@serve.zone/coremail 1.1.0 → 1.3.0

package/dist_ts/coremail.stats.js

@@ -0,0 +1,242 @@
+import * as plugins from './plugins.js';
+import { createSha256 } from './classes.storage.js';
+import { coreMailStatKinds, } from './coremail.persistence.js';
+const dayMs = 86_400_000;
+/** How long a counted day is retained before the maintenance sweep drops it. */
+export const coreMailStatRetentionMs = 90 * dayMs;
+/**
+ * The counter row an event at `nowArg` belongs to.
+ *
+ * Counters are keyed by binding rather than binding revision: a revision bump
+ * is a configuration change, not a new tenant, and a day's totals must survive
+ * one.
+ */
+export const createCoreMailStatDescriptor = (authorityArg, nowArg) => {
+    const dayUtc = Math.floor(nowArg / dayMs) * dayMs;
+    return {
+        tenantId: authorityArg.tenantId,
+        serviceId: authorityArg.serviceId,
+        bindingId: authorityArg.bindingId,
+        dayUtc,
+        statId: createSha256(JSON.stringify({
+            tenantId: authorityArg.tenantId,
+            serviceId: authorityArg.serviceId,
+            bindingId: authorityArg.bindingId,
+            dayUtc,
+        })),
+    };
+};
+const matchesDescriptor = (counterArg, descriptorArg) => counterArg.tenantId === descriptorArg.tenantId
+    && counterArg.serviceId === descriptorArg.serviceId
+    && counterArg.bindingId === descriptorArg.bindingId
+    && counterArg.dayUtc === descriptorArg.dayUtc;
+/** Create the day's row if it does not exist yet. Safe to call concurrently. */
+export const ensureCoreMailStatCounter = async (modelsArg, descriptorArg) => {
+    const existing = await modelsArg.StatCounter.exact.findStoredOne({
+        statId: descriptorArg.statId,
+    });
+    if (existing) {
+        if (!matchesDescriptor(existing, descriptorArg)) {
+            throw new Error('CoreMail stat counter identity conflicts with persisted state.');
+        }
+        return;
+    }
+    try {
+        const result = await modelsArg.StatCounter.exact.insert({
+            ...descriptorArg,
+            ...Object.fromEntries(coreMailStatKinds.map((kindArg) => [kindArg, 0])),
+            createdAt: descriptorArg.dayUtc,
+            updatedAt: descriptorArg.dayUtc,
+        });
+        if (result.status !== 'conflict') {
+            return;
+        }
+    }
+    catch (error) {
+        if (!(error instanceof plugins.smartdata.SmartdataExactPersistenceError)
+            || error.code !== 'unique_conflict') {
+            throw error;
+        }
+    }
+    const concurrent = await modelsArg.StatCounter.exact.findStoredOne({
+        statId: descriptorArg.statId,
+    });
+    if (!concurrent || !matchesDescriptor(concurrent, descriptorArg)) {
+        throw new Error('CoreMail stat counter identity conflicts with persisted state.');
+    }
+};
+/**
+ * Add one to a counter through the revision-fenced transition primitive, so
+ * the read and the write are one atomic compare-and-set. Call this inside the
+ * transaction that carries the counted state transition; then the event and
+ * its count commit together or not at all.
+ */
+export const incrementCoreMailStatCounter = async (modelsArg, descriptorArg, kindArg, updatedAtArg, sessionArg) => {
+    const counter = await modelsArg.StatCounter.exact.findStoredOne({ statId: descriptorArg.statId }, sessionArg ? { session: sessionArg } : undefined);
+    if (!counter) {
+        throw new Error('CoreMail stat counter is unavailable.');
+    }
+    if (!matchesDescriptor(counter, descriptorArg)) {
+        throw new Error('CoreMail stat counter identity conflicts with persisted state.');
+    }
+    const update = await modelsArg.StatCounter.exact.transition({
+        current: counter,
+        change: (modelArg) => {
+            modelArg[kindArg] += 1;
+            modelArg.updatedAt = updatedAtArg;
+        },
+    }, sessionArg ? { session: sessionArg } : undefined);
+    if (update.status !== 'transitioned') {
+        throw new Error('CoreMail stat counter transition was contended.');
+    }
+};
+/**
+ * Ensure the day's row exists, then count one event on it.
+ *
+ * For a counted transition that runs inside a transaction, call
+ * `ensureCoreMailStatCounter` before opening it and
+ * `incrementCoreMailStatCounter` with the session inside it — the same order
+ * the quota counters use, so the row insert never contends with the
+ * transaction that increments it.
+ */
+export const countCoreMailStat = async (modelsArg, authorityArg, kindArg, nowArg, sessionArg) => {
+    const descriptor = createCoreMailStatDescriptor(authorityArg, nowArg);
+    await ensureCoreMailStatCounter(modelsArg, descriptor);
+    await incrementCoreMailStatCounter(modelsArg, descriptor, kindArg, nowArg, sessionArg);
+    return descriptor;
+};
+/** Maximum rows one statistics page may return. */
+export const coreMailStatPageMaximum = 200;
+const dayPattern = /^[0-9]{4}-[0-9]{2}-[0-9]{2}$/;
+/** `YYYY-MM-DD` to the UTC midnight milliseconds the counter rows are keyed by. */
+export const parseCoreMailStatDay = (valueArg, labelArg) => {
+    if (typeof valueArg !== 'string' || !dayPattern.test(valueArg)) {
+        throw new Error(`CoreMail statistics ${labelArg} must be a YYYY-MM-DD day.`);
+    }
+    const parsed = Date.parse(`${valueArg}T00:00:00.000Z`);
+    if (!Number.isSafeInteger(parsed) || parsed % dayMs !== 0) {
+        throw new Error(`CoreMail statistics ${labelArg} must be a real UTC day.`);
+    }
+    return parsed;
+};
+export const formatCoreMailStatDay = (dayUtcArg) => new Date(dayUtcArg).toISOString().slice(0, 10);
+/**
+ * Opaque composite cursor over `(dayUtc, statId)`.
+ *
+ * It carries no authority: the control session is what authorizes the read,
+ * and every filter is re-applied on the next page, so a replayed cursor can
+ * only ever resume the same ordered scan.
+ */
+export const encodeCoreMailStatCursor = (positionArg) => Buffer.from(JSON.stringify({ v: 1, d: positionArg.dayUtc, s: positionArg.statId }), 'utf8').toString('base64url');
+export const decodeCoreMailStatCursor = (valueArg) => {
+    if (typeof valueArg !== 'string'
+        || valueArg.length === 0
+        || valueArg.length
+            > plugins.serveZoneInterfaces.data.coreMailLimits.cursorBytes) {
+        throw new Error('CoreMail statistics cursor is invalid.');
+    }
+    let decoded;
+    try {
+        decoded = JSON.parse(Buffer.from(valueArg, 'base64url').toString('utf8'));
+    }
+    catch {
+        throw new Error('CoreMail statistics cursor is invalid.');
+    }
+    const record = decoded;
+    if (!record
+        || typeof record !== 'object'
+        || record.v !== 1
+        || !Number.isSafeInteger(record.d)
+        || Number(record.d) % dayMs !== 0
+        || typeof record.s !== 'string') {
+        throw new Error('CoreMail statistics cursor is invalid.');
+    }
+    try {
+        return {
+            dayUtc: Number(record.d),
+            statId: plugins.serveZoneInterfaces.data.normalizeCoreMailSha256(record.s),
+        };
+    }
+    catch {
+        throw new Error('CoreMail statistics cursor is invalid.');
+    }
+};
+/** Project one counter row onto the wire contract. */
+export const toCoreMailServiceMailStatistics = (counterArg) => plugins.serveZoneInterfaces.data.normalizeCoreMailServiceMailStatistics({
+    tenantId: counterArg.tenantId,
+    serviceId: counterArg.serviceId,
+    bindingId: counterArg.bindingId,
+    dayUtc: formatCoreMailStatDay(counterArg.dayUtc),
+    outbound: {
+        submittedApi: counterArg.submittedApi,
+        submittedSmtp: counterArg.submittedSmtp,
+        delivered: counterArg.delivered,
+        deferred: counterArg.deferred,
+        failed: counterArg.failed,
+        deadLettered: counterArg.deadLettered,
+    },
+    inbound: {
+        received: counterArg.received,
+        acknowledgedProcessed: counterArg.acknowledgedProcessed,
+        acknowledgedDiscarded: counterArg.acknowledgedDiscarded,
+    },
+    updatedAt: counterArg.updatedAt,
+});
+/** One ordered, bounded page of per-service daily counters. */
+export const listCoreMailServiceMailStatistics = async (modelsArg, requestArg) => {
+    const fromDayUtc = parseCoreMailStatDay(requestArg.fromDayUtc, 'fromDayUtc');
+    const toDayUtc = parseCoreMailStatDay(requestArg.toDayUtc, 'toDayUtc');
+    if (toDayUtc < fromDayUtc) {
+        throw new Error('CoreMail statistics range is inverted.');
+    }
+    if (!Number.isSafeInteger(requestArg.limit)
+        || requestArg.limit < 1
+        || requestArg.limit > coreMailStatPageMaximum) {
+        throw new Error(`CoreMail statistics limit must be between 1 and ${coreMailStatPageMaximum}.`);
+    }
+    let serviceIds;
+    if (requestArg.serviceIds !== undefined) {
+        if (!Array.isArray(requestArg.serviceIds)
+            || requestArg.serviceIds.length === 0
+            || requestArg.serviceIds.length > 1_000
+            || requestArg.serviceIds.some((entryArg) => typeof entryArg !== 'string')) {
+            throw new Error('CoreMail statistics serviceIds filter is invalid.');
+        }
+        serviceIds = [...new Set(requestArg.serviceIds)];
+    }
+    const cursor = requestArg.cursor === undefined
+        ? undefined
+        : decodeCoreMailStatCursor(requestArg.cursor);
+    const rows = await modelsArg.StatCounter.exact.findStored({
+        filter: {
+            $and: [
+                { dayUtc: { $gte: fromDayUtc, $lte: toDayUtc } },
+                ...(serviceIds ? [{ serviceId: { $in: serviceIds } }] : []),
+                ...(cursor
+                    ? [{
+                            $or: [
+                                { dayUtc: { $gt: cursor.dayUtc } },
+                                { dayUtc: cursor.dayUtc, statId: { $gt: cursor.statId } },
+                            ],
+                        }]
+                    : []),
+            ],
+        },
+        sort: { dayUtc: 1, statId: 1 },
+        limit: requestArg.limit + 1,
+    });
+    const page = rows.slice(0, requestArg.limit);
+    const last = page.at(-1);
+    return {
+        statistics: page.map(toCoreMailServiceMailStatistics),
+        ...(rows.length > page.length && last
+            ? {
+                nextCursor: encodeCoreMailStatCursor({
+                    dayUtc: last.dayUtc,
+                    statId: last.statId,
+                }),
+            }
+            : {}),
+    };
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29yZW1haWwuc3RhdHMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9jb3JlbWFpbC5zdGF0cy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQUV4QyxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sc0JBQXNCLENBQUM7QUFDcEQsT0FBTyxFQUNMLGlCQUFpQixHQUdsQixNQUFNLDJCQUEyQixDQUFDO0FBRW5DLE1BQU0sS0FBSyxHQUFHLFVBQVUsQ0FBQztBQUV6QixnRkFBZ0Y7QUFDaEYsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUcsRUFBRSxHQUFHLEtBQUssQ0FBQztBQWFsRDs7Ozs7O0dBTUc7QUFDSCxNQUFNLENBQUMsTUFBTSw0QkFBNEIsR0FBRyxDQUMxQyxZQUFvQyxFQUNwQyxNQUFjLEVBQ1csRUFBRTtJQUMzQixNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sR0FBRyxLQUFLLENBQUMsR0FBRyxLQUFLLENBQUM7SUFDbEQsT0FBTztRQUNMLFFBQVEsRUFBRSxZQUFZLENBQUMsUUFBUTtRQUMvQixTQUFTLEVBQUUsWUFBWSxDQUFDLFNBQVM7UUFDakMsU0FBUyxFQUFFLFlBQVksQ0FBQyxTQUFTO1FBQ2pDLE1BQU07UUFDTixNQUFNLEVBQUUsWUFBWSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUM7WUFDbEMsUUFBUSxFQUFFLFlBQVksQ0FBQyxRQUFRO1lBQy9CLFNBQVMsRUFBRSxZQUFZLENBQUMsU0FBUztZQUNqQyxTQUFTLEVBQUUsWUFBWSxDQUFDLFNBQVM7WUFDakMsTUFBTTtTQUNQLENBQUMsQ0FBQztLQUNKLENBQUM7QUFDSixDQUFDLENBQUM7QUFFRixNQUFNLGlCQUFpQixHQUFHLENBQ3hCLFVBQXlFLEVBQ3pFLGFBQXNDLEVBQzdCLEVBQUUsQ0FDWCxVQUFVLENBQUMsUUFBUSxLQUFLLGFBQWEsQ0FBQyxRQUFRO09BQzNDLFVBQVUsQ0FBQyxTQUFTLEtBQUssYUFBYSxDQUFDLFNBQVM7T0FDaEQsVUFBVSxDQUFDLFNBQVMsS0FBSyxhQUFhLENBQUMsU0FBUztPQUNoRCxVQUFVLENBQUMsTUFBTSxLQUFLLGFBQWEsQ0FBQyxNQUFNLENBQUM7QUFFaEQsZ0ZBQWdGO0FBQ2hGLE1BQU0sQ0FBQyxNQUFNLHlCQUF5QixHQUFHLEtBQUssRUFDNUMsU0FBMEIsRUFDMUIsYUFBc0MsRUFDdkIsRUFBRTtJQUNqQixNQUFNLFFBQVEsR0FBRyxNQUFNLFNBQVMsQ0FBQyxXQUFXLENBQUMsS0FBSyxDQUFDLGFBQWEsQ0FBQztRQUMvRCxNQUFNLEVBQUUsYUFBYSxDQUFDLE1BQU07S0FDN0IsQ0FBQyxDQUFDO0lBQ0gsSUFBSSxRQUFRLEVBQUUsQ0FBQztRQUNiLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxRQUFRLEVBQUUsYUFBYSxDQUFDLEVBQUUsQ0FBQztZQUNoRCxNQUFNLElBQUksS0FBSyxDQUFDLGdFQUFnRSxDQUFDLENBQUM7UUFDcEYsQ0FBQztRQUNELE9BQU87SUFDVCxDQUFDO0lBQ0QsSUFBSSxDQUFDO1FBQ0gsTUFBTSxNQUFNLEdBQUcsTUFBTSxTQUFTLENBQUMsV0FBVyxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUM7WUFDdEQsR0FBRyxhQUFhO1lBQ2hCLEdBQUcsTUFBTSxDQUFDLFdBQVcsQ0FBQyxpQkFBaUIsQ0FBQyxHQUFHLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQ25DO1lBQ25DLFNBQVMsRUFBRSxhQUFhLENBQUMsTUFBTTtZQUMvQixTQUFTLEVBQUUsYUFBYSxDQUFDLE1BQU07U0FDaEMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxNQUFNLENBQUMsTUFBTSxLQUFLLFVBQVUsRUFBRSxDQUFDO1lBQ2pDLE9BQU87UUFDVCxDQUFDO0lBQ0gsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixJQUNFLENBQUMsQ0FBQyxLQUFLLFlBQVksT0FBTyxDQUFDLFNBQVMsQ0FBQyw4QkFBOEIsQ0FBQztlQUNqRSxLQUFLLENBQUMsSUFBSSxLQUFLLGlCQUFpQixFQUNuQyxDQUFDO1lBQ0QsTUFBTSxLQUFLLENBQUM7UUFDZCxDQUFDO0lBQ0gsQ0FBQztJQUNELE1BQU0sVUFBVSxHQUFHLE1BQU0sU0FBUyxDQUFDLFdBQVcsQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUFDO1FBQ2pFLE1BQU0sRUFBRSxhQUFhLENBQUMsTUFBTTtLQUM3QixDQUFDLENBQUM7SUFDSCxJQUFJLENBQUMsVUFBVSxJQUFJLENBQUMsaUJBQWlCLENBQUMsVUFBVSxFQUFFLGFBQWEsQ0FBQyxFQUFFLENBQUM7UUFDakUsTUFBTSxJQUFJLEtBQUssQ0FBQyxnRUFBZ0UsQ0FBQyxDQUFDO0lBQ3BGLENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRjs7Ozs7R0FLRztBQUNILE1BQU0sQ0FBQyxNQUFNLDRCQUE0QixHQUFHLEtBQUssRUFDL0MsU0FBMEIsRUFDMUIsYUFBc0MsRUFDdEMsT0FBMEIsRUFDMUIsWUFBb0IsRUFDcEIsVUFBK0MsRUFDaEMsRUFBRTtJQUNqQixNQUFNLE9BQU8sR0FBRyxNQUFNLFNBQVMsQ0FBQyxXQUFXLENBQUMsS0FBSyxDQUFDLGFBQWEsQ0FDN0QsRUFBRSxNQUFNLEVBQUUsYUFBYSxDQUFDLE1BQU0sRUFBRSxFQUNoQyxVQUFVLENBQUMsQ0FBQyxDQUFDLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQ2pELENBQUM7SUFDRixJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDYixNQUFNLElBQUksS0FBSyxDQUFDLHVDQUF1QyxDQUFDLENBQUM7SUFDM0QsQ0FBQztJQUNELElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxPQUFPLEVBQUUsYUFBYSxDQUFDLEVBQUUsQ0FBQztRQUMvQyxNQUFNLElBQUksS0FBSyxDQUFDLGdFQUFnRSxDQUFDLENBQUM7SUFDcEYsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLE1BQU0sU0FBUyxDQUFDLFdBQVcsQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDO1FBQzFELE9BQU8sRUFBRSxPQUFPO1FBQ2hCLE1BQU0sRUFBRSxDQUFDLFFBQVEsRUFBRSxFQUFFO1lBQ25CLFFBQVEsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7WUFDdkIsUUFBUSxDQUFDLFNBQVMsR0FBRyxZQUFZLENBQUM7UUFDcEMsQ0FBQztLQUNGLEVBQUUsVUFBVSxDQUFDLENBQUMsQ0FBQyxFQUFFLE9BQU8sRUFBRSxVQUFVLEVBQUUsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDckQsSUFBSSxNQUFNLENBQUMsTUFBTSxLQUFLLGNBQWMsRUFBRSxDQUFDO1FBQ3JDLE1BQU0sSUFBSSxLQUFLLENBQUMsaURBQWlELENBQUMsQ0FBQztJQUNyRSxDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUY7Ozs7Ozs7O0dBUUc7QUFDSCxNQUFNLENBQUMsTUFBTSxpQkFBaUIsR0FBRyxLQUFLLEVBQ3BDLFNBQTBCLEVBQzFCLFlBQW9DLEVBQ3BDLE9BQTBCLEVBQzFCLE1BQWMsRUFDZCxVQUErQyxFQUNiLEVBQUU7SUFDcEMsTUFBTSxVQUFVLEdBQUcsNEJBQTRCLENBQUMsWUFBWSxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ3RFLE1BQU0seUJBQXlCLENBQUMsU0FBUyxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQ3ZELE1BQU0sNEJBQTRCLENBQ2hDLFNBQVMsRUFDVCxVQUFVLEVBQ1YsT0FBTyxFQUNQLE1BQU0sRUFDTixVQUFVLENBQ1gsQ0FBQztJQUNGLE9BQU8sVUFBVSxDQUFDO0FBQ3BCLENBQUMsQ0FBQztBQUVGLG1EQUFtRDtBQUNuRCxNQUFNLENBQUMsTUFBTSx1QkFBdUIsR0FBRyxHQUFHLENBQUM7QUFFM0MsTUFBTSxVQUFVLEdBQUcsOEJBQThCLENBQUM7QUFFbEQsbUZBQW1GO0FBQ25GLE1BQU0sQ0FBQyxNQUFNLG9CQUFvQixHQUFHLENBQUMsUUFBaUIsRUFBRSxRQUFnQixFQUFVLEVBQUU7SUFDbEYsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDL0QsTUFBTSxJQUFJLEtBQUssQ0FBQyx1QkFBdUIsUUFBUSw0QkFBNEIsQ0FBQyxDQUFDO0lBQy9FLENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsUUFBUSxnQkFBZ0IsQ0FBQyxDQUFDO0lBQ3ZELElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLE1BQU0sQ0FBQyxJQUFJLE1BQU0sR0FBRyxLQUFLLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDMUQsTUFBTSxJQUFJLEtBQUssQ0FBQyx1QkFBdUIsUUFBUSwwQkFBMEIsQ0FBQyxDQUFDO0lBQzdFLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxxQkFBcUIsR0FBRyxDQUFDLFNBQWlCLEVBQVUsRUFBRSxDQUNqRSxJQUFJLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxXQUFXLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDO0FBT2pEOzs7Ozs7R0FNRztBQUNILE1BQU0sQ0FBQyxNQUFNLHdCQUF3QixHQUFHLENBQ3RDLFdBQXdDLEVBQ2hDLEVBQUUsQ0FDVixNQUFNLENBQUMsSUFBSSxDQUNULElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUMsRUFBRSxXQUFXLENBQUMsTUFBTSxFQUFFLENBQUMsRUFBRSxXQUFXLENBQUMsTUFBTSxFQUFFLENBQUMsRUFDdEUsTUFBTSxDQUNQLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxDQUFDO0FBRTFCLE1BQU0sQ0FBQyxNQUFNLHdCQUF3QixHQUFHLENBQ3RDLFFBQWlCLEVBQ1ksRUFBRTtJQUMvQixJQUNFLE9BQU8sUUFBUSxLQUFLLFFBQVE7V0FDekIsUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDO1dBQ3JCLFFBQVEsQ0FBQyxNQUFNO2NBQ2QsT0FBTyxDQUFDLG1CQUFtQixDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMsV0FBVyxFQUMvRCxDQUFDO1FBQ0QsTUFBTSxJQUFJLEtBQUssQ0FBQyx3Q0FBd0MsQ0FBQyxDQUFDO0lBQzVELENBQUM7SUFDRCxJQUFJLE9BQWdCLENBQUM7SUFDckIsSUFBSSxDQUFDO1FBQ0gsT0FBTyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsV0FBVyxDQUFDLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDNUUsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE1BQU0sSUFBSSxLQUFLLENBQUMsd0NBQXdDLENBQUMsQ0FBQztJQUM1RCxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsT0FBb0QsQ0FBQztJQUNwRSxJQUNFLENBQUMsTUFBTTtXQUNKLE9BQU8sTUFBTSxLQUFLLFFBQVE7V0FDMUIsTUFBTSxDQUFDLENBQUMsS0FBSyxDQUFDO1dBQ2QsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7V0FDL0IsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsR0FBRyxLQUFLLEtBQUssQ0FBQztXQUM5QixPQUFPLE1BQU0sQ0FBQyxDQUFDLEtBQUssUUFBUSxFQUMvQixDQUFDO1FBQ0QsTUFBTSxJQUFJLEtBQUssQ0FBQyx3Q0FBd0MsQ0FBQyxDQUFDO0lBQzVELENBQUM7SUFDRCxJQUFJLENBQUM7UUFDSCxPQUFPO1lBQ0wsTUFBTSxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO1lBQ3hCLE1BQU0sRUFBRSxPQUFPLENBQUMsbUJBQW1CLENBQUMsSUFBSSxDQUFDLHVCQUF1QixDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7U0FDM0UsQ0FBQztJQUNKLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxNQUFNLElBQUksS0FBSyxDQUFDLHdDQUF3QyxDQUFDLENBQUM7SUFDNUQsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGLHNEQUFzRDtBQUN0RCxNQUFNLENBQUMsTUFBTSwrQkFBK0IsR0FBRyxDQUM3QyxVQUFzQyxFQUMyQixFQUFFLENBQ25FLE9BQU8sQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsc0NBQXNDLENBQUM7SUFDdEUsUUFBUSxFQUFFLFVBQVUsQ0FBQyxRQUFRO0lBQzdCLFNBQVMsRUFBRSxVQUFVLENBQUMsU0FBUztJQUMvQixTQUFTLEVBQUUsVUFBVSxDQUFDLFNBQVM7SUFDL0IsTUFBTSxFQUFFLHFCQUFxQixDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUM7SUFDaEQsUUFBUSxFQUFFO1FBQ1IsWUFBWSxFQUFFLFVBQVUsQ0FBQyxZQUFZO1FBQ3JDLGFBQWEsRUFBRSxVQUFVLENBQUMsYUFBYTtRQUN2QyxTQUFTLEVBQUUsVUFBVSxDQUFDLFNBQVM7UUFDL0IsUUFBUSxFQUFFLFVBQVUsQ0FBQyxRQUFRO1FBQzdCLE1BQU0sRUFBRSxVQUFVLENBQUMsTUFBTTtRQUN6QixZQUFZLEVBQUUsVUFBVSxDQUFDLFlBQVk7S0FDdEM7SUFDRCxPQUFPLEVBQUU7UUFDUCxRQUFRLEVBQUUsVUFBVSxDQUFDLFFBQVE7UUFDN0IscUJBQXFCLEVBQUUsVUFBVSxDQUFDLHFCQUFxQjtRQUN2RCxxQkFBcUIsRUFBRSxVQUFVLENBQUMscUJBQXFCO0tBQ3hEO0lBQ0QsU0FBUyxFQUFFLFVBQVUsQ0FBQyxTQUFTO0NBQ2hDLENBQUMsQ0FBQztBQUVMLCtEQUErRDtBQUMvRCxNQUFNLENBQUMsTUFBTSxpQ0FBaUMsR0FBRyxLQUFLLEVBQ3BELFNBQTBCLEVBQzFCLFVBTUMsRUFJQSxFQUFFO0lBQ0gsTUFBTSxVQUFVLEdBQUcsb0JBQW9CLENBQUMsVUFBVSxDQUFDLFVBQVUsRUFBRSxZQUFZLENBQUMsQ0FBQztJQUM3RSxNQUFNLFFBQVEsR0FBRyxvQkFBb0IsQ0FBQyxVQUFVLENBQUMsUUFBUSxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQ3ZFLElBQUksUUFBUSxHQUFHLFVBQVUsRUFBRSxDQUFDO1FBQzFCLE1BQU0sSUFBSSxLQUFLLENBQUMsd0NBQXdDLENBQUMsQ0FBQztJQUM1RCxDQUFDO0lBQ0QsSUFDRSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQztXQUNwQyxVQUFVLENBQUMsS0FBSyxHQUFHLENBQUM7V0FDcEIsVUFBVSxDQUFDLEtBQUssR0FBRyx1QkFBdUIsRUFDN0MsQ0FBQztRQUNELE1BQU0sSUFBSSxLQUFLLENBQ2IsbURBQW1ELHVCQUF1QixHQUFHLENBQzlFLENBQUM7SUFDSixDQUFDO0lBQ0QsSUFBSSxVQUFnQyxDQUFDO0lBQ3JDLElBQUksVUFBVSxDQUFDLFVBQVUsS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUN4QyxJQUNFLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDO2VBQ2xDLFVBQVUsQ0FBQyxVQUFVLENBQUMsTUFBTSxLQUFLLENBQUM7ZUFDbEMsVUFBVSxDQUFDLFVBQVUsQ0FBQyxNQUFNLEdBQUcsS0FBSztlQUNwQyxVQUFVLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsT0FBTyxRQUFRLEtBQUssUUFBUSxDQUFDLEVBQ3pFLENBQUM7WUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLG1EQUFtRCxDQUFDLENBQUM7UUFDdkUsQ0FBQztRQUNELFVBQVUsR0FBRyxDQUFDLEdBQUcsSUFBSSxHQUFHLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUM7SUFDbkQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLFVBQVUsQ0FBQyxNQUFNLEtBQUssU0FBUztRQUM1QyxDQUFDLENBQUMsU0FBUztRQUNYLENBQUMsQ0FBQyx3QkFBd0IsQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDaEQsTUFBTSxJQUFJLEdBQUcsTUFBTSxTQUFTLENBQUMsV0FBVyxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUM7UUFDeEQsTUFBTSxFQUFFO1lBQ04sSUFBSSxFQUFFO2dCQUNKLEVBQUUsTUFBTSxFQUFFLEVBQUUsSUFBSSxFQUFFLFVBQVUsRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFLEVBQUU7Z0JBQ2hELEdBQUcsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxTQUFTLEVBQUUsRUFBRSxHQUFHLEVBQUUsVUFBVSxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7Z0JBQzNELEdBQUcsQ0FBQyxNQUFNO29CQUNSLENBQUMsQ0FBQyxDQUFDOzRCQUNDLEdBQUcsRUFBRTtnQ0FDSCxFQUFFLE1BQU0sRUFBRSxFQUFFLEdBQUcsRUFBRSxNQUFNLENBQUMsTUFBTSxFQUFFLEVBQUU7Z0NBQ2xDLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxNQUFNLEVBQUUsTUFBTSxFQUFFLEVBQUUsR0FBRyxFQUFFLE1BQU0sQ0FBQyxNQUFNLEVBQUUsRUFBRTs2QkFDMUQ7eUJBQ0YsQ0FBQztvQkFDSixDQUFDLENBQUMsRUFBRSxDQUFDO2FBQ1I7U0FDRjtRQUNELElBQUksRUFBRSxFQUFFLE1BQU0sRUFBRSxDQUFDLEVBQUUsTUFBTSxFQUFFLENBQUMsRUFBRTtRQUM5QixLQUFLLEVBQUUsVUFBVSxDQUFDLEtBQUssR0FBRyxDQUFDO0tBQzVCLENBQUMsQ0FBQztJQUNILE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLFVBQVUsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUM3QyxNQUFNLElBQUksR0FBRyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDekIsT0FBTztRQUNMLFVBQVUsRUFBRSxJQUFJLENBQUMsR0FBRyxDQUFDLCtCQUErQixDQUFDO1FBQ3JELEdBQUcsQ0FBQyxJQUFJLENBQUMsTUFBTSxHQUFHLElBQUksQ0FBQyxNQUFNLElBQUksSUFBSTtZQUNuQyxDQUFDLENBQUM7Z0JBQ0UsVUFBVSxFQUFFLHdCQUF3QixDQUFDO29CQUNuQyxNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU07b0JBQ25CLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTTtpQkFDcEIsQ0FBQzthQUNIO1lBQ0gsQ0FBQyxDQUFDLEVBQUUsQ0FBQztLQUNSLENBQUM7QUFDSixDQUFDLENBQUMifQ==

package/dist_ts/coremail.validation.d.ts

@@ -2,8 +2,21 @@ import * as plugins from './plugins.js';
 type TMessage = plugins.serveZoneInterfaces.data.ICoreMailOutboundMessageDescriptor;
 export declare const normalizeCoreMailMailboxAddress: (valueArg: unknown) => string;
 export declare const normalizeCoreMailEnvelope: (valueArg: unknown) => plugins.serveZoneInterfaces.data.ICoreMailEnvelope;
-export declare const normalizeCoreMailConnectionInfo: (valueArg: unknown) => plugins.serveZoneInterfaces.data.IMailConnectionInfo;
-export declare const normalizeCoreMailGatewayMessage: (valueArg: unknown) => plugins.serveZoneInterfaces.data.ICoreMailGatewayMessageDescriptor;
+/**
+ * The single sender-authorization rule every outbound path applies: the
+ * envelope sender must be an exact member of the binding's allowed senders.
+ */
+export declare const assertCoreMailSenderAllowed: (senderAddressArg: string, bindingArg: plugins.serveZoneInterfaces.data.ICoreMailBindingDesiredState) => void;
 export declare const normalizeCoreMailOutboundMessage: (valueArg: unknown, bindingArg: plugins.serveZoneInterfaces.data.ICoreMailBindingDesiredState) => TMessage;
+/**
+ * Build the outbound message descriptor of an exact-byte SMTP submission.
+ *
+ * An SMTP submission has no CoreMail-composed body: the bytes are opaque and
+ * are owned by the immutable MIME tuple, so the descriptor carries only the
+ * SMTP envelope. `parts` is therefore empty, which is why such a descriptor is
+ * deliberately not routed through
+ * `normalizeCoreMailOutboundMessageDescriptor` (it requires at least one part).
+ */
+export declare const createCoreMailRawOutboundMessage: (envelopeArg: plugins.serveZoneInterfaces.data.ICoreMailEnvelope) => TMessage;
 export declare const createCoreMailSubmissionDigest: (idempotencyKeyArg: string, messageArg: TMessage) => plugins.serveZoneInterfaces.data.TCoreMailSha256;
 export {};

package/dist_ts/coremail.validation.js

@@ -63,90 +63,38 @@ export const normalizeCoreMailEnvelope = (valueArg) => {
     }
     return { mailFrom, rcptTo };
 };
-export const normalizeCoreMailConnectionInfo = (valueArg) => {
-    const value = requirePlainRecord(valueArg, 'connectionInfo');
-    requireExactKeys(value, ['protocol'], [
-        'remoteAddress',
-        'proxyAddress',
-        'heloName',
-        'tls',
-        'authUsername',
-        'authenticatedCredentialId',
-    ], 'connectionInfo');
-    if (value.protocol !== 'smtp'
-        && value.protocol !== 'submission'
-        && value.protocol !== 'api') {
-        throw new Error('CoreMail gateway connection protocol is invalid.');
-    }
-    for (const key of [
-        'remoteAddress',
-        'proxyAddress',
-        'heloName',
-        'authUsername',
-        'authenticatedCredentialId',
-    ]) {
-        if (value[key] !== undefined
-            && (typeof value[key] !== 'string'
-                || value[key].length === 0
-                || Buffer.byteLength(value[key], 'utf8') > 512
-                || value[key].trim() !== value[key])) {
-            throw new Error(`CoreMail gateway connection ${key} is invalid.`);
-        }
-    }
-    if (value.tls !== undefined && typeof value.tls !== 'boolean') {
-        throw new Error('CoreMail gateway connection TLS state is invalid.');
-    }
-    return {
-        protocol: value.protocol,
-        ...(value.remoteAddress === undefined
-            ? {}
-            : { remoteAddress: value.remoteAddress }),
-        ...(value.proxyAddress === undefined
-            ? {}
-            : { proxyAddress: value.proxyAddress }),
-        ...(value.heloName === undefined
-            ? {}
-            : { heloName: value.heloName }),
-        ...(value.tls === undefined ? {} : { tls: value.tls }),
-        ...(value.authUsername === undefined
-            ? {}
-            : { authUsername: value.authUsername }),
-        ...(value.authenticatedCredentialId === undefined
-            ? {}
-            : {
-                authenticatedCredentialId: value.authenticatedCredentialId,
-            }),
-    };
-};
-export const normalizeCoreMailGatewayMessage = (valueArg) => {
-    const value = requirePlainRecord(valueArg, 'gatewayMessage');
-    requireExactKeys(value, ['envelope', 'rawMime'], [], 'gatewayMessage');
-    const rawMime = requirePlainRecord(value.rawMime, 'gatewayMessage.rawMime');
-    requireExactKeys(rawMime, ['sha256', 'lengthBytes', 'contentType'], [], 'gatewayMessage.rawMime');
-    if (rawMime.contentType !== 'message/rfc822'
-        || !Number.isSafeInteger(rawMime.lengthBytes)
-        || Number(rawMime.lengthBytes) < 1
-        || Number(rawMime.lengthBytes)
-            > plugins.serveZoneInterfaces.data.coreMailLimits.serializedMimeBytes) {
-        throw new Error('CoreMail gateway MIME descriptor is invalid.');
+/**
+ * The single sender-authorization rule every outbound path applies: the
+ * envelope sender must be an exact member of the binding's allowed senders.
+ */
+export const assertCoreMailSenderAllowed = (senderAddressArg, bindingArg) => {
+    if (!bindingArg.allowedSenders.includes(senderAddressArg)) {
+        throw new Error('CoreMail sender is not authorized by the binding.');
     }
-    return {
-        envelope: normalizeCoreMailEnvelope(value.envelope),
-        rawMime: {
-            sha256: plugins.serveZoneInterfaces.data.normalizeCoreMailSha256(rawMime.sha256),
-            lengthBytes: Number(rawMime.lengthBytes),
-            contentType: 'message/rfc822',
-        },
-    };
 };
 export const normalizeCoreMailOutboundMessage = (valueArg, bindingArg) => {
     const message = plugins.serveZoneInterfaces.data
         .normalizeCoreMailOutboundMessageDescriptor(valueArg);
-    if (!bindingArg.allowedSenders.includes(message.sender.address)) {
-        throw new Error('CoreMail sender is not authorized by the binding.');
-    }
+    assertCoreMailSenderAllowed(message.sender.address, bindingArg);
     return message;
 };
+/**
+ * Build the outbound message descriptor of an exact-byte SMTP submission.
+ *
+ * An SMTP submission has no CoreMail-composed body: the bytes are opaque and
+ * are owned by the immutable MIME tuple, so the descriptor carries only the
+ * SMTP envelope. `parts` is therefore empty, which is why such a descriptor is
+ * deliberately not routed through
+ * `normalizeCoreMailOutboundMessageDescriptor` (it requires at least one part).
+ */
+export const createCoreMailRawOutboundMessage = (envelopeArg) => ({
+    sender: { address: envelopeArg.mailFrom },
+    recipients: {
+        to: envelopeArg.rcptTo.map((recipientArg) => ({ address: recipientArg })),
+    },
+    subject: '',
+    parts: [],
+});
 export const createCoreMailSubmissionDigest = (idempotencyKeyArg, messageArg) => {
     if (!idRegex.test(idempotencyKeyArg)) {
         throw new Error('CoreMail idempotency key is invalid.');
@@ -157,4 +105,4 @@ export const createCoreMailSubmissionDigest = (idempotencyKeyArg, messageArg) =>
         message: messageArg,
     }));
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29yZW1haWwudmFsaWRhdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL2NvcmVtYWlsLnZhbGlkYXRpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFDeEMsT0FBTyxFQUFFLFlBQVksRUFBRSxNQUFNLHNCQUFzQixDQUFDO0FBSXBELE1BQU0scUJBQXFCLEdBQUcsaUNBQWlDLENBQUM7QUFDaEUsTUFBTSx1QkFBdUIsR0FBRyx3Q0FBd0MsQ0FBQztBQUN6RSxNQUFNLE9BQU8sR0FBRyxxQ0FBcUMsQ0FBQztBQUV0RCxNQUFNLGtCQUFrQixHQUFHLENBQ3pCLFFBQWlCLEVBQ2pCLFFBQWdCLEVBQ1MsRUFBRTtJQUMzQixJQUNFLENBQUMsUUFBUTtXQUNOLE9BQU8sUUFBUSxLQUFLLFFBQVE7V0FDNUIsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUM7V0FDdkIsQ0FDRCxNQUFNLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxLQUFLLE1BQU0sQ0FBQyxTQUFTO2VBQ2pELE1BQU0sQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLEtBQUssSUFBSSxDQUM1QyxFQUNELENBQUM7UUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLEdBQUcsUUFBUSwwQkFBMEIsQ0FBQyxDQUFDO0lBQ3pELENBQUM7SUFDRCxPQUFPLFFBQW1DLENBQUM7QUFDN0MsQ0FBQyxDQUFDO0FBRUYsTUFBTSxnQkFBZ0IsR0FBRyxDQUN2QixTQUFrQyxFQUNsQyxXQUFxQixFQUNyQixXQUFxQixFQUNyQixRQUFnQixFQUNWLEVBQUU7SUFDUixNQUFNLE9BQU8sR0FBRyxJQUFJLEdBQUcsQ0FBQyxDQUFDLEdBQUcsV0FBVyxFQUFFLEdBQUcsV0FBVyxDQUFDLENBQUMsQ0FBQztJQUMxRCxJQUNFLFdBQVcsQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsTUFBTSxDQUFDLENBQUM7V0FDNUQsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxFQUNoRSxDQUFDO1FBQ0QsTUFBTSxJQUFJLEtBQUssQ0FBQyxHQUFHLFFBQVEsc0NBQXNDLENBQUMsQ0FBQztJQUNyRSxDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sK0JBQStCLEdBQUcsQ0FBQyxRQUFpQixFQUFVLEVBQUU7SUFDM0UsSUFDRSxPQUFPLFFBQVEsS0FBSyxRQUFRO1dBQ3pCLFFBQVEsQ0FBQyxNQUFNLEdBQUcsQ0FBQztXQUNuQixNQUFNLENBQUMsVUFBVSxDQUFDLFFBQVEsRUFBRSxNQUFNLENBQUMsR0FBRyxHQUFHO1dBQ3pDLFFBQVEsS0FBSyxRQUFRLENBQUMsV0FBVyxFQUFFLEVBQ3RDLENBQUM7UUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLHFEQUFxRCxDQUFDLENBQUM7SUFDekUsQ0FBQztJQUNELE1BQU0sT0FBTyxHQUFHLFFBQVEsQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDMUMsTUFBTSxTQUFTLEdBQUcsT0FBTyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUNoRSxNQUFNLE1BQU0sR0FBRyxPQUFPLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLE9BQU8sR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQzlELE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDakMsSUFDRSxTQUFTLENBQUMsTUFBTSxLQUFLLENBQUM7V0FDbkIsU0FBUyxDQUFDLE1BQU0sR0FBRyxFQUFFO1dBQ3JCLENBQUMscUJBQXFCLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztXQUN0QyxTQUFTLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQztXQUN6QixTQUFTLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQztXQUN2QixTQUFTLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQztXQUN4QixNQUFNLENBQUMsTUFBTSxLQUFLLENBQUM7V0FDbkIsTUFBTSxDQUFDLE1BQU0sR0FBRyxHQUFHO1dBQ25CLE1BQU0sQ0FBQyxNQUFNLEdBQUcsQ0FBQztXQUNqQixNQUFNLENBQUMsSUFBSSxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxDQUFDLHVCQUF1QixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxFQUNyRSxDQUFDO1FBQ0QsTUFBTSxJQUFJLEtBQUssQ0FBQyw4QkFBOEIsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFDRCxPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSx5QkFBeUIsR0FBRyxDQUN2QyxRQUFpQixFQUNtQyxFQUFFO0lBQ3RELE1BQU0sS0FBSyxHQUFHLGtCQUFrQixDQUFDLFFBQVEsRUFBRSxVQUFVLENBQUMsQ0FBQztJQUN2RCxnQkFBZ0IsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxVQUFVLEVBQUUsUUFBUSxDQUFDLEVBQUUsRUFBRSxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQ2hFLElBQ0UsT0FBTyxLQUFLLENBQUMsUUFBUSxLQUFLLFFBQVE7V0FDL0IsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUM7V0FDNUIsS0FBSyxDQUFDLE1BQU0sQ0FBQyxNQUFNLEtBQUssQ0FBQztXQUN6QixLQUFLLENBQUMsTUFBTSxDQUFDLE1BQU0sR0FBRyxHQUFHLEVBQzVCLENBQUM7UUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLHVDQUF1QyxDQUFDLENBQUM7SUFDM0QsQ0FBQztJQUNELE1BQU0sUUFBUSxHQUFHLEtBQUssQ0FBQyxRQUFRLEtBQUssRUFBRTtRQUNwQyxDQUFDLENBQUMsRUFBRTtRQUNKLENBQUMsQ0FBQywrQkFBK0IsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDcEQsTUFBTSxNQUFNLEdBQUcsS0FBSyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsK0JBQStCLENBQUMsQ0FBQztJQUNqRSxJQUFJLElBQUksR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDLElBQUksS0FBSyxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDM0MsTUFBTSxJQUFJLEtBQUssQ0FBQywwREFBMEQsQ0FBQyxDQUFDO0lBQzlFLENBQUM7SUFDRCxPQUFPLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxDQUFDO0FBQzlCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLCtCQUErQixHQUFHLENBQzdDLFFBQWlCLEVBQ3FDLEVBQUU7SUFDeEQsTUFBTSxLQUFLLEdBQUcsa0JBQWtCLENBQUMsUUFBUSxFQUFFLGdCQUFnQixDQUFDLENBQUM7SUFDN0QsZ0JBQWdCLENBQ2QsS0FBSyxFQUNMLENBQUMsVUFBVSxDQUFDLEVBQ1o7UUFDRSxlQUFlO1FBQ2YsY0FBYztRQUNkLFVBQVU7UUFDVixLQUFLO1FBQ0wsY0FBYztRQUNkLDJCQUEyQjtLQUM1QixFQUNELGdCQUFnQixDQUNqQixDQUFDO0lBQ0YsSUFDRSxLQUFLLENBQUMsUUFBUSxLQUFLLE1BQU07V0FDdEIsS0FBSyxDQUFDLFFBQVEsS0FBSyxZQUFZO1dBQy9CLEtBQUssQ0FBQyxRQUFRLEtBQUssS0FBSyxFQUMzQixDQUFDO1FBQ0QsTUFBTSxJQUFJLEtBQUssQ0FBQyxrREFBa0QsQ0FBQyxDQUFDO0lBQ3RFLENBQUM7SUFDRCxLQUFLLE1BQU0sR0FBRyxJQUFJO1FBQ2hCLGVBQWU7UUFDZixjQUFjO1FBQ2QsVUFBVTtRQUNWLGNBQWM7UUFDZCwyQkFBMkI7S0FDbkIsRUFBRSxDQUFDO1FBQ1gsSUFDRSxLQUFLLENBQUMsR0FBRyxDQUFDLEtBQUssU0FBUztlQUNyQixDQUNELE9BQU8sS0FBSyxDQUFDLEdBQUcsQ0FBQyxLQUFLLFFBQVE7bUJBQzNCLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQzttQkFDdkIsTUFBTSxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLEVBQUUsTUFBTSxDQUFDLEdBQUcsR0FBRzttQkFDM0MsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksRUFBRSxLQUFLLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FDcEMsRUFDRCxDQUFDO1lBQ0QsTUFBTSxJQUFJLEtBQUssQ0FBQywrQkFBK0IsR0FBRyxjQUFjLENBQUMsQ0FBQztRQUNwRSxDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksS0FBSyxDQUFDLEdBQUcsS0FBSyxTQUFTLElBQUksT0FBTyxLQUFLLENBQUMsR0FBRyxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQzlELE1BQU0sSUFBSSxLQUFLLENBQUMsbURBQW1ELENBQUMsQ0FBQztJQUN2RSxDQUFDO0lBQ0QsT0FBTztRQUNMLFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUTtRQUN4QixHQUFHLENBQUMsS0FBSyxDQUFDLGFBQWEsS0FBSyxTQUFTO1lBQ25DLENBQUMsQ0FBQyxFQUFFO1lBQ0osQ0FBQyxDQUFDLEVBQUUsYUFBYSxFQUFFLEtBQUssQ0FBQyxhQUF1QixFQUFFLENBQUM7UUFDckQsR0FBRyxDQUFDLEtBQUssQ0FBQyxZQUFZLEtBQUssU0FBUztZQUNsQyxDQUFDLENBQUMsRUFBRTtZQUNKLENBQUMsQ0FBQyxFQUFFLFlBQVksRUFBRSxLQUFLLENBQUMsWUFBc0IsRUFBRSxDQUFDO1FBQ25ELEdBQUcsQ0FBQyxLQUFLLENBQUMsUUFBUSxLQUFLLFNBQVM7WUFDOUIsQ0FBQyxDQUFDLEVBQUU7WUFDSixDQUFDLENBQUMsRUFBRSxRQUFRLEVBQUUsS0FBSyxDQUFDLFFBQWtCLEVBQUUsQ0FBQztRQUMzQyxHQUFHLENBQUMsS0FBSyxDQUFDLEdBQUcsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxHQUFHLEVBQUUsS0FBSyxDQUFDLEdBQUcsRUFBRSxDQUFDO1FBQ3RELEdBQUcsQ0FBQyxLQUFLLENBQUMsWUFBWSxLQUFLLFNBQVM7WUFDbEMsQ0FBQyxDQUFDLEVBQUU7WUFDSixDQUFDLENBQUMsRUFBRSxZQUFZLEVBQUUsS0FBSyxDQUFDLFlBQXNCLEVBQUUsQ0FBQztRQUNuRCxHQUFHLENBQUMsS0FBSyxDQUFDLHlCQUF5QixLQUFLLFNBQVM7WUFDL0MsQ0FBQyxDQUFDLEVBQUU7WUFDSixDQUFDLENBQUM7Z0JBQ0UseUJBQXlCLEVBQ3ZCLEtBQUssQ0FBQyx5QkFBbUM7YUFDNUMsQ0FBQztLQUNQLENBQUM7QUFDSixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSwrQkFBK0IsR0FBRyxDQUM3QyxRQUFpQixFQUNtRCxFQUFFO0lBQ3RFLE1BQU0sS0FBSyxHQUFHLGtCQUFrQixDQUFDLFFBQVEsRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDO0lBQzdELGdCQUFnQixDQUFDLEtBQUssRUFBRSxDQUFDLFVBQVUsRUFBRSxTQUFTLENBQUMsRUFBRSxFQUFFLEVBQUUsZ0JBQWdCLENBQUMsQ0FBQztJQUN2RSxNQUFNLE9BQU8sR0FBRyxrQkFBa0IsQ0FBQyxLQUFLLENBQUMsT0FBTyxFQUFFLHdCQUF3QixDQUFDLENBQUM7SUFDNUUsZ0JBQWdCLENBQ2QsT0FBTyxFQUNQLENBQUMsUUFBUSxFQUFFLGFBQWEsRUFBRSxhQUFhLENBQUMsRUFDeEMsRUFBRSxFQUNGLHdCQUF3QixDQUN6QixDQUFDO0lBQ0YsSUFDRSxPQUFPLENBQUMsV0FBVyxLQUFLLGdCQUFnQjtXQUNyQyxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQztXQUMxQyxNQUFNLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUM7V0FDL0IsTUFBTSxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUM7Y0FDMUIsT0FBTyxDQUFDLG1CQUFtQixDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMsbUJBQW1CLEVBQ3ZFLENBQUM7UUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLDhDQUE4QyxDQUFDLENBQUM7SUFDbEUsQ0FBQztJQUNELE9BQU87UUFDTCxRQUFRLEVBQUUseUJBQXlCLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQztRQUNuRCxPQUFPLEVBQUU7WUFDUCxNQUFNLEVBQUUsT0FBTyxDQUFDLG1CQUFtQixDQUFDLElBQUksQ0FBQyx1QkFBdUIsQ0FDOUQsT0FBTyxDQUFDLE1BQU0sQ0FDZjtZQUNELFdBQVcsRUFBRSxNQUFNLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQztZQUN4QyxXQUFXLEVBQUUsZ0JBQWdCO1NBQzlCO0tBQ0YsQ0FBQztBQUNKLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLGdDQUFnQyxHQUFHLENBQzlDLFFBQWlCLEVBQ2pCLFVBQXlFLEVBQy9ELEVBQUU7SUFDWixNQUFNLE9BQU8sR0FBRyxPQUFPLENBQUMsbUJBQW1CLENBQUMsSUFBSTtTQUM3QywwQ0FBMEMsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUN4RCxJQUFJLENBQUMsVUFBVSxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQ2hFLE1BQU0sSUFBSSxLQUFLLENBQUMsbURBQW1ELENBQUMsQ0FBQztJQUN2RSxDQUFDO0lBQ0QsT0FBTyxPQUFPLENBQUM7QUFDakIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sOEJBQThCLEdBQUcsQ0FDNUMsaUJBQXlCLEVBQ3pCLFVBQW9CLEVBQzhCLEVBQUU7SUFDcEQsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsaUJBQWlCLENBQUMsRUFBRSxDQUFDO1FBQ3JDLE1BQU0sSUFBSSxLQUFLLENBQUMsc0NBQXNDLENBQUMsQ0FBQztJQUMxRCxDQUFDO0lBQ0QsT0FBTyxZQUFZLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUNqQyxhQUFhLEVBQUUsQ0FBQztRQUNoQixjQUFjLEVBQUUsaUJBQWlCO1FBQ2pDLE9BQU8sRUFBRSxVQUFVO0tBQ3BCLENBQUMsQ0FBQyxDQUFDO0FBQ04sQ0FBQyxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29yZW1haWwudmFsaWRhdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL2NvcmVtYWlsLnZhbGlkYXRpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFDeEMsT0FBTyxFQUFFLFlBQVksRUFBRSxNQUFNLHNCQUFzQixDQUFDO0FBSXBELE1BQU0scUJBQXFCLEdBQUcsaUNBQWlDLENBQUM7QUFDaEUsTUFBTSx1QkFBdUIsR0FBRyx3Q0FBd0MsQ0FBQztBQUN6RSxNQUFNLE9BQU8sR0FBRyxxQ0FBcUMsQ0FBQztBQUV0RCxNQUFNLGtCQUFrQixHQUFHLENBQ3pCLFFBQWlCLEVBQ2pCLFFBQWdCLEVBQ1MsRUFBRTtJQUMzQixJQUNFLENBQUMsUUFBUTtXQUNOLE9BQU8sUUFBUSxLQUFLLFFBQVE7V0FDNUIsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUM7V0FDdkIsQ0FDRCxNQUFNLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxLQUFLLE1BQU0sQ0FBQyxTQUFTO2VBQ2pELE1BQU0sQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLEtBQUssSUFBSSxDQUM1QyxFQUNELENBQUM7UUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLEdBQUcsUUFBUSwwQkFBMEIsQ0FBQyxDQUFDO0lBQ3pELENBQUM7SUFDRCxPQUFPLFFBQW1DLENBQUM7QUFDN0MsQ0FBQyxDQUFDO0FBRUYsTUFBTSxnQkFBZ0IsR0FBRyxDQUN2QixTQUFrQyxFQUNsQyxXQUFxQixFQUNyQixXQUFxQixFQUNyQixRQUFnQixFQUNWLEVBQUU7SUFDUixNQUFNLE9BQU8sR0FBRyxJQUFJLEdBQUcsQ0FBQyxDQUFDLEdBQUcsV0FBVyxFQUFFLEdBQUcsV0FBVyxDQUFDLENBQUMsQ0FBQztJQUMxRCxJQUNFLFdBQVcsQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsTUFBTSxDQUFDLENBQUM7V0FDNUQsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxFQUNoRSxDQUFDO1FBQ0QsTUFBTSxJQUFJLEtBQUssQ0FBQyxHQUFHLFFBQVEsc0NBQXNDLENBQUMsQ0FBQztJQUNyRSxDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sK0JBQStCLEdBQUcsQ0FBQyxRQUFpQixFQUFVLEVBQUU7SUFDM0UsSUFDRSxPQUFPLFFBQVEsS0FBSyxRQUFRO1dBQ3pCLFFBQVEsQ0FBQyxNQUFNLEdBQUcsQ0FBQztXQUNuQixNQUFNLENBQUMsVUFBVSxDQUFDLFFBQVEsRUFBRSxNQUFNLENBQUMsR0FBRyxHQUFHO1dBQ3pDLFFBQVEsS0FBSyxRQUFRLENBQUMsV0FBVyxFQUFFLEVBQ3RDLENBQUM7UUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLHFEQUFxRCxDQUFDLENBQUM7SUFDekUsQ0FBQztJQUNELE1BQU0sT0FBTyxHQUFHLFFBQVEsQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDMUMsTUFBTSxTQUFTLEdBQUcsT0FBTyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUNoRSxNQUFNLE1BQU0sR0FBRyxPQUFPLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLE9BQU8sR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQzlELE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDakMsSUFDRSxTQUFTLENBQUMsTUFBTSxLQUFLLENBQUM7V0FDbkIsU0FBUyxDQUFDLE1BQU0sR0FBRyxFQUFFO1dBQ3JCLENBQUMscUJBQXFCLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztXQUN0QyxTQUFTLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQztXQUN6QixTQUFTLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQztXQUN2QixTQUFTLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQztXQUN4QixNQUFNLENBQUMsTUFBTSxLQUFLLENBQUM7V0FDbkIsTUFBTSxDQUFDLE1BQU0sR0FBRyxHQUFHO1dBQ25CLE1BQU0sQ0FBQyxNQUFNLEdBQUcsQ0FBQztXQUNqQixNQUFNLENBQUMsSUFBSSxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxDQUFDLHVCQUF1QixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxFQUNyRSxDQUFDO1FBQ0QsTUFBTSxJQUFJLEtBQUssQ0FBQyw4QkFBOEIsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFDRCxPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSx5QkFBeUIsR0FBRyxDQUN2QyxRQUFpQixFQUNtQyxFQUFFO0lBQ3RELE1BQU0sS0FBSyxHQUFHLGtCQUFrQixDQUFDLFFBQVEsRUFBRSxVQUFVLENBQUMsQ0FBQztJQUN2RCxnQkFBZ0IsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxVQUFVLEVBQUUsUUFBUSxDQUFDLEVBQUUsRUFBRSxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQ2hFLElBQ0UsT0FBTyxLQUFLLENBQUMsUUFBUSxLQUFLLFFBQVE7V0FDL0IsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUM7V0FDNUIsS0FBSyxDQUFDLE1BQU0sQ0FBQyxNQUFNLEtBQUssQ0FBQztXQUN6QixLQUFLLENBQUMsTUFBTSxDQUFDLE1BQU0sR0FBRyxHQUFHLEVBQzVCLENBQUM7UUFDRCxNQUFNLElBQUksS0FBSyxDQUFDLHVDQUF1QyxDQUFDLENBQUM7SUFDM0QsQ0FBQztJQUNELE1BQU0sUUFBUSxHQUFHLEtBQUssQ0FBQyxRQUFRLEtBQUssRUFBRTtRQUNwQyxDQUFDLENBQUMsRUFBRTtRQUNKLENBQUMsQ0FBQywrQkFBK0IsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDcEQsTUFBTSxNQUFNLEdBQUcsS0FBSyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsK0JBQStCLENBQUMsQ0FBQztJQUNqRSxJQUFJLElBQUksR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDLElBQUksS0FBSyxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDM0MsTUFBTSxJQUFJLEtBQUssQ0FBQywwREFBMEQsQ0FBQyxDQUFDO0lBQzlFLENBQUM7SUFDRCxPQUFPLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxDQUFDO0FBQzlCLENBQUMsQ0FBQztBQUVGOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLDJCQUEyQixHQUFHLENBQ3pDLGdCQUF3QixFQUN4QixVQUF5RSxFQUNuRSxFQUFFO0lBQ1IsSUFBSSxDQUFDLFVBQVUsQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLGdCQUFnQixDQUFDLEVBQUUsQ0FBQztRQUMxRCxNQUFNLElBQUksS0FBSyxDQUFDLG1EQUFtRCxDQUFDLENBQUM7SUFDdkUsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLGdDQUFnQyxHQUFHLENBQzlDLFFBQWlCLEVBQ2pCLFVBQXlFLEVBQy9ELEVBQUU7SUFDWixNQUFNLE9BQU8sR0FBRyxPQUFPLENBQUMsbUJBQW1CLENBQUMsSUFBSTtTQUM3QywwQ0FBMEMsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUN4RCwyQkFBMkIsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxVQUFVLENBQUMsQ0FBQztJQUNoRSxPQUFPLE9BQU8sQ0FBQztBQUNqQixDQUFDLENBQUM7QUFFRjs7Ozs7Ozs7R0FRRztBQUNILE1BQU0sQ0FBQyxNQUFNLGdDQUFnQyxHQUFHLENBQzlDLFdBQStELEVBQ3JELEVBQUUsQ0FBQyxDQUFDO0lBQ2QsTUFBTSxFQUFFLEVBQUUsT0FBTyxFQUFFLFdBQVcsQ0FBQyxRQUFRLEVBQUU7SUFDekMsVUFBVSxFQUFFO1FBQ1YsRUFBRSxFQUFFLFdBQVcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsWUFBWSxFQUFFLEVBQUUsQ0FBQyxDQUFDLEVBQUUsT0FBTyxFQUFFLFlBQVksRUFBRSxDQUFDLENBQUM7S0FDMUU7SUFDRCxPQUFPLEVBQUUsRUFBRTtJQUNYLEtBQUssRUFBRSxFQUFFO0NBQ1YsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sOEJBQThCLEdBQUcsQ0FDNUMsaUJBQXlCLEVBQ3pCLFVBQW9CLEVBQzhCLEVBQUU7SUFDcEQsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsaUJBQWlCLENBQUMsRUFBRSxDQUFDO1FBQ3JDLE1BQU0sSUFBSSxLQUFLLENBQUMsc0NBQXNDLENBQUMsQ0FBQztJQUMxRCxDQUFDO0lBQ0QsT0FBTyxZQUFZLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUNqQyxhQUFhLEVBQUUsQ0FBQztRQUNoQixjQUFjLEVBQUUsaUJBQWlCO1FBQ2pDLE9BQU8sRUFBRSxVQUFVO0tBQ3BCLENBQUMsQ0FBQyxDQUFDO0FBQ04sQ0FBQyxDQUFDIn0=

package/dist_ts/interfaces.d.ts

@@ -56,6 +56,22 @@ export interface ITransferAuthority {
     serviceId: string;
     bindingId: string;
 }
+/**
+ * How an outbound submission entered CoreMail. Records persisted before this
+ * discriminator existed carry no value and are read as 'api'.
+ */
+export type TCoreMailSubmissionSource = 'api' | 'smtp';
+/**
+ * Exact-byte SMTP submission handed to CoreMail by an authenticated MSA
+ * session. CoreMail never parses or rewrites `rawMime`.
+ */
+export interface ICoreMailRawSubmissionInput {
+    envelope: {
+        from: string;
+        to: string[];
+    };
+    rawMime: Uint8Array;
+}
 export interface ISubmissionPartRecord {
     partId: string;
     kind: plugins.serveZoneInterfaces.data.TCoreMailPartKind;
@@ -76,6 +92,8 @@ export interface ICoreMailReadiness {
     exactPurge: boolean;
     controlBootstrap: boolean;
     gateway: boolean;
+    /** False whenever the desired state asks for an SMTP listener that is not accepting submissions. */
+    smtpSubmission: boolean;
 }
 export interface ICoreMailAuthLimiterSnapshot {
     inFlight: number;

package/dist_ts/plugins.d.ts

@@ -6,6 +6,7 @@ export * as projectinfo from '@push.rocks/projectinfo';
 export * as smartbucket from '@push.rocks/smartbucket';
 export * as smartdata from '@push.rocks/smartdata';
 export * as smartlog from '@push.rocks/smartlog';
+export * as smartmta from '@push.rocks/smartmta';
 export * as serveZoneInterfaces from '@serve.zone/interfaces';
 export * as argon2 from 'argon2';
 export * as nodeCrypto from 'node:crypto';

package/dist_ts/plugins.js

@@ -6,7 +6,8 @@ export * as projectinfo from '@push.rocks/projectinfo';
 export * as smartbucket from '@push.rocks/smartbucket';
 export * as smartdata from '@push.rocks/smartdata';
 export * as smartlog from '@push.rocks/smartlog';
+export * as smartmta from '@push.rocks/smartmta';
 export * as serveZoneInterfaces from '@serve.zone/interfaces';
 export * as argon2 from 'argon2';
 export * as nodeCrypto from 'node:crypto';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3BsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLFlBQVksTUFBTSwwQkFBMEIsQ0FBQztBQUN6RCxPQUFPLEtBQUssc0JBQXNCLE1BQU0scUNBQXFDLENBQUM7QUFDOUUsT0FBTyxLQUFLLFdBQVcsTUFBTSx5QkFBeUIsQ0FBQztBQUN2RCxPQUFPLEtBQUssV0FBVyxNQUFNLHlCQUF5QixDQUFDO0FBQ3ZELE9BQU8sS0FBSyxXQUFXLE1BQU0seUJBQXlCLENBQUM7QUFDdkQsT0FBTyxLQUFLLFdBQVcsTUFBTSx5QkFBeUIsQ0FBQztBQUN2RCxPQUFPLEtBQUssU0FBUyxNQUFNLHVCQUF1QixDQUFDO0FBQ25ELE9BQU8sS0FBSyxRQUFRLE1BQU0sc0JBQXNCLENBQUM7QUFDakQsT0FBTyxLQUFLLG1CQUFtQixNQUFNLHdCQUF3QixDQUFDO0FBQzlELE9BQU8sS0FBSyxNQUFNLE1BQU0sUUFBUSxDQUFDO0FBQ2pDLE9BQU8sS0FBSyxVQUFVLE1BQU0sYUFBYSxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3BsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLFlBQVksTUFBTSwwQkFBMEIsQ0FBQztBQUN6RCxPQUFPLEtBQUssc0JBQXNCLE1BQU0scUNBQXFDLENBQUM7QUFDOUUsT0FBTyxLQUFLLFdBQVcsTUFBTSx5QkFBeUIsQ0FBQztBQUN2RCxPQUFPLEtBQUssV0FBVyxNQUFNLHlCQUF5QixDQUFDO0FBQ3ZELE9BQU8sS0FBSyxXQUFXLE1BQU0seUJBQXlCLENBQUM7QUFDdkQsT0FBTyxLQUFLLFdBQVcsTUFBTSx5QkFBeUIsQ0FBQztBQUN2RCxPQUFPLEtBQUssU0FBUyxNQUFNLHVCQUF1QixDQUFDO0FBQ25ELE9BQU8sS0FBSyxRQUFRLE1BQU0sc0JBQXNCLENBQUM7QUFDakQsT0FBTyxLQUFLLFFBQVEsTUFBTSxzQkFBc0IsQ0FBQztBQUNqRCxPQUFPLEtBQUssbUJBQW1CLE1BQU0sd0JBQXdCLENBQUM7QUFDOUQsT0FBTyxLQUFLLE1BQU0sTUFBTSxRQUFRLENBQUM7QUFDakMsT0FBTyxLQUFLLFVBQVUsTUFBTSxhQUFhLENBQUMifQ==

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/coremail",
-  "version": "1.1.0",
+  "version": "1.3.0",
   "description": "Authenticated mail persistence and delivery orchestration for serve.zone workloads.",
   "main": "dist_ts/index.js",
   "typings": "dist_ts/index.d.ts",
@@ -8,24 +8,25 @@
   "author": "Task Venture Capital GmbH",
   "license": "MIT",
   "devDependencies": {
-    "@git.zone/tsbuild": "^4.4.2",
-    "@git.zone/tsdocker": "^3.4.1",
+    "@git.zone/tsbuild": "^4.4.3",
+    "@git.zone/tsdocker": "^3.5.8",
     "@git.zone/tsrun": "^2.0.6",
-    "@git.zone/tstest": "^3.6.7",
+    "@git.zone/tstest": "6.1.0",
     "@git.zone/tswatch": "^3.3.5",
-    "@push.rocks/smartmongo": "^7.0.0",
-    "@types/node": "^26.1.1"
+    "@push.rocks/smartmongo": "9.0.0",
+    "@types/node": "26.5.0"
   },
   "dependencies": {
-    "@api.global/typedrequest": "^3.7.0",
-    "@api.global/typedrequest-interfaces": "^4.0.0",
-    "@api.global/typedserver": "^8.10.0",
-    "@api.global/typedsocket": "^5.1.1",
+    "@api.global/typedrequest": "^8.0.4",
+    "@api.global/typedrequest-interfaces": "^7.1.0",
+    "@api.global/typedserver": "^11.4.1",
+    "@api.global/typedsocket": "^8.2.1",
     "@push.rocks/projectinfo": "^5.1.0",
     "@push.rocks/smartbucket": "^4.11.0",
     "@push.rocks/smartdata": "^10.4.0",
     "@push.rocks/smartlog": "^3.2.2",
-    "@serve.zone/interfaces": "^23.0.4",
+    "@push.rocks/smartmta": "^9.6.1",
+    "@serve.zone/interfaces": "30.13.0",
     "argon2": "^0.45.1"
   },
   "files": [

package/readme.md

@@ -11,6 +11,12 @@ needs to provision and reconcile bindings without proxying message traffic.
 pnpm add @serve.zone/coremail
 ```
 
+CoreMail installs on Linux only. Its SMTP submission listener is built on
+`@push.rocks/smartmta`, which declares `os: linux` and ships the prebuilt Rust
+`mailer-bin` for `linux-x64` and `linux-arm64` — CoreMail's own runtime target.
+Installing on macOS or Windows fails at the dependency, by design; develop
+against a Linux container or host.
+
 The package exports the service lifecycle and its strict configuration reader:
 
 ```typescript
@@ -75,11 +81,19 @@ CoreMail enforces these boundaries:
 One strict hostname surface is exposed:
 
 - `GET /live` reports process liveness.
-- `GET /ready` reports database, exact object-storage, desired-state, and
-  authenticated gateway readiness.
+- `GET /ready` reports database, exact object-storage, desired-state,
+  authenticated gateway, and SMTP submission listener readiness.
 - `GET|PUT /transfers/:grantId` consumes one-time transfer capabilities.
 - `GET /socket` upgrades to the authenticated TypedSocket RPC transport.
 
+When the desired state enables it, an SMTP submission listener (MSA) runs on
+its own port. It offers `STARTTLS` and accepts `AUTH` only on an encrypted
+session — the username is a `bindingId` and the password any accepted
+credential secret of that binding. Accepted messages go straight to the durable
+outbound pipeline as exact bytes; the embedded SMTP stack stores, queues and
+forwards nothing. A listener whose certificate or private key material does not
+resolve stays down and is reported unavailable.
+
 HTTP TypedRequest and built-in routes are disabled. WebSocket messages are
 limited to 64 KiB, unauthenticated connections have five seconds to complete
 their first authentication request, and HTTP connection/header/request
@@ -98,6 +112,13 @@ ready. Malformed startup configuration terminates
 startup. Missing desired-state secret references keep the affected gateway or
 cursor operation unavailable.
 
+The SMTP submission listener is configured entirely through desired state
+(`smtp`): `enabled`, `port`, `hostname`, and `tls.certificatePemSecretKey` /
+`tls.privateKeyPemSecretKey`, which name runtime secret keys holding PEM text —
+never the PEM values themselves. An omitted or disabled `smtp` section keeps the
+API-only surface; an enabled one whose secret keys do not resolve leaves the
+listener down. Changing any of these values restarts the listener in place.
+
 ```text
 /opt/serve.zone/runtime-assets/workloadinit/v1/workloadinit run \
   --map /run/serve.zone/workloadinit-map-v1.json -- node cli.js
@@ -140,6 +161,15 @@ header, publishes that MIME exactly once, and queues a lease-fenced worker.
 The downstream transport identity is the CoreMail submission ID and remains
 stable across ambiguous responses and retries.
 
+Every outbound submission records how it entered CoreMail. API submissions are
+composed from declared parts as described above. An SMTP submission is accepted
+as exact RFC822 bytes: it has no part descriptors, its bytes become its
+immutable MIME unchanged, and it enters the same lease-fenced worker in the same
+state a finalized API submission does. It is subject to the same binding
+authority, sender authorization, recipient validation, serialized-MIME byte
+budget, and minute and day quota. Records written before this discriminator
+existed are read as API submissions.
+
 Inbound SMTP recipient resolution returns short-lived opaque handles. The
 gateway uploads one immutable MIME object, after which CoreMail resumes a
 SmartData saga that consumes handles and creates one delivery per binding.
@@ -154,6 +184,25 @@ one-time grant, and may acknowledge only after the exact fetch completes.
 Cursor signatures rotate through current and bounded retiring desired-state
 keys without exposing runtime secret material.
 
+Every gateway-facing handler answers with the same privacy-safe typed error
+envelope the workload handlers use, so the transport can tell a retryable
+`QUOTA_EXCEEDED` or `STATE_CONFLICT` from a permanent refusal without ever
+receiving a cause string.
+
+Inbound deliveries carry the `Message-ID` and `Subject` read from a bounded
+prefix of the stored message. The gateway message descriptor cannot carry
+either, and a header scan that fails never costs a delivery — the fields simply
+stay absent.
+
+Per-binding counters are kept for each UTC day: `submittedApi` and
+`submittedSmtp` when a submission is published to the worker, `delivered`,
+`deferred`, `failed` and `deadLettered` on outbound transitions, and `received`,
+`acknowledgedProcessed` and `acknowledgedDiscarded` on inbound ones. Each
+increment commits in the same transaction as the durable transition it counts,
+so a replayed transition — a repeated finalization, a re-applied gateway status,
+a replayed handoff completion or acknowledgement — counts nothing. Counter rows
+are retained for 90 days.
+
 Desired-state activation uses immutable snapshots and a strictly increasing
 `configEpoch` compare-and-set pointer. Replayed or stale configurations cannot
 replace newer authority.

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/coremail',
-  version: '1.1.0',
+  version: '1.3.0',
   description: 'Authenticated mail persistence and delivery orchestration for serve.zone workloads.'
 }