@rapidmx/activesync 1.0.0-beta.0

package/dist/lib/commands/PingCommand.js

@@ -0,0 +1,145 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { createClient } from "redis";
+import { ObjectDecorators } from "@rapidrest/core";
+import { ACLAction, ACLUtils } from "@rapidrest/service-core";
+import { WbxmlCodePage } from "../codec/WbxmlCodePages.js";
+import { childText, element, findChild, findChildren, textElement } from "../codec/WbxmlElement.js";
+const { Config, Inject } = ObjectDecorators;
+/** MS-ASCMD `Ping` `Status` codes this pragmatic subset distinguishes - not the full enumeration the real
+ * spec defines (e.g. it also has codes for "too many folders", "folder hierarchy changed", etc.), matching
+ * this library's "pragmatic subset, not full fidelity" precedent elsewhere. */
+const STATUS_NO_CHANGES = "1";
+const STATUS_CHANGES_FOUND = "2";
+const STATUS_MISSING_PARAMETERS = "3";
+/**
+ * Handles EAS `Ping`: a long-poll HTTP request that blocks for up to `HeartbeatInterval` seconds waiting for a
+ * change in any of the client-specified folders, then reports which (if any) actually changed. No websocket
+ * needed - subscribes a plain, request-scoped Redis client (the same construction `BasePushRoute.connect()`
+ * uses, minus its own per-socket bookkeeping this one-shot request doesn't need) directly to the requested
+ * `folderUid` channels. Every `Message`/`CalendarEvent`/etc. mutation already publishes to exactly these
+ * channels via `BaseScopedChildRoute.notify()`/`RepoUtils`'s own push - `Ping` needs no new publish call site
+ * of its own, only a subscriber.
+ *
+ * Requested folder uids are filtered down to only those the caller currently has `READ` on before subscribing -
+ * matching every other command's ownership check on a client-supplied id, since without it a device could
+ * long-poll indefinitely on any folder uid it happens to know (including one it used to have legitimate access
+ * to and no longer does) and learn purely from this channel when that other mailbox's data changes.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export class PingCommand {
+    constructor() {
+        this.command = "Ping";
+        this.minHeartbeatSeconds = 60;
+        this.maxHeartbeatSeconds = 1740;
+    }
+    async handle(ctx) {
+        if (!ctx.request) {
+            return this.statusResponse(STATUS_MISSING_PARAMETERS);
+        }
+        const foldersEl = findChild(ctx.request, "Folders");
+        const requestedFolderUids = foldersEl
+            ? findChildren(foldersEl, "Folder")
+                .map((folderEl) => childText(folderEl, "ServerId"))
+                .filter((uid) => !!uid)
+            : [];
+        if (requestedFolderUids.length === 0) {
+            return this.statusResponse(STATUS_MISSING_PARAMETERS);
+        }
+        // Every other command checks ownership before acting on a client-supplied folder id - `Ping` must too,
+        // or a device that once had a folder shared with it (and so learned its real uid) could keep watching
+        // that folder's live activity via this long-poll indefinitely, even after the share is later revoked.
+        // Filtered down to the permitted subset rather than failing the whole request: `Ping`'s wire response
+        // has no per-folder status to report a partial denial through, and a client legitimately re-sends the
+        // same folder list across requests regardless of access changes it has no way to know about yet.
+        const permitted = await Promise.all(requestedFolderUids.map((uid) => this.aclUtils.hasPermission(ctx.user, uid, ACLAction.READ)));
+        const folderUids = requestedFolderUids.filter((_uid, i) => permitted[i]);
+        if (folderUids.length === 0) {
+            return this.statusResponse(STATUS_MISSING_PARAMETERS);
+        }
+        const requestedSeconds = Number(childText(ctx.request, "HeartbeatInterval") ?? this.minHeartbeatSeconds);
+        const heartbeatSeconds = Math.min(Math.max(Number.isFinite(requestedSeconds) ? requestedSeconds : this.minHeartbeatSeconds, this.minHeartbeatSeconds), this.maxHeartbeatSeconds);
+        const changedFolderUids = await this.waitForChange(folderUids, heartbeatSeconds);
+        if (changedFolderUids.length === 0) {
+            return this.statusResponse(STATUS_NO_CHANGES);
+        }
+        return element(WbxmlCodePage.Ping, "Ping", [
+            textElement(WbxmlCodePage.Ping, "Status", STATUS_CHANGES_FOUND),
+            element(WbxmlCodePage.Ping, "Folders", changedFolderUids.map((uid) => textElement(WbxmlCodePage.Ping, "Folder", uid))),
+        ]);
+    }
+    statusResponse(status) {
+        return element(WbxmlCodePage.Ping, "Ping", [textElement(WbxmlCodePage.Ping, "Status", status)]);
+    }
+    /** Subscribes to `folderUids` and resolves with whichever of them published a change first, or `[]` if
+     * `timeoutSeconds` elapses with no publish. A missing `datastores:events` config (Redis pub/sub not set up
+     * for this deployment) fails open to "no changes" rather than blocking forever or throwing - `Ping` is a
+     * best-effort low-latency notification path, not the only way a client ever discovers new mail (it will
+     * eventually poll a real `Sync`/`FolderSync` regardless). */
+    async waitForChange(folderUids, timeoutSeconds) {
+        if (!this.redisConfig) {
+            return [];
+        }
+        const client = createClient({ url: this.redisConfig.url });
+        await client.connect();
+        try {
+            return await new Promise((resolve) => {
+                let settled = false;
+                const timer = setTimeout(() => {
+                    if (!settled) {
+                        settled = true;
+                        resolve([]);
+                    }
+                }, timeoutSeconds * 1000);
+                client
+                    .subscribe(folderUids, (_message, channel) => {
+                    if (!settled) {
+                        settled = true;
+                        clearTimeout(timer);
+                        resolve([channel]);
+                    }
+                })
+                    .catch(() => {
+                    if (!settled) {
+                        settled = true;
+                        clearTimeout(timer);
+                        resolve([]);
+                    }
+                });
+            });
+        }
+        finally {
+            await client.unsubscribe(folderUids).catch(() => undefined);
+            await client.disconnect().catch(() => undefined);
+        }
+    }
+}
+__decorate([
+    Config("datastores:events", null),
+    __metadata("design:type", Object)
+], PingCommand.prototype, "redisConfig", void 0);
+__decorate([
+    Config("mail:eas:ping_min_heartbeat_seconds", 60),
+    __metadata("design:type", Number)
+], PingCommand.prototype, "minHeartbeatSeconds", void 0);
+__decorate([
+    Config("mail:eas:ping_max_heartbeat_seconds", 1740),
+    __metadata("design:type", Number)
+], PingCommand.prototype, "maxHeartbeatSeconds", void 0);
+__decorate([
+    Inject(ACLUtils),
+    __metadata("design:type", ACLUtils)
+], PingCommand.prototype, "aclUtils", void 0);
+//# sourceMappingURL=PingCommand.js.map

package/dist/lib/commands/PingCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PingCommand.js","sourceRoot":"","sources":["../../../src/commands/PingCommand.ts"],"names":[],"mappings":";;;;;;;;;AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,EAAE,YAAY,EAAwB,MAAM,OAAO,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAqB,MAAM,0BAA0B,CAAC;AAEvH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC;AAE5C;;+EAE+E;AAC/E,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACjC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAEtC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,WAAW;IAAxB;QACoB,YAAO,GAAG,MAAM,CAAC;QAUzB,wBAAmB,GAAW,EAAE,CAAC;QAGjC,wBAAmB,GAAW,IAAI,CAAC;IAsG/C,CAAC;IAjGU,KAAK,CAAC,MAAM,CAAC,GAAsB;QACtC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,cAAc,CAAC,yBAAyB,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,mBAAmB,GAAa,SAAS;YAC3C,CAAC,CAAC,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC;iBAC5B,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;iBAClD,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAC5C,CAAC,CAAC,EAAE,CAAC;QACT,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,cAAc,CAAC,yBAAyB,CAAC,CAAC;QAC1D,CAAC;QAED,uGAAuG;QACvG,sGAAsG;QACtG,sGAAsG;QACtG,sGAAsG;QACtG,sGAAsG;QACtG,iGAAiG;QACjG,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,mBAAmB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,QAAS,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAChG,CAAC;QACF,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,cAAc,CAAC,yBAAyB,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,gBAAgB,GAAW,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,mBAAmB,CAAC,IAAI,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACjH,MAAM,gBAAgB,GAAW,IAAI,CAAC,GAAG,CACrC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,CAAC,EACnH,IAAI,CAAC,mBAAmB,CAC3B,CAAC;QAEF,MAAM,iBAAiB,GAAa,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;QAC3F,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE;YACvC,WAAW,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,oBAAoB,CAAC;YAC/D,OAAO,CACH,aAAa,CAAC,IAAI,EAClB,SAAS,EACT,iBAAiB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CACjF;SACJ,CAAC,CAAC;IACP,CAAC;IAEO,cAAc,CAAC,MAAc;QACjC,OAAO,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACpG,CAAC;IAED;;;;iEAI6D;IACrD,KAAK,CAAC,aAAa,CAAC,UAAoB,EAAE,cAAsB;QACpE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAoB,YAAY,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5E,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,IAAI,CAAC;YACD,OAAO,MAAM,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,EAAE;gBAC3C,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;wBACX,OAAO,GAAG,IAAI,CAAC;wBACf,OAAO,CAAC,EAAE,CAAC,CAAC;oBAChB,CAAC;gBACL,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC,CAAC;gBAE1B,MAAM;qBACD,SAAS,CAAC,UAAU,EAAE,CAAC,QAAgB,EAAE,OAAe,EAAE,EAAE;oBACzD,IAAI,CAAC,OAAO,EAAE,CAAC;wBACX,OAAO,GAAG,IAAI,CAAC;wBACf,YAAY,CAAC,KAAK,CAAC,CAAC;wBACpB,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;oBACvB,CAAC;gBACL,CAAC,CAAC;qBACD,KAAK,CAAC,GAAG,EAAE;oBACR,IAAI,CAAC,OAAO,EAAE,CAAC;wBACX,OAAO,GAAG,IAAI,CAAC;wBACf,YAAY,CAAC,KAAK,CAAC,CAAC;wBACpB,OAAO,CAAC,EAAE,CAAC,CAAC;oBAChB,CAAC;gBACL,CAAC,CAAC,CAAC;YACX,CAAC,CAAC,CAAC;QACP,CAAC;gBAAS,CAAC;YACP,MAAM,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5D,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACrD,CAAC;IACL,CAAC;CACJ;AA5GW;IADP,MAAM,CAAC,mBAAmB,EAAE,IAAI,CAAC;;gDACT;AAGjB;IADP,MAAM,CAAC,qCAAqC,EAAE,EAAE,CAAC;;wDACT;AAGjC;IADP,MAAM,CAAC,qCAAqC,EAAE,IAAI,CAAC;;wDACT;AAGnC;IADP,MAAM,CAAC,QAAQ,CAAC;8BACE,QAAQ;6CAAC"}

package/dist/lib/commands/ProvisionCommand.js

@@ -0,0 +1,164 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import * as crypto from "crypto";
+import { ObjectDecorators } from "@rapidrest/core";
+import { WbxmlCodePage } from "../codec/WbxmlCodePages.js";
+import { childText, element, findChild, textElement } from "../codec/WbxmlElement.js";
+import { persistDeviceSyncState } from "../EasSyncKeyUtils.js";
+const { Config } = ObjectDecorators;
+const DEFAULT_POLICY_TYPE = "MS-EAS-Provisioning-WBXML";
+/**
+ * Handles the two-request EAS `Provision` handshake (MS-ASPROV) every client must complete before any other
+ * command is honored (see `BaseEasRoute`'s provisioning gate), plus the three-step `RemoteWipe` sub-flow that
+ * rides the same command.
+ *
+ * **Policy issuance/enforcement**: the password/encryption requirements sent back in request 1's policy
+ * document are sourced from `@Config("mail:eas:provision:*")` (defaults below are permissive but not
+ * `0`/`false` across the board, unlike the old hardcoded document) - a deployment can tighten them without
+ * code changes. Enforcement itself is honest but shallow: request 2 must carry back `Status: 1` on its own
+ * `Policy` (a device that reports it could *not* apply the policy, or omits `Status` entirely, is rejected
+ * without provisioning) - this library does not itself verify the device's actual password/encryption state
+ * beyond trusting that self-reported status, matching MS-ASPROV's own protocol design (the wire protocol has
+ * no way for the server to inspect device state directly either).
+ *
+ * - **Request 1** (no `PolicyKey` in the body): mint a new policy key, store it on `DeviceSyncState` (not yet
+ * provisioned), and send back the policy document under that key. If a `RemoteWipe` was requested for this
+ * device (`DeviceSyncState.remoteWipeRequested`, set by an admin - see the remote-wipe route), skip normal
+ * policy issuance entirely and send the `RemoteWipe` directive instead.
+ * - **Request 2** (client echoes the `PolicyKey` back, acknowledging the policy): if the key matches what was
+ * minted in request 1 *and* the client's own `Status` is `1`, mark the device provisioned and re-confirm the
+ * same key; anything else (a stale/replayed key, a device that never actually saw request 1's response, or a
+ * device reporting it could not comply) is rejected without provisioning.
+ * - **RemoteWipe acknowledgement**: after wiping itself, a device sends a bare `<Provision><RemoteWipe>
+ * <Status>1</Status></RemoteWipe></Provision>` (no `Policies`). Detected first, ahead of the normal
+ * issue/acknowledge branching. Clears `remoteWipeRequested` and stamps `remoteWipeAcknowledgedAt` for audit,
+ * but deliberately leaves `provisioned` untouched (`false`, from when the wipe was requested) - the device
+ * must complete a genuine fresh Provision handshake to re-add the account, it does not fall straight back into
+ * "provisioned". `remoteWipeAccountOnly` is recorded for admin audit only; the wire directive sent to the
+ * device is identical either way (a real "wipe just this account's data" vs. "wipe the whole device"
+ * distinction would require an MDM-capable client extension this library doesn't implement).
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export class ProvisionCommand {
+    constructor() {
+        this.command = "Provision";
+        this.passwordEnabled = true;
+        this.minPasswordLength = 4;
+        this.maxFailedAttempts = 8;
+        this.requireDeviceEncryption = true;
+        this.allowSimplePassword = false;
+    }
+    async handle(ctx) {
+        if (ctx.request && findChild(ctx.request, "RemoteWipe")) {
+            return await this.acknowledgeRemoteWipe(ctx);
+        }
+        const policiesEl = ctx.request ? findChild(ctx.request, "Policies") : undefined;
+        const policyEl = policiesEl ? findChild(policiesEl, "Policy") : undefined;
+        const policyType = (policyEl ? childText(policyEl, "PolicyType") : undefined) ?? DEFAULT_POLICY_TYPE;
+        const clientPolicyKey = policyEl ? childText(policyEl, "PolicyKey") : undefined;
+        const clientStatus = policyEl ? childText(policyEl, "Status") : undefined;
+        if (!clientPolicyKey) {
+            return await this.issuePolicy(ctx, policyType);
+        }
+        return await this.acknowledgePolicy(ctx, policyType, clientPolicyKey, clientStatus);
+    }
+    /** Request 1: mint and store a new policy key, send the policy document - or, if a remote wipe is
+     * pending for this device, the `RemoteWipe` directive instead. */
+    async issuePolicy(ctx, policyType) {
+        if (ctx.deviceSyncState.remoteWipeRequested) {
+            return element(WbxmlCodePage.Provision, "Provision", [
+                textElement(WbxmlCodePage.Provision, "Status", "1"),
+                element(WbxmlCodePage.Provision, "RemoteWipe", [textElement(WbxmlCodePage.Provision, "Status", "1")]),
+            ]);
+        }
+        const policyKey = crypto.randomBytes(8).toString("hex");
+        await this.persist(ctx, { policyKey, provisioned: false });
+        return element(WbxmlCodePage.Provision, "Provision", [
+            textElement(WbxmlCodePage.Provision, "Status", "1"),
+            element(WbxmlCodePage.Provision, "Policies", [
+                element(WbxmlCodePage.Provision, "Policy", [
+                    textElement(WbxmlCodePage.Provision, "PolicyType", policyType),
+                    textElement(WbxmlCodePage.Provision, "Status", "1"),
+                    textElement(WbxmlCodePage.Provision, "PolicyKey", policyKey),
+                    element(WbxmlCodePage.Provision, "Data", [
+                        element(WbxmlCodePage.Provision, "EASProvisionDoc", [
+                            textElement(WbxmlCodePage.Provision, "DevicePasswordEnabled", this.passwordEnabled ? "1" : "0"),
+                            textElement(WbxmlCodePage.Provision, "MinDevicePasswordLength", String(this.minPasswordLength)),
+                            textElement(WbxmlCodePage.Provision, "MaxDevicePasswordFailedAttempts", String(this.maxFailedAttempts)),
+                            textElement(WbxmlCodePage.Provision, "AllowSimpleDevicePassword", this.allowSimplePassword ? "1" : "0"),
+                            textElement(WbxmlCodePage.Provision, "RequireDeviceEncryption", this.requireDeviceEncryption ? "1" : "0"),
+                            textElement(WbxmlCodePage.Provision, "AttachmentsEnabled", "1"),
+                        ]),
+                    ]),
+                ]),
+            ]),
+        ]);
+    }
+    /** Request 2: the client acknowledges the policy key it was handed in request 1, self-reporting whether
+     * it actually applied the policy via its own `Status`. */
+    async acknowledgePolicy(ctx, policyType, clientPolicyKey, clientStatus) {
+        if (clientPolicyKey !== ctx.deviceSyncState.policyKey || clientStatus !== "1") {
+            // Status 2 ("protocol error" per MS-ASPROV) - an approximation, not a byte-exact enumeration of
+            // every real status code MS-ASPROV defines; this pragmatic subset only distinguishes success from
+            // "something is wrong, start over" (see this class's own doc comment on scope), and deliberately
+            // does not distinguish a key mismatch from a device self-reporting non-compliance.
+            return element(WbxmlCodePage.Provision, "Provision", [textElement(WbxmlCodePage.Provision, "Status", "2")]);
+        }
+        await this.persist(ctx, { policyKey: clientPolicyKey, provisioned: true });
+        return element(WbxmlCodePage.Provision, "Provision", [
+            textElement(WbxmlCodePage.Provision, "Status", "1"),
+            element(WbxmlCodePage.Provision, "Policies", [
+                element(WbxmlCodePage.Provision, "Policy", [
+                    textElement(WbxmlCodePage.Provision, "PolicyType", policyType),
+                    textElement(WbxmlCodePage.Provision, "Status", "1"),
+                    textElement(WbxmlCodePage.Provision, "PolicyKey", clientPolicyKey),
+                ]),
+            ]),
+        ]);
+    }
+    /** The device has wiped itself and is acknowledging - clear the pending flag but leave `provisioned`
+     * alone (still `false`, from when the wipe was requested) so a genuine re-provision is required. */
+    async acknowledgeRemoteWipe(ctx) {
+        await persistDeviceSyncState(ctx.deviceSyncState, ctx.deviceSyncStateRepo, {
+            remoteWipeRequested: false,
+            remoteWipeAcknowledgedAt: new Date(),
+        });
+        return element(WbxmlCodePage.Provision, "Provision", [textElement(WbxmlCodePage.Provision, "Status", "1")]);
+    }
+    async persist(ctx, changes) {
+        await persistDeviceSyncState(ctx.deviceSyncState, ctx.deviceSyncStateRepo, changes);
+    }
+}
+__decorate([
+    Config("mail:eas:provision:password_enabled", true),
+    __metadata("design:type", Boolean)
+], ProvisionCommand.prototype, "passwordEnabled", void 0);
+__decorate([
+    Config("mail:eas:provision:min_password_length", 4),
+    __metadata("design:type", Number)
+], ProvisionCommand.prototype, "minPasswordLength", void 0);
+__decorate([
+    Config("mail:eas:provision:max_failed_attempts", 8),
+    __metadata("design:type", Number)
+], ProvisionCommand.prototype, "maxFailedAttempts", void 0);
+__decorate([
+    Config("mail:eas:provision:require_device_encryption", true),
+    __metadata("design:type", Boolean)
+], ProvisionCommand.prototype, "requireDeviceEncryption", void 0);
+__decorate([
+    Config("mail:eas:provision:allow_simple_password", false),
+    __metadata("design:type", Boolean)
+], ProvisionCommand.prototype, "allowSimplePassword", void 0);
+//# sourceMappingURL=ProvisionCommand.js.map

package/dist/lib/commands/ProvisionCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProvisionCommand.js","sourceRoot":"","sources":["../../../src/commands/ProvisionCommand.ts"],"names":[],"mappings":";;;;;;;;;AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAqB,MAAM,0BAA0B,CAAC;AACzG,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE/D,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC;AAEpC,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,OAAO,gBAAgB;IAA7B;QACoB,YAAO,GAAG,WAAW,CAAC;QAG9B,oBAAe,GAAY,IAAI,CAAC;QAGhC,sBAAiB,GAAW,CAAC,CAAC;QAG9B,sBAAiB,GAAW,CAAC,CAAC;QAG9B,4BAAuB,GAAY,IAAI,CAAC;QAGxC,wBAAmB,GAAY,KAAK,CAAC;IA6GjD,CAAC;IA3GU,KAAK,CAAC,MAAM,CAAC,GAAsB;QACtC,IAAI,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;YACtD,OAAO,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,MAAM,UAAU,GAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,mBAAmB,CAAC;QAC7G,MAAM,eAAe,GAAuB,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpG,MAAM,YAAY,GAAuB,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE9F,IAAI,CAAC,eAAe,EAAE,CAAC;YACnB,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,UAAU,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;IACxF,CAAC;IAED;sEACkE;IAC1D,KAAK,CAAC,WAAW,CAAC,GAAsB,EAAE,UAAkB;QAChE,IAAI,GAAG,CAAC,eAAe,CAAC,mBAAmB,EAAE,CAAC;YAC1C,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,WAAW,EAAE;gBACjD,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC;gBACnD,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,YAAY,EAAE,CAAC,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;aACxG,CAAC,CAAC;QACP,CAAC;QAED,MAAM,SAAS,GAAW,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChE,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAE3D,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,WAAW,EAAE;YACjD,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC;YACnD,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,UAAU,EAAE;gBACzC,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE;oBACvC,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,YAAY,EAAE,UAAU,CAAC;oBAC9D,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC;oBACnD,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC;oBAC5D,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE;wBACrC,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,iBAAiB,EAAE;4BAChD,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,uBAAuB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;4BAC/F,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,yBAAyB,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;4BAC/F,WAAW,CACP,aAAa,CAAC,SAAS,EACvB,iCAAiC,EACjC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CACjC;4BACD,WAAW,CACP,aAAa,CAAC,SAAS,EACvB,2BAA2B,EAC3B,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CACvC;4BACD,WAAW,CACP,aAAa,CAAC,SAAS,EACvB,yBAAyB,EACzB,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAC3C;4BACD,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,oBAAoB,EAAE,GAAG,CAAC;yBAClE,CAAC;qBACL,CAAC;iBACL,CAAC;aACL,CAAC;SACL,CAAC,CAAC;IACP,CAAC;IAED;8DAC0D;IAClD,KAAK,CAAC,iBAAiB,CAC3B,GAAsB,EACtB,UAAkB,EAClB,eAAuB,EACvB,YAAgC;QAEhC,IAAI,eAAe,KAAK,GAAG,CAAC,eAAe,CAAC,SAAS,IAAI,YAAY,KAAK,GAAG,EAAE,CAAC;YAC5E,gGAAgG;YAChG,kGAAkG;YAClG,iGAAiG;YACjG,mFAAmF;YACnF,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAChH,CAAC;QAED,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAE3E,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,WAAW,EAAE;YACjD,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC;YACnD,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,UAAU,EAAE;gBACzC,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE;oBACvC,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,YAAY,EAAE,UAAU,CAAC;oBAC9D,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC;oBACnD,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,WAAW,EAAE,eAAe,CAAC;iBACrE,CAAC;aACL,CAAC;SACL,CAAC,CAAC;IACP,CAAC;IAED;wGACoG;IAC5F,KAAK,CAAC,qBAAqB,CAAC,GAAsB;QACtD,MAAM,sBAAsB,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,mBAAmB,EAAE;YACvE,mBAAmB,EAAE,KAAK;YAC1B,wBAAwB,EAAE,IAAI,IAAI,EAAE;SACvC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAChH,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,GAAsB,EAAE,OAAoD;QAC9F,MAAM,sBAAsB,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IACxF,CAAC;CACJ;AAzHW;IADP,MAAM,CAAC,qCAAqC,EAAE,IAAI,CAAC;;yDACZ;AAGhC;IADP,MAAM,CAAC,wCAAwC,EAAE,CAAC,CAAC;;2DACd;AAG9B;IADP,MAAM,CAAC,wCAAwC,EAAE,CAAC,CAAC;;2DACd;AAG9B;IADP,MAAM,CAAC,8CAA8C,EAAE,IAAI,CAAC;;iEACb;AAGxC;IADP,MAAM,CAAC,0CAA0C,EAAE,KAAK,CAAC;;6DACb"}

package/dist/lib/commands/ResolveRecipientsCommand.js

@@ -0,0 +1,124 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { ObjectDecorators } from "@rapidrest/core";
+import { RepoUtils } from "@rapidrest/service-core";
+import { WbxmlCodePage } from "../codec/WbxmlCodePages.js";
+import { element, findChildren, textElement } from "../codec/WbxmlElement.js";
+const { Config, Init } = ObjectDecorators;
+/** A simple, deliberately permissive email-address shape check - just enough to distinguish "the client sent
+ * an address it already knows how to reach" from "the client sent a partial name/string that needs GAL
+ * lookup", not full RFC 5322 validation. */
+const LOOKS_LIKE_EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+/** [MS-ASCMD] `ResolveRecipients` per-`To` `Status` codes this pragmatic subset actually distinguishes: `1`
+ * success (at least one match, or the input already looked like a resolvable address), `4` no match found -
+ * an approximation, not a byte-exact enumeration of every real status code MS-ASCMD's `ResolveRecipients` page
+ * defines, matching `ProvisionCommand`'s own identical precedent for the same reasoning. */
+const STATUS_SUCCESS = "1";
+const STATUS_NOT_FOUND = "4";
+/** Escapes regex metacharacters so a client-supplied query string is matched literally - identical helper to
+ * `SearchCommand`'s own (small enough, and specific enough to each command's own surrounding logic, that
+ * extracting a shared utility for two call sites isn't worth a new cross-command dependency). */
+function escapeForLikeQuery(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+ * Handles EAS `ResolveRecipients`: resolves each `<To>` value (a display name, partial name, or address) the
+ * client is unsure how to reach against the mailbox's own `Contact` (GAL) store - the same substring-match
+ * approach `SearchCommand` uses for its own `Store Name="GAL"` lookups, duplicated rather than shared (see
+ * `escapeForLikeQuery`'s own doc comment).
+ *
+ * **Pragmatic subset**: no free-busy `Availability`, no S/MIME `Certificates`/`Options` handling at all - this
+ * command's real-world use is overwhelmingly enterprise S/MIME certificate lookup, which this library doesn't
+ * implement elsewhere either (`ComposeMailCommand` sends plain MIME, never signed/encrypted). A `<To>` value
+ * that already looks like an email address (`LOOKS_LIKE_EMAIL`) is echoed straight back as its own single
+ * exact match rather than searched for, matching a real client's own common case of resolving an address it
+ * already typed correctly.
+ *
+ * `contactClass` is supplied by the Mongo/SQL concrete subclasses.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export class ResolveRecipientsCommand {
+    constructor() {
+        this.command = "ResolveRecipients";
+        this.maxMatches = 10;
+    }
+    async init() {
+        this.contactRepo = await this._objectFactory.newInstance(RepoUtils, {
+            name: this.contactClass.name,
+            args: [this.contactClass],
+        });
+    }
+    async handle(ctx) {
+        const toEls = ctx.request ? findChildren(ctx.request, "To") : [];
+        const responses = [];
+        for (const toEl of toEls) {
+            const value = toEl.text ?? "";
+            responses.push(await this.resolveOne(ctx, value));
+        }
+        return element(WbxmlCodePage.ResolveRecipients, "ResolveRecipients", [
+            textElement(WbxmlCodePage.ResolveRecipients, "Status", "1"),
+            ...responses,
+        ]);
+    }
+    async resolveOne(ctx, value) {
+        if (LOOKS_LIKE_EMAIL.test(value)) {
+            return this.responseElement(value, STATUS_SUCCESS, [this.recipientElement(value, undefined)]);
+        }
+        const pattern = this.likePattern(escapeForLikeQuery(value));
+        const findOptions = { ignoreACL: true, limit: this.maxMatches };
+        const perField = await Promise.all(["displayName", "givenName", "surname"].map((field) => this.contactRepo.find({ mailboxUid: ctx.mailboxUid, [field]: `like(${pattern})` }, findOptions)));
+        const byUid = new Map();
+        for (const contact of perField.flat()) {
+            byUid.set(contact.uid, contact);
+        }
+        const matches = Array.from(byUid.values())
+            .filter((contact) => contact.emails[0])
+            .slice(0, this.maxMatches);
+        if (matches.length === 0) {
+            return this.responseElement(value, STATUS_NOT_FOUND, []);
+        }
+        return this.responseElement(value, STATUS_SUCCESS, matches.map((contact) => this.recipientElement(contact.emails[0].address, contact.displayName)));
+    }
+    recipientElement(address, displayName) {
+        return element(WbxmlCodePage.ResolveRecipients, "Recipient", [
+            textElement(WbxmlCodePage.ResolveRecipients, "Type", "1"),
+            ...(displayName ? [textElement(WbxmlCodePage.ResolveRecipients, "DisplayName", displayName)] : []),
+            textElement(WbxmlCodePage.ResolveRecipients, "EmailAddress", address),
+        ]);
+    }
+    responseElement(to, status, recipients) {
+        return element(WbxmlCodePage.ResolveRecipients, "Response", [
+            textElement(WbxmlCodePage.ResolveRecipients, "To", to),
+            textElement(WbxmlCodePage.ResolveRecipients, "Status", status),
+            ...(recipients.length > 0
+                ? [
+                    textElement(WbxmlCodePage.ResolveRecipients, "RecipientCount", String(recipients.length)),
+                    ...recipients,
+                ]
+                : []),
+        ]);
+    }
+}
+__decorate([
+    Config("mail:eas:resolve_recipients_max_matches", 10),
+    __metadata("design:type", Number)
+], ResolveRecipientsCommand.prototype, "maxMatches", void 0);
+__decorate([
+    Init,
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], ResolveRecipientsCommand.prototype, "init", null);
+//# sourceMappingURL=ResolveRecipientsCommand.js.map

package/dist/lib/commands/ResolveRecipientsCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResolveRecipientsCommand.js","sourceRoot":"","sources":["../../../src/commands/ResolveRecipientsCommand.ts"],"names":[],"mappings":";;;;;;;;;AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAiB,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEnE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAqB,MAAM,0BAA0B,CAAC;AAEjG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC;AAE1C;;4CAE4C;AAC5C,MAAM,gBAAgB,GAAG,4BAA4B,CAAC;AAEtD;;;4FAG4F;AAC5F,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B;;iGAEiG;AACjG,SAAS,kBAAkB,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAgB,wBAAwB;IAA9C;QACoB,YAAO,GAAG,mBAAmB,CAAC;QAStC,eAAU,GAAW,EAAE,CAAC;IA+EpC,CAAC;IAvEgB,AAAN,KAAK,CAAC,IAAI;QACb,IAAI,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,cAAe,CAAC,WAAW,CAAC,SAAS,EAAE;YACjE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI;YAC5B,IAAI,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;SAC5B,CAAC,CAAC;IACP,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,GAAsB;QACtC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,SAAS,GAAmB,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;YAC9B,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,OAAO,CAAC,aAAa,CAAC,iBAAiB,EAAE,mBAAmB,EAAE;YACjE,WAAW,CAAC,aAAa,CAAC,iBAAiB,EAAE,QAAQ,EAAE,GAAG,CAAC;YAC3D,GAAG,SAAS;SACf,CAAC,CAAC;IACP,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,GAAsB,EAAE,KAAa;QAC1D,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;QAClG,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5D,MAAM,WAAW,GAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;QACrE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,CAAC,aAAa,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAClD,IAAI,CAAC,WAAY,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,EAAE,QAAQ,OAAO,GAAG,EAAS,EAAE,WAAW,CAAC,CAC1G,CACJ,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqC,CAAC;QAC3D,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YACpC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;aACrC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;aACtC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAE/B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,IAAI,CAAC,eAAe,CACvB,KAAK,EACL,cAAc,EACd,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAClG,CAAC;IACN,CAAC;IAEO,gBAAgB,CAAC,OAAe,EAAE,WAA+B;QACrE,OAAO,OAAO,CAAC,aAAa,CAAC,iBAAiB,EAAE,WAAW,EAAE;YACzD,WAAW,CAAC,aAAa,CAAC,iBAAiB,EAAE,MAAM,EAAE,GAAG,CAAC;YACzD,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,iBAAiB,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAClG,WAAW,CAAC,aAAa,CAAC,iBAAiB,EAAE,cAAc,EAAE,OAAO,CAAC;SACxE,CAAC,CAAC;IACP,CAAC;IAEO,eAAe,CAAC,EAAU,EAAE,MAAc,EAAE,UAA0B;QAC1E,OAAO,OAAO,CAAC,aAAa,CAAC,iBAAiB,EAAE,UAAU,EAAE;YACxD,WAAW,CAAC,aAAa,CAAC,iBAAiB,EAAE,IAAI,EAAE,EAAE,CAAC;YACtD,WAAW,CAAC,aAAa,CAAC,iBAAiB,EAAE,QAAQ,EAAE,MAAM,CAAC;YAC9D,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;gBACrB,CAAC,CAAC;oBACI,WAAW,CAAC,aAAa,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;oBACzF,GAAG,UAAU;iBAChB;gBACH,CAAC,CAAC,EAAE,CAAC;SACZ,CAAC,CAAC;IACP,CAAC;CACJ;AA/EW;IADP,MAAM,CAAC,yCAAyC,EAAE,EAAE,CAAC;;4DACtB;AAQnB;IADZ,IAAI;;;;oDAMJ"}

package/dist/lib/commands/SearchCommand.js

@@ -0,0 +1,137 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+import { ApiError, ObjectDecorators } from "@rapidrest/core";
+import { ApiErrorMessages, ApiErrors, RepoUtils } from "@rapidrest/service-core";
+import { WbxmlCodePage } from "../codec/WbxmlCodePages.js";
+import { childText, element, findChild, textElement } from "../codec/WbxmlElement.js";
+const { Config, Init } = ObjectDecorators;
+/** Escapes regex metacharacters so a client-supplied search string is matched literally by `RepoUtils`' own
+ * `like(pattern)` query operator (which compiles to a case-insensitive `$regex`) - without this, a query
+ * containing e.g. `.` or `(` would be interpreted as regex syntax rather than the literal characters typed. */
+function escapeForLikeQuery(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/** Parses a `Range` value (`"m-n"`, a zero-based inclusive index pair) into `{ start, end }`, falling back to
+ * `defaultEnd` for a missing/malformed value - never trusting the client to request more than `maxEnd` rows. */
+function parseRange(raw, defaultEnd, maxEnd) {
+    const match = raw?.match(/^(\d+)-(\d+)$/);
+    if (!match) {
+        return { start: 0, end: Math.min(defaultEnd, maxEnd) };
+    }
+    const start = Number(match[1]);
+    const end = Math.min(Number(match[2]), maxEnd);
+    return start <= end ? { start, end } : { start: 0, end: Math.min(defaultEnd, maxEnd) };
+}
+/**
+ * Handles EAS `Search` for the `GAL` store only - this library's `Contact` records are also the source of
+ * truth for GAL lookups against a mailbox's own address book (see the architecture note on `Contact` itself);
+ * searching a mailbox's item contents or a document library (the other two `Search` store types the real spec
+ * defines) is out of scope for this pragmatic subset.
+ *
+ * Per the plan's own scope: a simple case-insensitive substring match via `RepoUtils.find()` directly, not the
+ * heavier `SearchProvider` full-text index - GAL lookups are small-scale exact/prefix matching against a
+ * personal address book, not relevance-ranked full text over large content. Only `displayName`/`givenName`/
+ * `surname`/`company` are matched - `Contact.emails`/`phones` are embedded arrays of objects, which a plain
+ * per-field regex query can't reach into on either backend (confirmed: MongoDB's `$regex` against an
+ * array-of-objects field matches nothing useful, and this library's own query-injection guard rejects
+ * dot-notation field paths like `"emails.address"` outright) - a documented gap, not an oversight.
+ *
+ * `contactClass` is supplied by the Mongo/SQL concrete subclasses.
+ *
+ * @author Jean-Philippe Steinmetz
+ */
+export class SearchCommand {
+    constructor() {
+        this.command = "Search";
+        this.defaultRangeEnd = 9;
+        this.maxRangeEnd = 99;
+    }
+    async init() {
+        this.contactRepo = await this._objectFactory.newInstance(RepoUtils, {
+            name: this.contactClass.name,
+            args: [this.contactClass],
+        });
+    }
+    async handle(ctx) {
+        if (!this.contactRepo) {
+            throw new ApiError(ApiErrors.INTERNAL_ERROR, 500, ApiErrorMessages.INTERNAL_ERROR);
+        }
+        const storeEl = ctx.request ? findChild(ctx.request, "Store") : undefined;
+        const name = storeEl ? childText(storeEl, "Name") : undefined;
+        const query = storeEl ? childText(storeEl, "Query") : undefined;
+        if (!storeEl || name !== "GAL" || !query) {
+            throw new ApiError(ApiErrors.INVALID_REQUEST, 400, "Search requires a Store with Name 'GAL' and a Query.");
+        }
+        const optionsEl = findChild(storeEl, "Options");
+        const { start, end } = parseRange(optionsEl ? childText(optionsEl, "Range") : undefined, this.defaultRangeEnd, this.maxRangeEnd);
+        // `$or` is a Mongo-only feature of this framework's query builder - `buildSearchQuerySQL` (confirmed by
+        // reading its source) has no handling for it at all, so passing one on the SQL backend silently builds
+        // a broken TypeORM `where` clause (a literal `$or` property, not a real OR) and 500s. Querying each
+        // field separately and merging in memory - the same workaround `EasSyncKeyUtils.computeChanges()`
+        // already uses for its own two-backend query gap - works identically on both backends instead.
+        const pattern = this.likePattern(escapeForLikeQuery(query));
+        const findOptions = { ignoreACL: true, limit: this.maxRangeEnd + 1 };
+        const perField = await Promise.all(["displayName", "givenName", "surname", "company"].map((field) => this.contactRepo.find({ mailboxUid: ctx.mailboxUid, [field]: `like(${pattern})`, limit: this.maxRangeEnd + 1 }, findOptions)));
+        const byUid = new Map();
+        for (const contact of perField.flat()) {
+            byUid.set((contact).uid, contact);
+        }
+        const matches = Array.from(byUid.values()).sort((a, b) => a.displayName.localeCompare(b.displayName));
+        const page = matches.slice(start, end + 1);
+        // Both ends forced to 0 when there are no matches at all - `start` alone (from a client-requested
+        // Range like "5-10") would otherwise survive unclamped, producing a malformed "5-0" (start > end) once
+        // `end` collapses to 0. A non-empty result always has a real, in-range `start` already (see
+        // `parseRange`), so this only ever changes behavior for the zero-match case.
+        const rangeStart = matches.length === 0 ? 0 : start;
+        const rangeEnd = matches.length === 0 ? 0 : Math.min(end, matches.length - 1);
+        return element(WbxmlCodePage.Search, "Search", [
+            textElement(WbxmlCodePage.Search, "Status", "1"),
+            element(WbxmlCodePage.Search, "Response", [
+                element(WbxmlCodePage.Search, "Store", [
+                    textElement(WbxmlCodePage.Search, "Status", "1"),
+                    ...page.map((contact) => this.contactToResult(contact)),
+                    textElement(WbxmlCodePage.Search, "Range", `${rangeStart}-${rangeEnd}`),
+                    textElement(WbxmlCodePage.Search, "Total", String(matches.length)),
+                ]),
+            ]),
+        ]);
+    }
+    contactToResult(contact) {
+        const properties = [
+            textElement(WbxmlCodePage.Gal, "DisplayName", contact.displayName),
+            ...(contact.givenName ? [textElement(WbxmlCodePage.Gal, "FirstName", contact.givenName)] : []),
+            ...(contact.surname ? [textElement(WbxmlCodePage.Gal, "LastName", contact.surname)] : []),
+            ...(contact.company ? [textElement(WbxmlCodePage.Gal, "Company", contact.company)] : []),
+            ...(contact.jobTitle ? [textElement(WbxmlCodePage.Gal, "Title", contact.jobTitle)] : []),
+            ...(contact.emails[0] ? [textElement(WbxmlCodePage.Gal, "EmailAddress", contact.emails[0].address)] : []),
+            ...(contact.phones[0] ? [textElement(WbxmlCodePage.Gal, "Phone", contact.phones[0].phoneNumber)] : []),
+        ];
+        return element(WbxmlCodePage.Search, "Result", [element(WbxmlCodePage.Search, "Properties", properties)]);
+    }
+}
+__decorate([
+    Config("mail:eas:search_default_range", 9),
+    __metadata("design:type", Number)
+], SearchCommand.prototype, "defaultRangeEnd", void 0);
+__decorate([
+    Config("mail:eas:search_max_range", 99),
+    __metadata("design:type", Number)
+], SearchCommand.prototype, "maxRangeEnd", void 0);
+__decorate([
+    Init,
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], SearchCommand.prototype, "init", null);
+//# sourceMappingURL=SearchCommand.js.map

package/dist/lib/commands/SearchCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SearchCommand.js","sourceRoot":"","sources":["../../../src/commands/SearchCommand.ts"],"names":[],"mappings":";;;;;;;;;AAAA,+EAA+E;AAC/E,mEAAmE;AACnE,mCAAmC;AACnC,+EAA+E;AAC/E,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAiB,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAChG,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAqB,MAAM,0BAA0B,CAAC;AAGzG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC;AAE1C;;+GAE+G;AAC/G,SAAS,kBAAkB,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACxD,CAAC;AAED;gHACgH;AAChH,SAAS,UAAU,CAAC,GAAuB,EAAE,UAAkB,EAAE,MAAc;IAC3E,MAAM,KAAK,GAAG,GAAG,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;IAC3D,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/C,OAAO,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC;AAC3F,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAgB,aAAa;IAAnC;QACoB,YAAO,GAAG,QAAQ,CAAC;QAmB3B,oBAAe,GAAW,CAAC,CAAC;QAG5B,gBAAW,GAAW,EAAE,CAAC;IA+ErC,CAAC;IA5EgB,AAAN,KAAK,CAAC,IAAI;QACb,IAAI,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,cAAe,CAAC,WAAW,CAAC,SAAS,EAAE;YACjE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI;YAC5B,IAAI,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;SAC5B,CAAC,CAAC;IACP,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,GAAsB;QACtC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACpB,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,EAAE,gBAAgB,CAAC,cAAc,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,MAAM,IAAI,GAAuB,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClF,MAAM,KAAK,GAAuB,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpF,IAAI,CAAC,OAAO,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YACvC,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,GAAG,EAAE,sDAAsD,CAAC,CAAC;QAC/G,CAAC;QAED,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAChD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,UAAU,CAC7B,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,EACrD,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,WAAW,CACnB,CAAC;QAEF,wGAAwG;QACxG,uGAAuG;QACvG,oGAAoG;QACpG,kGAAkG;QAClG,+FAA+F;QAC/F,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5D,MAAM,WAAW,GAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;QAC1E,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,CAAC,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAC7D,IAAI,CAAC,WAAY,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,EAAE,QAAQ,OAAO,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,WAAW,GAAG,CAAC,EAAS,EAAE,WAAW,CAAC,CACvI,CACJ,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqC,CAAC;QAC3D,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YACpC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,OAAO,GAAc,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QAEjH,MAAM,IAAI,GAAc,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;QACtD,kGAAkG;QAClG,uGAAuG;QACvG,4FAA4F;QAC5F,6EAA6E;QAC7E,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAE9E,OAAO,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE;YAC3C,WAAW,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC;YAChD,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE;gBACtC,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE;oBACnC,WAAW,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC;oBAChD,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;oBACvD,WAAW,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,IAAI,QAAQ,EAAE,CAAC;oBACvE,WAAW,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;iBACrE,CAAC;aACL,CAAC;SACL,CAAC,CAAC;IACP,CAAC;IAEO,eAAe,CAAC,OAAgB;QACpC,MAAM,UAAU,GAAmB;YAC/B,WAAW,CAAC,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC;YAClE,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9F,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzF,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACzG,CAAC;QACF,OAAO,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9G,CAAC;CACJ;AAlFW;IADP,MAAM,CAAC,+BAA+B,EAAE,CAAC,CAAC;;sDACP;AAG5B;IADP,MAAM,CAAC,2BAA2B,EAAE,EAAE,CAAC;;kDACP;AAGpB;IADZ,IAAI;;;;yCAMJ"}