@ouro.bot/cli 0.1.0-alpha.454 → 0.1.0-alpha.456

package/dist/mailroom/file-store.js

@@ -58,6 +58,9 @@ function writeJson(filePath, value) {
 function compareNewestFirst(left, right) {
     return Date.parse(right.receivedAt) - Date.parse(left.receivedAt);
 }
+function compareCandidatesNewestFirst(left, right) {
+    return Date.parse(right.lastSeenAt) - Date.parse(left.lastSeenAt);
+}
 class FileMailroomStore {
     rootDir;
     constructor(options) {
@@ -65,6 +68,9 @@ class FileMailroomStore {
         ensureDir(this.messagesDir);
         ensureDir(this.rawDir);
         ensureDir(this.logsDir);
+        ensureDir(this.candidatesDir);
+        ensureDir(this.decisionsDir);
+        ensureDir(this.outboundDir);
         (0, runtime_1.emitNervesEvent)({
             component: "senses",
             event: "senses.mail_file_store_init",
@@ -81,17 +87,35 @@ class FileMailroomStore {
     get logsDir() {
         return path.join(this.rootDir, "access-log");
     }
+    get candidatesDir() {
+        return path.join(this.rootDir, "candidates");
+    }
+    get decisionsDir() {
+        return path.join(this.rootDir, "decisions");
+    }
+    get outboundDir() {
+        return path.join(this.rootDir, "outbound");
+    }
     messagePath(id) {
         return path.join(this.messagesDir, `${id}.json`);
     }
+    candidatePath(id) {
+        return path.join(this.candidatesDir, `${id}.json`);
+    }
     rawPath(objectName) {
         return path.join(this.rootDir, objectName);
     }
+    decisionLogPath(agentId) {
+        return path.join(this.decisionsDir, `${agentId}.jsonl`);
+    }
+    outboundPath(id) {
+        return path.join(this.outboundDir, `${id}.json`);
+    }
     accessLogPath(agentId) {
         return path.join(this.logsDir, `${agentId}.jsonl`);
     }
     async putRawMessage(input) {
-        const { message, rawPayload } = await (0, core_1.buildStoredMailMessage)(input);
+        const { message, rawPayload, candidate } = await (0, core_1.buildStoredMailMessage)(input);
         const existing = readJson(this.messagePath(message.id));
         if (existing) {
             (0, runtime_1.emitNervesEvent)({
@@ -104,11 +128,14 @@ class FileMailroomStore {
         }
         writeJson(this.rawPath(message.rawObject), rawPayload);
         writeJson(this.messagePath(message.id), message);
+        if (candidate) {
+            writeJson(this.candidatePath(candidate.id), candidate);
+        }
         (0, runtime_1.emitNervesEvent)({
             component: "senses",
             event: "senses.mail_store_message_written",
             message: "mailroom store wrote message",
-            meta: { id: message.id, agentId: message.agentId },
+            meta: { id: message.id, agentId: message.agentId, candidate: candidate !== undefined },
         });
         return { created: true, message };
     }
@@ -141,6 +168,27 @@ class FileMailroomStore {
         });
         return messages;
     }
+    async updateMessagePlacement(id, placement) {
+        const message = readJson(this.messagePath(id));
+        if (!message) {
+            (0, runtime_1.emitNervesEvent)({
+                component: "senses",
+                event: "senses.mail_store_message_placement_updated",
+                message: "mailroom store message placement update missed",
+                meta: { id, placement, found: false },
+            });
+            return null;
+        }
+        const updated = { ...message, placement };
+        writeJson(this.messagePath(id), updated);
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_store_message_placement_updated",
+            message: "mailroom store updated message placement",
+            meta: { id, placement, found: true },
+        });
+        return updated;
+    }
     async readRawPayload(objectName) {
         const payload = readJson(this.rawPath(objectName));
         (0, runtime_1.emitNervesEvent)({
@@ -151,6 +199,112 @@ class FileMailroomStore {
         });
         return payload;
     }
+    async putScreenerCandidate(candidate) {
+        writeJson(this.candidatePath(candidate.id), candidate);
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_screener_candidate_written",
+            message: "mail screener candidate written",
+            meta: { id: candidate.id, agentId: candidate.agentId, status: candidate.status },
+        });
+        return candidate;
+    }
+    async updateScreenerCandidate(candidate) {
+        return this.putScreenerCandidate(candidate);
+    }
+    async listScreenerCandidates(filters) {
+        const candidates = fs.readdirSync(this.candidatesDir)
+            .filter((name) => name.endsWith(".json"))
+            .map((name) => readJson(path.join(this.candidatesDir, name)))
+            .filter((candidate) => candidate !== null)
+            .filter((candidate) => candidate.agentId === filters.agentId)
+            .filter((candidate) => filters.status ? candidate.status === filters.status : true)
+            .filter((candidate) => filters.placement ? candidate.placement === filters.placement : true)
+            .sort(compareCandidatesNewestFirst)
+            .slice(0, filters.limit ?? 50);
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_screener_candidates_listed",
+            message: "mail screener candidates listed",
+            meta: { agentId: filters.agentId, count: candidates.length },
+        });
+        return candidates;
+    }
+    async recordMailDecision(entry) {
+        const complete = {
+            schemaVersion: 1,
+            ...entry,
+            id: entry.id ?? `decision_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`,
+            createdAt: entry.createdAt ?? new Date().toISOString(),
+        };
+        ensureDir(this.decisionsDir);
+        fs.appendFileSync(this.decisionLogPath(entry.agentId), `${JSON.stringify(complete)}\n`, "utf-8");
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_decision_recorded",
+            message: "mail decision recorded",
+            meta: { agentId: entry.agentId, messageId: entry.messageId, action: entry.action },
+        });
+        return complete;
+    }
+    async listMailDecisions(agentId) {
+        const filePath = this.decisionLogPath(agentId);
+        if (!fs.existsSync(filePath)) {
+            (0, runtime_1.emitNervesEvent)({
+                component: "senses",
+                event: "senses.mail_decisions_listed",
+                message: "mail decisions listed",
+                meta: { agentId, count: 0 },
+            });
+            return [];
+        }
+        const entries = fs.readFileSync(filePath, "utf-8")
+            .split(/\r?\n/)
+            .filter(Boolean)
+            .map((line) => JSON.parse(line));
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_decisions_listed",
+            message: "mail decisions listed",
+            meta: { agentId, count: entries.length },
+        });
+        return entries;
+    }
+    async upsertMailOutbound(record) {
+        writeJson(this.outboundPath(record.id), record);
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_outbound_record_written",
+            message: "mail outbound record written",
+            meta: { agentId: record.agentId, id: record.id, status: record.status },
+        });
+        return record;
+    }
+    async getMailOutbound(id) {
+        const record = readJson(this.outboundPath(id));
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_outbound_record_read",
+            message: "mail outbound record read",
+            meta: { id, found: record !== null },
+        });
+        return record;
+    }
+    async listMailOutbound(agentId) {
+        const records = fs.readdirSync(this.outboundDir)
+            .filter((name) => name.endsWith(".json"))
+            .map((name) => readJson(path.join(this.outboundDir, name)))
+            .filter((record) => record !== null)
+            .filter((record) => record.agentId === agentId)
+            .sort((left, right) => right.updatedAt.localeCompare(left.updatedAt));
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_outbound_records_listed",
+            message: "mail outbound records listed",
+            meta: { agentId, count: records.length },
+        });
+        return records;
+    }
     async recordAccess(entry) {
         const complete = {
             ...entry,
@@ -194,6 +348,7 @@ class FileMailroomStore {
 exports.FileMailroomStore = FileMailroomStore;
 async function ingestRawMailToStore(input) {
     const { resolveMailAddress } = await Promise.resolve().then(() => __importStar(require("./core")));
+    const { classifyResolvedMailPlacement } = await Promise.resolve().then(() => __importStar(require("./policy")));
     const accepted = [];
     const rejectedRecipients = [];
     for (const recipient of input.envelope.rcptTo) {
@@ -202,11 +357,18 @@ async function ingestRawMailToStore(input) {
             rejectedRecipients.push(recipient);
             continue;
         }
+        const classification = classifyResolvedMailPlacement({
+            registry: input.registry,
+            resolved,
+            sender: input.envelope.mailFrom,
+            ...(input.authentication ? { authentication: input.authentication } : {}),
+        });
         const result = await input.store.putRawMessage({
             resolved,
             envelope: input.envelope,
             rawMime: input.rawMime,
             receivedAt: input.receivedAt,
+            classification,
         });
         accepted.push(result.message);
     }

package/dist/mailroom/outbound.js

@@ -0,0 +1,177 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveOutboundTransport = resolveOutboundTransport;
+exports.createMailDraft = createMailDraft;
+exports.confirmMailDraftSend = confirmMailDraftSend;
+exports.listMailOutboundRecords = listMailOutboundRecords;
+const crypto = __importStar(require("node:crypto"));
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const runtime_1 = require("../nerves/runtime");
+const core_1 = require("./core");
+function isRecord(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function textField(value, key) {
+    const raw = value[key];
+    return typeof raw === "string" ? raw.trim() : "";
+}
+function normalizeList(values) {
+    return values
+        .map((value) => value.trim())
+        .filter(Boolean)
+        .map(core_1.normalizeMailAddress);
+}
+function draftId() {
+    return `draft_${crypto.randomBytes(12).toString("hex")}`;
+}
+function ensureRecipients(to) {
+    if (to.length === 0)
+        throw new Error("at least one recipient is required");
+}
+function resolveOutboundTransport(config) {
+    const outbound = isRecord(config) && isRecord(config.outbound) ? config.outbound : null;
+    if (!outbound) {
+        throw new Error("outbound mail transport is not configured; human-required: set mailroom.outbound before confirmed sends");
+    }
+    const transport = textField(outbound, "transport");
+    if (transport === "local-sink") {
+        const sinkPath = textField(outbound, "sinkPath");
+        if (!sinkPath)
+            throw new Error("outbound local-sink transport is missing sinkPath");
+        return { kind: "local-sink", sinkPath };
+    }
+    if (transport === "azure-communication-services") {
+        const endpoint = textField(outbound, "endpoint");
+        if (!endpoint)
+            throw new Error("outbound Azure Communication Services transport is missing endpoint");
+        const senderAddress = textField(outbound, "senderAddress");
+        return {
+            kind: "azure-communication-services",
+            endpoint,
+            ...(senderAddress ? { senderAddress } : {}),
+        };
+    }
+    throw new Error("outbound mail transport is not configured; human-required: choose local-sink or azure-communication-services");
+}
+async function createMailDraft(input) {
+    const now = (input.now ?? (() => new Date()))().toISOString();
+    const to = normalizeList(input.to);
+    ensureRecipients(to);
+    const record = {
+        schemaVersion: 1,
+        id: draftId(),
+        agentId: input.agentId,
+        status: "draft",
+        from: (0, core_1.normalizeMailAddress)(input.from),
+        to,
+        cc: normalizeList(input.cc ?? []),
+        bcc: normalizeList(input.bcc ?? []),
+        subject: input.subject.trim(),
+        text: input.text,
+        actor: input.actor,
+        reason: input.reason,
+        createdAt: now,
+        updatedAt: now,
+    };
+    await input.store.upsertMailOutbound(record);
+    (0, runtime_1.emitNervesEvent)({
+        component: "senses",
+        event: "senses.mail_draft_created",
+        message: "mail draft created",
+        meta: { agentId: record.agentId, id: record.id, toCount: record.to.length },
+    });
+    return record;
+}
+function appendLocalSink(transport, record, sentAt) {
+    fs.mkdirSync(path.dirname(transport.sinkPath), { recursive: true });
+    const transportMessageId = `local_${crypto.randomBytes(10).toString("hex")}`;
+    fs.appendFileSync(transport.sinkPath, `${JSON.stringify({
+        schemaVersion: 1,
+        transportMessageId,
+        draftId: record.id,
+        agentId: record.agentId,
+        from: record.from,
+        to: record.to,
+        cc: record.cc,
+        bcc: record.bcc,
+        subject: record.subject,
+        text: record.text,
+        sentAt,
+    })}\n`, "utf-8");
+    return transportMessageId;
+}
+function transportSend(transport, record, sentAt) {
+    if (transport.kind === "local-sink")
+        return appendLocalSink(transport, record, sentAt);
+    throw new Error("Azure Communication Services outbound send is configured but not enabled on this machine; human-required setup is still needed");
+}
+async function confirmMailDraftSend(input) {
+    if (input.autonomous) {
+        throw new Error("Autonomous mail sending is disabled; create a draft and require explicit confirmation instead");
+    }
+    if (input.confirmation !== "CONFIRM_SEND") {
+        throw new Error("mail_send requires confirmation=CONFIRM_SEND before any outbound mail leaves the agent");
+    }
+    const draft = await input.store.getMailOutbound(input.draftId);
+    if (!draft || draft.agentId !== input.agentId)
+        throw new Error(`No draft found for ${input.draftId}`);
+    if (draft.status !== "draft")
+        throw new Error(`Draft ${input.draftId} is already ${draft.status}`);
+    const sentAt = (input.now ?? (() => new Date()))().toISOString();
+    const transportMessageId = transportSend(input.transport, draft, sentAt);
+    const sent = {
+        ...draft,
+        status: "sent",
+        actor: input.actor,
+        reason: input.reason,
+        updatedAt: sentAt,
+        sentAt,
+        transport: input.transport.kind,
+        transportMessageId,
+    };
+    await input.store.upsertMailOutbound(sent);
+    (0, runtime_1.emitNervesEvent)({
+        component: "senses",
+        event: "senses.mail_draft_sent",
+        message: "mail draft sent",
+        meta: { agentId: sent.agentId, id: sent.id, transport: sent.transport },
+    });
+    return sent;
+}
+function listMailOutboundRecords(store, agentId) {
+    return store.listMailOutbound(agentId);
+}

package/dist/mailroom/policy.js

@@ -0,0 +1,263 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildSenderPolicy = buildSenderPolicy;
+exports.classifyResolvedMailPlacement = classifyResolvedMailPlacement;
+exports.classifyMailPlacement = classifyMailPlacement;
+exports.listPendingScreenerCandidates = listPendingScreenerCandidates;
+exports.applyMailDecision = applyMailDecision;
+const crypto = __importStar(require("node:crypto"));
+const runtime_1 = require("../nerves/runtime");
+const core_1 = require("./core");
+function stableJson(value) {
+    /* v8 ignore next -- current sender-policy IDs are built from object/scalar fields; array support is defensive. @preserve */
+    if (Array.isArray(value))
+        return `[${value.map(stableJson).join(",")}]`;
+    if (value && typeof value === "object") {
+        const record = value;
+        return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableJson(record[key])}`).join(",")}}`;
+    }
+    return JSON.stringify(value);
+}
+function policyId(input) {
+    return `policy_${crypto.createHash("sha256").update(stableJson({
+        agentId: input.agentId.toLowerCase(),
+        scope: input.scope,
+        match: normalizeMatch(input.match),
+        action: input.action,
+        reason: input.reason,
+    })).digest("hex").slice(0, 16)}`;
+}
+function normalizeSender(sender) {
+    try {
+        return (0, core_1.normalizeMailAddress)(sender);
+    }
+    catch {
+        return null;
+    }
+}
+function senderDomain(sender) {
+    if (!sender)
+        return null;
+    /* v8 ignore next -- normalizeMailAddress guarantees a domain for non-null senders. @preserve */
+    return sender.split("@")[1]?.toLowerCase() ?? null;
+}
+function normalizeMatch(match) {
+    if (match.kind === "email")
+        return { kind: "email", value: (0, core_1.normalizeMailAddress)(match.value) };
+    return { kind: match.kind, value: match.value.trim().toLowerCase() };
+}
+function authenticationFailed(authentication) {
+    if (!authentication)
+        return false;
+    return authentication.dmarc === "fail" || (authentication.spf === "fail" &&
+        authentication.dkim === "fail");
+}
+function scopeMatches(policy, resolved) {
+    if (policy.scope === "all")
+        return true;
+    if (policy.scope === resolved.compartmentKind)
+        return true;
+    if (policy.scope.startsWith("source:"))
+        return resolved.source?.toLowerCase() === policy.scope.slice("source:".length);
+    return false;
+}
+function policyMatches(policy, resolved, sender) {
+    if (policy.agentId !== resolved.agentId || !scopeMatches(policy, resolved))
+        return false;
+    const match = normalizeMatch(policy.match);
+    if (match.kind === "email")
+        return sender === match.value;
+    if (match.kind === "domain")
+        return senderDomain(sender) === match.value;
+    if (match.kind === "source")
+        return resolved.source?.toLowerCase() === match.value;
+    return false;
+}
+function classificationForPolicy(policy) {
+    const placement = policy.action === "allow"
+        ? "imbox"
+        : policy.action === "discard"
+            ? "discarded"
+            : "quarantine";
+    return {
+        placement,
+        candidate: false,
+        trustReason: `sender policy ${policy.action} ${policy.match.kind} ${normalizeMatch(policy.match).value}`,
+    };
+}
+function buildSenderPolicy(input) {
+    const policy = {
+        schemaVersion: 1,
+        policyId: policyId(input),
+        agentId: input.agentId.toLowerCase(),
+        scope: input.scope,
+        match: normalizeMatch(input.match),
+        action: input.action,
+        actor: input.actor,
+        reason: input.reason,
+        createdAt: (input.now ?? new Date()).toISOString(),
+    };
+    (0, runtime_1.emitNervesEvent)({
+        component: "senses",
+        event: "senses.mail_sender_policy_built",
+        message: "mail sender policy built",
+        meta: { agentId: policy.agentId, action: policy.action, scope: policy.scope, matchKind: policy.match.kind },
+    });
+    return policy;
+}
+function classifyResolvedMailPlacement(input) {
+    if (authenticationFailed(input.authentication)) {
+        const classification = {
+            placement: "quarantine",
+            candidate: false,
+            trustReason: "mail authentication failed",
+            authentication: input.authentication,
+        };
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_classified",
+            message: "mail classified by authentication failure",
+            meta: { agentId: input.resolved.agentId, placement: classification.placement },
+        });
+        return classification;
+    }
+    const sender = normalizeSender(input.sender);
+    const policy = input.registry.senderPolicies?.find((entry) => policyMatches(entry, input.resolved, sender));
+    if (policy) {
+        const classification = classificationForPolicy(policy);
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_classified",
+            message: "mail classified by sender policy",
+            meta: { agentId: input.resolved.agentId, placement: classification.placement, policyId: policy.policyId },
+        });
+        return classification;
+    }
+    const placement = input.resolved.defaultPlacement;
+    const classification = {
+        placement,
+        candidate: placement === "screener",
+        trustReason: input.resolved.compartmentKind === "delegated"
+            ? `delegated source grant ${input.resolved.source ?? input.resolved.compartmentId}`
+            : placement === "imbox"
+                ? "screened-in native agent mailbox"
+                : "native agent mailbox default screener",
+        ...(input.authentication ? { authentication: input.authentication } : {}),
+    };
+    (0, runtime_1.emitNervesEvent)({
+        component: "senses",
+        event: "senses.mail_classified",
+        message: "mail classified by default placement",
+        meta: { agentId: input.resolved.agentId, placement: classification.placement, candidate: classification.candidate },
+    });
+    return classification;
+}
+function classifyMailPlacement(input) {
+    const resolved = (0, core_1.resolveMailAddress)(input.registry, input.recipient);
+    if (!resolved)
+        throw new Error(`Cannot classify unknown mail recipient ${input.recipient}`);
+    return classifyResolvedMailPlacement({
+        registry: input.registry,
+        resolved,
+        sender: input.sender,
+        ...(input.authentication ? { authentication: input.authentication } : {}),
+    });
+}
+function decisionPlacement(action) {
+    if (action === "discard")
+        return "discarded";
+    if (action === "quarantine")
+        return "quarantine";
+    return "imbox";
+}
+function candidateStatus(action) {
+    if (action === "discard")
+        return "discarded";
+    if (action === "quarantine")
+        return "quarantined";
+    if (action === "restore")
+        return "restored";
+    return "allowed";
+}
+async function listPendingScreenerCandidates(store, agentId) {
+    const candidates = await store.listScreenerCandidates({ agentId, status: "pending" });
+    (0, runtime_1.emitNervesEvent)({
+        component: "senses",
+        event: "senses.mail_pending_screener_candidates_listed",
+        message: "pending mail screener candidates listed",
+        meta: { agentId, count: candidates.length },
+    });
+    return candidates;
+}
+async function applyMailDecision(input) {
+    const message = await input.store.getMessage(input.messageId);
+    if (!message || message.agentId !== input.agentId) {
+        throw new Error(`No mail message ${input.messageId} for ${input.agentId}`);
+    }
+    const candidate = (await input.store.listScreenerCandidates({ agentId: input.agentId }))
+        .find((entry) => entry.messageId === input.messageId);
+    const nextPlacement = decisionPlacement(input.action);
+    const decision = await input.store.recordMailDecision({
+        agentId: input.agentId,
+        messageId: input.messageId,
+        ...(candidate ? { candidateId: candidate.id } : {}),
+        action: input.action,
+        actor: input.actor,
+        reason: input.reason,
+        previousPlacement: message.placement,
+        nextPlacement,
+        ...(candidate?.senderEmail ? { senderEmail: candidate.senderEmail } : {}),
+        ...(input.friendId ? { friendId: input.friendId } : {}),
+        ...(input.now ? { createdAt: input.now.toISOString() } : {}),
+    });
+    await input.store.updateMessagePlacement(input.messageId, nextPlacement);
+    if (candidate) {
+        await input.store.updateScreenerCandidate({
+            ...candidate,
+            placement: nextPlacement,
+            status: candidateStatus(input.action),
+            lastSeenAt: decision.createdAt,
+            resolvedByDecisionId: decision.id,
+        });
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "senses",
+        event: "senses.mail_decision_applied",
+        message: "mail decision applied",
+        meta: { agentId: input.agentId, messageId: input.messageId, action: input.action, nextPlacement },
+    });
+    return decision;
+}