mailschema 0.3.0 → 0.3.2

package/README.md

@@ -3,7 +3,7 @@
 [Mail Action Protocol](https://mailschema.org) 0.3 for JavaScript. It parses and checks MAP descriptions, type contracts and Registry implementation records, and computes the RFC 8785 digests that identify contracts. The same code runs the MailSchema specification's own checks. It has no Node.js-only dependencies, so it also runs in browsers and workers.
 
 ```sh
-npm install mailschema@0.3.0
+npm install mailschema@0.3.2
 ```
 
 ## Check a description against its contract
@@ -20,6 +20,8 @@ if (errors.length) throw new Error(errors.join('\n'));
 
 `parseDescription` reads the bytes as MAP JSON (strict I-JSON within 64 KiB) and checks the core rules, or throws `InvalidDocument` with every reason. Obtain contracts from a catalogue you configure and pin them by digest; a message never chooses one.
 
+The published types and their contracts are in the Registry, [`https://mailschema.org/registry/map-0.3.json`](https://mailschema.org/registry/map-0.3.json): each type's `contractHref` is its contract under `https://mailschema.org/artifacts/map-0.3/contracts/`, and its Registry page (`href`) links an example description of the type.
+
 ## API
 
 - `parse(input, maxBytes)`, `canonicalize(value)`, `digest(value)`: MAP JSON and RFC 8785 digests.
@@ -27,6 +29,7 @@ if (errors.length) throw new Error(errors.join('\n'));
 - `new Contract(value)`, `Contract.parse(input)`: a checked contract with `digest`, `operation(id)`, `detailsErrors(details)`, `inputErrors(operationId, input)` and `descriptionErrors(description)`.
 - `contractErrors(value)`: why a value is not a contract, including schema keywords, formats and patterns every implementation can enforce alike.
 - `implementationErrors(value)`, `parseImplementation(input)`: Registry implementation records.
+- `extractMessage(input)`: the one MAP part of a received email, read from its original bytes. It returns `{ status: 'valid', description, bytes }`, `{ status: 'invalid', reason }` or `{ status: 'none' }`, and never throws for untrusted input.
 - `PROFILE`, `CONTEXT`, `DESCRIPTION_MEDIA_TYPE`, `EFFECTS`, `CAPABILITY_KINDS` and the size limits.
 
 The profile record, context and schemas are exported byte for byte: `mailschema/profile.json`, `mailschema/context.jsonld`, `mailschema/core.schema.json`, `mailschema/contract.schema.json` and `mailschema/implementation.schema.json`.
@@ -34,11 +37,14 @@ The profile record, context and schemas are exported byte for byte: `mailschema/
 ## Command line
 
 ```sh
-npx mailschema@0.3.0 contract campaign-send-approval-0.1.json
-npx mailschema@0.3.0 description description.json --contract campaign-send-approval-0.1.json
-npx mailschema@0.3.0 implementation record.json
+npx mailschema@0.3.2 contract campaign-send-approval-0.1.json
+npx mailschema@0.3.2 description description.json --contract campaign-send-approval-0.1.json
+npx mailschema@0.3.2 implementation record.json
+npx mailschema@0.3.2 message approval.eml > description.json
 ```
 
+Each command first prints a line naming what it checked. `contract` prints `Valid type contract <id> <version>` and, on the second line, the contract's digest. `description` prints `Valid MAP 0.3 description <@id>` and, on the second line, the description's digest; with `--contract`, it first checks that the description uses that contract as it allows. `implementation` prints `Valid implementation record for <service>`. `message` reads a received email (a saved `.eml`), writes its one MAP description to standard output exactly as the MAP part carries it, and prints the `description` lines on standard error. A digest is `sha-256:` and the SHA-256 of the document's RFC 8785 canonical JSON, the value `digest()` returns; the description's digest is not the contract digest it names. An invalid file prints every reason on standard error and exits with status 1. Nothing is uploaded or changed.
+
 Checking does not authenticate a message, establish a service's authority or perform an action. Those belong to the implementation, under the [specification](https://mailschema.org/specification/core).
 
 Source: [mailschema/javascript](https://github.com/mailschema/javascript). License: MIT.

package/bin/mailschema.js

@@ -4,6 +4,8 @@ import { parseArgs } from 'node:util';
 import {
   Contract,
   CONTRACT_MAX_BYTES,
+  digest,
+  extractMessage,
   InvalidDocument,
   parseDescription,
   parseImplementation,
@@ -14,16 +16,23 @@ const help = `Mail Action Protocol 0.3 checks
   mailschema contract <contract.json>
   mailschema description <description.json> [--contract <contract.json>]
   mailschema implementation <record.json>
+  mailschema message <message.eml>
 
 contract checks a type contract and prints its digest. description checks a
-description and, with --contract, that it uses that contract as it allows.
-implementation checks a Registry implementation record. Nothing is uploaded
-or changed.`;
+description and, with --contract, that it uses that contract as it allows,
+then prints the description's digest. implementation checks a Registry
+implementation record. message finds a received email's one MAP part, writes
+its description to standard output exactly as the part carries it, and prints
+the description's digest on standard error. A digest is the SHA-256 of the
+document's RFC 8785 canonical JSON. Nothing is uploaded or changed.`;
 
-async function read(path) {
+// A whole email, attachments included, is far larger than any MAP document.
+const MESSAGE_MAX_BYTES = 26214400;
+
+async function read(path, maxBytes = CONTRACT_MAX_BYTES, kind = 'a JSON file') {
   const info = await stat(path);
-  if (!info.isFile() || info.size > CONTRACT_MAX_BYTES)
-    throw new Error(`Expected a JSON file of at most ${CONTRACT_MAX_BYTES} bytes.`);
+  if (!info.isFile() || info.size > maxBytes)
+    throw new Error(`Expected ${kind} of at most ${maxBytes} bytes.`);
   return new Uint8Array(await readFile(path));
 }
 
@@ -48,7 +57,13 @@ try {
     const description = parseDescription(await read(path));
     if (values.contract)
       report(Contract.parse(await read(values.contract)).descriptionErrors(description));
-    console.log(`Valid MAP 0.3 description ${description['@id']}`);
+    console.log(`Valid MAP 0.3 description ${description['@id']}\n${digest(description)}`);
+  } else if (command === 'message') {
+    const result = extractMessage(await read(path, MESSAGE_MAX_BYTES, 'an email file'));
+    if (result.status === 'none') throw new Error('The message has no MAP 0.3 part.');
+    if (result.status === 'invalid') throw new Error(`The message's MAP part cannot be used: ${result.reason}.`);
+    process.stdout.write(result.bytes);
+    console.error(`Valid MAP 0.3 description ${result.description['@id']}\n${digest(result.description)}`);
   } else if (command === 'implementation') {
     const record = parseImplementation(await read(path));
     console.log(`Valid implementation record for ${record.service}`);

package/dist/core/artifacts.js

@@ -26,5 +26,15 @@ export function createValidator() {
         ajv.removeKeyword(keyword);
     return ajv;
 }
-/** Each validation error as its JSON Pointer and message. @internal */
-export const schemaErrors = (errors, prefix = '') => (errors ?? []).map((error) => `${prefix + error.instancePath || '/'}: ${error.message}`);
+/**
+ * Each validation error as its JSON Pointer and message. An enum or const error names the
+ * values it allows, so the fix is in the message. @internal
+ */
+export const schemaErrors = (errors, prefix = '') => (errors ?? []).map((error) => `${prefix + error.instancePath || '/'}: ${schemaMessage(error)}`);
+function schemaMessage(error) {
+    if (error.keyword === 'enum')
+        return `must be one of ${error.params.allowedValues.map((value) => JSON.stringify(value)).join(', ')}`;
+    if (error.keyword === 'const')
+        return `must be ${JSON.stringify(error.params.allowedValue)}`;
+    return error.message;
+}

package/dist/core/index.d.ts

@@ -4,4 +4,5 @@ export { sha256 } from './sha256.ts';
 export { descriptionErrors, parseDescription, type Description } from './description.ts';
 export { CAPABILITY_KINDS, Contract, contractErrors, type CapabilityKind, type ContractDocument, type Operation, } from './contract.ts';
 export { implementationErrors, parseImplementation, type ImplementationRecord, } from './implementation.ts';
+export { extractMessage, type MessageProblem, type MessageResult } from './message.ts';
 export { unportablePattern } from './patterns.ts';

package/dist/core/index.js

@@ -6,4 +6,5 @@ export { sha256 } from "./sha256.js";
 export { descriptionErrors, parseDescription } from "./description.js";
 export { CAPABILITY_KINDS, Contract, contractErrors, } from "./contract.js";
 export { implementationErrors, parseImplementation, } from "./implementation.js";
+export { extractMessage } from "./message.js";
 export { unportablePattern } from "./patterns.js";

package/dist/core/message.d.ts

@@ -0,0 +1,27 @@
+import { type Description } from './description.ts';
+/**
+ * Why a message's MAP part cannot be used: more than one designated part, a header that
+ * readers could read differently, a transfer encoding other than base64 or quoted-printable,
+ * a part not labelled exactly with this profile, a part outside a multipart/related entity
+ * whose root is readable, an invalid description, or a message that cannot be read.
+ */
+export type MessageProblem = 'multiple_parts' | 'ambiguous_headers' | 'transfer_encoding' | 'media_type' | 'not_partial_representation' | 'invalid_description' | 'unreadable';
+/** What a message carries: no MAP part, an unusable one and why, or its description. */
+export type MessageResult = {
+    status: 'none';
+} | {
+    status: 'invalid';
+    reason: MessageProblem;
+} | {
+    status: 'valid';
+    description: Description;
+    bytes: Uint8Array;
+};
+/**
+ * The MAP part of a received email (Core, "Email representation"), read from its original
+ * bytes: the one designated description of this profile, in a multipart/related entity whose
+ * root is the readable content it describes. A description inside an attachment or an
+ * attached message is never read. It never throws for untrusted input. `bytes` are the
+ * description exactly as the part carries it, after its transfer encoding is removed.
+ */
+export declare function extractMessage(input: string | Uint8Array): MessageResult;

package/dist/core/message.js

@@ -0,0 +1,262 @@
+import { PROFILE } from "./artifacts.js";
+import { parseDescription } from "./description.js";
+import { InvalidDocument } from "./json.js";
+const READABLE = new Set(['text/plain', 'text/html']);
+const TRANSFER_ENCODINGS = new Set(['base64', 'quoted-printable']);
+const SINGLE_FIELDS = ['content-type', 'content-purpose', 'content-transfer-encoding'];
+const FIELD = /^([!-9;-~]+):[ \t]*([\s\S]*)$/;
+const PARAMETER = /^\s*([!#$%&'*+.^_`|~0-9A-Za-z-]+)\s*=/;
+/**
+ * The MAP part of a received email (Core, "Email representation"), read from its original
+ * bytes: the one designated description of this profile, in a multipart/related entity whose
+ * root is the readable content it describes. A description inside an attachment or an
+ * attached message is never read. It never throws for untrusted input. `bytes` are the
+ * description exactly as the part carries it, after its transfer encoding is removed.
+ */
+export function extractMessage(input) {
+    try {
+        const raw = typeof input === 'string' ? input : binary(input);
+        const designated = entities(entity(raw)).filter(([part]) => isDesignated(part));
+        if (!designated.length)
+            return { status: 'none' };
+        if (designated.length > 1)
+            return invalid('multiple_parts');
+        const [part, parent] = designated[0];
+        const reason = problem(part, parent);
+        if (reason)
+            return invalid(reason);
+        const bytes = decoded(part);
+        try {
+            return { status: 'valid', description: parseDescription(bytes), bytes };
+        }
+        catch (error) {
+            if (error instanceof InvalidDocument)
+                return invalid('invalid_description');
+            throw error;
+        }
+    }
+    catch {
+        return invalid('unreadable');
+    }
+}
+function invalid(reason) {
+    return { status: 'invalid', reason };
+}
+// Every part with its parent, at any depth. An attachment or an attached message is a leaf,
+// so nothing inside one is read.
+function entities(parent) {
+    return parent.parts.flatMap((part) => attached(part) || part.mimeType === 'message/rfc822' ? [] : [[part, parent], ...entities(part)]);
+}
+// A designated part labelled with this profile, judged from its original header lines,
+// before a parser picks one of repeated fields or parameters.
+function isDesignated(part) {
+    const purposes = values(part, 'content-purpose');
+    if (!purposes.some((value) => value.trim().toLowerCase() === 'machine-readable'))
+        return false;
+    const types = values(part, 'content-type');
+    return types.some((value) => value.toLowerCase().includes('application/ld+json')) && types.some((value) => value.includes(PROFILE));
+}
+function problem(part, parent) {
+    if (!unambiguous(part))
+        return 'ambiguous_headers';
+    if (!TRANSFER_ENCODINGS.has(first(part, 'content-transfer-encoding').trim().toLowerCase()))
+        return 'transfer_encoding';
+    if (part.mimeType !== 'application/ld+json' || part.parameters.get('profile') !== PROFILE)
+        return 'media_type';
+    if (!partialRepresentation(parent))
+        return 'not_partial_representation';
+    return undefined;
+}
+// Each field that decides how the part is read appears once, with each parameter once.
+function unambiguous(part) {
+    if (!part.fields)
+        return false;
+    const counts = new Map();
+    for (const [name] of part.fields)
+        counts.set(name, (counts.get(name) ?? 0) + 1);
+    return SINGLE_FIELDS.every((name) => counts.get(name) === 1) && uniqueParameters(first(part, 'content-type'));
+}
+// A multipart/related entity with one unambiguous Content-Type, whose root (its start
+// parameter's part, or else its first) is readable.
+function partialRepresentation(parent) {
+    if (parent.mimeType !== 'multipart/related')
+        return false;
+    const types = values(parent, 'content-type');
+    if (types.length !== 1 || !uniqueParameters(types[0]))
+        return false;
+    const start = parent.parameters.get('start') ?? '';
+    const roots = start ? parent.parts.filter((part) => first(part, 'content-id').trim() === start) : parent.parts.slice(0, 1);
+    return roots.length === 1 && readable(roots[0]);
+}
+function readable(part) {
+    if (attached(part))
+        return false;
+    if (part.mimeType === 'multipart/alternative')
+        return part.parts.some(readable);
+    return READABLE.has(part.mimeType) && binary(decoded(part)).trim().length > 0;
+}
+function attached(part) {
+    return first(part, 'content-disposition').trim().toLowerCase().startsWith('attachment');
+}
+function values(part, name) {
+    return (part.fields ?? []).filter(([field]) => field === name).map(([, value]) => value);
+}
+function first(part, name) {
+    return values(part, name)[0] ?? '';
+}
+// One entity from its raw bytes (a binary string, one character per byte): its header,
+// Content-Type and, for a multipart entity, its parts.
+function entity(raw) {
+    const fields = headerFields(raw);
+    const body = split(raw)?.[1] ?? '';
+    const contentType = (fields ?? []).find(([name]) => name === 'content-type')?.[1] ?? 'text/plain';
+    const [type, ...rest] = segments(contentType) ?? [contentType];
+    const mimeType = type.trim().toLowerCase();
+    const parameters = new Map();
+    for (const segment of rest) {
+        const name = PARAMETER.exec(segment)?.[1];
+        if (!name)
+            continue;
+        const key = name.toLowerCase();
+        if (!parameters.has(key))
+            parameters.set(key, unquote(segment.slice(segment.indexOf('=') + 1).trim()));
+    }
+    const boundary = parameters.get('boundary');
+    const parts = mimeType.startsWith('multipart/') && boundary ? multipart(body, boundary).map(entity) : [];
+    return { fields, mimeType, parameters, body, parts };
+}
+// The raw bytes of each body part between the boundary's delimiter lines; the preamble and
+// epilogue are not parts.
+function multipart(body, boundary) {
+    const delimiter = `--${boundary}`;
+    const parts = [];
+    let current = null;
+    // The line break before a delimiter line belongs to the delimiter, not to the part.
+    const close = () => {
+        if (current)
+            parts.push(current.join('').replace(/\r?\n$/, ''));
+    };
+    for (const line of body.split(/(?<=\n)/)) {
+        const content = line.replace(/\r?\n$/, '').replace(/[ \t]+$/, '');
+        if (content === `${delimiter}--`) {
+            close();
+            return parts;
+        }
+        if (content === delimiter) {
+            close();
+            current = [];
+        }
+        else
+            current?.push(line);
+    }
+    close();
+    return parts;
+}
+// An entity's header block and body, split at the first empty line; a part that begins with
+// an empty line has no header fields. Null when there is no empty line.
+function split(raw) {
+    const leading = /^\r?\n/.exec(raw);
+    if (leading)
+        return ['', raw.slice(leading[0].length)];
+    const separator = /\r?\n\r?\n/.exec(raw);
+    return separator ? [raw.slice(0, separator.index), raw.slice(separator.index + separator[0].length)] : null;
+}
+// The unfolded fields of an entity's header block as [lowercase name, value] pairs, or null
+// when it is malformed. Lines end with CRLF or LF.
+function headerFields(raw) {
+    const parts = split(raw);
+    if (!parts)
+        return null;
+    const lines = parts[0] ? parts[0].split(/\r?\n/) : [];
+    const fields = [];
+    for (const line of lines) {
+        if (/[\r\n]/.test(line))
+            return null;
+        if (line.startsWith(' ') || line.startsWith('\t')) {
+            if (!fields.length)
+                return null;
+            fields[fields.length - 1][1] += ` ${line.trim()}`;
+        }
+        else {
+            const match = FIELD.exec(line);
+            if (!match)
+                return null;
+            fields.push([match[1].toLowerCase(), match[2]]);
+        }
+    }
+    return fields;
+}
+// Whether every parameter of a Content-Type value has its own name. RFC 2231 sections and
+// charset markers belong to the name they extend, so profile and profile* are one name.
+function uniqueParameters(value) {
+    const parts = segments(value);
+    if (!parts)
+        return false;
+    const names = [];
+    for (const segment of parts.slice(1)) {
+        const name = PARAMETER.exec(segment)?.[1];
+        if (!name)
+            return false;
+        names.push(name.toLowerCase().replace(/\*.*$/, ''));
+    }
+    return new Set(names).size === names.length;
+}
+// The value split at each semicolon outside a quoted string, or null when a quoted string or
+// an escape is left open.
+function segments(value) {
+    const parts = [''];
+    let quoted = false;
+    let escaped = false;
+    for (const char of value) {
+        if (char === ';' && !quoted) {
+            parts.push('');
+            continue;
+        }
+        if (escaped)
+            escaped = false;
+        else if (quoted && char === '\\')
+            escaped = true;
+        else if (char === '"')
+            quoted = !quoted;
+        parts[parts.length - 1] += char;
+    }
+    return quoted || escaped ? null : parts;
+}
+function unquote(value) {
+    return value.startsWith('"') && value.endsWith('"') && value.length >= 2
+        ? value.slice(1, -1).replace(/\\(.)/g, '$1')
+        : value;
+}
+// The part's body with its transfer encoding removed.
+function decoded(part) {
+    const encoding = first(part, 'content-transfer-encoding').trim().toLowerCase();
+    if (encoding === 'base64')
+        return base64(part.body);
+    if (encoding === 'quoted-printable')
+        return quotedPrintable(part.body);
+    return bytesOf(part.body);
+}
+// Characters outside the alphabet are skipped, as mail readers do, so a damaged body reads as
+// an invalid description rather than an unreadable message.
+function base64(body) {
+    let clean = body.replace(/[^A-Za-z0-9+/]/g, '');
+    if (clean.length % 4 === 1)
+        clean = clean.slice(0, -1);
+    return bytesOf(atob(clean.padEnd(Math.ceil(clean.length / 4) * 4, '=')));
+}
+function quotedPrintable(body) {
+    const text = body.replace(/[ \t]+(?=\r?\n)/g, '').replace(/=\r?\n/g, '');
+    return bytesOf(text.replace(/=([0-9A-Fa-f]{2})/g, (_match, hex) => String.fromCharCode(parseInt(hex, 16))));
+}
+function binary(bytes) {
+    let text = '';
+    for (let index = 0; index < bytes.length; index += 0x8000)
+        text += String.fromCharCode(...bytes.subarray(index, index + 0x8000));
+    return text;
+}
+function bytesOf(text) {
+    const bytes = new Uint8Array(text.length);
+    for (let index = 0; index < text.length; index += 1)
+        bytes[index] = text.charCodeAt(index) & 0xff;
+    return bytes;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mailschema",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Mail Action Protocol 0.3: parse and check descriptions, type contracts and implementation records",
   "type": "module",
   "license": "MIT",