@stage-labs/metro 0.1.0-beta.2 → 0.1.0-beta.200

package/runtime/node_modules/@metro-labs/threema/src/api.ts

@@ -0,0 +1,152 @@
+import { errMsg } from '@metro-labs/core/log';
+import { TrainError } from '@metro-labs/core/train-error';
+import { GATEWAY_API, MESSAGE_ID_RE } from './ids.js';
+
+const TIMEOUT_MS = 15_000;
+const PUBLIC_KEY_RE = /^[0-9a-f]{64}$/;
+
+export interface GatewayCreds {
+  gatewayId: string;
+  secret: string;
+}
+
+async function call(
+  path: string,
+  init: RequestInit,
+  label: string,
+): Promise<Response> {
+  try {
+    return await fetch(`${GATEWAY_API}${path}`, {
+      signal: AbortSignal.timeout(TIMEOUT_MS),
+      ...init,
+    });
+  } catch (err) {
+    throw new TrainError(
+      'threema_unreachable',
+      `${label}: could not reach the Threema Gateway (${errMsg(err)})`,
+      { retryable: true },
+    );
+  }
+}
+
+const authQuery = (c: GatewayCreds): string =>
+  new URLSearchParams({ from: c.gatewayId, secret: c.secret }).toString();
+
+function refusal(status: number, what: string): TrainError {
+  if (status === 401)
+    return new TrainError(
+      'threema_unauthorized',
+      'the Threema Gateway rejected this account credentials; check the Gateway ID and API secret',
+      { retryable: false },
+    );
+  if (status === 402)
+    return new TrainError(
+      'threema_no_credits',
+      'this Threema Gateway ID has no credits left; top it up at gateway.threema.ch',
+      { retryable: false },
+    );
+  if (status === 404)
+    return new TrainError('threema_unknown_id', `Threema does not know the ID ${what}`, {
+      retryable: false,
+    });
+  if (status === 413)
+    return new TrainError(
+      'threema_message_too_long',
+      'Threema refused the message as too long',
+      { retryable: false },
+    );
+  if (status === 400)
+    return new TrainError('threema_bad_recipient', `Threema refused the recipient ${what}`, {
+      retryable: false,
+    });
+  return new TrainError(
+    'threema_gateway_error',
+    `the Threema Gateway answered ${status}`,
+    { retryable: status >= 500 },
+  );
+}
+
+export async function fetchPublicKey(
+  c: GatewayCreds,
+  threemaId: string,
+): Promise<string> {
+  const res = await call(
+    `/pubkeys/${encodeURIComponent(threemaId)}?${authQuery(c)}`,
+    {},
+    'pubkeys',
+  );
+  if (!res.ok) throw refusal(res.status, threemaId);
+  const hex = (await res.text()).trim().toLowerCase();
+  if (!PUBLIC_KEY_RE.test(hex))
+    throw new TrainError(
+      'threema_gateway_error',
+      `pubkeys: the Threema Gateway gave an unexpected answer for ${threemaId}`,
+    );
+  return hex;
+}
+
+export async function fetchCredits(c: GatewayCreds): Promise<number> {
+  const res = await call(`/credits?${authQuery(c)}`, {}, 'credits');
+  if (!res.ok) throw refusal(res.status, c.gatewayId);
+  const credits = Number((await res.text()).trim());
+  if (!Number.isInteger(credits))
+    throw new TrainError(
+      'threema_gateway_error',
+      'credits: the Threema Gateway gave an unexpected answer',
+    );
+  return credits;
+}
+
+export async function sendE2E(
+  c: GatewayCreds,
+  to: string,
+  nonceHex: string,
+  boxHex: string,
+  group = false,
+): Promise<string> {
+  const body = new URLSearchParams({
+    from: c.gatewayId,
+    to,
+    nonce: nonceHex,
+    box: boxHex,
+    secret: c.secret,
+    ...(group ? { group: '1' } : {}),
+  });
+  const res = await call(
+    '/send_e2e',
+    {
+      method: 'POST',
+      headers: { 'content-type': 'application/x-www-form-urlencoded' },
+      body: body.toString(),
+    },
+    'send_e2e',
+  );
+  if (!res.ok) throw refusal(res.status, to);
+  const messageId = (await res.text()).trim().toLowerCase();
+  if (!MESSAGE_ID_RE.test(messageId))
+    throw new TrainError(
+      'threema_gateway_error',
+      'send_e2e: the Threema Gateway answered without a message id',
+    );
+  return messageId;
+}
+
+const BLOB_ID_RE = /^[0-9a-f]{32}$/;
+const BLOB_TIMEOUT_MS = 120_000;
+
+export async function uploadBlob(c: GatewayCreds, data: Uint8Array): Promise<string> {
+  const form = new FormData();
+  form.append('blob', new Blob([Buffer.from(data)]), 'blob');
+  const res = await call(`/upload_blob?${authQuery(c)}`, { method: 'POST', body: form, signal: AbortSignal.timeout(BLOB_TIMEOUT_MS) }, 'upload_blob');
+  if (!res.ok) throw refusal(res.status, 'blob');
+  const blobId = (await res.text()).trim().toLowerCase();
+  if (!BLOB_ID_RE.test(blobId)) throw new TrainError('threema_gateway_error', 'upload_blob: the Threema Gateway answered without a blob id');
+  return blobId;
+}
+
+export async function downloadBlob(c: GatewayCreds, blobId: string): Promise<Uint8Array> {
+  if (!BLOB_ID_RE.test(blobId)) throw new TrainError('threema_bad_blob', `'${blobId}' is not a blob id`, { retryable: false });
+  const res = await call(`/blobs/${blobId}?${authQuery(c)}`, { signal: AbortSignal.timeout(BLOB_TIMEOUT_MS) }, 'blob download');
+  if (!res.ok) throw refusal(res.status, `blob ${blobId}`);
+  return new Uint8Array(await res.arrayBuffer());
+}

package/runtime/node_modules/@metro-labs/threema/src/crypto.ts

@@ -0,0 +1,100 @@
+import { createHmac, randomInt, timingSafeEqual } from 'node:crypto';
+import nacl from 'tweetnacl';
+
+const HEX_RE = /^(?:[0-9a-fA-F]{2})*$/;
+
+export interface KeyPair {
+  publicKey: Uint8Array;
+  secretKey: Uint8Array;
+}
+
+export function hexToBytes(hex: string, label: string): Uint8Array {
+  if (!HEX_RE.test(hex)) throw new Error(`${label} is not hex`);
+  return new Uint8Array(Buffer.from(hex, 'hex'));
+}
+
+export const bytesToHex = (bytes: Uint8Array): string =>
+  Buffer.from(bytes).toString('hex');
+
+export const keyPairFrom = (privateKeyHex: string): KeyPair =>
+  nacl.box.keyPair.fromSecretKey(hexToBytes(privateKeyHex, 'private key'));
+
+function pad(plain: Uint8Array): Uint8Array {
+  const n = randomInt(1, 256);
+  const out = new Uint8Array(plain.length + n);
+  out.set(plain);
+  out.fill(n, plain.length);
+  return out;
+}
+
+function unpad(data: Uint8Array): Uint8Array | null {
+  const n = data[data.length - 1];
+  if (n === undefined || n < 1 || n > data.length) return null;
+  return data.subarray(0, data.length - n);
+}
+
+export function seal(
+  plain: Uint8Array,
+  theirPublicKey: Uint8Array,
+  mine: KeyPair,
+): { nonce: Uint8Array; box: Uint8Array } {
+  const nonce = nacl.randomBytes(nacl.box.nonceLength);
+  return {
+    nonce,
+    box: nacl.box(pad(plain), nonce, theirPublicKey, mine.secretKey),
+  };
+}
+
+export function open(
+  box: Uint8Array,
+  nonce: Uint8Array,
+  theirPublicKey: Uint8Array,
+  mine: KeyPair,
+): Uint8Array | null {
+  const padded = nacl.box.open(box, nonce, theirPublicKey, mine.secretKey);
+  return padded === null ? null : unpad(padded);
+}
+
+export interface CallbackFields {
+  from: string;
+  to: string;
+  messageId: string;
+  date: string;
+  nonce: string;
+  box: string;
+}
+
+export const callbackMac = (secret: string, f: CallbackFields): string =>
+  createHmac('sha256', secret)
+    .update(f.from + f.to + f.messageId + f.date + f.nonce + f.box)
+    .digest('hex');
+
+export function macMatches(
+  secret: string,
+  fields: CallbackFields,
+  mac: string,
+): boolean {
+  const want = Buffer.from(callbackMac(secret, fields), 'hex');
+  const got = Buffer.from(mac.toLowerCase(), 'hex');
+  return want.length === got.length && timingSafeEqual(want, got);
+}
+
+const QUOTE_RE = /^> quote #([0-9a-f]{16})\n\n([\s\S]*)$/;
+
+export const quoted = (replyTo: string, text: string): string =>
+  `> quote #${replyTo}\n\n${text}`;
+
+export function unquote(text: string): { replyTo?: string; text: string } {
+  const m = QUOTE_RE.exec(text);
+  const replyTo = m?.[1];
+  const body = m?.[2];
+  return replyTo === undefined || body === undefined ? { text } : { replyTo, text: body };
+}
+
+const FILE_NONCE = new Uint8Array([...new Array<number>(23).fill(0), 1]);
+
+export const newBlobKey = (): Uint8Array => nacl.randomBytes(nacl.secretbox.keyLength);
+
+export const sealBlob = (data: Uint8Array, key: Uint8Array): Uint8Array => nacl.secretbox(data, FILE_NONCE, key);
+
+export const openBlob = (data: Uint8Array, key: Uint8Array): Uint8Array | null => nacl.secretbox.open(data, FILE_NONCE, key);

package/runtime/node_modules/@metro-labs/threema/src/files.ts

@@ -0,0 +1,58 @@
+import { readFile } from 'node:fs/promises';
+import { emit } from '@metro-labs/core/stations/station-runtime';
+import { attachmentFailedEvent, attachmentSavedEvent, emitInbound } from '@metro-labs/core/stations/train-events';
+import { assertAttachmentSize, isImageMime, kindOf, saveBufferToCache } from '@metro-labs/core/stations/attachments';
+import { TrainError } from '@metro-labs/core/train-error';
+import type { Account } from './accounts.js';
+import { downloadBlob, uploadBlob } from './api.js';
+import { bytesToHex, hexToBytes, newBlobKey, openBlob, sealBlob } from './crypto.js';
+import { textEnvelope, type InboundMeta, type Room } from './format.js';
+import { encodeFile, encodeGroupFile, type FileData, type GroupRef } from './messages.js';
+
+export const MAX_BLOB_BYTES = 50 * 1024 * 1024;
+
+export interface OutgoingFile {
+  path: string;
+  mime: string;
+  name: string;
+}
+
+export async function packFile(acct: Account, file: OutgoingFile, caption: string | null): Promise<FileData> {
+  const data = await readFile(file.path);
+  assertAttachmentSize(data.length);
+  if (data.length > MAX_BLOB_BYTES) throw new TrainError('threema_file_too_big', `Threema carries files up to 50 MB; ${file.name} is bigger`, { retryable: false });
+  const key = newBlobKey();
+  const blobId = await uploadBlob(acct.cfg, sealBlob(new Uint8Array(data), key));
+  return { blobId, key: bytesToHex(key), mime: file.mime, name: file.name, size: data.length, caption, media: isImageMime(file.mime) };
+}
+
+export const encodeFileFor = (group: GroupRef | null, file: FileData): Uint8Array => (group === null ? encodeFile(file) : encodeGroupFile(group, file));
+
+export const fileLabel = (file: OutgoingFile): string => kindOf(file.mime, file.path);
+
+async function fetchFile(acct: Account, m: InboundMeta, file: FileData): Promise<{ path: string; bytes: number }> {
+  const sealed = await downloadBlob(acct.cfg, file.blobId);
+  const plain = openBlob(sealed, hexToBytes(file.key, 'blob key'));
+  if (plain === null) throw new TrainError('threema_bad_blob', 'the file did not decrypt with the key in the message', { retryable: false });
+  const saved = await saveBufferToCache(plain, m.messageId, 0, { mime: file.mime, name: file.name });
+  return { path: saved.path, bytes: saved.bytes };
+}
+
+export function deliverFile(acct: Account, m: InboundMeta, file: FileData, room: Room, sentByUs: (id: string) => boolean): void {
+  const env = textEnvelope(acct.cfg.id, m, file.caption ?? '', sentByUs, room);
+  const line = String(env.line);
+  const forId = String(env.id);
+  const payload = { ...(env.payload as Record<string, unknown>), attachments: [{ kind: kindOf(file.mime, file.name), name: file.name, mime: file.mime, ...(file.size === null ? {} : { size: file.size }) }] };
+  emitInbound(acct.cfg.id, { ...env, payload });
+  const at = { station: 'threema', account: acct.cfg.id, line, forId, index: 0 };
+  const kind = kindOf(file.mime, file.name);
+  fetchFile(acct, m, file)
+    .then(({ path, bytes }) => {
+      emit(attachmentSavedEvent({ ...at, saved: { path, mime: file.mime, name: file.name }, extra: { kind, size: bytes } }));
+    })
+    .catch((err: unknown) => {
+      const reason = err instanceof Error ? err.message : String(err);
+      process.stderr.write(`threema[${acct.cfg.id}]: could not fetch ${file.name} from ${m.from}: ${reason}\n`);
+      emit(attachmentFailedEvent({ ...at, reason, extra: { kind } }));
+    });
+}

package/runtime/node_modules/@metro-labs/threema/src/format.ts

@@ -0,0 +1,169 @@
+import { emit, mintId } from '@metro-labs/core/stations/station-runtime';
+import { selfUri } from '@metro-labs/core/stations/train-events';
+import { unquote } from './crypto.js';
+import { groupKey } from './groups.js';
+import { RECEIPT_ACK, RECEIPT_DECLINE, type GroupRef } from './messages.js';
+
+const REACTION_OF: Record<number, string> = {
+  [RECEIPT_ACK]: '👍',
+  [RECEIPT_DECLINE]: '👎',
+};
+
+export const lineOf = (accountId: string, threemaId: string): string =>
+  `metro://threema/${accountId}/${threemaId}`;
+
+export const groupLineOf = (accountId: string, group: GroupRef): string =>
+  `metro://threema/${accountId}/${groupKey(group)}`;
+
+const userOf = (accountId: string, threemaId: string): string =>
+  `metro://threema/${accountId}/user/${threemaId}`;
+
+export interface InboundMeta {
+  from: string;
+  to: string;
+  messageId: string;
+  date: string;
+  nickname?: string;
+}
+
+export interface Room {
+  group: GroupRef | null;
+  name: string | null;
+}
+
+export const DIRECT: Room = { group: null, name: null };
+
+const MENTION_ALL = '@@@@@@@@';
+
+export const mentionsSelf = (text: string, self: string): boolean =>
+  text.includes(MENTION_ALL) || text.toUpperCase().includes(`@@${self.toUpperCase()}`);
+
+function tsOf(date: string): string {
+  const seconds = Number(date);
+  return Number.isFinite(seconds) && seconds > 0
+    ? new Date(seconds * 1000).toISOString()
+    : new Date().toISOString();
+}
+
+function base(
+  accountId: string,
+  m: InboundMeta,
+  type: string,
+  room: Room,
+): Record<string, unknown> {
+  const group = room.group;
+  return {
+    kind: 'inbound',
+    id: mintId(),
+    ts: tsOf(m.date),
+    station: 'threema',
+    line: group === null ? lineOf(accountId, m.from) : groupLineOf(accountId, group),
+    line_name: group === null ? (m.nickname ?? m.from) : (room.name ?? groupKey(group)),
+    from: userOf(accountId, m.from),
+    from_name: m.nickname,
+    from_display_name: m.nickname,
+    is_private: group === null,
+    payload: { from: m.from, to: m.to, nickname: m.nickname ?? null, type, ...(group === null ? {} : { group: groupKey(group) }) },
+  };
+}
+
+export function textEnvelope(
+  accountId: string,
+  m: InboundMeta,
+  raw: string,
+  sentByUs: (messageId: string) => boolean,
+  room: Room = DIRECT,
+): Record<string, unknown> {
+  const { replyTo, text } = unquote(raw);
+  return {
+    ...base(accountId, m, 'text', room),
+    message_id: m.messageId,
+    text,
+    ...(room.group !== null && mentionsSelf(text, m.to) ? { mentions_self: true } : {}),
+    ...(replyTo === undefined
+      ? {}
+      : {
+          reply_to: replyTo,
+          event: { type: 'reply', replyTo },
+          reply_to_self: sentByUs(replyTo),
+        }),
+  };
+}
+
+export function reactionEnvelope(
+  accountId: string,
+  m: InboundMeta,
+  emoji: string,
+  targetId: string,
+  removed: boolean,
+  room: Room = DIRECT,
+  type = 'reaction',
+): Record<string, unknown> {
+  return {
+    ...base(accountId, m, type, room),
+    message_id: `${m.messageId}:${targetId}`,
+    text: `[react ${emoji}${removed ? ' (removed)' : ''}]`,
+    emoji,
+    event: { type: 'react', emoji, targetId, ...(removed ? { removed: true } : {}) },
+  };
+}
+
+export function receiptEnvelope(
+  accountId: string,
+  m: InboundMeta,
+  status: number,
+  targetId: string,
+  room: Room = DIRECT,
+): Record<string, unknown> | null {
+  const emoji = REACTION_OF[status];
+  return emoji === undefined ? null : reactionEnvelope(accountId, m, emoji, targetId, false, room, 'receipt');
+}
+
+export function emitOutbound(
+  accountId: string,
+  line: string,
+  messageId: string,
+  text: string,
+  replyTo?: string,
+): void {
+  emit({
+    kind: 'outbound',
+    id: mintId(),
+    ts: new Date().toISOString(),
+    station: 'threema',
+    line,
+    from: selfUri('threema', accountId),
+    to: line,
+    message_id: messageId,
+    text,
+    reply_to: replyTo,
+    ...(replyTo ? { event: { type: 'reply', replyTo } } : {}),
+    account: accountId,
+    payload: { account: accountId },
+  });
+}
+
+export function emitOutboundReaction(
+  accountId: string,
+  line: string,
+  messageId: string,
+  emoji: string,
+  targetId: string,
+  removed: boolean,
+): void {
+  emit({
+    kind: 'outbound',
+    id: mintId(),
+    ts: new Date().toISOString(),
+    station: 'threema',
+    line,
+    from: selfUri('threema', accountId),
+    to: line,
+    message_id: messageId,
+    text: `[react ${emoji}${removed ? ' (removed)' : ''}]`,
+    emoji,
+    event: { type: 'react', emoji, targetId, ...(removed ? { removed: true } : {}) },
+    account: accountId,
+    payload: { account: accountId },
+  });
+}

package/runtime/node_modules/@metro-labs/threema/src/groups.ts

@@ -0,0 +1,96 @@
+import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { accountFiles } from '@metro-labs/core/stations/account-files';
+import type { GroupRef } from './messages.js';
+
+export const GROUP_RE = /^([A-Z0-9]{8}|\*[A-Z0-9]{7})-([0-9a-f]{16})$/i;
+
+export interface GroupRoster {
+  creator: string;
+  groupId: string;
+  members: string[];
+  name: string | null;
+}
+
+export const groupKey = (group: GroupRef): string => `${group.creator.toUpperCase()}-${group.groupId.toLowerCase()}`;
+
+export function parseGroupKey(resource: string): GroupRef | null {
+  const m = GROUP_RE.exec(resource);
+  return m === null ? null : { creator: (m[1] ?? '').toUpperCase(), groupId: (m[2] ?? '').toLowerCase() };
+}
+
+export const groupFiles = accountFiles('THREEMA_GROUPS_DIR', 'threema-groups-');
+
+const groupsFile = (accountId: string): string => groupFiles.path(accountId);
+
+function readRosters(accountId: string): Map<string, GroupRoster> {
+  try {
+    const raw: unknown = JSON.parse(readFileSync(groupsFile(accountId), 'utf8'));
+    const out = new Map<string, GroupRoster>();
+    if (Array.isArray(raw))
+      for (const entry of raw) {
+        const g = (entry ?? {}) as Partial<GroupRoster>;
+        if (typeof g.creator === 'string' && typeof g.groupId === 'string' && Array.isArray(g.members))
+          out.set(groupKey(g as GroupRef), { creator: g.creator, groupId: g.groupId, members: g.members.filter((m): m is string => typeof m === 'string'), name: typeof g.name === 'string' ? g.name : null });
+      }
+    return out;
+  } catch {
+    return new Map();
+  }
+}
+
+export class GroupStore {
+  private readonly rosters: Map<string, GroupRoster>;
+
+  constructor(
+    private readonly accountId: string,
+    private readonly self: string,
+  ) {
+    this.rosters = readRosters(accountId);
+  }
+
+  get(group: GroupRef): GroupRoster | undefined {
+    return this.rosters.get(groupKey(group));
+  }
+
+  list(): GroupRoster[] {
+    return [...this.rosters.values()];
+  }
+
+  setup(creator: string, groupId: string, members: string[]): GroupRoster {
+    const key = groupKey({ creator, groupId });
+    const held = this.rosters.get(key);
+    const roster: GroupRoster = { creator, groupId, members: [...new Set([creator, ...members])], name: held?.name ?? null };
+    this.rosters.set(key, roster);
+    this.save();
+    return roster;
+  }
+
+  rename(creator: string, groupId: string, name: string): void {
+    const held = this.rosters.get(groupKey({ creator, groupId }));
+    if (held === undefined) return;
+    held.name = name;
+    this.save();
+  }
+
+  leave(group: GroupRef, member: string): void {
+    const held = this.rosters.get(groupKey(group));
+    if (held === undefined) return;
+    if (member === this.self) this.rosters.delete(groupKey(group));
+    else held.members = held.members.filter((m) => m !== member);
+    this.save();
+  }
+
+  recipients(group: GroupRef): string[] | null {
+    const held = this.get(group);
+    return held === undefined ? null : held.members.filter((m) => m !== this.self);
+  }
+
+  private save(): void {
+    const path = groupsFile(this.accountId);
+    mkdirSync(dirname(path), { recursive: true });
+    const tmp = `${path}.${String(process.pid)}.tmp`;
+    writeFileSync(tmp, JSON.stringify(this.list()), { mode: 0o600 });
+    renameSync(tmp, path);
+  }
+}

package/runtime/node_modules/@metro-labs/threema/src/ids.ts

@@ -0,0 +1,21 @@
+export const GATEWAY_API = (
+  process.env.THREEMA_GATEWAY_URL ?? 'https://msgapi.threema.ch'
+).replace(/\/+$/, '');
+
+const THREEMA_ID_RE = /^(?:[A-Z0-9]{8}|\*[A-Z0-9]{7})$/;
+const KEY_HEX_RE = /^[0-9a-f]{64}$/;
+
+export const MESSAGE_ID_RE = /^[0-9a-f]{16}$/;
+
+export const isThreemaId = (raw: string): boolean => THREEMA_ID_RE.test(raw);
+
+export const isGatewayId = (raw: string): boolean =>
+  raw.startsWith('*') && isThreemaId(raw);
+
+export const normalizeThreemaId = (raw: string): string =>
+  raw.trim().toUpperCase();
+
+export function parsePrivateKey(raw: string): string | null {
+  const text = raw.trim().replace(/^private:/i, '').trim().toLowerCase();
+  return KEY_HEX_RE.test(text) ? text : null;
+}

package/runtime/node_modules/@metro-labs/threema/src/inbound.ts

@@ -0,0 +1,89 @@
+import type { Account } from './accounts.js';
+import { emitInbound } from '@metro-labs/core/stations/train-events';
+import {
+  DIRECT,
+  reactionEnvelope,
+  receiptEnvelope,
+  textEnvelope,
+  type InboundMeta,
+  type Room,
+} from './format.js';
+import { deliverFile } from './files.js';
+import type { Decoded, GroupRef } from './messages.js';
+import { requestSync, sentByUs } from './outbound.js';
+
+const synced = new Set<string>();
+
+function roomOf(acct: Account, group: GroupRef | null): Room {
+  if (group === null) return DIRECT;
+  return { group, name: acct.groups.get(group)?.name ?? null };
+}
+
+function askForRoster(acct: Account, group: GroupRef): void {
+  const key = `${acct.cfg.id}:${group.creator}-${group.groupId}`;
+  if (acct.groups.get(group) !== undefined || synced.has(key)) return;
+  synced.add(key);
+  requestSync(acct, group).catch((err: unknown) => {
+    process.stderr.write(`threema[${acct.cfg.id}]: could not ask ${group.creator} for the group roster: ${err instanceof Error ? err.message : String(err)}\n`);
+  });
+}
+
+function reactions(acct: Account, m: InboundMeta, d: Extract<Decoded, { kind: 'receipt' }>): string {
+  let count = 0;
+  for (const target of d.messageIds) {
+    const env = receiptEnvelope(acct.cfg.id, m, d.status, target, roomOf(acct, d.group));
+    if (env === null) continue;
+    emitInbound(acct.cfg.id, env);
+    count += 1;
+  }
+  return count > 0 ? 'reaction' : `receipt:${String(d.status)}`;
+}
+
+function control(acct: Account, m: InboundMeta, d: Decoded): string | null {
+  if (d.kind === 'group-setup') {
+    acct.groups.setup(m.from, d.groupId, d.members);
+    return 'group-setup';
+  }
+  if (d.kind === 'group-rename') {
+    acct.groups.rename(m.from, d.groupId, d.name);
+    return 'group-rename';
+  }
+  if (d.kind === 'group-leave') {
+    acct.groups.leave(d.group, m.from);
+    return 'group-leave';
+  }
+  return null;
+}
+
+function chat(acct: Account, m: InboundMeta, d: Decoded): string | null {
+  if (d.kind === 'text') {
+    emitInbound(acct.cfg.id, textEnvelope(acct.cfg.id, m, d.text, sentByUs));
+    return 'text';
+  }
+  if (d.kind === 'group-text') {
+    askForRoster(acct, d.group);
+    emitInbound(acct.cfg.id, textEnvelope(acct.cfg.id, m, d.text, sentByUs, roomOf(acct, d.group)));
+    return 'group-text';
+  }
+  if (d.kind === 'file') {
+    if (d.group !== null) askForRoster(acct, d.group);
+    deliverFile(acct, m, d.file, roomOf(acct, d.group), sentByUs);
+    return 'file';
+  }
+  if (d.kind === 'reaction') {
+    if (d.group !== null) askForRoster(acct, d.group);
+    emitInbound(acct.cfg.id, reactionEnvelope(acct.cfg.id, m, d.emoji, d.messageId, d.removed, roomOf(acct, d.group)));
+    return 'reaction';
+  }
+  return null;
+}
+
+export function deliver(acct: Account, m: InboundMeta, d: Decoded): string {
+  const handled = control(acct, m, d) ?? chat(acct, m, d);
+  if (handled !== null) return handled;
+  if (d.kind === 'receipt') return reactions(acct, m, d);
+  if (d.kind === 'typing') return 'typing';
+  const type = d.kind === 'other' ? `0x${d.type.toString(16)}` : d.kind;
+  process.stderr.write(`threema[${acct.cfg.id}]: ignored a message of type ${type} from ${m.from}\n`);
+  return `ignored:${type}`;
+}