mailschema 0.3.1 → 0.3.3

package/README.md

@@ -3,9 +3,11 @@
 [Mail Action Protocol](https://mailschema.org) 0.3 for JavaScript. It parses and checks MAP descriptions, type contracts and Registry implementation records, and computes the RFC 8785 digests that identify contracts. The same code runs the MailSchema specification's own checks. It has no Node.js-only dependencies, so it also runs in browsers and workers.
 
 ```sh
-npm install mailschema@0.3.1
+npm install mailschema@0.3.3
 ```
 
+It needs Node.js 22 or later, as `engines` declares; browsers and workers run it as they are.
+
 ## Check a description against its contract
 
 ```js
@@ -20,6 +22,16 @@ if (errors.length) throw new Error(errors.join('\n'));
 
 `parseDescription` reads the bytes as MAP JSON (strict I-JSON within 64 KiB) and checks the core rules, or throws `InvalidDocument` with every reason. Obtain contracts from a catalogue you configure and pin them by digest; a message never chooses one.
 
+The published types and their contracts are in the Registry, [`https://mailschema.org/registry/map-0.3.json`](https://mailschema.org/registry/map-0.3.json): each type's `contractHref` is its contract under `https://mailschema.org/artifacts/map-0.3/contracts/`, `exampleHref` is an example description of the type, and its Registry page is `href`.
+
+## Write a description
+
+Start from the type's example. A description has these members, all required: `@context`, `@type` (`MailAction`), `@id`, `profile`, `type` (`id`, `version`, `contractDigest`), `issuedAt`, `expiresAt`, `inLanguage` (a BCP 47 tag such as `en`), `service` (`id`, an HTTPS origin with no path, and an optional `tenant`), `recipient`, `subject` (`id`, `title`), `terms` (`id`, `version`), `details` (the shape the contract's `detailsSchema` sets), `operations` and `human` (`url`). Times are UTC to the second, `YYYY-MM-DDTHH:MM:SSZ`. `type.contractDigest` is the contract's digest: the second line `mailschema contract <contract.json>` prints, and the type's `digest` in the Registry.
+
+## What a check covers
+
+`parseDescription` and `Contract.descriptionErrors` check the document: the core rules, and that `details` and the operations are what the contract allows. They do not check what only the acting service knows. Whether the service, recipient, `details` and terms match a request recorded when the person started it (for an Email Address Confirmation, that `details.mailbox` is the recipient's mailbox), whether the current time is between `issuedAt` and `expiresAt`, and whether the message is authentic are the implementation's checks, under the contract's requirements and the [specification](https://mailschema.org/specification/core).
+
 ## API
 
 - `parse(input, maxBytes)`, `canonicalize(value)`, `digest(value)`: MAP JSON and RFC 8785 digests.
@@ -27,6 +39,7 @@ if (errors.length) throw new Error(errors.join('\n'));
 - `new Contract(value)`, `Contract.parse(input)`: a checked contract with `digest`, `operation(id)`, `detailsErrors(details)`, `inputErrors(operationId, input)` and `descriptionErrors(description)`.
 - `contractErrors(value)`: why a value is not a contract, including schema keywords, formats and patterns every implementation can enforce alike.
 - `implementationErrors(value)`, `parseImplementation(input)`: Registry implementation records.
+- `extractMessage(input)`: the one MAP part of a received email, read from its original bytes. It returns `{ status: 'valid', description, bytes }`, `{ status: 'invalid', reason }` or `{ status: 'none' }`, and never throws for untrusted input.
 - `PROFILE`, `CONTEXT`, `DESCRIPTION_MEDIA_TYPE`, `EFFECTS`, `CAPABILITY_KINDS` and the size limits.
 
 The profile record, context and schemas are exported byte for byte: `mailschema/profile.json`, `mailschema/context.jsonld`, `mailschema/core.schema.json`, `mailschema/contract.schema.json` and `mailschema/implementation.schema.json`.
@@ -34,12 +47,13 @@ The profile record, context and schemas are exported byte for byte: `mailschema/
 ## Command line
 
 ```sh
-npx mailschema@0.3.1 contract campaign-send-approval-0.1.json
-npx mailschema@0.3.1 description description.json --contract campaign-send-approval-0.1.json
-npx mailschema@0.3.1 implementation record.json
+npx mailschema@0.3.3 contract campaign-send-approval-0.1.json
+npx mailschema@0.3.3 description description.json --contract campaign-send-approval-0.1.json
+npx mailschema@0.3.3 implementation record.json
+npx mailschema@0.3.3 message approval.eml > description.json
 ```
 
-Each command first prints a line naming what it checked. `contract` prints `Valid type contract <id> <version>` and, on the second line, the contract's digest. `description` prints `Valid MAP 0.3 description <@id>` and, on the second line, the description's digest; with `--contract`, it first checks that the description uses that contract as it allows. `implementation` prints `Valid implementation record for <service>`. A digest is `sha-256:` and the SHA-256 of the document's RFC 8785 canonical JSON, the value `digest()` returns; the description's digest is not the contract digest it names. An invalid file prints every reason on standard error and exits with status 1. Nothing is uploaded or changed.
+`mailschema <command> --help` explains one command, `--version` prints the package version, and `--json` prints the result as one JSON object: `{"valid":true,...}` with the identifiers and digest, or `{"valid":false,"errors":[...]}`. Each command first prints a line naming what it checked. `contract` prints `Valid type contract <id> <version>` and, on the second line, the contract's digest. `description` prints `Valid MAP 0.3 description <@id>` and, on the second line, the description's digest; with `--contract`, it first checks that the description uses that contract as it allows. `implementation` prints `Valid implementation record for <service>`. `message` reads a received email (a saved `.eml`), writes its one MAP description to standard output exactly as the MAP part carries it, and prints the `description` lines on standard error. A digest is `sha-256:` and the SHA-256 of the document's RFC 8785 canonical JSON, the value `digest()` returns; the description's digest is not the contract digest it names. An invalid file prints every reason on standard error and exits with status 1: each names the JSON Pointer to fix, and where a schema offers alternatives, only the one the value chose. Nothing is uploaded or changed.
 
 Checking does not authenticate a message, establish a service's authority or perform an action. Those belong to the implementation, under the [specification](https://mailschema.org/specification/core).
 

package/bin/mailschema.js

@@ -4,28 +4,61 @@ import { parseArgs } from 'node:util';
 import {
   Contract,
   CONTRACT_MAX_BYTES,
+  DESCRIPTION_MAX_BYTES,
   digest,
+  extractMessage,
   InvalidDocument,
   parseDescription,
   parseImplementation,
 } from '../dist/index.js';
 
-const help = `Mail Action Protocol 0.3 checks
+const { version } = JSON.parse(await readFile(new URL('../package.json', import.meta.url), 'utf8'));
 
-  mailschema contract <contract.json>
-  mailschema description <description.json> [--contract <contract.json>]
-  mailschema implementation <record.json>
+const COMMANDS = {
+  contract: {
+    usage: 'mailschema contract <contract.json>',
+    about: `Checks a type contract and prints "Valid type contract <id> <version>" and the
+contract's digest. type.contractDigest in a description names this digest.`,
+  },
+  description: {
+    usage: 'mailschema description <description.json> [--contract <contract.json>]',
+    about: `Checks a description against MAP 0.3 Core and, with --contract, that it uses that
+contract as it allows: its details and operations. Prints "Valid MAP 0.3 description
+<@id>" and the description's digest, which is not the contract digest it names. It
+checks the document only: whether the service, recipient and terms match a request
+recorded when the person started it, and whether the description is still in its
+issuedAt to expiresAt window, are for the implementation that acts on it.`,
+  },
+  implementation: {
+    usage: 'mailschema implementation <record.json>',
+    about: 'Checks a Registry implementation record and names the service it describes.',
+  },
+  message: {
+    usage: 'mailschema message <message.eml>',
+    about: `Finds a received email's one MAP part, writes its description to standard output
+exactly as the part carries it, and prints the description's digest on standard error.`,
+  },
+};
 
-contract checks a type contract and prints its digest. description checks a
-description and, with --contract, that it uses that contract as it allows,
-then prints the description's digest. implementation checks a Registry
-implementation record. A digest is the SHA-256 of the document's RFC 8785
-canonical JSON. Nothing is uploaded or changed.`;
+const help = `Mail Action Protocol 0.3 checks, mailschema ${version}
 
-async function read(path) {
+${Object.values(COMMANDS)
+  .map((command) => `  ${command.usage}`)
+  .join('\n')}
+
+Options: --json prints the result as JSON, --help after a command explains it, and
+--version prints the package version. A digest is the SHA-256 of the document's RFC 8785
+canonical JSON. Nothing is uploaded or changed. An invalid document prints every reason
+it is not valid, one per line, and exits 1.`;
+
+const commandHelp = (name) => `${COMMANDS[name].usage}\n\n${COMMANDS[name].about}\n\nAdd --json for a JSON result.`;
+
+// A whole email, attachments included, is far larger than any MAP document.
+const MESSAGE_MAX_BYTES = 26214400;
+
+async function read(path, maxBytes, kind) {
   const info = await stat(path);
-  if (!info.isFile() || info.size > CONTRACT_MAX_BYTES)
-    throw new Error(`Expected a JSON file of at most ${CONTRACT_MAX_BYTES} bytes.`);
+  if (!info.isFile() || info.size > maxBytes) throw new Error(`Expected ${kind} of at most ${maxBytes} bytes.`);
   return new Uint8Array(await readFile(path));
 }
 
@@ -34,28 +67,53 @@ function report(errors) {
   throw new InvalidDocument('Not valid.', errors);
 }
 
+let json = false;
 try {
   const { values, positionals } = parseArgs({
     allowPositionals: true,
-    options: { contract: { type: 'string' }, help: { type: 'boolean', short: 'h' } },
+    options: {
+      contract: { type: 'string' },
+      json: { type: 'boolean' },
+      help: { type: 'boolean', short: 'h' },
+      version: { type: 'boolean', short: 'v' },
+    },
   });
+  json = Boolean(values.json);
   const [command, path, ...extra] = positionals;
-  if (values.help || !command) console.log(help);
+  if (values.version) console.log(version);
+  else if (values.help && Object.hasOwn(COMMANDS, command ?? '')) console.log(commandHelp(command));
+  else if (values.help || !command) console.log(help);
+  else if (!Object.hasOwn(COMMANDS, command)) throw new Error(`Unknown command ${command}.\n\n${help}`);
   else if (!path || extra.length || (values.contract && command !== 'description'))
-    throw new Error(help);
+    throw new Error(commandHelp(command));
   else if (command === 'contract') {
-    const contract = Contract.parse(await read(path));
-    console.log(`Valid type contract ${contract.id} ${contract.version}\n${contract.digest}`);
+    const contract = Contract.parse(await read(path, CONTRACT_MAX_BYTES, 'a contract file'));
+    if (json) print({ valid: true, id: contract.id, version: contract.version, digest: contract.digest });
+    else console.log(`Valid type contract ${contract.id} ${contract.version}\n${contract.digest}`);
   } else if (command === 'description') {
-    const description = parseDescription(await read(path));
+    const description = parseDescription(await read(path, DESCRIPTION_MAX_BYTES, 'a description file'));
     if (values.contract)
-      report(Contract.parse(await read(values.contract)).descriptionErrors(description));
-    console.log(`Valid MAP 0.3 description ${description['@id']}\n${digest(description)}`);
-  } else if (command === 'implementation') {
-    const record = parseImplementation(await read(path));
-    console.log(`Valid implementation record for ${record.service}`);
-  } else throw new Error(help);
+      report(Contract.parse(await read(values.contract, CONTRACT_MAX_BYTES, 'a contract file')).descriptionErrors(description));
+    if (json) print({ valid: true, id: description['@id'], digest: digest(description) });
+    else console.log(`Valid MAP 0.3 description ${description['@id']}\n${digest(description)}`);
+  } else if (command === 'message') {
+    const result = extractMessage(await read(path, MESSAGE_MAX_BYTES, 'an email file'));
+    if (result.status === 'none') throw new Error('The message has no MAP 0.3 part.');
+    if (result.status === 'invalid') throw new Error(`The message's MAP part cannot be used: ${result.reason}.`);
+    process.stdout.write(result.bytes);
+    console.error(`Valid MAP 0.3 description ${result.description['@id']}\n${digest(result.description)}`);
+  } else {
+    const record = parseImplementation(await read(path, CONTRACT_MAX_BYTES, 'a record file'));
+    if (json) print({ valid: true, service: record.service });
+    else console.log(`Valid implementation record for ${record.service}`);
+  }
 } catch (error) {
-  console.error(error instanceof InvalidDocument ? error.errors.join('\n') : error.message);
+  const errors = error instanceof InvalidDocument ? error.errors : [error.message];
+  if (json) print({ valid: false, errors });
+  else console.error(errors.join('\n'));
   process.exitCode = 1;
 }
+
+function print(result) {
+  console.log(JSON.stringify(result));
+}

package/dist/core/artifacts.js

@@ -26,5 +26,50 @@ export function createValidator() {
         ajv.removeKeyword(keyword);
     return ajv;
 }
-/** Each validation error as its JSON Pointer and message. @internal */
-export const schemaErrors = (errors, prefix = '') => (errors ?? []).map((error) => `${prefix + error.instancePath || '/'}: ${error.message}`);
+/**
+ * Each validation error as its JSON Pointer and message, reduced to the ones that say what to
+ * fix: an enum or const error names the values it allows, an unexpected member is named, an
+ * if/then wrapper is left to the error inside it, and a oneOf whose branches are told apart by
+ * a const reports only the branch the value chose. @internal
+ */
+export const schemaErrors = (errors, prefix = '') => actionable(errors ?? []).map((error) => `${prefix + error.instancePath || '/'}: ${schemaMessage(error)}`);
+function schemaMessage(error) {
+    if (error.keyword === 'enum')
+        return `must be one of ${listed(error.params.allowedValues)}`;
+    if (error.keyword === 'const')
+        return `must be ${JSON.stringify(error.params.allowedValue)}`;
+    if (error.keyword === 'additionalProperties')
+        return `must not have the member ${JSON.stringify(error.params.additionalProperty)}`;
+    return error.message;
+}
+const listed = (values) => values.map((value) => JSON.stringify(value)).join(', ');
+function actionable(errors) {
+    let kept = errors.filter((error) => error.keyword !== 'if');
+    for (const oneOf of kept.filter((error) => error.keyword === 'oneOf' && !error.params.passingSchemas)) {
+        const branchOf = (error) => error.schemaPath.startsWith(`${oneOf.schemaPath}/`)
+            ? Number(error.schemaPath.slice(oneOf.schemaPath.length + 1).split('/')[0])
+            : undefined;
+        const branches = new Map();
+        for (const error of kept) {
+            const branch = branchOf(error);
+            if (branch !== undefined)
+                branches.set(branch, [...(branches.get(branch) ?? []), error]);
+        }
+        // The discriminator: a const one level below the oneOf's value that a branch refused.
+        const discriminator = (branch) => branch.find((error) => error.keyword === 'const' &&
+            error.instancePath.startsWith(`${oneOf.instancePath}/`) &&
+            !error.instancePath.slice(oneOf.instancePath.length + 1).includes('/'));
+        const refused = [...branches.values()].map(discriminator);
+        const chosen = [...branches.keys()].filter((_, index) => !refused[index]);
+        const sharedPointer = refused.find(Boolean)?.instancePath;
+        if (chosen.length === 1 && refused.filter(Boolean).length === branches.size - 1) {
+            kept = kept.filter((error) => error !== oneOf && (branchOf(error) ?? chosen[0]) === chosen[0]);
+        }
+        else if (chosen.length === 0 && sharedPointer && refused.every((error) => error?.instancePath === sharedPointer)) {
+            const allowed = refused.map((error) => error.params.allowedValue);
+            const combined = { ...refused[0], keyword: 'enum', params: { allowedValues: allowed } };
+            kept = [...kept.filter((error) => error !== oneOf && branchOf(error) === undefined), combined];
+        }
+    }
+    return kept;
+}

package/dist/core/description.d.ts

@@ -37,8 +37,9 @@ export interface Description {
 }
 /**
  * Why the value is not a MAP 0.3 description, or no reasons. Beyond the core schema:
- * expiry follows issuance, operation identifiers are unique, and no security-sensitive
- * identifier contains whitespace, a control or a formatting character.
+ * expiry follows issuance, inLanguage is a well-formed BCP 47 tag, operation identifiers are
+ * unique, and no security-sensitive identifier contains whitespace, a control or a
+ * formatting character.
  */
 export declare function descriptionErrors(value: unknown): string[];
 /** The description in the bytes or text, or InvalidDocument with every reason it is not one. */

package/dist/core/description.js

@@ -4,10 +4,17 @@ import { InvalidDocument, parse } from "./json.js";
 const validate = createValidator().compile(coreSchema);
 // Whitespace, controls, bidirectional and invisible formatting characters.
 const UNSAFE = /[\p{White_Space}\p{Cc}\p{Cf}]/u;
+// A well-formed BCP 47 language tag: RFC 5646's langtag, privateuse and grandfathered forms.
+const LANGUAGE_TAG = new RegExp('^(?:(?:[a-z]{2,3}(?:-[a-z]{3}){0,3}|[a-z]{4}|[a-z]{5,8})(?:-[a-z]{4})?(?:-(?:[a-z]{2}|[0-9]{3}))?' +
+    '(?:-(?:[a-z0-9]{5,8}|[0-9][a-z0-9]{3}))*(?:-[0-9a-wy-z](?:-[a-z0-9]{2,8})+)*(?:-x(?:-[a-z0-9]{1,8})+)?' +
+    '|x(?:-[a-z0-9]{1,8})+' +
+    '|en-gb-oed|i-(?:ami|bnn|default|enochian|hak|klingon|lux|mingo|navajo|pwn|tao|tay|tsu)' +
+    '|sgn-(?:be-fr|be-nl|ch-de)|art-lojban|cel-gaulish|no-(?:bok|nyn)|zh-(?:guoyu|hakka|min|min-nan|xiang))$', 'i');
 /**
  * Why the value is not a MAP 0.3 description, or no reasons. Beyond the core schema:
- * expiry follows issuance, operation identifiers are unique, and no security-sensitive
- * identifier contains whitespace, a control or a formatting character.
+ * expiry follows issuance, inLanguage is a well-formed BCP 47 tag, operation identifiers are
+ * unique, and no security-sensitive identifier contains whitespace, a control or a
+ * formatting character.
  */
 export function descriptionErrors(value) {
     if (!validate(value))
@@ -15,6 +22,8 @@ export function descriptionErrors(value) {
     const errors = [];
     if (Date.parse(value.expiresAt) <= Date.parse(value.issuedAt))
         errors.push('/expiresAt: must be later than issuedAt');
+    if (!LANGUAGE_TAG.test(value.inLanguage))
+        errors.push('/inLanguage: must be a well-formed BCP 47 language tag');
     const ids = value.operations.map((operation) => operation.id);
     if (new Set(ids).size !== ids.length)
         errors.push('/operations: identifiers must be unique');

package/dist/core/index.d.ts

@@ -4,4 +4,5 @@ export { sha256 } from './sha256.ts';
 export { descriptionErrors, parseDescription, type Description } from './description.ts';
 export { CAPABILITY_KINDS, Contract, contractErrors, type CapabilityKind, type ContractDocument, type Operation, } from './contract.ts';
 export { implementationErrors, parseImplementation, type ImplementationRecord, } from './implementation.ts';
+export { extractMessage, type MessageProblem, type MessageResult } from './message.ts';
 export { unportablePattern } from './patterns.ts';

package/dist/core/index.js

@@ -6,4 +6,5 @@ export { sha256 } from "./sha256.js";
 export { descriptionErrors, parseDescription } from "./description.js";
 export { CAPABILITY_KINDS, Contract, contractErrors, } from "./contract.js";
 export { implementationErrors, parseImplementation, } from "./implementation.js";
+export { extractMessage } from "./message.js";
 export { unportablePattern } from "./patterns.js";

package/dist/core/message.d.ts

@@ -0,0 +1,27 @@
+import { type Description } from './description.ts';
+/**
+ * Why a message's MAP part cannot be used: more than one designated part, a header that
+ * readers could read differently, a transfer encoding other than base64 or quoted-printable,
+ * a part not labelled exactly with this profile, a part outside a multipart/related entity
+ * whose root is readable, an invalid description, or a message that cannot be read.
+ */
+export type MessageProblem = 'multiple_parts' | 'ambiguous_headers' | 'transfer_encoding' | 'media_type' | 'not_partial_representation' | 'invalid_description' | 'unreadable';
+/** What a message carries: no MAP part, an unusable one and why, or its description. */
+export type MessageResult = {
+    status: 'none';
+} | {
+    status: 'invalid';
+    reason: MessageProblem;
+} | {
+    status: 'valid';
+    description: Description;
+    bytes: Uint8Array;
+};
+/**
+ * The MAP part of a received email (Core, "Email representation"), read from its original
+ * bytes: the one designated description of this profile, in a multipart/related entity whose
+ * root is the readable content it describes. A description inside an attachment or an
+ * attached message is never read. It never throws for untrusted input. `bytes` are the
+ * description exactly as the part carries it, after its transfer encoding is removed.
+ */
+export declare function extractMessage(input: string | Uint8Array): MessageResult;

package/dist/core/message.js

@@ -0,0 +1,262 @@
+import { PROFILE } from "./artifacts.js";
+import { parseDescription } from "./description.js";
+import { InvalidDocument } from "./json.js";
+const READABLE = new Set(['text/plain', 'text/html']);
+const TRANSFER_ENCODINGS = new Set(['base64', 'quoted-printable']);
+const SINGLE_FIELDS = ['content-type', 'content-purpose', 'content-transfer-encoding'];
+const FIELD = /^([!-9;-~]+):[ \t]*([\s\S]*)$/;
+const PARAMETER = /^\s*([!#$%&'*+.^_`|~0-9A-Za-z-]+)\s*=/;
+/**
+ * The MAP part of a received email (Core, "Email representation"), read from its original
+ * bytes: the one designated description of this profile, in a multipart/related entity whose
+ * root is the readable content it describes. A description inside an attachment or an
+ * attached message is never read. It never throws for untrusted input. `bytes` are the
+ * description exactly as the part carries it, after its transfer encoding is removed.
+ */
+export function extractMessage(input) {
+    try {
+        const raw = typeof input === 'string' ? input : binary(input);
+        const designated = entities(entity(raw)).filter(([part]) => isDesignated(part));
+        if (!designated.length)
+            return { status: 'none' };
+        if (designated.length > 1)
+            return invalid('multiple_parts');
+        const [part, parent] = designated[0];
+        const reason = problem(part, parent);
+        if (reason)
+            return invalid(reason);
+        const bytes = decoded(part);
+        try {
+            return { status: 'valid', description: parseDescription(bytes), bytes };
+        }
+        catch (error) {
+            if (error instanceof InvalidDocument)
+                return invalid('invalid_description');
+            throw error;
+        }
+    }
+    catch {
+        return invalid('unreadable');
+    }
+}
+function invalid(reason) {
+    return { status: 'invalid', reason };
+}
+// Every part with its parent, at any depth. An attachment or an attached message is a leaf,
+// so nothing inside one is read.
+function entities(parent) {
+    return parent.parts.flatMap((part) => attached(part) || part.mimeType === 'message/rfc822' ? [] : [[part, parent], ...entities(part)]);
+}
+// A designated part labelled with this profile, judged from its original header lines,
+// before a parser picks one of repeated fields or parameters.
+function isDesignated(part) {
+    const purposes = values(part, 'content-purpose');
+    if (!purposes.some((value) => value.trim().toLowerCase() === 'machine-readable'))
+        return false;
+    const types = values(part, 'content-type');
+    return types.some((value) => value.toLowerCase().includes('application/ld+json')) && types.some((value) => value.includes(PROFILE));
+}
+function problem(part, parent) {
+    if (!unambiguous(part))
+        return 'ambiguous_headers';
+    if (!TRANSFER_ENCODINGS.has(first(part, 'content-transfer-encoding').trim().toLowerCase()))
+        return 'transfer_encoding';
+    if (part.mimeType !== 'application/ld+json' || part.parameters.get('profile') !== PROFILE)
+        return 'media_type';
+    if (!partialRepresentation(parent))
+        return 'not_partial_representation';
+    return undefined;
+}
+// Each field that decides how the part is read appears once, with each parameter once.
+function unambiguous(part) {
+    if (!part.fields)
+        return false;
+    const counts = new Map();
+    for (const [name] of part.fields)
+        counts.set(name, (counts.get(name) ?? 0) + 1);
+    return SINGLE_FIELDS.every((name) => counts.get(name) === 1) && uniqueParameters(first(part, 'content-type'));
+}
+// A multipart/related entity with one unambiguous Content-Type, whose root (its start
+// parameter's part, or else its first) is readable.
+function partialRepresentation(parent) {
+    if (parent.mimeType !== 'multipart/related')
+        return false;
+    const types = values(parent, 'content-type');
+    if (types.length !== 1 || !uniqueParameters(types[0]))
+        return false;
+    const start = parent.parameters.get('start') ?? '';
+    const roots = start ? parent.parts.filter((part) => first(part, 'content-id').trim() === start) : parent.parts.slice(0, 1);
+    return roots.length === 1 && readable(roots[0]);
+}
+function readable(part) {
+    if (attached(part))
+        return false;
+    if (part.mimeType === 'multipart/alternative')
+        return part.parts.some(readable);
+    return READABLE.has(part.mimeType) && binary(decoded(part)).trim().length > 0;
+}
+function attached(part) {
+    return first(part, 'content-disposition').trim().toLowerCase().startsWith('attachment');
+}
+function values(part, name) {
+    return (part.fields ?? []).filter(([field]) => field === name).map(([, value]) => value);
+}
+function first(part, name) {
+    return values(part, name)[0] ?? '';
+}
+// One entity from its raw bytes (a binary string, one character per byte): its header,
+// Content-Type and, for a multipart entity, its parts.
+function entity(raw) {
+    const fields = headerFields(raw);
+    const body = split(raw)?.[1] ?? '';
+    const contentType = (fields ?? []).find(([name]) => name === 'content-type')?.[1] ?? 'text/plain';
+    const [type, ...rest] = segments(contentType) ?? [contentType];
+    const mimeType = type.trim().toLowerCase();
+    const parameters = new Map();
+    for (const segment of rest) {
+        const name = PARAMETER.exec(segment)?.[1];
+        if (!name)
+            continue;
+        const key = name.toLowerCase();
+        if (!parameters.has(key))
+            parameters.set(key, unquote(segment.slice(segment.indexOf('=') + 1).trim()));
+    }
+    const boundary = parameters.get('boundary');
+    const parts = mimeType.startsWith('multipart/') && boundary ? multipart(body, boundary).map(entity) : [];
+    return { fields, mimeType, parameters, body, parts };
+}
+// The raw bytes of each body part between the boundary's delimiter lines; the preamble and
+// epilogue are not parts.
+function multipart(body, boundary) {
+    const delimiter = `--${boundary}`;
+    const parts = [];
+    let current = null;
+    // The line break before a delimiter line belongs to the delimiter, not to the part.
+    const close = () => {
+        if (current)
+            parts.push(current.join('').replace(/\r?\n$/, ''));
+    };
+    for (const line of body.split(/(?<=\n)/)) {
+        const content = line.replace(/\r?\n$/, '').replace(/[ \t]+$/, '');
+        if (content === `${delimiter}--`) {
+            close();
+            return parts;
+        }
+        if (content === delimiter) {
+            close();
+            current = [];
+        }
+        else
+            current?.push(line);
+    }
+    close();
+    return parts;
+}
+// An entity's header block and body, split at the first empty line; a part that begins with
+// an empty line has no header fields. Null when there is no empty line.
+function split(raw) {
+    const leading = /^\r?\n/.exec(raw);
+    if (leading)
+        return ['', raw.slice(leading[0].length)];
+    const separator = /\r?\n\r?\n/.exec(raw);
+    return separator ? [raw.slice(0, separator.index), raw.slice(separator.index + separator[0].length)] : null;
+}
+// The unfolded fields of an entity's header block as [lowercase name, value] pairs, or null
+// when it is malformed. Lines end with CRLF or LF.
+function headerFields(raw) {
+    const parts = split(raw);
+    if (!parts)
+        return null;
+    const lines = parts[0] ? parts[0].split(/\r?\n/) : [];
+    const fields = [];
+    for (const line of lines) {
+        if (/[\r\n]/.test(line))
+            return null;
+        if (line.startsWith(' ') || line.startsWith('\t')) {
+            if (!fields.length)
+                return null;
+            fields[fields.length - 1][1] += ` ${line.trim()}`;
+        }
+        else {
+            const match = FIELD.exec(line);
+            if (!match)
+                return null;
+            fields.push([match[1].toLowerCase(), match[2]]);
+        }
+    }
+    return fields;
+}
+// Whether every parameter of a Content-Type value has its own name. RFC 2231 sections and
+// charset markers belong to the name they extend, so profile and profile* are one name.
+function uniqueParameters(value) {
+    const parts = segments(value);
+    if (!parts)
+        return false;
+    const names = [];
+    for (const segment of parts.slice(1)) {
+        const name = PARAMETER.exec(segment)?.[1];
+        if (!name)
+            return false;
+        names.push(name.toLowerCase().replace(/\*.*$/, ''));
+    }
+    return new Set(names).size === names.length;
+}
+// The value split at each semicolon outside a quoted string, or null when a quoted string or
+// an escape is left open.
+function segments(value) {
+    const parts = [''];
+    let quoted = false;
+    let escaped = false;
+    for (const char of value) {
+        if (char === ';' && !quoted) {
+            parts.push('');
+            continue;
+        }
+        if (escaped)
+            escaped = false;
+        else if (quoted && char === '\\')
+            escaped = true;
+        else if (char === '"')
+            quoted = !quoted;
+        parts[parts.length - 1] += char;
+    }
+    return quoted || escaped ? null : parts;
+}
+function unquote(value) {
+    return value.startsWith('"') && value.endsWith('"') && value.length >= 2
+        ? value.slice(1, -1).replace(/\\(.)/g, '$1')
+        : value;
+}
+// The part's body with its transfer encoding removed.
+function decoded(part) {
+    const encoding = first(part, 'content-transfer-encoding').trim().toLowerCase();
+    if (encoding === 'base64')
+        return base64(part.body);
+    if (encoding === 'quoted-printable')
+        return quotedPrintable(part.body);
+    return bytesOf(part.body);
+}
+// Characters outside the alphabet are skipped, as mail readers do, so a damaged body reads as
+// an invalid description rather than an unreadable message.
+function base64(body) {
+    let clean = body.replace(/[^A-Za-z0-9+/]/g, '');
+    if (clean.length % 4 === 1)
+        clean = clean.slice(0, -1);
+    return bytesOf(atob(clean.padEnd(Math.ceil(clean.length / 4) * 4, '=')));
+}
+function quotedPrintable(body) {
+    const text = body.replace(/[ \t]+(?=\r?\n)/g, '').replace(/=\r?\n/g, '');
+    return bytesOf(text.replace(/=([0-9A-Fa-f]{2})/g, (_match, hex) => String.fromCharCode(parseInt(hex, 16))));
+}
+function binary(bytes) {
+    let text = '';
+    for (let index = 0; index < bytes.length; index += 0x8000)
+        text += String.fromCharCode(...bytes.subarray(index, index + 0x8000));
+    return text;
+}
+function bytesOf(text) {
+    const bytes = new Uint8Array(text.length);
+    for (let index = 0; index < text.length; index += 1)
+        bytes[index] = text.charCodeAt(index) & 0xff;
+    return bytes;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mailschema",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "Mail Action Protocol 0.3: parse and check descriptions, type contracts and implementation records",
   "type": "module",
   "license": "MIT",