@agenticmail/enterprise 0.5.326 → 0.5.328

package/src/index.ts

@@ -1,77 +0,0 @@
-/**
- * AgenticMail Enterprise
- * 
- * Cloud-hosted AI agent identity, email, auth & compliance for organizations.
- * 
- * @example
- * ```ts
- * import { createAdapter, createServer } from '@agenticmail/enterprise';
- * 
- * const db = await createAdapter({ type: 'postgres', connectionString: '...' });
- * await db.migrate();
- * 
- * const server = createServer({ port: 3000, db, jwtSecret: '...' });
- * await server.start();
- * ```
- */
-
-// Database
-export { DatabaseAdapter } from './db/adapter.js';
-export type {
-  DatabaseConfig, DatabaseType,
-  Agent, AgentInput, User, UserInput,
-  AuditEvent, AuditFilters, ApiKey, ApiKeyInput,
-  EmailRule, RetentionPolicy, CompanySettings,
-} from './db/adapter.js';
-export { createAdapter, getSupportedDatabases } from './db/factory.js';
-
-// Server
-export { createServer } from './server.js';
-export type { ServerConfig, ServerInstance } from './server.js';
-
-// Deploy
-export { deployToCloud, generateDockerCompose, generateEnvFile, generateFlyToml } from './deploy/managed.js';
-
-// Routes (for custom server setups)
-export { createAdminRoutes } from './admin/routes.js';
-export { createAuthRoutes } from './auth/routes.js';
-
-// Middleware (for extending the server)
-export {
-  requestIdMiddleware,
-  requestLogger,
-  rateLimiter,
-  securityHeaders,
-  errorHandler,
-  auditLogger,
-  requireRole,
-  validate,
-  ValidationError,
-} from './middleware/index.js';
-
-// Setup Wizard
-export { runSetupWizard, provision } from './setup/index.js';
-export type { CompanyInfo, DatabaseSelection, DeployTarget, DomainSelection, ProvisionConfig, ProvisionResult } from './setup/index.js';
-
-// Engine (managed agent deployment platform)
-export * from './engine/index.js';
-
-// Resilience (for custom integrations)
-export {
-  withRetry,
-  CircuitBreaker,
-  RateLimiter,
-  KeyedRateLimiter,
-  HealthMonitor,
-  CircuitOpenError,
-} from './lib/resilience.js';
-export type { RetryOptions, CircuitBreakerOptions, RateLimiterOptions, HealthCheckOptions } from './lib/resilience.js';
-
-// AgenticMail Enterprise (embedded email for agents)
-export { AgenticMailManager } from './agenticmail/index.js';
-export type { AgentEmailIdentity, EmailProvider, IEmailProvider } from './agenticmail/index.js';
-export { createEmailProvider, MicrosoftEmailProvider, GoogleEmailProvider } from './agenticmail/index.js';
-
-// Agent Runtime (standalone agent execution)
-export { AgentRuntime, createAgentRuntime } from './runtime/index.js';
-export type { AgentConfig, SessionState, StreamEvent, RuntimeConfig, ModelConfig, SpawnOptions } from './runtime/types.js';

package/src/lib/cidr.ts

@@ -1,122 +0,0 @@
-/**
- * AgenticMail Enterprise — IPv4 CIDR Matching Utilities
- *
- * Pure functions for parsing and matching IPs against CIDR ranges.
- * Used by the firewall middleware for IP access control and trusted proxy validation.
- */
-
-/** Parsed CIDR with pre-computed numeric values for fast matching. */
-export interface ParsedCidr {
-  network: number;
-  mask: number;
-  original: string;
-}
-
-/**
- * Convert an IPv4 address string to a 32-bit unsigned integer.
- * Handles IPv4-mapped IPv6 (::ffff:x.x.x.x).
- * Returns null for invalid or non-IPv4 addresses.
- */
-export function ipToNumber(ip: string): number | null {
-  if (!ip) return null;
-  // Strip IPv4-mapped IPv6 prefix
-  let cleaned = ip.trim();
-  if (cleaned.startsWith('::ffff:')) cleaned = cleaned.slice(7);
-  // Must be IPv4 dotted-quad
-  const parts = cleaned.split('.');
-  if (parts.length !== 4) return null;
-  let num = 0;
-  for (let i = 0; i < 4; i++) {
-    const octet = parseInt(parts[i], 10);
-    if (isNaN(octet) || octet < 0 || octet > 255) return null;
-    num = (num << 8) | octet;
-  }
-  return num >>> 0; // Ensure unsigned
-}
-
-/**
- * Parse a CIDR string (e.g., "10.0.0.0/8") into a pre-computed matcher.
- * Plain IPs (e.g., "192.168.1.1") are treated as /32.
- * Returns null for invalid input.
- */
-export function parseCidr(cidr: string): ParsedCidr | null {
-  if (!cidr) return null;
-  const trimmed = cidr.trim();
-  const slashIdx = trimmed.indexOf('/');
-  let ip: string;
-  let prefix: number;
-
-  if (slashIdx === -1) {
-    ip = trimmed;
-    prefix = 32;
-  } else {
-    ip = trimmed.slice(0, slashIdx);
-    prefix = parseInt(trimmed.slice(slashIdx + 1), 10);
-    if (isNaN(prefix) || prefix < 0 || prefix > 32) return null;
-  }
-
-  const num = ipToNumber(ip);
-  if (num === null) return null;
-
-  // Build the mask: prefix=8 → 0xFF000000, prefix=32 → 0xFFFFFFFF, prefix=0 → 0x00000000
-  const mask = prefix === 0 ? 0 : (~0 << (32 - prefix)) >>> 0;
-  const network = (num & mask) >>> 0;
-
-  return { network, mask, original: trimmed };
-}
-
-/**
- * Test whether an IP address matches a parsed CIDR range.
- */
-export function ipMatchesCidr(ip: string, cidr: ParsedCidr): boolean {
-  const num = ipToNumber(ip);
-  if (num === null) return false;
-  return ((num & cidr.mask) >>> 0) === cidr.network;
-}
-
-/**
- * Compile a list of IP/CIDR strings into a fast matcher function.
- * Pre-parses all entries so per-request matching is O(n) comparisons with no parsing.
- * Invalid entries are silently skipped.
- */
-export function compileIpMatcher(entries: string[]): (ip: string) => boolean {
-  const parsed: ParsedCidr[] = [];
-  for (const entry of entries) {
-    const p = parseCidr(entry);
-    if (p) parsed.push(p);
-  }
-  if (parsed.length === 0) return () => false;
-
-  return function matchIp(ip: string): boolean {
-    const num = ipToNumber(ip);
-    if (num === null) return false;
-    for (let i = 0; i < parsed.length; i++) {
-      if (((num & parsed[i].mask) >>> 0) === parsed[i].network) return true;
-    }
-    return false;
-  };
-}
-
-/**
- * Validate that a string is a valid IPv4 address or CIDR notation.
- */
-export function isValidIpOrCidr(str: string): boolean {
-  return parseCidr(str) !== null;
-}
-
-/**
- * Match a hostname against a pattern that may include wildcards.
- * Supports: "*.example.com" matching "api.example.com", "sub.api.example.com"
- * Exact match: "example.com" only matches "example.com"
- */
-export function hostMatchesPattern(host: string, pattern: string): boolean {
-  if (!host || !pattern) return false;
-  const h = host.toLowerCase().trim();
-  const p = pattern.toLowerCase().trim();
-  if (p === h) return true;
-  if (p.startsWith('*.')) {
-    const suffix = p.slice(1); // ".example.com"
-    return h.endsWith(suffix) || h === p.slice(2);
-  }
-  return false;
-}

package/src/lib/config-store.ts

@@ -1,86 +0,0 @@
-/**
- * Encrypted Config Storage
- *
- * Stores database credentials in an encrypted file (.agenticmail.enc)
- * using AES-256-GCM with scrypt key derivation from a master secret.
- *
- * Format: JSON { iv, tag, salt, data } (all base64)
- */
-
-import { scryptSync, randomBytes, createCipheriv, createDecipheriv } from 'crypto';
-import { readFileSync, writeFileSync, existsSync } from 'fs';
-import { join } from 'path';
-
-const CONFIG_FILE = '.agenticmail.enc';
-const ALGORITHM = 'aes-256-gcm';
-const SCRYPT_KEYLEN = 32;
-const SCRYPT_PARAMS = { N: 16384, r: 8, p: 1 };
-
-function deriveKey(secret: string, salt: Buffer): Buffer {
-  return scryptSync(secret, salt, SCRYPT_KEYLEN, SCRYPT_PARAMS);
-}
-
-function getConfigPath(): string {
-  return join(process.cwd(), CONFIG_FILE);
-}
-
-export interface DatabaseConfigEntry {
-  type: string;
-  host?: string;
-  port?: number;
-  database?: string;
-  username?: string;
-  password?: string;
-  connectionString?: string;
-  ssl?: boolean;
-  authToken?: string;
-  region?: string;
-  accessKeyId?: string;
-  secretAccessKey?: string;
-}
-
-export async function saveDbConfig(config: DatabaseConfigEntry, secret: string): Promise<void> {
-  const salt = randomBytes(16);
-  const key = deriveKey(secret, salt);
-  const iv = randomBytes(12);
-
-  const cipher = createCipheriv(ALGORITHM, key, iv);
-  const plaintext = JSON.stringify(config);
-  const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
-  const tag = cipher.getAuthTag();
-
-  const payload = {
-    iv: iv.toString('base64'),
-    tag: tag.toString('base64'),
-    salt: salt.toString('base64'),
-    data: encrypted.toString('base64'),
-  };
-
-  writeFileSync(getConfigPath(), JSON.stringify(payload, null, 2), 'utf-8');
-}
-
-export async function loadDbConfig(secret: string): Promise<DatabaseConfigEntry | null> {
-  const path = getConfigPath();
-  if (!existsSync(path)) return null;
-
-  try {
-    const raw = JSON.parse(readFileSync(path, 'utf-8'));
-    const salt = Buffer.from(raw.salt, 'base64');
-    const iv = Buffer.from(raw.iv, 'base64');
-    const tag = Buffer.from(raw.tag, 'base64');
-    const data = Buffer.from(raw.data, 'base64');
-
-    const key = deriveKey(secret, salt);
-    const decipher = createDecipheriv(ALGORITHM, key, iv);
-    decipher.setAuthTag(tag);
-
-    const decrypted = Buffer.concat([decipher.update(data), decipher.final()]);
-    return JSON.parse(decrypted.toString('utf-8'));
-  } catch {
-    return null;
-  }
-}
-
-export function configFileExists(): boolean {
-  return existsSync(getConfigPath());
-}

package/src/lib/resilience.ts

@@ -1,326 +0,0 @@
-/**
- * Resilience Utilities
- * 
- * Retry logic, circuit breakers, connection health checks,
- * rate limiting, and graceful degradation patterns.
- */
-
-// ─── Retry with Exponential Backoff ──────────────────────
-
-export interface RetryOptions {
-  maxAttempts: number;
-  baseDelayMs: number;
-  maxDelayMs: number;
-  backoffMultiplier: number;
-  retryableErrors?: (err: Error) => boolean;
-  onRetry?: (attempt: number, err: Error, delayMs: number) => void;
-}
-
-const DEFAULT_RETRY: RetryOptions = {
-  maxAttempts: 3,
-  baseDelayMs: 500,
-  maxDelayMs: 30_000,
-  backoffMultiplier: 2,
-};
-
-export async function withRetry<T>(
-  fn: () => Promise<T>,
-  opts: Partial<RetryOptions> = {},
-): Promise<T> {
-  const config = { ...DEFAULT_RETRY, ...opts };
-  let lastError: Error = new Error('No attempts made');
-
-  for (let attempt = 1; attempt <= config.maxAttempts; attempt++) {
-    try {
-      return await fn();
-    } catch (err: any) {
-      lastError = err;
-
-      if (attempt === config.maxAttempts) break;
-      if (config.retryableErrors && !config.retryableErrors(err)) break;
-
-      // Exponential backoff with jitter
-      const delay = Math.min(
-        config.baseDelayMs * Math.pow(config.backoffMultiplier, attempt - 1) + Math.random() * 200,
-        config.maxDelayMs,
-      );
-
-      config.onRetry?.(attempt, err, delay);
-      await sleep(delay);
-    }
-  }
-
-  throw lastError;
-}
-
-// ─── Circuit Breaker ─────────────────────────────────────
-
-export type CircuitState = 'closed' | 'open' | 'half-open';
-
-export interface CircuitBreakerOptions {
-  failureThreshold: number;    // Failures before opening
-  recoveryTimeMs: number;      // Time before half-open
-  successThreshold: number;    // Successes in half-open to close
-  timeout?: number;            // Per-call timeout in ms
-}
-
-export class CircuitBreaker {
-  private state: CircuitState = 'closed';
-  private failures = 0;
-  private successes = 0;
-  private lastFailureTime = 0;
-  private readonly opts: CircuitBreakerOptions;
-
-  constructor(opts: Partial<CircuitBreakerOptions> = {}) {
-    this.opts = {
-      failureThreshold: opts.failureThreshold ?? 5,
-      recoveryTimeMs: opts.recoveryTimeMs ?? 30_000,
-      successThreshold: opts.successThreshold ?? 2,
-      timeout: opts.timeout,
-    };
-  }
-
-  async execute<T>(fn: () => Promise<T>): Promise<T> {
-    if (this.state === 'open') {
-      if (Date.now() - this.lastFailureTime >= this.opts.recoveryTimeMs) {
-        this.state = 'half-open';
-        this.successes = 0;
-      } else {
-        throw new CircuitOpenError(
-          `Circuit breaker is open. Retry after ${this.opts.recoveryTimeMs}ms`,
-        );
-      }
-    }
-
-    try {
-      const result = this.opts.timeout
-        ? await withTimeout(fn(), this.opts.timeout)
-        : await fn();
-
-      this.onSuccess();
-      return result;
-    } catch (err) {
-      this.onFailure();
-      throw err;
-    }
-  }
-
-  private onSuccess(): void {
-    if (this.state === 'half-open') {
-      this.successes++;
-      if (this.successes >= this.opts.successThreshold) {
-        this.state = 'closed';
-        this.failures = 0;
-      }
-    } else {
-      this.failures = 0;
-    }
-  }
-
-  private onFailure(): void {
-    this.failures++;
-    this.lastFailureTime = Date.now();
-    if (this.failures >= this.opts.failureThreshold) {
-      this.state = 'open';
-    }
-  }
-
-  getState(): CircuitState { return this.state; }
-  reset(): void { this.state = 'closed'; this.failures = 0; this.successes = 0; }
-}
-
-export class CircuitOpenError extends Error {
-  constructor(message: string) {
-    super(message);
-    this.name = 'CircuitOpenError';
-  }
-}
-
-// ─── Rate Limiter (Token Bucket) ─────────────────────────
-
-export interface RateLimiterOptions {
-  maxTokens: number;           // Bucket capacity
-  refillRate: number;          // Tokens per second
-  refillIntervalMs?: number;   // How often to refill (default: 1000)
-}
-
-export class RateLimiter {
-  private tokens: number;
-  private lastRefill: number;
-  private readonly opts: Required<RateLimiterOptions>;
-
-  constructor(opts: RateLimiterOptions) {
-    this.opts = {
-      maxTokens: opts.maxTokens,
-      refillRate: opts.refillRate,
-      refillIntervalMs: opts.refillIntervalMs ?? 1000,
-    };
-    this.tokens = this.opts.maxTokens;
-    this.lastRefill = Date.now();
-  }
-
-  /**
-   * Try to consume a token. Returns true if allowed, false if rate limited.
-   */
-  tryConsume(count = 1): boolean {
-    this.refill();
-    if (this.tokens >= count) {
-      this.tokens -= count;
-      return true;
-    }
-    return false;
-  }
-
-  /**
-   * Get time in ms until next token is available.
-   */
-  getRetryAfterMs(): number {
-    this.refill();
-    if (this.tokens >= 1) return 0;
-    const tokensNeeded = 1 - this.tokens;
-    return Math.ceil((tokensNeeded / this.opts.refillRate) * 1000);
-  }
-
-  private refill(): void {
-    const now = Date.now();
-    const elapsed = now - this.lastRefill;
-    const tokensToAdd = (elapsed / 1000) * this.opts.refillRate;
-    this.tokens = Math.min(this.opts.maxTokens, this.tokens + tokensToAdd);
-    this.lastRefill = now;
-  }
-}
-
-// ─── Per-Key Rate Limiter (for API endpoints) ────────────
-
-export class KeyedRateLimiter {
-  private limiters = new Map<string, RateLimiter>();
-  private readonly opts: RateLimiterOptions;
-  private cleanupTimer: ReturnType<typeof setInterval> | null = null;
-
-  constructor(opts: RateLimiterOptions) {
-    this.opts = opts;
-    // Cleanup stale entries every 5 minutes
-    this.cleanupTimer = setInterval(() => this.cleanup(), 5 * 60_000);
-    if (this.cleanupTimer && typeof this.cleanupTimer === 'object' && 'unref' in this.cleanupTimer) {
-      this.cleanupTimer.unref();
-    }
-  }
-
-  tryConsume(key: string, count = 1): boolean {
-    let limiter = this.limiters.get(key);
-    if (!limiter) {
-      limiter = new RateLimiter(this.opts);
-      this.limiters.set(key, limiter);
-    }
-    return limiter.tryConsume(count);
-  }
-
-  getRetryAfterMs(key: string): number {
-    const limiter = this.limiters.get(key);
-    return limiter ? limiter.getRetryAfterMs() : 0;
-  }
-
-  private cleanup(): void {
-    // Remove limiters that haven't been used (all have full tokens)
-    for (const [key, limiter] of this.limiters) {
-      if (limiter.getRetryAfterMs() === 0) {
-        this.limiters.delete(key);
-      }
-    }
-  }
-
-  destroy(): void {
-    if (this.cleanupTimer) clearInterval(this.cleanupTimer);
-    this.limiters.clear();
-  }
-}
-
-// ─── Connection Health Monitor ───────────────────────────
-
-export interface HealthCheckOptions {
-  intervalMs: number;        // How often to check (default: 30s)
-  timeoutMs: number;         // Health check timeout
-  unhealthyThreshold: number; // Consecutive failures before unhealthy
-  healthyThreshold: number;   // Consecutive successes before healthy
-}
-
-export class HealthMonitor {
-  private healthy = true;
-  private consecutiveFailures = 0;
-  private consecutiveSuccesses = 0;
-  private timer: ReturnType<typeof setInterval> | null = null;
-  private readonly check: () => Promise<void>;
-  private readonly opts: HealthCheckOptions;
-  private listeners: ((healthy: boolean) => void)[] = [];
-
-  constructor(check: () => Promise<void>, opts: Partial<HealthCheckOptions> = {}) {
-    this.check = check;
-    this.opts = {
-      intervalMs: opts.intervalMs ?? 30_000,
-      timeoutMs: opts.timeoutMs ?? 5_000,
-      unhealthyThreshold: opts.unhealthyThreshold ?? 3,
-      healthyThreshold: opts.healthyThreshold ?? 2,
-    };
-  }
-
-  start(): void {
-    if (this.timer) return;
-    this.timer = setInterval(() => this.runCheck(), this.opts.intervalMs);
-    if (this.timer && typeof this.timer === 'object' && 'unref' in this.timer) {
-      this.timer.unref();
-    }
-  }
-
-  stop(): void {
-    if (this.timer) { clearInterval(this.timer); this.timer = null; }
-  }
-
-  isHealthy(): boolean { return this.healthy; }
-
-  onStatusChange(fn: (healthy: boolean) => void): void {
-    this.listeners.push(fn);
-  }
-
-  private async runCheck(): Promise<void> {
-    try {
-      await withTimeout(this.check(), this.opts.timeoutMs);
-      this.consecutiveFailures = 0;
-      this.consecutiveSuccesses++;
-      if (!this.healthy && this.consecutiveSuccesses >= this.opts.healthyThreshold) {
-        this.healthy = true;
-        this.listeners.forEach(fn => fn(true));
-      }
-    } catch {
-      this.consecutiveSuccesses = 0;
-      this.consecutiveFailures++;
-      if (this.healthy && this.consecutiveFailures >= this.opts.unhealthyThreshold) {
-        this.healthy = false;
-        this.listeners.forEach(fn => fn(false));
-      }
-    }
-  }
-}
-
-// ─── Helpers ─────────────────────────────────────────────
-
-function sleep(ms: number): Promise<void> {
-  return new Promise(resolve => setTimeout(resolve, ms));
-}
-
-function withTimeout<T>(promise: Promise<T>, ms: number): Promise<T> {
-  return new Promise((resolve, reject) => {
-    const timer = setTimeout(() => reject(new Error(`Operation timed out after ${ms}ms`)), ms);
-    promise
-      .then(v => { clearTimeout(timer); resolve(v); })
-      .catch(e => { clearTimeout(timer); reject(e); });
-  });
-}
-
-// ─── Request ID Generator ────────────────────────────────
-
-let counter = 0;
-const prefix = Math.random().toString(36).substring(2, 8);
-
-export function requestId(): string {
-  return `${prefix}-${(++counter).toString(36)}-${Date.now().toString(36)}`;
-}