@rapidmx/activesync-plugin 1.0.0-beta.2

package/dist/lib/commands/PingCommand.js

@@ -0,0 +1,145 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { createClient } from "redis";
+import { ObjectDecorators } from "@rapidrest/core";
+import { ACLAction, ACLUtils } from "@rapidrest/service-core";
+import { WbxmlCodePage } from "../codec/WbxmlCodePages.js";
+import { childText, element, findChild, findChildren, textElement } from "../codec/WbxmlElement.js";
+const { Config, Inject } = ObjectDecorators;
+/** MS-ASCMD `Ping` `Status` codes this pragmatic subset distinguishes - not the full enumeration the real
+ * spec defines (e.g. it also has codes for "too many folders", "folder hierarchy changed", etc.), matching
+ * this library's "pragmatic subset, not full fidelity" precedent elsewhere. */
+const STATUS_NO_CHANGES = "1";
+const STATUS_CHANGES_FOUND = "2";
+const STATUS_MISSING_PARAMETERS = "3";
+/**
+ * Handles EAS `Ping`: a long-poll HTTP request that blocks for up to `HeartbeatInterval` seconds waiting for a
+ * change in any of the client-specified folders, then reports which (if any) actually changed. No websocket
+ * needed - subscribes a plain, request-scoped Redis client (the same construction `BasePushRoute.connect()`
+ * uses, minus its own per-socket bookkeeping this one-shot request doesn't need) directly to the requested
+ * `folderUid` channels. Every `Message`/`CalendarEvent`/etc. mutation already publishes to exactly these
+ * channels via `BaseScopedChildRoute.notify()`/`RepoUtils`'s own push - `Ping` needs no new publish call site
+ * of its own, only a subscriber.
+ *
+ * Requested folder uids are filtered down to only those the caller currently has `READ` on before subscribing -
+ * matching every other command's ownership check on a client-supplied id, since without it a device could
+ * long-poll indefinitely on any folder uid it happens to know (including one it used to have legitimate access
+ * to and no longer does) and learn purely from this channel when that other mailbox's data changes.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export class PingCommand {
+    constructor() {
+        this.command = "Ping";
+        this.minHeartbeatSeconds = 60;
+        this.maxHeartbeatSeconds = 1740;
+    }
+    async handle(ctx) {
+        if (!ctx.request) {
+            return this.statusResponse(STATUS_MISSING_PARAMETERS);
+        }
+        const foldersEl = findChild(ctx.request, "Folders");
+        const requestedFolderUids = foldersEl
+            ? findChildren(foldersEl, "Folder")
+                .map((folderEl) => childText(folderEl, "ServerId"))
+                .filter((uid) => !!uid)
+            : [];
+        if (requestedFolderUids.length === 0) {
+            return this.statusResponse(STATUS_MISSING_PARAMETERS);
+        }
+        // Every other command checks ownership before acting on a client-supplied folder id - `Ping` must too,
+        // or a device that once had a folder shared with it (and so learned its real uid) could keep watching
+        // that folder's live activity via this long-poll indefinitely, even after the share is later revoked.
+        // Filtered down to the permitted subset rather than failing the whole request: `Ping`'s wire response
+        // has no per-folder status to report a partial denial through, and a client legitimately re-sends the
+        // same folder list across requests regardless of access changes it has no way to know about yet.
+        const permitted = await Promise.all(requestedFolderUids.map((uid) => this.aclUtils.hasPermission(ctx.user, uid, ACLAction.READ)));
+        const folderUids = requestedFolderUids.filter((_uid, i) => permitted[i]);
+        if (folderUids.length === 0) {
+            return this.statusResponse(STATUS_MISSING_PARAMETERS);
+        }
+        const requestedSeconds = Number(childText(ctx.request, "HeartbeatInterval") ?? this.minHeartbeatSeconds);
+        const heartbeatSeconds = Math.min(Math.max(Number.isFinite(requestedSeconds) ? requestedSeconds : this.minHeartbeatSeconds, this.minHeartbeatSeconds), this.maxHeartbeatSeconds);
+        const changedFolderUids = await this.waitForChange(folderUids, heartbeatSeconds);
+        if (changedFolderUids.length === 0) {
+            return this.statusResponse(STATUS_NO_CHANGES);
+        }
+        return element(WbxmlCodePage.Ping, "Ping", [
+            textElement(WbxmlCodePage.Ping, "Status", STATUS_CHANGES_FOUND),
+            element(WbxmlCodePage.Ping, "Folders", changedFolderUids.map((uid) => textElement(WbxmlCodePage.Ping, "Folder", uid))),
+        ]);
+    }
+    statusResponse(status) {
+        return element(WbxmlCodePage.Ping, "Ping", [textElement(WbxmlCodePage.Ping, "Status", status)]);
+    }
+    /** Subscribes to `folderUids` and resolves with whichever of them published a change first, or `[]` if
+     * `timeoutSeconds` elapses with no publish. A missing `datastores:events` config (Redis pub/sub not set up
+     * for this deployment) fails open to "no changes" rather than blocking forever or throwing - `Ping` is a
+     * best-effort low-latency notification path, not the only way a client ever discovers new mail (it will
+     * eventually poll a real `Sync`/`FolderSync` regardless). */
+    async waitForChange(folderUids, timeoutSeconds) {
+        if (!this.redisConfig) {
+            return [];
+        }
+        const client = createClient({ url: this.redisConfig.url });
+        await client.connect();
+        try {
+            return await new Promise((resolve) => {
+                let settled = false;
+                const timer = setTimeout(() => {
+                    if (!settled) {
+                        settled = true;
+                        resolve([]);
+                    }
+                }, timeoutSeconds * 1000);
+                client
+                    .subscribe(folderUids, (_message, channel) => {
+                    if (!settled) {
+                        settled = true;
+                        clearTimeout(timer);
+                        resolve([channel]);
+                    }
+                })
+                    .catch(() => {
+                    if (!settled) {
+                        settled = true;
+                        clearTimeout(timer);
+                        resolve([]);
+                    }
+                });
+            });
+        }
+        finally {
+            await client.unsubscribe(folderUids).catch(() => undefined);
+            await client.disconnect().catch(() => undefined);
+        }
+    }
+}
+__decorate([
+    Config("datastores:events", null),
+    __metadata("design:type", Object)
+], PingCommand.prototype, "redisConfig", void 0);
+__decorate([
+    Config("mail:eas:ping_min_heartbeat_seconds", 60),
+    __metadata("design:type", Number)
+], PingCommand.prototype, "minHeartbeatSeconds", void 0);
+__decorate([
+    Config("mail:eas:ping_max_heartbeat_seconds", 1740),
+    __metadata("design:type", Number)
+], PingCommand.prototype, "maxHeartbeatSeconds", void 0);
+__decorate([
+    Inject(ACLUtils),
+    __metadata("design:type", ACLUtils)
+], PingCommand.prototype, "aclUtils", void 0);
+//# sourceMappingURL=PingCommand.js.map

package/dist/lib/commands/PingCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PingCommand.js","sourceRoot":"","sources":["../../../src/commands/PingCommand.ts"],"names":[],"mappings":";;;;;;;;;AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,EAAE,YAAY,EAAwB,MAAM,OAAO,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAqB,MAAM,0BAA0B,CAAC;AAEvH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC;AAE5C;;+EAE+E;AAC/E,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAEtC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,WAAW;IAAxB;QACoB,YAAO,GAAG,MAAM,CAAC;QAUzB,wBAAmB,GAAW,EAAE,CAAC;QAGjC,wBAAmB,GAAW,IAAI,CAAC;IAsG/C,CAAC;IAjGU,KAAK,CAAC,MAAM,CAAC,GAAsB;QACtC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,cAAc,CAAC,yBAAyB,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,mBAAmB,GAAa,SAAS;YAC3C,CAAC,CAAC,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC;iBAC5B,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;iBAClD,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAC5C,CAAC,CAAC,EAAE,CAAC;QACT,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,cAAc,CAAC,yBAAyB,CAAC,CAAC;QAC1D,CAAC;QAED,uGAAuG;QACvG,sGAAsG;QACtG,sGAAsG;QACtG,sGAAsG;QACtG,sGAAsG;QACtG,iGAAiG;QACjG,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,mBAAmB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,QAAS,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAChG,CAAC;QACF,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,cAAc,CAAC,yBAAyB,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,gBAAgB,GAAW,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,mBAAmB,CAAC,IAAI,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACjH,MAAM,gBAAgB,GAAW,IAAI,CAAC,GAAG,CACrC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,CAAC,EACnH,IAAI,CAAC,mBAAmB,CAC3B,CAAC;QAEF,MAAM,iBAAiB,GAAa,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;QAC3F,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE;YACvC,WAAW,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,oBAAoB,CAAC;YAC/D,OAAO,CACH,aAAa,CAAC,IAAI,EAClB,SAAS,EACT,iBAAiB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CACjF;SACJ,CAAC,CAAC;IACP,CAAC;IAEO,cAAc,CAAC,MAAc;QACjC,OAAO,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACpG,CAAC;IAED;;;;iEAI6D;IACrD,KAAK,CAAC,aAAa,CAAC,UAAoB,EAAE,cAAsB;QACpE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAoB,YAAY,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5E,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,IAAI,CAAC;YACD,OAAO,MAAM,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,EAAE;gBAC3C,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;wBACX,OAAO,GAAG,IAAI,CAAC;wBACf,OAAO,CAAC,EAAE,CAAC,CAAC;oBAChB,CAAC;gBACL,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC,CAAC;gBAE1B,MAAM;qBACD,SAAS,CAAC,UAAU,EAAE,CAAC,QAAgB,EAAE,OAAe,EAAE,EAAE;oBACzD,IAAI,CAAC,OAAO,EAAE,CAAC;wBACX,OAAO,GAAG,IAAI,CAAC;wBACf,YAAY,CAAC,KAAK,CAAC,CAAC;wBACpB,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;oBACvB,CAAC;gBACL,CAAC,CAAC;qBACD,KAAK,CAAC,GAAG,EAAE;oBACR,IAAI,CAAC,OAAO,EAAE,CAAC;wBACX,OAAO,GAAG,IAAI,CAAC;wBACf,YAAY,CAAC,KAAK,CAAC,CAAC;wBACpB,OAAO,CAAC,EAAE,CAAC,CAAC;oBAChB,CAAC;gBACL,CAAC,CAAC,CAAC;YACX,CAAC,CAAC,CAAC;QACP,CAAC;gBAAS,CAAC;YACP,MAAM,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5D,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACrD,CAAC;IACL,CAAC;CACJ;AA5GW;IADP,MAAM,CAAC,mBAAmB,EAAE,IAAI,CAAC;;gDACT;AAGjB;IADP,MAAM,CAAC,qCAAqC,EAAE,EAAE,CAAC;;wDACT;AAGjC;IADP,MAAM,CAAC,qCAAqC,EAAE,IAAI,CAAC;;wDACT;AAGnC;IADP,MAAM,CAAC,QAAQ,CAAC;8BACE,QAAQ;6CAAC"}

package/dist/lib/commands/ProvisionCommand.js

@@ -0,0 +1,164 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import * as crypto from "crypto";
+import { ObjectDecorators } from "@rapidrest/core";
+import { WbxmlCodePage } from "../codec/WbxmlCodePages.js";
+import { childText, element, findChild, textElement } from "../codec/WbxmlElement.js";
+import { persistDeviceSyncState } from "../EasSyncKeyUtils.js";
+const { Config } = ObjectDecorators;
+const DEFAULT_POLICY_TYPE = "MS-EAS-Provisioning-WBXML";
+/**
+ * Handles the two-request EAS `Provision` handshake (MS-ASPROV) every client must complete before any other
+ * command is honored (see `BaseEasRoute`'s provisioning gate), plus the three-step `RemoteWipe` sub-flow that
+ * rides the same command.
+ *
+ * **Policy issuance/enforcement**: the password/encryption requirements sent back in request 1's policy
+ * document are sourced from `@Config("mail:eas:provision:*")` (defaults below are permissive but not
+ * `0`/`false` across the board, unlike the old hardcoded document) - a deployment can tighten them without
+ * code changes. Enforcement itself is honest but shallow: request 2 must carry back `Status: 1` on its own
+ * `Policy` (a device that reports it could *not* apply the policy, or omits `Status` entirely, is rejected
+ * without provisioning) - this library does not itself verify the device's actual password/encryption state
+ * beyond trusting that self-reported status, matching MS-ASPROV's own protocol design (the wire protocol has
+ * no way for the server to inspect device state directly either).
+ *
+ * - **Request 1** (no `PolicyKey` in the body): mint a new policy key, store it on `DeviceSyncState` (not yet
+ * provisioned), and send back the policy document under that key. If a `RemoteWipe` was requested for this
+ * device (`DeviceSyncState.remoteWipeRequested`, set by an admin - see the remote-wipe route), skip normal
+ * policy issuance entirely and send the `RemoteWipe` directive instead.
+ * - **Request 2** (client echoes the `PolicyKey` back, acknowledging the policy): if the key matches what was
+ * minted in request 1 *and* the client's own `Status` is `1`, mark the device provisioned and re-confirm the
+ * same key; anything else (a stale/replayed key, a device that never actually saw request 1's response, or a
+ * device reporting it could not comply) is rejected without provisioning.
+ * - **RemoteWipe acknowledgement**: after wiping itself, a device sends a bare `<Provision><RemoteWipe>
+ * <Status>1</Status></RemoteWipe></Provision>` (no `Policies`). Detected first, ahead of the normal
+ * issue/acknowledge branching. Clears `remoteWipeRequested` and stamps `remoteWipeAcknowledgedAt` for audit,
+ * but deliberately leaves `provisioned` untouched (`false`, from when the wipe was requested) - the device
+ * must complete a genuine fresh Provision handshake to re-add the account, it does not fall straight back into
+ * "provisioned". `remoteWipeAccountOnly` is recorded for admin audit only; the wire directive sent to the
+ * device is identical either way (a real "wipe just this account's data" vs. "wipe the whole device"
+ * distinction would require an MDM-capable client extension this library doesn't implement).
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export class ProvisionCommand {
+    constructor() {
+        this.command = "Provision";
+        this.passwordEnabled = true;
+        this.minPasswordLength = 4;
+        this.maxFailedAttempts = 8;
+        this.requireDeviceEncryption = true;
+        this.allowSimplePassword = false;
+    }
+    async handle(ctx) {
+        if (ctx.request && findChild(ctx.request, "RemoteWipe")) {
+            return await this.acknowledgeRemoteWipe(ctx);
+        }
+        const policiesEl = ctx.request ? findChild(ctx.request, "Policies") : undefined;
+        const policyEl = policiesEl ? findChild(policiesEl, "Policy") : undefined;
+        const policyType = (policyEl ? childText(policyEl, "PolicyType") : undefined) ?? DEFAULT_POLICY_TYPE;
+        const clientPolicyKey = policyEl ? childText(policyEl, "PolicyKey") : undefined;
+        const clientStatus = policyEl ? childText(policyEl, "Status") : undefined;
+        if (!clientPolicyKey) {
+            return await this.issuePolicy(ctx, policyType);
+        }
+        return await this.acknowledgePolicy(ctx, policyType, clientPolicyKey, clientStatus);
+    }
+    /** Request 1: mint and store a new policy key, send the policy document - or, if a remote wipe is
+     * pending for this device, the `RemoteWipe` directive instead. */
+    async issuePolicy(ctx, policyType) {
+        if (ctx.deviceSyncState.remoteWipeRequested) {
+            return element(WbxmlCodePage.Provision, "Provision", [
+                textElement(WbxmlCodePage.Provision, "Status", "1"),
+                element(WbxmlCodePage.Provision, "RemoteWipe", [textElement(WbxmlCodePage.Provision, "Status", "1")]),
+            ]);
+        }
+        const policyKey = crypto.randomBytes(8).toString("hex");
+        await this.persist(ctx, { policyKey, provisioned: false });
+        return element(WbxmlCodePage.Provision, "Provision", [
+            textElement(WbxmlCodePage.Provision, "Status", "1"),
+            element(WbxmlCodePage.Provision, "Policies", [
+                element(WbxmlCodePage.Provision, "Policy", [
+                    textElement(WbxmlCodePage.Provision, "PolicyType", policyType),
+                    textElement(WbxmlCodePage.Provision, "Status", "1"),
+                    textElement(WbxmlCodePage.Provision, "PolicyKey", policyKey),
+                    element(WbxmlCodePage.Provision, "Data", [
+                        element(WbxmlCodePage.Provision, "EASProvisionDoc", [
+                            textElement(WbxmlCodePage.Provision, "DevicePasswordEnabled", this.passwordEnabled ? "1" : "0"),
+                            textElement(WbxmlCodePage.Provision, "MinDevicePasswordLength", String(this.minPasswordLength)),
+                            textElement(WbxmlCodePage.Provision, "MaxDevicePasswordFailedAttempts", String(this.maxFailedAttempts)),
+                            textElement(WbxmlCodePage.Provision, "AllowSimpleDevicePassword", this.allowSimplePassword ? "1" : "0"),
+                            textElement(WbxmlCodePage.Provision, "RequireDeviceEncryption", this.requireDeviceEncryption ? "1" : "0"),
+                            textElement(WbxmlCodePage.Provision, "AttachmentsEnabled", "1"),
+                        ]),
+                    ]),
+                ]),
+            ]),
+        ]);
+    }
+    /** Request 2: the client acknowledges the policy key it was handed in request 1, self-reporting whether
+     * it actually applied the policy via its own `Status`. */
+    async acknowledgePolicy(ctx, policyType, clientPolicyKey, clientStatus) {
+        if (clientPolicyKey !== ctx.deviceSyncState.policyKey || clientStatus !== "1") {
+            // Status 2 ("protocol error" per MS-ASPROV) - an approximation, not a byte-exact enumeration of
+            // every real status code MS-ASPROV defines; this pragmatic subset only distinguishes success from
+            // "something is wrong, start over" (see this class's own doc comment on scope), and deliberately
+            // does not distinguish a key mismatch from a device self-reporting non-compliance.
+            return element(WbxmlCodePage.Provision, "Provision", [textElement(WbxmlCodePage.Provision, "Status", "2")]);
+        }
+        await this.persist(ctx, { policyKey: clientPolicyKey, provisioned: true });
+        return element(WbxmlCodePage.Provision, "Provision", [
+            textElement(WbxmlCodePage.Provision, "Status", "1"),
+            element(WbxmlCodePage.Provision, "Policies", [
+                element(WbxmlCodePage.Provision, "Policy", [
+                    textElement(WbxmlCodePage.Provision, "PolicyType", policyType),
+                    textElement(WbxmlCodePage.Provision, "Status", "1"),
+                    textElement(WbxmlCodePage.Provision, "PolicyKey", clientPolicyKey),
+                ]),
+            ]),
+        ]);
+    }
+    /** The device has wiped itself and is acknowledging - clear the pending flag but leave `provisioned`
+     * alone (still `false`, from when the wipe was requested) so a genuine re-provision is required. */
+    async acknowledgeRemoteWipe(ctx) {
+        await persistDeviceSyncState(ctx.deviceSyncState, ctx.deviceSyncStateRepo, {
+            remoteWipeRequested: false,
+            remoteWipeAcknowledgedAt: new Date(),
+        });
+        return element(WbxmlCodePage.Provision, "Provision", [textElement(WbxmlCodePage.Provision, "Status", "1")]);
+    }
+    async persist(ctx, changes) {
+        await persistDeviceSyncState(ctx.deviceSyncState, ctx.deviceSyncStateRepo, changes);
+    }
+}
+__decorate([
+    Config("mail:eas:provision:password_enabled", true),
+    __metadata("design:type", Boolean)
+], ProvisionCommand.prototype, "passwordEnabled", void 0);
+__decorate([
+    Config("mail:eas:provision:min_password_length", 4),
+    __metadata("design:type", Number)
+], ProvisionCommand.prototype, "minPasswordLength", void 0);
+__decorate([
+    Config("mail:eas:provision:max_failed_attempts", 8),
+    __metadata("design:type", Number)
+], ProvisionCommand.prototype, "maxFailedAttempts", void 0);
+__decorate([
+    Config("mail:eas:provision:require_device_encryption", true),
+    __metadata("design:type", Boolean)
+], ProvisionCommand.prototype, "requireDeviceEncryption", void 0);
+__decorate([
+    Config("mail:eas:provision:allow_simple_password", false),
+    __metadata("design:type", Boolean)
+], ProvisionCommand.prototype, "allowSimplePassword", void 0);
+//# sourceMappingURL=ProvisionCommand.js.map

package/dist/lib/commands/ProvisionCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProvisionCommand.js","sourceRoot":"","sources":["../../../src/commands/ProvisionCommand.ts"],"names":[],"mappings":";;;;;;;;;AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAqB,MAAM,0BAA0B,CAAC;AACzG,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE/D,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC;AAEpC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,OAAO,gBAAgB;IAA7B;QACoB,YAAO,GAAG,WAAW,CAAC;QAG9B,oBAAe,GAAY,IAAI,CAAC;QAGhC,sBAAiB,GAAW,CAAC,CAAC;QAG9B,sBAAiB,GAAW,CAAC,CAAC;QAG9B,4BAAuB,GAAY,IAAI,CAAC;QAGxC,wBAAmB,GAAY,KAAK,CAAC;IA6GjD,CAAC;IA3GU,KAAK,CAAC,MAAM,CAAC,GAAsB;QACtC,IAAI,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;YACtD,OAAO,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,MAAM,UAAU,GAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,mBAAmB,CAAC;QAC7G,MAAM,eAAe,GAAuB,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpG,MAAM,YAAY,GAAuB,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE9F,IAAI,CAAC,eAAe,EAAE,CAAC;YACnB,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,UAAU,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;IACxF,CAAC;IAED;sEACkE;IAC1D,KAAK,CAAC,WAAW,CAAC,GAAsB,EAAE,UAAkB;QAChE,IAAI,GAAG,CAAC,eAAe,CAAC,mBAAmB,EAAE,CAAC;YAC1C,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,WAAW,EAAE;gBACjD,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC;gBACnD,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,YAAY,EAAE,CAAC,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;aACxG,CAAC,CAAC;QACP,CAAC;QAED,MAAM,SAAS,GAAW,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChE,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAE3D,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,WAAW,EAAE;YACjD,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC;YACnD,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,UAAU,EAAE;gBACzC,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE;oBACvC,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,YAAY,EAAE,UAAU,CAAC;oBAC9D,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC;oBACnD,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC;oBAC5D,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE;wBACrC,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,iBAAiB,EAAE;4BAChD,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,uBAAuB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;4BAC/F,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,yBAAyB,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;4BAC/F,WAAW,CACP,aAAa,CAAC,SAAS,EACvB,iCAAiC,EACjC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CACjC;4BACD,WAAW,CACP,aAAa,CAAC,SAAS,EACvB,2BAA2B,EAC3B,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CACvC;4BACD,WAAW,CACP,aAAa,CAAC,SAAS,EACvB,yBAAyB,EACzB,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAC3C;4BACD,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,oBAAoB,EAAE,GAAG,CAAC;yBAClE,CAAC;qBACL,CAAC;iBACL,CAAC;aACL,CAAC;SACL,CAAC,CAAC;IACP,CAAC;IAED;8DAC0D;IAClD,KAAK,CAAC,iBAAiB,CAC3B,GAAsB,EACtB,UAAkB,EAClB,eAAuB,EACvB,YAAgC;QAEhC,IAAI,eAAe,KAAK,GAAG,CAAC,eAAe,CAAC,SAAS,IAAI,YAAY,KAAK,GAAG,EAAE,CAAC;YAC5E,gGAAgG;YAChG,kGAAkG;YAClG,iGAAiG;YACjG,mFAAmF;YACnF,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAChH,CAAC;QAED,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAE3E,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,WAAW,EAAE;YACjD,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC;YACnD,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,UAAU,EAAE;gBACzC,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE;oBACvC,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,YAAY,EAAE,UAAU,CAAC;oBAC9D,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC;oBACnD,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,WAAW,EAAE,eAAe,CAAC;iBACrE,CAAC;aACL,CAAC;SACL,CAAC,CAAC;IACP,CAAC;IAED;wGACoG;IAC5F,KAAK,CAAC,qBAAqB,CAAC,GAAsB;QACtD,MAAM,sBAAsB,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,mBAAmB,EAAE;YACvE,mBAAmB,EAAE,KAAK;YAC1B,wBAAwB,EAAE,IAAI,IAAI,EAAE;SACvC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAChH,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,GAAsB,EAAE,OAAoD;QAC9F,MAAM,sBAAsB,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IACxF,CAAC;CACJ;AAzHW;IADP,MAAM,CAAC,qCAAqC,EAAE,IAAI,CAAC;;yDACZ;AAGhC;IADP,MAAM,CAAC,wCAAwC,EAAE,CAAC,CAAC;;2DACd;AAG9B;IADP,MAAM,CAAC,wCAAwC,EAAE,CAAC,CAAC;;2DACd;AAG9B;IADP,MAAM,CAAC,8CAA8C,EAAE,IAAI,CAAC;;iEACb;AAGxC;IADP,MAAM,CAAC,0CAA0C,EAAE,KAAK,CAAC;;6DACb"}

package/dist/lib/commands/ResolveRecipientsCommand.js

@@ -0,0 +1,123 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { ObjectDecorators, StringUtils } from "@rapidrest/core";
+import { RepoUtils } from "@rapidrest/service-core";
+import { WbxmlCodePage } from "../codec/WbxmlCodePages.js";
+import { element, findChildren, textElement } from "../codec/WbxmlElement.js";
+const { Config, Init } = ObjectDecorators;
+/** A simple, deliberately permissive email-address shape check - just enough to distinguish "the client sent
+ * an address it already knows how to reach" from "the client sent a partial name/string that needs GAL
+ * lookup", not full RFC 5322 validation. */
+const LOOKS_LIKE_EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+/** [MS-ASCMD] `ResolveRecipients` per-`To` `Status` codes this pragmatic subset actually distinguishes: `1`
+ * success (at least one match, or the input already looked like a resolvable address), `4` no match found -
+ * an approximation, not a byte-exact enumeration of every real status code MS-ASCMD's `ResolveRecipients` page
+ * defines, matching `ProvisionCommand`'s own identical precedent for the same reasoning. */
+const STATUS_SUCCESS = "1";
+const STATUS_NOT_FOUND = "4";
+/**
+ * Handles EAS `ResolveRecipients`: resolves each `<To>` value (a display name, partial name, or address) the
+ * client is unsure how to reach against the mailbox's own `Contact` (GAL) store - the same substring-match
+ * approach `SearchCommand` uses for its own `Store Name="GAL"` lookups, duplicated rather than shared (small
+ * enough, and specific enough to each command's own surrounding logic, that extracting a shared utility for two
+ * call sites isn't worth a new cross-command dependency). Both use `RepoUtils`' `regex(...)` operator (not
+ * `like(...)`, which compiles a glob pattern under `@rapidrest/service-core` ^2.0 - anchored, and with no escape
+ * for a literal `*`/`?`): `StringUtils.escapeRegExp(value)` gives a genuine, unanchored literal-substring match
+ * with no residual wildcard ambiguity, matching the same fix already applied to the `mapi` plugin's own
+ * identical GAL-search gap.
+ *
+ * **Pragmatic subset**: no free-busy `Availability`, no S/MIME `Certificates`/`Options` handling at all - this
+ * command's real-world use is overwhelmingly enterprise S/MIME certificate lookup, which this library doesn't
+ * implement elsewhere either (`ComposeMailCommand` sends plain MIME, never signed/encrypted). A `<To>` value
+ * that already looks like an email address (`LOOKS_LIKE_EMAIL`) is echoed straight back as its own single
+ * exact match rather than searched for, matching a real client's own common case of resolving an address it
+ * already typed correctly.
+ *
+ * `contactClass` is supplied by the Mongo/SQL concrete subclasses.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export class ResolveRecipientsCommand {
+    constructor() {
+        this.command = "ResolveRecipients";
+        this.maxMatches = 10;
+    }
+    async init() {
+        this.contactRepo = await this._objectFactory.newInstance(RepoUtils, {
+            name: this.contactClass.name,
+            args: [this.contactClass],
+        });
+    }
+    async handle(ctx) {
+        const toEls = ctx.request ? findChildren(ctx.request, "To") : [];
+        const responses = [];
+        for (const toEl of toEls) {
+            const value = toEl.text ?? "";
+            responses.push(await this.resolveOne(ctx, value));
+        }
+        return element(WbxmlCodePage.ResolveRecipients, "ResolveRecipients", [
+            textElement(WbxmlCodePage.ResolveRecipients, "Status", "1"),
+            ...responses,
+        ]);
+    }
+    async resolveOne(ctx, value) {
+        if (LOOKS_LIKE_EMAIL.test(value)) {
+            return this.responseElement(value, STATUS_SUCCESS, [this.recipientElement(value, undefined)]);
+        }
+        const pattern = StringUtils.escapeRegExp(value);
+        const findOptions = { ignoreACL: true, limit: this.maxMatches };
+        const perField = await Promise.all(["displayName", "givenName", "surname"].map((field) => this.contactRepo.find({ mailboxUid: ctx.mailboxUid, [field]: `regex(${pattern})` }, findOptions)));
+        const byUid = new Map();
+        for (const contact of perField.flat()) {
+            byUid.set(contact.uid, contact);
+        }
+        const matches = Array.from(byUid.values())
+            .filter((contact) => contact.emails[0])
+            .slice(0, this.maxMatches);
+        if (matches.length === 0) {
+            return this.responseElement(value, STATUS_NOT_FOUND, []);
+        }
+        return this.responseElement(value, STATUS_SUCCESS, matches.map((contact) => this.recipientElement(contact.emails[0].address, contact.displayName)));
+    }
+    recipientElement(address, displayName) {
+        return element(WbxmlCodePage.ResolveRecipients, "Recipient", [
+            textElement(WbxmlCodePage.ResolveRecipients, "Type", "1"),
+            ...(displayName ? [textElement(WbxmlCodePage.ResolveRecipients, "DisplayName", displayName)] : []),
+            textElement(WbxmlCodePage.ResolveRecipients, "EmailAddress", address),
+        ]);
+    }
+    responseElement(to, status, recipients) {
+        return element(WbxmlCodePage.ResolveRecipients, "Response", [
+            textElement(WbxmlCodePage.ResolveRecipients, "To", to),
+            textElement(WbxmlCodePage.ResolveRecipients, "Status", status),
+            ...(recipients.length > 0
+                ? [
+                    textElement(WbxmlCodePage.ResolveRecipients, "RecipientCount", String(recipients.length)),
+                    ...recipients,
+                ]
+                : []),
+        ]);
+    }
+}
+__decorate([
+    Config("mail:eas:resolve_recipients_max_matches", 10),
+    __metadata("design:type", Number)
+], ResolveRecipientsCommand.prototype, "maxMatches", void 0);
+__decorate([
+    Init,
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], ResolveRecipientsCommand.prototype, "init", null);
+//# sourceMappingURL=ResolveRecipientsCommand.js.map

package/dist/lib/commands/ResolveRecipientsCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResolveRecipientsCommand.js","sourceRoot":"","sources":["../../../src/commands/ResolveRecipientsCommand.ts"],"names":[],"mappings":";;;;;;;;;AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,EAAiB,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEnE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAqB,MAAM,0BAA0B,CAAC;AAEjG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC;AAE1C;;4CAE4C;AAC5C,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAEtD;;;4FAG4F;AAC5F,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,OAAgB,wBAAwB;IAA9C;QACoB,YAAO,GAAG,mBAAmB,CAAC;QAKtC,eAAU,GAAW,EAAE,CAAC;IA+EpC,CAAC;IAvEgB,AAAN,KAAK,CAAC,IAAI;QACb,IAAI,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,cAAe,CAAC,WAAW,CAAC,SAAS,EAAE;YACjE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI;YAC5B,IAAI,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;SAC5B,CAAC,CAAC;IACP,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,GAAsB;QACtC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,SAAS,GAAmB,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;YAC9B,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,OAAO,CAAC,aAAa,CAAC,iBAAiB,EAAE,mBAAmB,EAAE;YACjE,WAAW,CAAC,aAAa,CAAC,iBAAiB,EAAE,QAAQ,EAAE,GAAG,CAAC;YAC3D,GAAG,SAAS;SACf,CAAC,CAAC;IACP,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,GAAsB,EAAE,KAAa;QAC1D,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;QAClG,CAAC;QAED,MAAM,OAAO,GAAG,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,WAAW,GAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;QACrE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,CAAC,aAAa,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAClD,IAAI,CAAC,WAAY,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,EAAE,SAAS,OAAO,GAAG,EAAS,EAAE,WAAW,CAAC,CAC3G,CACJ,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqC,CAAC;QAC3D,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YACpC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;aACrC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;aACtC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAE/B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,IAAI,CAAC,eAAe,CACvB,KAAK,EACL,cAAc,EACd,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAClG,CAAC;IACN,CAAC;IAEO,gBAAgB,CAAC,OAAe,EAAE,WAA+B;QACrE,OAAO,OAAO,CAAC,aAAa,CAAC,iBAAiB,EAAE,WAAW,EAAE;YACzD,WAAW,CAAC,aAAa,CAAC,iBAAiB,EAAE,MAAM,EAAE,GAAG,CAAC;YACzD,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,iBAAiB,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClG,WAAW,CAAC,aAAa,CAAC,iBAAiB,EAAE,cAAc,EAAE,OAAO,CAAC;SACxE,CAAC,CAAC;IACP,CAAC;IAEO,eAAe,CAAC,EAAU,EAAE,MAAc,EAAE,UAA0B;QAC1E,OAAO,OAAO,CAAC,aAAa,CAAC,iBAAiB,EAAE,UAAU,EAAE;YACxD,WAAW,CAAC,aAAa,CAAC,iBAAiB,EAAE,IAAI,EAAE,EAAE,CAAC;YACtD,WAAW,CAAC,aAAa,CAAC,iBAAiB,EAAE,QAAQ,EAAE,MAAM,CAAC;YAC9D,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;gBACrB,CAAC,CAAC;oBACI,WAAW,CAAC,aAAa,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;oBACzF,GAAG,UAAU;iBAChB;gBACH,CAAC,CAAC,EAAE,CAAC;SACZ,CAAC,CAAC;IACP,CAAC;CACJ;AA/EW;IADP,MAAM,CAAC,yCAAyC,EAAE,EAAE,CAAC;;4DACtB;AAQnB;IADZ,IAAI;;;;oDAMJ"}