agentinbox-cli 0.0.0 → 0.1.0-nightly.1

package/dist/cli.js

@@ -0,0 +1,141 @@
+#!/usr/bin/env node
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { Command, InvalidArgumentError } from "commander";
+import pc from "picocolors";
+//#region server/cli.ts
+const emitWarning = process.emitWarning.bind(process);
+process.emitWarning = ((warning, ...rest) => {
+	const message = typeof warning === "string" ? warning : warning.message;
+	if (((typeof rest[0] === "string" ? rest[0] : rest[0]?.type) === "ExperimentalWarning" || warning.name === "ExperimentalWarning") && /SQLite/i.test(message)) return;
+	return emitWarning(warning, ...rest);
+});
+/** package.json sits one level above both dist/cli.js and server/cli.ts. */
+function packageVersion() {
+	try {
+		return JSON.parse(readFileSync(join(import.meta.dirname, "..", "package.json"), "utf8")).version;
+	} catch {
+		return "0.0.0";
+	}
+}
+const version = packageVersion();
+const validPort = (value) => /^\d+$/.test(value) && Number(value) <= 65535;
+function parsePort(value) {
+	if (!validPort(value)) throw new InvalidArgumentError("Port must be a number from 0 to 65535.");
+	return Number(value);
+}
+/** --port, else a validated PORT env (a typo there would otherwise become NaN deep inside). */
+function portOption(flag) {
+	if (flag !== void 0) return flag;
+	const env = process.env.PORT?.trim();
+	if (!env) return void 0;
+	if (!validPort(env)) throw new Error(`PORT="${process.env.PORT}" is not a valid port. Use a number from 0 to 65535.`);
+	return Number(env);
+}
+const withServerOptions = (cmd) => cmd.option("-p, --port <port>", "port to listen on (default 8425, env PORT)", parsePort).option("--host <host>", "bind address (default 0.0.0.0, env HOST)").option("-d, --data <dir>", "data directory (default ~/.agentinbox, env AGENTINBOX_DATA)");
+const configInput = (o) => ({
+	port: portOption(o.port),
+	host: o.host,
+	dataDir: o.data
+});
+const program = new Command("agentinbox").description("Self-hosted Gmail broker for AI agents: MCP tools, webhooks, guardrails and a web console.").version(version, "-v, --version", "print the version").helpOption("-h, --help", "show help").addHelpText("after", "\nWithout installing: npx agentinbox-cli [command]. To install the command: npm i -g agentinbox-cli").showSuggestionAfterError();
+withServerOptions(program.command("start", { isDefault: true }).description("run agentinbox in the foreground (default)")).option("--no-open", "don't open a browser on first run").option("--dev", "development: API only, the console runs on Vite (:5173)").action(async (o) => {
+	const { runForeground } = await import("./server-CWqKeCGn.js");
+	await runForeground({
+		...configInput(o),
+		dev: !!o.dev,
+		open: o.open,
+		version
+	});
+});
+const service = program.command("service").description("run agentinbox as a background service (systemd / launchd)");
+withServerOptions(service.command("install").description("install and start the service; re-run to update")).action(async (o) => {
+	const { loadConfig } = await import("./config-CIvgMqLx.js");
+	const { installService } = await import("./service-63pdSmhO.js");
+	await installService(loadConfig(configInput(o), version));
+});
+service.command("uninstall").description("stop and remove the service (keeps your data)").option("-d, --data <dir>", "data directory (default ~/.agentinbox, env AGENTINBOX_DATA)").action(async (o) => {
+	const { loadConfig } = await import("./config-CIvgMqLx.js");
+	const { uninstallService } = await import("./service-63pdSmhO.js");
+	uninstallService(loadConfig(configInput(o), version));
+});
+service.command("status").description("show service status").action(async () => {
+	const { serviceStatus } = await import("./service-63pdSmhO.js");
+	serviceStatus();
+});
+const skill = program.command("skill").description("the agentinbox agent skill (SKILL.md)");
+skill.command("print").description("print SKILL.md to stdout").option("--url <url>", "agentinbox server URL to fill in (env AGENTINBOX_URL)").action(async (o) => {
+	const { renderSkill } = await import("./skill-BWWtinsE.js");
+	process.stdout.write(renderSkill(serverUrl(o.url)));
+});
+skill.command("install").description("install SKILL.md for an agent (no running server needed)").option("-t, --target <target>", "claude, codex, agents, or a skills directory", "claude").option("--url <url>", "agentinbox server URL agents connect to (env AGENTINBOX_URL)").action(async (o) => {
+	const { renderSkill, skillPath, writeSkill } = await import("./skill-BWWtinsE.js");
+	const url = serverUrl(o.url);
+	const path = skillPath(o.target);
+	writeSkill(path, renderSkill(url));
+	console.log(`Installed the agentinbox skill to ${pc.cyan(path)} (server ${url}).`);
+	if (!o.url && !process.env.AGENTINBOX_URL) console.log(pc.dim("Agents on other machines need the server's address: re-run with --url https://your-server."));
+});
+withServerOptions(program.command("reset-password").description("remove the admin password and print a new setup link")).action(async (o) => {
+	const dataDir = resolve(o.data ?? process.env.AGENTINBOX_DATA ?? join(homedir(), ".agentinbox"));
+	const dbPath = join(dataDir, "agentinbox.db");
+	if (!existsSync(dbPath)) throw new Error(`No agentinbox data in ${dataDir}. If agentinbox runs as a system service, run this with sudo; otherwise pass the data directory it uses with --data.`);
+	const { loadConfig } = await import("./config-CIvgMqLx.js");
+	const { Db } = await import("./db-CfoMO5zW.js");
+	const { createBus } = await import("./bus-OKIGut72.js");
+	const { SettingsStore } = await import("./settings-qtn5WTBM.js");
+	const { AuditLog } = await import("./audit-CQe-_dPQ.js");
+	const { currentSetupToken, isClaimed, resetAdminPassword } = await import("./auth-C2v7bEmQ.js");
+	const { runningInstance } = await import("./instance-DZMV78rI.js");
+	const { consoleUrls } = await import("./urls-CNYhbeUQ.js");
+	const running = runningInstance(dataDir);
+	const config = loadConfig({
+		dataDir,
+		port: portOption(o.port) ?? running?.port,
+		host: o.host ?? (process.env.HOST || running?.host)
+	}, version);
+	const db = new Db(dbPath);
+	try {
+		const bus = createBus();
+		const core = {
+			config,
+			db,
+			settings: new SettingsStore(db, bus, config),
+			audit: new AuditLog(db, bus)
+		};
+		const claimed = isClaimed(core);
+		const token = claimed ? resetAdminPassword(core) : currentSetupToken(core);
+		console.log(claimed ? "\n  The admin password was removed and all console sessions were signed out.\n  Open this link to set a new password:\n" : "\n  This instance hasn't been claimed yet, so there is no password to reset.\n  Open this link to claim it:\n");
+		const urls = consoleUrls(config.host, config.port);
+		const publicUrl = core.settings.publicUrl();
+		if (!urls.includes(publicUrl)) urls.push(publicUrl);
+		for (const url of urls) console.log(`  ${pc.cyan(`${url}/setup?token=${token}`)}`);
+		console.log(pc.dim(`\n  ${running ? "The running agentinbox picks this up immediately; no restart needed." : "Start agentinbox to use it."}\n`));
+	} finally {
+		db.close();
+	}
+});
+/** The URL written into SKILL.md: --url, AGENTINBOX_URL, or this machine's default. */
+function serverUrl(flag) {
+	const raw = flag ?? process.env.AGENTINBOX_URL ?? `http://localhost:${process.env.PORT || 8425}`;
+	let url;
+	try {
+		url = new URL(raw);
+	} catch {
+		throw new Error(`Invalid --url "${raw}". Use a full URL such as https://mail.example.com.`);
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:") throw new Error("--url must start with http:// or https://");
+	return (url.origin + url.pathname).replace(/\/+$/, "");
+}
+try {
+	await program.parseAsync(process.argv);
+} catch (err) {
+	console.error(pc.red(err instanceof Error ? err.message : String(err)));
+	if (process.env.AGENTINBOX_DEBUG && err instanceof Error) console.error(err.stack);
+	process.exit(1);
+}
+//#endregion
+export {};
+
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","names":[],"sources":["../server/cli.ts"],"sourcesContent":["import { existsSync, readFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join, resolve } from \"node:path\";\nimport { Command, InvalidArgumentError } from \"commander\";\nimport pc from \"picocolors\";\n\n// node:sqlite is stable enough for us but still warns on Node 22. This runs before any server\n// module loads: everything that touches node:sqlite is imported dynamically below.\nconst emitWarning = process.emitWarning.bind(process);\nprocess.emitWarning = ((warning: string | Error, ...rest: unknown[]) => {\n  const message = typeof warning === \"string\" ? warning : warning.message;\n  const type = typeof rest[0] === \"string\" ? rest[0] : (rest[0] as { type?: string } | undefined)?.type;\n  if ((type === \"ExperimentalWarning\" || (warning as Error).name === \"ExperimentalWarning\") && /SQLite/i.test(message)) return;\n  return (emitWarning as (...args: unknown[]) => void)(warning, ...rest);\n}) as typeof process.emitWarning;\n\n/** package.json sits one level above both dist/cli.js and server/cli.ts. */\nfunction packageVersion(): string {\n  try {\n    return (JSON.parse(readFileSync(join(import.meta.dirname, \"..\", \"package.json\"), \"utf8\")) as { version: string }).version;\n  } catch {\n    return \"0.0.0\";\n  }\n}\n\nconst version = packageVersion();\n\ninterface ServerFlags {\n  port?: number;\n  host?: string;\n  data?: string;\n}\n\nconst validPort = (value: string) => /^\\d+$/.test(value) && Number(value) <= 65535;\n\nfunction parsePort(value: string): number {\n  if (!validPort(value)) throw new InvalidArgumentError(\"Port must be a number from 0 to 65535.\");\n  return Number(value);\n}\n\n/** --port, else a validated PORT env (a typo there would otherwise become NaN deep inside). */\nfunction portOption(flag: number | undefined): number | undefined {\n  if (flag !== undefined) return flag;\n  const env = process.env.PORT?.trim();\n  if (!env) return undefined;\n  if (!validPort(env)) throw new Error(`PORT=\"${process.env.PORT}\" is not a valid port. Use a number from 0 to 65535.`);\n  return Number(env);\n}\n\nconst withServerOptions = (cmd: Command) =>\n  cmd\n    .option(\"-p, --port <port>\", \"port to listen on (default 8425, env PORT)\", parsePort)\n    .option(\"--host <host>\", \"bind address (default 0.0.0.0, env HOST)\")\n    .option(\"-d, --data <dir>\", \"data directory (default ~/.agentinbox, env AGENTINBOX_DATA)\");\n\nconst configInput = (o: ServerFlags) => ({ port: portOption(o.port), host: o.host, dataDir: o.data });\n\nconst program = new Command(\"agentinbox\")\n  .description(\"Self-hosted Gmail broker for AI agents: MCP tools, webhooks, guardrails and a web console.\")\n  .version(version, \"-v, --version\", \"print the version\")\n  .helpOption(\"-h, --help\", \"show help\")\n  .addHelpText(\"after\", \"\\nWithout installing: npx agentinbox-cli [command]. To install the command: npm i -g agentinbox-cli\")\n  .showSuggestionAfterError();\n\nwithServerOptions(program.command(\"start\", { isDefault: true }).description(\"run agentinbox in the foreground (default)\"))\n  .option(\"--no-open\", \"don't open a browser on first run\")\n  .option(\"--dev\", \"development: API only, the console runs on Vite (:5173)\")\n  .action(async (o: ServerFlags & { open: boolean; dev?: boolean }) => {\n    const { runForeground } = await import(\"./server.ts\");\n    await runForeground({ ...configInput(o), dev: !!o.dev, open: o.open, version });\n  });\n\nconst service = program.command(\"service\").description(\"run agentinbox as a background service (systemd / launchd)\");\n\nwithServerOptions(service.command(\"install\").description(\"install and start the service; re-run to update\")).action(async (o: ServerFlags) => {\n  const { loadConfig } = await import(\"./config.ts\");\n  const { installService } = await import(\"./service.ts\");\n  await installService(loadConfig(configInput(o), version));\n});\n\nservice\n  .command(\"uninstall\")\n  .description(\"stop and remove the service (keeps your data)\")\n  .option(\"-d, --data <dir>\", \"data directory (default ~/.agentinbox, env AGENTINBOX_DATA)\")\n  .action(async (o: ServerFlags) => {\n    const { loadConfig } = await import(\"./config.ts\");\n    const { uninstallService } = await import(\"./service.ts\");\n    uninstallService(loadConfig(configInput(o), version));\n  });\n\nservice\n  .command(\"status\")\n  .description(\"show service status\")\n  .action(async () => {\n    const { serviceStatus } = await import(\"./service.ts\");\n    serviceStatus();\n  });\n\nconst skill = program.command(\"skill\").description(\"the agentinbox agent skill (SKILL.md)\");\n\nskill\n  .command(\"print\")\n  .description(\"print SKILL.md to stdout\")\n  .option(\"--url <url>\", \"agentinbox server URL to fill in (env AGENTINBOX_URL)\")\n  .action(async (o: { url?: string }) => {\n    const { renderSkill } = await import(\"./skill/index.ts\");\n    process.stdout.write(renderSkill(serverUrl(o.url)));\n  });\n\nskill\n  .command(\"install\")\n  .description(\"install SKILL.md for an agent (no running server needed)\")\n  .option(\"-t, --target <target>\", \"claude, codex, agents, or a skills directory\", \"claude\")\n  .option(\"--url <url>\", \"agentinbox server URL agents connect to (env AGENTINBOX_URL)\")\n  .action(async (o: { target: string; url?: string }) => {\n    const { renderSkill, skillPath, writeSkill } = await import(\"./skill/index.ts\");\n    const url = serverUrl(o.url);\n    const path = skillPath(o.target);\n    writeSkill(path, renderSkill(url));\n    console.log(`Installed the agentinbox skill to ${pc.cyan(path)} (server ${url}).`);\n    if (!o.url && !process.env.AGENTINBOX_URL) {\n      console.log(pc.dim(\"Agents on other machines need the server's address: re-run with --url https://your-server.\"));\n    }\n  });\n\nwithServerOptions(program.command(\"reset-password\").description(\"remove the admin password and print a new setup link\")).action(\n  async (o: ServerFlags) => {\n    // Never create a data directory or master key here: a wrong --data (or a service running as\n    // another user) must not silently produce a fresh instance.\n    const dataDir = resolve(o.data ?? process.env.AGENTINBOX_DATA ?? join(homedir(), \".agentinbox\"));\n    const dbPath = join(dataDir, \"agentinbox.db\");\n    if (!existsSync(dbPath)) {\n      throw new Error(\n        `No agentinbox data in ${dataDir}. If agentinbox runs as a system service, run this with sudo; ` +\n          \"otherwise pass the data directory it uses with --data.\",\n      );\n    }\n    const { loadConfig } = await import(\"./config.ts\");\n    const { Db } = await import(\"./db/index.ts\");\n    const { createBus } = await import(\"./bus.ts\");\n    const { SettingsStore } = await import(\"./settings.ts\");\n    const { AuditLog } = await import(\"./audit.ts\");\n    const { currentSetupToken, isClaimed, resetAdminPassword } = await import(\"./auth/index.ts\");\n    const { runningInstance } = await import(\"./instance.ts\");\n    const { consoleUrls } = await import(\"./urls.ts\");\n\n    const running = runningInstance(dataDir);\n    const config = loadConfig(\n      { dataDir, port: portOption(o.port) ?? running?.port, host: o.host ?? (process.env.HOST || running?.host) },\n      version,\n    );\n    const db = new Db(dbPath);\n    try {\n      const bus = createBus();\n      const core = { config, db, settings: new SettingsStore(db, bus, config), audit: new AuditLog(db, bus) };\n      const claimed = isClaimed(core);\n      const token = claimed ? resetAdminPassword(core) : currentSetupToken(core)!;\n      console.log(\n        claimed\n          ? \"\\n  The admin password was removed and all console sessions were signed out.\\n  Open this link to set a new password:\\n\"\n          : \"\\n  This instance hasn't been claimed yet, so there is no password to reset.\\n  Open this link to claim it:\\n\",\n      );\n      const urls = consoleUrls(config.host, config.port);\n      const publicUrl = core.settings.publicUrl();\n      if (!urls.includes(publicUrl)) urls.push(publicUrl);\n      for (const url of urls) console.log(`  ${pc.cyan(`${url}/setup?token=${token}`)}`);\n      console.log(pc.dim(`\\n  ${running ? \"The running agentinbox picks this up immediately; no restart needed.\" : \"Start agentinbox to use it.\"}\\n`));\n    } finally {\n      db.close();\n    }\n  },\n);\n\n/** The URL written into SKILL.md: --url, AGENTINBOX_URL, or this machine's default. */\nfunction serverUrl(flag: string | undefined): string {\n  const raw = flag ?? process.env.AGENTINBOX_URL ?? `http://localhost:${process.env.PORT || 8425}`;\n  let url: URL;\n  try {\n    url = new URL(raw);\n  } catch {\n    throw new Error(`Invalid --url \"${raw}\". Use a full URL such as https://mail.example.com.`);\n  }\n  if (url.protocol !== \"http:\" && url.protocol !== \"https:\") throw new Error(\"--url must start with http:// or https://\");\n  return (url.origin + url.pathname).replace(/\\/+$/, \"\");\n}\n\ntry {\n  await program.parseAsync(process.argv);\n} catch (err) {\n  console.error(pc.red(err instanceof Error ? err.message : String(err)));\n  if (process.env.AGENTINBOX_DEBUG && err instanceof Error) console.error(err.stack);\n  process.exit(1);\n}\n"],"mappings":";;;;;;;AAQA,MAAM,cAAc,QAAQ,YAAY,KAAK,OAAO;AACpD,QAAQ,gBAAgB,SAAyB,GAAG,SAAoB;CACtE,MAAM,UAAU,OAAO,YAAY,WAAW,UAAU,QAAQ;CAEhE,MADa,OAAO,KAAK,OAAO,WAAW,KAAK,KAAM,KAAK,EAAE,EAAoC,UACnF,yBAA0B,QAAkB,SAAS,0BAA0B,UAAU,KAAK,OAAO,GAAG;CACtH,OAAQ,YAA6C,SAAS,GAAG,IAAI;AACvE;;AAGA,SAAS,iBAAyB;CAChC,IAAI;EACF,OAAQ,KAAK,MAAM,aAAa,KAAK,YAAY,SAAS,MAAM,cAAc,GAAG,MAAM,CAAC,CAAC,CAAyB;CACpH,QAAQ;EACN,OAAO;CACT;AACF;AAEA,MAAM,UAAU,eAAe;AAQ/B,MAAM,aAAa,UAAkB,QAAQ,KAAK,KAAK,KAAK,OAAO,KAAK,KAAK;AAE7E,SAAS,UAAU,OAAuB;CACxC,IAAI,CAAC,UAAU,KAAK,GAAG,MAAM,IAAI,qBAAqB,wCAAwC;CAC9F,OAAO,OAAO,KAAK;AACrB;;AAGA,SAAS,WAAW,MAA8C;CAChE,IAAI,SAAS,KAAA,GAAW,OAAO;CAC/B,MAAM,MAAM,QAAQ,IAAI,MAAM,KAAK;CACnC,IAAI,CAAC,KAAK,OAAO,KAAA;CACjB,IAAI,CAAC,UAAU,GAAG,GAAG,MAAM,IAAI,MAAM,SAAS,QAAQ,IAAI,KAAK,qDAAqD;CACpH,OAAO,OAAO,GAAG;AACnB;AAEA,MAAM,qBAAqB,QACzB,IACG,OAAO,qBAAqB,8CAA8C,SAAS,CAAC,CACpF,OAAO,iBAAiB,0CAA0C,CAAC,CACnE,OAAO,oBAAoB,6DAA6D;AAE7F,MAAM,eAAe,OAAoB;CAAE,MAAM,WAAW,EAAE,IAAI;CAAG,MAAM,EAAE;CAAM,SAAS,EAAE;AAAK;AAEnG,MAAM,UAAU,IAAI,QAAQ,YAAY,CAAC,CACtC,YAAY,4FAA4F,CAAC,CACzG,QAAQ,SAAS,iBAAiB,mBAAmB,CAAC,CACtD,WAAW,cAAc,WAAW,CAAC,CACrC,YAAY,SAAS,qGAAqG,CAAC,CAC3H,yBAAyB;AAE5B,kBAAkB,QAAQ,QAAQ,SAAS,EAAE,WAAW,KAAK,CAAC,CAAC,CAAC,YAAY,4CAA4C,CAAC,CAAC,CACvH,OAAO,aAAa,mCAAmC,CAAC,CACxD,OAAO,SAAS,yDAAyD,CAAC,CAC1E,OAAO,OAAO,MAAsD;CACnE,MAAM,EAAE,kBAAkB,MAAM,OAAO;CACvC,MAAM,cAAc;EAAE,GAAG,YAAY,CAAC;EAAG,KAAK,CAAC,CAAC,EAAE;EAAK,MAAM,EAAE;EAAM;CAAQ,CAAC;AAChF,CAAC;AAEH,MAAM,UAAU,QAAQ,QAAQ,SAAS,CAAC,CAAC,YAAY,4DAA4D;AAEnH,kBAAkB,QAAQ,QAAQ,SAAS,CAAC,CAAC,YAAY,iDAAiD,CAAC,CAAC,CAAC,OAAO,OAAO,MAAmB;CAC5I,MAAM,EAAE,eAAe,MAAM,OAAO;CACpC,MAAM,EAAE,mBAAmB,MAAM,OAAO;CACxC,MAAM,eAAe,WAAW,YAAY,CAAC,GAAG,OAAO,CAAC;AAC1D,CAAC;AAED,QACG,QAAQ,WAAW,CAAC,CACpB,YAAY,+CAA+C,CAAC,CAC5D,OAAO,oBAAoB,6DAA6D,CAAC,CACzF,OAAO,OAAO,MAAmB;CAChC,MAAM,EAAE,eAAe,MAAM,OAAO;CACpC,MAAM,EAAE,qBAAqB,MAAM,OAAO;CAC1C,iBAAiB,WAAW,YAAY,CAAC,GAAG,OAAO,CAAC;AACtD,CAAC;AAEH,QACG,QAAQ,QAAQ,CAAC,CACjB,YAAY,qBAAqB,CAAC,CAClC,OAAO,YAAY;CAClB,MAAM,EAAE,kBAAkB,MAAM,OAAO;CACvC,cAAc;AAChB,CAAC;AAEH,MAAM,QAAQ,QAAQ,QAAQ,OAAO,CAAC,CAAC,YAAY,uCAAuC;AAE1F,MACG,QAAQ,OAAO,CAAC,CAChB,YAAY,0BAA0B,CAAC,CACvC,OAAO,eAAe,uDAAuD,CAAC,CAC9E,OAAO,OAAO,MAAwB;CACrC,MAAM,EAAE,gBAAgB,MAAM,OAAO;CACrC,QAAQ,OAAO,MAAM,YAAY,UAAU,EAAE,GAAG,CAAC,CAAC;AACpD,CAAC;AAEH,MACG,QAAQ,SAAS,CAAC,CAClB,YAAY,0DAA0D,CAAC,CACvE,OAAO,yBAAyB,gDAAgD,QAAQ,CAAC,CACzF,OAAO,eAAe,8DAA8D,CAAC,CACrF,OAAO,OAAO,MAAwC;CACrD,MAAM,EAAE,aAAa,WAAW,eAAe,MAAM,OAAO;CAC5D,MAAM,MAAM,UAAU,EAAE,GAAG;CAC3B,MAAM,OAAO,UAAU,EAAE,MAAM;CAC/B,WAAW,MAAM,YAAY,GAAG,CAAC;CACjC,QAAQ,IAAI,qCAAqC,GAAG,KAAK,IAAI,EAAE,WAAW,IAAI,GAAG;CACjF,IAAI,CAAC,EAAE,OAAO,CAAC,QAAQ,IAAI,gBACzB,QAAQ,IAAI,GAAG,IAAI,4FAA4F,CAAC;AAEpH,CAAC;AAEH,kBAAkB,QAAQ,QAAQ,gBAAgB,CAAC,CAAC,YAAY,sDAAsD,CAAC,CAAC,CAAC,OACvH,OAAO,MAAmB;CAGxB,MAAM,UAAU,QAAQ,EAAE,QAAQ,QAAQ,IAAI,mBAAmB,KAAK,QAAQ,GAAG,aAAa,CAAC;CAC/F,MAAM,SAAS,KAAK,SAAS,eAAe;CAC5C,IAAI,CAAC,WAAW,MAAM,GACpB,MAAM,IAAI,MACR,yBAAyB,QAAQ,qHAEnC;CAEF,MAAM,EAAE,eAAe,MAAM,OAAO;CACpC,MAAM,EAAE,OAAO,MAAM,OAAO;CAC5B,MAAM,EAAE,cAAc,MAAM,OAAO;CACnC,MAAM,EAAE,kBAAkB,MAAM,OAAO;CACvC,MAAM,EAAE,aAAa,MAAM,OAAO;CAClC,MAAM,EAAE,mBAAmB,WAAW,uBAAuB,MAAM,OAAO;CAC1E,MAAM,EAAE,oBAAoB,MAAM,OAAO;CACzC,MAAM,EAAE,gBAAgB,MAAM,OAAO;CAErC,MAAM,UAAU,gBAAgB,OAAO;CACvC,MAAM,SAAS,WACb;EAAE;EAAS,MAAM,WAAW,EAAE,IAAI,KAAK,SAAS;EAAM,MAAM,EAAE,SAAS,QAAQ,IAAI,QAAQ,SAAS;CAAM,GAC1G,OACF;CACA,MAAM,KAAK,IAAI,GAAG,MAAM;CACxB,IAAI;EACF,MAAM,MAAM,UAAU;EACtB,MAAM,OAAO;GAAE;GAAQ;GAAI,UAAU,IAAI,cAAc,IAAI,KAAK,MAAM;GAAG,OAAO,IAAI,SAAS,IAAI,GAAG;EAAE;EACtG,MAAM,UAAU,UAAU,IAAI;EAC9B,MAAM,QAAQ,UAAU,mBAAmB,IAAI,IAAI,kBAAkB,IAAI;EACzE,QAAQ,IACN,UACI,4HACA,+GACN;EACA,MAAM,OAAO,YAAY,OAAO,MAAM,OAAO,IAAI;EACjD,MAAM,YAAY,KAAK,SAAS,UAAU;EAC1C,IAAI,CAAC,KAAK,SAAS,SAAS,GAAG,KAAK,KAAK,SAAS;EAClD,KAAK,MAAM,OAAO,MAAM,QAAQ,IAAI,KAAK,GAAG,KAAK,GAAG,IAAI,eAAe,OAAO,GAAG;EACjF,QAAQ,IAAI,GAAG,IAAI,OAAO,UAAU,yEAAyE,8BAA8B,GAAG,CAAC;CACjJ,UAAU;EACR,GAAG,MAAM;CACX;AACF,CACF;;AAGA,SAAS,UAAU,MAAkC;CACnD,MAAM,MAAM,QAAQ,QAAQ,IAAI,kBAAkB,oBAAoB,QAAQ,IAAI,QAAQ;CAC1F,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,GAAG;CACnB,QAAQ;EACN,MAAM,IAAI,MAAM,kBAAkB,IAAI,oDAAoD;CAC5F;CACA,IAAI,IAAI,aAAa,WAAW,IAAI,aAAa,UAAU,MAAM,IAAI,MAAM,2CAA2C;CACtH,QAAQ,IAAI,SAAS,IAAI,SAAA,CAAU,QAAQ,QAAQ,EAAE;AACvD;AAEA,IAAI;CACF,MAAM,QAAQ,WAAW,QAAQ,IAAI;AACvC,SAAS,KAAK;CACZ,QAAQ,MAAM,GAAG,IAAI,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,CAAC;CACtE,IAAI,QAAQ,IAAI,oBAAoB,eAAe,OAAO,QAAQ,MAAM,IAAI,KAAK;CACjF,QAAQ,KAAK,CAAC;AAChB"}

package/dist/config-CIvgMqLx.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export { n as loadConfig } from "./config-v975gxv4.js";

package/dist/config-v975gxv4.js

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+import { chmodSync, mkdirSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+//#region server/config.ts
+const DEFAULT_PORT = 8425;
+function loadConfig(input = {}, version = "0.0.0") {
+	const dataDir = resolve(input.dataDir ?? process.env.AGENTINBOX_DATA ?? join(homedir(), ".agentinbox"));
+	mkdirSync(dataDir, {
+		recursive: true,
+		mode: 448
+	});
+	restrictDir(dataDir);
+	return {
+		dataDir,
+		dbPath: join(dataDir, "agentinbox.db"),
+		masterKeyPath: join(dataDir, "master.key"),
+		host: input.host ?? process.env.HOST ?? "0.0.0.0",
+		port: input.port ?? (process.env.PORT ? Number(process.env.PORT) : 8425),
+		dev: input.dev ?? false,
+		trustProxy: process.env.TRUST_PROXY === "1",
+		service: process.env.AGENTINBOX_SERVICE === "1",
+		version,
+		google: {
+			oauthBase: process.env.AGENTINBOX_GOOGLE_OAUTH_BASE ?? "https://oauth2.googleapis.com",
+			authBase: process.env.AGENTINBOX_GOOGLE_AUTH_BASE ?? "https://accounts.google.com",
+			gmailBase: process.env.AGENTINBOX_GOOGLE_GMAIL_BASE ?? "https://gmail.googleapis.com",
+			pubsubBase: process.env.AGENTINBOX_GOOGLE_PUBSUB_BASE ?? "https://pubsub.googleapis.com"
+		}
+	};
+}
+/** An existing data dir may be group/world accessible (umask, manual mkdir): tighten it to owner-only. */
+function restrictDir(dir) {
+	try {
+		if (process.platform !== "win32" && statSync(dir).mode & 63) {
+			chmodSync(dir, 448);
+			process.stderr.write(`agentinbox: restricted ${dir} to owner-only access (it was readable by other users).\n`);
+		}
+	} catch {}
+}
+//#endregion
+export { loadConfig as n, DEFAULT_PORT as t };
+
+//# sourceMappingURL=config-v975gxv4.js.map

package/dist/config-v975gxv4.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-v975gxv4.js","names":[],"sources":["../server/config.ts"],"sourcesContent":["import { chmodSync, mkdirSync, statSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join, resolve } from \"node:path\";\n\nexport interface Config {\n  dataDir: string;\n  dbPath: string;\n  masterKeyPath: string;\n  host: string;\n  port: number;\n  /** Dev mode: console served by Vite on :5173, server only serves /api, /mcp, /oauth. */\n  dev: boolean;\n  /** Honor X-Forwarded-For / X-Forwarded-Proto (behind a reverse proxy). */\n  trustProxy: boolean;\n  /** Running under `agentinbox service install` (set via AGENTINBOX_SERVICE=1 in the unit/plist). */\n  service: boolean;\n  version: string;\n  /**\n   * Base URLs for Google APIs. Overridable so tests can point at test/fake-google.ts.\n   * Defaults: https://oauth2.googleapis.com, https://accounts.google.com, https://gmail.googleapis.com, https://pubsub.googleapis.com\n   */\n  google: { oauthBase: string; authBase: string; gmailBase: string; pubsubBase: string };\n}\n\nexport interface ConfigInput {\n  dataDir?: string;\n  host?: string;\n  port?: number;\n  dev?: boolean;\n}\n\nexport const DEFAULT_PORT = 8425;\n\nexport function loadConfig(input: ConfigInput = {}, version = \"0.0.0\"): Config {\n  const dataDir = resolve(input.dataDir ?? process.env.AGENTINBOX_DATA ?? join(homedir(), \".agentinbox\"));\n  mkdirSync(dataDir, { recursive: true, mode: 0o700 });\n  restrictDir(dataDir);\n  return {\n    dataDir,\n    dbPath: join(dataDir, \"agentinbox.db\"),\n    masterKeyPath: join(dataDir, \"master.key\"),\n    host: input.host ?? process.env.HOST ?? \"0.0.0.0\",\n    port: input.port ?? (process.env.PORT ? Number(process.env.PORT) : DEFAULT_PORT),\n    dev: input.dev ?? false,\n    trustProxy: process.env.TRUST_PROXY === \"1\",\n    service: process.env.AGENTINBOX_SERVICE === \"1\",\n    version,\n    google: {\n      oauthBase: process.env.AGENTINBOX_GOOGLE_OAUTH_BASE ?? \"https://oauth2.googleapis.com\",\n      authBase: process.env.AGENTINBOX_GOOGLE_AUTH_BASE ?? \"https://accounts.google.com\",\n      gmailBase: process.env.AGENTINBOX_GOOGLE_GMAIL_BASE ?? \"https://gmail.googleapis.com\",\n      pubsubBase: process.env.AGENTINBOX_GOOGLE_PUBSUB_BASE ?? \"https://pubsub.googleapis.com\",\n    },\n  };\n}\n\n/** An existing data dir may be group/world accessible (umask, manual mkdir): tighten it to owner-only. */\nfunction restrictDir(dir: string): void {\n  try {\n    if (process.platform !== \"win32\" && statSync(dir).mode & 0o077) {\n      chmodSync(dir, 0o700);\n      process.stderr.write(`agentinbox: restricted ${dir} to owner-only access (it was readable by other users).\\n`);\n    }\n  } catch {\n    // Not ours to change; the files inside are still created owner-only.\n  }\n}\n"],"mappings":";;;;;AA+BA,MAAa,eAAe;AAE5B,SAAgB,WAAW,QAAqB,CAAC,GAAG,UAAU,SAAiB;CAC7E,MAAM,UAAU,QAAQ,MAAM,WAAW,QAAQ,IAAI,mBAAmB,KAAK,QAAQ,GAAG,aAAa,CAAC;CACtG,UAAU,SAAS;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;CACnD,YAAY,OAAO;CACnB,OAAO;EACL;EACA,QAAQ,KAAK,SAAS,eAAe;EACrC,eAAe,KAAK,SAAS,YAAY;EACzC,MAAM,MAAM,QAAQ,QAAQ,IAAI,QAAQ;EACxC,MAAM,MAAM,SAAS,QAAQ,IAAI,OAAO,OAAO,QAAQ,IAAI,IAAI,IAAA;EAC/D,KAAK,MAAM,OAAO;EAClB,YAAY,QAAQ,IAAI,gBAAgB;EACxC,SAAS,QAAQ,IAAI,uBAAuB;EAC5C;EACA,QAAQ;GACN,WAAW,QAAQ,IAAI,gCAAgC;GACvD,UAAU,QAAQ,IAAI,+BAA+B;GACrD,WAAW,QAAQ,IAAI,gCAAgC;GACvD,YAAY,QAAQ,IAAI,iCAAiC;EAC3D;CACF;AACF;;AAGA,SAAS,YAAY,KAAmB;CACtC,IAAI;EACF,IAAI,QAAQ,aAAa,WAAW,SAAS,GAAG,CAAC,CAAC,OAAO,IAAO;GAC9D,UAAU,KAAK,GAAK;GACpB,QAAQ,OAAO,MAAM,0BAA0B,IAAI,0DAA0D;EAC/G;CACF,QAAQ,CAER;AACF"}

package/dist/crypto-DYZ4R7c2.js

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+import { chmodSync, existsSync, readFileSync, writeFileSync } from "node:fs";
+import { createCipheriv, createDecipheriv, createHash, randomBytes, scrypt, timingSafeEqual } from "node:crypto";
+//#region server/crypto.ts
+/**
+* Secrets at rest (refresh tokens, webhook secrets, Google client secret) are AES-256-GCM encrypted.
+* Key source: AGENTINBOX_MASTER_KEY (base64, 32 bytes) or `<dataDir>/master.key` (generated, mode 0600).
+* Ciphertext format: "v1:" + base64(iv[12] | tag[16] | ciphertext).
+*/
+var Crypto = class Crypto {
+	key;
+	constructor(key) {
+		if (key.length !== 32) throw new Error("master key must be 32 bytes");
+		this.key = key;
+	}
+	static load(keyFile) {
+		const fromEnv = process.env.AGENTINBOX_MASTER_KEY;
+		if (fromEnv) return new Crypto(Buffer.from(fromEnv, "base64"));
+		if (!existsSync(keyFile)) writeFileSync(keyFile, randomBytes(32).toString("base64") + "\n", { mode: 384 });
+		chmodSync(keyFile, 384);
+		return new Crypto(Buffer.from(readFileSync(keyFile, "utf8").trim(), "base64"));
+	}
+	encrypt(plain) {
+		const iv = randomBytes(12);
+		const cipher = createCipheriv("aes-256-gcm", this.key, iv);
+		const ct = Buffer.concat([cipher.update(plain, "utf8"), cipher.final()]);
+		return "v1:" + Buffer.concat([
+			iv,
+			cipher.getAuthTag(),
+			ct
+		]).toString("base64");
+	}
+	decrypt(enc) {
+		if (!enc.startsWith("v1:")) throw new Error("unknown ciphertext version");
+		const buf = Buffer.from(enc.slice(3), "base64");
+		const decipher = createDecipheriv("aes-256-gcm", this.key, buf.subarray(0, 12));
+		decipher.setAuthTag(buf.subarray(12, 28));
+		return Buffer.concat([decipher.update(buf.subarray(28)), decipher.final()]).toString("utf8");
+	}
+};
+/** Fast hash for high-entropy tokens (API keys, session tokens). */
+const sha256 = (s) => createHash("sha256").update(s).digest("hex");
+const scryptAsync = (password, salt, length, opts) => new Promise((resolve, reject) => scrypt(password, salt, length, opts, (err, key) => err ? reject(err) : resolve(key)));
+/** Like hashPassword, but runs scrypt on the thread pool instead of blocking the event loop. */
+async function hashPasswordAsync(password) {
+	const salt = randomBytes(16);
+	const hash = await scryptAsync(password, salt, 32, {
+		N: 16384,
+		r: 8,
+		p: 1
+	});
+	return `scrypt$16384$8$1$${salt.toString("base64")}$${hash.toString("base64")}`;
+}
+/** Like verifyPassword, but runs scrypt on the thread pool instead of blocking the event loop. */
+async function verifyPasswordAsync(password, stored) {
+	const [alg, n, r, p, salt, hash] = stored.split("$");
+	if (alg !== "scrypt" || !salt || !hash) return false;
+	const expected = Buffer.from(hash, "base64");
+	const actual = await scryptAsync(password, Buffer.from(salt, "base64"), expected.length, {
+		N: Number(n),
+		r: Number(r),
+		p: Number(p)
+	});
+	return timingSafeEqual(actual, expected);
+}
+function safeEqual(a, b) {
+	const ab = Buffer.from(a);
+	const bb = Buffer.from(b);
+	return ab.length === bb.length && timingSafeEqual(ab, bb);
+}
+//#endregion
+export { verifyPasswordAsync as a, sha256 as i, hashPasswordAsync as n, safeEqual as r, Crypto as t };
+
+//# sourceMappingURL=crypto-DYZ4R7c2.js.map

package/dist/crypto-DYZ4R7c2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-DYZ4R7c2.js","names":[],"sources":["../server/crypto.ts"],"sourcesContent":["import { createCipheriv, createDecipheriv, createHash, randomBytes, type ScryptOptions, scrypt, scryptSync, timingSafeEqual } from \"node:crypto\";\nimport { chmodSync, existsSync, readFileSync, writeFileSync } from \"node:fs\";\n\n/**\n * Secrets at rest (refresh tokens, webhook secrets, Google client secret) are AES-256-GCM encrypted.\n * Key source: AGENTINBOX_MASTER_KEY (base64, 32 bytes) or `<dataDir>/master.key` (generated, mode 0600).\n * Ciphertext format: \"v1:\" + base64(iv[12] | tag[16] | ciphertext).\n */\nexport class Crypto {\n  private readonly key: Buffer;\n\n  constructor(key: Buffer) {\n    if (key.length !== 32) throw new Error(\"master key must be 32 bytes\");\n    this.key = key;\n  }\n\n  static load(keyFile: string): Crypto {\n    const fromEnv = process.env.AGENTINBOX_MASTER_KEY;\n    if (fromEnv) return new Crypto(Buffer.from(fromEnv, \"base64\"));\n    if (!existsSync(keyFile)) {\n      writeFileSync(keyFile, randomBytes(32).toString(\"base64\") + \"\\n\", { mode: 0o600 });\n    }\n    chmodSync(keyFile, 0o600);\n    return new Crypto(Buffer.from(readFileSync(keyFile, \"utf8\").trim(), \"base64\"));\n  }\n\n  encrypt(plain: string): string {\n    const iv = randomBytes(12);\n    const cipher = createCipheriv(\"aes-256-gcm\", this.key, iv);\n    const ct = Buffer.concat([cipher.update(plain, \"utf8\"), cipher.final()]);\n    return \"v1:\" + Buffer.concat([iv, cipher.getAuthTag(), ct]).toString(\"base64\");\n  }\n\n  decrypt(enc: string): string {\n    if (!enc.startsWith(\"v1:\")) throw new Error(\"unknown ciphertext version\");\n    const buf = Buffer.from(enc.slice(3), \"base64\");\n    const decipher = createDecipheriv(\"aes-256-gcm\", this.key, buf.subarray(0, 12));\n    decipher.setAuthTag(buf.subarray(12, 28));\n    return Buffer.concat([decipher.update(buf.subarray(28)), decipher.final()]).toString(\"utf8\");\n  }\n}\n\n/** Fast hash for high-entropy tokens (API keys, session tokens). */\nexport const sha256 = (s: string): string => createHash(\"sha256\").update(s).digest(\"hex\");\n\n/** Password hashing for the admin password. Format: \"scrypt$N$r$p$salt$hash\". */\nexport function hashPassword(password: string): string {\n  const salt = randomBytes(16);\n  const hash = scryptSync(password, salt, 32, { N: 16384, r: 8, p: 1 });\n  return `scrypt$16384$8$1$${salt.toString(\"base64\")}$${hash.toString(\"base64\")}`;\n}\n\nexport function verifyPassword(password: string, stored: string): boolean {\n  const [alg, n, r, p, salt, hash] = stored.split(\"$\");\n  if (alg !== \"scrypt\" || !salt || !hash) return false;\n  const expected = Buffer.from(hash, \"base64\");\n  const actual = scryptSync(password, Buffer.from(salt, \"base64\"), expected.length, {\n    N: Number(n),\n    r: Number(r),\n    p: Number(p),\n  });\n  return timingSafeEqual(actual, expected);\n}\n\nconst scryptAsync = (password: string, salt: Buffer, length: number, opts: ScryptOptions) =>\n  new Promise<Buffer>((resolve, reject) => scrypt(password, salt, length, opts, (err, key) => (err ? reject(err) : resolve(key))));\n\n/** Like hashPassword, but runs scrypt on the thread pool instead of blocking the event loop. */\nexport async function hashPasswordAsync(password: string): Promise<string> {\n  const salt = randomBytes(16);\n  const hash = await scryptAsync(password, salt, 32, { N: 16384, r: 8, p: 1 });\n  return `scrypt$16384$8$1$${salt.toString(\"base64\")}$${hash.toString(\"base64\")}`;\n}\n\n/** Like verifyPassword, but runs scrypt on the thread pool instead of blocking the event loop. */\nexport async function verifyPasswordAsync(password: string, stored: string): Promise<boolean> {\n  const [alg, n, r, p, salt, hash] = stored.split(\"$\");\n  if (alg !== \"scrypt\" || !salt || !hash) return false;\n  const expected = Buffer.from(hash, \"base64\");\n  const actual = await scryptAsync(password, Buffer.from(salt, \"base64\"), expected.length, { N: Number(n), r: Number(r), p: Number(p) });\n  return timingSafeEqual(actual, expected);\n}\n\nexport function safeEqual(a: string, b: string): boolean {\n  const ab = Buffer.from(a);\n  const bb = Buffer.from(b);\n  return ab.length === bb.length && timingSafeEqual(ab, bb);\n}\n"],"mappings":";;;;;;;;;AAQA,IAAa,SAAb,MAAa,OAAO;CAClB;CAEA,YAAY,KAAa;EACvB,IAAI,IAAI,WAAW,IAAI,MAAM,IAAI,MAAM,6BAA6B;EACpE,KAAK,MAAM;CACb;CAEA,OAAO,KAAK,SAAyB;EACnC,MAAM,UAAU,QAAQ,IAAI;EAC5B,IAAI,SAAS,OAAO,IAAI,OAAO,OAAO,KAAK,SAAS,QAAQ,CAAC;EAC7D,IAAI,CAAC,WAAW,OAAO,GACrB,cAAc,SAAS,YAAY,EAAE,CAAC,CAAC,SAAS,QAAQ,IAAI,MAAM,EAAE,MAAM,IAAM,CAAC;EAEnF,UAAU,SAAS,GAAK;EACxB,OAAO,IAAI,OAAO,OAAO,KAAK,aAAa,SAAS,MAAM,CAAC,CAAC,KAAK,GAAG,QAAQ,CAAC;CAC/E;CAEA,QAAQ,OAAuB;EAC7B,MAAM,KAAK,YAAY,EAAE;EACzB,MAAM,SAAS,eAAe,eAAe,KAAK,KAAK,EAAE;EACzD,MAAM,KAAK,OAAO,OAAO,CAAC,OAAO,OAAO,OAAO,MAAM,GAAG,OAAO,MAAM,CAAC,CAAC;EACvE,OAAO,QAAQ,OAAO,OAAO;GAAC;GAAI,OAAO,WAAW;GAAG;EAAE,CAAC,CAAC,CAAC,SAAS,QAAQ;CAC/E;CAEA,QAAQ,KAAqB;EAC3B,IAAI,CAAC,IAAI,WAAW,KAAK,GAAG,MAAM,IAAI,MAAM,4BAA4B;EACxE,MAAM,MAAM,OAAO,KAAK,IAAI,MAAM,CAAC,GAAG,QAAQ;EAC9C,MAAM,WAAW,iBAAiB,eAAe,KAAK,KAAK,IAAI,SAAS,GAAG,EAAE,CAAC;EAC9E,SAAS,WAAW,IAAI,SAAS,IAAI,EAAE,CAAC;EACxC,OAAO,OAAO,OAAO,CAAC,SAAS,OAAO,IAAI,SAAS,EAAE,CAAC,GAAG,SAAS,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,MAAM;CAC7F;AACF;;AAGA,MAAa,UAAU,MAAsB,WAAW,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,KAAK;AAqBxF,MAAM,eAAe,UAAkB,MAAc,QAAgB,SACnE,IAAI,SAAiB,SAAS,WAAW,OAAO,UAAU,MAAM,QAAQ,OAAO,KAAK,QAAS,MAAM,OAAO,GAAG,IAAI,QAAQ,GAAG,CAAE,CAAC;;AAGjI,eAAsB,kBAAkB,UAAmC;CACzE,MAAM,OAAO,YAAY,EAAE;CAC3B,MAAM,OAAO,MAAM,YAAY,UAAU,MAAM,IAAI;EAAE,GAAG;EAAO,GAAG;EAAG,GAAG;CAAE,CAAC;CAC3E,OAAO,oBAAoB,KAAK,SAAS,QAAQ,EAAE,GAAG,KAAK,SAAS,QAAQ;AAC9E;;AAGA,eAAsB,oBAAoB,UAAkB,QAAkC;CAC5F,MAAM,CAAC,KAAK,GAAG,GAAG,GAAG,MAAM,QAAQ,OAAO,MAAM,GAAG;CACnD,IAAI,QAAQ,YAAY,CAAC,QAAQ,CAAC,MAAM,OAAO;CAC/C,MAAM,WAAW,OAAO,KAAK,MAAM,QAAQ;CAC3C,MAAM,SAAS,MAAM,YAAY,UAAU,OAAO,KAAK,MAAM,QAAQ,GAAG,SAAS,QAAQ;EAAE,GAAG,OAAO,CAAC;EAAG,GAAG,OAAO,CAAC;EAAG,GAAG,OAAO,CAAC;CAAE,CAAC;CACrI,OAAO,gBAAgB,QAAQ,QAAQ;AACzC;AAEA,SAAgB,UAAU,GAAW,GAAoB;CACvD,MAAM,KAAK,OAAO,KAAK,CAAC;CACxB,MAAM,KAAK,OAAO,KAAK,CAAC;CACxB,OAAO,GAAG,WAAW,GAAG,UAAU,gBAAgB,IAAI,EAAE;AAC1D"}

package/dist/db-CfoMO5zW.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export { t as Db } from "./db-DdagFmUY.js";

package/dist/db-DdagFmUY.js

@@ -0,0 +1,247 @@
+#!/usr/bin/env node
+import { chmodSync } from "node:fs";
+import { DatabaseSync } from "node:sqlite";
+//#region server/db/schema.ts
+const MIGRATIONS = [`
+  CREATE TABLE settings (
+    key TEXT PRIMARY KEY,
+    value TEXT NOT NULL
+  );
+
+  CREATE TABLE admin_sessions (
+    token_hash TEXT PRIMARY KEY,
+    created_at TEXT NOT NULL,
+    expires_at TEXT NOT NULL,
+    ip TEXT,
+    user_agent TEXT
+  );
+
+  CREATE TABLE accounts (
+    id TEXT PRIMARY KEY,
+    email TEXT NOT NULL UNIQUE,
+    display_name TEXT,
+    status TEXT NOT NULL DEFAULT 'active',
+    last_error TEXT,
+    refresh_token_enc TEXT NOT NULL,
+    access_token_enc TEXT,
+    access_expires_at TEXT,
+    scopes TEXT NOT NULL DEFAULT '[]',
+    history_id TEXT,
+    watch_expires_at TEXT,
+    last_sync_at TEXT,
+    created_at TEXT NOT NULL
+  );
+
+  -- Pending OAuth flows (state → PKCE verifier). Short-lived.
+  CREATE TABLE oauth_states (
+    state TEXT PRIMARY KEY,
+    code_verifier TEXT NOT NULL,
+    redirect_uri TEXT NOT NULL,
+    reauth_account_id TEXT,
+    created_at TEXT NOT NULL
+  );
+
+  CREATE TABLE agents (
+    id TEXT PRIMARY KEY,
+    name TEXT NOT NULL,
+    description TEXT,
+    key_prefix TEXT NOT NULL,
+    key_hash TEXT NOT NULL UNIQUE,
+    disabled INTEGER NOT NULL DEFAULT 0,
+    last_used_at TEXT,
+    created_at TEXT NOT NULL
+  );
+
+  CREATE TABLE grants (
+    id TEXT PRIMARY KEY,
+    agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
+    account_id TEXT NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,
+    capabilities TEXT NOT NULL,           -- JSON Capability[]
+    label_scope TEXT,                     -- JSON string[] | NULL (= whole mailbox)
+    send_mode TEXT NOT NULL DEFAULT 'draft_only',
+    allow_to TEXT NOT NULL DEFAULT '[]',  -- JSON string[]
+    reply_only INTEGER NOT NULL DEFAULT 0,
+    max_sends_per_hour INTEGER,
+    max_sends_per_day INTEGER,
+    created_at TEXT NOT NULL,
+    UNIQUE (agent_id, account_id)
+  );
+
+  -- Agent event-feed cursor for the MCP pull tools (list_events / wait_for_events / ack_events).
+  CREATE TABLE agent_cursors (
+    agent_id TEXT PRIMARY KEY REFERENCES agents(id) ON DELETE CASCADE,
+    acked_seq INTEGER NOT NULL DEFAULT 0,
+    updated_at TEXT NOT NULL
+  );
+
+  CREATE TABLE events (
+    seq INTEGER PRIMARY KEY AUTOINCREMENT,
+    id TEXT NOT NULL UNIQUE,
+    type TEXT NOT NULL,
+    account_id TEXT NOT NULL,
+    gmail_message_id TEXT,
+    gmail_thread_id TEXT,
+    label_ids TEXT NOT NULL DEFAULT '[]',  -- JSON: message labels at event time (used for scope + filters)
+    message TEXT,                          -- JSON MessageSummary | NULL
+    changed_label_ids TEXT,                -- JSON string[] for label.added/removed
+    detail TEXT,                           -- JSON
+    dedupe_key TEXT NOT NULL UNIQUE,       -- e.g. "acc_x:msgid:message.received" — Pub/Sub is at-least-once
+    created_at TEXT NOT NULL
+  );
+  CREATE INDEX events_account_seq ON events(account_id, seq);
+  CREATE INDEX events_thread ON events(account_id, gmail_thread_id);
+  CREATE INDEX events_created ON events(created_at);
+
+  -- Threads the account has sent into; drives thread.reply_received.
+  CREATE TABLE sent_threads (
+    account_id TEXT NOT NULL,
+    gmail_thread_id TEXT NOT NULL,
+    last_sent_at TEXT NOT NULL,
+    PRIMARY KEY (account_id, gmail_thread_id)
+  );
+
+  CREATE TABLE webhooks (
+    id TEXT PRIMARY KEY,
+    agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
+    name TEXT NOT NULL,
+    url TEXT NOT NULL,
+    secret_enc TEXT NOT NULL,
+    secret_prefix TEXT NOT NULL,
+    event_types TEXT NOT NULL,   -- JSON EventType[]
+    filter TEXT NOT NULL DEFAULT '{}', -- JSON WebhookFilter
+    include_body INTEGER NOT NULL DEFAULT 0,
+    enabled INTEGER NOT NULL DEFAULT 1,
+    created_at TEXT NOT NULL
+  );
+
+  CREATE TABLE deliveries (
+    id TEXT PRIMARY KEY,
+    webhook_id TEXT NOT NULL REFERENCES webhooks(id) ON DELETE CASCADE,
+    event_seq INTEGER NOT NULL,
+    status TEXT NOT NULL DEFAULT 'pending',
+    attempts INTEGER NOT NULL DEFAULT 0,
+    next_attempt_at TEXT,
+    last_status_code INTEGER,
+    last_error TEXT,
+    last_response TEXT,
+    duration_ms INTEGER,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    UNIQUE (webhook_id, event_seq)
+  );
+  CREATE INDEX deliveries_due ON deliveries(status, next_attempt_at);
+  CREATE INDEX deliveries_webhook ON deliveries(webhook_id, created_at);
+
+  CREATE TABLE approvals (
+    id TEXT PRIMARY KEY,
+    agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE CASCADE,
+    account_id TEXT NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,
+    kind TEXT NOT NULL,
+    status TEXT NOT NULL DEFAULT 'pending',
+    draft_id TEXT NOT NULL,
+    payload TEXT NOT NULL,       -- JSON {to,cc,bcc,subject,body,threadId,attachments,reason}
+    decided_at TEXT,
+    decision_note TEXT,
+    sent_message_id TEXT,
+    error TEXT,
+    created_at TEXT NOT NULL,
+    expires_at TEXT NOT NULL
+  );
+  CREATE INDEX approvals_status ON approvals(status, created_at);
+
+  CREATE TABLE audit_log (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    ts TEXT NOT NULL,
+    actor_type TEXT NOT NULL,
+    actor_id TEXT,
+    action TEXT NOT NULL,
+    account_id TEXT,
+    target TEXT,
+    outcome TEXT NOT NULL,
+    reason TEXT,
+    duration_ms INTEGER,
+    detail TEXT
+  );
+  CREATE INDEX audit_ts ON audit_log(ts);
+  CREATE INDEX audit_actor ON audit_log(actor_id, ts);
+  `];
+//#endregion
+//#region server/db/index.ts
+/** Thin synchronous wrapper over node:sqlite. All repos go through this. */
+var Db = class {
+	raw;
+	depth = 0;
+	constructor(path) {
+		this.raw = new DatabaseSync(path);
+		this.raw.exec("PRAGMA journal_mode = WAL; PRAGMA foreign_keys = ON; PRAGMA busy_timeout = 5000;");
+		this.migrate();
+		if (path !== ":memory:") for (const file of [
+			path,
+			`${path}-wal`,
+			`${path}-shm`
+		]) try {
+			chmodSync(file, 384);
+		} catch {}
+	}
+	get(sql, ...params) {
+		return this.raw.prepare(sql).get(...params);
+	}
+	all(sql, ...params) {
+		return this.raw.prepare(sql).all(...params);
+	}
+	run(sql, ...params) {
+		const r = this.raw.prepare(sql).run(...params);
+		return {
+			changes: Number(r.changes),
+			lastInsertRowid: Number(r.lastInsertRowid)
+		};
+	}
+	/** Nested calls join the outer transaction (savepoints). */
+	tx(fn) {
+		const sp = `sp${this.depth++}`;
+		this.raw.exec(`SAVEPOINT ${sp}`);
+		try {
+			const out = fn();
+			this.raw.exec(`RELEASE ${sp}`);
+			return out;
+		} catch (err) {
+			this.raw.exec(`ROLLBACK TO ${sp}; RELEASE ${sp}`);
+			throw err;
+		} finally {
+			this.depth--;
+		}
+	}
+	close() {
+		this.raw.close();
+	}
+	migrate() {
+		this.raw.exec("CREATE TABLE IF NOT EXISTS _migrations (version INTEGER PRIMARY KEY, applied_at TEXT NOT NULL)");
+		const current = this.get("SELECT MAX(version) AS v FROM _migrations")?.v ?? 0;
+		MIGRATIONS.forEach((sql, i) => {
+			const version = i + 1;
+			if (version <= current) return;
+			this.tx(() => {
+				this.raw.exec(sql);
+				this.run("INSERT INTO _migrations (version, applied_at) VALUES (?, ?)", version, (/* @__PURE__ */ new Date()).toISOString());
+			});
+		});
+	}
+};
+const json = {
+	parse(v, fallback) {
+		if (typeof v !== "string" || v === "") return fallback;
+		try {
+			return JSON.parse(v);
+		} catch {
+			return fallback;
+		}
+	},
+	str(v) {
+		return JSON.stringify(v);
+	}
+};
+const now = () => (/* @__PURE__ */ new Date()).toISOString();
+//#endregion
+export { json as n, now as r, Db as t };
+
+//# sourceMappingURL=db-DdagFmUY.js.map

package/dist/db-DdagFmUY.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-DdagFmUY.js","names":[],"sources":["../server/db/schema.ts","../server/db/index.ts"],"sourcesContent":["// Ordered migrations. Append only — never edit a shipped migration.\n// Conventions: ids are prefixed TEXT, timestamps are ISO-8601 TEXT (UTC), JSON is TEXT,\n// booleans are INTEGER 0/1, secrets are AES-GCM ciphertext TEXT (see server/crypto.ts).\n\nexport const MIGRATIONS: string[] = [\n  /* 1: initial schema */ `\n  CREATE TABLE settings (\n    key TEXT PRIMARY KEY,\n    value TEXT NOT NULL\n  );\n\n  CREATE TABLE admin_sessions (\n    token_hash TEXT PRIMARY KEY,\n    created_at TEXT NOT NULL,\n    expires_at TEXT NOT NULL,\n    ip TEXT,\n    user_agent TEXT\n  );\n\n  CREATE TABLE accounts (\n    id TEXT PRIMARY KEY,\n    email TEXT NOT NULL UNIQUE,\n    display_name TEXT,\n    status TEXT NOT NULL DEFAULT 'active',\n    last_error TEXT,\n    refresh_token_enc TEXT NOT NULL,\n    access_token_enc TEXT,\n    access_expires_at TEXT,\n    scopes TEXT NOT NULL DEFAULT '[]',\n    history_id TEXT,\n    watch_expires_at TEXT,\n    last_sync_at TEXT,\n    created_at TEXT NOT NULL\n  );\n\n  -- Pending OAuth flows (state → PKCE verifier). Short-lived.\n  CREATE TABLE oauth_states (\n    state TEXT PRIMARY KEY,\n    code_verifier TEXT NOT NULL,\n    redirect_uri TEXT NOT NULL,\n    reauth_account_id TEXT,\n    created_at TEXT NOT NULL\n  );\n\n  CREATE TABLE agents (\n    id TEXT PRIMARY KEY,\n    name TEXT NOT NULL,\n    description TEXT,\n    key_prefix TEXT NOT NULL,\n    key_hash TEXT NOT NULL UNIQUE,\n    disabled INTEGER NOT NULL DEFAULT 0,\n    last_used_at TEXT,\n    created_at TEXT NOT NULL\n  );\n\n  CREATE TABLE grants (\n    id TEXT PRIMARY KEY,\n    agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE CASCADE,\n    account_id TEXT NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,\n    capabilities TEXT NOT NULL,           -- JSON Capability[]\n    label_scope TEXT,                     -- JSON string[] | NULL (= whole mailbox)\n    send_mode TEXT NOT NULL DEFAULT 'draft_only',\n    allow_to TEXT NOT NULL DEFAULT '[]',  -- JSON string[]\n    reply_only INTEGER NOT NULL DEFAULT 0,\n    max_sends_per_hour INTEGER,\n    max_sends_per_day INTEGER,\n    created_at TEXT NOT NULL,\n    UNIQUE (agent_id, account_id)\n  );\n\n  -- Agent event-feed cursor for the MCP pull tools (list_events / wait_for_events / ack_events).\n  CREATE TABLE agent_cursors (\n    agent_id TEXT PRIMARY KEY REFERENCES agents(id) ON DELETE CASCADE,\n    acked_seq INTEGER NOT NULL DEFAULT 0,\n    updated_at TEXT NOT NULL\n  );\n\n  CREATE TABLE events (\n    seq INTEGER PRIMARY KEY AUTOINCREMENT,\n    id TEXT NOT NULL UNIQUE,\n    type TEXT NOT NULL,\n    account_id TEXT NOT NULL,\n    gmail_message_id TEXT,\n    gmail_thread_id TEXT,\n    label_ids TEXT NOT NULL DEFAULT '[]',  -- JSON: message labels at event time (used for scope + filters)\n    message TEXT,                          -- JSON MessageSummary | NULL\n    changed_label_ids TEXT,                -- JSON string[] for label.added/removed\n    detail TEXT,                           -- JSON\n    dedupe_key TEXT NOT NULL UNIQUE,       -- e.g. \"acc_x:msgid:message.received\" — Pub/Sub is at-least-once\n    created_at TEXT NOT NULL\n  );\n  CREATE INDEX events_account_seq ON events(account_id, seq);\n  CREATE INDEX events_thread ON events(account_id, gmail_thread_id);\n  CREATE INDEX events_created ON events(created_at);\n\n  -- Threads the account has sent into; drives thread.reply_received.\n  CREATE TABLE sent_threads (\n    account_id TEXT NOT NULL,\n    gmail_thread_id TEXT NOT NULL,\n    last_sent_at TEXT NOT NULL,\n    PRIMARY KEY (account_id, gmail_thread_id)\n  );\n\n  CREATE TABLE webhooks (\n    id TEXT PRIMARY KEY,\n    agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE CASCADE,\n    name TEXT NOT NULL,\n    url TEXT NOT NULL,\n    secret_enc TEXT NOT NULL,\n    secret_prefix TEXT NOT NULL,\n    event_types TEXT NOT NULL,   -- JSON EventType[]\n    filter TEXT NOT NULL DEFAULT '{}', -- JSON WebhookFilter\n    include_body INTEGER NOT NULL DEFAULT 0,\n    enabled INTEGER NOT NULL DEFAULT 1,\n    created_at TEXT NOT NULL\n  );\n\n  CREATE TABLE deliveries (\n    id TEXT PRIMARY KEY,\n    webhook_id TEXT NOT NULL REFERENCES webhooks(id) ON DELETE CASCADE,\n    event_seq INTEGER NOT NULL,\n    status TEXT NOT NULL DEFAULT 'pending',\n    attempts INTEGER NOT NULL DEFAULT 0,\n    next_attempt_at TEXT,\n    last_status_code INTEGER,\n    last_error TEXT,\n    last_response TEXT,\n    duration_ms INTEGER,\n    created_at TEXT NOT NULL,\n    updated_at TEXT NOT NULL,\n    UNIQUE (webhook_id, event_seq)\n  );\n  CREATE INDEX deliveries_due ON deliveries(status, next_attempt_at);\n  CREATE INDEX deliveries_webhook ON deliveries(webhook_id, created_at);\n\n  CREATE TABLE approvals (\n    id TEXT PRIMARY KEY,\n    agent_id TEXT NOT NULL REFERENCES agents(id) ON DELETE CASCADE,\n    account_id TEXT NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,\n    kind TEXT NOT NULL,\n    status TEXT NOT NULL DEFAULT 'pending',\n    draft_id TEXT NOT NULL,\n    payload TEXT NOT NULL,       -- JSON {to,cc,bcc,subject,body,threadId,attachments,reason}\n    decided_at TEXT,\n    decision_note TEXT,\n    sent_message_id TEXT,\n    error TEXT,\n    created_at TEXT NOT NULL,\n    expires_at TEXT NOT NULL\n  );\n  CREATE INDEX approvals_status ON approvals(status, created_at);\n\n  CREATE TABLE audit_log (\n    id INTEGER PRIMARY KEY AUTOINCREMENT,\n    ts TEXT NOT NULL,\n    actor_type TEXT NOT NULL,\n    actor_id TEXT,\n    action TEXT NOT NULL,\n    account_id TEXT,\n    target TEXT,\n    outcome TEXT NOT NULL,\n    reason TEXT,\n    duration_ms INTEGER,\n    detail TEXT\n  );\n  CREATE INDEX audit_ts ON audit_log(ts);\n  CREATE INDEX audit_actor ON audit_log(actor_id, ts);\n  `,\n];\n","import { chmodSync } from \"node:fs\";\nimport { DatabaseSync, type SQLInputValue } from \"node:sqlite\";\nimport { MIGRATIONS } from \"./schema.ts\";\n\nexport type Param = SQLInputValue;\nexport type Row = Record<string, unknown>;\n\n/** Thin synchronous wrapper over node:sqlite. All repos go through this. */\nexport class Db {\n  readonly raw: DatabaseSync;\n  private depth = 0;\n\n  constructor(path: string) {\n    this.raw = new DatabaseSync(path);\n    this.raw.exec(\"PRAGMA journal_mode = WAL; PRAGMA foreign_keys = ON; PRAGMA busy_timeout = 5000;\");\n    this.migrate();\n    // The database holds (encrypted) tokens and the audit log: owner-only, whatever the umask.\n    if (path !== \":memory:\") {\n      for (const file of [path, `${path}-wal`, `${path}-shm`]) {\n        try {\n          chmodSync(file, 0o600);\n        } catch {\n          // Not created (yet) or not ours to change.\n        }\n      }\n    }\n  }\n\n  get<T = Row>(sql: string, ...params: Param[]): T | undefined {\n    return this.raw.prepare(sql).get(...params) as T | undefined;\n  }\n\n  all<T = Row>(sql: string, ...params: Param[]): T[] {\n    return this.raw.prepare(sql).all(...params) as T[];\n  }\n\n  run(sql: string, ...params: Param[]): { changes: number; lastInsertRowid: number } {\n    const r = this.raw.prepare(sql).run(...params);\n    return { changes: Number(r.changes), lastInsertRowid: Number(r.lastInsertRowid) };\n  }\n\n  /** Nested calls join the outer transaction (savepoints). */\n  tx<T>(fn: () => T): T {\n    const sp = `sp${this.depth++}`;\n    this.raw.exec(`SAVEPOINT ${sp}`);\n    try {\n      const out = fn();\n      this.raw.exec(`RELEASE ${sp}`);\n      return out;\n    } catch (err) {\n      this.raw.exec(`ROLLBACK TO ${sp}; RELEASE ${sp}`);\n      throw err;\n    } finally {\n      this.depth--;\n    }\n  }\n\n  close(): void {\n    this.raw.close();\n  }\n\n  private migrate(): void {\n    this.raw.exec(\"CREATE TABLE IF NOT EXISTS _migrations (version INTEGER PRIMARY KEY, applied_at TEXT NOT NULL)\");\n    const row = this.get<{ v: number | null }>(\"SELECT MAX(version) AS v FROM _migrations\");\n    const current = row?.v ?? 0;\n    MIGRATIONS.forEach((sql, i) => {\n      const version = i + 1;\n      if (version <= current) return;\n      this.tx(() => {\n        this.raw.exec(sql);\n        this.run(\"INSERT INTO _migrations (version, applied_at) VALUES (?, ?)\", version, new Date().toISOString());\n      });\n    });\n  }\n}\n\nexport const json = {\n  parse<T>(v: unknown, fallback: T): T {\n    if (typeof v !== \"string\" || v === \"\") return fallback;\n    try {\n      return JSON.parse(v) as T;\n    } catch {\n      return fallback;\n    }\n  },\n  str(v: unknown): string {\n    return JSON.stringify(v);\n  },\n};\n\nexport const bool = (v: unknown): boolean => v === 1 || v === 1n || v === true;\nexport const now = (): string => new Date().toISOString();\n"],"mappings":";;;;AAIA,MAAa,aAAuB,CACV;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmK1B;;;;AChKA,IAAa,KAAb,MAAgB;CACd;CACA,QAAgB;CAEhB,YAAY,MAAc;EACxB,KAAK,MAAM,IAAI,aAAa,IAAI;EAChC,KAAK,IAAI,KAAK,kFAAkF;EAChG,KAAK,QAAQ;EAEb,IAAI,SAAS,YACX,KAAK,MAAM,QAAQ;GAAC;GAAM,GAAG,KAAK;GAAO,GAAG,KAAK;EAAK,GACpD,IAAI;GACF,UAAU,MAAM,GAAK;EACvB,QAAQ,CAER;CAGN;CAEA,IAAa,KAAa,GAAG,QAAgC;EAC3D,OAAO,KAAK,IAAI,QAAQ,GAAG,CAAC,CAAC,IAAI,GAAG,MAAM;CAC5C;CAEA,IAAa,KAAa,GAAG,QAAsB;EACjD,OAAO,KAAK,IAAI,QAAQ,GAAG,CAAC,CAAC,IAAI,GAAG,MAAM;CAC5C;CAEA,IAAI,KAAa,GAAG,QAA+D;EACjF,MAAM,IAAI,KAAK,IAAI,QAAQ,GAAG,CAAC,CAAC,IAAI,GAAG,MAAM;EAC7C,OAAO;GAAE,SAAS,OAAO,EAAE,OAAO;GAAG,iBAAiB,OAAO,EAAE,eAAe;EAAE;CAClF;;CAGA,GAAM,IAAgB;EACpB,MAAM,KAAK,KAAK,KAAK;EACrB,KAAK,IAAI,KAAK,aAAa,IAAI;EAC/B,IAAI;GACF,MAAM,MAAM,GAAG;GACf,KAAK,IAAI,KAAK,WAAW,IAAI;GAC7B,OAAO;EACT,SAAS,KAAK;GACZ,KAAK,IAAI,KAAK,eAAe,GAAG,YAAY,IAAI;GAChD,MAAM;EACR,UAAU;GACR,KAAK;EACP;CACF;CAEA,QAAc;EACZ,KAAK,IAAI,MAAM;CACjB;CAEA,UAAwB;EACtB,KAAK,IAAI,KAAK,gGAAgG;EAE9G,MAAM,UADM,KAAK,IAA0B,2CACzB,CAAC,EAAE,KAAK;EAC1B,WAAW,SAAS,KAAK,MAAM;GAC7B,MAAM,UAAU,IAAI;GACpB,IAAI,WAAW,SAAS;GACxB,KAAK,SAAS;IACZ,KAAK,IAAI,KAAK,GAAG;IACjB,KAAK,IAAI,+DAA+D,0BAAS,IAAI,KAAK,EAAA,CAAE,YAAY,CAAC;GAC3G,CAAC;EACH,CAAC;CACH;AACF;AAEA,MAAa,OAAO;CAClB,MAAS,GAAY,UAAgB;EACnC,IAAI,OAAO,MAAM,YAAY,MAAM,IAAI,OAAO;EAC9C,IAAI;GACF,OAAO,KAAK,MAAM,CAAC;EACrB,QAAQ;GACN,OAAO;EACT;CACF;CACA,IAAI,GAAoB;EACtB,OAAO,KAAK,UAAU,CAAC;CACzB;AACF;AAGA,MAAa,6BAAoB,IAAI,KAAK,EAAA,CAAE,YAAY"}

package/dist/errors-CJLUPllS.js

@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+//#region server/util/errors.ts
+/** Throw from anywhere in request handling; the API layer turns it into an ApiError response. */
+var HttpError = class extends Error {
+	status;
+	code;
+	hint;
+	constructor(status, code, message, hint) {
+		super(message);
+		this.status = status;
+		this.code = code;
+		this.hint = hint;
+	}
+	toJSON() {
+		return { error: {
+			code: this.code,
+			message: this.message,
+			...this.hint ? { hint: this.hint } : {}
+		} };
+	}
+};
+const badRequest = (message, hint) => new HttpError(400, "bad_request", message, hint);
+const conflict = (message, hint) => new HttpError(409, "conflict", message, hint);
+/** Thrown by policy checks. `reason` is the guardrail name recorded in the audit log. */
+var PolicyDenied = class extends Error {
+	reason;
+	constructor(reason, message) {
+		super(message);
+		this.reason = reason;
+	}
+};
+function errorMessage(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+//#endregion
+export { errorMessage as a, conflict as i, PolicyDenied as n, badRequest as r, HttpError as t };
+
+//# sourceMappingURL=errors-CJLUPllS.js.map

package/dist/errors-CJLUPllS.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors-CJLUPllS.js","names":[],"sources":["../server/util/errors.ts"],"sourcesContent":["import type { ApiError } from \"../../shared/types.ts\";\n\n/** Throw from anywhere in request handling; the API layer turns it into an ApiError response. */\nexport class HttpError extends Error {\n  constructor(\n    readonly status: number,\n    readonly code: string,\n    message: string,\n    readonly hint?: string,\n  ) {\n    super(message);\n  }\n\n  toJSON(): ApiError {\n    return { error: { code: this.code, message: this.message, ...(this.hint ? { hint: this.hint } : {}) } };\n  }\n}\n\nexport const badRequest = (message: string, hint?: string) => new HttpError(400, \"bad_request\", message, hint);\nexport const notFound = (what: string) => new HttpError(404, \"not_found\", `${what} not found`);\nexport const conflict = (message: string, hint?: string) => new HttpError(409, \"conflict\", message, hint);\n\n/** Thrown by policy checks. `reason` is the guardrail name recorded in the audit log. */\nexport class PolicyDenied extends Error {\n  constructor(\n    readonly reason: string,\n    message: string,\n  ) {\n    super(message);\n  }\n}\n\nexport function errorMessage(err: unknown): string {\n  return err instanceof Error ? err.message : String(err);\n}\n"],"mappings":";;;AAGA,IAAa,YAAb,cAA+B,MAAM;CAExB;CACA;CAEA;CAJX,YACE,QACA,MACA,SACA,MACA;EACA,MAAM,OAAO;EALJ,KAAA,SAAA;EACA,KAAA,OAAA;EAEA,KAAA,OAAA;CAGX;CAEA,SAAmB;EACjB,OAAO,EAAE,OAAO;GAAE,MAAM,KAAK;GAAM,SAAS,KAAK;GAAS,GAAI,KAAK,OAAO,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;EAAG,EAAE;CACxG;AACF;AAEA,MAAa,cAAc,SAAiB,SAAkB,IAAI,UAAU,KAAK,eAAe,SAAS,IAAI;AAE7G,MAAa,YAAY,SAAiB,SAAkB,IAAI,UAAU,KAAK,YAAY,SAAS,IAAI;;AAGxG,IAAa,eAAb,cAAkC,MAAM;CAE3B;CADX,YACE,QACA,SACA;EACA,MAAM,OAAO;EAHJ,KAAA,SAAA;CAIX;AACF;AAEA,SAAgB,aAAa,KAAsB;CACjD,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AACxD"}

package/dist/instance-DZMV78rI.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export { s as runningInstance } from "./instance-Dy2jeyZc.js";