@tsdmarc/opensearch 0.0.0-stage → 1.0.0

package/dist/index.js

@@ -0,0 +1,1931 @@
+import { InvalidFailureReport, PyDateTime, camelToSnake, humanTimestampToDatetime, logger, parseDate, pyRepr, pyStr, rawJsonIntegers, redactUrlCredentials, sanitizeForLog } from "tsdmarc";
+import { readFile } from "node:fs/promises";
+import { Client, Transport, errors } from "@opensearch-project/opensearch";
+// ../search-common/src/python.ts
+const ASCII_INT = /^[+-]?\d+(?:_\d+)*$/u;
+/** Python's `KeyError`: a missing key in a report dict. */
+var KeyError = class extends Error {
+	name = "KeyError";
+	key;
+	constructor(key) {
+		super(pyRepr(key));
+		this.key = key;
+	}
+};
+/**
+* `target[key] = value` as a Python dict does it: an own enumerable
+* property even for keys from report data like `__proto__`, which plain
+* assignment would turn into a prototype change (and drop).
+*/
+function setOwn(target, key, value) {
+	Object.defineProperty(target, key, {
+		configurable: true,
+		enumerable: true,
+		value,
+		writable: true
+	});
+}
+/** Python's `ValueError`. */
+var ValueError = class extends Error {
+	name = "ValueError";
+};
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* `obj[key]` with Python's KeyError for a missing key. `key` is the camelCase
+* key of the report object; the error names the snake_case key, as parsedmarc
+* reports it.
+*/
+function getKey(obj, key) {
+	if (!isRecord$1(obj) || !(key in obj)) throw new KeyError(camelToSnake(key));
+	return obj[key];
+}
+/** Python's truthiness (`bool(value)`). */
+function pyBool(value) {
+	if (value === null || value === void 0 || value === false) return false;
+	if (typeof value === "number") return value !== 0 && !Number.isNaN(value);
+	if (typeof value === "bigint") return value !== 0n;
+	if (typeof value === "string" || Array.isArray(value)) return value.length > 0;
+	if (isRecord$1(value)) return Object.keys(value).length > 0;
+	return true;
+}
+/** A safe integer as a number, anything larger as an exact bigint. */
+function exactInt(value) {
+	return value >= BigInt(Number.MIN_SAFE_INTEGER) && value <= BigInt(Number.MAX_SAFE_INTEGER) ? Number(value) : value;
+}
+/**
+* Python's `int(value)` for the values reports carry (ASCII digits). Exact,
+* like Python's unbounded ints: beyond 2^53 the result is a `bigint`.
+*/
+function pyInt(value) {
+	if (typeof value === "boolean") return value ? 1 : 0;
+	if (typeof value === "bigint") return exactInt(value);
+	if (typeof value === "number") {
+		if (!Number.isFinite(value)) throw new ValueError(`cannot convert float ${Number.isNaN(value) ? "NaN" : "infinity"} to integer`);
+		return exactInt(BigInt(Math.trunc(value)));
+	}
+	if (typeof value === "string") {
+		const text = value.trim();
+		if (ASCII_INT.test(text)) return exactInt(BigInt(text.replaceAll("_", "")));
+		throw new ValueError(`invalid literal for int() with base 10: ${pyRepr(value)}`);
+	}
+	throw new ValueError(`int() argument must be a string, a bytes-like object or a real number, not '${typeof value}'`);
+}
+/** `str(error)`: the message of an error, or the value itself. */
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+// ../search-common/src/ip.ts
+const HEXTET_COUNT = 8;
+const MAX_IPV6_LENGTH = 45;
+const HEX_DIGITS = /^[0-9a-f]*$/iu;
+const DECIMAL_DIGITS = /^\d+$/u;
+const IPV4_MAPPED_PREFIX = 65535;
+/** Parse a dotted-quad IPv4 address (strict, like Python), or `null`. */
+function parseIpv4(text) {
+	if (text === "" || text.includes("/")) return null;
+	const octets = text.split(".");
+	if (octets.length !== 4) return null;
+	const values = [];
+	for (const octet of octets) {
+		if (!DECIMAL_DIGITS.test(octet) || octet.length > 3) return null;
+		if (octet !== "0" && octet.startsWith("0")) return null;
+		const value = Number(octet);
+		if (value > 255) return null;
+		values.push(value);
+	}
+	return values;
+}
+function parseHextet(text) {
+	if (text === "" || !HEX_DIGITS.test(text) || text.length > 4) return null;
+	return Number.parseInt(text, 16);
+}
+/** Python's `_BaseV6._ip_int_from_string`, as 8 hextets, or `null`. */
+function parseIpv6Hextets(text) {
+	if (text === "" || text.length > MAX_IPV6_LENGTH) return null;
+	const maxParts = 9;
+	const parts = text.split(":");
+	if (parts.length > 10) return null;
+	if (parts.length < 3) return null;
+	const last = parts.at(-1) ?? "";
+	if (last.includes(".")) {
+		const ipv4 = parseIpv4(last);
+		if (ipv4 === null) return null;
+		parts.pop();
+		const [a = 0, b = 0, c = 0, d = 0] = ipv4;
+		parts.push((a << 8 | b).toString(16), (c << 8 | d).toString(16));
+	}
+	if (parts.length > maxParts) return null;
+	let skipIndex = null;
+	for (let index = 1; index < parts.length - 1; index++) if (parts[index] === "") {
+		if (skipIndex !== null) return null;
+		skipIndex = index;
+	}
+	let partsHi;
+	let partsLo;
+	let partsSkipped;
+	if (skipIndex === null) {
+		if (parts.length !== HEXTET_COUNT || parts[0] === "" || last === "") return null;
+		partsHi = parts.length;
+		partsLo = 0;
+		partsSkipped = 0;
+	} else {
+		partsHi = skipIndex;
+		partsLo = parts.length - skipIndex - 1;
+		if (parts[0] === "") {
+			partsHi -= 1;
+			if (partsHi !== 0) return null;
+		}
+		if (parts.at(-1) === "") {
+			partsLo -= 1;
+			if (partsLo !== 0) return null;
+		}
+		partsSkipped = HEXTET_COUNT - (partsHi + partsLo);
+		if (partsSkipped < 1) return null;
+	}
+	const hextets = [];
+	for (let index = 0; index < partsHi; index++) {
+		const value = parseHextet(parts[index] ?? "");
+		if (value === null) return null;
+		hextets.push(value);
+	}
+	for (let index = 0; index < partsSkipped; index++) hextets.push(0);
+	for (let index = parts.length - partsLo; index < parts.length; index++) {
+		const value = parseHextet(parts[index] ?? "");
+		if (value === null) return null;
+		hextets.push(value);
+	}
+	return hextets;
+}
+/** Python's `_compress_hextets`: replace the longest run of zeros with `::`. */
+function compressHextets(hextets) {
+	let bestStart = -1;
+	let bestLength = 0;
+	let start = -1;
+	let length = 0;
+	hextets.forEach((hextet, index) => {
+		if (hextet === 0) {
+			length += 1;
+			if (start === -1) start = index;
+			if (length > bestLength) {
+				bestLength = length;
+				bestStart = start;
+			}
+		} else {
+			length = 0;
+			start = -1;
+		}
+	});
+	const parts = hextets.map((hextet) => hextet.toString(16));
+	if (bestLength > 1) {
+		const end = bestStart + bestLength;
+		const head = parts.slice(0, bestStart);
+		const tail = parts.slice(end);
+		return `${head.join(":")}::${tail.join(":")}`;
+	}
+	return parts.join(":");
+}
+function formatIpv6(text) {
+	if (text.includes("/")) return null;
+	const percent = text.indexOf("%");
+	let address = text;
+	let scopeId = null;
+	if (percent !== -1) {
+		scopeId = text.slice(percent + 1);
+		address = text.slice(0, percent);
+		if (scopeId === "" || scopeId.includes("%")) return null;
+	}
+	const hextets = parseIpv6Hextets(address);
+	if (hextets === null) return null;
+	const isIpv4Mapped = hextets.slice(0, 5).every((hextet) => hextet === 0) && hextets[5] === IPV4_MAPPED_PREFIX;
+	const [high = 0, low = 0] = hextets.slice(6);
+	const formatted = isIpv4Mapped ? `::ffff:${high >> 8}.${high & 255}.${low >> 8}.${low & 255}` : compressHextets(hextets);
+	return scopeId ? `${formatted}%${scopeId}` : formatted;
+}
+/**
+* Validate an IP address and return Python's canonical string for it.
+*
+* @throws {ValueError} `'<value>' does not appear to be an IPv4 or IPv6 address`
+*/
+function normalizeIpAddress(value) {
+	const ipv4 = parseIpv4(value);
+	if (ipv4 !== null) return ipv4.join(".");
+	const ipv6 = formatIpv6(value);
+	if (ipv6 !== null) return ipv6;
+	throw new ValueError(`${pyRepr(value)} does not appear to be an IPv4 or IPv6 address`);
+}
+// ../search-common/src/dsl.ts
+const MS_PER_SECOND$1 = 1e3;
+function isObjectField(field) {
+	return field.type === "object" || field.type === "nested";
+}
+function isPlainObject(value) {
+	if (value === null || typeof value !== "object") return false;
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === Object.prototype || prototype === null;
+}
+/** `value in ([], {}, None)`: what `to_dict(skip_empty=True)` leaves out. */
+function isEmptyValue(value) {
+	if (value === null || value === void 0) return true;
+	if (Array.isArray(value)) return value.length === 0;
+	return isPlainObject(value) && Object.keys(value).length === 0;
+}
+/** The DSL's `Date._deserialize`, then the JSON serializer's `isoformat()`. */
+function serializeDate(value) {
+	if (value instanceof PyDateTime) return value.isoformat();
+	if (typeof value === "string") return parseDate(value).isoformat();
+	if (typeof value === "number" && Number.isInteger(value)) return PyDateTime.fromTimestamp(value / MS_PER_SECOND$1, true).withOffset(null).isoformat();
+	throw new ValueError(`Could not parse date from the value (${pyRepr(value)})`);
+}
+/**
+* A report value as a text field holds it. The parser leaves an element with
+* children as an object; left alone it would map the field as an object in
+* the index (rejecting every later text value) and turn into parameters of
+* the duplicate search.
+*/
+function textValue(value) {
+	return isPlainObject(value) ? pyStr(value) : value;
+}
+/**
+* `value`, or `null` with a warning when `clean` rejects it. For values a
+* sender controls and the parser accepts: the DSL's ValueError would fail the
+* save of the whole report on every retry, for one field nothing depends on.
+*/
+function validOrNull(value, field, clean) {
+	if (value === null || value === void 0) return value;
+	try {
+		clean(value);
+		return value;
+	} catch (error) {
+		if (!(error instanceof ValueError)) throw error;
+		logger.warning(`Dropping ${field} from a report: ${sanitizeForLog(errorMessage(error))}`);
+		return null;
+	}
+}
+/** `value` if an `Ip()` field can hold it, otherwise `null` (see above). */
+function ipOrNull(value, field) {
+	return validOrNull(value, field, (item) => normalizeIpAddress(String(item)));
+}
+/** `value` if an `Integer()` field can hold it, otherwise `null` (see above). */
+function integerOrNull(value, field) {
+	return validOrNull(value, field, pyInt);
+}
+function serializeScalar(field, value) {
+	switch (field.type) {
+		case "integer": return pyInt(value);
+		case "boolean": return value === "false" ? false : pyBool(value);
+		case "date": return serializeDate(value);
+		case "ip": return normalizeIpAddress(String(value));
+		default: return textValue(value);
+	}
+}
+function serializeOne(field, value) {
+	if (isObjectField(field)) return isPlainObject(value) ? serializeDocument(field.properties ?? {}, value) : value;
+	return serializeScalar(field, value);
+}
+function serializeField(field, value) {
+	if (Array.isArray(value)) return value.map((item) => item === null || item === void 0 ? null : serializeOne(field, item));
+	return serializeOne(field, value);
+}
+/**
+* Clean and serialize a document like `Document.save()` does: declared
+* fields are converted to their type, undeclared fields are kept as they
+* are, and empty values are dropped. Throws like the DSL does for values a
+* field cannot hold (an invalid IP address, a non-numeric integer), except
+* objects in text fields (see {@link textValue}).
+*/
+function serializeDocument(schema, data) {
+	const out = {};
+	for (const [key, value] of Object.entries(data)) {
+		const field = Object.hasOwn(schema, key) ? schema[key] : void 0;
+		const serialized = field === void 0 || value === null || value === void 0 ? value : serializeField(field, value);
+		if (!isEmptyValue(serialized)) setOwn(out, key, serialized);
+	}
+	return out;
+}
+function fieldMapping(field) {
+	if (isObjectField(field)) {
+		if (field.properties === void 0) return { type: field.type };
+		return {
+			...schemaMapping(field.properties),
+			type: field.type
+		};
+	}
+	const mapping = { type: field.type };
+	if (field.fields !== void 0) mapping.fields = structuredClone(field.fields);
+	return mapping;
+}
+/** The mapping a DSL class declares (`Document._doc_type.mapping.to_dict()`). */
+function schemaMapping(schema) {
+	const properties = {};
+	for (const [name, field] of Object.entries(schema)) properties[name] = fieldMapping(field);
+	return { properties };
+}
+function indexProperties(schema) {
+	const properties = {};
+	for (const [name, field] of Object.entries(schema)) if (field.type === "date") properties[name] = { type: "date" };
+	else if (isObjectField(field) && field.indexMapping !== void 0) properties[name] = structuredClone(field.indexMapping);
+	else if (field.type === "object" && field.properties !== void 0) {
+		const inner = indexProperties(field.properties);
+		if (Object.keys(inner).length > 0) properties[name] = { properties: inner };
+	}
+	return properties;
+}
+/**
+* The field parsedmarc 11.2 adds to every saved document: the date that
+* picks the dated index (or that a data stream sorts by). Not declared on
+* the DSL classes, so it is serialized as given (an ISO 8601 string).
+*/
+const TIMESTAMP_FIELD = "@timestamp";
+/**
+* What the index template of a data stream maps without other mappings
+* (parsedmarc's `create_data_streams()`): only {@link TIMESTAMP_FIELD}.
+*/
+const TIMESTAMP_MAPPING = { properties: { [TIMESTAMP_FIELD]: { type: "date" } } };
+/**
+* The mappings of an index the save functions create: the declared date
+* fields, and date detection off. Otherwise the first document of an index
+* decides whether a text field is a date (`<report_id>2026-11-01</report_id>`),
+* and the index name comes from a date the sender picks too, so one report can
+* break the indexes of days to come. Plus the `indexMapping` of object fields
+* that carry one. Nothing else is declared: the dashboards need the dynamic
+* `object` mapping of the rest (see `createIndexes()`). With date detection
+* off, `@timestamp` is declared too (see {@link TIMESTAMP_FIELD}).
+*/
+function indexMapping(schema) {
+	return {
+		date_detection: false,
+		properties: {
+			...TIMESTAMP_MAPPING.properties,
+			...indexProperties(schema)
+		}
+	};
+}
+/**
+* The mappings of a data stream's index template: `mappings` (such as the
+* ones the save functions create dated indexes with) with
+* {@link TIMESTAMP_FIELD} as a date, which a data stream requires, or only
+* that field.
+*/
+function dataStreamMapping(mappings) {
+	if (mappings === null) return structuredClone(TIMESTAMP_MAPPING);
+	return {
+		...structuredClone(mappings),
+		properties: {
+			...structuredClone(mappings.properties),
+			...structuredClone(TIMESTAMP_MAPPING.properties)
+		}
+	};
+}
+/**
+* `q1 & q2 & ...`: the DSL combines queries into one `bool.must` list; a
+* single query stays as it is.
+*/
+function andQueries(queries) {
+	const [first] = queries;
+	if (queries.length === 1 && first !== void 0) return first;
+	return { bool: { must: [...queries] } };
+}
+/** Append to a list field, creating it on first use (an `AttrList`). */
+function appendTo(doc, key, value) {
+	const current = doc[key];
+	if (Array.isArray(current)) current.push(value);
+	else doc[key] = [value];
+}
+// ../search-common/src/documents.ts
+const TEXT = { type: "text" };
+const KEYWORD = { type: "keyword" };
+const INTEGER = { type: "integer" };
+const BOOLEAN = { type: "boolean" };
+const DATE = { type: "date" };
+const IP = { type: "ip" };
+/** `Text(multi=True, fields={"keyword": Keyword(ignore_above=256)})`. */
+const COMBINED_TEXT = {
+	type: "text",
+	fields: { keyword: {
+		type: "keyword",
+		ignore_above: 256
+	} }
+};
+/** `_AggregateReportDoc` (index `dmarc_aggregate`). */
+const AGGREGATE_REPORT_DOC = {
+	xml_schema: TEXT,
+	xml_namespace: KEYWORD,
+	org_name: TEXT,
+	org_email: TEXT,
+	org_extra_contact_info: TEXT,
+	report_id: TEXT,
+	date_range: DATE,
+	date_begin: DATE,
+	date_end: DATE,
+	normalized_timespan: BOOLEAN,
+	errors: TEXT,
+	published_policy: {
+		type: "object",
+		properties: {
+			domain: TEXT,
+			adkim: TEXT,
+			aspf: TEXT,
+			p: TEXT,
+			sp: TEXT,
+			pct: INTEGER,
+			fo: TEXT,
+			np: KEYWORD,
+			testing: KEYWORD,
+			discovery_method: KEYWORD
+		}
+	},
+	source_ip_address: IP,
+	source_country: TEXT,
+	source_reverse_dns: TEXT,
+	source_base_domain: TEXT,
+	source_type: TEXT,
+	source_name: TEXT,
+	source_asn: INTEGER,
+	source_as_name: TEXT,
+	source_as_domain: TEXT,
+	disposition: TEXT,
+	dkim_aligned: BOOLEAN,
+	spf_aligned: BOOLEAN,
+	passed_dmarc: BOOLEAN,
+	policy_overrides: {
+		type: "nested",
+		properties: {
+			type: TEXT,
+			comment: TEXT
+		}
+	},
+	header_from: TEXT,
+	envelope_from: TEXT,
+	envelope_to: TEXT,
+	dkim_results: {
+		type: "nested",
+		properties: {
+			domain: TEXT,
+			selector: TEXT,
+			result: TEXT,
+			human_result: TEXT
+		}
+	},
+	spf_results: {
+		type: "nested",
+		properties: {
+			domain: TEXT,
+			scope: TEXT,
+			result: TEXT,
+			human_result: TEXT
+		}
+	},
+	dkim_results_combined: COMBINED_TEXT,
+	spf_results_combined: COMBINED_TEXT,
+	np: KEYWORD,
+	testing: KEYWORD,
+	discovery_method: KEYWORD,
+	generator: TEXT
+};
+const EMAIL_ADDRESS_DOC = {
+	display_name: TEXT,
+	address: TEXT
+};
+/** `_EmailAttachmentDoc`. */
+const EMAIL_ATTACHMENT_DOC = {
+	filename: TEXT,
+	content_type: TEXT,
+	sha256: TEXT
+};
+/** `_FailureReportDoc` (index `dmarc_failure`). */
+const FAILURE_REPORT_DOC = {
+	feedback_type: TEXT,
+	user_agent: TEXT,
+	version: TEXT,
+	original_mail_from: TEXT,
+	arrival_date: DATE,
+	domain: TEXT,
+	original_envelope_id: TEXT,
+	authentication_results: TEXT,
+	delivery_results: TEXT,
+	source_ip_address: IP,
+	source_country: TEXT,
+	source_reverse_dns: TEXT,
+	source_asn: INTEGER,
+	source_as_name: TEXT,
+	source_as_domain: TEXT,
+	source_authentication_mechanisms: TEXT,
+	source_auth_failures: TEXT,
+	dkim_domain: TEXT,
+	original_rcpt_to: TEXT,
+	sample: {
+		type: "object",
+		properties: {
+			raw: TEXT,
+			headers: {
+				type: "object",
+				indexMapping: {
+					dynamic: false,
+					properties: Object.fromEntries([
+						"authentication-results",
+						"auto-submitted",
+						"cc",
+						"content-transfer-encoding",
+						"content-type",
+						"date",
+						"delivered-to",
+						"dkim-signature",
+						"from",
+						"in-reply-to",
+						"list-id",
+						"message-id",
+						"mime-version",
+						"received",
+						"received-spf",
+						"references",
+						"reply-to",
+						"return-path",
+						"sender",
+						"subject",
+						"thread-index",
+						"thread-topic",
+						"to",
+						"user-agent",
+						"x-auto-response-suppress",
+						"x-exclaimer-md-config",
+						"x-linkedin-fe",
+						"x-mailer",
+						"x-ms-exchange-generated-message-source",
+						"x-ms-exchange-inbox-rules-loop",
+						"x-ms-exchange-parent-message-id",
+						"x-ms-exchange-transport-fromentityheader",
+						"x-ms-has-attach",
+						"x-ms-tnef-correlator",
+						"x-onpremexternalip",
+						"x-originating-ip"
+					].map((name) => [name, {
+						type: "text",
+						fields: { keyword: {
+							type: "keyword",
+							ignore_above: 256
+						} }
+					}]))
+				}
+			},
+			headers_only: BOOLEAN,
+			to: {
+				type: "nested",
+				properties: EMAIL_ADDRESS_DOC
+			},
+			subject: TEXT,
+			filename_safe_subject: TEXT,
+			_from: {
+				type: "object",
+				properties: EMAIL_ADDRESS_DOC
+			},
+			date: DATE,
+			reply_to: {
+				type: "nested",
+				properties: EMAIL_ADDRESS_DOC
+			},
+			cc: {
+				type: "nested",
+				properties: EMAIL_ADDRESS_DOC
+			},
+			bcc: {
+				type: "nested",
+				properties: EMAIL_ADDRESS_DOC
+			},
+			body: TEXT,
+			attachments: {
+				type: "nested",
+				properties: EMAIL_ATTACHMENT_DOC
+			}
+		}
+	}
+};
+/** `_SMTPTLSReportDoc` (index `smtp_tls`). */
+const SMTP_TLS_REPORT_DOC = {
+	organization_name: TEXT,
+	date_range: DATE,
+	date_begin: DATE,
+	date_end: DATE,
+	contact_info: TEXT,
+	report_id: TEXT,
+	policies: {
+		type: "nested",
+		properties: {
+			policy_domain: TEXT,
+			policy_type: TEXT,
+			policy_strings: TEXT,
+			mx_host_patterns: TEXT,
+			successful_session_count: INTEGER,
+			failed_session_count: INTEGER,
+			failure_details: {
+				type: "nested",
+				properties: {
+					result_type: TEXT,
+					sending_mta_ip: IP,
+					receiving_mx_helo: TEXT,
+					receiving_mx_hostname: TEXT,
+					receiving_ip: IP,
+					failed_session_count: INTEGER,
+					additional_information_uri: TEXT,
+					failure_reason_code: TEXT
+				}
+			}
+		}
+	},
+	policies_combined: COMBINED_TEXT,
+	failure_details_combined: COMBINED_TEXT
+};
+/**
+* The mappings parsedmarc's document classes declare. `createIndexes()`
+* does not install them (neither does parsedmarc): the shipped dashboards
+* rely on dynamic mapping. They are exported for reference and for users
+* who manage index templates themselves.
+*/
+const DOCUMENT_MAPPINGS = {
+	aggregate: schemaMapping(AGGREGATE_REPORT_DOC),
+	failure: schemaMapping(FAILURE_REPORT_DOC),
+	smtpTls: schemaMapping(SMTP_TLS_REPORT_DOC)
+};
+/** What the save functions create indexes with (see `indexMapping()`). */
+const INDEX_MAPPINGS = {
+	aggregate: indexMapping(AGGREGATE_REPORT_DOC),
+	failure: indexMapping(FAILURE_REPORT_DOC),
+	smtpTls: indexMapping(SMTP_TLS_REPORT_DOC)
+};
+// ../search-common/src/resume.ts
+/**
+* The fields that tell the documents of one report apart. Enrichment
+* (reverse DNS, GeoIP, source name and type) is left out: its answers
+* change between attempts.
+*/
+const AGGREGATE_RECORD_FIELDS = [
+	"date_begin",
+	"date_end",
+	"source_ip_address",
+	"message_count",
+	"disposition",
+	"dkim_aligned",
+	"spf_aligned",
+	"header_from",
+	"envelope_from",
+	"envelope_to",
+	"dkim_results_combined",
+	"spf_results_combined"
+];
+/**
+* Most records a report can have to be resumed: the stored documents are
+* read in one search page, which the default `index.max_result_window`
+* limits to 10,000 hits (one more than the report is asked for).
+*/
+const MAX_RESUMABLE_RECORDS = 9999;
+function normalized(value) {
+	if (value === null || value === void 0) return null;
+	if (value instanceof PyDateTime) return value.isoformat();
+	if (Array.isArray(value)) return value.map(normalized);
+	if (typeof value === "number" || typeof value === "bigint") return String(value);
+	if (typeof value === "object") return { object: String(value) };
+	return value;
+}
+/** A serialized record document as the duplicate search returns it. */
+function fingerprint(document) {
+	const source = typeof document === "object" && document !== null ? document : {};
+	return JSON.stringify(AGGREGATE_RECORD_FIELDS.map((field) => normalized(Object.hasOwn(source, field) ? source[field] : null)));
+}
+/** Hits in a search response without `size`: Elasticsearch's default. */
+const DEFAULT_SEARCH_SIZE = 10;
+/**
+* The positions of the report's records that are already stored, when the
+* documents the duplicate search found are part of this report and some are
+* missing. `null` means the report counts as saved (parsedmarc's
+* `AlreadySaved`): every record is there, the documents found are not all
+* this report's (another report with the same identity), or there are too
+* many to compare.
+*
+* @param documents The report's documents, serialized as they are sent, in
+* record order; `null` when they can't be serialized.
+* @param found The `_source` of the hits of the duplicate search (one page
+* of the default size).
+* @param fetchStored Reads the `_source` (at least
+* {@link AGGREGATE_RECORD_FIELDS}) of up to `size` documents the duplicate
+* search matches, when `found` is a full page.
+*/
+async function findStoredRecords(documents, found, fetchStored) {
+	if (documents === null || found.length === 0 || found.length >= documents.length || documents.length > MAX_RESUMABLE_RECORDS) return null;
+	const stored = found.length < DEFAULT_SEARCH_SIZE ? found : await fetchStored(documents.length + 1);
+	if (stored.length === 0 || stored.length >= documents.length) return null;
+	const positions = /* @__PURE__ */ new Map();
+	for (const [position, document] of documents.entries()) {
+		const key = fingerprint(document);
+		const list = positions.get(key);
+		if (list === void 0) positions.set(key, [position]);
+		else list.push(position);
+	}
+	const taken = /* @__PURE__ */ new Set();
+	for (const source of stored) {
+		const position = positions.get(fingerprint(source))?.shift();
+		if (position === void 0) return null;
+		taken.add(position);
+	}
+	return taken;
+}
+// src/reindex.ts
+const DEFAULT_SCROLL = "5m";
+const SCAN_SIZE = 1e3;
+const BULK_CHUNK_SIZE = 500;
+const BULK_MAX_CHUNK_BYTES = 104857600;
+const HTTP_NOT_FOUND = 404;
+const ACTION_META_KEYS = [
+	"_id",
+	"_index",
+	"_routing"
+];
+/** Raised when a scroll request fails on some shards (helpers.ScanError). */
+var ScanError = class extends Error {
+	name = "ScanError";
+	scrollId;
+	constructor(scrollId, message) {
+		super(message);
+		this.scrollId = scrollId;
+	}
+};
+/** Raised when some documents fail to index (helpers.BulkIndexError). */
+var BulkIndexError = class extends Error {
+	name = "BulkIndexError";
+	errors;
+	constructor(message, errors) {
+		super(message);
+		this.errors = errors;
+	}
+};
+/**
+* Unlike helpers.scan(), also checked on a page without hits: when the last
+* shard with documents fails, the scroll ends in an empty page that reports
+* the failure, and stopping there would lose those documents in silence.
+*/
+function assertAllShards(response, scrollId) {
+	const shards = response._shards;
+	if (shards) {
+		const successful = shards.successful ?? 0;
+		const skipped = shards.skipped ?? 0;
+		const total = shards.total ?? 0;
+		if (successful + skipped < total) throw new ScanError(scrollId, `Scroll request has only succeeded on ${successful} (+${skipped} skipped) shards out of ${total}.`);
+	}
+}
+async function* scan(client, index, scroll) {
+	let response = (await client.search({
+		index,
+		scroll,
+		size: SCAN_SIZE,
+		body: { sort: "_doc" }
+	})).body;
+	let scrollId = response._scroll_id;
+	try {
+		while (scrollId) {
+			const hits = response.hits?.hits ?? [];
+			yield* hits;
+			assertAllShards(response, scrollId);
+			if (hits.length === 0) break;
+			response = (await client.scroll({ body: {
+				scroll_id: scrollId,
+				scroll
+			} })).body;
+			scrollId = response._scroll_id;
+		}
+	} finally {
+		if (scrollId) await client.clearScroll({ body: { scroll_id: [scrollId] } }, { ignore: [HTTP_NOT_FOUND] });
+	}
+}
+/** expand_action(): one hit → the bulk action line and the document. */
+function expandHit(hit) {
+	const meta = {};
+	for (const key of ACTION_META_KEYS) if (key in hit) meta[key] = hit[key];
+	return [{ index: meta }, rawJsonIntegers("_source" in hit ? hit._source : hit)];
+}
+async function sendChunk(client, body) {
+	const response = (await client.bulk({ body })).body;
+	if (!response.items) throw new BulkIndexError("The bulk response has no items.", []);
+	const errors = [];
+	for (const item of response.items) for (const [opType, result] of Object.entries(item)) {
+		const status = result?.status ?? 500;
+		if (status < 200 || status >= 300) errors.push({ [opType]: result });
+	}
+	if (errors.length > 0) throw new BulkIndexError(`${errors.length} document(s) failed to index.`, errors);
+}
+/**
+* Copy every document of `sourceIndex` into `targetIndex`
+* (`opensearchpy.helpers.reindex(client, source_index, target_index)`).
+*/
+async function reindex(client, sourceIndex, targetIndex) {
+	let body = [];
+	let count = 0;
+	let bytes = 0;
+	for await (const hit of scan(client, sourceIndex, DEFAULT_SCROLL)) {
+		const [action, document] = expandHit({
+			...hit,
+			_index: targetIndex
+		});
+		const size = Buffer.byteLength(JSON.stringify(action)) + Buffer.byteLength(JSON.stringify(document)) + 2;
+		if (count > 0 && (count === BULK_CHUNK_SIZE || bytes + size > BULK_MAX_CHUNK_BYTES)) {
+			await sendChunk(client, body);
+			body = [];
+			count = 0;
+			bytes = 0;
+		}
+		body.push(action, document);
+		count += 1;
+		bytes += size;
+	}
+	if (count > 0) await sendChunk(client, body);
+}
+// src/transport.ts
+/** opensearch-py's `Transport.DEFAULT_RETRY_ON_STATUS`. */
+const RETRY_ON_STATUS = /* @__PURE__ */ new Set([
+	502,
+	503,
+	504
+]);
+function isStream(value) {
+	return typeof value === "object" && value !== null && typeof value.pipe === "function";
+}
+/** Whether opensearch-py would retry after `error`. */
+function isRetryable(error) {
+	if (error instanceof errors.TimeoutError) return false;
+	if (error instanceof errors.ConnectionError) return true;
+	return error instanceof errors.ResponseError && RETRY_ON_STATUS.has(error.statusCode);
+}
+/** Hand the outcome of `promise` to a node-style callback. */
+async function deliver(promise, callback) {
+	let result;
+	try {
+		result = await promise;
+	} catch (error) {
+		callback(error, error.meta);
+		return;
+	}
+	callback(null, result);
+}
+/**
+* A subclass of `Base` (the client's Transport, or the SigV4 signer's) that
+* never retries a timed-out request.
+*/
+function withPythonRetries(Base) {
+	class PythonRetryTransport extends Base {
+		request(params, options = {}, callback) {
+			let requestOptions = {};
+			let done = callback;
+			if (typeof options === "function") done = options;
+			else requestOptions = options;
+			const maxRetries = isStream(params.body) || isStream(params.bulkBody) ? 0 : requestOptions.maxRetries ?? this.maxRetries;
+			let current = null;
+			let aborted = false;
+			const attempt = () => {
+				const pending = super.request(params, {
+					...requestOptions,
+					maxRetries: 0
+				});
+				current = pending;
+				return pending;
+			};
+			const run = async () => {
+				for (let retries = 0;; retries += 1) try {
+					return await attempt();
+				} catch (error) {
+					if (aborted || retries >= maxRetries || !isRetryable(error)) throw error;
+				}
+			};
+			const promise = run();
+			const abort = () => {
+				aborted = true;
+				current?.abort();
+			};
+			if (done) deliver(promise, done).catch((error) => {
+				queueMicrotask(() => {
+					throw error;
+				});
+			});
+			return Object.assign(promise, { abort });
+		}
+	}
+	return PythonRetryTransport;
+}
+// src/opensearch.ts
+/** Raised when an OpenSearch error occurs. */
+var OpenSearchError = class extends Error {
+	name = "OpenSearchError";
+};
+/** Raised when a report to be saved matches an existing report. */
+var AlreadySaved = class extends Error {
+	name = "AlreadySaved";
+};
+const MS_PER_SECOND = 1e3;
+const DEFAULT_MAX_INDEXES_PER_REPORT = 31;
+const DEFAULT_TIMEOUT_SECONDS = 60;
+const DEFAULT_PORT = 9200;
+const HTTPS_PORT = 443;
+let defaultConnection = null;
+const DATA_STREAM_TEMPLATE_PRIORITY = 501;
+const dataStreamStates = /* @__PURE__ */ new WeakMap();
+const COMBINED_BACKFILL_QUERY = { bool: {
+	minimum_should_match: 1,
+	should: [{ bool: {
+		must: [{ bool: {
+			minimum_should_match: 1,
+			should: [{ exists: { field: "dkim_results.domain" } }, { exists: { field: "dkim_results.result" } }]
+		} }],
+		must_not: [{ exists: { field: "dkim_results_combined" } }]
+	} }, { bool: {
+		must: [{ bool: {
+			minimum_should_match: 1,
+			should: [{ exists: { field: "spf_results.domain" } }, { exists: { field: "spf_results.result" } }]
+		} }],
+		must_not: [{ exists: { field: "spf_results_combined" } }]
+	} }]
+} };
+const COMBINED_BACKFILL_SCRIPT = [
+	"List dk = new ArrayList(); ",
+	"def dr = ctx._source.dkim_results; ",
+	"if (dr != null) { ",
+	"if (!(dr instanceof List)) { dr = [dr]; } ",
+	"for (e in dr) { ",
+	"if (e == null) { continue; } ",
+	"def sel = e.selector != null ? e.selector : \"none\"; ",
+	"def dom = e.domain != null ? e.domain : \"none\"; ",
+	"def res = e.result != null ? e.result : \"none\"; ",
+	"dk.add(sel + \" / \" + dom + \" / \" + res); ",
+	"} } ",
+	"ctx._source.dkim_results_combined = dk; ",
+	"List sp = new ArrayList(); ",
+	"def sr = ctx._source.spf_results; ",
+	"if (sr != null) { ",
+	"if (!(sr instanceof List)) { sr = [sr]; } ",
+	"for (e in sr) { ",
+	"if (e == null) { continue; } ",
+	"def sc = e.scope != null ? e.scope : \"mfrom\"; ",
+	"def dom = e.domain != null ? e.domain : \"none\"; ",
+	"def res = e.result != null ? e.result : (e.results != null ? e.results : \"none\"); ",
+	"sp.add(sc + \" / \" + dom + \" / \" + res); ",
+	"} } ",
+	"ctx._source.spf_results_combined = sp;"
+].join("");
+const SMTP_TLS_COMBINED_BACKFILL_QUERY = { bool: {
+	minimum_should_match: 1,
+	should: [{ bool: {
+		must: [{ bool: {
+			minimum_should_match: 1,
+			should: [{ exists: { field: "policies.policy_domain" } }, { exists: { field: "policies.policy_type" } }]
+		} }],
+		must_not: [{ exists: { field: "policies_combined" } }]
+	} }, { bool: {
+		must: [{ bool: {
+			minimum_should_match: 1,
+			should: [{ exists: { field: "policies.failure_details.result_type" } }, { exists: { field: "policies.failure_details.sending_mta_ip" } }]
+		} }],
+		must_not: [{ exists: { field: "failure_details_combined" } }]
+	} }]
+} };
+const SMTP_TLS_COMBINED_BACKFILL_SCRIPT = [
+	"List pols = new ArrayList(); ",
+	"List dets = new ArrayList(); ",
+	"def ps = ctx._source.policies; ",
+	"if (ps != null) { ",
+	"if (!(ps instanceof List)) { ps = [ps]; } ",
+	"for (p in ps) { ",
+	"if (p == null) { continue; } ",
+	"def dom = p.policy_domain != null ? p.policy_domain : \"none\"; ",
+	"def typ = p.policy_type != null ? p.policy_type : \"none\"; ",
+	"pols.add(dom + \" / \" + typ); ",
+	"def fds = p.failure_details; ",
+	"if (fds != null) { ",
+	"if (!(fds instanceof List)) { fds = [fds]; } ",
+	"for (f in fds) { ",
+	"if (f == null) { continue; } ",
+	"def rt = f.result_type != null ? f.result_type : \"none\"; ",
+	"def smi = f.sending_mta_ip != null ? f.sending_mta_ip : \"none\"; ",
+	"def ri = f.receiving_ip != null ? f.receiving_ip : \"none\"; ",
+	"def rmh = f.receiving_mx_hostname != null ? f.receiving_mx_hostname : \"none\"; ",
+	"dets.add(dom + \" / \" + typ + \" / \" + rt + \" / \" + smi + \" / \" + ri + \" / \" + rmh); ",
+	"} } } } ",
+	"ctx._source.policies_combined = pols; ",
+	"ctx._source.failure_details_combined = dets;"
+].join("");
+/** The backfill queries and scripts migrateIndexes() submits. */
+const BACKFILL = {
+	aggregateQuery: COMBINED_BACKFILL_QUERY,
+	aggregateScript: COMBINED_BACKFILL_SCRIPT,
+	smtpTlsQuery: SMTP_TLS_COMBINED_BACKFILL_QUERY,
+	smtpTlsScript: SMTP_TLS_COMBINED_BACKFILL_SCRIPT
+};
+const NETLOC_END = /[/?#]/u;
+const TRAILING_PORT = /:(\d+)$/u;
+/**
+* opensearch-py's host normalization: a host without a scheme is read as
+* `//host`; `https://` hosts default to port 443 and TLS, others to port
+* 9200; the client-level `use_ssl` turns on TLS for every host.
+*/
+function nodeUrl(host, useSsl) {
+	const withScheme = host.includes("://") ? host : `//${host}`;
+	const parsed = new URL(withScheme, "http://placeholder");
+	const schemeIsHttps = withScheme.toLowerCase().startsWith("https://");
+	const netloc = withScheme.split("//", 2)[1]?.split(NETLOC_END, 1)[0] ?? "";
+	const hostPort = netloc.slice(netloc.lastIndexOf("@") + 1);
+	const portPart = hostPort.startsWith("[") ? hostPort.slice(hostPort.indexOf("]") + 1) : hostPort;
+	const port = TRAILING_PORT.exec(portPart)?.[1] ?? String(schemeIsHttps ? HTTPS_PORT : DEFAULT_PORT);
+	const scheme = schemeIsHttps || useSsl ? "https" : "http";
+	const userinfo = parsed.username || parsed.password ? `${parsed.username}:${parsed.password}@` : "";
+	const path = parsed.pathname === "/" ? "" : parsed.pathname;
+	return `${scheme}://${userinfo}${parsed.hostname}:${port}${path}`;
+}
+/**
+* urllib3's timeout rules, as opensearch-py applies them: `None` means no
+* timeout (0 for opensearch-js), and a value that is not positive raises.
+*/
+function requestTimeoutMs(timeout) {
+	if (timeout === null) return 0;
+	if (!(timeout > 0)) throw new ValueError(`Attempted to set connect timeout to ${timeout}, but the timeout cannot be set to a value less than or equal to 0.`);
+	return timeout * MS_PER_SECOND;
+}
+async function sigV4Options(awsRegion, awsService) {
+	if (!awsRegion) throw new OpenSearchError("OpenSearch AWS SigV4 auth requires 'aws_region' to be set");
+	const [{ fromNodeProviderChain }, { AwsSigv4Signer }] = await Promise.all([import("@aws-sdk/credential-providers"), import("@opensearch-project/opensearch/aws")]);
+	const getCredentials = fromNodeProviderChain();
+	try {
+		await getCredentials();
+	} catch {
+		throw new OpenSearchError("Unable to load AWS credentials for OpenSearch SigV4 authentication");
+	}
+	return AwsSigv4Signer({
+		region: awsRegion,
+		service: awsService,
+		getCredentials
+	});
+}
+/**
+* Creates an OpenSearch client the way {@link setHosts} does, without
+* registering it as the default connection. Pass it as `client` to the save
+* functions, createIndexes() and migrateIndexes() to write to several
+* clusters from one process. Close it with `client.close()`.
+*/
+async function createClient(hosts, options = {}) {
+	const { useSsl = false, sslCertPath = null, skipCertificateVerification = false, username = null, password = null, timeout = DEFAULT_TIMEOUT_SECONDS, authType = "basic", awsRegion = null, awsService = "es" } = options;
+	const hostList = Array.isArray(hosts) ? hosts : [hosts];
+	logger.debug(`Connecting to OpenSearch: hosts=${pyRepr(redactUrlCredentials(hostList))}, use_ssl=${pyRepr(useSsl)}`);
+	const clientOptions = {
+		nodes: hostList.map((host) => nodeUrl(host, Boolean(useSsl))),
+		enableLongNumeralSupport: true,
+		disablePrototypePoisoningProtection: true
+	};
+	if (useSsl) clientOptions.ssl = {
+		rejectUnauthorized: !skipCertificateVerification,
+		...sslCertPath ? { ca: await readFile(sslCertPath) } : {}
+	};
+	const normalizedAuthType = (authType || "basic").trim().toLowerCase();
+	if (normalizedAuthType === "awssigv4") Object.assign(clientOptions, await sigV4Options(awsRegion, awsService));
+	else if (normalizedAuthType === "basic") {
+		if (username && password) clientOptions.auth = {
+			username,
+			password
+		};
+	} else throw new OpenSearchError(`Unsupported OpenSearch auth_type '${authType}'. Expected 'basic' or 'awssigv4'.`);
+	clientOptions.requestTimeout = requestTimeoutMs(timeout);
+	clientOptions.Transport = withPythonRetries(clientOptions.Transport ?? Transport);
+	return new Client(clientOptions);
+}
+/**
+* Sets the OpenSearch hosts to use, and registers the client as the
+* default connection the other functions use.
+*
+* A client registered by an earlier call is replaced but not closed, as in
+* parsedmarc (the DSL's connection registry only drops it): its owner may
+* still be using it or put it back (the CLI's configuration reload). Close
+* clients you no longer need with `client.close()`; on shutdown,
+* `await getDefaultConnection()?.close()` then `setDefaultConnection(null)`.
+*
+* @returns The registered client. Callers that need to close this exact
+* client later should hold on to it.
+*/
+async function setHosts(hosts, options = {}) {
+	defaultConnection = await createClient(hosts, options);
+	return defaultConnection;
+}
+/**
+* The client registered as the `default` connection, or `null`. With
+* {@link setDefaultConnection}, lets a caller snapshot and restore the
+* module state setHosts() writes (the CLI's configuration reload).
+*/
+function getDefaultConnection() {
+	return defaultConnection;
+}
+/** Register `client` as the `default` connection (`null` removes it). */
+function setDefaultConnection(client) {
+	defaultConnection = client;
+}
+/**
+* `client`, or the client registered by setHosts() (DSL
+* `connections.get_connection()`).
+*/
+function getConnection(client) {
+	if (client) return client;
+	if (defaultConnection === null) throw new KeyError("There is no connection with alias 'default'.");
+	return defaultConnection;
+}
+async function indexExists(client, name) {
+	return (await client.indices.exists({ index: name })).body;
+}
+/** `Index(name).settings(...).create()`: the body is `{}` without settings. */
+async function createIndex(client, name, settings = {}, mappings = null) {
+	await client.indices.create({
+		index: name,
+		body: {
+			...Object.keys(settings).length > 0 ? { settings } : {},
+			...mappings ? { mappings } : {}
+		}
+	});
+}
+/**
+* Whether `error` is the cluster refusing to create an index that another
+* writer created after the exists check (concurrent saves to a new index).
+*/
+function isIndexAlreadyCreated(error) {
+	if (!(error instanceof errors.ResponseError)) return false;
+	return error.meta.body?.error?.type === "resource_already_exists_exception";
+}
+/**
+* Create OpenSearch indexes that don't exist yet.
+*
+* @param settings Index settings (default: 1 shard, 0 replicas).
+* @param mappings Mappings for new indexes (default: none, as in parsedmarc).
+* @param options The cluster to use (default: the default connection).
+*/
+async function createIndexes(names, settings = null, mappings = null, options = {}) {
+	for (const name of names) try {
+		const client = getConnection(options.client);
+		if (!await indexExists(client, name)) {
+			logger.debug(`Creating OpenSearch index: ${name}`);
+			try {
+				await createIndex(client, name, settings ?? {
+					number_of_shards: 1,
+					number_of_replicas: 0
+				}, mappings);
+			} catch (error) {
+				if (!isIndexAlreadyCreated(error)) throw error;
+			}
+		}
+	} catch (error) {
+		throw new OpenSearchError(`OpenSearch error: ${errorMessage(error)}`);
+	}
+}
+function dataStreamState(client) {
+	let state = dataStreamStates.get(client);
+	if (state === void 0) {
+		state = {
+			ready: /* @__PURE__ */ new Map(),
+			pending: /* @__PURE__ */ new Map()
+		};
+		dataStreamStates.set(client, state);
+	}
+	return state;
+}
+/**
+* Whether `error` is the cluster refusing to look up a data stream by the
+* name of an alias (`illegal_argument_exception`, HTTP 400). The index
+* exists check then reports the name as taken, with a clearer message than
+* this error.
+*/
+function isAliasName(error) {
+	if (!(error instanceof errors.ResponseError) || error.statusCode !== 400) return false;
+	return error.meta.body?.error?.type === "illegal_argument_exception";
+}
+/** Whether `error` is an HTTP 404 (opensearch-py's `NotFoundError`). */
+function isNotFound(error) {
+	return error instanceof errors.ResponseError && error.statusCode === 404;
+}
+/**
+* Whether a data stream holds `name`. OpenSearch 3 answers both a missing
+* name and a name held by a concrete index with a 404. Elasticsearch answers
+* the latter with 200 and an empty list, so, as in the Elasticsearch
+* package, look for the stream in the response rather than trust the status
+* alone.
+*/
+async function dataStreamExists(client, name) {
+	try {
+		return ((await client.indices.getDataStream({ name })).body.data_streams ?? []).some((stream) => stream.name === name);
+	} catch (error) {
+		if (isNotFound(error) || isAliasName(error)) return false;
+		throw error;
+	}
+}
+async function setUpDataStream(client, name, body) {
+	let collision = false;
+	try {
+		let streamExists = await dataStreamExists(client, name);
+		if (!streamExists && await indexExists(client, name)) {
+			streamExists = await dataStreamExists(client, name);
+			collision = !streamExists;
+		}
+		if (!collision) {
+			await client.indices.putIndexTemplate({
+				name,
+				body
+			});
+			if (!streamExists) {
+				logger.debug(`Creating OpenSearch data stream: ${name}`);
+				try {
+					await client.indices.createDataStream({ name });
+				} catch (error) {
+					if (!isIndexAlreadyCreated(error)) throw error;
+				}
+			}
+		}
+	} catch (error) {
+		throw new OpenSearchError(`OpenSearch error: ${errorMessage(error)}`);
+	}
+	if (collision) throw new OpenSearchError(`OpenSearch error: cannot create the data stream ${name}: an index or alias with that name already exists`);
+}
+/**
+* Create OpenSearch data streams and their index templates.
+*
+* For each name, puts an index template named after the stream whose
+* `index_patterns` is exactly that name (no wildcard, so it never applies to
+* the date-suffixed indexes written without data streams), and then creates
+* the data stream if it does not exist yet. The template is put again by
+* every process that writes to the stream, so edits made to it directly do
+* not last; an ISM policy attaches itself to the stream's backing indices
+* through its own `ism_template` instead. Each name is set up once per
+* client and template.
+*
+* @param settings Index settings for the stream's backing indices (default:
+* 1 shard, 0 replicas, as in {@link createIndexes}).
+* @param mappings Mappings for the backing indices, plus `@timestamp` as a
+* date (default: only `@timestamp`, as in parsedmarc). The save functions
+* pass the mappings they create dated indexes with.
+* @param options The cluster to use (default: the default connection).
+* @throws {OpenSearchError} when a concrete index or alias already holds one
+* of the names, or the cluster returns an error. A name that fails is not
+* remembered, so the next save retries it.
+*/
+async function createDataStreams(names, settings = null, mappings = null, options = {}) {
+	const effectiveSettings = settings ? { ...settings } : {
+		number_of_shards: 1,
+		number_of_replicas: 0
+	};
+	for (const name of names) {
+		let client;
+		try {
+			client = getConnection(options.client);
+		} catch (error) {
+			throw new OpenSearchError(`OpenSearch error: ${errorMessage(error)}`);
+		}
+		const body = {
+			index_patterns: [name],
+			data_stream: {},
+			priority: DATA_STREAM_TEMPLATE_PRIORITY,
+			template: {
+				settings: effectiveSettings,
+				mappings: dataStreamMapping(mappings)
+			},
+			_meta: { description: "Managed by tsdmarc, which overwrites it. Attach ISM policies with an ism_template." }
+		};
+		const key = JSON.stringify({
+			name,
+			body
+		});
+		const state = dataStreamState(client);
+		if (state.ready.get(name) === key) continue;
+		let pending = state.pending.get(key);
+		if (pending === void 0) {
+			pending = setUpDataStream(client, name, body).finally(() => {
+				state.pending.delete(key);
+			});
+			state.pending.set(key, pending);
+		}
+		await pending;
+		state.ready.set(name, key);
+	}
+}
+const LEGACY_FO_FIELD = "published_policy.fo";
+const [LEGACY_FO_OBJECT = "", LEGACY_FO_LEAF = ""] = LEGACY_FO_FIELD.split(".");
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* The mapped type of `published_policy.fo` in an index, or `null` when the
+* index does not map it. Reads both the typeless response (OpenSearch has
+* no mapping types) and the Elasticsearch 6-era shape keyed by type (`doc`).
+*/
+async function legacyFoFieldType(client, index) {
+	const response = (await client.indices.getFieldMapping({
+		index,
+		fields: [LEGACY_FO_FIELD]
+	})).body;
+	const [firstIndex = ""] = Object.keys(response);
+	let mappings = response[firstIndex]?.mappings ?? {};
+	if (!(LEGACY_FO_FIELD in mappings)) for (const typeName of ["doc", "_doc"]) {
+		const typed = mappings[typeName];
+		if (isRecord(typed)) {
+			mappings = typed;
+			break;
+		}
+	}
+	const fieldMapping = mappings[LEGACY_FO_FIELD];
+	if (!isRecord(fieldMapping) || Object.keys(fieldMapping).length === 0) return null;
+	const mapping = isRecord(fieldMapping.mapping) ? fieldMapping.mapping : {};
+	const leaf = isRecord(mapping[LEGACY_FO_LEAF]) ? mapping[LEGACY_FO_LEAF] : {};
+	return typeof leaf.type === "string" ? leaf.type : null;
+}
+async function migrateLegacyFoIndex(client, legacyIndexName, version) {
+	if (!await indexExists(client, legacyIndexName)) return;
+	if (await legacyFoFieldType(client, legacyIndexName) !== "long") return;
+	const newIndexName = `${legacyIndexName}-v${version}`;
+	const body = { properties: { [LEGACY_FO_OBJECT]: { properties: { [LEGACY_FO_LEAF]: {
+		type: "text",
+		fields: { keyword: {
+			type: "keyword",
+			ignore_above: 256
+		} }
+	} } } } };
+	logger.info(`Migrating ${legacyIndexName} to ${newIndexName}: ${LEGACY_FO_FIELD} is mapped as long, as parsedmarc releases before 5.0.0 declared it`);
+	if (await indexExists(client, newIndexName)) {
+		logger.warning(`Discarding ${newIndexName} left behind by an earlier interrupted migration of ${legacyIndexName}`);
+		await client.indices.delete({ index: newIndexName });
+	}
+	await createIndex(client, newIndexName);
+	await client.indices.putMapping({
+		index: newIndexName,
+		body
+	});
+	await reindex(client, legacyIndexName, newIndexName);
+	await verifyCopy(client, legacyIndexName, newIndexName);
+	await client.indices.delete({ index: legacyIndexName });
+}
+/** Documents in `index`, failing if some shard did not answer. */
+async function countDocuments(client, index) {
+	const { body: response } = await client.count({ index });
+	if ((response._shards?.failed ?? 0) > 0) throw new OpenSearchError(`Could not count the documents of ${index}`);
+	return response.count;
+}
+/** The original is about to be deleted: the copy must be complete. */
+async function verifyCopy(client, sourceIndex, targetIndex) {
+	await client.indices.refresh({ index: targetIndex });
+	const sourceCount = await countDocuments(client, sourceIndex);
+	const targetCount = await countDocuments(client, targetIndex);
+	if (targetCount !== sourceCount) throw new OpenSearchError(`${targetIndex} holds ${targetCount} documents, ${sourceIndex} holds ${sourceCount}`);
+}
+async function submitBackfills(client, target) {
+	for (const name of target.names) {
+		const pattern = `${name}*`;
+		try {
+			const { count } = (await client.count({
+				index: pattern,
+				body: { query: target.query },
+				ignore_unavailable: true,
+				allow_no_indices: true
+			})).body;
+			if (!count) continue;
+			const taskId = (await client.updateByQuery({
+				index: pattern,
+				body: {
+					query: target.query,
+					script: {
+						source: target.script,
+						lang: "painless"
+					}
+				},
+				conflicts: "proceed",
+				wait_for_completion: false,
+				ignore_unavailable: true,
+				allow_no_indices: true
+			})).body?.task ?? null;
+			logger.info(`Backfilling ${target.fields} on ${count} existing documents in ${pattern} (task ${pyStr(taskId)})`);
+		} catch (error) {
+			logger.warning(`Failed to check/submit the ${target.fields} backfill for ${pattern}: ${errorMessage(error)}. This will be retried at the next startup; the manual _update_by_query command in the documentation remains available in the meantime.`);
+		}
+	}
+}
+/**
+* Runs index migrations and backfills.
+*
+* First, the legacy `published_policy.fo` migration for each name in
+* `legacyFoIndexes`: an index that maps the field as `long` (parsedmarc
+* before 5.0.0) is rebuilt as a `-v2` index with the text/keyword shape, its
+* documents are reindexed into it, and the original is deleted.
+*
+* Second, it backfills `dkim_results_combined`/`spf_results_combined` on
+* aggregate documents and `policies_combined`/`failure_details_combined` on
+* SMTP TLS documents saved before those fields existed, as non-blocking
+* `update_by_query` tasks against each `name*` pattern, guarded by a cheap
+* `count`. Errors are logged as warnings, never thrown: the work is retried
+* at the next startup.
+*/
+async function migrateIndexes(options = {}) {
+	const { aggregateIndexes, smtpTlsIndexes, legacyFoIndexes } = options;
+	const hasAggregate = Boolean(aggregateIndexes?.length);
+	const hasSmtpTls = Boolean(smtpTlsIndexes?.length);
+	if (!hasAggregate && !hasSmtpTls && !legacyFoIndexes?.length) return;
+	const version = 2;
+	for (const legacyIndexName of legacyFoIndexes ?? []) try {
+		await migrateLegacyFoIndex(getConnection(options.client), legacyIndexName, version);
+	} catch (error) {
+		logger.warning(`Failed the legacy published_policy.fo migration for ${legacyIndexName}: ${errorMessage(error)}. This will be retried at the next startup.`);
+	}
+	if (!hasAggregate && !hasSmtpTls) return;
+	let client;
+	try {
+		client = getConnection(options.client);
+	} catch (error) {
+		logger.warning(`Skipping the dkim_results_combined/spf_results_combined/policies_combined/failure_details_combined backfill: could not get an OpenSearch connection: ${errorMessage(error)}. This will be retried at the next startup.`);
+		return;
+	}
+	await submitBackfills(client, {
+		names: aggregateIndexes ?? [],
+		query: COMBINED_BACKFILL_QUERY,
+		script: COMBINED_BACKFILL_SCRIPT,
+		fields: "dkim_results_combined/spf_results_combined"
+	});
+	await submitBackfills(client, {
+		names: smtpTlsIndexes ?? [],
+		query: SMTP_TLS_COMBINED_BACKFILL_QUERY,
+		script: SMTP_TLS_COMBINED_BACKFILL_SCRIPT,
+		fields: "policies_combined/failure_details_combined"
+	});
+}
+/** `Search(index=...).query(...).execute()`: the number of hits. */
+async function countExisting(options, index, query) {
+	return (await searchExisting(options, index, query)).length;
+}
+/** The `_source` of the hits of `Search(index=...).query(...).execute()`. */
+async function searchExisting(options, index, query) {
+	return (await getConnection(options.client).search({
+		index,
+		ignore_unavailable: true,
+		body: { query }
+	})).body.hits.hits.map((hit) => hit._source);
+}
+/** The `_source` of up to `size` documents a duplicate search matches. */
+async function storedSources(options, index, query, size) {
+	return (await getConnection(options.client).search({
+		index,
+		ignore_unavailable: true,
+		body: {
+			query,
+			size,
+			_source: [...AGGREGATE_RECORD_FIELDS]
+		}
+	})).body.hits.hits.map((hit) => hit._source);
+}
+/** `Document.save()`: clean, serialize and index the document. */
+async function saveDocument(options, schema, index, doc) {
+	const body = rawJsonIntegers(serializeDocument(schema, doc));
+	await getConnection(options.client).index({
+		index,
+		body,
+		op_type: "create"
+	});
+}
+/** The index name without its date: also the name of the data stream. */
+function undatedIndexName(base, options) {
+	let index = base;
+	if (options.indexSuffix) index = `${index}_${options.indexSuffix}`;
+	if (options.indexPrefix) index = `${options.indexPrefix}${index}`;
+	return index;
+}
+/**
+* The indexes a duplicate search covers: the dated indexes of this prefix
+* and suffix, and the data stream (or a pre-5.0.0 undated index) of the
+* same name, so duplicates are caught across a switch between the two. The
+* `-` before the date stops the wildcard at the suffix, so `prod` does not
+* reach `production` and no suffix does not reach every suffix.
+*/
+function searchPattern(base, options) {
+	const name = undatedIndexName(base, options);
+	return `${name}-*,${name}`;
+}
+function indexSettings(options) {
+	return {
+		number_of_shards: options.numberOfShards ?? 1,
+		number_of_replicas: options.numberOfReplicas ?? 0
+	};
+}
+function indexDate(date, monthly) {
+	return date.strftime(monthly ? "%Y-%m" : "%Y-%m-%d");
+}
+function isAligned(result) {
+	return result !== null && result !== void 0 && result.toLowerCase() === "pass";
+}
+/** The indexes of one report, at most `maxIndexesPerReport` of them. */
+var ReportIndexes = class {
+	#limit;
+	#names = /* @__PURE__ */ new Set();
+	#warned = false;
+	constructor(options) {
+		this.#limit = options.maxIndexesPerReport ?? DEFAULT_MAX_INDEXES_PER_REPORT;
+	}
+	/** `name`, or the report's first index once the limit is reached. */
+	pick(name) {
+		if (this.#limit === 0 || this.#names.has(name) || this.#names.size < this.#limit) {
+			this.#names.add(name);
+			return name;
+		}
+		const [first = name] = this.#names;
+		if (!this.#warned) {
+			this.#warned = true;
+			logger.warning(`An aggregate report spans more than ${this.#limit} indexes; saving the remaining records to ${first}`);
+		}
+		return first;
+	}
+};
+/**
+* Saves a parsed DMARC aggregate report to OpenSearch, one document per
+* record.
+*
+* @throws {AlreadySaved} when the report is already in OpenSearch.
+* @throws {OpenSearchError} when OpenSearch fails or rejects the document.
+*/
+async function saveAggregateReportToOpenSearch(aggregateReport, options = {}) {
+	logger.info("Saving aggregate report to OpenSearch");
+	const metadata = aggregateReport.reportMetadata;
+	const policy = aggregateReport.policyPublished;
+	const { orgName, reportId } = metadata;
+	const domain = textValue(policy.domain);
+	const beginDate = humanTimestampToDatetime(metadata.beginDate, { toUtc: true });
+	const endDate = humanTimestampToDatetime(metadata.endDate, { toUtc: true });
+	const searchIndex = searchPattern("dmarc_aggregate", options);
+	const query = andQueries([
+		{ match_phrase: { org_name: orgName } },
+		{ match_phrase: { report_id: reportId } },
+		{ match_phrase: { "published_policy.domain": domain } },
+		{ range: { date_begin: { gte: beginDate.isoformat() } } },
+		{ range: { date_end: { lte: endDate.isoformat() } } }
+	]);
+	const beginDateHuman = beginDate.strftime("%Y-%m-%d %H:%M:%SZ");
+	const endDateHuman = endDate.strftime("%Y-%m-%d %H:%M:%SZ");
+	let existing;
+	try {
+		existing = await searchExisting(options, searchIndex, query);
+	} catch (error) {
+		throw new OpenSearchError(`OpenSearch's search for existing report error: ${errorMessage(error)}`);
+	}
+	const alreadySaved = () => new AlreadySaved(`An aggregate report ID ${reportId} from ${orgName} about ${pyStr(domain)} with a date range of ${beginDateHuman} UTC to ${endDateHuman} UTC already exists in OpenSearch`);
+	const records = aggregateReport.records;
+	const recordDocument = (record, policyDocument) => {
+		const recordBegin = humanTimestampToDatetime(record.intervalBegin, {
+			toUtc: true,
+			assumeUtc: true
+		});
+		const recordEnd = humanTimestampToDatetime(record.intervalEnd, {
+			toUtc: true,
+			assumeUtc: true
+		});
+		const { source, policyEvaluated, identifiers } = record;
+		const aggDoc = {
+			xml_schema: aggregateReport.xmlSchema,
+			xml_namespace: aggregateReport.xmlNamespace ?? null,
+			org_name: metadata.orgName,
+			org_email: metadata.orgEmail,
+			org_extra_contact_info: metadata.orgExtraContactInfo,
+			report_id: metadata.reportId,
+			date_range: [recordBegin, recordEnd],
+			date_begin: recordBegin,
+			date_end: recordEnd,
+			normalized_timespan: record.normalizedTimespan ?? null,
+			errors: metadata.errors,
+			published_policy: policyDocument,
+			source_ip_address: source.ipAddress,
+			source_country: source.country,
+			source_reverse_dns: source.reverseDns,
+			source_base_domain: source.baseDomain,
+			source_type: source.type,
+			source_name: source.name,
+			source_asn: source.asn,
+			source_as_name: source.asName,
+			source_as_domain: source.asDomain,
+			message_count: record.count,
+			disposition: policyEvaluated.disposition,
+			dkim_aligned: isAligned(policyEvaluated.dkim),
+			spf_aligned: isAligned(policyEvaluated.spf),
+			header_from: identifiers.headerFrom,
+			envelope_from: identifiers.envelopeFrom,
+			envelope_to: identifiers.envelopeTo,
+			np: policy.np ?? null,
+			testing: policy.testing ?? null,
+			discovery_method: policy.discoveryMethod ?? null,
+			generator: metadata.generator ?? null,
+			[TIMESTAMP_FIELD]: recordBegin.isoformat()
+		};
+		for (const override of policyEvaluated.policyOverrideReasons) appendTo(aggDoc, "policy_overrides", {
+			type: override.type,
+			comment: override.comment
+		});
+		for (const dkim of record.authResults.dkim) {
+			appendTo(aggDoc, "dkim_results", {
+				domain: dkim.domain,
+				selector: dkim.selector,
+				result: dkim.result,
+				human_result: dkim.humanResult ?? null
+			});
+			appendTo(aggDoc, "dkim_results_combined", `${dkim.selector} / ${dkim.domain} / ${dkim.result}`);
+		}
+		for (const spf of record.authResults.spf) {
+			appendTo(aggDoc, "spf_results", {
+				domain: spf.domain,
+				scope: spf.scope,
+				result: spf.result,
+				human_result: spf.humanResult ?? null
+			});
+			appendTo(aggDoc, "spf_results_combined", `${spf.scope} / ${spf.domain} / ${spf.result}`);
+		}
+		return {
+			aggDoc,
+			recordBegin
+		};
+	};
+	let storedRecords = /* @__PURE__ */ new Set();
+	if (existing.length > 0) {
+		let documents = null;
+		if (existing.length < records.length) try {
+			documents = records.map((record) => serializeDocument(AGGREGATE_REPORT_DOC, recordDocument(record, null).aggDoc));
+		} catch {
+			documents = null;
+		}
+		let stored;
+		try {
+			stored = await findStoredRecords(documents, existing, async (size) => storedSources(options, searchIndex, query, size));
+		} catch (error) {
+			throw new OpenSearchError(`OpenSearch's search for existing report error: ${errorMessage(error)}`);
+		}
+		if (stored === null) throw alreadySaved();
+		storedRecords = stored;
+		logger.warning(`Resuming aggregate report ID ${sanitizeForLog(pyStr(reportId))} from ${sanitizeForLog(pyStr(orgName))}: ${stored.size} of ${records.length} records are already in OpenSearch`);
+	}
+	const publishedPolicy = {
+		domain: policy.domain,
+		adkim: policy.adkim,
+		aspf: policy.aspf,
+		p: policy.p,
+		sp: policy.sp,
+		pct: integerOrNull(policy.pct, "pct"),
+		fo: policy.fo,
+		np: policy.np ?? null,
+		testing: policy.testing ?? null,
+		discovery_method: policy.discoveryMethod ?? null
+	};
+	const indexes = new ReportIndexes(options);
+	for (const [position, record] of records.entries()) {
+		const { aggDoc, recordBegin } = recordDocument(record, publishedPolicy);
+		let index = undatedIndexName("dmarc_aggregate", options);
+		if (!options.useDataStreams) index = indexes.pick(`${index}-${indexDate(recordBegin, options.monthlyIndexes)}`);
+		if (storedRecords.has(position)) continue;
+		if (options.useDataStreams) await createDataStreams([index], indexSettings(options), INDEX_MAPPINGS.aggregate, options);
+		else await createIndexes([index], indexSettings(options), INDEX_MAPPINGS.aggregate, options);
+		try {
+			aggDoc.passed_dmarc = aggDoc.spf_aligned || aggDoc.dkim_aligned;
+			await saveDocument(options, AGGREGATE_REPORT_DOC, index, aggDoc);
+		} catch (error) {
+			throw new OpenSearchError(`OpenSearch error: ${errorMessage(error)}`);
+		}
+	}
+}
+/**
+* Flatten a mailparser address header (`[[display_name, address], ...]`) to
+* one string from its first address: the bare address when the display
+* name is empty, otherwise `Name <address>`. `null` when there is no address
+* (`From:`, `To: undisclosed-recipients:;`), which parsedmarc fails on.
+*/
+function flattenAddressHeader(value) {
+	if (pyLength(value) === 0) return null;
+	const first = pyIndex(value, 0);
+	if (pyIndex(first, 0) === "") return pyIndex(first, 1);
+	return `${pyJoin(" <", first)}>`;
+}
+function pyLength(value) {
+	return Array.isArray(value) || typeof value === "string" ? value.length : null;
+}
+/** `value[index]` for the lists and strings header values can be. */
+function pyIndex(value, index) {
+	if (Array.isArray(value) || typeof value === "string") {
+		if (index >= value.length) throw new Error("list index out of range");
+		return value[index];
+	}
+	throw new TypeError(`'${typeof value}' object is not subscriptable`);
+}
+/** `separator.join(value)` for a list of strings or a string. */
+function pyJoin(separator, value) {
+	if (typeof value === "string") return [...value].join(separator);
+	if (Array.isArray(value)) return value.map(String).join(separator);
+	throw new TypeError("can only join an iterable");
+}
+function asRecord(value) {
+	return isRecord(value) ? value : {};
+}
+/**
+* Saves a parsed DMARC failure report to OpenSearch.
+*
+* @throws {AlreadySaved} when the failure sample is already in OpenSearch.
+* @throws {OpenSearchError} when OpenSearch fails or rejects the document.
+* @throws {InvalidFailureReport} when the report lacks a required field.
+*/
+async function saveFailureReportToOpenSearch(failureReport, options = {}) {
+	logger.info("Saving failure report to OpenSearch");
+	const parsedSample = getKey(failureReport, "parsedSample");
+	const sampleDateValue = getKey(parsedSample, "date");
+	let sampleDate = null;
+	if (sampleDateValue !== null && sampleDateValue !== void 0) sampleDate = humanTimestampToDatetime(String(sampleDateValue));
+	const originalHeaders = asRecord(getKey(parsedSample, "headers"));
+	const headers = {};
+	for (const [name, value] of Object.entries(originalHeaders)) setOwn(headers, name.toLowerCase().replaceAll(".", "_"), value);
+	const arrivalDateUtc = String(getKey(failureReport, "arrivalDateUtc"));
+	const arrivalDate = humanTimestampToDatetime(arrivalDateUtc, { assumeUtc: true });
+	const arrivalDateEpochMilliseconds = Math.trunc(arrivalDate.timestamp() * MS_PER_SECOND);
+	const searchIndex = [searchPattern("dmarc_failure", options), searchPattern("dmarc_forensic", options)].join(",");
+	const queries = [{ match: { arrival_date: arrivalDateEpochMilliseconds } }];
+	let from = null;
+	let to = null;
+	let subject = null;
+	if (Object.hasOwn(headers, "from")) {
+		headers.from = flattenAddressHeader(headers.from);
+		if (headers.from !== null) {
+			from = { "sample.headers.from": headers.from };
+			queries.push({ match_phrase: from });
+		}
+	}
+	if (Object.hasOwn(headers, "to")) {
+		headers.to = flattenAddressHeader(headers.to);
+		if (headers.to !== null) {
+			to = { "sample.headers.to": headers.to };
+			queries.push({ match_phrase: to });
+		}
+	}
+	if (Object.hasOwn(headers, "reply-to")) headers["reply-to"] = flattenAddressHeader(headers["reply-to"]);
+	if (Object.hasOwn(headers, "subject")) {
+		subject = headers.subject;
+		queries.push({ match_phrase: { "sample.headers.subject": subject } });
+	}
+	let existing;
+	try {
+		existing = await countExisting(options, searchIndex, andQueries(queries));
+	} catch (error) {
+		throw new OpenSearchError(`OpenSearch's search for existing report error: ${errorMessage(error)}`);
+	}
+	if (existing > 0) throw new AlreadySaved(`A failure sample to ${pyStr(to)} from ${pyStr(from)} with a subject of ${pyStr(subject)} and arrival date of ${arrivalDateUtc} already exists in OpenSearch`);
+	const sample = {
+		raw: getKey(failureReport, "sample"),
+		headers,
+		headers_only: getKey(failureReport, "sampleHeadersOnly"),
+		date: sampleDate,
+		subject: getKey(parsedSample, "subject"),
+		filename_safe_subject: getKey(parsedSample, "filenameSafeSubject"),
+		body: getKey(parsedSample, "body")
+	};
+	for (const [key, field] of [
+		["to", "to"],
+		["replyTo", "reply_to"],
+		["cc", "cc"],
+		["bcc", "bcc"]
+	]) for (const address of getKey(parsedSample, key)) appendTo(sample, field, {
+		display_name: getKey(address, "displayName"),
+		address: getKey(address, "address")
+	});
+	for (const attachment of getKey(parsedSample, "attachments")) appendTo(sample, "attachments", {
+		filename: getKey(attachment, "filename"),
+		content_type: getKey(attachment, "mailContentType"),
+		sha256: getKey(attachment, "sha256")
+	});
+	try {
+		const source = getKey(failureReport, "source");
+		const failureDoc = {
+			feedback_type: getKey(failureReport, "feedbackType"),
+			user_agent: getKey(failureReport, "userAgent"),
+			version: getKey(failureReport, "version"),
+			original_mail_from: getKey(failureReport, "originalMailFrom"),
+			arrival_date: arrivalDateEpochMilliseconds,
+			domain: getKey(failureReport, "reportedDomain"),
+			original_envelope_id: getKey(failureReport, "originalEnvelopeId"),
+			authentication_results: getKey(failureReport, "authenticationResults"),
+			delivery_results: getKey(failureReport, "deliveryResult"),
+			source_ip_address: getKey(source, "ipAddress"),
+			source_country: getKey(source, "country"),
+			source_reverse_dns: getKey(source, "reverseDns"),
+			source_base_domain: getKey(source, "baseDomain"),
+			source_asn: getKey(source, "asn"),
+			source_as_name: getKey(source, "asName"),
+			source_as_domain: getKey(source, "asDomain"),
+			authentication_mechanisms: getKey(failureReport, "authenticationMechanisms"),
+			auth_failure: getKey(failureReport, "authFailure"),
+			dkim_domain: getKey(failureReport, "dkimDomain"),
+			original_rcpt_to: getKey(failureReport, "originalRcptTo"),
+			sample,
+			[TIMESTAMP_FIELD]: arrivalDate.isoformat()
+		};
+		let index = undatedIndexName("dmarc_failure", options);
+		if (options.useDataStreams) await createDataStreams([index], indexSettings(options), INDEX_MAPPINGS.failure, options);
+		else {
+			index = `${index}-${indexDate(arrivalDate, options.monthlyIndexes)}`;
+			await createIndexes([index], indexSettings(options), INDEX_MAPPINGS.failure, options);
+		}
+		try {
+			await saveDocument(options, FAILURE_REPORT_DOC, index, failureDoc);
+		} catch (error) {
+			throw new OpenSearchError(`OpenSearch error: ${errorMessage(error)}`);
+		}
+	} catch (error) {
+		if (error instanceof KeyError) throw new InvalidFailureReport(`Failure report missing required field: ${error.message}`);
+		throw error;
+	}
+}
+/**
+* Saves a parsed SMTP TLS report to OpenSearch.
+*
+* @throws {AlreadySaved} when the report is already in OpenSearch.
+* @throws {OpenSearchError} when OpenSearch fails or rejects the document.
+*/
+async function saveSmtpTlsReportToOpenSearch(report, options = {}) {
+	logger.info("Saving SMTP TLS report to OpenSearch");
+	const orgName = report.organizationName;
+	const { reportId } = report;
+	const beginDate = humanTimestampToDatetime(report.beginDate, { toUtc: true });
+	const endDate = humanTimestampToDatetime(report.endDate, { toUtc: true });
+	const beginDateHuman = beginDate.strftime("%Y-%m-%d %H:%M:%SZ");
+	const endDateHuman = endDate.strftime("%Y-%m-%d %H:%M:%SZ");
+	const query = andQueries([
+		{ match_phrase: { org_name: orgName } },
+		{ match_phrase: { report_id: reportId } },
+		{ match: { date_begin: beginDate.isoformat() } },
+		{ match: { date_end: endDate.isoformat() } }
+	]);
+	const searchIndex = searchPattern("smtp_tls", options);
+	let existing;
+	try {
+		existing = await countExisting(options, searchIndex, query);
+	} catch (error) {
+		throw new OpenSearchError(`OpenSearch's search for existing report error: ${errorMessage(error)}`);
+	}
+	if (existing > 0) throw new AlreadySaved(`An SMTP TLS report ID ${reportId} from  ${orgName} with a date range of ${beginDateHuman} UTC to ${endDateHuman} UTC already exists in OpenSearch`);
+	let index = undatedIndexName("smtp_tls", options);
+	if (!options.useDataStreams) index = `${index}-${indexDate(beginDate, options.monthlyIndexes)}`;
+	const smtpTlsDoc = {
+		org_name: report.organizationName,
+		date_range: [beginDate, endDate],
+		date_begin: beginDate,
+		date_end: endDate,
+		contact_info: report.contactInfo,
+		report_id: report.reportId,
+		[TIMESTAMP_FIELD]: beginDate.isoformat()
+	};
+	for (const policy of report.policies) {
+		const policyStrings = "policyStrings" in policy ? policy.policyStrings : null;
+		const mxHostPatterns = "mxHostPatterns" in policy ? policy.mxHostPatterns : null;
+		const policyDomainCombined = policy.policyDomain || "none";
+		const policyTypeCombined = policy.policyType || "none";
+		appendTo(smtpTlsDoc, "policies_combined", `${policyDomainCombined} / ${policyTypeCombined}`);
+		const policyDoc = {
+			policy_domain: policy.policyDomain,
+			policy_type: policy.policyType,
+			successful_session_count: policy.successfulSessionCount,
+			failed_session_count: policy.failedSessionCount,
+			policy_string: policyStrings ?? null,
+			mx_host_patterns: mxHostPatterns ?? null
+		};
+		if ("failureDetails" in policy) for (const detail of policy.failureDetails ?? []) {
+			const longForm = detail;
+			let additionalInformationUri = null;
+			if ("additionalInfoUri" in detail) additionalInformationUri = detail.additionalInfoUri;
+			else if ("additionalInformationUri" in detail) additionalInformationUri = longForm.additionalInformationUri;
+			const pick = (key) => key in detail ? detail[key] : null;
+			const sendingMtaIp = pick("sendingMtaIp");
+			const receivingIp = pick("receivingIp");
+			const receivingMxHostname = pick("receivingMxHostname");
+			appendTo(policyDoc, "failure_details", {
+				result_type: detail.resultType,
+				ip_address: pick("ipAddress"),
+				sending_mta_ip: ipOrNull(sendingMtaIp, "sending_mta_ip"),
+				receiving_mx_hostname: receivingMxHostname,
+				receiving_mx_helo: pick("receivingMxHelo"),
+				receiving_ip: ipOrNull(receivingIp, "receiving_ip"),
+				failed_session_count: detail.failedSessionCount,
+				additional_information_uri: additionalInformationUri,
+				failure_reason_code: pick("failureReasonCode")
+			});
+			appendTo(smtpTlsDoc, "failure_details_combined", [
+				policyDomainCombined,
+				policyTypeCombined,
+				detail.resultType || "none",
+				pyStr(sendingMtaIp || "none"),
+				pyStr(receivingIp || "none"),
+				pyStr(receivingMxHostname || "none")
+			].join(" / "));
+		}
+		appendTo(smtpTlsDoc, "policies", policyDoc);
+	}
+	if (options.useDataStreams) await createDataStreams([index], indexSettings(options), INDEX_MAPPINGS.smtpTls, options);
+	else await createIndexes([index], indexSettings(options), INDEX_MAPPINGS.smtpTls, options);
+	try {
+		await saveDocument(options, SMTP_TLS_REPORT_DOC, index, smtpTlsDoc);
+	} catch (error) {
+		throw new OpenSearchError(`OpenSearch error: ${errorMessage(error)}`);
+	}
+}
+/** Backward-compatible alias of {@link saveFailureReportToOpenSearch}. */
+const saveForensicReportToOpenSearch = saveFailureReportToOpenSearch;
+export { AlreadySaved, BACKFILL, BulkIndexError, DOCUMENT_MAPPINGS, OpenSearchError, ScanError, createClient, createDataStreams, createIndexes, getDefaultConnection, migrateIndexes, saveAggregateReportToOpenSearch, saveFailureReportToOpenSearch, saveForensicReportToOpenSearch, saveSmtpTlsReportToOpenSearch, setDefaultConnection, setHosts };
+
+//# sourceMappingURL=index.js.map