fluxmail 0.20.0 → 0.21.0

package/dist/cliCloudAuth.js

@@ -0,0 +1,254 @@
+import { execFile } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
+import { createServer } from 'node:net';
+import { EmailError } from '@fluxmail/core';
+import { MAIL_SCOPES, PERMISSION_PRESETS } from '@fluxmail/core/mcp';
+import { runOAuthCallbackFlow } from './accounts/oauthCallback.js';
+import { clearCloudSession, CLOUD_SESSION_LOCK, cloudSessionLockPath, currentRequestDeadlineMs, InstanceApiError, loadCloudSession, requestTimeoutError, saveCloudInstance, saveCloudSession, } from './cliInstances.js';
+import { DEFAULT_FEEDBACK_CLOUD_ORIGIN } from './feedback.js';
+import { withAsyncFileLock } from './storage/fileLock.js';
+export const DEFAULT_CLOUD_ORIGIN = DEFAULT_FEEDBACK_CLOUD_ORIGIN;
+/** Refresh a little early so a token can't expire while a request is in flight. */
+const ACCESS_TOKEN_MARGIN_MS = 30_000;
+const DEFAULT_ACCESS_TOKEN_LIFETIME_MS = 15 * 60 * 1000;
+export function cloudMcpUrl(serverUrl) {
+    return `${serverUrl}/mcp`;
+}
+/**
+ * Every Cloud request goes through here. Credentials stay on the profile's
+ * origin and never follow a redirect, including OAuth endpoints a server names
+ * in its metadata.
+ */
+export function cloudFetch(serverUrl) {
+    const { origin } = new URL(serverUrl);
+    return async (input, init) => {
+        const url = new URL(input instanceof Request ? input.url : input);
+        if (url.origin !== origin) {
+            throw new EmailError('permission_denied', 'Fluxmail Cloud named another server. Refusing to contact it.');
+        }
+        const deadline = AbortSignal.timeout(currentRequestDeadlineMs());
+        const signal = init?.signal ? AbortSignal.any([init.signal, deadline]) : deadline;
+        let response;
+        try {
+            response = await fetch(input, { ...init, signal, redirect: 'manual' });
+        }
+        catch (error) {
+            if (deadline.aborted)
+                throw requestTimeoutError();
+            if (init?.signal?.aborted)
+                throw error;
+            throw new InstanceApiError('request_failed', `Could not reach Fluxmail Cloud at ${origin}.`, 0);
+        }
+        if (response.status >= 300 && response.status < 400) {
+            throw new EmailError('permission_denied', 'Fluxmail Cloud redirected an authenticated request. Refusing to forward credentials.');
+        }
+        return response;
+    };
+}
+function sessionEndedError(instance) {
+    return new EmailError('permission_denied', `The Fluxmail Cloud session for "${instance}" has ended. Run "fluxmail --instance ${instance} login".`);
+}
+export function apiKeyRejectedError(instance) {
+    return new EmailError('permission_denied', `Fluxmail Cloud rejected the API key for "${instance}". Run "fluxmail --instance ${instance} login --api-key" with an active key.`);
+}
+function missingSessionError(instance) {
+    return new EmailError('permission_denied', `Log in to instance "${instance}" first.`);
+}
+async function discover(serverUrl) {
+    const sdk = await import('@modelcontextprotocol/client');
+    const fetchFn = cloudFetch(serverUrl);
+    const { authorizationServerUrl, authorizationServerMetadata: metadata } = await sdk.discoverOAuthServerInfo(cloudMcpUrl(serverUrl), { fetchFn });
+    return { sdk, fetchFn, authorizationServerUrl, metadata };
+}
+function oauthSession(serverUrl, clientId, tokens, previous) {
+    const refreshToken = tokens.refresh_token ?? previous?.refreshToken;
+    if (!refreshToken) {
+        throw new EmailError('invalid_request', 'Fluxmail Cloud did not issue a refresh token. Try logging in again.');
+    }
+    return {
+        kind: 'oauth',
+        serverUrl,
+        clientId,
+        accessToken: tokens.access_token,
+        refreshToken,
+        expiresAt: Date.now() + (tokens.expires_in ? tokens.expires_in * 1000 : DEFAULT_ACCESS_TOKEN_LIFETIME_MS),
+        ...(tokens.scope ? { scope: tokens.scope } : {}),
+    };
+}
+function usable(session, rejected) {
+    return session.accessToken !== rejected && session.expiresAt - Date.now() > ACCESS_TOKEN_MARGIN_MS;
+}
+/**
+ * The bearer token for this instance. `rejected` names a token Cloud just
+ * refused. Parallel CLI processes share one refresh token, and Cloud treats a
+ * second use as replay and revokes the connection, so the refresh happens under
+ * a lock with the session read again inside it.
+ */
+export async function cloudAccessToken(instance, serverUrl, rejected) {
+    // A session from another origin belongs to a login that hasn't finished moving the profile.
+    const session = loadCloudSession(instance);
+    if (session?.serverUrl !== serverUrl)
+        throw missingSessionError(instance);
+    if (session.kind === 'key') {
+        if (session.key === rejected)
+            throw apiKeyRejectedError(instance);
+        return session.key;
+    }
+    if (usable(session, rejected))
+        return session.accessToken;
+    return withAsyncFileLock(cloudSessionLockPath(), CLOUD_SESSION_LOCK, async () => {
+        const current = loadCloudSession(instance);
+        if (current?.kind !== 'oauth' || current.serverUrl !== serverUrl)
+            throw missingSessionError(instance);
+        if (usable(current, rejected))
+            return current.accessToken;
+        const { sdk, fetchFn, authorizationServerUrl, metadata } = await discover(serverUrl);
+        let tokens;
+        try {
+            tokens = await sdk.refreshAuthorization(authorizationServerUrl, {
+                metadata,
+                clientInformation: { client_id: current.clientId },
+                refreshToken: current.refreshToken,
+                resource: new URL(cloudMcpUrl(serverUrl)),
+                fetchFn,
+            });
+        }
+        catch (error) {
+            if (error instanceof sdk.OAuthError && ['invalid_grant', 'invalid_client'].includes(error.code)) {
+                throw sessionEndedError(instance);
+            }
+            throw error;
+        }
+        const next = oauthSession(serverUrl, current.clientId, tokens, current);
+        saveCloudSession(instance, next);
+        return tokens.access_token;
+    });
+}
+function freeLoopbackPort() {
+    return new Promise((resolve, reject) => {
+        const server = createServer();
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', () => {
+            const address = server.address();
+            server.close(() => {
+                if (address && typeof address === 'object')
+                    resolve(address.port);
+                else
+                    reject(new Error('Could not choose an OAuth callback port.'));
+            });
+        });
+    });
+}
+/**
+ * Browser sign-in. Each login registers its own public client: Cloud deletes
+ * registered clients that have no tokens, so an ID kept across logins can go
+ * stale, and the failure would only show in the browser.
+ */
+export async function loginToCloud(options) {
+    const { instance, serverUrl, preset, onAuthUrl, flow } = options;
+    const { sdk, fetchFn, authorizationServerUrl, metadata } = await discover(serverUrl);
+    const resource = new URL(cloudMcpUrl(serverUrl));
+    const port = await freeLoopbackPort();
+    const redirectUri = `http://127.0.0.1:${port}/oauth/callback`;
+    const clientInformation = await sdk.registerClient(authorizationServerUrl, {
+        metadata,
+        fetchFn,
+        clientMetadata: {
+            client_name: 'Fluxmail CLI',
+            redirect_uris: [redirectUri],
+            grant_types: ['authorization_code', 'refresh_token'],
+            response_types: ['code'],
+            token_endpoint_auth_method: 'none',
+            // Registration caps what any login can later ask for; the authorization request narrows it.
+            scope: [...MAIL_SCOPES, 'offline_access'].join(' '),
+        },
+    });
+    const state = randomBytes(32).toString('base64url');
+    const { authorizationUrl, codeVerifier } = await sdk.startAuthorization(authorizationServerUrl, {
+        metadata,
+        clientInformation,
+        redirectUrl: redirectUri,
+        scope: [...PERMISSION_PRESETS[preset], 'offline_access'].join(' '),
+        state,
+        resource,
+    });
+    const tokens = await runOAuthCallbackFlow({
+        provider: 'cloud',
+        redirectUri,
+        host: '127.0.0.1',
+        port,
+        state,
+        authUrl: authorizationUrl.href,
+        onAuthUrl,
+        successTitle: () => 'Signed in to Fluxmail Cloud',
+        options: flow,
+        complete: async (code, callback) => ({
+            email: '',
+            value: await sdk.exchangeAuthorization(authorizationServerUrl, {
+                metadata,
+                clientInformation,
+                authorizationCode: code,
+                iss: callback.searchParams.get('iss') ?? undefined,
+                codeVerifier,
+                redirectUri,
+                resource,
+                fetchFn,
+            }),
+        }),
+    });
+    await replaceCloudSession(instance, oauthSession(serverUrl, clientInformation.client_id, tokens));
+}
+/**
+ * Stores a new login's session and points the profile at its origin. Both
+ * change under the refresh lock, so a refresh already in flight finishes first
+ * and can't overwrite the new session with the old one. Each approval is a
+ * separate connection, so the old one is then revoked at the server that
+ * issued it.
+ */
+export async function replaceCloudSession(instance, session) {
+    const previous = await withAsyncFileLock(cloudSessionLockPath(), CLOUD_SESSION_LOCK, async () => {
+        const current = loadCloudSession(instance);
+        saveCloudSession(instance, session);
+        saveCloudInstance(instance, session.serverUrl);
+        return current;
+    });
+    if (previous?.kind === 'oauth')
+        await revokeCloudSession(previous.serverUrl, previous).catch(() => false);
+}
+async function revokeCloudSession(serverUrl, session) {
+    const { fetchFn, metadata } = await discover(serverUrl);
+    const revocationEndpoint = metadata?.revocation_endpoint;
+    if (!revocationEndpoint)
+        return false;
+    const response = await fetchFn(revocationEndpoint, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            token: session.refreshToken,
+            token_type_hint: 'refresh_token',
+            client_id: session.clientId,
+        }),
+    });
+    return response.ok;
+}
+/** Forgets the local credentials even when Cloud can't be reached; reports whether the connection was revoked. */
+export async function logoutOfCloud(instance) {
+    return withAsyncFileLock(cloudSessionLockPath(), CLOUD_SESSION_LOCK, async () => {
+        const session = loadCloudSession(instance);
+        if (!session)
+            throw missingSessionError(instance);
+        const revoked = session.kind === 'oauth' && (await revokeCloudSession(session.serverUrl, session).catch(() => false));
+        clearCloudSession(instance);
+        return { revoked };
+    });
+}
+/** Best effort: the sign-in URL is always printed too. */
+export function openInBrowser(url) {
+    const [command, args] = process.platform === 'darwin'
+        ? ['open', [url]]
+        : process.platform === 'win32'
+            ? ['rundll32', ['url.dll,FileProtocolHandler', url]]
+            : ['xdg-open', [url]];
+    execFile(command, args, { timeout: 5_000 }, () => { }).unref();
+}
+//# sourceMappingURL=cliCloudAuth.js.map

package/dist/cliCloudAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cliCloudAuth.js","sourceRoot":"","sources":["../src/cliCloudAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAyB,MAAM,oBAAoB,CAAC;AAE5F,OAAO,EAAE,oBAAoB,EAAsD,MAAM,6BAA6B,CAAC;AACvH,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,wBAAwB,EACxB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,GAEjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,6BAA6B,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,MAAM,CAAC,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;AAElE,mFAAmF;AACnF,MAAM,sBAAsB,GAAG,MAAM,CAAC;AACtC,MAAM,gCAAgC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAExD,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,OAAO,GAAG,SAAS,MAAM,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAClE,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,8DAA8D,CAAC,CAAC;QAC5G,CAAC;QACD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAClF,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,QAAQ,CAAC,OAAO;gBAAE,MAAM,mBAAmB,EAAE,CAAC;YAClD,IAAI,IAAI,EAAE,MAAM,EAAE,OAAO;gBAAE,MAAM,KAAK,CAAC;YACvC,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,qCAAqC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpD,MAAM,IAAI,UAAU,CAClB,mBAAmB,EACnB,sFAAsF,CACvF,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACzC,OAAO,IAAI,UAAU,CACnB,mBAAmB,EACnB,mCAAmC,QAAQ,yCAAyC,QAAQ,UAAU,CACvG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,OAAO,IAAI,UAAU,CACnB,mBAAmB,EACnB,4CAA4C,QAAQ,+BAA+B,QAAQ,uCAAuC,CACnI,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,OAAO,IAAI,UAAU,CAAC,mBAAmB,EAAE,uBAAuB,QAAQ,UAAU,CAAC,CAAC;AACxF,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,SAAiB;IACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,EAAE,sBAAsB,EAAE,2BAA2B,EAAE,QAAQ,EAAE,GAAG,MAAM,GAAG,CAAC,uBAAuB,CACzG,WAAW,CAAC,SAAS,CAAC,EACtB,EAAE,OAAO,EAAE,CACZ,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,YAAY,CACnB,SAAiB,EACjB,QAAgB,EAChB,MAAmB,EACnB,QAAmC;IAEnC,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,IAAI,QAAQ,EAAE,YAAY,CAAC;IACpE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,qEAAqE,CAAC,CAAC;IACjH,CAAC;IACD,OAAO;QACL,IAAI,EAAE,OAAO;QACb,SAAS;QACT,QAAQ;QACR,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,YAAY;QACZ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,gCAAgC,CAAC;QACzG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,OAAiD,EAAE,QAAiB;IAClF,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,CAAC;AACrG,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,SAAiB,EAAE,QAAiB;IAC3F,4FAA4F;IAC5F,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,OAAO,EAAE,SAAS,KAAK,SAAS;QAAE,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ;YAAE,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAClE,OAAO,OAAO,CAAC,GAAG,CAAC;IACrB,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC,WAAW,CAAC;IAC1D,OAAO,iBAAiB,CAAC,oBAAoB,EAAE,EAAE,kBAAkB,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,OAAO,EAAE,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;YAAE,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACtG,IAAI,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC;YAAE,OAAO,OAAO,CAAC,WAAW,CAAC;QAC1D,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QACrF,IAAI,MAAmB,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,GAAG,CAAC,oBAAoB,CAAC,sBAAsB,EAAE;gBAC9D,QAAQ;gBACR,iBAAiB,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE;gBAClD,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,QAAQ,EAAE,IAAI,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;gBACzC,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,GAAG,CAAC,UAAU,IAAI,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACpC,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACxE,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACjC,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;gBAChB,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;oBAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;;oBAC7D,MAAM,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,CAAC;YACrE,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAUD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA0B;IAC3D,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IACjE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;IACrF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,oBAAoB,IAAI,iBAAiB,CAAC;IAC9D,MAAM,iBAAiB,GAAgC,MAAM,GAAG,CAAC,cAAc,CAAC,sBAAsB,EAAE;QACtG,QAAQ;QACR,OAAO;QACP,cAAc,EAAE;YACd,WAAW,EAAE,cAAc;YAC3B,aAAa,EAAE,CAAC,WAAW,CAAC;YAC5B,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,0BAA0B,EAAE,MAAM;YAClC,4FAA4F;YAC5F,KAAK,EAAE,CAAC,GAAG,WAAW,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;SACpD;KACF,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,EAAE,gBAAgB,EAAE,YAAY,EAAE,GAAG,MAAM,GAAG,CAAC,kBAAkB,CAAC,sBAAsB,EAAE;QAC9F,QAAQ;QACR,iBAAiB;QACjB,WAAW,EAAE,WAAW;QACxB,KAAK,EAAE,CAAC,GAAG,kBAAkB,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAClE,KAAK;QACL,QAAQ;KACT,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAc;QACrD,QAAQ,EAAE,OAAO;QACjB,WAAW;QACX,IAAI,EAAE,WAAW;QACjB,IAAI;QACJ,KAAK;QACL,OAAO,EAAE,gBAAgB,CAAC,IAAI;QAC9B,SAAS;QACT,YAAY,EAAE,GAAG,EAAE,CAAC,6BAA6B;QACjD,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YACnC,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,MAAM,GAAG,CAAC,qBAAqB,CAAC,sBAAsB,EAAE;gBAC7D,QAAQ;gBACR,iBAAiB;gBACjB,iBAAiB,EAAE,IAAI;gBACvB,GAAG,EAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS;gBAClD,YAAY;gBACZ,WAAW;gBACX,QAAQ;gBACR,OAAO;aACR,CAAC;SACH,CAAC;KACH,CAAC,CAAC;IACH,MAAM,mBAAmB,CAAC,QAAQ,EAAE,YAAY,CAAC,SAAS,EAAE,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AACpG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAAgB,EAAE,OAAqB;IAC/E,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,oBAAoB,EAAE,EAAE,kBAAkB,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC3C,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACpC,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC/C,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;IACH,IAAI,QAAQ,EAAE,IAAI,KAAK,OAAO;QAAE,MAAM,kBAAkB,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;AAC5G,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,SAAiB,EACjB,OAAiD;IAEjD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;IACxD,MAAM,kBAAkB,GAAI,QAAyD,EAAE,mBAAmB,CAAC;IAC3G,IAAI,CAAC,kBAAkB;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,kBAAkB,EAAE;QACjD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,KAAK,EAAE,OAAO,CAAC,YAAY;YAC3B,eAAe,EAAE,eAAe;YAChC,SAAS,EAAE,OAAO,CAAC,QAAQ;SAC5B,CAAC;KACH,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,EAAE,CAAC;AACrB,CAAC;AAED,kHAAkH;AAClH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAgB;IAClD,OAAO,iBAAiB,CAAC,oBAAoB,EAAE,EAAE,kBAAkB,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO;YAAE,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,OAAO,GACX,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,MAAM,kBAAkB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACxG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,GACnB,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAC3B,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC5B,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;AAChE,CAAC"}

package/dist/cliCloudClient.d.ts

@@ -0,0 +1,29 @@
+/** Calls Cloud's MCP endpoint, the only one that accepts both OAuth tokens and agent keys. */
+export declare class CloudClient {
+    readonly instance: string;
+    readonly serverUrl: string;
+    private readonly apiKey?;
+    private connection?;
+    private lastToken?;
+    /** The SDK wraps what the transport throws, so the original error is kept for the caller. */
+    private transportFailure?;
+    /** `apiKey` checks a key before login stores it; otherwise the instance's stored session is used. */
+    constructor(instance: string, serverUrl: string, apiKey?: string | undefined);
+    private transportStep;
+    /** The error to report for a failed SDK call, when it isn't a tool or protocol error. */
+    private sdkFailure;
+    private fetch;
+    private request;
+    private connect;
+    /**
+     * `data` from the tool result. Partly failed modifies and sends that have a
+     * delivery operation are errors that still carry data, which callers inspect
+     * the same way as a REST response.
+     */
+    callTool<T>(name: string, args?: Record<string, unknown>): Promise<T>;
+    readAttachment(accountId: string, messageId: string, attachmentId: string): Promise<{
+        content: Buffer;
+        mimeType?: string;
+    }>;
+}
+//# sourceMappingURL=cliCloudClient.d.ts.map

package/dist/cliCloudClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cliCloudClient.d.ts","sourceRoot":"","sources":["../src/cliCloudClient.ts"],"names":[],"mappings":"AAmCA,8FAA8F;AAC9F,qBAAa,WAAW;IAQpB,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAT1B,OAAO,CAAC,UAAU,CAAC,CAAkB;IACrC,OAAO,CAAC,SAAS,CAAC,CAAS;IAC3B,6FAA6F;IAC7F,OAAO,CAAC,gBAAgB,CAAC,CAAQ;IAEjC,qGAAqG;gBAE1F,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACT,MAAM,CAAC,EAAE,MAAM,YAAA;YAGpB,aAAa;IAS3B,yFAAyF;IACzF,OAAO,CAAC,UAAU;IAOlB,OAAO,CAAC,KAAK,CAAsF;IAEnG,OAAO,CAAC,OAAO,CAgBb;IAEF,OAAO,CAAC,OAAO;IA2Bf;;;;OAIG;IACG,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAoCzE,cAAc,CAClB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CA2BnD"}

package/dist/cliCloudClient.js

@@ -0,0 +1,154 @@
+import { EmailError } from '@fluxmail/core';
+import { attachmentUri } from '@fluxmail/core/mcp';
+import { apiKeyRejectedError, cloudAccessToken, cloudFetch, cloudMcpUrl } from './cliCloudAuth.js';
+import { currentRequestDeadlineMs, InstanceApiError, instanceResponseError, requestTimeoutError, } from './cliInstances.js';
+import { VERSION } from './version.js';
+const INVALID_PARAMS = -32602;
+const SDK_REQUEST_TIMEOUT = 'REQUEST_TIMEOUT';
+function parseJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Calls Cloud's MCP endpoint, the only one that accepts both OAuth tokens and agent keys. */
+export class CloudClient {
+    instance;
+    serverUrl;
+    apiKey;
+    connection;
+    lastToken;
+    /** The SDK wraps what the transport throws, so the original error is kept for the caller. */
+    transportFailure;
+    /** `apiKey` checks a key before login stores it; otherwise the instance's stored session is used. */
+    constructor(instance, serverUrl, apiKey) {
+        this.instance = instance;
+        this.serverUrl = serverUrl;
+        this.apiKey = apiKey;
+    }
+    async transportStep(step) {
+        try {
+            return await step();
+        }
+        catch (error) {
+            if (error instanceof EmailError || error instanceof InstanceApiError)
+                this.transportFailure = error;
+            throw error;
+        }
+    }
+    /** The error to report for a failed SDK call, when it isn't a tool or protocol error. */
+    sdkFailure(error) {
+        if (this.transportFailure)
+            return this.transportFailure;
+        // The SDK's own deadline aborts the fetch before cloudFetch's, so it needs the same mapping.
+        if (error.code === SDK_REQUEST_TIMEOUT)
+            return requestTimeoutError();
+        return undefined;
+    }
+    fetch = (input, init) => this.transportStep(() => this.request(input, init));
+    request = async (input, init) => {
+        const response = await cloudFetch(this.serverUrl)(input, init);
+        if (response.ok || response.status === 401)
+            return response;
+        const body = (await response
+            .clone()
+            .json()
+            .catch(() => undefined));
+        // JSON-RPC errors use numeric codes and belong to the SDK, which negotiates on them.
+        if (typeof body?.error?.code !== 'string')
+            return response;
+        throw instanceResponseError(body.error.code, body.error.message ?? `Fluxmail Cloud returned HTTP ${response.status}.`, response.status, body.error.data, body.requestId);
+    };
+    connect() {
+        this.connection ??= (async () => {
+            const { Client, StreamableHTTPClientTransport } = await import('@modelcontextprotocol/client');
+            const transport = new StreamableHTTPClientTransport(new URL(cloudMcpUrl(this.serverUrl)), {
+                fetch: this.fetch,
+                authProvider: {
+                    token: () => this.transportStep(async () => {
+                        this.lastToken = this.apiKey ?? (await cloudAccessToken(this.instance, this.serverUrl));
+                        return this.lastToken;
+                    }),
+                    onUnauthorized: () => this.transportStep(async () => {
+                        if (this.apiKey)
+                            throw apiKeyRejectedError(this.instance);
+                        this.lastToken = await cloudAccessToken(this.instance, this.serverUrl, this.lastToken);
+                    }),
+                },
+            });
+            const client = new Client({ name: 'fluxmail-cli', version: VERSION }, { versionNegotiation: { mode: 'auto' } });
+            await client.connect(transport, { timeout: currentRequestDeadlineMs() });
+            return client;
+        })().catch((error) => {
+            throw this.sdkFailure(error) ?? error;
+        });
+        return this.connection;
+    }
+    /**
+     * `data` from the tool result. Partly failed modifies and sends that have a
+     * delivery operation are errors that still carry data, which callers inspect
+     * the same way as a REST response.
+     */
+    async callTool(name, args = {}) {
+        const client = await this.connect();
+        this.transportFailure = undefined;
+        let result;
+        try {
+            result = await client.callTool({ name, arguments: args }, { timeout: currentRequestDeadlineMs() });
+        }
+        catch (error) {
+            const failure = this.sdkFailure(error);
+            if (failure)
+                throw failure;
+            if (error.code === INVALID_PARAMS) {
+                throw new EmailError('permission_denied', 'This Fluxmail Cloud connection does not allow this command. Log in again with more permissions.');
+            }
+            throw error;
+        }
+        const structured = result.structuredContent;
+        if (structured?.data !== undefined)
+            return structured.data;
+        const block = result.content.find((item) => item.type === 'text');
+        const text = block?.text ?? '';
+        if (!result.isError) {
+            const parsed = parseJson(text);
+            if (parsed?.data !== undefined)
+                return parsed.data;
+            throw instanceResponseError('invalid_response', 'Fluxmail Cloud returned no data.', 200);
+        }
+        const failure = parseJson(text);
+        throw instanceResponseError(failure?.error ?? 'invalid_request', failure?.message ?? text ?? 'Fluxmail Cloud rejected the request.', 0, failure?.data, failure?.requestId);
+    }
+    async readAttachment(accountId, messageId, attachmentId) {
+        const client = await this.connect();
+        this.transportFailure = undefined;
+        // Lookups use the IDs, and the template needs a filename segment.
+        const uri = attachmentUri(accountId, messageId, attachmentId, 'attachment');
+        let contents;
+        try {
+            ({
+                contents: [contents],
+            } = await client.readResource({ uri }, { timeout: currentRequestDeadlineMs() }));
+        }
+        catch (error) {
+            const failure = this.sdkFailure(error);
+            if (failure)
+                throw failure;
+            // Cloud's resource handler reports only a message. The tool reports the same failure with
+            // its code, such as not_found or permission_denied, and throws it from callTool.
+            await this.callTool('download_attachment', { accountId, messageId, attachmentId });
+            // The tool succeeded, so the read failed for a reason that has passed.
+            throw instanceResponseError('provider_unavailable', error instanceof Error ? error.message : String(error), 0);
+        }
+        if (contents?.blob !== undefined) {
+            return { content: Buffer.from(contents.blob, 'base64'), mimeType: contents.mimeType };
+        }
+        if (contents?.text !== undefined) {
+            return { content: Buffer.from(contents.text, 'utf8'), mimeType: contents.mimeType };
+        }
+        throw instanceResponseError('invalid_response', 'Fluxmail Cloud returned no attachment content.', 200);
+    }
+}
+//# sourceMappingURL=cliCloudClient.js.map

package/dist/cliCloudClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cliCloudClient.js","sourceRoot":"","sources":["../src/cliCloudClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACnG,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAcvC,MAAM,cAAc,GAAG,CAAC,KAAK,CAAC;AAC9B,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAE9C,SAAS,SAAS,CAAI,IAAY;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,MAAM,OAAO,WAAW;IAQX;IACA;IACQ;IATX,UAAU,CAAmB;IAC7B,SAAS,CAAU;IAC3B,6FAA6F;IACrF,gBAAgB,CAAS;IAEjC,qGAAqG;IACrG,YACW,QAAgB,EAChB,SAAiB,EACT,MAAe;QAFvB,aAAQ,GAAR,QAAQ,CAAQ;QAChB,cAAS,GAAT,SAAS,CAAQ;QACT,WAAM,GAAN,MAAM,CAAS;IAC/B,CAAC;IAEI,KAAK,CAAC,aAAa,CAAI,IAAsB;QACnD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,UAAU,IAAI,KAAK,YAAY,gBAAgB;gBAAE,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC;YACpG,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,yFAAyF;IACjF,UAAU,CAAC,KAAc;QAC/B,IAAI,IAAI,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC;QACxD,6FAA6F;QAC7F,IAAK,KAA4B,CAAC,IAAI,KAAK,mBAAmB;YAAE,OAAO,mBAAmB,EAAE,CAAC;QAC7F,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,KAAK,GAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IAE3F,OAAO,GAAiB,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACpD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,QAAQ,CAAC;QAC5D,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ;aACzB,KAAK,EAAE;aACP,IAAI,EAAE;aACN,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAA+B,CAAC;QACzD,qFAAqF;QACrF,IAAI,OAAO,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC3D,MAAM,qBAAqB,CACzB,IAAI,CAAC,KAAK,CAAC,IAAI,EACf,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,gCAAgC,QAAQ,CAAC,MAAM,GAAG,EACxE,QAAQ,CAAC,MAAM,EACf,IAAI,CAAC,KAAK,CAAC,IAAI,EACf,IAAI,CAAC,SAAS,CACf,CAAC;IACJ,CAAC,CAAC;IAEM,OAAO;QACb,IAAI,CAAC,UAAU,KAAK,CAAC,KAAK,IAAI,EAAE;YAC9B,MAAM,EAAE,MAAM,EAAE,6BAA6B,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;YAC/F,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE;gBACxF,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,YAAY,EAAE;oBACZ,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,CAAC,aAAa,CAAC,KAAK,IAAI,EAAE;wBAC5B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;wBACxF,OAAO,IAAI,CAAC,SAAS,CAAC;oBACxB,CAAC,CAAC;oBACJ,cAAc,EAAE,GAAG,EAAE,CACnB,IAAI,CAAC,aAAa,CAAC,KAAK,IAAI,EAAE;wBAC5B,IAAI,IAAI,CAAC,MAAM;4BAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;wBAC1D,IAAI,CAAC,SAAS,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;oBACzF,CAAC,CAAC;iBACL;aACF,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAChH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,EAAE,CAAC,CAAC;YACzE,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC5B,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;QACxC,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAI,IAAY,EAAE,OAAgC,EAAE;QAChE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;QAClC,IAAI,MAA+C,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,EAAE,CAAC,CAAC;QACrG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,OAAO;gBAAE,MAAM,OAAO,CAAC;YAC3B,IAAK,KAA4B,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;gBAC1D,MAAM,IAAI,UAAU,CAClB,mBAAmB,EACnB,iGAAiG,CAClG,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,iBAA6C,CAAC;QACxE,IAAI,UAAU,EAAE,IAAI,KAAK,SAAS;YAAE,OAAO,UAAU,CAAC,IAAI,CAAC;QAC3D,MAAM,KAAK,GAAI,MAAM,CAAC,OAAkD,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;QAC9G,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,SAAS,CAAe,IAAI,CAAC,CAAC;YAC7C,IAAI,MAAM,EAAE,IAAI,KAAK,SAAS;gBAAE,OAAO,MAAM,CAAC,IAAI,CAAC;YACnD,MAAM,qBAAqB,CAAC,kBAAkB,EAAE,kCAAkC,EAAE,GAAG,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAmB,IAAI,CAAC,CAAC;QAClD,MAAM,qBAAqB,CACzB,OAAO,EAAE,KAAK,IAAI,iBAAiB,EACnC,OAAO,EAAE,OAAO,IAAI,IAAI,IAAI,sCAAsC,EAClE,CAAC,EACD,OAAO,EAAE,IAAI,EACb,OAAO,EAAE,SAAS,CACnB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,SAAiB,EACjB,SAAiB,EACjB,YAAoB;QAEpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;QAClC,kEAAkE;QAClE,MAAM,GAAG,GAAG,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;QAC5E,IAAI,QAAyE,CAAC;QAC9E,IAAI,CAAC;YACH,CAAC;gBACC,QAAQ,EAAE,CAAC,QAAQ,CAAC;aACrB,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,EAAE,CAAC,CAAC,CAAC;QACnF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,OAAO;gBAAE,MAAM,OAAO,CAAC;YAC3B,0FAA0F;YAC1F,iFAAiF;YACjF,MAAM,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;YACnF,uEAAuE;YACvE,MAAM,qBAAqB,CAAC,sBAAsB,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QACjH,CAAC;QACD,IAAI,QAAQ,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACxF,CAAC;QACD,IAAI,QAAQ,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACtF,CAAC;QACD,MAAM,qBAAqB,CAAC,kBAAkB,EAAE,gDAAgD,EAAE,GAAG,CAAC,CAAC;IACzG,CAAC;CACF"}

package/dist/cliInstances.d.ts

@@ -1,4 +1,4 @@
-import { type ProviderFailure } from '@fluxmail/core';
+import { EmailError, type ProviderFailure } from '@fluxmail/core';
 export interface LocalInstanceProfile {
     kind: 'local';
 }
@@ -6,7 +6,31 @@ export interface RemoteInstanceProfile {
     kind: 'remote';
     serverUrl: string;
 }
-export type InstanceProfile = LocalInstanceProfile | RemoteInstanceProfile;
+export interface CloudInstanceProfile {
+    kind: 'cloud';
+    serverUrl: string;
+}
+export type InstanceProfile = LocalInstanceProfile | RemoteInstanceProfile | CloudInstanceProfile;
+/** `serverUrl` is the origin that issued the credential. It is only ever sent there. */
+export type CloudSession = {
+    serverUrl: string;
+} & ({
+    kind: 'oauth';
+    clientId: string;
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: number;
+    scope?: string;
+} | {
+    kind: 'key';
+    key: string;
+});
+/** Guards every change to a Cloud session: refresh, login, logout and profile removal. */
+export declare const CLOUD_SESSION_LOCK: {
+    timeoutMs: number;
+    staleMs: number;
+    description: string;
+};
 export interface CliInstanceConfig {
     active?: string;
     instances: Record<string, InstanceProfile>;
@@ -17,6 +41,7 @@ export interface ApiEnvelope<T> {
     warnings?: string[];
 }
 export declare function setRequestDeadlineMs(value: number): void;
+export declare function currentRequestDeadlineMs(): number;
 export declare class InstanceApiError extends Error {
     readonly code: string;
     readonly status: number;
@@ -26,6 +51,7 @@ export declare class InstanceApiError extends Error {
     failure?: ProviderFailure;
     constructor(code: string, message: string, status: number, data?: Record<string, unknown> | undefined, requestId?: string | undefined, connectionStage?: string | undefined);
 }
+export declare function requestTimeoutError(): InstanceApiError;
 export declare function instanceResponseError(code: string, message: string, status: number, data?: Record<string, unknown>, requestId?: string, connectionStage?: string): Error;
 /** The provider failure a local request recorded for this response or JSON envelope. */
 export declare function localFailure(value: object): ProviderFailure | undefined;
@@ -39,10 +65,17 @@ export declare class CliCanceledError extends Error {
 export declare function apiErrorCode(error: unknown): string;
 export declare function instanceConfigPath(): string;
 export declare function credentialPath(): string;
+/** Kept apart from member sessions because refreshing rewrites this file on every token rotation. */
+export declare function cloudCredentialPath(): string;
 export declare function loadInstanceConfig(): CliInstanceConfig;
+export declare function cloudSessionLockPath(): string;
+export declare function loadCloudSession(instanceName: string): CloudSession | undefined;
+export declare function saveCloudSession(instanceName: string, session: CloudSession): void;
+export declare function clearCloudSession(instanceName: string): void;
 export declare function validateRemoteServerUrl(value: string): string;
 export declare function saveLocalInstance(name?: string): void;
 export declare function saveRemoteInstance(name: string, serverUrl: string): void;
+export declare function saveCloudInstance(name: string, serverUrl: string): void;
 export declare function useInstance(name: string): void;
 export declare function removeInstance(name: string): void;
 export declare function resolveInstance(name?: string): {
@@ -55,13 +88,15 @@ export declare function saveSessionToken(instanceName: string, token: string): v
 export declare function clearSessionToken(instanceName: string): void;
 export declare class InstanceClient {
     readonly name: string;
-    readonly profile: InstanceProfile;
+    readonly profile: Exclude<InstanceProfile, CloudInstanceProfile>;
     private readonly token?;
     private readonly requestTimeoutMs?;
-    constructor(name: string, profile: InstanceProfile, token?: string | undefined, requestTimeoutMs?: number | undefined);
+    constructor(name: string, profile: Exclude<InstanceProfile, CloudInstanceProfile>, token?: string | undefined, requestTimeoutMs?: number | undefined);
     request(pathname: string, init?: RequestInit, authenticated?: boolean): Promise<Response>;
     json<T>(pathname: string, init?: RequestInit, authenticated?: boolean): Promise<T>;
     jsonEnvelope<T>(pathname: string, init?: RequestInit, authenticated?: boolean): Promise<ApiEnvelope<T>>;
 }
+/** Administration stays in the Cloud dashboard; the CLI only reads and manages mail there. */
+export declare function cloudManagementError(profile: CloudInstanceProfile, page?: string): EmailError;
 export declare function instanceClient(name?: string, requireToken?: boolean, requestTimeoutMs?: number): InstanceClient;
 //# sourceMappingURL=cliInstances.d.ts.map

package/dist/cliInstances.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cliInstances.d.ts","sourceRoot":"","sources":["../src/cliInstances.ts"],"names":[],"mappings":"AAEA,OAAO,EAAmC,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAOvF,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,QAAQ,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,eAAe,GAAG,oBAAoB,GAAG,qBAAqB,CAAC;AAE3E,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,WAAW,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC;IACR,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAwCD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAKxD;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IAIvC,QAAQ,CAAC,IAAI,EAAE,MAAM;IAErB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM;IAC3B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM;IARnC,OAAO,CAAC,EAAE,eAAe,CAAC;gBAGf,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA,EAC9B,SAAS,CAAC,EAAE,MAAM,YAAA,EAClB,eAAe,CAAC,EAAE,MAAM,YAAA;CAKpC;AAUD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,SAAS,CAAC,EAAE,MAAM,EAClB,eAAe,CAAC,EAAE,MAAM,GACvB,KAAK,CAYP;AAKD,wFAAwF;AACxF,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAEvE;AAED,4FAA4F;AAC5F,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,GAAG,CAAC,CAIjF;AA6BD,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAI/D;AAED,8EAA8E;AAC9E,qBAAa,gBAAiB,SAAQ,KAAK;;CAK1C;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAOnD;AAUD,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAwBD,wBAAgB,kBAAkB,IAAI,iBAAiB,CAEtD;AAsBD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAkB7D;AAED,wBAAgB,iBAAiB,CAAC,IAAI,SAAU,GAAG,IAAI,CAMtD;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAMxE;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAK9C;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CASjD;AAED,wBAAgB,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,eAAe,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAYzG;AAED,wBAAgB,oBAAoB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CA4BtF;AAED,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAI1E;AAED,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAI5D;AAED,qBAAa,cAAc;IAEvB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,OAAO,EAAE,eAAe;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBAHzB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,eAAe,EAChB,KAAK,CAAC,EAAE,MAAM,YAAA,EACd,gBAAgB,CAAC,EAAE,MAAM,YAAA;IAGtC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,EAAE,aAAa,UAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IA0E1F,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,EAAE,aAAa,UAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAInF,YAAY,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,EAAE,aAAa,UAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;CAmD/G;AAED,wBAAgB,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,YAAY,UAAO,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,cAAc,CAK5G"}
+{"version":3,"file":"cliInstances.d.ts","sourceRoot":"","sources":["../src/cliInstances.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAuB,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAQvF,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,QAAQ,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,OAAO,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,eAAe,GAAG,oBAAoB,GAAG,qBAAqB,GAAG,oBAAoB,CAAC;AAElG,wFAAwF;AACxF,MAAM,MAAM,YAAY,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,CAC/C;IACE,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GACD;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAC/B,CAAC;AAEF,0FAA0F;AAC1F,eAAO,MAAM,kBAAkB;;;;CAI9B,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,WAAW,CAAC,CAAC;IAC5B,IAAI,EAAE,CAAC,CAAC;IACR,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAoDD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAKxD;AAED,wBAAgB,wBAAwB,IAAI,MAAM,CAEjD;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IAIvC,QAAQ,CAAC,IAAI,EAAE,MAAM;IAErB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM;IAC3B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM;IARnC,OAAO,CAAC,EAAE,eAAe,CAAC;gBAGf,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA,EAC9B,SAAS,CAAC,EAAE,MAAM,YAAA,EAClB,eAAe,CAAC,EAAE,MAAM,YAAA;CAKpC;AAED,wBAAgB,mBAAmB,IAAI,gBAAgB,CAMtD;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,SAAS,CAAC,EAAE,MAAM,EAClB,eAAe,CAAC,EAAE,MAAM,GACvB,KAAK,CAYP;AAKD,wFAAwF;AACxF,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAEvE;AAED,4FAA4F;AAC5F,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,GAAG,CAAC,CAIjF;AA6BD,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAI/D;AAED,8EAA8E;AAC9E,qBAAa,gBAAiB,SAAQ,KAAK;;CAK1C;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAOnD;AAcD,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,qGAAqG;AACrG,wBAAgB,mBAAmB,IAAI,MAAM,CAE5C;AA+BD,wBAAgB,kBAAkB,IAAI,iBAAiB,CAEtD;AAcD,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAMD,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAE/E;AAED,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI,CAIlF;AAED,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAK5D;AAUD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAkB7D;AAED,wBAAgB,iBAAiB,CAAC,IAAI,SAAU,GAAG,IAAI,CAMtD;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAMxE;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAKvE;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAK9C;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CASjD;AAED,wBAAgB,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,eAAe,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAYzG;AAED,wBAAgB,oBAAoB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CA4BtF;AAED,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAI1E;AAED,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAI5D;AAED,qBAAa,cAAc;IAEvB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,EAAE,oBAAoB,CAAC;IAChE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBAHzB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,OAAO,CAAC,eAAe,EAAE,oBAAoB,CAAC,EAC/C,KAAK,CAAC,EAAE,MAAM,YAAA,EACd,gBAAgB,CAAC,EAAE,MAAM,YAAA;IAGtC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,EAAE,aAAa,UAAO,GAAG,OAAO,CAAC,QAAQ,CAAC;IA0E1F,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,EAAE,aAAa,UAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAInF,YAAY,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE,WAAgB,EAAE,aAAa,UAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;CAmD/G;AAED,8FAA8F;AAC9F,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,oBAAoB,EAAE,IAAI,SAAK,GAAG,UAAU,CAKzF;AAED,wBAAgB,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,YAAY,UAAO,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,cAAc,CAM5G"}