@atomicmail/agent-skill-openclaw 0.3.24

package/esm/lib/agent/session/agent-session.d.ts

@@ -0,0 +1,89 @@
+import { type CredentialStore, type SkillFiles } from "./agent-credentials-store.js";
+import type { JmapBlobUploadLimits } from "../jmap/agent-jmap-blob-limits.js";
+export interface AgentSessionConfig {
+    authUrl: string;
+    apiUrl: string;
+    scryptSalt: string;
+    apiKey?: string;
+    inboxId?: string;
+    credentialDir: string;
+    files?: SkillFiles;
+    store?: CredentialStore;
+}
+export interface RegisterResult {
+    inbox: string;
+    accountId: string;
+    /** Present only on first-time signup (not idempotent replay). */
+    apiKey?: string;
+    idempotent?: boolean;
+}
+export interface RegisterOptions {
+    /**
+     * Allows replacing credentials in the current credential directory when the
+     * requested username differs from the stored inbox local-part.
+     */
+    forced?: boolean;
+}
+/** Local-part of an inbox email, or the whole string if no @. */
+export declare function inboxLocalPart(inboxId: string): string;
+export declare class AgentSession {
+    private readonly authUrl;
+    readonly apiUrl: string;
+    private readonly scryptSalt;
+    private apiKey;
+    private inboxId;
+    readonly credentialDir: string;
+    readonly files: SkillFiles | undefined;
+    private readonly store;
+    private sessionJWT;
+    private capabilityJWT;
+    private cachedMailAccountId;
+    private cachedUploadUrl;
+    private cachedDownloadUrl;
+    /** RFC 8620 Session `apiUrl` (POST target); from `/.well-known/jmap`. */
+    private cachedJmapPostUrl;
+    /** Last successful GET /.well-known/jmap JSON (for RFC 9404 blob limits). */
+    private cachedJmapSession;
+    constructor(cfg: AgentSessionConfig);
+    static create(cfg: AgentSessionConfig): Promise<AgentSession>;
+    get hasApiKey(): boolean;
+    get currentInboxId(): string | undefined;
+    get currentUploadUrl(): string | undefined;
+    get currentDownloadUrl(): string | undefined;
+    private loadFromStore;
+    private currentCredentialArtifacts;
+    /**
+     * Primary JMAP mail accountId from GET /.well-known/jmap (cached).
+     */
+    getPrimaryMailAccountId(): Promise<string>;
+    invalidateJmapSessionCache(): void;
+    private refreshJmapSessionData;
+    /**
+     * Full URL for JMAP `POST` batches (RFC 8620 Session `apiUrl` from
+     * `GET /.well-known/jmap`).
+     */
+    getJmapPostUrl(): Promise<string>;
+    getBlobUploadLimitsForAccount(accountId: string): Promise<JmapBlobUploadLimits | null>;
+    /**
+     * Register or return existing inbox when username matches (idempotent).
+     * Different username requires explicit force to replace credentials and
+     * create a new inbox.
+     */
+    register(username: string, options?: RegisterOptions): Promise<RegisterResult>;
+    getCapabilityToken(): Promise<string>;
+    private ensureSession;
+    destroy(): void;
+}
+export interface PersistLoginWithApiKeyInput {
+    authUrl: string;
+    apiUrl: string;
+    scryptSalt: string;
+    apiKey: string;
+    files: SkillFiles;
+    onPowProgress?: (nonce: bigint) => void;
+}
+/** PoW login with an existing API key; writes credentials + JWT files. */
+export declare function persistLoginWithApiKey(input: PersistLoginWithApiKeyInput): Promise<{
+    inboxId: string;
+}>;
+//# sourceMappingURL=agent-session.d.ts.map

package/esm/lib/agent/session/agent-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-session.d.ts","sourceRoot":"","sources":["../../../../src/lib/agent/session/agent-session.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,eAAe,EAEpB,KAAK,UAAU,EAGhB,MAAM,8BAA8B,CAAC;AAOtC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAa9E,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAMD,iEAAiE;AACjE,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAKtD;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,OAAO,CAAqB;IACpC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,CAAC;IACvC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkB;IAExC,OAAO,CAAC,UAAU,CAAqB;IACvC,OAAO,CAAC,aAAa,CAAqB;IAC1C,OAAO,CAAC,mBAAmB,CAAqB;IAChD,OAAO,CAAC,eAAe,CAAqB;IAC5C,OAAO,CAAC,iBAAiB,CAAqB;IAC9C,yEAAyE;IACzE,OAAO,CAAC,iBAAiB,CAAqB;IAC9C,6EAA6E;IAC7E,OAAO,CAAC,iBAAiB,CAAsC;gBAEnD,GAAG,EAAE,kBAAkB;WActB,MAAM,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,YAAY,CAAC;IAMnE,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,IAAI,cAAc,IAAI,MAAM,GAAG,SAAS,CAEvC;IAED,IAAI,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAEzC;IAED,IAAI,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAE3C;YAEa,aAAa;IAa3B,OAAO,CAAC,0BAA0B;IA2BlC;;OAEG;IACG,uBAAuB,IAAI,OAAO,CAAC,MAAM,CAAC;IAiBhD,0BAA0B,IAAI,IAAI;YAQpB,sBAAsB;IAWpC;;;OAGG;IACG,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;IAWjC,6BAA6B,CACjC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAUvC;;;;OAIG;IACG,QAAQ,CACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,cAAc,CAAC;IAgGpB,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC;YA4B7B,aAAa;IA6B3B,OAAO,IAAI,IAAI;CAGhB;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,UAAU,CAAC;IAClB,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACzC;AAED,0EAA0E;AAC1E,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CA6B9B"}

package/esm/lib/agent/session/agent-session.js

@@ -0,0 +1,320 @@
+// Stateful PoW + capability JWT + optional cached JMAP session (accountId).
+import { FilesystemCredentialStore, writeCredentials, writeJwtFile, } from "./agent-credentials-store.js";
+import { CAPABILITY_SAFETY_MARGIN_MS, decodeJwtPayload, isJwtExpired, SESSION_SAFETY_MARGIN_MS, } from "../auth/agent-jwt.js";
+import { extractBlobEndpoints, extractBlobUploadLimits, extractJmapApiUrl, extractPrimaryMailAccountId, fetchJmapWellKnown, } from "../jmap/agent-jmap-run.js";
+import { fetchCapability, performPoWAndSession, } from "../auth/agent-auth-http.js";
+function normalizeUsername(u) {
+    return u.trim().toLowerCase();
+}
+/** Local-part of an inbox email, or the whole string if no @. */
+export function inboxLocalPart(inboxId) {
+    const i = inboxId.indexOf("@");
+    return i === -1
+        ? normalizeUsername(inboxId)
+        : normalizeUsername(inboxId.slice(0, i));
+}
+export class AgentSession {
+    authUrl;
+    apiUrl;
+    scryptSalt;
+    apiKey;
+    inboxId;
+    credentialDir;
+    files;
+    store;
+    sessionJWT;
+    capabilityJWT;
+    cachedMailAccountId;
+    cachedUploadUrl;
+    cachedDownloadUrl;
+    /** RFC 8620 Session `apiUrl` (POST target); from `/.well-known/jmap`. */
+    cachedJmapPostUrl;
+    /** Last successful GET /.well-known/jmap JSON (for RFC 9404 blob limits). */
+    cachedJmapSession;
+    constructor(cfg) {
+        this.authUrl = cfg.authUrl.replace(/\/+$/, "");
+        this.apiUrl = cfg.apiUrl.replace(/\/+$/, "");
+        this.scryptSalt = cfg.scryptSalt;
+        this.apiKey = cfg.apiKey;
+        this.inboxId = cfg.inboxId;
+        this.credentialDir = cfg.credentialDir;
+        this.store = cfg.store ??
+            (cfg.files ? new FilesystemCredentialStore(cfg.files) : (() => {
+                throw new Error("AgentSessionConfig requires either store or files.");
+            })());
+        this.files = cfg.files;
+    }
+    static async create(cfg) {
+        const session = new AgentSession(cfg);
+        await session.loadFromStore();
+        return session;
+    }
+    get hasApiKey() {
+        return this.apiKey !== undefined && this.apiKey.length > 0;
+    }
+    get currentInboxId() {
+        return this.inboxId;
+    }
+    get currentUploadUrl() {
+        return this.cachedUploadUrl;
+    }
+    get currentDownloadUrl() {
+        return this.cachedDownloadUrl;
+    }
+    async loadFromStore() {
+        const loaded = await this.store.load();
+        this.sessionJWT = loaded.sessionJwt;
+        this.capabilityJWT = loaded.capabilityJwt;
+        const disk = loaded.credentials;
+        if (disk) {
+            this.apiKey = this.apiKey ?? disk.apiKey;
+            this.inboxId = this.inboxId ?? disk.inboxId;
+            this.cachedUploadUrl = disk.uploadUrl;
+            this.cachedDownloadUrl = disk.downloadUrl;
+        }
+    }
+    currentCredentialArtifacts() {
+        const artifacts = {};
+        if (this.apiKey &&
+            this.inboxId &&
+            this.cachedUploadUrl &&
+            this.cachedDownloadUrl) {
+            artifacts.credentials = {
+                apiKey: this.apiKey,
+                inboxId: this.inboxId,
+                authUrl: this.authUrl,
+                apiUrl: this.apiUrl,
+                scryptSalt: this.scryptSalt,
+                uploadUrl: this.cachedUploadUrl,
+                downloadUrl: this.cachedDownloadUrl,
+            };
+        }
+        if (this.sessionJWT !== undefined) {
+            artifacts.sessionJwt = this.sessionJWT;
+        }
+        if (this.capabilityJWT !== undefined) {
+            artifacts.capabilityJwt = this.capabilityJWT;
+        }
+        return artifacts;
+    }
+    /**
+     * Primary JMAP mail accountId from GET /.well-known/jmap (cached).
+     */
+    async getPrimaryMailAccountId() {
+        if (this.cachedMailAccountId &&
+            this.cachedUploadUrl &&
+            this.cachedDownloadUrl &&
+            this.cachedJmapPostUrl &&
+            this.cachedJmapSession) {
+            return this.cachedMailAccountId;
+        }
+        await this.refreshJmapSessionData();
+        if (!this.cachedMailAccountId) {
+            throw new Error("JMAP session missing primary mail account id.");
+        }
+        return this.cachedMailAccountId;
+    }
+    invalidateJmapSessionCache() {
+        this.cachedMailAccountId = undefined;
+        this.cachedUploadUrl = undefined;
+        this.cachedDownloadUrl = undefined;
+        this.cachedJmapPostUrl = undefined;
+        this.cachedJmapSession = undefined;
+    }
+    async refreshJmapSessionData() {
+        const cap = await this.getCapabilityToken();
+        const session = await fetchJmapWellKnown(this.apiUrl, cap);
+        this.cachedJmapSession = session;
+        this.cachedMailAccountId = extractPrimaryMailAccountId(session);
+        const blobs = extractBlobEndpoints(session);
+        this.cachedUploadUrl = blobs.uploadUrl;
+        this.cachedDownloadUrl = blobs.downloadUrl;
+        this.cachedJmapPostUrl = extractJmapApiUrl(session);
+    }
+    /**
+     * Full URL for JMAP `POST` batches (RFC 8620 Session `apiUrl` from
+     * `GET /.well-known/jmap`).
+     */
+    async getJmapPostUrl() {
+        if (this.cachedJmapPostUrl && this.cachedJmapSession) {
+            return this.cachedJmapPostUrl;
+        }
+        await this.refreshJmapSessionData();
+        if (!this.cachedJmapPostUrl) {
+            throw new Error("JMAP session missing apiUrl.");
+        }
+        return this.cachedJmapPostUrl;
+    }
+    async getBlobUploadLimitsForAccount(accountId) {
+        if (!this.cachedJmapSession) {
+            await this.refreshJmapSessionData();
+        }
+        if (!this.cachedJmapSession) {
+            throw new Error("JMAP session cache missing after refresh.");
+        }
+        return extractBlobUploadLimits(this.cachedJmapSession, accountId);
+    }
+    /**
+     * Register or return existing inbox when username matches (idempotent).
+     * Different username requires explicit force to replace credentials and
+     * create a new inbox.
+     */
+    async register(username, options = {}) {
+        const want = normalizeUsername(username);
+        if (want.length < 5 || want.length > 21) {
+            throw new Error("Username must be 5–21 characters.");
+        }
+        if (this.hasApiKey && !this.inboxId) {
+            throw new Error("Cannot register: an API key is configured but inboxId is unknown. " +
+                "Fix credentials.json or unset ATOMIC_MAIL_API_KEY before registering.");
+        }
+        if (this.hasApiKey && this.inboxId) {
+            const have = inboxLocalPart(this.inboxId);
+            if (have === want) {
+                const accountId = await this.getPrimaryMailAccountId();
+                return {
+                    inbox: this.inboxId,
+                    accountId,
+                    idempotent: true,
+                };
+            }
+            if (options.forced !== true) {
+                throw new Error("Register refused because credentials already belong to " +
+                    `"${this.inboxId}" and requested username is "${want}". ` +
+                    "Alternatively, use a separate credential directory " +
+                    "(credentials_dir in MCP / --credentials-dir in AgentSkill) to " +
+                    "register another account without replacing the current one. " +
+                    "If you want to replace credentials in this directory, first " +
+                    "back it up and remember where you copied it, otherwise you may " +
+                    "lose access to your old account. Then retry with forced=true " +
+                    "(MCP) or --forced (AgentSkill).");
+            }
+            await this.store.clear();
+            this.apiKey = undefined;
+            this.inboxId = undefined;
+            this.sessionJWT = undefined;
+            this.capabilityJWT = undefined;
+            this.cachedMailAccountId = undefined;
+            this.cachedUploadUrl = undefined;
+            this.cachedDownloadUrl = undefined;
+            this.cachedJmapPostUrl = undefined;
+            this.cachedJmapSession = undefined;
+        }
+        const result = await performPoWAndSession({
+            authUrl: this.authUrl,
+            scryptSalt: this.scryptSalt,
+            username,
+        });
+        if (!result.apiKey) {
+            throw new Error("Signup did not return an apiKey — this indicates a server bug.");
+        }
+        this.apiKey = result.apiKey;
+        this.sessionJWT = result.sessionJWT;
+        await this.store.save({ sessionJwt: this.sessionJWT });
+        const capability = await fetchCapability(this.authUrl, this.sessionJWT);
+        this.capabilityJWT = capability;
+        await this.store.save({ capabilityJwt: capability });
+        const claims = decodeJwtPayload(capability);
+        if (typeof claims.inboxId !== "string" || claims.inboxId.length === 0) {
+            throw new Error("Capability JWT missing inboxId claim after signup.");
+        }
+        this.inboxId = claims.inboxId;
+        this.cachedMailAccountId = undefined;
+        this.cachedUploadUrl = undefined;
+        this.cachedDownloadUrl = undefined;
+        this.cachedJmapPostUrl = undefined;
+        this.cachedJmapSession = undefined;
+        const accountId = await this.getPrimaryMailAccountId();
+        if (!this.cachedUploadUrl || !this.cachedDownloadUrl ||
+            !this.cachedJmapPostUrl) {
+            throw new Error("JMAP session did not provide uploadUrl, downloadUrl, or apiUrl.");
+        }
+        await this.store.save(this.currentCredentialArtifacts());
+        return {
+            inbox: this.inboxId,
+            accountId,
+            apiKey: this.apiKey,
+        };
+    }
+    async getCapabilityToken() {
+        if (this.capabilityJWT &&
+            !isJwtExpired(this.capabilityJWT, CAPABILITY_SAFETY_MARGIN_MS)) {
+            return this.capabilityJWT;
+        }
+        await this.ensureSession();
+        if (!this.sessionJWT) {
+            throw new Error("Internal: ensureSession() left sessionJWT unset.");
+        }
+        const cap = await fetchCapability(this.authUrl, this.sessionJWT);
+        this.capabilityJWT = cap;
+        await this.store.save({ capabilityJwt: cap });
+        try {
+            const claims = decodeJwtPayload(cap);
+            if (typeof claims.inboxId === "string" && claims.inboxId.length > 0) {
+                this.inboxId = claims.inboxId;
+            }
+        }
+        catch {
+            // non-fatal
+        }
+        return cap;
+    }
+    async ensureSession() {
+        if (this.sessionJWT &&
+            !isJwtExpired(this.sessionJWT, SESSION_SAFETY_MARGIN_MS)) {
+            return;
+        }
+        if (!this.apiKey) {
+            throw new Error("No API key configured and no valid session on disk. Run register " +
+                "first, set ATOMIC_MAIL_API_KEY, or place credentials.json in the " +
+                "credential directory.");
+        }
+        const result = await performPoWAndSession({
+            authUrl: this.authUrl,
+            scryptSalt: this.scryptSalt,
+            apiKey: this.apiKey,
+        });
+        this.sessionJWT = result.sessionJWT;
+        this.capabilityJWT = undefined;
+        this.cachedMailAccountId = undefined;
+        this.cachedUploadUrl = undefined;
+        this.cachedDownloadUrl = undefined;
+        this.cachedJmapPostUrl = undefined;
+        this.cachedJmapSession = undefined;
+        await this.store.save({ sessionJwt: this.sessionJWT });
+    }
+    destroy() {
+        // reserved
+    }
+}
+/** PoW login with an existing API key; writes credentials + JWT files. */
+export async function persistLoginWithApiKey(input) {
+    const authUrl = input.authUrl.replace(/\/+$/, "");
+    const apiUrl = input.apiUrl.replace(/\/+$/, "");
+    const session = await performPoWAndSession({
+        authUrl,
+        scryptSalt: input.scryptSalt,
+        apiKey: input.apiKey,
+        onPowProgress: input.onPowProgress,
+    });
+    const capabilityJWT = await fetchCapability(authUrl, session.sessionJWT);
+    const claims = decodeJwtPayload(capabilityJWT);
+    const inboxId = claims.inboxId;
+    if (typeof inboxId !== "string" || inboxId.length === 0) {
+        throw new Error("Capability JWT did not contain an inboxId claim.");
+    }
+    const jmapSession = await fetchJmapWellKnown(apiUrl, capabilityJWT);
+    const blobs = extractBlobEndpoints(jmapSession);
+    await writeCredentials(input.files.credentialsFile, {
+        apiKey: input.apiKey,
+        inboxId,
+        authUrl,
+        apiUrl,
+        scryptSalt: input.scryptSalt,
+        uploadUrl: blobs.uploadUrl,
+        downloadUrl: blobs.downloadUrl,
+    });
+    await writeJwtFile(input.files.sessionFile, session.sessionJWT);
+    await writeJwtFile(input.files.capabilityFile, capabilityJWT);
+    return { inboxId };
+}

package/esm/lib/agent/session/inbox-id-to-mailbox-email.d.ts

@@ -0,0 +1,6 @@
+/** Optional inbox domain override for `$INBOX` normalization. */
+export type InboxEmailEnv = {
+    ATOMIC_MAIL_INBOX_DOMAIN?: string;
+};
+export declare function inboxIdToMailboxEmail(inboxId: string, env?: InboxEmailEnv): string;
+//# sourceMappingURL=inbox-id-to-mailbox-email.d.ts.map

package/esm/lib/agent/session/inbox-id-to-mailbox-email.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbox-id-to-mailbox-email.d.ts","sourceRoot":"","sources":["../../../../src/lib/agent/session/inbox-id-to-mailbox-email.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,MAAM,MAAM,aAAa,GAAG;IAAE,wBAAwB,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAYlE,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,GAAG,CAAC,EAAE,aAAa,GAClB,MAAM,CAWR"}

package/esm/lib/agent/session/inbox-id-to-mailbox-email.js

@@ -0,0 +1,21 @@
+/**
+ * Normalizes stored `inboxId` into an RFC5322 mailbox address for `$INBOX`
+ * substitution (`From`, submission `envelope`, etc.).
+ *
+ * Credentials may store only the local-part (`alice`); production mailboxes
+ * live at `alice@atomicmail.ai`. Pass `ATOMIC_MAIL_INBOX_DOMAIN` via `env`
+ * when not using the default domain.
+ */
+const DEFAULT_INBOX_DOMAIN = "atomicmail.ai";
+export function inboxIdToMailboxEmail(inboxId, env) {
+    const trimmed = inboxId.trim();
+    if (trimmed.length === 0)
+        return inboxId;
+    if (trimmed.includes("@"))
+        return trimmed;
+    const raw = env?.ATOMIC_MAIL_INBOX_DOMAIN?.trim();
+    const domain = raw && raw.length > 0
+        ? raw.replace(/^@+/, "")
+        : DEFAULT_INBOX_DOMAIN;
+    return `${trimmed}@${domain}`;
+}

package/esm/lib/core/consts.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Fixed proof-of-work scrypt salt. The auth-service passes this string (UTF-8
+ * bytes of the hex text, not decoded binary) to `scrypt` as the `salt`
+ * argument; all PoW clients must use the same value.
+ */
+export declare const DEFAULT_POW_SCRYPT_SALT_HEX: string;
+/** Production auth-service base URL when unset in env and credentials.json. */
+export declare const DEFAULT_AUTH_URL: string;
+/** Production JMAP / API base URL when unset in env and credentials.json. */
+export declare const DEFAULT_API_URL: string;
+export declare const ONE_SEC_MS: number;
+export declare const ONE_MIN_MS: number;
+export declare const ONE_HOUR_MS: number;
+export declare const ONE_DAY_MS: number;
+export declare const ONE_MONTH_MS: number;
+export declare const ONE_YEAR_MS: number;
+//# sourceMappingURL=consts.d.ts.map

package/esm/lib/core/consts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../../../src/lib/core/consts.ts"],"names":[],"mappings":"AA2BA;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,QACG,CAAC;AAE5C,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,QAAiC,CAAC;AAE/D,6EAA6E;AAC7E,eAAO,MAAM,eAAe,QAAgC,CAAC;AAE7D,eAAO,MAAM,UAAU,QAA2B,CAAC;AACnD,eAAO,MAAM,UAAU,QAA2B,CAAC;AACnD,eAAO,MAAM,WAAW,QAA4B,CAAC;AACrD,eAAO,MAAM,UAAU,QAA2B,CAAC;AACnD,eAAO,MAAM,YAAY,QAA6B,CAAC;AACvD,eAAO,MAAM,WAAW,QAA4B,CAAC"}

package/esm/lib/core/consts.js

@@ -0,0 +1,28 @@
+import { tryReadSharedJson } from "./shared-assets.js";
+const SHARED_CONSTS = tryReadSharedJson("consts.json") ?? {
+    DEFAULT_POW_SCRYPT_SALT_HEX: "0b980734412c292d6549110276b604ab1dea4883bd460d77d1b984adf8bca083",
+    DEFAULT_AUTH_URL: "https://auth.atomicmail.ai",
+    DEFAULT_API_URL: "https://api.atomicmail.ai",
+    ONE_SEC_MS: 1000,
+    ONE_MIN_MS: 1000 * 60,
+    ONE_HOUR_MS: 1000 * 60 * 60,
+    ONE_DAY_MS: 1000 * 60 * 60 * 24,
+    ONE_MONTH_MS: 1000 * 60 * 60 * 24 * 30,
+    ONE_YEAR_MS: 1000 * 60 * 60 * 24 * 365,
+};
+/**
+ * Fixed proof-of-work scrypt salt. The auth-service passes this string (UTF-8
+ * bytes of the hex text, not decoded binary) to `scrypt` as the `salt`
+ * argument; all PoW clients must use the same value.
+ */
+export const DEFAULT_POW_SCRYPT_SALT_HEX = SHARED_CONSTS.DEFAULT_POW_SCRYPT_SALT_HEX;
+/** Production auth-service base URL when unset in env and credentials.json. */
+export const DEFAULT_AUTH_URL = SHARED_CONSTS.DEFAULT_AUTH_URL;
+/** Production JMAP / API base URL when unset in env and credentials.json. */
+export const DEFAULT_API_URL = SHARED_CONSTS.DEFAULT_API_URL;
+export const ONE_SEC_MS = SHARED_CONSTS.ONE_SEC_MS;
+export const ONE_MIN_MS = SHARED_CONSTS.ONE_MIN_MS;
+export const ONE_HOUR_MS = SHARED_CONSTS.ONE_HOUR_MS;
+export const ONE_DAY_MS = SHARED_CONSTS.ONE_DAY_MS;
+export const ONE_MONTH_MS = SHARED_CONSTS.ONE_MONTH_MS;
+export const ONE_YEAR_MS = SHARED_CONSTS.ONE_YEAR_MS;

package/esm/lib/core/jmap-hints.d.ts

@@ -0,0 +1,3 @@
+/** Static JMAP success hints (no shared/ filesystem reads). */
+export declare const JMAP_NEXT_HINTS: readonly ["Use jmap_request with Mailbox/get or Email/query to work with mail data.", "Use presets with $VAR placeholders — $ACCOUNT_ID, $INBOX, and $INBOX_MAILBOX_ID come from the session; pass others via vars / --vars.", "Call help for the JMAP cheatsheet and troubleshooting."];
+//# sourceMappingURL=jmap-hints.d.ts.map

package/esm/lib/core/jmap-hints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jmap-hints.d.ts","sourceRoot":"","sources":["../../../src/lib/core/jmap-hints.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,eAAO,MAAM,eAAe,0RAIlB,CAAC"}

package/esm/lib/core/jmap-hints.js

@@ -0,0 +1,6 @@
+/** Static JMAP success hints (no shared/ filesystem reads). */
+export const JMAP_NEXT_HINTS = [
+    "Use jmap_request with Mailbox/get or Email/query to work with mail data.",
+    "Use presets with $VAR placeholders — $ACCOUNT_ID, $INBOX, and $INBOX_MAILBOX_ID come from the session; pass others via vars / --vars.",
+    "Call help for the JMAP cheatsheet and troubleshooting.",
+];

package/esm/lib/core/messages.d.ts

@@ -0,0 +1,6 @@
+type SharedErrorMap = Record<string, string>;
+declare const SHARED_ERRORS: SharedErrorMap;
+export declare function sharedError(key: keyof typeof SHARED_ERRORS): string;
+export declare function sharedErrorTemplate(key: keyof typeof SHARED_ERRORS, values: Record<string, string | number>): string;
+export {};
+//# sourceMappingURL=messages.d.ts.map

package/esm/lib/core/messages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"messages.d.ts","sourceRoot":"","sources":["../../../src/lib/core/messages.ts"],"names":[],"mappings":"AAEA,KAAK,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE7C,QAAA,MAAM,aAAa,gBAShB,CAAC;AAEJ,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,OAAO,aAAa,GAAG,MAAM,CAEnE;AAED,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,OAAO,aAAa,EAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,GACtC,MAAM,CAMR"}

package/esm/lib/core/messages.js

@@ -0,0 +1,19 @@
+import { tryReadSharedJson } from "./shared-assets.js";
+const SHARED_ERRORS = tryReadSharedJson("messages/errors.json") ??
+    {
+        mcp_ops_mutually_exclusive: "ops and ops_file are mutually exclusive — provide one.",
+        mcp_ops_required: "Provide either ops or ops_file.",
+        cli_ops_mutually_exclusive: "--ops and --ops-file are mutually exclusive.",
+        cli_ops_required: "Provide --ops or --ops-file.",
+        cli_dry_run_with_attachment: "--dry-run cannot be combined with --attachment.",
+    };
+export function sharedError(key) {
+    return SHARED_ERRORS[key];
+}
+export function sharedErrorTemplate(key, values) {
+    let out = SHARED_ERRORS[key];
+    for (const [k, v] of Object.entries(values)) {
+        out = out.replaceAll(`{${k}}`, String(v));
+    }
+    return out;
+}

package/esm/lib/core/read-npm-package-readme.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Reads README.md from the npm package root (next to package.json).
+ * Intended for published @atomicmail/mcp and @atomicmail/agent-skill layouts.
+ */
+export declare function readNpmPackageReadme(): Promise<string>;
+//# sourceMappingURL=read-npm-package-readme.d.ts.map

package/esm/lib/core/read-npm-package-readme.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-npm-package-readme.d.ts","sourceRoot":"","sources":["../../../src/lib/core/read-npm-package-readme.ts"],"names":[],"mappings":"AAiCA;;;GAGG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,CA+C5D"}

package/esm/lib/core/read-npm-package-readme.js

@@ -0,0 +1,81 @@
+// Locate and read README.md from an installed @atomicmail/* npm package.
+import { readFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+const MAX_DEPTH = 16;
+const ATOMICMAIL_NPM_NAMES = new Set([
+    "@atomicmail/mcp",
+    "@atomicmail/mcp-github",
+    "@atomicmail/mcp-gh-pages",
+    "@atomicmail/mcp-modelcontextprotocol",
+    "@atomicmail/mcp-clawhub",
+    "@atomic-mail/mcp",
+    "@atomic-mail/mcp-github",
+    "@atomic-mail/mcp-gh-pages",
+    "@atomic-mail/mcp-modelcontextprotocol",
+    "@atomic-mail/mcp-clawhub",
+    "@atomicmail/agent-skill",
+    "@atomicmail/agent-skill-github",
+    "@atomicmail/agent-skill-gh-pages",
+    "@atomic-mail/agent-skill",
+    "@atomic-mail/agent-skill-github",
+    "@atomic-mail/agent-skill-gh-pages",
+]);
+function isEnoent(err) {
+    if (!(err instanceof Error))
+        return false;
+    const code = err.code;
+    return code === "ENOENT" || code === "ENOTDIR";
+}
+/**
+ * Reads README.md from the npm package root (next to package.json).
+ * Intended for published @atomicmail/mcp and @atomicmail/agent-skill layouts.
+ */
+export async function readNpmPackageReadme() {
+    const moduleDir = dirname(fileURLToPath(globalThis[Symbol.for("import-meta-ponyfill-esmodule")](import.meta).url));
+    let currentDir = moduleDir;
+    for (let i = 0; i < MAX_DEPTH; i++) {
+        const pkgPath = resolve(currentDir, "package.json");
+        const readmePath = resolve(currentDir, "README.md");
+        let pkgRaw;
+        try {
+            pkgRaw = await readFile(pkgPath, "utf-8");
+        }
+        catch (err) {
+            if (!isEnoent(err))
+                throw err;
+            const parent = resolve(currentDir, "..");
+            if (parent === currentDir)
+                break;
+            currentDir = parent;
+            continue;
+        }
+        let name;
+        try {
+            name = JSON.parse(pkgRaw).name;
+        }
+        catch {
+            name = undefined;
+        }
+        if (!name || !ATOMICMAIL_NPM_NAMES.has(name)) {
+            const parent = resolve(currentDir, "..");
+            if (parent === currentDir)
+                break;
+            currentDir = parent;
+            continue;
+        }
+        try {
+            return await readFile(readmePath, "utf-8");
+        }
+        catch (err) {
+            if (!isEnoent(err))
+                throw err;
+        }
+        const parent = resolve(currentDir, "..");
+        if (parent === currentDir)
+            break;
+        currentDir = parent;
+    }
+    throw new Error("Could not find Atomic Mail package README.md — use a published npm install " +
+        "(@atomicmail/mcp* channel package) for --topic readme.");
+}

package/esm/lib/core/shared-assets.d.ts

@@ -0,0 +1,6 @@
+export declare function getSharedRootPath(): string;
+export declare function readSharedText(relativePath: string): string;
+export declare function readSharedJson<T>(relativePath: string): T;
+export declare function tryReadSharedText(relativePath: string): string | undefined;
+export declare function tryReadSharedJson<T>(relativePath: string): T | undefined;
+//# sourceMappingURL=shared-assets.d.ts.map

package/esm/lib/core/shared-assets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-assets.d.ts","sourceRoot":"","sources":["../../../src/lib/core/shared-assets.ts"],"names":[],"mappings":"AAwBA,wBAAgB,iBAAiB,IAAI,MAAM,CAG1C;AAED,wBAAgB,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAG3D;AAED,wBAAgB,cAAc,CAAC,CAAC,EAC9B,YAAY,EAAE,MAAM,GACnB,CAAC,CAEH;AAED,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAM1E;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAMxE"}