@dumbmice/pi-mailbridge 0.0.0-stage → 0.1.1

package/dist/core/deliveries.js

@@ -0,0 +1,180 @@
+// Delivery runner — the extension side of claim → inject → ack.
+//
+// Invariants, in order of importance:
+//
+//   1. Never inject a delivery for another session. The token already routed it;
+//      this is the second check, and it is cheap.
+//   2. Never ack a delivery that was not injected. Acking early would mark the
+//      mail seen and drop the record, losing the human's reply.
+//   3. Never inject the same UID twice *in this process*, even if the ack failed
+//      — a reconnect replays /pending, and a duplicate injection is worse than a
+//      stale seen-flag.
+//   4. A failed claim (another instance owns it) is not an error: leave it alone.
+//
+// The runner is deliberately synchronous-per-delivery: mail replies are serial and
+// ordering them keeps the transcript readable.
+/** In-flight drains, shared across runner instances in this process. */
+const inFlightByInstance = new Map();
+/**
+ * UIDs already injected, per instance.
+ *
+ * Per instance, not per runner object: a rebuilt runtime (a respawn, or a new session in
+ * the same pi process after session_shutdown) constructs a new runner while the claim key -
+ * the pid - stays the same. A per-runner set let the rebuilt runner re-inject a reply whose
+ * ack had failed, which is the one failure this design cannot undo.
+ */
+const injectedByInstance = new Map();
+/** A process has one instanceId; this only guards against a pathological caller. */
+const MAX_INSTANCE_SETS = 8;
+/** Cap per instance, like the journal: one key per injected message, oldest dropped. */
+const MAX_INJECTED_PER_INSTANCE = 5_000;
+/** UIDs are only unique within a UIDVALIDITY, so the key must carry it. */
+function injectionKey(record) {
+    return `${record.uidValidity ?? ""}:${record.uid}`;
+}
+function injectedFor(instanceId) {
+    let set = injectedByInstance.get(instanceId);
+    if (!set) {
+        set = new Set();
+        injectedByInstance.set(instanceId, set);
+        if (injectedByInstance.size > MAX_INSTANCE_SETS) {
+            const oldest = injectedByInstance.keys().next().value;
+            // Never evict the caller's own set: losing it would let this instance re-inject.
+            if (oldest !== undefined && oldest !== instanceId)
+                injectedByInstance.delete(oldest);
+        }
+    }
+    return set;
+}
+export function createDeliveryRunner(deps) {
+    /** Stale-space refusals already reported, so a stuck record does not log every poll. */
+    const reported = new Set();
+    const injected = () => injectedFor(deps.instanceId);
+    async function handle(record) {
+        if (injected().has(injectionKey(record))) {
+            // Injected earlier but possibly not acked: a single failed /ack used to pin the
+            // record for the process lifetime, leaking a queue slot, leaving \Seen unset and
+            // the journal unwritten - and after a restart (new pid, new instance) the same
+            // instruction would be injected again. The ack is idempotent, so retry it.
+            try {
+                const retried = await deps.client.ack(record.uid, deps.instanceId, record.sessionId, record.uidValidity);
+                // A retry that keeps failing is the same silent leak as a first ack that
+                // failed: surface it rather than looping quietly.
+                if (!retried.ok && retried.status !== 404) {
+                    deps.onError?.(new Error(`ack retry failed (${retried.code ?? retried.status})`), record);
+                }
+            }
+            catch (error) {
+                deps.onError?.(error instanceof Error ? error : new Error(String(error)), record);
+            }
+            return "already-injected";
+        }
+        const mine = deps.sessionId();
+        if (!mine || record.sessionId !== mine)
+            return "foreign-session";
+        const claim = await deps.client.claim(record.uid, deps.instanceId, record.uidValidity);
+        if (!claim.ok) {
+            // Expected when another instance won the race; the daemon answers 409.
+            if (claim.code === "claimed-by-other")
+                return "claimed-by-other";
+            // The record belongs to a UID numbering the mailbox has left. It cannot be delivered
+            // and is dropped at the next connect; say so once rather than retrying in silence
+            // every poll tick.
+            if (claim.code === "stale-space") {
+                const key = injectionKey(record);
+                if (!reported.has(key)) {
+                    reported.add(key);
+                    deps.onError?.(new Error("reply belongs to an earlier UID space; it will be dropped"), record);
+                }
+                return "stale-space";
+            }
+            // A record this daemon does not own (another machine's, or one stamped under a
+            // device name that has since changed) cannot be delivered by retrying. Say it once:
+            // silence here is how a queued reply is lost without a trace.
+            if (claim.code === "foreign-device") {
+                const key = injectionKey(record);
+                if (!reported.has(key)) {
+                    reported.add(key);
+                    deps.onError?.(new Error("reply was scanned under another device name; it will not be delivered here"), record);
+                }
+                return "foreign-device";
+            }
+            // Only a definite 404 means the record is gone. Anything else - a timeout, a
+            // network error, a rotated secret (401) - leaves the outcome unknown, and calling
+            // that "not-found" is the same lie in a different costume. It self-heals (the
+            // claim TTL expires, the next drain re-claims), but the diagnostic must not mislead.
+            if (claim.status === 404)
+                return "not-found";
+            return "claim-unconfirmed";
+        }
+        try {
+            await deps.inject(record.body, record);
+        }
+        catch (error) {
+            // Do NOT ack: the delivery must stay pending so it is retried.
+            deps.onError?.(error instanceof Error ? error : new Error(String(error)), record);
+            return "inject-failed";
+        }
+        // Record before acking: if the ack fails we still refuse to inject twice.
+        const set = injected();
+        set.add(injectionKey(record));
+        // Bounded like the journal. Evicting an entry whose ack never landed would let it be
+        // injected again, so this is a last resort, not a free trade.
+        while (set.size > MAX_INJECTED_PER_INSTANCE) {
+            const oldest = set.values().next().value;
+            if (oldest === undefined)
+                break;
+            set.delete(oldest);
+        }
+        try {
+            const ackResult = await deps.client.ack(record.uid, deps.instanceId, record.sessionId, record.uidValidity);
+            if (!ackResult.ok) {
+                // Injected but not acked: the record will be re-offered on reconnect and
+                // the `injected` set will absorb it. Surface it — a silent ack failure
+                // hides a growing pending queue.
+                deps.onError?.(new Error(`ack failed (${ackResult.code ?? ackResult.status})`), record);
+            }
+        }
+        catch (error) {
+            // Injected but not acked: same handling as above.
+            deps.onError?.(error instanceof Error ? error : new Error(String(error)), record);
+        }
+        return "injected";
+    }
+    return {
+        handle,
+        injectedUids: () => [...injected()].map((key) => Number(key.split(":")[1])),
+        async drain() {
+            // One drain at a time. The claim registry is keyed per pid, so two overlapping
+            // drains in this process would both be granted the same uid and inject twice -
+            // and a duplicate injection cannot be undone.
+            // Keyed by instanceId, not by this runner object: a respawn builds a new runner
+            // while the claim key (the pid) stays the same, so a per-object flag would let an
+            // old runner's drain overlap a new one's.
+            const running = inFlightByInstance.get(deps.instanceId);
+            if (running)
+                return running;
+            const attempt = (async () => {
+                try {
+                    const result = await deps.client.pending();
+                    if (!result.ok)
+                        return [];
+                    const outcomes = [];
+                    for (const record of result.data.pending) {
+                        // Re-checked every record: a reply that turns the mode off is in this very
+                        // batch, and everything after it must wait.
+                        if (deps.stillDelivering && !deps.stillDelivering())
+                            break;
+                        outcomes.push(await handle(record));
+                    }
+                    return outcomes;
+                }
+                finally {
+                    inFlightByInstance.delete(deps.instanceId);
+                }
+            })();
+            inFlightByInstance.set(deps.instanceId, attempt);
+            return attempt;
+        },
+    };
+}

package/dist/core/discover.js

@@ -0,0 +1,282 @@
+// Provider discovery + config synthesis.
+//
+// The one thing a human cannot avoid is creating the mailbox. Everything after
+// that — server names, ports, TLS mode, which auth the provider requires — is
+// public data, so we fetch it instead of asking.
+//
+// Source: Thunderbird's autoconfig service (ISPDB), the same database Mozilla
+// ships in Thunderbird. It publishes, for a domain:
+//
+//   <incomingServer type="imap"> <hostname> <port> <socketType> <authentication>
+//   <outgoingServer type="smtp"> <hostname> <port> <socketType> <authentication>
+//
+// Verified for gmail.com and outlook.com; 404 means "not in the database", not
+// "no such provider", so we report it as unknown rather than guessing.
+/** Parse a Thunderbird `clientConfig` document. Pure, so it is testable. */
+export function parseAutoconfig(xml) {
+    const block = (tag) => {
+        // type="imap" / type="smtp" specifically; pop3 must not win.
+        const re = new RegExp(`<${tag}\\b[^>]*type="(?:imap|smtp)"[^>]*>([\\s\\S]*?)</${tag}>`, "i");
+        return re.exec(xml)?.[1];
+    };
+    const one = (chunk, tag) => new RegExp(`<${tag}>\\s*([^<]+?)\\s*</${tag}>`, "i").exec(chunk)?.[1];
+    const all = (chunk, tag) => [...chunk.matchAll(new RegExp(`<${tag}>\\s*([^<]+?)\\s*</${tag}>`, "gi"))].map((m) => m[1].trim());
+    const incoming = block("incomingServer");
+    const outgoing = block("outgoingServer");
+    if (!incoming || !outgoing)
+        return undefined;
+    const endpoint = (chunk) => {
+        const host = one(chunk, "hostname");
+        const port = Number(one(chunk, "port"));
+        if (!host || !Number.isInteger(port) || port <= 0)
+            return undefined;
+        const socket = (one(chunk, "socketType") ?? "").toUpperCase();
+        return { host, port, secure: socket !== "STARTTLS" };
+    };
+    const imap = endpoint(incoming);
+    const smtp = endpoint(outgoing);
+    if (!imap || !smtp)
+        return undefined;
+    // A provider may advertise several; OAuth2 wins when present because password
+    // auth is what every major provider is retiring.
+    const auths = [...all(incoming, "authentication"), ...all(outgoing, "authentication")].map((a) => a.toLowerCase());
+    const authType = auths.some((a) => a.includes("oauth2")) ? "XOAUTH2" : "LOGIN";
+    const host = imap.host.toLowerCase();
+    const provider = /(?:office365|outlook|hotmail|live|msn)\./.test(host)
+        ? "microsoft"
+        : /gmail|googlemail/.test(host)
+            ? "google"
+            : "other";
+    return { imap, smtp, authType, provider };
+}
+/**
+ * Provider-specific auth defaults.
+ *
+ * Google advertises OAuth2 in its published settings, but for a personal mailbox
+ * an app password is strictly simpler: Google OAuth for mail scopes is *restricted*
+ * (app verification plus an annual CASA assessment to publish), and a consent
+ * screen left in "Testing" issues refresh tokens that expire after **7 days** —
+ * fatal for a daemon that must run unattended.
+ *
+ * Microsoft has no equivalent: app passwords were retired on 2024-09-16, so XOAUTH2
+ * is the only path there.
+ */
+function applyProviderDefaults(discovered) {
+    if (discovered.provider === "google")
+        return { ...discovered, authType: "LOGIN" };
+    return discovered;
+}
+const ISPDB = "https://autoconfig.thunderbird.net/v1.1";
+/**
+ * A work/school Microsoft 365 tenant mailbox. These have no ISPDB entry and an
+ * arbitrary subdomain, so the suffix is the signal: `something.onmicrosoft.com`.
+ * The SMTP host differs from the consumer one (`smtp.office365.com`, not
+ * `smtp-mail.outlook.com`) and the authority is `organizations`.
+ */
+export const M365_PROVIDER = {
+    imap: { host: "outlook.office365.com", port: 993, secure: true },
+    smtp: { host: "smtp.office365.com", port: 587, secure: false },
+    authType: "XOAUTH2",
+    provider: "microsoft-365",
+};
+/** Built-in fallback lookup, including the Microsoft 365 suffix rule. */
+function knownProvider(domain) {
+    const exact = KNOWN_PROVIDERS[domain.toLowerCase()];
+    if (exact)
+        return exact;
+    if (domain.toLowerCase().endsWith(".onmicrosoft.com"))
+        return M365_PROVIDER;
+    return undefined;
+}
+/**
+ * Built-in fallback for the provider families this package is used with.
+ *
+ * ISPDB is authoritative and current, so it is always tried first; this map only
+ * matters when it is unreachable or missing an entry. It also means the common
+ * cases work with no network at all.
+ */
+export const KNOWN_PROVIDERS = {
+    "hotmail.com": {
+        imap: { host: "outlook.office365.com", port: 993, secure: true },
+        smtp: { host: "smtp-mail.outlook.com", port: 587, secure: false },
+        authType: "XOAUTH2",
+        provider: "microsoft",
+    },
+    "outlook.com": {
+        imap: { host: "outlook.office365.com", port: 993, secure: true },
+        smtp: { host: "smtp-mail.outlook.com", port: 587, secure: false },
+        authType: "XOAUTH2",
+        provider: "microsoft",
+    },
+    "live.com": {
+        imap: { host: "outlook.office365.com", port: 993, secure: true },
+        smtp: { host: "smtp-mail.outlook.com", port: 587, secure: false },
+        authType: "XOAUTH2",
+        provider: "microsoft",
+    },
+    "msn.com": {
+        imap: { host: "outlook.office365.com", port: 993, secure: true },
+        smtp: { host: "smtp-mail.outlook.com", port: 587, secure: false },
+        authType: "XOAUTH2",
+        provider: "microsoft",
+    },
+    // Chinese providers: the practical choice where Google is unreachable. All four
+    // authenticate with an app-specific code (授权码) as a password, so no OAuth app
+    // is needed. NetEase (163/126) requires the IMAP ID command, which imapflow
+    // sends automatically when the server advertises ID.
+    "qq.com": {
+        imap: { host: "imap.qq.com", port: 993, secure: true },
+        smtp: { host: "smtp.qq.com", port: 465, secure: true },
+        authType: "LOGIN",
+        provider: "other",
+    },
+    "foxmail.com": {
+        imap: { host: "imap.qq.com", port: 993, secure: true },
+        smtp: { host: "smtp.qq.com", port: 465, secure: true },
+        authType: "LOGIN",
+        provider: "other",
+    },
+    "163.com": {
+        imap: { host: "imap.163.com", port: 993, secure: true },
+        smtp: { host: "smtp.163.com", port: 465, secure: true },
+        authType: "LOGIN",
+        provider: "other",
+    },
+    "126.com": {
+        imap: { host: "imap.126.com", port: 993, secure: true },
+        smtp: { host: "smtp.126.com", port: 465, secure: true },
+        authType: "LOGIN",
+        provider: "other",
+    },
+    // NetEase's other free domains: same service, no waiting period.
+    "yeah.net": {
+        imap: { host: "imap.yeah.net", port: 993, secure: true },
+        smtp: { host: "smtp.yeah.net", port: 465, secure: true },
+        authType: "LOGIN",
+        provider: "other",
+    },
+    "188.com": {
+        imap: { host: "imap.188.com", port: 993, secure: true },
+        smtp: { host: "smtp.188.com", port: 465, secure: true },
+        authType: "LOGIN",
+        provider: "other",
+    },
+    "gmail.com": {
+        imap: { host: "imap.gmail.com", port: 993, secure: true },
+        smtp: { host: "smtp.gmail.com", port: 465, secure: true },
+        authType: "XOAUTH2",
+        provider: "google",
+    },
+    "googlemail.com": {
+        imap: { host: "imap.gmail.com", port: 993, secure: true },
+        smtp: { host: "smtp.gmail.com", port: 465, secure: true },
+        authType: "XOAUTH2",
+        provider: "google",
+    },
+};
+/** Look a domain up in ISPDB. Returns undefined when the domain is unknown. */
+export async function discoverDomain(domain, options = {}) {
+    const doFetch = options.fetchImpl ?? fetch;
+    const base = options.baseUrl ?? ISPDB;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? 5_000);
+    try {
+        const response = await doFetch(`${base}/${encodeURIComponent(domain)}`, { signal: controller.signal });
+        const parsed = response.ok ? (parseAutoconfig(await response.text()) ?? knownProvider(domain)) : knownProvider(domain);
+        return parsed ? applyProviderDefaults(parsed) : undefined;
+    }
+    catch {
+        // Offline or blocked: fall back to the built-in table before giving up.
+        const known = knownProvider(domain);
+        return known ? applyProviderDefaults(known) : undefined;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+export function domainOf(address) {
+    const at = address.lastIndexOf("@");
+    if (at <= 0 || at === address.length - 1)
+        return undefined;
+    // A trailing dot is a valid FQDN form but never what a person means to type.
+    return address.slice(at + 1).trim().toLowerCase().replace(/\.+$/, "") || undefined;
+}
+/** Scope presets, kept here so setup and docs cannot drift apart. */
+export const OAUTH_SCOPE = {
+    microsoft: "offline_access https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/SMTP.Send",
+    /** Same delegated scopes; the tenant, not the resource, is what differs. */
+    "microsoft-365": "offline_access https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/SMTP.Send",
+    google: "https://mail.google.com/ offline_access",
+};
+export const OAUTH_ISSUER = {
+    /** consumer outlook.com / hotmail */
+    microsoft: "https://login.microsoftonline.com/consumers/v2.0",
+    /** work or school tenant, incl. a Developer Program sandbox */
+    "microsoft-365": "https://login.microsoftonline.com/organizations/v2.0",
+    google: "https://accounts.google.com",
+};
+/**
+ * Turn discovery into a config the daemon can actually run.
+ *
+ * `address` is pi's mailbox; `to` is the human. When they differ, the loop guard
+ * stays strict; when they are the same, single-mailbox mode is enabled
+ * automatically so replies are not rejected as self-loops.
+ */
+export function buildSetupConfig(address, to, discovered) {
+    const sameAddress = address.trim().toLowerCase() === to.trim().toLowerCase();
+    // Only attach an OAuth preset when OAuth is actually the chosen mechanism,
+    // otherwise a Gmail app-password setup would ship a clientId nobody needs.
+    const oauthPreset = discovered.authType === "XOAUTH2" &&
+        (discovered.provider === "microsoft" || discovered.provider === "microsoft-365" || discovered.provider === "google")
+        ? discovered.provider
+        : undefined;
+    // QQ rewrites the Message-ID we stamp (measured live), which silently breaks the reply-chain
+    // fallback. Naming the Sent folder makes `setup` record the delivered id instead, so the
+    // documented fallback works out of the box on the provider we know does this.
+    const rewritesMessageId = /(^|\.)(qq|foxmail)\.com$/i.test(discovered.imap.host);
+    return {
+        mail: {
+            imap: {
+                host: discovered.imap.host,
+                port: discovered.imap.port,
+                secure: discovered.imap.secure,
+                user: address,
+                password: "",
+                folder: discovered.folder ?? "INBOX",
+                authType: discovered.authType,
+                ...(rewritesMessageId ? { sentFolder: "Sent Messages" } : {}),
+            },
+            smtp: {
+                host: discovered.smtp.host,
+                port: discovered.smtp.port,
+                secure: discovered.smtp.secure,
+                user: address,
+                password: "",
+                authType: discovered.authType,
+            },
+            to,
+        },
+        security: {
+            allowFrom: [to],
+            // Single-mailbox mode sends and receives from one address, so the human's reply
+            // is a self-addressed message the provider may deliver without an
+            // Authentication-Results header at all (QQ does not add one to QQ->QQ mail).
+            // Requiring DMARC there rejects every genuine reply, so it is off for that shape
+            // and on everywhere else. The allowlist, loop guard and two self-echo guards
+            // still apply; setup says so and `--check` warns if both are set.
+            requireDmarcPass: !sameAddress,
+            allowHeaderThreading: true,
+            allowSelfReplies: sameAddress,
+            tokenTtlHours: 30 * 24,
+        },
+        ...(oauthPreset
+            ? {
+                oauth: {
+                    issuer: OAUTH_ISSUER[oauthPreset],
+                    clientId: "<your app client id>",
+                    scope: OAUTH_SCOPE[oauthPreset],
+                },
+            }
+            : {}),
+    };
+}

package/dist/core/header-encoding.js

@@ -0,0 +1,70 @@
+// RFC 2047 header decoding.
+//
+// Headers are read raw on purpose: `Authentication-Results` must keep its original
+// order and multiplicity, which most MIME parsers collapse. The cost is that any
+// header a mail client decides to encode arrives as `=?charset?B?...?=` words.
+//
+// That is not an edge case. A subject containing one non-ASCII character — an em
+// dash, a Chinese session name — is encoded *whole*, so the routing token inside it
+// becomes unreadable and every reply looks like `no-token`. This module decodes it.
+//
+// Node ships full ICU, so `TextDecoder` handles legacy charsets like gb2312/gbk
+// without adding a dependency (verified: `new TextDecoder("gb2312")` works).
+/** One encoded word: =?charset?B|Q?text?= */
+const ENCODED_WORD = /=\?([^?\s]+)\?([BbQq])\?([^?\s]*)\?=/g;
+function decodeQ(text) {
+    // RFC 2047 §4.2: `_` means space; `=XX` is a hex byte.
+    const spaced = text.replace(/_/g, " ");
+    const bytes = [];
+    for (let i = 0; i < spaced.length; i++) {
+        const char = spaced[i];
+        if (char === "=" && /^[0-9A-Fa-f]{2}$/.test(spaced.slice(i + 1, i + 3))) {
+            bytes.push(Number.parseInt(spaced.slice(i + 1, i + 3), 16));
+            i += 2;
+            continue;
+        }
+        bytes.push(char.charCodeAt(0));
+    }
+    return Buffer.from(bytes);
+}
+function decodeBytes(bytes, charset) {
+    try {
+        return new TextDecoder(charset.trim().toLowerCase()).decode(bytes);
+    }
+    catch {
+        // Unknown or unsupported charset: UTF-8 is the best guess and never throws
+        // on valid bytes, so a reply is not lost because of a weird label.
+        return bytes.toString("utf8");
+    }
+}
+/**
+ * Decode every RFC 2047 encoded word in `value`.
+ *
+ * Whitespace *between* adjacent encoded words is dropped, per RFC 2047 §6.2 —
+ * clients split long encoded subjects on spaces, and keeping that space would
+ * corrupt the decoded text (and the token inside it).
+ */
+export function decodeRfc2047(value) {
+    if (!value)
+        return "";
+    if (!value.includes("=?"))
+        return value.replace(/\r?\n\s*/g, " ").trim();
+    let out = "";
+    let lastIndex = 0;
+    let matched = false;
+    for (const match of value.matchAll(ENCODED_WORD)) {
+        const index = match.index ?? 0;
+        const between = value.slice(lastIndex, index);
+        // Before the first word, keep the prefix verbatim. Between two encoded words,
+        // drop it only when it is pure whitespace (RFC 2047 §6.2).
+        if (!matched || !/^\s*$/.test(between))
+            out += between;
+        const [, charset = "", encoding = "", text = ""] = match;
+        const bytes = encoding.toUpperCase() === "B" ? Buffer.from(text, "base64") : decodeQ(text);
+        out += decodeBytes(bytes, charset);
+        lastIndex = index + match[0].length;
+        matched = true;
+    }
+    out += value.slice(lastIndex);
+    return out.replace(/\r?\n\s*/g, " ").trim();
+}

package/dist/core/html.js

@@ -0,0 +1,48 @@
+// HTML alternative for outbound mail.
+//
+// Mail clients collapse quoted history only when the original is HTML: they quote it
+// as a <blockquote> they can fold away. A text/plain-only mail gets quoted as raw
+// lines, so a reply thread reads as walls of repeated text.
+//
+// So every message now goes out as multipart/alternative: `text` (the fallback, and
+// what the scanner would see if pi ever read its own mail) plus `html`.
+//
+// Escaping is not optional. The body is model output — it can contain `<`, `&`, or
+// something that looks like markup — and an unescaped interpolation would inject
+// into the recipient's mail client.
+import { renderBody } from "./markdown.js";
+import { inlineLocalImages } from "./inline-images.js";
+const ENTITIES = {
+    "&": "&amp;",
+    "<": "&lt;",
+    ">": "&gt;",
+    '"': "&quot;",
+    "'": "&#39;",
+};
+/** Escape text for safe interpolation into HTML. */
+export function escapeHtml(value) {
+    return value.replace(/[&<>"']/g, (char) => ENTITIES[char] ?? char);
+}
+/**
+ * Render a mail body as HTML.
+ *
+ * The agent answers in Markdown, so it is rendered (core/markdown.ts) instead of being
+ * shown as literal `**bold**` and fence markers. Structure lives in the markup, not in
+ * CSS: clients that sanitise inline styles (Outlook web does) would collapse anything
+ * that relied on `white-space: pre-wrap`.
+ */
+export function textToHtml(text) {
+    return [
+        '<div style="font-family:-apple-system,BlinkMacSystemFont,\'Segoe UI\',Roboto,Helvetica,Arial,sans-serif;font-size:14px;line-height:1.45">',
+        renderBody(text),
+        "</div>",
+    ].join("");
+}
+/**
+ * Full HTML body plus any images that had to be inlined.
+ * `root` is the agent's working directory, used to resolve relative image paths.
+ */
+export function renderMessage(text, options = {}) {
+    const rendered = inlineLocalImages(textToHtml(text), options);
+    return { html: rendered.html, attachments: rendered.attachments, skipped: rendered.skipped };
+}