@agenticmail/enterprise 0.5.326 → 0.5.328

package/src/domain-lock/cli-verify.ts

@@ -1,190 +0,0 @@
-/**
- * CLI Command: verify-domain
- *
- * Check DNS verification status for a registered domain.
- * Asks the central registry to resolve the TXT record.
- *
- * Usage:
- *   npx @agenticmail/enterprise verify-domain
- *   npx @agenticmail/enterprise verify-domain --domain agents.acme.com
- *   npx @agenticmail/enterprise verify-domain --poll     (retry every 10s for 5 attempts)
- *
- * Environment:
- *   DATABASE_URL    — Auto-detected if set
- */
-
-import { DomainLock } from './index.js';
-
-function getFlag(args: string[], name: string): string | undefined {
-  const idx = args.indexOf(name);
-  if (idx !== -1 && args[idx + 1]) return args[idx + 1];
-  return undefined;
-}
-
-function hasFlag(args: string[], name: string): boolean {
-  return args.includes(name);
-}
-
-function detectDbType(url: string): string {
-  const u = url.toLowerCase().trim();
-  if (u.startsWith('postgres') || u.startsWith('pg:')) return 'postgres';
-  if (u.startsWith('mysql')) return 'mysql';
-  if (u.startsWith('mongodb')) return 'mongodb';
-  if (u.startsWith('libsql') || u.includes('.turso.io')) return 'turso';
-  if (u.endsWith('.db') || u.endsWith('.sqlite') || u.endsWith('.sqlite3') || u.startsWith('file:')) return 'sqlite';
-  return 'postgres';
-}
-
-export async function runVerifyDomain(args: string[]): Promise<void> {
-  const { default: chalk } = await import('chalk');
-  const { default: ora } = await import('ora');
-
-  console.log('');
-  console.log(chalk.bold('  AgenticMail Enterprise — Domain Verification'));
-  console.log('');
-
-  // ═══════════════════════════════════════════════════
-  // Connect to database (for reading domain + updating status)
-  // ═══════════════════════════════════════════════════
-
-  let domain = getFlag(args, '--domain');
-  let dnsChallenge: string | undefined;
-  let db: any = null;
-  let dbConnected = false;
-
-  // Auto-detect from DATABASE_URL
-  const envDbUrl = process.env.DATABASE_URL;
-  if (envDbUrl) {
-    const dbType = detectDbType(envDbUrl);
-    const spinner = ora(`Connecting to database (${dbType})...`).start();
-    try {
-      const { createAdapter } = await import('../db/factory.js');
-      db = await createAdapter({ type: dbType as any, connectionString: envDbUrl });
-      await db.migrate();
-      const settings = await db.getSettings();
-      if (!domain && settings?.domain) domain = settings.domain;
-      if (settings?.domainDnsChallenge) dnsChallenge = settings.domainDnsChallenge;
-      dbConnected = true;
-      spinner.succeed(`Connected to ${dbType} database` + (domain ? ` (domain: ${domain})` : ''));
-    } catch (err: any) {
-      spinner.warn(`Could not connect via DATABASE_URL: ${err.message}`);
-      db = null;
-    }
-  }
-
-  // Try --db flag fallback
-  if (!dbConnected) {
-    const dbPath = getFlag(args, '--db');
-    const dbType = getFlag(args, '--db-type') || 'sqlite';
-    if (dbPath) {
-      const spinner = ora(`Connecting to ${dbType} database...`).start();
-      try {
-        const { createAdapter } = await import('../db/factory.js');
-        db = await createAdapter({ type: dbType as any, connectionString: dbPath });
-        await db.migrate();
-        const settings = await db.getSettings();
-        if (!domain && settings?.domain) domain = settings.domain;
-        if (settings?.domainDnsChallenge) dnsChallenge = settings.domainDnsChallenge;
-        dbConnected = true;
-        spinner.succeed(`Connected to ${dbType} database`);
-      } catch {
-        spinner.warn('Could not read local database');
-      }
-    }
-  }
-
-  // If still no domain, prompt
-  if (!domain) {
-    const { default: inquirer } = await import('inquirer');
-    const answer = await inquirer.prompt([{
-      type: 'input',
-      name: 'domain',
-      message: 'Domain to verify:',
-      suffix: chalk.dim('  (e.g. agents.yourcompany.com)'),
-      validate: (v: string) => v.includes('.') || 'Enter a valid domain',
-      filter: (v: string) => v.trim().toLowerCase(),
-    }]);
-    domain = answer.domain;
-  }
-
-  // ═══════════════════════════════════════════════════
-  // Check verification (with optional polling)
-  // ═══════════════════════════════════════════════════
-
-  const lock = new DomainLock();
-  const maxAttempts = hasFlag(args, '--poll') ? 5 : 1;
-
-  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
-    const spinner = ora(
-      maxAttempts > 1
-        ? `Checking DNS verification (attempt ${attempt}/${maxAttempts})...`
-        : 'Checking DNS verification...'
-    ).start();
-
-    try {
-      const result = await lock.checkVerification(domain!);
-
-      if (!result.success) {
-        spinner.fail('Verification check failed');
-        console.log('');
-        console.error(chalk.red(`  ${result.error}`));
-        console.log('');
-        if (db) await db.disconnect();
-        process.exit(1);
-      }
-
-      if (result.verified) {
-        spinner.succeed('Domain verified!');
-
-        // Update database
-        if (dbConnected && db) {
-          try {
-            await db.updateSettings({
-              domainStatus: 'verified',
-              domainVerifiedAt: new Date().toISOString(),
-            } as any);
-            console.log(chalk.dim('  Database updated with verified status.'));
-          } catch { /* non-critical */ }
-        }
-
-        console.log('');
-        console.log(chalk.green.bold(`  ✓ ${domain} is verified and protected.`));
-        console.log(chalk.dim('  Your deployment domain is locked. No other instance can claim it.'));
-        console.log(chalk.dim('  The system now operates 100% offline — no outbound calls are made.'));
-        console.log('');
-
-        if (db) await db.disconnect();
-        return;
-      }
-    } catch (err: any) {
-      spinner.warn(`Check failed: ${err.message}`);
-    }
-
-    if (attempt < maxAttempts) {
-      const waitSpinner = ora(`DNS record not found yet. Retrying in 10 seconds...`).start();
-      await new Promise(r => setTimeout(r, 10_000));
-      waitSpinner.stop();
-    }
-  }
-
-  // Not verified
-  console.log('');
-  console.log(chalk.yellow('  DNS record not detected yet.'));
-  console.log('');
-  console.log(chalk.bold('  Make sure this TXT record exists at your DNS provider:'));
-  console.log('');
-  console.log(`  ${chalk.bold('Host:')}   ${chalk.cyan(`_agenticmail-verify.${domain}`)}`);
-  console.log(`  ${chalk.bold('Type:')}   ${chalk.cyan('TXT')}`);
-  if (dnsChallenge) {
-    console.log(`  ${chalk.bold('Value:')}  ${chalk.cyan(dnsChallenge)}`);
-  } else {
-    console.log(`  ${chalk.bold('Value:')}  ${chalk.dim('(check your dashboard or setup output)')}`);
-  }
-  console.log('');
-  console.log(chalk.dim('  DNS propagation can take up to 48 hours.'));
-  console.log(chalk.dim('  Run with --poll to retry automatically:'));
-  console.log(chalk.dim(`    npx @agenticmail/enterprise verify-domain --domain ${domain} --poll`));
-  console.log('');
-
-  if (db) await db.disconnect();
-}

package/src/domain-lock/index.ts

@@ -1,220 +0,0 @@
-/**
- * DomainLock — Enterprise Domain Registration & Verification
- *
- * Protects enterprise deployments by ensuring domain uniqueness.
- * Communicates with the AgenticMail central registry for:
- *   1. Domain registration (one-time, during setup)
- *   2. DNS verification (one-time, after DNS TXT record is added)
- *   3. Recovery (if system is lost, re-register on a new machine)
- *
- * After verification, the system operates 100% offline.
- */
-
-import { randomBytes } from 'crypto';
-
-const REGISTRY_BASE_URL = process.env.AGENTICMAIL_REGISTRY_URL
-  || 'https://agenticmail.io/enterprise/v1';
-
-// ─── Types ──────────────────────────────────────────────
-
-export interface RegistrationResult {
-  success: boolean;
-  registrationId?: string;
-  dnsChallenge?: string;
-  error?: string;
-  /** HTTP status code from registry (e.g. 409 = domain already taken) */
-  statusCode?: number;
-}
-
-export interface VerificationResult {
-  success: boolean;
-  verified?: boolean;
-  error?: string;
-}
-
-export interface RecoveryResult {
-  success: boolean;
-  dnsChallenge?: string;
-  registrationId?: string;
-  error?: string;
-}
-
-export interface DomainStatus {
-  domain: string | null;
-  status: 'unregistered' | 'pending_dns' | 'verified' | 'failed';
-  registeredAt: string | null;
-  verifiedAt: string | null;
-  dnsChallenge: string | null;
-}
-
-// ─── DomainLock Client ──────────────────────────────────
-
-export class DomainLock {
-  private registryUrl: string;
-
-  constructor(opts?: { registryUrl?: string }) {
-    this.registryUrl = (opts?.registryUrl || REGISTRY_BASE_URL).replace(/\/$/, '');
-  }
-
-  /**
-   * Generate a 256-bit deployment key.
-   * Returns the plaintext (hex) and its bcrypt hash.
-   * The plaintext should be shown to the user ONCE and never stored.
-   */
-  async generateDeploymentKey(): Promise<{ plaintext: string; hash: string }> {
-    const { default: bcrypt } = await import('bcryptjs');
-    const plaintext = randomBytes(32).toString('hex'); // 64-char hex
-    const hash = await bcrypt.hash(plaintext, 12);
-    return { plaintext, hash };
-  }
-
-  /**
-   * Register a domain with the central registry.
-   * Called during setup wizard Step 5.
-   *
-   * @param domain - The domain to register (e.g. "agents.agenticmail.io")
-   * @param keyHash - bcrypt hash of the deployment key
-   * @param opts - Optional org name and contact email
-   */
-  async register(
-    domain: string,
-    keyHash: string,
-    opts?: { orgName?: string; contactEmail?: string },
-  ): Promise<RegistrationResult> {
-    try {
-      const res = await fetch(`${this.registryUrl}/domains/register`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-          domain: domain.toLowerCase().trim(),
-          keyHash,
-          orgName: opts?.orgName,
-          contactEmail: opts?.contactEmail,
-        }),
-        signal: AbortSignal.timeout(15_000),
-      });
-
-      const data = await res.json().catch(() => ({})) as any;
-
-      if (res.status === 409) {
-        return {
-          success: false,
-          error: data.error || 'Domain is already registered and verified. Use "recover" if this is your domain.',
-          statusCode: 409,
-        };
-      }
-
-      if (!res.ok) {
-        return {
-          success: false,
-          error: data.error || `Registration failed (HTTP ${res.status})`,
-          statusCode: res.status,
-        };
-      }
-
-      return {
-        success: true,
-        registrationId: data.registrationId,
-        dnsChallenge: data.dnsChallenge,
-      };
-    } catch (err: any) {
-      if (err.name === 'TimeoutError' || err.name === 'AbortError') {
-        return { success: false, error: 'Registry server unreachable (timeout). You can retry later or continue without registration.' };
-      }
-      return { success: false, error: `Registry connection failed: ${err.message}` };
-    }
-  }
-
-  /**
-   * Ask the registry to check DNS verification for a domain.
-   * The registry resolves _agenticmail-verify.<domain> TXT record.
-   */
-  async checkVerification(domain: string): Promise<VerificationResult> {
-    try {
-      const res = await fetch(`${this.registryUrl}/domains/verify`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ domain: domain.toLowerCase().trim() }),
-        signal: AbortSignal.timeout(15_000),
-      });
-
-      const data = await res.json().catch(() => ({})) as any;
-
-      if (!res.ok) {
-        return { success: false, error: data.error || `Verification check failed (HTTP ${res.status})` };
-      }
-
-      return {
-        success: true,
-        verified: data.verified === true,
-        error: data.verified ? undefined : (data.error || 'DNS record not found yet'),
-      };
-    } catch (err: any) {
-      if (err.name === 'TimeoutError' || err.name === 'AbortError') {
-        return { success: false, error: 'Registry server unreachable (timeout)' };
-      }
-      return { success: false, error: `Registry connection failed: ${err.message}` };
-    }
-  }
-
-  /**
-   * Recover a domain registration on a new machine.
-   * Requires the original deployment key (plaintext).
-   * The registry verifies via bcrypt.compare against stored hash.
-   * On success, a new DNS challenge is issued (must re-verify DNS).
-   */
-  async recover(domain: string, deploymentKey: string): Promise<RecoveryResult> {
-    try {
-      const res = await fetch(`${this.registryUrl}/domains/recover`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-          domain: domain.toLowerCase().trim(),
-          deploymentKey,
-        }),
-        signal: AbortSignal.timeout(15_000),
-      });
-
-      const data = await res.json().catch(() => ({})) as any;
-
-      if (res.status === 403) {
-        return { success: false, error: 'Invalid deployment key. The key does not match the registered domain.' };
-      }
-
-      if (res.status === 404) {
-        return { success: false, error: 'Domain is not registered. Use setup wizard to register first.' };
-      }
-
-      if (!res.ok) {
-        return { success: false, error: data.error || `Recovery failed (HTTP ${res.status})` };
-      }
-
-      return {
-        success: true,
-        dnsChallenge: data.dnsChallenge,
-        registrationId: data.registrationId,
-      };
-    } catch (err: any) {
-      if (err.name === 'TimeoutError' || err.name === 'AbortError') {
-        return { success: false, error: 'Registry server unreachable (timeout)' };
-      }
-      return { success: false, error: `Registry connection failed: ${err.message}` };
-    }
-  }
-
-  /**
-   * Check domain status on the registry (public, read-only).
-   */
-  async getRemoteStatus(domain: string): Promise<{ registered: boolean; verified: boolean } | null> {
-    try {
-      const res = await fetch(
-        `${this.registryUrl}/domains/${encodeURIComponent(domain.toLowerCase().trim())}/status`,
-        { signal: AbortSignal.timeout(10_000) },
-      );
-      if (!res.ok) return null;
-      return await res.json() as { registered: boolean; verified: boolean };
-    } catch {
-      return null;
-    }
-  }
-}

package/src/engine/activity-routes.ts

@@ -1,154 +0,0 @@
-/**
- * Activity + Monitoring + Engine Stats Routes
- * Mounted at / on the engine sub-app (routes define /activity/*, /stats/*).
- */
-
-import { Hono } from 'hono';
-import type { ActivityTracker } from './activity.js';
-import type { TenantManager } from './tenant.js';
-import type { AgentLifecycleManager } from './lifecycle.js';
-
-export function createActivityRoutes(opts: {
-  activity: ActivityTracker;
-  tenants: TenantManager;
-  lifecycle: AgentLifecycleManager;
-}) {
-  const { activity, tenants, lifecycle } = opts;
-  const router = new Hono();
-
-  // ─── Activity & Monitoring ──────────────────────────────
-
-  router.get('/activity/events', (c) => {
-    const limit = parseInt(c.req.query('limit') || '50');
-    const offset = parseInt(c.req.query('offset') || '0');
-    const typeFilter = c.req.query('type') || undefined;
-    const allEvents = activity.getEvents({
-      agentId: c.req.query('agentId') || undefined,
-      orgId: c.req.query('orgId') || undefined,
-      since: c.req.query('since') || undefined,
-      types: typeFilter ? [typeFilter as any] : undefined,
-      limit: 10000, // get all matching, paginate below
-    });
-    const search = (c.req.query('search') || '').toLowerCase();
-    const filtered = search
-      ? allEvents.filter(e => (e.type || '').toLowerCase().includes(search) || JSON.stringify(e.data || '').toLowerCase().includes(search))
-      : allEvents;
-    return c.json({ events: filtered.slice(offset, offset + limit), total: filtered.length });
-  });
-
-  router.get('/activity/tool-calls', (c) => {
-    const limit = parseInt(c.req.query('limit') || '50');
-    const offset = parseInt(c.req.query('offset') || '0');
-    const allCalls = activity.getToolCalls({
-      agentId: c.req.query('agentId') || undefined,
-      orgId: c.req.query('orgId') || undefined,
-      toolId: c.req.query('toolId') || undefined,
-      limit: 10000,
-    });
-    const search = (c.req.query('search') || '').toLowerCase();
-    const filtered = search
-      ? allCalls.filter(tc => (tc.toolId || (tc as any).tool || '').toLowerCase().includes(search))
-      : allCalls;
-    return c.json({ toolCalls: filtered.slice(offset, offset + limit), total: filtered.length });
-  });
-
-  router.get('/activity/conversation/:sessionId', async (c) => {
-    const entries = await activity.getConversation(c.req.param('sessionId'));
-    return c.json({ entries, total: entries.length });
-  });
-
-  router.get('/activity/timeline/:agentId/:date', (c) => {
-    const timeline = activity.getTimeline(c.req.param('agentId'), c.req.param('date'));
-    return c.json({ timeline });
-  });
-
-  router.get('/activity/stats', (c) => {
-    const orgId = c.req.query('orgId');
-    return c.json(activity.getStats(orgId || undefined));
-  });
-
-  // SSE endpoint for real-time events
-  router.get('/activity/stream', (c) => {
-    const orgId = c.req.query('orgId');
-    const agentId = c.req.query('agentId');
-
-    const stream = new ReadableStream({
-      start(controller) {
-        const encoder = new TextEncoder();
-        const send = (data: string) => {
-          try { controller.enqueue(encoder.encode(`data: ${data}\n\n`)); }
-          catch { unsubscribe(); }
-        };
-
-        // Send heartbeat every 30s
-        const heartbeat = setInterval(() => send(JSON.stringify({ type: 'heartbeat' })), 30_000);
-
-        const unsubscribe = activity.subscribe((event) => {
-          if (orgId && event.orgId !== orgId) return;
-          if (agentId && event.agentId !== agentId) return;
-          send(JSON.stringify(event));
-        });
-
-        // Cleanup on close
-        c.req.raw.signal.addEventListener('abort', () => {
-          unsubscribe();
-          clearInterval(heartbeat);
-        });
-      },
-    });
-
-    return new Response(stream, {
-      headers: {
-        'Content-Type': 'text/event-stream',
-        'Cache-Control': 'no-cache',
-        'Connection': 'keep-alive',
-      },
-    });
-  });
-
-  // ─── Knowledge Contributions (org_knowledge memories) ───
-
-  router.get('/activity/knowledge-contributions', async (c) => {
-    const orgId = c.req.query('orgId');
-    const agentId = c.req.query('agentId');
-    const limit = parseInt(c.req.query('limit') || '50');
-    const offset = parseInt(c.req.query('offset') || '0');
-    try {
-      const db = (activity as any).engineDb;
-      if (!db) return c.json({ contributions: [], total: 0 });
-      let where = "WHERE category = 'org_knowledge'";
-      const params: any[] = [];
-      if (orgId) { params.push(orgId); where += ` AND org_id = $${params.length}`; }
-      if (agentId) { params.push(agentId); where += ` AND agent_id = $${params.length}`; }
-      const countResult = await db.db.get(`SELECT COUNT(*) as c FROM agent_memory ${where}`, params);
-      const total = parseInt(countResult?.c || '0');
-      params.push(limit, offset);
-      const rows = await db.db.all(`SELECT * FROM agent_memory ${where} ORDER BY created_at DESC LIMIT $${params.length - 1} OFFSET $${params.length}`, params);
-      return c.json({ contributions: rows || [], total });
-    } catch (e: any) {
-      return c.json({ contributions: [], total: 0, error: e.message });
-    }
-  });
-
-  // ─── Engine Stats (Dashboard Overview) ──────────────────
-
-  router.get('/stats/:orgId', (c) => {
-    const orgId = c.req.param('orgId');
-    const org = tenants.getOrg(orgId);
-    const agents = lifecycle.getAgentsByOrg(orgId);
-    const orgUsage = lifecycle.getOrgUsage(orgId);
-    const realTimeStats = activity.getStats(orgId);
-
-    return c.json({
-      org: org ? { name: org.name, plan: org.plan, limits: org.limits, usage: org.usage } : null,
-      agents: {
-        total: agents.length,
-        byState: agents.reduce((acc, a) => { acc[a.state] = (acc[a.state] || 0) + 1; return acc; }, {} as Record<string, number>),
-      },
-      usage: orgUsage,
-      realTime: realTimeStats,
-    });
-  });
-
-  return router;
-}