agentinbox-cli 0.0.0-stage → 0.1.0-nightly.1

package/dist/auth-BniddcRD.js

@@ -0,0 +1,447 @@
+#!/usr/bin/env node
+import { t as HttpError } from "./errors-CJLUPllS.js";
+import { i as sha256 } from "./crypto-DYZ4R7c2.js";
+import { i as regenerateSetupToken, n as ensureSetupToken } from "./setup-token-Bkwk84l7.js";
+import { isIP, isIPv4, isIPv6 } from "node:net";
+import { getConnInfo } from "@hono/node-server/conninfo";
+import { deleteCookie, getCookie, setCookie } from "hono/cookie";
+import { randomBytes } from "node:crypto";
+const BAN_MS = 9e5;
+/** Tracked clients; the least recently seen is dropped beyond this. */
+const MAX_ENTRIES = 1e4;
+/**
+* Failed sign-in limiter. Per client (IPv4 address or IPv6 /64): 5 distinct wrong secrets or 30
+* attempts within 15 minutes ban it for 15 minutes. A secret already known to be wrong is
+* rejected without hashing (`knownBad`) and counts only as an attempt, so a client retrying a stale
+* password can't spend every attempt, and can't make the server hash it again either. Past a global
+* budget of distinct failures, every attempt is slowed down (never refused, so many clients can't
+* lock the owner out).
+*/
+var LoginLimiter = class {
+	clock;
+	entries = /* @__PURE__ */ new Map();
+	global = {
+		failures: 0,
+		since: 0
+	};
+	constructor(clock = Date.now) {
+		this.clock = clock;
+	}
+	/** Minutes until this client may try again, or 0. */
+	bannedMinutes(ip) {
+		const t = this.clock();
+		const entry = this.entries.get(clientKey(ip));
+		const until = entry && entry.bannedUntil > t ? entry.bannedUntil : 0;
+		return until > t ? Math.ceil((until - t) / 6e4) : 0;
+	}
+	/** The global failure budget is exhausted: slow every attempt down. */
+	overGlobalBudget() {
+		return this.global.failures >= 100 && this.clock() - this.global.since < 9e5;
+	}
+	/** The client already failed with exactly this secret in the current window. */
+	knownBad(ip, secret) {
+		return !!this.current(clientKey(ip), this.clock())?.tried.has(sha256(secret));
+	}
+	/** Records a failure; returns true when it started a ban for this client. `global: false` keeps it out of the global budget. */
+	fail(ip, secret, opts = {}) {
+		return this.record(ip, secret, opts).banned;
+	}
+	/**
+	* Counts an attempt with this secret now, before it is verified, so concurrent requests can't
+	* all pass the ban check first. `countedGlobally` says whether it used global budget (refund it
+	* with `refundGlobal` when the secret turns out to be right).
+	*/
+	record(ip, secret, opts = {}) {
+		const t = this.clock();
+		const key = clientKey(ip);
+		const entry = this.current(key, t) ?? {
+			tried: /* @__PURE__ */ new Set(),
+			attempts: 0,
+			since: t,
+			bannedUntil: 0
+		};
+		const hash = sha256(secret);
+		let countedGlobally = false;
+		if (!entry.tried.has(hash)) {
+			entry.tried.add(hash);
+			if (opts.global !== false) {
+				if (t - this.global.since >= 9e5) this.global = {
+					failures: 0,
+					since: t
+				};
+				this.global.failures++;
+				countedGlobally = true;
+			}
+		}
+		entry.attempts++;
+		const banned = entry.tried.size >= 5 || entry.attempts >= 30;
+		if (banned) entry.bannedUntil = t + BAN_MS;
+		this.touch(key, entry);
+		return {
+			banned,
+			countedGlobally
+		};
+	}
+	refundGlobal() {
+		if (this.global.failures > 0) this.global.failures--;
+	}
+	clear(ip) {
+		this.entries.delete(clientKey(ip));
+	}
+	/** After the password changes, previously wrong secrets may be right. */
+	reset() {
+		this.entries.clear();
+		this.global = {
+			failures: 0,
+			since: 0
+		};
+	}
+	get size() {
+		return this.entries.size;
+	}
+	/** The client's entry if its window (or ban) is still running. */
+	current(key, t) {
+		const entry = this.entries.get(key);
+		if (!entry) return void 0;
+		if (entry.bannedUntil > t || !entry.bannedUntil && t - entry.since < 9e5) return entry;
+		this.entries.delete(key);
+	}
+	/** Map order doubles as LRU order: re-insert on use, evict from the front. */
+	touch(key, entry) {
+		this.entries.delete(key);
+		this.entries.set(key, entry);
+		while (this.entries.size > MAX_ENTRIES) this.entries.delete(this.entries.keys().next().value);
+	}
+};
+/** IPv4 addresses as is (also when IPv4-mapped); IPv6 by /64, since one client usually owns the whole prefix. */
+function clientKey(ip) {
+	const addr = ip.replace(/%.*$/, "").toLowerCase();
+	const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(addr);
+	if (mapped) return mapped[1];
+	if (!isIPv6(addr)) return addr;
+	const [head = "", tail] = addr.split("::");
+	const left = head ? head.split(":") : [];
+	const right = tail ? tail.split(":") : [];
+	return `${(tail === void 0 ? left : [
+		...left,
+		...Array(8 - left.length - right.length).fill("0"),
+		...right
+	]).slice(0, 4).map((g) => g.replace(/^0+(?=.)/, "")).join(":")}::/64`;
+}
+//#endregion
+//#region server/auth/sessions.ts
+const SESSION_TTL_MS = 2592e6;
+/** Sliding refresh never extends a session past this age: sign in again after 90 days. */
+const SESSION_MAX_AGE_MS = 7776e6;
+/** Sliding expiry is pushed forward at most once per this interval, to avoid a write per request. */
+const REFRESH_AFTER_MS = 864e5;
+/** Admin console sessions. Only sha256(token) is stored. */
+var SessionStore = class {
+	db;
+	clock;
+	constructor(db, clock = Date.now) {
+		this.db = db;
+		this.clock = clock;
+	}
+	create(meta = {}) {
+		const token = randomBytes(32).toString("base64url");
+		const t = this.clock();
+		this.db.run("INSERT INTO admin_sessions (token_hash, created_at, expires_at, ip, user_agent) VALUES (?, ?, ?, ?, ?)", sha256(token), new Date(t).toISOString(), new Date(t + SESSION_TTL_MS).toISOString(), meta.ip ?? null, meta.userAgent?.slice(0, 300) ?? null);
+		return token;
+	}
+	check(token) {
+		if (!token) return {
+			valid: false,
+			refreshed: false
+		};
+		const hash = sha256(token);
+		const row = this.db.get("SELECT created_at, expires_at FROM admin_sessions WHERE token_hash = ?", hash);
+		if (!row) return {
+			valid: false,
+			refreshed: false
+		};
+		const t = this.clock();
+		const expires = Date.parse(row.expires_at);
+		const hardLimit = Date.parse(row.created_at) + SESSION_MAX_AGE_MS;
+		if (!(expires > t) || !(hardLimit > t)) {
+			this.db.run("DELETE FROM admin_sessions WHERE token_hash = ?", hash);
+			return {
+				valid: false,
+				refreshed: false
+			};
+		}
+		const next = Math.min(t + SESSION_TTL_MS, hardLimit);
+		if (next - expires < REFRESH_AFTER_MS) return {
+			valid: true,
+			refreshed: false
+		};
+		this.db.run("UPDATE admin_sessions SET expires_at = ? WHERE token_hash = ?", new Date(next).toISOString(), hash);
+		return {
+			valid: true,
+			refreshed: true
+		};
+	}
+	delete(token) {
+		this.db.run("DELETE FROM admin_sessions WHERE token_hash = ?", sha256(token));
+	}
+	/** Revokes every session, optionally keeping one (the caller's own). */
+	deleteAll(exceptToken) {
+		if (exceptToken) return this.db.run("DELETE FROM admin_sessions WHERE token_hash != ?", sha256(exceptToken)).changes;
+		return this.db.run("DELETE FROM admin_sessions").changes;
+	}
+	pruneExpired() {
+		return this.db.run("DELETE FROM admin_sessions WHERE expires_at <= ?", new Date(this.clock()).toISOString()).changes;
+	}
+};
+//#endregion
+//#region server/auth/index.ts
+const SESSION_COOKIE = "aib_session";
+const CSRF_HEADER = "x-agentinbox-csrf";
+const MAX_PASSWORD_LENGTH = 1024;
+/** Hands out at most `max` slots; waiters are served in order. */
+var Semaphore = class {
+	max;
+	active = 0;
+	waiters = [];
+	constructor(max) {
+		this.max = max;
+	}
+	get inUse() {
+		return this.active;
+	}
+	async acquire() {
+		if (this.active < this.max) this.active++;
+		else await new Promise((resolve) => this.waiters.push(resolve));
+		let released = false;
+		return () => {
+			if (released) return;
+			released = true;
+			const next = this.waiters.shift();
+			if (next) next();
+			else this.active--;
+		};
+	}
+};
+const instances = /* @__PURE__ */ new WeakMap();
+function adminAuth(ctx) {
+	let auth = instances.get(ctx);
+	if (!auth) {
+		auth = {
+			sessions: new SessionStore(ctx.db),
+			limiter: new LoginLimiter(),
+			lanes: /* @__PURE__ */ new Map(),
+			verifySlots: new Semaphore(4)
+		};
+		instances.set(ctx, auth);
+	}
+	return auth;
+}
+/** Claimed = an admin password exists. Before that only the setup-token claim works. */
+const isClaimed = (ctx) => !!ctx.settings.getState("admin.passwordHash");
+/** The current setup token while unclaimed (created on demand), otherwise null. */
+function currentSetupToken(ctx) {
+	return isClaimed(ctx) ? null : ensureSetupToken(ctx.config.dataDir);
+}
+/** `agentinbox reset-password`: back to the unclaimed state with a fresh setup link. */
+function resetAdminPassword(ctx) {
+	const auth = adminAuth(ctx);
+	ctx.db.tx(() => {
+		ctx.settings.deleteState("admin.passwordHash");
+		auth.sessions.deleteAll();
+	});
+	auth.limiter.reset();
+	ctx.audit.record({
+		actorType: "system",
+		action: "admin.password_reset",
+		outcome: "ok"
+	});
+	return regenerateSetupToken(ctx.config.dataDir);
+}
+/** Loopback, RFC 1918, CGNAT (100.64/10) and IPv6 ULA (fc00::/7): where a reverse proxy can be. */
+function isPrivateAddress(ip) {
+	const addr = ip.replace(/%.*$/, "").toLowerCase().replace(/^::ffff:(?=\d+\.\d+\.\d+\.\d+$)/, "");
+	if (isIPv4(addr)) {
+		const [a = 0, b = 0] = addr.split(".").map(Number);
+		return a === 127 || a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 100 && b >= 64 && b <= 127;
+	}
+	if (isIPv6(addr)) return addr === "::1" || /^f[cd][0-9a-f]{0,2}:/.test(addr);
+	return false;
+}
+function socketAddress(c) {
+	try {
+		return getConnInfo(c).remote.address ?? null;
+	} catch {
+		return null;
+	}
+}
+/**
+* The client address. X-Forwarded-For is honored only with TRUST_PROXY and only when the
+* connection comes from a loopback or private address (where the proxy runs); it is read from the
+* right, since proxies append the address they saw and entries further left are client-controlled.
+* TRUST_PROXY_HOPS (default 1) is the number of proxies in front of agentinbox.
+*/
+function clientIp(c, trustProxy) {
+	const peer = socketAddress(c);
+	if (trustProxy && peer && isPrivateAddress(peer)) {
+		const hops = Math.max(1, Number.parseInt(process.env.TRUST_PROXY_HOPS ?? "1", 10) || 1);
+		const chain = (c.req.header("x-forwarded-for") ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+		const forwarded = chain[chain.length - hops];
+		if (forwarded && isIP(forwarded)) return forwarded;
+	}
+	return peer ?? "unknown";
+}
+function isSecure(c, trustProxy) {
+	if (new URL(c.req.url).protocol === "https:") return true;
+	const peer = socketAddress(c);
+	return trustProxy && !!peer && isPrivateAddress(peer) && c.req.header("x-forwarded-proto")?.split(",")[0]?.trim().toLowerCase() === "https";
+}
+function sessionToken(c) {
+	return getCookie(c, "aib_session") || void 0;
+}
+function writeSessionCookie(c, token, trustProxy) {
+	setCookie(c, SESSION_COOKIE, token, {
+		httpOnly: true,
+		sameSite: "Lax",
+		path: "/",
+		secure: isSecure(c, trustProxy),
+		maxAge: Math.floor(SESSION_TTL_MS / 1e3)
+	});
+}
+/** Creates a session for the requester and sets the cookie. */
+function startSession(c, ctx) {
+	writeSessionCookie(c, adminAuth(ctx).sessions.create({
+		ip: clientIp(c, ctx.config.trustProxy),
+		userAgent: c.req.header("user-agent")
+	}), ctx.config.trustProxy);
+}
+function endSession(c, ctx) {
+	const token = sessionToken(c);
+	if (token) adminAuth(ctx).sessions.delete(token);
+	deleteCookie(c, SESSION_COOKIE, { path: "/" });
+}
+/** Whether the request carries a valid session; refreshes the cookie when the expiry slid forward. */
+function hasSession(c, ctx) {
+	const token = sessionToken(c);
+	const check = adminAuth(ctx).sessions.check(token);
+	if (check.refreshed && token) writeSessionCookie(c, token, ctx.config.trustProxy);
+	return check.valid;
+}
+/** Requires an admin session on every route it guards. */
+function requireAdmin(ctx) {
+	return async (c, next) => {
+		if (!hasSession(c, ctx)) {
+			if (!isClaimed(ctx)) throw new HttpError(401, "setup_required", "This instance has not been claimed yet", "Open the setup link printed by agentinbox on startup.");
+			throw new HttpError(401, "unauthorized", "Sign in to continue");
+		}
+		c.set("admin", true);
+		await next();
+	};
+}
+const MUTATING = /* @__PURE__ */ new Set([
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE"
+]);
+/**
+* CSRF guard: a custom header can't be sent cross-site without a CORS preflight (which this server
+* never approves), and SameSite=Lax already keeps the cookie off cross-site POSTs.
+*/
+function csrfGuard() {
+	return async (c, next) => {
+		if (MUTATING.has(c.req.method) && c.req.header("x-agentinbox-csrf") !== "1") throw new HttpError(403, "csrf", `Missing ${CSRF_HEADER} header`, `Send "${CSRF_HEADER}: 1" with every mutating /api request.`);
+		await next();
+	};
+}
+/** 429 response for a locked-out address. */
+function lockedOut(c, minutes) {
+	c.header("Retry-After", String(minutes * 60));
+	const message = `Too many failed attempts. Try again in ${minutes} minute${minutes === 1 ? "" : "s"}.`;
+	return c.json({ error: {
+		code: "locked_out",
+		message
+	} }, 429);
+}
+/**
+* Verifies a secret under the failed-login limiter.
+* - Each client gets one check at a time (a few more may queue, the rest get `busy`), and at most
+*   MAX_CONCURRENT_VERIFICATIONS run at once overall.
+* - The attempt is recorded before `verify` (scrypt) runs and refunded if it succeeds, so
+*   concurrent requests can't all slip past the ban.
+* - Locked-out clients and secrets this client already failed with never reach `verify`.
+* - While the instance-wide budget is exhausted, each attempt waits a little first; it is never refused.
+*/
+async function checkSecret(ctx, ip, secret, verify, opts = {}) {
+	const auth = adminAuth(ctx);
+	const key = clientKey(ip);
+	const lane = auth.lanes.get(key) ?? {
+		tail: Promise.resolve(),
+		queued: 0
+	};
+	if (lane.queued > 4) return {
+		ok: false,
+		lockedMinutes: 0,
+		nowBanned: false,
+		busy: true
+	};
+	lane.queued++;
+	auth.lanes.set(key, lane);
+	const previous = lane.tail;
+	let done;
+	lane.tail = new Promise((resolve) => done = resolve);
+	try {
+		await previous;
+		return await checkOnce(auth, ip, secret, verify, opts);
+	} finally {
+		done();
+		if (--lane.queued === 0) auth.lanes.delete(key);
+	}
+}
+async function checkOnce(auth, ip, secret, verify, opts) {
+	const { limiter } = auth;
+	const global = opts.global !== false;
+	if (global && limiter.overGlobalBudget() && !limiter.bannedMinutes(ip)) await new Promise((r) => setTimeout(r, opts.slowdownMs ?? 2e3));
+	const locked = limiter.bannedMinutes(ip);
+	if (locked) return {
+		ok: false,
+		lockedMinutes: locked,
+		nowBanned: false
+	};
+	if (limiter.knownBad(ip, secret)) return {
+		ok: false,
+		lockedMinutes: 0,
+		nowBanned: limiter.fail(ip, secret, { global })
+	};
+	const reservation = limiter.record(ip, secret, { global });
+	const release = await auth.verifySlots.acquire();
+	let ok = false;
+	try {
+		ok = await verify();
+	} finally {
+		release();
+	}
+	if (!ok) return {
+		ok: false,
+		lockedMinutes: 0,
+		nowBanned: reservation.banned
+	};
+	limiter.clear(ip);
+	if (reservation.countedGlobally) limiter.refundGlobal();
+	return { ok: true };
+}
+/** The 429 for a rejected check (locked out or too many at once), or null to continue. */
+function rejection(c, check) {
+	if (check.ok) return null;
+	if (check.busy) {
+		c.header("Retry-After", "2");
+		return c.json({ error: {
+			code: "too_many_requests",
+			message: "Another sign-in attempt from your address is still being checked. Try again in a moment."
+		} }, 429);
+	}
+	return check.lockedMinutes ? lockedOut(c, check.lockedMinutes) : null;
+}
+//#endregion
+export { resetAdminPassword as _, adminAuth as a, csrfGuard as c, hasSession as d, isClaimed as f, requireAdmin as g, rejection as h, Semaphore as i, currentSetupToken as l, lockedOut as m, MAX_PASSWORD_LENGTH as n, checkSecret as o, isPrivateAddress as p, SESSION_COOKIE as r, clientIp as s, CSRF_HEADER as t, endSession as u, sessionToken as v, startSession as y };
+
+//# sourceMappingURL=auth-BniddcRD.js.map

package/dist/auth-BniddcRD.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-BniddcRD.js","names":[],"sources":["../server/auth/lockout.ts","../server/auth/sessions.ts","../server/auth/index.ts"],"sourcesContent":["import { isIPv6 } from \"node:net\";\nimport { sha256 } from \"../crypto.ts\";\n\n/** Distinct wrong secrets per client within the window before a ban. */\nexport const MAX_FAILURES = 5;\n/** Raw failed attempts per client within the window (repeats of the same wrong secret included). */\nexport const MAX_ATTEMPTS = 30;\n/** Distinct wrong secrets across all clients within the window before every attempt is slowed down. */\nexport const GLOBAL_MAX_FAILURES = 100;\n/** Delay per attempt while the global budget is exceeded. */\nexport const GLOBAL_SLOWDOWN_MS = 2000;\nexport const WINDOW_MS = 15 * 60_000;\nexport const BAN_MS = 15 * 60_000;\n/** Tracked clients; the least recently seen is dropped beyond this. */\nexport const MAX_ENTRIES = 10_000;\n\ninterface Entry {\n  tried: Set<string>;\n  attempts: number;\n  since: number;\n  bannedUntil: number;\n}\n\n/**\n * Failed sign-in limiter. Per client (IPv4 address or IPv6 /64): 5 distinct wrong secrets or 30\n * attempts within 15 minutes ban it for 15 minutes. A secret already known to be wrong is\n * rejected without hashing (`knownBad`) and counts only as an attempt, so a client retrying a stale\n * password can't spend every attempt, and can't make the server hash it again either. Past a global\n * budget of distinct failures, every attempt is slowed down (never refused, so many clients can't\n * lock the owner out).\n */\nexport class LoginLimiter {\n  private readonly entries = new Map<string, Entry>();\n  private global = { failures: 0, since: 0 };\n\n  constructor(private readonly clock: () => number = Date.now) {}\n\n  /** Minutes until this client may try again, or 0. */\n  bannedMinutes(ip: string): number {\n    const t = this.clock();\n    const entry = this.entries.get(clientKey(ip));\n    const until = entry && entry.bannedUntil > t ? entry.bannedUntil : 0;\n    return until > t ? Math.ceil((until - t) / 60_000) : 0;\n  }\n\n  /** The global failure budget is exhausted: slow every attempt down. */\n  overGlobalBudget(): boolean {\n    return this.global.failures >= GLOBAL_MAX_FAILURES && this.clock() - this.global.since < WINDOW_MS;\n  }\n\n  /** The client already failed with exactly this secret in the current window. */\n  knownBad(ip: string, secret: string): boolean {\n    const entry = this.current(clientKey(ip), this.clock());\n    return !!entry?.tried.has(sha256(secret));\n  }\n\n  /** Records a failure; returns true when it started a ban for this client. `global: false` keeps it out of the global budget. */\n  fail(ip: string, secret: string, opts: { global?: boolean } = {}): boolean {\n    return this.record(ip, secret, opts).banned;\n  }\n\n  /**\n   * Counts an attempt with this secret now, before it is verified, so concurrent requests can't\n   * all pass the ban check first. `countedGlobally` says whether it used global budget (refund it\n   * with `refundGlobal` when the secret turns out to be right).\n   */\n  record(ip: string, secret: string, opts: { global?: boolean } = {}): { banned: boolean; countedGlobally: boolean } {\n    const t = this.clock();\n    const key = clientKey(ip);\n    const entry = this.current(key, t) ?? { tried: new Set<string>(), attempts: 0, since: t, bannedUntil: 0 };\n    const hash = sha256(secret);\n    let countedGlobally = false;\n    if (!entry.tried.has(hash)) {\n      entry.tried.add(hash);\n      if (opts.global !== false) {\n        if (t - this.global.since >= WINDOW_MS) this.global = { failures: 0, since: t };\n        this.global.failures++;\n        countedGlobally = true;\n      }\n    }\n    entry.attempts++;\n    const banned = entry.tried.size >= MAX_FAILURES || entry.attempts >= MAX_ATTEMPTS;\n    if (banned) entry.bannedUntil = t + BAN_MS;\n    this.touch(key, entry);\n    return { banned, countedGlobally };\n  }\n\n  refundGlobal(): void {\n    if (this.global.failures > 0) this.global.failures--;\n  }\n\n  clear(ip: string): void {\n    this.entries.delete(clientKey(ip));\n  }\n\n  /** After the password changes, previously wrong secrets may be right. */\n  reset(): void {\n    this.entries.clear();\n    this.global = { failures: 0, since: 0 };\n  }\n\n  get size(): number {\n    return this.entries.size;\n  }\n\n  /** The client's entry if its window (or ban) is still running. */\n  private current(key: string, t: number): Entry | undefined {\n    const entry = this.entries.get(key);\n    if (!entry) return undefined;\n    if (entry.bannedUntil > t || (!entry.bannedUntil && t - entry.since < WINDOW_MS)) return entry;\n    this.entries.delete(key);\n    return undefined;\n  }\n\n  /** Map order doubles as LRU order: re-insert on use, evict from the front. */\n  private touch(key: string, entry: Entry): void {\n    this.entries.delete(key);\n    this.entries.set(key, entry);\n    while (this.entries.size > MAX_ENTRIES) this.entries.delete(this.entries.keys().next().value!);\n  }\n}\n\n/** IPv4 addresses as is (also when IPv4-mapped); IPv6 by /64, since one client usually owns the whole prefix. */\nexport function clientKey(ip: string): string {\n  const addr = ip.replace(/%.*$/, \"\").toLowerCase();\n  const mapped = /^::ffff:(\\d+\\.\\d+\\.\\d+\\.\\d+)$/.exec(addr);\n  if (mapped) return mapped[1]!;\n  if (!isIPv6(addr)) return addr;\n  const [head = \"\", tail] = addr.split(\"::\");\n  const left = head ? head.split(\":\") : [];\n  const right = tail ? tail.split(\":\") : [];\n  const groups = tail === undefined ? left : [...left, ...Array(8 - left.length - right.length).fill(\"0\"), ...right];\n  return `${groups\n    .slice(0, 4)\n    .map((g) => g.replace(/^0+(?=.)/, \"\"))\n    .join(\":\")}::/64`;\n}\n","import { randomBytes } from \"node:crypto\";\nimport { sha256 } from \"../crypto.ts\";\nimport type { Db } from \"../db/index.ts\";\n\nexport const SESSION_TTL_MS = 30 * 24 * 3600_000;\n/** Sliding refresh never extends a session past this age: sign in again after 90 days. */\nexport const SESSION_MAX_AGE_MS = 90 * 24 * 3600_000;\n/** Sliding expiry is pushed forward at most once per this interval, to avoid a write per request. */\nconst REFRESH_AFTER_MS = 24 * 3600_000;\n\nexport interface SessionCheck {\n  valid: boolean;\n  /** The expiry was extended: re-send the cookie so the browser keeps it as long. */\n  refreshed: boolean;\n}\n\n/** Admin console sessions. Only sha256(token) is stored. */\nexport class SessionStore {\n  constructor(\n    private readonly db: Db,\n    private readonly clock: () => number = Date.now,\n  ) {}\n\n  create(meta: { ip?: string | null; userAgent?: string | null } = {}): string {\n    const token = randomBytes(32).toString(\"base64url\");\n    const t = this.clock();\n    this.db.run(\n      \"INSERT INTO admin_sessions (token_hash, created_at, expires_at, ip, user_agent) VALUES (?, ?, ?, ?, ?)\",\n      sha256(token),\n      new Date(t).toISOString(),\n      new Date(t + SESSION_TTL_MS).toISOString(),\n      meta.ip ?? null,\n      meta.userAgent?.slice(0, 300) ?? null,\n    );\n    return token;\n  }\n\n  check(token: string | undefined | null): SessionCheck {\n    if (!token) return { valid: false, refreshed: false };\n    const hash = sha256(token);\n    const row = this.db.get<{ created_at: string; expires_at: string }>(\n      \"SELECT created_at, expires_at FROM admin_sessions WHERE token_hash = ?\",\n      hash,\n    );\n    if (!row) return { valid: false, refreshed: false };\n    const t = this.clock();\n    const expires = Date.parse(row.expires_at);\n    const hardLimit = Date.parse(row.created_at) + SESSION_MAX_AGE_MS;\n    if (!(expires > t) || !(hardLimit > t)) {\n      this.db.run(\"DELETE FROM admin_sessions WHERE token_hash = ?\", hash);\n      return { valid: false, refreshed: false };\n    }\n    const next = Math.min(t + SESSION_TTL_MS, hardLimit);\n    if (next - expires < REFRESH_AFTER_MS) return { valid: true, refreshed: false };\n    this.db.run(\"UPDATE admin_sessions SET expires_at = ? WHERE token_hash = ?\", new Date(next).toISOString(), hash);\n    return { valid: true, refreshed: true };\n  }\n\n  delete(token: string): void {\n    this.db.run(\"DELETE FROM admin_sessions WHERE token_hash = ?\", sha256(token));\n  }\n\n  /** Revokes every session, optionally keeping one (the caller's own). */\n  deleteAll(exceptToken?: string | null): number {\n    if (exceptToken) return this.db.run(\"DELETE FROM admin_sessions WHERE token_hash != ?\", sha256(exceptToken)).changes;\n    return this.db.run(\"DELETE FROM admin_sessions\").changes;\n  }\n\n  pruneExpired(): number {\n    return this.db.run(\"DELETE FROM admin_sessions WHERE expires_at <= ?\", new Date(this.clock()).toISOString()).changes;\n  }\n}\n","import { isIP, isIPv4, isIPv6 } from \"node:net\";\nimport { getConnInfo } from \"@hono/node-server/conninfo\";\nimport type { Context, MiddlewareHandler } from \"hono\";\nimport { deleteCookie, getCookie, setCookie } from \"hono/cookie\";\nimport type { AppEnv } from \"../api/util.ts\";\nimport type { CoreContext } from \"../context.ts\";\nimport { HttpError } from \"../util/errors.ts\";\nimport { clientKey, GLOBAL_SLOWDOWN_MS, LoginLimiter } from \"./lockout.ts\";\nimport { SESSION_TTL_MS, SessionStore } from \"./sessions.ts\";\nimport { ensureSetupToken, regenerateSetupToken } from \"./setup-token.ts\";\n\nexport const SESSION_COOKIE = \"aib_session\";\nexport const CSRF_HEADER = \"x-agentinbox-csrf\";\nexport const MIN_PASSWORD_LENGTH = 10;\nexport const MAX_PASSWORD_LENGTH = 1024;\n\n/** Secret checks (scrypt) allowed at once: libuv's default thread pool size. */\nexport const MAX_CONCURRENT_VERIFICATIONS = 4;\n/** Requests from one client that may wait behind its in-flight check; more get 429. */\nexport const MAX_QUEUED_PER_CLIENT = 4;\n\n/** Hands out at most `max` slots; waiters are served in order. */\nexport class Semaphore {\n  private active = 0;\n  private readonly waiters: (() => void)[] = [];\n\n  constructor(private readonly max: number) {}\n\n  get inUse(): number {\n    return this.active;\n  }\n\n  async acquire(): Promise<() => void> {\n    if (this.active < this.max) this.active++;\n    else await new Promise<void>((resolve) => this.waiters.push(resolve));\n    let released = false;\n    return () => {\n      if (released) return;\n      released = true;\n      const next = this.waiters.shift();\n      if (next) next();\n      else this.active--;\n    };\n  }\n}\n\n/** Per-context admin auth state: the session store, the failed-login limiter and verification queues. */\nexport interface AdminAuth {\n  sessions: SessionStore;\n  limiter: LoginLimiter;\n  /** One secret check per client at a time: the tail of each client's queue. */\n  lanes: Map<string, { tail: Promise<void>; queued: number }>;\n  verifySlots: Semaphore;\n}\n\n/** What admin auth needs from the context (the CLI builds this without loading the master key). */\nexport type AuthCore = Pick<CoreContext, \"db\" | \"settings\" | \"audit\" | \"config\">;\n\nconst instances = new WeakMap<AuthCore, AdminAuth>();\n\nexport function adminAuth(ctx: AuthCore): AdminAuth {\n  let auth = instances.get(ctx);\n  if (!auth) {\n    auth = { sessions: new SessionStore(ctx.db), limiter: new LoginLimiter(), lanes: new Map(), verifySlots: new Semaphore(MAX_CONCURRENT_VERIFICATIONS) };\n    instances.set(ctx, auth);\n  }\n  return auth;\n}\n\n/** Claimed = an admin password exists. Before that only the setup-token claim works. */\nexport const isClaimed = (ctx: AuthCore): boolean => !!ctx.settings.getState(\"admin.passwordHash\");\n\n/** The current setup token while unclaimed (created on demand), otherwise null. */\nexport function currentSetupToken(ctx: AuthCore): string | null {\n  return isClaimed(ctx) ? null : ensureSetupToken(ctx.config.dataDir);\n}\n\n/** `agentinbox reset-password`: back to the unclaimed state with a fresh setup link. */\nexport function resetAdminPassword(ctx: AuthCore): string {\n  const auth = adminAuth(ctx);\n  ctx.db.tx(() => {\n    ctx.settings.deleteState(\"admin.passwordHash\");\n    auth.sessions.deleteAll();\n  });\n  auth.limiter.reset();\n  ctx.audit.record({ actorType: \"system\", action: \"admin.password_reset\", outcome: \"ok\" });\n  return regenerateSetupToken(ctx.config.dataDir);\n}\n\n/** Loopback, RFC 1918, CGNAT (100.64/10) and IPv6 ULA (fc00::/7): where a reverse proxy can be. */\nexport function isPrivateAddress(ip: string): boolean {\n  const addr = ip.replace(/%.*$/, \"\").toLowerCase().replace(/^::ffff:(?=\\d+\\.\\d+\\.\\d+\\.\\d+$)/, \"\");\n  if (isIPv4(addr)) {\n    const [a = 0, b = 0] = addr.split(\".\").map(Number);\n    return a === 127 || a === 10 || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168) || (a === 100 && b >= 64 && b <= 127);\n  }\n  if (isIPv6(addr)) return addr === \"::1\" || /^f[cd][0-9a-f]{0,2}:/.test(addr);\n  return false;\n}\n\nfunction socketAddress(c: Context): string | null {\n  try {\n    return getConnInfo(c).remote.address ?? null;\n  } catch {\n    // No Node socket (e.g. app.request() without bindings).\n    return null;\n  }\n}\n\n/**\n * The client address. X-Forwarded-For is honored only with TRUST_PROXY and only when the\n * connection comes from a loopback or private address (where the proxy runs); it is read from the\n * right, since proxies append the address they saw and entries further left are client-controlled.\n * TRUST_PROXY_HOPS (default 1) is the number of proxies in front of agentinbox.\n */\nexport function clientIp(c: Context, trustProxy: boolean): string {\n  const peer = socketAddress(c);\n  if (trustProxy && peer && isPrivateAddress(peer)) {\n    const hops = Math.max(1, Number.parseInt(process.env.TRUST_PROXY_HOPS ?? \"1\", 10) || 1);\n    const chain = (c.req.header(\"x-forwarded-for\") ?? \"\")\n      .split(\",\")\n      .map((s) => s.trim())\n      .filter(Boolean);\n    const forwarded = chain[chain.length - hops];\n    if (forwarded && isIP(forwarded)) return forwarded;\n  }\n  return peer ?? \"unknown\";\n}\n\nfunction isSecure(c: Context, trustProxy: boolean): boolean {\n  if (new URL(c.req.url).protocol === \"https:\") return true;\n  const peer = socketAddress(c);\n  return trustProxy && !!peer && isPrivateAddress(peer) && c.req.header(\"x-forwarded-proto\")?.split(\",\")[0]?.trim().toLowerCase() === \"https\";\n}\n\nexport function sessionToken(c: Context): string | undefined {\n  return getCookie(c, SESSION_COOKIE) || undefined;\n}\n\nfunction writeSessionCookie(c: Context, token: string, trustProxy: boolean): void {\n  setCookie(c, SESSION_COOKIE, token, {\n    httpOnly: true,\n    sameSite: \"Lax\",\n    path: \"/\",\n    secure: isSecure(c, trustProxy),\n    maxAge: Math.floor(SESSION_TTL_MS / 1000),\n  });\n}\n\n/** Creates a session for the requester and sets the cookie. */\nexport function startSession(c: Context, ctx: AuthCore): void {\n  const token = adminAuth(ctx).sessions.create({ ip: clientIp(c, ctx.config.trustProxy), userAgent: c.req.header(\"user-agent\") });\n  writeSessionCookie(c, token, ctx.config.trustProxy);\n}\n\nexport function endSession(c: Context, ctx: AuthCore): void {\n  const token = sessionToken(c);\n  if (token) adminAuth(ctx).sessions.delete(token);\n  deleteCookie(c, SESSION_COOKIE, { path: \"/\" });\n}\n\n/** Whether the request carries a valid session; refreshes the cookie when the expiry slid forward. */\nexport function hasSession(c: Context, ctx: AuthCore): boolean {\n  const token = sessionToken(c);\n  const check = adminAuth(ctx).sessions.check(token);\n  if (check.refreshed && token) writeSessionCookie(c, token, ctx.config.trustProxy);\n  return check.valid;\n}\n\n/** Requires an admin session on every route it guards. */\nexport function requireAdmin(ctx: AuthCore): MiddlewareHandler<AppEnv> {\n  return async (c, next) => {\n    if (!hasSession(c, ctx)) {\n      if (!isClaimed(ctx)) {\n        throw new HttpError(401, \"setup_required\", \"This instance has not been claimed yet\", \"Open the setup link printed by agentinbox on startup.\");\n      }\n      throw new HttpError(401, \"unauthorized\", \"Sign in to continue\");\n    }\n    c.set(\"admin\", true);\n    await next();\n  };\n}\n\nconst MUTATING = new Set([\"POST\", \"PUT\", \"PATCH\", \"DELETE\"]);\n\n/**\n * CSRF guard: a custom header can't be sent cross-site without a CORS preflight (which this server\n * never approves), and SameSite=Lax already keeps the cookie off cross-site POSTs.\n */\nexport function csrfGuard(): MiddlewareHandler<AppEnv> {\n  return async (c, next) => {\n    if (MUTATING.has(c.req.method) && c.req.header(CSRF_HEADER) !== \"1\") {\n      throw new HttpError(403, \"csrf\", `Missing ${CSRF_HEADER} header`, `Send \"${CSRF_HEADER}: 1\" with every mutating /api request.`);\n    }\n    await next();\n  };\n}\n\n/** 429 response for a locked-out address. */\nexport function lockedOut(c: Context, minutes: number): Response {\n  c.header(\"Retry-After\", String(minutes * 60));\n  const message = `Too many failed attempts. Try again in ${minutes} minute${minutes === 1 ? \"\" : \"s\"}.`;\n  return c.json({ error: { code: \"locked_out\", message } }, 429);\n}\n\nexport type CheckResult =\n  | { ok: true }\n  | { ok: false; lockedMinutes: number; nowBanned: boolean; /** Too many concurrent attempts from this client. */ busy?: boolean };\n\nexport interface CheckOptions {\n  /**\n   * Count toward (and be slowed down by) the instance-wide failure budget. Off for the setup claim:\n   * it's only open while unclaimed and needs the token.\n   */\n  global?: boolean;\n  /** Test hook: how long to wait while over the global budget. */\n  slowdownMs?: number;\n}\n\n/**\n * Verifies a secret under the failed-login limiter.\n * - Each client gets one check at a time (a few more may queue, the rest get `busy`), and at most\n *   MAX_CONCURRENT_VERIFICATIONS run at once overall.\n * - The attempt is recorded before `verify` (scrypt) runs and refunded if it succeeds, so\n *   concurrent requests can't all slip past the ban.\n * - Locked-out clients and secrets this client already failed with never reach `verify`.\n * - While the instance-wide budget is exhausted, each attempt waits a little first; it is never refused.\n */\nexport async function checkSecret(\n  ctx: AuthCore,\n  ip: string,\n  secret: string,\n  verify: () => boolean | Promise<boolean>,\n  opts: CheckOptions = {},\n): Promise<CheckResult> {\n  const auth = adminAuth(ctx);\n  const key = clientKey(ip);\n  const lane = auth.lanes.get(key) ?? { tail: Promise.resolve(), queued: 0 };\n  if (lane.queued > MAX_QUEUED_PER_CLIENT) return { ok: false, lockedMinutes: 0, nowBanned: false, busy: true };\n  lane.queued++;\n  auth.lanes.set(key, lane);\n  const previous = lane.tail;\n  let done!: () => void;\n  lane.tail = new Promise<void>((resolve) => (done = resolve));\n  try {\n    await previous;\n    return await checkOnce(auth, ip, secret, verify, opts);\n  } finally {\n    done();\n    if (--lane.queued === 0) auth.lanes.delete(key);\n  }\n}\n\nasync function checkOnce(auth: AdminAuth, ip: string, secret: string, verify: () => boolean | Promise<boolean>, opts: CheckOptions): Promise<CheckResult> {\n  const { limiter } = auth;\n  const global = opts.global !== false;\n  if (global && limiter.overGlobalBudget() && !limiter.bannedMinutes(ip)) {\n    await new Promise((r) => setTimeout(r, opts.slowdownMs ?? GLOBAL_SLOWDOWN_MS));\n  }\n  // From here to the reservation everything is synchronous.\n  const locked = limiter.bannedMinutes(ip);\n  if (locked) return { ok: false, lockedMinutes: locked, nowBanned: false };\n  if (limiter.knownBad(ip, secret)) return { ok: false, lockedMinutes: 0, nowBanned: limiter.fail(ip, secret, { global }) };\n  const reservation = limiter.record(ip, secret, { global });\n  const release = await auth.verifySlots.acquire();\n  let ok = false;\n  try {\n    ok = await verify();\n  } finally {\n    release();\n  }\n  if (!ok) return { ok: false, lockedMinutes: 0, nowBanned: reservation.banned };\n  limiter.clear(ip);\n  if (reservation.countedGlobally) limiter.refundGlobal();\n  return { ok: true };\n}\n\n/** The 429 for a rejected check (locked out or too many at once), or null to continue. */\nexport function rejection(c: Context, check: CheckResult): Response | null {\n  if (check.ok) return null;\n  if (check.busy) {\n    c.header(\"Retry-After\", \"2\");\n    return c.json({ error: { code: \"too_many_requests\", message: \"Another sign-in attempt from your address is still being checked. Try again in a moment.\" } }, 429);\n  }\n  return check.lockedMinutes ? lockedOut(c, check.lockedMinutes) : null;\n}\n"],"mappings":";;;;;;;;AAYA,MAAa,SAAS;;AAEtB,MAAa,cAAc;;;;;;;;;AAiB3B,IAAa,eAAb,MAA0B;CAIK;CAH7B,0BAA2B,IAAI,IAAmB;CAClD,SAAiB;EAAE,UAAU;EAAG,OAAO;CAAE;CAEzC,YAAY,QAAuC,KAAK,KAAK;EAAhC,KAAA,QAAA;CAAiC;;CAG9D,cAAc,IAAoB;EAChC,MAAM,IAAI,KAAK,MAAM;EACrB,MAAM,QAAQ,KAAK,QAAQ,IAAI,UAAU,EAAE,CAAC;EAC5C,MAAM,QAAQ,SAAS,MAAM,cAAc,IAAI,MAAM,cAAc;EACnE,OAAO,QAAQ,IAAI,KAAK,MAAM,QAAQ,KAAK,GAAM,IAAI;CACvD;;CAGA,mBAA4B;EAC1B,OAAO,KAAK,OAAO,YAAA,OAAmC,KAAK,MAAM,IAAI,KAAK,OAAO,QAAA;CACnF;;CAGA,SAAS,IAAY,QAAyB;EAE5C,OAAO,CAAC,CADM,KAAK,QAAQ,UAAU,EAAE,GAAG,KAAK,MAAM,CACxC,CAAC,EAAE,MAAM,IAAI,OAAO,MAAM,CAAC;CAC1C;;CAGA,KAAK,IAAY,QAAgB,OAA6B,CAAC,GAAY;EACzE,OAAO,KAAK,OAAO,IAAI,QAAQ,IAAI,CAAC,CAAC;CACvC;;;;;;CAOA,OAAO,IAAY,QAAgB,OAA6B,CAAC,GAAkD;EACjH,MAAM,IAAI,KAAK,MAAM;EACrB,MAAM,MAAM,UAAU,EAAE;EACxB,MAAM,QAAQ,KAAK,QAAQ,KAAK,CAAC,KAAK;GAAE,uBAAO,IAAI,IAAY;GAAG,UAAU;GAAG,OAAO;GAAG,aAAa;EAAE;EACxG,MAAM,OAAO,OAAO,MAAM;EAC1B,IAAI,kBAAkB;EACtB,IAAI,CAAC,MAAM,MAAM,IAAI,IAAI,GAAG;GAC1B,MAAM,MAAM,IAAI,IAAI;GACpB,IAAI,KAAK,WAAW,OAAO;IACzB,IAAI,IAAI,KAAK,OAAO,SAAA,KAAoB,KAAK,SAAS;KAAE,UAAU;KAAG,OAAO;IAAE;IAC9E,KAAK,OAAO;IACZ,kBAAkB;GACpB;EACF;EACA,MAAM;EACN,MAAM,SAAS,MAAM,MAAM,QAAA,KAAwB,MAAM,YAAA;EACzD,IAAI,QAAQ,MAAM,cAAc,IAAI;EACpC,KAAK,MAAM,KAAK,KAAK;EACrB,OAAO;GAAE;GAAQ;EAAgB;CACnC;CAEA,eAAqB;EACnB,IAAI,KAAK,OAAO,WAAW,GAAG,KAAK,OAAO;CAC5C;CAEA,MAAM,IAAkB;EACtB,KAAK,QAAQ,OAAO,UAAU,EAAE,CAAC;CACnC;;CAGA,QAAc;EACZ,KAAK,QAAQ,MAAM;EACnB,KAAK,SAAS;GAAE,UAAU;GAAG,OAAO;EAAE;CACxC;CAEA,IAAI,OAAe;EACjB,OAAO,KAAK,QAAQ;CACtB;;CAGA,QAAgB,KAAa,GAA8B;EACzD,MAAM,QAAQ,KAAK,QAAQ,IAAI,GAAG;EAClC,IAAI,CAAC,OAAO,OAAO,KAAA;EACnB,IAAI,MAAM,cAAc,KAAM,CAAC,MAAM,eAAe,IAAI,MAAM,QAAA,KAAoB,OAAO;EACzF,KAAK,QAAQ,OAAO,GAAG;CAEzB;;CAGA,MAAc,KAAa,OAAoB;EAC7C,KAAK,QAAQ,OAAO,GAAG;EACvB,KAAK,QAAQ,IAAI,KAAK,KAAK;EAC3B,OAAO,KAAK,QAAQ,OAAO,aAAa,KAAK,QAAQ,OAAO,KAAK,QAAQ,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAM;CAC/F;AACF;;AAGA,SAAgB,UAAU,IAAoB;CAC5C,MAAM,OAAO,GAAG,QAAQ,QAAQ,EAAE,CAAC,CAAC,YAAY;CAChD,MAAM,SAAS,gCAAgC,KAAK,IAAI;CACxD,IAAI,QAAQ,OAAO,OAAO;CAC1B,IAAI,CAAC,OAAO,IAAI,GAAG,OAAO;CAC1B,MAAM,CAAC,OAAO,IAAI,QAAQ,KAAK,MAAM,IAAI;CACzC,MAAM,OAAO,OAAO,KAAK,MAAM,GAAG,IAAI,CAAC;CACvC,MAAM,QAAQ,OAAO,KAAK,MAAM,GAAG,IAAI,CAAC;CAExC,OAAO,IADQ,SAAS,KAAA,IAAY,OAAO;EAAC,GAAG;EAAM,GAAG,MAAM,IAAI,KAAK,SAAS,MAAM,MAAM,CAAC,CAAC,KAAK,GAAG;EAAG,GAAG;CAAK,EAAA,CAE9G,MAAM,GAAG,CAAC,CAAC,CACX,KAAK,MAAM,EAAE,QAAQ,YAAY,EAAE,CAAC,CAAC,CACrC,KAAK,GAAG,EAAE;AACf;;;ACpIA,MAAa,iBAAiB;;AAE9B,MAAa,qBAAqB;;AAElC,MAAM,mBAAmB;;AASzB,IAAa,eAAb,MAA0B;CAEL;CACA;CAFnB,YACE,IACA,QAAuC,KAAK,KAC5C;EAFiB,KAAA,KAAA;EACA,KAAA,QAAA;CAChB;CAEH,OAAO,OAA0D,CAAC,GAAW;EAC3E,MAAM,QAAQ,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;EAClD,MAAM,IAAI,KAAK,MAAM;EACrB,KAAK,GAAG,IACN,0GACA,OAAO,KAAK,GACZ,IAAI,KAAK,CAAC,CAAC,CAAC,YAAY,GACxB,IAAI,KAAK,IAAI,cAAc,CAAC,CAAC,YAAY,GACzC,KAAK,MAAM,MACX,KAAK,WAAW,MAAM,GAAG,GAAG,KAAK,IACnC;EACA,OAAO;CACT;CAEA,MAAM,OAAgD;EACpD,IAAI,CAAC,OAAO,OAAO;GAAE,OAAO;GAAO,WAAW;EAAM;EACpD,MAAM,OAAO,OAAO,KAAK;EACzB,MAAM,MAAM,KAAK,GAAG,IAClB,0EACA,IACF;EACA,IAAI,CAAC,KAAK,OAAO;GAAE,OAAO;GAAO,WAAW;EAAM;EAClD,MAAM,IAAI,KAAK,MAAM;EACrB,MAAM,UAAU,KAAK,MAAM,IAAI,UAAU;EACzC,MAAM,YAAY,KAAK,MAAM,IAAI,UAAU,IAAI;EAC/C,IAAI,EAAE,UAAU,MAAM,EAAE,YAAY,IAAI;GACtC,KAAK,GAAG,IAAI,mDAAmD,IAAI;GACnE,OAAO;IAAE,OAAO;IAAO,WAAW;GAAM;EAC1C;EACA,MAAM,OAAO,KAAK,IAAI,IAAI,gBAAgB,SAAS;EACnD,IAAI,OAAO,UAAU,kBAAkB,OAAO;GAAE,OAAO;GAAM,WAAW;EAAM;EAC9E,KAAK,GAAG,IAAI,iEAAiE,IAAI,KAAK,IAAI,CAAC,CAAC,YAAY,GAAG,IAAI;EAC/G,OAAO;GAAE,OAAO;GAAM,WAAW;EAAK;CACxC;CAEA,OAAO,OAAqB;EAC1B,KAAK,GAAG,IAAI,mDAAmD,OAAO,KAAK,CAAC;CAC9E;;CAGA,UAAU,aAAqC;EAC7C,IAAI,aAAa,OAAO,KAAK,GAAG,IAAI,oDAAoD,OAAO,WAAW,CAAC,CAAC,CAAC;EAC7G,OAAO,KAAK,GAAG,IAAI,4BAA4B,CAAC,CAAC;CACnD;CAEA,eAAuB;EACrB,OAAO,KAAK,GAAG,IAAI,oDAAoD,IAAI,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;CAC/G;AACF;;;AC5DA,MAAa,iBAAiB;AAC9B,MAAa,cAAc;AAE3B,MAAa,sBAAsB;;AAQnC,IAAa,YAAb,MAAuB;CAIQ;CAH7B,SAAiB;CACjB,UAA2C,CAAC;CAE5C,YAAY,KAA8B;EAAb,KAAA,MAAA;CAAc;CAE3C,IAAI,QAAgB;EAClB,OAAO,KAAK;CACd;CAEA,MAAM,UAA+B;EACnC,IAAI,KAAK,SAAS,KAAK,KAAK,KAAK;OAC5B,MAAM,IAAI,SAAe,YAAY,KAAK,QAAQ,KAAK,OAAO,CAAC;EACpE,IAAI,WAAW;EACf,aAAa;GACX,IAAI,UAAU;GACd,WAAW;GACX,MAAM,OAAO,KAAK,QAAQ,MAAM;GAChC,IAAI,MAAM,KAAK;QACV,KAAK;EACZ;CACF;AACF;AAcA,MAAM,4BAAY,IAAI,QAA6B;AAEnD,SAAgB,UAAU,KAA0B;CAClD,IAAI,OAAO,UAAU,IAAI,GAAG;CAC5B,IAAI,CAAC,MAAM;EACT,OAAO;GAAE,UAAU,IAAI,aAAa,IAAI,EAAE;GAAG,SAAS,IAAI,aAAa;GAAG,uBAAO,IAAI,IAAI;GAAG,aAAa,IAAI,UAAA,CAAsC;EAAE;EACrJ,UAAU,IAAI,KAAK,IAAI;CACzB;CACA,OAAO;AACT;;AAGA,MAAa,aAAa,QAA2B,CAAC,CAAC,IAAI,SAAS,SAAS,oBAAoB;;AAGjG,SAAgB,kBAAkB,KAA8B;CAC9D,OAAO,UAAU,GAAG,IAAI,OAAO,iBAAiB,IAAI,OAAO,OAAO;AACpE;;AAGA,SAAgB,mBAAmB,KAAuB;CACxD,MAAM,OAAO,UAAU,GAAG;CAC1B,IAAI,GAAG,SAAS;EACd,IAAI,SAAS,YAAY,oBAAoB;EAC7C,KAAK,SAAS,UAAU;CAC1B,CAAC;CACD,KAAK,QAAQ,MAAM;CACnB,IAAI,MAAM,OAAO;EAAE,WAAW;EAAU,QAAQ;EAAwB,SAAS;CAAK,CAAC;CACvF,OAAO,qBAAqB,IAAI,OAAO,OAAO;AAChD;;AAGA,SAAgB,iBAAiB,IAAqB;CACpD,MAAM,OAAO,GAAG,QAAQ,QAAQ,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,QAAQ,mCAAmC,EAAE;CAC/F,IAAI,OAAO,IAAI,GAAG;EAChB,MAAM,CAAC,IAAI,GAAG,IAAI,KAAK,KAAK,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM;EACjD,OAAO,MAAM,OAAO,MAAM,MAAO,MAAM,OAAO,KAAK,MAAM,KAAK,MAAQ,MAAM,OAAO,MAAM,OAAS,MAAM,OAAO,KAAK,MAAM,KAAK;CACjI;CACA,IAAI,OAAO,IAAI,GAAG,OAAO,SAAS,SAAS,uBAAuB,KAAK,IAAI;CAC3E,OAAO;AACT;AAEA,SAAS,cAAc,GAA2B;CAChD,IAAI;EACF,OAAO,YAAY,CAAC,CAAC,CAAC,OAAO,WAAW;CAC1C,QAAQ;EAEN,OAAO;CACT;AACF;;;;;;;AAQA,SAAgB,SAAS,GAAY,YAA6B;CAChE,MAAM,OAAO,cAAc,CAAC;CAC5B,IAAI,cAAc,QAAQ,iBAAiB,IAAI,GAAG;EAChD,MAAM,OAAO,KAAK,IAAI,GAAG,OAAO,SAAS,QAAQ,IAAI,oBAAoB,KAAK,EAAE,KAAK,CAAC;EACtF,MAAM,SAAS,EAAE,IAAI,OAAO,iBAAiB,KAAK,GAAA,CAC/C,MAAM,GAAG,CAAC,CACV,KAAK,MAAM,EAAE,KAAK,CAAC,CAAC,CACpB,OAAO,OAAO;EACjB,MAAM,YAAY,MAAM,MAAM,SAAS;EACvC,IAAI,aAAa,KAAK,SAAS,GAAG,OAAO;CAC3C;CACA,OAAO,QAAQ;AACjB;AAEA,SAAS,SAAS,GAAY,YAA8B;CAC1D,IAAI,IAAI,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,aAAa,UAAU,OAAO;CACrD,MAAM,OAAO,cAAc,CAAC;CAC5B,OAAO,cAAc,CAAC,CAAC,QAAQ,iBAAiB,IAAI,KAAK,EAAE,IAAI,OAAO,mBAAmB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,YAAY,MAAM;AACtI;AAEA,SAAgB,aAAa,GAAgC;CAC3D,OAAO,UAAU,GAAA,aAAiB,KAAK,KAAA;AACzC;AAEA,SAAS,mBAAmB,GAAY,OAAe,YAA2B;CAChF,UAAU,GAAG,gBAAgB,OAAO;EAClC,UAAU;EACV,UAAU;EACV,MAAM;EACN,QAAQ,SAAS,GAAG,UAAU;EAC9B,QAAQ,KAAK,MAAM,iBAAiB,GAAI;CAC1C,CAAC;AACH;;AAGA,SAAgB,aAAa,GAAY,KAAqB;CAE5D,mBAAmB,GADL,UAAU,GAAG,CAAC,CAAC,SAAS,OAAO;EAAE,IAAI,SAAS,GAAG,IAAI,OAAO,UAAU;EAAG,WAAW,EAAE,IAAI,OAAO,YAAY;CAAE,CACnG,GAAG,IAAI,OAAO,UAAU;AACpD;AAEA,SAAgB,WAAW,GAAY,KAAqB;CAC1D,MAAM,QAAQ,aAAa,CAAC;CAC5B,IAAI,OAAO,UAAU,GAAG,CAAC,CAAC,SAAS,OAAO,KAAK;CAC/C,aAAa,GAAG,gBAAgB,EAAE,MAAM,IAAI,CAAC;AAC/C;;AAGA,SAAgB,WAAW,GAAY,KAAwB;CAC7D,MAAM,QAAQ,aAAa,CAAC;CAC5B,MAAM,QAAQ,UAAU,GAAG,CAAC,CAAC,SAAS,MAAM,KAAK;CACjD,IAAI,MAAM,aAAa,OAAO,mBAAmB,GAAG,OAAO,IAAI,OAAO,UAAU;CAChF,OAAO,MAAM;AACf;;AAGA,SAAgB,aAAa,KAA0C;CACrE,OAAO,OAAO,GAAG,SAAS;EACxB,IAAI,CAAC,WAAW,GAAG,GAAG,GAAG;GACvB,IAAI,CAAC,UAAU,GAAG,GAChB,MAAM,IAAI,UAAU,KAAK,kBAAkB,0CAA0C,uDAAuD;GAE9I,MAAM,IAAI,UAAU,KAAK,gBAAgB,qBAAqB;EAChE;EACA,EAAE,IAAI,SAAS,IAAI;EACnB,MAAM,KAAK;CACb;AACF;AAEA,MAAM,2BAAW,IAAI,IAAI;CAAC;CAAQ;CAAO;CAAS;AAAQ,CAAC;;;;;AAM3D,SAAgB,YAAuC;CACrD,OAAO,OAAO,GAAG,SAAS;EACxB,IAAI,SAAS,IAAI,EAAE,IAAI,MAAM,KAAK,EAAE,IAAI,OAAA,mBAAkB,MAAM,KAC9D,MAAM,IAAI,UAAU,KAAK,QAAQ,WAAW,YAAY,UAAU,SAAS,YAAY,uCAAuC;EAEhI,MAAM,KAAK;CACb;AACF;;AAGA,SAAgB,UAAU,GAAY,SAA2B;CAC/D,EAAE,OAAO,eAAe,OAAO,UAAU,EAAE,CAAC;CAC5C,MAAM,UAAU,0CAA0C,QAAQ,SAAS,YAAY,IAAI,KAAK,IAAI;CACpG,OAAO,EAAE,KAAK,EAAE,OAAO;EAAE,MAAM;EAAc;CAAQ,EAAE,GAAG,GAAG;AAC/D;;;;;;;;;;AAyBA,eAAsB,YACpB,KACA,IACA,QACA,QACA,OAAqB,CAAC,GACA;CACtB,MAAM,OAAO,UAAU,GAAG;CAC1B,MAAM,MAAM,UAAU,EAAE;CACxB,MAAM,OAAO,KAAK,MAAM,IAAI,GAAG,KAAK;EAAE,MAAM,QAAQ,QAAQ;EAAG,QAAQ;CAAE;CACzE,IAAI,KAAK,SAAA,GAAgC,OAAO;EAAE,IAAI;EAAO,eAAe;EAAG,WAAW;EAAO,MAAM;CAAK;CAC5G,KAAK;CACL,KAAK,MAAM,IAAI,KAAK,IAAI;CACxB,MAAM,WAAW,KAAK;CACtB,IAAI;CACJ,KAAK,OAAO,IAAI,SAAe,YAAa,OAAO,OAAQ;CAC3D,IAAI;EACF,MAAM;EACN,OAAO,MAAM,UAAU,MAAM,IAAI,QAAQ,QAAQ,IAAI;CACvD,UAAU;EACR,KAAK;EACL,IAAI,EAAE,KAAK,WAAW,GAAG,KAAK,MAAM,OAAO,GAAG;CAChD;AACF;AAEA,eAAe,UAAU,MAAiB,IAAY,QAAgB,QAA0C,MAA0C;CACxJ,MAAM,EAAE,YAAY;CACpB,MAAM,SAAS,KAAK,WAAW;CAC/B,IAAI,UAAU,QAAQ,iBAAiB,KAAK,CAAC,QAAQ,cAAc,EAAE,GACnE,MAAM,IAAI,SAAS,MAAM,WAAW,GAAG,KAAK,cAAA,GAAgC,CAAC;CAG/E,MAAM,SAAS,QAAQ,cAAc,EAAE;CACvC,IAAI,QAAQ,OAAO;EAAE,IAAI;EAAO,eAAe;EAAQ,WAAW;CAAM;CACxE,IAAI,QAAQ,SAAS,IAAI,MAAM,GAAG,OAAO;EAAE,IAAI;EAAO,eAAe;EAAG,WAAW,QAAQ,KAAK,IAAI,QAAQ,EAAE,OAAO,CAAC;CAAE;CACxH,MAAM,cAAc,QAAQ,OAAO,IAAI,QAAQ,EAAE,OAAO,CAAC;CACzD,MAAM,UAAU,MAAM,KAAK,YAAY,QAAQ;CAC/C,IAAI,KAAK;CACT,IAAI;EACF,KAAK,MAAM,OAAO;CACpB,UAAU;EACR,QAAQ;CACV;CACA,IAAI,CAAC,IAAI,OAAO;EAAE,IAAI;EAAO,eAAe;EAAG,WAAW,YAAY;CAAO;CAC7E,QAAQ,MAAM,EAAE;CAChB,IAAI,YAAY,iBAAiB,QAAQ,aAAa;CACtD,OAAO,EAAE,IAAI,KAAK;AACpB;;AAGA,SAAgB,UAAU,GAAY,OAAqC;CACzE,IAAI,MAAM,IAAI,OAAO;CACrB,IAAI,MAAM,MAAM;EACd,EAAE,OAAO,eAAe,GAAG;EAC3B,OAAO,EAAE,KAAK,EAAE,OAAO;GAAE,MAAM;GAAqB,SAAS;EAA2F,EAAE,GAAG,GAAG;CAClK;CACA,OAAO,MAAM,gBAAgB,UAAU,GAAG,MAAM,aAAa,IAAI;AACnE"}

package/dist/auth-C2v7bEmQ.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export { l as currentSetupToken, f as isClaimed, _ as resetAdminPassword } from "./auth-BniddcRD.js";

package/dist/bus-Cz0flS37.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+import { EventEmitter } from "node:events";
+//#region server/bus.ts
+function createBus() {
+	const bus = new EventEmitter();
+	bus.setMaxListeners(0);
+	return bus;
+}
+//#endregion
+export { createBus as t };
+
+//# sourceMappingURL=bus-Cz0flS37.js.map

package/dist/bus-Cz0flS37.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bus-Cz0flS37.js","names":[],"sources":["../server/bus.ts"],"sourcesContent":["import { EventEmitter } from \"node:events\";\nimport type { Account, Approval, AuditEntry, Delivery, MailEvent, Settings } from \"../shared/types.ts\";\n\n/**\n * In-process notifications. Fired *after* the change is committed to the database, so listeners\n * can read it back. Used by the console SSE stream, `wait_for_events`, the webhook worker and the\n * ingest loop (settings changes). Listeners must not throw.\n */\nexport interface BusEvents {\n  /** A new event row was committed (and its webhook deliveries enqueued). */\n  event: [MailEvent];\n  /** A delivery was created or changed state. */\n  delivery: [Delivery];\n  /** An approval was created or decided. */\n  approval: [Approval];\n  audit: [AuditEntry];\n  /** An account was connected or its status/sync state changed. */\n  account: [Account];\n  settings: [Settings];\n}\n\nexport type Bus = EventEmitter<BusEvents>;\n\nexport function createBus(): Bus {\n  const bus = new EventEmitter<BusEvents>();\n  // Every SSE client and pending wait_for_events call adds a listener.\n  bus.setMaxListeners(0);\n  return bus;\n}\n"],"mappings":";;;AAuBA,SAAgB,YAAiB;CAC/B,MAAM,MAAM,IAAI,aAAwB;CAExC,IAAI,gBAAgB,CAAC;CACrB,OAAO;AACT"}

package/dist/bus-OKIGut72.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export { t as createBus } from "./bus-Cz0flS37.js";