@bkazemi/verily 0.1.0

package/dist/server/email-logo.js

@@ -0,0 +1,122 @@
+/**
+ * The Verily logotype on its plate, as a PNG, for mail. A message cannot draw the logotype
+ * the way a page does: the clients most people read mail in strip an inline SVG. So it
+ * travels inside the message as an image of its own, which is shown without anything
+ * being fetched.
+ *
+ * This is docs/design/verily-logo-plate.svg drawn at 281 by 120, three times the 94 by 40
+ * it is shown at, with the plate's corners left transparent. Regenerate it from that file
+ * if the logotype changes.
+ */
+export const emailLogo = 'iVBORw0KGgoAAAANSUhEUgAAARkAAAB4CAYAAADGz4ZcAAAABmJLR0QA/wD/AP+gvaeTAAAchUlEQVR4nO2dd3wU' +
+    'VdfHf7Obzab3DklIoQQISJEnVHnoIKhUUVqAUEREsePr86qoqA+W10YnoYMgKEWUkpBIr+mNkFACKZtKyiab7O68' +
+    'f2CUkGTmZndmS7jfz4fPR2ZO7jnrkjN37mkMCLF19gyVAOMBDAQQAsAdgD3pz1MoFLNFA6AMDG4DSGJYNtqCUR8u' +
+    'LS2tIPlhhk/A0cVjlFbLfAwG/fS1lEKhtBlqGLBRGhlWVisUhVyCLToZezefzqxa8z3DYKTw9lEolDZCFcuyq6vK' +
+    'FasAqJsTaNbJOLp4jNKyzE8AnMS0jkKhtBXYP9l6yZSqqoKiR+80cTL2Lp4LwWINAKlBbKNQKG0DBllqSIfXlObl' +
+    'Nr78EH/tYH4DYGFQ4ygUSpuAARKsLTGosLCwuuGapOE/7N18OmtZZi+og6FQKDrCAk/U1CHq4Wt/vxJZWdrsAYOu' +
+    'hjeLQqG0MbrJrezi62qrM4G/djIOLh6jWQYjjGsXhUJpMzDsf/HXW5EUACzldrvAoJ1RjaJQKG0Ixs3KyjZbVVud' +
+    'KLFz9uxOE+0oFIrQsAwzFwAkDDDB2MZQKJQ2yWBHRz9nCR7UIlEoFIrQSFlJXZgEQBdjW0KhUNomLKMNkQDwMrYh' +
+    'FAqljcLCUwLAxth2UCiUtgkD2ElA0O6BQqFQdEPCSPiFhMVGIoW3XG5otXoRbE03exSKrhisTslWKsVEd3fM9PTB' +
+    'dWU1lmVlGkq1XrSTyxEV0hU5NTXYoyjEsdISaFnW2GY91ixcMA8r3n4Trq4uTe5ptVqkpKZhydLXkJScotP6Hu7u' +
+    '6Ny5Iyyk//x6qDVqZGZmQVHUpJMBhQfG3tlT1N8YZ5kMk9zcMd3TC7bSf7pHLMpIR3J1lZiqBWFFhw6Y4Or+999z' +
+    'amuws6AAx0tLoKHOxuD4+fki8eoFSKXcnUgSk5IxeGjr+61NGD8OkRvXQS63bHJPparD3IhFOPLb761e93GFAbNW' +
+    'tNclL0tLLPf1w4HQHpjv066RgwGAmV7eYqkWDA+ZDGOc3RpdC7Syxn86BGBft1BM8/SE3PBvnI81QYGBvA4GALqG' +
+    '6JaZsfzVpc06GACQyy2xZPFCndZ9nBH8dclZJsPSdu0xysUVUqblM+VBTk4IsrZGdk2N0CYIxgwvb8gkzX8GL7kc' +
+    'r7X3wwxPL2zNz8eBIoWBrXs8kUjInDrD8W+PC2cn7maQTk6OOq37OCP4Y1ipVqOfoyOngwEehLRmm/BuxsnCAhPc' +
+    '3Hnl3GWWaG9lXgfZFIohEdzJqFgW+wo5m5f/zXBnF/haWQltgiBM9/SCFcFTs07LYncB2eelUB5HRDlQ2F+kQJWm' +
+    '2cbljZUzDF70NL2EY1upFJPc+XcxAHC0tAhF9XUiW0ShmC+iOJlqjQY/K8jOKJ52dYOnZfMHbcZimocn7KT8x1Va' +
+    'lsVuwl0bRRiUSiWRXHV1Nb8QxSCIFhr5SVGIGq2GV86CYTDdw3R2M3K5DLYDgqGS8h8cniwrRW5trQGsojQQH5+A' +
+    'zOtZvHJbt+80gDUUEkRLxruvVuNQUTGe9/TklX3O3R3bCvNRVl8vljnEhA7tho19nLG3uxbP5VRjclY17Ou1TeRY' +
+    'ANsK8g1v4GNOrUqFYSPHYfzTY+Hl6dHkvlqtQUpKKk7F/WkE6yjNIWrG7+7CfEx094BlC2HgBuQSCaa6e2BD3j0x' +
+    'zeHFwkKK/L4PupDel0uwNcQe+4LtMOa2Ei9mVsG19p+d2enyMuSYcPi9LVNZWYnde/Ya2wwKIaJmkinq6/F7aTGR' +
+    '7FTCcxAx6Tk4BMW2jW1QyhgcCLbFC2M98FVvRyisHySC7SgoMIaJFIrZIXq66vaCfKL0+9ZEdMRAIpWgKMy/xfv1' +
+    'EgZHAmwxc4wnvvGVIMUMSiIoFFNAdCeTp1IhpqyUSPYFwtwUMQgN64RCe/6dVL0ESMqiZzEUCikG+Y3ekp9PVLns' +
+    'SJhlKzQMA1QOCCCSDSiuRWbqHZEtolDaDgZxMjdra3D2/n0iWa56IbHo1rcj7jmT5epIY/nDpxQK5R8M9m6yNT+P' +
+    'SK65ymexUQ8KJJJrX6ZCWnyOyNZQKG0Lg4Vz0pTVuFJRgb4ODryys729cbS02CD9WrqE+uOmO1n9lN2ZHIhtkpVc' +
+    'ji4hndG+XTvY2dnB3s4WjESC6upqVFVWo7ikGJnXs1BcXCKuIRSKQBg0ZrytMJ/IybSTyzHMyRknCA+M9UH6705E' +
+    'ch6V9Ui+dENw/RYWFhg4IAwTnh6HoUOHICgwgKhfSkFhIZKSUnD092M4/NtRFBWRpQroilQqxbSpk9G5U8dGbRRq' +
+    'ampw4mQMrl6L513D17c9OgYHw9/PF05OjrC2tob8oVasSqUSfxw/gcTEZN61evYMxZhRI2Fj07g1alFRMfbs3WcS' +
+    'TjgoKBATn50Ae3v7RterqqpwIjoGCQlJRrFr5IhheLJvn0b/7wEgJ+cmdv+0F3V1wibFit4Z71HWde6CHnb2vHI3' +
+    'apSYk5YKMY0L6uSDu+FPEsl2O3YD1+JSBdNtZ2eHiHlzsPTlxfDQM3Sv0WgQcyoOn33xJa5cvSaQhY359pvVmDtn' +
+    'VrP3tFotJk+bgeiYU03u9erVE3NmzcDI4cPg69ueV49arcawUeM4fwGfeKIHYo4fhYVF88/InJybCBs4FLUqFa++' +
+    'R4m/fA5BQS2/PqekpmHA4GG867i4OCP+8nk4Ozffn6a+vh4jx0zAtfiEVtuoDy++MA3rfvyuxfu7du/F4peXCaZP' +
+    '1M54LbGjkCyJLdjaBgN5Ggjpi90wsu5prko1ks+nC6KTYRjMnTMLqYlXsPLD/+jtYIAHu4yRI4Yh5sRR7N29Hf7+' +
+    'fgJY2pgpk55r8Z5EIsH0aZMbXQvt3g1HDu5HXPQxzAufTeRggAc7u7GjR3HKjB09qkUHAwCBgQEI6WrcmYUdg4Nb' +
+    'dDAAIJPJsOyVJQa0CLC2ssKqjz/ilOnVq6fgeg3uZM6Wl+M6YSXtHC8f0ezw9/dApi//jgoAvC7mor6uaf1Sa/Hx' +
+    '9sav+/fg229Wc/4D1Icxo0fibNxJTqegC7a2tsT3Fy2cj9joPzBksG4TkK14egw9us1vDmsj9ylKSExEVRV3wuaE' +
+    'p8fC28twxcFTp0yCi4szp8zpM+cE12twJ8MC2ElYWNjN1pboDEcXXEZ2BUsQKXes1SA1Vv9dTEiXzog+cRT/HvqU' +
+    '3mvx4eDggMhN6/DRB++LrutR3n/vHaz+/FPIZDKD6zYlVKo6HDz0G6eMTCZD+JyZBrLogfPn4+f9vwiu1yjptdHl' +
+    'ZchVkbVImCVCi05vb2dkBpA5L7+reVDpWR3eq1dPHDt6CO18DNtudPmrS/HJyv81mL45s2bg7TeXG0yfqbN+02Ze' +
+    'mfA5Mw3ikAcN7I/Q7t04ZeLjE3Hh4iXBdRulIlHLstiRX4AVHTrwyj5p74BQWztBx6f4jOyGUoJG07b1WqTH6nfY' +
+    '287HGz/t2taqBtTJKam4Fp+A7Owc3L9fAa1WCwcHB/j7++GJnqHo07sXUQQKAJYtXQKFohjf/bBG149AhJ+fLz5f' +
+    'tVKQterq2kanwYSEJFy6fAX9nuzbooy3lxfGjxuDXw4eFtUWkl3M2g2bRNFttLLn30uLMdfHB14EXfFmennhnWxh' +
+    'wsdubvbI7ORKJBuUUIjL1a2PUDQgl1tiz85t8CLoqVNXV4+NmyOxKXIrsrO5E/68vbww48Xn8eorS+DoyO+8PvjP' +
+    'Cpy/cBGXr1wltr219AjtLsg6Wq0WJ6ObRqnMlfUbIzmdDAAsiJgnqpNp374dnh47hlOmUKHAgV9+FUW/0ZyMmmWx' +
+    'u7AAy335IyGDnJwFG5/SYWQokgleEq3ULLJidJtA2MDyV19Bz56hvHIJCUmYu2Axr3NpIL+gAF9+/S0it2zDd998' +
+    'iWcmPM0pL5PJELlxLfr1H4IaI3XyKykpxaXLV1BUXIzS0jKwzWQ1KpVKnDgZY/CwrpgcPHQYqz75EJ4eTRtsNTBo' +
+    'YH90DemCtPQMUWxYMH8uZzQOACKjtgmeH9OAURu4HCpSYLa3N1wtuN9JG8anfHBTv5R+JwcbZIWQlSx0SlXg8n2y' +
+    'KFhzBAcF4fXl/PkGhw7/hoiFS3TK6SgtLcOs8Ai8+/YbWPHOm5yy/v5+WLwoAt98+0Or9eiKWq3Gvp8PYM36jUhO' +
+    'ToVWq3+Eztyoq6tH1JbtePftNzjlIuaH4/U33xVcv7WVFebMmsEpo1LVYXPkVsF1N2DU8YeGHp/SaWQoai34z2Jk' +
+    'WhY5J9P00vU/770NK55Q66nYOMxbsFgnB9MAy7L47Isv8dU3LSdYNfD6a6+IFjp/lJycmxj01AgsWrIMiYnJj6WD' +
+    'aSBqy3bU8wQPpk+b0iQzWAhIwtb7D/wq6oxvo89YNdT4FFtbOW704D8bAYAuGaUoKanQWVdAQAc898x4TplChQIR' +
+    'i14WbIv6yaov8Ofps5wyjo6OmBc+WxB9XFyLT8DQEWNE2/6bG/kFBTh05CinjJ2dHV6YPlVw3WQHvhsF1/swRncy' +
+    'hhqf0m14KKpl/LsYCQvkxei3i3n5pUW80Z+PPl4laL2RRqPBq6+/xfvEnPnidJ1HuJJQVFSMGbPmorycrLXH48KG' +
+    'jZG8MhHzwgX9bkjC1ufOXyCqFdMHozsZQPzxKXK5DDd7keWodM0uR16e7oWZUqkUE5+dwCmTk3MTu/fs01lHS2Rn' +
+    '52Dbjl2cMkFBgegf1k9w3Q28/8FK3MujnQMf5fyFi0hK5g4kdOncCYMHDRBMJ8kuZt16ccLWD2MSTqZhfAoJz7m7' +
+    'w0nWuvPq0KHdUCHn/6gMCyii9dvFDBwQBnd37sPlrdt3QqPhd6q6QHKAN27saFF03759B/t+PiDK2m0Bkt3Mgoi5' +
+    'gugiCVvn5t7FkaN/CKKPC5NwMsCD8Sl1Wv6a63vOlvhXf/LiNwuZBHlPkhXndb5Tidzb+h2AjR3DXdwHAPt/OaiX' +
+    'Di5SUtOQnpHJKTNk0CBRdP9y8DDUav7ztceVfT8fQGlpGafM02PHCJIZThK23rg5yiDfl8k4Gb7xKVlOMnwY5oyI' +
+    '4R64NCIAtrZkkaaeg7qixIYsO7bypP41Sn379Oa8f+vWbdy5k6u3Hi5OnYrjvB8a2o0oia+18B08P+7U1NZi+87d' +
+    'nDIWFhYIb6GlBikkYeuamhps2bZDLz2kmIyTAZofn5LsZon3Brhi4XB3xLWzBssASgsJQoZ15V3vwZgTsrYHnfKq' +
+    'kZOt31mCTCZDjx7cyXcJSeIesgFAfCJ3MySpVIoeodwHgrqQni5MO4y2zMbNUbyvyuFzZsLSUvd6JpKw9a49ew12' +
+    'OG9STqZhfArLAOe8rfDyv92x7Ck3nPdumm9yu48PrKy4v4gHY07Ivqy6U9yvGCQEBwXythi4cSNbbz18kOgIDCCb' +
+    'ztAa+F4FKMCdO7k4dvwkp4ynhweeGc+dxc0F34Evy7JYv4G/eFMoTMrJAEBUsQIRwz3wPwNckObSsoOosJSi+5CW' +
+    'dzOtGnNSVIvMVP1fYby9+d+li0vEbwtZVMx/iB4YKKyTqaurN1rJgrmxniScPT9cp7VJwtanYuOQkXldp/V1weSc' +
+    'zK3KKliWk6Xz5/Xzhcyy+Y/QqjEnccKMOfH25k/2U1brXqpACl+zJADEnepI0bKPb0Zva4mN+xPXs7gLfgf0D0P3' +
+    'bvxHAo9ClHxngLD1wxh3+HQLVEZnAvP4e++W2EgROqArrsU2zT9QDyJ7Ugs55oSrCK6BN19/VfSsW4mU/9lhb2cn' +
+    'qg2UlmFZFhs2ReLLL1ZxykXMD8drr79NvC5J2PpGdjZOnIwhXlMITNLJ5NzIQ/c8JbJ8bHhli/r7QXo6vdFh2oMx' +
+    'J9ZEuoQcc/Jo5/zm8PPzhZ+frzAK9YDEVop47Nq9Fx+8v4KzXumF56fiw5WfEh/QkoSt123YbPA6MpN7XWpAHUd2' +
+    'EKuwlyG0X3Cja6RjTjwr1YKOOSHpPWsq2PH07KWIS1VVFW/Wt7W1NaY/T1bPRBK2rqiowK7de4ltFAqTdTIZyXcQ' +
+    'oCDrH1M5OBANJR9BnXxww4vsKe127ha0GuG8ulzHuipjILUgyx2iiMeGTZHN9tV5mAXz5xLVM5GErXfs3EN0Xic0' +
+    'JutkAMDiDFm4966TJbr2DgIA2A4PIfoZIcecNKAmqCY3FWhmrvG5nnUDsXF/csp0DA7C0CGDedfiO/DVarVYv4k/' +
+    'qiUGJu1kUq9mw6+ErNeKekgw/P09cL092YGmUGNOHkalMp/etOfOXzC2CRSQhbP56pkGDgjjDVv/cewEbt681RrT' +
+    'BMMkD34bYFnA5txNYAJ/rdItdyv4TO9j0DEnj6IiaD51LT4Bt0UuK+BCXV+PhMRkbDTSU43SmGPHT+L27TucA/nG' +
+    'jhmF9u3b4e7de83eX7woglfP2vXi9ozhwqSdDAAkX8qC71NBKHDgz9zNcyQ7E/G7mocreo45aY6y8nJemagt27F1' +
+    '+07BdVPME41Gg02RW/DxRy2PrpFKpZgXPhsrP/msyT2SsHVqWjri/jyjt626YtKvSwCg1WjheuGOYOsJMeakJUoI' +
+    'hry7urqIoptivmzdvhM1PE3yw2fPhFze9CFKErZeu854uxjADJwMACSdSYe7Upj+K0HxBajWY8wJF3n5/AWWPj7i' +
+    'jd6lmCfl5fexj2dyo5ubK559pnEzNJKwdUlJqdF7/JiFk1GrNfC6pP85hpWaRdYpcXYxAHhTxQGgezey6Bfl8YKk' +
+    'YHHB/PBGf582dTJv2Dpq63aj15SZhZMBgORTKXCq1W830ylVgXI9xpzwUVxcwtu394mePZrd9lIeb5JTUnH+wkVO' +
+    'mX/1e7JRK5GFC+ZxytfX12Nz5BYhzNMLs3EyqnoNfOPzdP55IcackHDp8hXO+zY2NhgQFia6HRTzg6g95/xwAGRh' +
+    '60NHjppEv2WzcTIAkB6dBtt63QqN9B1zQsq589xPIwCYMmWi6HZQzI9DR44iv6CAU2balElwcnLEooUEYWsjH/g2' +
+    'YFZOplpZi8BE7i+hOSQscE/PBuGk/HHsOK/M5InPwslJ+PaXFPOmvv7BtEkurK2t8e5bb2D8OO6w9dVr8by7akNh' +
+    'Vk4GAK6fSIG1unWZul2zy5Gfr/uYk9aQdSMbySnch8s2NjZYtnSJKPqt5HJ8tfpzXL5wGknXLjb6c+3yWaz5/v9o' +
+    'BbYJE7VlO+/AvyUvLeQPWxu4ZwwXZudkKiqVCE4jH4omxJiT1sI3+wgAXn5pIYKDggTX/cN3X2PB/HB07tQRHTr4' +
+    'N/oTHBSEmTOmY9bMFwTXSxGGQoUCBw8d1muNgsJC/HrwkEAW6Y/ZORkAuHUyBTKC8SkA0OW2/mNOWsvOXT+hooL7' +
+    '/Mfa2hqbNvzIOy+7NbyxfBmmTZ3MK1dbQ9tkmjIk9UxcbI7cKtj4YyEwSydTXFyJzplkTasrog3fQb+qqgrffr+G' +
+    'V653ryewJXIDZDLdO9M38MbyZfjgP+/xyqnVakTHnNJbH0U8Ll2+goQE7okTLVGrUiFyyzaBLdIPs3QyAHDvRAqk' +
+    'PL04hBhzois//LgOubl3eeXGjR2NA/t2w9nZSSc9Tk6O2LF1M5GDAYCorTtw957uqQAUw7B+k27TBPbv/1XQGetC' +
+    'YLZOpqCgDF1yuNsSCjHmRFdqamvx8rLlRK0OnxoyCBfPxWHqlEmQSMi+ErncEkteWoj4y+fxzASy8Rn5BQVY9fl/' +
+    'iWQpxmX//l9RUtL6YIUxq61bwmydDAAojqe1+AECioUZc6IPsXGniV6bAMDL0xObN6xBwpXzWPHOmxg8aABcXV3A' +
+    'MAwkEgnc3d0Q0qUzxo0djdWff4rUpKv4/NOVxAWXSqUSz784W6d/uBTDU6tStbpa/8zZ80hKbtpU39iYfKsHLu7m' +
+    'FqHn7Qpk+Ds0uSeNFWbMib589PEqBAZ2wLMTxhPJd+jgjxXvvNnoGsuyRC0YW6JWpcLciMU6v+dTjMPmqK149ZUl' +
+    'kErJWqWu22A6YeuHMeudDPDX+JRHEHLMib5otVrMX/ASfj10ROc19HEwZWXlmDj5efz+B3+SIMW0yM29i6O/HyOW' +
+    '/e3oHyJbpBtm72RybuShY151o2t2p4UbcyIEdXX1mBexGBs2RRlUb1JyCoaNGoez52irTXNlA2EHw/UbI3lnbBsL' +
+    's3cyAKCO+2fkpmelGsmXhRtzIhRqtRpvvr0Cc+YuEP30X6lU4tPP/othI8ciO9s0dnSGxpQeMvqgUPDneCmVSmzb' +
+    'YbrdFtuEk3l4fIrruZuCjjkRml8OHkbvfgPx49r1UCqFbTuhKCrCl19/i159B+CL1V8LmpB169ZtzvuGdGa3b3N3' +
+    'StRqtcjN1e3Q/9Zt7s9JkpYgJBHzuZuIA8CuPXuJB8AZA6nc2u5DYxshBF5qgPF3wa2fLkCrMe3HmEqlQnRMLDZH' +
+    'bUVJSSmcnZzg5eWp09mLSlWH02fO4ONPv8Cy195AzKk4UWbrpKVnYED/MDg5Nc7nYVkWGZnXsXTZ60SdAYUgPSMD' +
+    'HTsGIzAgABaPzI8qL7+Pjz75DNExsTqtnZycirCwfnB3d2v0fbAsi7T0DLzx1gqD5aHY29tj/ZrvYMkxz4tlWSx6' +
+    '6RWUlJpm1JABc4Wxd/Y07d9IQhgG6NzdHxnJ3E8iU8XH2xv/6tcXffr0QmBAAPz8fOFgbw8HBwdIJBJUK5VQKpUo' +
+    'LFTg3r17SEvPQEJiMi5euiz4johiGixcMI93XnZ0zClMnGK6tWgMmLVtxslQKG0JhmFw+cJpdOoYzCk3aeqLOBkd' +
+    'YyCrWg8DZm2bOJOhUNoaQ58awutgsrNzEHMq1jAG6QF1MhSKCbKQZ2okAKxZt4GobMXYUCdDoZgY7du3w5jRIzll' +
+    '7t+/j1179hnIIv2gToZCMTEi5oXzlhJs27EL1dXVnDKmAnUyFIoJIZdbYtYM7miRRqPBxs1bDGOQAFAnQ6GYEJMn' +
+    'PQd3dzdOmaO/H+NNjjQlqJOhUEyIhRHcA9sA0+wZwwV1MhSKidC3T2/07vUEp0xaeobZFbxSJ0OhmAgkYesf1qwD' +
+    'a2bVnzTjl0IxAVxdXZCeEs85vaK4uARdQ3ujVqUyoGX6QTN+KRQTYe6cWbzjcSK3bDMrB9MAdTIUipGRSqUInz2T' +
+    'U+bBCFvTGnVCCnUyFIqRGT1qBPz8fDllDh46gnt5xhnvoy/UyVAoRmb0qBG8MmvWmVfY+mGok6FQjAxft72YU7G4' +
+    'cvWagawRHrMeiUKhtAW+/3Et7Ozs0KtXz0bXWa0W16/fwOervzKSZcJAQ9gUCkU0GkLY1MlQKBSR0LISALRBLIVC' +
+    'EQUWqJIAKDC2IRQKpW3CMEyBBEC6sQ2hUChtFJbJkAA4a2w7KBRKm0QjYWvPS1iGOWxsSygUSpvkz/Ly8nJJVWlB' +
+    'KoCLxraGQqG0LRiWjQL+yvhlWeZd45pDoVDaGBkV5YrdwF9Opqq8IJYFjhvXJgqF0oZ4C4AaeKh2SaLRLgVQbiyL' +
+    'KBRK24AB9lSWFR5p+PvfTqaioihLwrDT8Jf3oVAolNbCgom3tkTEw9caTZBS1VTnyG3s8gGMA63QplAorYFlrmsk' +
+    '0rHlxfklD19u4kgqSws3SRh2HIAygxlHoVDMGhY4LmEtw2pK7zXpW9HsLExVTXWOlaXNAUgkHQEEi24hhUIxVyoB' +
+    'rKwqK1yiUt1vtg6S4VvB1tFzuESCTwCECW0dhUIxT9gHhdWRqGdWVlUVFHHJ8jqZBuxcvUMYLTseYAcDCAHgAcBB' +
+    'P1MpFIoZoAZQDhY3ASSyDKKtLbRHioqKqkh++P8BysulpNQJzTwAAAAASUVORK5CYII=';

package/dist/server/email.d.ts

@@ -0,0 +1,46 @@
+import { type CodeProvider } from '../core/index.js';
+/**
+ * One message for whatever sends this deployment's mail, written twice: as HTML, and as
+ * the plain text a reader without it is shown. Send both, as alternatives of one message.
+ */
+export interface EmailMessage {
+    to: string;
+    subject: string;
+    text: string;
+    html: string;
+    /**
+     * Images the HTML shows, which travel inside the message and are attached inline under
+     * the id the HTML names each by, as `cid:<contentId>`. A sender that leaves them out
+     * still sends a whole message: the image's place reads "Verily" instead.
+     */
+    images: EmailImage[];
+}
+export interface EmailImage {
+    contentId: string;
+    filename: string;
+    contentType: string;
+    /** The image's bytes, in base 64. */
+    content: string;
+}
+export interface EmailProviderOptions {
+    /** Shown as "Verify with …". */
+    name?: string;
+    /**
+     * Hands one message to whatever sends this deployment's mail: an API, a relay, a queue.
+     * Rejecting fails the flow. Nothing here retries, since a second message would carry a
+     * code the holder was never shown a place to enter.
+     */
+    send(message: EmailMessage): Promise<void>;
+}
+/**
+ * Proves control of a mailbox by sending a code to it and having the holder read it back.
+ * No registration with anybody and nothing published: the proof is that the code arrived,
+ * so it says somebody could read that mailbox when the link was made, and nothing later.
+ * A domain can hand an address to somebody else, which is why the link expires and is
+ * renewed like any other.
+ *
+ * This sends mail to an address a visitor types, so the message carries the code, the
+ * site's name and nothing a visitor chose. How often it may be asked to send is the
+ * deployment's to limit, like every other request here.
+ */
+export declare function emailProvider(options: EmailProviderOptions): CodeProvider;

package/dist/server/email.js

@@ -0,0 +1,145 @@
+import { Refused } from '../core/index.js';
+import { emailLogo } from './email-logo.js';
+import { escape } from './escape.js';
+/** The logotype as the message carries it. */
+const logo = {
+    contentId: 'verily-logo',
+    filename: 'verily.png',
+    contentType: 'image/png',
+    content: emailLogo,
+};
+/** Atoms and single dots, as an address is written without quoting. */
+const local = /^[a-z0-9!#$%&'*+/=?^_`{|}~-]+(\.[a-z0-9!#$%&'*+/=?^_`{|}~-]+)*$/;
+const domain = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/;
+/**
+ * Proves control of a mailbox by sending a code to it and having the holder read it back.
+ * No registration with anybody and nothing published: the proof is that the code arrived,
+ * so it says somebody could read that mailbox when the link was made, and nothing later.
+ * A domain can hand an address to somebody else, which is why the link expires and is
+ * renewed like any other.
+ *
+ * This sends mail to an address a visitor types, so the message carries the code, the
+ * site's name and nothing a visitor chose. How often it may be asked to send is the
+ * deployment's to limit, like every other request here.
+ */
+export function emailProvider(options) {
+    return {
+        id: 'email',
+        name: options.name ?? 'Email',
+        method: 'code',
+        field: 'Your email address',
+        input: 'email',
+        account,
+        async deliver({ account, link, code, siteName, expiresAt }) {
+            // The name lands in a header, where a line break would start another one.
+            const site = siteName.replace(/\s+/g, ' ').trim();
+            const words = {
+                ask: `Press the button to show ${site} that this address is yours.`,
+                button: 'Confirm this address',
+                enter: 'Or enter this code on the page that asked for it:',
+                lasts: `Both work until ${new Date(expiresAt).toISOString().slice(11, 16)} UTC.`,
+                ignore: 'If you did not ask for this, ignore this message. Nothing is linked unless you confirm.',
+            };
+            await options.send({
+                to: account.id,
+                subject: `Confirm your address for ${site}`,
+                text: [
+                    `Open this link to show ${site} that this address is yours:`,
+                    link,
+                    words.enter,
+                    code,
+                    words.lasts,
+                    words.ignore,
+                ].join('\n\n'),
+                html: letter({ link, code, ...words }),
+                images: [logo],
+            });
+        },
+    };
+}
+/**
+ * The message as HTML, in the colours of the pages this library serves. Mail clients are
+ * not browsers: the layout is a table and every style is on its element, because that is
+ * what all of them keep, and the style block only adds a dark scheme where one is honoured.
+ * Nothing is fetched, so there is nothing to block and nothing to tell anyone the message
+ * was opened: the logotype is an image the message carries with it, on the plate it sits
+ * on everywhere else, and where a client will not show it the word stands in its place.
+ *
+ * Everything sits on the column's middle, said twice over, as an attribute and as a style,
+ * since clients differ on which they honour. The code's cell is padded three pixels more
+ * on the left: letter spacing follows every character, the last included, and would
+ * otherwise push the code that far off centre.
+ */
+function letter(parts) {
+    const sans = "system-ui,-apple-system,'Segoe UI',Roboto,Helvetica,Arial,sans-serif";
+    const mono = "ui-monospace,SFMono-Regular,Menlo,Consolas,'Liberation Mono',monospace";
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<meta name="color-scheme" content="light dark">
+<meta name="supported-color-schemes" content="light dark">
+<title>Verily</title>
+<style>
+@media (prefers-color-scheme: dark) {
+  .page { background: #161a18 !important; }
+  .ink { color: #dde5e0 !important; }
+  .muted { color: #96a39b !important; }
+  .button { background: #7fc4a2 !important; }
+  .button a { color: #10231a !important; }
+  .code { background: #1d2220 !important; border-color: #2f3b35 !important; color: #dde5e0 !important; }
+  .rule { border-color: #2f3b35 !important; }
+}
+</style>
+</head>
+<body class="page" style="margin:0;padding:0;background:#ffffff;">
+<div style="display:none;max-height:0;overflow:hidden;opacity:0;">${escape(parts.ask)} ${escape(parts.lasts)}</div>
+<table role="presentation" class="page" width="100%" cellpadding="0" cellspacing="0" border="0" style="background:#ffffff;">
+<tr><td align="center" style="padding:40px 16px 48px;">
+<table role="presentation" align="center" width="100%" cellpadding="0" cellspacing="0" border="0" style="max-width:440px;margin:0 auto;">
+<tr><td align="center" style="padding:0 0 28px;">
+<img src="cid:${logo.contentId}" width="94" height="40" alt="Verily" style="display:block;margin:0 auto;border:0;outline:none;font:700 20px/40px ${sans};color:#23312b;">
+</td></tr>
+<tr><td class="ink" align="center" style="padding:0 0 10px;font:650 22px/1.3 ${sans};color:#23312b;text-align:center;">Confirm your address</td></tr>
+<tr><td class="ink" align="center" style="padding:0 0 24px;font:16px/1.6 ${sans};color:#23312b;text-align:center;">${escape(parts.ask)}</td></tr>
+<tr><td align="center" style="padding:0 0 28px;">
+<table role="presentation" align="center" cellpadding="0" cellspacing="0" border="0" style="margin:0 auto;"><tr><td class="button" align="center" style="background:#245f43;border-radius:10px;"><a href="${escape(parts.link)}" style="display:inline-block;padding:13px 26px;font:600 16px/1.2 ${sans};color:#ffffff;text-decoration:none;">${escape(parts.button)}</a></td></tr></table>
+</td></tr>
+<tr><td class="muted" align="center" style="padding:0 0 10px;font:14px/1.5 ${sans};color:#6b786f;text-align:center;">${escape(parts.enter)}</td></tr>
+<tr><td class="code" align="center" style="padding:14px 12px 14px 15px;background:#f7f9f7;border:1px solid #dce2de;border-radius:10px;font:600 22px/1.2 ${mono};letter-spacing:.14em;color:#23312b;text-align:center;">${escape(parts.code)}</td></tr>
+<tr><td class="muted" align="center" style="padding:12px 0 28px;font:14px/1.5 ${sans};color:#6b786f;text-align:center;">${escape(parts.lasts)}</td></tr>
+<tr><td class="rule" style="border-top:1px solid #dce2de;font-size:0;line-height:0;">&nbsp;</td></tr>
+<tr><td class="muted" align="center" style="padding:18px 0 0;font:13px/1.6 ${sans};color:#6b786f;text-align:center;">${escape(parts.ignore)}</td></tr>
+</table>
+</td></tr>
+</table>
+</body>
+</html>`;
+}
+/**
+ * The mailbox an address names. Lowercased throughout: the part before the @ may be case
+ * sensitive by the letter of the standard and is not in any mailbox a person holds, and
+ * two spellings of one address must not be two records. Nothing else is folded, because
+ * whether a dot or a plus suffix names the same mailbox is each domain's own rule.
+ */
+function account(address) {
+    const text = address.trim().toLowerCase();
+    const at = text.lastIndexOf('@');
+    const name = text.slice(0, at);
+    const host = text.slice(at + 1);
+    if (at < 1 ||
+        text.length > 254 ||
+        name.length > 64 ||
+        !local.test(name) ||
+        !domain.test(host) ||
+        // An address literal, or a name nobody could have registered.
+        /^[\d.]+$/.test(host))
+        throw new Refused('Not an email address this can send to');
+    return {
+        id: text,
+        kind: 'mailbox',
+        handle: text,
+        profileUrl: `mailto:${encodeURIComponent(name)}@${host}`,
+    };
+}

package/dist/server/escape.d.ts

@@ -0,0 +1,2 @@
+/** Text as it is written into HTML, in an element or a quoted attribute, and read as text. */
+export declare const escape: (value: unknown) => string;

package/dist/server/escape.js

@@ -0,0 +1,2 @@
+/** Text as it is written into HTML, in an element or a quoted attribute, and read as text. */
+export const escape = (value) => String(value).replace(/[&<>"']/g, (char) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[char]);

package/dist/server/github-gist.d.ts

@@ -0,0 +1,11 @@
+import { type ArtifactProvider } from '../core/index.js';
+/**
+ * Proves control of a GitHub account by having its holder publish a given line in a public
+ * gist. No app registration, no client secret, and no token: the proof is a public document
+ * anyone can fetch, so a reader can repeat this check without trusting the backend that ran
+ * it. The unauthenticated API allows sixty requests an hour per address, which bounds how
+ * often connections using this method can be rechecked.
+ */
+export declare function githubGistProvider(options?: {
+    fetch?: typeof fetch;
+}): ArtifactProvider;

package/dist/server/github-gist.js

@@ -0,0 +1,68 @@
+import { Refused } from '../core/index.js';
+/**
+ * Proves control of a GitHub account by having its holder publish a given line in a public
+ * gist. No app registration, no client secret, and no token: the proof is a public document
+ * anyone can fetch, so a reader can repeat this check without trusting the backend that ran
+ * it. The unauthenticated API allows sixty requests an hour per address, which bounds how
+ * often connections using this method can be rechecked.
+ */
+export function githubGistProvider(options = {}) {
+    const request = options.fetch ?? fetch;
+    return {
+        id: 'github',
+        name: 'GitHub',
+        method: 'gist',
+        artifact: 'location',
+        instructions: (expect) => [
+            [
+                'Publish this line in a public gist at ',
+                { text: 'gist.github.com', href: 'https://gist.github.com/' },
+                ', then paste the gist address below.',
+            ],
+            { code: expect },
+        ],
+        async verify({ artifact, expect }) {
+            const url = URL.parse(artifact);
+            // The holder chooses this url, so nothing outside gist.github.com is ever fetched.
+            if (!url || url.protocol !== 'https:' || url.host !== 'gist.github.com')
+                throw new Refused('Not a gist address');
+            const id = url.pathname.split('/').filter(Boolean).at(-1) ?? '';
+            if (!/^[0-9a-f]{20,32}$/.test(id))
+                throw new Refused('Not a gist address');
+            const response = await request(`https://api.github.com/gists/${id}`, {
+                headers: { Accept: 'application/vnd.github+json', 'User-Agent': 'Verily-V0' },
+                signal: AbortSignal.timeout(15000),
+            });
+            const gist = await response.json();
+            if (!response.ok || !isRecord(gist))
+                throw new Refused('Gist unavailable');
+            // A secret gist proves nothing a reader could check for themselves.
+            if (gist.public !== true)
+                throw new Refused('Gist is not public');
+            const owner = gist.owner;
+            if (!isRecord(owner) ||
+                !Number.isSafeInteger(owner.id) ||
+                Number(owner.id) <= 0 ||
+                typeof owner.login !== 'string' ||
+                !/^[a-zA-Z0-9-]+$/.test(owner.login))
+                throw new Refused('Invalid gist owner');
+            if (!isRecord(gist.files) || !contains(gist.files, expect))
+                throw new Refused('Gist does not contain the expected line');
+            return {
+                id: String(owner.id),
+                handle: owner.login,
+                profileUrl: `https://github.com/${owner.login}`,
+            };
+        },
+    };
+}
+/** A truncated file is not proof: the part that would have matched may be the part omitted. */
+function contains(files, expect) {
+    return Object.values(files).some((file) => isRecord(file) &&
+        file.truncated !== true &&
+        typeof file.content === 'string' &&
+        file.content.includes(expect));
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object';
+}

package/dist/server/github.d.ts

@@ -0,0 +1,7 @@
+import type { RedirectProvider } from '../core/index.js';
+/** GitHub.com OAuth app, PKCE S256, no additional scopes. Tokens are never persisted. */
+export declare function githubProvider(options: {
+    clientId: string;
+    clientSecret: string;
+    fetch?: typeof fetch;
+}): RedirectProvider;

package/dist/server/github.js

@@ -0,0 +1,65 @@
+/** GitHub.com OAuth app, PKCE S256, no additional scopes. Tokens are never persisted. */
+export function githubProvider(options) {
+    if (!options.clientId || !options.clientSecret)
+        throw new Error('GitHub credentials required');
+    const request = options.fetch ?? fetch;
+    return {
+        id: 'github',
+        name: 'GitHub',
+        method: 'oauth',
+        authorizationUrl({ state, challenge, redirectUri }) {
+            const url = new URL('https://github.com/login/oauth/authorize');
+            url.search = new URLSearchParams({
+                client_id: options.clientId,
+                redirect_uri: redirectUri,
+                state,
+                code_challenge: challenge,
+                code_challenge_method: 'S256',
+                scope: '',
+                prompt: 'select_account',
+            }).toString();
+            return url.href;
+        },
+        async authenticate({ code, verifier, redirectUri }) {
+            const response = await request('https://github.com/login/oauth/access_token', {
+                method: 'POST',
+                headers: { Accept: 'application/json' },
+                signal: AbortSignal.timeout(15000),
+                body: new URLSearchParams({
+                    client_id: options.clientId,
+                    client_secret: options.clientSecret,
+                    code,
+                    code_verifier: verifier,
+                    redirect_uri: redirectUri,
+                }),
+            });
+            const token = await response.json();
+            if (!response.ok || !isRecord(token) || typeof token.access_token !== 'string' || token.error)
+                throw new Error('Provider authentication failed');
+            const identity = await request('https://api.github.com/user', {
+                headers: {
+                    Authorization: `Bearer ${token.access_token}`,
+                    Accept: 'application/vnd.github+json',
+                    'User-Agent': 'Verily-V0',
+                },
+                signal: AbortSignal.timeout(15000),
+            });
+            const user = await identity.json();
+            if (!identity.ok ||
+                !isRecord(user) ||
+                !Number.isSafeInteger(user.id) ||
+                Number(user.id) <= 0 ||
+                typeof user.login !== 'string' ||
+                !/^[a-zA-Z0-9-]+$/.test(user.login))
+                throw new Error('Invalid provider identity');
+            return {
+                id: String(user.id),
+                handle: user.login,
+                profileUrl: `https://github.com/${user.login}`,
+            };
+        },
+    };
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}

package/dist/server/index.d.ts

@@ -0,0 +1,70 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { type FlowResult, type LocalAccount, type Visibility } from '../core/index.js';
+import { VerilyService, type ServiceOptions } from './service.js';
+export { VerilyService, Unavailable } from './service.js';
+export { githubProvider } from './github.js';
+export { discordProvider } from './discord.js';
+export { youtubeProvider } from './youtube.js';
+export { githubGistProvider } from './github-gist.js';
+export { linkProvider, githubLinkProvider, type LinkProviderOptions } from './link.js';
+export { pgpProvider } from './pgp.js';
+export { generateSigningKey, signer } from './signing.js';
+export { emailProvider, type EmailImage, type EmailMessage, type EmailProviderOptions, } from './email.js';
+export { resendSender } from './resend.js';
+export type { ServiceOptions } from './service.js';
+export interface ServerOptions extends ServiceOptions {
+    /** Resolve identity exclusively from the adopting application's authenticated session. */
+    authenticate(request: Request): Promise<LocalAccount | undefined>;
+    reportUrl: string;
+    /**
+     * What to store on a flow when it is created, read from the request that creates it, and
+     * handed back to `finish`. Never called for removal from the external side, whatever the
+     * browser is signed into, since nothing local answers for that.
+     */
+    context?(request: Request): Promise<Record<string, string> | undefined>;
+    /**
+     * Where to send the holder once a flow has ended, each time its result page is served. It
+     * must depend on nothing but what it is given, so a page loaded again after a failure or
+     * a lost response sends the holder to the same place. Undefined shows the result page.
+     */
+    finish?(ended: Ended): Promise<string | undefined>;
+    /**
+     * Origins a form here may end up at, beyond this one and the sign-in providers': anywhere
+     * `finish` sends a holder, since an approval form's redirect is held to `form-action`.
+     */
+    formTargets?: string[];
+    /**
+     * The provider ids a subject may use, where not every subject gets every one: an
+     * instance serving several sites offers each site's subjects what that site chose.
+     * Undefined means all of them. Removal from the external side is never narrowed.
+     */
+    providersFor?(local: LocalAccount): string[] | undefined;
+    /**
+     * The visibilities a subject may choose, where a site does not offer both. Undefined
+     * means both. With one, the approval page states it and offers no choice, and there is
+     * nothing for a visibility flow to change. A record made before the choice was narrowed
+     * keeps the visibility it has.
+     */
+    visibilityFor?(local: LocalAccount): Visibility[] | undefined;
+}
+/** A flow that has ended, as `finish` is given it: all of it read from the stored flow. */
+export interface Ended {
+    /** The flow's id, which names it and is no secret. */
+    id: string;
+    context?: Record<string, string>;
+    local?: LocalAccount;
+    result: FlowResult;
+}
+export declare function createVerily(options: ServerOptions): {
+    service: VerilyService;
+    handle: (request: Request) => Promise<Response>;
+    /**
+     * The flow binding, for a host that carries it some way other than this handler's own
+     * cookie: the cookie's name, to read a binding from a request or a response, and the
+     * header that sets it in a browser.
+     */
+    flowCookieName: string;
+    flowCookie: (binding: string) => string;
+};
+/** Mount on your chosen Node router. Public origin is configured, never inferred from Host. */
+export declare function nodeHandler(handler: (request: Request) => Promise<Response>, origin: string): (req: IncomingMessage, res: ServerResponse) => Promise<void>;