@molecule/api-emails-inbound-ses 1.0.2 → 1.1.1

package/README.md

@@ -3,7 +3,7 @@ AUTO-GENERATED — DO NOT EDIT THIS FILE.
 Generated by `mlcl sync-docs` from the package's src/index.ts JSDoc + mlcl/registry.json.
 Edits here are overwritten on the next commit (molecule's pre-commit hook regenerates).
 To change this document, edit the module-level JSDoc in src/index.ts.
-Generated: 2026-08-04T01:48:03.682Z
+Generated: 2026-09-18T06:05:34.971Z
 -->
 
 # @molecule/api-emails-inbound-ses
@@ -381,7 +381,12 @@ interface SnsNotificationPayload {
   /** A unique UUID for the message. */
   MessageId: string
 
-  /** The notification topic ARN. */
+  /**
+   * The notification topic ARN. Its account-id field is part of the
+   * SNS-signed canonical string, so after signature verification it is an
+   * attested publisher identity — the source used for
+   * `AWS_SES_INBOUND_ACCOUNT_ID` pinning.
+   */
   TopicArn?: string
 
   /**
@@ -401,7 +406,11 @@ interface SnsNotificationPayload {
   /** Base64-encoded signature over the canonical string. */
   Signature: string
 
-  /** URL of the X.509 PEM cert used to sign the message. */
+  /**
+   * URL of the X.509 PEM cert used to sign the message. Must be HTTPS on an
+   * allowlisted `*.amazonaws.com` host; a 12-digit account-id path segment,
+   * when present, participates in `AWS_SES_INBOUND_ACCOUNT_ID` pinning.
+   */
   SigningCertURL: string
 
   /** Confirmation token (only on SubscriptionConfirmation messages). */
@@ -651,17 +660,27 @@ Verifies the signature of an SNS notification payload. Implements the
 AWS SNS signature-verification flow:
 
 1. Parse the JSON body.
-2. Reject if `SigningCertURL` is not from an allowlisted host.
-3. Fetch the X.509 certificate from `SigningCertURL`.
-4. Build the canonical string per AWS docs (field order varies by
+2. PIN THE PUBLISHER (fail-closed): accept the notification only when
+   EITHER `AWS_SES_INBOUND_TOPIC_ARN` is configured and matches the
+   payload's `TopicArn`, OR `AWS_SES_INBOUND_ACCOUNT_ID` is configured
+   and matches the AWS account id carried by the notification (the 12-digit
+   segment of the `SigningCertURL` path, or the account field of the
+   SIGNED `TopicArn`). When NEITHER is configured, verification THROWS a
+   tagged `config.notConfigured` error — a valid AWS signature only proves
+   that _some_ AWS account published the message (the cert-hostname
+   allowlist admits every `sns.<region>.amazonaws.com` cert), so without
+   a pin ANY AWS account that can publish to SNS can forge inbound mail.
+3. Reject if `SigningCertURL` is not from an allowlisted host.
+4. Fetch the X.509 certificate from `SigningCertURL`.
+5. Build the canonical string per AWS docs (field order varies by
    `Type`).
-5. Verify the base64-decoded `Signature` against the canonical string
+6. Verify the base64-decoded `Signature` against the canonical string
    using SHA1 (`SignatureVersion === '1'`) or SHA256
    (`SignatureVersion === '2'`).
-6. When `AWS_SES_INBOUND_TOPIC_ARN` is set, also verify the payload's
-   `TopicArn` matches.
 
 Errors NEVER leak signing material; failures simply return `false`.
+The ONLY throw is the misconfiguration error from step 2 (distinct
+failure class per the `InboundEmailProvider` contract).
 
 ```typescript
 function verifySignature(
@@ -761,6 +780,20 @@ Peer dependencies:
 - `@molecule/api-secrets`
 - `mailparser`
 
+Verification is FAIL-CLOSED on publisher identity. An SNS signature only
+proves that _some_ AWS account published the message — the
+`*.amazonaws.com` cert-hostname allowlist admits every AWS account's
+signing cert — so a notification is accepted only when it is pinned to
+YOUR infrastructure: either `AWS_SES_INBOUND_TOPIC_ARN` is set and
+exactly matches the payload's `TopicArn`, or
+`AWS_SES_INBOUND_ACCOUNT_ID` is set and matches the publisher's 12-digit
+AWS account id (read from the `SigningCertURL` path or the account field
+of the SNS-signed `TopicArn`). When NEITHER is configured,
+`verifySignature` throws a tagged `config.notConfigured` (503) error
+instead of accepting any validly-signed SNS message — without a pin, any
+AWS account could forge inbound mail into your app. Configure at least
+one of the two in `api/.env`; the topic ARN is the tighter pin.
+
 The (uncached) signing-certificate fetch is bounded to a 5 second
 timeout — a hanging/slow `SigningCertURL` endpoint fails fast into a
 `false` verification result instead of stalling the webhook handler for

package/dist/index.d.ts

@@ -12,6 +12,20 @@
  * reimplement SMTP / SES SendEmail.
  *
  * @remarks
+ * Verification is FAIL-CLOSED on publisher identity. An SNS signature only
+ * proves that *some* AWS account published the message — the
+ * `*.amazonaws.com` cert-hostname allowlist admits every AWS account's
+ * signing cert — so a notification is accepted only when it is pinned to
+ * YOUR infrastructure: either `AWS_SES_INBOUND_TOPIC_ARN` is set and
+ * exactly matches the payload's `TopicArn`, or
+ * `AWS_SES_INBOUND_ACCOUNT_ID` is set and matches the publisher's 12-digit
+ * AWS account id (read from the `SigningCertURL` path or the account field
+ * of the SNS-signed `TopicArn`). When NEITHER is configured,
+ * `verifySignature` throws a tagged `config.notConfigured` (503) error
+ * instead of accepting any validly-signed SNS message — without a pin, any
+ * AWS account could forge inbound mail into your app. Configure at least
+ * one of the two in `api/.env`; the topic ARN is the tighter pin.
+ *
  * The (uncached) signing-certificate fetch is bounded to a 5 second
  * timeout — a hanging/slow `SigningCertURL` endpoint fails fast into a
  * `false` verification result instead of stalling the webhook handler for

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA"}

package/dist/index.js

@@ -12,6 +12,20 @@
  * reimplement SMTP / SES SendEmail.
  *
  * @remarks
+ * Verification is FAIL-CLOSED on publisher identity. An SNS signature only
+ * proves that *some* AWS account published the message — the
+ * `*.amazonaws.com` cert-hostname allowlist admits every AWS account's
+ * signing cert — so a notification is accepted only when it is pinned to
+ * YOUR infrastructure: either `AWS_SES_INBOUND_TOPIC_ARN` is set and
+ * exactly matches the payload's `TopicArn`, or
+ * `AWS_SES_INBOUND_ACCOUNT_ID` is set and matches the publisher's 12-digit
+ * AWS account id (read from the `SigningCertURL` path or the account field
+ * of the SNS-signed `TopicArn`). When NEITHER is configured,
+ * `verifySignature` throws a tagged `config.notConfigured` (503) error
+ * instead of accepting any validly-signed SNS message — without a pin, any
+ * AWS account could forge inbound mail into your app. Configure at least
+ * one of the two in `api/.env`; the topic ARN is the tighter pin.
+ *
  * The (uncached) signing-certificate fetch is bounded to a 5 second
  * timeout — a hanging/slow `SigningCertURL` endpoint fails fast into a
  * `false` verification result instead of stalling the webhook handler for

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA"}

package/dist/provider.d.ts

@@ -29,21 +29,33 @@ export declare const _resetSigningCertCache: () => void;
  * AWS SNS signature-verification flow:
  *
  * 1. Parse the JSON body.
- * 2. Reject if `SigningCertURL` is not from an allowlisted host.
- * 3. Fetch the X.509 certificate from `SigningCertURL`.
- * 4. Build the canonical string per AWS docs (field order varies by
+ * 2. PIN THE PUBLISHER (fail-closed): accept the notification only when
+ *    EITHER `AWS_SES_INBOUND_TOPIC_ARN` is configured and matches the
+ *    payload's `TopicArn`, OR `AWS_SES_INBOUND_ACCOUNT_ID` is configured
+ *    and matches the AWS account id carried by the notification (the 12-digit
+ *    segment of the `SigningCertURL` path, or the account field of the
+ *    SIGNED `TopicArn`). When NEITHER is configured, verification THROWS a
+ *    tagged `config.notConfigured` error — a valid AWS signature only proves
+ *    that *some* AWS account published the message (the cert-hostname
+ *    allowlist admits every `sns.<region>.amazonaws.com` cert), so without
+ *    a pin ANY AWS account that can publish to SNS can forge inbound mail.
+ * 3. Reject if `SigningCertURL` is not from an allowlisted host.
+ * 4. Fetch the X.509 certificate from `SigningCertURL`.
+ * 5. Build the canonical string per AWS docs (field order varies by
  *    `Type`).
- * 5. Verify the base64-decoded `Signature` against the canonical string
+ * 6. Verify the base64-decoded `Signature` against the canonical string
  *    using SHA1 (`SignatureVersion === '1'`) or SHA256
  *    (`SignatureVersion === '2'`).
- * 6. When `AWS_SES_INBOUND_TOPIC_ARN` is set, also verify the payload's
- *    `TopicArn` matches.
  *
  * Errors NEVER leak signing material; failures simply return `false`.
+ * The ONLY throw is the misconfiguration error from step 2 (distinct
+ * failure class per the `InboundEmailProvider` contract).
  *
  * @param _headers - HTTP headers (unused — SNS signs the body).
  * @param body - Raw HTTP request body (JSON).
  * @returns `true` when the signature is valid, `false` otherwise.
+ * @throws {Error} Tagged `config.notConfigured` (503) when neither
+ *   `AWS_SES_INBOUND_TOPIC_ARN` nor `AWS_SES_INBOUND_ACCOUNT_ID` is set.
  */
 export declare const verifySignature: (_headers: Record<string, string | string[] | undefined>, body: Buffer | string) => Promise<boolean>;
 /**

package/dist/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAMpC,OAAO,cAAc,CAAA;AAGrB,OAAO,KAAK,EACV,YAAY,EAEZ,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACxB,MAAM,8BAA8B,CAAA;AA+BrC;;GAEG;AACH,eAAO,MAAM,sBAAsB,QAAO,IAEzC,CAAA;AAqDD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,eAAe,GAC1B,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,EACvD,MAAM,MAAM,GAAG,MAAM,KACpB,OAAO,CAAC,OAAO,CAqDjB,CAAA;AAuCD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,mBAAmB,GAC9B,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,EACvD,MAAM,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC9C,OAAO,CAAC,YAAY,CA6EtB,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAClB,OAAO,YAAY,EACnB,OAAO,iBAAiB,KACvB,OAAO,CAAC,uBAAuB,CA+CjC,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,QAAO,OAAe,CAAA;AAEhD;;;GAGG;AACH,eAAO,MAAM,QAAQ,EAAE,oBAKtB,CAAA"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAMpC,OAAO,cAAc,CAAA;AAGrB,OAAO,KAAK,EACV,YAAY,EAEZ,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACxB,MAAM,8BAA8B,CAAA;AA2ErC;;GAEG;AACH,eAAO,MAAM,sBAAsB,QAAO,IAEzC,CAAA;AAqDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,eAAe,GAC1B,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,EACvD,MAAM,MAAM,GAAG,MAAM,KACpB,OAAO,CAAC,OAAO,CA+EjB,CAAA;AAuCD;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,mBAAmB,GAC9B,UAAU,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,EACvD,MAAM,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC9C,OAAO,CAAC,YAAY,CA6EtB,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAClB,OAAO,YAAY,EACnB,OAAO,iBAAiB,KACvB,OAAO,CAAC,uBAAuB,CA+CjC,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,QAAO,OAAe,CAAA;AAEhD;;;GAGG;AACH,eAAO,MAAM,QAAQ,EAAE,oBAKtB,CAAA"}

package/dist/provider.js

@@ -24,7 +24,52 @@ import { createPublicKey, createVerify } from 'node:crypto';
 // (not through the package barrel).
 import './secrets.js';
 import { sendMail } from '@molecule/api-emails';
+import { configNotConfiguredError } from '@molecule/api-secrets';
 import { base64ToBuffer, buildSnsCanonicalString, isAllowedSigningCertUrl, parseJsonBody, parseRawMimeContent, splitReferences, unwrapMessageId, } from './utilities.js';
+/**
+ * Extracts the AWS account id from an SNS `SigningCertURL` path, when the URL
+ * carries one. AWS account ids are exactly 12 decimal digits; any single path
+ * segment of that shape is treated as the publisher's account id. Returns
+ * `undefined` when the URL has no such segment (the classic AWS shape
+ * `https://sns.<region>.amazonaws.com/SimpleNotificationService-<hash>.pem`
+ * does not embed the account id — see {@link topicArnAccountId} for the
+ * signed-TopicArn source that covers it).
+ *
+ * Module-private: not part of the package's public export surface.
+ */
+const extractSigningCertAccountId = (url) => {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch (_error) {
+        return undefined;
+    }
+    for (const segment of parsed.pathname.split('/')) {
+        if (/^\d{12}$/u.test(segment))
+            return segment;
+    }
+    return undefined;
+};
+/**
+ * Extracts the AWS account id from an SNS topic ARN
+ * (`arn:<partition>:<service>:<region>:<account-id>:<resource>`). The
+ * `TopicArn` field is part of the SNS-signed canonical string, so — once the
+ * signature itself verifies against an `*.amazonaws.com` cert — the account
+ * id it carries is an attested fact, not a client-controlled claim. This is
+ * what makes account pinning work for notifications whose `SigningCertURL`
+ * path has no account-id segment (the common AWS shape).
+ *
+ * Module-private: not part of the package's public export surface.
+ */
+const topicArnAccountId = (arn) => {
+    if (!arn)
+        return undefined;
+    const parts = arn.split(':');
+    // arn:<partition>:<service>:<region>:<account-id>:<resource>
+    const account = parts.length >= 6 ? parts[4] : undefined;
+    return account !== undefined && /^\d{12}$/u.test(account) ? account : undefined;
+};
 /**
  * Cache of fetched SNS signing certificate PEM bodies, keyed by
  * `SigningCertURL`. AWS rotates these infrequently and serves them from a
@@ -103,21 +148,33 @@ const isSnsPayload = (value) => {
  * AWS SNS signature-verification flow:
  *
  * 1. Parse the JSON body.
- * 2. Reject if `SigningCertURL` is not from an allowlisted host.
- * 3. Fetch the X.509 certificate from `SigningCertURL`.
- * 4. Build the canonical string per AWS docs (field order varies by
+ * 2. PIN THE PUBLISHER (fail-closed): accept the notification only when
+ *    EITHER `AWS_SES_INBOUND_TOPIC_ARN` is configured and matches the
+ *    payload's `TopicArn`, OR `AWS_SES_INBOUND_ACCOUNT_ID` is configured
+ *    and matches the AWS account id carried by the notification (the 12-digit
+ *    segment of the `SigningCertURL` path, or the account field of the
+ *    SIGNED `TopicArn`). When NEITHER is configured, verification THROWS a
+ *    tagged `config.notConfigured` error — a valid AWS signature only proves
+ *    that *some* AWS account published the message (the cert-hostname
+ *    allowlist admits every `sns.<region>.amazonaws.com` cert), so without
+ *    a pin ANY AWS account that can publish to SNS can forge inbound mail.
+ * 3. Reject if `SigningCertURL` is not from an allowlisted host.
+ * 4. Fetch the X.509 certificate from `SigningCertURL`.
+ * 5. Build the canonical string per AWS docs (field order varies by
  *    `Type`).
- * 5. Verify the base64-decoded `Signature` against the canonical string
+ * 6. Verify the base64-decoded `Signature` against the canonical string
  *    using SHA1 (`SignatureVersion === '1'`) or SHA256
  *    (`SignatureVersion === '2'`).
- * 6. When `AWS_SES_INBOUND_TOPIC_ARN` is set, also verify the payload's
- *    `TopicArn` matches.
  *
  * Errors NEVER leak signing material; failures simply return `false`.
+ * The ONLY throw is the misconfiguration error from step 2 (distinct
+ * failure class per the `InboundEmailProvider` contract).
  *
  * @param _headers - HTTP headers (unused — SNS signs the body).
  * @param body - Raw HTTP request body (JSON).
  * @returns `true` when the signature is valid, `false` otherwise.
+ * @throws {Error} Tagged `config.notConfigured` (503) when neither
+ *   `AWS_SES_INBOUND_TOPIC_ARN` nor `AWS_SES_INBOUND_ACCOUNT_ID` is set.
  */
 export const verifySignature = async (_headers, body) => {
     let parsed;
@@ -131,7 +188,29 @@ export const verifySignature = async (_headers, body) => {
     if (!isSnsPayload(parsed))
         return false;
     const expectedTopic = process.env.AWS_SES_INBOUND_TOPIC_ARN;
-    if (expectedTopic && parsed.TopicArn !== expectedTopic)
+    const expectedAccount = process.env.AWS_SES_INBOUND_ACCOUNT_ID;
+    if (expectedTopic === undefined && expectedAccount === undefined) {
+        // Fail closed: without an origin pin, "signature valid" only proves some
+        // AWS account sent this — cross-account forgery. This is a deployment
+        // misconfiguration, not a forged request, so it throws the tagged config
+        // error (503) rather than collapsing into the 401 `false` path.
+        throw Object.assign(configNotConfiguredError('AWS_SES_INBOUND_TOPIC_ARN'), {
+            message: 'Neither AWS_SES_INBOUND_TOPIC_ARN nor AWS_SES_INBOUND_ACCOUNT_ID is set — ' +
+                'SES inbound webhook verification is fail-closed without an origin pin. ' +
+                'Set AWS_SES_INBOUND_TOPIC_ARN to the exact topic ARN your SES receipt rule publishes ' +
+                'to, or AWS_SES_INBOUND_ACCOUNT_ID to your 12-digit AWS account id, in api/.env.',
+        });
+    }
+    // Origin pinning: either the exact topic matches, or the publisher account
+    // matches. The TopicArn account field is itself covered by the SNS signature
+    // (verified below), so it is an attested fact, not a client claim.
+    const topicMatches = expectedTopic !== undefined && parsed.TopicArn === expectedTopic;
+    const notificationAccounts = [
+        extractSigningCertAccountId(parsed.SigningCertURL),
+        topicArnAccountId(parsed.TopicArn),
+    ];
+    const accountMatches = expectedAccount !== undefined && notificationAccounts.includes(expectedAccount);
+    if (!topicMatches && !accountMatches)
         return false;
     if (!isAllowedSigningCertUrl(parsed.SigningCertURL))
         return false;

package/dist/provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider.js","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE3D,sEAAsE;AACtE,2EAA2E;AAC3E,oCAAoC;AACpC,OAAO,cAAc,CAAA;AAErB,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAU/C,OAAO,EACL,cAAc,EACd,uBAAuB,EACvB,uBAAuB,EACvB,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,eAAe,GAChB,MAAM,gBAAgB,CAAA;AAEvB;;;;;GAKG;AACH,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAA;AAE3C;;;;;;;GAOG;AACH,MAAM,qBAAqB,GAAG,IAAI,CAAA;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAS,EAAE;IAC/C,SAAS,CAAC,KAAK,EAAE,CAAA;AACnB,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,gBAAgB,GAAG,KAAK,EAAE,GAAW,EAA+B,EAAE;IAC1E,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IAEnD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAA;IAEvC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAA;QACzF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,SAAS,CAAA;QAClC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QACjC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YAAE,OAAO,SAAS,CAAA;QACxD,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACvB,OAAO,GAAG,CAAA;IACZ,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,4EAA4E;QAC5E,qEAAqE;QACrE,wDAAwD;QACxD,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,YAAY,GAAG,CAAC,KAAc,EAAmC,EAAE;IACvE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACrD,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,OAAO,CACL,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAC7B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ;QACpC,OAAO,CAAC,CAAC,gBAAgB,KAAK,QAAQ,CACvC,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,QAAuD,EACvD,IAAqB,EACH,EAAE;IACpB,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAC9B,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,8EAA8E;QAC9E,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IAEvC,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAA;IAC3D,IAAI,aAAa,IAAI,MAAM,CAAC,QAAQ,KAAK,aAAa;QAAE,OAAO,KAAK,CAAA;IAEpE,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,cAAc,CAAC;QAAE,OAAO,KAAK,CAAA;IAEjE,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;IACzD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAA;IAEtB,MAAM,SAAS,GACb,MAAM,CAAC,gBAAgB,KAAK,GAAG;QAC7B,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,MAAM,CAAC,gBAAgB,KAAK,GAAG;YAC/B,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,SAAS,CAAA;IACjB,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IAE5B,IAAI,SAAiB,CAAA;IACrB,IAAI,CAAC;QACH,SAAS,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAA;IAC7C,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,kFAAkF;QAClF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,eAAuB,CAAA;IAC3B,IAAI,CAAC;QACH,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IAC3D,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,oEAAoE;QACpE,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAE9C,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;QACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;QACxC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QAClC,QAAQ,CAAC,GAAG,EAAE,CAAA;QACd,OAAO,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;IACpD,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,yFAAyF;QACzF,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,CACzB,IAA2C,EACR,EAAE;IACrC,MAAM,GAAG,GAAsC,EAAE,CAAA;IACjD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;gBAAE,SAAQ;YAC7E,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAA;YAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,CAAA;YAC3B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAA;YACtB,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;YACxB,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAA;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,CAAA;IAC7B,IAAI,EAAE,EAAE,CAAC;QACP,IAAI,OAAO,EAAE,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;YAAE,GAAG,CAAC,OAAO,GAAG,EAAE,CAAC,OAAO,CAAA;QACzF,IAAI,OAAO,EAAE,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,SAAS;YACrE,GAAG,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,SAAS,CAAA;QAClC,IAAI,OAAO,EAAE,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,aAAa,CAAC,KAAK,SAAS;YACtE,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,SAAS,CAAA;QACnC,IAAI,OAAO,EAAE,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS;YACnE,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC,UAAU,CAAA;IAClC,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EACtC,QAAuD,EACvD,IAA+C,EACxB,EAAE;IACzB,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,6CAA6C,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAClF,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;IACjF,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,0BAA0B,IAAI,MAAM,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;QAC5F,MAAM,OAAO,GAAsC,EAAE,CAAA;QACrD,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;YACzC,OAAO,CAAC,qBAAqB,CAAC,GAAG,MAAM,CAAC,YAAY,CAAA;QACtD,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,SAAS;YACpB,IAAI,EAAE,EAAE;YACR,EAAE,EAAE,EAAE;YACN,OAAO,EAAE,SAAS,MAAM,CAAC,IAAI,EAAE;YAC/B,OAAO;YACP,UAAU,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;SACvC,CAAA;IACH,CAAC;IAED,IAAI,UAAyC,CAAA;IAC7C,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAkC,CAAA;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,uDAAuD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAC5F,CAAC;IACD,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACzD,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAA;IAE9C,IAAI,OAAO,UAAU,CAAC,OAAO,KAAK,QAAQ,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5E,MAAM,GAAG,GAAG,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;QAC9C,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE;YAC3C,EAAE,EAAE,YAAY;YAChB,UAAU,EAAE,aAAa;SAC1B,CAAC,CAAA;QACF,IAAI,CAAC,KAAK,CAAC,SAAS;YAAE,KAAK,CAAC,SAAS,GAAG,YAAY,CAAA;QACpD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,2DAA2D;IAC3D,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAA;IAC9C,MAAM,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;IACnD,MAAM,mBAAmB,GAAG,eAAe,CAAC,EAAE,CAAC,SAAS,CAAC,CAAA;IACzD,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,CAAC,SAAS,CAAC,CAAA;IAC/C,MAAM,UAAU,GAAG,eAAe,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAA;IAE3F,MAAM,KAAK,GAAiB;QAC1B,EAAE,EAAE,YAAY;QAChB,IAAI,EACF,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QAC7F,EAAE,EACA,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC;YACtC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE;YACf,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;gBAC1C,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE;gBACrC,CAAC,CAAC,EAAE;QACV,OAAO,EAAE,OAAO,EAAE,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;QACzD,OAAO;QACP,UAAU,EAAE,aAAa;KAC1B,CAAA;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAA;IACtE,IAAI,mBAAmB;QAAE,KAAK,CAAC,SAAS,GAAG,mBAAmB,CAAA;;QACzD,KAAK,CAAC,SAAS,GAAG,YAAY,CAAA;IACnC,IAAI,SAAS;QAAE,KAAK,CAAC,SAAS,GAAG,SAAS,CAAA;IAC1C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,UAAU,GAAG,UAAU,CAAA;IAExD,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,KAAK,EAC1B,KAAmB,EACnB,KAAwB,EACU,EAAE;IACpC,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IACjF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,wHAAwH,CACzH,CAAA;IACH,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,OAAO,KAAK,CAAC,OAAO,EAAE,CAAA;IAEvD,MAAM,gBAAgB,GAA2B,EAAE,CAAA;IACnD,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,gBAAgB,CAAC,aAAa,CAAC,GAAG,IAAI,KAAK,CAAC,SAAS,GAAG,CAAA;QACxD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC1D,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QAC1B,gBAAgB,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACrE,CAAC;IAED,MAAM,OAAO,GAA2B;QACtC,GAAG,gBAAgB;QACnB,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;KACzB,CAAA;IAED,MAAM,OAAO,GAAG;QACd,IAAI,EAAE,WAAW;QACjB,EAAE,EAAE,KAAK,CAAC,IAAI;QACd,OAAO;QACP,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;YACnD,CAAC,CAAC;gBACE,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAyB,EAAE,EAAE,CAAC,CAAC;oBACjE,QAAQ,EAAE,CAAC,CAAC,IAAI;oBAChB,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC;oBACxC,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3D,CAAC,CAAC;aACJ;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAA;IAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAyC,CAAC,CAAA;IAExE,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE;KAC3B,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,GAAY,EAAE,CAAC,IAAI,CAAA;AAEhD;;;GAGG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAyB;IAC5C,mBAAmB;IACnB,eAAe;IACf,OAAO;IACP,aAAa;CACd,CAAA"}
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE3D,sEAAsE;AACtE,2EAA2E;AAC3E,oCAAoC;AACpC,OAAO,cAAc,CAAA;AAErB,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAQ/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAGhE,OAAO,EACL,cAAc,EACd,uBAAuB,EACvB,uBAAuB,EACvB,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,eAAe,GAChB,MAAM,gBAAgB,CAAA;AAEvB;;;;;;;;;;GAUG;AACH,MAAM,2BAA2B,GAAG,CAAC,GAAW,EAAsB,EAAE;IACtE,IAAI,MAAW,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACvB,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,OAAO,CAAA;IAC/C,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,iBAAiB,GAAG,CAAC,GAAuB,EAAsB,EAAE;IACxE,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAA;IAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5B,6DAA6D;IAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACxD,OAAO,OAAO,KAAK,SAAS,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;AACjF,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAA;AAE3C;;;;;;;GAOG;AACH,MAAM,qBAAqB,GAAG,IAAI,CAAA;AAElC;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAS,EAAE;IAC/C,SAAS,CAAC,KAAK,EAAE,CAAA;AACnB,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,gBAAgB,GAAG,KAAK,EAAE,GAAW,EAA+B,EAAE;IAC1E,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IAEnD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAA;IAEvC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAA;QACzF,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,SAAS,CAAA;QAClC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QACjC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YAAE,OAAO,SAAS,CAAA;QACxD,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACvB,OAAO,GAAG,CAAA;IACZ,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,4EAA4E;QAC5E,qEAAqE;QACrE,wDAAwD;QACxD,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,YAAY,GAAG,CAAC,KAAc,EAAmC,EAAE;IACvE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACrD,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,OAAO,CACL,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAC7B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ;QACpC,OAAO,CAAC,CAAC,gBAAgB,KAAK,QAAQ,CACvC,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,QAAuD,EACvD,IAAqB,EACH,EAAE;IACpB,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAC9B,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,8EAA8E;QAC9E,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IAEvC,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAA;IAC3D,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAA;IAE9D,IAAI,aAAa,KAAK,SAAS,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QACjE,yEAAyE;QACzE,sEAAsE;QACtE,yEAAyE;QACzE,gEAAgE;QAChE,MAAM,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,2BAA2B,CAAC,EAAE;YACzE,OAAO,EACL,4EAA4E;gBAC5E,yEAAyE;gBACzE,uFAAuF;gBACvF,iFAAiF;SACpF,CAAC,CAAA;IACJ,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,mEAAmE;IACnE,MAAM,YAAY,GAAG,aAAa,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,aAAa,CAAA;IACrF,MAAM,oBAAoB,GAAG;QAC3B,2BAA2B,CAAC,MAAM,CAAC,cAAc,CAAC;QAClD,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC;KACnC,CAAA;IACD,MAAM,cAAc,GAClB,eAAe,KAAK,SAAS,IAAI,oBAAoB,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;IACjF,IAAI,CAAC,YAAY,IAAI,CAAC,cAAc;QAAE,OAAO,KAAK,CAAA;IAElD,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,cAAc,CAAC;QAAE,OAAO,KAAK,CAAA;IAEjE,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;IACzD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAA;IAEtB,MAAM,SAAS,GACb,MAAM,CAAC,gBAAgB,KAAK,GAAG;QAC7B,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,MAAM,CAAC,gBAAgB,KAAK,GAAG;YAC/B,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,SAAS,CAAA;IACjB,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IAE5B,IAAI,SAAiB,CAAA;IACrB,IAAI,CAAC;QACH,SAAS,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAA;IAC7C,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,kFAAkF;QAClF,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,eAAuB,CAAA;IAC3B,IAAI,CAAC;QACH,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IAC3D,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,oEAAoE;QACpE,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAE9C,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;QACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;QACxC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;QAClC,QAAQ,CAAC,GAAG,EAAE,CAAA;QACd,OAAO,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,CAAA;IACpD,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,yFAAyF;QACzF,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,CACzB,IAA2C,EACR,EAAE;IACrC,MAAM,GAAG,GAAsC,EAAE,CAAA;IACjD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;gBAAE,SAAQ;YAC7E,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAA;YAClC,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,CAAA;YAC3B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAA;YACtB,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;YACxB,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAA;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,CAAA;IAC7B,IAAI,EAAE,EAAE,CAAC;QACP,IAAI,OAAO,EAAE,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;YAAE,GAAG,CAAC,OAAO,GAAG,EAAE,CAAC,OAAO,CAAA;QACzF,IAAI,OAAO,EAAE,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,SAAS;YACrE,GAAG,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,SAAS,CAAA;QAClC,IAAI,OAAO,EAAE,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,aAAa,CAAC,KAAK,SAAS;YACtE,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,SAAS,CAAA;QACnC,IAAI,OAAO,EAAE,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS;YACnE,GAAG,CAAC,UAAU,GAAG,EAAE,CAAC,UAAU,CAAA;IAClC,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EACtC,QAAuD,EACvD,IAA+C,EACxB,EAAE;IACzB,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,6CAA6C,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAClF,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;IACjF,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,0BAA0B,IAAI,MAAM,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;QAC5F,MAAM,OAAO,GAAsC,EAAE,CAAA;QACrD,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;YACzC,OAAO,CAAC,qBAAqB,CAAC,GAAG,MAAM,CAAC,YAAY,CAAA;QACtD,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,SAAS;YACpB,IAAI,EAAE,EAAE;YACR,EAAE,EAAE,EAAE;YACN,OAAO,EAAE,SAAS,MAAM,CAAC,IAAI,EAAE;YAC/B,OAAO;YACP,UAAU,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;SACvC,CAAA;IACH,CAAC;IAED,IAAI,UAAyC,CAAA;IAC7C,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAkC,CAAA;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,uDAAuD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAC5F,CAAC;IACD,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC1E,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACzD,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAA;IAE9C,IAAI,OAAO,UAAU,CAAC,OAAO,KAAK,QAAQ,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5E,MAAM,GAAG,GAAG,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;QAC9C,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE;YAC3C,EAAE,EAAE,YAAY;YAChB,UAAU,EAAE,aAAa;SAC1B,CAAC,CAAA;QACF,IAAI,CAAC,KAAK,CAAC,SAAS;YAAE,KAAK,CAAC,SAAS,GAAG,YAAY,CAAA;QACpD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,2DAA2D;IAC3D,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAA;IAC9C,MAAM,OAAO,GAAG,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;IACnD,MAAM,mBAAmB,GAAG,eAAe,CAAC,EAAE,CAAC,SAAS,CAAC,CAAA;IACzD,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,CAAC,SAAS,CAAC,CAAA;IAC/C,MAAM,UAAU,GAAG,eAAe,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAA;IAE3F,MAAM,KAAK,GAAiB;QAC1B,EAAE,EAAE,YAAY;QAChB,IAAI,EACF,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QAC7F,EAAE,EACA,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC;YACtC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE;YACf,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;gBAC1C,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE;gBACrC,CAAC,CAAC,EAAE;QACV,OAAO,EAAE,OAAO,EAAE,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;QACzD,OAAO;QACP,UAAU,EAAE,aAAa;KAC1B,CAAA;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAA;IACtE,IAAI,mBAAmB;QAAE,KAAK,CAAC,SAAS,GAAG,mBAAmB,CAAA;;QACzD,KAAK,CAAC,SAAS,GAAG,YAAY,CAAA;IACnC,IAAI,SAAS;QAAE,KAAK,CAAC,SAAS,GAAG,SAAS,CAAA;IAC1C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,UAAU,GAAG,UAAU,CAAA;IAExD,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,KAAK,EAC1B,KAAmB,EACnB,KAAwB,EACU,EAAE;IACpC,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IACjF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,wHAAwH,CACzH,CAAA;IACH,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,OAAO,KAAK,CAAC,OAAO,EAAE,CAAA;IAEvD,MAAM,gBAAgB,GAA2B,EAAE,CAAA;IACnD,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,gBAAgB,CAAC,aAAa,CAAC,GAAG,IAAI,KAAK,CAAC,SAAS,GAAG,CAAA;QACxD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC1D,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QAC1B,gBAAgB,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACrE,CAAC;IAED,MAAM,OAAO,GAA2B;QACtC,GAAG,gBAAgB;QACnB,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;KACzB,CAAA;IAED,MAAM,OAAO,GAAG;QACd,IAAI,EAAE,WAAW;QACjB,EAAE,EAAE,KAAK,CAAC,IAAI;QACd,OAAO;QACP,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;YACnD,CAAC,CAAC;gBACE,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAyB,EAAE,EAAE,CAAC,CAAC;oBACjE,QAAQ,EAAE,CAAC,CAAC,IAAI;oBAChB,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC;oBACxC,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC3D,CAAC,CAAC;aACJ;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAA;IAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAyC,CAAC,CAAA;IAExE,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE;KAC3B,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,GAAY,EAAE,CAAC,IAAI,CAAA;AAEhD;;;GAGG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAyB;IAC5C,mBAAmB;IACnB,eAAe;IACf,OAAO;IACP,aAAa;CACd,CAAA"}

package/dist/secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAG7D,qEAAqE;AACrE,eAAO,MAAM,iCAAiC,EAAE,gBAAgB,EAuC/D,CAAA"}
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAG7D,qEAAqE;AACrE,eAAO,MAAM,iCAAiC,EAAE,gBAAgB,EA+C/D,CAAA"}

package/dist/secrets.js

@@ -34,11 +34,18 @@ export const emailsInboundSesSecretDefinitions = [
     },
     {
         key: 'AWS_SES_INBOUND_TOPIC_ARN',
-        description: 'SES inbound SNS topic ARN — ARN of the SNS topic your SES receipt rule publishes inbound mail to.',
+        description: 'SES inbound SNS topic ARN — ARN of the SNS topic your SES receipt rule publishes inbound mail to. One of this or AWS_SES_INBOUND_ACCOUNT_ID must be set; inbound webhook verification fails closed without an origin pin.',
         helpUrl: 'https://console.aws.amazon.com/ses/',
         required: false,
         example: 'arn:aws:sns:us-east-1:123456789012:ses-inbound',
     },
+    {
+        key: 'AWS_SES_INBOUND_ACCOUNT_ID',
+        description: 'SES inbound AWS account id — Your 12-digit AWS account id; SNS notifications published by any other AWS account are rejected. One of this or AWS_SES_INBOUND_TOPIC_ARN must be set; inbound webhook verification fails closed without an origin pin.',
+        helpUrl: 'https://console.aws.amazon.com/iam/',
+        required: false,
+        example: '123456789012',
+    },
     {
         key: 'AWS_SNS_SIGNING_CERT_HOSTNAME_SUFFIXES',
         description: 'SNS signing-cert hostname allowlist — Comma-separated hostname suffixes allowed for SNS signature certificates; the default (.amazonaws.com) is fine.',

package/dist/secrets.js.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,qEAAqE;AACrE,MAAM,CAAC,MAAM,iCAAiC,GAAuB;IACnE;QACE,GAAG,EAAE,mBAAmB;QACxB,WAAW,EACT,iIAAiI;QACnI,OAAO,EAAE,qCAAqC;QAC9C,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,SAAS;KACnB;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,WAAW,EACT,6FAA6F;QAC/F,OAAO,EAAE,qCAAqC;QAC9C,QAAQ,EAAE,IAAI;KACf;IACD;QACE,GAAG,EAAE,gBAAgB;QACrB,WAAW,EACT,kGAAkG;QACpG,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,WAAW;KACrB;IACD;QACE,GAAG,EAAE,2BAA2B;QAChC,WAAW,EACT,mGAAmG;QACrG,OAAO,EAAE,qCAAqC;QAC9C,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,gDAAgD;KAC1D;IACD;QACE,GAAG,EAAE,wCAAwC;QAC7C,WAAW,EACT,uJAAuJ;QACzJ,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,gBAAgB;QACzB,OAAO,EAAE,gBAAgB;KAC1B;CACF,CAAA;AAED,eAAe,CAAC,iCAAiC,CAAC,CAAA"}
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,qEAAqE;AACrE,MAAM,CAAC,MAAM,iCAAiC,GAAuB;IACnE;QACE,GAAG,EAAE,mBAAmB;QACxB,WAAW,EACT,iIAAiI;QACnI,OAAO,EAAE,qCAAqC;QAC9C,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,SAAS;KACnB;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,WAAW,EACT,6FAA6F;QAC/F,OAAO,EAAE,qCAAqC;QAC9C,QAAQ,EAAE,IAAI;KACf;IACD;QACE,GAAG,EAAE,gBAAgB;QACrB,WAAW,EACT,kGAAkG;QACpG,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,WAAW;KACrB;IACD;QACE,GAAG,EAAE,2BAA2B;QAChC,WAAW,EACT,2NAA2N;QAC7N,OAAO,EAAE,qCAAqC;QAC9C,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,gDAAgD;KAC1D;IACD;QACE,GAAG,EAAE,4BAA4B;QACjC,WAAW,EACT,sPAAsP;QACxP,OAAO,EAAE,qCAAqC;QAC9C,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,cAAc;KACxB;IACD;QACE,GAAG,EAAE,wCAAwC;QAC7C,WAAW,EACT,uJAAuJ;QACzJ,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,gBAAgB;QACzB,OAAO,EAAE,gBAAgB;KAC1B;CACF,CAAA;AAED,eAAe,CAAC,iCAAiC,CAAC,CAAA"}

package/dist/types.d.ts

@@ -28,7 +28,12 @@ export interface SnsNotificationPayload {
     Type: string;
     /** A unique UUID for the message. */
     MessageId: string;
-    /** The notification topic ARN. */
+    /**
+     * The notification topic ARN. Its account-id field is part of the
+     * SNS-signed canonical string, so after signature verification it is an
+     * attested publisher identity — the source used for
+     * `AWS_SES_INBOUND_ACCOUNT_ID` pinning.
+     */
     TopicArn?: string;
     /**
      * Subject line as supplied by the publisher. Optional for notifications.
@@ -42,7 +47,11 @@ export interface SnsNotificationPayload {
     SignatureVersion: string;
     /** Base64-encoded signature over the canonical string. */
     Signature: string;
-    /** URL of the X.509 PEM cert used to sign the message. */
+    /**
+     * URL of the X.509 PEM cert used to sign the message. Must be HTTPS on an
+     * allowlisted `*.amazonaws.com` host; a 12-digit account-id path segment,
+     * when present, participates in `AWS_SES_INBOUND_ACCOUNT_ID` pinning.
+     */
     SigningCertURL: string;
     /** Confirmation token (only on SubscriptionConfirmation messages). */
     Token?: string;
@@ -115,6 +124,17 @@ declare global {
              * `TopicArn` does not match are rejected.
              */
             AWS_SES_INBOUND_TOPIC_ARN?: string;
+            /**
+             * Optional AWS account id (12 digits). When set, notifications are
+             * accepted only when the publisher account matches — sourced from the
+             * 12-digit segment of the `SigningCertURL` path or the account field
+             * of the SNS-signed `TopicArn`. Together with
+             * `AWS_SES_INBOUND_TOPIC_ARN` this is the fail-closed origin pin: when
+             * NEITHER is configured, `verifySignature` throws a tagged
+             * configuration error instead of accepting any validly-signed SNS
+             * message (which would admit cross-account forgery).
+             */
+            AWS_SES_INBOUND_ACCOUNT_ID?: string;
         }
     }
 }

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,YAAY,EACV,YAAY,EACZ,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,8BAA8B,CAAA;AAErC;;;;;;;GAOG;AACH,eAAO,MAAM,kCAAkC,EAAE,SAAS,MAAM,EAAuB,CAAA;AAEvF;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAA;IAEZ,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAA;IAEjB,kCAAkC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAEjB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAEhB,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAA;IAEf,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAA;IAEjB,uEAAuE;IACvE,gBAAgB,EAAE,MAAM,CAAA;IAExB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAA;IAEjB,0DAA0D;IAC1D,cAAc,EAAE,MAAM,CAAA;IAEtB,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAA;IAEd,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,6BAA6B;IAC5C,gEAAgE;IAChE,gBAAgB,EAAE,MAAM,CAAA;IAExB,4CAA4C;IAC5C,IAAI,EAAE;QACJ,8CAA8C;QAC9C,SAAS,EAAE,MAAM,CAAA;QACjB,gCAAgC;QAChC,MAAM,EAAE,MAAM,CAAA;QACd,+BAA+B;QAC/B,SAAS,EAAE,MAAM,CAAA;QACjB,+BAA+B;QAC/B,WAAW,EAAE,MAAM,EAAE,CAAA;QACrB,oDAAoD;QACpD,aAAa,CAAC,EAAE;YACd,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;YACf,EAAE,CAAC,EAAE,MAAM,EAAE,CAAA;YACb,EAAE,CAAC,EAAE,MAAM,EAAE,CAAA;YACb,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;YACd,OAAO,CAAC,EAAE,MAAM,CAAA;YAChB,SAAS,CAAC,EAAE,MAAM,CAAA;YAClB,SAAS,CAAC,EAAE,MAAM,CAAA;YAClB,UAAU,CAAC,EAAE,MAAM,CAAA;SACpB,CAAA;QACD;;WAEG;QACH,OAAO,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KACjD,CAAA;IAED;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,OAAO,CAAC,MAAM,CAAC;IAEb,UAAU,MAAM,CAAC;QACf;;;;WAIG;QACH,UAAiB,UAAU;YACzB;;;eAGG;YACH,sCAAsC,CAAC,EAAE,MAAM,CAAA;YAE/C;;;eAGG;YACH,yBAAyB,CAAC,EAAE,MAAM,CAAA;SACnC;KACF;CACF"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,YAAY,EACV,YAAY,EACZ,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,8BAA8B,CAAA;AAErC;;;;;;;GAOG;AACH,eAAO,MAAM,kCAAkC,EAAE,SAAS,MAAM,EAAuB,CAAA;AAEvF;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAA;IAEZ,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAA;IAEjB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IAEjB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAEhB,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAA;IAEf,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAA;IAEjB,uEAAuE;IACvE,gBAAgB,EAAE,MAAM,CAAA;IAExB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAA;IAEjB;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAA;IAEtB,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAA;IAEd,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,CAAA;IAErB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,6BAA6B;IAC5C,gEAAgE;IAChE,gBAAgB,EAAE,MAAM,CAAA;IAExB,4CAA4C;IAC5C,IAAI,EAAE;QACJ,8CAA8C;QAC9C,SAAS,EAAE,MAAM,CAAA;QACjB,gCAAgC;QAChC,MAAM,EAAE,MAAM,CAAA;QACd,+BAA+B;QAC/B,SAAS,EAAE,MAAM,CAAA;QACjB,+BAA+B;QAC/B,WAAW,EAAE,MAAM,EAAE,CAAA;QACrB,oDAAoD;QACpD,aAAa,CAAC,EAAE;YACd,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;YACf,EAAE,CAAC,EAAE,MAAM,EAAE,CAAA;YACb,EAAE,CAAC,EAAE,MAAM,EAAE,CAAA;YACb,GAAG,CAAC,EAAE,MAAM,EAAE,CAAA;YACd,OAAO,CAAC,EAAE,MAAM,CAAA;YAChB,SAAS,CAAC,EAAE,MAAM,CAAA;YAClB,SAAS,CAAC,EAAE,MAAM,CAAA;YAClB,UAAU,CAAC,EAAE,MAAM,CAAA;SACpB,CAAA;QACD;;WAEG;QACH,OAAO,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KACjD,CAAA;IAED;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,OAAO,CAAC,MAAM,CAAC;IAEb,UAAU,MAAM,CAAC;QACf;;;;WAIG;QACH,UAAiB,UAAU;YACzB;;;eAGG;YACH,sCAAsC,CAAC,EAAE,MAAM,CAAA;YAE/C;;;eAGG;YACH,yBAAyB,CAAC,EAAE,MAAM,CAAA;YAElC;;;;;;;;;eASG;YACH,0BAA0B,CAAC,EAAE,MAAM,CAAA;SACpC;KACF;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@molecule/api-emails-inbound-ses",
-  "version": "1.0.2",
+  "version": "1.1.1",
   "description": "AWS SES inbound email provider — parses SNS notification payloads carrying SES inbound messages into normalized InboundEmail.",
   "type": "module",
   "main": "dist/index.js",
@@ -34,8 +34,8 @@
     "mailparser": "3.9.28"
   },
   "devDependencies": {
-    "@molecule/api-emails": "1.0.1",
-    "@molecule/api-emails-inbound": "1.0.1",
+    "@molecule/api-emails": "1.0.2",
+    "@molecule/api-emails-inbound": "1.0.2",
     "@types/mailparser": "3.4.6",
     "@types/node": "26.1.2",
     "typescript": "6.0.3",
@@ -51,7 +51,7 @@
     "url": "https://github.com/molecule-dev/molecule.git",
     "directory": "packages/api/bonds/emails-inbound/ses"
   },
-  "homepage": "https://github.com/molecule-dev/molecule/tree/main/packages/api/bonds/emails-inbound/ses",
+  "homepage": "https://www.molecule.dev/packages/api-emails-inbound-ses",
   "bugs": "https://github.com/molecule-dev/molecule/issues",
   "publishConfig": {
     "access": "public"