@ouro.bot/cli 0.1.0-alpha.6 → 0.1.0-alpha.600

package/dist/mailroom/entry.js

@@ -0,0 +1,160 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseMailroomEntryArgs = parseMailroomEntryArgs;
+exports.runMailroomEntry = runMailroomEntry;
+const fs = __importStar(require("node:fs"));
+const storage_blob_1 = require("@azure/storage-blob");
+const identity_1 = require("@azure/identity");
+const runtime_1 = require("../nerves/runtime");
+const blob_store_1 = require("./blob-store");
+const file_store_1 = require("./file-store");
+const smtp_ingress_1 = require("./smtp-ingress");
+const KEY_VALUE_ARGS = new Map([
+    ["registry", "--registry"],
+    ["registry-base64", "--registry-base64"],
+    ["store", "--store"],
+    ["azure-account-url", "--azure-account-url"],
+    ["azure-container", "--azure-container"],
+    ["azure-managed-identity-client-id", "--azure-managed-identity-client-id"],
+    ["smtp-port", "--smtp-port"],
+    ["http-port", "--http-port"],
+    ["host", "--host"],
+]);
+function expandKeyValueArgs(args) {
+    const expanded = [];
+    for (const arg of args) {
+        const equalsIndex = arg.indexOf("=");
+        if (!arg.startsWith("--") && equalsIndex > 0) {
+            const key = arg.slice(0, equalsIndex).trim();
+            const flag = KEY_VALUE_ARGS.get(key);
+            if (flag) {
+                expanded.push(flag, arg.slice(equalsIndex + 1));
+                continue;
+            }
+        }
+        expanded.push(arg);
+    }
+    return expanded;
+}
+function optionalValue(args, flag) {
+    const index = args.indexOf(flag);
+    return index === -1 ? undefined : args[index + 1];
+}
+function optionalNumber(args, flag, fallback) {
+    const index = args.indexOf(flag);
+    if (index === -1)
+        return fallback;
+    const value = Number.parseInt(args[index + 1] ?? "", 10);
+    if (!Number.isInteger(value) || value < 0 || value > 65535) {
+        throw new Error(`${flag} must be a TCP port`);
+    }
+    return value;
+}
+function optionalString(args, flag, fallback) {
+    return optionalValue(args, flag) ?? fallback;
+}
+function parseMailroomEntryArgs(args) {
+    const expanded = expandKeyValueArgs(args);
+    const storePath = optionalValue(expanded, "--store");
+    const azureAccountUrl = optionalValue(expanded, "--azure-account-url");
+    if (!storePath && !azureAccountUrl) {
+        throw new Error("Missing --store or --azure-account-url");
+    }
+    const registryPath = optionalValue(expanded, "--registry");
+    const registryBase64 = optionalValue(expanded, "--registry-base64");
+    if (!registryPath && !registryBase64) {
+        throw new Error("Missing --registry or --registry-base64");
+    }
+    const parsed = {
+        ...(registryPath ? { registryPath } : {}),
+        ...(registryBase64 ? { registryBase64 } : {}),
+        ...(storePath ? { storePath } : {}),
+        ...(azureAccountUrl ? { azureAccountUrl } : {}),
+        azureContainer: optionalString(expanded, "--azure-container", "mailroom"),
+        ...(optionalValue(expanded, "--azure-managed-identity-client-id") ? { azureManagedIdentityClientId: optionalValue(expanded, "--azure-managed-identity-client-id") } : {}),
+        smtpPort: optionalNumber(expanded, "--smtp-port", 2525),
+        httpPort: optionalNumber(expanded, "--http-port", 8080),
+        host: optionalString(expanded, "--host", "0.0.0.0"),
+    };
+    (0, runtime_1.emitNervesEvent)({
+        component: "senses",
+        event: "senses.mail_entry_args_parsed",
+        message: "mailroom entry args parsed",
+        meta: { registryPath: parsed.registryPath ?? null, registryBase64: parsed.registryBase64 ? "present" : null, storePath: parsed.storePath ?? null, azureAccountUrl: parsed.azureAccountUrl ?? null, azureContainer: parsed.azureContainer, azureManagedIdentityClientId: parsed.azureManagedIdentityClientId ? "present" : null, smtpPort: parsed.smtpPort, httpPort: parsed.httpPort },
+    });
+    return parsed;
+}
+function createStore(parsed) {
+    if (parsed.azureAccountUrl) {
+        const credential = parsed.azureManagedIdentityClientId
+            ? new identity_1.DefaultAzureCredential({ managedIdentityClientId: parsed.azureManagedIdentityClientId })
+            : new identity_1.DefaultAzureCredential();
+        return new blob_store_1.AzureBlobMailroomStore({
+            serviceClient: new storage_blob_1.BlobServiceClient(parsed.azureAccountUrl, credential),
+            containerName: parsed.azureContainer,
+        });
+    }
+    return new file_store_1.FileMailroomStore({ rootDir: parsed.storePath });
+}
+function readRegistry(parsed) {
+    if (parsed.registryBase64) {
+        return JSON.parse(Buffer.from(parsed.registryBase64, "base64").toString("utf-8"));
+    }
+    return JSON.parse(fs.readFileSync(parsed.registryPath, "utf-8"));
+}
+function runMailroomEntry(args = process.argv.slice(2)) {
+    const parsed = parseMailroomEntryArgs(args);
+    const registry = readRegistry(parsed);
+    const servers = (0, smtp_ingress_1.startMailroomIngress)({
+        registry,
+        store: createStore(parsed),
+        smtpPort: parsed.smtpPort,
+        httpPort: parsed.httpPort,
+        host: parsed.host,
+    });
+    (0, runtime_1.emitNervesEvent)({
+        component: "senses",
+        event: "senses.mail_entry_started",
+        message: "mailroom entry started",
+        meta: { domain: registry.domain, smtpPort: parsed.smtpPort, httpPort: parsed.httpPort },
+    });
+    return servers;
+}
+/* v8 ignore start -- exercised by packaged/container entrypoint smoke rather than in-process unit tests. @preserve */
+if (require.main === module) {
+    runMailroomEntry();
+}
+/* v8 ignore stop */

package/dist/mailroom/file-store.js

@@ -0,0 +1,457 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readPrivateEnvelope = exports.FileMailroomStore = void 0;
+exports.ingestRawMailToStore = ingestRawMailToStore;
+exports.decryptMessages = decryptMessages;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const runtime_1 = require("../nerves/runtime");
+const core_1 = require("./core");
+Object.defineProperty(exports, "readPrivateEnvelope", { enumerable: true, get: function () { return core_1.readPrivateEnvelope; } });
+const search_cache_1 = require("./search-cache");
+const migration_1 = require("./migration");
+function ensureDir(dir) {
+    fs.mkdirSync(dir, { recursive: true });
+}
+function applyOptionalLimit(items, limit) {
+    return typeof limit === "number" ? items.slice(0, limit) : items;
+}
+function readJson(filePath) {
+    try {
+        return JSON.parse(fs.readFileSync(filePath, "utf-8"));
+    }
+    catch {
+        return null;
+    }
+}
+function writeJson(filePath, value) {
+    ensureDir(path.dirname(filePath));
+    fs.writeFileSync(filePath, `${JSON.stringify(value, null, 2)}\n`, "utf-8");
+}
+function compareNewestFirst(left, right) {
+    return Date.parse(right.receivedAt) - Date.parse(left.receivedAt);
+}
+function compareCandidatesNewestFirst(left, right) {
+    return Date.parse(right.lastSeenAt) - Date.parse(left.lastSeenAt);
+}
+function sourceMatchesFilter(source, filter) {
+    if (!filter)
+        return true;
+    if (!source)
+        return false;
+    return source.toLowerCase() === filter.toLowerCase();
+}
+class FileMailroomStore {
+    rootDir;
+    mailSearchCache;
+    constructor(options) {
+        this.rootDir = options.rootDir;
+        this.mailSearchCache = options.mailSearchCache ?? {
+            cacheDirForAgent: () => path.resolve(this.rootDir, "..", "mail-search"),
+        };
+        ensureDir(this.messagesDir);
+        ensureDir(this.rawDir);
+        ensureDir(this.logsDir);
+        ensureDir(this.candidatesDir);
+        ensureDir(this.decisionsDir);
+        ensureDir(this.outboundDir);
+        if (options.migrateAgentId) {
+            const searchCacheRoot = this.mailSearchCache.cacheDirForAgent?.(options.migrateAgentId)
+                ?? path.resolve(this.rootDir, "..", "mail-search");
+            (0, migration_1.migrateLocalMailroomToPlaintext)({
+                agentId: options.migrateAgentId,
+                mailroomRoot: this.rootDir,
+                searchCacheRoot,
+            });
+        }
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_file_store_init",
+            message: "file mailroom store initialized",
+            meta: { rootDir: this.rootDir, migrated: options.migrateAgentId !== undefined },
+        });
+    }
+    get messagesDir() {
+        return path.join(this.rootDir, "messages");
+    }
+    get rawDir() {
+        return path.join(this.rootDir, "raw");
+    }
+    get logsDir() {
+        return path.join(this.rootDir, "access-log");
+    }
+    get candidatesDir() {
+        return path.join(this.rootDir, "candidates");
+    }
+    get decisionsDir() {
+        return path.join(this.rootDir, "decisions");
+    }
+    get outboundDir() {
+        return path.join(this.rootDir, "outbound");
+    }
+    messagePath(id) {
+        return path.join(this.messagesDir, `${id}.json`);
+    }
+    candidatePath(id) {
+        return path.join(this.candidatesDir, `${id}.json`);
+    }
+    rawPath(objectName) {
+        return path.join(this.rootDir, objectName);
+    }
+    decisionLogPath(agentId) {
+        return path.join(this.decisionsDir, `${agentId}.jsonl`);
+    }
+    outboundPath(id) {
+        return path.join(this.outboundDir, `${id}.json`);
+    }
+    accessLogPath(agentId) {
+        return path.join(this.logsDir, `${agentId}.jsonl`);
+    }
+    async putRawMessage(input) {
+        const { message, rawMime, privateEnvelope, candidate } = await (0, core_1.buildPlaintextStoredMailMessage)(input);
+        const existing = readJson(this.messagePath(message.id));
+        if (existing) {
+            (0, search_cache_1.upsertMailSearchCacheDocument)(existing, privateEnvelope, this.mailSearchCache);
+            (0, runtime_1.emitNervesEvent)({
+                component: "senses",
+                event: "senses.mail_store_dedupe",
+                message: "mailroom store deduped existing message",
+                meta: { id: message.id, agentId: message.agentId },
+            });
+            return { created: false, message: existing };
+        }
+        ensureDir(path.dirname(this.rawPath(message.rawObject)));
+        fs.writeFileSync(this.rawPath(message.rawObject), rawMime);
+        writeJson(this.messagePath(message.id), message);
+        (0, search_cache_1.upsertMailSearchCacheDocument)(message, privateEnvelope, this.mailSearchCache);
+        if (candidate) {
+            writeJson(this.candidatePath(candidate.id), candidate);
+        }
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_file_store_plaintext_written",
+            message: "mailroom store wrote plaintext message",
+            meta: { id: message.id, agentId: message.agentId, candidate: candidate !== undefined },
+        });
+        return { created: true, message };
+    }
+    async getMessage(id) {
+        const message = readJson(this.messagePath(id));
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_store_message_read",
+            message: "mailroom store read message",
+            meta: { id, found: message !== null },
+        });
+        return message;
+    }
+    async listMessages(filters) {
+        const messages = fs.readdirSync(this.messagesDir)
+            .filter((name) => name.endsWith(".json"))
+            .map((name) => readJson(path.join(this.messagesDir, name)))
+            .filter((message) => message !== null)
+            .filter((message) => message.agentId === filters.agentId)
+            .filter((message) => filters.placement ? message.placement === filters.placement : true)
+            .filter((message) => filters.compartmentKind ? message.compartmentKind === filters.compartmentKind : true)
+            .filter((message) => sourceMatchesFilter(message.source, filters.source))
+            .sort(compareNewestFirst);
+        const limited = applyOptionalLimit(messages, filters.limit);
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_store_messages_listed",
+            message: "mailroom store listed messages",
+            meta: { agentId: filters.agentId, count: limited.length },
+        });
+        return limited;
+    }
+    async updateMessagePlacement(id, placement) {
+        const message = readJson(this.messagePath(id));
+        if (!message) {
+            (0, runtime_1.emitNervesEvent)({
+                component: "senses",
+                event: "senses.mail_store_message_placement_updated",
+                message: "mailroom store message placement update missed",
+                meta: { id, placement, found: false },
+            });
+            return null;
+        }
+        const updated = { ...message, placement };
+        writeJson(this.messagePath(id), updated);
+        (0, search_cache_1.syncMailSearchCacheMetadata)(updated, this.mailSearchCache);
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_store_message_placement_updated",
+            message: "mailroom store updated message placement",
+            meta: { id, placement, found: true },
+        });
+        return updated;
+    }
+    async readRawMime(message, _privateKeys) {
+        const filePath = this.rawPath(message.rawObject);
+        let buffer;
+        try {
+            buffer = fs.readFileSync(filePath);
+        }
+        catch {
+            buffer = null;
+        }
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_store_raw_read",
+            message: "mailroom store read raw plaintext mime",
+            meta: { id: message.id, found: buffer !== null },
+        });
+        return buffer;
+    }
+    async putScreenerCandidate(candidate) {
+        writeJson(this.candidatePath(candidate.id), candidate);
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_screener_candidate_written",
+            message: "mail screener candidate written",
+            meta: { id: candidate.id, agentId: candidate.agentId, status: candidate.status },
+        });
+        return candidate;
+    }
+    async updateScreenerCandidate(candidate) {
+        return this.putScreenerCandidate(candidate);
+    }
+    async listScreenerCandidates(filters) {
+        const candidates = fs.readdirSync(this.candidatesDir)
+            .filter((name) => name.endsWith(".json"))
+            .map((name) => readJson(path.join(this.candidatesDir, name)))
+            .filter((candidate) => candidate !== null)
+            .filter((candidate) => candidate.agentId === filters.agentId)
+            .filter((candidate) => filters.status ? candidate.status === filters.status : true)
+            .filter((candidate) => filters.placement ? candidate.placement === filters.placement : true)
+            .sort(compareCandidatesNewestFirst)
+            .slice(0, filters.limit ?? 50);
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_screener_candidates_listed",
+            message: "mail screener candidates listed",
+            meta: { agentId: filters.agentId, count: candidates.length },
+        });
+        return candidates;
+    }
+    async recordMailDecision(entry) {
+        const complete = {
+            schemaVersion: 1,
+            ...entry,
+            id: entry.id ?? `decision_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`,
+            createdAt: entry.createdAt ?? new Date().toISOString(),
+        };
+        ensureDir(this.decisionsDir);
+        fs.appendFileSync(this.decisionLogPath(entry.agentId), `${JSON.stringify(complete)}\n`, "utf-8");
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_decision_recorded",
+            message: "mail decision recorded",
+            meta: { agentId: entry.agentId, messageId: entry.messageId, action: entry.action },
+        });
+        return complete;
+    }
+    async listMailDecisions(agentId) {
+        const filePath = this.decisionLogPath(agentId);
+        if (!fs.existsSync(filePath)) {
+            (0, runtime_1.emitNervesEvent)({
+                component: "senses",
+                event: "senses.mail_decisions_listed",
+                message: "mail decisions listed",
+                meta: { agentId, count: 0 },
+            });
+            return [];
+        }
+        const entries = fs.readFileSync(filePath, "utf-8")
+            .split(/\r?\n/)
+            .filter(Boolean)
+            .map((line) => JSON.parse(line));
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_decisions_listed",
+            message: "mail decisions listed",
+            meta: { agentId, count: entries.length },
+        });
+        return entries;
+    }
+    async upsertMailOutbound(record) {
+        writeJson(this.outboundPath(record.id), record);
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_outbound_record_written",
+            message: "mail outbound record written",
+            meta: { agentId: record.agentId, id: record.id, status: record.status },
+        });
+        return record;
+    }
+    async getMailOutbound(id) {
+        const record = readJson(this.outboundPath(id));
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_outbound_record_read",
+            message: "mail outbound record read",
+            meta: { id, found: record !== null },
+        });
+        return record;
+    }
+    async listMailOutbound(agentId) {
+        const records = fs.readdirSync(this.outboundDir)
+            .filter((name) => name.endsWith(".json"))
+            .map((name) => readJson(path.join(this.outboundDir, name)))
+            .filter((record) => record !== null)
+            .filter((record) => record.agentId === agentId)
+            .sort((left, right) => right.updatedAt.localeCompare(left.updatedAt));
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_outbound_records_listed",
+            message: "mail outbound records listed",
+            meta: { agentId, count: records.length },
+        });
+        return records;
+    }
+    async recordAccess(entry) {
+        const complete = {
+            ...entry,
+            id: `access_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`,
+            accessedAt: new Date().toISOString(),
+        };
+        ensureDir(this.logsDir);
+        fs.appendFileSync(this.accessLogPath(entry.agentId), `${JSON.stringify(complete)}\n`, "utf-8");
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_access_recorded",
+            message: "mail access recorded",
+            meta: { agentId: entry.agentId, messageId: entry.messageId ?? null, tool: entry.tool },
+        });
+        return complete;
+    }
+    async listAccessLog(agentId) {
+        const filePath = this.accessLogPath(agentId);
+        if (!fs.existsSync(filePath)) {
+            (0, runtime_1.emitNervesEvent)({
+                component: "senses",
+                event: "senses.mail_access_log_listed",
+                message: "mail access log listed",
+                meta: { agentId, count: 0 },
+            });
+            return [];
+        }
+        const lines = fs.readFileSync(filePath, "utf-8")
+            .split(/\r?\n/)
+            .filter(Boolean);
+        const entries = [];
+        let malformedEntriesSkipped = 0;
+        for (const line of lines) {
+            try {
+                entries.push(JSON.parse(line));
+            }
+            catch {
+                malformedEntriesSkipped += 1;
+            }
+        }
+        if (malformedEntriesSkipped > 0) {
+            entries.malformedEntriesSkipped = malformedEntriesSkipped;
+            (0, runtime_1.emitNervesEvent)({
+                level: "warn",
+                component: "senses",
+                event: "senses.mail_access_log_malformed_lines_skipped",
+                message: "skipped malformed file-backed mail access log lines",
+                meta: { agentId, malformedEntriesSkipped },
+            });
+        }
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_access_log_listed",
+            message: "mail access log listed",
+            meta: { agentId, count: entries.length, malformedEntriesSkipped },
+        });
+        return entries;
+    }
+}
+exports.FileMailroomStore = FileMailroomStore;
+async function ingestRawMailToStore(input) {
+    const { resolveMailAddress } = await Promise.resolve().then(() => __importStar(require("./core")));
+    const { classifyResolvedMailPlacement } = await Promise.resolve().then(() => __importStar(require("./policy")));
+    const accepted = [];
+    const rejectedRecipients = [];
+    for (const recipient of input.envelope.rcptTo) {
+        const resolved = resolveMailAddress(input.registry, recipient);
+        if (!resolved) {
+            rejectedRecipients.push(recipient);
+            continue;
+        }
+        const classification = classifyResolvedMailPlacement({
+            registry: input.registry,
+            resolved,
+            sender: input.envelope.mailFrom,
+            ...(input.authentication ? { authentication: input.authentication } : {}),
+        });
+        const result = await input.store.putRawMessage({
+            resolved,
+            envelope: input.envelope,
+            rawMime: input.rawMime,
+            receivedAt: input.receivedAt,
+            ...(input.ingest ? { ingest: input.ingest } : {}),
+            classification,
+        });
+        accepted.push(result.message);
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "senses",
+        event: "senses.mail_ingest_complete",
+        message: "mail ingest completed",
+        meta: { accepted: accepted.length, rejected: rejectedRecipients.length },
+    });
+    return { accepted, rejectedRecipients };
+}
+/**
+ * Reader-side convenience: produce a `DecryptedMailMessage[]` from any mix of
+ * stored variants. Plaintext-form messages pass through without touching
+ * `privateKeys`; encrypted-form messages decrypt with the matching key.
+ * Throws `MissingPrivateMailKeyError` on the first encrypted message whose key
+ * is absent — callers that want per-message resilience should call
+ * `readPrivateEnvelope` in their own loop.
+ */
+function decryptMessages(messages, privateKeys) {
+    const decrypted = messages.map((message) => (0, core_1.readDecryptedMailMessage)(message, privateKeys));
+    (0, runtime_1.emitNervesEvent)({
+        component: "senses",
+        event: "senses.mail_messages_decrypted",
+        message: "mail messages projected to decrypted view",
+        meta: { count: decrypted.length },
+    });
+    return decrypted;
+}