@cogitator-ai/channels 0.16.0 → 0.17.0

package/dist/channels/email/auth.d.ts

@@ -0,0 +1,59 @@
+import { type EmailHeaders } from './address.js';
+/**
+ * What the receiving side found about the sender: `pass` when DKIM, SPF or DMARC passed for a
+ * domain aligned with the `From` address, `fail` when results were reported and none of them
+ * did, `none` when nothing was reported.
+ */
+export type SenderAuthentication = 'pass' | 'fail' | 'none';
+/**
+ * Combines the results of one source, such as the methods of one `Authentication-Results`:
+ * any pass passes (mail forwarded on breaks SPF but keeps DKIM), else any fail fails.
+ */
+export declare function combineAuthentication(...verdicts: readonly SenderAuthentication[]): SenderAuthentication;
+/**
+ * The verdict of one `Authentication-Results` header (RFC 8601) for the author domain
+ * `fromDomain`, and its authserv-id. A DMARC result for the `From` domain decides when there is
+ * one: DMARC already weighs DKIM and SPF alignment. Otherwise a DKIM or SPF pass for an aligned
+ * domain passes, and any definite result (a fail, or a pass for another domain, as a spoofer
+ * signing with a domain of its own gets) fails, while `none` or `neutral` say nothing. Parts
+ * are split outside quoted strings, so an address like `"a;dkim=pass"@evil.example` stays one
+ * value.
+ */
+export declare function parseAuthenticationResults(value: string, fromDomain: string): {
+    authservId: string;
+    verdict: SenderAuthentication;
+};
+/** Where the sender authentication of a message's headers comes from, and whom to trust. */
+export interface HeaderAuthenticationOptions {
+    /**
+     * `imap`: the `Authentication-Results` of `trustedAuthservIds`. `postmark`: the SpamAssassin
+     * `X-Spam-Tests` Postmark adds, whose earlier copies SpamAssassin removes, and the
+     * `Authentication-Results` of `trustedAuthservIds`.
+     */
+    source: 'imap' | 'postmark';
+    /** The authserv-ids (the receiving servers) whose `Authentication-Results` count */
+    trustedAuthservIds?: readonly string[];
+}
+/**
+ * Combines the verdicts of independent sources: a fail of any of them fails, since one source
+ * passing does not undo what another found, then any pass passes.
+ */
+export declare function combineSources(...verdicts: readonly SenderAuthentication[]): SenderAuthentication;
+/**
+ * The sender verdict a message's headers carry, for the author domain `fromDomain`. A sender can
+ * add any header, so only those the receiving side wrote count: the topmost
+ * `Authentication-Results` of one of `trustedAuthservIds` (without them none is trusted), and
+ * Postmark's `X-Spam-Tests`. A fail of either source fails.
+ */
+export declare function headerAuthentication(headers: EmailHeaders, fromDomain: string, options: HeaderAuthenticationOptions): SenderAuthentication;
+/**
+ * Compares two secrets in constant time for their contents: unequal lengths still run one full
+ * comparison (of the expected secret with itself), so only the length of the secret can show.
+ */
+export declare function secretsEqual(given: string, expected: string): boolean;
+/**
+ * Whether `signature` is the hex HMAC SHA-256 of `timestamp` and `token` with Mailgun's webhook
+ * signing key, as Mailgun signs the requests of its routes (in JSON mode `token` is the body).
+ */
+export declare function verifyMailgunSignature(timestamp: string, token: string | Uint8Array, signature: string | undefined, signingKey: string): boolean;
+//# sourceMappingURL=auth.d.ts.map

package/dist/channels/email/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/channels/email/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAA6B,KAAK,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzE;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAE5D;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,QAAQ,EAAE,SAAS,oBAAoB,EAAE,GAC3C,oBAAoB,CAItB;AAyFD;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,GACjB;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,CAqBvD;AAED,4FAA4F;AAC5F,MAAM,WAAW,2BAA2B;IAC1C;;;;OAIG;IACH,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC;IAC5B,oFAAoF;IACpF,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,QAAQ,EAAE,SAAS,oBAAoB,EAAE,GAAG,oBAAoB,CAIjG;AAgBD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,YAAY,EACrB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,2BAA2B,GACnC,oBAAoB,CAatB;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAKrE;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,UAAU,EAC1B,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,UAAU,EAAE,MAAM,GACjB,OAAO,CAOT"}

package/dist/channels/email/auth.js

@@ -0,0 +1,212 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { alignedDomains, headersOf } from './address.js';
+/**
+ * Combines the results of one source, such as the methods of one `Authentication-Results`:
+ * any pass passes (mail forwarded on breaks SPF but keeps DKIM), else any fail fails.
+ */
+export function combineAuthentication(...verdicts) {
+    if (verdicts.includes('pass'))
+        return 'pass';
+    if (verdicts.includes('fail'))
+        return 'fail';
+    return 'none';
+}
+/** Results that say something about the sender, unlike `none`, `neutral` or `temperror`. */
+const DEFINITE = new Set(['pass', 'fail', 'softfail', 'permerror', 'hardfail']);
+/**
+ * The text of a header without its comments, in one pass that knows quoted strings and `\`
+ * escapes: a `(` inside quotes is text, and an escaped quote does not end them.
+ */
+function withoutComments(text) {
+    let out = '';
+    let depth = 0;
+    let quoted = false;
+    for (let i = 0; i < text.length; i++) {
+        const char = text[i];
+        if (char === '\\' && i + 1 < text.length) {
+            if (depth === 0)
+                out += char + text[i + 1];
+            i++;
+            continue;
+        }
+        if (depth === 0 && char === '"')
+            quoted = !quoted;
+        if (!quoted && char === '(')
+            depth++;
+        else if (!quoted && char === ')' && depth > 0)
+            depth--;
+        else if (depth === 0)
+            out += char;
+    }
+    return out;
+}
+/** `text` split at `separator` and at whitespace too when `alsoSpace`, never inside quotes. */
+function splitOutsideQuotes(text, separator, alsoSpace = false) {
+    const parts = [];
+    let current = '';
+    let quoted = false;
+    for (let i = 0; i < text.length; i++) {
+        const char = text[i];
+        if (char === '\\' && i + 1 < text.length) {
+            current += char + text[++i];
+            continue;
+        }
+        if (char === '"')
+            quoted = !quoted;
+        if (!quoted && (char === separator || (alsoSpace && /\s/.test(char)))) {
+            if (current)
+                parts.push(current);
+            current = '';
+        }
+        else
+            current += char;
+    }
+    if (current)
+        parts.push(current);
+    return parts;
+}
+/** The results of a header, its `;`-separated parts read outside quoted strings. */
+function authResultsOf(value) {
+    const [id = '', ...segments] = splitOutsideQuotes(withoutComments(value), ';');
+    const results = [];
+    for (const segment of segments) {
+        const [first = '', ...rest] = splitOutsideQuotes(segment.trim(), ' ', true);
+        const method = /^(dkim|spf|dmarc)=([a-z]+)$/i.exec(first);
+        if (!method)
+            continue;
+        const properties = new Map();
+        for (const token of rest) {
+            const equals = token.indexOf('=');
+            if (equals <= 0)
+                continue;
+            const name = token.slice(0, equals).toLowerCase();
+            if (!properties.has(name))
+                properties.set(name, token.slice(equals + 1));
+        }
+        results.push({ method: method[1].toLowerCase(), result: method[2].toLowerCase(), properties });
+    }
+    return { authservId: id.trim().split(/\s+/)[0]?.toLowerCase() ?? '', results };
+}
+/** The domain a property names: of an address (after its last `@`) or the value itself. */
+function propertyDomain(result, ...names) {
+    for (const name of names) {
+        const value = result.properties.get(name);
+        if (!value)
+            continue;
+        const bare = value.replace(/^"|"$/g, '');
+        const at = bare.lastIndexOf('@');
+        const domain = (at === -1 ? bare : bare.slice(at + 1)).replace(/^"|"$/g, '').toLowerCase();
+        if (domain && !/[\s";]/.test(domain))
+            return domain;
+    }
+    return undefined;
+}
+/**
+ * The verdict of one `Authentication-Results` header (RFC 8601) for the author domain
+ * `fromDomain`, and its authserv-id. A DMARC result for the `From` domain decides when there is
+ * one: DMARC already weighs DKIM and SPF alignment. Otherwise a DKIM or SPF pass for an aligned
+ * domain passes, and any definite result (a fail, or a pass for another domain, as a spoofer
+ * signing with a domain of its own gets) fails, while `none` or `neutral` say nothing. Parts
+ * are split outside quoted strings, so an address like `"a;dkim=pass"@evil.example` stays one
+ * value.
+ */
+export function parseAuthenticationResults(value, fromDomain) {
+    const { authservId, results } = authResultsOf(value);
+    const dmarc = results.find((result) => {
+        if (result.method !== 'dmarc')
+            return false;
+        const from = propertyDomain(result, 'header.from');
+        return !from || alignedDomains(from, fromDomain);
+    });
+    if (dmarc?.result === 'pass')
+        return { authservId, verdict: 'pass' };
+    if (dmarc && DEFINITE.has(dmarc.result))
+        return { authservId, verdict: 'fail' };
+    let reported = false;
+    for (const result of results) {
+        if (result.method === 'dmarc')
+            continue;
+        if (DEFINITE.has(result.result))
+            reported = true;
+        if (result.result !== 'pass')
+            continue;
+        const domain = result.method === 'dkim'
+            ? propertyDomain(result, 'header.d', 'header.i')
+            : propertyDomain(result, 'smtp.mailfrom', 'smtp.helo');
+        if (domain && alignedDomains(domain, fromDomain))
+            return { authservId, verdict: 'pass' };
+    }
+    return { authservId, verdict: reported ? 'fail' : 'none' };
+}
+/**
+ * Combines the verdicts of independent sources: a fail of any of them fails, since one source
+ * passing does not undo what another found, then any pass passes.
+ */
+export function combineSources(...verdicts) {
+    if (verdicts.includes('fail'))
+        return 'fail';
+    if (verdicts.includes('pass'))
+        return 'pass';
+    return 'none';
+}
+/**
+ * The verdict of Postmark's SpamAssassin tests: `DKIM_VALID_AU` is a valid signature of the
+ * author's domain, an SPF fail or an invalid signature fails. More than one `X-Spam-Tests`
+ * header fails, since one of them came from the sender.
+ */
+function spamTestsAuthentication(headers) {
+    const tests = headersOf(headers, 'x-spam-tests');
+    if (tests.length > 1)
+        return 'fail';
+    if (tests.length === 0)
+        return 'none';
+    if (/\bDKIM_VALID_AU\b/.test(tests[0]))
+        return 'pass';
+    if (/\b(SPF_FAIL|SPF_SOFTFAIL|DKIM_INVALID)\b/.test(tests[0]))
+        return 'fail';
+    return 'none';
+}
+/**
+ * The sender verdict a message's headers carry, for the author domain `fromDomain`. A sender can
+ * add any header, so only those the receiving side wrote count: the topmost
+ * `Authentication-Results` of one of `trustedAuthservIds` (without them none is trusted), and
+ * Postmark's `X-Spam-Tests`. A fail of either source fails.
+ */
+export function headerAuthentication(headers, fromDomain, options) {
+    const verdicts = [];
+    const trusted = options.trustedAuthservIds?.map((id) => id.toLowerCase()) ?? [];
+    if (trusted.length > 0) {
+        for (const value of headersOf(headers, 'authentication-results')) {
+            const parsed = parseAuthenticationResults(value, fromDomain);
+            if (!trusted.includes(parsed.authservId))
+                continue;
+            verdicts.push(parsed.verdict);
+            break;
+        }
+    }
+    if (options.source === 'postmark')
+        verdicts.push(spamTestsAuthentication(headers));
+    return combineSources(...verdicts);
+}
+/**
+ * Compares two secrets in constant time for their contents: unequal lengths still run one full
+ * comparison (of the expected secret with itself), so only the length of the secret can show.
+ */
+export function secretsEqual(given, expected) {
+    const givenBytes = Buffer.from(given);
+    const expectedBytes = Buffer.from(expected);
+    const sameLength = givenBytes.length === expectedBytes.length;
+    return timingSafeEqual(sameLength ? givenBytes : expectedBytes, expectedBytes) && sameLength;
+}
+/**
+ * Whether `signature` is the hex HMAC SHA-256 of `timestamp` and `token` with Mailgun's webhook
+ * signing key, as Mailgun signs the requests of its routes (in JSON mode `token` is the body).
+ */
+export function verifyMailgunSignature(timestamp, token, signature, signingKey) {
+    if (!signature || !/^[0-9a-f]+$/i.test(signature))
+        return false;
+    const expected = Buffer.from(createHmac('sha256', signingKey).update(timestamp).update(token).digest('hex'));
+    const given = Buffer.from(signature.toLowerCase());
+    return given.length === expected.length && timingSafeEqual(given, expected);
+}
+//# sourceMappingURL=auth.js.map

package/dist/channels/email/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/channels/email/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,SAAS,EAAqB,MAAM,WAAW,CAAC;AASzE;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAG,QAAyC;IAE5C,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC7C,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC7C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4FAA4F;AAC5F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;AAEhF;;;GAGG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACzC,IAAI,KAAK,KAAK,CAAC;gBAAE,GAAG,IAAI,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3C,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,GAAG;YAAE,MAAM,GAAG,CAAC,MAAM,CAAC;QAClD,IAAI,CAAC,MAAM,IAAI,IAAI,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;aAChC,IAAI,CAAC,MAAM,IAAI,IAAI,KAAK,GAAG,IAAI,KAAK,GAAG,CAAC;YAAE,KAAK,EAAE,CAAC;aAClD,IAAI,KAAK,KAAK,CAAC;YAAE,GAAG,IAAI,IAAI,CAAC;IACpC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+FAA+F;AAC/F,SAAS,kBAAkB,CAAC,IAAY,EAAE,SAAiB,EAAE,SAAS,GAAG,KAAK;IAC5E,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACzC,OAAO,IAAI,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG;YAAE,MAAM,GAAG,CAAC,MAAM,CAAC;QACnC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,IAAI,OAAO;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjC,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;;YAAM,OAAO,IAAI,IAAI,CAAC;IACzB,CAAC;IACD,IAAI,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC;AACf,CAAC;AASD,oFAAoF;AACpF,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,QAAQ,CAAC,GAAG,kBAAkB,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,KAAK,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,8BAA8B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC7C,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,MAAM,IAAI,CAAC;gBAAE,SAAS;YAC1B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;YAClD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC;AACjF,CAAC;AAED,2FAA2F;AAC3F,SAAS,cAAc,CAAC,MAAkB,EAAE,GAAG,KAAe;IAC5D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACzC,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3F,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAa,EACb,UAAkB;IAElB,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QACpC,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QAC5C,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,EAAE,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IACrE,IAAI,KAAK,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAChF,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO;YAAE,SAAS;QACxC,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,QAAQ,GAAG,IAAI,CAAC;QACjD,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;YAAE,SAAS;QACvC,MAAM,MAAM,GACV,MAAM,CAAC,MAAM,KAAK,MAAM;YACtB,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC;YAChD,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC;QAC3D,IAAI,MAAM,IAAI,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC;YAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC3F,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AAC7D,CAAC;AAcD;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAG,QAAyC;IACzE,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC7C,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC7C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAAC,OAAqB;IACpD,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACtC,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IACtD,IAAI,0CAA0C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAC7E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAqB,EACrB,UAAkB,EAClB,OAAoC;IAEpC,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAChF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,OAAO,EAAE,wBAAwB,CAAC,EAAE,CAAC;YACjE,MAAM,MAAM,GAAG,0BAA0B,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;YAC7D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;gBAAE,SAAS;YACnD,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU;QAAE,QAAQ,CAAC,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;IACnF,OAAO,cAAc,CAAC,GAAG,QAAQ,CAAC,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,QAAgB;IAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM,CAAC;IAC9D,OAAO,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,EAAE,aAAa,CAAC,IAAI,UAAU,CAAC;AAC/F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAAiB,EACjB,KAA0B,EAC1B,SAA6B,EAC7B,UAAkB;IAElB,IAAI,CAAC,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAC1B,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAC/E,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AAC9E,CAAC"}

package/dist/channels/email/channel.d.ts

@@ -0,0 +1,256 @@
+import { type RequestListener } from 'node:http';
+import type { Attachment, Channel, ChannelMessage, SendOptions } from '@cogitator-ai/types';
+import { type EmailImapConfig } from './imap.js';
+import { type InboundEmail } from './mime.js';
+import { type EmailWebhookRequest, type EmailWebhookResponse } from './providers.js';
+/** The header the channel puts on every mail it sends, and skips mail that carries it. */
+export declare const EMAIL_LOOP_HEADER = "X-Cogitator";
+/** The largest webhook body the channel's own server takes by default, in bytes. */
+export declare const EMAIL_DEFAULT_MAX_BODY: number;
+/** The largest attachment handed to the agent by default, in bytes. */
+export declare const EMAIL_DEFAULT_MAX_ATTACHMENT: number;
+/** How old a Mailgun signature may be by default, in seconds. */
+export declare const MAILGUN_DEFAULT_MAX_AGE = 300;
+/** Credentials for HTTP basic authentication of a webhook. */
+export interface EmailBasicAuth {
+    username: string;
+    password: string;
+}
+/** Mailgun signs each request of a route with the webhook signing key. */
+export interface MailgunWebhookConfig {
+    provider: 'mailgun';
+    /** The HTTP webhook signing key of the Mailgun account (Settings, Webhooks) */
+    signingKey: string;
+    /** How old a signature may be, in seconds (default 300). Older requests are refused as replays */
+    maxAge?: number;
+}
+/**
+ * Postmark and SendGrid do not sign inbound mail, so the webhook URL carries a secret: basic
+ * authentication (`https://user:password@host/path`) or a `token` query parameter (also taken
+ * from an `X-Webhook-Token` header). At least one is required.
+ */
+export interface SecretWebhookConfig {
+    provider: 'postmark' | 'sendgrid';
+    basicAuth?: EmailBasicAuth;
+    token?: string;
+}
+export type EmailWebhookConfig = (MailgunWebhookConfig | SecretWebhookConfig) & {
+    /**
+     * Run an HTTP server of the channel's own on this port. Without it, mount `handleWebhook` or
+     * `webhookListener()` in a server of yours.
+     */
+    port?: number;
+    /** The path of the channel's own server (default `/email/webhook`) */
+    path?: string;
+    host?: string;
+    /** The largest body taken, in bytes (default 10 MB), larger ones get `413` */
+    maxBody?: number;
+};
+/** A mail as the channel hands it to the transport, in the shape nodemailer takes. */
+export interface OutgoingEmail {
+    from: string | {
+        name: string;
+        address: string;
+    };
+    to: string;
+    subject: string;
+    text: string;
+    html?: string;
+    messageId: string;
+    inReplyTo?: string;
+    references?: string[];
+    headers: Record<string, string>;
+    attachments?: {
+        filename?: string;
+        content?: Buffer;
+        href?: string;
+        contentType?: string;
+    }[];
+}
+/** Anything that sends mail: a nodemailer transporter (SMTP, SES, ...) or one of your own. */
+export interface EmailTransport {
+    sendMail(mail: OutgoingEmail): Promise<unknown>;
+    close?(): void;
+}
+/** An SMTP server the channel sends through with nodemailer. */
+export interface EmailSmtpServer {
+    host: string;
+    /** Default 587, or 465 when `secure` */
+    port?: number;
+    /** TLS from the start, as on port 465 (default: true on port 465). Otherwise STARTTLS */
+    secure?: boolean;
+    auth?: {
+        user: string;
+        pass: string;
+    };
+    /** Further nodemailer SMTP options */
+    options?: Record<string, unknown>;
+}
+export type EmailSmtpConfig = EmailSmtpServer | {
+    transport: EmailTransport;
+};
+/**
+ * How mail is checked against the sender authentication results the receiving side reports
+ * (DKIM, SPF, DMARC): `when-reported` (default) drops mail whose results fail for the `From`
+ * domain and takes mail without results, `required` also drops mail without results, `off`
+ * does not look.
+ */
+export type EmailSenderAuthPolicy = 'required' | 'when-reported' | 'off';
+export interface EmailChannelConfig {
+    /** The bot's address: mail is sent from it, and mail from it is never answered */
+    address: string;
+    /** The display name of the mail it sends */
+    name?: string;
+    /** Other addresses of the bot, also never answered */
+    aliases?: string[];
+    /** How mail is sent */
+    smtp: EmailSmtpConfig;
+    /** Read mail from a mailbox over IMAP */
+    imap?: EmailImapConfig;
+    /** Take mail from a provider's inbound webhook: Mailgun, Postmark or SendGrid */
+    webhook?: EmailWebhookConfig;
+    /**
+     * Who the bot answers: addresses (`ann@example.com`), domains (`example.com`), subdomain
+     * wildcards (`*.example.com`) or `*` for everyone. Default: nobody, which `start()` warns
+     * about, since anyone can send mail and the `From` address can be forged.
+     */
+    allowFrom?: string[];
+    /**
+     * Addresses the gateway gives owner rights, also answered whatever `allowFrom` says. A `From`
+     * can be forged, so their mail reaches the agent only when the sender authentication passes
+     * for their domain, unless `senderAuth` is `off`.
+     */
+    owners?: string[];
+    /** See {@link EmailSenderAuthPolicy}. Default `when-reported` */
+    senderAuth?: EmailSenderAuthPolicy;
+    /**
+     * The authserv-ids (the first word of `Authentication-Results`, such as `mx.google.com`) of
+     * the servers that receive the mail, whose results count over IMAP and Postmark. A sender can
+     * add any header, so without them IMAP mail has no sender authentication at all.
+     */
+    trustedAuthservIds?: string[];
+    /** Start the text of a conversation's first mail with its subject (default true) */
+    includeSubject?: boolean;
+    /** The subject of mail that starts a conversation, such as a reminder (default `Message from <name>`) */
+    subject?: string;
+    /** The largest attachment handed to the agent, in bytes (default 10 MB), larger ones are skipped */
+    maxAttachmentBytes?: number;
+}
+/** `subject` as a reply's subject: with one `Re: `, whatever prefix it had. */
+export declare function replySubject(subject: string): string;
+/** Whether the mail is an automatic one: an auto-reply, a bounce, a list or bulk mailing. */
+export declare function isAutomatedEmail(email: InboundEmail): boolean;
+/**
+ * An email channel: an agent answers mail, in the thread of each mail. Mail comes from a mailbox
+ * over IMAP (`imapflow` and `postal-mime`), or from the inbound webhook of Mailgun, Postmark or
+ * SendGrid, and answers go out over SMTP (`nodemailer`) or any transport given, with
+ * `In-Reply-To` and `References` set, so mail clients keep them in the thread.
+ *
+ * A sender is a conversation partner: `channelId` and `userId` are the sender's address in lower
+ * case, and `topicId` is the thread's first `Message-ID`, so each email thread is a conversation
+ * of its own. Answers are Markdown, sent as HTML with a plain text alternative, and cannot be
+ * edited. Mail from the bot itself, mail that carries the `X-Cogitator` header the channel puts
+ * on what it sends, auto-replies, bounces and bulk mail are never answered.
+ */
+export declare class EmailChannel implements Channel {
+    readonly type = "email";
+    readonly editable = false;
+    readonly nativeMarkdown = true;
+    readonly maxMessageChars: number;
+    private readonly config;
+    private readonly address;
+    private readonly ownAddresses;
+    private readonly owners;
+    private handler;
+    /** Mail handed to the gateway whose handler has not resolved yet, by `Message-ID` */
+    private readonly inFlight;
+    /** Mail of `inFlight` the gateway handed back while it was being taken */
+    private readonly refused;
+    private readonly handled;
+    /** Mailgun signatures seen, with their timestamps, against replays */
+    private readonly signatures;
+    /** The IMAP UID of each mail taken from the mailbox, by `Message-ID`, to mark it unread again */
+    private readonly uids;
+    private readonly threads;
+    /** The latest mail of each thread, by `address|root` */
+    private readonly latest;
+    private transport?;
+    private inbox?;
+    private server?;
+    private running;
+    private stopped;
+    constructor(config: EmailChannelConfig);
+    onMessage(handler: (msg: ChannelMessage) => Promise<void>): void;
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    /** Looks for unread mail over IMAP now, besides IDLE and the poll timer. */
+    poll(): Promise<void>;
+    /**
+     * Takes back a mail the gateway does not answer because it stops. One it refuses while it is
+     * being handed over stays unread in the mailbox, and its webhook request is answered `503`, so
+     * the provider sends it again. One it dropped after taking it is marked unread again, so the
+     * next start reads it once more, or, when a webhook brought it, only logged.
+     */
+    redeliver(msg: ChannelMessage): Promise<void>;
+    /**
+     * Answers a provider's inbound webhook request: checks its signature or secret, reads the
+     * mail, answers at once and hands the mail to the agent after. Mount it in any HTTP server
+     * with the raw body unparsed. It works before `start()` too and answers `503` once stopped.
+     */
+    handleWebhook(request: EmailWebhookRequest): Promise<EmailWebhookResponse>;
+    /**
+     * A Node request listener that answers webhook requests on any path it is mounted at. Bodies
+     * over `webhook.maxBody` (10 MB by default) are refused with `413`.
+     */
+    webhookListener(): RequestListener;
+    /**
+     * Sends `text` to the address `channelId`. With a `replyTo` of a mail the channel saw, or the
+     * `topicId` of a thread, it answers in that thread (`Re:` subject, `In-Reply-To`,
+     * `References`), and otherwise it starts a new one. Resolves with the new mail's `Message-ID`.
+     */
+    sendText(channelId: string, text: string, options?: SendOptions): Promise<string>;
+    editText(): Promise<void>;
+    /**
+     * Sends a file as an attachment, its caption as the text, in the thread as `sendText` does.
+     * A file needs a `buffer` or an `http(s)` url, which nodemailer downloads.
+     */
+    sendFile(channelId: string, file: Attachment, options?: SendOptions): Promise<string>;
+    sendTyping(): Promise<void>;
+    private parseOptions;
+    private authorized;
+    /**
+     * Checks a Mailgun request's signature, age and token, and reads its mail. The signature is
+     * checked before the mail is read: a form is only split into its fields first, where the
+     * signature is.
+     */
+    private mailgunEmail;
+    /**
+     * Remembers a signature for as long as its timestamp is within the replay window: older ones
+     * are refused as stale anyway. Past `MAX_SIGNATURES` the oldest are forgotten.
+     */
+    private rememberSignature;
+    /** Whether the mail may reach the agent: by its sender, its kind and its authentication. */
+    private admits;
+    /**
+     * The text the agent reads: the new text of the mail, starting with the subject on a thread's
+     * first mail. A command (`/status`) stays first, so the gateway still sees it, and a mail
+     * with only a command as its subject is that command.
+     */
+    private textOf;
+    /**
+     * Hands an inbound mail to the agent when it is one to answer. Resolves `refused` when the
+     * gateway did not take it, so it may come again.
+     */
+    private accept;
+    private fallbackId;
+    private remember;
+    /** The thread a mail to `to` goes in: the mail it answers, or the latest of its topic. */
+    private threadOf;
+    private bodies;
+    private send;
+    private transportOf;
+    private listen;
+}
+/** An email channel that answers mail in its thread. */
+export declare function emailChannel(config: EmailChannelConfig): EmailChannel;
+//# sourceMappingURL=channel.d.ts.map

package/dist/channels/email/channel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel.d.ts","sourceRoot":"","sources":["../../../src/channels/email/channel.ts"],"names":[],"mappings":"AACA,OAAO,EAAsC,KAAK,eAAe,EAAe,MAAM,WAAW,CAAC;AAClG,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAM5F,OAAO,EAAa,KAAK,eAAe,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAiC,KAAK,YAAY,EAAE,MAAM,QAAQ,CAAC;AAE1E,OAAO,EAQL,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EAC1B,MAAM,aAAa,CAAC;AAGrB,0FAA0F;AAC1F,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAC/C,oFAAoF;AACpF,eAAO,MAAM,sBAAsB,QAAmB,CAAC;AACvD,uEAAuE;AACvE,eAAO,MAAM,4BAA4B,QAAmB,CAAC;AAC7D,iEAAiE;AACjE,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAc3C,8DAA8D;AAC9D,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,0EAA0E;AAC1E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,SAAS,CAAC;IACpB,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAC;IACnB,kGAAkG;IAClG,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,UAAU,GAAG,UAAU,CAAC;IAClC,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,kBAAkB,GAAG,CAAC,oBAAoB,GAAG,mBAAmB,CAAC,GAAG;IAC9E;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,sFAAsF;AACtF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACjD,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,WAAW,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC9F;AAED,8FAA8F;AAC9F,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,IAAI,CAAC;CAChB;AAED,gEAAgE;AAChE,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yFAAyF;IACzF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACtC,sCAAsC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,MAAM,eAAe,GAAG,eAAe,GAAG;IAAE,SAAS,EAAE,cAAc,CAAA;CAAE,CAAC;AAE9E;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG,UAAU,GAAG,eAAe,GAAG,KAAK,CAAC;AAEzE,MAAM,WAAW,kBAAkB;IACjC,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,uBAAuB;IACvB,IAAI,EAAE,eAAe,CAAC;IACtB,yCAAyC;IACzC,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB,iFAAiF;IACjF,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,iEAAiE;IACjE,UAAU,CAAC,EAAE,qBAAqB,CAAC;IACnC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,oFAAoF;IACpF,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,yGAAyG;IACzG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oGAAoG;IACpG,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AA2CD,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAGpD;AASD,6FAA6F;AAC7F,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAW7D;AAsBD;;;;;;;;;;;GAWG;AACH,qBAAa,YAAa,YAAW,OAAO;IAC1C,QAAQ,CAAC,IAAI,WAAW;IACxB,QAAQ,CAAC,QAAQ,SAAS;IAC1B,QAAQ,CAAC,cAAc,QAAQ;IAC/B,QAAQ,CAAC,eAAe,SAAY;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAc;IAC3C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,OAAO,CAAC,OAAO,CAAyD;IACxE,qFAAqF;IACrF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAC9C,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,sEAAsE;IACtE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IACxD,iGAAiG;IACjG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkC;IAC1D,wDAAwD;IACxD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IACpD,OAAO,CAAC,SAAS,CAAC,CAA0B;IAC5C,OAAO,CAAC,KAAK,CAAC,CAAkD;IAChE,OAAO,CAAC,MAAM,CAAC,CAAS;IACxB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,OAAO,CAAS;gBAEZ,MAAM,EAAE,kBAAkB;IA+BtC,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAI1D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAkDtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB3B,4EAA4E;IACtE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3B;;;;;OAKG;IACG,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAenD;;;;OAIG;IACG,aAAa,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAwDhF;;;OAGG;IACH,eAAe,IAAI,eAAe;IA8BlC;;;;OAIG;IACG,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IAKvF,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAIzB;;;OAGG;IACG,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IAcrF,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAEjC,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,UAAU;IAelB;;;;OAIG;YACW,YAAY;IAgD1B;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAQzB,4FAA4F;IAC5F,OAAO,CAAC,MAAM;IAad;;;;OAIG;IACH,OAAO,CAAC,MAAM;IAad;;;OAGG;YACW,MAAM;IAuDpB,OAAO,CAAC,UAAU;IAelB,OAAO,CAAC,QAAQ;IAUhB,0FAA0F;IAC1F,OAAO,CAAC,QAAQ;IAiBhB,OAAO,CAAC,MAAM;YAMA,IAAI;IA4ClB,OAAO,CAAC,WAAW;IAqBnB,OAAO,CAAC,MAAM;CA6Bf;AAED,wDAAwD;AACxD,wBAAgB,YAAY,CAAC,MAAM,EAAE,kBAAkB,GAAG,YAAY,CAErE"}