@serve.zone/coremail 1.0.0

package/ts/coremail.persistence.ts

@@ -0,0 +1,1156 @@
+import * as plugins from './plugins.js';
+import {
+  normalizeCoreMailConnectionInfo,
+  normalizeCoreMailEnvelope,
+  normalizeCoreMailGatewayMessage,
+  normalizeCoreMailOutboundMessage,
+} from './coremail.validation.js';
+import type {
+  ISubmissionPartRecord,
+  TTransferGrantPurpose,
+} from './interfaces.js';
+
+type TCoreMailSha256 = plugins.serveZoneInterfaces.data.TCoreMailSha256;
+
+export interface ICoreMailStateRecord {
+  stateId: string;
+  appliedConfigEpoch: number;
+  appliedDesiredStateDigest: TCoreMailSha256;
+  snapshotId: string;
+  updatedAt: number;
+}
+
+export interface ICoreMailDesiredSnapshotRecord {
+  snapshotId: string;
+  reconciliationId: string;
+  expectedAppliedConfigEpoch: number;
+  configEpoch: number;
+  desiredStateDigest: TCoreMailSha256;
+  lengthBytes: number;
+  objectKey: string;
+  state: 'staged' | 'active' | 'superseded' | 'failed' | 'retiring';
+  createdAt: number;
+  updatedAt: number;
+  activatedAt?: number;
+  retiringAt?: number;
+  errorCode?: plugins.serveZoneInterfaces.data.TCoreMailErrorCode;
+}
+
+export interface ICoreMailQuotaCounterRecord {
+  counterId: TCoreMailSha256;
+  tenantId: string;
+  serviceId: string;
+  bindingId: string;
+  bindingRevision: number;
+  kind: 'outbound-minute' | 'outbound-day' | 'pending-inbound';
+  windowStartedAt?: number;
+  count: number;
+  createdAt: number;
+  updatedAt: number;
+}
+
+export interface ICoreMailTransferGrantRecord {
+  grantId: string;
+  authorityKind: 'control' | 'gateway' | 'workload';
+  tenantId: string;
+  serviceId: string;
+  bindingId: string;
+  purpose: TTransferGrantPurpose;
+  method: 'PUT' | 'GET';
+  path: string;
+  bearerSha256: TCoreMailSha256;
+  expectedSha256: TCoreMailSha256;
+  lengthBytes: number;
+  contentType: string;
+  objectKey: string;
+  state: 'issued' | 'transferring' | 'consumed' | 'failed' | 'expired';
+  expiresAt: number;
+  createdAt: number;
+  consumedAt?: number;
+}
+
+export interface ICoreMailSubmissionRecord {
+  submissionId: string;
+  tenantId: string;
+  serviceId: string;
+  bindingId: string;
+  bindingRevision: number;
+  revision: number;
+  idempotencyKey: string;
+  submissionDigest: TCoreMailSha256;
+  state: plugins.serveZoneInterfaces.data.TCoreMailSubmissionState;
+  message: plugins.serveZoneInterfaces.data.ICoreMailOutboundMessageDescriptor;
+  parts: ISubmissionPartRecord[];
+  mimeObjectKey?: string;
+  mimeSha256?: TCoreMailSha256;
+  mimeLengthBytes?: number;
+  mimePublishedAt?: number;
+  transportMessageId?: string;
+  transportGrantId?: string;
+  gatewayStatusUpdatedAt?: number;
+  attempts: number;
+  nextAttemptAt?: number;
+  workerRetryAt?: number;
+  retiringAt?: number;
+  leaseOwnerTaskId?: string;
+  leaseToken?: string;
+  leaseExpiresAt?: number;
+  acceptedAt?: number;
+  deliveredAt?: number;
+  terminalAt?: number;
+  error?: plugins.serveZoneInterfaces.data.ICoreMailErrorData;
+  createdAt: number;
+  updatedAt: number;
+}
+
+export interface ICoreMailInboundDeliveryRecord {
+  deliveryId: string;
+  tenantId: string;
+  serviceId: string;
+  bindingId: string;
+  bindingRevision: number;
+  revision: number;
+  transportDeliveryId: string;
+  state: plugins.serveZoneInterfaces.data.TCoreMailInboundDeliveryState;
+  envelope: plugins.serveZoneInterfaces.data.ICoreMailEnvelope;
+  rawMimeSha256: TCoreMailSha256;
+  rawMimeLengthBytes: number;
+  rawMimeObjectKey: string;
+  messageId?: string;
+  subject?: string;
+  receivedAt: number;
+  updatedAt: number;
+  fetchGrantId?: string;
+  acknowledgedOutcome?: plugins.serveZoneInterfaces.data.TCoreMailInboundAckOutcome;
+}
+
+export interface ICoreMailRecipientHandleRecord {
+  routingHandle: string;
+  tenantId: string;
+  serviceId: string;
+  bindingId: string;
+  bindingRevision: number;
+  maxPendingInbound: number;
+  recipient: string;
+  envelopeDigest: TCoreMailSha256;
+  state: 'issued' | 'consumed' | 'expired';
+  handoffId?: string;
+  expiresAt: number;
+  createdAt: number;
+}
+
+export interface ICoreMailInboundHandoffRecord {
+  handoffId: string;
+  revision: number;
+  transportDeliveryId: string;
+  routingHandles: string[];
+  message: plugins.serveZoneInterfaces.data.ICoreMailGatewayMessageDescriptor;
+  source: plugins.serveZoneInterfaces.data.IMailConnectionInfo;
+  state: 'prepared' | 'uploaded' | 'completed' | 'failed' | 'retiring';
+  objectKey: string;
+  grantId?: string;
+  deliveryIds: string[];
+  createdAt: number;
+  updatedAt: number;
+  completedAt?: number;
+  retiringAt?: number;
+}
+
+const identifierRegex =
+  /^[A-Za-z0-9](?:[A-Za-z0-9._:-]{0,126}[A-Za-z0-9])?$/;
+const uuidRegex =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+const objectKeyRegex = /^[A-Za-z0-9][A-Za-z0-9._/-]{0,1023}$/;
+const contentTypeRegex =
+  /^[a-z0-9!#$&^_.+-]+\/[a-z0-9!#$&^_.+-]+(?:; ?[a-z0-9!#$&^_.+-]+=(?:"[^"\r\n]{1,100}"|[a-z0-9!#$&^_.+-]+))*$/i;
+
+const requireRecord = (
+  valueArg: unknown,
+  requiredArg: string[],
+  optionalArg: string[],
+  labelArg: string,
+): Record<string, unknown> => {
+  if (
+    !valueArg
+    || typeof valueArg !== 'object'
+    || Array.isArray(valueArg)
+    || (
+      Object.getPrototypeOf(valueArg) !== Object.prototype
+      && Object.getPrototypeOf(valueArg) !== null
+    )
+  ) {
+    throw new Error(`${labelArg} must be a plain record.`);
+  }
+  const value = valueArg as Record<string, unknown>;
+  const allowed = new Set([...requiredArg, ...optionalArg]);
+  if (
+    requiredArg.some((keyArg) => !Object.hasOwn(value, keyArg))
+    || Object.keys(value).some((keyArg) => !allowed.has(keyArg))
+    || optionalArg.some((keyArg) =>
+      Object.hasOwn(value, keyArg) && value[keyArg] === undefined
+    )
+  ) {
+    throw new Error(`${labelArg} has missing, unknown, or undefined fields.`);
+  }
+  return value;
+};
+
+const requireString = (
+  valueArg: unknown,
+  labelArg: string,
+  maximumArg = 2_048,
+): string => {
+  if (
+    typeof valueArg !== 'string'
+    || valueArg.length === 0
+    || valueArg.length > maximumArg
+    || valueArg.trim() !== valueArg
+  ) {
+    throw new Error(`${labelArg} must be a bounded canonical string.`);
+  }
+  return valueArg;
+};
+
+const requireIdentifier = (valueArg: unknown, labelArg: string): string => {
+  const value = requireString(valueArg, labelArg, 128);
+  if (!identifierRegex.test(value)) {
+    throw new Error(`${labelArg} must be a canonical identifier.`);
+  }
+  return value;
+};
+
+const requireUuid = (valueArg: unknown, labelArg: string): string => {
+  if (typeof valueArg !== 'string' || !uuidRegex.test(valueArg)) {
+    throw new Error(`${labelArg} must be a canonical UUID.`);
+  }
+  return valueArg;
+};
+
+const requireInteger = (
+  valueArg: unknown,
+  labelArg: string,
+  minimumArg = 0,
+): number => {
+  if (!Number.isSafeInteger(valueArg) || Number(valueArg) < minimumArg) {
+    throw new Error(`${labelArg} must be a bounded safe integer.`);
+  }
+  return Number(valueArg);
+};
+
+const requireSha256 = (
+  valueArg: unknown,
+  labelArg: string,
+): TCoreMailSha256 => {
+  try {
+    return plugins.serveZoneInterfaces.data.normalizeCoreMailSha256(valueArg);
+  } catch {
+    throw new Error(`${labelArg} must be a canonical SHA-256 digest.`);
+  }
+};
+
+const requireObjectKey = (valueArg: unknown, labelArg: string): string => {
+  const value = requireString(valueArg, labelArg, 1_024);
+  if (
+    !objectKeyRegex.test(value)
+    || value.includes('//')
+    || value.split('/').some((partArg) => partArg === '..')
+  ) {
+    throw new Error(`${labelArg} must be a canonical object key.`);
+  }
+  return value;
+};
+
+const canonicalJson = (valueArg: unknown): string => {
+  const visit = (value: unknown): unknown => {
+    if (Array.isArray(value)) return value.map(visit);
+    if (
+      value
+      && typeof value === 'object'
+      && (
+        Object.getPrototypeOf(value) === Object.prototype
+        || Object.getPrototypeOf(value) === null
+      )
+    ) {
+      return Object.fromEntries(
+        Object.keys(value as Record<string, unknown>)
+          .sort()
+          .map((keyArg) => [
+            keyArg,
+            visit((value as Record<string, unknown>)[keyArg]),
+          ]),
+      );
+    }
+    return value;
+  };
+  return JSON.stringify(visit(valueArg));
+};
+
+const requireNormalized = (
+  actualArg: unknown,
+  normalizedArg: unknown,
+  labelArg: string,
+): void => {
+  if (canonicalJson(actualArg) !== canonicalJson(normalizedArg)) {
+    throw new Error(`${labelArg} is not a strict normalized value.`);
+  }
+};
+
+const assertPart = (
+  valueArg: unknown,
+  labelArg: string,
+): asserts valueArg is ISubmissionPartRecord => {
+  const value = requireRecord(
+    valueArg,
+    [
+      'partId',
+      'kind',
+      'contentType',
+      'sha256',
+      'lengthBytes',
+      'objectKey',
+      'state',
+    ],
+    ['filename', 'contentId', 'grantId'],
+    labelArg,
+  );
+  requireIdentifier(value.partId, `${labelArg}.partId`);
+  if (
+    value.kind !== 'text'
+    && value.kind !== 'html'
+    && value.kind !== 'attachment'
+  ) {
+    throw new Error(`${labelArg}.kind is invalid.`);
+  }
+  if (
+    typeof value.contentType !== 'string'
+    || !contentTypeRegex.test(value.contentType)
+  ) {
+    throw new Error(`${labelArg}.contentType is invalid.`);
+  }
+  requireSha256(value.sha256, `${labelArg}.sha256`);
+  requireInteger(value.lengthBytes, `${labelArg}.lengthBytes`);
+  requireObjectKey(value.objectKey, `${labelArg}.objectKey`);
+  if (
+    value.state !== 'missing'
+    && value.state !== 'uploading'
+    && value.state !== 'complete'
+    && value.state !== 'failed'
+  ) {
+    throw new Error(`${labelArg}.state is invalid.`);
+  }
+  if (value.filename !== undefined) {
+    requireString(value.filename, `${labelArg}.filename`, 512);
+  }
+  if (value.contentId !== undefined) {
+    requireString(value.contentId, `${labelArg}.contentId`, 256);
+  }
+  if (value.grantId !== undefined) {
+    requireUuid(value.grantId, `${labelArg}.grantId`);
+  }
+  if (
+    (value.state === 'uploading' || value.state === 'complete')
+    && value.grantId === undefined
+  ) {
+    throw new Error(`${labelArg} requires its exact upload grant.`);
+  }
+};
+
+export const assertCoreMailStateRecord = (
+  valueArg: unknown,
+): asserts valueArg is ICoreMailStateRecord => {
+  const value = requireRecord(
+    valueArg,
+    [
+      'stateId',
+      'appliedConfigEpoch',
+      'appliedDesiredStateDigest',
+      'snapshotId',
+      'updatedAt',
+    ],
+    [],
+    'CoreMailState',
+  );
+  if (value.stateId !== 'active') {
+    throw new Error('CoreMailState.stateId is invalid.');
+  }
+  const epoch = requireInteger(
+    value.appliedConfigEpoch,
+    'CoreMailState.appliedConfigEpoch',
+  );
+  requireSha256(
+    value.appliedDesiredStateDigest,
+    'CoreMailState.appliedDesiredStateDigest',
+  );
+  if (epoch === 0) {
+    if (value.snapshotId !== '-') {
+      throw new Error('CoreMailState empty pointer is invalid.');
+    }
+  } else {
+    requireUuid(value.snapshotId, 'CoreMailState.snapshotId');
+  }
+  requireInteger(value.updatedAt, 'CoreMailState.updatedAt');
+};
+
+export const assertCoreMailDesiredSnapshotRecord = (
+  valueArg: unknown,
+): asserts valueArg is ICoreMailDesiredSnapshotRecord => {
+  const value = requireRecord(
+    valueArg,
+    [
+      'snapshotId',
+      'reconciliationId',
+      'expectedAppliedConfigEpoch',
+      'configEpoch',
+      'desiredStateDigest',
+      'lengthBytes',
+      'objectKey',
+      'state',
+      'createdAt',
+      'updatedAt',
+    ],
+    ['activatedAt', 'retiringAt', 'errorCode'],
+    'CoreMailDesiredSnapshot',
+  );
+  requireUuid(value.snapshotId, 'CoreMailDesiredSnapshot.snapshotId');
+  requireUuid(
+    value.reconciliationId,
+    'CoreMailDesiredSnapshot.reconciliationId',
+  );
+  const expectedEpoch = requireInteger(
+    value.expectedAppliedConfigEpoch,
+    'CoreMailDesiredSnapshot.expectedAppliedConfigEpoch',
+  );
+  const epoch = requireInteger(
+    value.configEpoch,
+    'CoreMailDesiredSnapshot.configEpoch',
+    1,
+  );
+  if (epoch <= expectedEpoch) {
+    throw new Error('CoreMailDesiredSnapshot epoch fence is invalid.');
+  }
+  requireSha256(
+    value.desiredStateDigest,
+    'CoreMailDesiredSnapshot.desiredStateDigest',
+  );
+  requireInteger(value.lengthBytes, 'CoreMailDesiredSnapshot.lengthBytes', 2);
+  requireObjectKey(value.objectKey, 'CoreMailDesiredSnapshot.objectKey');
+  if (
+    value.state !== 'staged'
+    && value.state !== 'active'
+    && value.state !== 'superseded'
+    && value.state !== 'failed'
+    && value.state !== 'retiring'
+  ) {
+    throw new Error('CoreMailDesiredSnapshot.state is invalid.');
+  }
+  requireInteger(value.createdAt, 'CoreMailDesiredSnapshot.createdAt');
+  requireInteger(value.updatedAt, 'CoreMailDesiredSnapshot.updatedAt');
+  if (value.activatedAt !== undefined) {
+    requireInteger(value.activatedAt, 'CoreMailDesiredSnapshot.activatedAt');
+  }
+  if (value.retiringAt !== undefined) {
+    requireInteger(value.retiringAt, 'CoreMailDesiredSnapshot.retiringAt');
+  }
+  if ((value.state === 'retiring') !== (value.retiringAt !== undefined)) {
+    throw new Error('CoreMailDesiredSnapshot retirement tuple is invalid.');
+  }
+  if (
+    (value.state === 'active' || value.state === 'superseded')
+    && value.activatedAt === undefined
+  ) {
+    throw new Error('Activated CoreMailDesiredSnapshot has no activation time.');
+  }
+  if (value.errorCode !== undefined) {
+    requireIdentifier(value.errorCode, 'CoreMailDesiredSnapshot.errorCode');
+  }
+};
+
+export const assertCoreMailQuotaCounterRecord = (
+  valueArg: unknown,
+): asserts valueArg is ICoreMailQuotaCounterRecord => {
+  const value = requireRecord(
+    valueArg,
+    [
+      'counterId',
+      'tenantId',
+      'serviceId',
+      'bindingId',
+      'bindingRevision',
+      'kind',
+      'count',
+      'createdAt',
+      'updatedAt',
+    ],
+    ['windowStartedAt'],
+    'CoreMailQuotaCounter',
+  );
+  requireSha256(value.counterId, 'CoreMailQuotaCounter.counterId');
+  requireIdentifier(value.tenantId, 'CoreMailQuotaCounter.tenantId');
+  requireIdentifier(value.serviceId, 'CoreMailQuotaCounter.serviceId');
+  requireIdentifier(value.bindingId, 'CoreMailQuotaCounter.bindingId');
+  requireInteger(
+    value.bindingRevision,
+    'CoreMailQuotaCounter.bindingRevision',
+    1,
+  );
+  if (
+    value.kind !== 'outbound-minute'
+    && value.kind !== 'outbound-day'
+    && value.kind !== 'pending-inbound'
+  ) {
+    throw new Error('CoreMailQuotaCounter.kind is invalid.');
+  }
+  const windowStartedAt = value.windowStartedAt === undefined
+    ? undefined
+    : requireInteger(
+        value.windowStartedAt,
+        'CoreMailQuotaCounter.windowStartedAt',
+      );
+  if ((value.kind === 'pending-inbound') === (windowStartedAt !== undefined)) {
+    throw new Error('CoreMailQuotaCounter window tuple is invalid.');
+  }
+  requireInteger(value.count, 'CoreMailQuotaCounter.count');
+  const createdAt = requireInteger(
+    value.createdAt,
+    'CoreMailQuotaCounter.createdAt',
+  );
+  const updatedAt = requireInteger(
+    value.updatedAt,
+    'CoreMailQuotaCounter.updatedAt',
+  );
+  if (updatedAt < createdAt) {
+    throw new Error('CoreMailQuotaCounter timestamps are invalid.');
+  }
+};
+
+export const assertCoreMailTransferGrantRecord = (
+  valueArg: unknown,
+): asserts valueArg is ICoreMailTransferGrantRecord => {
+  const value = requireRecord(
+    valueArg,
+    [
+      'grantId',
+      'authorityKind',
+      'tenantId',
+      'serviceId',
+      'bindingId',
+      'purpose',
+      'method',
+      'path',
+      'bearerSha256',
+      'expectedSha256',
+      'lengthBytes',
+      'contentType',
+      'objectKey',
+      'state',
+      'expiresAt',
+      'createdAt',
+    ],
+    ['consumedAt'],
+    'CoreMailTransferGrant',
+  );
+  const grantId = requireUuid(value.grantId, 'CoreMailTransferGrant.grantId');
+  if (
+    value.authorityKind !== 'control'
+    && value.authorityKind !== 'gateway'
+    && value.authorityKind !== 'workload'
+  ) {
+    throw new Error('CoreMailTransferGrant.authorityKind is invalid.');
+  }
+  if (value.tenantId !== '-') {
+    requireIdentifier(value.tenantId, 'CoreMailTransferGrant.tenantId');
+  }
+  requireIdentifier(value.serviceId, 'CoreMailTransferGrant.serviceId');
+  if (value.bindingId !== '-') {
+    requireIdentifier(value.bindingId, 'CoreMailTransferGrant.bindingId');
+  }
+  if (
+    value.purpose !== 'desired-state-upload'
+    && value.purpose !== 'outbound-part-upload'
+    && value.purpose !== 'outbound-mime-download'
+    && value.purpose !== 'inbound-mime-upload'
+    && value.purpose !== 'inbound-mime-download'
+  ) {
+    throw new Error('CoreMailTransferGrant.purpose is invalid.');
+  }
+  if (value.method !== 'PUT' && value.method !== 'GET') {
+    throw new Error('CoreMailTransferGrant.method is invalid.');
+  }
+  if (value.path !== `/transfers/${grantId}`) {
+    throw new Error('CoreMailTransferGrant.path is invalid.');
+  }
+  requireSha256(value.bearerSha256, 'CoreMailTransferGrant.bearerSha256');
+  requireSha256(value.expectedSha256, 'CoreMailTransferGrant.expectedSha256');
+  requireInteger(value.lengthBytes, 'CoreMailTransferGrant.lengthBytes');
+  if (
+    typeof value.contentType !== 'string'
+    || !contentTypeRegex.test(value.contentType)
+  ) {
+    throw new Error('CoreMailTransferGrant.contentType is invalid.');
+  }
+  requireObjectKey(value.objectKey, 'CoreMailTransferGrant.objectKey');
+  if (
+    value.state !== 'issued'
+    && value.state !== 'transferring'
+    && value.state !== 'consumed'
+    && value.state !== 'failed'
+    && value.state !== 'expired'
+  ) {
+    throw new Error('CoreMailTransferGrant.state is invalid.');
+  }
+  requireInteger(value.expiresAt, 'CoreMailTransferGrant.expiresAt');
+  requireInteger(value.createdAt, 'CoreMailTransferGrant.createdAt');
+  if (value.consumedAt !== undefined) {
+    requireInteger(value.consumedAt, 'CoreMailTransferGrant.consumedAt');
+  }
+  if (value.state === 'consumed' && value.consumedAt === undefined) {
+    throw new Error('Consumed CoreMailTransferGrant has no completion time.');
+  }
+};
+
+export const assertCoreMailSubmissionRecord = (
+  valueArg: unknown,
+): asserts valueArg is ICoreMailSubmissionRecord => {
+  const value = requireRecord(
+    valueArg,
+    [
+      'submissionId',
+      'tenantId',
+      'serviceId',
+      'bindingId',
+      'bindingRevision',
+      'revision',
+      'idempotencyKey',
+      'submissionDigest',
+      'state',
+      'message',
+      'parts',
+      'attempts',
+      'createdAt',
+      'updatedAt',
+    ],
+    [
+      'mimeObjectKey',
+      'mimeSha256',
+      'mimeLengthBytes',
+      'mimePublishedAt',
+      'transportMessageId',
+      'transportGrantId',
+      'gatewayStatusUpdatedAt',
+      'nextAttemptAt',
+      'workerRetryAt',
+      'retiringAt',
+      'leaseOwnerTaskId',
+      'leaseToken',
+      'leaseExpiresAt',
+      'acceptedAt',
+      'deliveredAt',
+      'terminalAt',
+      'error',
+    ],
+    'CoreMailSubmission',
+  );
+  requireUuid(value.submissionId, 'CoreMailSubmission.submissionId');
+  requireIdentifier(value.tenantId, 'CoreMailSubmission.tenantId');
+  requireIdentifier(value.serviceId, 'CoreMailSubmission.serviceId');
+  requireIdentifier(value.bindingId, 'CoreMailSubmission.bindingId');
+  requireInteger(
+    value.bindingRevision,
+    'CoreMailSubmission.bindingRevision',
+    1,
+  );
+  requireInteger(value.revision, 'CoreMailSubmission.revision');
+  requireIdentifier(value.idempotencyKey, 'CoreMailSubmission.idempotencyKey');
+  requireSha256(value.submissionDigest, 'CoreMailSubmission.submissionDigest');
+  const submissionStates = new Set([
+    'preparing',
+    'uploading',
+    'ready',
+    'accepted',
+    'queued',
+    'delivering',
+    'delivered',
+    'deferred',
+    'failed',
+    'deadLettered',
+  ]);
+  if (!submissionStates.has(String(value.state))) {
+    throw new Error('CoreMailSubmission.state is invalid.');
+  }
+  const messageRecord = requireRecord(
+    value.message,
+    ['sender', 'recipients', 'subject', 'parts'],
+    ['replyTo', 'headers'],
+    'CoreMailSubmission.message',
+  );
+  const sender = requireRecord(
+    messageRecord.sender,
+    ['address'],
+    ['displayName'],
+    'CoreMailSubmission.message.sender',
+  );
+  const normalizedMessage = normalizeCoreMailOutboundMessage(value.message, {
+    schemaVersion: 2,
+    bindingId: String(value.bindingId),
+    serviceId: String(value.serviceId),
+    tenantId: String(value.tenantId),
+    revision: Number(value.bindingRevision),
+    state: 'active',
+    capabilities: ['outbound'],
+    credentials: [],
+    allowedSenders: [String(sender.address)],
+    inboundRecipients: [],
+    limits: {
+      messagesPerMinute: 1,
+      messagesPerDay: 1,
+      maxPendingInbound: 1,
+    },
+  });
+  requireNormalized(
+    value.message,
+    normalizedMessage,
+    'CoreMailSubmission.message',
+  );
+  if (!Array.isArray(value.parts) || value.parts.length === 0) {
+    throw new Error('CoreMailSubmission.parts is invalid.');
+  }
+  value.parts.forEach((partArg, indexArg) =>
+    assertPart(partArg, `CoreMailSubmission.parts[${indexArg}]`)
+  );
+  const parts = value.parts as ISubmissionPartRecord[];
+  if (
+    new Set(parts.map((partArg) => partArg.partId)).size !== parts.length
+    || canonicalJson(parts.map((partArg) => ({
+      partId: partArg.partId,
+      kind: partArg.kind,
+      contentType: partArg.contentType,
+      ...(partArg.filename === undefined ? {} : { filename: partArg.filename }),
+      ...(partArg.contentId === undefined
+        ? {}
+        : { contentId: partArg.contentId }),
+      sha256: partArg.sha256,
+      lengthBytes: partArg.lengthBytes,
+    }))) !== canonicalJson(normalizedMessage.parts)
+  ) {
+    throw new Error('CoreMailSubmission parts do not match message intent.');
+  }
+  requireInteger(value.attempts, 'CoreMailSubmission.attempts');
+  requireInteger(value.createdAt, 'CoreMailSubmission.createdAt');
+  requireInteger(value.updatedAt, 'CoreMailSubmission.updatedAt');
+  if (value.mimeObjectKey !== undefined) {
+    requireObjectKey(value.mimeObjectKey, 'CoreMailSubmission.mimeObjectKey');
+  }
+  if (value.mimeSha256 !== undefined) {
+    requireSha256(value.mimeSha256, 'CoreMailSubmission.mimeSha256');
+  }
+  if (value.mimeLengthBytes !== undefined) {
+    requireInteger(
+      value.mimeLengthBytes,
+      'CoreMailSubmission.mimeLengthBytes',
+      1,
+    );
+  }
+  const mimeFieldCount = [
+    value.mimeObjectKey,
+    value.mimeSha256,
+    value.mimeLengthBytes,
+  ].filter((entryArg) => entryArg !== undefined).length;
+  if (mimeFieldCount !== 0 && mimeFieldCount !== 3) {
+    throw new Error('CoreMailSubmission immutable MIME tuple is incomplete.');
+  }
+  if (value.transportMessageId !== undefined) {
+    requireIdentifier(
+      value.transportMessageId,
+      'CoreMailSubmission.transportMessageId',
+    );
+  }
+  if (value.transportGrantId !== undefined) {
+    requireUuid(value.transportGrantId, 'CoreMailSubmission.transportGrantId');
+  }
+  for (const [key, entry] of [
+    ['gatewayStatusUpdatedAt', value.gatewayStatusUpdatedAt],
+    ['mimePublishedAt', value.mimePublishedAt],
+    ['nextAttemptAt', value.nextAttemptAt],
+    ['workerRetryAt', value.workerRetryAt],
+    ['retiringAt', value.retiringAt],
+    ['leaseExpiresAt', value.leaseExpiresAt],
+    ['acceptedAt', value.acceptedAt],
+    ['deliveredAt', value.deliveredAt],
+    ['terminalAt', value.terminalAt],
+  ] as const) {
+    if (entry !== undefined) requireInteger(entry, `CoreMailSubmission.${key}`);
+  }
+  if (value.leaseOwnerTaskId !== undefined) {
+    requireIdentifier(
+      value.leaseOwnerTaskId,
+      'CoreMailSubmission.leaseOwnerTaskId',
+    );
+  }
+  if (value.leaseToken !== undefined) {
+    requireUuid(value.leaseToken, 'CoreMailSubmission.leaseToken');
+  }
+  const leaseFieldCount = [
+    value.leaseOwnerTaskId,
+    value.leaseToken,
+    value.leaseExpiresAt,
+  ].filter((entryArg) => entryArg !== undefined).length;
+  if (leaseFieldCount !== 0 && leaseFieldCount !== 3) {
+    throw new Error('CoreMailSubmission lease tuple is incomplete.');
+  }
+  const hasTransportIdentity = value.transportMessageId !== undefined;
+  const hasAcceptedAt = value.acceptedAt !== undefined;
+  if (hasTransportIdentity !== hasAcceptedAt) {
+    throw new Error('CoreMailSubmission transport acceptance tuple is incomplete.');
+  }
+  if (
+    ['accepted', 'queued', 'delivering', 'delivered', 'deferred', 'deadLettered']
+      .includes(String(value.state))
+    && (!hasTransportIdentity || mimeFieldCount !== 3)
+  ) {
+    throw new Error('CoreMailSubmission accepted state has no transport or MIME.');
+  }
+  if (
+    ['preparing', 'uploading', 'ready'].includes(String(value.state))
+    && hasTransportIdentity
+  ) {
+    throw new Error('CoreMailSubmission pre-acceptance state has transport identity.');
+  }
+  if (hasTransportIdentity && mimeFieldCount !== 3) {
+    throw new Error('CoreMailSubmission transport identity has no immutable MIME.');
+  }
+  if (value.mimePublishedAt !== undefined && mimeFieldCount !== 3) {
+    throw new Error('CoreMailSubmission published MIME has no ownership tuple.');
+  }
+  if (hasTransportIdentity && value.mimePublishedAt === undefined) {
+    throw new Error('CoreMailSubmission accepted transport has unpublished MIME.');
+  }
+  if (value.state === 'delivered' && value.deliveredAt === undefined) {
+    throw new Error('Delivered CoreMailSubmission has no delivery time.');
+  }
+  let normalizedError: plugins.serveZoneInterfaces.data.ICoreMailErrorData | undefined;
+  if (value.error !== undefined) {
+    normalizedError = plugins.serveZoneInterfaces.data.normalizeCoreMailErrorData(
+      value.error,
+    );
+    requireNormalized(
+      value.error,
+      normalizedError,
+      'CoreMailSubmission.error',
+    );
+  }
+  if (
+    value.state === 'deferred'
+    && (
+      !normalizedError?.retryable
+      || value.nextAttemptAt === undefined
+      || value.terminalAt !== undefined
+      || value.deliveredAt !== undefined
+    )
+  ) {
+    throw new Error('Deferred CoreMailSubmission outcome is incomplete.');
+  }
+  if (
+    (value.state === 'failed' || value.state === 'deadLettered')
+    && (
+      !normalizedError
+      || normalizedError.retryable
+      || value.terminalAt === undefined
+      || value.deliveredAt !== undefined
+    )
+  ) {
+    throw new Error('Failed CoreMailSubmission outcome is incomplete.');
+  }
+  if (
+    value.state === 'delivered'
+    && (
+      value.terminalAt !== value.deliveredAt
+      || value.error !== undefined
+    )
+  ) {
+    throw new Error('Delivered CoreMailSubmission outcome is incomplete.');
+  }
+  if (
+    value.state !== 'deferred'
+    && value.state !== 'failed'
+    && value.state !== 'deadLettered'
+    && value.state !== 'delivered'
+    && (
+      value.nextAttemptAt !== undefined
+      || value.error !== undefined
+      || value.terminalAt !== undefined
+      || value.deliveredAt !== undefined
+    )
+  ) {
+    throw new Error('CoreMailSubmission non-outcome state has outcome fields.');
+  }
+  if (
+    value.workerRetryAt !== undefined
+    && !['ready', 'accepted', 'queued', 'delivering'].includes(String(value.state))
+  ) {
+    throw new Error('CoreMailSubmission worker retry state is invalid.');
+  }
+};
+
+export const assertCoreMailInboundDeliveryRecord = (
+  valueArg: unknown,
+): asserts valueArg is ICoreMailInboundDeliveryRecord => {
+  const value = requireRecord(
+    valueArg,
+    [
+      'deliveryId',
+      'tenantId',
+      'serviceId',
+      'bindingId',
+      'bindingRevision',
+      'revision',
+      'transportDeliveryId',
+      'state',
+      'envelope',
+      'rawMimeSha256',
+      'rawMimeLengthBytes',
+      'rawMimeObjectKey',
+      'receivedAt',
+      'updatedAt',
+    ],
+    ['messageId', 'subject', 'fetchGrantId', 'acknowledgedOutcome'],
+    'CoreMailInboundDelivery',
+  );
+  requireUuid(value.deliveryId, 'CoreMailInboundDelivery.deliveryId');
+  requireIdentifier(value.tenantId, 'CoreMailInboundDelivery.tenantId');
+  requireIdentifier(value.serviceId, 'CoreMailInboundDelivery.serviceId');
+  requireIdentifier(value.bindingId, 'CoreMailInboundDelivery.bindingId');
+  requireInteger(
+    value.bindingRevision,
+    'CoreMailInboundDelivery.bindingRevision',
+    1,
+  );
+  requireInteger(value.revision, 'CoreMailInboundDelivery.revision');
+  requireIdentifier(
+    value.transportDeliveryId,
+    'CoreMailInboundDelivery.transportDeliveryId',
+  );
+  if (
+    value.state !== 'pending'
+    && value.state !== 'fetching'
+    && value.state !== 'fetched'
+    && value.state !== 'acknowledged'
+  ) {
+    throw new Error('CoreMailInboundDelivery.state is invalid.');
+  }
+  requireNormalized(
+    value.envelope,
+    normalizeCoreMailEnvelope(value.envelope),
+    'CoreMailInboundDelivery.envelope',
+  );
+  requireSha256(
+    value.rawMimeSha256,
+    'CoreMailInboundDelivery.rawMimeSha256',
+  );
+  requireInteger(
+    value.rawMimeLengthBytes,
+    'CoreMailInboundDelivery.rawMimeLengthBytes',
+    1,
+  );
+  requireObjectKey(
+    value.rawMimeObjectKey,
+    'CoreMailInboundDelivery.rawMimeObjectKey',
+  );
+  requireInteger(value.receivedAt, 'CoreMailInboundDelivery.receivedAt');
+  requireInteger(value.updatedAt, 'CoreMailInboundDelivery.updatedAt');
+  if (value.messageId !== undefined) {
+    requireString(value.messageId, 'CoreMailInboundDelivery.messageId', 998);
+  }
+  if (value.subject !== undefined) {
+    requireString(value.subject, 'CoreMailInboundDelivery.subject', 768);
+  }
+  if (value.fetchGrantId !== undefined) {
+    requireUuid(value.fetchGrantId, 'CoreMailInboundDelivery.fetchGrantId');
+  }
+  if (
+    (value.state === 'fetching'
+      || value.state === 'fetched'
+      || value.state === 'acknowledged')
+    && value.fetchGrantId === undefined
+  ) {
+    throw new Error('CoreMailInboundDelivery fetch state has no grant.');
+  }
+  if (
+    value.acknowledgedOutcome !== undefined
+    && value.acknowledgedOutcome !== 'processed'
+    && value.acknowledgedOutcome !== 'discarded'
+  ) {
+    throw new Error('CoreMailInboundDelivery acknowledgement is invalid.');
+  }
+  if (
+    (value.state === 'acknowledged')
+    !== (value.acknowledgedOutcome !== undefined)
+  ) {
+    throw new Error('CoreMailInboundDelivery acknowledgement tuple is invalid.');
+  }
+};
+
+export const assertCoreMailRecipientHandleRecord = (
+  valueArg: unknown,
+): asserts valueArg is ICoreMailRecipientHandleRecord => {
+  const value = requireRecord(
+    valueArg,
+    [
+      'routingHandle',
+      'tenantId',
+      'serviceId',
+      'bindingId',
+      'bindingRevision',
+      'maxPendingInbound',
+      'recipient',
+      'envelopeDigest',
+      'state',
+      'expiresAt',
+      'createdAt',
+    ],
+    ['handoffId'],
+    'CoreMailRecipientHandle',
+  );
+  requireSha256(value.routingHandle, 'CoreMailRecipientHandle.routingHandle');
+  requireIdentifier(value.tenantId, 'CoreMailRecipientHandle.tenantId');
+  requireIdentifier(value.serviceId, 'CoreMailRecipientHandle.serviceId');
+  requireIdentifier(value.bindingId, 'CoreMailRecipientHandle.bindingId');
+  requireInteger(
+    value.bindingRevision,
+    'CoreMailRecipientHandle.bindingRevision',
+    1,
+  );
+  requireInteger(
+    value.maxPendingInbound,
+    'CoreMailRecipientHandle.maxPendingInbound',
+    1,
+  );
+  normalizeCoreMailEnvelope({
+    mailFrom: '',
+    rcptTo: [value.recipient],
+  });
+  requireSha256(
+    value.envelopeDigest,
+    'CoreMailRecipientHandle.envelopeDigest',
+  );
+  if (
+    value.state !== 'issued'
+    && value.state !== 'consumed'
+    && value.state !== 'expired'
+  ) {
+    throw new Error('CoreMailRecipientHandle.state is invalid.');
+  }
+  requireInteger(value.expiresAt, 'CoreMailRecipientHandle.expiresAt');
+  requireInteger(value.createdAt, 'CoreMailRecipientHandle.createdAt');
+  if (value.handoffId !== undefined) {
+    requireUuid(value.handoffId, 'CoreMailRecipientHandle.handoffId');
+  }
+  if (
+    (value.state === 'consumed')
+    !== (value.handoffId !== undefined)
+  ) {
+    throw new Error('CoreMailRecipientHandle handoff tuple is invalid.');
+  }
+};
+
+export const assertCoreMailInboundHandoffRecord = (
+  valueArg: unknown,
+): asserts valueArg is ICoreMailInboundHandoffRecord => {
+  const value = requireRecord(
+    valueArg,
+    [
+      'handoffId',
+      'revision',
+      'transportDeliveryId',
+      'routingHandles',
+      'message',
+      'source',
+      'state',
+      'objectKey',
+      'deliveryIds',
+      'createdAt',
+      'updatedAt',
+    ],
+    ['grantId', 'completedAt', 'retiringAt'],
+    'CoreMailInboundHandoff',
+  );
+  requireUuid(value.handoffId, 'CoreMailInboundHandoff.handoffId');
+  requireInteger(value.revision, 'CoreMailInboundHandoff.revision');
+  requireIdentifier(
+    value.transportDeliveryId,
+    'CoreMailInboundHandoff.transportDeliveryId',
+  );
+  if (
+    !Array.isArray(value.routingHandles)
+    || value.routingHandles.length === 0
+    || value.routingHandles.length > 100
+  ) {
+    throw new Error('CoreMailInboundHandoff.routingHandles is invalid.');
+  }
+  value.routingHandles.forEach((handleArg, indexArg) =>
+    requireSha256(
+      handleArg,
+      `CoreMailInboundHandoff.routingHandles[${indexArg}]`,
+    )
+  );
+  if (new Set(value.routingHandles).size !== value.routingHandles.length) {
+    throw new Error('CoreMailInboundHandoff.routingHandles contains duplicates.');
+  }
+  requireNormalized(
+    value.message,
+    normalizeCoreMailGatewayMessage(value.message),
+    'CoreMailInboundHandoff.message',
+  );
+  requireNormalized(
+    value.source,
+    normalizeCoreMailConnectionInfo(value.source),
+    'CoreMailInboundHandoff.source',
+  );
+  if (
+    value.state !== 'prepared'
+    && value.state !== 'uploaded'
+    && value.state !== 'completed'
+    && value.state !== 'failed'
+    && value.state !== 'retiring'
+  ) {
+    throw new Error('CoreMailInboundHandoff.state is invalid.');
+  }
+  requireObjectKey(value.objectKey, 'CoreMailInboundHandoff.objectKey');
+  if (value.grantId !== undefined) {
+    requireUuid(value.grantId, 'CoreMailInboundHandoff.grantId');
+  }
+  if (
+    (value.state === 'uploaded' || value.state === 'completed')
+    && value.grantId === undefined
+  ) {
+    throw new Error('CoreMailInboundHandoff upload state has no grant.');
+  }
+  if (!Array.isArray(value.deliveryIds)) {
+    throw new Error('CoreMailInboundHandoff.deliveryIds is invalid.');
+  }
+  value.deliveryIds.forEach((deliveryIdArg, indexArg) =>
+    requireUuid(
+      deliveryIdArg,
+      `CoreMailInboundHandoff.deliveryIds[${indexArg}]`,
+    )
+  );
+  if (new Set(value.deliveryIds).size !== value.deliveryIds.length) {
+    throw new Error('CoreMailInboundHandoff.deliveryIds contains duplicates.');
+  }
+  requireInteger(value.createdAt, 'CoreMailInboundHandoff.createdAt');
+  requireInteger(value.updatedAt, 'CoreMailInboundHandoff.updatedAt');
+  if (value.completedAt !== undefined) {
+    requireInteger(value.completedAt, 'CoreMailInboundHandoff.completedAt');
+  }
+  if (value.retiringAt !== undefined) {
+    requireInteger(value.retiringAt, 'CoreMailInboundHandoff.retiringAt');
+  }
+  if ((value.state === 'retiring') !== (value.retiringAt !== undefined)) {
+    throw new Error('CoreMailInboundHandoff retirement tuple is invalid.');
+  }
+  if (
+    (value.state === 'completed')
+    !== (value.completedAt !== undefined && value.deliveryIds.length > 0)
+  ) {
+    throw new Error('CoreMailInboundHandoff completion tuple is invalid.');
+  }
+};