@stage-labs/metro 0.1.0-beta.22 → 0.1.0-beta.221

package/runtime/node_modules/@metro-labs/gmail/src/query.ts

@@ -0,0 +1,99 @@
+import { mailFull, mailSummary, MAX_LIMIT, readQueryOf, str, type MailItem, type ReadQuery } from '@metro-labs/core/stations/mail';
+import { respond } from '@metro-labs/core/stations/station-runtime';
+import { accountOf, type Account } from './accounts.js';
+import { gmailJson, queryOf, USER } from './api.js';
+import { saveFile, withBodies } from './attachments.js';
+import { itemOf, LIST_HEADERS, mailFilesOf, type GmailMessage } from './message.js';
+
+type Args = Record<string, unknown>;
+
+const BATCH = 10;
+
+const listing = (): [string, string][] => [['format', 'metadata'], ...LIST_HEADERS.map((h): [string, string] => ['metadataHeaders', h])];
+
+const messagePath = (messageId: string, params: [string, string][]): string => `${USER}/messages/${encodeURIComponent(messageId)}?${queryOf(params)}`;
+
+const seconds = (iso: string): string => String(Math.floor(Date.parse(iso) / 1000));
+
+const untilOf = (q: ReadQuery, beforeAt: string): string | undefined => [q.until, beforeAt].filter((s) => s !== '').sort()[0];
+
+export function searchOf(q: ReadQuery, beforeAt: string): string {
+  const until = untilOf(q, beforeAt);
+  return [
+    q.query,
+    q.from === '' ? '' : `from:${q.from}`,
+    q.since === '' ? '' : `after:${seconds(q.since)}`,
+    until === undefined ? '' : `before:${seconds(until)}`,
+    q.unreadOnly ? 'is:unread' : '',
+  ]
+    .filter((s) => s !== '')
+    .join(' ');
+}
+
+function matches(q: ReadQuery, m: MailItem, beforeAt: string): boolean {
+  if (q.from !== '' && m.from !== q.from) return false;
+  if (q.unreadOnly && m.isRead) return false;
+  const at = Date.parse(m.date ?? '');
+  if (q.since !== '' && at < Date.parse(q.since)) return false;
+  const until = untilOf(q, beforeAt);
+  return until === undefined || at < Date.parse(until);
+}
+
+async function receivedAt(acct: Account, messageId: string): Promise<string> {
+  if (messageId === '') return '';
+  const m = await gmailJson<GmailMessage>(acct, messagePath(messageId, [['format', 'minimal']]));
+  return itemOf(m).date ?? '';
+}
+
+async function inThread(acct: Account, q: ReadQuery, threadId: string, beforeAt: string): Promise<MailItem[]> {
+  const thread = await gmailJson<{ messages?: GmailMessage[] }>(acct, `${USER}/threads/${encodeURIComponent(threadId)}?${queryOf(listing())}`);
+  return (thread.messages ?? [])
+    .map(itemOf)
+    .filter((m) => matches(q, m, beforeAt))
+    .reverse();
+}
+
+async function searched(acct: Account, q: ReadQuery, beforeAt: string): Promise<MailItem[]> {
+  const search = searchOf(q, beforeAt);
+  const params: [string, string][] = [...(search === '' ? [] : [['q', search] as [string, string]]), ['maxResults', String(q.threadId === null ? q.limit : MAX_LIMIT)]];
+  const found = await gmailJson<{ messages?: { id: string; threadId?: string }[] }>(acct, `${USER}/messages?${queryOf(params)}`);
+  const ids = (found.messages ?? []).filter((m) => q.threadId === null || m.threadId === q.threadId).slice(0, q.limit);
+  const items: MailItem[] = [];
+  for (let i = 0; i < ids.length; i += BATCH) {
+    const batch = ids.slice(i, i + BATCH).map((m) => gmailJson<GmailMessage>(acct, messagePath(m.id, listing())));
+    items.push(...(await Promise.all(batch)).map(itemOf));
+  }
+  return items;
+}
+
+async function list(id: string, acct: Account, q: ReadQuery): Promise<void> {
+  const beforeAt = await receivedAt(acct, q.before);
+  const found = q.threadId !== null && q.query === '' ? await inThread(acct, q, q.threadId, beforeAt) : await searched(acct, q, beforeAt);
+  respond(id, {
+    result: {
+      account: acct.id,
+      mode: q.query === '' ? 'filter' : 'search',
+      messages: found.slice(0, q.limit).map((m) => mailSummary('gmail', acct.id, m)),
+    },
+  });
+}
+
+async function one(id: string, acct: Account, messageId: string): Promise<void> {
+  const m = await withBodies(acct, await gmailJson<GmailMessage>(acct, messagePath(messageId, [['format', 'full']])));
+  const attachments = [];
+  for (const [index, file] of mailFilesOf(m).entries()) {
+    const saved = await saveFile(acct, m.id, file, index);
+    attachments.push({ name: file.name, mime: file.mime, kind: file.kind, size: saved.bytes, local_path: saved.path });
+  }
+  respond(id, { result: { account: acct.id, message: { ...mailFull('gmail', acct.id, itemOf(m)), attachments } } });
+}
+
+export async function read(id: string, args: Args): Promise<void> {
+  const acct = accountOf(args);
+  const messageId = str(args.messageId);
+  if (messageId !== '') {
+    await one(id, acct, messageId);
+    return;
+  }
+  await list(id, acct, readQueryOf('gmail', args));
+}

package/runtime/node_modules/@metro-labs/gmail/src/state.ts

@@ -0,0 +1,24 @@
+import { readJson, writeSecure } from '@metro-labs/core/secure-fs';
+import { accountFiles } from '@metro-labs/core/stations/account-files';
+import { seenOf } from '@metro-labs/core/stations/mail';
+import { tokenStateOf, type Tokens } from '@metro-labs/core/stations/oauth';
+
+export interface AccountState extends Tokens {
+  historyId: string | null;
+  seen: string[];
+}
+
+export const stateFiles = accountFiles('GMAIL_STATE_DIR', 'gmail-state-');
+
+export function loadState(accountId: string, seed: Partial<Tokens>): AccountState {
+  const saved = readJson<Record<string, unknown>>(stateFiles.path(accountId), {});
+  return {
+    ...tokenStateOf(saved, seed),
+    historyId: typeof saved.historyId === 'string' && saved.historyId !== '' ? saved.historyId : null,
+    seen: seenOf(saved.seen),
+  };
+}
+
+export function saveState(accountId: string, state: AccountState): void {
+  writeSecure(stateFiles.path(accountId), JSON.stringify(state));
+}

package/runtime/node_modules/@metro-labs/gmail/src/station.ts

@@ -0,0 +1,15 @@
+import type { ReadFilter, Station, Verb } from '@metro-labs/core/stations/types';
+import { stateFiles } from './state.js';
+
+export const gmailStation: Station = {
+  name: 'gmail',
+  hasAccounts: true,
+  hasTrain: true,
+  messageVerbs: new Set<Verb>(['send', 'reply', 'read']),
+  readFilters: new Set<ReadFilter>(['account', 'query', 'from', 'until', 'unread_only', 'message_id']),
+  approvals: false,
+  attachmentMode: 'canonical',
+  forget: stateFiles.forget,
+  forgetExcept: stateFiles.forgetExcept,
+  tools: [],
+};

package/runtime/node_modules/@metro-labs/gmail/src/trust.ts

@@ -0,0 +1,42 @@
+import { automatedByHeaders, automatedBySender, domainOf, firstHeader, type MailHeader, type Screened } from '@metro-labs/core/stations/mail-trust';
+
+const DMARC = /^dmarc=(\w+) header\.from=([a-z0-9.-]+)$/;
+const DKIM_PASS = /^dkim=pass((?: header\.[a-z]+=[^\s"()]+)+)$/;
+const DKIM_DOMAIN = / header\.(?:i=[^@\s]*@|d=)([a-z0-9.-]+)(?= |$)/g;
+
+function withoutComments(text: string): string {
+  let out = text.replace(/"(?:[^"\\]|\\.)*"/g, '""');
+  for (let before = ''; before !== out; ) {
+    before = out;
+    out = out.replace(/\([^()]*\)/g, ' ');
+  }
+  return out;
+}
+
+function clausesOf(result: string): string[] | null {
+  const clauses = withoutComments(result)
+    .split(';')
+    .map((c) => c.replace(/\s+/g, ' ').trim().toLowerCase());
+  return clauses[0] === 'mx.google.com' ? clauses.slice(1) : null;
+}
+
+const dkimAligned = (clauses: string[], fromDomain: string): boolean =>
+  clauses.some((c) => [...(DKIM_PASS.exec(c)?.[1] ?? '').matchAll(DKIM_DOMAIN)].some((m) => m[1] === fromDomain));
+
+function passes(clauses: string[], fromDomain: string): boolean {
+  const dmarc = clauses.map((c) => DMARC.exec(c)).find((m) => m !== null);
+  if (dmarc?.[2] !== undefined && dmarc[2] !== fromDomain) return false;
+  if (dmarc?.[1] === 'pass') return true;
+  return dmarc?.[1] !== 'fail' && dkimAligned(clauses, fromDomain);
+}
+
+export function senderVerified(headers: MailHeader[], fromAddress: string): boolean {
+  const fromDomain = domainOf(fromAddress);
+  const clauses = clausesOf(firstHeader(headers, 'authentication-results') ?? '');
+  return fromDomain !== '' && clauses !== null && passes(clauses, fromDomain);
+}
+
+export function screen(headers: MailHeader[], from: string, keepAutomated: boolean): Screened {
+  const automated = keepAutomated ? null : (automatedBySender(from) ?? automatedByHeaders(headers));
+  return automated === null ? { verified: senderVerified(headers, from) } : { skip: automated };
+}

package/runtime/node_modules/@metro-labs/http/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@metro-labs/http",
+  "version": "0.1.0",
+  "private": true,
+  "description": "How a metro server authenticates and answers a request: CORS, the JSON helpers, ApiError, the signed-identity header and the identity registry. Shared by the daemon and api.metro.box, never by a station.",
+  "type": "module",
+  "exports": {
+    "./cors": "./src/cors.ts",
+    "./api-http": "./src/api-http.ts",
+    "./api-error": "./src/api-error.ts",
+    "./return-to": "./src/return-to.ts",
+    "./mode-api": "./src/mode-api.ts",
+    "./workos-token": "./src/workos-token.ts"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "tsc --noEmit && bun test test/"
+  },
+  "dependencies": {
+    "@metro-labs/core": "workspace:*"
+  },
+  "devDependencies": {
+    "@stage-labs/config": "0.1.0-beta.2",
+    "eslint": "^10.3.0",
+    "knip": "^6.15.0",
+    "madge": "^8.0.0",
+    "typescript": "^5"
+  }
+}

package/runtime/node_modules/@metro-labs/http/src/api-http.ts

@@ -0,0 +1,135 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { ApiError } from './api-error.js';
+import { errMsg, log } from '@metro-labs/core/log';
+
+const BODY_MAX = 4 * 1024;
+
+export type Role = 'admin' | 'member';
+
+export interface ApiSession {
+  subject: string;
+  role: Role;
+}
+
+export type BearerSessions = (req: IncomingMessage) => Promise<ApiSession | null>;
+
+let bearerSessions: BearerSessions | null = null;
+
+export function setBearerSessions(fn: BearerSessions | null): void {
+  bearerSessions = fn;
+}
+
+export function requireAdmin(session: ApiSession): void {
+  if (session.role !== 'admin') throw new ApiError('this needs the admin role in your organization', 403);
+}
+
+export function cors(req: IncomingMessage): Record<string, string> {
+  return {
+    'access-control-allow-origin': req.headers.origin ?? '*',
+    'access-control-allow-methods': 'GET, POST, PUT, DELETE, OPTIONS',
+    'access-control-allow-headers': 'Authorization, Content-Type',
+    'access-control-allow-private-network': 'true',
+    'access-control-max-age': '86400',
+    vary: 'Origin',
+  };
+}
+
+export function sendJson(
+  req: IncomingMessage,
+  res: ServerResponse,
+  status: number,
+  body: unknown,
+): void {
+  res.writeHead(status, {
+    'content-type': 'application/json',
+    'cache-control': 'no-store',
+    ...cors(req),
+  });
+  res.end(JSON.stringify(body));
+}
+
+export function apiSession(req: IncomingMessage): Promise<ApiSession | null> {
+  return bearerSessions === null ? Promise.resolve(null) : bearerSessions(req);
+}
+
+export async function readJsonBody(req: IncomingMessage, max = BODY_MAX): Promise<unknown> {
+  const chunks: Buffer[] = [];
+  let total = 0;
+  let over = false;
+  for await (const c of req) {
+    const buf = c as Buffer;
+    total += buf.length;
+    if (total > max) over = true;
+    if (!over) chunks.push(buf);
+    else if (total > 2 * max) break;
+  }
+  if (over) throw new ApiError('request body too large', 413);
+  const raw = Buffer.concat(chunks).toString('utf8').trim();
+  if (raw === '') return {};
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw new ApiError('body must be JSON', 400);
+  }
+}
+
+export function apiFailure(
+  req: IncomingMessage,
+  res: ServerResponse,
+  err: unknown,
+  label = 'agent-api',
+): void {
+  if (err instanceof ApiError) {
+    sendJson(req, res, err.status, { error: err.message });
+    return;
+  }
+  log.warn({ err: errMsg(err) }, `${label}: request failed`);
+  if (!res.headersSent) sendJson(req, res, 500, { error: `${label} failed` });
+}
+
+export interface SessionRoute {
+  methods: Readonly<Record<string, readonly string[]>>;
+  admin: boolean | readonly string[];
+  label: string;
+}
+
+const needsAdmin = (route: SessionRoute, method: string): boolean =>
+  route.admin === true || (Array.isArray(route.admin) && route.admin.includes(method));
+
+export function sessionRoute(
+  req: IncomingMessage,
+  res: ServerResponse,
+  route: SessionRoute,
+  handler: (session: ApiSession, path: string) => Promise<unknown>,
+): boolean {
+  const path = (req.url ?? '').split('?')[0] ?? '';
+  const methods = Object.hasOwn(route.methods, path) ? route.methods[path] : undefined;
+  if (methods === undefined) return false;
+  const method = req.method ?? '';
+  if (method === 'OPTIONS') {
+    res.writeHead(204, cors(req)).end();
+    return true;
+  }
+  if (!methods.includes(method)) {
+    sendJson(req, res, 405, { error: 'method not allowed' });
+    return true;
+  }
+  apiSession(req)
+    .then(async (session) => {
+      if (!session) throw new ApiError('unauthorized', 401);
+      if (needsAdmin(route, method)) requireAdmin(session);
+      sendJson(req, res, 200, await handler(session, path));
+    })
+    .catch((err: unknown) => {
+      apiFailure(req, res, err, route.label);
+    });
+  return true;
+}
+
+export function bodyField(body: unknown, key: string): unknown {
+  return typeof body === 'object' && body !== null && !Array.isArray(body)
+    ? (body as Record<string, unknown>)[key]
+    : undefined;
+}
+
+export const stringOf = (value: unknown): string => (typeof value === 'string' ? value : '');

package/runtime/node_modules/@metro-labs/{mcp/src/daemon/session-api.ts → http/src/mode-api.ts}

@@ -1,11 +1,20 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
-import { apiSession, cors, sendJson } from './api-http.js';
+import { cors, sendJson } from './api-http.js';
 
-const PATH = '/api/session';
+const PATH = '/api/mode';
 
-export function handleSessionApiRequest(
+export type DaemonMode = 'hosted' | 'local';
+
+export interface ModeInfo {
+  mode: DaemonMode;
+  owner: string | null;
+  version: string;
+}
+
+export function handleModeRequest(
   req: IncomingMessage,
   res: ServerResponse,
+  info: () => ModeInfo,
 ): boolean {
   const path = (req.url ?? '').split('?')[0] ?? '';
   if (path !== PATH) return false;
@@ -17,11 +26,6 @@ export function handleSessionApiRequest(
     sendJson(req, res, 405, { error: 'method not allowed' });
     return true;
   }
-  const session = apiSession(req);
-  if (!session) {
-    sendJson(req, res, 401, { error: 'unauthorized' });
-    return true;
-  }
-  sendJson(req, res, 200, { email: session.email });
+  sendJson(req, res, 200, info());
   return true;
 }

package/runtime/node_modules/@metro-labs/http/src/return-to.ts

@@ -0,0 +1,21 @@
+const PREVIEW = /^([a-z0-9-]+--)?metro-ui\.netlify\.app$/;
+
+export function allowedWebHost(host: string): boolean {
+  if (host === 'metro.box' || host === 'localhost' || host === '127.0.0.1')
+    return true;
+  return PREVIEW.test(host);
+}
+
+export function validateReturnTo(returnTo: string): boolean {
+  let url: URL;
+  try {
+    url = new URL(returnTo);
+  } catch {
+    return false;
+  }
+  const host = url.hostname;
+  if (url.protocol === 'http:' && (host === 'localhost' || host === '127.0.0.1'))
+    return true;
+  if (url.protocol !== 'https:') return false;
+  return allowedWebHost(host);
+}

package/runtime/node_modules/@metro-labs/http/src/workos-token.ts

@@ -0,0 +1,149 @@
+import type { IncomingMessage } from 'node:http';
+import { createPublicKey, verify, type JsonWebKey, type KeyObject } from 'node:crypto';
+
+const WORKOS_API = 'https://api.workos.com';
+const ORG_RE = /^org_[A-Za-z0-9]{10,64}$/;
+export const isOrganizationId = (value: string): boolean => ORG_RE.test(value);
+export const DEFAULT_CLIENT_ID = 'client_01M2TJJJ6RM9CT081QB4XZK3G2';
+const SKEW_S = 60;
+const REFETCH_COOLDOWN_MS = 60_000;
+const FETCH_MS = 10_000;
+
+export interface Session {
+  userId: string;
+  sessionId: string;
+  organization: string | null;
+  role: string | null;
+  expiresAt: number;
+}
+
+export interface KeyStore {
+  read: () => string | null;
+  write: (text: string) => void;
+}
+
+export const filled = (value: string | undefined): string | null => {
+  const text = value?.trim() ?? '';
+  return text === '' ? null : text;
+};
+
+export const clientId = (env: NodeJS.ProcessEnv = process.env): string => filled(env.WORKOS_CLIENT_ID) ?? DEFAULT_CLIENT_ID;
+export const workosBase = (env: NodeJS.ProcessEnv = process.env): string => filled(env.WORKOS_API_BASE) ?? WORKOS_API;
+export const jwksUrl = (id: string, base = WORKOS_API): string => `${base}/sso/jwks/${id}`;
+
+function jwksKeys(text: string): Map<string, KeyObject> {
+  const keys = new Map<string, KeyObject>();
+  const parsed: unknown = JSON.parse(text);
+  const list = typeof parsed === 'object' && parsed !== null ? (parsed as { keys?: unknown }).keys : undefined;
+  if (!Array.isArray(list)) return keys;
+  for (const jwk of list) {
+    if (typeof jwk !== 'object' || jwk === null) continue;
+    const { kid, kty } = jwk as { kid?: unknown; kty?: unknown };
+    if (typeof kid !== 'string' || kty !== 'RSA') continue;
+    try {
+      keys.set(kid, createPublicKey({ key: jwk as JsonWebKey, format: 'jwk' }));
+    } catch {
+      continue;
+    }
+  }
+  return keys;
+}
+
+export class SigningKeys {
+  private keys = new Map<string, KeyObject>();
+  private lastMiss = 0;
+  private loaded = false;
+
+  constructor(
+    private readonly url: string,
+    private readonly store?: KeyStore,
+  ) {}
+
+  private load(): void {
+    if (this.loaded) return;
+    this.loaded = true;
+    const cached = this.store?.read() ?? null;
+    if (cached !== null) this.keys = jwksKeys(cached);
+  }
+
+  private async refresh(now: number): Promise<void> {
+    if (now - this.lastMiss < REFETCH_COOLDOWN_MS) return;
+    const res = await fetch(this.url, { signal: AbortSignal.timeout(FETCH_MS) });
+    if (!res.ok) throw new Error(`the signing keys answered ${String(res.status)}`);
+    const text = await res.text();
+    const keys = jwksKeys(text);
+    if (keys.size === 0) throw new Error('the signing keys answered no RSA key');
+    this.keys = keys;
+    this.store?.write(text);
+  }
+
+  async keyFor(kid: string, now = Date.now()): Promise<KeyObject | null> {
+    this.load();
+    const held = this.keys.get(kid);
+    if (held !== undefined) return held;
+    await this.refresh(now);
+    const fetched = this.keys.get(kid);
+    if (fetched === undefined) this.lastMiss = now;
+    return fetched ?? null;
+  }
+}
+
+const b64url = (text: string): Buffer => Buffer.from(text.replace(/-/g, '+').replace(/_/g, '/'), 'base64');
+
+function jsonPart(text: string): Record<string, unknown> | null {
+  try {
+    const parsed: unknown = JSON.parse(b64url(text).toString('utf8'));
+    return typeof parsed === 'object' && parsed !== null ? (parsed as Record<string, unknown>) : null;
+  } catch {
+    return null;
+  }
+}
+
+const str = (value: unknown): string | null => (typeof value === 'string' && value !== '' ? value : null);
+
+const issuedBy = (iss: unknown, issuer: string): boolean => typeof iss === 'string' && (iss === issuer || iss.startsWith(`${issuer}/`));
+
+function sessionOf(claims: Record<string, unknown>, issuer: string, now: number): Session | null {
+  const exp = typeof claims.exp === 'number' ? claims.exp : null;
+  const userId = str(claims.sub);
+  const sessionId = str(claims.sid);
+  if (!issuedBy(claims.iss, issuer) || exp === null || userId === null || sessionId === null) return null;
+  if (exp * 1000 < now - SKEW_S * 1000) return null;
+  return { userId, sessionId, organization: str(claims.org_id), role: str(claims.role), expiresAt: exp * 1000 };
+}
+
+interface Parts {
+  signed: string;
+  body: string;
+  signature: Buffer;
+  kid: string;
+}
+
+function parseToken(token: string): Parts | null {
+  const [head, body, sig] = token.split('.');
+  if (head === undefined || body === undefined || sig === undefined) return null;
+  const header = jsonPart(head);
+  const kid = str(header?.kid);
+  if (header?.alg !== 'RS256' || kid === null) return null;
+  return { signed: `${head}.${body}`, body, signature: b64url(sig), kid };
+}
+
+export async function verifyToken(token: string, keys: SigningKeys, issuer = WORKOS_API, now = Date.now()): Promise<Session | null> {
+  const parts = parseToken(token);
+  if (parts === null) return null;
+  const key = await keys.keyFor(parts.kid, now).catch(() => null);
+  if (key === null || !verify('sha256', Buffer.from(parts.signed), key, parts.signature)) return null;
+  const claims = jsonPart(parts.body);
+  return claims === null ? null : sessionOf(claims, issuer, now);
+}
+
+export function bearerToken(req: IncomingMessage): string | null {
+  const header = req.headers.authorization ?? '';
+  const [scheme, token] = header.trim().split(/\s+/);
+  return scheme?.toLowerCase() === 'bearer' && token?.includes('.') === true ? token : null;
+}
+
+export async function bearerSession(req: IncomingMessage, keys: SigningKeys, issuer = WORKOS_API): Promise<Session | null> {
+  const token = bearerToken(req);
+  return token === null ? null : verifyToken(token, keys, issuer);
+}

package/runtime/node_modules/@metro-labs/outlook/package.json

@@ -0,0 +1,25 @@
+{
+  "name": "@metro-labs/outlook",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "exports": {
+    ".": "./src/station.ts",
+    "./train": "./src/index.ts",
+    "./login": "./src/login.ts"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "tsc --noEmit && bun test test/"
+  },
+  "dependencies": {
+    "@metro-labs/core": "workspace:*"
+  },
+  "devDependencies": {
+    "@stage-labs/config": "0.1.0-beta.2",
+    "eslint": "^10.3.0",
+    "knip": "^6.15.0",
+    "madge": "^8.0.0",
+    "typescript": "^5"
+  }
+}

package/runtime/node_modules/@metro-labs/outlook/src/accounts.ts

@@ -0,0 +1,78 @@
+import { makeAccountStore, resolveAccountId, type Die } from '@metro-labs/core/stations/account-store';
+import { threadOfLine } from '@metro-labs/core/stations/mail';
+import { TokenKeeper, type FetchLike } from '@metro-labs/core/stations/oauth';
+import { TrainError } from '@metro-labs/core/train-error';
+import { refreshTokens } from './auth.js';
+import { loadState, saveState, type AccountState } from './state.js';
+
+export interface AccountConfig {
+  id: string;
+  accountEmail: string;
+  refreshToken: string;
+  accessToken?: string;
+  expiresAt?: number;
+  includeAutomated?: boolean;
+}
+
+function checkAccount(a: AccountConfig, die: Die): void {
+  if (typeof a.accountEmail !== 'string' || !a.accountEmail.includes('@')) die(`account '${a.id}' has no mailbox address`);
+  if (typeof a.refreshToken !== 'string' || a.refreshToken === '') die(`account '${a.id}' has no refresh token`);
+}
+
+export const { loadAccounts } = makeAccountStore<AccountConfig>({
+  prefix: 'outlook',
+  validate(raw, die) {
+    for (const a of raw) checkAccount(a, die);
+  },
+});
+
+const signedOut = (err: unknown): never => {
+  throw new TrainError('outlook_signed_out', err instanceof Error ? err.message : String(err), { retryable: false });
+};
+
+export class Account {
+  readonly email: string;
+  readonly state: AccountState;
+  private readonly keeper: TokenKeeper;
+
+  constructor(
+    readonly cfg: AccountConfig,
+    private readonly fetchImpl: FetchLike = (input, init) => fetch(input, init),
+  ) {
+    this.email = cfg.accountEmail.toLowerCase();
+    this.state = loadState(cfg.id, { refreshToken: cfg.refreshToken, accessToken: cfg.accessToken ?? '', expiresAt: cfg.expiresAt ?? 0 });
+    this.keeper = new TokenKeeper(this.state, (refreshToken) => refreshTokens(refreshToken, this.fetchImpl).catch(signedOut), () => {
+      this.save();
+    });
+  }
+
+  get id(): string {
+    return this.cfg.id;
+  }
+
+  save(): void {
+    saveState(this.cfg.id, this.state);
+  }
+
+  token(force = false): Promise<string> {
+    return this.keeper.token(force);
+  }
+
+  fetch(input: string, init?: RequestInit): Promise<Response> {
+    return this.fetchImpl(input, init);
+  }
+}
+
+export const accounts = new Map<string, Account>();
+
+function accountFor(id: string): Account {
+  const acct = accounts.get(id);
+  if (!acct) throw new Error(`unknown account '${id}' (have: ${[...accounts.keys()].join(', ')})`);
+  return acct;
+}
+
+export function accountOf(args: { account?: unknown; line?: unknown }): Account {
+  const line = typeof args.line === 'string' && args.line !== '' ? args.line : undefined;
+  const account = typeof args.account === 'string' && args.account !== '' ? args.account : undefined;
+  return accountFor(resolveAccountId(accounts, { account, line }, (l) => threadOfLine('outlook', l)?.accountId));
+}

package/runtime/node_modules/@metro-labs/outlook/src/actions.ts

@@ -0,0 +1,14 @@
+import { makeStation, respond } from '@metro-labs/core/stations/station-runtime';
+import { accounts } from './accounts.js';
+import { MAILBOX_URL } from './config.js';
+import { reply, send } from './outbound.js';
+import { read } from './query.js';
+
+function listAccounts(id: string): void {
+  const list = [...accounts.values()].map((a) => ({ id: a.id, handle: a.email, url: MAILBOX_URL, email: a.email }));
+  respond(id, { result: { accounts: list } });
+}
+
+export const handleCall = makeStation({
+  handlers: { accounts: listAccounts, send, reply, read },
+});