@stage-labs/metro 0.1.0-beta.21 → 0.1.0-beta.210

package/runtime/node_modules/@metro-labs/telegram-bot/src/format.ts

@@ -0,0 +1,170 @@
+import { accounts, lineOf } from './accounts.js';
+import { reportAttachment } from '@metro-labs/core/stations/train-events';
+import { mintId } from '@metro-labs/core/stations/station-runtime';
+import { mediaRefOf, saveTelegramMedia } from './attachments.js';
+import type { TgMsg, TgReaction, TgReactionCount, TgUser } from './types.js';
+
+export type { TgMsg, TgReaction, TgReactionCount };
+
+function lineForMsg(
+  accountId: string,
+  m: TgMsg,
+): { line: string; topicId?: number } {
+  const topicId = m.is_topic_message ? m.message_thread_id : undefined;
+  return { line: lineOf(accountId, m.chat.id, topicId), topicId };
+}
+
+function stickerTag(s: NonNullable<TgMsg['sticker']>): string {
+  const set = s.set_name ? ` · ${s.set_name}` : '';
+  return `[sticker${s.emoji ? ` ${s.emoji}` : ''}${set}]`;
+}
+
+const TAG_EXTRACTORS: ((m: TgMsg) => string | null)[] = [
+  (m) => (m.photo?.length ? '[image]' : null),
+  (m) => (m.voice ? '[voice]' : null),
+  (m) => (m.audio ? `[audio: ${m.audio.file_name ?? 'audio'}]` : null),
+  (m) => (m.video ? `[video: ${m.video.file_name ?? 'video'}]` : null),
+  (m) => (m.animation ? `[gif: ${m.animation.file_name ?? 'gif'}]` : null),
+  (m) => (m.sticker ? stickerTag(m.sticker) : null),
+  (m) =>
+    m.document && !m.animation
+      ? `[file: ${m.document.file_name ?? 'doc'}]`
+      : null,
+  (m) =>
+    m.location
+      ? `[location: ${m.location.latitude}, ${m.location.longitude}]`
+      : null,
+  (m) => (m.dice ? `[dice ${m.dice.emoji} = ${m.dice.value}]` : null),
+];
+
+function projectText(m: TgMsg): string {
+  const tags = TAG_EXTRACTORS.map((f) => f(m)).filter(
+    (t): t is string => t !== null,
+  );
+  return [m.text ?? m.caption, ...tags].filter(Boolean).join(' ');
+}
+
+const botIdOf = (accountId: string): number | null => {
+  const token = accounts.get(accountId)?.cfg.token ?? '';
+  const id = Number(token.split(':')[0]);
+  return Number.isInteger(id) && id > 0 ? id : null;
+};
+
+function mentionsBot(m: TgMsg, botId: number | null, username: string | undefined): boolean {
+  const text = m.text ?? m.caption ?? '';
+  const handle = username === undefined ? null : `@${username.toLowerCase()}`;
+  return [...(m.entities ?? []), ...(m.caption_entities ?? [])].some((e) => {
+    if (e.type === 'text_mention') return botId !== null && e.user?.id === botId;
+    if (e.type !== 'mention' || handle === null) return false;
+    return text.slice(e.offset, e.offset + e.length).toLowerCase() === handle;
+  });
+}
+
+function addressing(accountId: string, m: TgMsg): Record<string, unknown> {
+  const botId = botIdOf(accountId);
+  const topicRoot = m.is_topic_message === true && m.reply_to_message?.message_id === m.message_thread_id;
+  const replied = topicRoot ? undefined : m.reply_to_message;
+  const replyTo = replied === undefined ? undefined : String(replied.message_id);
+  return {
+    ...(replyTo === undefined ? {} : { reply_to: replyTo, event: { type: 'reply', replyTo } }),
+    mentions_self: mentionsBot(m, botId, accounts.get(accountId)?.username),
+    reply_to_self: botId !== null && replied?.from?.id === botId,
+  };
+}
+
+export const fullName = (u: TgUser | undefined): string | undefined => {
+  const name = [u?.first_name, u?.last_name].filter((part) => typeof part === 'string' && part !== '').join(' ');
+  return name === '' ? undefined : name;
+};
+
+export function envelope(accountId: string, m: TgMsg): Record<string, unknown> {
+  const { line } = lineForMsg(accountId, m);
+  return {
+    id: mintId(),
+    ts: new Date(m.date * 1000).toISOString(),
+    station: 'telegram-bot',
+    line,
+    line_name: m.chat.title ?? m.chat.first_name ?? undefined,
+    from: `metro://telegram-bot/${accountId}/user/${m.from?.id ?? 'unknown'}`,
+    from_name: m.from?.username ? `@${m.from.username}` : m.from?.first_name,
+    from_display_name: fullName(m.from),
+    message_id: String(m.message_id),
+    text: projectText(m),
+    payload: m,
+    is_private: m.chat.type === 'private',
+    ...addressing(accountId, m),
+  };
+}
+
+export function reactionEnvelope(
+  accountId: string,
+  r: TgReaction,
+): Record<string, unknown> | null {
+  if (r.user?.is_bot) return null;
+  const newEmojis = r.new_reaction
+    .filter((x) => x.type === 'emoji')
+    .map((x) => x.emoji ?? '');
+  const oldEmojis = r.old_reaction
+    .filter((x) => x.type === 'emoji')
+    .map((x) => x.emoji ?? '');
+  const added = newEmojis.filter((e) => !oldEmojis.includes(e));
+  if (!added.length) return null;
+  return {
+    id: mintId(),
+    ts: new Date(r.date * 1000).toISOString(),
+    station: 'telegram-bot',
+    line: lineOf(accountId, r.chat.id),
+    from: `metro://telegram-bot/${accountId}/user/${r.user?.id ?? 'unknown'}`,
+    from_name: r.user?.username ? `@${r.user.username}` : r.user?.first_name,
+    from_display_name: fullName(r.user),
+    message_id: String(r.message_id),
+    emoji: added[0],
+    event: { type: 'react', emoji: added[0], targetId: String(r.message_id) },
+    is_private: r.chat.type === 'private',
+    payload: r,
+  };
+}
+
+export function reactionCountEnvelope(
+  accountId: string,
+  rc: TgReactionCount,
+): Record<string, unknown> | null {
+  const emojiReactions = rc.reactions.filter(
+    (r) => r.type.type === 'emoji' && r.type.emoji,
+  );
+  if (!emojiReactions.length) return null;
+  const top = emojiReactions.reduce((a, b) =>
+    b.total_count > a.total_count ? b : a,
+  );
+  const emoji = top.type.emoji ?? '';
+  if (!emoji) return null;
+  return {
+    id: mintId(),
+    ts: new Date(rc.date * 1000).toISOString(),
+    station: 'telegram-bot',
+    line: lineOf(accountId, rc.chat.id),
+    from: `metro://telegram-bot/${accountId}/user/unknown`,
+    message_id: String(rc.message_id),
+    emoji,
+    event: { type: 'react', emoji, targetId: String(rc.message_id) },
+    is_private: rc.chat.type === 'private',
+    payload: rc,
+  };
+}
+
+export function saveMediaAndEmit(
+  accountId: string,
+  m: TgMsg,
+  sourceEnvId: string,
+): void {
+  const ref = mediaRefOf(m);
+  if (!ref) return;
+  const line = lineForMsg(accountId, m).line;
+  reportAttachment(saveTelegramMedia(accountId, ref, String(m.message_id), 0), {
+    station: 'telegram-bot',
+    account: accountId,
+    line,
+    forId: sourceEnvId,
+    index: 0,
+  });
+}

package/runtime/node_modules/@metro-labs/telegram-bot/src/index.ts

@@ -0,0 +1,103 @@
+import { errMsg } from '@metro-labs/core/log';
+import { accounts, loadAccounts, tg, type Account } from './accounts.js';
+import { emitInbound } from '@metro-labs/core/stations/train-events';
+import { announceAccounts } from '@metro-labs/core/stations/train-boot';
+import {
+  envelope,
+  reactionCountEnvelope,
+  reactionEnvelope,
+  saveMediaAndEmit,
+  type TgMsg,
+  type TgReaction,
+  type TgReactionCount,
+} from './format.js';
+import { readCalls } from '@metro-labs/core/trains/protocol';
+import { handleCall } from './actions.js';
+
+readCalls('telegram-bot', handleCall);
+
+interface Update {
+  update_id: number;
+  message?: TgMsg;
+  message_reaction?: TgReaction;
+  message_reaction_count?: TgReactionCount;
+}
+
+function handleUpdate(id: string, u: Update): void {
+  if (u.message && !u.message.from?.is_bot) {
+    const env = envelope(id, u.message);
+    emitInbound(id, env);
+    saveMediaAndEmit(id, u.message, env.id as string);
+  }
+  if (u.message_reaction) {
+    const env = reactionEnvelope(id, u.message_reaction);
+    if (env) emitInbound(id, env);
+  }
+  if (u.message_reaction_count) {
+    const env = reactionCountEnvelope(id, u.message_reaction_count);
+    if (env) emitInbound(id, env);
+  }
+}
+
+async function runAccount(acct: Account): Promise<void> {
+  const { id } = acct.cfg;
+  try {
+    await tg(id, 'deleteWebhook', { drop_pending_updates: false });
+  } catch (err) {
+    process.stderr.write(
+      `telegram-bot[${id}] deleteWebhook: ${errMsg(err)}\n`,
+    );
+  }
+  try {
+    const me = await tg<{ username?: string }>(id, 'getMe', {});
+    if (typeof me.username === 'string') acct.username = me.username;
+  } catch (err) {
+    process.stderr.write(`telegram-bot[${id}] getMe: ${errMsg(err)}\n`);
+  }
+
+  for (;;) {
+    try {
+      const updates = await tg<Update[]>(
+        id,
+        'getUpdates',
+        {
+          offset: acct.offset,
+          timeout: 25,
+          allowed_updates: [
+            'message',
+            'message_reaction',
+            'message_reaction_count',
+          ],
+        },
+        60_000,
+      );
+      for (const u of updates) {
+        acct.offset = u.update_id + 1;
+        handleUpdate(id, u);
+      }
+    } catch (err) {
+      process.stderr.write(
+        `telegram-bot[${id}] poll error: ${errMsg(err)}\n`,
+      );
+      await new Promise((r) => setTimeout(r, 2_000));
+    }
+  }
+}
+
+const cfgs = loadAccounts();
+for (const cfg of cfgs) {
+  accounts.set(cfg.id, {
+    cfg,
+    api: `https://api.telegram.org/bot${cfg.token}`,
+    fileApi: `https://api.telegram.org/file/bot${cfg.token}`,
+    offset: 0,
+  });
+}
+announceAccounts('telegram-bot', accounts.keys());
+
+for (const acct of accounts.values())
+  runAccount(acct).catch((err: unknown) => {
+    process.stderr.write(
+      `telegram-bot[${acct.cfg.id}] account loop failed: ${errMsg(err)}\n`,
+    );
+  });

package/runtime/node_modules/@metro-labs/telegram-bot/src/media-actions.ts

@@ -0,0 +1,90 @@
+import { tg, targetOf } from './accounts.js';
+import { selfUri } from '@metro-labs/core/stations/train-events';
+import { emit, mintId, respond } from '@metro-labs/core/stations/station-runtime';
+import { appendFile } from '@metro-labs/core/stations/attachments';
+
+export function emitOutbound(
+  accountId: string,
+  line: string,
+  messageId: string,
+  text: string,
+  replyTo?: string,
+): void {
+  emit({
+    id: mintId(),
+    ts: new Date().toISOString(),
+    station: 'telegram-bot',
+    line,
+    from: selfUri(),
+    to: line,
+    message_id: messageId,
+    text,
+    reply_to: replyTo,
+    ...(replyTo ? { event: { type: 'reply', replyTo } } : {}),
+    payload: { account: accountId },
+  });
+}
+
+export function finishSend(
+  id: string,
+  accountId: string,
+  line: string,
+  messageId: string,
+  label: string,
+  replyTo?: string,
+  extra?: Record<string, unknown>,
+): void {
+  emitOutbound(accountId, line, messageId, label, replyTo);
+  respond(id, {
+    result: { messageId, account: accountId, ...extra },
+  });
+}
+
+interface MediaArgs {
+  line: string;
+  path: string;
+  caption?: string;
+  replyTo?: string;
+  account?: string;
+  name?: string;
+}
+
+export async function sendMedia(
+  method: string,
+  fieldName: string,
+  args: Record<string, unknown>,
+): Promise<{ accountId: string; message_id: number }> {
+  const {
+    line,
+    path,
+    caption,
+    replyTo,
+    account,
+    name: fileName,
+  } = args as unknown as MediaArgs;
+  const { accountId, chatId, topicId } = targetOf(line, account);
+  const form = new FormData();
+  form.append('chat_id', String(chatId));
+  if (topicId !== undefined) form.append('message_thread_id', String(topicId));
+  if (caption) form.append('caption', caption);
+  if (replyTo)
+    form.append(
+      'reply_parameters',
+      JSON.stringify({ message_id: Number(replyTo) }),
+    );
+  const name = fileName ?? path.split('/').pop() ?? fieldName;
+  await appendFile(form, fieldName, path, name);
+  const r = await tg<{ message_id: number }>(accountId, method, form);
+  return { accountId, message_id: r.message_id };
+}
+
+export const MEDIA_METHOD_FIELD: Record<
+  string,
+  { method: string; field: string }
+> = {
+  image: { method: 'sendPhoto', field: 'photo' },
+  voice: { method: 'sendVoice', field: 'voice' },
+  audio: { method: 'sendAudio', field: 'audio' },
+  video: { method: 'sendVideo', field: 'video' },
+  document: { method: 'sendDocument', field: 'document' },
+};

package/runtime/node_modules/@metro-labs/telegram-bot/src/members.ts

@@ -0,0 +1,47 @@
+import type { MemberList, MetroMember } from '@metro-labs/core/stations/types';
+
+export interface TgUser {
+  id: number;
+  username?: string;
+  first_name?: string;
+  last_name?: string;
+  is_bot?: boolean;
+}
+
+export interface TgChatMember {
+  user: TgUser;
+  status: string;
+}
+
+export function mapTgMember(m: TgChatMember): MetroMember {
+  const u = m.user;
+  const member: MetroMember = { id: String(u.id) };
+  if (u.username) member.name = u.username;
+  const display = [u.first_name, u.last_name].filter(Boolean).join(' ');
+  if (display) member.display_name = display;
+  member.is_admin = m.status === 'creator' || m.status === 'administrator';
+  member.is_bot = Boolean(u.is_bot);
+  return member;
+}
+
+const BOT_LIMIT_REASON =
+  'Telegram Bot API cannot enumerate full membership; returning administrators only.';
+
+export function adminMemberList(
+  admins: TgChatMember[],
+  total: number | null,
+): MemberList {
+  return {
+    members: admins.map(mapTgMember),
+    capability: {
+      supported: true,
+      complete: false,
+      reason: BOT_LIMIT_REASON,
+      ...(total != null ? { total } : {}),
+    },
+  };
+}
+
+export function inaccessibleMemberList(reason: string): MemberList {
+  return { members: [], capability: { supported: false, complete: false, reason } };
+}

package/runtime/node_modules/@metro-labs/telegram-bot/src/profile.ts

@@ -0,0 +1,85 @@
+import { appendFile } from '@metro-labs/core/stations/attachments';
+import {
+  assertImage,
+  fieldsOf,
+  parseProfileChange,
+  type ProfileApplied,
+  type ProfileAvatar,
+  type ProfileChange,
+} from '@metro-labs/core/stations/profile';
+import { makeProfileCache, nonEmpty, type SenderProfile } from '@metro-labs/core/stations/sender-profile';
+import { TrainError } from '@metro-labs/core/train-error';
+import { accountFor, accounts, tg } from './accounts.js';
+import { respond } from '@metro-labs/core/stations/station-runtime';
+
+async function setPhoto(accountId: string, avatar: ProfileAvatar): Promise<void> {
+  assertImage(avatar);
+  const form = new FormData();
+  form.append('photo', JSON.stringify({ type: 'static', photo: 'attach://avatar' }));
+  await appendFile(form, 'avatar', avatar.path, avatar.name);
+  await tg(accountId, 'setMyProfilePhoto', form);
+}
+
+export async function applyProfile(accountId: string, change: ProfileChange): Promise<void> {
+  if (change.name !== undefined) await tg(accountId, 'setMyName', { name: change.name });
+  if (change.bio !== undefined) await tg(accountId, 'setMyDescription', { description: change.bio });
+  if (change.avatar !== undefined) await setPhoto(accountId, change.avatar);
+}
+
+export async function setProfile(id: string, args: Record<string, unknown>): Promise<void> {
+  const accountId = accountFor({ account: args.account as string | undefined });
+  const change = parseProfileChange(args);
+  await applyProfile(accountId, change);
+  const result: ProfileApplied = { account: accountId, applied: fieldsOf(change) };
+  respond(id, { result });
+}
+
+interface TgChat {
+  username?: unknown;
+  first_name?: unknown;
+  last_name?: unknown;
+  bio?: unknown;
+  photo?: { small_file_id?: unknown };
+}
+
+const PHOTO_MAX = 64 * 1024;
+
+async function photoData(accountId: string, fileId: unknown): Promise<string | undefined> {
+  if (typeof fileId !== 'string' || fileId === '') return undefined;
+  try {
+    const file = await tg<{ file_path?: string }>(accountId, 'getFile', { file_id: fileId }, 10_000);
+    const acct = accounts.get(accountId);
+    if (acct === undefined || typeof file.file_path !== 'string') return undefined;
+    const res = await fetch(`${acct.fileApi}/${file.file_path}`, { signal: AbortSignal.timeout(10_000) });
+    if (!res.ok) return undefined;
+    const bytes = Buffer.from(await res.arrayBuffer());
+    return bytes.length === 0 || bytes.length > PHOTO_MAX ? undefined : `data:image/jpeg;base64,${bytes.toString('base64')}`;
+  } catch {
+    return undefined;
+  }
+}
+
+const senders = makeProfileCache<SenderProfile>(
+  async (key) => {
+    const [accountId, user] = key.split(':', 2) as [string, string];
+    const chat = await tg<TgChat>(accountId, 'getChat', { chat_id: Number(user) }, 10_000);
+    const handle = nonEmpty(chat.username);
+    const display = nonEmpty([chat.first_name, chat.last_name].filter((part) => typeof part === 'string').join(' '));
+    const avatar = await photoData(accountId, chat.photo?.small_file_id);
+    return {
+      id: user,
+      ...(handle === undefined ? {} : { name: `@${handle}` }),
+      ...(display === undefined ? {} : { display_name: display }),
+      ...(nonEmpty(chat.bio) === undefined ? {} : { about: nonEmpty(chat.bio) }),
+      ...(avatar === undefined ? {} : { avatar }),
+    };
+  },
+  { onError: (key, err) => process.stderr.write(`telegram-bot: could not read the profile of ${key}: ${err instanceof Error ? err.message : String(err)}\n`) },
+);
+
+export async function readProfile(id: string, args: Record<string, unknown>): Promise<void> {
+  const accountId = accountFor({ account: args.account as string | undefined });
+  const user = typeof args.user === 'string' ? args.user.trim() : '';
+  if (!/^\d+$/.test(user)) throw new TrainError('telegram_user_required', 'profile needs the numeric Telegram id of the person', { retryable: false });
+  respond(id, { result: (await senders.get(`${accountId}:${user}`)) ?? { id: user } });
+}

package/runtime/node_modules/@metro-labs/telegram-bot/src/station.ts

@@ -0,0 +1,21 @@
+import type { Station, Verb } from '@metro-labs/core/stations/types';
+import { PROFILE_FIELDS, type ProfileField } from '@metro-labs/core/stations/profile';
+
+export const telegramBotStation: Station = {
+  name: 'telegram-bot',
+  hasAccounts: true,
+  hasTrain: true,
+  messageVerbs: new Set<Verb>([
+    'send',
+    'reply',
+    'react',
+    'unreact',
+    'edit',
+    'delete',
+    'typing',
+  ]),
+  attachmentMode: 'canonical',
+  profileFields: new Set<ProfileField>(PROFILE_FIELDS),
+  readsProfiles: true,
+  tools: [],
+};

package/runtime/node_modules/@metro-labs/telegram-bot/src/types.ts

@@ -0,0 +1,56 @@
+export interface TgEntity {
+  type: string;
+  offset: number;
+  length: number;
+  user?: { id: number };
+}
+
+export interface TgUser {
+  id: number;
+  username?: string;
+  first_name?: string;
+  last_name?: string;
+  is_bot?: boolean;
+}
+
+export interface TgMsg {
+  entities?: TgEntity[];
+  caption_entities?: TgEntity[];
+  reply_to_message?: { message_id: number; from?: { id: number; username?: string; is_bot?: boolean } };
+  message_id: number;
+  date: number;
+  chat: { id: number; type: string; title?: string; first_name?: string };
+  from?: TgUser;
+  text?: string;
+  caption?: string;
+  message_thread_id?: number;
+  is_topic_message?: boolean;
+  photo?: { file_id: string; file_size?: number }[];
+  document?: { file_name?: string; file_id?: string; mime_type?: string };
+  voice?: { file_id?: string; duration?: number; mime_type?: string };
+  audio?: { file_id?: string; file_name?: string; mime_type?: string };
+  video?: { file_id?: string; file_name?: string; mime_type?: string };
+  animation?: { file_id?: string; file_name?: string; mime_type?: string };
+  sticker?: { file_id?: string; emoji?: string; set_name?: string };
+  location?: { latitude: number; longitude: number };
+  dice?: { emoji: string; value: number };
+}
+
+export interface TgReaction {
+  chat: { id: number; type: string };
+  message_id: number;
+  user?: TgUser;
+  date: number;
+  old_reaction: { type: string; emoji?: string }[];
+  new_reaction: { type: string; emoji?: string }[];
+}
+
+export interface TgReactionCount {
+  chat: { id: number; type: string };
+  message_id: number;
+  date: number;
+  reactions: {
+    type: { type: string; emoji?: string };
+    total_count: number;
+  }[];
+}

package/runtime/node_modules/@metro-labs/threema/package.json

@@ -0,0 +1,26 @@
+{
+  "name": "@metro-labs/threema",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "exports": {
+    ".": "./src/station.ts",
+    "./train": "./src/index.ts",
+    "./verify": "./src/verify.ts"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "tsc --noEmit && bun test test/"
+  },
+  "dependencies": {
+    "@metro-labs/core": "workspace:*",
+    "tweetnacl": "^1.0.3"
+  },
+  "devDependencies": {
+    "@stage-labs/config": "0.1.0-beta.2",
+    "eslint": "^10.3.0",
+    "knip": "^6.15.0",
+    "madge": "^8.0.0",
+    "typescript": "^5"
+  }
+}

package/runtime/node_modules/@metro-labs/threema/src/accounts.ts

@@ -0,0 +1,95 @@
+import {
+  makeAccountStore,
+  resolveAccountId,
+  type Die,
+} from '@metro-labs/core/stations/account-store';
+import { Line } from '@metro-labs/core/lines';
+import { fetchPublicKey } from './api.js';
+import { hexToBytes, keyPairFrom, type KeyPair } from './crypto.js';
+import { isGatewayId, normalizeThreemaId, parsePrivateKey } from './ids.js';
+import { GroupStore, parseGroupKey } from './groups.js';
+import type { GroupRef } from './messages.js';
+
+export interface AccountConfig {
+  id: string;
+  gatewayId: string;
+  secret: string;
+  privateKey: string;
+  callbackId?: string;
+  callbackToken?: string;
+}
+
+function checkAccount(a: AccountConfig, die: Die): void {
+  if (typeof a.gatewayId !== 'string' || !isGatewayId(a.gatewayId))
+    die(`account '${a.id}' has no Gateway ID`);
+  if (typeof a.secret !== 'string' || a.secret === '')
+    die(`account '${a.id}' missing secret`);
+  if (typeof a.privateKey !== 'string' || parsePrivateKey(a.privateKey) === null)
+    die(`account '${a.id}' has no usable private key`);
+}
+
+export const { loadAccounts } = makeAccountStore<AccountConfig>({
+  prefix: 'threema',
+  validate(raw, die) {
+    const seenGateway = new Set<string>();
+    for (const a of raw) {
+      checkAccount(a, die);
+      if (seenGateway.has(a.gatewayId))
+        die(`account '${a.id}' reuses the Gateway ID of another account`);
+      seenGateway.add(a.gatewayId);
+    }
+  },
+});
+
+export interface Account {
+  cfg: AccountConfig;
+  keys: KeyPair;
+  publicKeys: Map<string, Uint8Array>;
+  groups: GroupStore;
+}
+
+export type Target = { kind: 'user'; id: string } | { kind: 'group'; group: GroupRef };
+
+export const accounts = new Map<string, Account>();
+
+export function bootAccount(cfg: AccountConfig): Account {
+  const key = parsePrivateKey(cfg.privateKey);
+  if (key === null) throw new Error(`account '${cfg.id}' has no usable private key`);
+  return { cfg, keys: keyPairFrom(key), publicKeys: new Map(), groups: new GroupStore(cfg.id, cfg.gatewayId) };
+}
+
+export function accountFor(id: string): Account {
+  const acct = accounts.get(id);
+  if (!acct)
+    throw new Error(
+      `unknown account '${id}' (have: ${[...accounts.keys()].join(', ')})`,
+    );
+  return acct;
+}
+
+export function targetOf(
+  line: string,
+  account?: string,
+): { acct: Account; target: Target } {
+  const parsed = Line.parseThreema(line);
+  if (parsed === null) throw new Error(`not a threema line: ${line}`);
+  const id = resolveAccountId(
+    accounts,
+    { account, line },
+    (l) => Line.parseThreema(l)?.accountId,
+  );
+  const group = parseGroupKey(parsed.resource);
+  const target: Target = group === null ? { kind: 'user', id: normalizeThreemaId(parsed.resource) } : { kind: 'group', group };
+  return { acct: accountFor(id), target };
+}
+
+export async function publicKeyFor(
+  acct: Account,
+  threemaId: string,
+): Promise<Uint8Array> {
+  const cached = acct.publicKeys.get(threemaId);
+  if (cached) return cached;
+  const key = hexToBytes(await fetchPublicKey(acct.cfg, threemaId), 'public key');
+  acct.publicKeys.set(threemaId, key);
+  return key;
+}