@softure-ai/mailing 0.1.7 → 0.1.8

package/CHANGELOG.md

@@ -4,6 +4,21 @@ Newest first. Each version lists what changed for an app that uses `@softure-ai/
 production, the version gets a line `verified in: <app>@<commit>` ([docs/05](../../docs/05-adoption-playbook.md),
 "Definition of done"). Versions before the first one below are described in their GitHub Releases (`mailing@x.y.z`).
 
+## 0.1.8
+
+- `checkSenderDns` takes `expectDmarc: { policy, subdomainPolicy, adkim, aspf }`: a DMARC record weaker than it (a
+  lower policy, relaxed or absent alignment where strict is required, `pct` under 100) fails with the new finding
+  `weak`. Without the option nothing changes.
+- `replyTo` checks that the reply domain accepts mail: MX records that are not a null MX (finding `null-mx`) and at
+  most one SPF record.
+- `returnPath: [{ host, targetDomain? }]` checks return-path hosts: a CNAME (to the target domain, else finding
+  `unexpected-target`) or MX records. New `resendReturnPath(domain)` gives Resend's `send.` and `rsend.` hosts.
+- `SenderDnsReport` has two new keys, `replyTo` (`null` when not asked) and `returnPath` (`[]` when not asked); new
+  resolver options `resolveMx` and `resolveCname`.
+- `softure-mail dns`: `--dmarc-policy`, `--dmarc-sp`, `--dmarc-adkim`, `--dmarc-aspf`, `--reply-to`,
+  `--return-path`, `--resend-return-path`; without `--domain` it also checks the configured `replyTo`. New output
+  lines `REPLY` and `PATH`.
+
 ## 0.1.7
 
 - A failed send keeps the provider's HTTP status: `SendMailResult` failures and `deliverOnce` outcomes carry

package/README.md

@@ -45,7 +45,8 @@ FIRE ran deployment-specific scripts.
   in `/next`) sends a mail at most once per scope and recipient through the delivery ledger.
 - **Campaigns.** `sendCampaign`, `planCampaign` and the content file parser in `/server`; the
   `softure-mail campaign` command sends a campaign from a content file.
-- **Sender DNS.** `checkSenderDns(domain)` and `softure-mail dns` report SPF, DKIM and DMARC.
+- **Sender DNS.** `checkSenderDns(domain)` and `softure-mail dns` report SPF, DKIM and DMARC, hold DMARC to a
+  required minimum, and check the reply-to domain's MX and the provider's return-path hosts.
 - The `MailProvider` contract and `resend()`, the first adapter.
 - `@softure-ai/mailing/testing`: `fakeMailProvider()` and `readMailOutbox(file)`.
 
@@ -192,15 +193,32 @@ softure-mail campaign launch.md --recipients recipients.txt              # sends
 ### Sender DNS check: `softure-mail dns`
 
 ```bash
-softure-mail dns                                       # the domain of `from` in the config
+softure-mail dns                                       # the domain of `from` (and replyTo) in the config
 softure-mail dns --domain mail.example.com --spf-host send.mail.example.com
+softure-mail dns --spf-host send.mail.example.com --resend-return-path \
+  --dmarc-policy reject --dmarc-sp reject --dmarc-adkim s --dmarc-aspf s
 ```
 
-It reads TXT records and reports each check as `pass`, `warn` or `fail`, exiting 1 on any `fail`:
-SPF (one `v=spf1` record on the domain or each `--spf-host`; `+all` warns), DKIM (a non-empty `p=`
-at `<selector>._domainkey.<domain>`; selector `resend` unless `--dkim-selector` is given) and DMARC
-(`_dmarc.<domain>` or a parent domain's record; `p=none` warns: it only reports). Resend publishes
-SPF on `send.<domain>`. It cannot see whether the provider signs with the published key.
+It reports each check as `pass`, `warn` or `fail`, exiting 1 on any `fail`:
+
+- **SPF**: one `v=spf1` record on the domain or each `--spf-host`; `+all` warns. Resend publishes SPF on
+  `send.<domain>`.
+- **DKIM**: a non-empty `p=` at `<selector>._domainkey.<domain>`; selector `resend` unless `--dkim-selector` is given.
+- **DMARC**: `_dmarc.<domain>` or a parent domain's record; `p=none` warns: it only reports. With a required minimum
+  (`expectDmarc: { policy, subdomainPolicy, adkim, aspf }`, or the `--dmarc-*` flags) a weaker record fails as
+  `weak`: `p=quarantine` where `reject` is required, `adkim=r` (or no `adkim`) where `s` is required, `pct` under 100
+  when a policy is required. A stricter record passes, so adding `rua=` or tightening a tag never turns it red. For
+  an inherited record the domain's policy is `sp`, else `p`.
+- **REPLY** (when `replyTo` is configured and `--domain` is not given, or with `--reply-to`; `replyTo` option of the
+  function): the reply domain must have MX records that are not a null MX (`0 .`, "accepts no mail") and at most one
+  SPF record. Without it replies bounce while every sender check is green.
+- **PATH** (`returnPath: [{ host, targetDomain? }]`, `--return-path <host>`, `--resend-return-path`): each host must
+  be a CNAME (to `targetDomain` or under it, when set) or have MX records. `resendReturnPath(domain)` (the flag) gives
+  Resend's `send.<domain>` and `rsend.<domain>` with target `rmta.net`; a domain Resend set up with MX records on
+  `send` and no `rsend` checks `--return-path send.<domain>` alone.
+
+It cannot see whether the provider signs with the published key. The function takes `resolveTxt`, `resolveMx` and
+`resolveCname` for tests; by default it asks the system resolver.
 
 ## 2. Installation
 

package/dist/cli/run.d.ts

@@ -1,6 +1,6 @@
 import { type SoftureConfig } from "@softure-ai/core";
 import { type DatabaseHandle } from "@softure-ai/db";
-import { type ResolveTxt } from "../server/dns.js";
+import { type ResolveCname, type ResolveMx, type ResolveTxt } from "../server/dns.js";
 import { type Env } from "../server/unsubscribe-link.js";
 export interface CliOutput {
     readonly log: (line: string) => void;
@@ -17,6 +17,8 @@ export interface RunMailCliOptions {
     /** Opens the campaign's database connection. Default: the config's `database.handle`, else `createDatabase(url, { max: 1 })`. */
     readonly openDatabase?: (url: string) => Promise<DatabaseHandle>;
     readonly resolveTxt?: ResolveTxt;
+    readonly resolveMx?: ResolveMx;
+    readonly resolveCname?: ResolveCname;
     readonly sleep?: (ms: number) => Promise<void>;
     readonly env?: Env;
 }

package/dist/cli/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/cli/run.ts"],"names":[],"mappings":"AAWA,OAAO,EAAe,KAAK,aAAa,EAA8B,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAA6C,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAIhG,OAAO,EAAkD,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnG,OAAO,EAAiF,KAAK,GAAG,EAAE,MAAM,+BAA+B,CAAC;AAExI,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,iBAAiB;IAChC,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC,wGAAwG;IACxG,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,mEAAmE;IACnE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B,iIAAiI;IACjI,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC;CACpB;AAED,eAAO,MAAM,OAAO,IAAI,CAAC;AACzB,eAAO,MAAM,WAAW,IAAI,CAAC;AAC7B,eAAO,MAAM,UAAU,IAAI,CAAC;AAE5B,8EAA8E;AAC9E,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAEpC,eAAO,MAAM,UAAU,QAqBa,CAAC;AAmBrC,yGAAyG;AACzG,wBAAsB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB5E"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/cli/run.ts"],"names":[],"mappings":"AAWA,OAAO,EAAe,KAAK,aAAa,EAA8B,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAA6C,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAIhG,OAAO,EAAkI,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,KAAK,UAAU,EAAuB,MAAM,kBAAkB,CAAC;AAE3O,OAAO,EAAiF,KAAK,GAAG,EAAE,MAAM,+BAA+B,CAAC;AAExI,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,iBAAiB;IAChC,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC,wGAAwG;IACxG,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,mEAAmE;IACnE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B,iIAAiI;IACjI,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC;CACpB;AAED,eAAO,MAAM,OAAO,IAAI,CAAC;AACzB,eAAO,MAAM,WAAW,IAAI,CAAC;AAC7B,eAAO,MAAM,UAAU,IAAI,CAAC;AAE5B,8EAA8E;AAC9E,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAEpC,eAAO,MAAM,UAAU,QAgCa,CAAC;AAgCrC,yGAAyG;AACzG,wBAAsB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB5E"}

package/dist/cli/run.js

@@ -13,7 +13,7 @@ import { systemClock } from "@softure-ai/core";
 import { openCommandDatabase } from "@softure-ai/db";
 import { parseCampaignFile, parseRecipientList } from "../server/campaign-file.js";
 import { planCampaign, sendCampaign } from "../server/campaigns.js";
-import { checkSenderDns, getSenderDomain } from "../server/dns.js";
+import { checkSenderDns, getSenderDomain, resendReturnPath } from "../server/dns.js";
 import { getMailingOptions } from "../server/options.js";
 import { MIN_UNSUBSCRIBE_SECRET_LENGTH, readUnsubscribeSecrets, UNSUBSCRIBE_SECRET_ENV } from "../server/unsubscribe-link.js";
 export const EXIT_OK = 0;
@@ -24,6 +24,8 @@ export const DEFAULT_PAUSE_MS = 500;
 export const MAIL_USAGE = `Usage:
   softure-mail campaign <content-file> --recipients <file> [--dry-run] [--pause-ms <ms>] [--resend-uncertain]
   softure-mail dns [--domain <domain>] [--dkim-selector <name>]... [--spf-host <host>]...
+                   [--dmarc-policy <p>] [--dmarc-sp <p>] [--dmarc-adkim <a>] [--dmarc-aspf <a>]
+                   [--reply-to <address>] [--return-path <host>]... [--resend-return-path]
 
 campaign  Sends the campaign in <content-file> (frontmatter id, kind, subject, optional html,
           then the text body) to every address in the recipients file (one per line), at most
@@ -39,6 +41,15 @@ dns       Checks SPF, DKIM and DMARC for the sender domain (default: the domain
   --dkim-selector <name>  DKIM selector to look up (default resend; repeatable)
   --spf-host <host>       where SPF is published (default the domain; repeatable;
                           Resend publishes it on send.<domain>)
+  --dmarc-policy <p>      require at least this DMARC policy (quarantine or reject)
+                          and pct=100; a weaker record fails
+  --dmarc-sp <p>          require at least this subdomain policy (sp, else p)
+  --dmarc-adkim <a>       require this DKIM alignment (r or s; absent counts as r)
+  --dmarc-aspf <a>        require this SPF alignment (r or s; absent counts as r)
+  --reply-to <address>    check that this address's domain accepts mail (MX, one SPF)
+                          (default: replyTo of the config, when --domain is not given)
+  --return-path <host>    a return-path host that must be a CNAME or have MX (repeatable)
+  --resend-return-path    check Resend's send.<domain> and rsend.<domain> CNAMEs
 
 Options for both:
   --config <file>    the app's softure.config file (bin only)
@@ -47,6 +58,9 @@ const consoleOutput = {
     log: (line) => console.log(line),
     error: (line) => console.error(line),
 };
+const DMARC_POLICIES = ["quarantine", "reject"];
+const DMARC_ALIGNMENTS = ["r", "s"];
+const DNS_ONLY_OPTIONS = ["domain", "dkim-selector", "spf-host", "dmarc-policy", "dmarc-sp", "dmarc-adkim", "dmarc-aspf", "reply-to", "return-path", "resend-return-path"];
 /** Runs the command and returns the process exit code: 0 done, 1 failed or incomplete, 2 usage error. */
 export async function runMailCli(options) {
     const output = options.output ?? consoleOutput;
@@ -90,9 +104,21 @@ function parseCommand(argv) {
             return `dns does not take --${misplaced.join(", --")}`;
         if (positionals.length > 0)
             return `dns takes no file, got "${positionals.join(" ")}"`;
-        return { kind: "dns", domain: values.domain, dkimSelectors: values["dkim-selector"], spfHosts: values["spf-host"] };
+        const expectDmarc = parseDmarcExpectation(values);
+        if (typeof expectDmarc === "string")
+            return expectDmarc;
+        return {
+            kind: "dns",
+            domain: values.domain,
+            dkimSelectors: values["dkim-selector"],
+            spfHosts: values["spf-host"],
+            expectDmarc,
+            replyTo: values["reply-to"],
+            returnPathHosts: values["return-path"] ?? [],
+            resendReturnPath: values["resend-return-path"] === true,
+        };
     }
-    const misplaced = ["domain", "dkim-selector", "spf-host"].filter((option) => values[option] !== undefined);
+    const misplaced = DNS_ONLY_OPTIONS.filter((option) => values[option] !== undefined);
     if (misplaced.length > 0)
         return `campaign does not take --${misplaced.join(", --")}`;
     const [contentFile, ...extra] = positionals;
@@ -118,42 +144,101 @@ function parseCommandArgs(args) {
             domain: { type: "string" },
             "dkim-selector": { type: "string", multiple: true },
             "spf-host": { type: "string", multiple: true },
+            "dmarc-policy": { type: "string" },
+            "dmarc-sp": { type: "string" },
+            "dmarc-adkim": { type: "string" },
+            "dmarc-aspf": { type: "string" },
+            "reply-to": { type: "string" },
+            "return-path": { type: "string", multiple: true },
+            "resend-return-path": { type: "boolean" },
             help: { type: "boolean" },
         },
         strict: true,
         allowPositionals: true,
     });
 }
+/** One choice of a fixed list, case-insensitive; `undefined` when the option was not given. */
+function pickChoice(values, option, allowed) {
+    const given = values[option];
+    if (given === undefined)
+        return { value: undefined };
+    const found = allowed.find((candidate) => candidate === given.trim().toLowerCase());
+    return found === undefined ? `--${option} expects ${allowed.join(" or ")}, got "${given}"` : { value: found };
+}
+function parseDmarcExpectation(values) {
+    const policy = pickChoice(values, "dmarc-policy", DMARC_POLICIES);
+    if (typeof policy === "string")
+        return policy;
+    const subdomainPolicy = pickChoice(values, "dmarc-sp", DMARC_POLICIES);
+    if (typeof subdomainPolicy === "string")
+        return subdomainPolicy;
+    const adkim = pickChoice(values, "dmarc-adkim", DMARC_ALIGNMENTS);
+    if (typeof adkim === "string")
+        return adkim;
+    const aspf = pickChoice(values, "dmarc-aspf", DMARC_ALIGNMENTS);
+    if (typeof aspf === "string")
+        return aspf;
+    const expectation = {
+        ...(policy.value === undefined ? {} : { policy: policy.value }),
+        ...(subdomainPolicy.value === undefined ? {} : { subdomainPolicy: subdomainPolicy.value }),
+        ...(adkim.value === undefined ? {} : { adkim: adkim.value }),
+        ...(aspf.value === undefined ? {} : { aspf: aspf.value }),
+    };
+    return Object.keys(expectation).length === 0 ? undefined : expectation;
+}
 async function runDns(command, options, output) {
     let domain = command.domain;
+    let replyTo = command.replyTo;
     if (domain === undefined) {
         if (options.config === undefined) {
             output.error("softure-mail dns: pass --domain <domain>, or run it with the app's config to check the sender's domain");
             return EXIT_FAILED;
         }
-        domain = getSenderDomain(getMailingOptions(options.config).from);
+        const mailing = getMailingOptions(options.config);
+        domain = getSenderDomain(mailing.from);
+        replyTo ??= mailing.replyTo;
     }
+    const returnPath = [...(command.resendReturnPath ? resendReturnPath(domain) : []), ...command.returnPathHosts.map((host) => ({ host }))];
     const report = await checkSenderDns(domain, {
         ...(command.dkimSelectors === undefined ? {} : { dkimSelectors: command.dkimSelectors }),
         ...(command.spfHosts === undefined ? {} : { spfHosts: command.spfHosts }),
+        ...(command.expectDmarc === undefined ? {} : { expectDmarc: command.expectDmarc }),
+        ...(replyTo === undefined ? {} : { replyTo }),
+        returnPath,
         ...(options.resolveTxt === undefined ? {} : { resolveTxt: options.resolveTxt }),
+        ...(options.resolveMx === undefined ? {} : { resolveMx: options.resolveMx }),
+        ...(options.resolveCname === undefined ? {} : { resolveCname: options.resolveCname }),
     });
-    const checks = [
+    const authentication = [
         ["SPF", report.spf],
         ["DKIM", report.dkim],
         ["DMARC", report.dmarc],
     ];
+    const reply = report.replyTo === null ? [] : [["REPLY", report.replyTo]];
+    const paths = report.returnPath.map((check) => ["PATH", check]);
     output.log(`sender domain ${report.domain}`);
-    for (const [name, check] of checks) {
-        const line = `${name.padEnd(6)}${check.status.padEnd(6)}${check.finding.padEnd(15)}${check.host}${check.record === null ? "" : `  ${check.record}`}`;
+    for (const [name, check] of [...authentication, ...reply, ...paths]) {
+        const line = `${name.padEnd(6)}${check.status.padEnd(6)}${`${check.finding} `.padEnd(15)}${check.host}${check.record === null ? "" : `  ${check.record}`}`;
         if (check.status === "fail")
             output.error(line);
         else
             output.log(line);
     }
-    const failed = checks.filter(([, check]) => check.status === "fail").length;
-    output.log(failed === 0 ? "receivers can authenticate mail from this domain" : `${String(failed)} check(s) failed: list mail from this domain will land in spam or be refused`);
-    return failed === 0 ? EXIT_OK : EXIT_FAILED;
+    const countFailed = (checks) => checks.filter(([, check]) => check.status === "fail").length;
+    const failedAuthentication = countFailed(authentication);
+    const failedReply = countFailed(reply);
+    const failedPaths = countFailed(paths);
+    if (failedAuthentication + failedReply + failedPaths === 0) {
+        output.log("receivers can authenticate mail from this domain");
+        return EXIT_OK;
+    }
+    if (failedAuthentication > 0)
+        output.log(`${String(failedAuthentication)} check(s) failed: list mail from this domain will land in spam or be refused`);
+    if (failedReply > 0)
+        output.log("the reply-to domain does not accept mail: replies will bounce");
+    if (failedPaths > 0)
+        output.log(`${String(failedPaths)} return-path host(s) failed: the provider cannot use them for bounces`);
+    return EXIT_FAILED;
 }
 async function runCampaign(command, options, output) {
     const cwd = options.cwd ?? process.cwd();

package/dist/cli/run.js.map

@@ -1 +1 @@
-{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/cli/run.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,4FAA4F;AAC5F,iCAAiC;AACjC,EAAE;AACF,uBAAuB;AACvB,0DAA0D;AAC1D,4CAA4C;AAC5C,kFAAkF;AAClF,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,WAAW,EAAkD,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAE,mBAAmB,EAA6C,MAAM,gBAAgB,CAAC;AAChG,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAwB,MAAM,4BAA4B,CAAC;AACzG,OAAO,EAAE,YAAY,EAAE,YAAY,EAAwB,MAAM,wBAAwB,CAAC;AAE1F,OAAO,EAAE,cAAc,EAAE,eAAe,EAAkC,MAAM,kBAAkB,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,6BAA6B,EAAE,sBAAsB,EAAE,sBAAsB,EAAY,MAAM,+BAA+B,CAAC;AAsBxI,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC;AACzB,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC;AAC7B,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC;AAE5B,8EAA8E;AAC9E,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAEpC,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;yDAS+B,MAAM,CAAC,gBAAgB,CAAC;;;;;;;;;;;;oCAY7C,CAAC;AAErC,MAAM,aAAa,GAAc;IAC/B,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;IAChC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;CACrC,CAAC;AAcF,yGAAyG;AACzG,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAA0B;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;IAC/C,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,iBAAiB,OAAO,EAAE,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzB,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,MAAM;YACT,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACvB,OAAO,OAAO,CAAC;QACjB,KAAK,KAAK;YACR,OAAO,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1C,KAAK,UAAU;YACb,OAAO,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAuB;IAC3C,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,sCAAsC,CAAC;IACtE,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC/C,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,oBAAoB,IAAI,wBAAwB,CAAC;IAEnG,IAAI,MAA2C,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IACvC,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAElD,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,MAAM,SAAS,GAAI,CAAC,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,kBAAkB,CAAW,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC;QACxI,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,uBAAuB,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACjF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,2BAA2B,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QACvF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;IACtH,CAAC;IAED,MAAM,SAAS,GAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,UAAU,CAAW,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC;IACtH,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,4BAA4B,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IACtF,MAAM,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,GAAG,WAAW,CAAC;IAC5C,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,+BAA+B,CAAC;IACtE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,8CAA8C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9F,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,oCAAoC,CAAC;IACjF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IACjG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,MAAM;QAAE,OAAO,+DAA+D,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC;IACrK,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE,CAAC;AACjL,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAuB;IAC/C,OAAO,SAAS,CAAC;QACf,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QACf,OAAO,EAAE;YACP,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC9B,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YAC9B,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC9B,kBAAkB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACvC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YACnD,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC9C,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;SAC1B;QACD,MAAM,EAAE,IAAI;QACZ,gBAAgB,EAAE,IAAI;KACvB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,OAA0C,EAAE,OAA0B,EAAE,MAAiB;IAC7G,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC5B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,CAAC,KAAK,CAAC,wGAAwG,CAAC,CAAC;YACvH,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,MAAM,GAAG,eAAe,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE;QAC1C,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;QACxF,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;KAChF,CAAC,CAAC;IACH,MAAM,MAAM,GAAyB;QACnC,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;QACnB,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC;KACxB,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACrJ,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;YAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;;YAC3C,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAC5E,MAAM,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,kDAAkD,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,8EAA8E,CAAC,CAAC;IAChL,OAAO,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAA+C,EAAE,OAA0B,EAAE,MAAiB;IACvH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC9D,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IAC3G,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,KAAK,CAAC,0BAA0B,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,sBAAsB,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC3F,MAAM,CAAC,KAAK,CAAC,uDAAuD,sBAAsB,cAAc,MAAM,CAAC,6BAA6B,CAAC,8CAA8C,CAAC,CAAC;QAC7L,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,uFAAuF,CAAC,CAAC;QACtG,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,0BAA0B,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/D,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,MAAM,GAAG,GAAoB,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;IAClF,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,MAAM;YACnB,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC;YAChE,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,EAAE,MAAM,CAAC,CAAC;IAC1I,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kFAAkF;QAClF,MAAM,CAAC,KAAK,CAAC,0BAA0B,aAAa,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC1F,OAAO,WAAW,CAAC;IACrB,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAOD,KAAK,UAAU,YAAY,CAAC,WAAmB,EAAE,cAAsB;IACrE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,gCAAgC,WAAW,EAAE,CAAC;IAC1E,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,GAAG,WAAW,0BAA0B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IAC9F,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;IAC9C,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,CAAC;QACzD,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,6BAA6B,QAAQ,EAAE,CAAC;QAClE,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,iBAAiB,QAAQ,WAAW,CAAC;IACtE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC5C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,mCAAmC,cAAc,EAAE,CAAC;IAC9E,OAAO,EAAE,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;AAClF,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAAoB,EAAE,MAAsB,EAAE,eAAwB,EAAE,MAAiB;IACjH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;IAClE,MAAM,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,MAAM,CAAC,QAAQ,CAAC,IAAI,qCAAqC,CAAC,CAAC;IACzG,MAAM,CAAC,GAAG,CACR;QACE,cAAc,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE;QACvC,gBAAgB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACnC,gBAAgB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE;QACzC,gBAAgB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;QACvC,aAAa,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;QACrC,WAAW,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;KACjC,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACF,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,YAAY,MAAM,CAAC,QAAQ,CAAC,EAAE,0DAA0D,CAAC,CAAC;QACvG,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAoB,EACpB,MAAsB,EACtB,IAAkI,EAClI,MAAiB;IAEjB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE;QAC7C,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1D,UAAU,EAAE,GAAG,EAAE;YACf,OAAO,IAAI,CAAC,CAAC;YACb,IAAI,OAAO,GAAG,GAAG,KAAK,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,YAAY,MAAM,CAAC,QAAQ,CAAC,EAAE,0DAA0D,CAAC,CAAC;QACvG,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC;IAC7B,MAAM,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClG,IAAI,IAAI,GAAG,OAAO,CAAC;IACnB,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QAC7G,MAAM,CAAC,KAAK,CAAC,YAAY,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,0FAA0F,CAAC,CAAC;QACtK,IAAI,GAAG,WAAW,CAAC;IACrB,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IACnD,IAAI,IAAI,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACxC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;QACnG,IAAI,GAAG,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,KAAK,CACV,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,0KAA0K,CACvM,CAAC;QACF,IAAI,GAAG,WAAW,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,iBAAiB,GAA+C;IACpE,0BAA0B,EAAE,sEAAsE;IAClG,wBAAwB,EAAE,sCAAsC;CACjE,CAAC;AAEF,SAAS,aAAa,CAAC,OAAwB;IAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACnF,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACrJ,OAAO;QACL,cAAc,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE;QAC1C,QAAQ,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QAC9B,YAAY,MAAM,CAAC,aAAa,CAAC,GAAG,OAAO,EAAE;QAC7C,gBAAgB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QACtC,aAAa,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;QACvC,eAAe,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE;QAC3C,gBAAgB,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;QAC1C,aAAa,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE;KACzC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,QAA+B,EAAE,IAA4D;IACvH,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,mBAAmB,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,iFAAiF;QACjF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;AAC5E,CAAC"}
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../src/cli/run.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,4FAA4F;AAC5F,iCAAiC;AACjC,EAAE;AACF,uBAAuB;AACvB,0DAA0D;AAC1D,4CAA4C;AAC5C,kFAAkF;AAClF,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,WAAW,EAAkD,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAE,mBAAmB,EAA6C,MAAM,gBAAgB,CAAC;AAChG,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAwB,MAAM,4BAA4B,CAAC;AACzG,OAAO,EAAE,YAAY,EAAE,YAAY,EAAwB,MAAM,wBAAwB,CAAC;AAE1F,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,gBAAgB,EAAwJ,MAAM,kBAAkB,CAAC;AAC3O,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,6BAA6B,EAAE,sBAAsB,EAAE,sBAAsB,EAAY,MAAM,+BAA+B,CAAC;AAwBxI,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC;AACzB,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC;AAC7B,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC;AAE5B,8EAA8E;AAC9E,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAEpC,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;yDAW+B,MAAM,CAAC,gBAAgB,CAAC;;;;;;;;;;;;;;;;;;;;;oCAqB7C,CAAC;AAErC,MAAM,aAAa,GAAc;IAC/B,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;IAChC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;CACrC,CAAC;AAuBF,MAAM,cAAc,GAA2B,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;AACxE,MAAM,gBAAgB,GAA8B,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAC/D,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,oBAAoB,CAAU,CAAC;AAEpL,yGAAyG;AACzG,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAA0B;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;IAC/C,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,iBAAiB,OAAO,EAAE,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzB,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,MAAM;YACT,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACvB,OAAO,OAAO,CAAC;QACjB,KAAK,KAAK;YACR,OAAO,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1C,KAAK,UAAU;YACb,OAAO,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAuB;IAC3C,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC7B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,sCAAsC,CAAC;IACtE,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC/C,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,oBAAoB,IAAI,wBAAwB,CAAC;IAEnG,IAAI,MAA2C,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IACvC,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAElD,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,MAAM,SAAS,GAAI,CAAC,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,kBAAkB,CAAW,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC;QACxI,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,uBAAuB,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACjF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,2BAA2B,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QACvF,MAAM,WAAW,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,OAAO,WAAW,KAAK,QAAQ;YAAE,OAAO,WAAW,CAAC;QACxD,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,aAAa,EAAE,MAAM,CAAC,eAAe,CAAC;YACtC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;YAC5B,WAAW;YACX,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC;YAC3B,eAAe,EAAE,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE;YAC5C,gBAAgB,EAAE,MAAM,CAAC,oBAAoB,CAAC,KAAK,IAAI;SACxD,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC;IACpF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,4BAA4B,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IACtF,MAAM,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,GAAG,WAAW,CAAC;IAC5C,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,+BAA+B,CAAC;IACtE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,8CAA8C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9F,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,oCAAoC,CAAC;IACjF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IACjG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,MAAM;QAAE,OAAO,+DAA+D,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC;IACrK,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE,CAAC;AACjL,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAuB;IAC/C,OAAO,SAAS,CAAC;QACf,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QACf,OAAO,EAAE;YACP,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC9B,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YAC9B,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC9B,kBAAkB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACvC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YACnD,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC9C,cAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAClC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC9B,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACjC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAChC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC9B,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YACjD,oBAAoB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YACzC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;SAC1B;QACD,MAAM,EAAE,IAAI;QACZ,gBAAgB,EAAE,IAAI;KACvB,CAAC,CAAC;AACL,CAAC;AAID,+FAA+F;AAC/F,SAAS,UAAU,CAAmB,MAAoB,EAAE,MAAkE,EAAE,OAAqB;IACnJ,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACpF,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,MAAM,YAAY,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAChH,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAoB;IACjD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;IAClE,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;IACvE,IAAI,OAAO,eAAe,KAAK,QAAQ;QAAE,OAAO,eAAe,CAAC;IAChE,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC;IAClE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;IAChE,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,WAAW,GAAqB;QACpC,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC/D,GAAG,CAAC,eAAe,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,eAAe,CAAC,KAAK,EAAE,CAAC;QAC1F,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAC5D,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;KAC1D,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;AACzE,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,OAA0C,EAAE,OAA0B,EAAE,MAAiB;IAC7G,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC5B,IAAI,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAC9B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,CAAC,KAAK,CAAC,wGAAwG,CAAC,CAAC;YACvH,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC;IAC9B,CAAC;IACD,MAAM,UAAU,GAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3J,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE;QAC1C,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;QACxF,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAClF,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,UAAU;QACV,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;QAC/E,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QAC5E,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;KACtF,CAAC,CAAC;IACH,MAAM,cAAc,GAAyB;QAC3C,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;QACnB,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC;KACxB,CAAC;IACF,MAAM,KAAK,GAAyB,MAAM,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAyB,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IACtF,MAAM,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,cAAc,EAAE,GAAG,KAAK,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QAC3J,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;YAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;;YAC3C,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,MAAqC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAC5H,MAAM,oBAAoB,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,oBAAoB,GAAG,WAAW,GAAG,WAAW,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;QAC/D,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,oBAAoB,GAAG,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,oBAAoB,CAAC,8EAA8E,CAAC,CAAC;IACxJ,IAAI,WAAW,GAAG,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;IACjG,IAAI,WAAW,GAAG,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,uEAAuE,CAAC,CAAC;IAC/H,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAA+C,EAAE,OAA0B,EAAE,MAAiB;IACvH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC9D,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IAC3G,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,KAAK,CAAC,0BAA0B,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,sBAAsB,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC3F,MAAM,CAAC,KAAK,CAAC,uDAAuD,sBAAsB,cAAc,MAAM,CAAC,6BAA6B,CAAC,8CAA8C,CAAC,CAAC;QAC7L,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,uFAAuF,CAAC,CAAC;QACtG,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,0BAA0B,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/D,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,MAAM,GAAG,GAAoB,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;IAClF,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,MAAM;YACnB,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC;YAChE,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,EAAE,MAAM,CAAC,CAAC;IAC1I,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kFAAkF;QAClF,MAAM,CAAC,KAAK,CAAC,0BAA0B,aAAa,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC1F,OAAO,WAAW,CAAC;IACrB,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAOD,KAAK,UAAU,YAAY,CAAC,WAAmB,EAAE,cAAsB;IACrE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,gCAAgC,WAAW,EAAE,CAAC;IAC1E,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,GAAG,WAAW,0BAA0B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IAC9F,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;IAC9C,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,CAAC;QACzD,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,6BAA6B,QAAQ,EAAE,CAAC;QAClE,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,iBAAiB,QAAQ,WAAW,CAAC;IACtE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC5C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,mCAAmC,cAAc,EAAE,CAAC;IAC9E,OAAO,EAAE,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;AAClF,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAAoB,EAAE,MAAsB,EAAE,eAAwB,EAAE,MAAiB;IACjH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;IAClE,MAAM,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,MAAM,CAAC,QAAQ,CAAC,IAAI,qCAAqC,CAAC,CAAC;IACzG,MAAM,CAAC,GAAG,CACR;QACE,cAAc,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE;QACvC,gBAAgB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACnC,gBAAgB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE;QACzC,gBAAgB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;QACvC,aAAa,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;QACrC,WAAW,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;KACjC,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACF,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,CAAC,KAAK,CAAC,YAAY,MAAM,CAAC,QAAQ,CAAC,EAAE,0DAA0D,CAAC,CAAC;QACvG,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAoB,EACpB,MAAsB,EACtB,IAAkI,EAClI,MAAiB;IAEjB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE;QAC7C,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1D,UAAU,EAAE,GAAG,EAAE;YACf,OAAO,IAAI,CAAC,CAAC;YACb,IAAI,OAAO,GAAG,GAAG,KAAK,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,YAAY,MAAM,CAAC,QAAQ,CAAC,EAAE,0DAA0D,CAAC,CAAC;QACvG,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC;IAC7B,MAAM,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClG,IAAI,IAAI,GAAG,OAAO,CAAC;IACnB,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QAC7G,MAAM,CAAC,KAAK,CAAC,YAAY,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,0FAA0F,CAAC,CAAC;QACtK,IAAI,GAAG,WAAW,CAAC;IACrB,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IACnD,IAAI,IAAI,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACxC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;QACnG,IAAI,GAAG,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,KAAK,CACV,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,0KAA0K,CACvM,CAAC;QACF,IAAI,GAAG,WAAW,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,iBAAiB,GAA+C;IACpE,0BAA0B,EAAE,sEAAsE;IAClG,wBAAwB,EAAE,sCAAsC;CACjE,CAAC;AAEF,SAAS,aAAa,CAAC,OAAwB;IAC7C,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACnF,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACrJ,OAAO;QACL,cAAc,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE;QAC1C,QAAQ,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QAC9B,YAAY,MAAM,CAAC,aAAa,CAAC,GAAG,OAAO,EAAE;QAC7C,gBAAgB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;QACtC,aAAa,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;QACvC,eAAe,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE;QAC3C,gBAAgB,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;QAC1C,aAAa,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE;KACzC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,QAA+B,EAAE,IAA4D;IACvH,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,mBAAmB,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,iFAAiF;QACjF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;AAC5E,CAAC"}

package/dist/index.js

@@ -15,7 +15,7 @@ export const MODULE_ID = "mailing";
 export const mailing = defineModule({
     manifest: {
         id: MODULE_ID,
-        version: "0.1.7",
+        version: "0.1.8",
         dependsOn: {},
         dbSchema: "mailing",
         tables: ["suppressions", "campaigns", "deliveries"],

package/dist/server/dns.d.ts

@@ -1,5 +1,5 @@
 export type DnsCheckStatus = "pass" | "warn" | "fail";
-export type DnsFinding = "found" | "missing" | "multiple" | "permissive" | "revoked" | "monitor-only" | "inherited" | "lookup-failed";
+export type DnsFinding = "found" | "missing" | "multiple" | "permissive" | "revoked" | "monitor-only" | "inherited" | "weak" | "null-mx" | "unexpected-target" | "lookup-failed";
 export interface DnsCheck {
     readonly status: DnsCheckStatus;
     readonly finding: DnsFinding;
@@ -13,8 +13,37 @@ export interface SenderDnsReport {
     readonly spf: DnsCheck;
     readonly dkim: DnsCheck;
     readonly dmarc: DnsCheck;
+    /** The reply-to domain's MX, when `replyTo` was given. */
+    readonly replyTo: DnsCheck | null;
+    /** One check per `returnPath` host, in the order given. */
+    readonly returnPath: readonly DnsCheck[];
 }
 export type ResolveTxt = (hostname: string) => Promise<string[][]>;
+export interface MxRecord {
+    readonly exchange: string;
+    readonly priority: number;
+}
+export type ResolveMx = (hostname: string) => Promise<MxRecord[]>;
+export type ResolveCname = (hostname: string) => Promise<string[]>;
+export type DmarcPolicy = "quarantine" | "reject";
+export type DmarcAlignment = "r" | "s";
+/** The least a DMARC record must carry; a weaker one fails as `weak`. Absent tags count as their defaults. */
+export interface DmarcExpectation {
+    /** The policy for the checked domain: `p`, or `sp ?? p` of a parent's record. Also requires `pct` 100. */
+    readonly policy?: DmarcPolicy;
+    /** The policy for subdomains: `sp ?? p`. */
+    readonly subdomainPolicy?: DmarcPolicy;
+    /** `adkim`; absent means relaxed (`r`). */
+    readonly adkim?: DmarcAlignment;
+    /** `aspf`; absent means relaxed (`r`). */
+    readonly aspf?: DmarcAlignment;
+}
+/** A host the provider uses for MAIL FROM or bounces. */
+export interface ReturnPathHost {
+    readonly host: string;
+    /** When set, a CNAME must point at this domain or under it (`rmta.net` accepts `send.forge.rmta.net`). */
+    readonly targetDomain?: string;
+}
 export interface CheckSenderDnsOptions {
     /** DKIM selectors to look up under `_domainkey`. Default `["resend"]`, the Resend selector. */
     readonly dkimSelectors?: readonly string[];
@@ -23,9 +52,27 @@ export interface CheckSenderDnsOptions {
      * return path); DMARC accepts that in relaxed alignment.
      */
     readonly spfHosts?: readonly string[];
+    /** Turns a DMARC record weaker than this into a `fail` (e.g. `{ policy: "reject", adkim: "s", aspf: "s" }`). */
+    readonly expectDmarc?: DmarcExpectation;
+    /**
+     * Where replies go (an address, `Name <address>` or a domain): its domain must have MX records and at most one
+     * SPF record, or replies bounce while the sender checks pass.
+     */
+    readonly replyTo?: string;
+    /** Hosts that must resolve as a CNAME or with MX records; `resendReturnPath(domain)` gives Resend's. */
+    readonly returnPath?: readonly ReturnPathHost[];
     readonly resolveTxt?: ResolveTxt;
+    readonly resolveMx?: ResolveMx;
+    readonly resolveCname?: ResolveCname;
 }
 export declare const DEFAULT_DKIM_SELECTORS: readonly string[];
+/** Domain of the CNAME targets Resend publishes for its return-path hosts. */
+export declare const RESEND_RETURN_PATH_DOMAIN = "rmta.net";
+/**
+ * Resend's return-path hosts: `send.<domain>` (MAIL FROM) and `rsend.<domain>`, CNAMEs to `*.rmta.net`. Domains
+ * set up before Resend published `rsend` have MX records on `send` and no `rsend`: check `send` alone there.
+ */
+export declare function resendReturnPath(domain: string): ReturnPathHost[];
 /** Reads the SPF, DKIM and DMARC records of `domain`. Never throws: a failed lookup is a finding. */
 export declare function checkSenderDns(domain: string, options?: CheckSenderDnsOptions): Promise<SenderDnsReport>;
 /** The domain part of a sender (`Plan <hello@mail.example.com>` gives `mail.example.com`). */

package/dist/server/dns.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dns.d.ts","sourceRoot":"","sources":["../../src/server/dns.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAEtD,MAAM,MAAM,UAAU,GAClB,OAAO,GACP,SAAS,GACT,UAAU,GACV,YAAY,GACZ,SAAS,GACT,cAAc,GACd,WAAW,GACX,eAAe,CAAC;AAEpB,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,sEAAsE;IACtE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;CAC1B;AAED,MAAM,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEnE,MAAM,WAAW,qBAAqB;IACpC,+FAA+F;IAC/F,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;CAClC;AAED,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAAe,CAAC;AAEpE,qGAAqG;AACrG,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,eAAe,CAAC,CAUlH;AAED,8FAA8F;AAC9F,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOpD"}
+{"version":3,"file":"dns.d.ts","sourceRoot":"","sources":["../../src/server/dns.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAEtD,MAAM,MAAM,UAAU,GAClB,OAAO,GACP,SAAS,GACT,UAAU,GACV,YAAY,GACZ,SAAS,GACT,cAAc,GACd,WAAW,GACX,MAAM,GACN,SAAS,GACT,mBAAmB,GACnB,eAAe,CAAC;AAEpB,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,sEAAsE;IACtE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,IAAI,CAAC;IAClC,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,EAAE,SAAS,QAAQ,EAAE,CAAC;CAC1C;AAED,MAAM,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnE,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AACD,MAAM,MAAM,SAAS,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;AAClE,MAAM,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAEnE,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,QAAQ,CAAC;AAClD,MAAM,MAAM,cAAc,GAAG,GAAG,GAAG,GAAG,CAAC;AAEvC,8GAA8G;AAC9G,MAAM,WAAW,gBAAgB;IAC/B,0GAA0G;IAC1G,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,4CAA4C;IAC5C,QAAQ,CAAC,eAAe,CAAC,EAAE,WAAW,CAAC;IACvC,2CAA2C;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC;IAChC,0CAA0C;IAC1C,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC;CAChC;AAED,yDAAyD;AACzD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0GAA0G;IAC1G,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,qBAAqB;IACpC,+FAA+F;IAC/F,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;OAGG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,gHAAgH;IAChH,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC;IACxC;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,wGAAwG;IACxG,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAChD,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;CACtC;AAED,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAAe,CAAC;AAEpE,8EAA8E;AAC9E,eAAO,MAAM,yBAAyB,aAAa,CAAC;AAEpD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,EAAE,CAMjE;AAED,qGAAqG;AACrG,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,eAAe,CAAC,CAclH;AAED,8FAA8F;AAC9F,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOpD"}

package/dist/server/dns.js

@@ -1,19 +1,38 @@
 // The sender domain's DNS, as receivers check it: SPF (RFC 7208), DKIM (RFC 6376) and DMARC
-// (RFC 7489). Without all three, list mail lands in spam or is refused outright. The check only
-// reads public TXT records; it cannot see whether the provider signs with the published key.
-import { resolveTxt as resolveTxtRecords } from "node:dns/promises";
+// (RFC 7489). Without all three, list mail lands in spam or is refused outright. On request it also
+// holds DMARC to a required minimum, checks that the reply-to domain accepts mail (MX) and that the
+// provider's return-path hosts resolve. The check only reads public records; it cannot see whether
+// the provider signs with the published key.
+import { resolveCname as resolveCnameRecords, resolveMx as resolveMxRecords, resolveTxt as resolveTxtRecords } from "node:dns/promises";
 export const DEFAULT_DKIM_SELECTORS = ["resend"];
+/** Domain of the CNAME targets Resend publishes for its return-path hosts. */
+export const RESEND_RETURN_PATH_DOMAIN = "rmta.net";
+/**
+ * Resend's return-path hosts: `send.<domain>` (MAIL FROM) and `rsend.<domain>`, CNAMEs to `*.rmta.net`. Domains
+ * set up before Resend published `rsend` have MX records on `send` and no `rsend`: check `send` alone there.
+ */
+export function resendReturnPath(domain) {
+    const name = normalizeHost(domain);
+    return [
+        { host: `send.${name}`, targetDomain: RESEND_RETURN_PATH_DOMAIN },
+        { host: `rsend.${name}`, targetDomain: RESEND_RETURN_PATH_DOMAIN },
+    ];
+}
 /** Reads the SPF, DKIM and DMARC records of `domain`. Never throws: a failed lookup is a finding. */
 export async function checkSenderDns(domain, options = {}) {
-    const name = domain.trim().toLowerCase().replace(/\.$/, "");
+    const name = normalizeHost(domain);
     const resolveTxt = options.resolveTxt ?? resolveTxtRecords;
     const lookup = (host) => lookupTxt(resolveTxt, host);
-    const [spf, dkim, dmarc] = await Promise.all([
+    const lookupMx = (host) => lookupRecords(options.resolveMx ?? resolveMxRecords, host);
+    const lookupCname = (host) => lookupRecords(options.resolveCname ?? resolveCnameRecords, host);
+    const [spf, dkim, dmarc, replyTo, returnPath] = await Promise.all([
         checkSpf(lookup, options.spfHosts ?? [name]),
         checkDkim(lookup, (options.dkimSelectors ?? DEFAULT_DKIM_SELECTORS).map((selector) => `${selector}._domainkey.${name}`)),
-        checkDmarc(lookup, name),
+        checkDmarc(lookup, name, options.expectDmarc),
+        options.replyTo === undefined ? null : checkReplyPath(lookup, lookupMx, normalizeHost(getSenderDomain(options.replyTo))),
+        Promise.all((options.returnPath ?? []).map((path) => checkReturnPath(lookupCname, lookupMx, path))),
     ]);
-    return { domain: name, spf, dkim, dmarc };
+    return { domain: name, spf, dkim, dmarc, replyTo, returnPath };
 }
 /** The domain part of a sender (`Plan <hello@mail.example.com>` gives `mail.example.com`). */
 export function getSenderDomain(from) {
@@ -24,11 +43,13 @@ export function getSenderDomain(from) {
     const address = open !== -1 && close > open ? from.slice(open + 1, close) : from;
     return address.slice(address.lastIndexOf("@") + 1).trim().toLowerCase();
 }
+function normalizeHost(host) {
+    return host.trim().toLowerCase().replace(/\.$/, "");
+}
 const NO_RECORD_CODES = new Set(["ENOTFOUND", "ENODATA", "NXDOMAIN"]);
-async function lookupTxt(resolveTxt, host) {
+async function lookupRecords(resolve, host) {
     try {
-        // A TXT record may arrive in 255-byte chunks; they form one string.
-        const records = (await resolveTxt(host)).map((chunks) => chunks.join(""));
+        const records = await resolve(host);
         return records.length === 0 ? { kind: "none" } : { kind: "records", records };
     }
     catch (error) {
@@ -36,6 +57,13 @@ async function lookupTxt(resolveTxt, host) {
         return typeof code === "string" && NO_RECORD_CODES.has(code) ? { kind: "none" } : { kind: "error" };
     }
 }
+async function lookupTxt(resolveTxt, host) {
+    // A TXT record may arrive in 255-byte chunks; they form one string.
+    return lookupRecords(async (name) => (await resolveTxt(name)).map((chunks) => chunks.join("")), host);
+}
+function isSpfRecord(record) {
+    return /^v=spf1(\s|$)/i.test(record.trim());
+}
 function startsWithTag(record, tag) {
     return record.trim().toLowerCase().startsWith(tag);
 }
@@ -48,7 +76,7 @@ async function checkSpf(lookup, hosts) {
             lookupFailed ??= host;
             continue;
         }
-        const records = answer.kind === "records" ? answer.records.filter((record) => /^v=spf1(\s|$)/i.test(record.trim())) : [];
+        const records = answer.kind === "records" ? answer.records.filter(isSpfRecord) : [];
         if (records.length > 1)
             return { status: "fail", finding: "multiple", host, record: null };
         const record = records[0];
@@ -83,9 +111,10 @@ async function checkDkim(lookup, hosts) {
 }
 /**
  * `_dmarc.<domain>`, or the nearest parent's record (the organisational domain's policy, with
- * `sp=` for subdomains when it is set). `p=none` only reports; it protects nothing.
+ * `sp=` for subdomains when it is set). `p=none` only reports; it protects nothing. With an
+ * expectation, a record weaker than it fails as `weak`.
  */
-async function checkDmarc(lookup, domain) {
+async function checkDmarc(lookup, domain, expected) {
     const labels = domain.split(".");
     const first = `_dmarc.${domain}`;
     for (let index = 0; index <= labels.length - 2; index += 1) {
@@ -102,12 +131,92 @@ async function checkDmarc(lookup, domain) {
         if (record === undefined)
             continue;
         const inherited = host !== first;
-        const tag = (name) => new RegExp(`(?:^|;)\\s*${name}=([^;]*)`, "i").exec(record)?.[1]?.trim().toLowerCase();
-        const policy = (inherited ? (tag("sp") ?? tag("p")) : tag("p")) ?? "none";
+        const tags = readDmarcTags(record);
+        const policy = (inherited ? (tags.get("sp") ?? tags.get("p")) : tags.get("p")) ?? "none";
+        if (expected !== undefined && !meetsDmarcExpectation(tags, policy, expected))
+            return { status: "fail", finding: "weak", host, record };
         if (policy === "none")
             return { status: "warn", finding: "monitor-only", host, record };
         return inherited ? { status: "pass", finding: "inherited", host, record } : { status: "pass", finding: "found", host, record };
     }
     return { status: "fail", finding: "missing", host: first, record: null };
 }
+/** `tag=value` pairs of a DMARC record, names and values lower-cased; the first occurrence wins. */
+function readDmarcTags(record) {
+    const tags = new Map();
+    for (const part of record.split(";")) {
+        const separator = part.indexOf("=");
+        if (separator === -1)
+            continue;
+        const name = part.slice(0, separator).trim().toLowerCase();
+        if (!tags.has(name))
+            tags.set(name, part.slice(separator + 1).trim().toLowerCase());
+    }
+    return tags;
+}
+const POLICY_RANK = { none: 0, quarantine: 1, reject: 2 };
+/** An unknown policy value counts as `none`, as receivers treat an invalid `p=`. */
+function rankPolicy(policy) {
+    return (policy === undefined ? undefined : POLICY_RANK[policy]) ?? 0;
+}
+function meetsAlignment(actual, expected) {
+    return expected !== "s" || actual === "s";
+}
+function meetsDmarcExpectation(tags, policy, expected) {
+    if (expected.policy !== undefined) {
+        if (rankPolicy(policy) < rankPolicy(expected.policy))
+            return false;
+        const percent = tags.get("pct");
+        if (percent !== undefined && Number(percent) !== 100)
+            return false;
+    }
+    if (expected.subdomainPolicy !== undefined && rankPolicy(tags.get("sp") ?? tags.get("p")) < rankPolicy(expected.subdomainPolicy))
+        return false;
+    return meetsAlignment(tags.get("adkim"), expected.adkim) && meetsAlignment(tags.get("aspf"), expected.aspf);
+}
+function formatMx(records) {
+    return [...records]
+        .sort((left, right) => left.priority - right.priority)
+        .map((record) => `${String(record.priority)} ${normalizeHost(record.exchange) || "."}`)
+        .join(", ");
+}
+/** A null MX (RFC 7505: one record, exchange `.`) says the domain accepts no mail. Node reports it as `""`. */
+function isNullMx(records) {
+    return records.length === 1 && normalizeHost(records[0]?.exchange ?? "") === "";
+}
+/** The reply-to domain must accept mail (MX, not a null MX) and publish at most one SPF record. */
+async function checkReplyPath(lookup, lookupMx, host) {
+    const mx = await lookupMx(host);
+    if (mx.kind === "error")
+        return { status: "fail", finding: "lookup-failed", host, record: null };
+    if (mx.kind === "none")
+        return { status: "fail", finding: "missing", host, record: null };
+    if (isNullMx(mx.records))
+        return { status: "fail", finding: "null-mx", host, record: formatMx(mx.records) };
+    const txt = await lookup(host);
+    if (txt.kind === "error")
+        return { status: "fail", finding: "lookup-failed", host, record: null };
+    if (txt.kind === "records" && txt.records.filter(isSpfRecord).length > 1)
+        return { status: "fail", finding: "multiple", host, record: null };
+    return { status: "pass", finding: "found", host, record: formatMx(mx.records) };
+}
+/** A CNAME (to `targetDomain` or under it, when set), else MX records. Strings, not patterns: the domain is input. */
+async function checkReturnPath(lookupCname, lookupMx, path) {
+    const host = normalizeHost(path.host);
+    const cname = await lookupCname(host);
+    if (cname.kind === "error")
+        return { status: "fail", finding: "lookup-failed", host, record: null };
+    if (cname.kind === "records") {
+        const target = normalizeHost(cname.records[0] ?? "");
+        const expected = path.targetDomain === undefined ? null : normalizeHost(path.targetDomain);
+        const matches = expected === null || target === expected || target.endsWith(`.${expected}`);
+        return matches ? { status: "pass", finding: "found", host, record: target } : { status: "fail", finding: "unexpected-target", host, record: target };
+    }
+    const mx = await lookupMx(host);
+    if (mx.kind === "error")
+        return { status: "fail", finding: "lookup-failed", host, record: null };
+    if (mx.kind === "none" || isNullMx(mx.records))
+        return { status: "fail", finding: "missing", host, record: null };
+    return { status: "pass", finding: "found", host, record: formatMx(mx.records) };
+}
 //# sourceMappingURL=dns.js.map

package/dist/server/dns.js.map

@@ -1 +1 @@
-{"version":3,"file":"dns.js","sourceRoot":"","sources":["../../src/server/dns.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,gGAAgG;AAChG,6FAA6F;AAC7F,OAAO,EAAE,UAAU,IAAI,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AA2CpE,MAAM,CAAC,MAAM,sBAAsB,GAAsB,CAAC,QAAQ,CAAC,CAAC;AAEpE,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,UAAiC,EAAE;IACtF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,iBAAiB,CAAC;IAC3D,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAC7D,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC3C,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,SAAS,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,IAAI,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,QAAQ,eAAe,IAAI,EAAE,CAAC,CAAC;QACxH,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC;KACzB,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,gGAAgG;IAChG,wDAAwD;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjF,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAC1E,CAAC;AAKD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;AAEtE,KAAK,UAAU,SAAS,CAAC,UAAsB,EAAE,IAAY;IAC3D,IAAI,CAAC;QACH,oEAAoE;QACpE,MAAM,OAAO,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1E,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAAmC,EAAE,IAAI,CAAC;QACxD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACtG,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,GAAW;IAChD,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AACrD,CAAC;AAED,6FAA6F;AAC7F,KAAK,UAAU,QAAQ,CAAC,MAAc,EAAE,KAAwB;IAC9D,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,YAAY,KAAK,IAAI,CAAC;YACtB,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzH,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC3F,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACnI,CAAC;IACD,OAAO,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC7L,CAAC;AAED,+FAA+F;AAC/F,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,KAAwB;IAC/D,IAAI,QAAQ,GAAa,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACpG,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS;gBAAE,QAAQ,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAChH,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;YAAE,SAAS;QACrC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QACjF,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,MAAM,GAAG,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACnE,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1E,QAAQ,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,MAAc;IACtD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,UAAU,MAAM,EAAE,CAAC;IACjC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,UAAU,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACrG,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;YAAE,SAAS;QACrC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;QACrF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC3F,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,MAAM,SAAS,GAAG,IAAI,KAAK,KAAK,CAAC;QACjC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,cAAc,IAAI,UAAU,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpH,MAAM,MAAM,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC;QAC1E,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACxF,OAAO,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACjI,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC3E,CAAC"}
+{"version":3,"file":"dns.js","sourceRoot":"","sources":["../../src/server/dns.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,oGAAoG;AACpG,oGAAoG;AACpG,mGAAmG;AACnG,6CAA6C;AAC7C,OAAO,EAAE,YAAY,IAAI,mBAAmB,EAAE,SAAS,IAAI,gBAAgB,EAAE,UAAU,IAAI,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAyFxI,MAAM,CAAC,MAAM,sBAAsB,GAAsB,CAAC,QAAQ,CAAC,CAAC;AAEpE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,yBAAyB,GAAG,UAAU,CAAC;AAEpD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO;QACL,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,EAAE,YAAY,EAAE,yBAAyB,EAAE;QACjE,EAAE,IAAI,EAAE,SAAS,IAAI,EAAE,EAAE,YAAY,EAAE,yBAAyB,EAAE;KACnE,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,UAAiC,EAAE;IACtF,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,iBAAiB,CAAC;IAC3D,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,IAAI,gBAAgB,EAAE,IAAI,CAAC,CAAC;IAC9F,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,YAAY,IAAI,mBAAmB,EAAE,IAAI,CAAC,CAAC;IACvG,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,SAAS,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,IAAI,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,QAAQ,eAAe,IAAI,EAAE,CAAC,CAAC;QACxH,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC;QAC7C,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QACxH,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;KACpG,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACjE,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,gGAAgG;IAChG,wDAAwD;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,KAAK,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjF,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC;AAQD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;AAEtE,KAAK,UAAU,aAAa,CAAI,OAAuC,EAAE,IAAY;IACnF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QACpC,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAAmC,EAAE,IAAI,CAAC;QACxD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACtG,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,UAAsB,EAAE,IAAY;IAC3D,oEAAoE;IACpE,OAAO,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AACxG,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,GAAW;IAChD,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AACrD,CAAC;AAED,6FAA6F;AAC7F,KAAK,UAAU,QAAQ,CAAC,MAAc,EAAE,KAAwB;IAC9D,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,YAAY,KAAK,IAAI,CAAC;YACtB,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC3F,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACnI,CAAC;IACD,OAAO,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC7L,CAAC;AAED,+FAA+F;AAC/F,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,KAAwB;IAC/D,IAAI,QAAQ,GAAa,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACpG,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC5B,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS;gBAAE,QAAQ,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAChH,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;YAAE,SAAS;QACrC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QACjF,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,MAAM,GAAG,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACnE,IAAI,GAAG,KAAK,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1E,QAAQ,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,MAAc,EAAE,QAAsC;IAC9F,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,UAAU,MAAM,EAAE,CAAC;IACjC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,UAAU,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACrG,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;YAAE,SAAS;QACrC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;QACrF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC3F,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,MAAM,SAAS,GAAG,IAAI,KAAK,KAAK,CAAC;QACjC,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC;QACzF,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACvI,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACxF,OAAO,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACjI,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC3E,CAAC;AAED,oGAAoG;AACpG,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,KAAK,CAAC,CAAC;YAAE,SAAS;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,WAAW,GAAqC,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AAE5F,oFAAoF;AACpF,SAAS,UAAU,CAAC,MAA0B;IAC5C,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,cAAc,CAAC,MAA0B,EAAE,QAAoC;IACtF,OAAO,QAAQ,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC5C,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAiC,EAAE,MAAc,EAAE,QAA0B;IAC1G,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,UAAU,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QACnE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;IACrE,CAAC;IACD,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/I,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC9G,CAAC;AAED,SAAS,QAAQ,CAAC,OAA4B;IAC5C,OAAO,CAAC,GAAG,OAAO,CAAC;SAChB,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;SACrD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,CAAC;SACtF,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,+GAA+G;AAC/G,SAAS,QAAQ,CAAC,OAA4B;IAC5C,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;AAClF,CAAC;AAED,mGAAmG;AACnG,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,QAAkB,EAAE,IAAY;IAC5E,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,EAAE,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACjG,IAAI,EAAE,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC1F,IAAI,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5G,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAClG,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC7I,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;AAClF,CAAC;AAED,sHAAsH;AACtH,KAAK,UAAU,eAAe,CAAC,WAAwB,EAAE,QAAkB,EAAE,IAAoB;IAC/F,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACpG,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3F,MAAM,OAAO,GAAG,QAAQ,KAAK,IAAI,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;QAC5F,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvJ,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,EAAE,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACjG,IAAI,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAClH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;AAClF,CAAC"}

package/dist/server/index.d.ts

@@ -1,7 +1,7 @@
 export { getCampaignProblems, parseCampaignFile, parseRecipientList, type CampaignContent, type CampaignFile, type CampaignFileResult } from "./campaign-file.js";
 export { getCampaignContentHash, planCampaign, registerCampaign, sendCampaign, type CampaignErrorCode, type CampaignHalt, type CampaignPlan, type CampaignSummary, type SendCampaignOptions, } from "./campaigns.js";
 export { DEFAULT_MAX_ATTEMPTS, DEFAULT_STALE_CLAIM_MS, DEFAULT_UNCERTAIN_CLAIM_MS, deliverOnce, type DeliverOptions, type Delivery, type DeliveryContext, type DeliveryOutcome, type HaltingErrorCode, } from "./deliveries.js";
-export { checkSenderDns, DEFAULT_DKIM_SELECTORS, getSenderDomain, type CheckSenderDnsOptions, type DnsCheck, type DnsCheckStatus, type DnsFinding, type ResolveTxt, type SenderDnsReport, } from "./dns.js";
+export { checkSenderDns, DEFAULT_DKIM_SELECTORS, getSenderDomain, RESEND_RETURN_PATH_DOMAIN, resendReturnPath, type CheckSenderDnsOptions, type DmarcAlignment, type DmarcExpectation, type DmarcPolicy, type DnsCheck, type DnsCheckStatus, type DnsFinding, type MxRecord, type ResolveCname, type ResolveMx, type ResolveTxt, type ReturnPathHost, type SenderDnsReport, } from "./dns.js";
 export { checkMailingTables } from "./health.js";
 export { addHtmlFooter, addTextFooter, getListUnsubscribeHeaders, SIGNATURE_SEPARATOR } from "./list-mail.js";
 export { getMailingModule, getMailingOptions, getMailingRoutes, type MailingRoutes } from "./options.js";

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAClK,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,mBAAmB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,0BAA0B,EAC1B,WAAW,EACX,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,eAAe,EACf,KAAK,qBAAqB,EAC1B,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,eAAe,GACrB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC9G,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AACzG,OAAO,EAAE,QAAQ,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC3H,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,6BAA6B,EAC7B,sBAAsB,EACtB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,+BAA+B,EAC/B,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,GAAG,EACR,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,KAAK,cAAc,EAAE,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAClK,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,mBAAmB,GACzB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,0BAA0B,EAC1B,WAAW,EACX,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,eAAe,EACf,yBAAyB,EACzB,gBAAgB,EAChB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,eAAe,GACrB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC9G,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AACzG,OAAO,EAAE,QAAQ,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC3H,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,6BAA6B,EAC7B,sBAAsB,EACtB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,+BAA+B,EAC/B,sBAAsB,EACtB,sBAAsB,EACtB,KAAK,GAAG,EACR,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,KAAK,cAAc,EAAE,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/server/index.js

@@ -3,7 +3,7 @@
 export { getCampaignProblems, parseCampaignFile, parseRecipientList } from "./campaign-file.js";
 export { getCampaignContentHash, planCampaign, registerCampaign, sendCampaign, } from "./campaigns.js";
 export { DEFAULT_MAX_ATTEMPTS, DEFAULT_STALE_CLAIM_MS, DEFAULT_UNCERTAIN_CLAIM_MS, deliverOnce, } from "./deliveries.js";
-export { checkSenderDns, DEFAULT_DKIM_SELECTORS, getSenderDomain, } from "./dns.js";
+export { checkSenderDns, DEFAULT_DKIM_SELECTORS, getSenderDomain, RESEND_RETURN_PATH_DOMAIN, resendReturnPath, } from "./dns.js";
 export { checkMailingTables } from "./health.js";
 export { addHtmlFooter, addTextFooter, getListUnsubscribeHeaders, SIGNATURE_SEPARATOR } from "./list-mail.js";
 export { getMailingModule, getMailingOptions, getMailingRoutes } from "./options.js";

package/dist/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,wFAAwF;AACxF,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,kBAAkB,EAAoE,MAAM,oBAAoB,CAAC;AAClK,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,gBAAgB,EAChB,YAAY,GAMb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,0BAA0B,EAC1B,WAAW,GAMZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,eAAe,GAOhB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC9G,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAsB,MAAM,cAAc,CAAC;AACzG,OAAO,EAAE,QAAQ,EAAoB,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAA2B,MAAM,mBAAmB,CAAC;AAC3H,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,6BAA6B,EAC7B,sBAAsB,EACtB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,+BAA+B,EAC/B,sBAAsB,EACtB,sBAAsB,GAOvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAuC,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,wFAAwF;AACxF,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,kBAAkB,EAAoE,MAAM,oBAAoB,CAAC;AAClK,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,gBAAgB,EAChB,YAAY,GAMb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,0BAA0B,EAC1B,WAAW,GAMZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,eAAe,EACf,yBAAyB,EACzB,gBAAgB,GAcjB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC9G,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAsB,MAAM,cAAc,CAAC;AACzG,OAAO,EAAE,QAAQ,EAAoB,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAA2B,MAAM,mBAAmB,CAAC;AAC3H,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,6BAA6B,EAC7B,sBAAsB,EACtB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,+BAA+B,EAC/B,sBAAsB,EACtB,sBAAsB,GAOvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAuC,MAAM,oBAAoB,CAAC"}

package/module.json

@@ -1,6 +1,6 @@
 {
   "id": "mailing",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "dependsOn": {},
   "dbSchema": "mailing",
   "tables": ["suppressions", "campaigns", "deliveries"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softure-ai/mailing",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "SOFTURE AI mailing module: sendMail over a provider adapter (Resend first) with plain-text and HTML bodies, sender and reply-to from config, idempotency keys, a timeout and a typed result; signed one-click unsubscribe (RFC 8058) with a suppression list for list mail; an exactly-once delivery ledger, campaigns sent from a content file by the softure-mail command, and a sender DNS check; a fake provider for tests.",
   "license": "MIT",
   "type": "module",

package/src/cli/run.ts

@@ -14,7 +14,7 @@ import { openCommandDatabase, type CommandDatabase, type DatabaseHandle } from "
 import { parseCampaignFile, parseRecipientList, type CampaignContent } from "../server/campaign-file.js";
 import { planCampaign, sendCampaign, type CampaignSummary } from "../server/campaigns.js";
 import type { DeliveryContext, HaltingErrorCode } from "../server/deliveries.js";
-import { checkSenderDns, getSenderDomain, type DnsCheck, type ResolveTxt } from "../server/dns.js";
+import { checkSenderDns, getSenderDomain, resendReturnPath, type DmarcAlignment, type DmarcExpectation, type DmarcPolicy, type DnsCheck, type ResolveCname, type ResolveMx, type ResolveTxt, type ReturnPathHost } from "../server/dns.js";
 import { getMailingOptions } from "../server/options.js";
 import { MIN_UNSUBSCRIBE_SECRET_LENGTH, readUnsubscribeSecrets, UNSUBSCRIBE_SECRET_ENV, type Env } from "../server/unsubscribe-link.js";
 
@@ -34,6 +34,8 @@ export interface RunMailCliOptions {
   /** Opens the campaign's database connection. Default: the config's `database.handle`, else `createDatabase(url, { max: 1 })`. */
   readonly openDatabase?: (url: string) => Promise<DatabaseHandle>;
   readonly resolveTxt?: ResolveTxt;
+  readonly resolveMx?: ResolveMx;
+  readonly resolveCname?: ResolveCname;
   readonly sleep?: (ms: number) => Promise<void>;
   readonly env?: Env;
 }
@@ -48,6 +50,8 @@ export const DEFAULT_PAUSE_MS = 500;
 export const MAIL_USAGE = `Usage:
   softure-mail campaign <content-file> --recipients <file> [--dry-run] [--pause-ms <ms>] [--resend-uncertain]
   softure-mail dns [--domain <domain>] [--dkim-selector <name>]... [--spf-host <host>]...
+                   [--dmarc-policy <p>] [--dmarc-sp <p>] [--dmarc-adkim <a>] [--dmarc-aspf <a>]
+                   [--reply-to <address>] [--return-path <host>]... [--resend-return-path]
 
 campaign  Sends the campaign in <content-file> (frontmatter id, kind, subject, optional html,
           then the text body) to every address in the recipients file (one per line), at most
@@ -63,6 +67,15 @@ dns       Checks SPF, DKIM and DMARC for the sender domain (default: the domain
   --dkim-selector <name>  DKIM selector to look up (default resend; repeatable)
   --spf-host <host>       where SPF is published (default the domain; repeatable;
                           Resend publishes it on send.<domain>)
+  --dmarc-policy <p>      require at least this DMARC policy (quarantine or reject)
+                          and pct=100; a weaker record fails
+  --dmarc-sp <p>          require at least this subdomain policy (sp, else p)
+  --dmarc-adkim <a>       require this DKIM alignment (r or s; absent counts as r)
+  --dmarc-aspf <a>        require this SPF alignment (r or s; absent counts as r)
+  --reply-to <address>    check that this address's domain accepts mail (MX, one SPF)
+                          (default: replyTo of the config, when --domain is not given)
+  --return-path <host>    a return-path host that must be a CNAME or have MX (repeatable)
+  --resend-return-path    check Resend's send.<domain> and rsend.<domain> CNAMEs
 
 Options for both:
   --config <file>    the app's softure.config file (bin only)
@@ -83,7 +96,20 @@ type Command =
       readonly pauseMs: number;
       readonly resendUncertain: boolean;
     }
-  | { readonly kind: "dns"; readonly domain: string | undefined; readonly dkimSelectors: readonly string[] | undefined; readonly spfHosts: readonly string[] | undefined };
+  | {
+      readonly kind: "dns";
+      readonly domain: string | undefined;
+      readonly dkimSelectors: readonly string[] | undefined;
+      readonly spfHosts: readonly string[] | undefined;
+      readonly expectDmarc: DmarcExpectation | undefined;
+      readonly replyTo: string | undefined;
+      readonly returnPathHosts: readonly string[];
+      readonly resendReturnPath: boolean;
+    };
+
+const DMARC_POLICIES: readonly DmarcPolicy[] = ["quarantine", "reject"];
+const DMARC_ALIGNMENTS: readonly DmarcAlignment[] = ["r", "s"];
+const DNS_ONLY_OPTIONS = ["domain", "dkim-selector", "spf-host", "dmarc-policy", "dmarc-sp", "dmarc-adkim", "dmarc-aspf", "reply-to", "return-path", "resend-return-path"] as const;
 
 /** Runs the command and returns the process exit code: 0 done, 1 failed or incomplete, 2 usage error. */
 export async function runMailCli(options: RunMailCliOptions): Promise<number> {
@@ -124,10 +150,21 @@ function parseCommand(argv: readonly string[]): Command | string {
     const misplaced = (["recipients", "dry-run", "pause-ms", "resend-uncertain"] as const).filter((option) => values[option] !== undefined);
     if (misplaced.length > 0) return `dns does not take --${misplaced.join(", --")}`;
     if (positionals.length > 0) return `dns takes no file, got "${positionals.join(" ")}"`;
-    return { kind: "dns", domain: values.domain, dkimSelectors: values["dkim-selector"], spfHosts: values["spf-host"] };
+    const expectDmarc = parseDmarcExpectation(values);
+    if (typeof expectDmarc === "string") return expectDmarc;
+    return {
+      kind: "dns",
+      domain: values.domain,
+      dkimSelectors: values["dkim-selector"],
+      spfHosts: values["spf-host"],
+      expectDmarc,
+      replyTo: values["reply-to"],
+      returnPathHosts: values["return-path"] ?? [],
+      resendReturnPath: values["resend-return-path"] === true,
+    };
   }
 
-  const misplaced = (["domain", "dkim-selector", "spf-host"] as const).filter((option) => values[option] !== undefined);
+  const misplaced = DNS_ONLY_OPTIONS.filter((option) => values[option] !== undefined);
   if (misplaced.length > 0) return `campaign does not take --${misplaced.join(", --")}`;
   const [contentFile, ...extra] = positionals;
   if (contentFile === undefined) return "campaign needs a content file";
@@ -149,6 +186,13 @@ function parseCommandArgs(args: readonly string[]) {
       domain: { type: "string" },
       "dkim-selector": { type: "string", multiple: true },
       "spf-host": { type: "string", multiple: true },
+      "dmarc-policy": { type: "string" },
+      "dmarc-sp": { type: "string" },
+      "dmarc-adkim": { type: "string" },
+      "dmarc-aspf": { type: "string" },
+      "reply-to": { type: "string" },
+      "return-path": { type: "string", multiple: true },
+      "resend-return-path": { type: "boolean" },
       help: { type: "boolean" },
     },
     strict: true,
@@ -156,34 +200,82 @@ function parseCommandArgs(args: readonly string[]) {
   });
 }
 
+type ParsedValues = ReturnType<typeof parseCommandArgs>["values"];
+
+/** One choice of a fixed list, case-insensitive; `undefined` when the option was not given. */
+function pickChoice<T extends string>(values: ParsedValues, option: "dmarc-policy" | "dmarc-sp" | "dmarc-adkim" | "dmarc-aspf", allowed: readonly T[]): { readonly value: T | undefined } | string {
+  const given = values[option];
+  if (given === undefined) return { value: undefined };
+  const found = allowed.find((candidate) => candidate === given.trim().toLowerCase());
+  return found === undefined ? `--${option} expects ${allowed.join(" or ")}, got "${given}"` : { value: found };
+}
+
+function parseDmarcExpectation(values: ParsedValues): DmarcExpectation | undefined | string {
+  const policy = pickChoice(values, "dmarc-policy", DMARC_POLICIES);
+  if (typeof policy === "string") return policy;
+  const subdomainPolicy = pickChoice(values, "dmarc-sp", DMARC_POLICIES);
+  if (typeof subdomainPolicy === "string") return subdomainPolicy;
+  const adkim = pickChoice(values, "dmarc-adkim", DMARC_ALIGNMENTS);
+  if (typeof adkim === "string") return adkim;
+  const aspf = pickChoice(values, "dmarc-aspf", DMARC_ALIGNMENTS);
+  if (typeof aspf === "string") return aspf;
+  const expectation: DmarcExpectation = {
+    ...(policy.value === undefined ? {} : { policy: policy.value }),
+    ...(subdomainPolicy.value === undefined ? {} : { subdomainPolicy: subdomainPolicy.value }),
+    ...(adkim.value === undefined ? {} : { adkim: adkim.value }),
+    ...(aspf.value === undefined ? {} : { aspf: aspf.value }),
+  };
+  return Object.keys(expectation).length === 0 ? undefined : expectation;
+}
+
 async function runDns(command: Extract<Command, { kind: "dns" }>, options: RunMailCliOptions, output: CliOutput): Promise<number> {
   let domain = command.domain;
+  let replyTo = command.replyTo;
   if (domain === undefined) {
     if (options.config === undefined) {
       output.error("softure-mail dns: pass --domain <domain>, or run it with the app's config to check the sender's domain");
       return EXIT_FAILED;
     }
-    domain = getSenderDomain(getMailingOptions(options.config).from);
+    const mailing = getMailingOptions(options.config);
+    domain = getSenderDomain(mailing.from);
+    replyTo ??= mailing.replyTo;
   }
+  const returnPath: ReturnPathHost[] = [...(command.resendReturnPath ? resendReturnPath(domain) : []), ...command.returnPathHosts.map((host) => ({ host }))];
   const report = await checkSenderDns(domain, {
     ...(command.dkimSelectors === undefined ? {} : { dkimSelectors: command.dkimSelectors }),
     ...(command.spfHosts === undefined ? {} : { spfHosts: command.spfHosts }),
+    ...(command.expectDmarc === undefined ? {} : { expectDmarc: command.expectDmarc }),
+    ...(replyTo === undefined ? {} : { replyTo }),
+    returnPath,
     ...(options.resolveTxt === undefined ? {} : { resolveTxt: options.resolveTxt }),
+    ...(options.resolveMx === undefined ? {} : { resolveMx: options.resolveMx }),
+    ...(options.resolveCname === undefined ? {} : { resolveCname: options.resolveCname }),
   });
-  const checks: [string, DnsCheck][] = [
+  const authentication: [string, DnsCheck][] = [
     ["SPF", report.spf],
     ["DKIM", report.dkim],
     ["DMARC", report.dmarc],
   ];
+  const reply: [string, DnsCheck][] = report.replyTo === null ? [] : [["REPLY", report.replyTo]];
+  const paths: [string, DnsCheck][] = report.returnPath.map((check) => ["PATH", check]);
   output.log(`sender domain ${report.domain}`);
-  for (const [name, check] of checks) {
-    const line = `${name.padEnd(6)}${check.status.padEnd(6)}${check.finding.padEnd(15)}${check.host}${check.record === null ? "" : `  ${check.record}`}`;
+  for (const [name, check] of [...authentication, ...reply, ...paths]) {
+    const line = `${name.padEnd(6)}${check.status.padEnd(6)}${`${check.finding} `.padEnd(15)}${check.host}${check.record === null ? "" : `  ${check.record}`}`;
     if (check.status === "fail") output.error(line);
     else output.log(line);
   }
-  const failed = checks.filter(([, check]) => check.status === "fail").length;
-  output.log(failed === 0 ? "receivers can authenticate mail from this domain" : `${String(failed)} check(s) failed: list mail from this domain will land in spam or be refused`);
-  return failed === 0 ? EXIT_OK : EXIT_FAILED;
+  const countFailed = (checks: readonly [string, DnsCheck][]) => checks.filter(([, check]) => check.status === "fail").length;
+  const failedAuthentication = countFailed(authentication);
+  const failedReply = countFailed(reply);
+  const failedPaths = countFailed(paths);
+  if (failedAuthentication + failedReply + failedPaths === 0) {
+    output.log("receivers can authenticate mail from this domain");
+    return EXIT_OK;
+  }
+  if (failedAuthentication > 0) output.log(`${String(failedAuthentication)} check(s) failed: list mail from this domain will land in spam or be refused`);
+  if (failedReply > 0) output.log("the reply-to domain does not accept mail: replies will bounce");
+  if (failedPaths > 0) output.log(`${String(failedPaths)} return-path host(s) failed: the provider cannot use them for bounces`);
+  return EXIT_FAILED;
 }
 
 async function runCampaign(command: Extract<Command, { kind: "campaign" }>, options: RunMailCliOptions, output: CliOutput): Promise<number> {

package/src/index.ts

@@ -17,7 +17,7 @@ export const MODULE_ID = "mailing";
 export const mailing = defineModule({
   manifest: {
     id: MODULE_ID,
-    version: "0.1.7",
+    version: "0.1.8",
     dependsOn: {},
     dbSchema: "mailing",
     tables: ["suppressions", "campaigns", "deliveries"],

package/src/server/dns.ts

@@ -1,7 +1,9 @@
 // The sender domain's DNS, as receivers check it: SPF (RFC 7208), DKIM (RFC 6376) and DMARC
-// (RFC 7489). Without all three, list mail lands in spam or is refused outright. The check only
-// reads public TXT records; it cannot see whether the provider signs with the published key.
-import { resolveTxt as resolveTxtRecords } from "node:dns/promises";
+// (RFC 7489). Without all three, list mail lands in spam or is refused outright. On request it also
+// holds DMARC to a required minimum, checks that the reply-to domain accepts mail (MX) and that the
+// provider's return-path hosts resolve. The check only reads public records; it cannot see whether
+// the provider signs with the published key.
+import { resolveCname as resolveCnameRecords, resolveMx as resolveMxRecords, resolveTxt as resolveTxtRecords } from "node:dns/promises";
 
 export type DnsCheckStatus = "pass" | "warn" | "fail";
 
@@ -13,6 +15,9 @@ export type DnsFinding =
   | "revoked"
   | "monitor-only"
   | "inherited"
+  | "weak"
+  | "null-mx"
+  | "unexpected-target"
   | "lookup-failed";
 
 export interface DnsCheck {
@@ -29,9 +34,41 @@ export interface SenderDnsReport {
   readonly spf: DnsCheck;
   readonly dkim: DnsCheck;
   readonly dmarc: DnsCheck;
+  /** The reply-to domain's MX, when `replyTo` was given. */
+  readonly replyTo: DnsCheck | null;
+  /** One check per `returnPath` host, in the order given. */
+  readonly returnPath: readonly DnsCheck[];
 }
 
 export type ResolveTxt = (hostname: string) => Promise<string[][]>;
+export interface MxRecord {
+  readonly exchange: string;
+  readonly priority: number;
+}
+export type ResolveMx = (hostname: string) => Promise<MxRecord[]>;
+export type ResolveCname = (hostname: string) => Promise<string[]>;
+
+export type DmarcPolicy = "quarantine" | "reject";
+export type DmarcAlignment = "r" | "s";
+
+/** The least a DMARC record must carry; a weaker one fails as `weak`. Absent tags count as their defaults. */
+export interface DmarcExpectation {
+  /** The policy for the checked domain: `p`, or `sp ?? p` of a parent's record. Also requires `pct` 100. */
+  readonly policy?: DmarcPolicy;
+  /** The policy for subdomains: `sp ?? p`. */
+  readonly subdomainPolicy?: DmarcPolicy;
+  /** `adkim`; absent means relaxed (`r`). */
+  readonly adkim?: DmarcAlignment;
+  /** `aspf`; absent means relaxed (`r`). */
+  readonly aspf?: DmarcAlignment;
+}
+
+/** A host the provider uses for MAIL FROM or bounces. */
+export interface ReturnPathHost {
+  readonly host: string;
+  /** When set, a CNAME must point at this domain or under it (`rmta.net` accepts `send.forge.rmta.net`). */
+  readonly targetDomain?: string;
+}
 
 export interface CheckSenderDnsOptions {
   /** DKIM selectors to look up under `_domainkey`. Default `["resend"]`, the Resend selector. */
@@ -41,22 +78,52 @@ export interface CheckSenderDnsOptions {
    * return path); DMARC accepts that in relaxed alignment.
    */
   readonly spfHosts?: readonly string[];
+  /** Turns a DMARC record weaker than this into a `fail` (e.g. `{ policy: "reject", adkim: "s", aspf: "s" }`). */
+  readonly expectDmarc?: DmarcExpectation;
+  /**
+   * Where replies go (an address, `Name <address>` or a domain): its domain must have MX records and at most one
+   * SPF record, or replies bounce while the sender checks pass.
+   */
+  readonly replyTo?: string;
+  /** Hosts that must resolve as a CNAME or with MX records; `resendReturnPath(domain)` gives Resend's. */
+  readonly returnPath?: readonly ReturnPathHost[];
   readonly resolveTxt?: ResolveTxt;
+  readonly resolveMx?: ResolveMx;
+  readonly resolveCname?: ResolveCname;
 }
 
 export const DEFAULT_DKIM_SELECTORS: readonly string[] = ["resend"];
 
+/** Domain of the CNAME targets Resend publishes for its return-path hosts. */
+export const RESEND_RETURN_PATH_DOMAIN = "rmta.net";
+
+/**
+ * Resend's return-path hosts: `send.<domain>` (MAIL FROM) and `rsend.<domain>`, CNAMEs to `*.rmta.net`. Domains
+ * set up before Resend published `rsend` have MX records on `send` and no `rsend`: check `send` alone there.
+ */
+export function resendReturnPath(domain: string): ReturnPathHost[] {
+  const name = normalizeHost(domain);
+  return [
+    { host: `send.${name}`, targetDomain: RESEND_RETURN_PATH_DOMAIN },
+    { host: `rsend.${name}`, targetDomain: RESEND_RETURN_PATH_DOMAIN },
+  ];
+}
+
 /** Reads the SPF, DKIM and DMARC records of `domain`. Never throws: a failed lookup is a finding. */
 export async function checkSenderDns(domain: string, options: CheckSenderDnsOptions = {}): Promise<SenderDnsReport> {
-  const name = domain.trim().toLowerCase().replace(/\.$/, "");
+  const name = normalizeHost(domain);
   const resolveTxt = options.resolveTxt ?? resolveTxtRecords;
   const lookup = (host: string) => lookupTxt(resolveTxt, host);
-  const [spf, dkim, dmarc] = await Promise.all([
+  const lookupMx = (host: string) => lookupRecords(options.resolveMx ?? resolveMxRecords, host);
+  const lookupCname = (host: string) => lookupRecords(options.resolveCname ?? resolveCnameRecords, host);
+  const [spf, dkim, dmarc, replyTo, returnPath] = await Promise.all([
     checkSpf(lookup, options.spfHosts ?? [name]),
     checkDkim(lookup, (options.dkimSelectors ?? DEFAULT_DKIM_SELECTORS).map((selector) => `${selector}._domainkey.${name}`)),
-    checkDmarc(lookup, name),
+    checkDmarc(lookup, name, options.expectDmarc),
+    options.replyTo === undefined ? null : checkReplyPath(lookup, lookupMx, normalizeHost(getSenderDomain(options.replyTo))),
+    Promise.all((options.returnPath ?? []).map((path) => checkReturnPath(lookupCname, lookupMx, path))),
   ]);
-  return { domain: name, spf, dkim, dmarc };
+  return { domain: name, spf, dkim, dmarc, replyTo, returnPath };
 }
 
 /** The domain part of a sender (`Plan <hello@mail.example.com>` gives `mail.example.com`). */
@@ -69,15 +136,21 @@ export function getSenderDomain(from: string): string {
   return address.slice(address.lastIndexOf("@") + 1).trim().toLowerCase();
 }
 
+function normalizeHost(host: string): string {
+  return host.trim().toLowerCase().replace(/\.$/, "");
+}
+
+type Answer<T> = { readonly kind: "records"; readonly records: T[] } | { readonly kind: "none" } | { readonly kind: "error" };
+type TxtAnswer = Answer<string>;
 type Lookup = (host: string) => Promise<TxtAnswer>;
-type TxtAnswer = { readonly kind: "records"; readonly records: string[] } | { readonly kind: "none" } | { readonly kind: "error" };
+type MxLookup = (host: string) => Promise<Answer<MxRecord>>;
+type CnameLookup = (host: string) => Promise<Answer<string>>;
 
 const NO_RECORD_CODES = new Set(["ENOTFOUND", "ENODATA", "NXDOMAIN"]);
 
-async function lookupTxt(resolveTxt: ResolveTxt, host: string): Promise<TxtAnswer> {
+async function lookupRecords<T>(resolve: (host: string) => Promise<T[]>, host: string): Promise<Answer<T>> {
   try {
-    // A TXT record may arrive in 255-byte chunks; they form one string.
-    const records = (await resolveTxt(host)).map((chunks) => chunks.join(""));
+    const records = await resolve(host);
     return records.length === 0 ? { kind: "none" } : { kind: "records", records };
   } catch (error) {
     const code = (error as { code?: unknown } | null)?.code;
@@ -85,6 +158,15 @@ async function lookupTxt(resolveTxt: ResolveTxt, host: string): Promise<TxtAnswe
   }
 }
 
+async function lookupTxt(resolveTxt: ResolveTxt, host: string): Promise<TxtAnswer> {
+  // A TXT record may arrive in 255-byte chunks; they form one string.
+  return lookupRecords(async (name) => (await resolveTxt(name)).map((chunks) => chunks.join("")), host);
+}
+
+function isSpfRecord(record: string): boolean {
+  return /^v=spf1(\s|$)/i.test(record.trim());
+}
+
 function startsWithTag(record: string, tag: string): boolean {
   return record.trim().toLowerCase().startsWith(tag);
 }
@@ -98,7 +180,7 @@ async function checkSpf(lookup: Lookup, hosts: readonly string[]): Promise<DnsCh
       lookupFailed ??= host;
       continue;
     }
-    const records = answer.kind === "records" ? answer.records.filter((record) => /^v=spf1(\s|$)/i.test(record.trim())) : [];
+    const records = answer.kind === "records" ? answer.records.filter(isSpfRecord) : [];
     if (records.length > 1) return { status: "fail", finding: "multiple", host, record: null };
     const record = records[0];
     if (record === undefined) continue;
@@ -129,9 +211,10 @@ async function checkDkim(lookup: Lookup, hosts: readonly string[]): Promise<DnsC
 
 /**
  * `_dmarc.<domain>`, or the nearest parent's record (the organisational domain's policy, with
- * `sp=` for subdomains when it is set). `p=none` only reports; it protects nothing.
+ * `sp=` for subdomains when it is set). `p=none` only reports; it protects nothing. With an
+ * expectation, a record weaker than it fails as `weak`.
  */
-async function checkDmarc(lookup: Lookup, domain: string): Promise<DnsCheck> {
+async function checkDmarc(lookup: Lookup, domain: string, expected: DmarcExpectation | undefined): Promise<DnsCheck> {
   const labels = domain.split(".");
   const first = `_dmarc.${domain}`;
   for (let index = 0; index <= labels.length - 2; index += 1) {
@@ -144,10 +227,85 @@ async function checkDmarc(lookup: Lookup, domain: string): Promise<DnsCheck> {
     const record = records[0];
     if (record === undefined) continue;
     const inherited = host !== first;
-    const tag = (name: string) => new RegExp(`(?:^|;)\\s*${name}=([^;]*)`, "i").exec(record)?.[1]?.trim().toLowerCase();
-    const policy = (inherited ? (tag("sp") ?? tag("p")) : tag("p")) ?? "none";
+    const tags = readDmarcTags(record);
+    const policy = (inherited ? (tags.get("sp") ?? tags.get("p")) : tags.get("p")) ?? "none";
+    if (expected !== undefined && !meetsDmarcExpectation(tags, policy, expected)) return { status: "fail", finding: "weak", host, record };
     if (policy === "none") return { status: "warn", finding: "monitor-only", host, record };
     return inherited ? { status: "pass", finding: "inherited", host, record } : { status: "pass", finding: "found", host, record };
   }
   return { status: "fail", finding: "missing", host: first, record: null };
 }
+
+/** `tag=value` pairs of a DMARC record, names and values lower-cased; the first occurrence wins. */
+function readDmarcTags(record: string): Map<string, string> {
+  const tags = new Map<string, string>();
+  for (const part of record.split(";")) {
+    const separator = part.indexOf("=");
+    if (separator === -1) continue;
+    const name = part.slice(0, separator).trim().toLowerCase();
+    if (!tags.has(name)) tags.set(name, part.slice(separator + 1).trim().toLowerCase());
+  }
+  return tags;
+}
+
+const POLICY_RANK: Readonly<Record<string, number>> = { none: 0, quarantine: 1, reject: 2 };
+
+/** An unknown policy value counts as `none`, as receivers treat an invalid `p=`. */
+function rankPolicy(policy: string | undefined): number {
+  return (policy === undefined ? undefined : POLICY_RANK[policy]) ?? 0;
+}
+
+function meetsAlignment(actual: string | undefined, expected: DmarcAlignment | undefined): boolean {
+  return expected !== "s" || actual === "s";
+}
+
+function meetsDmarcExpectation(tags: ReadonlyMap<string, string>, policy: string, expected: DmarcExpectation): boolean {
+  if (expected.policy !== undefined) {
+    if (rankPolicy(policy) < rankPolicy(expected.policy)) return false;
+    const percent = tags.get("pct");
+    if (percent !== undefined && Number(percent) !== 100) return false;
+  }
+  if (expected.subdomainPolicy !== undefined && rankPolicy(tags.get("sp") ?? tags.get("p")) < rankPolicy(expected.subdomainPolicy)) return false;
+  return meetsAlignment(tags.get("adkim"), expected.adkim) && meetsAlignment(tags.get("aspf"), expected.aspf);
+}
+
+function formatMx(records: readonly MxRecord[]): string {
+  return [...records]
+    .sort((left, right) => left.priority - right.priority)
+    .map((record) => `${String(record.priority)} ${normalizeHost(record.exchange) || "."}`)
+    .join(", ");
+}
+
+/** A null MX (RFC 7505: one record, exchange `.`) says the domain accepts no mail. Node reports it as `""`. */
+function isNullMx(records: readonly MxRecord[]): boolean {
+  return records.length === 1 && normalizeHost(records[0]?.exchange ?? "") === "";
+}
+
+/** The reply-to domain must accept mail (MX, not a null MX) and publish at most one SPF record. */
+async function checkReplyPath(lookup: Lookup, lookupMx: MxLookup, host: string): Promise<DnsCheck> {
+  const mx = await lookupMx(host);
+  if (mx.kind === "error") return { status: "fail", finding: "lookup-failed", host, record: null };
+  if (mx.kind === "none") return { status: "fail", finding: "missing", host, record: null };
+  if (isNullMx(mx.records)) return { status: "fail", finding: "null-mx", host, record: formatMx(mx.records) };
+  const txt = await lookup(host);
+  if (txt.kind === "error") return { status: "fail", finding: "lookup-failed", host, record: null };
+  if (txt.kind === "records" && txt.records.filter(isSpfRecord).length > 1) return { status: "fail", finding: "multiple", host, record: null };
+  return { status: "pass", finding: "found", host, record: formatMx(mx.records) };
+}
+
+/** A CNAME (to `targetDomain` or under it, when set), else MX records. Strings, not patterns: the domain is input. */
+async function checkReturnPath(lookupCname: CnameLookup, lookupMx: MxLookup, path: ReturnPathHost): Promise<DnsCheck> {
+  const host = normalizeHost(path.host);
+  const cname = await lookupCname(host);
+  if (cname.kind === "error") return { status: "fail", finding: "lookup-failed", host, record: null };
+  if (cname.kind === "records") {
+    const target = normalizeHost(cname.records[0] ?? "");
+    const expected = path.targetDomain === undefined ? null : normalizeHost(path.targetDomain);
+    const matches = expected === null || target === expected || target.endsWith(`.${expected}`);
+    return matches ? { status: "pass", finding: "found", host, record: target } : { status: "fail", finding: "unexpected-target", host, record: target };
+  }
+  const mx = await lookupMx(host);
+  if (mx.kind === "error") return { status: "fail", finding: "lookup-failed", host, record: null };
+  if (mx.kind === "none" || isNullMx(mx.records)) return { status: "fail", finding: "missing", host, record: null };
+  return { status: "pass", finding: "found", host, record: formatMx(mx.records) };
+}

package/src/server/index.ts

@@ -27,11 +27,20 @@ export {
   checkSenderDns,
   DEFAULT_DKIM_SELECTORS,
   getSenderDomain,
+  RESEND_RETURN_PATH_DOMAIN,
+  resendReturnPath,
   type CheckSenderDnsOptions,
+  type DmarcAlignment,
+  type DmarcExpectation,
+  type DmarcPolicy,
   type DnsCheck,
   type DnsCheckStatus,
   type DnsFinding,
+  type MxRecord,
+  type ResolveCname,
+  type ResolveMx,
   type ResolveTxt,
+  type ReturnPathHost,
   type SenderDnsReport,
 } from "./dns.js";
 export { checkMailingTables } from "./health.js";