@ouro.bot/cli 0.1.0-alpha.83 → 0.1.0-alpha.831

package/dist/mailroom/blob-store.js

@@ -0,0 +1,889 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AzureBlobMailroomStore = void 0;
+exports.canonicalMailIndexRecordSnapshot = canonicalMailIndexRecordSnapshot;
+exports.decryptBlobMessages = decryptBlobMessages;
+const node_crypto_1 = require("node:crypto");
+const runtime_1 = require("../nerves/runtime");
+const core_1 = require("./core");
+const search_cache_1 = require("./search-cache");
+const MESSAGE_INDEX_PREFIX = "message-index";
+const MESSAGE_INDEX_SORT_MAX_MS = 9_999_999_999_999;
+const MESSAGE_INDEX_SORT_WIDTH = 13;
+const MESSAGE_INDEX_NO_SOURCE = "~";
+// Bumped from 20s after real HEY-corpus validation revealed that
+// real-world mail bodies (HTML-heavy booking confirmations, MBOX-imported
+// large messages) regularly exceed the original 20s ceiling. 60s with 2
+// attempts = 120s max wait, which is closer to what Azure Blob actually
+// needs for cold reads of a few-MB message body. Index reads still fit
+// comfortably in this budget.
+const DEFAULT_BLOB_OPERATION_TIMEOUT_MS = 60_000;
+const DEFAULT_BLOB_DOWNLOAD_ATTEMPTS = 2;
+const DEFAULT_MESSAGE_FETCH_CONCURRENCY = 20;
+const DEFAULT_MESSAGE_INDEX_BACKFILL_CONCURRENCY = 8;
+const MESSAGE_LIST_SCAN_CONCURRENCY = 32;
+function compareNewestFirst(left, right) {
+    return Date.parse(right.receivedAt) - Date.parse(left.receivedAt);
+}
+function compareCandidatesNewestFirst(left, right) {
+    return Date.parse(right.lastSeenAt) - Date.parse(left.lastSeenAt);
+}
+function blobText(value) {
+    return Buffer.from(`${JSON.stringify(value, null, 2)}\n`, "utf-8");
+}
+function applyOptionalLimit(items, limit) {
+    return typeof limit === "number" ? items.slice(0, limit) : items;
+}
+function positiveInteger(value, fallback) {
+    if (typeof value !== "number" || !Number.isFinite(value))
+        return fallback;
+    const normalized = Math.floor(value);
+    return normalized > 0 ? normalized : fallback;
+}
+function blobClientName(blob) {
+    return typeof blob.name === "string" && blob.name.trim().length > 0 ? blob.name : "<unknown-blob>";
+}
+function timeoutSignal(timeoutMs) {
+    if (typeof AbortSignal.timeout === "function") {
+        return {
+            signal: AbortSignal.timeout(timeoutMs),
+            dispose() {
+                return undefined;
+            },
+        };
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(new Error(`The operation timed out after ${timeoutMs}ms`)), timeoutMs);
+    return {
+        signal: controller.signal,
+        dispose() {
+            clearTimeout(timer);
+        },
+    };
+}
+async function withBlobOperationTimeout(timeoutMs, operation) {
+    const timeout = timeoutSignal(timeoutMs);
+    try {
+        return await operation(timeout.signal);
+    }
+    finally {
+        timeout.dispose();
+    }
+}
+function normalizeBlobOperationError(action, blob, timeoutMs, error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if ((error instanceof Error && error.name === "AbortError") || message.toLowerCase().includes("aborted")) {
+        return new Error(`${action} ${blobClientName(blob)} timed out after ${timeoutMs}ms`);
+    }
+    return new Error(`${action} ${blobClientName(blob)} failed: ${message}`);
+}
+function isRetryableBlobDownloadError(error) {
+    const message = (error instanceof Error ? error.message : String(error)).toLowerCase();
+    return message.includes("timed out") ||
+        message.includes("abort") ||
+        message.includes("econnreset") ||
+        message.includes("etimedout") ||
+        message.includes("socket closed");
+}
+function isBlobNotFoundError(error) {
+    const maybeStatus = typeof error === "object" && error !== null && "statusCode" in error
+        ? error.statusCode
+        : undefined;
+    if (maybeStatus === 404)
+        return true;
+    const message = (error instanceof Error ? error.message : String(error)).toLowerCase();
+    return message.includes("blobnotfound") ||
+        message.includes("the specified blob does not exist") ||
+        message.includes("missing blob");
+}
+function messageDestinationMatches(message, resolved) {
+    return message.agentId === resolved.agentId &&
+        message.mailboxId === resolved.mailboxId &&
+        message.recipient.toLowerCase() === resolved.address.toLowerCase();
+}
+function isNonEmptyString(value) {
+    return typeof value === "string" && value.length > 0;
+}
+function isEncryptedPayload(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const payload = value;
+    return payload.algorithm === "RSA-OAEP-SHA256+A256GCM" &&
+        isNonEmptyString(payload.keyId) &&
+        isNonEmptyString(payload.wrappedKey) &&
+        isNonEmptyString(payload.iv) &&
+        isNonEmptyString(payload.authTag) &&
+        isNonEmptyString(payload.ciphertext);
+}
+function validateCommittedEncryptedMessage(value, expectedId, resolved, label) {
+    if (typeof value !== "object" || value === null) {
+        throw new Error(`${label} ${expectedId} is invalid: expected an object`);
+    }
+    const message = value;
+    if (message.schemaVersion !== 1 || message.id !== expectedId) {
+        throw new Error(`${label} ${expectedId} is invalid: message identity does not match its committed path`);
+    }
+    if (!isNonEmptyString(message.agentId) || !isNonEmptyString(message.mailboxId) || !isNonEmptyString(message.recipient)) {
+        throw new Error(`${label} ${expectedId} is invalid: resolved destination metadata is incomplete`);
+    }
+    if (!messageDestinationMatches(message, resolved)) {
+        throw new Error(`${label} ${expectedId} belongs to a different resolved destination`);
+    }
+    if (message.bodyForm !== "encrypted" || !isEncryptedPayload(message.privateEnvelope) || "private" in message) {
+        throw new Error(`${label} ${expectedId} is invalid: committed body is not a coherent encrypted payload`);
+    }
+    const rawPrefix = `raw/${expectedId}.`;
+    const rawFingerprint = isNonEmptyString(message.rawObject) && message.rawObject.startsWith(rawPrefix) && message.rawObject.endsWith(".json")
+        ? message.rawObject.slice(rawPrefix.length, -".json".length)
+        : "";
+    if (!/^[a-f0-9]{64}$/.test(rawFingerprint) ||
+        !isNonEmptyString(message.rawSha256) || !/^[a-f0-9]{64}$/.test(message.rawSha256) ||
+        typeof message.rawSize !== "number" || !Number.isSafeInteger(message.rawSize) || message.rawSize < 0) {
+        throw new Error(`${label} ${expectedId} is invalid: encrypted raw metadata is incoherent`);
+    }
+    return message;
+}
+async function downloadJson(blob, timeoutMs) {
+    if (!await blob.exists())
+        return null;
+    let lastError = null;
+    for (let attempt = 1; attempt <= DEFAULT_BLOB_DOWNLOAD_ATTEMPTS; attempt += 1) {
+        try {
+            const buffer = await withBlobOperationTimeout(timeoutMs, (abortSignal) => {
+                return blob.downloadToBuffer(undefined, undefined, { abortSignal });
+            });
+            return JSON.parse(buffer.toString("utf-8"));
+        }
+        catch (error) {
+            lastError = error;
+            if (attempt >= DEFAULT_BLOB_DOWNLOAD_ATTEMPTS || !isRetryableBlobDownloadError(error))
+                break;
+        }
+    }
+    throw normalizeBlobOperationError("download", blob, timeoutMs, lastError);
+}
+async function downloadIndexedJson(blob, timeoutMs) {
+    let lastError = null;
+    for (let attempt = 1; attempt <= DEFAULT_BLOB_DOWNLOAD_ATTEMPTS; attempt += 1) {
+        try {
+            const buffer = await withBlobOperationTimeout(timeoutMs, (abortSignal) => {
+                return blob.downloadToBuffer(undefined, undefined, { abortSignal });
+            });
+            return JSON.parse(buffer.toString("utf-8"));
+        }
+        catch (error) {
+            if (isBlobNotFoundError(error))
+                return null;
+            lastError = error;
+            if (attempt >= DEFAULT_BLOB_DOWNLOAD_ATTEMPTS || !isRetryableBlobDownloadError(error))
+                break;
+        }
+    }
+    throw normalizeBlobOperationError("download", blob, timeoutMs, lastError);
+}
+async function uploadJson(blob, value, timeoutMs) {
+    try {
+        await withBlobOperationTimeout(timeoutMs, (abortSignal) => {
+            return blob.uploadData(blobText(value), { abortSignal });
+        });
+    }
+    catch (error) {
+        throw normalizeBlobOperationError("upload", blob, timeoutMs, error);
+    }
+}
+async function mapWithConcurrency(items, concurrency, worker) {
+    if (items.length === 0)
+        return [];
+    const results = new Array(items.length);
+    let nextIndex = 0;
+    const workerLoop = async () => {
+        while (true) {
+            const current = nextIndex;
+            nextIndex += 1;
+            if (current >= items.length)
+                return;
+            results[current] = await worker(items[current], current);
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(concurrency, items.length) }, async () => workerLoop()));
+    return results;
+}
+function encodeSourceToken(source) {
+    return source ? encodeURIComponent(source.toLowerCase()) : MESSAGE_INDEX_NO_SOURCE;
+}
+function decodeSourceToken(token) {
+    return token === MESSAGE_INDEX_NO_SOURCE ? undefined : decodeURIComponent(token);
+}
+function parseSortMs(receivedAt) {
+    const parsed = Date.parse(receivedAt);
+    if (!Number.isFinite(parsed))
+        return 0;
+    return Math.max(0, Math.min(MESSAGE_INDEX_SORT_MAX_MS, parsed));
+}
+function messageIndexPrefix(agentId) {
+    return `${MESSAGE_INDEX_PREFIX}/${agentId}/`;
+}
+function messageIndexBlobName(message) {
+    const sortKey = String(MESSAGE_INDEX_SORT_MAX_MS - parseSortMs(message.receivedAt)).padStart(MESSAGE_INDEX_SORT_WIDTH, "0");
+    return `${messageIndexPrefix(message.agentId)}${sortKey}__${message.compartmentKind}__${message.placement}__${encodeSourceToken(message.source)}__${message.id}.json`;
+}
+function messageIndexRecord(message) {
+    return {
+        schemaVersion: 1,
+        id: message.id,
+        agentId: message.agentId,
+        compartmentKind: message.compartmentKind,
+        placement: message.placement,
+        ...(message.source ? { source: message.source } : {}),
+        receivedAt: message.receivedAt,
+    };
+}
+function parseMessageIndexBlobName(name) {
+    if (!name.startsWith(`${MESSAGE_INDEX_PREFIX}/`) || !name.endsWith(".json"))
+        return null;
+    const parts = name.split("/");
+    if (parts.length !== 3)
+        return null;
+    const agentId = parts[1];
+    const stem = parts[2].slice(0, -5);
+    const [sortKey, compartmentKind, placement, sourceToken, ...idParts] = stem.split("__");
+    const id = idParts.join("__");
+    if (!agentId || !sortKey || !compartmentKind || !placement || !sourceToken || !id)
+        return null;
+    if (!/^\d{13}$/.test(sortKey))
+        return null;
+    if (compartmentKind !== "native" && compartmentKind !== "delegated")
+        return null;
+    if (!["imbox", "screener", "discarded", "quarantine", "draft", "sent"].includes(placement))
+        return null;
+    const decodedSource = decodeSourceToken(sourceToken);
+    const receivedAtMs = MESSAGE_INDEX_SORT_MAX_MS - Number(sortKey);
+    return {
+        schemaVersion: 1,
+        id,
+        agentId,
+        compartmentKind,
+        placement: placement,
+        ...(decodedSource ? { source: decodedSource } : {}),
+        receivedAt: new Date(receivedAtMs).toISOString(),
+    };
+}
+function canonicalIndexRecord(record) {
+    return {
+        id: record.id,
+        receivedAt: record.receivedAt,
+        placement: record.placement,
+        compartmentKind: record.compartmentKind,
+        source: record.source?.toLowerCase() ?? null,
+    };
+}
+function canonicalMailIndexRecordSnapshot(records) {
+    const normalizedRecords = records
+        .map(canonicalIndexRecord)
+        .sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right)));
+    const receivedTimes = records
+        .map((record) => record.receivedAt)
+        .sort((left, right) => Date.parse(left) - Date.parse(right));
+    return {
+        visibleMessageCount: records.length,
+        messageIndexFingerprint: (0, node_crypto_1.createHash)("sha256").update(JSON.stringify(normalizedRecords)).digest("hex"),
+        ...(receivedTimes[0] ? { oldestReceivedAt: receivedTimes[0] } : {}),
+        ...(receivedTimes.at(-1) ? { newestReceivedAt: receivedTimes.at(-1) } : {}),
+    };
+}
+function canonicalMailIndexRecordOrder(left, right) {
+    return JSON.stringify(canonicalIndexRecord(left)).localeCompare(JSON.stringify(canonicalIndexRecord(right)));
+}
+function sourceMatchesFilter(source, filter) {
+    if (!filter)
+        return true;
+    if (!source)
+        return false;
+    return source.toLowerCase() === filter.toLowerCase();
+}
+function messageMatchesFilters(message, filters) {
+    return message.agentId === filters.agentId &&
+        (filters.placement ? message.placement === filters.placement : true) &&
+        (filters.compartmentKind ? message.compartmentKind === filters.compartmentKind : true) &&
+        sourceMatchesFilter(message.source, filters.source);
+}
+class AzureBlobMailroomStore {
+    serviceClient;
+    containerName;
+    mailSearchCache;
+    blobOperationTimeoutMs;
+    messageFetchConcurrency;
+    backfillConcurrency;
+    containerReady = null;
+    constructor(options) {
+        this.serviceClient = options.serviceClient;
+        this.containerName = options.containerName;
+        this.mailSearchCache = options.mailSearchCache ?? null;
+        this.blobOperationTimeoutMs = positiveInteger(options.blobOperationTimeoutMs, DEFAULT_BLOB_OPERATION_TIMEOUT_MS);
+        this.messageFetchConcurrency = positiveInteger(options.messageFetchConcurrency, DEFAULT_MESSAGE_FETCH_CONCURRENCY);
+        this.backfillConcurrency = positiveInteger(options.backfillConcurrency, DEFAULT_MESSAGE_INDEX_BACKFILL_CONCURRENCY);
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_blob_store_init",
+            message: "azure blob mailroom store initialized",
+            meta: { containerName: this.containerName },
+        });
+    }
+    get container() {
+        return this.serviceClient.getContainerClient(this.containerName);
+    }
+    async ensureContainer() {
+        if (!this.containerReady) {
+            this.containerReady = this.container.createIfNotExists().then(() => undefined);
+        }
+        await this.containerReady;
+    }
+    messageBlob(id) {
+        return this.container.getBlockBlobClient(`messages/${id}.json`);
+    }
+    messageIndexBlob(name) {
+        return this.container.getBlockBlobClient(name);
+    }
+    candidateBlob(id) {
+        return this.container.getBlockBlobClient(`candidates/${id}.json`);
+    }
+    rawBlob(objectName) {
+        return this.container.getBlockBlobClient(objectName);
+    }
+    mailSearchCacheOptions() {
+        return this.mailSearchCache ?? {};
+    }
+    decisionsBlob(agentId) {
+        return this.container.getBlockBlobClient(`decisions/${agentId}.json`);
+    }
+    accessLogBlob(agentId) {
+        return this.container.getBlockBlobClient(`access-log/${agentId}.jsonl`);
+    }
+    outboundBlob(id) {
+        return this.container.getBlockBlobClient(`outbound/${id}.json`);
+    }
+    async putMessageIndex(message) {
+        await uploadJson(this.messageIndexBlob(messageIndexBlobName(message)), messageIndexRecord(message), this.blobOperationTimeoutMs);
+    }
+    async removeMessageIndex(message) {
+        await this.messageIndexBlob(messageIndexBlobName(message)).deleteIfExists();
+    }
+    upsertMailSearchCache(message, privateEnvelope) {
+        if (!this.mailSearchCache)
+            return;
+        (0, search_cache_1.upsertMailSearchCacheDocument)(message, privateEnvelope, this.mailSearchCache);
+    }
+    syncMailSearchCache(message) {
+        if (!this.mailSearchCache)
+            return;
+        (0, search_cache_1.syncMailSearchCacheMetadata)(message, this.mailSearchCache);
+    }
+    async listMessagesLegacy(filters) {
+        const messageBlobNames = [];
+        for await (const item of this.container.listBlobsFlat({ prefix: "messages/" })) {
+            messageBlobNames.push(item.name);
+        }
+        const matches = [];
+        let nextIndex = 0;
+        const worker = async () => {
+            while (nextIndex < messageBlobNames.length) {
+                const current = messageBlobNames[nextIndex];
+                nextIndex += 1;
+                const message = await downloadJson(this.container.getBlockBlobClient(current), this.blobOperationTimeoutMs);
+                if (!message || !messageMatchesFilters(message, filters))
+                    continue;
+                matches.push(message);
+                matches.sort(compareNewestFirst);
+                if (typeof filters.limit === "number" && matches.length > filters.limit)
+                    matches.length = filters.limit;
+            }
+        };
+        await Promise.all(Array.from({ length: Math.min(MESSAGE_LIST_SCAN_CONCURRENCY, Math.max(messageBlobNames.length, 1)) }, async () => worker()));
+        return applyOptionalLimit(matches.sort(compareNewestFirst), filters.limit);
+    }
+    async listMessageIndexRecords(filters) {
+        await this.ensureContainer();
+        const records = [];
+        let sawIndex = false;
+        for await (const item of this.container.listBlobsFlat({ prefix: messageIndexPrefix(filters.agentId) })) {
+            sawIndex = true;
+            const parsed = parseMessageIndexBlobName(item.name);
+            if (!parsed || !messageMatchesFilters(parsed, filters))
+                continue;
+            records.push(parsed);
+            if (typeof filters.limit === "number" && records.length >= filters.limit)
+                break;
+        }
+        if (!sawIndex)
+            return null;
+        const sorted = records.sort((left, right) => Date.parse(right.receivedAt) - Date.parse(left.receivedAt));
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_blob_store_message_indexes_listed",
+            message: "azure blob mailroom store listed message indexes",
+            meta: { agentId: filters.agentId, count: sorted.length },
+        });
+        return applyOptionalLimit(sorted, filters.limit);
+    }
+    async observeMessageIndexAuthority(agentId) {
+        const prefix = messageIndexPrefix(agentId);
+        const operationTimeout = timeoutSignal(this.blobOperationTimeoutMs);
+        const records = [];
+        let totalNameCount = 0;
+        let parseFailureCount = 0;
+        try {
+            for await (const item of this.container.listBlobsFlat({ prefix, abortSignal: operationTimeout.signal })) {
+                totalNameCount += 1;
+                let parsed = null;
+                try {
+                    parsed = parseMessageIndexBlobName(item.name);
+                }
+                catch {
+                    parsed = null;
+                }
+                if (!parsed) {
+                    parseFailureCount += 1;
+                    continue;
+                }
+                records.push(parsed);
+            }
+        }
+        catch (error) {
+            const message = (error instanceof Error ? error.message : String(error)).toLowerCase();
+            if ((error instanceof Error && error.name === "AbortError") || message.includes("aborted")) {
+                throw normalizeBlobOperationError("list", { name: prefix }, this.blobOperationTimeoutMs, error);
+            }
+            throw error;
+        }
+        finally {
+            operationTimeout.dispose();
+        }
+        records.sort(canonicalMailIndexRecordOrder);
+        const counts = new Map();
+        for (const record of records)
+            counts.set(record.id, (counts.get(record.id) ?? 0) + 1);
+        const duplicateIds = [...counts.entries()]
+            .filter(([, count]) => count > 1)
+            .map(([id]) => id)
+            .sort((left, right) => left.localeCompare(right));
+        const observation = {
+            totalNameCount,
+            parsedRecordCount: records.length,
+            parseFailureCount,
+            duplicateIds,
+            records,
+            snapshot: canonicalMailIndexRecordSnapshot(records),
+        };
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_blob_store_authority_observed",
+            message: "azure blob mailroom index authority observed",
+            meta: {
+                agentId,
+                totalNameCount,
+                parsedRecordCount: records.length,
+                parseFailureCount,
+                duplicateIdCount: duplicateIds.length,
+            },
+        });
+        return observation;
+    }
+    async listMessagesFromIndexes(filters) {
+        const records = await this.listMessageIndexRecords(filters);
+        if (records === null)
+            return null;
+        const messageIds = records.map((record) => record.id);
+        const messages = (await mapWithConcurrency(messageIds, this.messageFetchConcurrency, async (id) => {
+            return downloadJson(this.messageBlob(id), this.blobOperationTimeoutMs);
+        }))
+            .filter((message) => message !== null)
+            .filter((message) => messageMatchesFilters(message, filters))
+            .sort(compareNewestFirst);
+        return applyOptionalLimit(messages, filters.limit);
+    }
+    async backfillMessageIndexes(agentId, onProgress) {
+        await this.ensureContainer();
+        const messageBlobNames = [];
+        for await (const item of this.container.listBlobsFlat({ prefix: "messages/" })) {
+            messageBlobNames.push(item.name);
+        }
+        let indexed = 0;
+        const failures = [];
+        let scanned = 0;
+        let nextIndex = 0;
+        const worker = async () => {
+            while (nextIndex < messageBlobNames.length) {
+                const current = messageBlobNames[nextIndex];
+                nextIndex += 1;
+                try {
+                    const message = await downloadJson(this.container.getBlockBlobClient(current), this.blobOperationTimeoutMs);
+                    if (!message)
+                        continue;
+                    if (agentId && message.agentId !== agentId)
+                        continue;
+                    await uploadJson(this.messageIndexBlob(messageIndexBlobName(message)), messageIndexRecord(message), this.blobOperationTimeoutMs);
+                    indexed += 1;
+                }
+                catch (error) {
+                    failures.push(error instanceof Error ? error.message : String(error));
+                }
+                finally {
+                    scanned += 1;
+                    onProgress?.({ scanned, indexed, failures: failures.length, total: messageBlobNames.length });
+                }
+            }
+        };
+        await Promise.all(Array.from({ length: Math.min(this.backfillConcurrency, Math.max(messageBlobNames.length, 1)) }, async () => worker()));
+        if (failures.length > 0) {
+            const sample = failures.slice(0, 3).join("; ");
+            throw new Error(`hosted message index backfill incomplete after indexing ${indexed} message(s); ${failures.length} blob operation(s) failed. first failure(s): ${sample}. rerun the command to retry remaining messages.`);
+        }
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_blob_index_backfilled",
+            message: "azure blob mailroom message indexes backfilled",
+            meta: { agentId: agentId ?? null, indexed },
+        });
+        return indexed;
+    }
+    async putRawMessage(input) {
+        await this.ensureContainer();
+        const { message, rawPayload, privateEnvelope, candidate } = await (0, core_1.buildEncryptedStoredMailMessage)(input);
+        const messageBlob = this.messageBlob(message.id);
+        let existing = null;
+        try {
+            existing = await downloadJson(messageBlob, this.blobOperationTimeoutMs);
+        }
+        catch (error) {
+            throw new Error(`committed message ${message.id} could not be read: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+        }
+        if (existing) {
+            const committed = validateCommittedEncryptedMessage(existing, message.id, input.resolved, "committed message");
+            this.upsertMailSearchCache(committed, privateEnvelope);
+            await this.putMessageIndex(committed);
+            (0, runtime_1.emitNervesEvent)({
+                component: "senses",
+                event: "senses.mail_blob_store_dedupe",
+                message: "azure blob mailroom store deduped existing message",
+                meta: { id: message.id, agentId: message.agentId },
+            });
+            return { created: false, message: committed };
+        }
+        await this.rawBlob(message.rawObject).uploadData(blobText(rawPayload));
+        try {
+            await messageBlob.uploadData(blobText(message), { conditions: { ifNoneMatch: "*" } });
+        }
+        catch (error) {
+            if (error?.statusCode !== 412)
+                throw error;
+            let winner;
+            try {
+                winner = await downloadJson(messageBlob, this.blobOperationTimeoutMs);
+            }
+            catch (winnerError) {
+                throw new Error(`committed winner ${message.id} could not be read: ${winnerError instanceof Error ? winnerError.message : String(winnerError)}`, { cause: winnerError });
+            }
+            if (!winner)
+                throw new Error(`committed winner ${message.id} could not be read: message blob is absent`);
+            const committed = validateCommittedEncryptedMessage(winner, message.id, input.resolved, "committed winner");
+            if (committed.rawObject !== message.rawObject) {
+                try {
+                    await this.rawBlob(message.rawObject).deleteIfExists();
+                }
+                catch (cleanupError) {
+                    (0, runtime_1.emitNervesEvent)({
+                        level: "warn",
+                        component: "senses",
+                        event: "senses.mail_blob_store_loser_raw_cleanup_failed",
+                        message: "azure blob mailroom store could not clean up a losing encrypted raw object",
+                        meta: {
+                            id: message.id,
+                            agentId: message.agentId,
+                            rawObject: message.rawObject,
+                            error: cleanupError instanceof Error ? cleanupError.message : String(cleanupError),
+                        },
+                    });
+                }
+            }
+            this.upsertMailSearchCache(committed, privateEnvelope);
+            await this.putMessageIndex(committed);
+            (0, runtime_1.emitNervesEvent)({
+                component: "senses",
+                event: "senses.mail_blob_store_dedupe",
+                message: "azure blob mailroom store deduped existing message",
+                meta: { id: committed.id, agentId: committed.agentId },
+            });
+            return { created: false, message: committed };
+        }
+        await this.putMessageIndex(message);
+        this.upsertMailSearchCache(message, privateEnvelope);
+        if (candidate) {
+            await this.candidateBlob(candidate.id).uploadData(blobText(candidate));
+        }
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_blob_store_message_written",
+            message: "azure blob mailroom store wrote message",
+            meta: { id: message.id, agentId: message.agentId, candidate: candidate !== undefined },
+        });
+        return { created: true, message };
+    }
+    async getMessage(id) {
+        await this.ensureContainer();
+        const message = await downloadJson(this.messageBlob(id), this.blobOperationTimeoutMs);
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_blob_store_message_read",
+            message: "azure blob mailroom store read message",
+            meta: { id, found: message !== null },
+        });
+        return message;
+    }
+    async getIndexedMessageById(id) {
+        const message = await downloadIndexedJson(this.messageBlob(id), this.blobOperationTimeoutMs);
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_blob_store_indexed_message_read",
+            message: "azure blob mailroom store read message from known index",
+            meta: { id, found: message !== null },
+        });
+        return message;
+    }
+    async listMessages(filters) {
+        await this.ensureContainer();
+        let filtered = await this.listMessagesFromIndexes(filters);
+        let source = "index";
+        if (filtered === null) {
+            filtered = await this.listMessagesLegacy(filters);
+            source = "legacy";
+        }
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_blob_store_messages_listed",
+            message: "azure blob mailroom store listed messages",
+            meta: { agentId: filters.agentId, count: filtered.length, source },
+        });
+        return filtered;
+    }
+    async updateMessagePlacement(id, placement) {
+        await this.ensureContainer();
+        const blob = this.messageBlob(id);
+        const message = await downloadJson(blob, this.blobOperationTimeoutMs);
+        if (!message) {
+            (0, runtime_1.emitNervesEvent)({
+                component: "senses",
+                event: "senses.mail_blob_store_message_placement_updated",
+                message: "azure blob mailroom store message placement update missed",
+                meta: { id, placement, found: false },
+            });
+            return null;
+        }
+        const updated = { ...message, placement };
+        await blob.uploadData(blobText(updated));
+        await this.removeMessageIndex(message);
+        await this.putMessageIndex(updated);
+        this.syncMailSearchCache(updated);
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_blob_store_message_placement_updated",
+            message: "azure blob mailroom store updated message placement",
+            meta: { id, placement, found: true },
+        });
+        return updated;
+    }
+    async readRawMime(message, privateKeys) {
+        await this.ensureContainer();
+        /* v8 ignore start -- defensive: AzureBlobMailroomStore only writes encrypted messages, but the interface accepts the union @preserve */
+        if (message.bodyForm !== "encrypted") {
+            throw new Error(`AzureBlobMailroomStore stores encrypted messages, got bodyForm=${message.bodyForm} for ${message.id}`);
+        }
+        /* v8 ignore stop */
+        const payload = await downloadJson(this.rawBlob(message.rawObject), this.blobOperationTimeoutMs);
+        if (!payload) {
+            (0, runtime_1.emitNervesEvent)({
+                component: "senses",
+                event: "senses.mail_blob_store_raw_read",
+                message: "azure blob mailroom store read raw payload",
+                meta: { id: message.id, found: false },
+            });
+            return null;
+        }
+        const privateKey = privateKeys[payload.keyId];
+        /* v8 ignore start -- runtime config refuses to load without private keys; defensive check for partial vault state @preserve */
+        if (!privateKey) {
+            throw new Error(`Missing private mail key ${payload.keyId}`);
+        }
+        /* v8 ignore stop */
+        const plaintext = (0, core_1.decryptMailPayload)(payload, privateKey);
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_blob_store_raw_read",
+            message: "azure blob mailroom store read raw payload",
+            meta: { id: message.id, found: true },
+        });
+        return plaintext;
+    }
+    /** Test helper: read the encrypted raw payload without decrypting. */
+    async readEncryptedRawPayload(message) {
+        await this.ensureContainer();
+        return downloadJson(this.rawBlob(message.rawObject), this.blobOperationTimeoutMs);
+    }
+    async putScreenerCandidate(candidate) {
+        await this.ensureContainer();
+        await this.candidateBlob(candidate.id).uploadData(blobText(candidate));
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_blob_screener_candidate_written",
+            message: "azure blob mail screener candidate written",
+            meta: { id: candidate.id, agentId: candidate.agentId, status: candidate.status },
+        });
+        return candidate;
+    }
+    async updateScreenerCandidate(candidate) {
+        return this.putScreenerCandidate(candidate);
+    }
+    async listScreenerCandidates(filters) {
+        await this.ensureContainer();
+        const candidates = [];
+        for await (const item of this.container.listBlobsFlat({ prefix: "candidates/" })) {
+            const candidate = await downloadJson(this.container.getBlockBlobClient(item.name), this.blobOperationTimeoutMs);
+            if (candidate)
+                candidates.push(candidate);
+        }
+        const filtered = candidates
+            .filter((candidate) => candidate.agentId === filters.agentId)
+            .filter((candidate) => filters.status ? candidate.status === filters.status : true)
+            .filter((candidate) => filters.placement ? candidate.placement === filters.placement : true)
+            .sort(compareCandidatesNewestFirst)
+            .slice(0, filters.limit ?? 50);
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_blob_screener_candidates_listed",
+            message: "azure blob mail screener candidates listed",
+            meta: { agentId: filters.agentId, count: filtered.length },
+        });
+        return filtered;
+    }
+    async recordMailDecision(entry) {
+        await this.ensureContainer();
+        const complete = {
+            schemaVersion: 1,
+            ...entry,
+            id: entry.id ?? `decision_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`,
+            createdAt: entry.createdAt ?? new Date().toISOString(),
+        };
+        const blob = this.decisionsBlob(entry.agentId);
+        const existing = await downloadJson(blob, this.blobOperationTimeoutMs).catch(() => null);
+        const entries = Array.isArray(existing) ? existing : [];
+        entries.push(complete);
+        await blob.uploadData(blobText(entries));
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_blob_decision_recorded",
+            message: "azure blob mail decision recorded",
+            meta: { agentId: entry.agentId, messageId: entry.messageId, action: entry.action },
+        });
+        return complete;
+    }
+    async listMailDecisions(agentId) {
+        await this.ensureContainer();
+        const entries = await downloadJson(this.decisionsBlob(agentId), this.blobOperationTimeoutMs);
+        const safeEntries = Array.isArray(entries) ? entries : [];
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_blob_decisions_listed",
+            message: "azure blob mail decisions listed",
+            meta: { agentId, count: safeEntries.length },
+        });
+        return safeEntries;
+    }
+    async upsertMailOutbound(record) {
+        await this.ensureContainer();
+        await this.outboundBlob(record.id).uploadData(blobText(record));
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_blob_outbound_record_written",
+            message: "azure blob mail outbound record written",
+            meta: { agentId: record.agentId, id: record.id, status: record.status },
+        });
+        return record;
+    }
+    async getMailOutbound(id) {
+        await this.ensureContainer();
+        const record = await downloadJson(this.outboundBlob(id), this.blobOperationTimeoutMs);
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_blob_outbound_record_read",
+            message: "azure blob mail outbound record read",
+            meta: { id, found: record !== null },
+        });
+        return record;
+    }
+    async listMailOutbound(agentId, options = {}) {
+        await this.ensureContainer();
+        // Stream blob NAMES first (no JSON downloads yet), then fan out the
+        // downloads with bounded concurrency. The previous loop awaited each
+        // download sequentially inside the iterator, which made every Mailbox
+        // tab open scale linearly with the total number of outbound records in
+        // the container — for an agent with many drafts/sent/failed entries,
+        // the UI sat on a loading spinner for minutes (or never finished) while
+        // the daemon ground through O(N) sequential network round-trips.
+        const outboundBlobNames = [];
+        for await (const item of this.container.listBlobsFlat({ prefix: "outbound/" })) {
+            outboundBlobNames.push(item.name);
+        }
+        const downloaded = await mapWithConcurrency(outboundBlobNames, MESSAGE_LIST_SCAN_CONCURRENCY, async (name) => {
+            return downloadJson(this.container.getBlockBlobClient(name), this.blobOperationTimeoutMs);
+        });
+        const filtered = downloaded
+            .filter((record) => record !== null)
+            .filter((record) => record.agentId === agentId)
+            .sort((left, right) => right.updatedAt.localeCompare(left.updatedAt));
+        const limited = typeof options.limit === "number" && options.limit > 0
+            ? filtered.slice(0, options.limit)
+            : filtered;
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_blob_outbound_records_listed",
+            message: "azure blob mail outbound records listed",
+            meta: { agentId, count: limited.length, scanned: outboundBlobNames.length },
+        });
+        return limited;
+    }
+    async recordAccess(entry) {
+        await this.ensureContainer();
+        const complete = {
+            ...entry,
+            id: `access_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`,
+            accessedAt: new Date().toISOString(),
+        };
+        const blob = this.accessLogBlob(entry.agentId);
+        const existing = await downloadJson(blob, this.blobOperationTimeoutMs).catch(() => null);
+        const entries = Array.isArray(existing) ? existing : [];
+        entries.push(complete);
+        await blob.uploadData(blobText(entries));
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_blob_access_recorded",
+            message: "azure blob mail access recorded",
+            meta: { agentId: entry.agentId, messageId: entry.messageId ?? null, tool: entry.tool },
+        });
+        return complete;
+    }
+    async listAccessLog(agentId) {
+        await this.ensureContainer();
+        const entries = await downloadJson(this.accessLogBlob(agentId), this.blobOperationTimeoutMs);
+        const safeEntries = (Array.isArray(entries) ? entries : []);
+        (0, runtime_1.emitNervesEvent)({
+            component: "senses",
+            event: "senses.mail_blob_access_log_listed",
+            message: "azure blob mail access log listed",
+            meta: { agentId, count: safeEntries.length },
+        });
+        return safeEntries;
+    }
+}
+exports.AzureBlobMailroomStore = AzureBlobMailroomStore;
+function decryptBlobMessages(messages, privateKeys) {
+    return messages.map((message) => (0, core_1.readDecryptedMailMessage)(message, privateKeys));
+}