@agenticmail/enterprise 0.5.318 → 0.5.320

package/dist/{chunk-AQMSHJQT.js → chunk-DXZGPUAF.js}

@@ -11,7 +11,7 @@ import {
   init_config_bus,
   init_routes,
   routes_exports
-} from "./chunk-P3HVY2HS.js";
+} from "./chunk-C7HGQF4Y.js";
 import {
   CircuitBreaker,
   HealthMonitor,
@@ -34,7 +34,7 @@ import {
 import {
   init_transport_encryption,
   transportEncryptionMiddleware
-} from "./chunk-JGEVQZDR.js";
+} from "./chunk-FLQ5FLHW.js";
 import {
   SecureVault,
   init_vault
@@ -2015,7 +2015,7 @@ function createAdminRoutes(db) {
       await updateSettingsAndEmit({ securityConfig });
       if (securityConfig.transportEncryption) {
         try {
-          const { setTransportEncryptionConfig: setTransportEncryptionConfig2 } = await import("./transport-encryption-F2NQYACT.js");
+          const { setTransportEncryptionConfig: setTransportEncryptionConfig2 } = await import("./transport-encryption-2T7PIXKG.js");
           setTransportEncryptionConfig2(securityConfig.transportEncryption);
         } catch {
         }
@@ -3758,6 +3758,24 @@ function createAuthRoutes(db, jwtSecret, opts) {
       if (payload.type !== "refresh") return c.json({ error: "Invalid token type" }, 401);
       const user = await db.getUser(payload.sub);
       if (!user) return c.json({ error: "User not found" }, 401);
+      const currentSessionJwt = getCookie(c, COOKIE_NAME);
+      let impersonatedBy;
+      if (currentSessionJwt) {
+        try {
+          const { jwtVerify: jv } = await import("jose");
+          const { payload: sp } = await jv(currentSessionJwt, secret);
+          if (sp.impersonatedBy) impersonatedBy = sp.impersonatedBy;
+        } catch {
+        }
+      }
+      if (impersonatedBy) {
+        const { SignJWT: SJ } = await import("jose");
+        const impersonateToken = await new SJ({ sub: user.id, role: user.role, impersonatedBy, clientOrgId: user.clientOrgId || void 0, orgId: user.clientOrgId || user.org_id || void 0 }).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime("1h").sign(secret);
+        setCookie(c, COOKIE_NAME, impersonateToken, { path: "/", httpOnly: true, secure: isSecure(), sameSite: "Lax", maxAge: 3600 });
+        const csrf2 = generateCsrf();
+        setCookie(c, CSRF_COOKIE, csrf2, { ...cookieOpts(86400, isSecure()), httpOnly: false });
+        return c.json({ token: impersonateToken, csrf: csrf2 });
+      }
       const { token, refreshToken } = await issueTokens(user.id, user.email, user.role, user.clientOrgId);
       const csrf = generateCsrf();
       const secure = isSecure();
@@ -3797,7 +3815,7 @@ function createAuthRoutes(db, jwtSecret, opts) {
       const target = await db.getUser(targetId);
       if (!target) return c.json({ error: "User not found" }, 404);
       const impersonateToken = await new SignJWT({ sub: target.id, role: target.role, impersonatedBy: caller.id, clientOrgId: target.clientOrgId || void 0, orgId: target.clientOrgId || target.org_id || void 0 }).setProtectedHeader({ alg: "HS256" }).setIssuedAt().setExpirationTime("1h").sign(secret);
-      setCookie(c, "em_session", impersonateToken, { path: "/", httpOnly: true, secure: isSecure, sameSite: "Lax", maxAge: 3600 });
+      setCookie(c, "em_session", impersonateToken, { path: "/", httpOnly: true, secure: isSecure(), sameSite: "Lax", maxAge: 3600 });
       return c.json({
         token: impersonateToken,
         user: { id: target.id, email: target.email, name: target.name, role: target.role, totpEnabled: !!target.totpEnabled, clientOrgId: target.clientOrgId || null, permissions: target.permissions },
@@ -4611,14 +4629,14 @@ function createServer(config) {
   api.use("*", auditLogger(config.db));
   api.use("*", async (c, next) => {
     try {
-      const { transportEncryptionMiddleware: transportEncryptionMiddleware2 } = await import("./transport-encryption-F2NQYACT.js");
+      const { transportEncryptionMiddleware: transportEncryptionMiddleware2 } = await import("./transport-encryption-2T7PIXKG.js");
       const mw = transportEncryptionMiddleware2();
       return mw(c, next);
     } catch {
       return next();
     }
   });
-  import("./transport-encryption-F2NQYACT.js").then(({ setSettingsDb: setSettingsDb2, loadConfig: loadConfig2 }) => {
+  import("./transport-encryption-2T7PIXKG.js").then(({ setSettingsDb: setSettingsDb2, loadConfig: loadConfig2 }) => {
     setSettingsDb2(config.db);
     loadConfig2().catch(() => {
     });
@@ -4629,8 +4647,8 @@ function createServer(config) {
   let engineInitialized = false;
   api.all("/engine/*", async (c, next) => {
     try {
-      const { engineRoutes, setEngineDb } = await import("./routes-D7SMYOLT.js");
-      const { EngineDatabase } = await import("./db-adapter-IK2EDK2N.js");
+      const { engineRoutes, setEngineDb } = await import("./routes-ZEZZACZP.js");
+      const { EngineDatabase } = await import("./db-adapter-2T56ORSD.js");
       if (!engineInitialized) {
         engineInitialized = true;
         const engineDbInterface = config.db.getEngineDB();
@@ -4659,13 +4677,13 @@ function createServer(config) {
         engineInitialized = true;
         if (config.runtime?.enabled) {
           try {
-            const { createAgentRuntime } = await import("./runtime-K4C7NQLW.js");
-            const { mountRuntimeApp, setRuntime } = await import("./routes-D7SMYOLT.js");
+            const { createAgentRuntime } = await import("./runtime-5LP7PUD4.js");
+            const { mountRuntimeApp, setRuntime } = await import("./routes-ZEZZACZP.js");
             let getEmailConfig;
             let onTokenRefresh;
             let agentMemoryMgr;
             try {
-              const { lifecycle: lc, memoryManager: mm } = await import("./routes-D7SMYOLT.js");
+              const { lifecycle: lc, memoryManager: mm } = await import("./routes-ZEZZACZP.js");
               agentMemoryMgr = mm;
               if (lc) {
                 getEmailConfig = (agentId) => {
@@ -4704,7 +4722,7 @@ function createServer(config) {
               }
             } catch {
             }
-            const { vault: vaultRef, permissionEngine: permRef, databaseManager: dbMgr } = await import("./routes-D7SMYOLT.js");
+            const { vault: vaultRef, permissionEngine: permRef, databaseManager: dbMgr } = await import("./routes-ZEZZACZP.js");
             const runtime = createAgentRuntime({
               engineDb,
               adminDb: config.db,
@@ -4904,8 +4922,8 @@ function createServer(config) {
             });
             (async () => {
               try {
-                const { engineRoutes, setEngineDb } = await import("./routes-D7SMYOLT.js");
-                const { EngineDatabase } = await import("./db-adapter-IK2EDK2N.js");
+                const { engineRoutes, setEngineDb } = await import("./routes-ZEZZACZP.js");
+                const { EngineDatabase } = await import("./db-adapter-2T56ORSD.js");
                 if (!engineInitialized) {
                   engineInitialized = true;
                   const engineDbInterface = config.db.getEngineDB();
@@ -4928,13 +4946,13 @@ function createServer(config) {
                     await setEngineDb(engineDb, config.db);
                     if (config.runtime?.enabled) {
                       try {
-                        const { createAgentRuntime } = await import("./runtime-K4C7NQLW.js");
-                        const { mountRuntimeApp, setRuntime } = await import("./routes-D7SMYOLT.js");
+                        const { createAgentRuntime } = await import("./runtime-5LP7PUD4.js");
+                        const { mountRuntimeApp, setRuntime } = await import("./routes-ZEZZACZP.js");
                         let getEmailConfig;
                         let onTokenRefresh;
                         let agentMemoryMgr;
                         try {
-                          const { lifecycle: lc, memoryManager: mm } = await import("./routes-D7SMYOLT.js");
+                          const { lifecycle: lc, memoryManager: mm } = await import("./routes-ZEZZACZP.js");
                           agentMemoryMgr = mm;
                           if (lc) {
                             getEmailConfig = (agentId) => {
@@ -4973,7 +4991,7 @@ function createServer(config) {
                           }
                         } catch {
                         }
-                        const { vault: vaultRef2, permissionEngine: permRef2, databaseManager: dbMgr2 } = await import("./routes-D7SMYOLT.js");
+                        const { vault: vaultRef2, permissionEngine: permRef2, databaseManager: dbMgr2 } = await import("./routes-ZEZZACZP.js");
                         const runtime = createAgentRuntime({
                           engineDb,
                           adminDb: config.db,
@@ -4985,7 +5003,7 @@ function createServer(config) {
                           agentMemoryManager: agentMemoryMgr,
                           vault: vaultRef2,
                           permissionEngine: permRef2,
-                          hierarchyManager: (await import("./routes-D7SMYOLT.js")).hierarchyManager ?? void 0,
+                          hierarchyManager: (await import("./routes-ZEZZACZP.js")).hierarchyManager ?? void 0,
                           databaseManager: dbMgr2
                         });
                         await runtime.start();
@@ -4999,7 +5017,7 @@ function createServer(config) {
                     }
                     console.log("[engine] Eagerly initialized");
                     try {
-                      const { lifecycle: lcRef } = await import("./routes-D7SMYOLT.js");
+                      const { lifecycle: lcRef } = await import("./routes-ZEZZACZP.js");
                       if (lcRef) {
                         const agents = Array.from(lcRef.agents?.values?.() || []);
                         const hasLocalPm2 = agents.some((a) => {