tsdmarc 0.0.0-stage → 1.0.0

package/dist/index.js

@@ -0,0 +1,3146 @@
+import { $ as RFC_9990_NAMESPACE, $n as InvalidForensicReport, $t as camelToSnake, A as pyJsonDumps, An as Logger, Ar as createParserConfig, At as DNSTimeout, B as CalledProcessError, Bn as formatAsctime, Br as RECOMMENDED_DNS_NAMESERVERS, Bt as UnknownRdatatype, Cn as CRITICAL, Cr as DEFAULT_MAX_XML_DEPTH, Ct as queryDns, D as parseReportFileTask, Dn as FileHandler, Dr as IP_ADDRESS_CACHE, Dt as DNSException, E as parseReportEmailTask, En as ERROR, Er as ExpiringDict, Et as BadResponse, F as parseForensicReport, Fn as basicFormat, Fr as replaceParserConfig, Ft as NXDOMAIN, G as isMbox, Gn as DownloadError, Gt as InvalidURL, H as convertOutlookMsg, Hn as getLogger, Hr as VERSION, Ht as getBaseDomain, I as parsedFailureReportsToCsv, In as captureLogs, Ir as resolveParserConfig, It as NameTooLong, J as parseEmailAddress, Jn as EnrichmentError, Jt as Message, K as isOutlookMsg, Kn as EmailParserError, Kt as maskNameserverSecrets, L as parsedFailureReportsToCsvRows, Ln as configureLogging, Lr as DEFAULT_DNS_MAX_RETRIES, Lt as NoAnswer, M as EMAIL_SAMPLE_CONTENT_TYPES, Mn as NullHandler, Mr as newSeenAggregateReportIds, Mt as IDNAException, N as FAILURE_CSV_FIELDS, Nn as StreamHandler, Nr as parserConfigFromState, Nt as LabelTooLong, On as Handler, Or as REVERSE_DNS_MAP, Ot as DNSFormError, P as parseFailureReport, Pn as WARNING, Pr as parserConfigToState, Pt as LifetimeTimeout, Q as RFC_7489_REMOVED_POLICY_OVERRIDE_TYPES, Qn as InvalidFailureReport, Qt as RecursionError, R as parsedForensicReportsToCsv, Rn as consoleFormat, Rr as DEFAULT_DNS_TIMEOUT, Rt as NoMetaqueries, Sn as PyDateTime, Sr as DEFAULT_MAX_WORKER_HEAP_MB, St as getReverseDns, T as parallelMap, Tn as DEBUG, Tr as DEFAULT_PARSER_OPTIONS, Tt as BadEscape, U as decodeBase64, Un as logger, Ut as loadPslOverrides, V as MSGCONVERT_TIMEOUT_MS, Vn as getLevelName, Vr as USER_AGENT, Vt as YXDOMAIN, W as getFilenameSafeString, Wn as sanitizeForLog, Wt as pslOverrides, X as AGGREGATE_CSV_FIELDS, Xn as InvalidAggregateReport, Xt as formatParam, Y as parseEmailText, Yn as IPDatabaseError, Yt as base64BodyEncode, Z as NormalizedRecordBudget, Zn as InvalidDMARCReport, Zt as MessageError, _ as JSONDecodeError, _n as humanTimestampToUnixTimestamp, _r as DEFAULT_MAX_LOOKUPS_PER_REPORT, _t as loadIpDb, a as aggregateReportKey, an as decompressGzipBounded, ar as CsvDictWriter, at as parseAggregateReportXml, b as JobTimeoutError, bn as timestampToDatetime, br as DEFAULT_MAX_NORMALIZED_RECORDS, bt as DNSSocketError, c as emailByteLength, cn as extractReportFromStream, cr as rowsToCsv, ct as parsedAggregateReportsToCsvRows, d as SMTP_TLS_CSV_FIELDS, dn as PyAttributeError, dr as pyStr, dt as configureIpinfoApi, en as snakeToCamel, er as InvalidIPinfoAPIKey, et as RFC_9990_POLICY_OVERRIDE_TYPES, f as parseSmtpTlsFailureDetails, fn as PyValueError, fr as DEFAULT_JOB_TIMEOUT, ft as getIpAddressCountry, g as parsedSmtpTlsReportsToCsvRows, gn as humanTimestampToDatetime, gr as DEFAULT_MAX_HEADER_LINES, gt as ipInfoState, h as parsedSmtpTlsReportsToCsv, hn as DateParseError, hr as DEFAULT_MAX_FAILED_LOOKUPS_PER_REPORT, ht as getServiceFromReverseDnsBaseDomain, i as TEXT_REPORT_REGEX, in as MAX_DECOMPRESSED_SLOW_CODEC_SIZE, ir as findEnrichmentError, it as parseAggregateReportFromFilePath, j as rawJsonIntegers, jn as NOTSET, jr as newIpAddressCache, jt as EmptyLabel, k as PyJsonNumber, kn as INFO, kr as SEEN_AGGREGATE_REPORT_IDS, kt as DNSSyntaxError, l as parseReportEmail, ln as pyDecode, lr as pyFloatRepr, lt as unwrapText, m as parseSmtpTlsReportPolicy, mn as pyInt, mr as DEFAULT_MAX_EXPANDED_EMAIL_SIZE, mt as getIpAddressInfo, n as parseReportFile, nn as toSnakeCaseKeys, nr as ParserError, nt as bucketIntervalByDay, o as checkEmailLimits, on as extractReport, or as csvFormulaEscape, ot as parseReportRecord, p as parseSmtpTlsReportJson, pn as errorText, pr as DEFAULT_MAX_EMAIL_SIZE, pt as getIpAddressDbRecord, q as parseEmail, qn as EmailTooLargeError, qt as redactUrlCredentials, r as parseReportFileJob, rn as MAX_DECOMPRESSED_REPORT_SIZE, rr as emailTooLargeError, rt as parseAggregateReportFile, s as classifyParsedEmail, sn as extractReportFromFilePath, sr as csvSafe, st as parsedAggregateReportsToCsv, t as getDmarcReportsFromMbox, tn as toCamelCaseKeys, tr as InvalidSMTPTLSReport, tt as appendParsedRecord, u as parseReportEmailJob, un as KeyError, ur as pyRepr, ut as ExpatError, v as pyJsonLoads, vn as parseDate, vr as DEFAULT_MAX_LOOKUP_TIME_PER_REPORT, vt as loadReverseDnsMap, w as initWorker, wn as CaptureHandler, wr as DEFAULT_MAX_XML_NODES, wt as reverseNameFromAddress, x as WorkerCrashedError, xn as timestampToHuman, xr as DEFAULT_MAX_SMTP_TLS_REPORT_SIZE, xt as InvalidNameserverError, y as BrokenProcessPool, yn as stripComments, yr as DEFAULT_MAX_MIME_PARTS, yt as DEFAULT_NAMESERVERS, z as parsedForensicReportsToCsvRows, zn as fileFormat, zr as PARSEDMARC_COMPAT_VERSION, zt as NoNameservers } from "./report-file-C6u0I5I1.js";
+import { constants, mkdirSync, readFileSync, statSync } from "node:fs";
+import path from "node:path";
+import { mkdir, mkdtemp, open, opendir, readFile, readdir, realpath, rename, rm, rmdir, stat, unlink, writeFile } from "node:fs/promises";
+import { request } from "node:http";
+import { randomBytes } from "node:crypto";
+import { EOL, homedir, hostname, tmpdir } from "node:os";
+import { createSocket } from "node:dgram";
+import { lookup } from "node:dns/promises";
+import { connect, isIP } from "node:net";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
+import { connect as connect$1, getCACertificates } from "node:tls";
+import { zipSync } from "fflate";
+import { deflateSync } from "node:zlib";
+import { request as request$1 } from "node:https";
+import { Buffer as Buffer$1 } from "node:buffer";
+// src/mailbox/base.ts
+/** Raised by mailbox methods a backend does not implement. */
+var NotImplementedError = class extends Error {
+	name = "NotImplementedError";
+};
+/** A folder/label operation targets a name that is already taken. */
+var FolderExistsError = class extends Error {
+	name = "FolderExistsError";
+};
+/** A folder/label referenced by an operation does not exist. */
+var FolderNotFoundError = class extends Error {
+	name = "FolderNotFoundError";
+};
+function notImplemented(method) {
+	return Promise.reject(new NotImplementedError(`${method} is not implemented by this mailbox backend`));
+}
+var MailboxConnection = class {
+	/**
+	* Tells this mailbox from others whose message IDs may be the same, for
+	* state kept between calls (several connection objects to one mailbox
+	* share it). Backends whose IDs are unique on their own leave it empty.
+	*/
+	get mailboxIdentity() {
+		return "";
+	}
+	createFolder(_folderName) {
+		return notImplemented("createFolder");
+	}
+	deleteFolder(_folderName) {
+		return notImplemented("deleteFolder");
+	}
+	/**
+	* Rename a folder. Implementations call `ensureNoFolderConflict()` first,
+	* so renaming onto an existing name throws `FolderExistsError`.
+	*/
+	renameFolder(_oldName, _newName) {
+		return notImplemented("renameFolder");
+	}
+	folderExists(_folderName) {
+		return notImplemented("folderExists");
+	}
+	/** Throw `FolderExistsError` if `folderName` already exists. */
+	async ensureNoFolderConflict(folderName) {
+		if (await this.folderExists(folderName)) throw new FolderExistsError(`cannot rename to ${JSON.stringify(folderName)}: a folder or label with that name already exists`);
+	}
+	/**
+	* Move a folder (and its contents). Give exactly one of `newPath` (the
+	* complete new path) or `newParent` (keep the leaf name).
+	*/
+	async moveFolder(source, options) {
+		const newPath = options.newPath ?? null;
+		const newParent = options.newParent ?? null;
+		if (newPath === null === (newParent === null)) throw new PyValueError("provide exactly one of newPath or newParent");
+		if (!await this.folderExists(source)) throw new FolderNotFoundError(`folder ${JSON.stringify(source)} not found`);
+		let targetParent;
+		let targetPath;
+		if (newParent === null) {
+			const path = newPath;
+			const slash = path.lastIndexOf("/");
+			targetParent = slash === -1 ? "" : path.slice(0, slash);
+			targetPath = path;
+		} else {
+			const sourceLeaf = source.slice(source.lastIndexOf("/") + 1);
+			targetParent = newParent;
+			targetPath = newParent ? `${newParent}/${sourceLeaf}` : sourceLeaf;
+		}
+		if (targetParent && !await this.folderExists(targetParent)) {
+			if (options.create) await this.createFolder(targetParent);
+			else throw new FolderNotFoundError(`destination parent ${JSON.stringify(targetParent)} not found (pass create: true to create it)`);
+		}
+		await this.ensureNoFolderConflict(targetPath);
+		await this.doMoveFolder(source, targetParent, targetPath);
+	}
+	/** Move every message of each source folder into `destination`. */
+	async mergeFolders(sources, destination, options = {}) {
+		const sourceList = typeof sources === "string" ? [sources] : sources;
+		if (!await this.folderExists(destination)) {
+			if (options.create) await this.createFolder(destination);
+			else throw new FolderNotFoundError(`destination ${JSON.stringify(destination)} not found (pass create: true to create it)`);
+		}
+		for (const source of sourceList) {
+			if (source === destination) continue;
+			if (!await this.folderExists(source)) throw new FolderNotFoundError(`folder ${JSON.stringify(source)} not found`);
+			for (const messageId of await this.fetchMessages(source)) await this.moveMessageFrom(messageId, source, destination);
+			if (!options.keepSourceFolders) await this.deleteFolder(source);
+		}
+	}
+	/** Backend-specific relocation, called by `moveFolder()` after validation. */
+	doMoveFolder(_source, _targetParent, _targetPath) {
+		return notImplemented("moveFolder");
+	}
+	/** Move one message during `mergeFolders()`. Defaults to `moveMessage()`. */
+	moveMessageFrom(messageId, _source, destination) {
+		return this.moveMessage(messageId, destination);
+	}
+	/** Identifiers of the messages in a folder. */
+	fetchMessages(_reportsFolder, _options) {
+		return notImplemented("fetchMessages");
+	}
+	/** Raw RFC 822 contents of a message. */
+	fetchMessage(_messageId, _options) {
+		return notImplemented("fetchMessage");
+	}
+	deleteMessage(_messageId) {
+		return notImplemented("deleteMessage");
+	}
+	moveMessage(_messageId, _folderName) {
+		return notImplemented("moveMessage");
+	}
+	/** Send a no-op to keep the connection alive (if applicable). */
+	keepalive() {
+		return notImplemented("keepalive");
+	}
+	/** Watch for new messages, calling `checkCallback` on new mail or each interval. */
+	watch(_options) {
+		return notImplemented("watch");
+	}
+	/** Send through the backend's native API. Returns a message ID when available. */
+	sendMessage(_options) {
+		return notImplemented("sendMessage");
+	}
+	/** Release network resources. No-op for backends without a connection. */
+	close() {
+		return Promise.resolve();
+	}
+};
+// src/mailbox/reports.ts
+/**
+* Per-message count of consecutive failed saves, keyed on
+* `failedSaveKey(connection, reportsFolder, messageUid)` (parsedmarc's
+* `_FAILED_SAVE_ATTEMPTS`). Populated when a `saveCallback` reports a batch
+* unsaved, or a message runs past `jobTimeout` or loses its worker; a message
+* whose count exceeds `maxUnsavedRetries` is moved to `{archiveFolder}/Unsaved` and its
+* entry dropped. A successful save clears the entries of its batch.
+*
+* Process-local and deliberately not persisted: a restart re-attempts every
+* message still in the reports folder (retry rather than shelve). Unlike
+* parsedmarc's, the key carries `mailboxIdentity`: IMAP UIDs are small
+* integers, so two mailboxes would share counters. Reconnecting to the same
+* mailbox keeps them.
+*/
+const FAILED_SAVE_ATTEMPTS = /* @__PURE__ */ new Map();
+/** The `FAILED_SAVE_ATTEMPTS` key: Python's `(reports_folder, str(uid))` plus the mailbox. */
+function failedSaveKey(connection, reportsFolder, messageUid) {
+	return JSON.stringify([
+		connection.mailboxIdentity,
+		reportsFolder,
+		String(messageUid)
+	]);
+}
+/** Each connection's seen aggregate report IDs, for calls without `config`. */
+const CONNECTION_SEEN_REPORT_IDS = /* @__PURE__ */ new WeakMap();
+/**
+* `resolveParserConfig()` for a mailbox: without an explicit `config`, dedup
+* is per connection instead of per process (parsedmarc's module-wide
+* cache), so a report seen in one mailbox isn't dropped, and its message
+* archived unsaved, in another. Share an explicit `config` to dedup across
+* connections.
+*/
+function resolveMailboxConfig(connection, input) {
+	const config = resolveParserConfig(input);
+	if (input.config) return config;
+	let seenAggregateReportIds = CONNECTION_SEEN_REPORT_IDS.get(connection);
+	if (seenAggregateReportIds === void 0) {
+		seenAggregateReportIds = newSeenAggregateReportIds();
+		CONNECTION_SEEN_REPORT_IDS.set(connection, seenAggregateReportIds);
+	}
+	return replaceParserConfig(config, { seenAggregateReportIds });
+}
+/**
+* Fetch one message by UID, casting the UID to what each backend expects
+* (parsedmarc's `_fetch_mailbox_message`). Returns `[messageId, content]`;
+* `messageId` is what later move/delete calls use.
+*
+* A content error raised while fetching (Python's `email.errors.MessageError`
+* or `RecursionError`, from a backend that re-serializes the message) is
+* returned, not thrown, as `content`: a `ParserError` the caller treats like
+* a parse failure, so the message is disposed of as invalid instead of
+* aborting the batch on every run (GHSA-qxwv-2vwj-v828). Transport and
+* service errors still throw: a transient network failure must not move a
+* legitimate report to the invalid folder.
+*
+* With `maxSize` (bytes, not in parsedmarc), a message over the limit is
+* returned as an `EmailTooLargeError` the same way: backends that know a
+* message's size refuse it before downloading it.
+*/
+async function fetchMailboxMessage(connection, msgUid, test, maxSize = null) {
+	const limit = maxSize !== null && maxSize > 0 ? { maxSize } : {};
+	const messageId = connection.kind === "imap" ? pyInt(msgUid) : String(msgUid);
+	let content;
+	try {
+		content = connection.kind === "msgraph" || connection.kind === "maildir" ? await connection.fetchMessage(messageId, {
+			markRead: !test,
+			...limit
+		}) : await connection.fetchMessage(messageId, limit);
+	} catch (error) {
+		if (error instanceof MessageError || error instanceof RecursionError) return [messageId, new ParserError(`Unable to fetch message UID ${messageId}: ${error.name}: ${error.message}`, { cause: error })];
+		if (error instanceof EmailTooLargeError) return [messageId, new EmailTooLargeError(`Message UID ${msgUid}: ${error.message}`, { cause: error })];
+		throw error;
+	}
+	if (limit.maxSize !== void 0) {
+		const size = emailByteLength(content);
+		if (size > limit.maxSize) {
+			const tooLarge = emailTooLargeError(size, limit.maxSize);
+			return [messageId, new EmailTooLargeError(`Message UID ${msgUid}: ${tooLarge.message}`, { cause: tooLarge })];
+		}
+	}
+	return [messageId, content];
+}
+/**
+* The warning for a message that couldn't be parsed: a {@link ParserError}'s
+* own message (as parsedmarc logs it), or the error type and message of any
+* other error. Untrusted text is escaped.
+*/
+function invalidMessageWarning(error, messageId) {
+	if (error instanceof ParserError) return sanitizeForLog(error.message);
+	const name = error instanceof Error ? error.name : "Error";
+	return sanitizeForLog(`Unexpected error parsing message UID ${messageId}, treating it as invalid: ${name}: ${errorText(error)}`);
+}
+/** The warning for a message that ran past `jobTimeout`. */
+function timedOutMessageWarning(error, messageId) {
+	return `Timed out parsing message UID ${messageId}: ${error.message}`;
+}
+/** The warning for a message whose worker died (usually out of memory). */
+function crashedMessageWarning(error, messageId) {
+	return `Worker failed parsing message UID ${messageId}: ${error.message}: ${errorText(error.cause)}`;
+}
+/**
+* Delete or move an unparseable message (parsedmarc's
+* `_dispose_invalid_message`). Callers pass their effective
+* `deleteInvalid` as `del`.
+*/
+async function disposeInvalidMessage(connection, messageId, del, invalidReportsFolder) {
+	try {
+		const id = connection.kind === "imap" ? pyInt(messageId) : String(messageId);
+		if (del) {
+			logger.debug(`Deleting message UID ${messageId}`);
+			await connection.deleteMessage(id);
+		} else {
+			logger.debug(`Moving message UID ${messageId} to ${invalidReportsFolder}`);
+			await connection.moveMessage(id, invalidReportsFolder);
+		}
+	} catch (error) {
+		const action = del ? "deleting" : "moving";
+		const name = error instanceof Error ? error.name : "Error";
+		logger.error(`Mailbox error: Error ${action} invalid message UID ${messageId}: ${name}: ${errorText(error)}`);
+	}
+}
+/**
+* Consolidate a pre-rename `<archive>/Forensic` subfolder into
+* `<archive>/Failure` (parsedmarc's `_migrate_forensic_archive_folder`).
+* A no-op without a legacy folder; never throws (warn, don't crash).
+*/
+async function migrateForensicArchiveFolder(connection, archiveFolder) {
+	const oldFolder = `${archiveFolder}/Forensic`;
+	const newFolder = `${archiveFolder}/Failure`;
+	try {
+		if (!await connection.folderExists(oldFolder)) return;
+		if (await connection.folderExists(newFolder)) {
+			await connection.mergeFolders(oldFolder, newFolder);
+			logger.info(`Merged legacy archive folder ${oldFolder} into ${newFolder}`);
+		} else {
+			await connection.renameFolder(oldFolder, newFolder);
+			logger.info(`Renamed legacy archive folder ${oldFolder} to ${newFolder}`);
+		}
+	} catch (error) {
+		logger.warning(`Could not migrate legacy archive folder ${oldFolder} to ${newFolder}: ${errorText(error)}`);
+	}
+}
+/**
+* Best-effort create `folder` if the backend says it is missing
+* (parsedmarc's `_ensure_folder`). Never throws.
+*/
+async function ensureFolder(connection, folder) {
+	try {
+		if (!await connection.folderExists(folder)) await connection.createFolder(folder);
+	} catch (error) {
+		logger.warning(`Could not create folder ${folder}: ${errorText(error)}`);
+	}
+}
+const SINCE_PATTERN = /^(?<amount>\p{Nd}+)(?<unit>[mhdw]\n?)$/u;
+const MINUTES_PER_UNIT = {
+	m: 1,
+	h: 60,
+	d: 1440,
+	w: 10080
+};
+const DEFAULT_SINCE_MINUTES = 1440;
+const SECONDS_PER_MINUTE = 60;
+const DECIMAL_BASE = 10;
+const MS_PER_SECOND$3 = 1e3;
+/** Python's `int()` of a run of Unicode decimal digits (`\d` matches them all). */
+function decimalDigitsValue(digits) {
+	let value = 0;
+	for (const char of digits) {
+		let codePoint = char.codePointAt(0) ?? 0;
+		let start = codePoint;
+		while (/^\p{Nd}$/u.test(String.fromCodePoint(start - 1))) start -= 1;
+		codePoint = (codePoint - start) % DECIMAL_BASE;
+		value = value * DECIMAL_BASE + codePoint;
+	}
+	return value;
+}
+/** The minutes a relative `since` (`5m`, `3h`, `2d`, `1w`) stands for. */
+function sinceMinutes(since) {
+	const match = SINCE_PATTERN.exec(since);
+	if (!match?.groups) {
+		logger.warning(`Incorrect format for 'since' option. Provided value: ${since}, expected values: (5m|3h|2d|1w). Ignoring option, fetching messages for last 24hrs. SMTP does not support a time or timezone in since. See https://www.rfc-editor.org/rfc/rfc3501#page-52`);
+		return DEFAULT_SINCE_MINUTES;
+	}
+	const perUnit = MINUTES_PER_UNIT[match.groups.unit ?? ""];
+	if (perUnit === void 0) return DEFAULT_SINCE_MINUTES;
+	return decimalDigitsValue(match.groups.amount ?? "") * perUnit;
+}
+/**
+* `strftime("%s")` of an aware UTC datetime, as CPython computes it on
+* glibc: the tm fields go through mktime(), which reads them as local
+* time, so the result is off by the local UTC offset (exact under TZ=UTC).
+*/
+function pyStrftimeEpoch(datetime) {
+	return String(Math.floor(datetime.withOffset(null).timestamp()));
+}
+/** Backend-specific `since` and `currentTime` strings. */
+function resolveSince(connection, since) {
+	const minutes = sinceMinutes(since);
+	const sinceTime = () => PyDateTime.now(true).addSeconds(-minutes * SECONDS_PER_MINUTE);
+	switch (connection.kind) {
+		case "imap":
+			logger.debug("Only days and weeks values in 'since' option are considered for IMAP connections. Examples: 2d or 1w");
+			return {
+				since: sinceTime().strftime("%d-%b-%Y"),
+				currentTime: PyDateTime.now(true).strftime("%d-%b-%Y")
+			};
+		case "msgraph": return {
+			since: sinceTime().isoformat(),
+			currentTime: PyDateTime.now(true).isoformat()
+		};
+		case "gmail": return {
+			since: pyStrftimeEpoch(sinceTime()),
+			currentTime: pyStrftimeEpoch(PyDateTime.now(true))
+		};
+		default: return {
+			since,
+			currentTime: null
+		};
+	}
+}
+/** One batch's parsed reports and the message IDs behind them. */
+var Batch = class {
+	config;
+	aggregateReports = [];
+	failureReports = [];
+	smtpTlsReports = [];
+	/** Aggregate dedup keys, staged until the batch is saved. */
+	pendingAggregateKeys = /* @__PURE__ */ new Set();
+	aggregateMsgUids = [];
+	failureMsgUids = [];
+	smtpTlsMsgUids = [];
+	constructor(config) {
+		this.config = config;
+	}
+	add(parsedEmail, messageId) {
+		const reportType = classifyParsedEmail(parsedEmail, this.aggregateReports, this.failureReports, this.smtpTlsReports, {
+			seenAggregateReportIds: this.config.seenAggregateReportIds,
+			pendingAggregateKeys: this.pendingAggregateKeys
+		});
+		if (reportType === "aggregate") this.aggregateMsgUids.push(messageId);
+		else if (reportType === "failure") this.failureMsgUids.push(messageId);
+		else if (reportType === "smtp_tls") this.smtpTlsMsgUids.push(messageId);
+	}
+	results() {
+		return {
+			aggregateReports: this.aggregateReports,
+			failureReports: this.failureReports,
+			smtpTlsReports: this.smtpTlsReports
+		};
+	}
+	msgUids() {
+		return [
+			...this.aggregateMsgUids,
+			...this.failureMsgUids,
+			...this.smtpTlsMsgUids
+		];
+	}
+};
+/**
+* Put back messages that ran past `jobTimeout` or lost their worker. Neither
+* says anything about the content (the same report can fit in on a healthy
+* resolver, or in a worker with free memory), so unlike an invalid message
+* one is never deleted: it is retried like an unsaved batch, up to
+* `maxUnsavedRetries` times so it can't hold up every pass, then moved to
+* `Unsaved`.
+*/
+async function holdBackUnfinishedMessages(context, messageIds) {
+	if (context.test || messageIds.length === 0) return;
+	await holdBackUnsavedBatch(context.connection, messageIds, context.reportsFolder, context.unsavedReportsFolder, context.maxUnsavedRetries);
+}
+async function parseInParallel(context, nProcs) {
+	const { connection, messages, messageLimit, test, batch } = context;
+	const fetchedIds = [];
+	const invalidMsgIds = [];
+	const unfinishedMsgIds = [];
+	async function* jobs() {
+		for (let index = 0; index < messageLimit; index += 1) {
+			const msgUid = messages[index];
+			logger.debug(`Processing message ${index + 1} of ${messageLimit}: UID ${msgUid}`);
+			const [messageId, msgContent] = await fetchMailboxMessage(connection, msgUid, test, context.maxSize);
+			if (msgContent instanceof ParserError) {
+				logger.warning(sanitizeForLog(msgContent.message));
+				invalidMsgIds.push(messageId);
+				continue;
+			}
+			fetchedIds.push(messageId);
+			yield msgContent;
+		}
+	}
+	for await (const result of parallelMap(parseReportEmailTask(context.config), jobs(), nProcs, {
+		heartbeat: () => connection.keepalive(),
+		onJobError: (error) => error instanceof Error ? error : new Error(String(error))
+	})) {
+		const messageId = fetchedIds.shift();
+		if (result instanceof JobTimeoutError) {
+			logger.warning(timedOutMessageWarning(result, messageId));
+			unfinishedMsgIds.push(messageId);
+		} else if (result instanceof WorkerCrashedError) {
+			logger.warning(crashedMessageWarning(result, messageId));
+			unfinishedMsgIds.push(messageId);
+		} else if (result instanceof Error) {
+			const enrichmentError = findEnrichmentError(result);
+			if (enrichmentError !== null) throw enrichmentError;
+			logger.warning(invalidMessageWarning(result, messageId));
+			invalidMsgIds.push(messageId);
+		} else batch.add(result, messageId);
+	}
+	if (!test) for (const invalidMessageId of invalidMsgIds) await disposeInvalidMessage(connection, invalidMessageId, context.deleteInvalid, context.invalidReportsFolder);
+	await holdBackUnfinishedMessages(context, unfinishedMsgIds);
+}
+/**
+* `parseReportEmail()` on the calling thread, with the connection kept alive
+* and `config.jobTimeout` checked at each keepalive. A failure of either
+* reaches the caller as thrown (see `parseReportEmail()`): the message isn't
+* at fault, and a `ParserError` here would dispose of a legitimate report.
+*/
+async function parseWithKeepalive(context, content) {
+	const { connection, config } = context;
+	const deadline = config.jobTimeout > 0 ? Date.now() + config.jobTimeout * MS_PER_SECOND$3 : Number.POSITIVE_INFINITY;
+	const keepAlive = async () => {
+		if (Date.now() >= deadline) throw new JobTimeoutError(`Job did not finish within ${config.jobTimeout} seconds`);
+		await connection.keepalive();
+	};
+	return parseReportEmail(content, {
+		config,
+		keepAlive
+	});
+}
+async function parseSequentially(context) {
+	const { connection, messages, messageLimit, test, batch } = context;
+	for (let index = 0; index < messageLimit; index += 1) {
+		const msgUid = messages[index];
+		logger.debug(`Processing message ${index + 1} of ${messageLimit}: UID ${msgUid}`);
+		const [messageId, msgContent] = await fetchMailboxMessage(connection, msgUid, test, context.maxSize);
+		try {
+			if (msgContent instanceof ParserError) throw msgContent;
+			batch.add(await parseWithKeepalive(context, msgContent), messageId);
+		} catch (error) {
+			if (error instanceof JobTimeoutError) {
+				logger.warning(timedOutMessageWarning(error, messageId));
+				await holdBackUnfinishedMessages(context, [messageId]);
+				continue;
+			}
+			if (!(error instanceof ParserError)) throw error;
+			const enrichmentError = findEnrichmentError(error);
+			if (enrichmentError !== null) throw enrichmentError;
+			logger.warning(invalidMessageWarning(error, messageId));
+			if (!test) await disposeInvalidMessage(connection, messageId, context.deleteInvalid, context.invalidReportsFolder);
+		}
+	}
+}
+/**
+* Failure bookkeeping for an unsaved batch: count the attempt for each
+* message, keep those under the cap in place and move the rest to
+* `Unsaved` (never deleted).
+*/
+async function holdBackUnsavedBatch(connection, batchMsgUids, reportsFolder, unsavedReportsFolder, maxUnsavedRetries) {
+	const retainedUids = [];
+	const overCapUids = [];
+	let highestAttempt = 0;
+	for (const msgUid of batchMsgUids) {
+		const attemptsKey = failedSaveKey(connection, reportsFolder, msgUid);
+		const attempts = (FAILED_SAVE_ATTEMPTS.get(attemptsKey) ?? 0) + 1;
+		FAILED_SAVE_ATTEMPTS.set(attemptsKey, attempts);
+		if (attempts > maxUnsavedRetries) overCapUids.push(msgUid);
+		else {
+			retainedUids.push(msgUid);
+			highestAttempt = Math.max(highestAttempt, attempts);
+		}
+	}
+	if (retainedUids.length > 0) logger.error(`Reports were not saved: leaving ${retainedUids.length} message(s) in ${reportsFolder} to retry on the next run or check (failed attempt ${highestAttempt} of ${maxUnsavedRetries + 1})`);
+	if (overCapUids.length > 0) {
+		logger.error(`Reports were not saved after ${maxUnsavedRetries + 1} attempt(s): moving ${overCapUids.length} message(s) from ${reportsFolder} to ${unsavedReportsFolder} instead of retrying them further. They are never deleted -- fix the output destination, then move them back to ${reportsFolder}`);
+		await ensureFolder(connection, unsavedReportsFolder);
+		for (const msgUid of overCapUids) {
+			try {
+				await connection.moveMessage(msgUid, unsavedReportsFolder);
+			} catch (error) {
+				logger.error(`Mailbox error: Error moving message UID ${msgUid}: ${errorText(error)}`);
+				continue;
+			}
+			FAILED_SAVE_ATTEMPTS.delete(failedSaveKey(connection, reportsFolder, msgUid));
+		}
+	}
+}
+/** Delete or archive each report type's messages per its delete flag. */
+async function disposeSavedBatch(connection, batch, reportsFolder, folders, deleteFlags) {
+	const groups = [
+		[
+			batch.aggregateMsgUids,
+			deleteFlags.aggregate,
+			folders.aggregate,
+			"aggregate report"
+		],
+		[
+			batch.failureMsgUids,
+			deleteFlags.failure,
+			folders.failure,
+			"failure report"
+		],
+		[
+			batch.smtpTlsMsgUids,
+			deleteFlags.smtpTls,
+			folders.smtpTls,
+			"SMTP TLS report"
+		]
+	];
+	for (const [msgUids, deleteType, destinationFolder, label] of groups) {
+		const numberOfMsgs = msgUids.length;
+		if (numberOfMsgs === 0) continue;
+		if (!deleteType) logger.debug(`Moving ${label} messages from ${reportsFolder} to ${destinationFolder}`);
+		for (const [index, msgUid] of msgUids.entries()) if (deleteType) {
+			logger.debug(`Deleting message ${index + 1} of ${numberOfMsgs}: UID ${msgUid}`);
+			try {
+				await connection.deleteMessage(msgUid);
+			} catch (error) {
+				logger.error(`Mailbox error: Error deleting message UID ${msgUid}: ${errorText(error)}`);
+			}
+		} else {
+			logger.debug(`Moving message ${index + 1} of ${numberOfMsgs}: UID ${msgUid}`);
+			try {
+				await connection.moveMessage(msgUid, destinationFolder);
+			} catch (error) {
+				logger.error(`Mailbox error: Error moving message UID ${msgUid}: ${errorText(error)}`);
+			}
+		}
+	}
+}
+/**
+* Fetches and parses DMARC and SMTP TLS reports from a mailbox, then
+* archives (or deletes) each message by report type: `<archive>/Aggregate`,
+* `Failure`, `SMTP-TLS`, `Invalid`, and `Unsaved` for batches the
+* `saveCallback` kept failing to save.
+*
+* Parsing options (or `config`) work as in every parsing function; the
+* mailbox options always apply. With `batchSize: 0` the reports folder is
+* re-checked after the run and new messages are processed recursively.
+*
+* Throws an `EnrichmentError` when enrichment fails for every report
+* (a revoked IPinfo token, no readable IP database): the batch stays in
+* `reportsFolder`, unsaved, for the next run. Unlike parsedmarc, which
+* files those reports as invalid or empty, and deletes them with `delete`.
+*
+* Throws `ValueError` when a delete option is combined with `test`, when
+* `maxUnsavedRetries` is negative, or without a connection.
+*/
+async function getDmarcReportsFromMailbox(connection, options = {}) {
+	const { reportsFolder = "INBOX", archiveFolder = "Archive", delete: del = false, deleteAggregate = null, deleteFailure = null, deleteSmtpTls = null, deleteInvalid = null, test = false, results = null, batchSize = 10, since: sinceOption = null, createFolders = true, nProcs = 1, saveCallback = null, maxUnsavedRetries = 2, ...configOptions } = options;
+	const deleteFlags = {
+		aggregate: deleteAggregate ?? del,
+		failure: deleteFailure ?? del,
+		smtpTls: deleteSmtpTls ?? del,
+		invalid: deleteInvalid ?? del
+	};
+	if (test && (deleteFlags.aggregate || deleteFlags.failure || deleteFlags.smtpTls || deleteFlags.invalid)) throw new PyValueError("delete options and test are mutually exclusive");
+	if (maxUnsavedRetries < 0) throw new PyValueError("max_unsaved_retries must be >= 0");
+	if (connection == null) throw new PyValueError("Must supply a connection");
+	const config = resolveMailboxConfig(connection, configOptions);
+	let currentTime = null;
+	let aggregateReports = [];
+	let failureReports = [];
+	let smtpTlsReports = [];
+	const batch = new Batch(config);
+	const folders = {
+		aggregate: `${archiveFolder}/Aggregate`,
+		failure: `${archiveFolder}/Failure`,
+		smtpTls: `${archiveFolder}/SMTP-TLS`,
+		invalid: `${archiveFolder}/Invalid`,
+		unsaved: `${archiveFolder}/Unsaved`
+	};
+	if (results) {
+		aggregateReports = [...results.aggregateReports];
+		failureReports = [...results.failureReports];
+		smtpTlsReports = [...results.smtpTlsReports];
+	}
+	if (!test && createFolders) {
+		await migrateForensicArchiveFolder(connection, archiveFolder);
+		await connection.createFolder(archiveFolder);
+		await connection.createFolder(folders.aggregate);
+		await connection.createFolder(folders.failure);
+		await connection.createFolder(folders.smtpTls);
+		await connection.createFolder(folders.invalid);
+		if (saveCallback !== null) await connection.createFolder(folders.unsaved);
+	}
+	let since = sinceOption;
+	if (since) ({since, currentTime} = resolveSince(connection, since));
+	const messages = await connection.fetchMessages(reportsFolder, {
+		batchSize,
+		since
+	});
+	let totalMessages = messages.length;
+	logger.debug(`Found ${messages.length} messages in ${reportsFolder}`);
+	const messageLimit = batchSize && !since ? Math.min(totalMessages, batchSize) : totalMessages;
+	logger.debug(`Processing ${messageLimit} messages`);
+	const context = {
+		connection,
+		maxSize: config.maxEmailSize > 0 ? config.maxEmailSize : null,
+		messages,
+		messageLimit,
+		test,
+		config,
+		batch,
+		deleteInvalid: deleteFlags.invalid,
+		invalidReportsFolder: folders.invalid,
+		reportsFolder,
+		unsavedReportsFolder: folders.unsaved,
+		maxUnsavedRetries
+	};
+	if (nProcs > 1 && messageLimit > 1) await parseInParallel(context, nProcs);
+	else await parseSequentially(context);
+	let persisted = true;
+	let callbackError = null;
+	if (saveCallback !== null) try {
+		persisted = await saveCallback(batch.results()) !== false;
+	} catch (error) {
+		persisted = false;
+		callbackError = { error };
+	}
+	const batchMsgUids = batch.msgUids();
+	if (persisted) {
+		for (const reportKey of batch.pendingAggregateKeys) config.seenAggregateReportIds.set(reportKey, true);
+		if (!test) for (const msgUid of batchMsgUids) FAILED_SAVE_ATTEMPTS.delete(failedSaveKey(connection, reportsFolder, msgUid));
+	} else if (!test) await holdBackUnsavedBatch(connection, batchMsgUids, reportsFolder, folders.unsaved, maxUnsavedRetries);
+	if (callbackError !== null) throw callbackError.error;
+	for (const report of batch.aggregateReports) aggregateReports.push(report);
+	for (const report of batch.failureReports) failureReports.push(report);
+	for (const report of batch.smtpTlsReports) smtpTlsReports.push(report);
+	if (persisted && !test) await disposeSavedBatch(connection, batch, reportsFolder, folders, deleteFlags);
+	let accumulated = {
+		aggregateReports,
+		failureReports,
+		smtpTlsReports
+	};
+	if (persisted && !test && !batchSize) totalMessages = currentTime ? (await connection.fetchMessages(reportsFolder, { since: currentTime })).length : (await connection.fetchMessages(reportsFolder)).length;
+	else totalMessages = 0;
+	if (totalMessages > 0) accumulated = await getDmarcReportsFromMailbox(connection, {
+		reportsFolder,
+		archiveFolder,
+		delete: del,
+		deleteAggregate: deleteFlags.aggregate,
+		deleteFailure: deleteFlags.failure,
+		deleteSmtpTls: deleteFlags.smtpTls,
+		deleteInvalid: deleteFlags.invalid,
+		test,
+		results: accumulated,
+		since: currentTime,
+		nProcs,
+		saveCallback,
+		maxUnsavedRetries,
+		config
+	});
+	return accumulated;
+}
+/**
+* Watches the mailbox for new messages and processes them with
+* {@link getDmarcReportsFromMailbox} on every check, with `callback` as its
+* `saveCallback`: it runs once per batch, before the batch's messages are
+* archived or deleted, and returning `false` (or throwing) leaves them for
+* the next check. What happens to a thrown error is backend-specific: the
+* IMAP and Maildir watch loops log it and keep checking; Gmail and
+* Microsoft Graph end the watch.
+*
+* Throws `ValueError` for a negative `maxUnsavedRetries` before watching.
+*/
+async function watchInbox(mailboxConnection, callback, options = {}) {
+	const { reportsFolder = "INBOX", archiveFolder = "Archive", delete: del = false, deleteAggregate = null, deleteFailure = null, deleteSmtpTls = null, deleteInvalid = null, test = false, checkTimeout = 30, batchSize = 10, since = null, configReloading = null, nProcs = 1, maxUnsavedRetries = 2, signal, ...configOptions } = options;
+	if (maxUnsavedRetries < 0) throw new PyValueError("max_unsaved_retries must be >= 0");
+	const config = resolveMailboxConfig(mailboxConnection, configOptions);
+	const checkCallback = async (connection) => {
+		await getDmarcReportsFromMailbox(connection, {
+			reportsFolder,
+			archiveFolder,
+			delete: del,
+			deleteAggregate,
+			deleteFailure,
+			deleteSmtpTls,
+			deleteInvalid,
+			test,
+			batchSize,
+			since,
+			createFolders: false,
+			nProcs,
+			saveCallback: callback,
+			maxUnsavedRetries,
+			config
+		});
+	};
+	await mailboxConnection.watch({
+		checkCallback,
+		checkTimeout,
+		...configReloading === null ? {} : { configReloading },
+		...signal === void 0 ? {} : { signal }
+	});
+}
+// src/output.ts
+function errorCode(error) {
+	if (error instanceof Error && "code" in error) return typeof error.code === "string" ? error.code : void 0;
+}
+/** `os.stat()` that returns `null` where `os.path.exists()` is false. */
+async function statOrNull(filePath) {
+	try {
+		return await stat(filePath);
+	} catch (error) {
+		if (errorCode(error) !== void 0) return null;
+		throw error;
+	}
+}
+/** Python's `os.path.expanduser()` for `~` and `~/...`. */
+function expandUser(filePath) {
+	if (filePath === "~" || filePath.startsWith("~/")) return path.join(homedir(), filePath.slice(1));
+	return filePath;
+}
+/**
+* Files up to this size are parsed and rewritten, like parsedmarc. A larger
+* file that ends the way {@link appendJson} writes it only gets the new
+* entries spliced in: parsing it would take seconds per batch.
+*/
+const MAX_REWRITTEN_JSON_BYTES = 8388608;
+/** The largest file ever parsed; V8 strings stop at 512 MiB of characters. */
+const MAX_PARSED_JSON_BYTES = 268435456;
+/** How `json.dump(reports, indent=2)` starts and ends a list of objects. */
+const JSON_ARRAY_HEAD = "[\n  {";
+const JSON_ARRAY_TAIL = "\n  }\n]";
+/** The closing `\n]`, replaced when entries are spliced in. */
+const JSON_ARRAY_CLOSE_BYTES = 2;
+const COPY_CHUNK_BYTES = 1048576;
+const TEMP_SUFFIX_BYTES = 6;
+const PERMISSION_BITS = 4095;
+/** One array element, laid out as `json.dump(list, indent=2)` writes it. */
+function encodeJsonEntry(entry) {
+	try {
+		return pyJsonDumps([entry], {
+			ensureAscii: false,
+			indent: 2
+		}).slice(2, -2);
+	} catch (error) {
+		if (error instanceof RangeError) throw new PyValueError(`Report too large for JSON output: ${error.message}`);
+		throw error;
+	}
+}
+/** Whether a file looks like what `json.dump(reports, indent=2)` writes. */
+async function isJsonArrayOfObjects(filename, size) {
+	const handle = await open(filename, "r");
+	try {
+		const head = Buffer.alloc(5);
+		const tail = Buffer.alloc(6);
+		await handle.read(head, 0, head.length, 0);
+		await handle.read(tail, 0, tail.length, size - tail.length);
+		return head.toString("latin1") === JSON_ARRAY_HEAD && tail.toString("latin1") === JSON_ARRAY_TAIL;
+	} finally {
+		await handle.close();
+	}
+}
+/** Copy the first `length` bytes of `filename`, without holding them all. */
+async function copyFileStart(filename, length, output) {
+	const input = await open(filename, "r");
+	try {
+		const buffer = Buffer.allocUnsafe(COPY_CHUNK_BYTES);
+		let remaining = length;
+		while (remaining > 0) {
+			const { bytesRead } = await input.read(buffer, 0, Math.min(remaining, buffer.length));
+			if (bytesRead === 0) throw new PyValueError(`${filename} shrank while being copied`);
+			await output.writeFile(buffer.subarray(0, bytesRead));
+			remaining -= bytesRead;
+		}
+	} finally {
+		await input.close();
+	}
+}
+/**
+* Replace `filename` with what `write` produces: a temporary file in the same
+* directory, flushed, then renamed over it, so a crash or a full disk leaves
+* the old content whole. Symbolic links, the mode and (when allowed) the
+* owner are kept. Anything but a regular file (a FIFO, `/dev/stdout`) can't
+* be replaced and is written directly, like Python.
+*/
+async function replaceFile(filename, info, write) {
+	if (info !== null && !info.isFile()) {
+		const output = await open(filename, "w");
+		try {
+			await write(output);
+		} finally {
+			await output.close();
+		}
+		return;
+	}
+	const target = info === null ? filename : await realpath(filename);
+	const tempPath = `${target}.${randomBytes(TEMP_SUFFIX_BYTES).toString("hex")}.tmp`;
+	const output = await open(tempPath, "wx");
+	try {
+		await write(output);
+		if (info !== null) {
+			await output.chmod(info.mode & PERMISSION_BITS);
+			await output.chown(info.uid, info.gid).catch(() => void 0);
+		}
+		await output.sync();
+		await output.close();
+		await rename(tempPath, target);
+	} catch (error) {
+		await output.close().catch(() => void 0);
+		await rm(tempPath, { force: true });
+		throw error;
+	}
+}
+/** Keep a file {@link appendJson} can't use next to it, and say so. */
+async function setAsideJsonFile(filename, reason) {
+	const aside = `${filename}.corrupt-${Date.now()}`;
+	await rename(filename, aside);
+	logger.warning(`${sanitizeForLog(filename)} ${reason}: moved to ${sanitizeForLog(aside)}, starting a new file`);
+}
+/**
+* The entries of an existing JSON array to carry over, or `null` when the
+* file was moved aside (it holds no array that can be read).
+*/
+async function readJsonArray(filename, size) {
+	if (size > MAX_PARSED_JSON_BYTES) {
+		await setAsideJsonFile(filename, "is too large to parse");
+		return null;
+	}
+	let bytes;
+	try {
+		bytes = await readFile(filename);
+	} catch (error) {
+		if (errorCode(error) === void 0) throw error;
+		await setAsideJsonFile(filename, `is unreadable (${errorText(error)})`);
+		return null;
+	}
+	const text = pyDecode(bytes, "utf-8");
+	try {
+		const loaded = pyJsonLoads(text, { exactNumbers: true });
+		if (Array.isArray(loaded)) return loaded;
+		await setAsideJsonFile(filename, "does not hold a JSON array");
+		return null;
+	} catch (error) {
+		if (!(error instanceof JSONDecodeError)) throw error;
+		await setAsideJsonFile(filename, "is not valid JSON");
+		return null;
+	}
+}
+async function appendJsonEntries(filename, reports) {
+	const entries = reports.map((report) => toSnakeCaseKeys(report));
+	const info = await statOrNull(filename);
+	let existing = [];
+	let keptBytes = 0;
+	if (info?.isFile() && info.size > 0) {
+		if (info.size > MAX_REWRITTEN_JSON_BYTES && await isJsonArrayOfObjects(filename, info.size)) keptBytes = info.size - JSON_ARRAY_CLOSE_BYTES;
+		else existing = await readJsonArray(filename, info.size) ?? [];
+	}
+	await replaceFile(filename, await statOrNull(filename), async (output) => {
+		let separator = "[\n";
+		if (keptBytes > 0) {
+			await copyFileStart(filename, keptBytes, output);
+			separator = ",\n";
+		}
+		for (const entry of [...existing, ...entries]) {
+			await output.writeFile(`${separator}${encodeJsonEntry(entry)}`, "utf-8");
+			separator = ",\n";
+		}
+		await output.writeFile("\n]", "utf-8");
+	});
+}
+/** Tails of the {@link appendJson} calls running, by absolute path. */
+const jsonAppends = /* @__PURE__ */ new Map();
+/**
+* Append `reports` to a JSON array on disk, creating the file if needed.
+*
+* Reads the existing array (if the file exists and parses cleanly), merges
+* the new reports onto the end, and replaces the file with a single valid
+* JSON array (indented by 2, keys in snake_case like parsedmarc's output).
+* A file above {@link MAX_REWRITTEN_JSON_BYTES} that already has that layout
+* keeps its bytes and only gets the new entries, which gives the same result.
+* A file that can't be used (corrupt, unreadable, a root that is not an
+* array) is moved to `<filename>.corrupt-<timestamp>` with a warning, never
+* discarded. An empty `reports` leaves the file alone (and creates nothing).
+* Calls for one file run in turn; other processes are not coordinated with.
+*
+* Throws `ValueError` when a single report is too large to serialize.
+*/
+async function appendJson(filename, reports) {
+	if (reports.length === 0) return;
+	const key = path.resolve(filename);
+	const current = (jsonAppends.get(key) ?? Promise.resolve()).catch(() => void 0).then(() => appendJsonEntries(filename, reports));
+	jsonAppends.set(key, current);
+	try {
+		await current;
+	} finally {
+		if (jsonAppends.get(key) === current) jsonAppends.delete(key);
+	}
+}
+/**
+* Append CSV text to a file. When the file already has content, the header
+* line of `csv` is dropped; a header-only `csv` then writes nothing.
+*/
+async function appendCsv(filename, csv) {
+	const handle = await open(filename, "a+");
+	try {
+		let text = csv;
+		const { size } = await handle.stat();
+		if (size !== 0) {
+			const newline = text.indexOf("\n");
+			if (newline === -1) throw new PyValueError("not enough values to unpack (expected 2, got 1)");
+			text = text.slice(newline + 1);
+			if (text.length === 0) return;
+		}
+		await handle.writeFile(text, "utf-8");
+	} finally {
+		await handle.close();
+	}
+}
+/** Numbered names tried for a sample before a random one is used. */
+const MAX_SAMPLE_NAME_PROBES = 1e3;
+/**
+* Write `sample` to a file that doesn't exist yet, named `<subject>.eml`,
+* then `<subject> (1).eml`, … A sender repeats a subject at will, so an
+* existing sample is never reused, and a long run of one subject stops
+* probing. Returns the name used, without the extension.
+*/
+async function writeNewSample(directory, subject, sample) {
+	for (let count = 0;; count += 1) {
+		let filename = subject;
+		if (count > MAX_SAMPLE_NAME_PROBES) filename = `${subject} (${randomBytes(TEMP_SUFFIX_BYTES).toString("hex")})`;
+		else if (count > 0) filename = `${subject} (${count})`;
+		try {
+			await writeFile(path.join(directory, `${filename}.eml`), sample, {
+				encoding: "utf-8",
+				flag: "wx"
+			});
+			return filename;
+		} catch (error) {
+			if (errorCode(error) !== "EEXIST") throw error;
+		}
+	}
+}
+/**
+* Save report data in the given directory.
+*
+* Writes the JSON and CSV files of each report type, then the message
+* sample of each failure report to a `samples` subdirectory, named after the
+* sample's own `subject` header run through {@link getFilenameSafeString},
+* falling back to `sample` when sanitizing leaves nothing. A subject comes
+* from an untrusted sender, so it is sanitized here, at write time; a
+* caller-supplied `filenameSafeSubject` is not trusted and not used. Names
+* that collide, in this call or with a file already there, get a ` (1)`,
+* ` (2)`, … suffix.
+*
+* Throws `ValueError` if `outputDirectory` exists and is not a directory.
+*/
+async function saveOutput(results, options = {}) {
+	const { aggregateJsonFilename = "aggregate.json", failureJsonFilename = "failure.json", smtpTlsJsonFilename = "smtp_tls.json", aggregateCsvFilename = "aggregate.csv", failureCsvFilename = "failure.csv", smtpTlsCsvFilename = "smtp_tls.csv" } = options;
+	const { aggregateReports, failureReports, smtpTlsReports } = results;
+	const outputDirectory = expandUser(options.outputDirectory ?? "output");
+	const csvOptions = { formulaEscape: options.csvFormulaEscape !== false };
+	const outputInfo = await statOrNull(outputDirectory);
+	if (outputInfo === null) await mkdir(outputDirectory, { recursive: true });
+	else if (!outputInfo.isDirectory()) throw new PyValueError(`${outputDirectory} is not a directory`);
+	const aggregateCsv = parsedAggregateReportsToCsv(aggregateReports, csvOptions);
+	const failureCsv = parsedFailureReportsToCsv(failureReports, csvOptions);
+	const smtpTlsCsv = parsedSmtpTlsReportsToCsv(smtpTlsReports, csvOptions);
+	await appendJson(path.join(outputDirectory, aggregateJsonFilename), aggregateReports);
+	await appendCsv(path.join(outputDirectory, aggregateCsvFilename), aggregateCsv);
+	await appendJson(path.join(outputDirectory, failureJsonFilename), failureReports);
+	await appendCsv(path.join(outputDirectory, failureCsvFilename), failureCsv);
+	await appendJson(path.join(outputDirectory, smtpTlsJsonFilename), smtpTlsReports);
+	await appendCsv(path.join(outputDirectory, smtpTlsCsvFilename), smtpTlsCsv);
+	const samplesDirectory = path.join(outputDirectory, "samples");
+	if (await statOrNull(samplesDirectory) === null) await mkdir(samplesDirectory, { recursive: true });
+	for (const failureReport of failureReports) {
+		const { sample, parsedSample } = failureReport;
+		const subject = getFilenameSafeString(parsedSample.subject ?? null) || "sample";
+		try {
+			await writeNewSample(samplesDirectory, subject, sample);
+		} catch (error) {
+			if (subject === "sample") throw error;
+			const fallback = await writeNewSample(samplesDirectory, "sample", sample);
+			logger.warning(`Could not write sample ${sanitizeForLog(JSON.stringify(subject))}.eml (${errorText(error)}); writing it as ${fallback}.eml instead`);
+		}
+	}
+}
+/** Entries of a directory in on-disk order, like `os.scandir()`. */
+async function scanDirectory(directory) {
+	const dirs = [];
+	const files = [];
+	for await (const entry of await opendir(directory)) if (entry.isDirectory()) dirs.push(entry.name);
+	else files.push(entry.name);
+	return {
+		root: directory,
+		dirs,
+		files
+	};
+}
+/**
+* Python's `os.walk(top)`: top-down, a directory before its children.
+*
+* @yields {WalkEntry} Each directory with its subdirectory and file names.
+*/
+async function* walk(top) {
+	let entry;
+	try {
+		entry = await scanDirectory(top);
+	} catch {
+		return;
+	}
+	yield entry;
+	for (const directory of entry.dirs) yield* walk(path.join(top, directory));
+}
+/** The arcname `zipfile.ZipInfo.from_file()` stores (normalized, relative). */
+function zipArcname(arcname, isDirectory) {
+	let name = path.normalize(arcname);
+	while (name.startsWith("/")) name = name.slice(1);
+	return isDirectory ? `${name}/` : name;
+}
+const ZIP_UNIX = 3;
+const MS_DOS_DIRECTORY = 16;
+const MODE_MASK = 65535;
+const ATTRS_SHIFT = 65536;
+/** Python's `ZipFile.write(filename, arcname)` with `ZIP_DEFLATED`. */
+async function addToZip(entries, filePath, arcname) {
+	const info = await stat(filePath);
+	const isDirectory = info.isDirectory();
+	let attrs = (info.mode & MODE_MASK) * ATTRS_SHIFT;
+	if (isDirectory) attrs += MS_DOS_DIRECTORY;
+	const options = {
+		os: ZIP_UNIX,
+		attrs,
+		mtime: info.mtime,
+		level: isDirectory ? 0 : 6
+	};
+	const data = isDirectory ? /* @__PURE__ */ new Uint8Array(0) : await readFile(filePath);
+	entries.push([zipArcname(arcname, isDirectory), [data, options]]);
+}
+async function isFile(filePath) {
+	return (await statOrNull(filePath))?.isFile() ?? false;
+}
+async function isDirectory$1(filePath) {
+	return (await statOrNull(filePath))?.isDirectory() ?? false;
+}
+/**
+* Creates a zip file of parsed report output: {@link saveOutput} into a
+* temporary directory, then every file in it.
+*
+* The layout is parsedmarc's, except that parsedmarc also stores each file
+* of `samples/` a second time as `../<name>` (its `add_subdir()` swaps the
+* `relpath` arguments). Those entries point outside the extraction
+* directory, a path-traversal risk for whoever unzips the attachment, so
+* they are left out; every file is still in the zip once.
+*/
+async function getReportZip(results, options = {}) {
+	const entries = [];
+	const tmpDir = await mkdtemp(path.join(tmpdir(), "tmp"));
+	try {
+		await saveOutput(results, {
+			outputDirectory: tmpDir,
+			csvFormulaEscape: options.csvFormulaEscape !== false
+		});
+		for await (const { root, dirs, files } of walk(tmpDir)) {
+			for (const file of files) {
+				const filePath = path.join(root, file);
+				if (await isFile(filePath)) await addToZip(entries, filePath, path.join(path.relative(tmpDir, root) || ".", file));
+			}
+			for (const directory of dirs) {
+				const dirPath = path.join(root, directory);
+				if (await isDirectory$1(dirPath)) await addToZip(entries, dirPath, directory);
+			}
+		}
+	} finally {
+		await rm(tmpDir, {
+			recursive: true,
+			force: true
+		});
+	}
+	return zipSync(Object.fromEntries(entries));
+}
+// src/outputs/socket-io.ts
+const KEEP_ALIVE_INTERVAL_MS = 2 ** 30;
+/** Python's `TimeoutError: timed out` for socket operations. */
+var SocketTimeoutError = class extends Error {
+	name = "TimeoutError";
+	constructor() {
+		super("timed out");
+	}
+};
+/**
+* Runs send tasks one after another. Sockets are unref'd, like Python's,
+* which never hold the interpreter open; while sends are queued a timer
+* keeps the event loop alive so they are not cut short.
+*/
+var SendQueue = class {
+	#tail = Promise.resolve();
+	#queued = 0;
+	#keepAlive = null;
+	/** Queue `task`; its error goes to `onError` (never rejects the queue). */
+	push(task, onError) {
+		this.#queued += 1;
+		this.#keepAlive ??= setInterval(() => void 0, KEEP_ALIVE_INTERVAL_MS);
+		this.#tail = this.#tail.then(() => this.#run(task, onError));
+	}
+	async #run(task, onError) {
+		try {
+			await task();
+		} catch (error) {
+			onError(error);
+		} finally {
+			this.#queued -= 1;
+			if (this.#queued === 0 && this.#keepAlive !== null) {
+				clearInterval(this.#keepAlive);
+				this.#keepAlive = null;
+			}
+		}
+	}
+	/** Resolves once every queued send has finished. */
+	async drain() {
+		await this.#tail;
+	}
+};
+/**
+* Messages a stream handler could not deliver. `emit()` can't report them
+* and `SendQueue` runs on, so the client's save method asks here after
+* draining and fails, which keeps the batch from counting as saved.
+*/
+var SendFailures = class {
+	#count = 0;
+	#first = null;
+	record(error) {
+		if (this.#count === 0) this.#first = error;
+		this.#count += 1;
+	}
+	/** The failures since the last call, or `null` when there were none. */
+	take() {
+		if (this.#count === 0) return null;
+		const failures = {
+			count: this.#count,
+			error: this.#first
+		};
+		this.#count = 0;
+		this.#first = null;
+		return failures;
+	}
+};
+/** Run `start` and settle with it, or reject after `timeoutMs`. */
+async function withTimeout(timeoutMs, start, onTimeout = () => void 0) {
+	return await new Promise((resolve, reject) => {
+		const timer = timeoutMs === null ? null : setTimeout(() => {
+			onTimeout();
+			reject(new SocketTimeoutError());
+		}, timeoutMs);
+		const done = () => {
+			if (timer !== null) clearTimeout(timer);
+		};
+		start((value) => {
+			done();
+			resolve(value);
+		}, (error) => {
+			done();
+			reject(error);
+		});
+	});
+}
+/** Connect a TCP socket, failing after `timeoutMs`. */
+async function connectTcp(options, timeoutMs) {
+	const socket = connect(options);
+	try {
+		await withTimeout(timeoutMs, (resolve, reject) => {
+			socket.once("connect", () => resolve());
+			socket.once("error", reject);
+		}, () => socket.destroy());
+	} catch (error) {
+		socket.destroy();
+		throw error;
+	}
+	socket.removeAllListeners("error");
+	socket.on("error", () => void 0);
+	return socket;
+}
+/** Start TLS (over `options.socket` or a new connection), with a timeout. */
+async function connectTls(options, timeoutMs) {
+	const socket = connect$1(options);
+	try {
+		await withTimeout(timeoutMs, (resolve, reject) => {
+			socket.once("secureConnect", () => resolve());
+			socket.once("error", reject);
+		}, () => socket.destroy());
+	} catch (error) {
+		socket.destroy();
+		throw error;
+	}
+	socket.removeAllListeners("error");
+	socket.on("error", () => void 0);
+	return socket;
+}
+/** Python's `sock.sendall(data)`, with the socket's timeout. */
+async function sendAll(socket, data, timeoutMs) {
+	await withTimeout(timeoutMs, (resolve, reject) => {
+		if (socket.destroyed || !socket.writable) {
+			reject(Object.assign(/* @__PURE__ */ new Error("Broken pipe"), { code: "EPIPE" }));
+			return;
+		}
+		socket.write(data, (error) => {
+			if (error) reject(error);
+			else resolve();
+		});
+	});
+}
+/** Python's `sock.sendto(data, (host, port))`. */
+async function sendTo(socket, data, port, host) {
+	await new Promise((resolve, reject) => {
+		socket.send(data, port, host, (error) => {
+			if (error) reject(error);
+			else resolve();
+		});
+	});
+}
+/** Close a stream socket after its pending writes, without waiting forever. */
+async function closeStream(socket, timeoutMs) {
+	if (socket.destroyed) return;
+	await new Promise((resolve) => {
+		const timer = setTimeout(() => {
+			socket.destroy();
+		}, timeoutMs);
+		timer.unref();
+		socket.once("close", () => {
+			clearTimeout(timer);
+			resolve();
+		});
+		socket.end(() => socket.destroy());
+	});
+}
+/** Close a datagram socket. */
+async function closeDatagram(socket) {
+	await new Promise((resolve) => {
+		try {
+			socket.close(() => resolve());
+		} catch {
+			resolve();
+		}
+	});
+}
+// src/outputs/gelf.ts
+const MS_PER_SECOND$2 = 1e3;
+/** How long `close()` waits for queued bytes to flush. */
+const CLOSE_TIMEOUT_MS$1 = 5e3;
+/** pygelf's `LEVELS`: logging level → syslog severity. */
+const LEVELS = /* @__PURE__ */ new Map([
+	[10, 7],
+	[20, 6],
+	[30, 4],
+	[40, 3],
+	[50, 2]
+]);
+/**
+* pygelf's `SKIP_LIST`: LogRecord attributes never sent as extra fields
+* (plus `id`, which GELF forbids).
+*/
+const SKIP_LIST = /* @__PURE__ */ new Set([
+	"args",
+	"asctime",
+	"created",
+	"exc_info",
+	"exc_text",
+	"filename",
+	"funcName",
+	"id",
+	"levelname",
+	"levelno",
+	"lineno",
+	"module",
+	"msecs",
+	"message",
+	"msg",
+	"name",
+	"pathname",
+	"process",
+	"processName",
+	"relativeCreated",
+	"thread",
+	"threadName"
+]);
+/**
+* LogRecord attributes of Python 3.12+ that pygelf's `SKIP_LIST` misses, so
+* they always reach the packet as `_stack_info` / `_taskName` (both `None`
+* for parsedmarc's records).
+*/
+const UNSKIPPED_RECORD_ATTRIBUTES = ["stack_info", "taskName"];
+/** pygelf's `object_to_json`: datetimes as ISO 8601, anything else `str()`. */
+function objectToJson(value) {
+	if (value instanceof PyDateTime) return value.isoformat();
+	if (value instanceof Date) return value.toISOString();
+	return String(value);
+}
+function tracebackText(error) {
+	return error instanceof Error ? error.stack ?? errorText(error) : String(error);
+}
+/** pygelf's `gelf.make()` with `debug=False` and no static fields. */
+function makeGelf(record, domain, version, includeExtraFields) {
+	const level = LEVELS.get(record.level);
+	if (level === void 0) throw new KeyError(record.level);
+	const gelf = {
+		version,
+		short_message: record.message,
+		timestamp: record.created / MS_PER_SECOND$2,
+		level,
+		host: domain
+	};
+	if (record.error !== void 0) gelf.full_message = tracebackText(record.error);
+	if (includeExtraFields) {
+		for (const key of UNSKIPPED_RECORD_ATTRIBUTES) gelf[`_${key}`] = null;
+		for (const [key, value] of Object.entries(record.extra)) if (!(SKIP_LIST.has(key) || key.startsWith("_"))) gelf[`_${key}`] = value;
+	}
+	return gelf;
+}
+/** pygelf's `gelf.pack()`: compact JSON, UTF-8, zlib when compressing. */
+function packGelf(gelf, compress) {
+	const packed = Buffer.from(pyJsonDumps(gelf, {
+		separators: [",", ":"],
+		default: objectToJson
+	}), "utf-8");
+	return compress ? deflateSync(packed) : packed;
+}
+const CHUNK_MAGIC = [30, 15];
+const MESSAGE_ID_LENGTH = 8;
+const MAX_CHUNKS = 127;
+/**
+* pygelf's `gelf.split()`: GELF chunks of `chunkSize` bytes, each with the
+* magic bytes, a random 8-byte message id, the sequence number and count.
+*/
+function splitGelf(gelf, chunkSize) {
+	const messageId = randomBytes(MESSAGE_ID_LENGTH);
+	const count = Math.ceil(gelf.length / chunkSize);
+	if (count > MAX_CHUNKS) throw new Error(`'b' format requires -128 <= number <= ${MAX_CHUNKS}`);
+	const chunks = [];
+	for (let index = 0; index < count; index += 1) {
+		const body = gelf.subarray(index * chunkSize, (index + 1) * chunkSize);
+		chunks.push(Buffer.concat([
+			Buffer.from(CHUNK_MAGIC),
+			messageId,
+			Buffer.from([index, count]),
+			body
+		]));
+	}
+	return chunks;
+}
+/** pygelf's `BaseHandler`: turns records into GELF. */
+var BaseGelfHandler = class extends Handler {
+	host;
+	port;
+	version;
+	includeExtraFields;
+	compress;
+	/** The `host` field: this machine's hostname. */
+	domain = hostname();
+	queue = new SendQueue();
+	failures = new SendFailures();
+	constructor(host, port, options, compressDefault) {
+		super();
+		this.host = host;
+		this.port = port;
+		this.version = options.version ?? "1.1";
+		this.includeExtraFields = options.includeExtraFields ?? false;
+		this.compress = options.compress ?? compressDefault;
+	}
+	convertRecordToGelf(record) {
+		return packGelf(makeGelf(record, this.domain, this.version, this.includeExtraFields), this.compress);
+	}
+	/** The bytes sent for one record. */
+	makePickle(record) {
+		return this.convertRecordToGelf(record);
+	}
+	emit(record) {
+		const data = this.makePickle(record);
+		this.queue.push(() => this.send(data), (error) => this.handleError(record, error));
+	}
+	/** Resolves once every record emitted so far has been sent (or dropped). */
+	async drain() {
+		await this.queue.drain();
+	}
+	/** The messages dropped since the last call (always none over UDP). */
+	takeFailures() {
+		return this.failures.take();
+	}
+	close() {
+		this.closeAsync();
+	}
+};
+/** `SocketHandler.makeSocket()`'s timeout, in seconds. */
+const SOCKET_TIMEOUT = 1;
+/**
+* pygelf's `GelfTcpHandler` over Python's `SocketHandler`: connects on the
+* first record, sends each message NUL-terminated, and on a connection or
+* send error closes the socket and retries later with exponential back-off
+* (1 s doubling up to 30 s). Unlike Python, a message that fails on a stale
+* connection is sent again once over a new one, and one that is still lost
+* is recorded in `failures` (`SocketHandler` drops it without a trace).
+*/
+var GelfTcpHandler = class extends BaseGelfHandler {
+	sock = null;
+	/** Epoch ms before which no reconnect is attempted. */
+	retryTime = null;
+	retryPeriod = 1;
+	#connectError = null;
+	constructor(host, port, options = {}) {
+		super(host, port, options, false);
+	}
+	/** NUL-terminated: "if you send the message over tcp, it should always be null terminated". */
+	makePickle(record) {
+		return Buffer.concat([this.convertRecordToGelf(record), Buffer.from([0])]);
+	}
+	/** Open the connection (`SocketHandler.makeSocket`). */
+	async makeSocket(timeout = SOCKET_TIMEOUT) {
+		return await connectTcp({
+			host: this.host,
+			port: this.port
+		}, timeout * MS_PER_SECOND$2);
+	}
+	/** `SocketHandler.createSocket()`: connect unless backing off. */
+	async createSocket() {
+		const now = Date.now();
+		if (this.retryTime !== null && now < this.retryTime) return;
+		try {
+			this.sock = await this.makeSocket();
+			this.sock.unref();
+			this.retryTime = null;
+		} catch (error) {
+			this.#connectError = error;
+			if (this.retryTime === null) this.retryPeriod = 1;
+			else this.retryPeriod = Math.min(this.retryPeriod * 2, 30);
+			this.retryTime = now + this.retryPeriod * MS_PER_SECOND$2;
+		}
+	}
+	/** Send over the open connection, or a new one; throws if that fails. */
+	async #sendOnce(data) {
+		if (this.sock === null) await this.createSocket();
+		const { sock } = this;
+		if (sock === null) throw this.#connectError;
+		try {
+			await sendAll(sock, data, SOCKET_TIMEOUT * MS_PER_SECOND$2);
+		} catch (error) {
+			sock.destroy();
+			this.sock = null;
+			throw error;
+		}
+	}
+	async send(data) {
+		try {
+			await this.#sendOnce(data);
+		} catch {
+			try {
+				await this.#sendOnce(data);
+			} catch (error) {
+				this.failures.record(error);
+			}
+		}
+	}
+	async closeAsync() {
+		await this.drain();
+		const { sock } = this;
+		this.sock = null;
+		if (sock !== null) await closeStream(sock, CLOSE_TIMEOUT_MS$1);
+	}
+};
+/**
+* pygelf's `GelfUdpHandler`: zlib-compressed datagrams (IPv4, like Python's
+* `DatagramHandler`), split into GELF chunks above `chunkSize` bytes.
+*/
+var GelfUdpHandler = class extends BaseGelfHandler {
+	chunkSize;
+	sock = null;
+	constructor(host, port, options = {}) {
+		super(host, port, options, true);
+		this.chunkSize = options.chunkSize ?? 1300;
+	}
+	async send(data) {
+		if (this.sock === null) {
+			const sock = createSocket("udp4");
+			sock.on("error", () => void 0);
+			sock.unref();
+			this.sock = sock;
+		}
+		const chunks = data.length <= this.chunkSize ? [data] : splitGelf(data, this.chunkSize);
+		for (const chunk of chunks) await sendTo(this.sock, chunk, this.port, this.host);
+	}
+	async closeAsync() {
+		await this.drain();
+		const { sock } = this;
+		this.sock = null;
+		if (sock !== null) await closeDatagram(sock);
+	}
+};
+/** pygelf's `GelfTlsHandler`: {@link GelfTcpHandler} over TLS (IPv4). */
+var GelfTlsHandler = class extends GelfTcpHandler {
+	tlsOptions;
+	constructor(host, port, options = {}) {
+		const { validate = true, caCerts, certfile, keyfile } = options;
+		if (keyfile && !certfile) throw new PyValueError("certfile must be specified");
+		super(host, port, options);
+		const tlsOptions = { rejectUnauthorized: validate };
+		if (caCerts) tlsOptions.ca = [...getCACertificates("default"), readFileSync(caCerts, "utf-8")];
+		if (certfile) {
+			tlsOptions.cert = readFileSync(certfile);
+			tlsOptions.key = readFileSync(keyfile || certfile);
+		}
+		this.tlsOptions = tlsOptions;
+	}
+	async makeSocket(timeout = SOCKET_TIMEOUT) {
+		const timeoutMs = timeout * MS_PER_SECOND$2;
+		const plain = await connectTcp({
+			host: this.host,
+			port: this.port,
+			family: 4
+		}, timeoutMs);
+		plain.unref();
+		try {
+			return await connectTls({
+				...this.tlsOptions,
+				socket: plain,
+				host: this.host,
+				...isIP(this.host) === 0 && { servername: this.host }
+			}, timeoutMs);
+		} catch (error) {
+			plain.destroy();
+			throw error;
+		}
+	}
+};
+/** parsedmarc's thread-local `log_context_data`: the row being logged. */
+const logContextData = {};
+/** Copies `logContextData.parsedmarc` onto each record as `parsedmarc`. */
+var ContextFilter = class {
+	filter = (record) => {
+		if (!("parsedmarc" in logContextData)) throw new PyAttributeError("'_thread._local' object has no attribute 'parsedmarc'");
+		record.extra.parsedmarc = logContextData.parsedmarc;
+		return true;
+	};
+};
+/** Raised when messages could not be delivered over TCP or TLS. */
+var GelfError = class extends Error {
+	name = "GelfError";
+};
+/** A client for the Graylog Extended Log Format. */
+var GelfClient = class {
+	host;
+	port;
+	logger;
+	gelfMode;
+	/** The GELF handler attached to {@link logger}. */
+	handler;
+	/**
+	* @param host - The GELF host
+	* @param port - The GELF port
+	* @param mode - The GELF transport mode: `udp`, `tcp` or `tls`
+	*/
+	constructor(host, port, mode, options = {}) {
+		this.host = host;
+		this.port = port;
+		this.logger = new Logger("tsdmarc_gelf");
+		this.logger.setLevel(20);
+		this.logger.addFilter(new ContextFilter().filter);
+		this.gelfMode = {
+			udp: (h, p) => new GelfUdpHandler(h, p, { includeExtraFields: true }),
+			tcp: (h, p) => new GelfTcpHandler(h, p, { includeExtraFields: true }),
+			tls: (h, p) => new GelfTlsHandler(h, p, {
+				...options.tls,
+				includeExtraFields: true
+			})
+		};
+		if (!Object.hasOwn(this.gelfMode, mode)) throw new KeyError(mode);
+		this.handler = this.gelfMode[mode](this.host, this.port);
+		this.logger.addHandler(this.handler);
+	}
+	async saveAggregateReportToGelf(aggregateReports) {
+		const rows = parsedAggregateReportsToCsvRows(aggregateReports);
+		for (const row of rows) {
+			logContextData.parsedmarc = row;
+			this.logger.info("parsedmarc aggregate report");
+		}
+		logContextData.parsedmarc = null;
+		await this.#drain();
+	}
+	async saveFailureReportToGelf(failureReports) {
+		const rows = parsedFailureReportsToCsvRows(failureReports);
+		for (const row of rows) {
+			logContextData.parsedmarc = row;
+			this.logger.info("parsedmarc failure report");
+		}
+		await this.#drain();
+	}
+	/** Backward-compatible alias of {@link saveFailureReportToGelf}. */
+	async saveForensicReportToGelf(failureReports) {
+		await this.saveFailureReportToGelf(failureReports);
+	}
+	async saveSmtpTlsReportToGelf(smtpTlsReports) {
+		const rows = parsedSmtpTlsReportsToCsvRows(smtpTlsReports);
+		for (const row of rows) {
+			logContextData.parsedmarc = row;
+			this.logger.info("parsedmarc smtptls report");
+		}
+		await this.#drain();
+	}
+	/**
+	* Wait until the messages logged so far have been sent.
+	*
+	* @throws {GelfError} When some could not be delivered over TCP or TLS.
+	*/
+	async #drain() {
+		if (this.handler instanceof BaseGelfHandler) {
+			await this.handler.drain();
+			const failures = this.handler.takeFailures();
+			if (failures !== null) throw new GelfError(`${failures.count} message(s) not sent to ${this.host}:${this.port}: ${errorText(failures.error)}`, { cause: failures.error });
+		}
+	}
+	/** Remove and close the GELF handler, releasing its connection. */
+	async close() {
+		this.logger.removeHandler(this.handler);
+		if (this.handler instanceof BaseGelfHandler) await this.handler.closeAsync();
+		else this.handler.close();
+	}
+};
+// src/outputs/http.ts
+/**
+* The largest response body read (Splunk's HEC answers with a few bytes of
+* JSON). httpx reads any size; a hostile or broken server could otherwise
+* make the client buffer without limit.
+*/
+const MAX_RESPONSE_BYTES = 1048576;
+/** httpx's default `max_redirects`. */
+const MAX_REDIRECTS = 20;
+const MS_PER_SECOND$1 = 1e3;
+const URL_SCHEME = /^[a-z][a-z0-9+.-]*:/iu;
+const REDIRECT_STATUSES = /* @__PURE__ */ new Set([
+	301,
+	302,
+	303,
+	307,
+	308
+]);
+/** `scheme://`, then `user:password@`, the host, and the rest of the URL. */
+/** What `fetch` refuses in a header value (it quotes the value in its error). */
+const INVALID_HEADER_VALUE = /[\0\n\r\u0100-\u{10ffff}]/u;
+const URL_IN_TEXT = /\b([a-z][a-z0-9+.-]*:\/\/)(?:[^\s/@"'<>)]*@)?([^\s/?#"'<>)]*)[^\s"'<>)]*/giu;
+function bodyTooLarge() {
+	return /* @__PURE__ */ new Error(`Response body exceeds ${MAX_RESPONSE_BYTES} bytes`);
+}
+/** Read a fetch body up to {@link MAX_RESPONSE_BYTES}. */
+async function readFetchBody(response) {
+	const declared = Number(response.headers.get("content-length"));
+	if (Number.isFinite(declared) && declared > 1048576) {
+		await response.body?.cancel();
+		throw bodyTooLarge();
+	}
+	if (response.body === null) return "";
+	const reader = response.body.getReader();
+	const chunks = [];
+	let total = 0;
+	for (;;) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		total += value.length;
+		if (total > 1048576) {
+			await reader.cancel();
+			throw bodyTooLarge();
+		}
+		chunks.push(value);
+	}
+	return Buffer.concat(chunks, total).toString("utf8");
+}
+function fetchResponse(response) {
+	return {
+		status: response.status,
+		text: () => readFetchBody(response),
+		discard: async () => {
+			try {
+				await response.body?.cancel();
+			} catch {}
+		}
+	};
+}
+function requestSignal(options) {
+	const signals = [];
+	if (options.timeout !== null) signals.push(AbortSignal.timeout(options.timeout * MS_PER_SECOND$1));
+	if (options.signal) signals.push(options.signal);
+	if (signals.length === 0) return;
+	return signals.length === 1 ? signals[0] : AbortSignal.any(signals);
+}
+/**
+* The URL to request, like httpx refusing what it can't send (no URL
+* quoted). An unparsable URL with a scheme throws {@link InvalidURL}: a
+* password with an unencoded `/`, `?` or `#` ends the authority early, and
+* httpx's `InvalidURL` then quotes part of it as the port.
+*/
+function parseRequestUrl(url) {
+	if (!URL.canParse(url)) {
+		if (URL_SCHEME.test(url)) throw new InvalidURL("Invalid URL");
+		throw new Error("Request URL is missing an 'http://' or 'https://' protocol.");
+	}
+	const target = new URL(url);
+	if (target.protocol !== "http:" && target.protocol !== "https:") throw new Error(`Request URL has an unsupported protocol '${target.protocol}//'.`);
+	return target;
+}
+/** httpx's `unquote()`: invalid percent-encoding stays as it is. */
+function unquote(text) {
+	try {
+		return decodeURIComponent(text);
+	} catch {
+		return text;
+	}
+}
+/** Basic auth from a URL's userinfo; it replaces any `Authorization`, like httpx. */
+function withUrlCredentials(target, headers) {
+	const credentials = `${unquote(target.username)}:${unquote(target.password)}`;
+	return {
+		...withoutHeader(headers, ["Authorization"]),
+		Authorization: `Basic ${Buffer.from(credentials).toString("base64")}`
+	};
+}
+/** `text` with each URL cut down to its scheme and host. */
+function redactUrls(text) {
+	return text.replaceAll(URL_IN_TEXT, "$1$2");
+}
+/** `error`, or a copy of it (and its causes) without the URLs it quotes. */
+function withoutUrlSecrets(error) {
+	if (!(error instanceof Error)) return error;
+	const { cause } = error;
+	const safeCause = withoutUrlSecrets(cause);
+	const message = redactUrls(error.message);
+	if (message === error.message && safeCause === cause) return error;
+	const safe = new Error(message, { cause: safeCause });
+	safe.name = error.name;
+	return safe;
+}
+/** POST `body` to `url`, following redirects unless `followRedirects` is `false`. */
+async function httpPost(url, options) {
+	const target = parseRequestUrl(url);
+	let request = options;
+	let requestUrl = url;
+	if (target.username || target.password) {
+		request = {
+			...options,
+			headers: withUrlCredentials(target, options.headers)
+		};
+		target.username = "";
+		target.password = "";
+		requestUrl = target.href;
+	}
+	for (const [name, value] of Object.entries(request.headers)) if (INVALID_HEADER_VALUE.test(value)) throw new Error(`Invalid value for the ${name} header`);
+	const signal = requestSignal(request);
+	try {
+		if (request.verify === false && target.protocol === "https:") return await insecurePost(requestUrl, request, signal);
+		return fetchResponse(await fetch(requestUrl, {
+			method: "POST",
+			headers: request.headers,
+			body: request.body,
+			redirect: request.followRedirects === false ? "manual" : "follow",
+			signal
+		}));
+	} catch (error) {
+		throw withoutUrlSecrets(error);
+	}
+}
+/** Read a node:http body up to {@link MAX_RESPONSE_BYTES}. */
+function readNodeBody(response) {
+	return new Promise((resolve, reject) => {
+		const declared = Number(response.headers["content-length"]);
+		if (Number.isFinite(declared) && declared > 1048576) {
+			response.destroy();
+			reject(bodyTooLarge());
+			return;
+		}
+		const chunks = [];
+		let total = 0;
+		response.on("data", (chunk) => {
+			total += chunk.length;
+			if (total > 1048576) {
+				response.destroy();
+				reject(bodyTooLarge());
+				return;
+			}
+			chunks.push(chunk);
+		});
+		response.on("end", () => resolve(Buffer.concat(chunks, total).toString("utf8")));
+		response.on("error", reject);
+	});
+}
+function nodeRequest(url, method, headers, body, signal) {
+	return new Promise((resolve, reject) => {
+		const outgoing = (url.protocol === "https:" ? request$1 : request)(url, {
+			method,
+			headers,
+			rejectUnauthorized: false,
+			signal
+		}, resolve);
+		outgoing.on("error", reject);
+		outgoing.end(body);
+	});
+}
+function encodeBody(body) {
+	if (body instanceof Uint8Array) return body;
+	return new TextEncoder().encode(body.toString());
+}
+function withoutHeader(headers, names) {
+	const lowered = new Set(names.map((name) => name.toLowerCase()));
+	return Object.fromEntries(Object.entries(headers).filter(([key]) => !lowered.has(key.toLowerCase())));
+}
+async function insecurePost(url, options, signal) {
+	let target = new URL(url);
+	let method = "POST";
+	let body = encodeBody(options.body);
+	let headers = { ...options.headers };
+	if (options.body instanceof URLSearchParams && !hasHeader(headers)) headers["Content-Type"] = "application/x-www-form-urlencoded";
+	for (let redirects = 0;; redirects += 1) {
+		const response = await nodeRequest(target, method, headers, body, signal);
+		const status = response.statusCode ?? 0;
+		const { location } = response.headers;
+		if (options.followRedirects === false || !REDIRECT_STATUSES.has(status) || location === void 0) return {
+			status,
+			text: () => readNodeBody(response),
+			discard: () => {
+				response.destroy();
+				return Promise.resolve();
+			}
+		};
+		response.destroy();
+		if (redirects >= MAX_REDIRECTS) throw new Error("Exceeded maximum allowed redirects.");
+		const next = new URL(location, target);
+		if (status !== 307 && status !== 308) {
+			method = "GET";
+			body = void 0;
+			headers = withoutHeader(headers, ["Content-Type", "Content-Length"]);
+		}
+		if (next.origin !== target.origin) headers = withoutHeader(headers, ["Authorization"]);
+		target = next;
+	}
+}
+function hasHeader(headers) {
+	return Object.keys(headers).some((key) => key.toLowerCase() === "content-type");
+}
+/** The message of an error, with the low-level cause `fetch` wraps. */
+function describeError(error) {
+	if (!(error instanceof Error)) return String(error);
+	const { cause } = error;
+	if (cause instanceof Error && cause.message && cause.message !== error.message) return `${error.message}: ${cause.message}`;
+	return error.message;
+}
+// src/outputs/splunk.ts
+const DEFAULT_TIMEOUT$2 = 60;
+const CLOSED_MESSAGE$2 = "Cannot send a request, as the client has been closed.";
+const TOKEN_PREFIX_CHARS = "Splunk ";
+const URL_SCHEME_AND_NETLOC = /^([A-Za-z][A-Za-z0-9+.-]*):(?:\/\/([^/?#]*))?/u;
+const INVALID_URL_MESSAGE$2 = "Invalid Splunk HEC URL (details withheld because they may include credentials)";
+/** Characters of a sender's date quoted in a warning. */
+const MAX_LOGGED_DATE = 100;
+/** Raised when a Splunk API error occurs. */
+var SplunkError = class extends Error {
+	name = "SplunkError";
+};
+const HEC_JSON = { nonFiniteAsNull: true };
+/** Python's `str.lstrip(chars)`: drop leading characters found in `chars`. */
+function lstripChars(value, chars) {
+	let start = 0;
+	while (start < value.length && chars.includes(value.charAt(start))) start += 1;
+	return value.slice(start);
+}
+/** `{scheme}://{netloc}` as Python's `urlparse()` splits them. */
+function schemeAndNetloc(url) {
+	const match = URL_SCHEME_AND_NETLOC.exec(url);
+	return `${match?.[1]?.toLowerCase() ?? ""}://${match?.[2] ?? ""}`;
+}
+/**
+* The event time of an SMTP TLS report, or `null` when its `start-datetime`
+* is no date: the parser keeps that value as the sender wrote it (any JSON
+* type), and one such report must not cost the batch its Splunk events.
+*/
+function smtpTlsEventTime(report) {
+	try {
+		return humanTimestampToUnixTimestamp(report.beginDate);
+	} catch (error) {
+		if (!(error instanceof Error)) throw error;
+		const value = sanitizeForLog(String(report.beginDate).slice(0, MAX_LOGGED_DATE));
+		logger.warning(`Sending SMTP TLS report to Splunk without an event time: invalid begin_date ${value}`);
+		return null;
+	}
+}
+function snake(value) {
+	return toSnakeCaseKeys(value);
+}
+/** A client for a Splunk HTTP Events Collector (HEC). */
+var HECClient = class {
+	url;
+	accessToken;
+	index;
+	host;
+	source;
+	timeout;
+	verify;
+	/** Headers sent with every request. */
+	headers;
+	#commonData;
+	#closed = new AbortController();
+	/**
+	* @param url - The URL of the HEC; only its scheme and host are used
+	* @param accessToken - The HEC access token
+	* @param index - The name of the index
+	*/
+	constructor(url, accessToken, index, options = {}) {
+		this.url = `${schemeAndNetloc(url)}/services/collector/event/1.0`;
+		this.accessToken = lstripChars(accessToken, TOKEN_PREFIX_CHARS);
+		this.index = index;
+		this.host = hostname();
+		this.source = options.source ?? "tsdmarc";
+		this.timeout = options.timeout ?? DEFAULT_TIMEOUT$2;
+		this.verify = options.verify ?? true;
+		this.#commonData = {
+			host: this.host,
+			source: this.source,
+			index: this.index
+		};
+		this.headers = {
+			"User-Agent": USER_AGENT,
+			Authorization: `Splunk ${this.accessToken}`
+		};
+	}
+	/** The `host`, `source` and `index` fields every event carries. */
+	get commonData() {
+		return { ...this.#commonData };
+	}
+	/** Saves aggregate DMARC reports to Splunk, one event per record. */
+	async saveAggregateReportsToSplunk(aggregateReports) {
+		logger.debug("Saving aggregate reports to Splunk");
+		const reports = Array.isArray(aggregateReports) ? aggregateReports : [aggregateReports];
+		if (reports.length < 1) return;
+		const data = { ...this.#commonData };
+		const jsonLines = [];
+		for (const report of reports) {
+			const metadata = snake(report.reportMetadata);
+			const policyPublished = snake(report.policyPublished);
+			for (const record of report.records) {
+				const snakeRecord = snake(record);
+				const { source, alignment, identifiers } = record;
+				const newReport = { ...metadata };
+				newReport.interval_begin = record.intervalBegin;
+				newReport.interval_end = record.intervalEnd;
+				newReport.normalized_timespan = snakeRecord.normalized_timespan;
+				newReport.published_policy = policyPublished;
+				newReport.source_ip_address = source.ipAddress;
+				newReport.source_country = source.country;
+				newReport.source_reverse_dns = source.reverseDns;
+				newReport.source_base_domain = source.baseDomain;
+				newReport.source_type = source.type;
+				newReport.source_name = source.name;
+				newReport.source_asn = source.asn;
+				newReport.source_as_name = source.asName;
+				newReport.source_as_domain = source.asDomain;
+				newReport.message_count = record.count;
+				newReport.disposition = record.policyEvaluated.disposition;
+				newReport.spf_aligned = alignment.spf;
+				newReport.dkim_aligned = alignment.dkim;
+				newReport.passed_dmarc = alignment.dmarc;
+				newReport.header_from = identifiers.headerFrom;
+				newReport.envelope_from = identifiers.envelopeFrom;
+				const authResults = snakeRecord.auth_results;
+				if ("dkim" in authResults) newReport.dkim_results = authResults.dkim;
+				if ("spf" in authResults) newReport.spf_results = authResults.spf;
+				data.sourcetype = "dmarc:aggregate";
+				data.time = humanTimestampToUnixTimestamp(record.intervalBegin, { assumeUtc: true });
+				data.event = newReport;
+				jsonLines.push(`${pyJsonDumps(data, HEC_JSON)}\n`);
+			}
+		}
+		await this.#post(jsonLines);
+	}
+	/** Saves failure DMARC reports to Splunk, one event per report. */
+	async saveFailureReportsToSplunk(failureReports) {
+		logger.debug("Saving failure reports to Splunk");
+		const reports = Array.isArray(failureReports) ? failureReports : [failureReports];
+		if (reports.length < 1) return;
+		const jsonLines = [];
+		for (const report of reports) {
+			const data = { ...this.#commonData };
+			data.sourcetype = "dmarc:failure";
+			data.time = humanTimestampToUnixTimestamp(report.arrivalDateUtc, { assumeUtc: true });
+			data.event = snake(report);
+			jsonLines.push(`${pyJsonDumps(data, HEC_JSON)}\n`);
+		}
+		await this.#post(jsonLines);
+	}
+	/** Backward-compatible alias of {@link saveFailureReportsToSplunk}. */
+	async saveForensicReportsToSplunk(failureReports) {
+		await this.saveFailureReportsToSplunk(failureReports);
+	}
+	/** Saves SMTP TLS reports to Splunk, one event per report. */
+	async saveSmtpTlsReportsToSplunk(reports) {
+		logger.debug("Saving SMTP TLS reports to Splunk");
+		const reportList = Array.isArray(reports) ? reports : [reports];
+		if (reportList.length < 1) return;
+		const jsonLines = [];
+		for (const report of reportList) {
+			const data = {
+				...this.#commonData,
+				sourcetype: "smtp:tls"
+			};
+			const time = smtpTlsEventTime(report);
+			if (time !== null) data.time = time;
+			data.event = snake(report);
+			jsonLines.push(`${pyJsonDumps(data, HEC_JSON)}\n`);
+		}
+		await this.#post(jsonLines);
+	}
+	async #post(jsonLines) {
+		if (!this.verify) logger.debug("Skipping certificate verification for Splunk HEC");
+		let response;
+		try {
+			if (this.#closed.signal.aborted) throw new Error(CLOSED_MESSAGE$2);
+			const result = await httpPost(this.url, {
+				headers: { ...this.headers },
+				body: new TextEncoder().encode(jsonLines.join("")),
+				timeout: this.timeout,
+				verify: this.verify,
+				signal: this.#closed.signal
+			});
+			response = JSON.parse(await result.text());
+		} catch (error) {
+			if (error instanceof InvalidURL) throw new SplunkError(INVALID_URL_MESSAGE$2);
+			throw new SplunkError(describeError(error), { cause: error });
+		}
+		const { code, text } = response ?? {};
+		if (code !== 0) throw new SplunkError(String(text));
+	}
+	/** Close the client: abort in-flight requests and refuse new ones. */
+	close() {
+		this.#closed.abort(/* @__PURE__ */ new Error(CLOSED_MESSAGE$2));
+	}
+};
+// src/outputs/loki.ts
+const LOKI_PUSH_PATH = "/loki/api/v1/push";
+const LOKI_TIMESTAMP_MODES = ["ingest", "report_begin"];
+const LOKI_DEFAULT_LABEL_FIELDS = ["report_type", "domain"];
+const LABEL_NAME = /^[a-zA-Z_][a-zA-Z0-9_]*$/u;
+const DEFAULT_TIMEOUT$1 = 60;
+const DEFAULT_BATCH_SIZE = 1e3;
+const NS_PER_MS = 1000000n;
+const NS_PER_SECOND = 1000000000n;
+/** Characters of the response body quoted in a failed push's error. */
+const MAX_ERROR_BODY = 500;
+/**
+* Loki answers 204 when it stored the push; 200 is also accepted. Other
+* 2xx codes are not success: with `block_ingestion_until` set it returns a
+* custom 260 and discards the logs (`block_ingestion_status_code`).
+*/
+const SUCCESS_STATUSES = /* @__PURE__ */ new Set([200, 204]);
+const CLOSED_MESSAGE$1 = "Cannot send a request, as the client has been closed.";
+const INVALID_URL_MESSAGE$1 = "Invalid Loki URL (details withheld because they may include credentials)";
+/**
+* Per report type: the row field holding the domain the report is about,
+* the row field with its begin time, and whether that value is UTC without
+* an offset (aggregate rows carry the record's interval_begin, which is
+* naive UTC wall-clock time).
+*/
+const REPORT_TYPES = {
+	aggregate: [
+		"domain",
+		"begin_date",
+		true
+	],
+	failure: [
+		"reported_domain",
+		"arrival_date_utc",
+		true
+	],
+	smtp_tls: [
+		"policy_domain",
+		"begin_date",
+		false
+	]
+};
+/** Raised when pushing to Loki fails. */
+var LokiError = class extends Error {
+	name = "LokiError";
+};
+/**
+* The push URL: `url` with {@link LOKI_PUSH_PATH} as its path when it has none
+* (keeping its query string, userinfo and port), else `url` unchanged.
+*/
+function pushUrl(url) {
+	if (!URL.canParse(url)) throw new PyValueError(INVALID_URL_MESSAGE$1);
+	const target = new URL(url);
+	if (target.pathname !== "" && target.pathname !== "/") return url;
+	target.pathname = LOKI_PUSH_PATH;
+	return target.href;
+}
+/** `url` without its userinfo. */
+function withoutUserinfo(url) {
+	const target = new URL(url);
+	if (!target.username && !target.password) return url;
+	target.username = "";
+	target.password = "";
+	return target.href;
+}
+/** The first `length` characters (code points) of `text`, like Python. */
+function headChars(text, length) {
+	return Array.from(text).slice(0, length).join("");
+}
+/** A client for the Grafana Loki push API. */
+var LokiClient = class {
+	/** The push URL (with its userinfo, if any). */
+	url;
+	labels;
+	labelFields;
+	timestamp;
+	timeout;
+	batchSize;
+	verify;
+	/** Headers sent with every request. */
+	headers;
+	#requestUrl;
+	#closed = new AbortController();
+	/**
+	* Every report record becomes one JSON log line.
+	*
+	* @param url - Loki base URL (`/loki/api/v1/push` is appended when the URL
+	*   has no path) or the full push URL
+	*/
+	constructor(url, options = {}) {
+		const timestamp = options.timestamp ?? "ingest";
+		if (!LOKI_TIMESTAMP_MODES.includes(timestamp)) throw new PyValueError(`Invalid Loki timestamp '${pyStr(timestamp)}'. Must be one of: ${LOKI_TIMESTAMP_MODES.join(", ")}`);
+		const { username, password, token, tenantId } = options;
+		if (token && (username || password)) throw new PyValueError("Loki token and username/password are exclusive");
+		const labels = {
+			job: "parsedmarc",
+			host: hostname()
+		};
+		for (const [name, value] of Object.entries(options.labels ?? {})) labels[name] = value;
+		this.labels = labels;
+		this.labelFields = [...options.labelFields ?? LOKI_DEFAULT_LABEL_FIELDS];
+		for (const name of [...Object.keys(labels), ...this.labelFields]) if (!LABEL_NAME.test(name)) throw new PyValueError(`Invalid Loki label name '${name}'`);
+		this.url = pushUrl(url);
+		this.timestamp = timestamp;
+		this.timeout = options.timeout ?? DEFAULT_TIMEOUT$1;
+		this.batchSize = Math.max(1, Math.trunc(options.batchSize ?? DEFAULT_BATCH_SIZE));
+		if (Number.isNaN(this.batchSize)) throw new PyValueError("Invalid Loki batch size");
+		this.verify = options.verify ?? true;
+		const headers = {
+			"User-Agent": USER_AGENT,
+			"Content-Type": "application/json"
+		};
+		if (token) headers.Authorization = `Bearer ${token}`;
+		if (tenantId) headers["X-Scope-OrgID"] = tenantId;
+		this.#requestUrl = this.url;
+		if (username) {
+			headers.Authorization = `Basic ${Buffer$1.from(`${username}:${password ?? ""}`, "utf8").toString("base64")}`;
+			this.#requestUrl = withoutUserinfo(this.url);
+		}
+		this.headers = headers;
+	}
+	async saveAggregateReportToLoki(aggregateReports) {
+		await this.#save("aggregate", parsedAggregateReportsToCsvRows(aggregateReports));
+	}
+	async saveFailureReportToLoki(failureReports) {
+		await this.#save("failure", parsedFailureReportsToCsvRows(failureReports));
+	}
+	/** Backward-compatible alias of {@link saveFailureReportToLoki}. */
+	async saveForensicReportToLoki(failureReports) {
+		await this.saveFailureReportToLoki(failureReports);
+	}
+	async saveSmtpTlsReportToLoki(smtpTlsReports) {
+		await this.#save("smtp_tls", parsedSmtpTlsReportsToCsvRows(smtpTlsReports));
+	}
+	async #save(reportType, rows) {
+		if (rows.length === 0) return;
+		logger.debug(`Saving ${rows.length} ${reportType} records to Loki`);
+		const [domainField, beginField, beginIsUtc] = REPORT_TYPES[reportType];
+		const now = BigInt(Date.now()) * NS_PER_MS;
+		const sorted = rows.map((row, index) => {
+			const line = {
+				...row,
+				report_type: reportType
+			};
+			if (!Object.hasOwn(line, "domain")) line.domain = row[domainField];
+			let timestamp = now;
+			if (this.timestamp === "report_begin") try {
+				if (!Object.hasOwn(row, beginField)) throw new PyValueError(`'${beginField}'`);
+				const begin = humanTimestampToUnixTimestamp(pyStr(row[beginField]), { assumeUtc: beginIsUtc });
+				timestamp = BigInt(begin) * NS_PER_SECOND;
+			} catch {
+				logger.debug(`Unparsable ${beginField}, using ingest time`);
+			}
+			return {
+				labels: this.#streamLabels(line),
+				timestamp: timestamp + BigInt(index),
+				line
+			};
+		}).toSorted((a, b) => {
+			if (a.timestamp === b.timestamp) return 0;
+			return a.timestamp < b.timestamp ? -1 : 1;
+		});
+		for (let start = 0; start < sorted.length; start += this.batchSize) await this.#push(sorted.slice(start, start + this.batchSize));
+	}
+	#streamLabels(line) {
+		const labels = { ...this.labels };
+		for (const field of this.labelFields) {
+			const value = Object.hasOwn(line, field) ? line[field] : void 0;
+			if (value !== null && value !== void 0 && value !== "") labels[field] = pyStr(value);
+		}
+		return Object.entries(labels);
+	}
+	async #push(entries) {
+		const streams = /* @__PURE__ */ new Map();
+		for (const { labels, timestamp, line } of entries) {
+			const key = JSON.stringify(labels);
+			let stream = streams.get(key);
+			if (stream === void 0) {
+				stream = {
+					labels,
+					values: []
+				};
+				streams.set(key, stream);
+			}
+			stream.values.push([timestamp.toString(), pyJsonDumps(line, {
+				ensureAscii: false,
+				default: pyStr
+			})]);
+		}
+		const body = { streams: [...streams.values()].map(({ labels, values }) => ({
+			stream: Object.fromEntries(labels),
+			values
+		})) };
+		const redactedUrl = redactUrlCredentials(this.url);
+		let status;
+		let text;
+		try {
+			if (this.#closed.signal.aborted) throw new Error(CLOSED_MESSAGE$1);
+			const response = await httpPost(this.#requestUrl, {
+				headers: { ...this.headers },
+				body: pyJsonDumps(body),
+				timeout: this.timeout,
+				verify: this.verify,
+				followRedirects: false,
+				signal: this.#closed.signal
+			});
+			({status} = response);
+			if (SUCCESS_STATUSES.has(status)) {
+				await response.discard();
+				return;
+			}
+			try {
+				text = await response.text();
+			} catch {
+				text = "";
+			}
+		} catch (error) {
+			if (this.#closed.signal.aborted) throw new Error(CLOSED_MESSAGE$1, { cause: error });
+			throw new LokiError(`Loki push to ${redactedUrl} failed: ${describeError(error)}`, { cause: error });
+		}
+		throw new LokiError(`Loki push to ${redactedUrl} failed with HTTP ${status}: ${headChars(text, MAX_ERROR_BODY)}`);
+	}
+	/** Close the client: abort in-flight requests and refuse new ones. */
+	close() {
+		this.#closed.abort(/* @__PURE__ */ new Error(CLOSED_MESSAGE$1));
+	}
+};
+// src/outputs/syslog.ts
+/** Connection problems, shared; report rows go through each client's logger. */
+const connectionLogger = getLogger("tsdmarc_syslog");
+const MS_PER_SECOND = 1e3;
+/** How long `close()` waits for queued bytes to flush. */
+const CLOSE_TIMEOUT_MS = 5e3;
+/** `LOG_USER`, SysLogHandler's default facility. */
+const LOG_USER = 1;
+/** SysLogHandler's `priority_names` for the levels its `priority_map` uses. */
+const PRIORITIES = {
+	DEBUG: 7,
+	INFO: 6,
+	WARNING: 4,
+	ERROR: 3,
+	CRITICAL: 2
+};
+const DEFAULT_PRIORITY = PRIORITIES.WARNING ?? 4;
+/**
+* Port of `logging.handlers.SysLogHandler` for a `(host, port)` address:
+* sends `<PRI>message\0` per record, as one datagram (UDP) or on one
+* connection (TCP, no octet counting, like Python). Create it with
+* {@link SysLogHandler.create}, which resolves the host and, for TCP,
+* connects, like Python's constructor. Unlike Python, which keeps using a
+* dead TCP socket forever, a failed send reconnects (with `SocketHandler`'s
+* back-off) and tries once more; what is still lost is in {@link takeFailures}.
+*/
+var SysLogHandler = class SysLogHandler extends Handler {
+	address;
+	facility = 1;
+	socktype;
+	/** Seconds for each send on a stream socket; `null` waits forever. */
+	timeout;
+	/** The datagram socket, or the (possibly TLS-wrapped) stream socket. */
+	socket = null;
+	#queue = new SendQueue();
+	#failures = new SendFailures();
+	#wrapSocket;
+	/** Epoch ms before which no reconnect is attempted. */
+	#retryTime = null;
+	#retryPeriod = 1;
+	#connectError = null;
+	constructor(address, options) {
+		super();
+		this.address = address;
+		this.socktype = options.socktype ?? "dgram";
+		this.timeout = options.timeout ?? null;
+		this.#wrapSocket = options.wrapSocket;
+		this.formatter = (record) => record.error === void 0 ? record.message : `${record.message}\n${record.error instanceof Error ? record.error.stack ?? errorText(record.error) : String(record.error)}`;
+	}
+	/** Create the handler and its socket (throws if that fails). */
+	static async create(address, options = {}) {
+		const handler = new SysLogHandler(address, options);
+		await handler.createSocket();
+		return handler;
+	}
+	/**
+	* Resolve the address and create the socket; for TCP, connect to the
+	* first address that accepts, like Python's `createSocket()`.
+	*/
+	async createSocket() {
+		const [host, port] = this.address;
+		const addresses = await lookup(host, {
+			all: true,
+			order: "verbatim"
+		});
+		if (addresses.length === 0) throw new Error("getaddrinfo returns an empty list");
+		const timeoutMs = this.timeout ? this.timeout * MS_PER_SECOND : null;
+		let lastError = null;
+		for (const { address, family } of addresses) {
+			if (this.socktype === "dgram") {
+				const socket = createSocket(family === 6 ? "udp6" : "udp4");
+				socket.on("error", () => void 0);
+				socket.unref();
+				this.socket = socket;
+				return;
+			}
+			try {
+				const plain = await connectTcp({
+					host: address,
+					port,
+					family
+				}, timeoutMs);
+				plain.unref();
+				const socket = await this.#wrapSocket?.(plain) ?? plain;
+				socket.unref();
+				this.socket = socket;
+				return;
+			} catch (error) {
+				lastError = error;
+			}
+		}
+		throw lastError;
+	}
+	/** `SysLogHandler.encodePriority()` with `mapPriority()`. */
+	encodePriority(levelName) {
+		return this.facility * 8 + (PRIORITIES[levelName] ?? DEFAULT_PRIORITY);
+	}
+	emit(record) {
+		const message = `<${this.encodePriority(record.levelName)}>${this.format(record)}\0`;
+		const data = Buffer.from(message, "utf-8");
+		this.#queue.push(() => this.#send(data), (error) => {
+			this.handleError(record, error);
+			if (this.socktype === "stream") this.#failures.record(error);
+		});
+	}
+	async #send(data) {
+		if (this.socktype === "stream") {
+			try {
+				await this.#sendOverStream(data);
+			} catch {
+				await this.#sendOverStream(data);
+			}
+			return;
+		}
+		if (this.socket === null) await this.createSocket();
+		const [host, port] = this.address;
+		await sendTo(this.socket, data, port, host);
+	}
+	/** Send over the open connection, or a new one; throws if that fails. */
+	async #sendOverStream(data) {
+		if (this.socket === null) await this.#reconnect();
+		const socket = this.socket;
+		const timeoutMs = this.timeout ? this.timeout * MS_PER_SECOND : null;
+		try {
+			await sendAll(socket, data, timeoutMs);
+		} catch (error) {
+			socket.destroy();
+			this.socket = null;
+			throw error;
+		}
+	}
+	/** `createSocket()` with the back-off of Python's `SocketHandler`. */
+	async #reconnect() {
+		const now = Date.now();
+		if (this.#retryTime !== null && now < this.#retryTime) throw this.#connectError;
+		try {
+			await this.createSocket();
+			this.#retryTime = null;
+		} catch (error) {
+			this.#retryPeriod = this.#retryTime === null ? 1 : Math.min(this.#retryPeriod * 2, 30);
+			this.#retryTime = now + this.#retryPeriod * MS_PER_SECOND;
+			this.#connectError = error;
+			throw error;
+		}
+	}
+	/** Resolves once every record emitted so far has been sent (or failed). */
+	async drain() {
+		await this.#queue.drain();
+	}
+	/** The messages lost over TCP/TLS since the last call (UDP has no record). */
+	takeFailures() {
+		return this.#failures.take();
+	}
+	/** Close the socket (after the queued sends). Use {@link closeAsync} to wait. */
+	close() {
+		this.closeAsync();
+	}
+	/** Send what is queued, then close the socket. */
+	async closeAsync() {
+		await this.drain();
+		const { socket } = this;
+		this.socket = null;
+		if (socket === null) return;
+		if (this.socktype === "dgram") await closeDatagram(socket);
+		else await closeStream(socket, CLOSE_TIMEOUT_MS);
+	}
+};
+/** Hooks for tests: the delay between connection attempts. */
+const syslogTimers = { async sleep(seconds) {
+	await new Promise((resolve) => setTimeout(resolve, seconds * MS_PER_SECOND));
+} };
+async function readOptionalFile(filePath) {
+	return filePath ? await readFile(filePath) : null;
+}
+/** Raised when messages could not be delivered over TCP or TLS. */
+var SyslogError = class extends Error {
+	name = "SyslogError";
+};
+/** A client for Syslog. */
+var SyslogClient = class SyslogClient {
+	serverName;
+	serverPort;
+	protocol;
+	timeout;
+	retryAttempts;
+	retryDelay;
+	logger;
+	/** The syslog handler attached to {@link logger}. */
+	logHandler;
+	constructor(serverName, serverPort, options) {
+		this.serverName = serverName;
+		this.serverPort = serverPort;
+		this.protocol = (options.protocol ?? "udp").toLowerCase();
+		this.timeout = options.timeout ?? 5;
+		this.retryAttempts = options.retryAttempts ?? 3;
+		this.retryDelay = options.retryDelay ?? 5;
+		this.logger = new Logger("tsdmarc_syslog");
+		this.logger.setLevel(20);
+	}
+	/**
+	* Create a SyslogClient: resolves the server and, for TCP/TLS, connects
+	* (retrying `retryAttempts` times, `retryDelay` seconds apart), so a bad
+	* address fails here as Python's constructor does.
+	*
+	* @param serverName - The Syslog server
+	* @param serverPort - The Syslog port
+	*/
+	static async create(serverName, serverPort, options = {}) {
+		const client = new SyslogClient(serverName, serverPort, options);
+		client.logHandler = await client.createSyslogHandler(options);
+		client.logger.addHandler(client.logHandler);
+		return client;
+	}
+	/** Creates a SysLogHandler with the specified protocol and TLS settings. */
+	async createSyslogHandler(options) {
+		const { protocol, retryAttempts, retryDelay, timeout } = this;
+		const address = [this.serverName, this.serverPort];
+		if (protocol === "udp") return await SysLogHandler.create(address, { socktype: "dgram" });
+		if (protocol !== "tcp" && protocol !== "tls") throw new PyValueError(`Invalid protocol '${protocol}'. Must be 'udp', 'tcp', or 'tls'.`);
+		for (let attempt = 1; attempt <= retryAttempts; attempt += 1) try {
+			if (protocol === "tcp") return await SysLogHandler.create(address, {
+				socktype: "stream",
+				timeout
+			});
+			return await this.createTlsHandler(options);
+		} catch (error) {
+			if (attempt < retryAttempts) {
+				connectionLogger.warning(`Syslog connection attempt ${attempt}/${retryAttempts} failed: ${errorText(error)}. Retrying in ${retryDelay} seconds...`);
+				await syslogTimers.sleep(retryDelay);
+			} else {
+				connectionLogger.error(`Syslog connection failed after ${retryAttempts} attempts: ${errorText(error)}`);
+				throw error;
+			}
+		}
+		throw new PyValueError("retry_attempts must be at least 1");
+	}
+	/** TCP connection wrapped in TLS ≥ 1.2, verifying the server. */
+	async createTlsHandler(options) {
+		const { cafilePath, certfilePath, keyfilePath } = options;
+		const tlsOptions = {
+			minVersion: "TLSv1.2",
+			rejectUnauthorized: true
+		};
+		const ca = await readOptionalFile(cafilePath);
+		if (ca !== null) tlsOptions.ca = [...getCACertificates("default"), ca.toString("utf-8")];
+		if (certfilePath && keyfilePath) {
+			tlsOptions.cert = await readFile(certfilePath);
+			tlsOptions.key = await readFile(keyfilePath);
+		} else if (certfilePath || keyfilePath) connectionLogger.warning("Both certfile_path and keyfile_path are required for client certificate authentication. Client authentication will not be used.");
+		const timeoutMs = this.timeout * MS_PER_SECOND;
+		const wrapSocket = async (plain) => {
+			try {
+				return await connectTls({
+					...tlsOptions,
+					socket: plain,
+					host: this.serverName,
+					...isIP(this.serverName) === 0 && { servername: this.serverName }
+				}, timeoutMs);
+			} catch (error) {
+				plain.destroy();
+				throw error;
+			}
+		};
+		return await SysLogHandler.create([this.serverName, this.serverPort], {
+			socktype: "stream",
+			timeout: this.timeout,
+			wrapSocket
+		});
+	}
+	async saveAggregateReportToSyslog(aggregateReports) {
+		const rows = parsedAggregateReportsToCsvRows(aggregateReports);
+		for (const row of rows) this.logger.info(pyJsonDumps(row));
+		await this.#drain();
+	}
+	async saveFailureReportToSyslog(failureReports) {
+		const rows = parsedFailureReportsToCsvRows(failureReports);
+		for (const row of rows) this.logger.info(pyJsonDumps(row));
+		await this.#drain();
+	}
+	/** Backward-compatible alias of {@link saveFailureReportToSyslog}. */
+	async saveForensicReportToSyslog(failureReports) {
+		await this.saveFailureReportToSyslog(failureReports);
+	}
+	async saveSmtpTlsReportToSyslog(smtpTlsReports) {
+		const rows = parsedSmtpTlsReportsToCsvRows(smtpTlsReports);
+		for (const row of rows) this.logger.info(pyJsonDumps(row));
+		await this.#drain();
+	}
+	/**
+	* Wait until the messages logged so far have been sent.
+	*
+	* @throws {SyslogError} When some could not be delivered over TCP or TLS.
+	*/
+	async #drain() {
+		if (this.logHandler instanceof SysLogHandler) {
+			await this.logHandler.drain();
+			const failures = this.logHandler.takeFailures();
+			if (failures !== null) throw new SyslogError(`${failures.count} message(s) not sent to ${this.serverName}:${this.serverPort}: ${errorText(failures.error)}`, { cause: failures.error });
+		}
+	}
+	/** Remove and close the syslog handler, releasing its socket. */
+	async close() {
+		this.logger.removeHandler(this.logHandler);
+		if (this.logHandler instanceof SysLogHandler) await this.logHandler.closeAsync();
+		else this.logHandler.close();
+	}
+};
+// src/outputs/webhook.ts
+const DEFAULT_TIMEOUT = 60;
+/** Raised (and logged) when a request is made after {@link WebhookClient.close}. */
+const CLOSED_MESSAGE = "Cannot send a request, as the client has been closed.";
+/** Logged (or thrown) for a URL that can't be parsed; see {@link InvalidURL}. */
+const INVALID_URL_MESSAGE = "invalid webhook URL (details withheld because they may include credentials)";
+const HTTP_SUCCESS_MIN = 200;
+const HTTP_SUCCESS_MAX = 299;
+function isSuccess(status) {
+	return status >= HTTP_SUCCESS_MIN && status <= HTTP_SUCCESS_MAX;
+}
+/** A client for webhooks. */
+var WebhookClient = class {
+	aggregateUrl;
+	failureUrl;
+	smtpTlsUrl;
+	timeout;
+	throwOnError;
+	/** Headers sent with every request. */
+	headers;
+	#closed = new AbortController();
+	/**
+	* @param aggregateUrl - The aggregate report webhook URL
+	* @param failureUrl - The failure report webhook URL
+	* @param smtpTlsUrl - The SMTP TLS report webhook URL
+	*/
+	constructor(aggregateUrl, failureUrl, smtpTlsUrl, options = {}) {
+		this.aggregateUrl = aggregateUrl;
+		this.failureUrl = failureUrl;
+		this.smtpTlsUrl = smtpTlsUrl;
+		this.timeout = options.timeout === void 0 ? DEFAULT_TIMEOUT : options.timeout;
+		this.throwOnError = options.throwOnError ?? false;
+		this.headers = {
+			"User-Agent": USER_AGENT,
+			"Content-Type": "application/json"
+		};
+	}
+	async saveFailureReportToWebhook(report) {
+		await this.sendToWebhook(this.failureUrl, report);
+	}
+	/** Backward-compatible alias of {@link saveFailureReportToWebhook}. */
+	async saveForensicReportToWebhook(report) {
+		await this.saveFailureReportToWebhook(report);
+	}
+	async saveSmtpTlsReportToWebhook(report) {
+		await this.sendToWebhook(this.smtpTlsUrl, report);
+	}
+	async saveAggregateReportToWebhook(report) {
+		await this.sendToWebhook(this.aggregateUrl, report);
+	}
+	/**
+	* POST `payload` to `webhookUrl`. A string or bytes payload is sent as
+	* is; an object is form-encoded. Network errors are logged and swallowed
+	* and HTTP error statuses ignored, so a failing webhook never aborts the
+	* surrounding batch; with `throwOnError`, both are thrown instead (and
+	* not logged here).
+	*/
+	async sendToWebhook(webhookUrl, payload) {
+		let status;
+		try {
+			if (this.#closed.signal.aborted) throw new Error(CLOSED_MESSAGE);
+			const body = typeof payload === "string" || payload instanceof Uint8Array ? payload : new URLSearchParams(payload);
+			const response = await httpPost(webhookUrl, {
+				headers: { ...this.headers },
+				body,
+				timeout: this.timeout,
+				signal: this.#closed.signal
+			});
+			await response.discard();
+			({status} = response);
+		} catch (error) {
+			if (error instanceof InvalidURL) {
+				if (this.throwOnError) throw new Error(INVALID_URL_MESSAGE);
+				logger.error(`Webhook Error: ${INVALID_URL_MESSAGE}`);
+				return;
+			}
+			if (this.throwOnError) throw new Error(describeError(error), { cause: error });
+			logger.error(`Webhook Error: ${describeError(error)}`);
+			return;
+		}
+		if (this.throwOnError && !isSuccess(status)) throw new Error(`Webhook responded with HTTP ${status}`);
+	}
+	/** Close the client: abort in-flight requests and refuse new ones. */
+	close() {
+		this.#closed.abort(/* @__PURE__ */ new Error(CLOSED_MESSAGE));
+	}
+};
+// src/mailbox/maildir.ts
+/** The Maildir directory does not exist and `maildirCreate` was not set. */
+var NoSuchMailboxError = class extends Error {
+	name = "NoSuchMailboxError";
+};
+/** A folder can't be removed because it still holds messages or subfolders. */
+var NotEmptyError = class extends Error {
+	name = "NotEmptyError";
+};
+/** A move would overwrite a message with the same key (`mailbox.ExternalClashError`). */
+var ExternalClashError = class extends Error {
+	name = "ExternalClashError";
+};
+/**
+* Running as root, the process could not fully drop to the Maildir's owner
+* (uid, gid and supplementary groups). mailsuite only warns and stays root.
+*/
+var PrivilegeDropError = class extends Error {
+	name = "PrivilegeDropError";
+};
+/** No message has the given key (Python's `KeyError`). */
+var MaildirKeyError = class extends Error {
+	name = "KeyError";
+};
+/** Separator between a message's unique name and its info (`:2,S`). */
+const COLON = ":";
+const SUBDIRS = [
+	"tmp",
+	"new",
+	"cur"
+];
+const TOC_SUBDIRS = ["new", "cur"];
+const FOLDER_MODE = 448;
+const FILE_MODE = 438;
+const MILLISECONDS_PER_SECOND = 1e3;
+const MAILDIR_INFO_PREFIX = "2,";
+const SEEN_FLAG = "S";
+const utf8Decoder = new TextDecoder("utf-8", { ignoreBOM: true });
+/** Python's `str(exception)`: the message without the class name. */
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+/** Python's `os.path.isdir`: false for anything missing or unreadable. */
+async function isDirectory(target) {
+	try {
+		return (await stat(target)).isDirectory();
+	} catch {
+		return false;
+	}
+}
+/** The flags of an info suffix (`2,RS` → `RS`), like `MaildirMessage.get_flags()`. */
+function flagsOf(info) {
+	return info.startsWith(MAILDIR_INFO_PREFIX) ? info.slice(2) : "";
+}
+/** `MaildirMessage.add_flag()`: merge, deduplicate and sort the flags. */
+function addFlag(info, flag) {
+	const flags = /* @__PURE__ */ new Set([...flagsOf(info), ...flag]);
+	return `${MAILDIR_INFO_PREFIX}${[...flags].sort().join("")}`;
+}
+/**
+* The parts of Python's `mailbox.Maildir` that `MaildirConnection` uses.
+*
+* Keys are the unique part of a file name (before the colon). The table of
+* contents is rebuilt on every lookup miss and every `keys()` call, which is
+* what Python's `_refresh()` amounts to when files change underneath it.
+*/
+var Maildir = class Maildir {
+	root;
+	toc = /* @__PURE__ */ new Map();
+	constructor(root) {
+		this.root = root;
+	}
+	/** Open (and with `create`, make) a Maildir, like `mailbox.Maildir(path, create=...)`. */
+	static openSync(dirname, create) {
+		const root = path.resolve(dirname);
+		let exists = true;
+		try {
+			statSync(root);
+		} catch {
+			exists = false;
+		}
+		if (!exists) {
+			if (!create) throw new NoSuchMailboxError(root);
+			mkdirSync(root, { mode: FOLDER_MODE });
+			for (const subdir of SUBDIRS) mkdirSync(path.join(root, subdir), { mode: FOLDER_MODE });
+		}
+		return new Maildir(root);
+	}
+	/** `Maildir.add_folder()`: open or create `.<folder>` and its `maildirfolder` marker. */
+	async addFolder(folder) {
+		const folderPath = path.join(this.root, `.${folder}`);
+		const result = Maildir.openSync(folderPath, true);
+		const markerPath = path.join(folderPath, "maildirfolder");
+		await (await open(markerPath, constants.O_CREAT | constants.O_WRONLY, FILE_MODE)).close();
+		return result;
+	}
+	/** `Maildir.remove_folder()`: delete an empty folder. */
+	async removeFolder(folder) {
+		const folderPath = path.join(this.root, `.${folder}`);
+		const entries = [...await readdir(path.join(folderPath, "new")), ...await readdir(path.join(folderPath, "cur"))];
+		for (const entry of entries) if (entry.length < 1 || !entry.startsWith(".")) throw new NotEmptyError(`Folder contains message(s): ${folder}`);
+		for (const entry of await readdir(folderPath)) if (entry !== "new" && entry !== "cur" && entry !== "tmp" && await isDirectory(path.join(folderPath, entry))) throw new NotEmptyError(`Folder contains subdirectory '${folder}': ${entry}`);
+		for (const entry of await readdir(folderPath)) await rm(path.join(folderPath, entry), { recursive: true });
+		await rmdir(folderPath);
+	}
+	/** `Maildir._refresh()`: map each key to its `new/...` or `cur/...` subpath. */
+	async refresh() {
+		const toc = /* @__PURE__ */ new Map();
+		for (const subdir of TOC_SUBDIRS) {
+			const subdirPath = path.join(this.root, subdir);
+			for (const entry of await readdir(subdirPath)) {
+				if (entry.startsWith(".")) continue;
+				if (await isDirectory(path.join(subdirPath, entry))) continue;
+				const key = entry.split(COLON)[0] ?? entry;
+				toc.set(key, path.join(subdir, entry));
+			}
+		}
+		this.toc = toc;
+	}
+	/** `Maildir._lookup()`: the subpath of a key, or `MaildirKeyError`. */
+	async lookup(key) {
+		const cached = this.toc.get(key);
+		if (cached !== void 0) try {
+			await stat(path.join(this.root, cached));
+			return cached;
+		} catch {}
+		await this.refresh();
+		const subpath = this.toc.get(key);
+		if (subpath === void 0) throw new MaildirKeyError(`No message with key: ${key}`);
+		return subpath;
+	}
+	async keys() {
+		await this.refresh();
+		return [...this.toc.keys()];
+	}
+	/** The size of a message file in bytes, or `null` when the key is unknown. */
+	async size(key) {
+		let subpath;
+		try {
+			subpath = await this.lookup(key);
+		} catch (error) {
+			if (error instanceof MaildirKeyError) return null;
+			throw error;
+		}
+		return (await stat(path.join(this.root, subpath))).size;
+	}
+	/**
+	* `Maildir.get_bytes()`: the stored bytes, or `null` when the key is
+	* unknown. Python converts `os.linesep` to `\n` (a no-op on POSIX).
+	*/
+	async getBytes(key) {
+		let subpath;
+		try {
+			subpath = await this.lookup(key);
+		} catch (error) {
+			if (error instanceof MaildirKeyError) return null;
+			throw error;
+		}
+		const content = await readFile(path.join(this.root, subpath));
+		return EOL === "\n" ? content : Buffer.from(content.toString("latin1").replaceAll(EOL, "\n"), "latin1");
+	}
+	/** `key in maildir`. */
+	async has(key) {
+		await this.refresh();
+		return this.toc.has(key);
+	}
+	/**
+	* Move a message's file into the same subdirectory (`new`/`cur`) of
+	* `destination`, keeping its name; `MaildirKeyError` for an unknown key.
+	*/
+	async moveTo(key, destination) {
+		const subpath = await this.lookup(key);
+		await rename(path.join(this.root, subpath), path.join(destination.root, subpath));
+		this.toc.delete(key);
+		destination.toc.set(key, subpath);
+	}
+	/** `Maildir.remove()`: delete a message, or `MaildirKeyError`. */
+	async remove(key) {
+		await unlink(path.join(this.root, await this.lookup(key)));
+	}
+	/**
+	* Mark a message read like mailsuite 2.3.3: rename its file into `cur/`
+	* with the `S` (Seen) flag added to its info suffix, which is what the
+	* Maildir spec defines a flag change to be; the content is untouched.
+	*/
+	async markRead(key) {
+		const subpath = await this.lookup(key);
+		const name = path.basename(subpath);
+		const info = name.includes(COLON) ? name.split(COLON).at(-1) ?? "" : "";
+		const newSubpath = path.join("cur", `${key}${COLON}${addFlag(info, SEEN_FLAG)}`);
+		await rename(path.join(this.root, subpath), path.join(this.root, newSubpath));
+		this.toc.set(key, newSubpath);
+	}
+};
+/**
+* Drop root to the Maildir's owner: its group as the only group, then its uid.
+*
+* Unlike mailsuite, which keeps root's groups and, if `setuid` fails, only
+* warns and goes on as root, any failure throws `PrivilegeDropError`, so the
+* process never keeps working as root (or half-dropped) by accident.
+*/
+function dropPrivileges(maildirPath, uid, gid) {
+	const { setuid, setgid, setgroups } = process;
+	const fix = `Run tsdmarc as the Maildir's owner (uid ${uid}), or chown ${maildirPath} to the user tsdmarc runs as.`;
+	if (setgroups === void 0 || setgid === void 0 || setuid === void 0) throw new PrivilegeDropError(`Running as root over ${maildirPath} (owner uid ${uid}), but this runtime can't drop root's groups. ${fix}`);
+	try {
+		setgroups([gid]);
+		setgid(gid);
+		setuid(uid);
+	} catch (error) {
+		throw new PrivilegeDropError(`Failed to switch to uid ${uid} and gid ${gid} to access Maildir ${maildirPath}: ${errorMessage(error)}. ${fix}`, { cause: error });
+	}
+}
+/**
+* A `MailboxConnection` backed by an on-disk Maildir.
+*
+* Useful for local processing of messages dropped into a Maildir by an MTA
+* (e.g. postfix delivering DMARC reports). Maildir has no concept of
+* sending: `sendMessage()` throws `NotImplementedError`.
+*
+* The constructor does its filesystem checks synchronously, like
+* mailsuite's: uid checks (warn, don't crash, but throw `PrivilegeDropError`
+* if root can't drop to the Maildir's owner), the optional `cur`/`new`/`tmp`
+* creation, and opening the Maildir.
+*/
+var MaildirConnection = class extends MailboxConnection {
+	kind = "maildir";
+	maildirPath;
+	maildirCreate;
+	client;
+	activeFolder;
+	subfolderClient = /* @__PURE__ */ new Map();
+	constructor(maildirPath, options = {}) {
+		super();
+		this.maildirPath = maildirPath;
+		this.maildirCreate = options.maildirCreate ?? false;
+		const { getuid, setuid } = process;
+		if (getuid !== void 0 && setuid !== void 0) {
+			let maildirOwner = null;
+			let maildirGroup = 0;
+			try {
+				({uid: maildirOwner, gid: maildirGroup} = statSync(maildirPath));
+			} catch {
+				maildirOwner = null;
+			}
+			const currentUid = getuid();
+			if (maildirOwner !== null && currentUid !== maildirOwner) {
+				if (currentUid === 0) {
+					logger.warning(`Switching uid to ${maildirOwner} to access Maildir`);
+					dropPrivileges(maildirPath, maildirOwner, maildirGroup);
+				} else logger.warning(`Runtime uid ${currentUid} differs from maildir ${maildirPath} owner ${maildirOwner}. Access may fail if permissions are insufficient.`);
+			}
+		}
+		if (this.maildirCreate) for (const subdir of [
+			"cur",
+			"new",
+			"tmp"
+		]) mkdirSync(path.join(maildirPath, subdir), { recursive: true });
+		this.client = Maildir.openSync(maildirPath, this.maildirCreate);
+		this.activeFolder = this.client;
+	}
+	async getFolder(folderName) {
+		let folder = this.subfolderClient.get(folderName);
+		if (folder === void 0) {
+			folder = await this.client.addFolder(folderName);
+			this.subfolderClient.set(folderName, folder);
+		}
+		return folder;
+	}
+	folderPath(folderName) {
+		return path.join(this.maildirPath, `.${folderName}`);
+	}
+	async createFolder(folderName) {
+		await this.getFolder(folderName);
+	}
+	async renameFolder(oldName, newName) {
+		await this.ensureNoFolderConflict(newName);
+		await rename(this.folderPath(oldName), this.folderPath(newName));
+		this.subfolderClient.delete(oldName);
+		this.subfolderClient.delete(newName);
+	}
+	folderExists(folderName) {
+		return isDirectory(this.folderPath(folderName));
+	}
+	async deleteFolder(folderName) {
+		await this.client.removeFolder(folderName);
+		this.subfolderClient.delete(folderName);
+	}
+	async doMoveFolder(source, _targetParent, targetPath) {
+		await rename(this.folderPath(source), this.folderPath(targetPath));
+		this.subfolderClient.delete(source);
+		this.subfolderClient.delete(targetPath);
+	}
+	async fetchMessages(reportsFolder, _options) {
+		this.activeFolder = reportsFolder && reportsFolder !== "INBOX" ? await this.getFolder(reportsFolder) : this.client;
+		return this.activeFolder.keys();
+	}
+	/**
+	* The message's stored bytes decoded as UTF-8 (undecodable bytes
+	* replaced), like mailsuite 2.3.3 and its IMAP backend's raw fetch, or
+	* `""` for an unknown key. The file is not parsed or re-serialized, so a
+	* message Python's `email` package can parse but not generate (a `\x1c`
+	* in a nested header, deep multipart nesting) is returned as is.
+	*
+	* With `markRead` the file is renamed into `cur/` with the `S` flag (see
+	* `Maildir.markRead`). With `maxSize`, a larger file throws
+	* `EmailTooLargeError` without being read (not in mailsuite).
+	*/
+	async fetchMessage(messageId, options = {}) {
+		const key = String(messageId);
+		const maxSize = options.maxSize ?? 0;
+		if (maxSize > 0) {
+			const size = await this.activeFolder.size(key);
+			if (size !== null && size > maxSize) throw emailTooLargeError(size, maxSize);
+		}
+		const content = await this.activeFolder.getBytes(key);
+		if (content === null) return "";
+		const text = utf8Decoder.decode(content);
+		if (options.markRead) await this.activeFolder.markRead(key);
+		return text;
+	}
+	async deleteMessage(messageId) {
+		await this.activeFolder.remove(String(messageId));
+	}
+	/**
+	* Move the message's file into the same subdirectory (`new`/`cur`) of
+	* `folderName`, keeping its file name, flags and bytes, like mailsuite
+	* 2.3.3 (it no longer re-serializes the message). Maildir++ folders live
+	* under the same root, so this is a same-filesystem rename; a folder on
+	* another mount fails with `EXDEV`. Throws {@link ExternalClashError}
+	* rather than overwriting when the destination already holds a message
+	* with the same key (including a move into the active folder itself).
+	*/
+	async moveMessage(messageId, folderName) {
+		const key = String(messageId);
+		if (!await this.activeFolder.has(key)) return;
+		const destination = await this.getFolder(folderName);
+		if (await destination.has(key)) throw new ExternalClashError(`Folder ${folderName} already contains message ${key}`);
+		await this.activeFolder.moveTo(key, destination);
+	}
+	keepalive() {
+		return Promise.resolve();
+	}
+	async watch(options) {
+		const { checkCallback, checkTimeout, configReloading, signal } = options;
+		while (true) {
+			if (signal?.aborted || configReloading?.()) return;
+			try {
+				await checkCallback(this);
+			} catch (error) {
+				logger.warning(`Maildir init error. ${errorMessage(error)}`);
+			}
+			if (configReloading?.()) return;
+			try {
+				await setTimeout$1(checkTimeout * MILLISECONDS_PER_SECOND, void 0, { signal });
+			} catch {
+				return;
+			}
+		}
+	}
+	sendMessage(_options) {
+		return Promise.reject(new NotImplementedError("Maildir cannot send mail; use sendEmail from @tsdmarc/smtp"));
+	}
+};
+// src/utils/create-email.ts
+const NON_ASCII = /\P{ASCII}/u;
+const DAY_NAMES = [
+	"Sun",
+	"Mon",
+	"Tue",
+	"Wed",
+	"Thu",
+	"Fri",
+	"Sat"
+];
+const MONTH_NAMES = [
+	"Jan",
+	"Feb",
+	"Mar",
+	"Apr",
+	"May",
+	"Jun",
+	"Jul",
+	"Aug",
+	"Sep",
+	"Oct",
+	"Nov",
+	"Dec"
+];
+function pad2(value) {
+	return String(value).padStart(2, "0");
+}
+/** `email.utils.formatdate(localtime=True)`: RFC 2822 date in local time. */
+function formatDate(date = /* @__PURE__ */ new Date()) {
+	const offsetMinutes = -date.getTimezoneOffset();
+	const sign = offsetMinutes < 0 ? "-" : "+";
+	const absolute = Math.abs(offsetMinutes);
+	const offset = `${sign}${pad2(Math.floor(absolute / 60))}${pad2(absolute % 60)}`;
+	const day = DAY_NAMES[date.getDay()] ?? "";
+	const month = MONTH_NAMES[date.getMonth()] ?? "";
+	return `${day}, ${pad2(date.getDate())} ${month} ${date.getFullYear()} ${pad2(date.getHours())}:${pad2(date.getMinutes())}:${pad2(date.getSeconds())} ${offset}`;
+}
+/** `MIMEBase.__init__`: Content-Type (with `add_header` params) and MIME-Version. */
+function mimeBase(maintype, subtype, params) {
+	const message = new Message();
+	const parts = [`${maintype}/${subtype}`];
+	for (const [name, value] of params) parts.push(formatParam(name, value));
+	message.set("Content-Type", parts.join("; "));
+	message.set("MIME-Version", "1.0");
+	return message;
+}
+/** `MIMEText(text, subtype)`: us-ascii when it encodes, else utf-8 (base64). */
+function mimeText(text, subtype) {
+	const charset = NON_ASCII.test(text) ? "utf-8" : "us-ascii";
+	const message = mimeBase("text", subtype, [["charset", charset]]);
+	message.setPayload(text, charset);
+	return message;
+}
+/** `MIMEApplication(data, Name=filename)` with `encode_base64`. */
+function mimeApplication(data, filename) {
+	const message = mimeBase("application", "octet-stream", [["Name", filename]]);
+	message.setPayload(base64BodyEncode(data));
+	message.set("Content-Transfer-Encoding", "base64");
+	return message;
+}
+/**
+* Create an RFC 822 email message and return it as a string.
+*
+* Port of `mailsuite.utils.create_email`: a `multipart/mixed` message with
+* the plain and/or HTML body followed by one `application/octet-stream`
+* part per attachment.
+*/
+function createEmail(options) {
+	const message = mimeBase("multipart", "mixed", []);
+	message.payload = [];
+	message.set("From", options.messageFrom);
+	if (options.messageTo && options.messageTo.length > 0) message.set("To", options.messageTo.join(", "));
+	if (options.messageCc && options.messageCc.length > 0) message.set("Cc", options.messageCc.join(", "));
+	message.set("Date", formatDate());
+	if (options.subject) message.set("Subject", options.subject);
+	for (const [name, value] of Object.entries(options.messageHeaders ?? {})) message.set(name, value);
+	if (options.plainMessage !== null && options.plainMessage !== void 0) message.attach(mimeText(options.plainMessage, "plain"));
+	if (options.htmlMessage !== null && options.htmlMessage !== void 0) message.attach(mimeText(options.htmlMessage, "html"));
+	for (const [filename, payload] of options.attachments ?? []) {
+		const part = mimeApplication(payload, filename);
+		part.set("Content-Disposition", `attachment; filename="${filename}"`);
+		message.attach(part);
+	}
+	return message.asString();
+}
+export { AGGREGATE_CSV_FIELDS, BadEscape, BadResponse, BrokenProcessPool, CRITICAL, CalledProcessError, CaptureHandler, ContextFilter, CsvDictWriter, DEBUG, DEFAULT_DNS_MAX_RETRIES, DEFAULT_DNS_TIMEOUT, DEFAULT_JOB_TIMEOUT, DEFAULT_MAX_EMAIL_SIZE, DEFAULT_MAX_EXPANDED_EMAIL_SIZE, DEFAULT_MAX_FAILED_LOOKUPS_PER_REPORT, DEFAULT_MAX_HEADER_LINES, DEFAULT_MAX_LOOKUPS_PER_REPORT, DEFAULT_MAX_LOOKUP_TIME_PER_REPORT, DEFAULT_MAX_MIME_PARTS, DEFAULT_MAX_NORMALIZED_RECORDS, DEFAULT_MAX_SMTP_TLS_REPORT_SIZE, DEFAULT_MAX_WORKER_HEAP_MB, DEFAULT_MAX_XML_DEPTH, DEFAULT_MAX_XML_NODES, DEFAULT_NAMESERVERS, DEFAULT_PARSER_OPTIONS, DNSException, DNSFormError, DNSSocketError, DNSSyntaxError, DNSTimeout, DateParseError, DownloadError, EMAIL_SAMPLE_CONTENT_TYPES, ERROR, EmailParserError, EmailTooLargeError, EmptyLabel, EnrichmentError, ExpatError, ExpiringDict, ExternalClashError, FAILURE_CSV_FIELDS, FileHandler, FolderExistsError, FolderNotFoundError, GelfClient, GelfError, GelfTcpHandler, GelfTlsHandler, GelfUdpHandler, HECClient, Handler, IDNAException, INFO, IPDatabaseError, IP_ADDRESS_CACHE, InvalidAggregateReport, InvalidDMARCReport, InvalidFailureReport, InvalidForensicReport, InvalidIPinfoAPIKey, InvalidNameserverError, InvalidSMTPTLSReport, JobTimeoutError, LOG_USER, LOKI_DEFAULT_LABEL_FIELDS, LOKI_PUSH_PATH, LOKI_TIMESTAMP_MODES, LabelTooLong, LifetimeTimeout, Logger, LokiClient, LokiError, MAX_DECOMPRESSED_REPORT_SIZE, MAX_DECOMPRESSED_SLOW_CODEC_SIZE, MSGCONVERT_TIMEOUT_MS, MailboxConnection, MaildirConnection, MaildirKeyError, NOTSET, NXDOMAIN, NameTooLong, NoAnswer, NoMetaqueries, NoNameservers, NoSuchMailboxError, NormalizedRecordBudget, NotEmptyError, NotImplementedError, NullHandler, PARSEDMARC_COMPAT_VERSION, ParserError, PrivilegeDropError, PyDateTime, PyJsonNumber, RECOMMENDED_DNS_NAMESERVERS, REVERSE_DNS_MAP, RFC_7489_REMOVED_POLICY_OVERRIDE_TYPES, RFC_9990_NAMESPACE, RFC_9990_POLICY_OVERRIDE_TYPES, SEEN_AGGREGATE_REPORT_IDS, SMTP_TLS_CSV_FIELDS, SplunkError, StreamHandler, SysLogHandler, SyslogClient, SyslogError, TEXT_REPORT_REGEX, USER_AGENT, UnknownRdatatype, VERSION, PyValueError as ValueError, WARNING, WebhookClient, WorkerCrashedError, YXDOMAIN, aggregateReportKey, appendCsv, appendJson, appendParsedRecord, basicFormat, bucketIntervalByDay, camelToSnake, captureLogs, checkEmailLimits, configureIpinfoApi, configureLogging, consoleFormat, convertOutlookMsg, createEmail, createParserConfig, csvFormulaEscape, csvSafe, decodeBase64, decompressGzipBounded, emailTooLargeError, extractReport, extractReportFromFilePath, extractReportFromStream, fileFormat, findEnrichmentError, formatAsctime, formatDate, getBaseDomain, getDmarcReportsFromMailbox, getDmarcReportsFromMbox, getFilenameSafeString, getIpAddressCountry, getIpAddressDbRecord, getIpAddressInfo, getLevelName, getLogger, getReportZip, getReverseDns, getServiceFromReverseDnsBaseDomain, humanTimestampToDatetime, humanTimestampToUnixTimestamp, initWorker, ipInfoState, isMbox, isOutlookMsg, loadIpDb, loadPslOverrides, loadReverseDnsMap, logContextData, logger, maskNameserverSecrets, newIpAddressCache, newSeenAggregateReportIds, parallelMap, parseAggregateReportFile, parseAggregateReportFromFilePath, parseAggregateReportXml, parseDate, parseEmail, parseEmailAddress, parseEmailText, parseFailureReport, parseForensicReport, parseReportEmail, parseReportEmailJob, parseReportEmailTask, parseReportFile, parseReportFileJob, parseReportFileTask, parseReportRecord, parseSmtpTlsFailureDetails, parseSmtpTlsReportJson, parseSmtpTlsReportPolicy, parsedAggregateReportsToCsv, parsedAggregateReportsToCsvRows, parsedFailureReportsToCsv, parsedFailureReportsToCsvRows, parsedForensicReportsToCsv, parsedForensicReportsToCsvRows, parsedSmtpTlsReportsToCsv, parsedSmtpTlsReportsToCsvRows, parserConfigFromState, parserConfigToState, pslOverrides, pyFloatRepr, pyJsonDumps, pyRepr, pyStr, queryDns, rawJsonIntegers, redactUrlCredentials, replaceParserConfig, resolveParserConfig, reverseNameFromAddress, rowsToCsv, sanitizeForLog, saveOutput, snakeToCamel, stripComments, timestampToDatetime, timestampToHuman, toCamelCaseKeys, toSnakeCaseKeys, unwrapText, watchInbox };
+
+//# sourceMappingURL=index.js.map