@molecule/api-emails-inbound-ses 1.0.0

package/dist/utilities.d.ts

@@ -0,0 +1,121 @@
+/**
+ * Internal utilities for the AWS SES inbound-email provider.
+ *
+ * Kept out of `provider.ts` so the parsing helpers can be unit-tested in
+ * isolation without touching the bond singleton.
+ *
+ * @module
+ */
+import { Buffer } from 'node:buffer';
+import './secrets.js';
+import type { InboundEmail } from '@molecule/api-emails-inbound';
+/**
+ * Coerces an HTTP header value (which may be `string`, `string[]`, or
+ * `undefined`) to a single string. Multi-value headers are joined with
+ * `, ` per RFC 9110 §5.2.
+ *
+ * @param value - The header value to coerce.
+ * @returns The header value as a single string, or `undefined` when the
+ *   header was not present.
+ */
+export declare const headerToString: (value: string | string[] | undefined) => string | undefined;
+/**
+ * Returns the value of `headers[name]` (case-insensitive) coerced to a
+ * single string.
+ *
+ * @param headers - The headers object.
+ * @param name - The header name (case-insensitive).
+ * @returns The header value as a single string, or `undefined` if absent.
+ */
+export declare const getHeader: (headers: Record<string, string | string[] | undefined>, name: string) => string | undefined;
+/**
+ * Coerces the request body into a UTF-8 string. SNS POSTs JSON as UTF-8.
+ *
+ * @param body - The raw body.
+ * @returns The body as a UTF-8 string.
+ */
+export declare const bodyToString: (body: Buffer | string) => string;
+/**
+ * Parses a Buffer/string/object body as an SNS JSON payload. Throws
+ * (caught by the caller) when the body is not valid JSON.
+ *
+ * @param body - The raw body.
+ * @returns The parsed object.
+ */
+export declare const parseJsonBody: (body: Buffer | string | Record<string, unknown>) => unknown;
+/**
+ * Returns the configured allowlist of hostname suffixes for the SNS
+ * `SigningCertURL`. Defaults to {@link SNS_SIGNING_CERT_HOSTNAME_SUFFIXES}
+ * when the env override is unset.
+ *
+ * @returns The allowlist of hostname suffixes.
+ */
+export declare const getSigningCertHostnameSuffixes: () => readonly string[];
+/**
+ * Validates that an SNS `SigningCertURL` is HTTPS and its hostname matches
+ * an entry in the allowlist. Defends against SSRF and certificate
+ * substitution attacks where an attacker tricks the verifier into fetching
+ * a cert from a host they control.
+ *
+ * @param url - The candidate URL string.
+ * @returns `true` when the URL is acceptable.
+ */
+export declare const isAllowedSigningCertUrl: (url: string) => boolean;
+/**
+ * Builds the canonical string SNS signs for the supplied notification.
+ * The exact field order is mandated by the SNS message-and-signature
+ * format; the canonical string is built from key/value pairs separated by
+ * `\n`, with a trailing `\n` after the last value.
+ *
+ * @param payload - The SNS notification payload.
+ * @returns The canonical string suitable for HMAC verification.
+ *
+ * @see https://docs.aws.amazon.com/sns/latest/dg/sns-verify-signature-of-message.html
+ */
+export declare const buildSnsCanonicalString: (payload: {
+    Type?: string;
+    Message?: string;
+    MessageId?: string;
+    Subject?: string;
+    SubscribeURL?: string;
+    Timestamp?: string;
+    Token?: string;
+    TopicArn?: string;
+}) => string;
+/**
+ * Splits a `References:` header (whitespace-separated `<message-id>`
+ * tokens) into individual values, preserving the angle brackets.
+ *
+ * @param value - The raw header value.
+ * @returns Array of message-id tokens (with angle brackets) or empty.
+ */
+export declare const splitReferences: (value: string | undefined) => string[];
+/**
+ * Strips surrounding angle brackets from a `Message-ID` value.
+ *
+ * @param value - The raw value (with or without angle brackets).
+ * @returns The value without angle brackets, or `undefined` if input was empty.
+ */
+export declare const unwrapMessageId: (value: string | undefined) => string | undefined;
+/**
+ * Decodes a base64 string into a Node `Buffer`.
+ *
+ * @param value - The base64 string.
+ * @returns The decoded buffer.
+ */
+export declare const base64ToBuffer: (value: string) => Buffer;
+/**
+ * Parses a raw RFC 822 MIME message into a normalized {@link InboundEmail}.
+ *
+ * Used internally by `parseWebhookPayload` after the SES `content` field
+ * has been base64-decoded. Exposed so that applications using SES's
+ * S3-only delivery mode can reuse the same parser by fetching the S3
+ * object themselves and calling this helper.
+ *
+ * @param raw - The raw RFC 822 message bytes.
+ * @param overrides - Optional fields to override on the parsed result
+ *   (e.g. an SES-assigned `id` or `receivedAt` timestamp).
+ * @returns The normalized inbound email.
+ */
+export declare const parseRawMimeContent: (raw: Buffer | string, overrides?: Partial<InboundEmail>) => Promise<InboundEmail>;
+//# sourceMappingURL=utilities.d.ts.map

package/dist/utilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utilities.d.ts","sourceRoot":"","sources":["../src/utilities.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAKpC,OAAO,cAAc,CAAA;AAGrB,OAAO,KAAK,EAAE,YAAY,EAA0B,MAAM,8BAA8B,CAAA;AAIxF;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,KAAG,MAAM,GAAG,SAG9E,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,GACpB,SAAS,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,EACtD,MAAM,MAAM,KACX,MAAM,GAAG,SAQX,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,YAAY,GAAI,MAAM,MAAM,GAAG,MAAM,KAAG,MAEpD,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,OAK/E,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,QAAO,SAAS,MAAM,EAQhE,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,GAAI,KAAK,MAAM,KAAG,OAkBrD,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB,GAAI,SAAS;IAC/C,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,KAAG,MAsBH,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,GAAI,OAAO,MAAM,GAAG,SAAS,KAAG,MAAM,EAMjE,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAAI,OAAO,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAKpE,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,KAAG,MAAsC,CAAA;AAErF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,GAC9B,KAAK,MAAM,GAAG,MAAM,EACpB,YAAW,OAAO,CAAC,YAAY,CAAM,KACpC,OAAO,CAAC,YAAY,CA8HtB,CAAA"}

package/dist/utilities.js

@@ -0,0 +1,324 @@
+/**
+ * Internal utilities for the AWS SES inbound-email provider.
+ *
+ * Kept out of `provider.ts` so the parsing helpers can be unit-tested in
+ * isolation without touching the bond singleton.
+ *
+ * @module
+ */
+import { Buffer } from 'node:buffer';
+// Side-effect import: registers this bond's secret definitions so the
+// runtime registry is populated even when utilities.js is imported directly
+// (not through the package barrel).
+import './secrets.js';
+import { simpleParser } from 'mailparser';
+import { SNS_SIGNING_CERT_HOSTNAME_SUFFIXES } from './types.js';
+/**
+ * Coerces an HTTP header value (which may be `string`, `string[]`, or
+ * `undefined`) to a single string. Multi-value headers are joined with
+ * `, ` per RFC 9110 §5.2.
+ *
+ * @param value - The header value to coerce.
+ * @returns The header value as a single string, or `undefined` when the
+ *   header was not present.
+ */
+export const headerToString = (value) => {
+    if (value === undefined)
+        return undefined;
+    return Array.isArray(value) ? value.join(', ') : value;
+};
+/**
+ * Returns the value of `headers[name]` (case-insensitive) coerced to a
+ * single string.
+ *
+ * @param headers - The headers object.
+ * @param name - The header name (case-insensitive).
+ * @returns The header value as a single string, or `undefined` if absent.
+ */
+export const getHeader = (headers, name) => {
+    const target = name.toLowerCase();
+    for (const key of Object.keys(headers)) {
+        if (key.toLowerCase() === target) {
+            return headerToString(headers[key]);
+        }
+    }
+    return undefined;
+};
+/**
+ * Coerces the request body into a UTF-8 string. SNS POSTs JSON as UTF-8.
+ *
+ * @param body - The raw body.
+ * @returns The body as a UTF-8 string.
+ */
+export const bodyToString = (body) => {
+    return Buffer.isBuffer(body) ? body.toString('utf8') : body;
+};
+/**
+ * Parses a Buffer/string/object body as an SNS JSON payload. Throws
+ * (caught by the caller) when the body is not valid JSON.
+ *
+ * @param body - The raw body.
+ * @returns The parsed object.
+ */
+export const parseJsonBody = (body) => {
+    if (typeof body === 'string' || Buffer.isBuffer(body)) {
+        return JSON.parse(bodyToString(body));
+    }
+    return body;
+};
+/**
+ * Returns the configured allowlist of hostname suffixes for the SNS
+ * `SigningCertURL`. Defaults to {@link SNS_SIGNING_CERT_HOSTNAME_SUFFIXES}
+ * when the env override is unset.
+ *
+ * @returns The allowlist of hostname suffixes.
+ */
+export const getSigningCertHostnameSuffixes = () => {
+    const raw = process.env.AWS_SNS_SIGNING_CERT_HOSTNAME_SUFFIXES;
+    if (!raw)
+        return SNS_SIGNING_CERT_HOSTNAME_SUFFIXES;
+    const parts = raw
+        .split(',')
+        .map((part) => part.trim())
+        .filter((part) => part.length > 0);
+    return parts.length > 0 ? parts : SNS_SIGNING_CERT_HOSTNAME_SUFFIXES;
+};
+/**
+ * Validates that an SNS `SigningCertURL` is HTTPS and its hostname matches
+ * an entry in the allowlist. Defends against SSRF and certificate
+ * substitution attacks where an attacker tricks the verifier into fetching
+ * a cert from a host they control.
+ *
+ * @param url - The candidate URL string.
+ * @returns `true` when the URL is acceptable.
+ */
+export const isAllowedSigningCertUrl = (url) => {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch (_error) {
+        // URL constructor throws on malformed input — a parse failure IS the
+        // validation signal; returning false is the correct, safe response.
+        return false;
+    }
+    if (parsed.protocol !== 'https:')
+        return false;
+    const host = parsed.hostname.toLowerCase();
+    for (const suffix of getSigningCertHostnameSuffixes()) {
+        const normalized = suffix.startsWith('.') ? suffix : `.${suffix}`;
+        if (host === normalized.slice(1) || host.endsWith(normalized)) {
+            return true;
+        }
+    }
+    return false;
+};
+/**
+ * Builds the canonical string SNS signs for the supplied notification.
+ * The exact field order is mandated by the SNS message-and-signature
+ * format; the canonical string is built from key/value pairs separated by
+ * `\n`, with a trailing `\n` after the last value.
+ *
+ * @param payload - The SNS notification payload.
+ * @returns The canonical string suitable for HMAC verification.
+ *
+ * @see https://docs.aws.amazon.com/sns/latest/dg/sns-verify-signature-of-message.html
+ */
+export const buildSnsCanonicalString = (payload) => {
+    const orderedKeys = payload.Type === 'SubscriptionConfirmation' || payload.Type === 'UnsubscribeConfirmation'
+        ? [
+            'Message',
+            'MessageId',
+            'SubscribeURL',
+            'Timestamp',
+            'Token',
+            'TopicArn',
+            'Type',
+        ]
+        : ['Message', 'MessageId', 'Subject', 'Timestamp', 'TopicArn', 'Type'];
+    const parts = [];
+    for (const key of orderedKeys) {
+        const value = payload[key];
+        if (value === undefined)
+            continue;
+        parts.push(key);
+        parts.push(value);
+    }
+    return `${parts.join('\n')}\n`;
+};
+/**
+ * Splits a `References:` header (whitespace-separated `<message-id>`
+ * tokens) into individual values, preserving the angle brackets.
+ *
+ * @param value - The raw header value.
+ * @returns Array of message-id tokens (with angle brackets) or empty.
+ */
+export const splitReferences = (value) => {
+    if (!value)
+        return [];
+    return value
+        .split(/\s+/u)
+        .map((token) => token.trim())
+        .filter((token) => token.length > 0);
+};
+/**
+ * Strips surrounding angle brackets from a `Message-ID` value.
+ *
+ * @param value - The raw value (with or without angle brackets).
+ * @returns The value without angle brackets, or `undefined` if input was empty.
+ */
+export const unwrapMessageId = (value) => {
+    if (!value)
+        return undefined;
+    const trimmed = value.trim();
+    if (trimmed.length === 0)
+        return undefined;
+    return trimmed.replace(/^<|>$/gu, '');
+};
+/**
+ * Decodes a base64 string into a Node `Buffer`.
+ *
+ * @param value - The base64 string.
+ * @returns The decoded buffer.
+ */
+export const base64ToBuffer = (value) => Buffer.from(value, 'base64');
+/**
+ * Parses a raw RFC 822 MIME message into a normalized {@link InboundEmail}.
+ *
+ * Used internally by `parseWebhookPayload` after the SES `content` field
+ * has been base64-decoded. Exposed so that applications using SES's
+ * S3-only delivery mode can reuse the same parser by fetching the S3
+ * object themselves and calling this helper.
+ *
+ * @param raw - The raw RFC 822 message bytes.
+ * @param overrides - Optional fields to override on the parsed result
+ *   (e.g. an SES-assigned `id` or `receivedAt` timestamp).
+ * @returns The normalized inbound email.
+ */
+export const parseRawMimeContent = async (raw, overrides = {}) => {
+    const buffer = typeof raw === 'string' ? Buffer.from(raw, 'utf8') : raw;
+    const parsed = await simpleParser(buffer);
+    const fromText = parsed.from && typeof parsed.from === 'object' && 'text' in parsed.from
+        ? (parsed.from.text ?? '')
+        : '';
+    const toAddresses = (() => {
+        const t = parsed.to;
+        if (!t)
+            return [];
+        const list = Array.isArray(t) ? t : [t];
+        const out = [];
+        for (const entry of list) {
+            if (entry && typeof entry === 'object' && 'value' in entry) {
+                for (const v of entry.value) {
+                    if (v.address)
+                        out.push(v.address);
+                }
+            }
+        }
+        return out;
+    })();
+    const ccAddresses = (() => {
+        const c = parsed.cc;
+        if (!c)
+            return [];
+        const list = Array.isArray(c) ? c : [c];
+        const out = [];
+        for (const entry of list) {
+            if (entry && typeof entry === 'object' && 'value' in entry) {
+                for (const v of entry.value) {
+                    if (v.address)
+                        out.push(v.address);
+                }
+            }
+        }
+        return out;
+    })();
+    const headers = {};
+    if (parsed.headers) {
+        for (const [name, value] of parsed.headers.entries()) {
+            const lower = name.toLowerCase();
+            if (typeof value === 'string') {
+                headers[lower] = value;
+            }
+            else if (Array.isArray(value)) {
+                const strings = value.filter((v) => typeof v === 'string');
+                if (strings.length > 0)
+                    headers[lower] = strings.length === 1 ? strings[0] : strings;
+            }
+            else if (value && typeof value === 'object') {
+                // mailparser returns parsed objects for some headers (Date, addresses);
+                // we serialize their `text` form when present, else JSON.
+                const obj = value;
+                if (typeof obj.text === 'string')
+                    headers[lower] = obj.text;
+            }
+        }
+    }
+    const attachments = [];
+    if (Array.isArray(parsed.attachments)) {
+        for (const att of parsed.attachments) {
+            const name = typeof att.filename === 'string' && att.filename.length > 0 ? att.filename : 'attachment';
+            const contentType = typeof att.contentType === 'string' && att.contentType.length > 0
+                ? att.contentType
+                : 'application/octet-stream';
+            const content = att.content;
+            const contentBase64 = Buffer.isBuffer(content)
+                ? content.toString('base64')
+                : typeof content === 'string'
+                    ? Buffer.from(content, 'utf8').toString('base64')
+                    : '';
+            const entry = {
+                name,
+                contentType,
+                contentBase64,
+            };
+            if (typeof att.size === 'number')
+                entry.sizeBytes = att.size;
+            const cid = att.cid ??
+                att.contentId;
+            if (typeof cid === 'string' && cid.length > 0)
+                entry.contentId = cid;
+            attachments.push(entry);
+        }
+    }
+    const messageId = unwrapMessageId(typeof parsed.messageId === 'string' ? parsed.messageId : undefined);
+    const inReplyTo = unwrapMessageId(typeof parsed.inReplyTo === 'string' ? parsed.inReplyTo : undefined);
+    const references = (() => {
+        const r = parsed.references;
+        if (!r)
+            return [];
+        const list = Array.isArray(r) ? r : [r];
+        return list
+            .filter((v) => typeof v === 'string')
+            .map((v) => unwrapMessageId(v) ?? v);
+    })();
+    const date = parsed.date instanceof Date
+        ? parsed.date
+        : parsed.date
+            ? new Date(String(parsed.date))
+            : new Date();
+    const email = {
+        id: messageId ?? `ses-${String(Date.now())}`,
+        from: fromText,
+        to: toAddresses,
+        subject: typeof parsed.subject === 'string' ? parsed.subject : '',
+        headers,
+        receivedAt: date,
+    };
+    if (ccAddresses.length > 0)
+        email.cc = ccAddresses;
+    if (typeof parsed.text === 'string')
+        email.textBody = parsed.text;
+    if (typeof parsed.html === 'string')
+        email.htmlBody = parsed.html;
+    if (attachments.length > 0)
+        email.attachments = attachments;
+    if (messageId)
+        email.messageId = messageId;
+    if (inReplyTo)
+        email.inReplyTo = inReplyTo;
+    if (references.length > 0)
+        email.references = references;
+    return { ...email, ...overrides };
+};
+//# sourceMappingURL=utilities.js.map

package/dist/utilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utilities.js","sourceRoot":"","sources":["../src/utilities.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,sEAAsE;AACtE,4EAA4E;AAC5E,oCAAoC;AACpC,OAAO,cAAc,CAAA;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAIzC,OAAO,EAAE,kCAAkC,EAAE,MAAM,YAAY,CAAA;AAE/D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAoC,EAAsB,EAAE;IACzF,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACzC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AACxD,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,OAAsD,EACtD,IAAY,EACQ,EAAE;IACtB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IACjC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;YACjC,OAAO,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;QACrC,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAqB,EAAU,EAAE;IAC5D,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC7D,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAA+C,EAAW,EAAE;IACxF,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAY,CAAA;IAClD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAsB,EAAE;IACpE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAA;IAC9D,IAAI,CAAC,GAAG;QAAE,OAAO,kCAAkC,CAAA;IACnD,MAAM,KAAK,GAAG,GAAG;SACd,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACpC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,kCAAkC,CAAA;AACtE,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAW,EAAW,EAAE;IAC9D,IAAI,MAAW,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACvB,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,qEAAqE;QACrE,oEAAoE;QACpE,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;IAC1C,KAAK,MAAM,MAAM,IAAI,8BAA8B,EAAE,EAAE,CAAC;QACtD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAA;QACjE,IAAI,IAAI,KAAK,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9D,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,OASvC,EAAU,EAAE;IACX,MAAM,WAAW,GACf,OAAO,CAAC,IAAI,KAAK,0BAA0B,IAAI,OAAO,CAAC,IAAI,KAAK,yBAAyB;QACvF,CAAC,CAAE;YACC,SAAS;YACT,WAAW;YACX,cAAc;YACd,WAAW;YACX,OAAO;YACP,UAAU;YACV,MAAM;SACG;QACb,CAAC,CAAE,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,CAAW,CAAA;IAErF,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAI,OAA8C,CAAC,GAAG,CAAC,CAAA;QAClE,IAAI,KAAK,KAAK,SAAS;YAAE,SAAQ;QACjC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACnB,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAA;AAChC,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAyB,EAAY,EAAE;IACrE,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAA;IACrB,OAAO,KAAK;SACT,KAAK,CAAC,MAAM,CAAC;SACb,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AACxC,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAyB,EAAsB,EAAE;IAC/E,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC1C,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;AACvC,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;AAErF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EACtC,GAAoB,EACpB,YAAmC,EAAE,EACd,EAAE;IACzB,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;IACvE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAA;IAEzC,MAAM,QAAQ,GACZ,MAAM,CAAC,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI;QACrE,CAAC,CAAC,CAAE,MAAM,CAAC,IAA0B,CAAC,IAAI,IAAI,EAAE,CAAC;QACjD,CAAC,CAAC,EAAE,CAAA;IAER,MAAM,WAAW,GAAa,CAAC,GAAG,EAAE;QAClC,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAA;QACnB,IAAI,CAAC,CAAC;YAAE,OAAO,EAAE,CAAA;QACjB,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACvC,MAAM,GAAG,GAAa,EAAE,CAAA;QACxB,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;gBAC3D,KAAK,MAAM,CAAC,IAAK,KAAgD,CAAC,KAAK,EAAE,CAAC;oBACxE,IAAI,CAAC,CAAC,OAAO;wBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;gBACpC,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC,CAAC,EAAE,CAAA;IAEJ,MAAM,WAAW,GAAa,CAAC,GAAG,EAAE;QAClC,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAA;QACnB,IAAI,CAAC,CAAC;YAAE,OAAO,EAAE,CAAA;QACjB,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACvC,MAAM,GAAG,GAAa,EAAE,CAAA;QACxB,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACzB,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;gBAC3D,KAAK,MAAM,CAAC,IAAK,KAAgD,CAAC,KAAK,EAAE,CAAC;oBACxE,IAAI,CAAC,CAAC,OAAO;wBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;gBACpC,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC,CAAC,EAAE,CAAA;IAEJ,MAAM,OAAO,GAAsC,EAAE,CAAA;IACrD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACrD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;YAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,CAAA;YACxB,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAA;gBACvE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;oBAAE,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,OAAO,CAAA;YACvF,CAAC;iBAAM,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9C,wEAAwE;gBACxE,0DAA0D;gBAC1D,MAAM,GAAG,GAAG,KAA0B,CAAA;gBACtC,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,IAAI,CAAA;YAC7D,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAA6B,EAAE,CAAA;IAChD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,IAAI,GACR,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAA;YAC3F,MAAM,WAAW,GACf,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;gBAC/D,CAAC,CAAC,GAAG,CAAC,WAAW;gBACjB,CAAC,CAAC,0BAA0B,CAAA;YAChC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAA;YAC3B,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAC5C,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC5B,CAAC,CAAC,OAAO,OAAO,KAAK,QAAQ;oBAC3B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBACjD,CAAC,CAAC,EAAE,CAAA;YACR,MAAM,KAAK,GAA2B;gBACpC,IAAI;gBACJ,WAAW;gBACX,aAAa;aACd,CAAA;YACD,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;gBAAE,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,IAAI,CAAA;YAC5D,MAAM,GAAG,GACN,GAA4C,CAAC,GAAG;gBAChD,GAA8B,CAAC,SAAS,CAAA;YAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;gBAAE,KAAK,CAAC,SAAS,GAAG,GAAG,CAAA;YACpE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACzB,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,eAAe,CAC/B,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CACpE,CAAA;IACD,MAAM,SAAS,GAAG,eAAe,CAC/B,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CACpE,CAAA;IACD,MAAM,UAAU,GAAa,CAAC,GAAG,EAAE;QACjC,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAA;QAC3B,IAAI,CAAC,CAAC;YAAE,OAAO,EAAE,CAAA;QACjB,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACvC,OAAO,IAAI;aACR,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;aACjD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IACxC,CAAC,CAAC,EAAE,CAAA;IAEJ,MAAM,IAAI,GACR,MAAM,CAAC,IAAI,YAAY,IAAI;QACzB,CAAC,CAAC,MAAM,CAAC,IAAI;QACb,CAAC,CAAC,MAAM,CAAC,IAAI;YACX,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC/B,CAAC,CAAC,IAAI,IAAI,EAAE,CAAA;IAElB,MAAM,KAAK,GAAiB;QAC1B,EAAE,EAAE,SAAS,IAAI,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE;QAC5C,IAAI,EAAE,QAAQ;QACd,EAAE,EAAE,WAAW;QACf,OAAO,EAAE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;QACjE,OAAO;QACP,UAAU,EAAE,IAAI;KACjB,CAAA;IAED,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,EAAE,GAAG,WAAW,CAAA;IAClD,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAA;IACjE,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAA;IACjE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,WAAW,GAAG,WAAW,CAAA;IAC3D,IAAI,SAAS;QAAE,KAAK,CAAC,SAAS,GAAG,SAAS,CAAA;IAC1C,IAAI,SAAS;QAAE,KAAK,CAAC,SAAS,GAAG,SAAS,CAAA;IAC1C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,UAAU,GAAG,UAAU,CAAA;IAExD,OAAO,EAAE,GAAG,KAAK,EAAE,GAAG,SAAS,EAAE,CAAA;AACnC,CAAC,CAAA"}

package/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "@molecule/api-emails-inbound-ses",
+  "version": "1.0.0",
+  "description": "AWS SES inbound email provider — parses SNS notification payloads carrying SES inbound messages into normalized InboundEmail.",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "keywords": [
+    "molecule",
+    "emails",
+    "inbound",
+    "ses",
+    "aws",
+    "sns",
+    "webhook"
+  ],
+  "license": "Apache-2.0",
+  "dependencies": {
+    "mailparser": "3.9.14"
+  },
+  "devDependencies": {
+    "@molecule/api-emails": "1.0.0",
+    "@molecule/api-emails-inbound": "1.0.0",
+    "@types/mailparser": "3.4.6",
+    "@types/node": "26.1.2",
+    "typescript": "6.0.3",
+    "vitest": "4.1.10"
+  },
+  "peerDependencies": {
+    "@molecule/api-emails": "^1.0.0",
+    "@molecule/api-emails-inbound": "^1.0.0",
+    "@molecule/api-secrets": "^1.0.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/molecule-dev/molecule.git",
+    "directory": "packages/api/bonds/emails-inbound/ses"
+  },
+  "homepage": "https://github.com/molecule-dev/molecule/tree/main/packages/api/bonds/emails-inbound/ses",
+  "bugs": "https://github.com/molecule-dev/molecule/issues",
+  "publishConfig": {
+    "access": "public"
+  }
+}