.limit / config.windowSec
+  });
+  let _currentLimit = config.limit;
+  let _currentSkipPaths = config.skipPaths || [];
+  return async (c, next) => {
+    const netConfig = await getNetworkConfig();
+    const dbRl = netConfig.network?.rateLimit;
+    if (dbRl?.enabled === false) return next();
+    const effectiveLimit = dbRl?.requestsPerMinute || config.limit;
+    if (effectiveLimit !== _currentLimit) {
+      _currentLimit = effectiveLimit;
+      limiter = new KeyedRateLimiter({
+        maxTokens: _currentLimit,
+        refillRate: _currentLimit / config.windowSec
+      });
+    }
+    const skipPaths = [...config.skipPaths || [], ...dbRl?.skipPaths || []];
+    if (skipPaths.some((p) => c.req.path.startsWith(p))) {
+      return next();
+    }
+    const key = config.keyFn?.(c) || c.get?.("clientIp") || c.req.header("x-forwarded-for")?.split(",")[0]?.trim() || c.req.header("x-real-ip") || "unknown";
+    if (!limiter.tryConsume(key)) {
+      const retryAfter = Math.ceil(limiter.getRetryAfterMs(key) / 1e3);
+      c.header("Retry-After", String(retryAfter));
+      c.header("X-RateLimit-Limit", String(_currentLimit));
+      c.header("X-RateLimit-Remaining", "0");
+      return c.json(
+        { error: "Too many requests", retryAfter },
+        429
+      );
+    }
+    await next();
+  };
+}
+function securityHeaders() {
+  return async (c, next) => {
+    await next();
+    const netConfig = await getNetworkConfig();
+    const sh = netConfig.network?.securityHeaders;
+    if (sh?.xContentTypeOptions !== false) {
+      c.header("X-Content-Type-Options", "nosniff");
+    }
+    const xfo = sh?.xFrameOptions || "DENY";
+    if (xfo !== "ALLOW") {
+      c.header("X-Frame-Options", xfo);
+    }
+    c.header("X-XSS-Protection", "0");
+    c.header("Referrer-Policy", sh?.referrerPolicy || "strict-origin-when-cross-origin");
+    c.header("Permissions-Policy", sh?.permissionsPolicy || "camera=(), microphone=(), geolocation=()");
+    const isTls = c.req.url.startsWith("https://") || c.req.header("x-forwarded-proto") === "https";
+    if (isTls && sh?.hsts !== false) {
+      const maxAge = sh?.hstsMaxAge || 31536e3;
+      c.header("Strict-Transport-Security", `max-age=${maxAge}; includeSubDomains`);
+    }
+  };
+}
+function errorHandler() {
+  return async (c, next) => {
+    try {
+      await next();
+    } catch (err) {
+      const reqId = c.get("requestId");
+      const status = err.status || err.statusCode || 500;
+      const message = status >= 500 ? "Internal server error" : err.message;
+      if (status >= 500) {
+        console.error(`[${(/* @__PURE__ */ new Date()).toISOString()}] ERROR req=${reqId}`, err);
+      }
+      const body = {
+        error: message,
+        code: err.code,
+        requestId: reqId
+      };
+      if (status === 400 && err.details) {
+        body.details = err.details;
+      }
+      return c.json(body, status);
+    }
+  };
+}
+var ValidationError = class extends Error {
+  status = 400;
+  code = "VALIDATION_ERROR";
+  details;
+  constructor(details) {
+    const fields = Object.keys(details).join(", ");
+    super(`Validation failed: ${fields}`);
+    this.details = details;
+  }
+};
+function validate(body, validators) {
+  const errors = {};
+  for (const v of validators) {
+    const value = body[v.field];
+    if (value === void 0 || value === null || value === "") {
+      if (v.required) errors[v.field] = "Required";
+      continue;
+    }
+    switch (v.type) {
+      case "string":
+        if (typeof value !== "string") {
+          errors[v.field] = "Must be a string";
+          break;
+        }
+        if (v.minLength && value.length < v.minLength) errors[v.field] = `Min length: ${v.minLength}`;
+        if (v.maxLength && value.length > v.maxLength) errors[v.field] = `Max length: ${v.maxLength}`;
+        if (v.pattern && !v.pattern.test(value)) errors[v.field] = "Invalid format";
+        break;
+      case "number":
+        if (typeof value !== "number" || isNaN(value)) {
+          errors[v.field] = "Must be a number";
+          break;
+        }
+        if (v.min !== void 0 && value < v.min) errors[v.field] = `Min: ${v.min}`;
+        if (v.max !== void 0 && value > v.max) errors[v.field] = `Max: ${v.max}`;
+        break;
+      case "boolean":
+        if (typeof value !== "boolean") errors[v.field] = "Must be a boolean";
+        break;
+      case "email":
+        if (typeof value !== "string" || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value))
+          errors[v.field] = "Invalid email";
+        break;
+      case "url":
+        try {
+          new URL(value);
+        } catch {
+          errors[v.field] = "Invalid URL";
+        }
+        break;
+      case "uuid":
+        if (typeof value !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value))
+          errors[v.field] = "Invalid UUID";
+        break;
+    }
+  }
+  if (Object.keys(errors).length > 0) {
+    throw new ValidationError(errors);
+  }
+}
+function auditLogger(db) {
+  const AUDIT_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE"]);
+  return async (c, next) => {
+    await next();
+    if (!AUDIT_METHODS.has(c.req.method)) return;
+    if (c.res.status >= 400) return;
+    try {
+      const userId = c.get("userId") || "anonymous";
+      const path = c.req.path;
+      const method = c.req.method;
+      const segments = path.split("/").filter(Boolean);
+      const resource = segments[segments.length - 2] || segments[segments.length - 1] || "unknown";
+      const actionMap = {
+        POST: "create",
+        PUT: "update",
+        PATCH: "update",
+        DELETE: "delete"
+      };
+      const action = `${resource}.${actionMap[method] || method.toLowerCase()}`;
+      const userEmail = c.get("userEmail") || void 0;
+      const userRole = c.get("userRole") || void 0;
+      await db.logEvent({
+        actor: userId,
+        actorType: "user",
+        action,
+        resource: path,
+        details: {
+          ...userEmail ? { email: userEmail } : {},
+          ...userRole ? { role: userRole } : {},
+          method
+        },
+        ip: c.req.header("x-forwarded-for")?.split(",")[0]?.trim() || c.req.header("x-real-ip")
+      });
+    } catch {
+    }
+  };
+}
+var ROLE_HIERARCHY = {
+  viewer: 0,
+  member: 1,
+  admin: 2,
+  owner: 3
+};
+function requireRole(minRole) {
+  return async (c, next) => {
+    const userRole = c.get("userRole");
+    if (c.get("authType") === "api-key") {
+      return next();
+    }
+    if (!userRole || ROLE_HIERARCHY[userRole] < ROLE_HIERARCHY[minRole]) {
+      return c.json({
+        error: "Insufficient permissions",
+        required: minRole,
+        current: userRole || "none"
+      }, 403);
+    }
+    return next();
+  };
+}
+// src/admin/routes.ts
+async function validateProviderApiKey(providerId, apiKey, provider) {
+  const timeout = 1e4;
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), timeout);
+  try {
+    let resp;
+    switch (providerId) {
+      case "anthropic": {
+        resp = await fetch("https://api.anthropic.com/v1/messages", {
+          method: "POST",
+          headers: { "x-api-key": apiKey, "anthropic-version": "2023-06-01", "content-type": "application/json" },
+          body: JSON.stringify({ model: "claude-haiku-4-20250414", max_tokens: 1, messages: [{ role: "user", content: "hi" }] }),
+          signal: ctrl.signal
+        });
+        if (resp.status === 401 || resp.status === 403) {
+          return { ok: false, error: "Invalid API key (HTTP " + resp.status + ")" };
+        }
+        return { ok: true };
+      }
+      case "openai": {
+        resp = await fetch("https://api.openai.com/v1/models", {
+          headers: { Authorization: "Bearer " + apiKey },
+          signal: ctrl.signal
+        });
+        if (resp.status === 401 || resp.status === 403) {
+          return { ok: false, error: "Invalid API key (HTTP " + resp.status + ")" };
+        }
+        return { ok: true };
+      }
+      case "google": {
+        resp = await fetch("https://generativelanguage.googleapis.com/v1beta/models?key=" + apiKey, {
+          signal: ctrl.signal
+        });
+        if (resp.status === 400 || resp.status === 401 || resp.status === 403) {
+          return { ok: false, error: "Invalid API key (HTTP " + resp.status + ")" };
+        }
+        return { ok: true };
+      }
+      case "xai": {
+        resp = await fetch("https://api.x.ai/v1/models", {
+          headers: { Authorization: "Bearer " + apiKey },
+          signal: ctrl.signal
+        });
+        if (resp.status === 401 || resp.status === 403) {
+          return { ok: false, error: "Invalid API key" };
+        }
+        return { ok: true };
+      }
+      case "deepseek": {
+        resp = await fetch("https://api.deepseek.com/models", {
+          headers: { Authorization: "Bearer " + apiKey },
+          signal: ctrl.signal
+        });
+        if (resp.status === 401 || resp.status === 403) {
+          return { ok: false, error: "Invalid API key" };
+        }
+        return { ok: true };
+      }
+      case "mistral": {
+        resp = await fetch("https://api.mistral.ai/v1/models", {
+          headers: { Authorization: "Bearer " + apiKey },
+          signal: ctrl.signal
+        });
+        if (resp.status === 401 || resp.status === 403) {
+          return { ok: false, error: "Invalid API key" };
+        }
+        return { ok: true };
+      }
+      case "groq": {
+        resp = await fetch("https://api.groq.com/openai/v1/models", {
+          headers: { Authorization: "Bearer " + apiKey },
+          signal: ctrl.signal
+        });
+        if (resp.status === 401 || resp.status === 403) {
+          return { ok: false, error: "Invalid API key" };
+        }
+        return { ok: true };
+      }
+      case "together": {
+        resp = await fetch("https://api.together.xyz/v1/models", {
+          headers: { Authorization: "Bearer " + apiKey },
+          signal: ctrl.signal
+        });
+        if (resp.status === 401 || resp.status === 403) {
+          return { ok: false, error: "Invalid API key" };
+        }
+        return { ok: true };
+      }
+      case "openrouter": {
+        resp = await fetch("https://openrouter.ai/api/v1/models", {
+          headers: { Authorization: "Bearer " + apiKey },
+          signal: ctrl.signal
+        });
+        if (resp.status === 401 || resp.status === 403) {
+          return { ok: false, error: "Invalid API key" };
+        }
+        return { ok: true };
+      }
+      case "fireworks": {
+        resp = await fetch("https://api.fireworks.ai/inference/v1/models", {
+          headers: { Authorization: "Bearer " + apiKey },
+          signal: ctrl.signal
+        });
+        if (resp.status === 401 || resp.status === 403) {
+          return { ok: false, error: "Invalid API key" };
+        }
+        return { ok: true };
+      }
+      case "cerebras": {
+        resp = await fetch("https://api.cerebras.ai/v1/models", {
+          headers: { Authorization: "Bearer " + apiKey },
+          signal: ctrl.signal
+        });
+        if (resp.status === 401 || resp.status === 403) {
+          return { ok: false, error: "Invalid API key" };
+        }
+        return { ok: true };
+      }
+      // Local providers (ollama, vllm, lmstudio, litellm) — skip validation
+      case "ollama":
+      case "vllm":
+      case "lmstudio":
+      case "litellm":
+        return { ok: true };
+      default: {
+        try {
+          resp = await fetch(provider.baseUrl + "/models", {
+            headers: { Authorization: "Bearer " + apiKey },
+            signal: ctrl.signal
+          });
+          if (resp.status === 401 || resp.status === 403) {
+            return { ok: false, error: "Invalid API key" };
+          }
+          return { ok: true };
+        } catch {
+          return { ok: true };
+        }
+      }
+    }
+  } catch (e) {
+    if (e.name === "AbortError") {
+      return { ok: false, error: "Validation timed out \u2014 provider not reachable" };
+    }
+    return { ok: false, error: e.message || "Connection failed" };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+var vault = new SecureVault();
+function createAdminRoutes(db) {
+  const api = new Hono();
+  const updateSettingsAndEmit = async (updates) => {
+    const result = await db.updateSettings(updates);
+    configBus.emitSettings(Object.keys(updates));
+    return result;
+  };
+  api.get("/stats", async (c) => {
+    const stats = await db.getStats();
+    return c.json(stats);
+  });
+  api.get("/agents", async (c) => {
+    const status = c.req.query("status");
+    const limit = Math.min(parseInt(c.req.query("limit") || "50"), 200);
+    const offset = Math.max(parseInt(c.req.query("offset") || "0"), 0);
+    const agents = await db.listAgents({ status, limit, offset });
+    const total = await db.countAgents(status);
+    return c.json({ agents, total, limit, offset });
+  });
+  api.get("/agents/:id", async (c) => {
+    const agent = await db.getAgent(c.req.param("id"));
+    if (!agent) return c.json({ error: "Agent not found" }, 404);
+    return c.json(agent);
+  });
+  api.post("/agents", async (c) => {
+    const body = await c.req.json();
+    validate(body, [
+      { field: "name", type: "string", required: true, minLength: 1, maxLength: 64, pattern: /^[a-zA-Z0-9_-]+$/ },
+      { field: "email", type: "email" },
+      { field: "role", type: "string", maxLength: 32 }
+    ]);
+    const existing = await db.getAgentByName(body.name);
+    if (existing) {
+      return c.json({ error: "Agent name already exists" }, 409);
+    }
+    const userId = c.get("userId") || "system";
+    const agent = await db.createAgent({ ...body, createdBy: userId });
+    return c.json(agent, 201);
+  });
+  api.patch("/agents/:id", async (c) => {
+    const id = c.req.param("id");
+    const existing = await db.getAgent(id);
+    if (!existing) return c.json({ error: "Agent not found" }, 404);
+    const body = await c.req.json();
+    validate(body, [
+      { field: "name", type: "string", minLength: 1, maxLength: 64 },
+      { field: "email", type: "email" },
+      { field: "role", type: "string", maxLength: 32 },
+      { field: "status", type: "string", pattern: /^(active|archived|suspended)$/ }
+    ]);
+    if (body.name && body.name !== existing.name) {
+      const conflict = await db.getAgentByName(body.name);
+      if (conflict) return c.json({ error: "Agent name already exists" }, 409);
+    }
+    const agent = await db.updateAgent(id, body);
+    configBus.emitAgentUpdate(id, Object.keys(body));
+    return c.json(agent);
+  });
+  api.post("/agents/:id/archive", async (c) => {
+    const existing = await db.getAgent(c.req.param("id"));
+    if (!existing) return c.json({ error: "Agent not found" }, 404);
+    if (existing.status === "archived") return c.json({ error: "Agent already archived" }, 400);
+    await db.archiveAgent(c.req.param("id"));
+    return c.json({ ok: true, status: "archived" });
+  });
+  api.post("/agents/:id/restore", async (c) => {
+    const existing = await db.getAgent(c.req.param("id"));
+    if (!existing) return c.json({ error: "Agent not found" }, 404);
+    if (existing.status !== "archived") return c.json({ error: "Agent is not archived" }, 400);
+    await db.updateAgent(c.req.param("id"), { status: "active" });
+    return c.json({ ok: true, status: "active" });
+  });
+  api.delete("/agents/:id", requireRole("admin"), async (c) => {
+    const existing = await db.getAgent(c.req.param("id"));
+    if (!existing) return c.json({ error: "Agent not found" }, 404);
+    await db.deleteAgent(c.req.param("id"));
+    return c.json({ ok: true });
+  });
+  api.post("/agents/:id/deploy", requireRole("admin"), async (c) => {
+    const agentId = c.req.param("id");
+    const agent = await db.getAgent(agentId);
+    if (!agent) return c.json({ error: "Agent not found" }, 404);
+    const body = await c.req.json();
+    const targetType = body.targetType || "fly";
+    const config = body.config || {};
+    const settings = await db.getSettings();
+    const pricingConfig = settings?.modelPricingConfig || {};
+    const providerApiKeys = pricingConfig.providerApiKeys || {};
+    if (targetType === "fly") {
+      let flyToken = config.flyApiToken || process.env.FLY_API_TOKEN;
+      if (!flyToken && body.credentialId) {
+        try {
+          const creds = await db.query?.("SELECT config FROM deploy_credentials WHERE id = $1", [body.credentialId]);
+          if (creds?.rows?.[0]?.config) {
+            const credConfig = typeof creds.rows[0].config === "string" ? JSON.parse(creds.rows[0].config) : creds.rows[0].config;
+            flyToken = credConfig.apiToken;
+          }
+        } catch {
+        }
+      }
+      if (!flyToken) {
+        return c.json({ error: "Fly.io API token required. Add it in Settings \u2192 Deployments or pass flyApiToken in config." }, 400);
+      }
+      const flyConfig = {
+        apiToken: flyToken,
+        org: config.flyOrg || "personal",
+        image: config.image || "node:22-slim",
+        regions: config.regions || ["iad"]
+      };
+      const agentName = agent.name || agentId;
+      const appConfig = {
+        subdomain: agentName.toLowerCase().replace(/[^a-z0-9-]/g, "-"),
+        dbType: "postgres",
+        dbConnectionString: process.env.DATABASE_URL || "",
+        jwtSecret: process.env.JWT_SECRET || "agent-" + agentId,
+        smtpHost: settings?.smtpHost,
+        smtpPort: settings?.smtpPort,
+        smtpUser: settings?.smtpUser,
+        smtpPass: settings?.smtpPass,
+        memoryMb: config.memoryMb || 256,
+        cpuKind: config.cpuKind || "shared",
+        cpus: config.cpus || 1
+      };
+      try {
+        const result = await deployToFly(appConfig, flyConfig);
+        const existingAgent = await db.getAgent(agentId);
+        const existingMeta = existingAgent?.metadata || {};
+        await db.updateAgent(agentId, {
+          status: result.status === "started" ? "active" : "error",
+          metadata: {
+            ...existingMeta,
+            deployment: {
+              target: "fly",
+              appName: result.appName,
+              url: result.url,
+              region: result.region,
+              machineId: result.machineId,
+              deployedAt: (/* @__PURE__ */ new Date()).toISOString(),
+              deployedBy: body.deployedBy || "dashboard",
+              status: result.status
+            }
+          }
+        });
+        return c.json({
+          success: result.status === "started",
+          deployment: result
+        });
+      } catch (err) {
+        return c.json({ error: "Deployment failed: " + err.message }, 500);
+      }
+    }
+    if (targetType === "local") {
+      const existingAgent = await db.getAgent(agentId);
+      const existingMeta = existingAgent?.metadata || {};
+      await db.updateAgent(agentId, {
+        status: "active",
+        metadata: {
+          ...existingMeta,
+          deployment: {
+            target: "local",
+            url: `http://localhost:${3e3 + Math.floor(Math.random() * 1e3)}`,
+            deployedAt: (/* @__PURE__ */ new Date()).toISOString(),
+            deployedBy: body.deployedBy || "dashboard",
+            status: "started"
+          }
+        }
+      });
+      return c.json({ success: true, deployment: { status: "started", target: "local" } });
+    }
+    return c.json({ error: "Unsupported deploy target: " + targetType + ". Supported: fly, docker, vps, local" }, 400);
+  });
+  api.get("/agents/:id/deploy", requireRole("admin"), async (c) => {
+    const agent = await db.getAgent(c.req.param("id"));
+    if (!agent) return c.json({ error: "Agent not found" }, 404);
+    const meta = agent.metadata || {};
+    const info = meta.deployment;
+    if (!info) return c.json({ deployed: false });
+    if (info.target === "fly" && info.appName) {
+      const flyToken = process.env.FLY_API_TOKEN;
+      if (flyToken) {
+        try {
+          const status = await getAppStatus(info.appName, { apiToken: flyToken });
+          return c.json({ deployed: true, ...info, live: status });
+        } catch {
+        }
+      }
+    }
+    return c.json({ deployed: true, ...info });
+  });
+  api.delete("/agents/:id/deploy", requireRole("admin"), async (c) => {
+    const agent = await db.getAgent(c.req.param("id"));
+    if (!agent) return c.json({ error: "Agent not found" }, 404);
+    const meta = agent.metadata || {};
+    const info = meta.deployment;
+    if (!info) return c.json({ error: "Agent not deployed" }, 400);
+    if (info.target === "fly" && info.appName) {
+      const flyToken = process.env.FLY_API_TOKEN;
+      if (flyToken) {
+        try {
+          await destroyApp(info.appName, { apiToken: flyToken });
+        } catch (err) {
+          return c.json({ error: "Failed to destroy: " + err.message }, 500);
+        }
+      }
+    }
+    delete meta.deployment;
+    await db.updateAgent(c.req.param("id"), { status: "inactive", metadata: meta });
+    return c.json({ ok: true, message: "Deployment destroyed" });
+  });
+  api.get("/users", requireRole("admin"), async (c) => {
+    const limit = Math.min(parseInt(c.req.query("limit") || "50"), 200);
+    const offset = Math.max(parseInt(c.req.query("offset") || "0"), 0);
+    const users = await db.listUsers({ limit, offset });
+    const safe = users.map(({ passwordHash, totpSecret, totpBackupCodes, ...u }) => u);
+    return c.json({ users: safe, limit, offset });
+  });
+  api.post("/users", requireRole("admin"), async (c) => {
+    const body = await c.req.json();
+    validate(body, [
+      { field: "email", type: "email", required: true },
+      { field: "name", type: "string", required: true, minLength: 1, maxLength: 128 },
+      { field: "role", type: "string", required: true, pattern: /^(owner|admin|member|viewer)$/ },
+      { field: "password", type: "string", minLength: 8, maxLength: 128 }
+    ]);
+    const existing = await db.getUserByEmail(body.email);
+    if (existing) return c.json({ error: "Email already registered" }, 409);
+    const user = await db.createUser(body);
+    const { passwordHash, ...safe } = user;
+    return c.json(safe, 201);
+  });
+  api.patch("/users/:id", requireRole("admin"), async (c) => {
+    const existing = await db.getUser(c.req.param("id"));
+    if (!existing) return c.json({ error: "User not found" }, 404);
+    const body = await c.req.json();
+    validate(body, [
+      { field: "email", type: "email" },
+      { field: "name", type: "string", minLength: 1, maxLength: 128 },
+      { field: "role", type: "string", pattern: /^(owner|admin|member|viewer)$/ }
+    ]);
+    const user = await db.updateUser(c.req.param("id"), body);
+    const { passwordHash, ...safe } = user;
+    return c.json(safe);
+  });
+  api.post("/users/:id/reset-password", requireRole("admin"), async (c) => {
+    const existing = await db.getUser(c.req.param("id"));
+    if (!existing) return c.json({ error: "User not found" }, 404);
+    const body = await c.req.json();
+    const newPassword = body.password;
+    if (!newPassword || typeof newPassword !== "string" || newPassword.length < 8) {
+      return c.json({ error: "Password must be at least 8 characters" }, 400);
+    }
+    const { default: bcrypt } = await import("bcryptjs");
+    const passwordHash = await bcrypt.hash(newPassword, 12);
+    await db.pool.query(
+      "UPDATE users SET password_hash = $1, updated_at = NOW() WHERE id = $2",
+      [passwordHash, c.req.param("id")]
+    );
+    await db.logEvent({
+      actor: c.get("userId") || "system",
+      actorType: "user",
+      action: "user.password_reset",
+      resource: `user:${c.req.param("id")}`,
+      details: { targetEmail: existing.email, resetBy: "admin" },
+      ip: c.req.header("x-forwarded-for")?.split(",")[0]?.trim() || c.req.header("x-real-ip")
+    }).catch(() => {
+    });
+    return c.json({ ok: true, message: "Password reset successfully" });
+  });
+  api.delete("/users/:id", requireRole("owner"), async (c) => {
+    const existing = await db.getUser(c.req.param("id"));
+    if (!existing) return c.json({ error: "User not found" }, 404);
+    const requesterId = c.get("userId");
+    if (requesterId === c.req.param("id")) {
+      return c.json({ error: "Cannot delete your own account" }, 400);
+    }
+    await db.deleteUser(c.req.param("id"));
+    return c.json({ ok: true });
+  });
+  api.get("/platform-capabilities", requireRole("admin"), async (c) => {
+    const os = await import("os");
+    const settings = await db.getSettings();
+    return c.json({ capabilities: settings?.platformCapabilities || {}, serverOS: os.platform() });
+  });
+  api.put("/platform-capabilities", requireRole("owner"), async (c) => {
+    const body = await c.req.json();
+    const userId = c.get("userId") || "system";
+    const capabilities = {
+      localSystemAccess: !!body.localSystemAccess,
+      telegram: !!body.telegram,
+      whatsapp: !!body.whatsapp,
+      enabledAt: (/* @__PURE__ */ new Date()).toISOString(),
+      enabledBy: userId
+    };
+    await updateSettingsAndEmit({ platformCapabilities: capabilities });
+    for (const [cap, enabled] of Object.entries(body)) {
+      if (cap === "enabledAt" || cap === "enabledBy") continue;
+      configBus.emitCapability(cap, !!enabled);
+    }
+    await db.logEvent({
+      actor: userId,
+      actorType: "user",
+      action: "platform.capabilities_updated",
+      resource: "company_settings",
+      details: capabilities,
+      ip: c.req.header("x-forwarded-for")?.split(",")[0]?.trim() || c.req.header("x-real-ip")
+    }).catch(() => {
+    });
+    return c.json({ ok: true, capabilities });
+  });
+  api.get("/whatsapp/qr/:agentId", requireRole("admin"), async (c) => {
+    try {
+      var { getWhatsAppQR, isWhatsAppConnected } = await import("./whatsapp-NATGQVO5.js");
+      var agentId = c.req.param("agentId");
+      if (isWhatsAppConnected(agentId)) {
+        return c.json({ status: "connected" });
+      }
+      var qr = getWhatsAppQR(agentId);
+      if (qr) {
+        return c.json({ status: "awaiting_scan", qr });
+      }
+      return c.json({ status: "not_initialized", message: "Agent has not started WhatsApp connection yet." });
+    } catch (err) {
+      return c.json({ error: err.message }, 500);
+    }
+  });
+  api.get("/audit", requireRole("admin"), async (c) => {
+    const filters = {
+      actor: c.req.query("actor") || void 0,
+      action: c.req.query("action") || void 0,
+      resource: c.req.query("resource") || void 0,
+      from: c.req.query("from") ? new Date(c.req.query("from")) : void 0,
+      to: c.req.query("to") ? new Date(c.req.query("to")) : void 0,
+      limit: Math.min(parseInt(c.req.query("limit") || "50"), 500),
+      offset: Math.max(parseInt(c.req.query("offset") || "0"), 0)
+    };
+    if (filters.from && isNaN(filters.from.getTime())) {
+      return c.json({ error: 'Invalid "from" date' }, 400);
+    }
+    if (filters.to && isNaN(filters.to.getTime())) {
+      return c.json({ error: 'Invalid "to" date' }, 400);
+    }
+    const result = await db.queryAudit(filters);
+    return c.json(result);
+  });
+  api.get("/api-keys", requireRole("admin"), async (c) => {
+    const keys = await db.listApiKeys();
+    const safe = keys.map(({ keyHash, ...k }) => k);
+    return c.json({ keys: safe });
+  });
+  api.post("/api-keys", requireRole("admin"), async (c) => {
+    const body = await c.req.json();
+    validate(body, [
+      { field: "name", type: "string", required: true, minLength: 1, maxLength: 64 }
+    ]);
+    const userId = c.get("userId") || "system";
+    const scopes = Array.isArray(body.scopes) ? body.scopes : ["*"];
+    const expiresAt = body.expiresAt ? new Date(body.expiresAt) : void 0;
+    const { key, plaintext } = await db.createApiKey({
+      name: body.name,
+      scopes,
+      createdBy: userId,
+      expiresAt
+    });
+    const { keyHash, ...safeKey } = key;
+    return c.json({
+      key: safeKey,
+      plaintext,
+      warning: "Store this key securely. It will not be shown again."
+    }, 201);
+  });
+  api.delete("/api-keys/:id", requireRole("admin"), async (c) => {
+    const existing = await db.getApiKey(c.req.param("id"));
+    if (!existing) return c.json({ error: "API key not found" }, 404);
+    await db.revokeApiKey(c.req.param("id"));
+    return c.json({ ok: true, revoked: true });
+  });
+  api.get("/rules", async (c) => {
+    const agentId = c.req.query("agentId") || void 0;
+    const rules = await db.getRules(agentId);
+    return c.json({ rules });
+  });
+  api.post("/rules", async (c) => {
+    const body = await c.req.json();
+    validate(body, [
+      { field: "name", type: "string", required: true, minLength: 1, maxLength: 128 }
+    ]);
+    if (body.conditions && typeof body.conditions !== "object") {
+      return c.json({ error: "conditions must be an object" }, 400);
+    }
+    if (body.actions && typeof body.actions !== "object") {
+      return c.json({ error: "actions must be an object" }, 400);
+    }
+    const rule = await db.createRule({
+      name: body.name,
+      agentId: body.agentId,
+      conditions: body.conditions || {},
+      actions: body.actions || {},
+      priority: body.priority ?? 0,
+      enabled: body.enabled ?? true
+    });
+    return c.json(rule, 201);
+  });
+  api.patch("/rules/:id", async (c) => {
+    const body = await c.req.json();
+    const rule = await db.updateRule(c.req.param("id"), body);
+    return c.json(rule);
+  });
+  api.delete("/rules/:id", async (c) => {
+    await db.deleteRule(c.req.param("id"));
+    return c.json({ ok: true });
+  });
+  api.get("/settings", async (c) => {
+    const settings = await db.getSettings();
+    if (!settings) return c.json({ error: "Not configured" }, 404);
+    const safe = { ...settings };
+    if (safe.smtpPass) safe.smtpPass = "***";
+    if (safe.dkimPrivateKey) safe.dkimPrivateKey = "***";
+    if (safe.ssoConfig?.oidc?.clientSecret) {
+      safe.ssoConfig = { ...safe.ssoConfig, oidc: { ...safe.ssoConfig.oidc, clientSecret: "***" } };
+    }
+    return c.json(safe);
+  });
+  api.patch("/settings", requireRole("admin"), async (c) => {
+    const body = await c.req.json();
+    validate(body, [
+      { field: "name", type: "string", minLength: 1, maxLength: 128 },
+      { field: "domain", type: "string", maxLength: 253 },
+      { field: "subdomain", type: "string", maxLength: 64 },
+      { field: "primaryColor", type: "string", pattern: /^#[0-9a-fA-F]{6}$/ },
+      { field: "logoUrl", type: "url" },
+      { field: "smtpHost", type: "string", maxLength: 253 },
+      { field: "smtpPort", type: "number" },
+      { field: "smtpUser", type: "string", maxLength: 253 },
+      { field: "smtpPass", type: "string", maxLength: 253 },
+      { field: "dkimPrivateKey", type: "string" },
+      { field: "cfApiToken", type: "string", maxLength: 500 },
+      { field: "cfAccountId", type: "string", maxLength: 100 },
+      { field: "plan", type: "string", maxLength: 32 },
+      { field: "signatureTemplate", type: "string", maxLength: 1e4 },
+      { field: "branding", type: "object" }
+    ]);
+    const settings = await updateSettingsAndEmit(body);
+    return c.json(settings);
+  });
+  api.post("/settings/branding", requireRole("admin"), async (c) => {
+    const body = await c.req.json();
+    const { type, data, filename } = body;
+    if (!type || !data) return c.json({ error: "type and data are required" }, 400);
+    if (!["logo", "favicon", "login_bg", "login_logo"].includes(type)) return c.json({ error: "Invalid type" }, 400);
+    const os = await import("os");
+    const fs = await import("fs");
+    const path = await import("path");
+    const brandDir = path.join(os.homedir(), ".agenticmail", "branding");
+    if (!fs.existsSync(brandDir)) fs.mkdirSync(brandDir, { recursive: true });
+    const base64 = data.replace(/^data:[^;]+;base64,/, "");
+    const buffer = Buffer.from(base64, "base64");
+    const ext = filename ? path.extname(filename).toLowerCase() : ".png";
+    const validExts = [".png", ".jpg", ".jpeg", ".svg", ".ico", ".gif", ".webp"];
+    if (!validExts.includes(ext)) return c.json({ error: "Invalid file type. Supported: " + validExts.join(", ") }, 400);
+    const savedName = type + ext;
+    fs.writeFileSync(path.join(brandDir, savedName), buffer);
+    if (type === "logo" || type === "favicon") {
+      try {
+        const sharp = (await import("sharp")).default;
+        const sizes = [16, 32, 48, 64, 180, 192, 512];
+        for (const size of sizes) {
+          await sharp(buffer).resize(size, size, { fit: "contain", background: { r: 0, g: 0, b: 0, alpha: 0 } }).png().toFile(path.join(brandDir, `icon-${size}.png`));
+        }
+        await sharp(buffer).resize(32, 32, { fit: "contain", background: { r: 0, g: 0, b: 0, alpha: 0 } }).png().toFile(path.join(brandDir, "favicon.png"));
+        await sharp(buffer).resize(180, 180, { fit: "contain", background: { r: 0, g: 0, b: 0, alpha: 0 } }).png().toFile(path.join(brandDir, "apple-touch-icon.png"));
+      } catch (e) {
+        console.warn("[branding] Sharp not available, skipping icon generation:", e.message);
+      }
+    }
+    const settings = await db.getSettings();
+    const branding = settings?.branding || {};
+    const v = Date.now();
+    branding[type] = `/branding/${savedName}?v=${v}`;
+    if (type === "logo" || type === "favicon") {
+      branding.favicon = `/branding/favicon.png?v=${v}`;
+      branding.appleTouchIcon = `/branding/apple-touch-icon.png?v=${v}`;
+      branding.icon192 = `/branding/icon-192.png?v=${v}`;
+      branding.icon512 = `/branding/icon-512.png?v=${v}`;
+    }
+    await updateSettingsAndEmit({ branding });
+    return c.json({ success: true, branding, message: "Branding assets saved. Refresh to see changes." });
+  });
+  api.delete("/settings/branding/:type", requireRole("admin"), async (c) => {
+    const type = c.req.param("type");
+    if (!["logo", "favicon", "login_bg", "login_logo"].includes(type)) return c.json({ error: "Invalid type" }, 400);
+    const settings = await db.getSettings();
+    const branding = settings?.branding || {};
+    delete branding[type];
+    if (type === "logo") {
+      delete branding.favicon;
+      delete branding.appleTouchIcon;
+      delete branding.icon192;
+      delete branding.icon512;
+    }
+    await updateSettingsAndEmit({ branding });
+    return c.json({ success: true, branding });
+  });
+  api.get("/settings/sso", requireRole("admin"), async (c) => {
+    const settings = await db.getSettings();
+    if (!settings) return c.json({ ssoConfig: null });
+    const sso = settings.ssoConfig || {};
+    const safe = { ...sso };
+    if (safe.oidc?.clientSecret) {
+      safe.oidc = { ...safe.oidc, clientSecret: "***" };
+    }
+    if (safe.saml?.certificate) {
+      const cert = safe.saml.certificate;
+      safe.saml = {
+        ...safe.saml,
+        certificate: cert.length > 50 ? cert.substring(0, 20) + "..." + cert.substring(cert.length - 20) : cert,
+        certificateConfigured: true
+      };
+    }
+    return c.json({ ssoConfig: safe });
+  });
+  api.put("/settings/sso/saml", requireRole("admin"), async (c) => {
+    const body = await c.req.json();
+    validate(body, [
+      { field: "entityId", type: "string", required: true, minLength: 1, maxLength: 512 },
+      { field: "ssoUrl", type: "url", required: true },
+      { field: "certificate", type: "string", required: true, minLength: 10 }
+    ]);
+    const settings = await db.getSettings();
+    const current = settings?.ssoConfig || {};
+    const ssoConfig = {
+      ...current,
+      saml: {
+        entityId: body.entityId,
+        ssoUrl: body.ssoUrl,
+        certificate: body.certificate,
+        signatureAlgorithm: body.signatureAlgorithm || "RSA-SHA256",
+        autoProvision: body.autoProvision ?? true,
+        defaultRole: body.defaultRole || "member",
+        allowedDomains: body.allowedDomains || []
+      }
+    };
+    await updateSettingsAndEmit({ ssoConfig });
+    return c.json({ ok: true, provider: "saml", configured: true });
+  });
+  api.put("/settings/sso/oidc", requireRole("admin"), async (c) => {
+    const body = await c.req.json();
+    validate(body, [
+      { field: "clientId", type: "string", required: true, minLength: 1, maxLength: 256 },
+      { field: "clientSecret", type: "string", required: true, minLength: 1, maxLength: 512 },
+      { field: "discoveryUrl", type: "url", required: true }
+    ]);
+    const settings = await db.getSettings();
+    const current = settings?.ssoConfig || {};
+    let clientSecret = body.clientSecret;
+    if (clientSecret === "***" && current.oidc?.clientSecret) {
+      clientSecret = current.oidc.clientSecret;
+    }
+    const ssoConfig = {
+      ...current,
+      oidc: {
+        clientId: body.clientId,
+        clientSecret,
+        discoveryUrl: body.discoveryUrl,
+        scopes: body.scopes || ["openid", "email", "profile"],
+        autoProvision: body.autoProvision ?? true,
+        defaultRole: body.defaultRole || "member",
+        allowedDomains: body.allowedDomains || []
+      }
+    };
+    await updateSettingsAndEmit({ ssoConfig });
+    return c.json({ ok: true, provider: "oidc", configured: true });
+  });
+  api.delete("/settings/sso/:provider", requireRole("admin"), async (c) => {
+    const provider = c.req.param("provider");
+    if (provider !== "saml" && provider !== "oidc") {
+      return c.json({ error: 'Invalid provider. Use "saml" or "oidc".' }, 400);
+    }
+    const settings = await db.getSettings();
+    const current = settings?.ssoConfig || {};
+    const ssoConfig = { ...current };
+    delete ssoConfig[provider];
+    await updateSettingsAndEmit({ ssoConfig });
+    return c.json({ ok: true, provider, removed: true });
+  });
+  api.post("/settings/sso/oidc/test", requireRole("admin"), async (c) => {
+    const { discoveryUrl } = await c.req.json();
+    if (!discoveryUrl) return c.json({ error: "discoveryUrl required" }, 400);
+    try {
+      const res = await fetch(discoveryUrl);
+      if (!res.ok) return c.json({ ok: false, error: `HTTP ${res.status}` });
+      const doc = await res.json();
+      return c.json({
+        ok: true,
+        issuer: doc.issuer,
+        hasAuthorizationEndpoint: !!doc.authorization_endpoint,
+        hasTokenEndpoint: !!doc.token_endpoint,
+        hasUserinfoEndpoint: !!doc.userinfo_endpoint,
+        hasJwksUri: !!doc.jwks_uri,
+        supportedScopes: doc.scopes_supported
+      });
+    } catch (e) {
+      return c.json({ ok: false, error: e.message });
+    }
+  });
+  api.get("/settings/org-email", requireRole("admin"), async (c) => {
+    const settings = await db.getSettings();
+    const cfg = settings?.orgEmailConfig;
+    if (!cfg) return c.json({ configured: false });
+    return c.json({
+      configured: cfg.configured || false,
+      provider: cfg.provider,
+      label: cfg.label,
+      oauthClientId: cfg.oauthClientId,
+      oauthTenantId: cfg.oauthTenantId
+    });
+  });
+  api.put("/settings/org-email", requireRole("admin"), async (c) => {
+    const body = await c.req.json();
+    const { provider, oauthClientId, oauthClientSecret, oauthTenantId } = body;
+    if (!provider || !["google", "microsoft"].includes(provider)) {
+      return c.json({ error: 'provider must be "google" or "microsoft"' }, 400);
+    }
+    if (!oauthClientId || !oauthClientSecret) {
+      return c.json({ error: "oauthClientId and oauthClientSecret are required" }, 400);
+    }
+    const label = provider === "google" ? "Google Workspace" : "Microsoft 365";
+    const orgEmailConfig = {
+      provider,
+      oauthClientId,
+      oauthClientSecret,
+      oauthTenantId: provider === "microsoft" ? oauthTenantId || "common" : void 0,
+      oauthRedirectUri: "",
+      // Will be set per-agent at OAuth time
+      configured: true,
+      label
+    };
+    await updateSettingsAndEmit({ orgEmailConfig });
+    return c.json({ success: true, orgEmailConfig: { configured: true, provider, label, oauthClientId, oauthTenantId: orgEmailConfig.oauthTenantId } });
+  });
+  api.delete("/settings/org-email", requireRole("admin"), async (c) => {
+    await updateSettingsAndEmit({ orgEmailConfig: null });
+    return c.json({ success: true });
+  });
+  api.get("/settings/tool-security", requireRole("admin"), async (c) => {
+    const settings = await db.getSettings();
+    return c.json({ toolSecurityConfig: settings?.toolSecurityConfig || {} });
+  });
+  api.put("/settings/tool-security", requireRole("admin"), async (c) => {
+    const body = await c.req.json();
+    if (body && typeof body !== "object") {
+      return c.json({ error: "Body must be a JSON object" }, 400);
+    }
+    await updateSettingsAndEmit({ toolSecurityConfig: body });
+    const settings = await db.getSettings();
+    return c.json({ toolSecurityConfig: settings?.toolSecurityConfig || {} });
+  });
+  api.get("/settings/firewall", requireRole("admin"), async (c) => {
+    const settings = await db.getSettings();
+    return c.json({ firewallConfig: settings?.firewallConfig || {} });
+  });
+  api.put("/settings/firewall", requireRole("admin"), async (c) => {
+    const body = await c.req.json();
+    if (body && typeof body !== "object") {
+      return c.json({ error: "Body must be a JSON object" }, 400);
+    }
+    if (body.ipAccess?.mode && !["allowlist", "blocklist"].includes(body.ipAccess.mode)) {
+      return c.json({ error: 'ipAccess.mode must be "allowlist" or "blocklist"' }, 400);
+    }
+    if (body.egress?.mode && !["allowlist", "blocklist"].includes(body.egress.mode)) {
+      return c.json({ error: 'egress.mode must be "allowlist" or "blocklist"' }, 400);
+    }
+    const { isValidIpOrCidr } = await import("./cidr-LISVZSM2.js");
+    for (const entry of body.ipAccess?.allowlist || []) {
+      if (!isValidIpOrCidr(entry)) return c.json({ error: "Invalid IP/CIDR in allowlist: " + entry }, 400);
+    }
+    for (const entry of body.ipAccess?.blocklist || []) {
+      if (!isValidIpOrCidr(entry)) return c.json({ error: "Invalid IP/CIDR in blocklist: " + entry }, 400);
+    }
+    for (const entry of body.trustedProxies?.ips || []) {
+      if (!isValidIpOrCidr(entry)) return c.json({ error: "Invalid IP/CIDR in trusted proxies: " + entry }, 400);
+    }
+    if (body.ipAccess?.enabled && body.ipAccess?.mode === "allowlist" && body.ipAccess?.allowlist?.length > 0) {
+      const clientIp = c.req.header("x-forwarded-for")?.split(",")[0]?.trim() || c.req.header("x-real-ip") || "";
+      if (clientIp && clientIp !== "unknown") {
+        const { compileIpMatcher: compileIpMatcher2 } = await import("./cidr-LISVZSM2.js");
+        const matcher = compileIpMatcher2(body.ipAccess.allowlist);
+        if (!matcher(clientIp)) {
+          return c.json({ error: "Your current IP (" + clientIp + ") is not in the allowlist. Add it first to avoid lockout." }, 400);
+        }
+      }
+    }
+    await updateSettingsAndEmit({ firewallConfig: body });
+    try {
+      const { invalidateNetworkConfig: invalidateNetworkConfig2 } = await import("./network-config-IJ2XYW2B.js");
+      await invalidateNetworkConfig2();
+    } catch {
+    }
+    const settings = await db.getSettings();
+    return c.json({ firewallConfig: settings?.firewallConfig || {} });
+  });
+  api.post("/settings/firewall/test-ip", requireRole("admin"), async (c) => {
+    const { ip } = await c.req.json();
+    if (!ip) return c.json({ error: "ip is required" }, 400);
+    const { isValidIpOrCidr, compileIpMatcher: compileIpMatcher2 } = await import("./cidr-LISVZSM2.js");
+    if (!isValidIpOrCidr(ip)) return c.json({ error: "Invalid IP address" }, 400);
+    const settings = await db.getSettings();
+    const ipAccess = settings?.firewallConfig?.ipAccess;
+    if (!ipAccess?.enabled) {
+      return c.json({ ip, allowed: true, reason: "IP access control is disabled" });
+    }
+    if (ipAccess.mode === "allowlist") {
+      const matcher = compileIpMatcher2(ipAccess.allowlist || []);
+      const allowed = matcher(ip);
+      return c.json({ ip, allowed, reason: allowed ? "IP matches allowlist" : "IP not in allowlist" });
+    } else {
+      const matcher = compileIpMatcher2(ipAccess.blocklist || []);
+      const blocked = matcher(ip);
+      return c.json({ ip, allowed: !blocked, reason: blocked ? "IP matches blocklist" : "IP not in blocklist" });
+    }
+  });
+  api.get("/settings/model-pricing", requireRole("admin"), async (c) => {
+    const settings = await db.getSettings();
+    var config = settings?.modelPricingConfig || { models: [], currency: "USD" };
+    if (!config.models || config.models.length === 0) {
+      config.models = getDefaultModelPricing();
+    }
+    return c.json({ modelPricingConfig: config });
+  });
+  api.put("/settings/model-pricing", requireRole("admin"), async (c) => {
+    const body = await c.req.json();
+    if (!body || typeof body !== "object") {
+      return c.json({ error: "Body must be a JSON object" }, 400);
+    }
+    if (body.models && Array.isArray(body.models)) {
+      for (const m of body.models) {
+        if (!m.provider || !m.modelId) {
+          return c.json({ error: "Each model must have provider and modelId" }, 400);
+        }
+        if (typeof m.inputCostPerMillion !== "number" || m.inputCostPerMillion < 0) {
+          return c.json({ error: `Invalid inputCostPerMillion for ${m.modelId}` }, 400);
+        }
+        if (typeof m.outputCostPerMillion !== "number" || m.outputCostPerMillion < 0) {
+          return c.json({ error: `Invalid outputCostPerMillion for ${m.modelId}` }, 400);
+        }
+      }
+    }
+    body.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+    await updateSettingsAndEmit({ modelPricingConfig: body });
+    const settings = await db.getSettings();
+    return c.json({ modelPricingConfig: settings?.modelPricingConfig || {} });
+  });
+  api.get("/providers", requireRole("admin"), async (c) => {
+    var settings = await db.getSettings();
+    var pricingConfig = settings?.modelPricingConfig;
+    var savedApiKeys = pricingConfig?.providerApiKeys || {};
+    var builtIn = Object.values(PROVIDER_REGISTRY).map(function(p) {
+      var configured = !p.requiresApiKey || !!savedApiKeys[p.id];
+      return {
+        id: p.id,
+        name: p.name,
+        baseUrl: p.baseUrl,
+        apiType: p.apiType,
+        isLocal: p.isLocal,
+        requiresApiKey: p.requiresApiKey,
+        configured,
+        source: "built-in",
+        defaultModels: p.defaultModels || []
+      };
+    });
+    var customProviders = pricingConfig?.customProviders || [];
+    var custom = customProviders.map(function(p) {
+      return { ...p, configured: true, source: "custom" };
+    });
+    return c.json({ providers: [...builtIn, ...custom] });
+  });
+  api.post("/providers", requireRole("admin"), async (c) => {
+    var body = await c.req.json();
+    if (!body.id || !body.name || !body.baseUrl || !body.apiType) {
+      return c.json({ error: "id, name, baseUrl, and apiType are required" }, 400);
+    }
+    if (PROVIDER_REGISTRY[body.id]) {
+      return c.json({ error: "Cannot override built-in provider" }, 409);
+    }
+    var validTypes = ["anthropic", "openai-compatible", "google", "ollama"];
+    if (!validTypes.includes(body.apiType)) {
+      return c.json({ error: "apiType must be one of: " + validTypes.join(", ") }, 400);
+    }
+    var settings = await db.getSettings();
+    var config = settings?.modelPricingConfig || { models: [], currency: "USD" };
+    config.customProviders = config.customProviders || [];
+    if (config.customProviders.find(function(p) {
+      return p.id === body.id;
+    })) {
+      return c.json({ error: "Custom provider with this ID already exists" }, 409);
+    }
+    config.customProviders.push({
+      id: body.id,
+      name: body.name,
+      baseUrl: body.baseUrl,
+      apiType: body.apiType,
+      apiKeyEnvVar: body.apiKeyEnvVar || "",
+      headers: body.headers || {},
+      models: body.models || []
+    });
+    await updateSettingsAndEmit({ modelPricingConfig: config });
+    return c.json({ ok: true, provider: body });
+  });
+  api.post("/providers/:id/api-key", requireRole("admin"), async (c) => {
+    var id = c.req.param("id");
+    var provider = PROVIDER_REGISTRY[id];
+    if (!provider) {
+      return c.json({ error: "Unknown provider" }, 404);
+    }
+    var body = await c.req.json();
+    var apiKey = body.apiKey?.trim();
+    if (!apiKey || typeof apiKey !== "string" || apiKey.length < 5) {
+      return c.json({ error: "Valid API key required" }, 400);
+    }
+    var skipValidation = body.skipValidation === true;
+    if (!skipValidation) {
+      try {
+        var valid = await validateProviderApiKey(id, apiKey, provider);
+        if (!valid.ok) {
+          return c.json({ error: "API key validation failed: " + valid.error, validationFailed: true }, 400);
+        }
+      } catch (e) {
+        return c.json({ error: "API key validation failed: " + (e.message || "Unknown error"), validationFailed: true }, 400);
+      }
+    }
+    var settings = await db.getSettings();
+    var config = settings?.modelPricingConfig || { models: [], currency: "USD" };
+    config.providerApiKeys = config.providerApiKeys || {};
+    config.providerApiKeys[id] = vault.encrypt(apiKey);
+    await updateSettingsAndEmit({ modelPricingConfig: config });
+    return c.json({ ok: true, message: "API key saved for " + provider.name, validated: !skipValidation });
+  });
+  api.put("/providers/:id", requireRole("admin"), async (c) => {
+    var id = c.req.param("id");
+    if (PROVIDER_REGISTRY[id]) {
+      return c.json({ error: "Cannot modify built-in provider" }, 400);
+    }
+    var body = await c.req.json();
+    var settings = await db.getSettings();
+    var config = settings?.modelPricingConfig || { models: [], currency: "USD" };
+    config.customProviders = config.customProviders || [];
+    var idx = config.customProviders.findIndex(function(p) {
+      return p.id === id;
+    });
+    if (idx === -1) {
+      return c.json({ error: "Custom provider not found" }, 404);
+    }
+    config.customProviders[idx] = Object.assign({}, config.customProviders[idx], body, { id });
+    await updateSettingsAndEmit({ modelPricingConfig: config });
+    return c.json({ ok: true, provider: config.customProviders[idx] });
+  });
+  api.delete("/providers/:id", requireRole("admin"), async (c) => {
+    var id = c.req.param("id");
+    if (PROVIDER_REGISTRY[id]) {
+      return c.json({ error: "Cannot delete built-in provider" }, 400);
+    }
+    var settings = await db.getSettings();
+    var config = settings?.modelPricingConfig || { models: [], currency: "USD" };
+    config.customProviders = config.customProviders || [];
+    var before = config.customProviders.length;
+    config.customProviders = config.customProviders.filter(function(p) {
+      return p.id !== id;
+    });
+    if (config.customProviders.length === before) {
+      return c.json({ error: "Custom provider not found" }, 404);
+    }
+    await updateSettingsAndEmit({ modelPricingConfig: config });
+    return c.json({ ok: true });
+  });
+  api.get("/providers/:id/models", requireRole("admin"), async (c) => {
+    var id = c.req.param("id");
+    var provider = PROVIDER_REGISTRY[id];
+    if (id === "ollama" || provider && provider.apiType === "ollama") {
+      var ollamaHost = process.env.OLLAMA_HOST || (provider ? provider.baseUrl : "http://localhost:11434");
+      try {
+        var resp = await fetch(ollamaHost + "/api/tags");
+        var data = await resp.json();
+        return c.json({ models: (data.models || []).map(function(m) {
+          return { id: m.name, name: m.name, size: m.size };
+        }) });
+      } catch (err) {
+        return c.json({ error: "Cannot connect to Ollama: " + err.message }, 502);
+      }
+    }
+    if (provider && provider.isLocal && provider.apiType === "openai-compatible") {
+      try {
+        var resp = await fetch(provider.baseUrl + "/models");
+        var data = await resp.json();
+        return c.json({ models: (data.data || []).map(function(m) {
+          return { id: m.id, name: m.id };
+        }) });
+      } catch (err) {
+        return c.json({ error: "Cannot connect to " + provider.name + ": " + err.message }, 502);
+      }
+    }
+    if (provider && provider.defaultModels) {
+      return c.json({ models: provider.defaultModels.map(function(mid) {
+        return { id: mid, name: mid };
+      }) });
+    }
+    var settings = await db.getSettings();
+    var pricingConfig = settings?.modelPricingConfig;
+    var customProviders = pricingConfig?.customProviders || [];
+    var customProvider = customProviders.find(function(p) {
+      return p.id === id;
+    });
+    if (customProvider && customProvider.models) {
+      return c.json({ models: customProvider.models });
+    }
+    return c.json({ models: [] });
+  });
+  api.get("/retention", requireRole("admin"), async (c) => {
+    const policy = await db.getRetentionPolicy();
+    return c.json(policy);
+  });
+  api.put("/retention", requireRole("owner"), async (c) => {
+    const body = await c.req.json();
+    validate(body, [
+      { field: "enabled", type: "boolean", required: true },
+      { field: "retainDays", type: "number", required: true, min: 1, max: 3650 },
+      { field: "archiveFirst", type: "boolean" }
+    ]);
+    await db.setRetentionPolicy({
+      enabled: body.enabled,
+      retainDays: body.retainDays,
+      excludeTags: body.excludeTags || [],
+      archiveFirst: body.archiveFirst ?? true
+    });
+    return c.json({ ok: true });
+  });
+  api.get("/settings/security", requireRole("admin"), async (c) => {
+    try {
+      const settings = await db.getSettings();
+      const securityConfig = settings?.securityConfig || {};
+      return c.json({ securityConfig });
+    } catch (err) {
+      return c.json({ error: err.message }, 500);
+    }
+  });
+  api.put("/settings/security", requireRole("admin"), async (c) => {
+    try {
+      const body = await c.req.json();
+      const { securityConfig } = body;
+      if (!securityConfig || typeof securityConfig !== "object") {
+        return c.json({ error: "securityConfig is required and must be an object" }, 400);
+      }
+      await updateSettingsAndEmit({ securityConfig });
+      return c.json({ ok: true });
+    } catch (err) {
+      return c.json({ error: err.message }, 500);
+    }
+  });
+  api.get("/settings/security/events", requireRole("admin"), async (c) => {
+    try {
+      const query = c.req.query();
+      const filter = {
+        eventType: query.eventType ? query.eventType.split(",") : void 0,
+        severity: query.severity ? query.severity.split(",") : void 0,
+        agentId: query.agentId,
+        sourceIp: query.sourceIp,
+        fromDate: query.fromDate,
+        toDate: query.toDate,
+        limit: query.limit ? parseInt(query.limit) : 50,
+        offset: query.offset ? parseInt(query.offset) : 0
+      };
+      const events = await db.getSecurityEvents(filter);
+      return c.json({ events });
+    } catch (err) {
+      return c.json({ error: err.message }, 500);
+    }
+  });
+  api.get("/settings/security/port-scan", requireRole("admin"), async (c) => {
+    try {
+      const { scanPorts } = await import("./port-scanner-7IQVRFUW.js");
+      const result = await scanPorts();
+      return c.json({ scanResult: result });
+    } catch (err) {
+      return c.json({ error: err.message }, 500);
+    }
+  });
+  api.get("/agents/:id/security", requireRole("admin"), async (c) => {
+    try {
+      const agentId = c.req.param("id");
+      const agent = await db.getAgent(agentId);
+      if (!agent) {
+        return c.json({ error: "Agent not found" }, 404);
+      }
+      const securityOverrides = agent?.securityOverrides || {};
+      return c.json({ securityOverrides });
+    } catch (err) {
+      return c.json({ error: err.message }, 500);
+    }
+  });
+  api.put("/agents/:id/security", requireRole("admin"), async (c) => {
+    try {
+      const agentId = c.req.param("id");
+      const body = await c.req.json();
+      const { securityOverrides } = body;
+      const agent = await db.getAgent(agentId);
+      if (!agent) {
+        return c.json({ error: "Agent not found" }, 404);
+      }
+      await db.updateAgent(agentId, { securityOverrides });
+      return c.json({ ok: true });
+    } catch (err) {
+      return c.json({ error: err.message }, 500);
+    }
+  });
+  async function updateCorsOrigin(newOrigin, oldOrigin) {
+    try {
+      var settings = await db.getSettings();
+      var fw = settings.firewallConfig || {};
+      var net = fw.network || {};
+      var origins = Array.isArray(net.corsOrigins) ? [...net.corsOrigins] : [];
+      if (oldOrigin) origins = origins.filter((o) => o !== oldOrigin);
+      if (!origins.includes(newOrigin)) origins.push(newOrigin);
+      await updateSettingsAndEmit({ firewallConfig: { ...fw, network: { ...net, corsOrigins: origins } } });
+      try {
+        const { invalidateNetworkConfig: invalidateNetworkConfig2 } = await import("./network-config-IJ2XYW2B.js");
+        await invalidateNetworkConfig2();
+      } catch {
+      }
+    } catch {
+    }
+  }
+  api.get("/domain/cors", requireRole("admin"), async (c) => {
+    try {
+      var settings = await db.getSettings();
+      var origins = settings?.firewallConfig?.network?.corsOrigins || [];
+      return c.json({ origins });
+    } catch (err) {
+      return c.json({ error: err.message }, 500);
+    }
+  });
+  api.post("/domain/cors", requireRole("admin"), async (c) => {
+    var body = await c.req.json();
+    if (!Array.isArray(body.origins)) {
+      return c.json({ error: "origins must be an array of URLs" }, 400);
+    }
+    for (var o of body.origins) {
+      if (typeof o !== "string") return c.json({ error: "Each origin must be a string" }, 400);
+      if (o !== "*" && !o.startsWith("http://") && !o.startsWith("https://")) {
+        return c.json({ error: 'Origin "' + o + '" must start with http:// or https://' }, 400);
+      }
+    }
+    try {
+      var settings = await db.getSettings();
+      var fw = settings.firewallConfig || {};
+      var net = fw.network || {};
+      await updateSettingsAndEmit({ firewallConfig: { ...fw, network: { ...net, corsOrigins: body.origins } } });
+      try {
+        const { invalidateNetworkConfig: invalidateNetworkConfig2 } = await import("./network-config-IJ2XYW2B.js");
+        await invalidateNetworkConfig2();
+      } catch {
+      }
+      return c.json({ success: true, origins: body.origins });
+    } catch (err) {
+      return c.json({ error: err.message }, 500);
+    }
+  });
+  api.post("/domain/register", requireRole("admin"), async (c) => {
+    var body = await c.req.json();
+    if (!body.domain) {
+      return c.json({ error: "domain is required" }, 400);
+    }
+    var domain = String(body.domain).toLowerCase().trim();
+    if (!/^[a-zA-Z0-9][a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/.test(domain)) {
+      return c.json({ error: "Invalid domain format" }, 400);
+    }
+    try {
+      var { DomainLock } = await import("./domain-lock-Z5A74VJK.js");
+      var lock = new DomainLock();
+      var keyPair = await lock.generateDeploymentKey();
+      var settings = await db.getSettings();
+      var result = await lock.register(domain, keyPair.hash, {
+        orgName: settings?.name,
+        contactEmail: body.contactEmail
+      });
+      if (!result.success) {
+        return c.json({ error: result.error, statusCode: result.statusCode }, 400);
+      }
+      await updateSettingsAndEmit({
+        domain,
+        deploymentKeyHash: keyPair.hash,
+        domainRegistrationId: result.registrationId,
+        domainDnsChallenge: result.dnsChallenge,
+        domainRegisteredAt: (/* @__PURE__ */ new Date()).toISOString(),
+        domainStatus: "pending_dns"
+      });
+      return c.json({
+        deploymentKey: keyPair.plaintext,
+        dnsChallenge: result.dnsChallenge,
+        registrationId: result.registrationId
+      });
+    } catch (err) {
+      return c.json({ error: err.message || "Domain registration failed" }, 500);
+    }
+  });
+  api.post("/domain/verify", requireRole("admin"), async (c) => {
+    var body = await c.req.json();
+    if (!body.domain) {
+      return c.json({ error: "domain is required" }, 400);
+    }
+    var domain = String(body.domain).toLowerCase().trim();
+    try {
+      var { DomainLock } = await import("./domain-lock-Z5A74VJK.js");
+      var lock = new DomainLock();
+      var result = await lock.checkVerification(domain);
+      if (result.verified) {
+        await updateSettingsAndEmit({
+          domainStatus: "verified",
+          domainVerifiedAt: (/* @__PURE__ */ new Date()).toISOString()
+        });
+        return c.json({ verified: true });
+      }
+      return c.json({ verified: false, error: result.error });
+    } catch (err) {
+      return c.json({ error: err.message || "Verification check failed" }, 500);
+    }
+  });
+  api.get("/domain/status", requireRole("admin"), async (c) => {
+    try {
+      var settings = await db.getSettings();
+      return c.json({
+        domain: settings.domain || null,
+        subdomain: settings.subdomain || null,
+        status: settings.domainStatus || "unregistered",
+        registeredAt: settings.domainRegisteredAt || null,
+        verifiedAt: settings.domainVerifiedAt || null,
+        dnsChallenge: settings.domainDnsChallenge || null,
+        useRootDomain: settings.useRootDomain || false,
+        plan: settings.plan || "self-hosted"
+      });
+    } catch (err) {
+      return c.json({ error: err.message }, 500);
+    }
+  });
+  api.post("/domain/change", requireRole("admin"), async (c) => {
+    var body = await c.req.json();
+    if (!body.domain) {
+      return c.json({ error: "domain is required" }, 400);
+    }
+    var domain = String(body.domain).toLowerCase().trim();
+    if (!/^[a-zA-Z0-9][a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/.test(domain)) {
+      return c.json({ error: "Invalid domain format" }, 400);
+    }
+    try {
+      var { DomainLock } = await import("./domain-lock-Z5A74VJK.js");
+      var lock = new DomainLock();
+      var keyPair = await lock.generateDeploymentKey();
+      var settings = await db.getSettings();
+      var result = await lock.register(domain, keyPair.hash, {
+        orgName: settings?.name,
+        contactEmail: body.contactEmail
+      });
+      if (!result.success) {
+        return c.json({ error: result.error, statusCode: result.statusCode }, 400);
+      }
+      var oldDomain = settings.domain;
+      await updateSettingsAndEmit({
+        domain,
+        useRootDomain: body.useRootDomain || false,
+        deploymentKeyHash: keyPair.hash,
+        domainRegistrationId: result.registrationId,
+        domainDnsChallenge: result.dnsChallenge,
+        domainRegisteredAt: (/* @__PURE__ */ new Date()).toISOString(),
+        domainStatus: "pending_dns",
+        domainVerifiedAt: void 0
+      });
+      await updateCorsOrigin("https://" + domain, oldDomain ? "https://" + oldDomain : void 0);
+      return c.json({
+        success: true,
+        deploymentKey: keyPair.plaintext,
+        dnsChallenge: result.dnsChallenge,
+        registrationId: result.registrationId
+      });
+    } catch (err) {
+      return c.json({ error: err.message || "Domain change failed" }, 500);
+    }
+  });
+  api.post("/domain/subdomain", requireRole("admin"), async (c) => {
+    var body = await c.req.json();
+    if (!body.subdomain) {
+      return c.json({ error: "subdomain is required" }, 400);
+    }
+    var sub = String(body.subdomain).toLowerCase().trim().replace(/\.agenticmail\.io$/, "");
+    if (sub.length < 2) {
+      return c.json({ error: "Subdomain must be at least 2 characters." }, 400);
+    }
+    if (sub.length > 63) {
+      return c.json({ error: "Subdomain must be 63 characters or fewer." }, 400);
+    }
+    if (/^-|-$/.test(sub)) {
+      return c.json({ error: "Subdomain cannot start or end with a hyphen." }, 400);
+    }
+    if (!/^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/.test(sub)) {
+      return c.json({ error: "Subdomain can only contain lowercase letters, numbers, and hyphens." }, 400);
+    }
+    var reserved = ["www", "mail", "api", "app", "admin", "dashboard", "help", "support", "docs", "status", "blog", "cdn", "static", "assets", "ns1", "ns2"];
+    if (reserved.includes(sub)) {
+      return c.json({ error: '"' + sub + '" is a reserved subdomain. Please choose a different one.' }, 400);
+    }
+    try {
+      var settings = await db.getSettings();
+      var oldSub = settings.subdomain || null;
+      await updateSettingsAndEmit({ subdomain: sub });
+      await updateCorsOrigin(
+        "https://" + sub + ".agenticmail.io",
+        oldSub ? "https://" + oldSub + ".agenticmail.io" : void 0
+      );
+      return c.json({ success: true, subdomain: sub, oldSubdomain: oldSub, plan: settings.plan || "self-hosted" });
+    } catch (err) {
+      return c.json({ error: err.message || "Subdomain update failed" }, 500);
+    }
+  });
+  api.delete("/domain", requireRole("admin"), async (c) => {
+    try {
+      var settings = await db.getSettings();
+      var oldDomain = settings.domain;
+      await updateSettingsAndEmit({
+        domain: void 0,
+        domainStatus: void 0,
+        domainDnsChallenge: void 0,
+        domainRegisteredAt: void 0,
+        domainVerifiedAt: void 0,
+        domainRegistrationId: void 0,
+        deploymentKeyHash: void 0
+      });
+      if (oldDomain) {
+        try {
+          var fw = settings.firewallConfig || {};
+          var net = fw.network || {};
+          var origins = Array.isArray(net.corsOrigins) ? net.corsOrigins.filter((o) => o !== "https://" + oldDomain) : [];
+          await updateSettingsAndEmit({ firewallConfig: { ...fw, network: { ...net, corsOrigins: origins } } });
+          try {
+            const { invalidateNetworkConfig: invalidateNetworkConfig2 } = await import("./network-config-IJ2XYW2B.js");
+            await invalidateNetworkConfig2();
+          } catch {
+          }
+        } catch {
+        }
+      }
+      return c.json({ success: true });
+    } catch (err) {
+      return c.json({ error: err.message || "Failed to remove domain" }, 500);
+    }
+  });
+  function getDefaultModelPricing() {
+    return [
+      // Anthropic (Feb 2026 — 1M context window)
+      { provider: "anthropic", modelId: "claude-opus-4-6", displayName: "Claude Opus 4.6", inputCostPerMillion: 5, outputCostPerMillion: 25, contextWindow: 1e6 },
+      { provider: "anthropic", modelId: "claude-sonnet-4-6", displayName: "Claude Sonnet 4.6", inputCostPerMillion: 3, outputCostPerMillion: 15, contextWindow: 1e6 },
+      { provider: "anthropic", modelId: "claude-sonnet-4-5-20250929", displayName: "Claude Sonnet 4.5", inputCostPerMillion: 3, outputCostPerMillion: 15, contextWindow: 1e6 },
+      { provider: "anthropic", modelId: "claude-haiku-4-5-20251001", displayName: "Claude Haiku 4.5", inputCostPerMillion: 0.8, outputCostPerMillion: 4, contextWindow: 2e5 },
+      // OpenAI
+      { provider: "openai", modelId: "gpt-4o", displayName: "GPT-4o", inputCostPerMillion: 2.5, outputCostPerMillion: 10, contextWindow: 128e3 },
+      { provider: "openai", modelId: "gpt-4o-mini", displayName: "GPT-4o Mini", inputCostPerMillion: 0.15, outputCostPerMillion: 0.6, contextWindow: 128e3 },
+      { provider: "openai", modelId: "gpt-4.1", displayName: "GPT-4.1", inputCostPerMillion: 2, outputCostPerMillion: 8, contextWindow: 1e6 },
+      { provider: "openai", modelId: "gpt-4.1-mini", displayName: "GPT-4.1 Mini", inputCostPerMillion: 0.4, outputCostPerMillion: 1.6, contextWindow: 1e6 },
+      { provider: "openai", modelId: "gpt-4.1-nano", displayName: "GPT-4.1 Nano", inputCostPerMillion: 0.1, outputCostPerMillion: 0.4, contextWindow: 1e6 },
+      { provider: "openai", modelId: "o3", displayName: "o3", inputCostPerMillion: 10, outputCostPerMillion: 40, contextWindow: 2e5 },
+      { provider: "openai", modelId: "o4-mini", displayName: "o4-mini", inputCostPerMillion: 1.1, outputCostPerMillion: 4.4, contextWindow: 2e5 },
+      // Google Gemini (up to 2M context)
+      { provider: "google", modelId: "gemini-2.5-pro", displayName: "Gemini 2.5 Pro", inputCostPerMillion: 2.5, outputCostPerMillion: 15, contextWindow: 1e6 },
+      { provider: "google", modelId: "gemini-2.5-flash", displayName: "Gemini 2.5 Flash", inputCostPerMillion: 0.15, outputCostPerMillion: 0.6, contextWindow: 1e6 },
+      { provider: "google", modelId: "gemini-2.0-flash", displayName: "Gemini 2.0 Flash", inputCostPerMillion: 0.1, outputCostPerMillion: 0.4, contextWindow: 1e6 },
+      { provider: "google", modelId: "gemini-3-pro", displayName: "Gemini 3 Pro", inputCostPerMillion: 2.5, outputCostPerMillion: 15, contextWindow: 1e6 },
+      // DeepSeek (128K context)
+      { provider: "deepseek", modelId: "deepseek-chat", displayName: "DeepSeek Chat (V3)", inputCostPerMillion: 0.14, outputCostPerMillion: 0.28, contextWindow: 128e3 },
+      { provider: "deepseek", modelId: "deepseek-reasoner", displayName: "DeepSeek Reasoner (R1)", inputCostPerMillion: 0.55, outputCostPerMillion: 2.19, contextWindow: 128e3 },
+      // xAI Grok (2M context window)
+      { provider: "xai", modelId: "grok-4", displayName: "Grok 4", inputCostPerMillion: 3, outputCostPerMillion: 15, contextWindow: 2e6 },
+      { provider: "xai", modelId: "grok-4-fast", displayName: "Grok 4 Fast", inputCostPerMillion: 0.2, outputCostPerMillion: 0.5, contextWindow: 2e6 },
+      { provider: "xai", modelId: "grok-3", displayName: "Grok 3", inputCostPerMillion: 3, outputCostPerMillion: 15, contextWindow: 131072 },
+      { provider: "xai", modelId: "grok-3-mini", displayName: "Grok 3 Mini", inputCostPerMillion: 0.3, outputCostPerMillion: 0.5, contextWindow: 131072 },
+      // Mistral
+      { provider: "mistral", modelId: "mistral-large-latest", displayName: "Mistral Large", inputCostPerMillion: 2, outputCostPerMillion: 6, contextWindow: 128e3 },
+      { provider: "mistral", modelId: "mistral-small-latest", displayName: "Mistral Small", inputCostPerMillion: 0.1, outputCostPerMillion: 0.3, contextWindow: 128e3 },
+      // Groq (inference provider)
+      { provider: "groq", modelId: "llama-3.3-70b-versatile", displayName: "Llama 3.3 70B (Groq)", inputCostPerMillion: 0.59, outputCostPerMillion: 0.79, contextWindow: 128e3 },
+      // Together (inference provider)
+      { provider: "together", modelId: "meta-llama/Llama-3.3-70B-Instruct-Turbo", displayName: "Llama 3.3 70B (Together)", inputCostPerMillion: 0.88, outputCostPerMillion: 0.88, contextWindow: 128e3 }
+    ];
+  }
+  api.get("/tunnel/status", requireRole("admin"), async (c) => {
+    try {
+      const { execSync } = await import("child_process");
+      let installed = false;
+      let version = "";
+      let running = false;
+      let config = null;
+      try {
+        version = execSync("cloudflared --version 2>&1", { encoding: "utf8", timeout: 5e3 }).trim();
+        installed = true;
+      } catch {
+      }
+      try {
+        const pm2List = execSync("pm2 jlist 2>/dev/null", { encoding: "utf8", timeout: 5e3 });
+        const procs = JSON.parse(pm2List);
+        const cf = procs.find((p) => p.name === "cloudflared");
+        running = cf?.pm2_env?.status === "online";
+      } catch {
+      }
+      const os = await import("os");
+      const fs = await import("fs");
+      const path = await import("path");
+      const cfDir = path.join(os.default.homedir(), ".cloudflared");
+      const cfgPath = path.join(cfDir, "config.yml");
+      if (fs.existsSync(cfgPath)) {
+        const raw = fs.readFileSync(cfgPath, "utf8");
+        const tunnelMatch = raw.match(/^tunnel:\s*(.+)$/m);
+        const hostnameMatch = raw.match(/hostname:\s*(.+)$/m);
+        const serviceMatch = raw.match(/service:\s*(http.+)$/m);
+        config = {
+          tunnelId: tunnelMatch?.[1]?.trim(),
+          hostname: hostnameMatch?.[1]?.trim(),
+          service: serviceMatch?.[1]?.trim(),
+          raw
+        };
+      }
+      return c.json({ installed, version, running, config });
+    } catch (e) {
+      return c.json({ error: e.message }, 500);
+    }
+  });
+  api.post("/tunnel/install", requireRole("admin"), async (c) => {
+    try {
+      const { execSync } = await import("child_process");
+      const os = await import("os");
+      const platform = os.default.platform();
+      if (platform === "darwin") {
+        try {
+          execSync("which brew", { timeout: 3e3 });
+          execSync("brew install cloudflared 2>&1", { encoding: "utf8", timeout: 12e4 });
+        } catch {
+          const arch = os.default.arch() === "arm64" ? "arm64" : "amd64";
+          execSync(`curl -L -o /usr/local/bin/cloudflared https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-darwin-${arch} && chmod +x /usr/local/bin/cloudflared`, { timeout: 6e4 });
+        }
+      } else if (platform === "linux") {
+        const arch = os.default.arch() === "arm64" ? "arm64" : "amd64";
+        execSync(`curl -L -o /usr/local/bin/cloudflared https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-${arch} && chmod +x /usr/local/bin/cloudflared`, { timeout: 6e4 });
+      } else {
+        return c.json({ error: "Unsupported platform: " + platform }, 400);
+      }
+      const version = execSync("cloudflared --version 2>&1", { encoding: "utf8", timeout: 5e3 }).trim();
+      return c.json({ success: true, version });
+    } catch (e) {
+      return c.json({ error: e.message }, 500);
+    }
+  });
+  api.post("/tunnel/login", requireRole("admin"), async (c) => {
+    try {
+      const { exec: execCb } = await import("child_process");
+      const { promisify } = await import("util");
+      const execP = promisify(execCb);
+      await execP("cloudflared tunnel login", { timeout: 12e4 });
+      return c.json({ success: true });
+    } catch (e) {
+      return c.json({ error: "Login failed or timed out. Make sure to complete the browser authorization. " + e.message }, 500);
+    }
+  });
+  api.post("/tunnel/deploy", requireRole("admin"), async (c) => {
+    const body = await c.req.json();
+    const { domain, tunnelName, port } = body;
+    if (!domain) return c.json({ error: "domain is required" }, 400);
+    const localPort = port || 3200;
+    const name = tunnelName || "agenticmail-enterprise";
+    try {
+      const { execSync } = await import("child_process");
+      const os = await import("os");
+      const fs = await import("fs");
+      const path = await import("path");
+      const cfDir = path.join(os.default.homedir(), ".cloudflared");
+      const steps = [];
+      if (!fs.existsSync(path.join(cfDir, "cert.pem"))) {
+        return c.json({ error: 'Not authenticated with Cloudflare. Click "Login to Cloudflare" first.' }, 400);
+      }
+      let tunnelId = "";
+      try {
+        const out = execSync(`cloudflared tunnel create ${name} 2>&1`, { encoding: "utf8", timeout: 3e4 });
+        const match = out.match(/Created tunnel .+ with id ([a-f0-9-]+)/);
+        tunnelId = match?.[1] || "";
+        steps.push("Created tunnel: " + name + " (" + tunnelId + ")");
+      } catch (e) {
+        if (e.message?.includes("already exists")) {
+          const listOut = execSync("cloudflared tunnel list --output json 2>&1", { encoding: "utf8", timeout: 15e3 });
+          const tunnels = JSON.parse(listOut);
+          const existing = tunnels.find((t) => t.name === name);
+          if (existing) {
+            tunnelId = existing.id;
+            steps.push("Using existing tunnel: " + name + " (" + tunnelId + ")");
+          } else {
+            throw e;
+          }
+        } else {
+          throw e;
+        }
+      }
+      if (!tunnelId) return c.json({ error: "Failed to get tunnel ID" }, 500);
+      const config = [
+        `tunnel: ${tunnelId}`,
+        `credentials-file: ${path.join(cfDir, tunnelId + ".json")}`,
+        "",
+        "ingress:",
+        `  - hostname: ${domain}`,
+        `    service: http://localhost:${localPort}`,
+        "  - service: http_status:404"
+      ].join("\n");
+      fs.writeFileSync(path.join(cfDir, "config.yml"), config);
+      steps.push("Wrote config: " + domain + " \u2192 localhost:" + localPort);
+      try {
+        execSync(`cloudflared tunnel route dns ${tunnelId} ${domain} 2>&1`, { encoding: "utf8", timeout: 3e4 });
+        steps.push("DNS CNAME created: " + domain + " \u2192 " + tunnelId + ".cfargotunnel.com");
+      } catch (e) {
+        if (e.message?.includes("already exists")) {
+          steps.push("DNS CNAME already exists for " + domain);
+        } else {
+          steps.push("DNS routing failed (you may need to add CNAME manually): " + e.message);
+        }
+      }
+      try {
+        execSync("which pm2", { timeout: 3e3 });
+        try {
+          execSync("pm2 delete cloudflared 2>/dev/null", { timeout: 5e3 });
+        } catch {
+        }
+        execSync(`pm2 start cloudflared --name cloudflared -- tunnel run`, { encoding: "utf8", timeout: 15e3 });
+        execSync("pm2 save 2>/dev/null", { timeout: 5e3 });
+        steps.push("Started cloudflared via PM2 (auto-restarts on crash)");
+      } catch {
+        try {
+          const { spawn } = await import("child_process");
+          const child = spawn("cloudflared", ["tunnel", "run"], { detached: true, stdio: "ignore" });
+          child.unref();
+          steps.push("Started cloudflared in background (install PM2 for auto-restart)");
+        } catch (e2) {
+          steps.push("Could not start tunnel automatically: " + e2.message);
+        }
+      }
+      try {
+        if (db) {
+          const corsRows = await db.query(`SELECT value FROM admin_settings WHERE key = 'cors_origins'`);
+          let origins = [];
+          if (corsRows?.[0]) {
+            try {
+              origins = JSON.parse(corsRows[0].value);
+            } catch {
+              origins = [];
+            }
+          }
+          const newOrigin = "https://" + domain;
+          if (!origins.includes(newOrigin)) {
+            origins.push(newOrigin);
+            await db.execute(
+              `INSERT INTO admin_settings (key, value) VALUES ('cors_origins', $1) ON CONFLICT (key) DO UPDATE SET value = $1`,
+              [JSON.stringify(origins)]
+            );
+            steps.push("Added " + newOrigin + " to CORS allowed origins");
+          }
+        }
+      } catch {
+      }
+      return c.json({ success: true, tunnelId, domain, steps });
+    } catch (e) {
+      return c.json({ error: e.message }, 500);
+    }
+  });
+  api.post("/tunnel/stop", requireRole("admin"), async (c) => {
+    try {
+      const { execSync } = await import("child_process");
+      try {
+        execSync("pm2 stop cloudflared 2>/dev/null", { timeout: 5e3 });
+      } catch {
+      }
+      try {
+        execSync("pm2 delete cloudflared 2>/dev/null", { timeout: 5e3 });
+      } catch {
+      }
+      return c.json({ success: true });
+    } catch (e) {
+      return c.json({ error: e.message }, 500);
+    }
+  });
+  return api;
+}
+// src/auth/routes.ts
+import { Hono as Hono2 } from "hono";
+import { setCookie, getCookie, deleteCookie } from "hono/cookie";
+import { createVerify } from "crypto";
+var COOKIE_NAME = "em_session";
+var REFRESH_COOKIE = "em_refresh";
+var CSRF_COOKIE = "em_csrf";
+var TOKEN_TTL = "24h";
+var REFRESH_TTL = "7d";
+function cookieOpts(maxAge, isSecure) {
+  return {
+    httpOnly: true,
+    secure: isSecure,
+    sameSite: "Lax",
+    path: "/",
+    maxAge
+  };
+}
+function generateCsrf() {
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function generateState() {
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function generateCodeVerifier() {
+  const bytes = new Uint8Array(32);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes).map((b) => "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~"[b % 66]).join("");
+}
+async function generateCodeChallenge(verifier) {
+  const encoder = new TextEncoder();
+  const data = encoder.encode(verifier);
+  const digest = await crypto.subtle.digest("SHA-256", data);
+  return btoa(String.fromCharCode(...new Uint8Array(digest))).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function createAuthRoutes(db, jwtSecret, opts) {
+  const auth = new Hono2();
+  const isSecure = () => {
+    return process.env.NODE_ENV === "production" || process.env.SECURE_COOKIES === "1";
+  };
+  async function issueTokens(userId, email, role) {
+    const { SignJWT } = await import("jose");
+    const secret = new TextEncoder().encode(jwtSecret);
+    const token = await new SignJWT({ sub: userId, email, role }).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime(TOKEN_TTL).sign(secret);
+    const refreshToken = await new SignJWT({ sub: userId, type: "refresh" }).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime(REFRESH_TTL).sign(secret);
+    return { token, refreshToken };
+  }
+  async function setSessionCookies(c, userId, email, role, method) {
+    const { token, refreshToken } = await issueTokens(userId, email, role);
+    const csrf = generateCsrf();
+    const secure = isSecure();
+    setCookie(c, COOKIE_NAME, token, cookieOpts(86400, secure));
+    setCookie(c, REFRESH_COOKIE, refreshToken, cookieOpts(604800, secure));
+    setCookie(c, CSRF_COOKIE, csrf, { ...cookieOpts(86400, secure), httpOnly: false });
+    await db.updateUser(userId, { lastLoginAt: /* @__PURE__ */ new Date() }).catch(() => {
+    });
+    await db.logEvent({
+      actor: userId,
+      actorType: "user",
+      action: "auth.login",
+      resource: `user:${userId}`,
+      details: { method },
+      ip: c.req.header("x-forwarded-for") || c.req.header("x-real-ip")
+    }).catch(() => {
+    });
+    return { token, refreshToken, csrf };
+  }
+  async function findOrProvisionSsoUser(provider, subject, email, name, config) {
+    if (config.allowedDomains?.length) {
+      const domain = email.split("@")[1]?.toLowerCase();
+      if (!config.allowedDomains.some((d) => d.toLowerCase() === domain)) {
+        return { error: `Email domain "${domain}" not allowed for SSO login` };
+      }
+    }
+    let user = await db.getUserBySso(provider, subject);
+    if (user) return { user };
+    user = await db.getUserByEmail(email);
+    if (user) {
+      await db.updateUser(user.id, { ssoProvider: provider, ssoSubject: subject });
+      return { user };
+    }
+    if (!config.autoProvision) {
+      return { error: "No account found. Contact your administrator to create an account." };
+    }
+    const newUser = await db.createUser({
+      email,
+      name: name || email.split("@")[0],
+      role: config.defaultRole || "member",
+      ssoProvider: provider,
+      ssoSubject: subject
+    });
+    return { user: newUser };
+  }
+  async function extractToken(c) {
+    const cookieToken = getCookie(c, COOKIE_NAME);
+    if (cookieToken) return cookieToken;
+    const authHeader = c.req.header("Authorization");
+    if (authHeader?.startsWith("Bearer ")) return authHeader.slice(7);
+    return null;
+  }
+  async function getSsoConfig() {
+    try {
+      const settings = await db.getSettings();
+      return settings?.ssoConfig || null;
+    } catch {
+      return null;
+    }
+  }
+  function generateTotpSecret() {
+    const bytes = new Uint8Array(20);
+    crypto.getRandomValues(bytes);
+    return base32Encode(bytes);
+  }
+  function base32Encode(bytes) {
+    const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+    let result = "";
+    let bits = 0;
+    let value = 0;
+    for (const byte of bytes) {
+      value = value << 8 | byte;
+      bits += 8;
+      while (bits >= 5) {
+        result += alphabet[value >>> bits - 5 & 31];
+        bits -= 5;
+      }
+    }
+    if (bits > 0) {
+      result += alphabet[value << 5 - bits & 31];
+    }
+    return result;
+  }
+  function base32Decode(input) {
+    const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+    const cleaned = input.replace(/[=\s]/g, "").toUpperCase();
+    const bytes = [];
+    let bits = 0;
+    let value = 0;
+    for (const char of cleaned) {
+      const idx = alphabet.indexOf(char);
+      if (idx === -1) continue;
+      value = value << 5 | idx;
+      bits += 5;
+      if (bits >= 8) {
+        bytes.push(value >>> bits - 8 & 255);
+        bits -= 8;
+      }
+    }
+    return new Uint8Array(bytes);
+  }
+  async function generateTotp(secret, timeStep = 30, digits = 6, offsetSteps = 0) {
+    const keyBytes = base32Decode(secret);
+    const time = Math.floor(Date.now() / 1e3 / timeStep) + offsetSteps;
+    const timeBytes = new Uint8Array(8);
+    let t = time;
+    for (let i = 7; i >= 0; i--) {
+      timeBytes[i] = t & 255;
+      t = Math.floor(t / 256);
+    }
+    const key = await crypto.subtle.importKey("raw", keyBytes.buffer, { name: "HMAC", hash: "SHA-1" }, false, ["sign"]);
+    const sig = new Uint8Array(await crypto.subtle.sign("HMAC", key, timeBytes));
+    const offset = sig[sig.length - 1] & 15;
+    const code = ((sig[offset] & 127) << 24 | sig[offset + 1] << 16 | sig[offset + 2] << 8 | sig[offset + 3]) % 10 ** digits;
+    return String(code).padStart(digits, "0");
+  }
+  async function verifyTotp(secret, token) {
+    for (const offset of [0, -1, 1]) {
+      const expected = await generateTotp(secret, 30, 6, offset);
+      if (expected === token) return true;
+    }
+    return false;
+  }
+  function generateBackupCodes(count = 8) {
+    const codes = [];
+    for (let i = 0; i < count; i++) {
+      const bytes = new Uint8Array(4);
+      crypto.getRandomValues(bytes);
+      codes.push(Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("").toUpperCase());
+    }
+    return codes;
+  }
+  const pending2fa = /* @__PURE__ */ new Map();
+  setInterval(() => {
+    const now = Date.now();
+    for (const [k, v] of pending2fa) {
+      if (v.expiresAt < now) pending2fa.delete(k);
+    }
+  }, 6e4);
+  auth.post("/login", async (c) => {
+    const { email, password } = await c.req.json();
+    if (!email || !password) {
+      return c.json({ error: "Email and password required" }, 400);
+    }
+    const user = await db.getUserByEmail(email);
+    if (!user || !user.passwordHash) {
+      return c.json({ error: "Invalid credentials" }, 401);
+    }
+    const { default: bcrypt } = await import("bcryptjs");
+    const valid = await bcrypt.compare(password, user.passwordHash);
+    if (!valid) {
+      return c.json({ error: "Invalid credentials" }, 401);
+    }
+    if (user.totpEnabled && user.totpSecret) {
+      const challengeToken = generateCsrf();
+      pending2fa.set(challengeToken, { userId: user.id, expiresAt: Date.now() + 5 * 60 * 1e3 });
+      return c.json({
+        requires2fa: true,
+        challengeToken,
+        message: "Enter your 2FA code to continue"
+      });
+    }
+    const { token, refreshToken, csrf } = await setSessionCookies(c, user.id, user.email, user.role, "password");
+    return c.json({
+      token,
+      refreshToken,
+      csrf,
+      user: { id: user.id, email: user.email, name: user.name, role: user.role }
+    });
+  });
+  auth.post("/2fa/verify", async (c) => {
+    const { challengeToken, code } = await c.req.json();
+    if (!challengeToken || !code) {
+      return c.json({ error: "Challenge token and code required" }, 400);
+    }
+    const challenge = pending2fa.get(challengeToken);
+    if (!challenge || challenge.expiresAt < Date.now()) {
+      pending2fa.delete(challengeToken);
+      return c.json({ error: "Challenge expired. Please login again." }, 401);
+    }
+    const user = await db.getUser(challenge.userId);
+    if (!user || !user.totpSecret) {
+      pending2fa.delete(challengeToken);
+      return c.json({ error: "User not found" }, 401);
+    }
+    const totpValid = await verifyTotp(user.totpSecret, code.replace(/\s/g, ""));
+    let backupUsed = false;
+    if (!totpValid && user.totpBackupCodes) {
+      try {
+        const { default: bcrypt } = await import("bcryptjs");
+        const backupCodes = JSON.parse(user.totpBackupCodes);
+        for (let i = 0; i < backupCodes.length; i++) {
+          const match = await bcrypt.compare(code.toUpperCase().replace(/\s/g, ""), backupCodes[i]);
+          if (match) {
+            backupCodes.splice(i, 1);
+            await db.updateUser(user.id, { totpBackupCodes: JSON.stringify(backupCodes) });
+            backupUsed = true;
+            break;
+          }
+        }
+      } catch {
+      }
+    }
+    if (!totpValid && !backupUsed) {
+      return c.json({ error: "Invalid 2FA code" }, 401);
+    }
+    pending2fa.delete(challengeToken);
+    const { token, refreshToken, csrf } = await setSessionCookies(c, user.id, user.email, user.role, "password+2fa");
+    return c.json({
+      token,
+      refreshToken,
+      csrf,
+      user: { id: user.id, email: user.email, name: user.name, role: user.role },
+      ...backupUsed ? { warning: "Backup code used. You have fewer backup codes remaining." } : {}
+    });
+  });
+  auth.post("/2fa/setup", async (c) => {
+    const token = await extractToken(c);
+    if (!token) return c.json({ error: "Authentication required" }, 401);
+    let userId;
+    try {
+      const { jwtVerify } = await import("jose");
+      const secret = new TextEncoder().encode(jwtSecret);
+      const { payload } = await jwtVerify(token, secret);
+      userId = payload.sub;
+    } catch {
+      return c.json({ error: "Invalid token" }, 401);
+    }
+    const user = await db.getUser(userId);
+    if (!user) return c.json({ error: "User not found" }, 404);
+    if (user.totpEnabled) {
+      return c.json({ error: "2FA is already enabled. Disable it first to re-enroll." }, 400);
+    }
+    const totpSecret = generateTotpSecret();
+    const settings = await db.getSettings();
+    const issuer = settings?.name || "AgenticMail Enterprise";
+    const otpauthUrl = `otpauth://totp/${encodeURIComponent(issuer)}:${encodeURIComponent(user.email)}?secret=${totpSecret}&issuer=${encodeURIComponent(issuer)}&algorithm=SHA1&digits=6&period=30`;
+    await db.updateUser(userId, { totpSecret });
+    return c.json({
+      secret: totpSecret,
+      otpauthUrl,
+      qrData: otpauthUrl
+      // Frontend can render QR from this
+    });
+  });
+  auth.post("/2fa/confirm", async (c) => {
+    const token = await extractToken(c);
+    if (!token) return c.json({ error: "Authentication required" }, 401);
+    let userId;
+    try {
+      const { jwtVerify } = await import("jose");
+      const secret = new TextEncoder().encode(jwtSecret);
+      const { payload } = await jwtVerify(token, secret);
+      userId = payload.sub;
+    } catch {
+      return c.json({ error: "Invalid token" }, 401);
+    }
+    const { code } = await c.req.json();
+    if (!code) return c.json({ error: "Verification code required" }, 400);
+    const user = await db.getUser(userId);
+    if (!user || !user.totpSecret) return c.json({ error: "No 2FA setup in progress" }, 400);
+    if (user.totpEnabled) return c.json({ error: "2FA is already enabled" }, 400);
+    const valid = await verifyTotp(user.totpSecret, code.replace(/\s/g, ""));
+    if (!valid) return c.json({ error: "Invalid code. Make sure your authenticator app time is synced." }, 400);
+    const plainBackupCodes = generateBackupCodes(8);
+    const { default: bcrypt } = await import("bcryptjs");
+    const hashedCodes = await Promise.all(plainBackupCodes.map((c2) => bcrypt.hash(c2, 10)));
+    await db.updateUser(userId, {
+      totpEnabled: true,
+      totpBackupCodes: JSON.stringify(hashedCodes)
+    });
+    return c.json({
+      enabled: true,
+      backupCodes: plainBackupCodes,
+      warning: "Save these backup codes securely. They will not be shown again."
+    });
+  });
+  auth.post("/2fa/disable", async (c) => {
+    const token = await extractToken(c);
+    if (!token) return c.json({ error: "Authentication required" }, 401);
+    let userId;
+    try {
+      const { jwtVerify } = await import("jose");
+      const secret = new TextEncoder().encode(jwtSecret);
+      const { payload } = await jwtVerify(token, secret);
+      userId = payload.sub;
+    } catch {
+      return c.json({ error: "Invalid token" }, 401);
+    }
+    const { password } = await c.req.json();
+    if (!password) return c.json({ error: "Password required to disable 2FA" }, 400);
+    const user = await db.getUser(userId);
+    if (!user || !user.passwordHash) return c.json({ error: "User not found" }, 404);
+    const { default: bcrypt } = await import("bcryptjs");
+    const valid = await bcrypt.compare(password, user.passwordHash);
+    if (!valid) return c.json({ error: "Invalid password" }, 401);
+    await db.updateUser(userId, {
+      totpEnabled: false,
+      totpSecret: void 0,
+      totpBackupCodes: void 0
+    });
+    return c.json({ disabled: true });
+  });
+  auth.get("/2fa/status", async (c) => {
+    const token = await extractToken(c);
+    if (!token) return c.json({ error: "Authentication required" }, 401);
+    try {
+      const { jwtVerify } = await import("jose");
+      const secret = new TextEncoder().encode(jwtSecret);
+      const { payload } = await jwtVerify(token, secret);
+      const user = await db.getUser(payload.sub);
+      if (!user) return c.json({ error: "User not found" }, 404);
+      return c.json({ enabled: !!user.totpEnabled });
+    } catch {
+      return c.json({ error: "Invalid token" }, 401);
+    }
+  });
+  auth.post("/login/api-key", async (c) => {
+    const { apiKey } = await c.req.json();
+    if (!apiKey) return c.json({ error: "API key required" }, 400);
+    const key = await db.validateApiKey(apiKey);
+    if (!key) return c.json({ error: "Invalid or revoked API key" }, 401);
+    const user = await db.getUser(key.createdBy);
+    if (!user) return c.json({ error: "API key owner not found" }, 401);
+    const { token, refreshToken, csrf } = await setSessionCookies(c, user.id, user.email, user.role, "api-key");
+    return c.json({
+      token,
+      refreshToken,
+      csrf,
+      user: { id: user.id, email: user.email, name: user.name, role: user.role },
+      keyName: key.name
+    });
+  });
+  auth.post("/refresh", async (c) => {
+    const refreshJwt = getCookie(c, REFRESH_COOKIE) || c.req.header("Authorization")?.slice(7);
+    if (!refreshJwt) {
+      return c.json({ error: "Refresh token required" }, 401);
+    }
+    try {
+      const { jwtVerify } = await import("jose");
+      const secret = new TextEncoder().encode(jwtSecret);
+      const { payload } = await jwtVerify(refreshJwt, secret);
+      if (payload.type !== "refresh") return c.json({ error: "Invalid token type" }, 401);
+      const user = await db.getUser(payload.sub);
+      if (!user) return c.json({ error: "User not found" }, 401);
+      const { token, refreshToken } = await issueTokens(user.id, user.email, user.role);
+      const csrf = generateCsrf();
+      const secure = isSecure();
+      setCookie(c, COOKIE_NAME, token, cookieOpts(86400, secure));
+      setCookie(c, REFRESH_COOKIE, refreshToken, cookieOpts(604800, secure));
+      setCookie(c, CSRF_COOKIE, csrf, { ...cookieOpts(86400, secure), httpOnly: false });
+      return c.json({ token, csrf });
+    } catch {
+      return c.json({ error: "Invalid or expired refresh token" }, 401);
+    }
+  });
+  auth.get("/me", async (c) => {
+    const token = await extractToken(c);
+    if (!token) return c.json({ error: "Authentication required" }, 401);
+    try {
+      const { jwtVerify } = await import("jose");
+      const secret = new TextEncoder().encode(jwtSecret);
+      const { payload } = await jwtVerify(token, secret);
+      const user = await db.getUser(payload.sub);
+      if (!user) return c.json({ error: "User not found" }, 404);
+      const { passwordHash, ...safe } = user;
+      return c.json(safe);
+    } catch {
+      return c.json({ error: "Invalid or expired token" }, 401);
+    }
+  });
+  auth.post("/logout", (c) => {
+    deleteCookie(c, COOKIE_NAME, { path: "/" });
+    deleteCookie(c, REFRESH_COOKIE, { path: "/" });
+    deleteCookie(c, CSRF_COOKIE, { path: "/" });
+    return c.json({ ok: true });
+  });
+  auth.get("/sso/providers", async (c) => {
+    const sso = await getSsoConfig();
+    const providers = [];
+    if (sso?.saml?.entityId && sso?.saml?.ssoUrl) {
+      providers.push({ type: "saml", name: "SAML SSO", url: "/auth/saml/login" });
+    }
+    if (sso?.oidc?.clientId && sso?.oidc?.discoveryUrl) {
+      providers.push({ type: "oidc", name: "OpenID Connect", url: "/auth/oidc/authorize" });
+    }
+    return c.json({ providers, ssoEnabled: providers.length > 0 });
+  });
+  auth.get("/setup-status", async (c) => {
+    try {
+      const stats = await db.getStats();
+      const settings = await db.getSettings();
+      const hasUsers = stats.totalUsers > 0;
+      const hasCompanyName = !!(settings?.name && settings.name !== "" && settings.name !== "My Company");
+      const hasAgents = stats.totalAgents > 0;
+      return c.json({
+        setupComplete: hasUsers,
+        needsBootstrap: !hasUsers,
+        checklist: {
+          adminCreated: hasUsers,
+          companyConfigured: hasCompanyName,
+          agentCreated: hasAgents
+        }
+      });
+    } catch {
+      return c.json({ setupComplete: false, needsBootstrap: true, checklist: { adminCreated: false, companyConfigured: false, emailConfigured: false, agentCreated: false } });
+    }
+  });
+  auth.post("/test-db", async (c) => {
+    const stats = await db.getStats();
+    if (stats.totalUsers > 0) {
+      return c.json({ error: "Setup already complete. Database configuration is disabled." }, 403);
+    }
+    const body = await c.req.json();
+    if (!body.type) {
+      return c.json({ error: "Database type is required" }, 400);
+    }
+    try {
+      const { createAdapter } = await import("./factory-672W7A5B.js");
+      const testAdapter = await createAdapter(body);
+      await testAdapter.getStats();
+      await testAdapter.disconnect();
+      return c.json({ success: true });
+    } catch (err) {
+      return c.json({ success: false, error: err.message || "Connection failed" }, 400);
+    }
+  });
+  auth.post("/configure-db", async (c) => {
+    const stats = await db.getStats();
+    if (stats.totalUsers > 0) {
+      return c.json({ error: "Setup already complete. Database configuration is disabled." }, 403);
+    }
+    if (!opts?.onDbConfigure) {
+      return c.json({ error: "Database hot-swap not available" }, 501);
+    }
+    const body = await c.req.json();
+    if (!body.type) {
+      return c.json({ error: "Database type is required" }, 400);
+    }
+    try {
+      const { createAdapter } = await import("./factory-672W7A5B.js");
+      const newAdapter = await createAdapter(body);
+      await newAdapter.migrate();
+      const oldAdapter = opts.onDbConfigure(newAdapter);
+      try {
+        await oldAdapter.disconnect();
+      } catch {
+      }
+      try {
+        const { saveDbConfig } = await import("./config-store-CRMKWBON.js");
+        await saveDbConfig(body, jwtSecret);
+      } catch {
+      }
+      return c.json({ success: true, type: body.type });
+    } catch (err) {
+      return c.json({ success: false, error: err.message || "Configuration failed" }, 400);
+    }
+  });
+  const bootstrapAttempts = /* @__PURE__ */ new Map();
+  auth.post("/bootstrap", async (c) => {
+    const clientIp = c.req.header("x-forwarded-for")?.split(",")[0]?.trim() || c.req.header("x-real-ip") || "unknown";
+    const now = Date.now();
+    const attempt = bootstrapAttempts.get(clientIp);
+    if (attempt && attempt.resetAt > now && attempt.count >= 5) {
+      return c.json({ error: "Too many attempts. Try again later." }, 429);
+    }
+    if (!attempt || attempt.resetAt <= now) {
+      bootstrapAttempts.set(clientIp, { count: 1, resetAt: now + 6e4 });
+    } else {
+      attempt.count++;
+    }
+    const stats = await db.getStats();
+    if (stats.totalUsers > 0) {
+      return c.json({ error: "Setup already complete. Bootstrap is disabled." }, 403);
+    }
+    const { name, email, password, companyName, subdomain } = await c.req.json();
+    if (!email || !password || !name) {
+      return c.json({ error: "Name, email, and password are required" }, 400);
+    }
+    if (password.length < 8) {
+      return c.json({ error: "Password must be at least 8 characters" }, 400);
+    }
+    if (!email.includes("@") || !email.includes(".")) {
+      return c.json({ error: "Invalid email address" }, 400);
+    }
+    try {
+      const user = await db.createUser({
+        email,
+        name,
+        role: "owner",
+        password
+      });
+      if (companyName || subdomain) {
+        const updates = {};
+        if (companyName) updates.name = companyName;
+        if (subdomain) {
+          updates.subdomain = subdomain.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 63);
+        }
+        await db.updateSettings(updates);
+      }
+      await db.logEvent({
+        actor: user.id,
+        actorType: "system",
+        action: "setup.bootstrap",
+        resource: `user:${user.id}`,
+        details: { method: "web-wizard", companyName },
+        ip: c.req.header("x-forwarded-for") || c.req.header("x-real-ip")
+      });
+      const { token, refreshToken, csrf } = await setSessionCookies(c, user.id, user.email, user.role, "bootstrap");
+      opts?.onBootstrap?.();
+      (async () => {
+        try {
+          const { execSync } = await import("child_process");
+          const cwd = process.cwd();
+          const deps = ["@anthropic-ai/sdk", "openai", "elevenlabs"];
+          const missing = deps.filter((d) => {
+            try {
+              __require.resolve(d);
+              return false;
+            } catch {
+              return true;
+            }
+          });
+          if (missing.length > 0) {
+            console.log(`[setup] Auto-installing SDKs: ${missing.join(", ")}...`);
+            execSync(`npm install --no-save ${missing.join(" ")}`, { cwd, timeout: 12e4, stdio: "pipe" });
+            console.log(`[setup] \u2705 SDKs installed: ${missing.join(", ")}`);
+          }
+        } catch (e) {
+          console.error(`[setup] SDK install failed (non-fatal): ${e.message}`);
+        }
+      })();
+      return c.json({
+        token,
+        refreshToken,
+        csrf,
+        user: { id: user.id, email: user.email, name: user.name, role: user.role }
+      });
+    } catch (err) {
+      return c.json({ error: err.message || "Bootstrap failed" }, 500);
+    }
+  });
+  auth.get("/oidc/authorize", async (c) => {
+    const sso = await getSsoConfig();
+    if (!sso?.oidc?.clientId || !sso?.oidc?.discoveryUrl) {
+      return c.json({ error: "OIDC not configured. Set up OIDC in Settings > SSO." }, 400);
+    }
+    const oidc = sso.oidc;
+    let discovery;
+    try {
+      const res = await fetch(oidc.discoveryUrl);
+      if (!res.ok) throw new Error(`Discovery fetch failed: ${res.status}`);
+      discovery = await res.json();
+    } catch (e) {
+      return c.json({ error: `Failed to fetch OIDC discovery: ${e.message}` }, 502);
+    }
+    if (!discovery.authorization_endpoint) {
+      return c.json({ error: "Invalid OIDC discovery: missing authorization_endpoint" }, 502);
+    }
+    const state = generateState();
+    const nonce = generateState();
+    const codeVerifier = generateCodeVerifier();
+    const codeChallenge = await generateCodeChallenge(codeVerifier);
+    const protocol = c.req.header("x-forwarded-proto") || "http";
+    const host = c.req.header("host") || "localhost";
+    const redirectUri = `${protocol}://${host}/auth/oidc/callback`;
+    const { SignJWT } = await import("jose");
+    const secret = new TextEncoder().encode(jwtSecret);
+    const stateToken = await new SignJWT({
+      state,
+      nonce,
+      codeVerifier,
+      redirectUri,
+      discoveryUrl: oidc.discoveryUrl
+    }).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime("10m").sign(secret);
+    setCookie(c, "em_oidc_state", stateToken, {
+      httpOnly: true,
+      secure: isSecure(),
+      sameSite: "Lax",
+      path: "/auth/oidc",
+      maxAge: 600
+    });
+    const scopes = oidc.scopes?.join(" ") || "openid email profile";
+    const authUrl = new URL(discovery.authorization_endpoint);
+    authUrl.searchParams.set("client_id", oidc.clientId);
+    authUrl.searchParams.set("response_type", "code");
+    authUrl.searchParams.set("scope", scopes);
+    authUrl.searchParams.set("redirect_uri", redirectUri);
+    authUrl.searchParams.set("state", state);
+    authUrl.searchParams.set("nonce", nonce);
+    authUrl.searchParams.set("code_challenge", codeChallenge);
+    authUrl.searchParams.set("code_challenge_method", "S256");
+    return c.redirect(authUrl.toString());
+  });
+  auth.get("/oidc/callback", async (c) => {
+    const code = c.req.query("code");
+    const returnedState = c.req.query("state");
+    const error = c.req.query("error");
+    const errorDesc = c.req.query("error_description");
+    if (error) {
+      return c.html(ssoErrorPage("OIDC Error", errorDesc || error));
+    }
+    if (!code || !returnedState) {
+      return c.html(ssoErrorPage("OIDC Error", "Missing code or state parameter"));
+    }
+    const stateCookie = getCookie(c, "em_oidc_state");
+    if (!stateCookie) {
+      return c.html(ssoErrorPage("OIDC Error", "Session expired. Please try again."));
+    }
+    deleteCookie(c, "em_oidc_state", { path: "/auth/oidc" });
+    let statePayload;
+    try {
+      const { jwtVerify } = await import("jose");
+      const secret = new TextEncoder().encode(jwtSecret);
+      const { payload } = await jwtVerify(stateCookie, secret);
+      statePayload = payload;
+    } catch {
+      return c.html(ssoErrorPage("OIDC Error", "Invalid or expired state. Please try again."));
+    }
+    if (statePayload.state !== returnedState) {
+      return c.html(ssoErrorPage("OIDC Error", "State mismatch. Possible CSRF attack."));
+    }
+    const sso = await getSsoConfig();
+    if (!sso?.oidc) {
+      return c.html(ssoErrorPage("OIDC Error", "OIDC is no longer configured."));
+    }
+    const oidc = sso.oidc;
+    let discovery;
+    try {
+      const res = await fetch(oidc.discoveryUrl);
+      discovery = await res.json();
+    } catch (e) {
+      return c.html(ssoErrorPage("OIDC Error", `Discovery fetch failed: ${e.message}`));
+    }
+    let tokenResponse;
+    try {
+      const tokenRes = await fetch(discovery.token_endpoint, {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          grant_type: "authorization_code",
+          code,
+          redirect_uri: statePayload.redirectUri,
+          client_id: oidc.clientId,
+          client_secret: oidc.clientSecret,
+          code_verifier: statePayload.codeVerifier
+        }).toString()
+      });
+      if (!tokenRes.ok) {
+        const errBody = await tokenRes.text();
+        throw new Error(`Token exchange failed (${tokenRes.status}): ${errBody}`);
+      }
+      tokenResponse = await tokenRes.json();
+    } catch (e) {
+      return c.html(ssoErrorPage("OIDC Error", e.message));
+    }
+    let email;
+    let name;
+    let sub;
+    if (tokenResponse.id_token) {
+      const parts = tokenResponse.id_token.split(".");
+      if (parts.length !== 3) {
+        return c.html(ssoErrorPage("OIDC Error", "Invalid id_token format"));
+      }
+      try {
+        const { jwtVerify, createRemoteJWKSet } = await import("jose");
+        const jwks = createRemoteJWKSet(new URL(discovery.jwks_uri));
+        const { payload } = await jwtVerify(tokenResponse.id_token, jwks, {
+          issuer: discovery.issuer,
+          audience: oidc.clientId
+        });
+        if (payload.nonce !== statePayload.nonce) {
+          return c.html(ssoErrorPage("OIDC Error", "Nonce mismatch. Possible replay attack."));
+        }
+        sub = payload.sub;
+        email = payload.email || "";
+        name = payload.name || payload.preferred_username || "";
+      } catch (e) {
+        return c.html(ssoErrorPage("OIDC Error", `ID token verification failed: ${e.message}`));
+      }
+    } else if (discovery.userinfo_endpoint) {
+      try {
+        const uiRes = await fetch(discovery.userinfo_endpoint, {
+          headers: { Authorization: `Bearer ${tokenResponse.access_token}` }
+        });
+        const userinfo = await uiRes.json();
+        sub = userinfo.sub;
+        email = userinfo.email || "";
+        name = userinfo.name || userinfo.preferred_username || "";
+      } catch (e) {
+        return c.html(ssoErrorPage("OIDC Error", `Userinfo fetch failed: ${e.message}`));
+      }
+    } else {
+      return c.html(ssoErrorPage("OIDC Error", "No id_token or userinfo endpoint available"));
+    }
+    if (!email) {
+      return c.html(ssoErrorPage("OIDC Error", 'No email claim in the token. Ensure "email" scope is granted.'));
+    }
+    const result = await findOrProvisionSsoUser("oidc", sub, email, name, oidc);
+    if ("error" in result) {
+      return c.html(ssoErrorPage("OIDC Error", result.error ?? "Unknown error"));
+    }
+    await setSessionCookies(c, result.user.id, result.user.email, result.user.role, "oidc");
+    return c.redirect("/dashboard");
+  });
+  auth.get("/saml/login", async (c) => {
+    const sso = await getSsoConfig();
+    if (!sso?.saml?.ssoUrl || !sso?.saml?.entityId) {
+      return c.json({ error: "SAML not configured. Set up SAML in Settings > SSO." }, 400);
+    }
+    const saml = sso.saml;
+    const protocol = c.req.header("x-forwarded-proto") || "http";
+    const host = c.req.header("host") || "localhost";
+    const acsUrl = `${protocol}://${host}/auth/saml/callback`;
+    const requestId2 = "_" + crypto.randomUUID().replace(/-/g, "");
+    const issueInstant = (/* @__PURE__ */ new Date()).toISOString();
+    const authnRequest = `<samlp:AuthnRequest
+  xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
+  xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+  ID="${requestId2}"
+  Version="2.0"
+  IssueInstant="${issueInstant}"
+  Destination="${saml.ssoUrl}"
+  AssertionConsumerServiceURL="${acsUrl}"
+  ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST">
+  <saml:Issuer>${saml.entityId}</saml:Issuer>
+  <samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" AllowCreate="true"/>
+</samlp:AuthnRequest>`;
+    const { deflateRawSync } = await import("zlib");
+    const deflated = deflateRawSync(Buffer.from(authnRequest, "utf-8"));
+    const encoded = deflated.toString("base64");
+    const redirectUrl = new URL(saml.ssoUrl);
+    redirectUrl.searchParams.set("SAMLRequest", encoded);
+    redirectUrl.searchParams.set("RelayState", "/dashboard");
+    return c.redirect(redirectUrl.toString());
+  });
+  auth.get("/saml/metadata", async (c) => {
+    const sso = await getSsoConfig();
+    const entityId = sso?.saml?.entityId || "agenticmail-enterprise";
+    const protocol = c.req.header("x-forwarded-proto") || "http";
+    const host = c.req.header("host") || "localhost";
+    const acsUrl = `${protocol}://${host}/auth/saml/callback`;
+    const sloUrl = `${protocol}://${host}/auth/saml/logout`;
+    const metadata = `<?xml version="1.0" encoding="UTF-8"?>
+<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
+  entityID="${entityId}">
+  <md:SPSSODescriptor
+    AuthnRequestsSigned="false"
+    WantAssertionsSigned="true"
+    protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+    <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
+    <md:AssertionConsumerService
+      Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+      Location="${acsUrl}"
+      index="0"
+      isDefault="true"/>
+    <md:SingleLogoutService
+      Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+      Location="${sloUrl}"/>
+  </md:SPSSODescriptor>
+</md:EntityDescriptor>`;
+    return c.body(metadata, 200, {
+      "Content-Type": "application/xml"
+    });
+  });
+  auth.post("/saml/callback", async (c) => {
+    const sso = await getSsoConfig();
+    if (!sso?.saml?.certificate) {
+      return c.html(ssoErrorPage("SAML Error", "SAML not configured."));
+    }
+    const saml = sso.saml;
+    let samlResponse;
+    const contentType = c.req.header("content-type") || "";
+    if (contentType.includes("application/x-www-form-urlencoded")) {
+      const body = await c.req.parseBody();
+      samlResponse = body["SAMLResponse"];
+    } else {
+      const body = await c.req.json().catch(() => ({}));
+      samlResponse = body.SAMLResponse;
+    }
+    if (!samlResponse) {
+      return c.html(ssoErrorPage("SAML Error", "Missing SAMLResponse"));
+    }
+    let xml;
+    try {
+      xml = Buffer.from(samlResponse, "base64").toString("utf-8");
+    } catch {
+      return c.html(ssoErrorPage("SAML Error", "Invalid base64 encoding"));
+    }
+    const assertion = parseSamlAssertion(xml, saml.certificate);
+    if (assertion.error) {
+      return c.html(ssoErrorPage("SAML Error", assertion.error));
+    }
+    if (!assertion.email) {
+      return c.html(ssoErrorPage("SAML Error", "No email found in SAML assertion. Check your IdP attribute mapping."));
+    }
+    if (assertion.notBefore && new Date(assertion.notBefore) > /* @__PURE__ */ new Date()) {
+      return c.html(ssoErrorPage("SAML Error", "Assertion not yet valid"));
+    }
+    if (assertion.notOnOrAfter && new Date(assertion.notOnOrAfter) <= /* @__PURE__ */ new Date()) {
+      return c.html(ssoErrorPage("SAML Error", "Assertion has expired"));
+    }
+    const subject = assertion.nameId || assertion.email;
+    const result = await findOrProvisionSsoUser("saml", subject, assertion.email, assertion.name || "", saml);
+    if ("error" in result) {
+      return c.html(ssoErrorPage("SAML Error", result.error ?? "Unknown error"));
+    }
+    await setSessionCookies(c, result.user.id, result.user.email, result.user.role, "saml");
+    return c.redirect("/dashboard");
+  });
+  return auth;
+}
+function parseSamlAssertion(xml, certificate) {
+  const result = {};
+  try {
+    const statusMatch = xml.match(/<samlp?:StatusCode[^>]*Value="([^"]+)"/);
+    if (statusMatch) {
+      const statusValue = statusMatch[1];
+      if (!statusValue.includes(":Success")) {
+        result.error = `SAML authentication failed with status: ${statusValue}`;
+        return result;
+      }
+    }
+    const nameIdMatch = xml.match(/<(?:saml2?:)?NameID[^>]*>([^<]+)<\/(?:saml2?:)?NameID>/);
+    if (nameIdMatch) {
+      result.nameId = nameIdMatch[1].trim();
+    }
+    const issuerMatch = xml.match(/<(?:saml2?:)?Issuer[^>]*>([^<]+)<\/(?:saml2?:)?Issuer>/);
+    if (issuerMatch) {
+      result.issuer = issuerMatch[1].trim();
+    }
+    const condMatch = xml.match(/<(?:saml2?:)?Conditions\s+NotBefore="([^"]+)"\s+NotOnOrAfter="([^"]+)"/);
+    if (condMatch) {
+      result.notBefore = condMatch[1];
+      result.notOnOrAfter = condMatch[2];
+    }
+    const sessionMatch = xml.match(/SessionIndex="([^"]+)"/);
+    if (sessionMatch) {
+      result.sessionIndex = sessionMatch[1];
+    }
+    const attrRegex = /<(?:saml2?:)?Attribute\s+Name="([^"]+)"[^>]*>[\s\S]*?<(?:saml2?:)?AttributeValue[^>]*>([^<]*)<\/(?:saml2?:)?AttributeValue>/g;
+    let match;
+    while ((match = attrRegex.exec(xml)) !== null) {
+      const attrName = match[1].toLowerCase();
+      const attrValue = match[2].trim();
+      if (attrName.includes("emailaddress") || attrName.includes("email") || attrName === "mail") {
+        result.email = attrValue;
+      } else if (attrName.includes("displayname") || attrName === "name") {
+        result.name = attrValue;
+      } else if (attrName.includes("givenname") || attrName.includes("firstname")) {
+        result.firstName = attrValue;
+      } else if (attrName.includes("surname") || attrName.includes("lastname")) {
+        result.lastName = attrValue;
+      }
+    }
+    if (!result.email && result.nameId?.includes("@")) {
+      result.email = result.nameId;
+    }
+    if (!result.name && (result.firstName || result.lastName)) {
+      result.name = [result.firstName, result.lastName].filter(Boolean).join(" ");
+    }
+    result.signatureValid = verifySamlSignature(xml, certificate);
+    if (!result.signatureValid) {
+      result.error = "SAML assertion signature verification failed. Check IdP certificate.";
+      return result;
+    }
+  } catch (e) {
+    result.error = `Failed to parse SAML assertion: ${e.message}`;
+  }
+  return result;
+}
+function verifySamlSignature(xml, certPem) {
+  try {
+    const sigMatch = xml.match(/<(?:ds:)?SignatureValue[^>]*>([\s\S]*?)<\/(?:ds:)?SignatureValue>/);
+    if (!sigMatch) return true;
+    const signedInfoMatch = xml.match(/<(?:ds:)?SignedInfo[^>]*>[\s\S]*?<\/(?:ds:)?SignedInfo>/);
+    if (!signedInfoMatch) return false;
+    let cert = certPem.trim();
+    if (!cert.startsWith("-----BEGIN CERTIFICATE-----")) {
+      cert = cert.replace(/\s/g, "");
+      cert = `-----BEGIN CERTIFICATE-----
+${cert.match(/.{1,64}/g)?.join("\n")}
+-----END CERTIFICATE-----`;
+    }
+    const algMatch = xml.match(/SignatureMethod\s+Algorithm="([^"]+)"/);
+    const algorithm = algMatch?.[1]?.includes("rsa-sha256") ? "RSA-SHA256" : "RSA-SHA1";
+    const signature = Buffer.from(sigMatch[1].replace(/\s/g, ""), "base64");
+    const signedInfo = signedInfoMatch[0];
+    const canonicalized = signedInfo.replace(/\r\n/g, "\n").replace(/\r/g, "\n").trim();
+    const verifier = createVerify(algorithm);
+    verifier.update(canonicalized);
+    return verifier.verify(cert, signature);
+  } catch {
+    return false;
+  }
+}
+function ssoErrorPage(title, message) {
+  return `<!DOCTYPE html>
+<html>
+<head><title>${title}</title>
+<style>
+  body { font-family: system-ui, -apple-system, sans-serif; display: flex; align-items: center; justify-content: center; min-height: 100vh; margin: 0; background: #f8f9fa; }
+  .card { background: white; border-radius: 12px; padding: 40px; max-width: 480px; box-shadow: 0 2px 8px rgba(0,0,0,0.1); text-align: center; }
+  h1 { color: #dc2626; font-size: 1.5rem; margin: 0 0 16px; }
+  p { color: #4b5563; margin: 0 0 24px; line-height: 1.5; }
+  a { display: inline-block; padding: 10px 24px; background: #6366f1; color: white; border-radius: 8px; text-decoration: none; }
+  a:hover { background: #4f46e5; }
+</style></head>
+<body>
+<div class="card">
+  <h1>${title}</h1>
+  <p>${message}</p>
+  <a href="/dashboard">Back to Dashboard</a>
+</div>
+</body></html>`;
+}
+// src/server.ts
+var ENTERPRISE_VERSION = "unknown";
+try {
+  const _require = createRequire(import.meta.url);
+  ENTERPRISE_VERSION = _require("../package.json").version;
+} catch {
+  try {
+    ENTERPRISE_VERSION = JSON.parse(readFileSync(join(process.cwd(), "node_modules", "@agenticmail", "enterprise", "package.json"), "utf-8")).version;
+  } catch {
+  }
+}
+function createServer(config) {
+  const app = new Hono3();
+  const dbProxy = createDbProxy(config.db);
+  config.db = dbProxy;
+  setNetworkDb(config.db);
+  invalidateNetworkConfig().catch(() => {
+  });
+  initProxyConfig();
+  const dbBreaker = new CircuitBreaker({
+    failureThreshold: 5,
+    recoveryTimeMs: 3e4,
+    timeout: 1e4
+  });
+  const healthMonitor = new HealthMonitor(
+    async () => {
+      await config.db.getStats();
+    },
+    { intervalMs: 3e4, timeoutMs: 5e3, unhealthyThreshold: 3 }
+  );
+  healthMonitor.onStatusChange((healthy) => {
+    console.log(
+      `[${(/* @__PURE__ */ new Date()).toISOString()}] ${healthy ? "\u2705" : "\u274C"} Database health: ${healthy ? "healthy" : "unhealthy"}`
+    );
+  });
+  app.use("*", requestIdMiddleware());
+  app.use("*", errorHandler());
+  app.use("*", securityHeaders());
+  app.use("*", requireHttps());
+  app.use("*", dnsRebindingProtection());
+  app.use("*", requestBodyLimit());
+  app.use("*", geoIpRestriction());
+  app.use("*", ipAccessControl());
+  async function getCorsOrigins() {
+    if (config.corsOrigins && config.corsOrigins.length && config.corsOrigins[0] !== "*") {
+      return config.corsOrigins;
+    }
+    const { getNetworkConfig: getNetworkConfig2 } = await import("./network-config-IJ2XYW2B.js");
+    const netConfig = await getNetworkConfig2();
+    const origins = netConfig.network?.corsOrigins;
+    if (origins && Array.isArray(origins) && origins.length > 0) return origins;
+    return [];
+  }
+  app.use("*", cors({
+    origin: async (origin, c) => {
+      const allowed = await getCorsOrigins();
+      if (!allowed.length) return origin || "*";
+      if (origin && allowed.includes(origin)) return origin;
+      if (!origin) return allowed[0];
+      return "";
+    },
+    credentials: true,
+    allowHeaders: ["Content-Type", "Authorization", "X-API-Key", "X-Request-Id", "X-CSRF-Token"],
+    exposeHeaders: ["X-Request-Id", "X-RateLimit-Limit", "X-RateLimit-Remaining", "Retry-After"]
+  }));
+  app.use("*", rateLimiter({
+    limit: config.rateLimit ?? 300,
+    windowSec: 60,
+    skipPaths: ["/health", "/ready", "/dashboard", "/api/engine/agent-status"]
+  }));
+  if (config.logging !== false) {
+    app.use("*", requestLogger());
+  }
+  app.get("/health", (c) => c.json({
+    status: "ok",
+    version: "0.4.0",
+    uptime: process.uptime()
+  }));
+  app.get("/ready", async (c) => {
+    const dbHealthy = healthMonitor.isHealthy();
+    const status = dbHealthy ? 200 : 503;
+    return c.json({
+      ready: dbHealthy,
+      checks: {
+        database: dbHealthy ? "ok" : "unhealthy",
+        circuitBreaker: dbBreaker.getState()
+      }
+    }, status);
+  });
+  let _setupComplete = false;
+  (async () => {
+    try {
+      const stats = await config.db.getStats();
+      if (stats.totalUsers > 0) _setupComplete = true;
+    } catch {
+    }
+  })();
+  const authRoutes = createAuthRoutes(config.db, config.jwtSecret, {
+    onBootstrap: () => {
+      _setupComplete = true;
+    },
+    onDbConfigure: (newAdapter) => {
+      const old = dbProxy.__swap(newAdapter);
+      engineInitialized = false;
+      return old;
+    }
+  });
+  app.route("/auth", authRoutes);
+  const api = new Hono3();
+  api.use("*", async (c, next) => {
+    if (c.req.path.endsWith("/oauth/callback") && c.req.method === "GET") {
+      return next();
+    }
+    if (c.req.path.includes("/chat-webhook") && c.req.method === "POST") {
+      return next();
+    }
+    if (c.req.path.includes("/engine/agent-status") || c.req.path.includes("/whatsapp/proxy-send") && (c.req.header("host") || "").startsWith("localhost")) {
+      return next();
+    }
+    if (c.req.path.includes("/runtime/chat") && c.req.method === "POST") {
+      return next();
+    }
+    if (c.req.path.includes("/runtime/hooks/") && c.req.method === "POST") {
+      return next();
+    }
+    const apiKeyHeader = c.req.header("X-API-Key");
+    if (apiKeyHeader) {
+      const key = await dbBreaker.execute(() => config.db.validateApiKey(apiKeyHeader));
+      if (!key) return c.json({ error: "Invalid API key" }, 401);
+      c.set("userId", key.createdBy);
+      c.set("authType", "api-key");
+      c.set("apiKeyScopes", key.scopes);
+      return next();
+    }
+    const { getCookie: getCookie2 } = await import("hono/cookie");
+    const cookieToken = getCookie2(c, "em_session");
+    const authHeader = c.req.header("Authorization");
+    const jwt = cookieToken || (authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : null);
+    if (!jwt) {
+      return c.json({ error: "Authentication required" }, 401);
+    }
+    try {
+      const { jwtVerify } = await import("jose");
+      const secret = new TextEncoder().encode(config.jwtSecret);
+      const { payload } = await jwtVerify(jwt, secret);
+      c.set("userId", payload.sub);
+      c.set("userRole", payload.role || "");
+      c.set("userEmail", payload.email || "");
+      c.set("authType", cookieToken ? "cookie" : "jwt");
+      return next();
+    } catch {
+      return c.json({ error: "Invalid or expired token" }, 401);
+    }
+  });
+  api.use("*", auditLogger(config.db));
+  const adminRoutes = createAdminRoutes(config.db);
+  api.route("/", adminRoutes);
+  let engineInitialized = false;
+  api.all("/engine/*", async (c, next) => {
+    try {
+      const { engineRoutes, setEngineDb } = await import("./routes-GYKER7K7.js");
+      const { EngineDatabase } = await import("./db-adapter-FBLIO7QY.js");
+      if (!engineInitialized) {
+        engineInitialized = true;
+        const engineDbInterface = config.db.getEngineDB();
+        if (!engineDbInterface) {
+          return c.json({
+            error: "Engine not available",
+            detail: `Engine requires a SQL-compatible database. "${config.db.type}" does not support raw SQL queries. Use postgres, mysql, sqlite, or turso.`
+          }, 501);
+        }
+        const adapterDialect = config.db.getDialect();
+        const dialectMap = {
+          sqlite: "sqlite",
+          postgres: "postgres",
+          supabase: "postgres",
+          neon: "postgres",
+          cockroachdb: "postgres",
+          mysql: "mysql",
+          planetscale: "mysql",
+          turso: "turso"
+        };
+        const engineDialect = dialectMap[adapterDialect] || adapterDialect;
+        const engineDb = new EngineDatabase(engineDbInterface, engineDialect);
+        const migrationResult = await engineDb.migrate();
+        console.log(`[engine] Migrations: ${migrationResult.applied} applied, ${migrationResult.total} total`);
+        await setEngineDb(engineDb, config.db);
+        engineInitialized = true;
+        if (config.runtime?.enabled) {
+          try {
+            const { createAgentRuntime } = await import("./runtime-3CAEEFSI.js");
+            const { mountRuntimeApp, setRuntime } = await import("./routes-GYKER7K7.js");
+            let getEmailConfig;
+            let onTokenRefresh;
+            let agentMemoryMgr;
+            try {
+              const { lifecycle: lc, memoryManager: mm } = await import("./routes-GYKER7K7.js");
+              agentMemoryMgr = mm;
+              if (lc) {
+                getEmailConfig = (agentId) => {
+                  const managed = lc.getAgent(agentId);
+                  return managed?.config?.emailConfig || null;
+                };
+                onTokenRefresh = (agentId, tokens) => {
+                  const managed = lc.getAgent(agentId);
+                  if (managed?.config?.emailConfig) {
+                    if (tokens.accessToken) managed.config.emailConfig.oauthAccessToken = tokens.accessToken;
+                    if (tokens.refreshToken) managed.config.emailConfig.oauthRefreshToken = tokens.refreshToken;
+                    if (tokens.expiresAt) managed.config.emailConfig.oauthTokenExpiry = tokens.expiresAt;
+                    lc.saveAgent(agentId).catch(() => {
+                    });
+                  }
+                };
+              }
+            } catch {
+            }
+            const { vault: vaultRef, permissionEngine: permRef } = await import("./routes-GYKER7K7.js");
+            const runtime = createAgentRuntime({
+              engineDb,
+              adminDb: config.db,
+              defaultModel: config.runtime.defaultModel,
+              apiKeys: config.runtime.apiKeys,
+              gatewayEnabled: true,
+              getEmailConfig,
+              onTokenRefresh,
+              agentMemoryManager: agentMemoryMgr,
+              vault: vaultRef,
+              permissionEngine: permRef
+            });
+            await runtime.start();
+            const runtimeApp = runtime.getApp();
+            if (runtimeApp) {
+              mountRuntimeApp(runtimeApp);
+            }
+            setRuntime(runtime);
+            console.log("[runtime] Agent runtime started and mounted at /api/engine/runtime/*");
+          } catch (runtimeErr) {
+            console.warn(`[runtime] Failed to start agent runtime: ${runtimeErr.message}`);
+          }
+        }
+      }
+      const originalUrl = new URL(c.req.url);
+      const subPath = (c.req.path.replace(/^\/api\/engine/, "") || "/") + originalUrl.search;
+      const headers = new Headers(c.req.raw.headers);
+      const userId = c.get("userId");
+      const userRole = c.get("userRole");
+      const userEmail = c.get("userEmail");
+      const authType = c.get("authType");
+      const requestId2 = c.get("requestId");
+      if (userId) headers.set("X-User-Id", String(userId));
+      if (userRole) headers.set("X-User-Role", String(userRole));
+      if (userEmail) headers.set("X-User-Email", String(userEmail));
+      if (authType) headers.set("X-Auth-Type", String(authType));
+      if (requestId2) headers.set("X-Request-Id", String(requestId2));
+      const subReq = new Request(new URL(subPath, "http://localhost"), {
+        method: c.req.method,
+        headers,
+        body: c.req.method !== "GET" && c.req.method !== "HEAD" ? c.req.raw.body : void 0
+      });
+      return engineRoutes.fetch(subReq);
+    } catch (e) {
+      console.error("[engine] Error:", e.message);
+      return c.json({ error: "Engine module not available", detail: e.message }, 501);
+    }
+  });
+  app.route("/api", api);
+  let dashboardHtml = null;
+  function getDashboardHtml() {
+    if (!dashboardHtml) {
+      try {
+        const dir = dirname(fileURLToPath(import.meta.url));
+        dashboardHtml = readFileSync(join(dir, "dashboard", "index.html"), "utf-8");
+      } catch {
+        try {
+          dashboardHtml = readFileSync(join(process.cwd(), "node_modules", "@agenticmail", "enterprise", "dist", "dashboard", "index.html"), "utf-8");
+        } catch {
+          dashboardHtml = "<html><body><h1>Dashboard not found</h1><p>The dashboard HTML file could not be located.</p></body></html>";
+        }
+      }
+    }
+    return dashboardHtml;
+  }
+  async function serveDashboard(c) {
+    let html = getDashboardHtml();
+    html = html.replace("</head>", `<script>window.__ENTERPRISE_VERSION__="${ENTERPRISE_VERSION}";</script></head>`);
+    if (!_setupComplete) {
+      const injection = `<script>window.__EM_SETUP_STATE__=${JSON.stringify({ needsBootstrap: true })};</script>`;
+      html = html.replace("</head>", injection + "</head>");
+    }
+    try {
+      const settings0 = await config.db.getSettings();
+      const branding = settings0?.branding || {};
+      if (settings0?.name && !branding.companyName) branding.companyName = settings0.name;
+      if (Object.keys(branding).length > 0) {
+        const brandScript = `<script>window.__EM_BRANDING__=${JSON.stringify(branding)};</script>`;
+        html = html.replace("</head>", brandScript + "</head>");
+      }
+    } catch {
+    }
+    try {
+      const settings = await config.db.getSettings();
+      if (settings.domain && settings.domainStatus) {
+        const domainState = {
+          domain: settings.domain,
+          status: settings.domainStatus,
+          verifiedAt: settings.domainVerifiedAt,
+          dnsChallenge: settings.domainDnsChallenge
+        };
+        const domainScript = `<script>window.__EM_DOMAIN_STATE__=${JSON.stringify(domainState)};</script>`;
+        html = html.replace("</head>", domainScript + "</head>");
+      }
+    } catch {
+    }
+    return c.html(html);
+  }
+  app.get("/branding/*", (c) => {
+    const reqPath = c.req.path.replace("/branding/", "").split("?")[0];
+    if (reqPath.includes("..")) return c.json({ error: "Forbidden" }, 403);
+    const ext = reqPath.substring(reqPath.lastIndexOf("."));
+    const mimeMap = { ".png": "image/png", ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".svg": "image/svg+xml", ".ico": "image/x-icon", ".gif": "image/gif", ".webp": "image/webp" };
+    const mime = mimeMap[ext];
+    if (!mime) return c.json({ error: "Not found" }, 404);
+    const brandDir = join(homedir(), ".agenticmail", "branding");
+    const filePath = join(brandDir, reqPath);
+    if (!filePath.startsWith(brandDir) || !existsSync(filePath)) return c.json({ error: "Not found" }, 404);
+    const content = readFileSync(filePath);
+    return new Response(content, { status: 200, headers: { "Content-Type": mime, "Cache-Control": "public, max-age=3600" } });
+  });
+  app.get("/", (c) => c.redirect("/dashboard"));
+  app.get("/dashboard", serveDashboard);
+  app.get("/docs/:page", (c) => {
+    const page = c.req.param("page").replace(/[^a-z0-9-]/gi, "");
+    const dir = dirname(fileURLToPath(import.meta.url));
+    const filePath = join(dir, "dashboard", "docs", page + ".html");
+    if (existsSync(filePath)) {
+      const content = readFileSync(filePath, "utf-8");
+      return new Response(content, { status: 200, headers: { "Content-Type": "text/html; charset=utf-8" } });
+    }
+    return c.json({ error: "Documentation page not found" }, 404);
+  });
+  const STATIC_MIME = { ".js": "application/javascript; charset=utf-8", ".png": "image/png", ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".svg": "image/svg+xml", ".ico": "image/x-icon", ".gif": "image/gif", ".webp": "image/webp", ".css": "text/css; charset=utf-8" };
+  app.get("/dashboard/*", (c) => {
+    const reqPath = c.req.path.replace("/dashboard/", "");
+    const ext = reqPath.substring(reqPath.lastIndexOf("."));
+    const mime = STATIC_MIME[ext];
+    if (mime) {
+      const dir = dirname(fileURLToPath(import.meta.url));
+      const filePath = join(dir, "dashboard", reqPath);
+      if (!filePath.startsWith(join(dir, "dashboard"))) {
+        return c.json({ error: "Forbidden" }, 403);
+      }
+      if (existsSync(filePath)) {
+        const content = readFileSync(filePath);
+        return new Response(content, { status: 200, headers: { "Content-Type": mime, "Cache-Control": ext === ".js" ? "no-cache, no-store, must-revalidate" : "public, max-age=86400" } });
+      }
+      return c.json({ error: "Not found", path: c.req.path }, 404);
+    }
+    return serveDashboard(c);
+  });
+  app.notFound((c) => {
+    return c.json({ error: "Not found", path: c.req.path }, 404);
+  });
+  return {
+    app,
+    healthMonitor,
+    start: () => {
+      return new Promise((resolve) => {
+        const server = serve(
+          { fetch: app.fetch, port: config.port },
+          (info) => {
+            console.log(`
+\u{1F3E2} AgenticMail Enterprise v${ENTERPRISE_VERSION}`);
+            console.log(`   API:    http://localhost:${info.port}/api`);
+            console.log(`   Auth:   http://localhost:${info.port}/auth`);
+            console.log(`   Health: http://localhost:${info.port}/health`);
+            console.log("");
+            healthMonitor.start();
+            config.db.getSettings().then(async (settings) => {
+              const { SecureVault: SecureVault2 } = await import("./vault-JZFISH5D.js");
+              const vaultInst = new SecureVault2();
+              const keys = settings?.modelPricingConfig?.providerApiKeys;
+              if (keys && typeof keys === "object") {
+                for (const [providerId, apiKey] of Object.entries(keys)) {
+                  if (apiKey && typeof apiKey === "string") {
+                    let decrypted;
+                    try {
+                      decrypted = vaultInst.decrypt(apiKey);
+                    } catch {
+                      decrypted = apiKey;
+                    }
+                    if (config.runtime?.apiKeys) {
+                      config.runtime.apiKeys[providerId] = decrypted;
+                    }
+                    console.log(`   \u{1F511} Loaded API key for ${providerId} from DB`);
+                  }
+                }
+              }
+            }).catch(() => {
+            });
+            (async () => {
+              try {
+                const { engineRoutes, setEngineDb } = await import("./routes-GYKER7K7.js");
+                const { EngineDatabase } = await import("./db-adapter-FBLIO7QY.js");
+                if (!engineInitialized) {
+                  engineInitialized = true;
+                  const engineDbInterface = config.db.getEngineDB();
+                  if (engineDbInterface) {
+                    const adapterDialect = config.db.getDialect();
+                    const dialectMap = {
+                      sqlite: "sqlite",
+                      postgres: "postgres",
+                      supabase: "postgres",
+                      neon: "postgres",
+                      cockroachdb: "postgres",
+                      mysql: "mysql",
+                      planetscale: "mysql",
+                      turso: "turso"
+                    };
+                    const engineDialect = dialectMap[adapterDialect] || adapterDialect;
+                    const engineDb = new EngineDatabase(engineDbInterface, engineDialect);
+                    const migrationResult = await engineDb.migrate();
+                    console.log(`[engine] Migrations: ${migrationResult.applied} applied, ${migrationResult.total} total`);
+                    await setEngineDb(engineDb, config.db);
+                    if (config.runtime?.enabled) {
+                      try {
+                        const { createAgentRuntime } = await import("./runtime-3CAEEFSI.js");
+                        const { mountRuntimeApp, setRuntime } = await import("./routes-GYKER7K7.js");
+                        let getEmailConfig;
+                        let onTokenRefresh;
+                        let agentMemoryMgr;
+                        try {
+                          const { lifecycle: lc, memoryManager: mm } = await import("./routes-GYKER7K7.js");
+                          agentMemoryMgr = mm;
+                          if (lc) {
+                            getEmailConfig = (agentId) => {
+                              const managed = lc.getAgent(agentId);
+                              return managed?.config?.emailConfig || null;
+                            };
+                            onTokenRefresh = (agentId, tokens) => {
+                              const managed = lc.getAgent(agentId);
+                              if (managed?.config?.emailConfig) {
+                                if (tokens.accessToken) managed.config.emailConfig.oauthAccessToken = tokens.accessToken;
+                                if (tokens.refreshToken) managed.config.emailConfig.oauthRefreshToken = tokens.refreshToken;
+                                if (tokens.expiresAt) managed.config.emailConfig.oauthTokenExpiry = tokens.expiresAt;
+                                lc.saveAgent(agentId).catch(() => {
+                                });
+                              }
+                            };
+                          }
+                        } catch {
+                        }
+                        const { vault: vaultRef2, permissionEngine: permRef2 } = await import("./routes-GYKER7K7.js");
+                        const runtime = createAgentRuntime({
+                          engineDb,
+                          adminDb: config.db,
+                          defaultModel: config.runtime.defaultModel,
+                          apiKeys: config.runtime.apiKeys,
+                          gatewayEnabled: true,
+                          getEmailConfig,
+                          onTokenRefresh,
+                          agentMemoryManager: agentMemoryMgr,
+                          vault: vaultRef2,
+                          permissionEngine: permRef2,
+                          hierarchyManager: (await import("./routes-GYKER7K7.js")).hierarchyManager ?? void 0
+                        });
+                        await runtime.start();
+                        const runtimeApp = runtime.getApp();
+                        if (runtimeApp) mountRuntimeApp(runtimeApp);
+                        setRuntime(runtime);
+                        console.log("[runtime] Agent runtime started");
+                      } catch (runtimeErr) {
+                        console.warn(`[runtime] Failed to start: ${runtimeErr.message}`);
+                      }
+                    }
+                    console.log("[engine] Eagerly initialized");
+                    try {
+                      const { lifecycle: lcRef } = await import("./routes-GYKER7K7.js");
+                      if (lcRef) {
+                        const agents = Array.from(lcRef.agents?.values?.() || []);
+                        const hasLocalPm2 = agents.some((a) => {
+                          const target = a?.config?.deployment?.target;
+                          const pm = a?.config?.deployment?.config?.local?.processManager;
+                          return target === "local" && (!pm || pm === "pm2");
+                        });
+                        if (hasLocalPm2) {
+                          const { ensurePm2 } = await import("./deployer-NKRPK6LJ.js");
+                          const pm2 = await ensurePm2();
+                          if (pm2.installed) {
+                            console.log(`[startup] PM2 v${pm2.version} available for local deployments`);
+                          } else {
+                            console.warn(`[startup] PM2 auto-install failed: ${pm2.error}`);
+                          }
+                        }
+                      }
+                    } catch {
+                    }
+                  }
+                }
+              } catch (e) {
+                console.warn(`[engine] Eager init failed: ${e.message}`);
+              }
+            })();
+            const shutdown = () => {
+              console.log("\n\u23F3 Shutting down gracefully...");
+              healthMonitor.stop();
+              server.close(() => {
+                config.db.disconnect().then(() => {
+                  console.log("\u2705 Shutdown complete");
+                  process.exit(0);
+                });
+              });
+              setTimeout(() => {
+                process.exit(1);
+              }, 1e4).unref();
+            };
+            process.on("SIGINT", shutdown);
+            process.on("SIGTERM", shutdown);
+            resolve({
+              close: () => {
+                healthMonitor.stop();
+                server.close();
+              }
+            });
+          }
+        );
+      });
+    }
+  };
+}
+export {
+  requestIdMiddleware,
+  requestLogger,
+  rateLimiter,
+  securityHeaders,
+  errorHandler,
+  ValidationError,
+  validate,
+  auditLogger,
+  requireRole,
+  createAdminRoutes,
+  createAuthRoutes,
+  createServer
+};