fluxmail 0.0.1 → 0.2.0

package/dist/service/emailService.js

@@ -0,0 +1,380 @@
+import { computeReplyRecipients, EmailError, formatAddressList, forwardSubject, isEmailError, } from '@fluxmail/core';
+import { assertWithinQuota, checkLicenseState } from '../licensing/entitlements.js';
+import { listMembers } from '../storage/members.js';
+import { cancelScheduledSend, countPending, createScheduledSend, findPendingByDraft, getScheduledSend, listScheduledSends, markSent, } from '../storage/scheduledSends.js';
+const ADMIN_SCOPE = { memberId: null };
+const SCHEDULE_GRACE_MS = 60_000;
+const SCHEDULE_MAX_HORIZON_MS = 365 * 24 * 3_600_000;
+/** Parse and validate a sendAt timestamp; returns epoch ms. */
+export function resolveSendAt(sendAtIso, now = Date.now()) {
+    // Require an ISO 8601 shape: Date.parse alone is lenient enough to accept junk.
+    const sendAt = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}/.test(sendAtIso) ? Date.parse(sendAtIso) : NaN;
+    if (Number.isNaN(sendAt)) {
+        throw new EmailError('invalid_request', `Could not parse sendAt: "${sendAtIso}" (expected ISO 8601)`);
+    }
+    if (sendAt < now - SCHEDULE_GRACE_MS) {
+        throw new EmailError('invalid_request', 'sendAt is in the past; leave it out to send now');
+    }
+    if (sendAt > now + SCHEDULE_MAX_HORIZON_MS) {
+        throw new EmailError('invalid_request', 'sendAt is more than a year away');
+    }
+    return sendAt;
+}
+function toScheduledInfo(row) {
+    return {
+        scheduleId: row.id,
+        accountId: row.accountId,
+        draftId: row.draftId,
+        sendAt: new Date(row.sendAt).toISOString(),
+        status: row.status,
+        attempts: row.attempts,
+        ...(row.subject !== null ? { subject: row.subject } : {}),
+        ...(row.toRecipients !== null ? { to: row.toRecipients } : {}),
+        ...(row.lastError !== null ? { lastError: row.lastError } : {}),
+        ...(row.sentMessageId !== null ? { sentMessageId: row.sentMessageId } : {}),
+        ...(row.sentThreadId !== null ? { sentThreadId: row.sentThreadId } : {}),
+    };
+}
+/**
+ * All business logic lives here: account routing, reply/forward computation,
+ * entitlement enforcement, auth-failure bookkeeping. MCP tools (and the future
+ * REST API / CLI) are thin wrappers over this service.
+ */
+export class EmailService {
+    registry;
+    db;
+    scope;
+    /** Wired to SendScheduler.wake() in long-lived processes; a no-op for one-shot CLI commands. */
+    onScheduleChanged = () => { };
+    constructor(registry, db, scope = ADMIN_SCOPE) {
+        this.registry = registry;
+        this.db = db;
+        this.scope = scope;
+    }
+    /**
+     * A view of this service restricted to one member's mailboxes (shared + owned).
+     * The HTTP layer scopes each request to the authenticated API key's member;
+     * unscoped admin keys keep full access.
+     */
+    withScope(scope) {
+        const scoped = new EmailService(this.registry, this.db, scope);
+        scoped.onScheduleChanged = () => this.onScheduleChanged();
+        return scoped;
+    }
+    /** Shared mailboxes and, for member keys, the member's own mailboxes. */
+    canAccess(account) {
+        return this.scope.memberId === null || account.memberId == null || account.memberId === this.scope.memberId;
+    }
+    accessibleAccounts() {
+        const all = this.registry.listAccounts();
+        return this.scope.memberId === null ? all : all.filter((a) => this.canAccess(a));
+    }
+    /**
+     * Resolve an account id within the current scope. A member-scoped key defaults
+     * to its sole accessible mailbox and can never reach another member's mailbox;
+     * inaccessible ids surface as not_found so a key cannot probe for their existence.
+     */
+    resolveScopedAccountId(accountId) {
+        if (accountId !== undefined) {
+            const account = this.registry.getAccount(accountId);
+            if (!this.canAccess(account)) {
+                throw new EmailError('not_found', `No account with id "${accountId}"`);
+            }
+            return account.id;
+        }
+        if (this.scope.memberId === null)
+            return this.registry.resolveAccountId();
+        const accessible = this.accessibleAccounts();
+        if (accessible.length === 0) {
+            throw new EmailError('invalid_request', 'No email accounts are available for this member.');
+        }
+        if (accessible.length > 1) {
+            throw new EmailError('invalid_request', `Multiple accounts are available; specify accountId. Available: ${accessible
+                .map((a) => `${a.id} (${a.email})`)
+                .join(', ')}`);
+        }
+        return accessible[0].id;
+    }
+    /** Route a call to the right provider, recording auth failures on the account. */
+    async withProvider(accountId, fn) {
+        const resolvedId = this.resolveScopedAccountId(accountId);
+        const account = this.registry.getAccount(resolvedId);
+        if (account.status === 'disabled') {
+            throw new EmailError('invalid_request', `Account ${resolvedId} is disabled`);
+        }
+        try {
+            const result = await fn(this.registry.getProvider(resolvedId), resolvedId, account);
+            if (account.status === 'auth_error')
+                this.registry.markStatus(resolvedId, 'active');
+            return result;
+        }
+        catch (err) {
+            if (isEmailError(err) && err.code === 'auth_expired') {
+                this.registry.markStatus(resolvedId, 'auth_error');
+            }
+            throw err;
+        }
+    }
+    listAccounts() {
+        return this.accessibleAccounts();
+    }
+    async status() {
+        const accounts = this.accessibleAccounts();
+        const errors = new Map();
+        const warnings = new Map();
+        await Promise.all(accounts
+            .filter((account) => account.status !== 'disabled')
+            .map(async (account) => {
+            try {
+                await this.registry.getProvider(account.id).testConnection();
+                const provider = this.registry.getProvider(account.id);
+                if (provider.getFolderWarnings) {
+                    const folderWarnings = await provider.getFolderWarnings();
+                    if (folderWarnings.length)
+                        warnings.set(account.id, folderWarnings.map((warning) => warning.message));
+                }
+                if (account.status === 'auth_error')
+                    this.registry.markStatus(account.id, 'active');
+            }
+            catch (err) {
+                if (isEmailError(err) && err.code === 'auth_expired') {
+                    this.registry.markStatus(account.id, 'auth_error');
+                }
+                errors.set(account.id, isEmailError(err)
+                    ? { code: err.code, message: err.message }
+                    : { code: 'internal', message: err instanceof Error ? err.message : String(err) });
+            }
+        }));
+        const admin = this.scope.memberId === null;
+        const license = admin ? checkLicenseState(this.db) : undefined;
+        return {
+            // Re-read so statuses reflect any markStatus writes from the live checks above.
+            accounts: this.accessibleAccounts().map(({ id, provider, email, status, memberId }) => ({
+                id,
+                provider,
+                email,
+                status,
+                ...(memberId ? { memberId } : {}),
+                ...(errors.has(id) ? { error: errors.get(id) } : {}),
+                ...(warnings.has(id) ? { warnings: warnings.get(id) } : {}),
+            })),
+            ...(admin
+                ? {
+                    members: { count: listMembers(this.db).length },
+                    entitlements: license.entitlements,
+                    ...(license.warning ? { licenseWarning: license.warning } : {}),
+                }
+                : {}),
+            providersAvailable: ['gmail', 'imap'],
+            scheduled: this.scheduledStatus(),
+        };
+    }
+    /**
+     * Gate for MCP tool calls: throws once a lapsed license leaves the instance
+     * over the entitled caps; returns a renewal warning to attach to results
+     * while the license is in its grace period or has lapsed.
+     */
+    enforceQuota() {
+        if (this.scope.memberId !== null) {
+            const state = checkLicenseState(this.db);
+            if (state.overQuota) {
+                throw new EmailError('entitlement_exceeded', 'This Fluxmail instance is over its plan limits. Ask an administrator to renew the license or reduce usage.');
+            }
+            // License dates and renewal state are instance administration details.
+            return undefined;
+        }
+        return assertWithinQuota(this.db).warning;
+    }
+    scheduledStatus() {
+        if (this.scope.memberId === null) {
+            const { pending, nextSendAt } = countPending(this.db);
+            return {
+                pending,
+                ...(nextSendAt !== undefined ? { nextSendAt: new Date(nextSendAt).toISOString() } : {}),
+            };
+        }
+        const accessible = new Set(this.accessibleAccounts().map((account) => account.id));
+        const active = listScheduledSends(this.db).filter((row) => accessible.has(row.accountId) && (row.status === 'pending' || row.status === 'sending'));
+        const nextSendAt = active.length ? Math.min(...active.map((row) => row.sendAt)) : undefined;
+        return {
+            pending: active.length,
+            ...(nextSendAt !== undefined ? { nextSendAt: new Date(nextSendAt).toISOString() } : {}),
+        };
+    }
+    listFolders(accountId) {
+        return this.withProvider(accountId, (p) => p.listFolders());
+    }
+    listMessages(accountId, q, page) {
+        return this.withProvider(accountId, (p) => p.listMessages(q, page));
+    }
+    getMessage(accountId, id) {
+        return this.withProvider(accountId, (p) => p.getMessage(id));
+    }
+    getThread(accountId, threadId) {
+        return this.withProvider(accountId, (p) => p.getThread(threadId));
+    }
+    createDraft(accountId, d) {
+        return this.withProvider(accountId, async (p, _id, account) => {
+            return p.createDraft(await this.resolveRecipients(p, account, d));
+        });
+    }
+    updateDraft(accountId, draftId, d) {
+        return this.withProvider(accountId, async (p, _id, account) => {
+            return p.updateDraft(draftId, await this.resolveRecipients(p, account, d));
+        });
+    }
+    deleteDraft(accountId, draftId) {
+        return this.withProvider(accountId, (p) => p.deleteDraft(draftId));
+    }
+    send(accountId, input) {
+        return this.withProvider(accountId, async (p, resolvedId, account) => {
+            if ('draftId' in input) {
+                const result = await p.send({ draftId: input.draftId });
+                // Sending a scheduled draft now supersedes its schedule.
+                const pending = findPendingByDraft(this.db, resolvedId, input.draftId);
+                if (pending) {
+                    markSent(this.db, pending.id, result);
+                    this.onScheduleChanged();
+                }
+                return result;
+            }
+            return p.send(await this.resolveRecipients(p, account, input));
+        });
+    }
+    /**
+     * Draft-backed scheduled send: the content becomes a real provider draft
+     * immediately; only the schedule (draft id + fire time) is stored locally.
+     */
+    async scheduleSend(accountId, input, sendAtIso) {
+        const sendAt = resolveSendAt(sendAtIso);
+        const { draft, resolvedId } = await this.withProvider(accountId, async (p, id, account) => {
+            let message;
+            if ('draftId' in input) {
+                message = await p.getDraft(input.draftId);
+            }
+            else {
+                const resolved = await this.resolveRecipients(p, account, input);
+                if (!resolved.to?.length && !resolved.cc?.length && !resolved.bcc?.length) {
+                    throw new EmailError('invalid_request', 'Cannot schedule a message with no recipients');
+                }
+                message = await p.createDraft(resolved);
+            }
+            return { draft: message, resolvedId: id };
+        });
+        if (!draft.draftId) {
+            throw new EmailError('provider_unavailable', 'Provider did not return a draft id');
+        }
+        const row = createScheduledSend(this.db, {
+            accountId: resolvedId,
+            draftId: draft.draftId,
+            sendAt,
+            ...(draft.subject !== undefined ? { subject: draft.subject } : {}),
+            ...(draft.to?.length ? { toRecipients: formatAddressList(draft.to) } : {}),
+        });
+        this.onScheduleChanged();
+        return toScheduledInfo(row);
+    }
+    listScheduled(accountId) {
+        if (accountId !== undefined) {
+            return listScheduledSends(this.db, this.resolveScopedAccountId(accountId)).map(toScheduledInfo);
+        }
+        // Listing must work across accounts, but a member key only sees its own mailboxes'.
+        const rows = listScheduledSends(this.db);
+        if (this.scope.memberId === null)
+            return rows.map(toScheduledInfo);
+        const accessible = new Set(this.accessibleAccounts().map((a) => a.id));
+        return rows.filter((r) => accessible.has(r.accountId)).map(toScheduledInfo);
+    }
+    /** Cancels a pending schedule; the provider draft is kept. */
+    cancelScheduled(scheduleId) {
+        const row = getScheduledSend(this.db, scheduleId);
+        // A member key cannot see (or cancel) schedules on mailboxes it cannot reach.
+        if (!row || !this.canAccess(this.registry.getAccount(row.accountId))) {
+            throw new EmailError('not_found', `No scheduled send with id ${scheduleId}`);
+        }
+        if (row.status !== 'pending') {
+            throw new EmailError('invalid_request', `Scheduled send ${scheduleId} is already ${row.status}`);
+        }
+        if (!cancelScheduledSend(this.db, scheduleId)) {
+            throw new EmailError('invalid_request', `Scheduled send ${scheduleId} has already started sending`);
+        }
+        this.onScheduleChanged();
+        return { scheduleId, draftId: row.draftId, draftKept: true };
+    }
+    /**
+     * Reply recipient computation (provider-agnostic): when replying without explicit
+     * recipients, derive them from the original message: Reply-To/From for a plain
+     * reply; plus original To/Cc (minus our own address) for reply-all.
+     */
+    async resolveRecipients(p, account, input) {
+        const { replyAll, ...draft } = input;
+        if (!draft.replyToMessageId || draft.to?.length)
+            return draft;
+        const original = await p.getMessage(draft.replyToMessageId);
+        const recipients = computeReplyRecipients(original, account.email, replyAll ?? false);
+        draft.to = recipients.to;
+        if (recipients.cc.length && !draft.cc?.length)
+            draft.cc = recipients.cc;
+        return draft;
+    }
+    forward(accountId, input) {
+        return this.withProvider(accountId, async (p) => {
+            const original = await p.getMessage(input.messageId);
+            const includeAttachments = input.includeAttachments ?? true;
+            const attachments = [];
+            if (includeAttachments) {
+                for (const meta of original.attachments ?? []) {
+                    const { content } = await p.getAttachment(original.id, meta.id);
+                    attachments.push({
+                        filename: meta.filename,
+                        mimeType: meta.mimeType,
+                        content: content.toString('base64'),
+                        ...(meta.contentId ? { contentId: meta.contentId } : {}),
+                        ...(meta.disposition ? { disposition: meta.disposition } : {}),
+                    });
+                }
+            }
+            const draft = {
+                to: input.to,
+                ...(input.cc?.length ? { cc: input.cc } : {}),
+                subject: forwardSubject(original.subject),
+                body: buildForwardBody(original, input.comment),
+                ...(attachments.length ? { attachments } : {}),
+            };
+            return p.send(draft);
+        });
+    }
+    modify(accountId, ids, action) {
+        return this.withProvider(accountId, (p) => p.modify(ids, action));
+    }
+    getAttachment(accountId, messageId, attachmentId) {
+        return this.withProvider(accountId, (p) => p.getAttachment(messageId, attachmentId));
+    }
+}
+export function buildForwardBody(original, comment) {
+    const headerLines = [
+        '---------- Forwarded message ----------',
+        `From: ${original.from ? formatAddressList([original.from]) : '(unknown)'}`,
+        `Date: ${original.date}`,
+        `Subject: ${original.subject}`,
+        `To: ${formatAddressList(original.to)}`,
+        ...(original.cc?.length ? [`Cc: ${formatAddressList(original.cc)}`] : []),
+    ].join('\n');
+    const body = {};
+    const originalText = original.body?.text;
+    const originalHtml = original.body?.html;
+    if (originalText !== undefined || originalHtml === undefined) {
+        body.text = [comment, headerLines, '', originalText ?? ''].filter((x) => x !== undefined).join('\n\n');
+    }
+    if (originalHtml !== undefined) {
+        const escapedHeader = escapeHtml(headerLines).replace(/\n/g, '<br>');
+        body.html =
+            (comment ? `<p>${escapeHtml(comment)}</p>` : '') +
+                `<p>${escapedHeader}</p><blockquote style="border-left:1px solid #ccc;padding-left:1ex;margin:0 0 0 0.8ex">${originalHtml}</blockquote>`;
+    }
+    return body;
+}
+function escapeHtml(s) {
+    return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+//# sourceMappingURL=emailService.js.map

package/dist/service/emailService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emailService.js","sourceRoot":"","sources":["../../src/service/emailService.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,UAAU,EACV,iBAAiB,EACjB,cAAc,EACd,YAAY,GAcb,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAqB,MAAM,8BAA8B,CAAC;AAEvG,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EACL,mBAAmB,EACnB,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,QAAQ,GAGT,MAAM,8BAA8B,CAAC;AAatC,MAAM,WAAW,GAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AA0CpD,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,MAAM,uBAAuB,GAAG,GAAG,GAAG,EAAE,GAAG,SAAS,CAAC;AAErD,+DAA+D;AAC/D,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC/D,gFAAgF;IAChF,MAAM,MAAM,GAAG,gCAAgC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC9F,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,4BAA4B,SAAS,uBAAuB,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,MAAM,GAAG,GAAG,GAAG,iBAAiB,EAAE,CAAC;QACrC,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,iDAAiD,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,MAAM,GAAG,GAAG,GAAG,uBAAuB,EAAE,CAAC;QAC3C,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,GAAqB;IAC5C,OAAO;QACL,UAAU,EAAE,GAAG,CAAC,EAAE;QAClB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,MAAM,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE;QAC1C,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,YAAY;IAKJ;IACA;IACA;IANnB,gGAAgG;IAChG,iBAAiB,GAAe,GAAG,EAAE,GAAE,CAAC,CAAC;IAEzC,YACmB,QAAyB,EACzB,EAAc,EACd,QAAqB,WAAW;QAFhC,aAAQ,GAAR,QAAQ,CAAiB;QACzB,OAAE,GAAF,EAAE,CAAY;QACd,UAAK,GAAL,KAAK,CAA2B;IAChD,CAAC;IAEJ;;;;OAIG;IACH,SAAS,CAAC,KAAkB;QAC1B,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC/D,MAAM,CAAC,iBAAiB,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC1D,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,yEAAyE;IACjE,SAAS,CAAC,OAAgB;QAChC,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;IAC9G,CAAC;IAEO,kBAAkB;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IAED;;;;OAIG;IACK,sBAAsB,CAAC,SAAkB;QAC/C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,uBAAuB,SAAS,GAAG,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,OAAO,CAAC,EAAE,CAAC;QACpB,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAC1E,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC7C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,kDAAkD,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,UAAU,CAClB,iBAAiB,EACjB,kEAAkE,UAAU;iBACzE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC;iBAClC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;QACJ,CAAC;QACD,OAAO,UAAU,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;IAC3B,CAAC;IAED,kFAAkF;IAC1E,KAAK,CAAC,YAAY,CACxB,SAA6B,EAC7B,EAA8G;QAE9G,MAAM,UAAU,GAAG,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAClC,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,WAAW,UAAU,cAAc,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;YACpF,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY;gBAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACpF,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBACrD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YACrD,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6C,CAAC;QACpE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC7C,MAAM,OAAO,CAAC,GAAG,CACf,QAAQ;aACL,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC;aAClD,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YACrB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC;gBAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAEpD,CAAC;gBACF,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;oBAC/B,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,iBAAiB,EAAE,CAAC;oBAC1D,IAAI,cAAc,CAAC,MAAM;wBACvB,QAAQ,CAAC,GAAG,CACV,OAAO,CAAC,EAAE,EACV,cAAc,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CACjD,CAAC;gBACN,CAAC;gBACD,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY;oBAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YACtF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;oBACrD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;gBACrD,CAAC;gBACD,MAAM,CAAC,GAAG,CACR,OAAO,CAAC,EAAE,EACV,YAAY,CAAC,GAAG,CAAC;oBACf,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;oBAC1C,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACpF,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CACL,CAAC;QAEF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC;QAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/D,OAAO;YACL,gFAAgF;YAChF,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;gBACtF,EAAE;gBACF,QAAQ;gBACR,KAAK;gBACL,MAAM;gBACN,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7D,CAAC,CAAC;YACH,GAAG,CAAC,KAAK;gBACP,CAAC,CAAC;oBACE,OAAO,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;oBAC/C,YAAY,EAAE,OAAQ,CAAC,YAAY;oBACnC,GAAG,CAAC,OAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAClE;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;YACrC,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE;SAClC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,YAAY;QACV,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBACpB,MAAM,IAAI,UAAU,CAClB,sBAAsB,EACtB,4GAA4G,CAC7G,CAAC;YACJ,CAAC;YACD,uEAAuE;YACvE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IAC5C,CAAC;IAEO,eAAe;QACrB,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YACjC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACtD,OAAO;gBACL,OAAO;gBACP,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxF,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACnF,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAC/C,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CACjG,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,MAAM;YACtB,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxF,CAAC;IACJ,CAAC;IAED,WAAW,CAAC,SAAkB;QAC5B,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,YAAY,CAAC,SAA6B,EAAE,CAAa,EAAE,IAAe;QACxE,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,UAAU,CAAC,SAA6B,EAAE,EAAU;QAClD,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,SAAS,CAAC,SAA6B,EAAE,QAAgB;QACvD,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,WAAW,CAAC,SAA6B,EAAE,CAAY;QACrD,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;YAC5D,OAAO,CAAC,CAAC,WAAW,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,WAAW,CAAC,SAA6B,EAAE,OAAe,EAAE,CAAY;QACtE,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;YAC5D,OAAO,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,iBAAiB,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,WAAW,CAAC,SAA6B,EAAE,OAAe;QACxD,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,CAAC,SAA6B,EAAE,KAAsC;QACxE,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE;YACnE,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBACxD,yDAAyD;gBACzD,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBACvE,IAAI,OAAO,EAAE,CAAC;oBACZ,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;oBACtC,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC3B,CAAC;gBACD,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAChB,SAA6B,EAC7B,KAAsC,EACtC,SAAiB;QAEjB,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE;YACxF,IAAI,OAAgB,CAAC;YACrB,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;gBACvB,OAAO,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;gBACjE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC;oBAC1E,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,8CAA8C,CAAC,CAAC;gBAC1F,CAAC;gBACD,OAAO,GAAG,MAAM,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YAC1C,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QAC5C,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,UAAU,CAAC,sBAAsB,EAAE,oCAAoC,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,EAAE,EAAE;YACvC,SAAS,EAAE,UAAU;YACrB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM;YACN,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3E,CAAC,CAAC;QACH,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,aAAa,CAAC,SAAkB;QAC9B,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAClG,CAAC;QACD,oFAAoF;QACpF,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACnE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC9E,CAAC;IAED,8DAA8D;IAC9D,eAAe,CAAC,UAAkB;QAChC,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QAClD,8EAA8E;QAC9E,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,UAAU,CAAC,WAAW,EAAE,6BAA6B,UAAU,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,kBAAkB,UAAU,eAAe,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,kBAAkB,UAAU,8BAA8B,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,iBAAiB,CAC7B,CAA6C,EAC7C,OAAgB,EAChB,KAAgB;QAEhB,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,EAAE,GAAG,KAAK,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,EAAE,EAAE,MAAM;YAAE,OAAO,KAAK,CAAC;QAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,IAAI,KAAK,CAAC,CAAC;QACtF,KAAK,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;QACzB,IAAI,UAAU,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM;YAAE,KAAK,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CAAC,SAA6B,EAAE,KAAmB;QACxD,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YACrD,MAAM,kBAAkB,GAAG,KAAK,CAAC,kBAAkB,IAAI,IAAI,CAAC;YAE5D,MAAM,WAAW,GAAsB,EAAE,CAAC;YAC1C,IAAI,kBAAkB,EAAE,CAAC;gBACvB,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;oBAC9C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;oBAChE,WAAW,CAAC,IAAI,CAAC;wBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;wBACnC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACxD,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC/D,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,MAAM,KAAK,GAAe;gBACxB,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,OAAO,EAAE,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC;gBACzC,IAAI,EAAE,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC;gBAC/C,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/C,CAAC;YACF,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,SAA6B,EAAE,GAAa,EAAE,MAAoB;QACvE,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,aAAa,CACX,SAA6B,EAC7B,SAAiB,EACjB,YAAoB;QAEpB,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;IACvF,CAAC;CACF;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAiB,EAAE,OAAgB;IAClE,MAAM,WAAW,GAAG;QAClB,yCAAyC;QACzC,SAAS,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;QAC3E,SAAS,QAAQ,CAAC,IAAI,EAAE;QACxB,YAAY,QAAQ,CAAC,OAAO,EAAE;QAC9B,OAAO,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE;QACvC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,IAAI,GAAqC,EAAE,CAAC;IAClD,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACzC,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAEzC,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC7D,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,aAAa,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI;YACP,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,MAAM,aAAa,0FAA0F,YAAY,eAAe,CAAC;IAC7I,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC9E,CAAC"}

package/dist/storage/apiKeys.d.ts

@@ -0,0 +1,27 @@
+import { type FluxmailDb } from './db.js';
+export interface ApiKeyInfo {
+    id: string;
+    name: string;
+    createdAt: number;
+    lastUsedAt: number | null;
+    /** Member the key was issued to; null means an unscoped admin key. */
+    memberId: string | null;
+}
+/** Returns the plaintext key exactly once; only its hash is stored. */
+export declare function createApiKey(db: FluxmailDb, name: string, memberId?: string): {
+    key: string;
+    info: ApiKeyInfo;
+};
+export interface ApiKeyAuth {
+    /** Member the key was issued to; null for an unscoped admin key. */
+    memberId: string | null;
+}
+/**
+ * Verify a key, record its use, and return the scope it authorizes. Callers must
+ * honour `memberId`: a member-scoped key may only reach shared or owned mailboxes.
+ */
+export declare function authenticateApiKey(db: FluxmailDb, key: string): ApiKeyAuth | null;
+export declare function verifyApiKey(db: FluxmailDb, key: string): boolean;
+export declare function listApiKeys(db: FluxmailDb): ApiKeyInfo[];
+export declare function revokeApiKey(db: FluxmailDb, id: string): boolean;
+//# sourceMappingURL=apiKeys.d.ts.map

package/dist/storage/apiKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiKeys.d.ts","sourceRoot":"","sources":["../../src/storage/apiKeys.ts"],"names":[],"mappings":"AAEA,OAAO,EAAW,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAGnD,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,sEAAsE;IACtE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAMD,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAS/G;AAED,MAAM,WAAW,UAAU;IACzB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CASjF;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAEjE;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,UAAU,GAAG,UAAU,EAAE,CAMxD;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAGhE"}

package/dist/storage/apiKeys.js

@@ -0,0 +1,49 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { eq } from 'drizzle-orm';
+import { apiKeys } from './db.js';
+import { getMember } from './members.js';
+function hashKey(key) {
+    return createHash('sha256').update(key).digest('hex');
+}
+/** Returns the plaintext key exactly once; only its hash is stored. */
+export function createApiKey(db, name, memberId) {
+    if (memberId)
+        getMember(db, memberId);
+    const id = `key_${randomBytes(8).toString('hex')}`;
+    const key = `fmk_${randomBytes(24).toString('hex')}`;
+    const createdAt = Date.now();
+    db.insert(apiKeys)
+        .values({ id, name, keyHash: hashKey(key), createdAt, memberId: memberId ?? null })
+        .run();
+    return { key, info: { id, name, createdAt, lastUsedAt: null, memberId: memberId ?? null } };
+}
+/**
+ * Verify a key, record its use, and return the scope it authorizes. Callers must
+ * honour `memberId`: a member-scoped key may only reach shared or owned mailboxes.
+ */
+export function authenticateApiKey(db, key) {
+    const row = db
+        .select()
+        .from(apiKeys)
+        .where(eq(apiKeys.keyHash, hashKey(key)))
+        .get();
+    if (!row)
+        return null;
+    db.update(apiKeys).set({ lastUsedAt: Date.now() }).where(eq(apiKeys.id, row.id)).run();
+    return { memberId: row.memberId };
+}
+export function verifyApiKey(db, key) {
+    return authenticateApiKey(db, key) !== null;
+}
+export function listApiKeys(db) {
+    return db
+        .select()
+        .from(apiKeys)
+        .all()
+        .map((r) => ({ id: r.id, name: r.name, createdAt: r.createdAt, lastUsedAt: r.lastUsedAt, memberId: r.memberId }));
+}
+export function revokeApiKey(db, id) {
+    const result = db.delete(apiKeys).where(eq(apiKeys.id, id)).run();
+    return result.changes > 0;
+}
+//# sourceMappingURL=apiKeys.js.map

package/dist/storage/apiKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiKeys.js","sourceRoot":"","sources":["../../src/storage/apiKeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,OAAO,EAAmB,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAWzC,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,YAAY,CAAC,EAAc,EAAE,IAAY,EAAE,QAAiB;IAC1E,IAAI,QAAQ;QAAE,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,EAAE,GAAG,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACnD,MAAM,GAAG,GAAG,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;SACf,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC;SAClF,GAAG,EAAE,CAAC;IACT,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE,EAAE,CAAC;AAC9F,CAAC;AAOD;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAc,EAAE,GAAW;IAC5D,MAAM,GAAG,GAAG,EAAE;SACX,MAAM,EAAE;SACR,IAAI,CAAC,OAAO,CAAC;SACb,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;SACxC,GAAG,EAAE,CAAC;IACT,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACvF,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,EAAc,EAAE,GAAW;IACtD,OAAO,kBAAkB,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,IAAI,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAc;IACxC,OAAO,EAAE;SACN,MAAM,EAAE;SACR,IAAI,CAAC,OAAO,CAAC;SACb,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;AACtH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,EAAc,EAAE,EAAU;IACrD,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAClE,OAAO,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;AAC5B,CAAC"}

package/dist/storage/crypto.d.ts

@@ -0,0 +1,4 @@
+/** AES-256-GCM. Output layout: base64(iv || tag || ciphertext). */
+export declare function encryptString(key: Buffer, plaintext: string): string;
+export declare function decryptString(key: Buffer, packed: string): string;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/storage/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/storage/crypto.ts"],"names":[],"mappings":"AAMA,mEAAmE;AACnE,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAKpE;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAQjE"}

package/dist/storage/crypto.js

@@ -0,0 +1,21 @@
+import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
+const ALGO = 'aes-256-gcm';
+const IV_LENGTH = 12;
+const TAG_LENGTH = 16;
+/** AES-256-GCM. Output layout: base64(iv || tag || ciphertext). */
+export function encryptString(key, plaintext) {
+    const iv = randomBytes(IV_LENGTH);
+    const cipher = createCipheriv(ALGO, key, iv);
+    const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+    return Buffer.concat([iv, cipher.getAuthTag(), ciphertext]).toString('base64');
+}
+export function decryptString(key, packed) {
+    const buf = Buffer.from(packed, 'base64');
+    const iv = buf.subarray(0, IV_LENGTH);
+    const tag = buf.subarray(IV_LENGTH, IV_LENGTH + TAG_LENGTH);
+    const ciphertext = buf.subarray(IV_LENGTH + TAG_LENGTH);
+    const decipher = createDecipheriv(ALGO, key, iv);
+    decipher.setAuthTag(tag);
+    return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');
+}
+//# sourceMappingURL=crypto.js.map

package/dist/storage/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/storage/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE5E,MAAM,IAAI,GAAG,aAAa,CAAC;AAC3B,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,SAAiB;IAC1D,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACrF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,MAAc;IACvD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,UAAU,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,SAAS,GAAG,UAAU,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACjD,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACzF,CAAC"}