@softure-ai/mailing 0.1.7 → 0.1.9

package/CHANGELOG.md

@@ -4,6 +4,47 @@ Newest first. Each version lists what changed for an app that uses `@softure-ai/
 production, the version gets a line `verified in: <app>@<commit>` ([docs/05](../../docs/05-adoption-playbook.md),
 "Definition of done"). Versions before the first one below are described in their GitHub Releases (`mailing@x.y.z`).
 
+## 0.1.9
+
+- New `importDeliveries(ctx, rows)` (`/server`, and `importDeliveries(rows)` in `/next`) and `softure-mail import
+  <file|->` (JSON Lines): seed `mailing.deliveries` with the deliveries an app made before it adopted the module, so
+  the first `deliverOnce` or campaign run skips them. Rows `{ scope, address, status: "sent" | "rejected",
+  finishedAt, providerMessageId?, reason?, kind? }`; every row is checked before anything is written, rows already
+  in the ledger are left as they are, a re-run imports nothing twice. `checkImportedDeliveries` checks without
+  writing (`--dry-run`).
+- Migration `0004`: `mailing.deliveries.imported_at`; an imported `sent` row may have no `provider_message_id`.
+  Run `softure migrate`.
+- `maxAttempts` is a module option (default 5) and may be `null`, in the module or per `deliverOnce` call: then
+  `mailing.unavailable` always releases the claim and never closes the delivery.
+- `listCampaignRecipients(campaign, ctx)` module option: `softure-mail campaign` without `--recipients` takes the
+  recipients from it. New `listConfiguredCampaignRecipients` in `/server`.
+- `softure-mail` reads a file given as `-` from standard input (the campaign's content file or `--recipients`, the
+  import's history file), so it runs inside the app's container with `docker compose exec -T`. The README documents
+  that topology.
+- `legacyUnsubscribe.params` also takes `{ required, optional }`: a link is legacy when it carries every required
+  name, and the optional names it carries go to `verify` too, so two old link forms on one path both keep working.
+  The array form still means "all required".
+- `mailing({ oneClickInvalidLinkStatus: 200 })`: the one-click route answers 200 for a link that does not verify, so
+  the answer never tells whether a token is live. The default stays 400; a failure still answers 500.
+- `onUnsubscribed` receives `event.link`: `{ scheme: "signed" }` or `{ scheme: "legacy", values }` with the values
+  `verify` accepted, so the hook can find the row a legacy link named. New types `LegacyUnsubscribeParams` and
+  `VerifiedUnsubscribeLink`.
+
+## 0.1.8
+
+- `checkSenderDns` takes `expectDmarc: { policy, subdomainPolicy, adkim, aspf }`: a DMARC record weaker than it (a
+  lower policy, relaxed or absent alignment where strict is required, `pct` under 100) fails with the new finding
+  `weak`. Without the option nothing changes.
+- `replyTo` checks that the reply domain accepts mail: MX records that are not a null MX (finding `null-mx`) and at
+  most one SPF record.
+- `returnPath: [{ host, targetDomain? }]` checks return-path hosts: a CNAME (to the target domain, else finding
+  `unexpected-target`) or MX records. New `resendReturnPath(domain)` gives Resend's `send.` and `rsend.` hosts.
+- `SenderDnsReport` has two new keys, `replyTo` (`null` when not asked) and `returnPath` (`[]` when not asked); new
+  resolver options `resolveMx` and `resolveCname`.
+- `softure-mail dns`: `--dmarc-policy`, `--dmarc-sp`, `--dmarc-adkim`, `--dmarc-aspf`, `--reply-to`,
+  `--return-path`, `--resend-return-path`; without `--domain` it also checks the configured `replyTo`. New output
+  lines `REPLY` and `PATH`.
+
 ## 0.1.7
 
 - A failed send keeps the provider's HTTP status: `SendMailResult` failures and `deliverOnce` outcomes carry

package/README.md

@@ -1,12 +1,10 @@
 # @softure-ai/mailing
 
 Sends one mail to one recipient through a provider adapter and answers with a typed result, never a
-throw. Ported from FIRE_TRACKER `src/lib/mail.ts` (a hand-written Resend `fetch`, plain text only),
-with the sender, reply-to, provider and timeout taken from configuration, an HTML body, and a fake
-provider for tests. List mail gets signed one-click unsubscribe (RFC 8058) and a suppression list,
-ported from FIRE_TRACKER `src/lib/unsubscribe-*.ts` and `/wypisz`. A delivery ledger sends a mail
-at most once per scope and recipient, and `softure-mail` sends campaigns from a content file where
-FIRE ran deployment-specific scripts.
+throw, with the sender, reply-to, provider and timeout taken from configuration, an HTML body, and a
+fake provider for tests. List mail gets signed one-click unsubscribe (RFC 8058) and a suppression
+list. A delivery ledger sends a mail at most once per scope and recipient, an app's earlier history
+can be imported into it, and `softure-mail` sends campaigns from a content file.
 
 ## 1. What it provides
 
@@ -42,10 +40,12 @@ FIRE ran deployment-specific scripts.
   the withdrawal, and **`legacyUnsubscribe`**, which keeps unsubscribe links the app sent before it
   adopted the module working (section 10).
 - **Sending once.** `deliverOnce(ctx, { scope, mail })` (`/server`, and `deliverOnce({ scope, mail })`
-  in `/next`) sends a mail at most once per scope and recipient through the delivery ledger.
+  in `/next`) sends a mail at most once per scope and recipient through the delivery ledger;
+  `importDeliveries` (and `softure-mail import`) seeds it with the app's earlier history.
 - **Campaigns.** `sendCampaign`, `planCampaign` and the content file parser in `/server`; the
   `softure-mail campaign` command sends a campaign from a content file.
-- **Sender DNS.** `checkSenderDns(domain)` and `softure-mail dns` report SPF, DKIM and DMARC.
+- **Sender DNS.** `checkSenderDns(domain)` and `softure-mail dns` report SPF, DKIM and DMARC, hold DMARC to a
+  required minimum, and check the reply-to domain's MX and the provider's return-path hosts.
 - The `MailProvider` contract and `resend()`, the first adapter.
 - `@softure-ai/mailing/testing`: `fakeMailProvider()` and `readMailOutbox(file)`.
 
@@ -89,8 +89,9 @@ address, and `t`, the base64url HMAC-SHA256 of a fixed prefix plus `r` under
 `MAILING_UNSUBSCRIBE_SECRET`. The address never appears in a URL, and the suppression table stores
 only `r`. The page (footer link) shows a button and changes nothing on open: mail scanners open
 links. The one-click route takes a mail client's POST without a session, verifies before touching
-the database and answers 200 (recorded, also again), 400 (link does not verify) or 500 (database
-failure, so the client retries); a GET redirects to the page. The whole link is a credential: it is
+the database and answers 200 (recorded, also again), 400 (link does not verify; 200 with
+`oneClickInvalidLinkStatus: 200`) or 500 (database failure, so the client retries); a GET redirects
+to the page. The whole link is a credential: it is
 never logged.
 
 ### Sending once: the delivery ledger
@@ -123,7 +124,10 @@ const outcome = await deliverOnce({
   Lowercase letters, digits and `._:-`, at most 128 characters. Campaigns use `campaign:<id>`.
 - **Idempotency key.** The ledger sends with `<scope>:<recipient key>`; callers do not pass one.
 - **Retries.** `unavailable` releases the claim (`pending`); the fifth attempt (`maxAttempts`) that
-  is still unavailable closes the row as `rejected`. A halt (`provider_refused`, `quota_exceeded`)
+  is still unavailable closes the row as `rejected`. Five rides out a short provider outage across
+  a few runs, while a provider that keeps failing on one mail does not keep it open forever. An app
+  that retries on its own schedule sets `mailing({ maxAttempts: null })` (or passes it per call):
+  `unavailable` then always releases the claim and never closes the row. A halt (`provider_refused`, `quota_exceeded`)
   never closes a row and never uses up an attempt, so a run with a bad key loses no recipient. The
   provider's HTTP status of the last failed answer is kept in `provider_status`.
 - **Interrupted sends.** A process that dies between the send and the outcome leaves a claim; after
@@ -137,6 +141,47 @@ const outcome = await deliverOnce({
   claim cannot overwrite the one that took over.
 - A malformed scope or kind throws (a bug); a database failure propagates.
 
+### Importing an existing history
+
+An app that already kept its own once-only records (which campaign went to which signup, which
+notice went to which user for which period) seeds the ledger before its first `deliverOnce` or
+campaign run; otherwise that run mails everyone again. Map each record to the scope the module
+will use for it and import:
+
+```ts
+import { importDeliveries } from "@softure-ai/mailing/server";
+
+const result = await importDeliveries(ctx, [
+  { scope: "campaign:2026-09-launch", address: "ada@example.org", status: "sent", finishedAt: "2026-09-20T10:15:00Z", kind: "newsletter" },
+  { scope: "account.trial-ending:user_7", address: "bob@example.org", status: "rejected", finishedAt: row.sentAt, reason: "mailing.rejected" },
+]);
+if (!result.ok) console.error(result.problems); // [{ index, problem }]: nothing was written
+else console.log(result.value); // { rows, imported, alreadyPresent, duplicates }
+```
+
+Or from a file, one JSON object per line with the same fields:
+
+```bash
+softure-mail import history.jsonl --dry-run   # checks the file, writes nothing
+softure-mail import history.jsonl
+docker compose exec -T app npx softure-mail import - < history.jsonl   # inside the app's container
+```
+
+- Rows: `scope`, `address` (only its key is stored), `status` (`sent` or `rejected`), `finishedAt`
+  (a date or ISO string, not in the future), optional `providerMessageId` (sent rows; history
+  rarely kept it, and an imported sent row may go without), `reason` (rejected rows: one of
+  `mailing.invalid_input`, `rejected`, `unavailable`, `suppressed`; default `mailing.rejected`) and
+  `kind` (default `transactional`).
+- **Every row is checked before anything is written**; problems name the row (the file's line) and
+  the field, never the address.
+- **Idempotent.** A row whose scope and recipient the ledger already has (imported earlier, or sent
+  by the module) is left as it is and counted as `alreadyPresent`; re-run the same import after a
+  failure. Two input rows for the same scope and recipient count once (`duplicates`).
+- Imported rows are closed (`sent` or `rejected`), with `imported_at` set and no `campaign_id`:
+  `deliverOnce`, `planCampaign` and `sendCampaign` match a delivery by scope, so they skip it.
+- Unsubscribes the app recorded go to `suppressRecipient`, not here: the suppression list is what
+  stops future campaigns.
+
 ### Campaigns: `softure-mail campaign`
 
 A campaign is one list mail to many recipients through the ledger. The content file is frontmatter
@@ -160,6 +205,25 @@ softure-mail campaign launch.md --recipients recipients.txt              # sends
 ```
 
 - The recipients file holds one address per line (`#` comments and blank lines skipped).
+- **Recipients from the database.** Without `--recipients` the command asks
+  `mailing({ listCampaignRecipients })`, which lists the addresses from the app's own data
+  (duplicates are fine; the filter and the suppression list still apply):
+
+  ```ts
+  listCampaignRecipients: async ({ kind }, ctx) => listOptedInAddresses(ctx.db, kind),
+  ```
+
+- **Where it runs.** The command needs the database (the ledger) and the provider key, so it runs
+  where both are: inside the app's container. When the database is not reachable from the
+  operator's machine, send the content file on standard input (`-`) and let the recipients come
+  from `listCampaignRecipients` (or pass `--recipients -` with the content as a file in the image):
+
+  ```bash
+  ssh app-host 'cd /srv/app && docker compose exec -T app npx softure-mail campaign - --dry-run' < launch.md
+  ssh app-host 'cd /srv/app && docker compose exec -T app npx softure-mail campaign -' < launch.md
+  ```
+
+  With the content on standard input, its `html:` file is looked up in the working directory.
 - The command loads `softure.config.*` like `softure migrate` (or `--config <file>`), opens the
   config's `database.handle` when set, otherwise its own connection on `database.url`, and needs `MAILING_UNSUBSCRIBE_SECRET` (campaigns are list
   mail). Run `softure migrate` first.
@@ -192,15 +256,32 @@ softure-mail campaign launch.md --recipients recipients.txt              # sends
 ### Sender DNS check: `softure-mail dns`
 
 ```bash
-softure-mail dns                                       # the domain of `from` in the config
+softure-mail dns                                       # the domain of `from` (and replyTo) in the config
 softure-mail dns --domain mail.example.com --spf-host send.mail.example.com
+softure-mail dns --spf-host send.mail.example.com --resend-return-path \
+  --dmarc-policy reject --dmarc-sp reject --dmarc-adkim s --dmarc-aspf s
 ```
 
-It reads TXT records and reports each check as `pass`, `warn` or `fail`, exiting 1 on any `fail`:
-SPF (one `v=spf1` record on the domain or each `--spf-host`; `+all` warns), DKIM (a non-empty `p=`
-at `<selector>._domainkey.<domain>`; selector `resend` unless `--dkim-selector` is given) and DMARC
-(`_dmarc.<domain>` or a parent domain's record; `p=none` warns: it only reports). Resend publishes
-SPF on `send.<domain>`. It cannot see whether the provider signs with the published key.
+It reports each check as `pass`, `warn` or `fail`, exiting 1 on any `fail`:
+
+- **SPF**: one `v=spf1` record on the domain or each `--spf-host`; `+all` warns. Resend publishes SPF on
+  `send.<domain>`.
+- **DKIM**: a non-empty `p=` at `<selector>._domainkey.<domain>`; selector `resend` unless `--dkim-selector` is given.
+- **DMARC**: `_dmarc.<domain>` or a parent domain's record; `p=none` warns: it only reports. With a required minimum
+  (`expectDmarc: { policy, subdomainPolicy, adkim, aspf }`, or the `--dmarc-*` flags) a weaker record fails as
+  `weak`: `p=quarantine` where `reject` is required, `adkim=r` (or no `adkim`) where `s` is required, `pct` under 100
+  when a policy is required. A stricter record passes, so adding `rua=` or tightening a tag never turns it red. For
+  an inherited record the domain's policy is `sp`, else `p`.
+- **REPLY** (when `replyTo` is configured and `--domain` is not given, or with `--reply-to`; `replyTo` option of the
+  function): the reply domain must have MX records that are not a null MX (`0 .`, "accepts no mail") and at most one
+  SPF record. Without it replies bounce while every sender check is green.
+- **PATH** (`returnPath: [{ host, targetDomain? }]`, `--return-path <host>`, `--resend-return-path`): each host must
+  be a CNAME (to `targetDomain` or under it, when set) or have MX records. `resendReturnPath(domain)` (the flag) gives
+  Resend's `send.<domain>` and `rsend.<domain>` with target `rmta.net`; a domain Resend set up with MX records on
+  `send` and no `rsend` checks `--return-path send.<domain>` alone.
+
+It cannot see whether the provider signs with the published key. The function takes `resolveTxt`, `resolveMx` and
+`resolveCname` for tests; by default it asks the system resolver.
 
 ## 2. Installation
 
@@ -232,7 +313,10 @@ mailing({
 | `timeoutMs` | `number` | `10000` | 1000 to 60000. |
 | `onUnsubscribed` | `(event, ctx) => Promise<void>` | — | Runs on every verified unsubscribe, in its transaction (section 10). |
 | `legacyUnsubscribe` | `{ params, verify }` | — | Verifies unsubscribe links the app sent before it adopted the module (section 10). |
+| `oneClickInvalidLinkStatus` | `200 \| 400` | `400` | What the one-click route answers for a link that does not verify. `200` gives no oracle on whether a token is live; a failure still answers 500, and the page still shows its message. |
 | `filterCampaignRecipient` | `(recipient, ctx) => Promise<boolean>` | — | Decides per recipient whether a campaign goes to them (section 1, Campaigns). |
+| `listCampaignRecipients` | `(campaign, ctx) => Iterable<string> \| AsyncIterable<string> \| Promise<Iterable<string>>` | — | Lists a campaign's recipients from the app's data; `softure-mail campaign` uses it without `--recipients` (section 1, Campaigns). |
+| `maxAttempts` | `number \| null` | `5` | Claims before `mailing.unavailable` closes a delivery as rejected, 1 to 100; `null` never closes it (section 1, Retries). |
 | `staleClaimMs` | `number` | `900000` (15 min) | How long a delivery claim may stay open before another sender takes it over. 1 minute to 23 hours. |
 | `uncertainClaimMs` | `number` | `82800000` (23 h) | How old a claim may get before it waits for an operator (`uncertain`). More than `staleClaimMs`, at most 30 days; keep it under the provider's idempotency window. |
 | `routes` | `{ unsubscribe?, oneClick? }` | `/unsubscribe`, `/api/mailing/unsubscribe` | Where you mount the page and the route; links are built on `appOrigin` plus these paths. |
@@ -292,8 +376,9 @@ Schema `mailing`, applied by `softure migrate`:
 | --- | --- | --- |
 | `0001_create_suppressions.sql` | `mailing.suppressions` | `recipient_key` (primary key, 43-character base64url), `source` (`one-click`, `page`, `operator`), `created_at`. One row per address, the first opt-out kept. |
 | `0002_create_campaigns_and_deliveries.sql` | `mailing.campaigns` | `id` (kebab-case), `kind` (never `transactional`), `subject`, `content_hash` (sha256 of kind, subject and bodies), `created_at`. |
-| | `mailing.deliveries` | primary key (`scope`, `recipient_key`), `kind`, `campaign_id` (then `scope` is `campaign:<id>`), `status` (`pending`, `claimed`, `sent`, `rejected`), `attempts`, `claimed_at`, `finished_at`, `provider_message_id` (exactly when sent), `reason` (exactly when rejected). |
+| | `mailing.deliveries` | primary key (`scope`, `recipient_key`), `kind`, `campaign_id` (then `scope` is `campaign:<id>`), `status` (`pending`, `claimed`, `sent`, `rejected`), `attempts`, `claimed_at`, `finished_at`, `provider_message_id` (exactly when sent; see `0004`), `reason` (exactly when rejected). |
 | `0003_add_delivery_provider_status.sql` | `mailing.deliveries` | `provider_status` (the HTTP status of the last failed or released answer, 100 to 599, else null); `attempts` may be 0 on a `pending` row (a halt gave its attempt back). |
+| `0004_allow_imported_deliveries.sql` | `mailing.deliveries` | `imported_at` (set by `importDeliveries`, only on `sent`/`rejected` rows); `provider_message_id` only on `sent` rows, and required there unless the row was imported. |
 
 The health check (`checkMailingTables`) runs `select 1 from mailing.<table> limit 0` for the three
 tables.
@@ -333,8 +418,9 @@ The provider is the extension point (section 3).
 
 **`onUnsubscribed(event, ctx)`** runs on every verified unsubscribe (the page's button or a mail
 client's one-click POST), also a repeated one, in the transaction that stores the opt-out:
-`event` is `{ recipientKey, source }` (the key is privacy's email key of the same address, never the
-address), `ctx.db` is the transaction. A throw rolls the opt-out back: the route answers 500 and the
+`event` is `{ recipientKey, source, link }` (the key is privacy's email key of the same address, never the
+address; `link` is `{ scheme: "signed" }` or `{ scheme: "legacy", values }` with the values `verify`
+accepted, so a hook can find the row a legacy link named), `ctx.db` is the transaction. A throw rolls the opt-out back: the route answers 500 and the
 page offers a retry, so the opt-out and what the hook records never disagree. It does not run for
 `suppressRecipient` (a bounce or a script is not the person's choice). Wire the waitlist's handler,
 which withdraws its consents in privacy's ledger:
@@ -347,9 +433,12 @@ mailing({ from: "…", provider: resend(), onUnsubscribed: withdrawWaitlistConse
 
 **`legacyUnsubscribe: { params, verify }`** keeps unsubscribe links working that the app sent
 before it adopted the module, in its own scheme (an HMAC over a sign-up id, say, on its own path).
-`params` are the old link's query names (1 to 8; never `r` or `status`, which the module's links and
-page own; `t` may be shared). A link without `r` that carries every one of them (non-empty, at most
-512 characters) is a legacy link: the page shows the same button with the values in hidden fields,
+`params` are the old link's query names (never `r` or `status`, which the module's links and page
+own; `t` may be shared). An array names parameters the link must all carry; `{ required, optional }`
+also names ones it may carry, for an app that sent more than one form on the same path (at most 8
+names in all, at least one required). A link without `r` that carries every required one
+(non-empty, at most 512 characters) is a legacy link, and its values also hold the optional ones it
+has (an empty one counts as absent, one over 512 characters makes the link invalid): the page shows the same button with the values in hidden fields,
 and the action and the one-click POST call `verify(values, ctx)`. It returns the recipient's
 **address** when the link is genuine, else `null`; the module records the opt-out under that
 address's key and runs `onUnsubscribed`, exactly as for its own links. `verify` must check the
@@ -368,6 +457,25 @@ mailing({
 export { UnsubscribePage as default } from "@softure-ai/mailing/next";
 ```
 
+Two forms on one path (a signed `?u=<id>&t=<hmac>` in mail and a bare `?t=<token>` shown after
+sign-up), an opt-out recorded on the app's own row, and a one-click route that never tells a live
+token from a dead one:
+
+```ts
+mailing({
+  from: "…",
+  provider: resend(),
+  oneClickInvalidLinkStatus: 200,
+  legacyUnsubscribe: {
+    params: { required: ["t"], optional: ["u"] },
+    verify: ({ u, t }, ctx) => (u === undefined ? findAddressByToken(ctx.db, t) : verifyOldLink(ctx.db, u, t)),
+  },
+  onUnsubscribed: async (event, ctx) => {
+    if (event.link.scheme === "legacy") await markSignupUnsubscribed(ctx.db, event.link.values);
+  },
+}),
+```
+
 **`liftSuppression(ctx, address)`** is the other direction: a module that has just recorded a new
 explicit consent (the waitlist's sign-up) calls it in that consent's transaction. It deletes the
 row only when its source is `page` or `one-click`; an `operator` row stays. It returns whether it

package/dist/cli/run.d.ts

@@ -1,13 +1,13 @@
 import { type SoftureConfig } from "@softure-ai/core";
 import { type DatabaseHandle } from "@softure-ai/db";
-import { type ResolveTxt } from "../server/dns.js";
+import { type ResolveCname, type ResolveMx, type ResolveTxt } from "../server/dns.js";
 import { type Env } from "../server/unsubscribe-link.js";
 export interface CliOutput {
     readonly log: (line: string) => void;
     readonly error: (line: string) => void;
 }
 export interface RunMailCliOptions {
-    /** The app's config. Needed by `campaign`, and by `dns` without `--domain`. */
+    /** The app's config. Needed by `campaign` and `import`, and by `dns` without `--domain`. */
     readonly config?: SoftureConfig;
     /** The arguments after the executable, e.g. `["campaign", "launch.md", "--recipients", "list.txt"]`. */
     readonly argv: readonly string[];
@@ -17,8 +17,12 @@ export interface RunMailCliOptions {
     /** Opens the campaign's database connection. Default: the config's `database.handle`, else `createDatabase(url, { max: 1 })`. */
     readonly openDatabase?: (url: string) => Promise<DatabaseHandle>;
     readonly resolveTxt?: ResolveTxt;
+    readonly resolveMx?: ResolveMx;
+    readonly resolveCname?: ResolveCname;
     readonly sleep?: (ms: number) => Promise<void>;
     readonly env?: Env;
+    /** Reads all of standard input, for a file given as `-`. Default: `process.stdin`. */
+    readonly readStdin?: () => Promise<string>;
 }
 export declare const EXIT_OK = 0;
 export declare const EXIT_FAILED = 1;

package/dist/cli/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/cli/run.ts"],"names":[],"mappings":"AAWA,OAAO,EAAe,KAAK,aAAa,EAA8B,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAA6C,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAIhG,OAAO,EAAkD,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnG,OAAO,EAAiF,KAAK,GAAG,EAAE,MAAM,+BAA+B,CAAC;AAExI,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,iBAAiB;IAChC,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC,wGAAwG;IACxG,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,mEAAmE;IACnE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B,iIAAiI;IACjI,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC;CACpB;AAED,eAAO,MAAM,OAAO,IAAI,CAAC;AACzB,eAAO,MAAM,WAAW,IAAI,CAAC;AAC7B,eAAO,MAAM,UAAU,IAAI,CAAC;AAE5B,8EAA8E;AAC9E,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAEpC,eAAO,MAAM,UAAU,QAqBa,CAAC;AAmBrC,yGAAyG;AACzG,wBAAsB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB5E"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/cli/run.ts"],"names":[],"mappings":"AAWA,OAAO,EAAe,KAAK,aAAa,EAA8B,MAAM,kBAAkB,CAAC;AAE/F,OAAO,EAA6C,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAIhG,OAAO,EAAkI,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,KAAK,UAAU,EAAuB,MAAM,kBAAkB,CAAC;AAG3O,OAAO,EAAiF,KAAK,GAAG,EAAE,MAAM,+BAA+B,CAAC;AAExI,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,iBAAiB;IAChC,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC,wGAAwG;IACxG,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,mEAAmE;IACnE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAC5B,iIAAiI;IACjI,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACjE,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC;IACnB,sFAAsF;IACtF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5C;AAED,eAAO,MAAM,OAAO,IAAI,CAAC;AACzB,eAAO,MAAM,WAAW,IAAI,CAAC;AAC7B,eAAO,MAAM,UAAU,IAAI,CAAC;AAE5B,8EAA8E;AAC9E,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAEpC,eAAO,MAAM,UAAU,QA6C8C,CAAC;AAqCtE,yGAAyG;AACzG,wBAAsB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmB5E"}