@iflow-mcp/jkheadley-instar 0.26.2

package/dist/threadline/relay/AbuseDetector.js

@@ -0,0 +1,358 @@
+/**
+ * AbuseDetector — Pattern-based abuse detection for the relay.
+ *
+ * Monitors agent behavior for spam, enumeration, flooding, connection churn,
+ * and oversized payload attempts. Issues temporary bans by agent fingerprint.
+ *
+ * Bans are by agent ID (public key fingerprint), not IP — preventing ban
+ * evasion by IP rotation while avoiding collateral damage to shared IPs.
+ *
+ * Also implements Sybil resistance via progressive rate limiting for new agents.
+ *
+ * Part of Threadline Relay Phase 5.
+ */
+// ── Defaults ───────────────────────────────────────────────────────
+const DEFAULTS = {
+    spamUniqueRecipientsPerMinute: 50,
+    spamBanDurationMs: 60 * 60 * 1000, // 1 hour
+    floodingRateMultiplier: 10,
+    floodingSustainedMinutes: 5,
+    floodingBanDurationMs: 24 * 60 * 60 * 1000, // 24 hours
+    connectionChurnPerHour: 100,
+    connectionChurnBanDurationMs: 60 * 60 * 1000, // 1 hour
+    oversizedPayloadWarnings: 3,
+    oversizedPayloadBanDurationMs: 60 * 60 * 1000, // 1 hour
+    sybilFirstHourLimit: 10,
+    sybilSecondHourLimit: 30,
+    sybilGraduationMs: 24 * 60 * 60 * 1000, // 24 hours
+    normalRatePerMinute: 60,
+};
+// ── Implementation ─────────────────────────────────────────────────
+export class AbuseDetector {
+    config;
+    nowFn;
+    /** Active bans by agent ID */
+    bans = new Map();
+    /** Track unique recipients per agent (for spam detection) */
+    recipientTracker = new Map();
+    /** Track message rate per agent per minute (for flooding detection) */
+    rateTracker = new Map();
+    /** Track connection events per agent (for churn detection) */
+    connectionTracker = new Map();
+    /** Track oversized payload warnings per agent */
+    oversizedWarnings = new Map();
+    /** Track when agents first connected (for Sybil resistance) */
+    firstSeen = new Map();
+    /** Track messages sent by new agents (for Sybil limits) */
+    sybilMessageCounts = new Map();
+    /** Event listeners for abuse events */
+    listeners = [];
+    /** Timer for periodic cleanup */
+    cleanupTimer = null;
+    constructor(config, nowFn) {
+        this.config = { ...DEFAULTS, ...config };
+        this.nowFn = nowFn ?? (() => Date.now());
+        // Periodic cleanup every 5 minutes
+        this.cleanupTimer = setInterval(() => this.cleanup(), 5 * 60 * 1000);
+    }
+    // ── Ban Management ───────────────────────────────────────────────
+    /**
+     * Check if an agent is currently banned.
+     */
+    isBanned(agentId) {
+        const ban = this.bans.get(agentId);
+        if (!ban)
+            return null;
+        // Check if ban has expired
+        if (this.nowFn() >= new Date(ban.expiresAt).getTime()) {
+            this.bans.delete(agentId);
+            return null;
+        }
+        return ban;
+    }
+    /**
+     * Manually ban an agent (admin action).
+     */
+    ban(agentId, reason, durationMs, pattern = 'flooding') {
+        const now = this.nowFn();
+        const info = {
+            agentId,
+            reason,
+            pattern,
+            bannedAt: new Date(now).toISOString(),
+            expiresAt: new Date(now + durationMs).toISOString(),
+            durationMs,
+        };
+        this.bans.set(agentId, info);
+        return info;
+    }
+    /**
+     * Manually unban an agent (admin action).
+     */
+    unban(agentId) {
+        return this.bans.delete(agentId);
+    }
+    /**
+     * Get all active bans.
+     */
+    getActiveBans() {
+        const now = this.nowFn();
+        const active = [];
+        for (const [id, ban] of this.bans) {
+            if (now < new Date(ban.expiresAt).getTime()) {
+                active.push(ban);
+            }
+            else {
+                this.bans.delete(id);
+            }
+        }
+        return active;
+    }
+    // ── Abuse Pattern Detection ──────────────────────────────────────
+    /**
+     * Record a message send and check for spam/flooding patterns.
+     * Returns a ban if the agent should be banned, null otherwise.
+     */
+    recordMessage(agentId, recipientId) {
+        const now = this.nowFn();
+        // Check for spam (too many unique recipients)
+        const spamBan = this.checkSpam(agentId, recipientId, now);
+        if (spamBan)
+            return spamBan;
+        // Check for flooding (sustained high rate)
+        const floodBan = this.checkFlooding(agentId, now);
+        if (floodBan)
+            return floodBan;
+        return null;
+    }
+    /**
+     * Record a connection event and check for churn.
+     * Returns a ban if the agent should be banned, null otherwise.
+     */
+    recordConnection(agentId) {
+        const now = this.nowFn();
+        // Track first seen for Sybil resistance
+        if (!this.firstSeen.has(agentId)) {
+            this.firstSeen.set(agentId, now);
+            this.sybilMessageCounts.set(agentId, { firstHour: 0, secondHour: 0 });
+        }
+        // Track connection events
+        if (!this.connectionTracker.has(agentId)) {
+            this.connectionTracker.set(agentId, []);
+        }
+        const events = this.connectionTracker.get(agentId);
+        events.push(now);
+        // Clean old events (keep last hour)
+        const hourAgo = now - 60 * 60 * 1000;
+        const recent = events.filter(t => t > hourAgo);
+        this.connectionTracker.set(agentId, recent);
+        // Check for churn
+        if (recent.length >= this.config.connectionChurnPerHour) {
+            const ban = this.ban(agentId, `Connection churn: ${recent.length} connections in the last hour`, this.config.connectionChurnBanDurationMs, 'connection_churn');
+            this.emitEvent(agentId, 'connection_churn', ban.reason);
+            return ban;
+        }
+        return null;
+    }
+    /**
+     * Record an oversized payload attempt and check for abuse.
+     * Returns a ban if warnings exceeded, null otherwise.
+     */
+    recordOversizedPayload(agentId) {
+        const count = (this.oversizedWarnings.get(agentId) ?? 0) + 1;
+        this.oversizedWarnings.set(agentId, count);
+        if (count >= this.config.oversizedPayloadWarnings) {
+            const ban = this.ban(agentId, `Repeated oversized payloads (${count} attempts)`, this.config.oversizedPayloadBanDurationMs, 'oversized_payload');
+            this.emitEvent(agentId, 'oversized_payload', ban.reason);
+            this.oversizedWarnings.delete(agentId);
+            return ban;
+        }
+        return null;
+    }
+    // ── Sybil Resistance ─────────────────────────────────────────────
+    /**
+     * Check if a new agent is within its progressive rate limits.
+     * Returns { allowed, remaining, reason } indicating whether the message is allowed.
+     */
+    checkSybilLimit(agentId) {
+        const now = this.nowFn();
+        let seen = this.firstSeen.get(agentId);
+        if (!seen) {
+            // First time — register
+            this.firstSeen.set(agentId, now);
+            this.sybilMessageCounts.set(agentId, { firstHour: 0, secondHour: 0 });
+            seen = now;
+        }
+        const elapsed = now - seen;
+        // Graduated: no Sybil limits apply
+        if (elapsed >= this.config.sybilGraduationMs) {
+            return { allowed: true, remaining: Infinity };
+        }
+        const counts = this.sybilMessageCounts.get(agentId) ?? { firstHour: 0, secondHour: 0 };
+        if (elapsed < 60 * 60 * 1000) {
+            // First hour
+            if (counts.firstHour >= this.config.sybilFirstHourLimit) {
+                return {
+                    allowed: false,
+                    remaining: 0,
+                    reason: `New agent rate limit: ${this.config.sybilFirstHourLimit} messages in first hour`,
+                };
+            }
+            counts.firstHour++;
+            this.sybilMessageCounts.set(agentId, counts);
+            return { allowed: true, remaining: this.config.sybilFirstHourLimit - counts.firstHour };
+        }
+        if (elapsed < 2 * 60 * 60 * 1000) {
+            // Second hour
+            if (counts.secondHour >= this.config.sybilSecondHourLimit) {
+                return {
+                    allowed: false,
+                    remaining: 0,
+                    reason: `New agent rate limit: ${this.config.sybilSecondHourLimit} messages in second hour`,
+                };
+            }
+            counts.secondHour++;
+            this.sybilMessageCounts.set(agentId, counts);
+            return { allowed: true, remaining: this.config.sybilSecondHourLimit - counts.secondHour };
+        }
+        // Between 2 hours and graduation — no Sybil limits (standard rate limits still apply)
+        return { allowed: true, remaining: Infinity };
+    }
+    // ── Event System ─────────────────────────────────────────────────
+    /**
+     * Register a listener for abuse events.
+     */
+    onAbuse(listener) {
+        this.listeners.push(listener);
+    }
+    // ── Stats ────────────────────────────────────────────────────────
+    /**
+     * Get abuse detection statistics.
+     */
+    getStats() {
+        const now = this.nowFn();
+        const graduationCutoff = now - this.config.sybilGraduationMs;
+        let newAgents = 0;
+        for (const [, seen] of this.firstSeen) {
+            if (seen > graduationCutoff)
+                newAgents++;
+        }
+        return {
+            activeBans: this.getActiveBans().length,
+            trackedAgents: this.firstSeen.size,
+            newAgents,
+        };
+    }
+    // ── Cleanup ──────────────────────────────────────────────────────
+    /**
+     * Clean up expired bans and stale tracking data.
+     */
+    cleanup() {
+        const now = this.nowFn();
+        // Remove expired bans
+        for (const [id, ban] of this.bans) {
+            if (now >= new Date(ban.expiresAt).getTime()) {
+                this.bans.delete(id);
+            }
+        }
+        // Clean up stale recipient trackers (older than 2 minutes)
+        for (const [id, tracker] of this.recipientTracker) {
+            if (now - tracker.windowStart > 2 * 60 * 1000) {
+                this.recipientTracker.delete(id);
+            }
+        }
+        // Clean up stale rate trackers (no events in last 10 minutes)
+        for (const [id, events] of this.rateTracker) {
+            const recent = events.filter(t => t > now - 10 * 60 * 1000);
+            if (recent.length === 0) {
+                this.rateTracker.delete(id);
+            }
+            else {
+                this.rateTracker.set(id, recent);
+            }
+        }
+        // Clean up graduated agents from Sybil tracking
+        const graduationCutoff = now - this.config.sybilGraduationMs;
+        for (const [id, seen] of this.firstSeen) {
+            if (seen < graduationCutoff) {
+                this.firstSeen.delete(id);
+                this.sybilMessageCounts.delete(id);
+            }
+        }
+    }
+    /**
+     * Destroy the detector (clear timers).
+     */
+    destroy() {
+        if (this.cleanupTimer) {
+            clearInterval(this.cleanupTimer);
+            this.cleanupTimer = null;
+        }
+        this.bans.clear();
+        this.recipientTracker.clear();
+        this.rateTracker.clear();
+        this.connectionTracker.clear();
+        this.oversizedWarnings.clear();
+        this.firstSeen.clear();
+        this.sybilMessageCounts.clear();
+    }
+    // ── Private ──────────────────────────────────────────────────────
+    checkSpam(agentId, recipientId, now) {
+        if (!this.recipientTracker.has(agentId)) {
+            this.recipientTracker.set(agentId, { recipients: new Set(), windowStart: now });
+        }
+        const tracker = this.recipientTracker.get(agentId);
+        // Reset window if it's been more than 1 minute
+        if (now - tracker.windowStart > 60_000) {
+            tracker.recipients.clear();
+            tracker.windowStart = now;
+        }
+        tracker.recipients.add(recipientId);
+        if (tracker.recipients.size >= this.config.spamUniqueRecipientsPerMinute) {
+            const ban = this.ban(agentId, `Spam: sent to ${tracker.recipients.size} unique recipients in 1 minute`, this.config.spamBanDurationMs, 'spam');
+            this.emitEvent(agentId, 'spam', ban.reason);
+            tracker.recipients.clear();
+            return ban;
+        }
+        return null;
+    }
+    checkFlooding(agentId, now) {
+        if (!this.rateTracker.has(agentId)) {
+            this.rateTracker.set(agentId, []);
+        }
+        const events = this.rateTracker.get(agentId);
+        events.push(now);
+        // Keep only events within the sustained window
+        const windowMs = this.config.floodingSustainedMinutes * 60 * 1000;
+        const cutoff = now - windowMs;
+        const recent = events.filter(t => t > cutoff);
+        this.rateTracker.set(agentId, recent);
+        // Check if rate exceeds threshold sustained over the window
+        const threshold = this.config.normalRatePerMinute * this.config.floodingRateMultiplier;
+        const ratePerMinute = recent.length / this.config.floodingSustainedMinutes;
+        if (ratePerMinute >= threshold && recent.length >= threshold * this.config.floodingSustainedMinutes) {
+            const ban = this.ban(agentId, `Flooding: ${Math.round(ratePerMinute)} msgs/min sustained for ${this.config.floodingSustainedMinutes} minutes (threshold: ${threshold})`, this.config.floodingBanDurationMs, 'flooding');
+            this.emitEvent(agentId, 'flooding', ban.reason);
+            this.rateTracker.delete(agentId);
+            return ban;
+        }
+        return null;
+    }
+    emitEvent(agentId, pattern, details) {
+        const event = {
+            agentId,
+            pattern,
+            details,
+            timestamp: new Date(this.nowFn()).toISOString(),
+        };
+        for (const listener of this.listeners) {
+            try {
+                listener(event);
+            }
+            catch {
+                // Don't let listener errors break abuse detection
+            }
+        }
+    }
+}
+//# sourceMappingURL=AbuseDetector.js.map

package/dist/threadline/relay/AbuseDetector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AbuseDetector.js","sourceRoot":"","sources":["../../../src/threadline/relay/AbuseDetector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAwDH,sEAAsE;AAEtE,MAAM,QAAQ,GAAwB;IACpC,6BAA6B,EAAE,EAAE;IACjC,iBAAiB,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,SAAS;IAE5C,sBAAsB,EAAE,EAAE;IAC1B,wBAAwB,EAAE,CAAC;IAC3B,qBAAqB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW;IAEvD,sBAAsB,EAAE,GAAG;IAC3B,4BAA4B,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,SAAS;IAEvD,wBAAwB,EAAE,CAAC;IAC3B,6BAA6B,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,SAAS;IAExD,mBAAmB,EAAE,EAAE;IACvB,oBAAoB,EAAE,EAAE;IACxB,iBAAiB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW;IAEnD,mBAAmB,EAAE,EAAE;CACxB,CAAC;AAEF,sEAAsE;AAEtE,MAAM,OAAO,aAAa;IACP,MAAM,CAAsB;IAC5B,KAAK,CAAe;IAErC,8BAA8B;IACb,IAAI,GAAG,IAAI,GAAG,EAA6B,CAAC;IAE7D,6DAA6D;IAC5C,gBAAgB,GAAG,IAAI,GAAG,EAAsE,CAAC;IAElH,uEAAuE;IACtD,WAAW,GAAG,IAAI,GAAG,EAA8B,CAAC;IAErE,8DAA8D;IAC7C,iBAAiB,GAAG,IAAI,GAAG,EAA8B,CAAC;IAE3E,iDAAiD;IAChC,iBAAiB,GAAG,IAAI,GAAG,EAA4B,CAAC;IAEzE,+DAA+D;IAC9C,SAAS,GAAG,IAAI,GAAG,EAA4B,CAAC;IAEjE,2DAA2D;IAC1C,kBAAkB,GAAG,IAAI,GAAG,EAA+D,CAAC;IAE7G,uCAAuC;IACtB,SAAS,GAAoC,EAAE,CAAC;IAEjE,iCAAiC;IACzB,YAAY,GAA0C,IAAI,CAAC;IAEnE,YAAY,MAAqC,EAAE,KAAoB;QACrE,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAEzC,mCAAmC;QACnC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACvE,CAAC;IAED,oEAAoE;IAEpE;;OAEG;IACH,QAAQ,CAAC,OAAyB;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAEtB,2BAA2B;QAC3B,IAAI,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,OAAyB,EAAE,MAAc,EAAE,UAAkB,EAAE,UAAwB,UAAU;QACnG,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAY;YACpB,OAAO;YACP,MAAM;YACN,OAAO;YACP,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;YACrC,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,UAAU,CAAC,CAAC,WAAW,EAAE;YACnD,UAAU;SACX,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAyB;QAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,aAAa;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC5C,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,oEAAoE;IAEpE;;;OAGG;IACH,aAAa,CAAC,OAAyB,EAAE,WAA6B;QACpE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAEzB,8CAA8C;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;QAC1D,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAE5B,2CAA2C;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAClD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,gBAAgB,CAAC,OAAyB;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAEzB,wCAAwC;QACxC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,0BAA0B;QAC1B,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEjB,oCAAoC;QACpC,MAAM,OAAO,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAE5C,kBAAkB;QAClB,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;YACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAClB,OAAO,EACP,qBAAqB,MAAM,CAAC,MAAM,+BAA+B,EACjE,IAAI,CAAC,MAAM,CAAC,4BAA4B,EACxC,kBAAkB,CACnB,CAAC;YACF,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,kBAAkB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACxD,OAAO,GAAG,CAAC;QACb,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,sBAAsB,CAAC,OAAyB;QAC9C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAE3C,IAAI,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE,CAAC;YAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAClB,OAAO,EACP,gCAAgC,KAAK,YAAY,EACjD,IAAI,CAAC,MAAM,CAAC,6BAA6B,EACzC,mBAAmB,CACpB,CAAC;YACF,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,mBAAmB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACzD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACvC,OAAO,GAAG,CAAC;QACb,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oEAAoE;IAEpE;;;OAGG;IACH,eAAe,CAAC,OAAyB;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,wBAAwB;YACxB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;YACtE,IAAI,GAAG,GAAG,CAAC;QACb,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,GAAG,IAAI,CAAC;QAE3B,mCAAmC;QACnC,IAAI,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QAEvF,IAAI,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YAC7B,aAAa;YACb,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;gBACxD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,SAAS,EAAE,CAAC;oBACZ,MAAM,EAAE,yBAAyB,IAAI,CAAC,MAAM,CAAC,mBAAmB,yBAAyB;iBAC1F,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1F,CAAC;QAED,IAAI,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YACjC,cAAc;YACd,IAAI,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;gBAC1D,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,SAAS,EAAE,CAAC;oBACZ,MAAM,EAAE,yBAAyB,IAAI,CAAC,MAAM,CAAC,oBAAoB,0BAA0B;iBAC5F,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC5F,CAAC;QAED,sFAAsF;QACtF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IAChD,CAAC;IAED,oEAAoE;IAEpE;;OAEG;IACH,OAAO,CAAC,QAAqC;QAC3C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAED,oEAAoE;IAEpE;;OAEG;IACH,QAAQ;QAKN,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,gBAAgB,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAE7D,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,KAAK,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,IAAI,IAAI,GAAG,gBAAgB;gBAAE,SAAS,EAAE,CAAC;QAC3C,CAAC;QAED,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM;YACvC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI;YAClC,SAAS;SACV,CAAC;IACJ,CAAC;IAED,oEAAoE;IAEpE;;OAEG;IACH,OAAO;QACL,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAEzB,sBAAsB;QACtB,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC7C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAED,2DAA2D;QAC3D,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAClD,IAAI,GAAG,GAAG,OAAO,CAAC,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;gBAC9C,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,8DAA8D;QAC9D,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAC5D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,gDAAgD;QAChD,MAAM,gBAAgB,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAC7D,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACxC,IAAI,IAAI,GAAG,gBAAgB,EAAE,CAAC;gBAC5B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC1B,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACjC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;QAC9B,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;IAClC,CAAC;IAED,oEAAoE;IAE5D,SAAS,CAAC,OAAyB,EAAE,WAA6B,EAAE,GAAW;QACrF,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,GAAG,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;QAEpD,+CAA+C;QAC/C,IAAI,GAAG,GAAG,OAAO,CAAC,WAAW,GAAG,MAAM,EAAE,CAAC;YACvC,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YAC3B,OAAO,CAAC,WAAW,GAAG,GAAG,CAAC;QAC5B,CAAC;QAED,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAEpC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,6BAA6B,EAAE,CAAC;YACzE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAClB,OAAO,EACP,iBAAiB,OAAO,CAAC,UAAU,CAAC,IAAI,gCAAgC,EACxE,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAC7B,MAAM,CACP,CAAC;YACF,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5C,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YAC3B,OAAO,GAAG,CAAC;QACb,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,aAAa,CAAC,OAAyB,EAAE,GAAW;QAC1D,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEjB,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,wBAAwB,GAAG,EAAE,GAAG,IAAI,CAAC;QAClE,MAAM,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAEtC,4DAA4D;QAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,GAAG,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC;QACvF,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC;QAE3E,IAAI,aAAa,IAAI,SAAS,IAAI,MAAM,CAAC,MAAM,IAAI,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,wBAAwB,EAAE,CAAC;YACpG,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAClB,OAAO,EACP,aAAa,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,2BAA2B,IAAI,CAAC,MAAM,CAAC,wBAAwB,wBAAwB,SAAS,GAAG,EACzI,IAAI,CAAC,MAAM,CAAC,qBAAqB,EACjC,UAAU,CACX,CAAC;YACF,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAChD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACjC,OAAO,GAAG,CAAC;QACb,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,SAAS,CAAC,OAAyB,EAAE,OAAqB,EAAE,OAAe;QACjF,MAAM,KAAK,GAAe;YACxB,OAAO;YACP,OAAO;YACP,OAAO;YACP,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,WAAW,EAAE;SAChD,CAAC;QACF,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,kDAAkD;YACpD,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/threadline/relay/AdminServer.d.ts

@@ -0,0 +1,55 @@
+/**
+ * AdminServer — Relay administration endpoints.
+ *
+ * Exposes relay health, agent management, metrics, and ban management
+ * on a separate port accessible only from the operator's network.
+ *
+ * Requires authentication via `RELAY_ADMIN_KEY` environment variable
+ * or config, passed as `Authorization: Bearer <key>`.
+ *
+ * Part of Threadline Relay Phase 5.
+ */
+import type { PresenceRegistry } from './PresenceRegistry.js';
+import type { RelayRateLimiter } from './RelayRateLimiter.js';
+import type { ConnectionManager } from './ConnectionManager.js';
+import type { AbuseDetector } from './AbuseDetector.js';
+import type { IOfflineQueue } from './OfflineQueue.js';
+import type { RelayMetrics } from './RelayMetrics.js';
+export interface AdminServerConfig {
+    port: number;
+    host?: string;
+    adminKey: string;
+}
+export interface AdminServerDeps {
+    presence: PresenceRegistry;
+    rateLimiter: RelayRateLimiter;
+    connections: ConnectionManager;
+    abuseDetector: AbuseDetector;
+    offlineQueue: IOfflineQueue;
+    metrics: RelayMetrics;
+    getUptime: () => number;
+}
+export declare class AdminServer {
+    private readonly config;
+    private readonly deps;
+    private server;
+    private running;
+    constructor(config: AdminServerConfig, deps: AdminServerDeps);
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    get isRunning(): boolean;
+    get address(): {
+        host: string;
+        port: number;
+    } | null;
+    private handleRequest;
+    private handleStatus;
+    private handleListAgents;
+    private handleMetrics;
+    private handleBan;
+    private handleUnban;
+    private handleListBans;
+    private readBody;
+    private sendJson;
+}
+//# sourceMappingURL=AdminServer.d.ts.map

package/dist/threadline/relay/AdminServer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AdminServer.d.ts","sourceRoot":"","sources":["../../../src/threadline/relay/AdminServer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAItD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,WAAW,EAAE,gBAAgB,CAAC;IAC9B,WAAW,EAAE,iBAAiB,CAAC;IAC/B,aAAa,EAAE,aAAa,CAAC;IAC7B,YAAY,EAAE,aAAa,CAAC;IAC5B,OAAO,EAAE,YAAY,CAAC;IACtB,SAAS,EAAE,MAAM,MAAM,CAAC;CACzB;AAID,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IACrD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAkB;IACvC,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,OAAO,CAAS;gBAEZ,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,eAAe;IAStD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAetB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAY3B,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,IAAI,OAAO,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAInD;IAID,OAAO,CAAC,aAAa;IA0CrB,OAAO,CAAC,YAAY;IAqBpB,OAAO,CAAC,gBAAgB;IAkBxB,OAAO,CAAC,aAAa;YAeP,SAAS;YA0BT,WAAW;IAwBzB,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,QAAQ;IAShB,OAAO,CAAC,QAAQ;CAIjB"}

package/dist/threadline/relay/AdminServer.js

@@ -0,0 +1,215 @@
+/**
+ * AdminServer — Relay administration endpoints.
+ *
+ * Exposes relay health, agent management, metrics, and ban management
+ * on a separate port accessible only from the operator's network.
+ *
+ * Requires authentication via `RELAY_ADMIN_KEY` environment variable
+ * or config, passed as `Authorization: Bearer <key>`.
+ *
+ * Part of Threadline Relay Phase 5.
+ */
+import http from 'node:http';
+// ── Implementation ─────────────────────────────────────────────────
+export class AdminServer {
+    config;
+    deps;
+    server = null;
+    running = false;
+    constructor(config, deps) {
+        this.config = {
+            port: config.port,
+            host: config.host ?? '127.0.0.1',
+            adminKey: config.adminKey,
+        };
+        this.deps = deps;
+    }
+    async start() {
+        if (this.running)
+            return;
+        return new Promise((resolve) => {
+            this.server = http.createServer((req, res) => {
+                this.handleRequest(req, res);
+            });
+            this.server.listen(this.config.port, this.config.host, () => {
+                this.running = true;
+                resolve();
+            });
+        });
+    }
+    async stop() {
+        if (!this.running || !this.server)
+            return;
+        return new Promise((resolve) => {
+            this.server.close(() => {
+                this.server = null;
+                this.running = false;
+                resolve();
+            });
+        });
+    }
+    get isRunning() {
+        return this.running;
+    }
+    get address() {
+        const addr = this.server?.address();
+        if (!addr || typeof addr === 'string')
+            return null;
+        return { host: addr.address, port: addr.port };
+    }
+    // ── Request Handling ─────────────────────────────────────────────
+    handleRequest(req, res) {
+        // CORS for localhost only
+        res.setHeader('Access-Control-Allow-Origin', 'http://127.0.0.1');
+        res.setHeader('Access-Control-Allow-Headers', 'Authorization, Content-Type');
+        res.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS');
+        if (req.method === 'OPTIONS') {
+            res.writeHead(204);
+            res.end();
+            return;
+        }
+        // Auth check
+        const authHeader = req.headers.authorization;
+        if (!authHeader || authHeader !== `Bearer ${this.config.adminKey}`) {
+            this.sendJson(res, 401, { error: 'Unauthorized. Provide relay admin key.' });
+            return;
+        }
+        const pathname = new URL(req.url ?? '/', `http://${req.headers.host}`).pathname;
+        try {
+            if (pathname === '/admin/status' && req.method === 'GET') {
+                this.handleStatus(res);
+            }
+            else if (pathname === '/admin/agents' && req.method === 'GET') {
+                this.handleListAgents(res);
+            }
+            else if (pathname === '/admin/metrics' && req.method === 'GET') {
+                this.handleMetrics(req, res);
+            }
+            else if (pathname === '/admin/ban' && req.method === 'POST') {
+                this.handleBan(req, res);
+            }
+            else if (pathname === '/admin/unban' && req.method === 'POST') {
+                this.handleUnban(req, res);
+            }
+            else if (pathname === '/admin/bans' && req.method === 'GET') {
+                this.handleListBans(res);
+            }
+            else {
+                this.sendJson(res, 404, { error: 'Not found' });
+            }
+        }
+        catch (err) {
+            this.sendJson(res, 500, { error: err instanceof Error ? err.message : 'Internal error' });
+        }
+    }
+    handleStatus(res) {
+        const queueStats = this.deps.offlineQueue.getStats();
+        const abuseStats = this.deps.abuseDetector.getStats();
+        const metricsSnapshot = this.deps.metrics.getSnapshot();
+        this.sendJson(res, 200, {
+            status: 'ok',
+            uptime: this.deps.getUptime(),
+            agents: this.deps.presence.size,
+            connections: this.deps.connections.size,
+            offlineQueue: queueStats,
+            abuse: abuseStats,
+            throughput: {
+                messagesTotal: metricsSnapshot.messagesRouted,
+                messagesPerMinute: metricsSnapshot.messagesPerMinute,
+                connectionsTotal: metricsSnapshot.connectionsTotal,
+                authFailures: metricsSnapshot.authFailures,
+            },
+        });
+    }
+    handleListAgents(res) {
+        const agents = this.deps.presence.getAll();
+        this.sendJson(res, 200, {
+            agents: agents.map(a => ({
+                agentId: a.agentId,
+                name: a.metadata.name,
+                framework: a.metadata.framework,
+                capabilities: a.metadata.capabilities,
+                visibility: a.visibility,
+                status: a.status,
+                connectedSince: a.connectedSince,
+                lastSeen: a.lastSeen,
+                sessionId: a.sessionId,
+            })),
+            count: agents.length,
+        });
+    }
+    handleMetrics(req, res) {
+        const accept = req.headers.accept ?? '';
+        const snapshot = this.deps.metrics.getSnapshot();
+        // If Prometheus format requested (or default)
+        if (accept.includes('text/plain') || !accept.includes('application/json')) {
+            res.writeHead(200, { 'Content-Type': 'text/plain; version=0.0.4; charset=utf-8' });
+            res.end(this.deps.metrics.toPrometheus());
+            return;
+        }
+        // JSON format
+        this.sendJson(res, 200, snapshot);
+    }
+    async handleBan(req, res) {
+        const body = await this.readBody(req);
+        if (!body) {
+            this.sendJson(res, 400, { error: 'Request body required' });
+            return;
+        }
+        let params;
+        try {
+            params = JSON.parse(body);
+        }
+        catch {
+            this.sendJson(res, 400, { error: 'Invalid JSON body' });
+            return;
+        }
+        if (!params.agentId) {
+            this.sendJson(res, 400, { error: 'agentId is required' });
+            return;
+        }
+        const durationMs = params.durationMs ?? 60 * 60 * 1000; // default 1 hour
+        const reason = params.reason ?? 'Manual admin ban';
+        const ban = this.deps.abuseDetector.ban(params.agentId, reason, durationMs);
+        this.sendJson(res, 200, { ban });
+    }
+    async handleUnban(req, res) {
+        const body = await this.readBody(req);
+        if (!body) {
+            this.sendJson(res, 400, { error: 'Request body required' });
+            return;
+        }
+        let params;
+        try {
+            params = JSON.parse(body);
+        }
+        catch {
+            this.sendJson(res, 400, { error: 'Invalid JSON body' });
+            return;
+        }
+        if (!params.agentId) {
+            this.sendJson(res, 400, { error: 'agentId is required' });
+            return;
+        }
+        const removed = this.deps.abuseDetector.unban(params.agentId);
+        this.sendJson(res, 200, { unbanned: removed, agentId: params.agentId });
+    }
+    handleListBans(res) {
+        const bans = this.deps.abuseDetector.getActiveBans();
+        this.sendJson(res, 200, { bans, count: bans.length });
+    }
+    // ── Helpers ──────────────────────────────────────────────────────
+    readBody(req) {
+        return new Promise((resolve) => {
+            const chunks = [];
+            req.on('data', (chunk) => chunks.push(chunk));
+            req.on('end', () => resolve(Buffer.concat(chunks).toString('utf-8')));
+            req.on('error', () => resolve(''));
+        });
+    }
+    sendJson(res, status, data) {
+        res.writeHead(status, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(data));
+    }
+}
+//# sourceMappingURL=AdminServer.js.map

package/dist/threadline/relay/AdminServer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AdminServer.js","sourceRoot":"","sources":["../../../src/threadline/relay/AdminServer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AA0B7B,sEAAsE;AAEtE,MAAM,OAAO,WAAW;IACL,MAAM,CAA8B;IACpC,IAAI,CAAkB;IAC/B,MAAM,GAAuB,IAAI,CAAC;IAClC,OAAO,GAAG,KAAK,CAAC;IAExB,YAAY,MAAyB,EAAE,IAAqB;QAC1D,IAAI,CAAC,MAAM,GAAG;YACZ,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,WAAW;YAChC,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QAEzB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;gBAC3C,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC/B,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;gBAC1D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;gBACpB,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO;QAE1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,CAAC,MAAO,CAAC,KAAK,CAAC,GAAG,EAAE;gBACtB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;gBACnB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;gBACrB,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,IAAI,OAAO;QACT,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACnD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IACjD,CAAC;IAED,oEAAoE;IAE5D,aAAa,CAAC,GAAyB,EAAE,GAAwB;QACvE,0BAA0B;QAC1B,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,kBAAkB,CAAC,CAAC;QACjE,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,6BAA6B,CAAC,CAAC;QAC7E,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,4BAA4B,CAAC,CAAC;QAE5E,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,aAAa;QACb,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,UAAU,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;YACnE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;YAC7E,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC;QAEhF,IAAI,CAAC;YACH,IAAI,QAAQ,KAAK,eAAe,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACzD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;iBAAM,IAAI,QAAQ,KAAK,eAAe,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAChE,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YAC7B,CAAC;iBAAM,IAAI,QAAQ,KAAK,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACjE,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC/B,CAAC;iBAAM,IAAI,QAAQ,KAAK,YAAY,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9D,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC3B,CAAC;iBAAM,IAAI,QAAQ,KAAK,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAChE,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC7B,CAAC;iBAAM,IAAI,QAAQ,KAAK,aAAa,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC9D,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,GAAwB;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;QACrD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;QACtD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAExD,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACtB,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YAC7B,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI;YAC/B,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI;YACvC,YAAY,EAAE,UAAU;YACxB,KAAK,EAAE,UAAU;YACjB,UAAU,EAAE;gBACV,aAAa,EAAE,eAAe,CAAC,cAAc;gBAC7C,iBAAiB,EAAE,eAAe,CAAC,iBAAiB;gBACpD,gBAAgB,EAAE,eAAe,CAAC,gBAAgB;gBAClD,YAAY,EAAE,eAAe,CAAC,YAAY;aAC3C;SACF,CAAC,CAAC;IACL,CAAC;IAEO,gBAAgB,CAAC,GAAwB;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3C,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACtB,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACvB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI;gBACrB,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS;gBAC/B,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,YAAY;gBACrC,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,cAAc,EAAE,CAAC,CAAC,cAAc;gBAChC,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,SAAS,EAAE,CAAC,CAAC,SAAS;aACvB,CAAC,CAAC;YACH,KAAK,EAAE,MAAM,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IAEO,aAAa,CAAC,GAAyB,EAAE,GAAwB;QACvE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAEjD,8CAA8C;QAC9C,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0CAA0C,EAAE,CAAC,CAAC;YACnF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,cAAc;QACd,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACpC,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,GAAyB,EAAE,GAAwB;QACzE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,IAAI,MAAkE,CAAC;QACvE,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,iBAAiB;QACzE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,kBAAkB,CAAC;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAC5E,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACnC,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,GAAyB,EAAE,GAAwB;QAC3E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,IAAI,MAA4B,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9D,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC;IAEO,cAAc,CAAC,GAAwB;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,aAAa,EAAE,CAAC;QACrD,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,oEAAoE;IAE5D,QAAQ,CAAC,GAAyB;QACxC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACtD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACtE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,QAAQ,CAAC,GAAwB,EAAE,MAAc,EAAE,IAAa;QACtE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC;CACF"}