agent-inbox 0.2.3 → 0.2.4

package/dist/mail/mail-gateway.d.ts

@@ -0,0 +1,114 @@
+/**
+ * MailGateway — the only mail-aware component the rest of the system touches.
+ *
+ * Ingress: transport.onReceive → policy (size / allow-list / DMARC) → dedup →
+ * bounce-detect → map → commit via router.routeMessage (single ingestion path).
+ * The transport ACKs only after this resolves (commit-before-ACK); a throw
+ * NACKs so the sender retries.
+ *
+ * Egress: router calls send() for mail-class recipients. The message is rendered
+ * and attempted; transient failures are queued durably and retried; permanent
+ * failures (and inbound DSNs) converge on one config-gated bounce handler.
+ *
+ * See docs/MAIL-INTEROP-PLAN.md §7, §8.
+ */
+import { EventEmitter } from "node:events";
+import type { Storage } from "../storage/interface.js";
+import type { MessageRouter, MailEgress } from "../router/message-router.js";
+import { DeliveryQueue } from "../federation/delivery-queue.js";
+import type { QueueStore } from "../federation/queue-store.js";
+import type { Message, MailIdentityConfig, DeliveryQueueConfig } from "../types.js";
+import type { MailTransport, InboundMail } from "./types.js";
+export interface MailGatewayConfig {
+    identity: MailIdentityConfig;
+    /** Domains we send to without erroring; combined with identity.localDomains. */
+    routableDomains?: string[];
+    /** Override the transport's maxMessageBytes for inbound rejection. */
+    maxMessageBytes?: number;
+    /** Inbound sender allow-list (domains). Empty/undefined = allow all. */
+    allowedSenderDomains?: string[];
+    /** Drop inbound mail whose DMARC verdict is "fail". */
+    rejectDmarcFail?: boolean;
+    /** Max attachments on an inbound message before it is rejected. */
+    maxAttachments?: number;
+    /**
+     * Inbound rate limiting (abuse control). Over-limit inbound is NACKed
+     * (transient) so legitimate senders back off and retry. Disabled if unset.
+     */
+    rateLimit?: {
+        /** Sliding window, ms (default 60000). */
+        windowMs?: number;
+        /** Max inbound per sender domain per window. */
+        perSenderDomain?: number;
+        /** Max inbound across all senders per window. */
+        global?: number;
+    };
+    /** Bounce behavior; both paths default on. */
+    bounce?: {
+        emitEvent?: boolean;
+        synthesizeInboxMessage?: boolean;
+    };
+    /** Domain used to mint outbound Message-IDs (defaults to primary local domain). */
+    messageIdDomain?: string;
+    /** Default inbox scope for inbound mail without plus-addressing. */
+    defaultScope?: string;
+    /** Delivery queue config for outbound retries. */
+    queue?: Partial<DeliveryQueueConfig>;
+}
+/** Thrown to NACK over-limit inbound so the sender backs off and retries. */
+export declare class RateLimitedError extends Error {
+    readonly scope: string;
+    constructor(scope: string);
+}
+export declare class MailGateway implements MailEgress {
+    private transport;
+    private storage;
+    private router;
+    private events;
+    private config;
+    private addressBook;
+    private mailDomains;
+    private senderLimiter;
+    private globalLimiter;
+    readonly queue: DeliveryQueue;
+    private retryTimer?;
+    private retrying;
+    constructor(opts: {
+        transport: MailTransport;
+        storage: Storage;
+        router: MessageRouter;
+        events: EventEmitter;
+        config: MailGatewayConfig;
+        /** Durable queue store for outbound retries (sqlite). Memory if omitted. */
+        queueStore?: QueueStore;
+    });
+    /** Start the underlying transport and the retry/TTL timers. */
+    start(intervalMs?: number): Promise<void>;
+    stop(): Promise<void>;
+    /** True if this recipient's domain is one we route mail for. */
+    ownsRecipient(agentId: string): boolean;
+    /** Render and deliver the mail-class recipients of a message. */
+    send(message: Message): Promise<void>;
+    /**
+     * Handle one inbound message. Resolves on ACK; throws on NACK (transient
+     * failure the sender should retry). Policy rejections ACK-and-drop so the
+     * sender does not retry forever.
+     */
+    handleInbound(mail: InboundMail): Promise<void>;
+    /** Attempt delivery; classify the result and queue/bounce accordingly. */
+    private attemptDelivery;
+    /** Re-attempt all retryable queued mail. Call from a timer or deterministically. */
+    processRetries(): Promise<void>;
+    private markDelivered;
+    private handleInboundBounce;
+    private bounce;
+    /** Inject a bounce notification into the original sender's inbox. */
+    private synthesizeBounce;
+    private reject;
+    /** Throw RateLimitedError (→ NACK) when an inbound limiter is exceeded. */
+    private enforceRateLimits;
+    private senderAllowed;
+    /** Dedup key: RFC Message-ID when present, else a synthetic content hash. */
+    private externalIdFor;
+}
+//# sourceMappingURL=mail-gateway.d.ts.map

package/dist/mail/mail-gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail-gateway.d.ts","sourceRoot":"","sources":["../../src/mail/mail-gateway.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAG7E,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAQ/D,OAAO,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACpF,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE7D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,gFAAgF;IAChF,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,sEAAsE;IACtE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wEAAwE;IACxE,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,uDAAuD;IACvD,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,SAAS,CAAC,EAAE;QACV,0CAA0C;QAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,gDAAgD;QAChD,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,iDAAiD;QACjD,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,8CAA8C;IAC9C,MAAM,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,sBAAsB,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IACnE,mFAAmF;IACnF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,KAAK,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACtC;AAKD,6EAA6E;AAC7E,qBAAa,gBAAiB,SAAQ,KAAK;aACb,KAAK,EAAE,MAAM;gBAAb,KAAK,EAAE,MAAM;CAI1C;AAED,qBAAa,WAAY,YAAW,UAAU;IAC5C,OAAO,CAAC,SAAS,CAAgB;IACjC,OAAO,CAAC,OAAO,CAAU;IACzB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,WAAW,CAAW;IAC9B,OAAO,CAAC,aAAa,CAA4B;IACjD,OAAO,CAAC,aAAa,CAA4B;IACjD,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,OAAO,CAAC,UAAU,CAAC,CAAiC;IACpD,OAAO,CAAC,QAAQ,CAAS;gBAEb,IAAI,EAAE;QAChB,SAAS,EAAE,aAAa,CAAC;QACzB,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,aAAa,CAAC;QACtB,MAAM,EAAE,YAAY,CAAC;QACrB,MAAM,EAAE,iBAAiB,CAAC;QAC1B,4EAA4E;QAC5E,UAAU,CAAC,EAAE,UAAU,CAAC;KACzB;IAqCD,+DAA+D;IACzD,KAAK,CAAC,UAAU,GAAE,MAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAQjD,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAS3B,gEAAgE;IAChE,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAMvC,iEAAiE;IAC3D,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAU3C;;;;OAIG;IACG,aAAa,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAiFrD,0EAA0E;YAC5D,eAAe;IAgF7B,oFAAoF;IAC9E,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAiBrC,OAAO,CAAC,aAAa;YAYP,mBAAmB;YAWnB,MAAM;IAgDpB,qEAAqE;YACvD,gBAAgB;IA4B9B,OAAO,CAAC,MAAM;IAQd,2EAA2E;IAC3E,OAAO,CAAC,iBAAiB;IAgBzB,OAAO,CAAC,aAAa;IAQrB,6EAA6E;IAC7E,OAAO,CAAC,aAAa;CAYtB"}

package/dist/mail/mail-gateway.js

@@ -0,0 +1,402 @@
+/**
+ * MailGateway — the only mail-aware component the rest of the system touches.
+ *
+ * Ingress: transport.onReceive → policy (size / allow-list / DMARC) → dedup →
+ * bounce-detect → map → commit via router.routeMessage (single ingestion path).
+ * The transport ACKs only after this resolves (commit-before-ACK); a throw
+ * NACKs so the sender retries.
+ *
+ * Egress: router calls send() for mail-class recipients. The message is rendered
+ * and attempted; transient failures are queued durably and retried; permanent
+ * failures (and inbound DSNs) converge on one config-gated bounce handler.
+ *
+ * See docs/MAIL-INTEROP-PLAN.md §7, §8.
+ */
+import { createHash } from "node:crypto";
+import { parseAddress } from "../federation/address.js";
+import { domainMatches } from "../router/destination.js";
+import { DeliveryQueue } from "../federation/delivery-queue.js";
+import { AddressBook } from "./address-book.js";
+import { RateLimiter } from "./rate-limiter.js";
+import { inboundMailToMessage, messageToOutboundMail, UnknownRecipientError, } from "./email-mapper.js";
+/** Single queue bucket for outbound mail retries. */
+const MAIL_QUEUE = "mail";
+/** Thrown to NACK over-limit inbound so the sender backs off and retries. */
+export class RateLimitedError extends Error {
+    scope;
+    constructor(scope) {
+        super(`Inbound rate limit exceeded (${scope})`);
+        this.scope = scope;
+        this.name = "RateLimitedError";
+    }
+}
+export class MailGateway {
+    transport;
+    storage;
+    router;
+    events;
+    config;
+    addressBook;
+    mailDomains;
+    senderLimiter = null;
+    globalLimiter = null;
+    queue;
+    retryTimer;
+    retrying = false;
+    constructor(opts) {
+        this.transport = opts.transport;
+        this.storage = opts.storage;
+        this.router = opts.router;
+        this.events = opts.events;
+        this.config = opts.config;
+        this.addressBook = new AddressBook(opts.config.identity);
+        if (this.addressBook.conflicts.length > 0) {
+            this.events.emit("mail.config.conflict", {
+                kind: "address-mapping",
+                conflicts: this.addressBook.conflicts,
+            });
+        }
+        this.mailDomains = [
+            ...opts.config.identity.localDomains,
+            ...(opts.config.routableDomains ?? []),
+        ];
+        this.queue = new DeliveryQueue(opts.events, opts.config.queue, opts.queueStore ? { store: opts.queueStore } : undefined);
+        const rl = opts.config.rateLimit;
+        if (rl) {
+            const windowMs = rl.windowMs ?? 60_000;
+            if (rl.perSenderDomain && rl.perSenderDomain > 0) {
+                this.senderLimiter = new RateLimiter(windowMs, rl.perSenderDomain);
+            }
+            if (rl.global && rl.global > 0) {
+                this.globalLimiter = new RateLimiter(windowMs, rl.global);
+            }
+        }
+        this.transport.onReceive((mail) => this.handleInbound(mail));
+    }
+    /** Start the underlying transport and the retry/TTL timers. */
+    async start(intervalMs = 30_000) {
+        await this.transport.start();
+        this.queue.startTicking();
+        this.retryTimer = setInterval(() => {
+            void this.processRetries();
+        }, intervalMs);
+    }
+    async stop() {
+        if (this.retryTimer)
+            clearInterval(this.retryTimer);
+        this.retryTimer = undefined;
+        this.queue.stopTicking();
+        await this.transport.stop();
+    }
+    // -- MailEgress ----------------------------------------------------------
+    /** True if this recipient's domain is one we route mail for. */
+    ownsRecipient(agentId) {
+        if (agentId.indexOf("@") === -1)
+            return false;
+        const addr = parseAddress(agentId);
+        return addr.system ? domainMatches(addr.system, this.mailDomains) : false;
+    }
+    /** Render and deliver the mail-class recipients of a message. */
+    async send(message) {
+        const mailRecipients = message.recipients.filter((r) => this.ownsRecipient(r.agent_id));
+        if (mailRecipients.length === 0)
+            return;
+        await this.attemptDelivery({ ...message, recipients: mailRecipients });
+    }
+    // -- Ingress -------------------------------------------------------------
+    /**
+     * Handle one inbound message. Resolves on ACK; throws on NACK (transient
+     * failure the sender should retry). Policy rejections ACK-and-drop so the
+     * sender does not retry forever.
+     */
+    async handleInbound(mail) {
+        const cap = this.config.maxMessageBytes ?? this.transport.capabilities.maxMessageBytes;
+        if (mail.sizeBytes > cap) {
+            this.reject(mail, "size-exceeded");
+            return;
+        }
+        // Rate limiting (abuse control) — applies to all inbound including bounces.
+        // Over-limit NACKs (throws) so legitimate senders back off and retry.
+        this.enforceRateLimits(mail);
+        // Bounces/DSNs correlate to a prior send rather than routing as new mail.
+        if (mail.bounce) {
+            await this.handleInboundBounce(mail);
+            return;
+        }
+        if (!this.senderAllowed(mail)) {
+            this.reject(mail, "sender-not-allowed");
+            return;
+        }
+        if (this.config.rejectDmarcFail && mail.authResults?.dmarc === "fail") {
+            this.reject(mail, "dmarc-fail");
+            return;
+        }
+        const maxAtt = this.config.maxAttachments;
+        if (maxAtt !== undefined && (mail.attachments?.length ?? 0) > maxAtt) {
+            this.reject(mail, "too-many-attachments");
+            return;
+        }
+        const externalId = this.externalIdFor(mail);
+        if (this.storage.hasSeenExternalId(externalId)) {
+            this.events.emit("mail.duplicate", { externalId });
+            return; // already ingested — ACK without re-injecting
+        }
+        let mapped;
+        try {
+            mapped = inboundMailToMessage(mail, {
+                addressBook: this.addressBook,
+                defaultScope: this.config.defaultScope,
+                lookupInboxIdByRfcMessageId: (id) => this.storage.getMessageIdByExternalId(id),
+            });
+        }
+        catch (err) {
+            if (err instanceof UnknownRecipientError) {
+                this.reject(mail, "no-local-recipient");
+                return;
+            }
+            throw err; // unexpected — NACK
+        }
+        // Single ingestion path: routeMessage stores, marks delivery, fires events.
+        // When the reply resolves to a known parent, inherit the parent's thread_tag
+        // (keeps threads consistent even for clients that send In-Reply-To without a
+        // full References chain). Fall back to our derived tag if the parent is gone.
+        const parentThreadTag = mapped.in_reply_to
+            ? this.storage.getMessage(mapped.in_reply_to)?.thread_tag
+            : undefined;
+        const stored = await this.router.routeMessage({
+            from: mapped.sender_id,
+            to: mapped.recipients.map((r) => ({ agent_id: r.agent_id, kind: r.kind })),
+            payload: mapped.content,
+            scope: mapped.scope,
+            subject: mapped.subject,
+            threadTag: parentThreadTag ?? mapped.thread_tag,
+            inReplyTo: mapped.in_reply_to,
+            importance: mapped.importance,
+            metadata: mapped.metadata,
+        });
+        this.storage.recordExternalId(externalId, stored.id);
+        this.events.emit("mail.received", { messageId: stored.id, externalId });
+    }
+    // -- Egress delivery -----------------------------------------------------
+    /** Attempt delivery; classify the result and queue/bounce accordingly. */
+    async attemptDelivery(message, queuedId) {
+        const outbound = messageToOutboundMail(message, {
+            addressBook: this.addressBook,
+            messageIdDomain: this.config.messageIdDomain,
+            lookupRfcMessageId: (id) => this.storage.getMessage(id)?.metadata.rfcMessageId,
+            lookupReferences: (id) => this.storage.getMessage(id)?.metadata.rfcReferences,
+        });
+        let disposition;
+        let detail;
+        let code;
+        let remoteMessageId;
+        try {
+            const res = await this.transport.send(outbound);
+            disposition = res.disposition;
+            detail = res.detail;
+            code = res.code;
+            remoteMessageId = res.remoteMessageId;
+        }
+        catch (err) {
+            // Transport threw (e.g. not ready) — treat as transient, keep retrying.
+            disposition = "transient";
+            detail = err instanceof Error ? err.message : String(err);
+        }
+        if (disposition === "delivered") {
+            // Record our Message-ID so an inbound DSN or reply can correlate back.
+            this.storage.recordExternalId(outbound.headers.messageId, message.id);
+            // Also record the provider's id — some backends (Postmark) reference their
+            // own message id in bounce webhooks rather than the RFC Message-ID.
+            if (remoteMessageId) {
+                this.storage.recordExternalId(remoteMessageId, message.id);
+            }
+            this.markDelivered(message);
+            if (queuedId)
+                this.queue.removeEntry(MAIL_QUEUE, queuedId);
+            this.events.emit("mail.sent", { messageId: message.id, remoteMessageId });
+            return;
+        }
+        if (disposition === "transient") {
+            if (queuedId) {
+                // recordAttempt returns false once retryMaxAttempts is exhausted (the
+                // entry is then removed). Bounce instead of silently dropping it.
+                const kept = this.queue.recordAttempt(MAIL_QUEUE, queuedId);
+                if (!kept) {
+                    await this.bounce({
+                        message,
+                        recipient: outbound.to.map((t) => t.address).join(", "),
+                        status: code ? String(code) : undefined,
+                        diagnostic: detail ?? "retries exhausted",
+                        action: "failed",
+                    });
+                    return;
+                }
+            }
+            else {
+                this.queue.enqueue(MAIL_QUEUE, message);
+            }
+            this.events.emit("mail.queued", { messageId: message.id, detail });
+            return;
+        }
+        // permanent
+        if (queuedId)
+            this.queue.removeEntry(MAIL_QUEUE, queuedId);
+        await this.bounce({
+            message,
+            recipient: outbound.to.map((t) => t.address).join(", "),
+            status: code ? String(code) : undefined,
+            diagnostic: detail,
+            action: "failed",
+        });
+    }
+    /** Re-attempt all retryable queued mail. Call from a timer or deterministically. */
+    async processRetries() {
+        // Guard against overlapping ticks: a slow send must not be re-selected and
+        // re-sent by the next interval while it is still in flight.
+        if (this.retrying)
+            return;
+        this.retrying = true;
+        // Opportunistically reclaim idle rate-limiter keys (bounded memory).
+        this.senderLimiter?.prune();
+        this.globalLimiter?.prune();
+        try {
+            for (const entry of this.queue.getRetryable(MAIL_QUEUE)) {
+                await this.attemptDelivery(entry.message, entry.id);
+            }
+        }
+        finally {
+            this.retrying = false;
+        }
+    }
+    markDelivered(message) {
+        const stored = this.storage.getMessage(message.id);
+        if (!stored)
+            return;
+        const now = new Date().toISOString();
+        for (const r of stored.recipients) {
+            if (this.ownsRecipient(r.agent_id))
+                r.delivered_at = now;
+        }
+        this.storage.putMessage(stored);
+    }
+    // -- Bounce (shared by outbound permanent + inbound DSN) -----------------
+    async handleInboundBounce(mail) {
+        const b = mail.bounce;
+        await this.bounce({
+            originalMessageId: b.originalMessageId,
+            recipient: b.recipient,
+            status: b.status,
+            diagnostic: b.diagnostic,
+            action: b.action,
+        });
+    }
+    async bounce(opts) {
+        let original = opts.message;
+        if (!original && opts.originalMessageId) {
+            const inboxId = this.storage.getMessageIdByExternalId(opts.originalMessageId);
+            if (inboxId)
+                original = this.storage.getMessage(inboxId);
+        }
+        // A delayed DSN means the peer MTA is still retrying — surface, don't bounce.
+        if (opts.action === "delayed") {
+            this.events.emit("mail.queued", {
+                messageId: original?.id,
+                recipient: opts.recipient,
+                delayed: true,
+            });
+            return;
+        }
+        // A positive DSN ("delivered") is informational only.
+        if (opts.action === "delivered")
+            return;
+        // Dedup: a replayed/spoofed DSN echoing a known message id must not
+        // repeatedly emit events or synthesize inbox notices (flood protection).
+        const bounceKey = `bounce:${original?.id ?? opts.originalMessageId ?? "?"}:${opts.recipient}`;
+        if (this.storage.hasSeenExternalId(bounceKey))
+            return;
+        this.storage.recordExternalId(bounceKey, original?.id ?? bounceKey);
+        if (this.config.bounce?.emitEvent !== false) {
+            this.events.emit("mail.bounced", {
+                messageId: original?.id,
+                recipient: opts.recipient,
+                status: opts.status,
+                diagnostic: opts.diagnostic,
+            });
+        }
+        if (this.config.bounce?.synthesizeInboxMessage !== false && original) {
+            await this.synthesizeBounce(original, opts);
+        }
+    }
+    /** Inject a bounce notification into the original sender's inbox. */
+    async synthesizeBounce(original, opts) {
+        const parts = [`Delivery to ${opts.recipient} failed`];
+        if (opts.status)
+            parts.push(`(${opts.status})`);
+        if (opts.diagnostic)
+            parts.push(`- ${opts.diagnostic}`);
+        await this.router.routeMessage({
+            from: "mailer-daemon",
+            to: [{ agent_id: original.sender_id, kind: "to" }],
+            subject: `Delivery failed: ${original.subject ?? "(no subject)"}`,
+            payload: { type: "text", text: parts.join(" ") },
+            inReplyTo: original.id,
+            importance: "high",
+            scope: original.scope,
+            metadata: {
+                bounce: {
+                    recipient: opts.recipient,
+                    status: opts.status,
+                    diagnostic: opts.diagnostic,
+                },
+            },
+        });
+    }
+    // -- Helpers -------------------------------------------------------------
+    reject(mail, reason) {
+        this.events.emit("mail.rejected", {
+            reason,
+            from: mail.from.address,
+            to: mail.to.map((t) => t.address),
+        });
+    }
+    /** Throw RateLimitedError (→ NACK) when an inbound limiter is exceeded. */
+    enforceRateLimits(mail) {
+        if (this.globalLimiter && !this.globalLimiter.tryAcquire("*")) {
+            this.events.emit("mail.rate_limited", { scope: "global" });
+            throw new RateLimitedError("global");
+        }
+        if (this.senderLimiter) {
+            const from = mail.from.address || mail.envelopeFrom || "unknown";
+            const at = from.lastIndexOf("@");
+            const domain = at === -1 ? from : from.slice(at + 1).toLowerCase();
+            if (!this.senderLimiter.tryAcquire(domain)) {
+                this.events.emit("mail.rate_limited", { scope: "sender", domain });
+                throw new RateLimitedError(`sender:${domain}`);
+            }
+        }
+    }
+    senderAllowed(mail) {
+        const allow = this.config.allowedSenderDomains;
+        if (!allow || allow.length === 0)
+            return true;
+        const at = mail.from.address.lastIndexOf("@");
+        if (at === -1)
+            return false;
+        return domainMatches(mail.from.address.slice(at + 1), allow);
+    }
+    /** Dedup key: RFC Message-ID when present, else a synthetic content hash. */
+    externalIdFor(mail) {
+        if (mail.headers.messageId)
+            return mail.headers.messageId;
+        const h = createHash("sha256");
+        h.update(mail.from.address);
+        h.update("\0");
+        h.update(mail.subject ?? "");
+        h.update("\0");
+        h.update(mail.receivedAt);
+        h.update("\0");
+        h.update((mail.text ?? mail.html ?? "").slice(0, 4096));
+        return "syn:" + h.digest("hex");
+    }
+}
+//# sourceMappingURL=mail-gateway.js.map

package/dist/mail/mail-gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mail-gateway.js","sourceRoot":"","sources":["../../src/mail/mail-gateway.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAEhE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAsC3B,qDAAqD;AACrD,MAAM,UAAU,GAAG,MAAM,CAAC;AAE1B,6EAA6E;AAC7E,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACb;IAA5B,YAA4B,KAAa;QACvC,KAAK,CAAC,gCAAgC,KAAK,GAAG,CAAC,CAAC;QADtB,UAAK,GAAL,KAAK,CAAQ;QAEvC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,MAAM,OAAO,WAAW;IACd,SAAS,CAAgB;IACzB,OAAO,CAAU;IACjB,MAAM,CAAgB;IACtB,MAAM,CAAe;IACrB,MAAM,CAAoB;IAC1B,WAAW,CAAc;IACzB,WAAW,CAAW;IACtB,aAAa,GAAuB,IAAI,CAAC;IACzC,aAAa,GAAuB,IAAI,CAAC;IACxC,KAAK,CAAgB;IACtB,UAAU,CAAkC;IAC5C,QAAQ,GAAG,KAAK,CAAC;IAEzB,YAAY,IAQX;QACC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE;gBACvC,IAAI,EAAE,iBAAiB;gBACvB,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS;aACtC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,WAAW,GAAG;YACjB,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY;YACpC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC;SACvC,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,IAAI,aAAa,CAC5B,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,MAAM,CAAC,KAAK,EACjB,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CACzD,CAAC;QAEF,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QACjC,IAAI,EAAE,EAAE,CAAC;YACP,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,IAAI,MAAM,CAAC;YACvC,IAAI,EAAE,CAAC,eAAe,IAAI,EAAE,CAAC,eAAe,GAAG,CAAC,EAAE,CAAC;gBACjD,IAAI,CAAC,aAAa,GAAG,IAAI,WAAW,CAAC,QAAQ,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC;YACrE,CAAC;YACD,IAAI,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/B,IAAI,CAAC,aAAa,GAAG,IAAI,WAAW,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,KAAK,CAAC,aAAqB,MAAM;QACrC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAC1B,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE;YACjC,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;QAC7B,CAAC,EAAE,UAAU,CAAC,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,UAAU;YAAE,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IAED,2EAA2E;IAE3E,gEAAgE;IAChE,aAAa,CAAC,OAAe;QAC3B,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9C,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5E,CAAC;IAED,iEAAiE;IACjE,KAAK,CAAC,IAAI,CAAC,OAAgB;QACzB,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACrD,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAC/B,CAAC;QACF,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACxC,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,2EAA2E;IAE3E;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,IAAiB;QACnC,MAAM,GAAG,GACP,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,eAAe,CAAC;QAC7E,IAAI,IAAI,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;QAED,4EAA4E;QAC5E,sEAAsE;QACtE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAE7B,0EAA0E;QAC1E,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,MAAM,EAAE,CAAC;YACtE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;QAC1C,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC;YACrE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;YACnD,OAAO,CAAC,8CAA8C;QACxD,CAAC;QAED,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,oBAAoB,CAAC,IAAI,EAAE;gBAClC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;gBACtC,2BAA2B,EAAE,CAAC,EAAE,EAAE,EAAE,CAClC,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,EAAE,CAAC;aAC5C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,qBAAqB,EAAE,CAAC;gBACzC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;gBACxC,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC,CAAC,oBAAoB;QACjC,CAAC;QAED,4EAA4E;QAC5E,6EAA6E;QAC7E,6EAA6E;QAC7E,8EAA8E;QAC9E,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW;YACxC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,UAAU;YACzD,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YAC5C,IAAI,EAAE,MAAM,CAAC,SAAS;YACtB,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1E,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,eAAe,IAAI,MAAM,CAAC,UAAU;YAC/C,SAAS,EAAE,MAAM,CAAC,WAAW;YAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,2EAA2E;IAE3E,0EAA0E;IAClE,KAAK,CAAC,eAAe,CAC3B,OAAgB,EAChB,QAAiB;QAEjB,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,EAAE;YAC9C,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe;YAC5C,kBAAkB,EAAE,CAAC,EAAE,EAAE,EAAE,CACzB,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,YAEzB;YACf,gBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,CACvB,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,aAEzB;SAChB,CAAC,CAAC;QAEH,IAAI,WAAoD,CAAC;QACzD,IAAI,MAA0B,CAAC;QAC/B,IAAI,IAAwB,CAAC;QAC7B,IAAI,eAAmC,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAChD,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;YAC9B,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YACpB,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;YAChB,eAAe,GAAG,GAAG,CAAC,eAAe,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,WAAW,GAAG,WAAW,CAAC;YAC1B,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;YAChC,uEAAuE;YACvE,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACtE,2EAA2E;YAC3E,oEAAoE;YACpE,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,eAAe,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YAC5B,IAAI,QAAQ;gBAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QAED,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;YAChC,IAAI,QAAQ,EAAE,CAAC;gBACb,sEAAsE;gBACtE,kEAAkE;gBAClE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;gBAC5D,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,MAAM,IAAI,CAAC,MAAM,CAAC;wBAChB,OAAO;wBACP,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;wBACvD,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;wBACvC,UAAU,EAAE,MAAM,IAAI,mBAAmB;wBACzC,MAAM,EAAE,QAAQ;qBACjB,CAAC,CAAC;oBACH,OAAO;gBACT,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QAED,YAAY;QACZ,IAAI,QAAQ;YAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC3D,MAAM,IAAI,CAAC,MAAM,CAAC;YAChB,OAAO;YACP,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACvD,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YACvC,UAAU,EAAE,MAAM;YAClB,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;IACL,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,cAAc;QAClB,2EAA2E;QAC3E,4DAA4D;QAC5D,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,qEAAqE;QACrE,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;gBACxD,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,OAAgB;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YAClC,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAAE,CAAC,CAAC,YAAY,GAAG,GAAG,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,2EAA2E;IAEnE,KAAK,CAAC,mBAAmB,CAAC,IAAiB;QACjD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAO,CAAC;QACvB,MAAM,IAAI,CAAC,MAAM,CAAC;YAChB,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;YACtC,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,MAAM,EAAE,CAAC,CAAC,MAAM;SACjB,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,IAOpB;QACC,IAAI,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,wBAAwB,CACnD,IAAI,CAAC,iBAAiB,CACvB,CAAC;YACF,IAAI,OAAO;gBAAE,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC3D,CAAC;QAED,8EAA8E;QAC9E,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE;gBAC9B,SAAS,EAAE,QAAQ,EAAE,EAAE;gBACvB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,sDAAsD;QACtD,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW;YAAE,OAAO;QAExC,oEAAoE;QACpE,yEAAyE;QACzE,MAAM,SAAS,GAAG,UAAU,QAAQ,EAAE,EAAE,IAAI,IAAI,CAAC,iBAAiB,IAAI,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9F,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,CAAC;YAAE,OAAO;QACtD,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,IAAI,SAAS,CAAC,CAAC;QAEpE,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,KAAK,KAAK,EAAE,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE;gBAC/B,SAAS,EAAE,QAAQ,EAAE,EAAE;gBACvB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,sBAAsB,KAAK,KAAK,IAAI,QAAQ,EAAE,CAAC;YACrE,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,qEAAqE;IAC7D,KAAK,CAAC,gBAAgB,CAC5B,QAAiB,EACjB,IAAiE;QAEjE,MAAM,KAAK,GAAG,CAAC,eAAe,IAAI,CAAC,SAAS,SAAS,CAAC,CAAC;QACvD,IAAI,IAAI,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,UAAU;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAExD,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC;YAC7B,IAAI,EAAE,eAAe;YACrB,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAClD,OAAO,EAAE,oBAAoB,QAAQ,CAAC,OAAO,IAAI,cAAc,EAAE;YACjE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YAChD,SAAS,EAAE,QAAQ,CAAC,EAAE;YACtB,UAAU,EAAE,MAAM;YAClB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,QAAQ,EAAE;gBACR,MAAM,EAAE;oBACN,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,UAAU,EAAE,IAAI,CAAC,UAAU;iBAC5B;aACF;SACF,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAEnE,MAAM,CAAC,IAAiB,EAAE,MAAc;QAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE;YAChC,MAAM;YACN,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;YACvB,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IACnE,iBAAiB,CAAC,IAAiB;QACzC,IAAI,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC3D,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,YAAY,IAAI,SAAS,CAAC;YACjE,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACnE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;gBACnE,MAAM,IAAI,gBAAgB,CAAC,UAAU,MAAM,EAAE,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,IAAiB;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;QAC/C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5B,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/D,CAAC;IAED,6EAA6E;IACrE,aAAa,CAAC,IAAiB;QACrC,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1D,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACf,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC7B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACf,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACf,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACxD,OAAO,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;CACF"}